Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1396708 > unrolled thread

[PATCH 4.4 00/67] 4.4.10-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.4 00/67] 4.4.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:30 +0200
    [PATCH 4.4 36/67] batman-adv: fix DAT candidate selection (must use vid) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:30 +0200
    [PATCH 4.4 67/67] drm/i915/skl: Fix DMC load on Skylake J0 and K0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:30 +0200
    [PATCH 4.4 30/67] xen/evtchn: fix ring resize when binding new events Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:30 +0200
    [PATCH 4.4 41/67] MAINTAINERS: Remove asterisk from EFI directory names Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:30 +0200
    [PATCH 4.4 26/67] ARM: EXYNOS: Properly skip unitialized parent clock in power domain on Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:30 +0200
    [PATCH 4.4 46/67] ARC: Add missing io barriers to io{read,write}{16,32}be() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:30 +0200
    [PATCH 4.4 05/67] ipvs: drop first packet to redirect conntrack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 09/67] mwifiex: fix corner case association failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 20/67] mac80211: fix statistics leak if dev_alloc_name() fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 22/67] MD: make bio mergeable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 44/67] propogate_mnt: Handle the first propogated copy being a slave Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 08/67] ata: ahci_xgene: dereferencing uninitialized pointer in probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 06/67] mfd: intel-lpss: Remove clock tree on error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 07/67] nbd: ratelimit error msgs after socket close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 23/67] Minimal fix-up of bad hashing behavior of hash_64() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 29/67] xen/balloon: Fix crash when ballooning on x86 32 bit PAE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 27/67] ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 25/67] mm/zswap: provide unique zpool name Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 42/67] x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 40/67] writeback: Fix performance regression in wb_over_bg_thresh() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 09:40 +0200
    [PATCH 4.4 12/67] soc: rockchip: power-domain: fix err handle while probing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 10:00 +0200
    [PATCH 4.4 17/67] clk: qcom: msm8960: Fix ce3_src register offset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 10:00 +0200
    [PATCH 4.4 15/67] clk: qcom: msm8960: fix ce3_core clk enable register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 10:00 +0200
    Re: [PATCH 4.4 00/67] 4.4.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-09 10:10 +0200
    Re: [PATCH 4.4 00/67] 4.4.10-stable review Guenter Roeck <linux@roeck-us.net> - 2016-05-09 15:20 +0200
    Re: [PATCH 4.4 00/67] 4.4.10-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-05-09 21:50 +0200

Page 1 of 2  [1] 2  Next page →

#1396708 — [PATCH 4.4 00/67] 4.4.10-stable review

This is the start of the stable review cycle for the 4.4.10 release.
There are 67 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed May 11 07:18:08 UTC 2016.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.10-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.4.10-rc1

Mat Martineau <mathew.j.martineau@linux.intel.com>
    drm/i915/skl: Fix DMC load on Skylake J0 and K0

Vitaly Kuznetsov <vkuznets@redhat.com>
    lib/test-string_helpers.c: fix and improve string_get_size() tests

Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
    ACPI / processor: Request native thermal interrupt handling via _OSC

Shashank Sharma <shashank.sharma@intel.com>
    drm/i915: Fake HDMI live status

Ville Syrjälä <ville.syrjala@linux.intel.com>
    drm/i915: Make RPS EI/thresholds multiple of 25 on SNB-BDW

Mika Kahola <mika.kahola@intel.com>
    drm/i915: Fix eDP low vswing for Broadwell

Imre Deak <imre.deak@intel.com>
    drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon: make sure vertical front porch is at least 1

Richard Leitner <dev@g0hl1n.net>
    iio: ak8975: fix maybe-uninitialized warning

Krzysztof Kozlowski <k.kozlowski@samsung.com>
    iio: ak8975: Fix NULL pointer exception on early interrupt

Dave Airlie <airlied@redhat.com>
    drm/amdgpu: set metadata pointer to NULL after freeing.

Alex Deucher <alexander.deucher@amd.com>
    drm/amdgpu: make sure vertical front porch is at least 1

Philipp Zabel <p.zabel@pengutronix.de>
    gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading

Stanislav Meduna <stano@meduna.org>
    nvmem: mxs-ocotp: fix buffer overflow in read

Jasem Mutlaq <mutlaqja@ikarustech.com>
    USB: serial: cp210x: add Straizona Focusers device ids

Mike Manning <michael@bsch.com.au>
    USB: serial: cp210x: add ID for Link ECU

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    ata: ahci-platform: Add ports-implemented DT bindings.

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    libahci: save port map for forced port map

Anton Blanchard <anton@samba.org>
    powerpc: Fix bad inline asm constraint in create_zero_mask()

Prarit Bhargava <prarit@redhat.com>
    ACPICA: Dispatcher: Update thread ID for recursive method calls

Wang YanQing <udknight@gmail.com>
    x86/sysfb_efi: Fix valid BAR address range check

Vineet Gupta <vgupta@synopsys.com>
    ARC: Add missing io barriers to io{read,write}{16,32}be()

James Morse <james.morse@arm.com>
    ARM: cpuidle: Pass on arm_cpuidle_suspend()'s return value

Eric W. Biederman <ebiederm@xmission.com>
    propogate_mnt: Handle the first propogated copy being a slave

Maxim Patlasov <mpatlasov@virtuozzo.com>
    fs/pnode.c: treat zero mnt_group_id-s as unequal

Chen Yu <yu.c.chen@intel.com>
    x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO

Matt Fleming <matt@codeblueprint.co.uk>
    MAINTAINERS: Remove asterisk from EFI directory names

Howard Cochran <hcochran@kernelspring.com>
    writeback: Fix performance regression in wb_over_bg_thresh()

Sven Eckelmann <sven@narfation.org>
    batman-adv: Reduce refcnt of removed router when updating route

Linus Lüssing <linus.luessing@c0d3.blue>
    batman-adv: Fix broadcast/ogm queue limit on a removed interface

Sven Eckelmann <sven@narfation.org>
    batman-adv: Check skb size before using encapsulated ETH+VLAN header

Antonio Quartulli <a@unstable.cc>
    batman-adv: fix DAT candidate selection (must use vid)

Jason Baron <jbaron@akamai.com>
    mm: update min_free_kbytes from khugepaged after core initialization

Mathias Krause <minipli@googlemail.com>
    proc: prevent accessing /proc/<PID>/environ until it's ready

Knut Wohlrab <Knut.Wohlrab@de.bosch.com>
    Input: zforce_ts - fix dual touch recognition

Nazar Mokrynskyi <nazar@mokrynskyi.com>
    HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirk

Ping Cheng <pinglinux@gmail.com>
    HID: wacom: Add support for DTK-1651

Jan Beulich <JBeulich@suse.com>
    xen/evtchn: fix ring resize when binding new events

Ross Lagerwall <ross.lagerwall@citrix.com>
    xen/balloon: Fix crash when ballooning on x86 32 bit PAE

Ross Lagerwall <ross.lagerwall@citrix.com>
    xen: Fix page <-> pfn conversion on 32 bit systems

Sascha Hauer <s.hauer@pengutronix.de>
    ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel

Krzysztof Kozlowski <k.kozlowski@samsung.com>
    ARM: EXYNOS: Properly skip unitialized parent clock in power domain on

Dan Streetman <ddstreet@ieee.org>
    mm/zswap: provide unique zpool name

Hugh Dickins <hughd@google.com>
    mm, cma: prevent nr_isolated_* counters from going negative

Linus Torvalds <torvalds@linux-foundation.org>
    Minimal fix-up of bad hashing behavior of hash_64()

Shaohua Li <shli@fb.com>
    MD: make bio mergeable

Chunyu Hu <chuhu@redhat.com>
    tracing: Don't display trigger file for events that can't be enabled

Johannes Berg <johannes.berg@intel.com>
    mac80211: fix statistics leak if dev_alloc_name() fails

Oleksij Rempel <linux@rempel-privat.de>
    ath9k: ar5008_hw_cmn_spur_mitigate: add missing mask_m & mask_p initialisation

Arnd Bergmann <arnd@arndb.de>
    lpfc: fix misleading indentation

Stephen Boyd <sboyd@codeaurora.org>
    clk: qcom: msm8960: Fix ce3_src register offset

Linus Walleij <linus.walleij@linaro.org>
    clk: versatile: sp810: support reentrance

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    clk: qcom: msm8960: fix ce3_core clk enable register

Andreas Färber <afaerber@suse.de>
    clk: meson: Fix meson_clk_register_clks() signature type mismatch

Shawn Lin <shawn.lin@rock-chips.com>
    clk: rockchip: free memory in error cases when registering clock branches

Shawn Lin <shawn.lin@rock-chips.com>
    soc: rockchip: power-domain: fix err handle while probing

Heiko Stuebner <heiko@sntech.de>
    clk-divider: make sure read-only dividers do not write to their register

Krzysztof Halasa <khalasa@piap.pl>
    CNS3xxx: Fix PCI cns3xxx_write_config()

Amitkumar Karwar <akarwar@marvell.com>
    mwifiex: fix corner case association failure

Dan Carpenter <dan.carpenter@oracle.com>
    ata: ahci_xgene: dereferencing uninitialized pointer in probe

Dan Streetman <dan.streetman@canonical.com>
    nbd: ratelimit error msgs after socket close

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    mfd: intel-lpss: Remove clock tree on error path

Julian Anastasov <ja@ssi.bg>
    ipvs: drop first packet to redirect conntrack

Marco Angaroni <marcoangaroni@gmail.com>
    ipvs: correct initial offset of Call-ID header search in SIP persistence engine

Arnd Bergmann <arnd@arndb.de>
    ipvs: handle ip_vs_fill_iph_skb_off failure

Hariprasad S <hariprasad@chelsio.com>
    RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Revert: "powerpc/tm: Check for already reclaimed tasks"


-------------

Diffstat:

 .../devicetree/bindings/ata/ahci-platform.txt      |  4 ++
 MAINTAINERS                                        |  4 +-
 Makefile                                           |  4 +-
 arch/arc/include/asm/io.h                          | 27 ++++++---
 arch/arm/mach-cns3xxx/pcie.c                       |  6 +-
 arch/arm/mach-exynos/pm_domains.c                  |  2 +-
 arch/arm/mach-socfpga/headsmp.S                    |  1 +
 arch/powerpc/include/asm/word-at-a-time.h          |  2 +-
 arch/powerpc/kernel/process.c                      | 18 ------
 arch/x86/kernel/cpu/mcheck/therm_throt.c           |  3 +
 arch/x86/kernel/sysfb_efi.c                        | 14 ++++-
 arch/x86/kernel/tsc_msr.c                          |  2 +-
 drivers/acpi/acpi_processor.c                      | 52 +++++++++++++++++
 drivers/acpi/acpica/dsmethod.c                     |  3 +
 drivers/acpi/bus.c                                 |  3 +
 drivers/acpi/internal.h                            |  6 ++
 drivers/ata/ahci_platform.c                        |  3 +
 drivers/ata/ahci_xgene.c                           |  4 +-
 drivers/ata/libahci.c                              |  1 +
 drivers/block/nbd.c                                |  4 +-
 drivers/clk/clk-divider.c                          | 11 +++-
 drivers/clk/meson/clkc.c                           |  2 +-
 drivers/clk/nxp/clk-lpc18xx-ccu.c                  |  2 +-
 drivers/clk/qcom/gcc-msm8960.c                     |  4 +-
 drivers/clk/rockchip/clk.c                         | 13 ++++-
 drivers/clk/versatile/clk-sp810.c                  |  4 +-
 drivers/cpuidle/cpuidle-arm.c                      |  2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |  1 +
 drivers/gpu/drm/amd/amdgpu/atombios_encoders.c     |  4 ++
 drivers/gpu/drm/i915/i915_reg.h                    |  9 ++-
 drivers/gpu/drm/i915/intel_csr.c                   |  3 +-
 drivers/gpu/drm/i915/intel_ddi.c                   | 22 ++++---
 drivers/gpu/drm/i915/intel_dp.c                    |  4 +-
 drivers/gpu/drm/i915/intel_drv.h                   |  2 +
 drivers/gpu/drm/i915/intel_hdmi.c                  | 12 +++-
 drivers/gpu/drm/radeon/atombios_encoders.c         |  4 ++
 drivers/gpu/ipu-v3/ipu-common.c                    |  7 ++-
 drivers/hid/hid-ids.h                              |  1 +
 drivers/hid/usbhid/hid-quirks.c                    |  1 +
 drivers/hid/wacom_wac.c                            |  5 ++
 drivers/iio/magnetometer/ak8975.c                  |  6 +-
 drivers/infiniband/hw/cxgb4/cq.c                   |  2 +-
 drivers/infiniband/hw/cxgb4/qp.c                   |  6 +-
 drivers/input/touchscreen/zforce_ts.c              |  4 +-
 drivers/md/md.c                                    |  2 +
 drivers/mfd/intel-lpss.c                           |  1 +
 drivers/net/wireless/ath/ath9k/ar5008_phy.c        |  8 +--
 drivers/net/wireless/ath/ath9k/ar9002_phy.c        |  5 --
 drivers/net/wireless/mwifiex/sta_ioctl.c           |  1 +
 drivers/nvmem/mxs-ocotp.c                          |  4 +-
 drivers/scsi/lpfc/lpfc_init.c                      |  5 +-
 drivers/soc/rockchip/pm_domains.c                  |  1 +
 drivers/usb/serial/cp210x.c                        |  4 ++
 drivers/xen/balloon.c                              | 16 ++++++
 drivers/xen/evtchn.c                               | 20 +++----
 fs/pnode.c                                         | 32 +++++++----
 fs/proc/base.c                                     |  3 +-
 include/linux/clk-provider.h                       |  1 +
 include/linux/hash.h                               | 20 ++++++-
 include/net/ip_vs.h                                | 17 ++++++
 include/xen/page.h                                 |  4 +-
 kernel/trace/trace_events.c                        |  9 ++-
 lib/test-string_helpers.c                          | 67 ++++++++++++++++------
 mm/compaction.c                                    | 10 +---
 mm/page-writeback.c                                |  6 +-
 mm/page_alloc.c                                    |  2 +-
 mm/zswap.c                                         |  8 ++-
 net/batman-adv/distributed-arp-table.c             | 17 +++---
 net/batman-adv/routing.c                           |  9 +++
 net/batman-adv/send.c                              |  6 ++
 net/batman-adv/soft-interface.c                    |  8 ++-
 net/mac80211/iface.c                               |  4 +-
 net/netfilter/ipvs/ip_vs_core.c                    | 37 +++++++++---
 net/netfilter/ipvs/ip_vs_pe_sip.c                  |  6 +-
 74 files changed, 452 insertions(+), 175 deletions(-)

[toc] | [next] | [standalone]

#1396709 — [PATCH 4.4 36/67] batman-adv: fix DAT candidate selection (must use vid)

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Antonio Quartulli <a@unstable.cc>

commit 2871734e85e920503d49b3a8bc0afbe0773b6036 upstream.

Now that DAT is VLAN aware, it must use the VID when
computing the DHT address of the candidate nodes where
an entry is going to be stored/retrieved.

Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware")
Signed-off-by: Antonio Quartulli <a@unstable.cc>
[sven@narfation.org: fix conflicts with current version]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/batman-adv/distributed-arp-table.c |   17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -553,6 +553,7 @@ static void batadv_choose_next_candidate
  * be sent to
  * @bat_priv: the bat priv with all the soft interface information
  * @ip_dst: ipv4 to look up in the DHT
+ * @vid: VLAN identifier
  *
  * An originator O is selected if and only if its DHT_ID value is one of three
  * closest values (from the LEFT, with wrap around if needed) then the hash
@@ -561,7 +562,8 @@ static void batadv_choose_next_candidate
  * Returns the candidate array of size BATADV_DAT_CANDIDATE_NUM.
  */
 static struct batadv_dat_candidate *
-batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst)
+batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst,
+			     unsigned short vid)
 {
 	int select;
 	batadv_dat_addr_t last_max = BATADV_DAT_ADDR_MAX, ip_key;
@@ -577,7 +579,7 @@ batadv_dat_select_candidates(struct bata
 		return NULL;
 
 	dat.ip = ip_dst;
-	dat.vid = 0;
+	dat.vid = vid;
 	ip_key = (batadv_dat_addr_t)batadv_hash_dat(&dat,
 						    BATADV_DAT_ADDR_MAX);
 
@@ -597,6 +599,7 @@ batadv_dat_select_candidates(struct bata
  * @bat_priv: the bat priv with all the soft interface information
  * @skb: payload to send
  * @ip: the DHT key
+ * @vid: VLAN identifier
  * @packet_subtype: unicast4addr packet subtype to use
  *
  * This function copies the skb with pskb_copy() and is sent as unicast packet
@@ -607,7 +610,7 @@ batadv_dat_select_candidates(struct bata
  */
 static bool batadv_dat_send_data(struct batadv_priv *bat_priv,
 				 struct sk_buff *skb, __be32 ip,
-				 int packet_subtype)
+				 unsigned short vid, int packet_subtype)
 {
 	int i;
 	bool ret = false;
@@ -616,7 +619,7 @@ static bool batadv_dat_send_data(struct
 	struct sk_buff *tmp_skb;
 	struct batadv_dat_candidate *cand;
 
-	cand = batadv_dat_select_candidates(bat_priv, ip);
+	cand = batadv_dat_select_candidates(bat_priv, ip, vid);
 	if (!cand)
 		goto out;
 
@@ -1004,7 +1007,7 @@ bool batadv_dat_snoop_outgoing_arp_reque
 		ret = true;
 	} else {
 		/* Send the request to the DHT */
-		ret = batadv_dat_send_data(bat_priv, skb, ip_dst,
+		ret = batadv_dat_send_data(bat_priv, skb, ip_dst, vid,
 					   BATADV_P_DAT_DHT_GET);
 	}
 out:
@@ -1132,8 +1135,8 @@ void batadv_dat_snoop_outgoing_arp_reply
 	/* Send the ARP reply to the candidates for both the IP addresses that
 	 * the node obtained from the ARP reply
 	 */
-	batadv_dat_send_data(bat_priv, skb, ip_src, BATADV_P_DAT_DHT_PUT);
-	batadv_dat_send_data(bat_priv, skb, ip_dst, BATADV_P_DAT_DHT_PUT);
+	batadv_dat_send_data(bat_priv, skb, ip_src, vid, BATADV_P_DAT_DHT_PUT);
+	batadv_dat_send_data(bat_priv, skb, ip_dst, vid, BATADV_P_DAT_DHT_PUT);
 }
 
 /**

[toc] | [prev] | [next] | [standalone]

#1396710 — [PATCH 4.4 67/67] drm/i915/skl: Fix DMC load on Skylake J0 and K0

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mat Martineau <mathew.j.martineau@linux.intel.com>

commit a41c8882592fb80458959b10e37632ce030b68ca upstream.

The driver does not load firmware for unknown steppings, so these new
steppings must be added to the list.

Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1454023163-25469-1-git-send-email-mathew.j.martineau@linux.intel.com
Cc: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/intel_csr.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -180,7 +180,8 @@ struct stepping_info {
 static const struct stepping_info skl_stepping_info[] = {
 		{'A', '0'}, {'B', '0'}, {'C', '0'},
 		{'D', '0'}, {'E', '0'}, {'F', '0'},
-		{'G', '0'}, {'H', '0'}, {'I', '0'}
+		{'G', '0'}, {'H', '0'}, {'I', '0'},
+		{'J', '0'}, {'K', '0'}
 };
 
 static struct stepping_info bxt_stepping_info[] = {

[toc] | [prev] | [next] | [standalone]

#1396711 — [PATCH 4.4 30/67] xen/evtchn: fix ring resize when binding new events

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Beulich <JBeulich@suse.com>

commit 27e0e6385377c4dc68a4ddaf1a35a2dfa951f3c5 upstream.

The copying of ring data was wrong for two cases: For a full ring
nothing got copied at all (as in that case the canonicalized producer
and consumer indexes are identical). And in case one or both of the
canonicalized (after the resize) indexes would point into the second
half of the buffer, the copied data ended up in the wrong (free) part
of the new buffer. In both cases uninitialized data would get passed
back to the caller.

Fix this by simply copying the old ring contents twice: Once to the
low half of the new buffer, and a second time to the high half.

This addresses the inability to boot a HVM guest with 64 or more
vCPUs.  This regression was caused by 8620015499101090 (xen/evtchn:
dynamically grow pending event channel ring).

Reported-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/evtchn.c |   20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -316,7 +316,6 @@ static int evtchn_resize_ring(struct per
 {
 	unsigned int new_size;
 	evtchn_port_t *new_ring, *old_ring;
-	unsigned int p, c;
 
 	/*
 	 * Ensure the ring is large enough to capture all possible
@@ -346,20 +345,17 @@ static int evtchn_resize_ring(struct per
 	/*
 	 * Copy the old ring contents to the new ring.
 	 *
-	 * If the ring contents crosses the end of the current ring,
-	 * it needs to be copied in two chunks.
+	 * To take care of wrapping, a full ring, and the new index
+	 * pointing into the second half, simply copy the old contents
+	 * twice.
 	 *
 	 * +---------+    +------------------+
-	 * |34567  12| -> |       1234567    |
-	 * +-----p-c-+    +------------------+
+	 * |34567  12| -> |34567  1234567  12|
+	 * +-----p-c-+    +-------c------p---+
 	 */
-	p = evtchn_ring_offset(u, u->ring_prod);
-	c = evtchn_ring_offset(u, u->ring_cons);
-	if (p < c) {
-		memcpy(new_ring + c, u->ring + c, (u->ring_size - c) * sizeof(*u->ring));
-		memcpy(new_ring + u->ring_size, u->ring, p * sizeof(*u->ring));
-	} else
-		memcpy(new_ring + c, u->ring + c, (p - c) * sizeof(*u->ring));
+	memcpy(new_ring, old_ring, u->ring_size * sizeof(*u->ring));
+	memcpy(new_ring + u->ring_size, old_ring,
+	       u->ring_size * sizeof(*u->ring));
 
 	u->ring = new_ring;
 	u->ring_size = new_size;

[toc] | [prev] | [next] | [standalone]

#1396712 — [PATCH 4.4 41/67] MAINTAINERS: Remove asterisk from EFI directory names

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matt Fleming <matt@codeblueprint.co.uk>

commit e8dfe6d8f6762d515fcd4f30577f7bfcf7659887 upstream.

Mark reported that having asterisks on the end of directory names
confuses get_maintainer.pl when it encounters subdirectories, and that
my name does not appear when run on drivers/firmware/efi/libstub.

Reported-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/1462303781-8686-2-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 MAINTAINERS |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4097,8 +4097,8 @@ F:	Documentation/efi-stub.txt
 F:	arch/ia64/kernel/efi.c
 F:	arch/x86/boot/compressed/eboot.[ch]
 F:	arch/x86/include/asm/efi.h
-F:	arch/x86/platform/efi/*
-F:	drivers/firmware/efi/*
+F:	arch/x86/platform/efi/
+F:	drivers/firmware/efi/
 F:	include/linux/efi*.h
 
 EFI VARIABLE FILESYSTEM

[toc] | [prev] | [next] | [standalone]

#1396713 — [PATCH 4.4 26/67] ARM: EXYNOS: Properly skip unitialized parent clock in power domain on

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <k.kozlowski@samsung.com>

commit a0a966b83873f33778710a4fc59240244b0734a5 upstream.

We want to skip reparenting a clock on turning on power domain, if we
do not have the parent yet. The parent is obtained when turning the
domain off. However due to a typo, the loop is continued on IS_ERR() of
clock being reparented, not on the IS_ERR() of the parent.

Theoretically this could lead to OOPS on first turn on of a power
domain, if there was no turn off before. Practically that should never
happen because all power domains are turned on by default (reset value,
bootloader does not turn off them usually) so the first action will be
always turn off.

Fixes: 29e5eea06bc1 ("ARM: EXYNOS: Get current parent clock for power domain on/off")
Reported-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/mach-exynos/pm_domains.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/mach-exynos/pm_domains.c
+++ b/arch/arm/mach-exynos/pm_domains.c
@@ -92,7 +92,7 @@ static int exynos_pd_power(struct generi
 			if (IS_ERR(pd->clk[i]))
 				break;
 
-			if (IS_ERR(pd->clk[i]))
+			if (IS_ERR(pd->pclk[i]))
 				continue; /* Skip on first power up */
 			if (clk_set_parent(pd->clk[i], pd->pclk[i]))
 				pr_err("%s: error setting parent to clock%d\n",

[toc] | [prev] | [next] | [standalone]

#1396714 — [PATCH 4.4 46/67] ARC: Add missing io barriers to io{read,write}{16,32}be()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vineet Gupta <vgupta@synopsys.com>

commit e5bc0478ab6cf565619224536d75ecb2aedca43b upstream.

While reviewing a different change to asm-generic/io.h Arnd spotted that
ARC ioread32 and ioread32be both of which come from asm-generic versions
are not symmetrical in terms of calling the io barriers.

generic ioread32   -> ARC readl()                  [ has barriers]
generic ioread32be -> __be32_to_cpu(__raw_readl()) [ lacks barriers]

While generic ioread32be is being remediated to call readl(), that involves
a swab32(), causing double swaps on ioread32be() on Big Endian systems.

So provide our versions of big endian IO accessors to ensure io barrier
calls while also keeping them optimal

Suggested-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arc/include/asm/io.h |   27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

--- a/arch/arc/include/asm/io.h
+++ b/arch/arc/include/asm/io.h
@@ -13,6 +13,15 @@
 #include <asm/byteorder.h>
 #include <asm/page.h>
 
+#ifdef CONFIG_ISA_ARCV2
+#include <asm/barrier.h>
+#define __iormb()		rmb()
+#define __iowmb()		wmb()
+#else
+#define __iormb()		do { } while (0)
+#define __iowmb()		do { } while (0)
+#endif
+
 extern void __iomem *ioremap(unsigned long physaddr, unsigned long size);
 extern void __iomem *ioremap_prot(phys_addr_t offset, unsigned long size,
 				  unsigned long flags);
@@ -22,6 +31,15 @@ extern void iounmap(const void __iomem *
 #define ioremap_wc(phy, sz)		ioremap(phy, sz)
 #define ioremap_wt(phy, sz)		ioremap(phy, sz)
 
+/*
+ * io{read,write}{16,32}be() macros
+ */
+#define ioread16be(p)		({ u16 __v = be16_to_cpu((__force __be16)__raw_readw(p)); __iormb(); __v; })
+#define ioread32be(p)		({ u32 __v = be32_to_cpu((__force __be32)__raw_readl(p)); __iormb(); __v; })
+
+#define iowrite16be(v,p)	({ __iowmb(); __raw_writew((__force u16)cpu_to_be16(v), p); })
+#define iowrite32be(v,p)	({ __iowmb(); __raw_writel((__force u32)cpu_to_be32(v), p); })
+
 /* Change struct page to physical address */
 #define page_to_phys(page)		(page_to_pfn(page) << PAGE_SHIFT)
 
@@ -99,15 +117,6 @@ static inline void __raw_writel(u32 w, v
 
 }
 
-#ifdef CONFIG_ISA_ARCV2
-#include <asm/barrier.h>
-#define __iormb()		rmb()
-#define __iowmb()		wmb()
-#else
-#define __iormb()		do { } while (0)
-#define __iowmb()		do { } while (0)
-#endif
-
 /*
  * MMIO can also get buffered/optimized in micro-arch, so barriers needed
  * Based on ARM model for the typical use case

[toc] | [prev] | [next] | [standalone]

#1396717 — [PATCH 4.4 05/67] ipvs: drop first packet to redirect conntrack

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Julian Anastasov <ja@ssi.bg>

commit f719e3754ee2f7275437e61a6afd520181fdd43b upstream.

Jiri Bohac is reporting for a problem where the attempt
to reschedule existing connection to another real server
needs proper redirect for the conntrack used by the IPVS
connection. For example, when IPVS connection is created
to NAT-ed real server we alter the reply direction of
conntrack. If we later decide to select different real
server we can not alter again the conntrack. And if we
expire the old connection, the new connection is left
without conntrack.

So, the only way to redirect both the IPVS connection and
the Netfilter's conntrack is to drop the SYN packet that
hits existing connection, to wait for the next jiffie
to expire the old connection and its conntrack and to rely
on client's retransmission to create new connection as
usually.

Jiri Bohac provided a fix that drops all SYNs on rescheduling,
I extended his patch to do such drops only for connections
that use conntrack. Here is the original report from Jiri Bohac:

Since commit dc7b3eb900aa ("ipvs: Fix reuse connection if real server
is dead"), new connections to dead servers are redistributed
immediately to new servers.  The old connection is expired using
ip_vs_conn_expire_now() which sets the connection timer to expire
immediately.

However, before the timer callback, ip_vs_conn_expire(), is run
to clean the connection's conntrack entry, the new redistributed
connection may already be established and its conntrack removed
instead.

Fix this by dropping the first packet of the new connection
instead, like we do when the destination server is not available.
The timer will have deleted the old conntrack entry long before
the first packet of the new connection is retransmitted.

Fixes: dc7b3eb900aa ("ipvs: Fix reuse connection if real server is dead")
Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/net/ip_vs.h             |   17 +++++++++++++++++
 net/netfilter/ipvs/ip_vs_core.c |   37 ++++++++++++++++++++++++++++---------
 2 files changed, 45 insertions(+), 9 deletions(-)

--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1588,6 +1588,23 @@ static inline void ip_vs_conn_drop_connt
 }
 #endif /* CONFIG_IP_VS_NFCT */
 
+/* Really using conntrack? */
+static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp,
+					     struct sk_buff *skb)
+{
+#ifdef CONFIG_IP_VS_NFCT
+	enum ip_conntrack_info ctinfo;
+	struct nf_conn *ct;
+
+	if (!(cp->flags & IP_VS_CONN_F_NFCT))
+		return false;
+	ct = nf_ct_get(skb, &ctinfo);
+	if (ct && !nf_ct_is_untracked(ct))
+		return true;
+#endif
+	return false;
+}
+
 static inline int
 ip_vs_dest_conn_overhead(struct ip_vs_dest *dest)
 {
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1757,15 +1757,34 @@ ip_vs_in(struct netns_ipvs *ipvs, unsign
 	cp = pp->conn_in_get(ipvs, af, skb, &iph);
 
 	conn_reuse_mode = sysctl_conn_reuse_mode(ipvs);
-	if (conn_reuse_mode && !iph.fragoffs &&
-	    is_new_conn(skb, &iph) && cp &&
-	    ((unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest &&
-	      unlikely(!atomic_read(&cp->dest->weight))) ||
-	     unlikely(is_new_conn_expected(cp, conn_reuse_mode)))) {
-		if (!atomic_read(&cp->n_control))
-			ip_vs_conn_expire_now(cp);
-		__ip_vs_conn_put(cp);
-		cp = NULL;
+	if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) {
+		bool uses_ct = false, resched = false;
+
+		if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest &&
+		    unlikely(!atomic_read(&cp->dest->weight))) {
+			resched = true;
+			uses_ct = ip_vs_conn_uses_conntrack(cp, skb);
+		} else if (is_new_conn_expected(cp, conn_reuse_mode)) {
+			uses_ct = ip_vs_conn_uses_conntrack(cp, skb);
+			if (!atomic_read(&cp->n_control)) {
+				resched = true;
+			} else {
+				/* Do not reschedule controlling connection
+				 * that uses conntrack while it is still
+				 * referenced by controlled connection(s).
+				 */
+				resched = !uses_ct;
+			}
+		}
+
+		if (resched) {
+			if (!atomic_read(&cp->n_control))
+				ip_vs_conn_expire_now(cp);
+			__ip_vs_conn_put(cp);
+			if (uses_ct)
+				return NF_DROP;
+			cp = NULL;
+		}
 	}
 
 	if (unlikely(!cp)) {

[toc] | [prev] | [next] | [standalone]

#1396718 — [PATCH 4.4 09/67] mwifiex: fix corner case association failure

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Amitkumar Karwar <akarwar@marvell.com>

commit a6139b6271f9f95377fe3486aed6120c9142779b upstream.

This patch corrects the error case in association path by returning
-1. Earlier "media_connected" used to remain on in this error case
causing failure for further association attempts.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Fixes: b887664d882ee4 ('mwifiex: channel switch handling for station')
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mwifiex/sta_ioctl.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -313,6 +313,7 @@ int mwifiex_bss_start(struct mwifiex_pri
 			mwifiex_dbg(adapter, ERROR,
 				    "Attempt to reconnect on csa closed chan(%d)\n",
 				    bss_desc->channel);
+			ret = -1;
 			goto done;
 		}
 

[toc] | [prev] | [next] | [standalone]

#1396720 — [PATCH 4.4 20/67] mac80211: fix statistics leak if dev_alloc_name() fails

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Berg <johannes.berg@intel.com>

commit e6436be21e77e3659b4ff7e357ab5a8342d132d2 upstream.

In the case that dev_alloc_name() fails, e.g. because the name was
given by the user and already exists, we need to clean up properly
and free the per-CPU statistics. Fix that.

Fixes: 5a490510ba5f ("mac80211: use per-CPU TX/RX statistics")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/iface.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1750,7 +1750,7 @@ int ieee80211_if_add(struct ieee80211_lo
 
 		ret = dev_alloc_name(ndev, ndev->name);
 		if (ret < 0) {
-			free_netdev(ndev);
+			ieee80211_if_free(ndev);
 			return ret;
 		}
 
@@ -1836,7 +1836,7 @@ int ieee80211_if_add(struct ieee80211_lo
 
 		ret = register_netdevice(ndev);
 		if (ret) {
-			free_netdev(ndev);
+			ieee80211_if_free(ndev);
 			return ret;
 		}
 	}

[toc] | [prev] | [next] | [standalone]

#1396721 — [PATCH 4.4 22/67] MD: make bio mergeable

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shaohua Li <shli@fb.com>

commit 9c573de3283af007ea11c17bde1e4568d9417328 upstream.

blk_queue_split marks bio unmergeable, which makes sense for normal bio.
But if dispatching the bio to underlayer disk, the blk_queue_split
checks are invalid, hence it's possible the bio becomes mergeable.

In the reported bug, this bug causes trim against raid0 performance slash
https://bugzilla.kernel.org/show_bug.cgi?id=117051

Reported-and-tested-by: Park Ju Hyung <qkrwngud825@gmail.com>
Fixes: 6ac45aeb6bca(block: avoid to merge splitted bio)
Cc: Ming Lei <ming.lei@canonical.com>
Cc: Neil Brown <neilb@suse.de>
Reviewed-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -293,6 +293,8 @@ static blk_qc_t md_make_request(struct r
 	 * go away inside make_request
 	 */
 	sectors = bio_sectors(bio);
+	/* bio could be mergeable after passing to underlayer */
+	bio->bi_rw &= ~REQ_NOMERGE;
 	mddev->pers->make_request(mddev, bio);
 
 	cpu = part_stat_lock();

[toc] | [prev] | [next] | [standalone]

#1396728 — [PATCH 4.4 44/67] propogate_mnt: Handle the first propogated copy being a slave

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric W. Biederman <ebiederm@xmission.com>

commit 5ec0811d30378ae104f250bfc9b3640242d81e3f upstream.

When the first propgated copy was a slave the following oops would result:
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
> IP: [<ffffffff811fba4e>] propagate_one+0xbe/0x1c0
> PGD bacd4067 PUD bac66067 PMD 0
> Oops: 0000 [#1] SMP
> Modules linked in:
> CPU: 1 PID: 824 Comm: mount Not tainted 4.6.0-rc5userns+ #1523
> Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
> task: ffff8800bb0a8000 ti: ffff8800bac3c000 task.ti: ffff8800bac3c000
> RIP: 0010:[<ffffffff811fba4e>]  [<ffffffff811fba4e>] propagate_one+0xbe/0x1c0
> RSP: 0018:ffff8800bac3fd38  EFLAGS: 00010283
> RAX: 0000000000000000 RBX: ffff8800bb77ec00 RCX: 0000000000000010
> RDX: 0000000000000000 RSI: ffff8800bb58c000 RDI: ffff8800bb58c480
> RBP: ffff8800bac3fd48 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000001ca1 R11: 0000000000001c9d R12: 0000000000000000
> R13: ffff8800ba713800 R14: ffff8800bac3fda0 R15: ffff8800bb77ec00
> FS:  00007f3c0cd9b7e0(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000010 CR3: 00000000bb79d000 CR4: 00000000000006e0
> Stack:
>  ffff8800bb77ec00 0000000000000000 ffff8800bac3fd88 ffffffff811fbf85
>  ffff8800bac3fd98 ffff8800bb77f080 ffff8800ba713800 ffff8800bb262b40
>  0000000000000000 0000000000000000 ffff8800bac3fdd8 ffffffff811f1da0
> Call Trace:
>  [<ffffffff811fbf85>] propagate_mnt+0x105/0x140
>  [<ffffffff811f1da0>] attach_recursive_mnt+0x120/0x1e0
>  [<ffffffff811f1ec3>] graft_tree+0x63/0x70
>  [<ffffffff811f1f6b>] do_add_mount+0x9b/0x100
>  [<ffffffff811f2c1a>] do_mount+0x2aa/0xdf0
>  [<ffffffff8117efbe>] ? strndup_user+0x4e/0x70
>  [<ffffffff811f3a45>] SyS_mount+0x75/0xc0
>  [<ffffffff8100242b>] do_syscall_64+0x4b/0xa0
>  [<ffffffff81988f3c>] entry_SYSCALL64_slow_path+0x25/0x25
> Code: 00 00 75 ec 48 89 0d 02 22 22 01 8b 89 10 01 00 00 48 89 05 fd 21 22 01 39 8e 10 01 00 00 0f 84 e0 00 00 00 48 8b 80 d8 00 00 00 <48> 8b 50 10 48 89 05 df 21 22 01 48 89 15 d0 21 22 01 8b 53 30
> RIP  [<ffffffff811fba4e>] propagate_one+0xbe/0x1c0
>  RSP <ffff8800bac3fd38>
> CR2: 0000000000000010
> ---[ end trace 2725ecd95164f217 ]---

This oops happens with the namespace_sem held and can be triggered by
non-root users.  An all around not pleasant experience.

To avoid this scenario when finding the appropriate source mount to
copy stop the walk up the mnt_master chain when the first source mount
is encountered.

Further rewrite the walk up the last_source mnt_master chain so that
it is clear what is going on.

The reason why the first source mount is special is that it it's
mnt_parent is not a mount in the dest_mnt propagation tree, and as
such termination conditions based up on the dest_mnt mount propgation
tree do not make sense.

To avoid other kinds of confusion last_dest is not changed when
computing last_source.  last_dest is only used once in propagate_one
and that is above the point of the code being modified, so changing
the global variable is meaningless and confusing.

fixes: f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 ("smarter propagate_mnt()")
Reported-by: Tycho Andersen <tycho.andersen@canonical.com>
Reviewed-by: Seth Forshee <seth.forshee@canonical.com>
Tested-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/pnode.c |   25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -198,7 +198,7 @@ static struct mount *next_group(struct m
 
 /* all accesses are serialized by namespace_sem */
 static struct user_namespace *user_ns;
-static struct mount *last_dest, *last_source, *dest_master;
+static struct mount *last_dest, *first_source, *last_source, *dest_master;
 static struct mountpoint *mp;
 static struct hlist_head *list;
 
@@ -221,20 +221,22 @@ static int propagate_one(struct mount *m
 		type = CL_MAKE_SHARED;
 	} else {
 		struct mount *n, *p;
+		bool done;
 		for (n = m; ; n = p) {
 			p = n->mnt_master;
-			if (p == dest_master || IS_MNT_MARKED(p)) {
-				while (last_dest->mnt_master != p) {
-					last_source = last_source->mnt_master;
-					last_dest = last_source->mnt_parent;
-				}
-				if (!peers(n, last_dest)) {
-					last_source = last_source->mnt_master;
-					last_dest = last_source->mnt_parent;
-				}
+			if (p == dest_master || IS_MNT_MARKED(p))
 				break;
-			}
 		}
+		do {
+			struct mount *parent = last_source->mnt_parent;
+			if (last_source == first_source)
+				break;
+			done = parent->mnt_master == p;
+			if (done && peers(n, parent))
+				break;
+			last_source = last_source->mnt_master;
+		} while (!done);
+
 		type = CL_SLAVE;
 		/* beginning of peer group among the slaves? */
 		if (IS_MNT_SHARED(m))
@@ -286,6 +288,7 @@ int propagate_mnt(struct mount *dest_mnt
 	 */
 	user_ns = current->nsproxy->mnt_ns->user_ns;
 	last_dest = dest_mnt;
+	first_source = source_mnt;
 	last_source = source_mnt;
 	mp = dest_mp;
 	list = tree_list;

[toc] | [prev] | [next] | [standalone]

#1396734 — [PATCH 4.4 08/67] ata: ahci_xgene: dereferencing uninitialized pointer in probe

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 8134233e8d346aaa1c929dc510e75482ae318bce upstream.

If the call to acpi_get_object_info() fails then "info" hasn't been
initialized.  In that situation, we already know that "version" should
be XGENE_AHCI_V1 so we don't actually need to dereference "info".

Fixes: c9802a4be661 ('ata: ahci_xgene: Add AHCI Support for 2nd HW version of APM X-Gene SoC AHCI SATA Host controller.')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/ahci_xgene.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/ata/ahci_xgene.c
+++ b/drivers/ata/ahci_xgene.c
@@ -739,9 +739,9 @@ static int xgene_ahci_probe(struct platf
 				dev_warn(&pdev->dev, "%s: Error reading device info. Assume version1\n",
 					__func__);
 				version = XGENE_AHCI_V1;
-			}
-			if (info->valid & ACPI_VALID_CID)
+			} else if (info->valid & ACPI_VALID_CID) {
 				version = XGENE_AHCI_V2;
+			}
 		}
 	}
 #endif

[toc] | [prev] | [next] | [standalone]

#1396740 — [PATCH 4.4 06/67] mfd: intel-lpss: Remove clock tree on error path

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit 84cb36cac581c915ef4e8b70abb73e084325df92 upstream.

We forgot to remove the clock tree if something goes wrong in ->probe(). Add a
call to intel_lpss_unregister_clock() on error path in ->probe() to fix the
potential issue.

Fixes: 4b45efe85263 (mfd: Add support for Intel Sunrisepoint LPSS devices)
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mfd/intel-lpss.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/mfd/intel-lpss.c
+++ b/drivers/mfd/intel-lpss.c
@@ -445,6 +445,7 @@ int intel_lpss_probe(struct device *dev,
 err_remove_ltr:
 	intel_lpss_debugfs_remove(lpss);
 	intel_lpss_ltr_hide(lpss);
+	intel_lpss_unregister_clock(lpss);
 
 err_clk_register:
 	ida_simple_remove(&intel_lpss_devid_ida, lpss->devid);

[toc] | [prev] | [next] | [standalone]

#1396742 — [PATCH 4.4 07/67] nbd: ratelimit error msgs after socket close

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Streetman <dan.streetman@canonical.com>

commit da6ccaaa79caca4f38b540b651238f87215217a2 upstream.

Make the "Attempted send on closed socket" error messages generated in
nbd_request_handler() ratelimited.

When the nbd socket is shutdown, the nbd_request_handler() function emits
an error message for every request remaining in its queue.  If the queue
is large, this will spam a large amount of messages to the log.  There's
no need for a separate error message for each request, so this patch
ratelimits it.

In the specific case this was found, the system was virtual and the error
messages were logged to the serial port, which overwhelmed it.

Fixes: 4d48a542b427 ("nbd: fix I/O hang on disconnected nbds")
Signed-off-by: Dan Streetman <dan.streetman@canonical.com>
Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/nbd.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -618,8 +618,8 @@ static void nbd_request_handler(struct r
 			req, req->cmd_type);
 
 		if (unlikely(!nbd->sock)) {
-			dev_err(disk_to_dev(nbd->disk),
-				"Attempted send on closed socket\n");
+			dev_err_ratelimited(disk_to_dev(nbd->disk),
+					    "Attempted send on closed socket\n");
 			req->errors++;
 			nbd_end_request(nbd, req);
 			spin_lock_irq(q->queue_lock);

[toc] | [prev] | [next] | [standalone]

#1396744 — [PATCH 4.4 23/67] Minimal fix-up of bad hashing behavior of hash_64()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Linus Torvalds <torvalds@linux-foundation.org>

commit 689de1d6ca95b3b5bd8ee446863bf81a4883ea25 upstream.

This is a fairly minimal fixup to the horribly bad behavior of hash_64()
with certain input patterns.

In particular, because the multiplicative value used for the 64-bit hash
was intentionally bit-sparse (so that the multiply could be done with
shifts and adds on architectures without hardware multipliers), some
bits did not get spread out very much.  In particular, certain fairly
common bit ranges in the input (roughly bits 12-20: commonly with the
most information in them when you hash things like byte offsets in files
or memory that have block factors that mean that the low bits are often
zero) would not necessarily show up much in the result.

There's a bigger patch-series brewing to fix up things more completely,
but this is the fairly minimal fix for the 64-bit hashing problem.  It
simply picks a much better constant multiplier, spreading the bits out a
lot better.

NOTE! For 32-bit architectures, the bad old hash_64() remains the same
for now, since 64-bit multiplies are expensive.  The bigger hashing
cleanup will replace the 32-bit case with something better.

The new constants were picked by George Spelvin who wrote that bigger
cleanup series.  I just picked out the constants and part of the comment
from that series.

Cc: George Spelvin <linux@horizon.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/hash.h |   20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

--- a/include/linux/hash.h
+++ b/include/linux/hash.h
@@ -32,12 +32,28 @@
 #error Wordsize not 32 or 64
 #endif
 
+/*
+ * The above primes are actively bad for hashing, since they are
+ * too sparse. The 32-bit one is mostly ok, the 64-bit one causes
+ * real problems. Besides, the "prime" part is pointless for the
+ * multiplicative hash.
+ *
+ * Although a random odd number will do, it turns out that the golden
+ * ratio phi = (sqrt(5)-1)/2, or its negative, has particularly nice
+ * properties.
+ *
+ * These are the negative, (1 - phi) = (phi^2) = (3 - sqrt(5))/2.
+ * (See Knuth vol 3, section 6.4, exercise 9.)
+ */
+#define GOLDEN_RATIO_32 0x61C88647
+#define GOLDEN_RATIO_64 0x61C8864680B583EBull
+
 static __always_inline u64 hash_64(u64 val, unsigned int bits)
 {
 	u64 hash = val;
 
-#if defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER) && BITS_PER_LONG == 64
-	hash = hash * GOLDEN_RATIO_PRIME_64;
+#if BITS_PER_LONG == 64
+	hash = hash * GOLDEN_RATIO_64;
 #else
 	/*  Sigh, gcc can't optimise this alone like it does for 32 bits. */
 	u64 n = hash;

[toc] | [prev] | [next] | [standalone]

#1396745 — [PATCH 4.4 29/67] xen/balloon: Fix crash when ballooning on x86 32 bit PAE

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ross Lagerwall <ross.lagerwall@citrix.com>

commit dfd74a1edfaba5864276a2859190a8d242d18952 upstream.

Commit 55b3da98a40dbb3776f7454daf0d95dde25c33d2 (xen/balloon: find
non-conflicting regions to place hotplugged memory) caused a
regression in 4.4.

When ballooning on an x86 32 bit PAE system with close to 64 GiB of
memory, the address returned by allocate_resource may be above 64 GiB.
When using CONFIG_SPARSEMEM, this setup is limited to using physical
addresses < 64 GiB.  When adding memory at this address, it runs off
the end of the mem_section array and causes a crash.  Instead, fail
the ballooning request.

Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/balloon.c |   16 ++++++++++++++++
 1 file changed, 16 insertions(+)

--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -152,6 +152,8 @@ static DECLARE_WAIT_QUEUE_HEAD(balloon_w
 static void balloon_process(struct work_struct *work);
 static DECLARE_DELAYED_WORK(balloon_worker, balloon_process);
 
+static void release_memory_resource(struct resource *resource);
+
 /* When ballooning out (allocating memory to return to Xen) we don't really
    want the kernel to try too hard since that can trigger the oom killer. */
 #define GFP_BALLOON \
@@ -268,6 +270,20 @@ static struct resource *additional_memor
 		return NULL;
 	}
 
+#ifdef CONFIG_SPARSEMEM
+	{
+		unsigned long limit = 1UL << (MAX_PHYSMEM_BITS - PAGE_SHIFT);
+		unsigned long pfn = res->start >> PAGE_SHIFT;
+
+		if (pfn > limit) {
+			pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n",
+			       pfn, limit);
+			release_memory_resource(res);
+			return NULL;
+		}
+	}
+#endif
+
 	return res;
 }
 

[toc] | [prev] | [next] | [standalone]

#1396746 — [PATCH 4.4 27/67] ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sascha Hauer <s.hauer@pengutronix.de>

commit 5616f36713ea77f57ae908bf2fef641364403c9f upstream.

The secondary CPU starts up in ARM mode. When the kernel is compiled in
thumb2 mode we have to explicitly compile the secondary startup
trampoline in ARM mode, otherwise the CPU will go to Nirvana.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Reported-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Dinh Nguyen <dinguyen@opensource.altera.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/mach-socfpga/headsmp.S |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/arm/mach-socfpga/headsmp.S
+++ b/arch/arm/mach-socfpga/headsmp.S
@@ -13,6 +13,7 @@
 #include <asm/assembler.h>
 
 	.arch	armv7-a
+	.arm
 
 ENTRY(secondary_trampoline)
 	/* CPU1 will always fetch from 0x0 when it is brought out of reset.

[toc] | [prev] | [next] | [standalone]

#1396747 — [PATCH 4.4 25/67] mm/zswap: provide unique zpool name

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Streetman <ddstreet@ieee.org>

commit 32a4e169039927bfb6ee9f0ccbbe3a8aaf13a4bc upstream.

Instead of using "zswap" as the name for all zpools created, add an
atomic counter and use "zswap%x" with the counter number for each zpool
created, to provide a unique name for each new zpool.

As zsmalloc, one of the zpool implementations, requires/expects a unique
name for each pool created, zswap should provide a unique name.  The
zsmalloc pool creation does not fail if a new pool with a conflicting
name is created, unless CONFIG_ZSMALLOC_STAT is enabled; in that case,
zsmalloc pool creation fails with -ENOMEM.  Then zswap will be unable to
change its compressor parameter if its zpool is zsmalloc; it also will
be unable to change its zpool parameter back to zsmalloc, if it has any
existing old zpool using zsmalloc with page(s) in it.  Attempts to
change the parameters will result in failure to create the zpool.  This
changes zswap to provide a unique name for each zpool creation.

Fixes: f1c54846ee45 ("zswap: dynamic pool creation")
Signed-off-by: Dan Streetman <ddstreet@ieee.org>
Reported-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Dan Streetman <dan.streetman@canonical.com>
Cc: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/zswap.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -170,6 +170,8 @@ static struct zswap_tree *zswap_trees[MA
 static LIST_HEAD(zswap_pools);
 /* protects zswap_pools list modification */
 static DEFINE_SPINLOCK(zswap_pools_lock);
+/* pool counter to provide unique names to zpool */
+static atomic_t zswap_pools_count = ATOMIC_INIT(0);
 
 /* used by param callback function */
 static bool zswap_init_started;
@@ -565,6 +567,7 @@ static struct zswap_pool *zswap_pool_fin
 static struct zswap_pool *zswap_pool_create(char *type, char *compressor)
 {
 	struct zswap_pool *pool;
+	char name[38]; /* 'zswap' + 32 char (max) num + \0 */
 	gfp_t gfp = __GFP_NORETRY | __GFP_NOWARN | __GFP_KSWAPD_RECLAIM;
 
 	pool = kzalloc(sizeof(*pool), GFP_KERNEL);
@@ -573,7 +576,10 @@ static struct zswap_pool *zswap_pool_cre
 		return NULL;
 	}
 
-	pool->zpool = zpool_create_pool(type, "zswap", gfp, &zswap_zpool_ops);
+	/* unique name for each pool specifically required by zsmalloc */
+	snprintf(name, 38, "zswap%x", atomic_inc_return(&zswap_pools_count));
+
+	pool->zpool = zpool_create_pool(type, name, gfp, &zswap_zpool_ops);
 	if (!pool->zpool) {
 		pr_err("%s zpool not available\n", type);
 		goto error;

[toc] | [prev] | [next] | [standalone]

#1396756 — [PATCH 4.4 42/67] x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chen Yu <yu.c.chen@intel.com>

commit 886123fb3a8656699dff40afa0573df359abeb18 upstream.

Currently we read the tsc radio: ratio = (MSR_PLATFORM_INFO >> 8) & 0x1f;

Thus we get bit 8-12 of MSR_PLATFORM_INFO, however according to the SDM
(35.5), the ratio bits are bit 8-15.

Ignoring the upper bits can result in an incorrect tsc ratio, which causes the
TSC calibration and the Local APIC timer frequency to be incorrect.

Fix this problem by masking 0xff instead.

[ tglx: Massaged changelog ]

Fixes: 7da7c1561366 "x86, tsc: Add static (MSR) TSC calibration on Intel Atom SoCs"
Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: Bin Gao <bin.gao@intel.com>
Cc: Len Brown <lenb@kernel.org>
Link: http://lkml.kernel.org/r/1462505619-5516-1-git-send-email-yu.c.chen@intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/tsc_msr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/tsc_msr.c
+++ b/arch/x86/kernel/tsc_msr.c
@@ -92,7 +92,7 @@ unsigned long try_msr_calibrate_tsc(void
 
 	if (freq_desc_tables[cpu_index].msr_plat) {
 		rdmsr(MSR_PLATFORM_INFO, lo, hi);
-		ratio = (lo >> 8) & 0x1f;
+		ratio = (lo >> 8) & 0xff;
 	} else {
 		rdmsr(MSR_IA32_PERF_STATUS, lo, hi);
 		ratio = (hi >> 8) & 0x1f;

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.kernel

csiph-web