Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1458024 > unrolled thread

[PATCH 4.4 00/68] 4.4.17-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.4 00/68] 4.4.17-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 36/68] locks: use file_inode() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 32/68] pinctrl: single: Fix missing flush of posted write for a wakeirq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 15/68] pps: do not crash when failed to register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 58/68] ipr: Clear interrupt on croc/crocodile when running with LSI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 10/68] fs/nilfs2: fix potential underflow in call to crc32_le Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 17/68] arc: unwind: warn only once if DW2_UNWIND is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 35/68] power_supply: power_supply_read_temp only if use_cnt > 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 56/68] RDS: fix rds_tcp_init() error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 68/68] vfs: fix deadlock in file_remove_privs() on overlayfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 26/68] Input: elantech - add more IC body types to the list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 42/68] spi: sunxi: fix transfer timeout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 47/68] block: fix use-after-free in sys_ioprio_get() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 37/68] Revert "ecryptfs: forbid opening files without mmap handler" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 25/68] Input: vmmouse - remove port reservation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 49/68] sched/fair: Fix effective_load() to consistently use smoothed load Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 21/68] xenbus: dont bail early from xenbus_dev_request_and_reply() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 28/68] Input: wacom_w8001 - w8001_MAX_LENGTH should be 13 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 09/68] mm, compaction: abort free scanner if split fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 07/68] dmaengine: at_xdmac: double FIFO flush needed to compute residue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 55/68] can: fix oops caused by wrong rtnl dellink usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 52/68] can: at91_can: RX queue could get stuck at high bus load Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 06/68] dmaengine: at_xdmac: fix residue corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 61/68] i2c: qup: Fix wrong value of index variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 45/68] platform/chrome: cros_ec_dev - double fetch bug in ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
    [PATCH 4.4 64/68] libceph: apply new_state before new_up_client on incrementals Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 16/68] kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 51/68] perf/x86: fix PEBS issues on Intel Atom/Core2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 14/68] vmlinux.lds: account for destructor sections Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 38/68] ecryptfs: dont allow mmap when the lower fs doesnt support it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 46/68] qeth: delete napi struct when removing a qeth device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 08/68] mm, sl[au]b: add __GFP_ATOMIC to the GFP reclaim mask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 66/68] intel_th: pci: Add Kaby Lake PCH-H support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 41/68] namespace: update event counter when umounting a deleted dentry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 60/68] posix_cpu_timer: Exit early when process has been reaped Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 54/68] can: fix handling of unmodifiable configuration options fix Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 67/68] intel_th: Fix a deadlock in modprobing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 43/68] spi: sun4i: fix FIFO limit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 11/68] mm, compaction: prevent VM_BUG_ON when terminating freeing scanner Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 39/68] ext4: verify extent header depth Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 12/68] mm, meminit: always return a valid node from early_pfn_to_nid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 63/68] libata: LITE-ON CX1-JB256-HP needs lower max_sectors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 40/68] 9p: use file_dentry() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 57/68] SCSI: fix new bug in scsi_dev_info_list string matching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 50/68] ovl: handle ATTR_KILL* Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 44/68] clk: rockchip: initialize flags of clk_init_data in mmc-phase clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 59/68] media: fix airspy usb probe error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 53/68] can: c_can: Update D_CAN TX and RX functions to 32 bit - fix Altera Cyclone access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 13/68] mm, meminit: ensure node is online before checking whether pages are uninitialised Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 48/68] mmc: block: fix packed command header endianness Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
    [PATCH 4.4 34/68] cgroup: set css->id to -1 during init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
    [PATCH 4.4 18/68] ARC: unwind: ensure that .debug_frame is generated (vs. .eh_frame) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
    [PATCH 4.4 27/68] Input: xpad - fix oops when attaching an unknown Xbox One gamepad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
    [PATCH 4.4 29/68] Input: xpad - validate USB endpoint count during probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
    [PATCH 4.4 19/68] xen/pciback: Fix conf_space read/write overlap check. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
    [PATCH 4.4 03/68] x86/quirks: Reintroduce scanning of secondary buses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
    [PATCH 4.4 31/68] pvclock: Add CPU barriers to get correct version value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
    Re: [PATCH 4.4 00/68] 4.4.17-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-09 06:30 +0200
      Re: [PATCH 4.4 00/68] 4.4.17-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-09 10:30 +0200
        Re: [PATCH 4.4 00/68] 4.4.17-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-09 18:20 +0200
          Re: [PATCH 4.4 00/68] 4.4.17-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-09 19:30 +0200
    Re: [PATCH 4.4 00/68] 4.4.17-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-08-09 17:20 +0200

Page 1 of 4  [1] 2 3 4  Next page →

#1458024 — [PATCH 4.4 00/68] 4.4.17-stable review

This is the start of the stable review cycle for the 4.4.17 release.
There are 68 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed Aug 10 18:01:56 UTC 2016.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.17-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.4.17-rc1

Miklos Szeredi <mszeredi@redhat.com>
    vfs: fix deadlock in file_remove_privs() on overlayfs

Alexander Shishkin <alexander.shishkin@linux.intel.com>
    intel_th: Fix a deadlock in modprobing

Alexander Shishkin <alexander.shishkin@linux.intel.com>
    intel_th: pci: Add Kaby Lake PCH-H support

Dmitri Epshtein <dima@marvell.com>
    net: mvneta: set real interrupt per packet for tx_done

Ilya Dryomov <idryomov@gmail.com>
    libceph: apply new_state before new_up_client on incrementals

Tejun Heo <tj@kernel.org>
    libata: LITE-ON CX1-JB256-HP needs lower max_sectors

Lukasz Gemborowski <lukasz.gemborowski@nokia.com>
    i2c: mux: reg: wrong condition checked for of_address_to_resource return value

Sricharan R <sricharan@codeaurora.org>
    i2c: qup: Fix wrong value of index variable

Alexey Dobriyan <adobriyan@gmail.com>
    posix_cpu_timer: Exit early when process has been reaped

James Patrick-Evans <james@jmp-e.com>
    media: fix airspy usb probe error path

Brian King <brking@linux.vnet.ibm.com>
    ipr: Clear interrupt on croc/crocodile when running with LSI

Alan Stern <stern@rowland.harvard.edu>
    SCSI: fix new bug in scsi_dev_info_list string matching

Vegard Nossum <vegard.nossum@oracle.com>
    RDS: fix rds_tcp_init() error path

Oliver Hartkopp <socketcan@hartkopp.net>
    can: fix oops caused by wrong rtnl dellink usage

Oliver Hartkopp <socketcan@hartkopp.net>
    can: fix handling of unmodifiable configuration options fix

Thor Thayer <tthayer@opensource.altera.com>
    can: c_can: Update D_CAN TX and RX functions to 32 bit - fix Altera Cyclone access

Wolfgang Grandegger <wg@grandegger.com>
    can: at91_can: RX queue could get stuck at high bus load

Stephane Eranian <eranian@google.com>
    perf/x86: fix PEBS issues on Intel Atom/Core2

Miklos Szeredi <mszeredi@redhat.com>
    ovl: handle ATTR_KILL*

Peter Zijlstra <peterz@infradead.org>
    sched/fair: Fix effective_load() to consistently use smoothed load

Taras Kondratiuk <takondra@cisco.com>
    mmc: block: fix packed command header endianness

Omar Sandoval <osandov@fb.com>
    block: fix use-after-free in sys_ioprio_get()

Ursula Braun <ubraun@linux.vnet.ibm.com>
    qeth: delete napi struct when removing a qeth device

Dan Carpenter <dan.carpenter@oracle.com>
    platform/chrome: cros_ec_dev - double fetch bug in ioctl

Heiko Stuebner <heiko@sntech.de>
    clk: rockchip: initialize flags of clk_init_data in mmc-phase clock

Michal Suchanek <hramrach@gmail.com>
    spi: sun4i: fix FIFO limit

Michal Suchanek <hramrach@gmail.com>
    spi: sunxi: fix transfer timeout

Andrey Ulanov <andreyu@google.com>
    namespace: update event counter when umounting a deleted dentry

Miklos Szeredi <mszeredi@redhat.com>
    9p: use file_dentry()

Vegard Nossum <vegard.nossum@oracle.com>
    ext4: verify extent header depth

Jeff Mahoney <jeffm@suse.com>
    ecryptfs: don't allow mmap when the lower fs doesn't support it

Jeff Mahoney <jeffm@suse.com>
    Revert "ecryptfs: forbid opening files without mmap handler"

Miklos Szeredi <mszeredi@redhat.com>
    locks: use file_inode()

Rhyland Klein <rklein@nvidia.com>
    power_supply: power_supply_read_temp only if use_cnt > 0

Tejun Heo <tj@kernel.org>
    cgroup: set css->id to -1 during init

Alexander Shiyan <shc_work@mail.ru>
    pinctrl: imx: Do not treat a PIN without MUX register as an error

Tony Lindgren <tony@atomide.com>
    pinctrl: single: Fix missing flush of posted write for a wakeirq

Minfei Huang <mnghuan@gmail.com>
    pvclock: Add CPU barriers to get correct version value

Michael Welling <mwelling@ieee.org>
    Input: tsc200x - report proper input_dev name

Cameron Gutman <aicommander@gmail.com>
    Input: xpad - validate USB endpoint count during probe

Ping Cheng <pinglinux@gmail.com>
    Input: wacom_w8001 - w8001_MAX_LENGTH should be 13

Cameron Gutman <aicommander@gmail.com>
    Input: xpad - fix oops when attaching an unknown Xbox One gamepad

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: elantech - add more IC body types to the list

Sinclair Yeh <syeh@vmware.com>
    Input: vmmouse - remove port reservation

Kangjie Lu <kangjielu@gmail.com>
    ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt

Kangjie Lu <kangjielu@gmail.com>
    ALSA: timer: Fix leak in events via snd_timer_user_ccallback

Kangjie Lu <kangjielu@gmail.com>
    ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS

Jan Beulich <JBeulich@suse.com>
    xenbus: don't bail early from xenbus_dev_request_and_reply()

Jan Beulich <JBeulich@suse.com>
    xenbus: don't BUG() on user mode induced condition

Andrey Grodzovsky <andrey2805@gmail.com>
    xen/pciback: Fix conf_space read/write overlap check.

Vineet Gupta <vgupta@synopsys.com>
    ARC: unwind: ensure that .debug_frame is generated (vs. .eh_frame)

Alexey Brodkin <Alexey.Brodkin@synopsys.com>
    arc: unwind: warn only once if DW2_UNWIND is disabled

Andrey Ryabinin <aryabinin@virtuozzo.com>
    kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w

Jiri Slaby <jslaby@suse.cz>
    pps: do not crash when failed to register

Dmitry Vyukov <dvyukov@google.com>
    vmlinux.lds: account for destructor sections

Mel Gorman <mgorman@techsingularity.net>
    mm, meminit: ensure node is online before checking whether pages are uninitialised

Mel Gorman <mgorman@techsingularity.net>
    mm, meminit: always return a valid node from early_pfn_to_nid

David Rientjes <rientjes@google.com>
    mm, compaction: prevent VM_BUG_ON when terminating freeing scanner

Torsten Hilbrich <torsten.hilbrich@secunet.com>
    fs/nilfs2: fix potential underflow in call to crc32_le

David Rientjes <rientjes@google.com>
    mm, compaction: abort free scanner if split fails

Mel Gorman <mgorman@techsingularity.net>
    mm, sl[au]b: add __GFP_ATOMIC to the GFP reclaim mask

Ludovic Desroches <ludovic.desroches@atmel.com>
    dmaengine: at_xdmac: double FIFO flush needed to compute residue

Ludovic Desroches <ludovic.desroches@atmel.com>
    dmaengine: at_xdmac: fix residue corruption

Ludovic Desroches <ludovic.desroches@atmel.com>
    dmaengine: at_xdmac: align descriptors on 64 bits

Lukas Wunner <lukas@wunner.de>
    x86/quirks: Add early quirk to reset Apple AirPort card

Lukas Wunner <lukas@wunner.de>
    x86/quirks: Reintroduce scanning of secondary buses

Lukas Wunner <lukas@wunner.de>
    x86/quirks: Apply nvidia_bugs quirk only on root bus

Michał Pecio <michal.pecio@gmail.com>
    USB: OHCI: Don't mark EDs as ED_OPER if scheduling fails


-------------

Diffstat:

 Makefile                                  |   4 +-
 arch/arc/Makefile                         |   2 -
 arch/arc/kernel/stacktrace.c              |   2 +-
 arch/x86/include/asm/pvclock.h            |   2 +
 arch/x86/kernel/cpu/perf_event_intel_ds.c |   9 +-
 arch/x86/kernel/early-quirks.c            | 105 +++++++++++++++++---
 arch/x86/kernel/pvclock.c                 |   4 +
 block/ioprio.c                            |   2 +
 drivers/ata/libata-core.c                 |   6 ++
 drivers/bcma/bcma_private.h               |   2 -
 drivers/clk/rockchip/clk-mmc-phase.c      |   1 +
 drivers/dma/at_xdmac.c                    |  82 +++++++++++-----
 drivers/hwtracing/intel_th/core.c         |  35 ++++++-
 drivers/hwtracing/intel_th/intel_th.h     |   3 +
 drivers/hwtracing/intel_th/pci.c          |   5 +
 drivers/i2c/busses/i2c-qup.c              |   2 +
 drivers/i2c/muxes/i2c-mux-reg.c           |   2 +-
 drivers/input/joystick/xpad.c             |  26 +++--
 drivers/input/mouse/elantech.c            |   8 +-
 drivers/input/mouse/vmmouse.c             |  22 +----
 drivers/input/touchscreen/tsc2004.c       |   7 +-
 drivers/input/touchscreen/tsc2005.c       |   7 +-
 drivers/input/touchscreen/tsc200x-core.c  |  15 ++-
 drivers/input/touchscreen/tsc200x-core.h  |   2 +-
 drivers/input/touchscreen/wacom_w8001.c   |   2 +-
 drivers/media/usb/airspy/airspy.c         |   3 +-
 drivers/mmc/card/block.c                  |  12 +--
 drivers/net/can/at91_can.c                |   5 +-
 drivers/net/can/c_can/c_can.c             |  38 ++++++--
 drivers/net/can/dev.c                     |   9 ++
 drivers/net/ethernet/marvell/mvneta.c     |   2 +-
 drivers/pinctrl/freescale/pinctrl-imx.c   |   4 +-
 drivers/pinctrl/pinctrl-single.c          |   3 +
 drivers/platform/chrome/cros_ec_dev.c     |   8 +-
 drivers/power/power_supply_core.c         |  27 +++---
 drivers/pps/clients/pps_parport.c         |   2 +-
 drivers/s390/net/qeth_l2_main.c           |   1 +
 drivers/s390/net/qeth_l3_main.c           |   1 +
 drivers/scsi/ipr.c                        |   1 +
 drivers/scsi/scsi_devinfo.c               |  10 +-
 drivers/spi/spi-sun4i.c                   |  23 ++++-
 drivers/spi/spi-sun6i.c                   |  10 +-
 drivers/usb/host/ohci-q.c                 |   3 +-
 drivers/xen/xen-pciback/conf_space.c      |   6 +-
 drivers/xen/xenbus/xenbus_dev_frontend.c  |  14 +--
 drivers/xen/xenbus/xenbus_xs.c            |   3 -
 fs/9p/vfs_file.c                          |   6 +-
 fs/ecryptfs/file.c                        |  15 ++-
 fs/ecryptfs/kthread.c                     |  13 +--
 fs/ext4/extents.c                         |   4 +
 fs/inode.c                                |   6 +-
 fs/locks.c                                |   2 +-
 fs/namespace.c                            |   1 +
 fs/nilfs2/the_nilfs.c                     |   2 +-
 fs/overlayfs/inode.c                      |   3 +
 include/asm-generic/vmlinux.lds.h         |   4 +
 include/linux/bcma/bcma.h                 |   1 +
 kernel/cgroup.c                           |   1 +
 kernel/sched/core.c                       |   6 +-
 kernel/sched/fair.c                       |  15 +--
 kernel/time/posix-cpu-timers.c            |   1 +
 mm/compaction.c                           |  61 ++++++------
 mm/internal.h                             |   3 +-
 mm/page_alloc.c                           |   6 +-
 net/ceph/osdmap.c                         | 156 ++++++++++++++++++++++--------
 net/rds/tcp.c                             |   5 +-
 sound/core/timer.c                        |   3 +
 67 files changed, 599 insertions(+), 257 deletions(-)

[toc] | [next] | [standalone]

#1458027 — [PATCH 4.4 36/68] locks: use file_inode()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miklos Szeredi <mszeredi@redhat.com>

commit 6343a2120862f7023006c8091ad95c1f16a32077 upstream.

(Another one for the f_path debacle.)

ltp fcntl33 testcase caused an Oops in selinux_file_send_sigiotask.

The reason is that generic_add_lease() used filp->f_path.dentry->inode
while all the others use file_inode().  This makes a difference for files
opened on overlayfs since the former will point to the overlay inode the
latter to the underlying inode.

So generic_add_lease() added the lease to the overlay inode and
generic_delete_lease() removed it from the underlying inode.  When the file
was released the lease remained on the overlay inode's lock list, resulting
in use after free.

Reported-by: Eryu Guan <eguan@redhat.com>
Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/locks.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1602,7 +1602,7 @@ generic_add_lease(struct file *filp, lon
 {
 	struct file_lock *fl, *my_fl = NULL, *lease;
 	struct dentry *dentry = filp->f_path.dentry;
-	struct inode *inode = dentry->d_inode;
+	struct inode *inode = file_inode(filp);
 	struct file_lock_context *ctx;
 	bool is_deleg = (*flp)->fl_flags & FL_DELEG;
 	int error;

[toc] | [prev] | [next] | [standalone]

#1458028 — [PATCH 4.4 32/68] pinctrl: single: Fix missing flush of posted write for a wakeirq

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tony Lindgren <tony@atomide.com>

commit 0ac3c0a4025f41748a083bdd4970cb3ede802b15 upstream.

With many repeated suspend resume cycles, the pin specific wakeirq
may not always work on omaps. This is because the write to enable the
pin interrupt may not have reached the device over the interconnect
before suspend happens.

Let's fix the issue with a flush of posted write with a readback.

Reported-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pinctrl/pinctrl-single.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1576,6 +1576,9 @@ static inline void pcs_irq_set(struct pc
 		else
 			mask &= ~soc_mask;
 		pcs->write(mask, pcswi->reg);
+
+		/* flush posted write */
+		mask = pcs->read(pcswi->reg);
 		raw_spin_unlock(&pcs->lock);
 	}
 

[toc] | [prev] | [next] | [standalone]

#1458033 — [PATCH 4.4 15/68] pps: do not crash when failed to register

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jiri Slaby <jslaby@suse.cz>

commit 368301f2fe4b07e5fb71dba3cc566bc59eb6705f upstream.

With this command sequence:

  modprobe plip
  modprobe pps_parport
  rmmod pps_parport

the partport_pps modules causes this crash:

  BUG: unable to handle kernel NULL pointer dereference at (null)
  IP: parport_detach+0x1d/0x60 [pps_parport]
  Oops: 0000 [#1] SMP
  ...
  Call Trace:
    parport_unregister_driver+0x65/0xc0 [parport]
    SyS_delete_module+0x187/0x210

The sequence that builds up to this is:

 1) plip is loaded and takes the parport device for exclusive use:

    plip0: Parallel port at 0x378, using IRQ 7.

 2) pps_parport then fails to grab the device:

    pps_parport: parallel port PPS client
    parport0: cannot grant exclusive access for device pps_parport
    pps_parport: couldn't register with parport0

 3) rmmod of pps_parport is then killed because it tries to access
    pardev->name, but pardev (taken from port->cad) is NULL.

So add a check for NULL in the test there too.

Link: http://lkml.kernel.org/r/20160714115245.12651-1-jslaby@suse.cz
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pps/clients/pps_parport.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pps/clients/pps_parport.c
+++ b/drivers/pps/clients/pps_parport.c
@@ -195,7 +195,7 @@ static void parport_detach(struct parpor
 	struct pps_client_pp *device;
 
 	/* FIXME: oooh, this is ugly! */
-	if (strcmp(pardev->name, KBUILD_MODNAME))
+	if (!pardev || strcmp(pardev->name, KBUILD_MODNAME))
 		/* not our port */
 		return;
 

[toc] | [prev] | [next] | [standalone]

#1458034 — [PATCH 4.4 58/68] ipr: Clear interrupt on croc/crocodile when running with LSI

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brian King <brking@linux.vnet.ibm.com>

commit 54e430bbd490e18ab116afa4cd90dcc45787b3df upstream.

If we fall back to using LSI on the Croc or Crocodile chip we need to
clear the interrupt so we don't hang the system.

Tested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/ipr.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -10095,6 +10095,7 @@ static int ipr_probe_ioa(struct pci_dev
 		ioa_cfg->intr_flag = IPR_USE_MSI;
 	else {
 		ioa_cfg->intr_flag = IPR_USE_LSI;
+		ioa_cfg->clear_isr = 1;
 		ioa_cfg->nvectors = 1;
 		dev_info(&pdev->dev, "Cannot enable MSI.\n");
 	}

[toc] | [prev] | [next] | [standalone]

#1458035 — [PATCH 4.4 10/68] fs/nilfs2: fix potential underflow in call to crc32_le

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Torsten Hilbrich <torsten.hilbrich@secunet.com>

commit 63d2f95d63396059200c391ca87161897b99e74a upstream.

The value `bytes' comes from the filesystem which is about to be
mounted.  We cannot trust that the value is always in the range we
expect it to be.

Check its value before using it to calculate the length for the crc32_le
call.  It value must be larger (or equal) sumoff + 4.

This fixes a kernel bug when accidentially mounting an image file which
had the nilfs2 magic value 0x3434 at the right offset 0x406 by chance.
The bytes 0x01 0x00 were stored at 0x408 and were interpreted as a
s_bytes value of 1.  This caused an underflow when substracting sumoff +
4 (20) in the call to crc32_le.

  BUG: unable to handle kernel paging request at ffff88021e600000
  IP:  crc32_le+0x36/0x100
  ...
  Call Trace:
    nilfs_valid_sb.part.5+0x52/0x60 [nilfs2]
    nilfs_load_super_block+0x142/0x300 [nilfs2]
    init_nilfs+0x60/0x390 [nilfs2]
    nilfs_mount+0x302/0x520 [nilfs2]
    mount_fs+0x38/0x160
    vfs_kern_mount+0x67/0x110
    do_mount+0x269/0xe00
    SyS_mount+0x9f/0x100
    entry_SYSCALL_64_fastpath+0x16/0x71

Link: http://lkml.kernel.org/r/1466778587-5184-2-git-send-email-konishi.ryusuke@lab.ntt.co.jp
Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Tested-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nilfs2/the_nilfs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -443,7 +443,7 @@ static int nilfs_valid_sb(struct nilfs_s
 	if (!sbp || le16_to_cpu(sbp->s_magic) != NILFS_SUPER_MAGIC)
 		return 0;
 	bytes = le16_to_cpu(sbp->s_bytes);
-	if (bytes > BLOCK_SIZE)
+	if (bytes < sumoff + 4 || bytes > BLOCK_SIZE)
 		return 0;
 	crc = crc32_le(le32_to_cpu(sbp->s_crc_seed), (unsigned char *)sbp,
 		       sumoff);

[toc] | [prev] | [next] | [standalone]

#1458041 — [PATCH 4.4 17/68] arc: unwind: warn only once if DW2_UNWIND is disabled

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>

commit 9bd54517ee86cb164c734f72ea95aeba4804f10b upstream.

If CONFIG_ARC_DW2_UNWIND is disabled every time arc_unwind_core()
gets called following message gets printed in debug console:
----------------->8---------------
CONFIG_ARC_DW2_UNWIND needs to be enabled
----------------->8---------------

That message makes sense if user indeed wants to see a backtrace or
get nice function call-graphs in perf but what if user disabled
unwinder for the purpose? Why pollute his debug console?

So instead we'll warn user about possibly missing feature once and
let him decide if that was what he or she really wanted.

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arc/kernel/stacktrace.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arc/kernel/stacktrace.c
+++ b/arch/arc/kernel/stacktrace.c
@@ -142,7 +142,7 @@ arc_unwind_core(struct task_struct *tsk,
 	 * prelogue is setup (callee regs saved and then fp set and not other
 	 * way around
 	 */
-	pr_warn("CONFIG_ARC_DW2_UNWIND needs to be enabled\n");
+	pr_warn_once("CONFIG_ARC_DW2_UNWIND needs to be enabled\n");
 	return 0;
 
 #endif

[toc] | [prev] | [next] | [standalone]

#1458042 — [PATCH 4.4 35/68] power_supply: power_supply_read_temp only if use_cnt > 0

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rhyland Klein <rklein@nvidia.com>

commit 5bc28b93a36e3cb3acc2870fb75cb6ffb182fece upstream.

Change power_supply_read_temp() to use power_supply_get_property()
so that it will check the use_cnt and ensure it is > 0. The use_cnt
will be incremented at the end of __power_supply_register, so this
will block to case where get_property can be called before the supply
is fully registered. This fixes the issue show in the stack below:

[    1.452598] power_supply_read_temp+0x78/0x80
[    1.458680] thermal_zone_get_temp+0x5c/0x11c
[    1.464765] thermal_zone_device_update+0x34/0xb4
[    1.471195] thermal_zone_device_register+0x87c/0x8cc
[    1.477974] __power_supply_register+0x364/0x424
[    1.484317] power_supply_register_no_ws+0x10/0x18
[    1.490833] bq27xxx_battery_setup+0x10c/0x164
[    1.497003] bq27xxx_battery_i2c_probe+0xd0/0x1b0
[    1.503435] i2c_device_probe+0x174/0x240
[    1.509172] driver_probe_device+0x1fc/0x29c
[    1.515167] __driver_attach+0xa4/0xa8
[    1.520643] bus_for_each_dev+0x58/0x98
[    1.526204] driver_attach+0x20/0x28
[    1.531505] bus_add_driver+0x1c8/0x22c
[    1.537067] driver_register+0x68/0x108
[    1.542630] i2c_register_driver+0x38/0x7c
[    1.548457] bq27xxx_battery_i2c_driver_init+0x18/0x20
[    1.555321] do_one_initcall+0x38/0x12c
[    1.560886] kernel_init_freeable+0x148/0x1ec
[    1.566972] kernel_init+0x10/0xfc
[    1.572101] ret_from_fork+0x10/0x40

Also make the same change to ps_get_max_charge_cntl_limit() and
ps_get_cur_chrage_cntl_limit() to be safe. Lastly, change the return
value of power_supply_get_property() to -EAGAIN from -ENODEV if
use_cnt <= 0.

Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core")
Signed-off-by: Rhyland Klein <rklein@nvidia.com>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/power/power_supply_core.c |   27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -565,11 +565,12 @@ static int power_supply_read_temp(struct
 
 	WARN_ON(tzd == NULL);
 	psy = tzd->devdata;
-	ret = psy->desc->get_property(psy, POWER_SUPPLY_PROP_TEMP, &val);
+	ret = power_supply_get_property(psy, POWER_SUPPLY_PROP_TEMP, &val);
+	if (ret)
+		return ret;
 
 	/* Convert tenths of degree Celsius to milli degree Celsius. */
-	if (!ret)
-		*temp = val.intval * 100;
+	*temp = val.intval * 100;
 
 	return ret;
 }
@@ -612,10 +613,12 @@ static int ps_get_max_charge_cntl_limit(
 	int ret;
 
 	psy = tcd->devdata;
-	ret = psy->desc->get_property(psy,
-		POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val);
-	if (!ret)
-		*state = val.intval;
+	ret = power_supply_get_property(psy,
+			POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val);
+	if (ret)
+		return ret;
+
+	*state = val.intval;
 
 	return ret;
 }
@@ -628,10 +631,12 @@ static int ps_get_cur_chrage_cntl_limit(
 	int ret;
 
 	psy = tcd->devdata;
-	ret = psy->desc->get_property(psy,
-		POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
-	if (!ret)
-		*state = val.intval;
+	ret = power_supply_get_property(psy,
+			POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
+	if (ret)
+		return ret;
+
+	*state = val.intval;
 
 	return ret;
 }

[toc] | [prev] | [next] | [standalone]

#1458044 — [PATCH 4.4 56/68] RDS: fix rds_tcp_init() error path

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vegard Nossum <vegard.nossum@oracle.com>

commit 3dad5424adfb346c871847d467f97dcdca64ea97 upstream.

If register_pernet_subsys() fails, we shouldn't try to call
unregister_pernet_subsys().

Fixes: 467fa15356 ("RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.")
Cc: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Acked-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/rds/tcp.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -421,7 +421,7 @@ static int rds_tcp_init(void)
 
 	ret = rds_tcp_recv_init();
 	if (ret)
-		goto out_slab;
+		goto out_pernet;
 
 	ret = rds_trans_register(&rds_tcp_transport);
 	if (ret)
@@ -433,8 +433,9 @@ static int rds_tcp_init(void)
 
 out_recv:
 	rds_tcp_recv_exit();
-out_slab:
+out_pernet:
 	unregister_pernet_subsys(&rds_tcp_net_ops);
+out_slab:
 	kmem_cache_destroy(rds_tcp_conn_slab);
 out:
 	return ret;

[toc] | [prev] | [next] | [standalone]

#1458046 — [PATCH 4.4 68/68] vfs: fix deadlock in file_remove_privs() on overlayfs

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miklos Szeredi <mszeredi@redhat.com>

commit c1892c37769cf89c7e7ba57528ae2ccb5d153c9b upstream.

file_remove_privs() is called with inode lock on file_inode(), which
proceeds to calling notify_change() on file->f_path.dentry.  Which triggers
the WARN_ON_ONCE(!inode_is_locked(inode)) in addition to deadlocking later
when ovl_setattr tries to lock the underlying inode again.

Fix this mess by not mixing the layers, but doing everything on underlying
dentry/inode.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 07a2daab49c5 ("ovl: Copy up underlying inode's ->i_mode to overlay inode")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/inode.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1733,8 +1733,8 @@ static int __remove_privs(struct dentry
  */
 int file_remove_privs(struct file *file)
 {
-	struct dentry *dentry = file->f_path.dentry;
-	struct inode *inode = d_inode(dentry);
+	struct dentry *dentry = file_dentry(file);
+	struct inode *inode = file_inode(file);
 	int kill;
 	int error = 0;
 
@@ -1742,7 +1742,7 @@ int file_remove_privs(struct file *file)
 	if (IS_NOSEC(inode))
 		return 0;
 
-	kill = file_needs_remove_privs(file);
+	kill = dentry_needs_remove_privs(dentry);
 	if (kill < 0)
 		return kill;
 	if (kill)

[toc] | [prev] | [next] | [standalone]

#1458047 — [PATCH 4.4 26/68] Input: elantech - add more IC body types to the list

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit 226ba707744a51acb4244724e09caacb1d96aed9 upstream.

The touchpad in HP Pavilion 14-ab057ca reports it's version as 12 and
according to Elan both 11 and 12 are valid IC types and should be
identified as hw_version 4.

Reported-by: Patrick Lessard <Patrick.Lessard@cogeco.com>
Tested-by: Patrick Lessard <Patrick.Lessard@cogeco.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/mouse/elantech.c |    8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1568,13 +1568,7 @@ static int elantech_set_properties(struc
 		case 5:
 			etd->hw_version = 3;
 			break;
-		case 6:
-		case 7:
-		case 8:
-		case 9:
-		case 10:
-		case 13:
-		case 14:
+		case 6 ... 14:
 			etd->hw_version = 4;
 			break;
 		default:

[toc] | [prev] | [next] | [standalone]

#1458049 — [PATCH 4.4 42/68] spi: sunxi: fix transfer timeout

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michal Suchanek <hramrach@gmail.com>

commit 719bd6542044efd9b338a53dba1bef45f40ca169 upstream.

The trasfer timeout is fixed at 1000 ms. Reading a 4Mbyte flash over
1MHz SPI bus takes way longer than that. Calculate the timeout from the
actual time the transfer is supposed to take and multiply by 2 for good
measure.

Signed-off-by: Michal Suchanek <hramrach@gmail.com>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-sun4i.c |   10 +++++++++-
 drivers/spi/spi-sun6i.c |   10 +++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi-sun4i.c
+++ b/drivers/spi/spi-sun4i.c
@@ -170,6 +170,7 @@ static int sun4i_spi_transfer_one(struct
 {
 	struct sun4i_spi *sspi = spi_master_get_devdata(master);
 	unsigned int mclk_rate, div, timeout;
+	unsigned int start, end, tx_time;
 	unsigned int tx_len = 0;
 	int ret = 0;
 	u32 reg;
@@ -279,9 +280,16 @@ static int sun4i_spi_transfer_one(struct
 	reg = sun4i_spi_read(sspi, SUN4I_CTL_REG);
 	sun4i_spi_write(sspi, SUN4I_CTL_REG, reg | SUN4I_CTL_XCH);
 
+	tx_time = max(tfr->len * 8 * 2 / (tfr->speed_hz / 1000), 100U);
+	start = jiffies;
 	timeout = wait_for_completion_timeout(&sspi->done,
-					      msecs_to_jiffies(1000));
+					      msecs_to_jiffies(tx_time));
+	end = jiffies;
 	if (!timeout) {
+		dev_warn(&master->dev,
+			 "%s: timeout transferring %u bytes@%iHz for %i(%i)ms",
+			 dev_name(&spi->dev), tfr->len, tfr->speed_hz,
+			 jiffies_to_msecs(end - start), tx_time);
 		ret = -ETIMEDOUT;
 		goto out;
 	}
--- a/drivers/spi/spi-sun6i.c
+++ b/drivers/spi/spi-sun6i.c
@@ -160,6 +160,7 @@ static int sun6i_spi_transfer_one(struct
 {
 	struct sun6i_spi *sspi = spi_master_get_devdata(master);
 	unsigned int mclk_rate, div, timeout;
+	unsigned int start, end, tx_time;
 	unsigned int tx_len = 0;
 	int ret = 0;
 	u32 reg;
@@ -269,9 +270,16 @@ static int sun6i_spi_transfer_one(struct
 	reg = sun6i_spi_read(sspi, SUN6I_TFR_CTL_REG);
 	sun6i_spi_write(sspi, SUN6I_TFR_CTL_REG, reg | SUN6I_TFR_CTL_XCH);
 
+	tx_time = max(tfr->len * 8 * 2 / (tfr->speed_hz / 1000), 100U);
+	start = jiffies;
 	timeout = wait_for_completion_timeout(&sspi->done,
-					      msecs_to_jiffies(1000));
+					      msecs_to_jiffies(tx_time));
+	end = jiffies;
 	if (!timeout) {
+		dev_warn(&master->dev,
+			 "%s: timeout transferring %u bytes@%iHz for %i(%i)ms",
+			 dev_name(&spi->dev), tfr->len, tfr->speed_hz,
+			 jiffies_to_msecs(end - start), tx_time);
 		ret = -ETIMEDOUT;
 		goto out;
 	}

[toc] | [prev] | [next] | [standalone]

#1458050 — [PATCH 4.4 47/68] block: fix use-after-free in sys_ioprio_get()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Omar Sandoval <osandov@fb.com>

commit 8ba8682107ee2ca3347354e018865d8e1967c5f4 upstream.

get_task_ioprio() accesses the task->io_context without holding the task
lock and thus can race with exit_io_context(), leading to a
use-after-free. The reproducer below hits this within a few seconds on
my 4-core QEMU VM:

#define _GNU_SOURCE
#include <assert.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <sys/wait.h>

int main(int argc, char **argv)
{
	pid_t pid, child;
	long nproc, i;

	/* ioprio_set(IOPRIO_WHO_PROCESS, 0, IOPRIO_PRIO_VALUE(IOPRIO_CLASS_IDLE, 0)); */
	syscall(SYS_ioprio_set, 1, 0, 0x6000);

	nproc = sysconf(_SC_NPROCESSORS_ONLN);

	for (i = 0; i < nproc; i++) {
		pid = fork();
		assert(pid != -1);
		if (pid == 0) {
			for (;;) {
				pid = fork();
				assert(pid != -1);
				if (pid == 0) {
					_exit(0);
				} else {
					child = wait(NULL);
					assert(child == pid);
				}
			}
		}

		pid = fork();
		assert(pid != -1);
		if (pid == 0) {
			for (;;) {
				/* ioprio_get(IOPRIO_WHO_PGRP, 0); */
				syscall(SYS_ioprio_get, 2, 0);
			}
		}
	}

	for (;;) {
		/* ioprio_get(IOPRIO_WHO_PGRP, 0); */
		syscall(SYS_ioprio_get, 2, 0);
	}

	return 0;
}

This gets us KASAN dumps like this:

[   35.526914] ==================================================================
[   35.530009] BUG: KASAN: out-of-bounds in get_task_ioprio+0x7b/0x90 at addr ffff880066f34e6c
[   35.530009] Read of size 2 by task ioprio-gpf/363
[   35.530009] =============================================================================
[   35.530009] BUG blkdev_ioc (Not tainted): kasan: bad access detected
[   35.530009] -----------------------------------------------------------------------------

[   35.530009] Disabling lock debugging due to kernel taint
[   35.530009] INFO: Allocated in create_task_io_context+0x2b/0x370 age=0 cpu=0 pid=360
[   35.530009] 	___slab_alloc+0x55d/0x5a0
[   35.530009] 	__slab_alloc.isra.20+0x2b/0x40
[   35.530009] 	kmem_cache_alloc_node+0x84/0x200
[   35.530009] 	create_task_io_context+0x2b/0x370
[   35.530009] 	get_task_io_context+0x92/0xb0
[   35.530009] 	copy_process.part.8+0x5029/0x5660
[   35.530009] 	_do_fork+0x155/0x7e0
[   35.530009] 	SyS_clone+0x19/0x20
[   35.530009] 	do_syscall_64+0x195/0x3a0
[   35.530009] 	return_from_SYSCALL_64+0x0/0x6a
[   35.530009] INFO: Freed in put_io_context+0xe7/0x120 age=0 cpu=0 pid=1060
[   35.530009] 	__slab_free+0x27b/0x3d0
[   35.530009] 	kmem_cache_free+0x1fb/0x220
[   35.530009] 	put_io_context+0xe7/0x120
[   35.530009] 	put_io_context_active+0x238/0x380
[   35.530009] 	exit_io_context+0x66/0x80
[   35.530009] 	do_exit+0x158e/0x2b90
[   35.530009] 	do_group_exit+0xe5/0x2b0
[   35.530009] 	SyS_exit_group+0x1d/0x20
[   35.530009] 	entry_SYSCALL_64_fastpath+0x1a/0xa4
[   35.530009] INFO: Slab 0xffffea00019bcd00 objects=20 used=4 fp=0xffff880066f34ff0 flags=0x1fffe0000004080
[   35.530009] INFO: Object 0xffff880066f34e58 @offset=3672 fp=0x0000000000000001
[   35.530009] ==================================================================

Fix it by grabbing the task lock while we poke at the io_context.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Omar Sandoval <osandov@fb.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 block/ioprio.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/block/ioprio.c
+++ b/block/ioprio.c
@@ -150,8 +150,10 @@ static int get_task_ioprio(struct task_s
 	if (ret)
 		goto out;
 	ret = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, IOPRIO_NORM);
+	task_lock(p);
 	if (p->io_context)
 		ret = p->io_context->ioprio;
+	task_unlock(p);
 out:
 	return ret;
 }

[toc] | [prev] | [next] | [standalone]

#1458051 — [PATCH 4.4 37/68] Revert "ecryptfs: forbid opening files without mmap handler"

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeff Mahoney <jeffm@suse.com>

commit 78c4e172412de5d0456dc00d2b34050aa0b683b5 upstream.

This reverts commit 2f36db71009304b3f0b95afacd8eba1f9f046b87.

It fixed a local root exploit but also introduced a dependency on
the lower file system implementing an mmap operation just to open a file,
which is a bit of a heavy hammer.  The right fix is to have mmap depend
on the existence of the mmap handler instead.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ecryptfs/kthread.c |   13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -25,7 +25,6 @@
 #include <linux/slab.h>
 #include <linux/wait.h>
 #include <linux/mount.h>
-#include <linux/file.h>
 #include "ecryptfs_kernel.h"
 
 struct ecryptfs_open_req {
@@ -148,7 +147,7 @@ int ecryptfs_privileged_open(struct file
 	flags |= IS_RDONLY(d_inode(lower_dentry)) ? O_RDONLY : O_RDWR;
 	(*lower_file) = dentry_open(&req.path, flags, cred);
 	if (!IS_ERR(*lower_file))
-		goto have_file;
+		goto out;
 	if ((flags & O_ACCMODE) == O_RDONLY) {
 		rc = PTR_ERR((*lower_file));
 		goto out;
@@ -166,16 +165,8 @@ int ecryptfs_privileged_open(struct file
 	mutex_unlock(&ecryptfs_kthread_ctl.mux);
 	wake_up(&ecryptfs_kthread_ctl.wait);
 	wait_for_completion(&req.done);
-	if (IS_ERR(*lower_file)) {
+	if (IS_ERR(*lower_file))
 		rc = PTR_ERR(*lower_file);
-		goto out;
-	}
-have_file:
-	if ((*lower_file)->f_op->mmap == NULL) {
-		fput(*lower_file);
-		*lower_file = NULL;
-		rc = -EMEDIUMTYPE;
-	}
 out:
 	return rc;
 }

[toc] | [prev] | [next] | [standalone]

#1458054 — [PATCH 4.4 25/68] Input: vmmouse - remove port reservation

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sinclair Yeh <syeh@vmware.com>

commit 60842ef8128e7bf58c024814cd0dc14319232b6c upstream.

The VMWare EFI BIOS will expose port 0x5658 as an ACPI resource.  This
causes the port to be reserved by the APCI module as the system comes up,
making it unavailable to be reserved again by other drivers, thus
preserving this VMWare port for special use in a VMWare guest.

This port is designed to be shared among multiple VMWare services, such as
the VMMOUSE.  Because of this, VMMOUSE should not try to reserve this port
on its own.

The VMWare non-EFI BIOS does not do this to preserve compatibility with
existing/legacy VMs.  It is known that there is small chance a VM may be
configured such that these ports get reserved by other non-VMWare devices,
and if this ever happens, the result is undefined.

Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/mouse/vmmouse.c |   22 ++--------------------
 1 file changed, 2 insertions(+), 20 deletions(-)

--- a/drivers/input/mouse/vmmouse.c
+++ b/drivers/input/mouse/vmmouse.c
@@ -355,18 +355,11 @@ int vmmouse_detect(struct psmouse *psmou
 		return -ENXIO;
 	}
 
-	if (!request_region(VMMOUSE_PROTO_PORT, 4, "vmmouse")) {
-		psmouse_dbg(psmouse, "VMMouse port in use.\n");
-		return -EBUSY;
-	}
-
 	/* Check if the device is present */
 	response = ~VMMOUSE_PROTO_MAGIC;
 	VMMOUSE_CMD(GETVERSION, 0, version, response, dummy1, dummy2);
-	if (response != VMMOUSE_PROTO_MAGIC || version == 0xffffffffU) {
-		release_region(VMMOUSE_PROTO_PORT, 4);
+	if (response != VMMOUSE_PROTO_MAGIC || version == 0xffffffffU)
 		return -ENXIO;
-	}
 
 	if (set_properties) {
 		psmouse->vendor = VMMOUSE_VENDOR;
@@ -374,8 +367,6 @@ int vmmouse_detect(struct psmouse *psmou
 		psmouse->model = version;
 	}
 
-	release_region(VMMOUSE_PROTO_PORT, 4);
-
 	return 0;
 }
 
@@ -394,7 +385,6 @@ static void vmmouse_disconnect(struct ps
 	psmouse_reset(psmouse);
 	input_unregister_device(priv->abs_dev);
 	kfree(priv);
-	release_region(VMMOUSE_PROTO_PORT, 4);
 }
 
 /**
@@ -438,15 +428,10 @@ int vmmouse_init(struct psmouse *psmouse
 	struct input_dev *rel_dev = psmouse->dev, *abs_dev;
 	int error;
 
-	if (!request_region(VMMOUSE_PROTO_PORT, 4, "vmmouse")) {
-		psmouse_dbg(psmouse, "VMMouse port in use.\n");
-		return -EBUSY;
-	}
-
 	psmouse_reset(psmouse);
 	error = vmmouse_enable(psmouse);
 	if (error)
-		goto release_region;
+		return error;
 
 	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
 	abs_dev = input_allocate_device();
@@ -502,8 +487,5 @@ init_fail:
 	kfree(priv);
 	psmouse->private = NULL;
 
-release_region:
-	release_region(VMMOUSE_PROTO_PORT, 4);
-
 	return error;
 }

[toc] | [prev] | [next] | [standalone]

#1458056 — [PATCH 4.4 49/68] sched/fair: Fix effective_load() to consistently use smoothed load

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <peterz@infradead.org>

commit 7dd4912594daf769a46744848b05bd5bc6d62469 upstream.

Starting with the following commit:

  fde7d22e01aa ("sched/fair: Fix overly small weight for interactive group entities")

calc_tg_weight() doesn't compute the right value as expected by effective_load().

The difference is in the 'correction' term. In order to ensure \Sum
rw_j >= rw_i we cannot use tg->load_avg directly, since that might be
lagging a correction on the current cfs_rq->avg.load_avg value.
Therefore we use tg->load_avg - cfs_rq->tg_load_avg_contrib +
cfs_rq->avg.load_avg.

Now, per the referenced commit, calc_tg_weight() doesn't use
cfs_rq->avg.load_avg, as is later used in @w, but uses
cfs_rq->load.weight instead.

So stop using calc_tg_weight() and do it explicitly.

The effects of this bug are wake_affine() making randomly
poor choices in cgroup-intense workloads.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: fde7d22e01aa ("sched/fair: Fix overly small weight for interactive group entities")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/sched/fair.c |   15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -687,8 +687,6 @@ void init_entity_runnable_average(struct
 	/* when this task enqueue'ed, it will contribute to its cfs_rq's load_avg */
 }
 
-static inline unsigned long cfs_rq_runnable_load_avg(struct cfs_rq *cfs_rq);
-static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq);
 #else
 void init_entity_runnable_average(struct sched_entity *se)
 {
@@ -4594,19 +4592,24 @@ static long effective_load(struct task_g
 		return wl;
 
 	for_each_sched_entity(se) {
-		long w, W;
+		struct cfs_rq *cfs_rq = se->my_q;
+		long W, w = cfs_rq_load_avg(cfs_rq);
 
-		tg = se->my_q->tg;
+		tg = cfs_rq->tg;
 
 		/*
 		 * W = @wg + \Sum rw_j
 		 */
-		W = wg + calc_tg_weight(tg, se->my_q);
+		W = wg + atomic_long_read(&tg->load_avg);
+
+		/* Ensure \Sum rw_j >= rw_i */
+		W -= cfs_rq->tg_load_avg_contrib;
+		W += w;
 
 		/*
 		 * w = rw_i + @wl
 		 */
-		w = cfs_rq_load_avg(se->my_q) + wl;
+		w += wl;
 
 		/*
 		 * wl = S * s'_i; see (2)

[toc] | [prev] | [next] | [standalone]

#1458057 — [PATCH 4.4 21/68] xenbus: dont bail early from xenbus_dev_request_and_reply()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Beulich <JBeulich@suse.com>

commit 7469be95a487319514adce2304ad2af3553d2fc9 upstream.

xenbus_dev_request_and_reply() needs to track whether a transaction is
open.  For XS_TRANSACTION_START messages it calls transaction_start()
and for XS_TRANSACTION_END messages it calls transaction_end().

If sending an XS_TRANSACTION_START message fails or responds with an
an error, the transaction is not open and transaction_end() must be
called.

If sending an XS_TRANSACTION_END message fails, the transaction is
still open, but if an error response is returned the transaction is
closed.

Commit 027bd7e89906 ("xen/xenbus: Avoid synchronous wait on XenBus
stalling shutdown/restart") introduced a regression where failed
XS_TRANSACTION_START messages were leaving the transaction open.  This
can cause problems with suspend (and migration) as all transactions
must be closed before suspending.

It appears that the problematic change was added accidentally, so just
remove it.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/xenbus/xenbus_xs.c |    3 ---
 1 file changed, 3 deletions(-)

--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -250,9 +250,6 @@ void *xenbus_dev_request_and_reply(struc
 
 	mutex_unlock(&xs_state.request_mutex);
 
-	if (IS_ERR(ret))
-		return ret;
-
 	if ((msg->type == XS_TRANSACTION_END) ||
 	    ((req_msg.type == XS_TRANSACTION_START) &&
 	     (msg->type == XS_ERROR)))

[toc] | [prev] | [next] | [standalone]

#1458065 — [PATCH 4.4 28/68] Input: wacom_w8001 - w8001_MAX_LENGTH should be 13

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ping Cheng <pinglinux@gmail.com>

commit 12afb34400eb2b301f06b2aa3535497d14faee59 upstream.

Somehow the patch that added two-finger touch support forgot to update
W8001_MAX_LENGTH from 11 to 13.

Signed-off-by: Ping Cheng <pingc@wacom.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/touchscreen/wacom_w8001.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -27,7 +27,7 @@ MODULE_AUTHOR("Jaya Kumar <jayakumar.lkm
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
 
-#define W8001_MAX_LENGTH	11
+#define W8001_MAX_LENGTH	13
 #define W8001_LEAD_MASK		0x80
 #define W8001_LEAD_BYTE		0x80
 #define W8001_TAB_MASK		0x40

[toc] | [prev] | [next] | [standalone]

#1458069 — [PATCH 4.4 09/68] mm, compaction: abort free scanner if split fails

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Rientjes <rientjes@google.com>

commit a4f04f2c6955aff5e2c08dcb40aca247ff4d7370 upstream.

If the memory compaction free scanner cannot successfully split a free
page (only possible due to per-zone low watermark), terminate the free
scanner rather than continuing to scan memory needlessly.  If the
watermark is insufficient for a free page of order <= cc->order, then
terminate the scanner since all future splits will also likely fail.

This prevents the compaction freeing scanner from scanning all memory on
very large zones (very noticeable for zones > 128GB, for instance) when
all splits will likely fail while holding zone->lock.

compaction_alloc() iterating a 128GB zone has been benchmarked to take
over 400ms on some systems whereas any free page isolated and ready to
be split ends up failing in split_free_page() because of the low
watermark check and thus the iteration continues.

The next time compaction occurs, the freeing scanner will likely start
at the end of the zone again since no success was made previously and we
get the same lengthy iteration until the zone is brought above the low
watermark.  All thp page faults can take >400ms in such a state without
this fix.

Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1606211820350.97086@chino.kir.corp.google.com
Signed-off-by: David Rientjes <rientjes@google.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/compaction.c |   39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -475,25 +475,23 @@ static unsigned long isolate_freepages_b
 
 		/* Found a free page, break it into order-0 pages */
 		isolated = split_free_page(page);
+		if (!isolated)
+			break;
+
 		total_isolated += isolated;
+		cc->nr_freepages += isolated;
 		for (i = 0; i < isolated; i++) {
 			list_add(&page->lru, freelist);
 			page++;
 		}
-
-		/* If a page was split, advance to the end of it */
-		if (isolated) {
-			cc->nr_freepages += isolated;
-			if (!strict &&
-				cc->nr_migratepages <= cc->nr_freepages) {
-				blockpfn += isolated;
-				break;
-			}
-
-			blockpfn += isolated - 1;
-			cursor += isolated - 1;
-			continue;
+		if (!strict && cc->nr_migratepages <= cc->nr_freepages) {
+			blockpfn += isolated;
+			break;
 		}
+		/* Advance to the end of split page */
+		blockpfn += isolated - 1;
+		cursor += isolated - 1;
+		continue;
 
 isolate_fail:
 		if (strict)
@@ -503,6 +501,9 @@ isolate_fail:
 
 	}
 
+	if (locked)
+		spin_unlock_irqrestore(&cc->zone->lock, flags);
+
 	/*
 	 * There is a tiny chance that we have read bogus compound_order(),
 	 * so be careful to not go outside of the pageblock.
@@ -524,9 +525,6 @@ isolate_fail:
 	if (strict && blockpfn < end_pfn)
 		total_isolated = 0;
 
-	if (locked)
-		spin_unlock_irqrestore(&cc->zone->lock, flags);
-
 	/* Update the pageblock-skip if the whole pageblock was scanned */
 	if (blockpfn == end_pfn)
 		update_pageblock_skip(cc, valid_page, total_isolated, false);
@@ -966,6 +964,7 @@ static void isolate_freepages(struct com
 				block_end_pfn = block_start_pfn,
 				block_start_pfn -= pageblock_nr_pages,
 				isolate_start_pfn = block_start_pfn) {
+		unsigned long isolated;
 
 		/*
 		 * This can iterate a massively long zone without finding any
@@ -990,8 +989,12 @@ static void isolate_freepages(struct com
 			continue;
 
 		/* Found a block suitable for isolating free pages from. */
-		isolate_freepages_block(cc, &isolate_start_pfn,
-					block_end_pfn, freelist, false);
+		isolated = isolate_freepages_block(cc, &isolate_start_pfn,
+						block_end_pfn, freelist, false);
+		/* If isolation failed early, do not continue needlessly */
+		if (!isolated && isolate_start_pfn < block_end_pfn &&
+		    cc->nr_migratepages > cc->nr_freepages)
+			break;
 
 		/*
 		 * If we isolated enough freepages, or aborted due to async

[toc] | [prev] | [next] | [standalone]

#1458070 — [PATCH 4.4 07/68] dmaengine: at_xdmac: double FIFO flush needed to compute residue

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ludovic Desroches <ludovic.desroches@atmel.com>

commit 9295c41d77ca93aac79cfca6fa09fa1ca5cab66f upstream.

Due to the way CUBC register is updated, a double flush is needed to
compute an accurate residue. First flush aim is to get data from the DMA
FIFO and second one ensures that we won't report data which are not in
memory.

Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel
eXtended DMA Controller driver")
Reviewed-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma/at_xdmac.c |   24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -1413,7 +1413,16 @@ at_xdmac_tx_status(struct dma_chan *chan
 	residue = desc->xfer_size;
 	/*
 	 * Flush FIFO: only relevant when the transfer is source peripheral
-	 * synchronized.
+	 * synchronized. Flush is needed before reading CUBC because data in
+	 * the FIFO are not reported by CUBC. Reporting a residue of the
+	 * transfer length while we have data in FIFO can cause issue.
+	 * Usecase: atmel USART has a timeout which means I have received
+	 * characters but there is no more character received for a while. On
+	 * timeout, it requests the residue. If the data are in the DMA FIFO,
+	 * we will return a residue of the transfer length. It means no data
+	 * received. If an application is waiting for these data, it will hang
+	 * since we won't have another USART timeout without receiving new
+	 * data.
 	 */
 	mask = AT_XDMAC_CC_TYPE | AT_XDMAC_CC_DSYNC;
 	value = AT_XDMAC_CC_TYPE_PER_TRAN | AT_XDMAC_CC_DSYNC_PER2MEM;
@@ -1469,6 +1478,19 @@ at_xdmac_tx_status(struct dma_chan *chan
 	}
 
 	/*
+	 * Flush FIFO: only relevant when the transfer is source peripheral
+	 * synchronized. Another flush is needed here because CUBC is updated
+	 * when the controller sends the data write command. It can lead to
+	 * report data that are not written in the memory or the device. The
+	 * FIFO flush ensures that data are really written.
+	 */
+	if ((desc->lld.mbr_cfg & mask) == value) {
+		at_xdmac_write(atxdmac, AT_XDMAC_GSWF, atchan->mask);
+		while (!(at_xdmac_chan_read(atchan, AT_XDMAC_CIS) & AT_XDMAC_CIS_FIS))
+			cpu_relax();
+	}
+
+	/*
 	 * Remove size of all microblocks already transferred and the current
 	 * one. Then add the remaining size to transfer of the current
 	 * microblock.

[toc] | [prev] | [next] | [standalone]

Page 1 of 4  [1] 2 3 4  Next page →

Back to top | Article view | linux.kernel

csiph-web