Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1392612 > unrolled thread

[PATCH 4.4 000/163] 4.4.9-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.4 000/163] 4.4.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 122/163] scsi_dh: force modular build if SCSI is a module Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 138/163] ext4: fix NULL pointer dereference in ext4_mark_inode_dirty() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 053/163] powerpc: Update TM user feature bits in scan_features() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 100/163] workqueue: fix ghost PENDING flag while doing MQ IO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 048/163] crypto: sha1-mb - use corrcet pointer while completing jobs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 104/163] mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 054/163] nl80211: check netlink protocol in socket release notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 049/163] crypto: talitos - fix crash in talitos_cra_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 157/163] jme: Fix device PM wakeup API usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 126/163] misc: mic/scif: fix wrap around tests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 051/163] powerpc: scan_features() updates incorrect bits for REAL_LE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 099/163] x86/apic: Handle zero vector gracefully in clear_vector_irq() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 039/163] drm/qxl: fix cursor position with non-zero hotspot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 069/163] drm/radeon: fix initial connector audio value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 115/163] regulator: core: Fix nested locking of supplies Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 163/163] extcon: max77843: Use correct size for reading the interrupt register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 056/163] Input: gtco - fix crash on detecting device without endpoints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 091/163] ASoC: rt5640: Correct the digital interface data select Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 098/163] efi: Expose non-blocking set_variable() wrapper to efivars Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 052/163] powerpc: Update cpu_user_features2 in scan_features() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 140/163] mtd: spi-nor: remove micron_quad_enable() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 072/163] drm: Loongson-3 doesnt fully support wc memory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 007/163] ARM: mvebu: Correct unit address for linksys Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 139/163] serial: sh-sci: Remove cpufreq notifier to fix crash/deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 047/163] crypto: ccp - Prevent information leakage on export Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 102/163] cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 103/163] memcg: relocate charge moving from ->attach to ->post_attach Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 101/163] slub: clean up code for kmem cgroup support to kmem_cache_free_bulk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 105/163] numa: fix /proc/<pid>/numa_maps for THP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 106/163] mm: vmscan: reclaim highmem zone if buffer_heads is over limit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 161/163] megaraid_sas: add missing curly braces in ioctl handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 148/163] ext4: fix races between buffered IO and collapse / insert range Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 149/163] ext4: fix races of writeback with punch hole and zero range Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 092/163] [media] vb2-memops: Fix over allocation of frame vectors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 146/163] ext4: fix races between page faults and hole punching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 137/163] x86/mm/kmmio: Fix mmiotrace for hugepages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 153/163] ARM: dts: armada-375: use armada-370-sata for SATA Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 125/163] misc/bmp085: Enable building as a module Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 123/163] fbdev: da8xx-fb: fix videomodes of lcd panels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 147/163] ext4: move unlocked dio protection from ext4_alloc_file_blocks() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 154/163] ARM: dts: pxa: fix dma engine node to pxa3xx-nand Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 155/163] bus: imx-weim: Take the status property value into account Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 158/163] unbreak allmodconfig KCONFIG_ALLCONFIG=... Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 151/163] ARM: prima2: always enable reset controller Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 145/163] perf stat: Document --detailed option Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 156/163] jme: Do not enable NIC WoL functions on S0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 152/163] ARM: EXYNOS: select THERMAL_OF Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 032/163] ALSA: hda - add PCI ID for Intel Broxton-T Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:00 +0200
    [PATCH 4.4 143/163] perf hists browser: Only offer symbol scripting when a symbol is under the cursor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
    [PATCH 4.4 135/163] perf evlist: Reference count the cpu and thread maps at set_maps() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
    [PATCH 4.4 141/163] mtd: brcmnand: Fix v7.1 register offsets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
    [PATCH 4.4 111/163] [media] videobuf2-v4l2: Verify planes array in buffer dequeueing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 089/163] ASoC: ssm4567: Reset device before regcache_sync() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 046/163] iwlwifi: mvm: fix memory leak in paging Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 128/163] PM / Domains: Fix removal of a subdomain Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 127/163] PM / OPP: Initialize u_volt_min/max to a valid value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 044/163] s390/pci: add extra padding to function measurement block Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 090/163] ASoC: dapm: Make sure we have a card when displaying component widgets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 045/163] iwlwifi: pcie: lower the debug level for RSA semaphore access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 108/163] cgroup: make sure a parent css isnt freed before its children Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 109/163] USB: usbip: fix potential out-of-bounds write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 113/163] regulator: core: fix regulator_lock_supply regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 094/163] cxl: Keep IRQ mappings on context teardown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 116/163] locking/mcs: Fix mcs_spin_lock() ordering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 096/163] IB/security: Restrict use of the write() interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 087/163] EDAC: i7core, sb_edac: Dont return NOTIFY_BAD from mce_decoder callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 136/163] spi: rockchip: modify DMA max burst to 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 112/163] Revert "regulator: core: Fix nested locking of supplies" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 084/163] i2c: cpm: Fix build break due to incompatible pointer types Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 129/163] rtc: hym8563: fix invalid year calculation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 110/163] [media] videobuf2-core: Check user space planes array in dqbuf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 132/163] rtc: rx8025: remove rv8803 id Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 107/163] mm/hwpoison: fix wrong num_poisoned_pages accounting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 133/163] rtc: max77686: Properly handle regmap_irq_get_virq() error code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 118/163] irqchip/sunxi-nmi: Fix error check of of_io_request_and_map() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 134/163] drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 114/163] regulator: core: Ensure we lock all regulators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 124/163] lib/mpi: Endianness fix Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 119/163] irqchip/mxs: Fix error check of of_io_request_and_map() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 095/163] IB/mlx5: Expose correct max_sge_rd limit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 093/163] [media] v4l2-dv-timings.h: fix polarity for 4k formats Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 117/163] spi/rockchip: Make sure spi clk is on in rockchip_spi_set_cs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 120/163] regulator: s5m8767: fix get_register() error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 131/163] rtc: ds1685: passing bogus values to irq_restore Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 073/163] drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 075/163] drm/dp/mst: Restore primary hub guid on resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 076/163] drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 010/163] assoc_array: dont call compare_object() on a node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 085/163] i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 086/163] toshiba_acpi: Fix regression caused by hotkey enabling value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 006/163] ARM: dts: AM43x-epos: Fix clk parent for synctimer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 036/163] futex: Handle unlock_pi race gracefully Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 029/163] ALSA: hda - Dont trust the reported actual power state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 080/163] drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 071/163] drm/radeon: fix vertical bars appear on monitor (v2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 083/163] perf intel-pt: Fix segfault tracing transactions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 031/163] ALSA: hda - Keep powering up ADCs on Cirrus codecs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 081/163] drm/i915: Fixup the free space logic in ring_prepare Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 004/163] kvm: x86: do not leak guest xcr0 into host interrupt handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 030/163] ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 028/163] x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 026/163] arm64: Update PTE_RDONLY in set_pte_at() for PROT_NONE permission Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 027/163] x86/mm/xen: Suppress hugetlbfs in PV guests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 038/163] drm/nouveau/core: use vzalloc for allocating ramht Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 009/163] ARM: OMAP2+: hwmod: Fix updating of sysconfig register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 005/163] KVM: arm/arm64: Handle forward time correction gracefully Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 003/163] x86/mce: Avoid using object after free in genpool Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 015/163] usb: hcd: out of bounds access in for_each_companion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 024/163] sched/cgroup: Fix/cleanup cgroup teardown/init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 025/163] arm64: Honour !PTE_WRITE in set_pte_at() for kernel mappings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 037/163] futex: Acknowledge a new waiter in counter before plist Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 077/163] pwm: brcmstb: Fix check of devm_ioremap_resource() return code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 035/163] asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 043/163] cpufreq: intel_pstate: Fix processing for turbo activation ratio Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 017/163] dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 022/163] dmaengine: hsu: correct use of channel status register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 019/163] lib: lz4: fixed zram with lz4 on big endian machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 014/163] xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 011/163] usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 023/163] dmaengine: pxa_dma: fix the maximum requestor line Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 016/163] usb: gadget: f_fs: Fix use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 020/163] debugfs: Make automount point inodes permanently empty Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 018/163] dm cache metadata: fix cmd_read_lock() acquiring write lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 002/163] block: loop: fix filesystem corruption in case of aio/dio Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 012/163] xhci: resume USB 3 roothub first Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 021/163] dmaengine: dw: fix master selection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 013/163] usb: xhci: fix wild pointers in xhci_mem_cleanup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    Re: [PATCH 4.4 000/163] 4.4.9-stable review Guenter Roeck <linux@roeck-us.net> - 2016-05-03 09:30 +0200
      Re: [PATCH 4.4 000/163] 4.4.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 20:30 +0200
    Re: [PATCH 4.4 000/163] 4.4.9-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-05-03 17:10 +0200

Page 5 of 7 — ← Prev page 1 2 3 4 [5] 6 7  Next page →

#1392900 — [PATCH 4.4 095/163] IB/mlx5: Expose correct max_sge_rd limit

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sagi Grimberg <sagi@grimberg.me>

commit 986ef95ecdd3eb6fa29433e68faa94c7624083be upstream.

mlx5 devices (Connect-IB, ConnectX-4, ConnectX-4-LX) has a limitation
where rdma read work queue entries cannot exceed 512 bytes.
A rdma_read wqe needs to fit in 512 bytes:
- wqe control segment (16 bytes)
- rdma segment (16 bytes)
- scatter elements (16 bytes each)

So max_sge_rd should be: (512 - 16 - 16) / 16 = 30.

Reported-by: Christoph Hellwig <hch@lst.de>
Tested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sagi Grimberg <sagig@grimberg.me>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/hw/mlx5/main.c |    2 +-
 include/linux/mlx5/device.h       |   11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -273,7 +273,7 @@ static int mlx5_ib_query_device(struct i
 		     sizeof(struct mlx5_wqe_ctrl_seg)) /
 		     sizeof(struct mlx5_wqe_data_seg);
 	props->max_sge = min(max_rq_sg, max_sq_sg);
-	props->max_sge_rd = props->max_sge;
+	props->max_sge_rd	   = MLX5_MAX_SGE_RD;
 	props->max_cq		   = 1 << MLX5_CAP_GEN(mdev, log_max_cq);
 	props->max_cqe = (1 << MLX5_CAP_GEN(mdev, log_max_cq_sz)) - 1;
 	props->max_mr		   = 1 << MLX5_CAP_GEN(mdev, log_max_mkey);
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -334,6 +334,17 @@ enum {
 	MLX5_CAP_OFF_CMDIF_CSUM		= 46,
 };
 
+enum {
+	/*
+	 * Max wqe size for rdma read is 512 bytes, so this
+	 * limits our max_sge_rd as the wqe needs to fit:
+	 * - ctrl segment (16 bytes)
+	 * - rdma segment (16 bytes)
+	 * - scatter elements (16 bytes each)
+	 */
+	MLX5_MAX_SGE_RD	= (512 - 16 - 16) / 16
+};
+
 struct mlx5_inbox_hdr {
 	__be16		opcode;
 	u8		rsvd[4];

[toc] | [prev] | [next] | [standalone]

#1392901 — [PATCH 4.4 093/163] [media] v4l2-dv-timings.h: fix polarity for 4k formats

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans Verkuil <hverkuil@xs4all.nl>

commit 3020ca711871fdaf0c15c8bab677a6bc302e28fe upstream.

The VSync polarity was negative instead of positive for the 4k CEA formats.
I probably copy-and-pasted these from the DMT 4k format, which does have a
negative VSync polarity.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Martin Bugge <marbugge@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/uapi/linux/v4l2-dv-timings.h |   30 ++++++++++++++++++++----------
 1 file changed, 20 insertions(+), 10 deletions(-)

--- a/include/uapi/linux/v4l2-dv-timings.h
+++ b/include/uapi/linux/v4l2-dv-timings.h
@@ -183,7 +183,8 @@
 
 #define V4L2_DV_BT_CEA_3840X2160P24 { \
 	.type = V4L2_DV_BT_656_1120, \
-	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
+		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
 		297000000, 1276, 88, 296, 8, 10, 72, 0, 0, 0, \
 		V4L2_DV_BT_STD_CEA861, \
 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -191,14 +192,16 @@
 
 #define V4L2_DV_BT_CEA_3840X2160P25 { \
 	.type = V4L2_DV_BT_656_1120, \
-	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
+		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
 		297000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \
 		V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
 }
 
 #define V4L2_DV_BT_CEA_3840X2160P30 { \
 	.type = V4L2_DV_BT_656_1120, \
-	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
+		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
 		297000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \
 		V4L2_DV_BT_STD_CEA861, \
 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -206,14 +209,16 @@
 
 #define V4L2_DV_BT_CEA_3840X2160P50 { \
 	.type = V4L2_DV_BT_656_1120, \
-	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
+		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
 		594000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \
 		V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
 }
 
 #define V4L2_DV_BT_CEA_3840X2160P60 { \
 	.type = V4L2_DV_BT_656_1120, \
-	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
+		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
 		594000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \
 		V4L2_DV_BT_STD_CEA861, \
 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -221,7 +226,8 @@
 
 #define V4L2_DV_BT_CEA_4096X2160P24 { \
 	.type = V4L2_DV_BT_656_1120, \
-	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
+		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
 		297000000, 1020, 88, 296, 8, 10, 72, 0, 0, 0, \
 		V4L2_DV_BT_STD_CEA861, \
 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -229,14 +235,16 @@
 
 #define V4L2_DV_BT_CEA_4096X2160P25 { \
 	.type = V4L2_DV_BT_656_1120, \
-	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
+		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
 		297000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \
 		V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
 }
 
 #define V4L2_DV_BT_CEA_4096X2160P30 { \
 	.type = V4L2_DV_BT_656_1120, \
-	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
+		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
 		297000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \
 		V4L2_DV_BT_STD_CEA861, \
 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -244,14 +252,16 @@
 
 #define V4L2_DV_BT_CEA_4096X2160P50 { \
 	.type = V4L2_DV_BT_656_1120, \
-	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
+		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
 		594000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \
 		V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
 }
 
 #define V4L2_DV_BT_CEA_4096X2160P60 { \
 	.type = V4L2_DV_BT_656_1120, \
-	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
+		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
 		594000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \
 		V4L2_DV_BT_STD_CEA861, \
 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \

[toc] | [prev] | [next] | [standalone]

#1392902 — [PATCH 4.4 117/163] spi/rockchip: Make sure spi clk is on in rockchip_spi_set_cs

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Huibin Hong <huibin.hong@rock-chips.com>

commit b920cc3191d7612f26f36ee494e05b5ffd9044c0 upstream.

Rockchip_spi_set_cs could be called by spi_setup, but
spi_setup may be called by device driver after runtime suspend.
Then the spi clock is closed, rockchip_spi_set_cs may access the
spi registers, which causes cpu block in some socs.

Fixes: 64e36824b32 ("spi/rockchip: add driver for Rockchip RK3xxx")
Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-rockchip.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -265,7 +265,10 @@ static inline u32 rx_max(struct rockchip
 static void rockchip_spi_set_cs(struct spi_device *spi, bool enable)
 {
 	u32 ser;
-	struct rockchip_spi *rs = spi_master_get_devdata(spi->master);
+	struct spi_master *master = spi->master;
+	struct rockchip_spi *rs = spi_master_get_devdata(master);
+
+	pm_runtime_get_sync(rs->dev);
 
 	ser = readl_relaxed(rs->regs + ROCKCHIP_SPI_SER) & SER_MASK;
 
@@ -290,6 +293,8 @@ static void rockchip_spi_set_cs(struct s
 		ser &= ~(1 << spi->chip_select);
 
 	writel_relaxed(ser, rs->regs + ROCKCHIP_SPI_SER);
+
+	pm_runtime_put_sync(rs->dev);
 }
 
 static int rockchip_spi_prepare_message(struct spi_master *master,

[toc] | [prev] | [next] | [standalone]

#1392903 — [PATCH 4.4 120/163] regulator: s5m8767: fix get_register() error handling

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit e07ff9434167981c993a26d2edbbcb8e13801dbb upstream.

The s5m8767_pmic_probe() function calls s5m8767_get_register() to
read data without checking the return code, which produces a compile-time
warning when that data is accessed:

drivers/regulator/s5m8767.c: In function 's5m8767_pmic_probe':
drivers/regulator/s5m8767.c:924:7: error: 'enable_reg' may be used uninitialized in this function [-Werror=maybe-uninitialized]
drivers/regulator/s5m8767.c:944:30: error: 'enable_val' may be used uninitialized in this function [-Werror=maybe-uninitialized]

This changes the s5m8767_get_register() function to return a -EINVAL
not just for an invalid register number but also for an invalid
regulator number, as both would result in returning uninitialized
data. The s5m8767_pmic_probe() function is then changed accordingly
to fail on a read error, as all the other callers of s5m8767_get_register()
already do.

In practice this probably cannot happen, as we don't call
s5m8767_get_register() with invalid arguments, but the gcc
warning seems valid in principle, in terms writing safe
error checking.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 9c4c60554acf ("regulator: s5m8767: Convert to use regulator_[enable|disable|is_enabled]_regmap")
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/s5m8767.c |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -202,9 +202,10 @@ static int s5m8767_get_register(struct s
 		}
 	}
 
-	if (i < s5m8767->num_regulators)
-		*enable_ctrl =
-		s5m8767_opmode_reg[reg_id][mode] << S5M8767_ENCTRL_SHIFT;
+	if (i >= s5m8767->num_regulators)
+		return -EINVAL;
+
+	*enable_ctrl = s5m8767_opmode_reg[reg_id][mode] << S5M8767_ENCTRL_SHIFT;
 
 	return 0;
 }
@@ -937,8 +938,12 @@ static int s5m8767_pmic_probe(struct pla
 			else
 				regulators[id].vsel_mask = 0xff;
 
-			s5m8767_get_register(s5m8767, id, &enable_reg,
+			ret = s5m8767_get_register(s5m8767, id, &enable_reg,
 					     &enable_val);
+			if (ret) {
+				dev_err(s5m8767->dev, "error reading registers\n");
+				return ret;
+			}
 			regulators[id].enable_reg = enable_reg;
 			regulators[id].enable_mask = S5M8767_ENCTRL_MASK;
 			regulators[id].enable_val = enable_val;

[toc] | [prev] | [next] | [standalone]

#1392904 — [PATCH 4.4 131/163] rtc: ds1685: passing bogus values to irq_restore

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 8c09b9fdecab1f4a289f07b46e2ad174b6641928 upstream.

We call spin_lock_irqrestore with "flags" set to zero instead of to the
value from spin_lock_irqsave().

Fixes: aaaf5fbf56f1 ('rtc: add driver for DS1685 family of real time clocks')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/rtc/rtc-ds1685.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/rtc/rtc-ds1685.c
+++ b/drivers/rtc/rtc-ds1685.c
@@ -187,9 +187,9 @@ ds1685_rtc_end_data_access(struct ds1685
  * Only use this where you are certain another lock will not be held.
  */
 static inline void
-ds1685_rtc_begin_ctrl_access(struct ds1685_priv *rtc, unsigned long flags)
+ds1685_rtc_begin_ctrl_access(struct ds1685_priv *rtc, unsigned long *flags)
 {
-	spin_lock_irqsave(&rtc->lock, flags);
+	spin_lock_irqsave(&rtc->lock, *flags);
 	ds1685_rtc_switch_to_bank1(rtc);
 }
 
@@ -1304,7 +1304,7 @@ ds1685_rtc_sysfs_ctrl_regs_store(struct
 {
 	struct ds1685_priv *rtc = dev_get_drvdata(dev);
 	u8 reg = 0, bit = 0, tmp;
-	unsigned long flags = 0;
+	unsigned long flags;
 	long int val = 0;
 	const struct ds1685_rtc_ctrl_regs *reg_info =
 		ds1685_rtc_sysfs_ctrl_regs_lookup(attr->attr.name);
@@ -1325,7 +1325,7 @@ ds1685_rtc_sysfs_ctrl_regs_store(struct
 	bit = reg_info->bit;
 
 	/* Safe to spinlock during a write. */
-	ds1685_rtc_begin_ctrl_access(rtc, flags);
+	ds1685_rtc_begin_ctrl_access(rtc, &flags);
 	tmp = rtc->read(rtc, reg);
 	rtc->write(rtc, reg, (val ? (tmp | bit) : (tmp & ~(bit))));
 	ds1685_rtc_end_ctrl_access(rtc, flags);

[toc] | [prev] | [next] | [standalone]

#1392906 — [PATCH 4.4 073/163] drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <bskeggs@redhat.com>

commit 28dca90533750c7e31e8641c3df426bad9c12941 upstream.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
@@ -1717,6 +1717,8 @@ gf100_gr_init(struct gf100_gr *gr)
 
 	gf100_gr_mmio(gr, gr->func->mmio);
 
+	nvkm_mask(device, TPC_UNIT(0, 0, 0x05c), 0x00000001, 0x00000001);
+
 	memcpy(tpcnr, gr->tpc_nr, sizeof(gr->tpc_nr));
 	for (i = 0, gpc = -1; i < gr->tpc_total; i++) {
 		do {

[toc] | [prev] | [next] | [standalone]

#1392908 — [PATCH 4.4 075/163] drm/dp/mst: Restore primary hub guid on resume

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lyude <cpaul@redhat.com>

commit 9dc0487d96a0396367a1451b31873482080b527f upstream.

Some hubs are forgetful, and end up forgetting whatever GUID we set
previously after we do a suspend/resume cycle. This can lead to
hotplugging breaking (along with probably other things) since the hub
will start sending connection notifications with the wrong GUID. As
such, we need to check on resume whether or not the GUID the hub is
giving us is valid.

Signed-off-by: Lyude <cpaul@redhat.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1460580618-7421-1-git-send-email-cpaul@redhat.com
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_dp_mst_topology.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2116,6 +2116,8 @@ int drm_dp_mst_topology_mgr_resume(struc
 
 	if (mgr->mst_primary) {
 		int sret;
+		u8 guid[16];
+
 		sret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, mgr->dpcd, DP_RECEIVER_CAP_SIZE);
 		if (sret != DP_RECEIVER_CAP_SIZE) {
 			DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n");
@@ -2130,6 +2132,16 @@ int drm_dp_mst_topology_mgr_resume(struc
 			ret = -1;
 			goto out_unlock;
 		}
+
+		/* Some hubs forget their guids after they resume */
+		sret = drm_dp_dpcd_read(mgr->aux, DP_GUID, guid, 16);
+		if (sret != 16) {
+			DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n");
+			ret = -1;
+			goto out_unlock;
+		}
+		drm_dp_check_mstb_guid(mgr->mst_primary, guid);
+
 		ret = 0;
 	} else
 		ret = -1;

[toc] | [prev] | [next] | [standalone]

#1392910 — [PATCH 4.4 076/163] drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: cpaul@redhat.com <cpaul@redhat.com>

commit 263efde31f97c498e1ebad30e4d2906609d7ad6b upstream.

We can thank KASAN for finding this, otherwise I probably would have spent
hours on it. This fixes a somewhat harder to trigger kernel panic, occuring
while enabling MST where the port we were currently updating the payload on
would have all of it's refs dropped before we finished what we were doing:

==================================================================
BUG: KASAN: use-after-free in drm_dp_update_payload_part1+0xb3f/0xdb0 [drm_kms_helper] at addr ffff8800d29de018
Read of size 4 by task Xorg/973
=============================================================================
BUG kmalloc-2048 (Tainted: G    B   W      ): kasan: bad access detected
-----------------------------------------------------------------------------

INFO: Allocated in drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] age=16477 cpu=0 pid=2175
	___slab_alloc+0x472/0x490
	__slab_alloc+0x20/0x40
	kmem_cache_alloc_trace+0x151/0x190
	drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper]
	drm_dp_send_link_address+0x526/0x960 [drm_kms_helper]
	drm_dp_check_and_send_link_address+0x1ac/0x210 [drm_kms_helper]
	drm_dp_mst_link_probe_work+0x77/0xd0 [drm_kms_helper]
	process_one_work+0x562/0x1350
	worker_thread+0xd9/0x1390
	kthread+0x1c5/0x260
	ret_from_fork+0x22/0x40
INFO: Freed in drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] age=7521 cpu=0 pid=2175
	__slab_free+0x17f/0x2d0
	kfree+0x169/0x180
	drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper]
	drm_dp_destroy_connector_work+0x2b8/0x490 [drm_kms_helper]
	process_one_work+0x562/0x1350
	worker_thread+0xd9/0x1390
	kthread+0x1c5/0x260
	ret_from_fork+0x22/0x40

which on this T460s, would eventually lead to kernel panics in somewhat
random places later in intel_mst_enable_dp() if we got lucky enough.

Signed-off-by: Lyude <cpaul@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_dp_mst_topology.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1786,6 +1786,11 @@ int drm_dp_update_payload_part1(struct d
 		req_payload.start_slot = cur_slots;
 		if (mgr->proposed_vcpis[i]) {
 			port = container_of(mgr->proposed_vcpis[i], struct drm_dp_mst_port, vcpi);
+			port = drm_dp_get_validated_port_ref(mgr, port);
+			if (!port) {
+				mutex_unlock(&mgr->payload_lock);
+				return -EINVAL;
+			}
 			req_payload.num_slots = mgr->proposed_vcpis[i]->num_slots;
 		} else {
 			port = NULL;
@@ -1811,6 +1816,9 @@ int drm_dp_update_payload_part1(struct d
 			mgr->payloads[i].payload_state = req_payload.payload_state;
 		}
 		cur_slots += req_payload.num_slots;
+
+		if (port)
+			drm_dp_put_port(port);
 	}
 
 	for (i = 0; i < mgr->max_payloads; i++) {

[toc] | [prev] | [next] | [standalone]

#1392911 — [PATCH 4.4 010/163] assoc_array: dont call compare_object() on a node

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jerome Marchand <jmarchan@redhat.com>

commit 8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2 upstream.

Changes since V1: fixed the description and added KASan warning.

In assoc_array_insert_into_terminal_node(), we call the
compare_object() method on all non-empty slots, even when they're
not leaves, passing a pointer to an unexpected structure to
compare_object(). Currently it causes an out-of-bound read access
in keyring_compare_object detected by KASan (see below). The issue
is easily reproduced with keyutils testsuite.
Only call compare_object() when the slot is a leave.

KASan warning:
==================================================================
BUG: KASAN: slab-out-of-bounds in keyring_compare_object+0x213/0x240 at addr ffff880060a6f838
Read of size 8 by task keyctl/1655
=============================================================================
BUG kmalloc-192 (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------

Disabling lock debugging due to kernel taint
INFO: Allocated in assoc_array_insert+0xfd0/0x3a60 age=69 cpu=1 pid=1647
	___slab_alloc+0x563/0x5c0
	__slab_alloc+0x51/0x90
	kmem_cache_alloc_trace+0x263/0x300
	assoc_array_insert+0xfd0/0x3a60
	__key_link_begin+0xfc/0x270
	key_create_or_update+0x459/0xaf0
	SyS_add_key+0x1ba/0x350
	entry_SYSCALL_64_fastpath+0x12/0x76
INFO: Slab 0xffffea0001829b80 objects=16 used=8 fp=0xffff880060a6f550 flags=0x3fff8000004080
INFO: Object 0xffff880060a6f740 @offset=5952 fp=0xffff880060a6e5d1

Bytes b4 ffff880060a6f730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff880060a6f740: d1 e5 a6 60 00 88 ff ff 0e 00 00 00 00 00 00 00  ...`............
Object ffff880060a6f750: 02 cf 8e 60 00 88 ff ff 02 c0 8e 60 00 88 ff ff  ...`.......`....
Object ffff880060a6f760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff880060a6f770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff880060a6f790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff880060a6f7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff880060a6f7b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff880060a6f7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff880060a6f7d0: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff880060a6f7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff880060a6f7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
CPU: 0 PID: 1655 Comm: keyctl Tainted: G    B           4.5.0-rc4-kasan+ #291
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
 0000000000000000 000000001b2800b4 ffff880060a179e0 ffffffff81b60491
 ffff88006c802900 ffff880060a6f740 ffff880060a17a10 ffffffff815e2969
 ffff88006c802900 ffffea0001829b80 ffff880060a6f740 ffff880060a6e650
Call Trace:
 [<ffffffff81b60491>] dump_stack+0x85/0xc4
 [<ffffffff815e2969>] print_trailer+0xf9/0x150
 [<ffffffff815e9454>] object_err+0x34/0x40
 [<ffffffff815ebe50>] kasan_report_error+0x230/0x550
 [<ffffffff819949be>] ? keyring_get_key_chunk+0x13e/0x210
 [<ffffffff815ec62d>] __asan_report_load_n_noabort+0x5d/0x70
 [<ffffffff81994cc3>] ? keyring_compare_object+0x213/0x240
 [<ffffffff81994cc3>] keyring_compare_object+0x213/0x240
 [<ffffffff81bc238c>] assoc_array_insert+0x86c/0x3a60
 [<ffffffff81bc1b20>] ? assoc_array_cancel_edit+0x70/0x70
 [<ffffffff8199797d>] ? __key_link_begin+0x20d/0x270
 [<ffffffff8199786c>] __key_link_begin+0xfc/0x270
 [<ffffffff81993389>] key_create_or_update+0x459/0xaf0
 [<ffffffff8128ce0d>] ? trace_hardirqs_on+0xd/0x10
 [<ffffffff81992f30>] ? key_type_lookup+0xc0/0xc0
 [<ffffffff8199e19d>] ? lookup_user_key+0x13d/0xcd0
 [<ffffffff81534763>] ? memdup_user+0x53/0x80
 [<ffffffff819983ea>] SyS_add_key+0x1ba/0x350
 [<ffffffff81998230>] ? key_get_type_from_user.constprop.6+0xa0/0xa0
 [<ffffffff828bcf4e>] ? retint_user+0x18/0x23
 [<ffffffff8128cc7e>] ? trace_hardirqs_on_caller+0x3fe/0x580
 [<ffffffff81004017>] ? trace_hardirqs_on_thunk+0x17/0x19
 [<ffffffff828bc432>] entry_SYSCALL_64_fastpath+0x12/0x76
Memory state around the buggy address:
 ffff880060a6f700: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
 ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
>ffff880060a6f800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                        ^
 ffff880060a6f880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff880060a6f900: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00
==================================================================

Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 lib/assoc_array.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -524,7 +524,9 @@ static bool assoc_array_insert_into_term
 			free_slot = i;
 			continue;
 		}
-		if (ops->compare_object(assoc_array_ptr_to_leaf(ptr), index_key)) {
+		if (assoc_array_ptr_is_leaf(ptr) &&
+		    ops->compare_object(assoc_array_ptr_to_leaf(ptr),
+					index_key)) {
 			pr_devel("replace in slot %d\n", i);
 			edit->leaf_p = &node->slots[i];
 			edit->dead_leaf = node->slots[i];

[toc] | [prev] | [next] | [standalone]

#1392912 — [PATCH 4.4 085/163] i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Javier Martinez Canillas <javier@osg.samsung.com>

commit 10ff4c5239a137abfc896ec73ef3d15a0f86a16a upstream.

The exynos5 I2C controller driver always prepares and enables a clock
before using it and then disables unprepares it when the clock is not
used anymore.

But this can cause a possible ABBA deadlock in some scenarios since a
driver that uses regmap to access its I2C registers, will first grab
the regmap lock and then the I2C xfer function will grab the prepare
lock when preparing the I2C clock. But since the clock driver also
uses regmap for I2C accesses, preparing a clock will first grab the
prepare lock and then the regmap lock when using the regmap API.

An example of this happens on the Exynos5422 Odroid XU4 board where a
s2mps11 PMIC is used and both the s2mps11 regulators and clk drivers
share the same I2C regmap.

The possible deadlock is reported by the kernel lockdep:

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(sec_core:428:(regmap)->lock);
                                lock(prepare_lock);
                                lock(sec_core:428:(regmap)->lock);
   lock(prepare_lock);

  *** DEADLOCK ***

Fix it by leaving the code prepared on probe and use {en,dis}able in
the I2C transfer function.

This patch is similar to commit 34e81ad5f0b6 ("i2c: s3c2410: fix ABBA
deadlock by keeping clock prepared") that fixes the same bug in other
driver for an I2C controller found in Samsung SoCs.

Reported-by: Anand Moon <linux.amoon@gmail.com>
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Reviewed-by: Anand Moon <linux.amoon@gmail.com>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/i2c/busses/i2c-exynos5.c |   24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

--- a/drivers/i2c/busses/i2c-exynos5.c
+++ b/drivers/i2c/busses/i2c-exynos5.c
@@ -671,7 +671,9 @@ static int exynos5_i2c_xfer(struct i2c_a
 		return -EIO;
 	}
 
-	clk_prepare_enable(i2c->clk);
+	ret = clk_enable(i2c->clk);
+	if (ret)
+		return ret;
 
 	for (i = 0; i < num; i++, msgs++) {
 		stop = (i == num - 1);
@@ -695,7 +697,7 @@ static int exynos5_i2c_xfer(struct i2c_a
 	}
 
  out:
-	clk_disable_unprepare(i2c->clk);
+	clk_disable(i2c->clk);
 	return ret;
 }
 
@@ -747,7 +749,9 @@ static int exynos5_i2c_probe(struct plat
 		return -ENOENT;
 	}
 
-	clk_prepare_enable(i2c->clk);
+	ret = clk_prepare_enable(i2c->clk);
+	if (ret)
+		return ret;
 
 	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	i2c->regs = devm_ioremap_resource(&pdev->dev, mem);
@@ -799,6 +803,10 @@ static int exynos5_i2c_probe(struct plat
 
 	platform_set_drvdata(pdev, i2c);
 
+	clk_disable(i2c->clk);
+
+	return 0;
+
  err_clk:
 	clk_disable_unprepare(i2c->clk);
 	return ret;
@@ -810,6 +818,8 @@ static int exynos5_i2c_remove(struct pla
 
 	i2c_del_adapter(&i2c->adap);
 
+	clk_unprepare(i2c->clk);
+
 	return 0;
 }
 
@@ -821,6 +831,8 @@ static int exynos5_i2c_suspend_noirq(str
 
 	i2c->suspended = 1;
 
+	clk_unprepare(i2c->clk);
+
 	return 0;
 }
 
@@ -830,7 +842,9 @@ static int exynos5_i2c_resume_noirq(stru
 	struct exynos5_i2c *i2c = platform_get_drvdata(pdev);
 	int ret = 0;
 
-	clk_prepare_enable(i2c->clk);
+	ret = clk_prepare_enable(i2c->clk);
+	if (ret)
+		return ret;
 
 	ret = exynos5_hsi2c_clock_setup(i2c);
 	if (ret) {
@@ -839,7 +853,7 @@ static int exynos5_i2c_resume_noirq(stru
 	}
 
 	exynos5_i2c_init(i2c);
-	clk_disable_unprepare(i2c->clk);
+	clk_disable(i2c->clk);
 	i2c->suspended = 0;
 
 	return 0;

[toc] | [prev] | [next] | [standalone]

#1392913 — [PATCH 4.4 086/163] toshiba_acpi: Fix regression caused by hotkey enabling value

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Azael Avalos <coproscefalo@gmail.com>

commit a30b8f81d9d6fe24eab8a023794548b048f08e3c upstream.

Commit 52cbae0127ad ("toshiba_acpi: Change default Hotkey enabling value")
changed the hotkeys enabling value, as it was the same value Windows uses,
however, it turns out that the value tells the EC that the driver will now
take care of the hardware events like the physical RFKill switch or the
pointing device toggle button.

This patch reverts such commit by changing the default hotkey enabling
value to 0x09, which enables hotkey events only, making the hardware
buttons working again.

Fixes bugs 113331 and 114941.

Signed-off-by: Azael Avalos <coproscefalo@gmail.com>
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/platform/x86/toshiba_acpi.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -131,7 +131,7 @@ MODULE_LICENSE("GPL");
 /* Field definitions */
 #define HCI_ACCEL_MASK			0x7fff
 #define HCI_HOTKEY_DISABLE		0x0b
-#define HCI_HOTKEY_ENABLE		0x01
+#define HCI_HOTKEY_ENABLE		0x09
 #define HCI_HOTKEY_SPECIAL_FUNCTIONS	0x10
 #define HCI_LCD_BRIGHTNESS_BITS		3
 #define HCI_LCD_BRIGHTNESS_SHIFT	(16-HCI_LCD_BRIGHTNESS_BITS)

[toc] | [prev] | [next] | [standalone]

#1392914 — [PATCH 4.4 006/163] ARM: dts: AM43x-epos: Fix clk parent for synctimer

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lokesh Vutla <lokeshvutla@ti.com>

commit cfe1580a6415bc37fd62d79eb8102a618f7650b2 upstream.

commit 55ee7017ee31 ("arm: omap2: board-generic: use omap4_local_timer_init
for AM437x") makes synctimer32k as the clocksource on AM43xx. By default
the synctimer32k is clocked by 32K RTC OSC on AM43xx. But this 32K RTC OSC
is not available on epos boards which makes it fail to boot.

Synctimer32k can also be clocked by a peripheral PLL, so making this as
clock parent for synctimer3k on epos boards.

Fixes: 55ee7017ee31 ("arm: omap2: board-generic: use omap4_local_timer_init for AM437x")
Reported-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/am43x-epos-evm.dts |    5 +++++
 1 file changed, 5 insertions(+)

--- a/arch/arm/boot/dts/am43x-epos-evm.dts
+++ b/arch/arm/boot/dts/am43x-epos-evm.dts
@@ -792,3 +792,8 @@
 	tx-num-evt = <32>;
 	rx-num-evt = <32>;
 };
+
+&synctimer_32kclk {
+	assigned-clocks = <&mux_synctimer32k_ck>;
+	assigned-clock-parents = <&clkdiv32k_ick>;
+};

[toc] | [prev] | [next] | [standalone]

#1392915 — [PATCH 4.4 036/163] futex: Handle unlock_pi race gracefully

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

commit 89e9e66ba1b3bde9d8ea90566c2aee20697ad681 upstream.

If userspace calls UNLOCK_PI unconditionally without trying the TID -> 0
transition in user space first then the user space value might not have the
waiters bit set. This opens the following race:

CPU0	    	      	    CPU1
uval = get_user(futex)
			    lock(hb)
lock(hb)
			    futex |= FUTEX_WAITERS
			    ....
			    unlock(hb)

cmpxchg(futex, uval, newval)

So the cmpxchg fails and returns -EINVAL to user space, which is wrong because
the futex value is valid.

To handle this (yes, yet another) corner case gracefully, check for a flag
change and retry.

[ tglx: Massaged changelog and slightly reworked implementation ]

Fixes: ccf9e6a80d9e ("futex: Make unlock_pi more robust")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1460723739-5195-1-git-send-email-bigeasy@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/futex.c |   25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1244,10 +1244,20 @@ static int wake_futex_pi(u32 __user *uad
 	if (unlikely(should_fail_futex(true)))
 		ret = -EFAULT;
 
-	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
+	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) {
 		ret = -EFAULT;
-	else if (curval != uval)
-		ret = -EINVAL;
+	} else if (curval != uval) {
+		/*
+		 * If a unconditional UNLOCK_PI operation (user space did not
+		 * try the TID->0 transition) raced with a waiter setting the
+		 * FUTEX_WAITERS flag between get_user() and locking the hash
+		 * bucket lock, retry the operation.
+		 */
+		if ((FUTEX_TID_MASK & curval) == uval)
+			ret = -EAGAIN;
+		else
+			ret = -EINVAL;
+	}
 	if (ret) {
 		raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
 		return ret;
@@ -2538,6 +2548,15 @@ retry:
 		if (ret == -EFAULT)
 			goto pi_faulted;
 		/*
+		 * A unconditional UNLOCK_PI op raced against a waiter
+		 * setting the FUTEX_WAITERS bit. Try again.
+		 */
+		if (ret == -EAGAIN) {
+			spin_unlock(&hb->lock);
+			put_futex_key(&key);
+			goto retry;
+		}
+		/*
 		 * wake_futex_pi has detected invalid state. Tell user
 		 * space.
 		 */

[toc] | [prev] | [next] | [standalone]

#1392916 — [PATCH 4.4 029/163] ALSA: hda - Dont trust the reported actual power state

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 50fd4987c4f3c3ebf0ce94d932732011bbdc7c71 upstream.

We've got a regression report that the recording on Mac with a cirrus
codec doesn't work any longer.  This turned out to be the missing
power up to D0 by power_save_node enablement.

After analyzing the traces, we found out that the culprit is that the
codec advertises the "actual" power state of a few nodes to be D0
while the "target" power state is D3.  This inconsistency is usually
OK, as it implies the power transition.  But in the case of cirrus
codec, this seems to be stuck to D3 while it's not actually D0.

This patch addresses the issue by checking the power state difference
more strictly.  It sends the power-state change verb unless both the
target and the actual power states show the given value.

We may introduce yet another flag indicating the possible broken
hardware power state, but it's anyway safer to set the proper power
state even in a transition (at least it's harmless as long as the
target state is same).  So this simpler change was applied now.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/hda_generic.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -843,7 +843,7 @@ static hda_nid_t path_power_update(struc
 				   bool allow_powerdown)
 {
 	hda_nid_t nid, changed = 0;
-	int i, state;
+	int i, state, power;
 
 	for (i = 0; i < path->depth; i++) {
 		nid = path->path[i];
@@ -855,7 +855,9 @@ static hda_nid_t path_power_update(struc
 			state = AC_PWRST_D0;
 		else
 			state = AC_PWRST_D3;
-		if (!snd_hda_check_power_state(codec, nid, state)) {
+		power = snd_hda_codec_read(codec, nid, 0,
+					   AC_VERB_GET_POWER_STATE, 0);
+		if (power != (state | (state << 4))) {
 			snd_hda_codec_write(codec, nid, 0,
 					    AC_VERB_SET_POWER_STATE, state);
 			changed = nid;

[toc] | [prev] | [next] | [standalone]

#1392917 — [PATCH 4.4 080/163] drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 93fce954427effee89e44a976299b15dd75b4bbc upstream.

At the end of the function we expect "status" to be zero, but it's
either -EINVAL or uninitialized.

Fixes: 788bf83db301 ('drm/amdkfd: Add wave control operation to debugger')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c
@@ -513,7 +513,7 @@ static int dbgdev_wave_control_set_regis
 				union SQ_CMD_BITS *in_reg_sq_cmd,
 				union GRBM_GFX_INDEX_BITS *in_reg_gfx_index)
 {
-	int status;
+	int status = 0;
 	union SQ_CMD_BITS reg_sq_cmd;
 	union GRBM_GFX_INDEX_BITS reg_gfx_index;
 	struct HsaDbgWaveMsgAMDGen2 *pMsg;

[toc] | [prev] | [next] | [standalone]

#1392918 — [PATCH 4.4 071/163] drm/radeon: fix vertical bars appear on monitor (v2)

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vitaly Prosyak <vitaly.prosyak@amd.com>

commit 5d5b7803c49bbb01bdf4c6e95e8314d0515b9484 upstream.

When crtc/timing is disabled on boot the dig block
should be stopped in order ignore timing from crtc,
reset the steering fifo otherwise we get display
corruption or hung in dp sst mode.

v2: agd: fix coding style

Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/evergreen.c     |  154 ++++++++++++++++++++++++++++++++-
 drivers/gpu/drm/radeon/evergreen_reg.h |   46 +++++++++
 2 files changed, 199 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2608,10 +2608,152 @@ static void evergreen_agp_enable(struct
 	WREG32(VM_CONTEXT1_CNTL, 0);
 }
 
+static const unsigned ni_dig_offsets[] =
+{
+	NI_DIG0_REGISTER_OFFSET,
+	NI_DIG1_REGISTER_OFFSET,
+	NI_DIG2_REGISTER_OFFSET,
+	NI_DIG3_REGISTER_OFFSET,
+	NI_DIG4_REGISTER_OFFSET,
+	NI_DIG5_REGISTER_OFFSET
+};
+
+static const unsigned ni_tx_offsets[] =
+{
+	NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1,
+	NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1,
+	NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1,
+	NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1,
+	NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1,
+	NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1
+};
+
+static const unsigned evergreen_dp_offsets[] =
+{
+	EVERGREEN_DP0_REGISTER_OFFSET,
+	EVERGREEN_DP1_REGISTER_OFFSET,
+	EVERGREEN_DP2_REGISTER_OFFSET,
+	EVERGREEN_DP3_REGISTER_OFFSET,
+	EVERGREEN_DP4_REGISTER_OFFSET,
+	EVERGREEN_DP5_REGISTER_OFFSET
+};
+
+
+/*
+ * Assumption is that EVERGREEN_CRTC_MASTER_EN enable for requested crtc
+ * We go from crtc to connector and it is not relible  since it
+ * should be an opposite direction .If crtc is enable then
+ * find the dig_fe which selects this crtc and insure that it enable.
+ * if such dig_fe is found then find dig_be which selects found dig_be and
+ * insure that it enable and in DP_SST mode.
+ * if UNIPHY_PLL_CONTROL1.enable then we should disconnect timing
+ * from dp symbols clocks .
+ */
+static bool evergreen_is_dp_sst_stream_enabled(struct radeon_device *rdev,
+					       unsigned crtc_id, unsigned *ret_dig_fe)
+{
+	unsigned i;
+	unsigned dig_fe;
+	unsigned dig_be;
+	unsigned dig_en_be;
+	unsigned uniphy_pll;
+	unsigned digs_fe_selected;
+	unsigned dig_be_mode;
+	unsigned dig_fe_mask;
+	bool is_enabled = false;
+	bool found_crtc = false;
+
+	/* loop through all running dig_fe to find selected crtc */
+	for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) {
+		dig_fe = RREG32(NI_DIG_FE_CNTL + ni_dig_offsets[i]);
+		if (dig_fe & NI_DIG_FE_CNTL_SYMCLK_FE_ON &&
+		    crtc_id == NI_DIG_FE_CNTL_SOURCE_SELECT(dig_fe)) {
+			/* found running pipe */
+			found_crtc = true;
+			dig_fe_mask = 1 << i;
+			dig_fe = i;
+			break;
+		}
+	}
+
+	if (found_crtc) {
+		/* loop through all running dig_be to find selected dig_fe */
+		for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) {
+			dig_be = RREG32(NI_DIG_BE_CNTL + ni_dig_offsets[i]);
+			/* if dig_fe_selected by dig_be? */
+			digs_fe_selected = NI_DIG_BE_CNTL_FE_SOURCE_SELECT(dig_be);
+			dig_be_mode = NI_DIG_FE_CNTL_MODE(dig_be);
+			if (dig_fe_mask &  digs_fe_selected &&
+			    /* if dig_be in sst mode? */
+			    dig_be_mode == NI_DIG_BE_DPSST) {
+				dig_en_be = RREG32(NI_DIG_BE_EN_CNTL +
+						   ni_dig_offsets[i]);
+				uniphy_pll = RREG32(NI_DCIO_UNIPHY0_PLL_CONTROL1 +
+						    ni_tx_offsets[i]);
+				/* dig_be enable and tx is running */
+				if (dig_en_be & NI_DIG_BE_EN_CNTL_ENABLE &&
+				    dig_en_be & NI_DIG_BE_EN_CNTL_SYMBCLK_ON &&
+				    uniphy_pll & NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE) {
+					is_enabled = true;
+					*ret_dig_fe = dig_fe;
+					break;
+				}
+			}
+		}
+	}
+
+	return is_enabled;
+}
+
+/*
+ * Blank dig when in dp sst mode
+ * Dig ignores crtc timing
+ */
+static void evergreen_blank_dp_output(struct radeon_device *rdev,
+				      unsigned dig_fe)
+{
+	unsigned stream_ctrl;
+	unsigned fifo_ctrl;
+	unsigned counter = 0;
+
+	if (dig_fe >= ARRAY_SIZE(evergreen_dp_offsets)) {
+		DRM_ERROR("invalid dig_fe %d\n", dig_fe);
+		return;
+	}
+
+	stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
+			     evergreen_dp_offsets[dig_fe]);
+	if (!(stream_ctrl & EVERGREEN_DP_VID_STREAM_CNTL_ENABLE)) {
+		DRM_ERROR("dig %d , should be enable\n", dig_fe);
+		return;
+	}
+
+	stream_ctrl &=~EVERGREEN_DP_VID_STREAM_CNTL_ENABLE;
+	WREG32(EVERGREEN_DP_VID_STREAM_CNTL +
+	       evergreen_dp_offsets[dig_fe], stream_ctrl);
+
+	stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
+			     evergreen_dp_offsets[dig_fe]);
+	while (counter < 32 && stream_ctrl & EVERGREEN_DP_VID_STREAM_STATUS) {
+		msleep(1);
+		counter++;
+		stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
+				     evergreen_dp_offsets[dig_fe]);
+	}
+	if (counter >= 32 )
+		DRM_ERROR("counter exceeds %d\n", counter);
+
+	fifo_ctrl = RREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe]);
+	fifo_ctrl |= EVERGREEN_DP_STEER_FIFO_RESET;
+	WREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe], fifo_ctrl);
+
+}
+
 void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *save)
 {
 	u32 crtc_enabled, tmp, frame_count, blackout;
 	int i, j;
+	unsigned dig_fe;
 
 	if (!ASIC_IS_NODCE(rdev)) {
 		save->vga_render_control = RREG32(VGA_RENDER_CONTROL);
@@ -2651,7 +2793,17 @@ void evergreen_mc_stop(struct radeon_dev
 					break;
 				udelay(1);
 			}
-
+			/*we should disable dig if it drives dp sst*/
+			/*but we are in radeon_device_init and the topology is unknown*/
+			/*and it is available after radeon_modeset_init*/
+			/*the following method radeon_atom_encoder_dpms_dig*/
+			/*does the job if we initialize it properly*/
+			/*for now we do it this manually*/
+			/**/
+			if (ASIC_IS_DCE5(rdev) &&
+			    evergreen_is_dp_sst_stream_enabled(rdev, i ,&dig_fe))
+				evergreen_blank_dp_output(rdev, dig_fe);
+			/*we could remove 6 lines below*/
 			/* XXX this is a hack to avoid strange behavior with EFI on certain systems */
 			WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
 			tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
--- a/drivers/gpu/drm/radeon/evergreen_reg.h
+++ b/drivers/gpu/drm/radeon/evergreen_reg.h
@@ -250,8 +250,43 @@
 
 /* HDMI blocks at 0x7030, 0x7c30, 0x10830, 0x11430, 0x12030, 0x12c30 */
 #define EVERGREEN_HDMI_BASE				0x7030
+/*DIG block*/
+#define NI_DIG0_REGISTER_OFFSET                 (0x7000  - 0x7000)
+#define NI_DIG1_REGISTER_OFFSET                 (0x7C00  - 0x7000)
+#define NI_DIG2_REGISTER_OFFSET                 (0x10800 - 0x7000)
+#define NI_DIG3_REGISTER_OFFSET                 (0x11400 - 0x7000)
+#define NI_DIG4_REGISTER_OFFSET                 (0x12000 - 0x7000)
+#define NI_DIG5_REGISTER_OFFSET                 (0x12C00 - 0x7000)
+
+
+#define NI_DIG_FE_CNTL                               0x7000
+#       define NI_DIG_FE_CNTL_SOURCE_SELECT(x)        ((x) & 0x3)
+#       define NI_DIG_FE_CNTL_SYMCLK_FE_ON            (1<<24)
+
+
+#define NI_DIG_BE_CNTL                    0x7140
+#       define NI_DIG_BE_CNTL_FE_SOURCE_SELECT(x)     (((x) >> 8 ) & 0x3F)
+#       define NI_DIG_FE_CNTL_MODE(x)                 (((x) >> 16) & 0x7 )
+
+#define NI_DIG_BE_EN_CNTL                              0x7144
+#       define NI_DIG_BE_EN_CNTL_ENABLE               (1 << 0)
+#       define NI_DIG_BE_EN_CNTL_SYMBCLK_ON           (1 << 8)
+#       define NI_DIG_BE_DPSST 0
 
 /* Display Port block */
+#define EVERGREEN_DP0_REGISTER_OFFSET                 (0x730C  - 0x730C)
+#define EVERGREEN_DP1_REGISTER_OFFSET                 (0x7F0C  - 0x730C)
+#define EVERGREEN_DP2_REGISTER_OFFSET                 (0x10B0C - 0x730C)
+#define EVERGREEN_DP3_REGISTER_OFFSET                 (0x1170C - 0x730C)
+#define EVERGREEN_DP4_REGISTER_OFFSET                 (0x1230C - 0x730C)
+#define EVERGREEN_DP5_REGISTER_OFFSET                 (0x12F0C - 0x730C)
+
+
+#define EVERGREEN_DP_VID_STREAM_CNTL                    0x730C
+#       define EVERGREEN_DP_VID_STREAM_CNTL_ENABLE     (1 << 0)
+#       define EVERGREEN_DP_VID_STREAM_STATUS          (1 <<16)
+#define EVERGREEN_DP_STEER_FIFO                         0x7310
+#       define EVERGREEN_DP_STEER_FIFO_RESET           (1 << 0)
 #define EVERGREEN_DP_SEC_CNTL                           0x7280
 #       define EVERGREEN_DP_SEC_STREAM_ENABLE           (1 << 0)
 #       define EVERGREEN_DP_SEC_ASP_ENABLE              (1 << 4)
@@ -266,4 +301,15 @@
 #       define EVERGREEN_DP_SEC_N_BASE_MULTIPLE(x)      (((x) & 0xf) << 24)
 #       define EVERGREEN_DP_SEC_SS_EN                   (1 << 28)
 
+/*DCIO_UNIPHY block*/
+#define NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1            (0x6600  -0x6600)
+#define NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1            (0x6640  -0x6600)
+#define NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1            (0x6680 - 0x6600)
+#define NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1            (0x66C0 - 0x6600)
+#define NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1            (0x6700 - 0x6600)
+#define NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1            (0x6740 - 0x6600)
+
+#define NI_DCIO_UNIPHY0_PLL_CONTROL1                   0x6618
+#       define NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE     (1 << 0)
+
 #endif

[toc] | [prev] | [next] | [standalone]

#1392919 — [PATCH 4.4 083/163] perf intel-pt: Fix segfault tracing transactions

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Adrian Hunter <adrian.hunter@intel.com>

commit 1342e0b7a6c1a060c593037fbac9f4b717f1cb3b upstream.

Tracing a workload that uses transactions gave a seg fault as follows:

  perf record -e intel_pt// workload
  perf report
  Program received signal SIGSEGV, Segmentation fault.
  0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110)
  	at util/intel-pt.c:929
  929 ptq->last_branch_rb->nr = 0;
  (gdb) p ptq->last_branch_rb
  $1 = (struct branch_stack *) 0x0
  (gdb) up
  1148 intel_pt_reset_last_branch_rb(ptq);
  (gdb) l
  1143 if (ret)
  1144 pr_err("Intel Processor Trace: failed to deliver transaction event
  1145 ret);
  1146
  1147 if (pt->synth_opts.callchain)
  1148 intel_pt_reset_last_branch_rb(ptq);
  1149
  1150 return ret;
  1151 }
  1152
  (gdb) p pt->synth_opts.callchain
  $2 = true
  (gdb)
  (gdb) bt
   #0 0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110)
   #1 0x000000000054c1e0 in intel_pt_synth_transaction_sample (ptq=0x1a36110)
   #2 0x000000000054c5b2 in intel_pt_sample (ptq=0x1a36110)

Caused by checking the 'callchain' flag when it should have been the
'last_branch' flag.  Fix that.

Reported-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Fixes: f14445ee72c5 ("perf intel-pt: Support generating branch stack")
Link: http://lkml.kernel.org/r/1460977068-11566-1-git-send-email-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 tools/perf/util/intel-pt.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -1127,7 +1127,7 @@ static int intel_pt_synth_transaction_sa
 		pr_err("Intel Processor Trace: failed to deliver transaction event, error %d\n",
 		       ret);
 
-	if (pt->synth_opts.callchain)
+	if (pt->synth_opts.last_branch)
 		intel_pt_reset_last_branch_rb(ptq);
 
 	return ret;

[toc] | [prev] | [next] | [standalone]

#1392920 — [PATCH 4.4 031/163] ALSA: hda - Keep powering up ADCs on Cirrus codecs

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit de3df8a986b635082a1d94bae2c361d043c57106 upstream.

Although one weird behavior about the input path (inconsistent D0/D3
switch) on Cirrus CS420x codecs was fixed in the previous commit,
there is still an issue on some Mac machines: the capture stream
stalls when switching the ADCs on the fly.  More badly, this keeps
stuck until the next reboot.

The dynamic ADC switching is already a bit fragile and assuming
optimistically that the chip accepts the frequent power changes.  On
Cirrus codecs, this doesn't seem applicable.

As a quick workaround, we pin down the ADCs to keep up in D0 when
spec->dyn_adc_switch is set.  In this way, the ADCs are kept up only
for the system that were confirmed to be broken.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_cirrus.c |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -361,6 +361,7 @@ static int cs_parse_auto_config(struct h
 {
 	struct cs_spec *spec = codec->spec;
 	int err;
+	int i;
 
 	err = snd_hda_parse_pin_defcfg(codec, &spec->gen.autocfg, NULL, 0);
 	if (err < 0)
@@ -370,6 +371,19 @@ static int cs_parse_auto_config(struct h
 	if (err < 0)
 		return err;
 
+	/* keep the ADCs powered up when it's dynamically switchable */
+	if (spec->gen.dyn_adc_switch) {
+		unsigned int done = 0;
+		for (i = 0; i < spec->gen.input_mux.num_items; i++) {
+			int idx = spec->gen.dyn_adc_idx[i];
+			if (done & (1 << idx))
+				continue;
+			snd_hda_gen_fix_pin_power(codec,
+						  spec->gen.adc_nids[idx]);
+			done |= 1 << idx;
+		}
+	}
+
 	return 0;
 }
 

[toc] | [prev] | [next] | [standalone]

#1392921 — [PATCH 4.4 081/163] drm/i915: Fixup the free space logic in ring_prepare

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Akash Goel <akash.goel@intel.com>

commit d43f3ebf12f59c57782ec652da65ef61c2662b40 upstream.

Currently for the case where there is enough space at the end of Ring
buffer for accommodating only the base request, the wrapround is done
immediately and as a result the base request gets added at the start
of Ring buffer. But there may not be enough free space at the beginning
to accommodate the base request, as before the wraparound, the wait was
effectively done for the reserved_size free space from the start of
Ring buffer. In such a case there is a potential of Ring buffer overflow,
the instructions at the head of Ring (ACTHD) can get overwritten.

Since the base request can fit in the remaining space, there is no need
to wraparound immediately. The wraparound will anyway happen later when
the reserved part starts getting used.

Cc: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Akash Goel <akash.goel@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: http://patchwork.freedesktop.org/patch/msgid/1457688402-10411-1-git-send-email-akash.goel@intel.com
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
(cherry picked from commit 782f6bc0aba037436d6a04d19b23f8b61020a576)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/intel_lrc.c        |    6 +++---
 drivers/gpu/drm/i915/intel_ringbuffer.c |    6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -776,11 +776,11 @@ static int logical_ring_prepare(struct d
 		if (unlikely(total_bytes > remain_usable)) {
 			/*
 			 * The base request will fit but the reserved space
-			 * falls off the end. So only need to to wait for the
-			 * reserved size after flushing out the remainder.
+			 * falls off the end. So don't need an immediate wrap
+			 * and only need to effectively wait for the reserved
+			 * size space from the start of ringbuffer.
 			 */
 			wait_bytes = remain_actual + ringbuf->reserved_size;
-			need_wrap = true;
 		} else if (total_bytes > ringbuf->space) {
 			/* No wrapping required, just waiting. */
 			wait_bytes = total_bytes;
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -2357,11 +2357,11 @@ static int __intel_ring_prepare(struct i
 		if (unlikely(total_bytes > remain_usable)) {
 			/*
 			 * The base request will fit but the reserved space
-			 * falls off the end. So only need to to wait for the
-			 * reserved size after flushing out the remainder.
+			 * falls off the end. So don't need an immediate wrap
+			 * and only need to effectively wait for the reserved
+			 * size space from the start of ringbuffer.
 			 */
 			wait_bytes = remain_actual + ringbuf->reserved_size;
-			need_wrap = true;
 		} else if (total_bytes > ringbuf->space) {
 			/* No wrapping required, just waiting. */
 			wait_bytes = total_bytes;

[toc] | [prev] | [next] | [standalone]

#1392923 — [PATCH 4.4 004/163] kvm: x86: do not leak guest xcr0 into host interrupt handlers

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Matlack <dmatlack@google.com>

commit fc5b7f3bf1e1414bd4e91db6918c85ace0c873a5 upstream.

An interrupt handler that uses the fpu can kill a KVM VM, if it runs
under the following conditions:
 - the guest's xcr0 register is loaded on the cpu
 - the guest's fpu context is not loaded
 - the host is using eagerfpu

Note that the guest's xcr0 register and fpu context are not loaded as
part of the atomic world switch into "guest mode". They are loaded by
KVM while the cpu is still in "host mode".

Usage of the fpu in interrupt context is gated by irq_fpu_usable(). The
interrupt handler will look something like this:

if (irq_fpu_usable()) {
        kernel_fpu_begin();

        [... code that uses the fpu ...]

        kernel_fpu_end();
}

As long as the guest's fpu is not loaded and the host is using eager
fpu, irq_fpu_usable() returns true (interrupted_kernel_fpu_idle()
returns true). The interrupt handler proceeds to use the fpu with
the guest's xcr0 live.

kernel_fpu_begin() saves the current fpu context. If this uses
XSAVE[OPT], it may leave the xsave area in an undesirable state.
According to the SDM, during XSAVE bit i of XSTATE_BV is not modified
if bit i is 0 in xcr0. So it's possible that XSTATE_BV[i] == 1 and
xcr0[i] == 0 following an XSAVE.

kernel_fpu_end() restores the fpu context. Now if any bit i in
XSTATE_BV == 1 while xcr0[i] == 0, XRSTOR generates a #GP. The
fault is trapped and SIGSEGV is delivered to the current process.

Only pre-4.2 kernels appear to be vulnerable to this sequence of
events. Commit 653f52c ("kvm,x86: load guest FPU context more eagerly")
from 4.2 forces the guest's fpu to always be loaded on eagerfpu hosts.

This patch fixes the bug by keeping the host's xcr0 loaded outside
of the interrupts-disabled region where KVM switches into guest mode.

Suggested-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: David Matlack <dmatlack@google.com>
[Move load after goto cancel_injection. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/x86.c |   10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -697,7 +697,6 @@ static int __kvm_set_xcr(struct kvm_vcpu
 		if ((xcr0 & XFEATURE_MASK_AVX512) != XFEATURE_MASK_AVX512)
 			return 1;
 	}
-	kvm_put_guest_xcr0(vcpu);
 	vcpu->arch.xcr0 = xcr0;
 
 	if ((xcr0 ^ old_xcr0) & XFEATURE_MASK_EXTEND)
@@ -6495,8 +6494,6 @@ static int vcpu_enter_guest(struct kvm_v
 	kvm_x86_ops->prepare_guest_switch(vcpu);
 	if (vcpu->fpu_active)
 		kvm_load_guest_fpu(vcpu);
-	kvm_load_guest_xcr0(vcpu);
-
 	vcpu->mode = IN_GUEST_MODE;
 
 	srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
@@ -6519,6 +6516,8 @@ static int vcpu_enter_guest(struct kvm_v
 		goto cancel_injection;
 	}
 
+	kvm_load_guest_xcr0(vcpu);
+
 	if (req_immediate_exit)
 		smp_send_reschedule(vcpu->cpu);
 
@@ -6568,6 +6567,8 @@ static int vcpu_enter_guest(struct kvm_v
 	vcpu->mode = OUTSIDE_GUEST_MODE;
 	smp_wmb();
 
+	kvm_put_guest_xcr0(vcpu);
+
 	/* Interrupt is enabled by handle_external_intr() */
 	kvm_x86_ops->handle_external_intr(vcpu);
 
@@ -7215,7 +7216,6 @@ void kvm_load_guest_fpu(struct kvm_vcpu
 	 * and assume host would use all available bits.
 	 * Guest xcr0 would be loaded later.
 	 */
-	kvm_put_guest_xcr0(vcpu);
 	vcpu->guest_fpu_loaded = 1;
 	__kernel_fpu_begin();
 	__copy_kernel_to_fpregs(&vcpu->arch.guest_fpu.state);
@@ -7224,8 +7224,6 @@ void kvm_load_guest_fpu(struct kvm_vcpu
 
 void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
 {
-	kvm_put_guest_xcr0(vcpu);
-
 	if (!vcpu->guest_fpu_loaded) {
 		vcpu->fpu_counter = 0;
 		return;

[toc] | [prev] | [next] | [standalone]

Page 5 of 7 — ← Prev page 1 2 3 4 [5] 6 7  Next page →

Back to top | Article view | linux.kernel

csiph-web