Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1610698 > unrolled thread

[PATCH 4.9 00/88] 4.9.19-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.9 00/88] 4.9.19-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 23/88] Input: iforce - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 21/88] Input: elan_i2c - add ASUS EeeBook X205TA special touchpad fw Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 44/88] USB: usbtmc: add missing endpoint sanity check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 79/88] intel_th: Dont leak module refcount on failure to activate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 43/88] usb: hub: Fix crash after failure to read BOS descriptor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 67/88] xen/acpi: upload PM state from init-domain to Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 82/88] libceph: dont set weight to IN when OSD is destroyed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 22/88] Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 72/88] cpufreq: Restore policy min/max limits on CPU online Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 24/88] Input: ims-pcu - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 01/88] net/openvswitch: Set the ipv6 source tunnel key address attribute correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 47/88] uwb: hwa-rc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 50/88] iio: sw-device: Fix config group initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 17/88] socket, bpf: fix sk_filter use after free in sk_clone_lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 41/88] USB: wusbcore: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 42/88] usb: musb: cppi41: dont check early-TX-interrupt for Isoch transfer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 39/88] USB: lvtest: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 56/88] powerpc/64s: Fix idle wakeup potential to clobber registers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 86/88] drm: reference count event->completion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 85/88] nl80211: fix dumpit error path RTNL deadlocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 10/88] net/mlx5e: Use the proper UAPI values when offloading TC vlan actions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 31/88] ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 53/88] parport: fix attempt to write duplicate procfiles Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 32/88] ALSA: hda - Adding a group of pin definition to fix headset problem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 38/88] USB: uss720: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 28/88] Input: kbtab - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 81/88] Drivers: hv: vmbus: Dont leak memory when a channel is rescinded Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 30/88] ALSA: seq: Fix racy cell insertions during snd_seq_pool_done() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 88/88] crypto: algif_hash - avoid zero-sized array Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 55/88] ext4: lock the xattr block before checksuming it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 61/88] hwrng: amd - Revert managed API changes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.9 83/88] device-dax: fix pmd/pte fault fallback handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.9 45/88] USB: usbtmc: fix probe error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.9 84/88] drm/bridge: analogix dp: Fix runtime PM state on driver bind Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.9 62/88] hwrng: geode - Revert managed API changes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.9 87/88] fbcon: Fix vc attr at deinit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.9 66/88] crypto: ccp - Assign DMA commands to the channels CCP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.9 48/88] mmc: ushc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.9 46/88] uwb: i1480-dfu: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.9 80/88] Drivers: hv: vmbus: Dont leak channel ids Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.9 08/88] net: vrf: Reset rt6i_idev in local dst after put Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 71/88] arm64: kaslr: Fix up the kernel image alignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 06/88] net: unix: properly re-increment inflight counter of GC discarded candidates Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 63/88] clk: sunxi-ng: sun6i: Fix enable bit offset for hdmi-ddc module clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 59/88] mmc: sdhci: Do not disable interrupts while waiting for clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 51/88] iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 52/88] iio: magnetometer: ak8974: remove incorrect __exit markups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 05/88] openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 78/88] jbd2: dont leak memory if setting up journal fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 58/88] mmc: sdhci-of-arasan: fix incorrect timeout clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 54/88] ext4: mark inode dirty after converting inline directory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 73/88] cgroup, net_cls: iterate the fds of only the tasks which are being migrated Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 74/88] blk-mq: dont complete un-started request in timeout handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 40/88] USB: idmouse: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 64/88] clk: sunxi-ng: mp: Adjust parent rate for pre-dividers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 77/88] auxdisplay: img-ascii-lcd: add missing sentinel entry in img_ascii_lcd_matches Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 76/88] drm/amdgpu: reinstate oland workaround for sclk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 09/88] net/mlx5: Add missing entries for set/query rate limit commands Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 57/88] mmc: sdhci-of-at91: Support external regulators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 69/88] Revert "ARM: at91/dt: sama5d2: Use new compatible for ohci node" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 65/88] mwifiex: pcie: dont leak DMA buffers when removing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 68/88] iommu/vt-d: Fix NULL pointer dereference in device_to_iommu Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 37/88] usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 70/88] ARM: at91: pm: cpu_idle: switch DDR to power-down mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 49/88] iio: adc: ti_am335x_adc: fix fifo overrun recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
    [PATCH 4.9 75/88] libceph: force GFP_NOIO for socket allocations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:10 +0200
      Re: [PATCH 4.9 75/88] libceph: force GFP_NOIO for socket allocations Michal Hocko <mhocko@kernel.org> - 2017-03-29 10:20 +0200
    [PATCH 4.9 14/88] ipv6: make sure to initialize sockc.tsflags before first use Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 16/88] ipv4: provide stronger user input validation in nl_fib_input() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 02/88] net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 25/88] Input: hanwang - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 15/88] net: bcmgenet: remove bcmgenet_internal_phy_setup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 04/88] amd-xgbe: Fix jumbo MTU processing on newer hardware Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 36/88] usb: gadget: f_uvc: Fix SuperSpeed companion descriptors wBytesPerInterval Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 29/88] Input: sur40 - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 03/88] net: properly release sk_frag.page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 26/88] Input: yealink - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 12/88] net/mlx5e: Count GSO packets correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 13/88] net/mlx5e: Count LRO packets correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 33/88] USB: serial: option: add Quectel UC15, UC20, EC21, and EC25 modems Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 20/88] Input: ALPS - fix trackstick button handling on V8 devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 18/88] tcp: initialize icsk_ack.lrcvtime at session start time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 19/88] Input: ALPS - fix V8+ protocol handling (73 03 28) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.9 11/88] net/mlx5: Increase number of max QPs in default profile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    Re: [PATCH 4.9 00/88] 4.9.19-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-03-28 21:50 +0200
    Re: [PATCH 4.9 00/88] 4.9.19-stable review Guenter Roeck <linux@roeck-us.net> - 2017-03-29 06:50 +0200
    Re: [PATCH 4.9 00/88] 4.9.19-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-29 07:50 +0200

Page 1 of 5  [1] 2 3 4 5  Next page →

#1610698 — [PATCH 4.9 00/88] 4.9.19-stable review

This is the start of the stable review cycle for the 4.9.19 release.
There are 88 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu Mar 30 12:27:29 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.19-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.9.19-rc1

Jiri Slaby <jslaby@suse.cz>
    crypto: algif_hash - avoid zero-sized array

Takashi Iwai <tiwai@suse.de>
    fbcon: Fix vc attr at deinit

Daniel Vetter <daniel.vetter@ffwll.ch>
    drm: reference count event->completion

Johannes Berg <johannes.berg@intel.com>
    nl80211: fix dumpit error path RTNL deadlocks

Marek Szyprowski <m.szyprowski@samsung.com>
    drm/bridge: analogix dp: Fix runtime PM state on driver bind

Dave Jiang <dave.jiang@intel.com>
    device-dax: fix pmd/pte fault fallback handling

Ilya Dryomov <idryomov@gmail.com>
    libceph: don't set weight to IN when OSD is destroyed

K. Y. Srinivasan <kys@microsoft.com>
    Drivers: hv: vmbus: Don't leak memory when a channel is rescinded

K. Y. Srinivasan <kys@microsoft.com>
    Drivers: hv: vmbus: Don't leak channel ids

Alexander Shishkin <alexander.shishkin@linux.intel.com>
    intel_th: Don't leak module refcount on failure to activate

Eric Biggers <ebiggers@google.com>
    jbd2: don't leak memory if setting up journal fails

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    auxdisplay: img-ascii-lcd: add missing sentinel entry in img_ascii_lcd_matches

Alex Deucher <alexander.deucher@amd.com>
    drm/amdgpu: reinstate oland workaround for sclk

Ilya Dryomov <idryomov@gmail.com>
    libceph: force GFP_NOIO for socket allocations

Ming Lei <tom.leiming@gmail.com>
    blk-mq: don't complete un-started request in timeout handler

Tejun Heo <tj@kernel.org>
    cgroup, net_cls: iterate the fds of only the tasks which are being migrated

Viresh Kumar <viresh.kumar@linaro.org>
    cpufreq: Restore policy min/max limits on CPU online

Neeraj Upadhyay <neeraju@codeaurora.org>
    arm64: kaslr: Fix up the kernel image alignment

Nicolas Ferre <nicolas.ferre@microchip.com>
    ARM: at91: pm: cpu_idle: switch DDR to power-down mode

Romain Izard <romain.izard.pro@gmail.com>
    Revert "ARM: at91/dt: sama5d2: Use new compatible for ohci node"

Koos Vriezen <koos.vriezen@gmail.com>
    iommu/vt-d: Fix NULL pointer dereference in device_to_iommu

Ankur Arora <ankur.a.arora@oracle.com>
    xen/acpi: upload PM state from init-domain to Xen

Gary R Hook <ghook@amd.com>
    crypto: ccp - Assign DMA commands to the channel's CCP

Brian Norris <briannorris@chromium.org>
    mwifiex: pcie: don't leak DMA buffers when removing

Chen-Yu Tsai <wens@csie.org>
    clk: sunxi-ng: mp: Adjust parent rate for pre-dividers

Chen-Yu Tsai <wens@csie.org>
    clk: sunxi-ng: sun6i: Fix enable bit offset for hdmi-ddc module clock

Prarit Bhargava <prarit@redhat.com>
    hwrng: geode - Revert managed API changes

Prarit Bhargava <prarit@redhat.com>
    hwrng: amd - Revert managed API changes

Adrian Hunter <adrian.hunter@intel.com>
    mmc: sdhci-pci: Do not disable interrupts in sdhci_intel_set_power

Adrian Hunter <adrian.hunter@intel.com>
    mmc: sdhci: Do not disable interrupts while waiting for clock

Anssi Hannula <anssi.hannula@bitwise.fi>
    mmc: sdhci-of-arasan: fix incorrect timeout clock

Romain Izard <romain.izard.pro@gmail.com>
    mmc: sdhci-of-at91: Support external regulators

Nicholas Piggin <npiggin@gmail.com>
    powerpc/64s: Fix idle wakeup potential to clobber registers

Theodore Ts'o <tytso@mit.edu>
    ext4: lock the xattr block before checksuming it

Eric Biggers <ebiggers@google.com>
    ext4: mark inode dirty after converting inline directory

Sudip Mukherjee <sudipm.mukherjee@gmail.com>
    parport: fix attempt to write duplicate procfiles

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    iio: magnetometer: ak8974: remove incorrect __exit markups

Song Hongyan <hongyan.song@intel.com>
    iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3

Lars-Peter Clausen <lars@metafoo.de>
    iio: sw-device: Fix config group initialization

Michael Engl <michael.engl@wjw-solutions.com>
    iio: adc: ti_am335x_adc: fix fifo overrun recovery

Johan Hovold <johan@kernel.org>
    mmc: ushc: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    uwb: hwa-rc: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    uwb: i1480-dfu: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    USB: usbtmc: fix probe error path

Johan Hovold <johan@kernel.org>
    USB: usbtmc: add missing endpoint sanity check

Guenter Roeck <linux@roeck-us.net>
    usb: hub: Fix crash after failure to read BOS descriptor

Bin Liu <b-liu@ti.com>
    usb: musb: cppi41: don't check early-TX-interrupt for Isoch transfer

Johan Hovold <johan@kernel.org>
    USB: wusbcore: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    USB: idmouse: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    USB: lvtest: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    USB: uss720: fix NULL-deref at probe

Samuel Thibault <samuel.thibault@ens-lyon.org>
    usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk

Roger Quadros <rogerq@ti.com>
    usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval

Oliver Neukum <oneukum@suse.com>
    ACM gadget: fix endianness in notifications

Bjørn Mork <bjorn@mork.no>
    USB: serial: qcserial: add Dell DW5811e

Dan Williams <dcbw@redhat.com>
    USB: serial: option: add Quectel UC15, UC20, EC21, and EC25 modems

Hui Wang <hui.wang@canonical.com>
    ALSA: hda - Adding a group of pin definition to fix headset problem

Takashi Iwai <tiwai@suse.de>
    ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()

Johan Hovold <johan@kernel.org>
    Input: sur40 - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: kbtab - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: cm109 - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: yealink - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: hanwang - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: ims-pcu - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: iforce - validate number of endpoints before using them

Kai-Heng Feng <kai.heng.feng@canonical.com>
    Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000

Matjaz Hegedic <matjaz.hegedic@gmail.com>
    Input: elan_i2c - add ASUS EeeBook X205TA special touchpad fw

Masaki Ota <masaki.ota@jp.alps.com>
    Input: ALPS - fix trackstick button handling on V8 devices

Masaki Ota <masaki.ota@jp.alps.com>
    Input: ALPS - fix V8+ protocol handling (73 03 28)

Eric Dumazet <edumazet@google.com>
    tcp: initialize icsk_ack.lrcvtime at session start time

Daniel Borkmann <daniel@iogearbox.net>
    socket, bpf: fix sk_filter use after free in sk_clone_lock

Eric Dumazet <edumazet@google.com>
    ipv4: provide stronger user input validation in nl_fib_input()

Doug Berger <opendmb@gmail.com>
    net: bcmgenet: remove bcmgenet_internal_phy_setup()

Alexander Potapenko <glider@google.com>
    ipv6: make sure to initialize sockc.tsflags before first use

Gal Pressman <galp@mellanox.com>
    net/mlx5e: Count LRO packets correctly

Gal Pressman <galp@mellanox.com>
    net/mlx5e: Count GSO packets correctly

Maor Gottlieb <maorg@mellanox.com>
    net/mlx5: Increase number of max QPs in default profile

Or Gerlitz <ogerlitz@mellanox.com>
    net/mlx5e: Use the proper UAPI values when offloading TC vlan actions

Or Gerlitz <ogerlitz@mellanox.com>
    net/mlx5: Add missing entries for set/query rate limit commands

David Ahern <dsa@cumulusnetworks.com>
    net: vrf: Reset rt6i_idev in local dst after put

Bjørn Mork <bjorn@mork.no>
    qmi_wwan: add Dell DW5811e

Andrey Ulanov <andreyu@google.com>
    net: unix: properly re-increment inflight counter of GC discarded candidates

Kris Murphy <kriskend@linux.vnet.ibm.com>
    openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD

Lendacky, Thomas <Thomas.Lendacky@amd.com>
    amd-xgbe: Fix jumbo MTU processing on newer hardware

Eric Dumazet <edumazet@google.com>
    net: properly release sk_frag.page

Florian Fainelli <f.fainelli@gmail.com>
    net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled

Or Gerlitz <ogerlitz@mellanox.com>
    net/openvswitch: Set the ipv6 source tunnel key address attribute correctly


-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arm/boot/dts/sama5d2.dtsi                     |   2 +-
 arch/arm/mach-at91/pm.c                            |  18 ++-
 arch/arm64/kernel/kaslr.c                          |  10 +-
 arch/powerpc/kernel/idle_book3s.S                  |  20 +++-
 block/blk-mq.c                                     |  11 +-
 crypto/algif_hash.c                                |   2 +-
 drivers/auxdisplay/img-ascii-lcd.c                 |   1 +
 drivers/char/hw_random/amd-rng.c                   |  42 +++++--
 drivers/char/hw_random/geode-rng.c                 |  50 +++++---
 drivers/clk/sunxi-ng/ccu-sun6i-a31.c               |   2 +-
 drivers/clk/sunxi-ng/ccu_mp.c                      |   8 ++
 drivers/cpufreq/cpufreq.c                          |   3 +
 drivers/crypto/ccp/ccp-dev.c                       |   5 +-
 drivers/crypto/ccp/ccp-dmaengine.c                 |   1 +
 drivers/dax/dax.c                                  |  15 +++
 drivers/gpu/drm/amd/amdgpu/si_dpm.c                |  10 +-
 drivers/gpu/drm/bridge/analogix/analogix_dp_core.c |   7 ++
 drivers/gpu/drm/drm_atomic_helper.c                |  11 ++
 drivers/gpu/drm/drm_fops.c                         |   2 +-
 drivers/hv/channel.c                               |  13 +-
 drivers/hv/channel_mgmt.c                          |   1 +
 drivers/hwtracing/intel_th/core.c                  |   4 +-
 drivers/iio/adc/ti_am335x_adc.c                    |  13 +-
 .../iio/common/hid-sensors/hid-sensor-trigger.c    |   6 +-
 drivers/iio/magnetometer/ak8974.c                  |   4 +-
 drivers/input/joystick/iforce/iforce-usb.c         |   3 +
 drivers/input/misc/cm109.c                         |   4 +
 drivers/input/misc/ims-pcu.c                       |   4 +
 drivers/input/misc/yealink.c                       |   4 +
 drivers/input/mouse/alps.c                         |  72 +++++++----
 drivers/input/mouse/alps.h                         |  11 ++
 drivers/input/mouse/elan_i2c_core.c                |  20 ++--
 drivers/input/serio/i8042-x86ia64io.h              |   7 ++
 drivers/input/tablet/hanwang.c                     |   3 +
 drivers/input/tablet/kbtab.c                       |   3 +
 drivers/input/touchscreen/sur40.c                  |   3 +
 drivers/iommu/intel-iommu.c                        |   2 +-
 drivers/mmc/host/sdhci-of-arasan.c                 |  14 +--
 drivers/mmc/host/sdhci-of-at91.c                   |  19 +++
 drivers/mmc/host/sdhci-pci-core.c                  |   4 +
 drivers/mmc/host/sdhci.c                           |   4 +-
 drivers/mmc/host/ushc.c                            |   3 +
 drivers/net/ethernet/amd/xgbe/xgbe-common.h        |   6 +-
 drivers/net/ethernet/amd/xgbe/xgbe-dev.c           |  20 ++--
 drivers/net/ethernet/amd/xgbe/xgbe-drv.c           | 102 ++++++++++------
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |   6 +-
 drivers/net/ethernet/broadcom/genet/bcmmii.c       |  15 ---
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      |   4 +
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c    |   4 +
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c    |   6 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_tx.c    |   5 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   2 +-
 drivers/net/usb/qmi_wwan.c                         |   2 +
 drivers/net/vrf.c                                  |   4 +-
 drivers/net/wireless/marvell/mwifiex/pcie.c        |  41 ++++---
 drivers/parport/share.c                            |   6 +-
 drivers/usb/class/usbtmc.c                         |  18 ++-
 drivers/usb/core/config.c                          |  10 ++
 drivers/usb/core/hub.c                             |   2 +-
 drivers/usb/core/quirks.c                          |   8 ++
 drivers/usb/gadget/function/f_acm.c                |   4 +-
 drivers/usb/gadget/function/f_uvc.c                |   2 +-
 drivers/usb/misc/idmouse.c                         |   3 +
 drivers/usb/misc/lvstest.c                         |   4 +
 drivers/usb/misc/uss720.c                          |   5 +
 drivers/usb/musb/musb_cppi41.c                     |  23 +++-
 drivers/usb/serial/option.c                        |  17 ++-
 drivers/usb/serial/qcserial.c                      |   2 +
 drivers/usb/wusbcore/wa-hc.c                       |   3 +
 drivers/uwb/hwa-rc.c                               |   3 +
 drivers/uwb/i1480/dfu/usb.c                        |   3 +
 drivers/video/console/fbcon.c                      |  67 ++++++-----
 drivers/xen/xen-acpi-processor.c                   |  34 ++++--
 fs/ext4/inline.c                                   |   5 +-
 fs/ext4/xattr.c                                    |  65 +++++-----
 fs/jbd2/journal.c                                  |  22 ++--
 fs/jbd2/revoke.c                                   |   1 +
 include/drm/drmP.h                                 |   1 +
 include/linux/ccp.h                                |   2 +-
 include/linux/iio/sw_device.h                      |   2 +-
 include/linux/usb/quirks.h                         |   6 +
 net/ceph/messenger.c                               |   6 +
 net/ceph/osdmap.c                                  |   1 -
 net/core/netclassid_cgroup.c                       |  32 ++---
 net/core/sock.c                                    |  16 ++-
 net/ipv4/fib_frontend.c                            |   3 +-
 net/ipv4/tcp_input.c                               |   2 +-
 net/ipv4/tcp_minisocks.c                           |   1 +
 net/ipv6/udp.c                                     |   2 +-
 net/openvswitch/flow_netlink.c                     |   4 +-
 net/unix/garbage.c                                 |  17 +--
 net/wireless/nl80211.c                             | 133 ++++++++++-----------
 sound/core/seq/seq_clientmgr.c                     |   1 +
 sound/core/seq/seq_fifo.c                          |   3 +
 sound/core/seq/seq_memory.c                        |  17 ++-
 sound/core/seq/seq_memory.h                        |   1 +
 sound/pci/ctxfi/cthw20k1.c                         |   2 +-
 sound/pci/hda/patch_realtek.c                      |   2 +
 99 files changed, 819 insertions(+), 404 deletions(-)

[toc] | [next] | [standalone]

#1610699 — [PATCH 4.9 23/88] Input: iforce - validate number of endpoints before using them

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 59cf8bed44a79ec42303151dd014fdb6434254bb upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory that lie beyond the end of the endpoint
array should a malicious device lack the expected endpoints.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/joystick/iforce/iforce-usb.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -141,6 +141,9 @@ static int iforce_usb_probe(struct usb_i
 
 	interface = intf->cur_altsetting;
 
+	if (interface->desc.bNumEndpoints < 2)
+		return -ENODEV;
+
 	epirq = &interface->endpoint[0].desc;
 	epout = &interface->endpoint[1].desc;
 

[toc] | [prev] | [next] | [standalone]

#1610700 — [PATCH 4.9 21/88] Input: elan_i2c - add ASUS EeeBook X205TA special touchpad fw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matjaz Hegedic <matjaz.hegedic@gmail.com>

commit 92ef6f97a66e580189a41a132d0f8a9f78d6ddce upstream.

EeeBook X205TA is yet another ASUS device with a special touchpad
firmware that needs to be accounted for during initialization, or
else the touchpad will go into an invalid state upon suspend/resume.
Adding the appropriate ic_type and product_id check fixes the problem.

Signed-off-by: Matjaz Hegedic <matjaz.hegedic@gmail.com>
Acked-by: KT Liao <kt.liao@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/mouse/elan_i2c_core.c |   20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -218,17 +218,19 @@ static int elan_query_product(struct ela
 
 static int elan_check_ASUS_special_fw(struct elan_tp_data *data)
 {
-	if (data->ic_type != 0x0E)
-		return false;
-
-	switch (data->product_id) {
-	case 0x05 ... 0x07:
-	case 0x09:
-	case 0x13:
+	if (data->ic_type == 0x0E) {
+		switch (data->product_id) {
+		case 0x05 ... 0x07:
+		case 0x09:
+		case 0x13:
+			return true;
+		}
+	} else if (data->ic_type == 0x08 && data->product_id == 0x26) {
+		/* ASUS EeeBook X205TA */
 		return true;
-	default:
-		return false;
 	}
+
+	return false;
 }
 
 static int __elan_initialize(struct elan_tp_data *data)

[toc] | [prev] | [next] | [standalone]

#1610703 — [PATCH 4.9 44/88] USB: usbtmc: add missing endpoint sanity check

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 687e0687f71ec00e0132a21fef802dee88c2f1ad upstream.

USBTMC devices are required to have a bulk-in and a bulk-out endpoint,
but the driver failed to verify this, something which could lead to the
endpoint addresses being taken from uninitialised memory.

Make sure to zero all private data as part of allocation, and add the
missing endpoint sanity check.

Note that this also addresses a more recently introduced issue, where
the interrupt-in-presence flag would also be uninitialised whenever the
optional interrupt-in endpoint is not present. This in turn could lead
to an interrupt urb being allocated, initialised and submitted based on
uninitialised values.

Fixes: dbf3e7f654c0 ("Implement an ioctl to support the USMTMC-USB488 READ_STATUS_BYTE operation.")
Fixes: 5b775f672cc9 ("USB: add USB test and measurement class driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/class/usbtmc.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1380,7 +1380,7 @@ static int usbtmc_probe(struct usb_inter
 
 	dev_dbg(&intf->dev, "%s called\n", __func__);
 
-	data = kmalloc(sizeof(*data), GFP_KERNEL);
+	data = kzalloc(sizeof(*data), GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
 
@@ -1443,6 +1443,13 @@ static int usbtmc_probe(struct usb_inter
 			break;
 		}
 	}
+
+	if (!data->bulk_out || !data->bulk_in) {
+		dev_err(&intf->dev, "bulk endpoints not found\n");
+		retcode = -ENODEV;
+		goto err_put;
+	}
+
 	/* Find int endpoint */
 	for (n = 0; n < iface_desc->desc.bNumEndpoints; n++) {
 		endpoint = &iface_desc->endpoint[n].desc;
@@ -1511,6 +1518,7 @@ error_register:
 	sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
 	sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
 	usbtmc_free_int(data);
+err_put:
 	kref_put(&data->kref, usbtmc_delete);
 	return retcode;
 }

[toc] | [prev] | [next] | [standalone]

#1610705 — [PATCH 4.9 79/88] intel_th: Dont leak module refcount on failure to activate

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexander Shishkin <alexander.shishkin@linux.intel.com>

commit e609ccef5222c73b46b322be7d3796d60bff353d upstream.

Output 'activation' may fail for the reasons of the output driver,
for example, if msc's buffer is not allocated. We forget, however,
to drop the module reference in this case. So each attempt at
activation in this case leaks a reference, preventing the module
from ever unloading.

This patch adds the missing module_put() in the activation error
path.

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwtracing/intel_th/core.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -218,8 +218,10 @@ static int intel_th_output_activate(stru
 	else
 		intel_th_trace_enable(thdev);
 
-	if (ret)
+	if (ret) {
 		pm_runtime_put(&thdev->dev);
+		module_put(thdrv->driver.owner);
+	}
 
 	return ret;
 }

[toc] | [prev] | [next] | [standalone]

#1610706 — [PATCH 4.9 43/88] usb: hub: Fix crash after failure to read BOS descriptor

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <linux@roeck-us.net>

commit 7b2db29fbb4e766fcd02207eb2e2087170bd6ebc upstream.

If usb_get_bos_descriptor() returns an error, usb->bos will be NULL.
Nevertheless, it is dereferenced unconditionally in
hub_set_initial_usb2_lpm_policy() if usb2_hw_lpm_capable is set.
This results in a crash.

usb 5-1: unable to get BOS descriptor
...
Unable to handle kernel NULL pointer dereference at virtual address 00000008
pgd = ffffffc00165f000
[00000008] *pgd=000000000174f003, *pud=000000000174f003,
		*pmd=0000000001750003, *pte=00e8000001751713
Internal error: Oops: 96000005 [#1] PREEMPT SMP
Modules linked in: uinput uvcvideo videobuf2_vmalloc cmac [ ... ]
CPU: 5 PID: 3353 Comm: kworker/5:3 Tainted: G    B 4.4.52 #480
Hardware name: Google Kevin (DT)
Workqueue: events driver_set_config_work
task: ffffffc0c3690000 ti: ffffffc0ae9a8000 task.ti: ffffffc0ae9a8000
PC is at hub_port_init+0xc3c/0xd10
LR is at hub_port_init+0xc3c/0xd10
...
Call trace:
[<ffffffc0007fbbfc>] hub_port_init+0xc3c/0xd10
[<ffffffc0007fbe2c>] usb_reset_and_verify_device+0x15c/0x82c
[<ffffffc0007fc5e0>] usb_reset_device+0xe4/0x298
[<ffffffbffc0e3fcc>] rtl8152_probe+0x84/0x9b0 [r8152]
[<ffffffc00080ca8c>] usb_probe_interface+0x244/0x2f8
[<ffffffc000774a24>] driver_probe_device+0x180/0x3b4
[<ffffffc000774e48>] __device_attach_driver+0xb4/0xe0
[<ffffffc000772168>] bus_for_each_drv+0xb4/0xe4
[<ffffffc0007747ec>] __device_attach+0xd0/0x158
[<ffffffc000775080>] device_initial_probe+0x24/0x30
[<ffffffc0007739d4>] bus_probe_device+0x50/0xe4
[<ffffffc000770bd0>] device_add+0x414/0x738
[<ffffffc000809fe8>] usb_set_configuration+0x89c/0x914
[<ffffffc00080a120>] driver_set_config_work+0xc0/0xf0
[<ffffffc000249bb8>] process_one_work+0x390/0x6b8
[<ffffffc00024abcc>] worker_thread+0x480/0x610
[<ffffffc000251a80>] kthread+0x164/0x178
[<ffffffc0002045d0>] ret_from_fork+0x10/0x40

Since we don't know anything about LPM capabilities without BOS descriptor,
don't attempt to enable LPM if it is not available.

Fixes: 890dae886721 ("xhci: Enable LPM support only for hardwired ...")
Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/hub.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4266,7 +4266,7 @@ static void hub_set_initial_usb2_lpm_pol
 	struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent);
 	int connect_type = USB_PORT_CONNECT_TYPE_UNKNOWN;
 
-	if (!udev->usb2_hw_lpm_capable)
+	if (!udev->usb2_hw_lpm_capable || !udev->bos)
 		return;
 
 	if (hub)

[toc] | [prev] | [next] | [standalone]

#1610707 — [PATCH 4.9 67/88] xen/acpi: upload PM state from init-domain to Xen

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ankur Arora <ankur.a.arora@oracle.com>

commit 1914f0cd203c941bba72f9452c8290324f1ef3dc upstream.

This was broken in commit cd979883b9ed ("xen/acpi-processor:
fix enabling interrupts on syscore_resume"). do_suspend (from
xen/manage.c) and thus xen_resume_notifier never get called on
the initial-domain at resume (it is if running as guest.)

The rationale for the breaking change was that upload_pm_data()
potentially does blocking work in syscore_resume(). This patch
addresses the original issue by scheduling upload_pm_data() to
execute in workqueue context.

Cc: Stanislaw Gruszka <sgruszka@redhat.com>
Based-on-patch-by: Konrad Wilk <konrad.wilk@oracle.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Ankur Arora <ankur.a.arora@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/xen-acpi-processor.c |   34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -27,10 +27,10 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/syscore_ops.h>
 #include <linux/acpi.h>
 #include <acpi/processor.h>
 #include <xen/xen.h>
-#include <xen/xen-ops.h>
 #include <xen/interface/platform.h>
 #include <asm/xen/hypercall.h>
 
@@ -466,15 +466,33 @@ static int xen_upload_processor_pm_data(
 	return rc;
 }
 
-static int xen_acpi_processor_resume(struct notifier_block *nb,
-				     unsigned long action, void *data)
+static void xen_acpi_processor_resume_worker(struct work_struct *dummy)
 {
+	int rc;
+
 	bitmap_zero(acpi_ids_done, nr_acpi_bits);
-	return xen_upload_processor_pm_data();
+
+	rc = xen_upload_processor_pm_data();
+	if (rc != 0)
+		pr_info("ACPI data upload failed, error = %d\n", rc);
+}
+
+static void xen_acpi_processor_resume(void)
+{
+	static DECLARE_WORK(wq, xen_acpi_processor_resume_worker);
+
+	/*
+	 * xen_upload_processor_pm_data() calls non-atomic code.
+	 * However, the context for xen_acpi_processor_resume is syscore
+	 * with only the boot CPU online and in an atomic context.
+	 *
+	 * So defer the upload for some point safer.
+	 */
+	schedule_work(&wq);
 }
 
-struct notifier_block xen_acpi_processor_resume_nb = {
-	.notifier_call = xen_acpi_processor_resume,
+static struct syscore_ops xap_syscore_ops = {
+	.resume	= xen_acpi_processor_resume,
 };
 
 static int __init xen_acpi_processor_init(void)
@@ -527,7 +545,7 @@ static int __init xen_acpi_processor_ini
 	if (rc)
 		goto err_unregister;
 
-	xen_resume_notifier_register(&xen_acpi_processor_resume_nb);
+	register_syscore_ops(&xap_syscore_ops);
 
 	return 0;
 err_unregister:
@@ -544,7 +562,7 @@ static void __exit xen_acpi_processor_ex
 {
 	int i;
 
-	xen_resume_notifier_unregister(&xen_acpi_processor_resume_nb);
+	unregister_syscore_ops(&xap_syscore_ops);
 	kfree(acpi_ids_done);
 	kfree(acpi_id_present);
 	kfree(acpi_id_cst_present);

[toc] | [prev] | [next] | [standalone]

#1610709 — [PATCH 4.9 82/88] libceph: dont set weight to IN when OSD is destroyed

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ilya Dryomov <idryomov@gmail.com>

commit b581a5854eee4b7851dedb0f8c2ceb54fb902c06 upstream.

Since ceph.git commit 4e28f9e63644 ("osd/OSDMap: clear osd_info,
osd_xinfo on osd deletion"), weight is set to IN when OSD is deleted.
This changes the result of applying an incremental for clients, not
just OSDs.  Because CRUSH computations are obviously affected,
pre-4e28f9e63644 servers disagree with post-4e28f9e63644 clients on
object placement, resulting in misdirected requests.

Mirrors ceph.git commit a6009d1039a55e2c77f431662b3d6cc5a8e8e63f.

Fixes: 930c53286977 ("libceph: apply new_state before new_up_client on incrementals")
Link: http://tracker.ceph.com/issues/19122
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ceph/osdmap.c |    1 -
 1 file changed, 1 deletion(-)

--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1334,7 +1334,6 @@ static int decode_new_up_state_weight(vo
 		if ((map->osd_state[osd] & CEPH_OSD_EXISTS) &&
 		    (xorstate & CEPH_OSD_EXISTS)) {
 			pr_info("osd%d does not exist\n", osd);
-			map->osd_weight[osd] = CEPH_OSD_IN;
 			ret = set_primary_affinity(map, osd,
 						   CEPH_OSD_DEFAULT_PRIMARY_AFFINITY);
 			if (ret)

[toc] | [prev] | [next] | [standalone]

#1610710 — [PATCH 4.9 22/88] Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kai-Heng Feng <kai.heng.feng@canonical.com>

commit 45838660e34d90db8d4f7cbc8fd66e8aff79f4fe upstream.

The aux port does not get detected without noloop quirk, so external PS/2
mouse cannot work as result.

The PS/2 mouse can work with this quirk.

BugLink: https://bugs.launchpad.net/bugs/1591053
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Reviewed-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/serio/i8042-x86ia64io.h |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -120,6 +120,13 @@ static const struct dmi_system_id __init
 		},
 	},
 	{
+		/* Dell Embedded Box PC 3000 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Embedded Box PC 3000"),
+		},
+	},
+	{
 		/* OQO Model 01 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "OQO"),

[toc] | [prev] | [next] | [standalone]

#1610711 — [PATCH 4.9 72/88] cpufreq: Restore policy min/max limits on CPU online

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Viresh Kumar <viresh.kumar@linaro.org>

commit ff010472fb75670cb5c08671e820eeea3af59c87 upstream.

On CPU online the cpufreq core restores the previous governor (or
the previous "policy" setting for ->setpolicy drivers), but it does
not restore the min/max limits at the same time, which is confusing,
inconsistent and real pain for users who set the limits and then
suspend/resume the system (using full suspend), in which case the
limits are reset on all CPUs except for the boot one.

Fix this by making cpufreq_online() restore the limits when an inactive
policy is brought online.

The commit log and patch are inspired from Rafael's earlier work.

Reported-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/cpufreq/cpufreq.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1190,6 +1190,9 @@ static int cpufreq_online(unsigned int c
 		for_each_cpu(j, policy->related_cpus)
 			per_cpu(cpufreq_cpu_data, j) = policy;
 		write_unlock_irqrestore(&cpufreq_driver_lock, flags);
+	} else {
+		policy->min = policy->user_policy.min;
+		policy->max = policy->user_policy.max;
 	}
 
 	if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {

[toc] | [prev] | [next] | [standalone]

#1610712 — [PATCH 4.9 24/88] Input: ims-pcu - validate number of endpoints before using them

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 1916d319271664241b7aa0cd2b05e32bdb310ce9 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack control-interface endpoints.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/misc/ims-pcu.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1667,6 +1667,10 @@ static int ims_pcu_parse_cdc_data(struct
 		return -EINVAL;
 
 	alt = pcu->ctrl_intf->cur_altsetting;
+
+	if (alt->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	pcu->ep_ctrl = &alt->endpoint[0].desc;
 	pcu->max_ctrl_size = usb_endpoint_maxp(pcu->ep_ctrl);
 

[toc] | [prev] | [next] | [standalone]

#1610713 — [PATCH 4.9 01/88] net/openvswitch: Set the ipv6 source tunnel key address attribute correctly

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Or Gerlitz <ogerlitz@mellanox.com>


[ Upstream commit 3d20f1f7bd575d147ffa75621fa560eea0aec690 ]

When dealing with ipv6 source tunnel key address attribute
(OVS_TUNNEL_KEY_ATTR_IPV6_SRC) we are wrongly setting the tunnel
dst ip, fix that.

Fixes: 6b26ba3a7d95 ('openvswitch: netlink attributes for IPv6 tunneling')
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Reported-by: Paul Blakey <paulb@mellanox.com>
Acked-by: Jiri Benc <jbenc@redhat.com>
Acked-by: Joe Stringer <joe@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/openvswitch/flow_netlink.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -588,7 +588,7 @@ static int ip_tun_from_nlattr(const stru
 			ipv4 = true;
 			break;
 		case OVS_TUNNEL_KEY_ATTR_IPV6_SRC:
-			SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst,
+			SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src,
 					nla_get_in6_addr(a), is_mask);
 			ipv6 = true;
 			break;

[toc] | [prev] | [next] | [standalone]

#1610714 — [PATCH 4.9 47/88] uwb: hwa-rc: fix NULL-deref at probe

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit daf229b15907fbfdb6ee183aac8ca428cb57e361 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Note that the dereference happens in the start callback which is called
during probe.

Fixes: de520b8bd552 ("uwb: add HWA radio controller driver")
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Cc: David Vrabel <david.vrabel@csr.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/uwb/hwa-rc.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -823,6 +823,9 @@ static int hwarc_probe(struct usb_interf
 	struct hwarc *hwarc;
 	struct device *dev = &iface->dev;
 
+	if (iface->cur_altsetting->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	result = -ENOMEM;
 	uwb_rc = uwb_rc_alloc();
 	if (uwb_rc == NULL) {

[toc] | [prev] | [next] | [standalone]

#1610715 — [PATCH 4.9 50/88] iio: sw-device: Fix config group initialization

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lars-Peter Clausen <lars@metafoo.de>

commit c42f8218610aa09d7d3795e5810387673c1f84b6 upstream.

Use the IS_ENABLED() helper macro to ensure that the configfs group is
initialized either when configfs is built-in or when configfs is built as a
module. Otherwise software device creation will result in undefined
behaviour when configfs is built as a module since the configfs group for
the device not properly initialized.

Similar to commit b2f0c09664b7 ("iio: sw-trigger: Fix config group
initialization").

Fixes: 0f3a8c3f34f7 ("iio: Add support for creating IIO devices via configfs")
Reported-by: Miguel Robles <miguel.robles@farole.net>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Daniel Baluta <daniel.baluta@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/iio/sw_device.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/linux/iio/sw_device.h
+++ b/include/linux/iio/sw_device.h
@@ -62,7 +62,7 @@ void iio_swd_group_init_type_name(struct
 				  const char *name,
 				  struct config_item_type *type)
 {
-#ifdef CONFIG_CONFIGFS_FS
+#if IS_ENABLED(CONFIG_CONFIGFS_FS)
 	config_group_init_type_name(&d->group, name, type);
 #endif
 }

[toc] | [prev] | [next] | [standalone]

#1610716 — [PATCH 4.9 17/88] socket, bpf: fix sk_filter use after free in sk_clone_lock

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <daniel@iogearbox.net>


[ Upstream commit a97e50cc4cb67e1e7bff56f6b41cda62ca832336 ]

In sk_clone_lock(), we create a new socket and inherit most of the
parent's members via sock_copy() which memcpy()'s various sections.
Now, in case the parent socket had a BPF socket filter attached,
then newsk->sk_filter points to the same instance as the original
sk->sk_filter.

sk_filter_charge() is then called on the newsk->sk_filter to take a
reference and should that fail due to hitting max optmem, we bail
out and release the newsk instance.

The issue is that commit 278571baca2a ("net: filter: simplify socket
charging") wrongly combined the dismantle path with the failure path
of xfrm_sk_clone_policy(). This means, even when charging failed, we
call sk_free_unlock_clone() on the newsk, which then still points to
the same sk_filter as the original sk.

Thus, sk_free_unlock_clone() calls into __sk_destruct() eventually
where it tests for present sk_filter and calls sk_filter_uncharge()
on it, which potentially lets sk_omem_alloc wrap around and releases
the eBPF prog and sk_filter structure from the (still intact) parent.

Fix it by making sure that when sk_filter_charge() failed, we reset
newsk->sk_filter back to NULL before passing to sk_free_unlock_clone(),
so that we don't mess with the parents sk_filter.

Only if xfrm_sk_clone_policy() fails, we did reach the point where
either the parent's filter was NULL and as a result newsk's as well
or where we previously had a successful sk_filter_charge(), thus for
that case, we do need sk_filter_uncharge() to release the prior taken
reference on sk_filter.

Fixes: 278571baca2a ("net: filter: simplify socket charging")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/sock.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1538,6 +1538,12 @@ struct sock *sk_clone_lock(const struct
 			is_charged = sk_filter_charge(newsk, filter);
 
 		if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
+			/* We need to make sure that we don't uncharge the new
+			 * socket if we couldn't charge it in the first place
+			 * as otherwise we uncharge the parent's filter.
+			 */
+			if (!is_charged)
+				RCU_INIT_POINTER(newsk->sk_filter, NULL);
 			/* It is still raw copy of parent, so invalidate
 			 * destructor and make plain sk_free() */
 			newsk->sk_destruct = NULL;

[toc] | [prev] | [next] | [standalone]

#1610718 — [PATCH 4.9 41/88] USB: wusbcore: fix NULL-deref at probe

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 03ace948a4eb89d1cf51c06afdfc41ebca5fdb27 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

This specifically fixes the NULL-pointer dereference when probing HWA HC
devices.

Fixes: df3654236e31 ("wusb: add the Wire Adapter (WA) core")
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Cc: David Vrabel <david.vrabel@csr.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/wusbcore/wa-hc.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/wusbcore/wa-hc.c
+++ b/drivers/usb/wusbcore/wa-hc.c
@@ -39,6 +39,9 @@ int wa_create(struct wahc *wa, struct us
 	int result;
 	struct device *dev = &iface->dev;
 
+	if (iface->cur_altsetting->desc.bNumEndpoints < 3)
+		return -ENODEV;
+
 	result = wa_rpipes_create(wa);
 	if (result < 0)
 		goto error_rpipes_create;

[toc] | [prev] | [next] | [standalone]

#1610720 — [PATCH 4.9 42/88] usb: musb: cppi41: dont check early-TX-interrupt for Isoch transfer

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bin Liu <b-liu@ti.com>

commit 0090114d336a9604aa2d90bc83f20f7cd121b76c upstream.

The CPPI 4.1 driver polls register to workaround the premature TX
interrupt issue, but it causes audio playback underrun when triggered in
Isoch transfers.

Isoch doesn't do back-to-back transfers, the TX should be done by the
time the next transfer is scheduled. So skip this polling workaround for
Isoch transfer.

Fixes: a655f481d83d6 ("usb: musb: musb_cppi41: handle pre-mature TX complete interrupt")
Reported-by: Alexandre Bailon <abailon@baylibre.com>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Tested-by: Alexandre Bailon <abailon@baylibre.com>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/musb/musb_cppi41.c |   23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -232,8 +232,27 @@ static void cppi41_dma_callback(void *pr
 			transferred < cppi41_channel->packet_sz)
 		cppi41_channel->prog_len = 0;
 
-	if (cppi41_channel->is_tx)
-		empty = musb_is_tx_fifo_empty(hw_ep);
+	if (cppi41_channel->is_tx) {
+		u8 type;
+
+		if (is_host_active(musb))
+			type = hw_ep->out_qh->type;
+		else
+			type = hw_ep->ep_in.type;
+
+		if (type == USB_ENDPOINT_XFER_ISOC)
+			/*
+			 * Don't use the early-TX-interrupt workaround below
+			 * for Isoch transfter. Since Isoch are periodic
+			 * transfer, by the time the next transfer is
+			 * scheduled, the current one should be done already.
+			 *
+			 * This avoids audio playback underrun issue.
+			 */
+			empty = true;
+		else
+			empty = musb_is_tx_fifo_empty(hw_ep);
+	}
 
 	if (!cppi41_channel->is_tx || empty) {
 		cppi41_trans_done(cppi41_channel);

[toc] | [prev] | [next] | [standalone]

#1610721 — [PATCH 4.9 39/88] USB: lvtest: fix NULL-deref at probe

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 1dc56c52d2484be09c7398a5207d6b11a4256be9 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should the probed device lack endpoints.

Note that this driver does not bind to any devices by default.

Fixes: ce21bfe603b3 ("USB: Add LVS Test device driver")
Cc: Pratyush Anand <pratyush.anand@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/misc/lvstest.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/usb/misc/lvstest.c
+++ b/drivers/usb/misc/lvstest.c
@@ -366,6 +366,10 @@ static int lvs_rh_probe(struct usb_inter
 
 	hdev = interface_to_usbdev(intf);
 	desc = intf->cur_altsetting;
+
+	if (desc->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	endpoint = &desc->endpoint[0].desc;
 
 	/* valid only for SS root hub */

[toc] | [prev] | [next] | [standalone]

#1610722 — [PATCH 4.9 56/88] powerpc/64s: Fix idle wakeup potential to clobber registers

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicholas Piggin <npiggin@gmail.com>

commit 6d98ce0be541d4a3cfbb52cd75072c0339ebb500 upstream.

We concluded there may be a window where the idle wakeup code could get
to pnv_wakeup_tb_loss() (which clobbers non-volatile GPRs), but the
hardware may set SRR1[46:47] to 01b (no state loss) which would result
in the wakeup code failing to restore non-volatile GPRs.

I was not able to trigger this condition with trivial tests on real
hardware or simulator, but the ISA (at least 2.07) seems to allow for
it, and Gautham says that it can happen if there is an exception pending
when the sleep/winkle instruction is executed.

Fixes: 1706567117ba ("powerpc/kvm: make hypervisor state restore a function")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Acked-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kernel/idle_book3s.S |   20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -439,9 +439,23 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
 _GLOBAL(pnv_wakeup_tb_loss)
 	ld	r1,PACAR1(r13)
 	/*
-	 * Before entering any idle state, the NVGPRs are saved in the stack
-	 * and they are restored before switching to the process context. Hence
-	 * until they are restored, they are free to be used.
+	 * Before entering any idle state, the NVGPRs are saved in the stack.
+	 * If there was a state loss, or PACA_NAPSTATELOST was set, then the
+	 * NVGPRs are restored. If we are here, it is likely that state is lost,
+	 * but not guaranteed -- neither ISA207 nor ISA300 tests to reach
+	 * here are the same as the test to restore NVGPRS:
+	 * PACA_THREAD_IDLE_STATE test for ISA207, PSSCR test for ISA300,
+	 * and SRR1 test for restoring NVGPRs.
+	 *
+	 * We are about to clobber NVGPRs now, so set NAPSTATELOST to
+	 * guarantee they will always be restored. This might be tightened
+	 * with careful reading of specs (particularly for ISA300) but this
+	 * is already a slow wakeup path and it's simpler to be safe.
+	 */
+	li	r0,1
+	stb	r0,PACA_NAPSTATELOST(r13)
+
+	/*
 	 *
 	 * Save SRR1 and LR in NVGPRs as they might be clobbered in
 	 * opal_call() (called in CHECK_HMI_INTERRUPT). SRR1 is required

[toc] | [prev] | [next] | [standalone]

#1610724 — [PATCH 4.9 86/88] drm: reference count event->completion

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Vetter <daniel.vetter@ffwll.ch>

commit 24835e442f289813aa568d142a755672a740503c upstream.

When writing the generic nonblocking commit code I assumed that
through clever lifetime management I can assure that the completion
(stored in drm_crtc_commit) only gets freed after it is completed. And
that worked.

I also wanted to make nonblocking helpers resilient against driver
bugs, by having timeouts everywhere. And that worked too.

Unfortunately taking boths things together results in oopses :( Well,
at least sometimes: What seems to happen is that the drm event hangs
around forever stuck in limbo land. The nonblocking helpers eventually
time out, move on and release it. Now the bug I tested all this
against is drivers that just entirely fail to deliver the vblank
events like they should, and in those cases the event is simply
leaked. But what seems to happen, at least sometimes, on i915 is that
the event is set up correctly, but somohow the vblank fails to fire in
time. Which means the event isn't leaked, it's still there waiting for
eventually a vblank to fire. That tends to happen when re-enabling the
pipe, and then the trap springs and the kernel oopses.

The correct fix here is simply to refcount the crtc commit to make
sure that the event sticks around even for drivers which only
sometimes fail to deliver vblanks for some arbitrary reasons. Since
crtc commits are already refcounted that's easy to do.

References: https://bugs.freedesktop.org/show_bug.cgi?id=96781
Cc: Jim Rees <rees@umich.edu>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161221102331.31033-1-daniel.vetter@ffwll.ch
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_atomic_helper.c |   11 +++++++++++
 drivers/gpu/drm/drm_fops.c          |    2 +-
 include/drm/drmP.h                  |    1 +
 3 files changed, 13 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1382,6 +1382,15 @@ static int stall_checks(struct drm_crtc
 	return ret < 0 ? ret : 0;
 }
 
+void release_crtc_commit(struct completion *completion)
+{
+	struct drm_crtc_commit *commit = container_of(completion,
+						      typeof(*commit),
+						      flip_done);
+
+	drm_crtc_commit_put(commit);
+}
+
 /**
  * drm_atomic_helper_setup_commit - setup possibly nonblocking commit
  * @state: new modeset state to be committed
@@ -1474,6 +1483,8 @@ int drm_atomic_helper_setup_commit(struc
 		}
 
 		crtc_state->event->base.completion = &commit->flip_done;
+		crtc_state->event->base.completion_release = release_crtc_commit;
+		drm_crtc_commit_get(commit);
 	}
 
 	return 0;
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -686,8 +686,8 @@ void drm_send_event_locked(struct drm_de
 	assert_spin_locked(&dev->event_lock);
 
 	if (e->completion) {
-		/* ->completion might disappear as soon as it signalled. */
 		complete_all(e->completion);
+		e->completion_release(e->completion);
 		e->completion = NULL;
 	}
 
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -361,6 +361,7 @@ struct drm_ioctl_desc {
 /* Event queued up for userspace to read */
 struct drm_pending_event {
 	struct completion *completion;
+	void (*completion_release)(struct completion *completion);
 	struct drm_event *event;
 	struct fence *fence;
 	struct list_head link;

[toc] | [prev] | [next] | [standalone]

Page 1 of 5  [1] 2 3 4 5  Next page →

Back to top | Article view | linux.kernel

csiph-web