1. 02 Feb, 2017 1 commit
  2. 31 Jan, 2017 10 commits
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2017-01-31' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes · 52b679f6
      Dave Airlie authored
      2 patches to fix the oops Dave Hanse reported, plus a double kfree fix
      Maarten discovered while backporting the fix for Linus.
      
      For Linus' vma tracking oops the plan is to send you a dedicated pull with
      the 2 patches we need, but since it's tricky we're letting CI beat on it a
      bit more.
      
      * tag 'drm-misc-fixes-2017-01-31' of git://anongit.freedesktop.org/git/drm-misc:
        drm/atomic: Fix double free in drm_atomic_state_default_clear
        drm: Don't race connector registration
        drm: prevent double-(un)registration for connectors
      52b679f6
    • Dave Airlie's avatar
      Merge branch 'linux-4.10' of git://github.com/skeggsb/linux into drm-fixes · edc67410
      Dave Airlie authored
      Just a couple of minor race/regression fixes, nothing exciting, but
      somewhat important
      
      * 'linux-4.10' of git://github.com/skeggsb/linux:
        drm/nouveau/kms/nv50: request vblank events for commits that send completion events
        drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval
        drm/nouveau/disp/gt215: Fix HDA ELD handling (thus, HDMI audio) on gt215
        drm/nouveau/nouveau/led: prevent compiling the led-code if nouveau=y and leds=m
        drm/nouveau/disp/mcp7x: disable dptmds workaround
        drm/nouveau: prevent userspace from deleting client object
        drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers
      edc67410
    • Maarten Lankhorst's avatar
      drm/atomic: Fix double free in drm_atomic_state_default_clear · 92c715fc
      Maarten Lankhorst authored
      drm_atomic_helper_page_flip and drm_atomic_ioctl set their own events
      in crtc_state->event. But when it's set the event is freed in 2 places.
      
      Solve this by only freeing the event in the atomic ioctl when it
      allocated its own event.
      
      This has been broken twice. The first time when the code was introduced,
      but only in the corner case when an event is allocated, but more crtc's
      were included by atomic check and then failing. This can mostly
      happen when you do an atomic modeset in i915 and the display clock is
      changed, which forces all crtc's to be included to the state.
      
      This has been broken worse by adding in-fences support, which caused
      the double free to be done unconditionally.
      
      [IGT] kms_rotation_crc: starting subtest primary-rotation-180
      =============================================================================
      BUG kmalloc-128 (Tainted: G     U         ): Object already free
      -----------------------------------------------------------------------------
      
      Disabling lock debugging due to kernel taint
      INFO: Allocated in drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper] age=0 cpu=3 pid=1529
       ___slab_alloc+0x308/0x3b0
       __slab_alloc+0xd/0x20
       kmem_cache_alloc_trace+0x92/0x1c0
       drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper]
       intel_atomic_commit+0x35/0x4f0 [i915]
       drm_atomic_commit+0x46/0x50 [drm]
       drm_mode_atomic_ioctl+0x7d4/0xab0 [drm]
       drm_ioctl+0x2b3/0x490 [drm]
       do_vfs_ioctl+0x69c/0x700
       SyS_ioctl+0x4e/0x80
       entry_SYSCALL_64_fastpath+0x13/0x94
      INFO: Freed in drm_event_cancel_free+0xa3/0xb0 [drm] age=0 cpu=3 pid=1529
       __slab_free+0x48/0x2e0
       kfree+0x159/0x1a0
       drm_event_cancel_free+0xa3/0xb0 [drm]
       drm_mode_atomic_ioctl+0x86d/0xab0 [drm]
       drm_ioctl+0x2b3/0x490 [drm]
       do_vfs_ioctl+0x69c/0x700
       SyS_ioctl+0x4e/0x80
       entry_SYSCALL_64_fastpath+0x13/0x94
      INFO: Slab 0xffffde1f0997b080 objects=17 used=2 fp=0xffff92fb65ec2578 flags=0x200000000008101
      INFO: Object 0xffff92fb65ec2578 @offset=1400 fp=0xffff92fb65ec2ae8
      
      Redzone ffff92fb65ec2570: bb bb bb bb bb bb bb bb                          ........
      Object ffff92fb65ec2578: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      Object ffff92fb65ec2588: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      Object ffff92fb65ec2598: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      Object ffff92fb65ec25a8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      Object ffff92fb65ec25b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      Object ffff92fb65ec25c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      Object ffff92fb65ec25d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      Object ffff92fb65ec25e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  kkkkkkkkkkkkkkk.
      Redzone ffff92fb65ec25f8: bb bb bb bb bb bb bb bb                          ........
      Padding ffff92fb65ec2738: 5a 5a 5a 5a 5a 5a 5a 5a                          ZZZZZZZZ
      CPU: 3 PID: 180 Comm: kworker/3:2 Tainted: G    BU          4.10.0-rc6-patser+ #5039
      Hardware name:                  /NUC5PPYB, BIOS PYBSWCEL.86A.0031.2015.0601.1712 06/01/2015
      Workqueue: events intel_atomic_helper_free_state [i915]
      Call Trace:
       dump_stack+0x4d/0x6d
       print_trailer+0x20c/0x220
       free_debug_processing+0x1c6/0x330
       ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm]
       __slab_free+0x48/0x2e0
       ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm]
       kfree+0x159/0x1a0
       drm_atomic_state_default_clear+0xf7/0x1c0 [drm]
       ? drm_atomic_state_clear+0x30/0x30 [drm]
       intel_atomic_state_clear+0xd/0x20 [i915]
       drm_atomic_state_clear+0x1a/0x30 [drm]
       __drm_atomic_state_free+0x13/0x60 [drm]
       intel_atomic_helper_free_state+0x5d/0x70 [i915]
       process_one_work+0x260/0x4a0
       worker_thread+0x2d1/0x4f0
       kthread+0x127/0x130
       ? process_one_work+0x4a0/0x4a0
       ? kthread_stop+0x120/0x120
       ret_from_fork+0x29/0x40
      FIX kmalloc-128: Object at 0xffff92fb65ec2578 not freed
      
      Fixes: 3b24f7d6 ("drm/atomic: Add struct drm_crtc_commit to track async updates")
      Fixes: 96260142 ("drm/fence: add in-fences support")
      Cc: <stable@vger.kernel.org> # v4.8+
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: default avatarMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Reviewed-by: default avatarGustavo Padovan <gustavo.padovan@collabora.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: http://patchwork.freedesktop.org/patch/msgid/1485854725-27640-1-git-send-email-maarten.lankhorst@linux.intel.com
      92c715fc
    • Ben Skeggs's avatar
      drm/nouveau/kms/nv50: request vblank events for commits that send completion events · 2b507893
      Ben Skeggs authored
      This somehow fixes an issue where sync-to-vblank longer works correctly
      after resume from suspend.
      
      From a HW perspective, we don't need the IRQs turned on to be able to
      detect flip completion, so it's assumed that this is required for the
      voodoo in the core DRM vblank core.
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      2b507893
    • Ilia Mirkin's avatar
      drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval · 24bf7ae3
      Ilia Mirkin authored
      Based on the xf86-video-nv code, NFORCE (NV1A) and NFORCE2 (NV1F) have a
      different way of retrieving clocks. See the
      nv_hw.c:nForceUpdateArbitrationSettings function in the original code
      for how these clocks were accessed.
      
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=54587
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarIlia Mirkin <imirkin@alum.mit.edu>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      24bf7ae3
    • Alastair Bridgewater's avatar
      drm/nouveau/disp/gt215: Fix HDA ELD handling (thus, HDMI audio) on gt215 · d347583a
      Alastair Bridgewater authored
      Store the ELD correctly, not just enough copies of the first byte
      to pad out the given ELD size.
      Signed-off-by: default avatarAlastair Bridgewater <alastair.bridgewater@gmail.com>
      Fixes: 120b0c39 ("drm/nv50-/disp: audit and version SOR_HDA_ELD method")
      Cc: stable@vger.kernel.org # v3.17+
      Reviewed-by: default avatarIlia Mirkin <imirkin@alum.mit.edu>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      d347583a
    • Martin Peres's avatar
      drm/nouveau/nouveau/led: prevent compiling the led-code if nouveau=y and leds=m · d72498ca
      Martin Peres authored
      The proper fix would have been to select LEDS_CLASS but this can lead
      to a circular dependency, as found out by Arnd.
      
      This patch implements Arnd's suggestion instead, at the cost of some
      auto-magic for a fringe feature.
      Reported-by: default avatarArnd Bergmann <arnd@arndb.de>
      Reported-by: Intel's 0-DAY
      Fixes: 8d021d71 ("drm/nouveau/drm/nouveau: add a LED driver for the NVIDIA logo")
      Signed-off-by: default avatarMartin Peres <martin.peres@free.fr>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      d72498ca
    • Ben Skeggs's avatar
      drm/nouveau/disp/mcp7x: disable dptmds workaround · 7dfee682
      Ben Skeggs authored
      The workaround appears to cause regressions on these boards, and from
      inspection of RM traces, NVIDIA don't appear to do it on them either.
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      Tested-by: default avatarRoy Spliet <nouveau@spliet.org>
      7dfee682
    • Ben Skeggs's avatar
      c966b627
    • Ben Skeggs's avatar
  3. 30 Jan, 2017 2 commits
  4. 29 Jan, 2017 3 commits
    • Linus Torvalds's avatar
      Linux 4.10-rc6 · 566cf877
      Linus Torvalds authored
      566cf877
    • Linus Torvalds's avatar
      drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj() · 39cb2c9a
      Linus Torvalds authored
      I've seen this trigger twice now, where the i915_gem_object_to_ggtt()
      call in intel_unpin_fb_obj() returns NULL, resulting in an oops
      immediately afterwards as the (inlined) call to i915_vma_unpin_fence()
      tries to dereference it.
      
      It seems to be some race condition where the object is going away at
      shutdown time, since both times happened when shutting down the X
      server.  The call chains were different:
      
       - VT ioctl(KDSETMODE, KD_TEXT):
      
          intel_cleanup_plane_fb+0x5b/0xa0 [i915]
          drm_atomic_helper_cleanup_planes+0x6f/0x90 [drm_kms_helper]
          intel_atomic_commit_tail+0x749/0xfe0 [i915]
          intel_atomic_commit+0x3cb/0x4f0 [i915]
          drm_atomic_commit+0x4b/0x50 [drm]
          restore_fbdev_mode+0x14c/0x2a0 [drm_kms_helper]
          drm_fb_helper_restore_fbdev_mode_unlocked+0x34/0x80 [drm_kms_helper]
          drm_fb_helper_set_par+0x2d/0x60 [drm_kms_helper]
          intel_fbdev_set_par+0x18/0x70 [i915]
          fb_set_var+0x236/0x460
          fbcon_blank+0x30f/0x350
          do_unblank_screen+0xd2/0x1a0
          vt_ioctl+0x507/0x12a0
          tty_ioctl+0x355/0xc30
          do_vfs_ioctl+0xa3/0x5e0
          SyS_ioctl+0x79/0x90
          entry_SYSCALL_64_fastpath+0x13/0x94
      
       - i915 unpin_work workqueue:
      
          intel_unpin_work_fn+0x58/0x140 [i915]
          process_one_work+0x1f1/0x480
          worker_thread+0x48/0x4d0
          kthread+0x101/0x140
      
      and this patch purely papers over the issue by adding a NULL pointer
      check and a WARN_ON_ONCE() to avoid the oops that would then generally
      make the machine unresponsive.
      
      Other callers of i915_gem_object_to_ggtt() seem to also check for the
      returned pointer being NULL and warn about it, so this clearly has
      happened before in other places.
      
      [ Reported it originally to the i915 developers on Jan 8, applying the
        ugly workaround on my own now after triggering the problem for the
        second time with no feedback.
      
        This is likely to be the same bug reported as
      
           https://bugs.freedesktop.org/show_bug.cgi?id=98829
           https://bugs.freedesktop.org/show_bug.cgi?id=99134
      
        which has a patch for the underlying problem, but it hasn't gotten to
        me, so I'm applying the workaround. ]
      
      Cc: Daniel Vetter <daniel.vetter@intel.com>
      Cc: Jani Nikula <jani.nikula@linux.intel.com>
      Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
      Cc: Chris Wilson <chris@chris-wilson.co.uk>
      Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Cc: Imre Deak <imre.deak@intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      39cb2c9a
    • Linus Torvalds's avatar
      Merge branch 'parisc-4.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · 2c5d9555
      Linus Torvalds authored
      Pull two parisc fixes from Helge Deller:
       "One fix to avoid usage of BITS_PER_LONG in user-space exported swab.h
        header which breaks compiling qemu, and one trivial fix for printk
        continuation in the parisc parport driver"
      
      * 'parisc-4.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header
        parisc, parport_gsc: Fixes for printk continuation lines
      2c5d9555
  5. 28 Jan, 2017 7 commits
  6. 27 Jan, 2017 17 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 1b1bc42c
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) GTP fixes from Andreas Schultz (missing genl module alias, clear IP
          DF on transmit).
      
       2) Netfilter needs to reflect the fwmark when sending resets, from Pau
          Espin Pedrol.
      
       3) nftable dump OOPS fix from Liping Zhang.
      
       4) Fix erroneous setting of VIRTIO_NET_HDR_F_DATA_VALID on transmit,
          from Rolf Neugebauer.
      
       5) Fix build error of ipt_CLUSTERIP when procfs is disabled, from Arnd
          Bergmann.
      
       6) Fix regression in handling of NETIF_F_SG in harmonize_features(),
          from Eric Dumazet.
      
       7) Fix RTNL deadlock wrt. lwtunnel module loading, from David Ahern.
      
       8) tcp_fastopen_create_child() needs to setup tp->max_window, from
          Alexey Kodanev.
      
       9) Missing kmemdup() failure check in ipv6 segment routing code, from
          Eric Dumazet.
      
      10) Don't execute unix_bind() under the bindlock, otherwise we deadlock
          with splice. From WANG Cong.
      
      11) ip6_tnl_parse_tlv_enc_lim() potentially reallocates the skb buffer,
          therefore callers must reload cached header pointers into that skb.
          Fix from Eric Dumazet.
      
      12) Fix various bugs in legacy IRQ fallback handling in alx driver, from
          Tobias Regnery.
      
      13) Do not allow lwtunnel drivers to be unloaded while they are
          referenced by active instances, from Robert Shearman.
      
      14) Fix truncated PHY LED trigger names, from Geert Uytterhoeven.
      
      15) Fix a few regressions from virtio_net XDP support, from John
          Fastabend and Jakub Kicinski.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (102 commits)
        ISDN: eicon: silence misleading array-bounds warning
        net: phy: micrel: add support for KSZ8795
        gtp: fix cross netns recv on gtp socket
        gtp: clear DF bit on GTP packet tx
        gtp: add genl family modules alias
        tcp: don't annotate mark on control socket from tcp_v6_send_response()
        ravb: unmap descriptors when freeing rings
        virtio_net: reject XDP programs using header adjustment
        virtio_net: use dev_kfree_skb for small buffer XDP receive
        r8152: check rx after napi is enabled
        r8152: re-schedule napi for tx
        r8152: avoid start_xmit to schedule napi when napi is disabled
        r8152: avoid start_xmit to call napi_schedule during autosuspend
        net: dsa: Bring back device detaching in dsa_slave_suspend()
        net: phy: leds: Fix truncated LED trigger names
        net: phy: leds: Break dependency of phy.h on phy_led_triggers.h
        net: phy: leds: Clear phy_num_led_triggers on failure to avoid crash
        net-next: ethernet: mediatek: change the compatible string
        Documentation: devicetree: change the mediatek ethernet compatible string
        bnxt_en: Fix RTNL lock usage on bnxt_get_port_module_status().
        ...
      1b1bc42c
    • Linus Torvalds's avatar
      Merge tag 'xfs-for-linus-4.10-rc6-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 3365135d
      Linus Torvalds authored
      Pull xfs uodates from Darrick Wong:
       "I have some more fixes this week: better input validation, corruption
        avoidance, build fixes, memory leak fixes, and a couple from Christoph
        to avoid an ENOSPC failure.
      
        Summary:
         - Fix race conditions in the CoW code
         - Fix some incorrect input validation checks
         - Avoid crashing fs by running out of space when freeing inodes
         - Fix toctou race wrt whether or not an inode has an attr
         - Fix build error on arm
         - Fix page refcount corruption when readahead fails
         - Don't corrupt userspace in the bmap ioctl"
      
      * tag 'xfs-for-linus-4.10-rc6-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: prevent quotacheck from overloading inode lru
        xfs: fix bmv_count confusion w/ shared extents
        xfs: clear _XBF_PAGES from buffers when readahead page
        xfs: extsize hints are not unlikely in xfs_bmap_btalloc
        xfs: remove racy hasattr check from attr ops
        xfs: use per-AG reservations for the finobt
        xfs: only update mount/resv fields on success in __xfs_ag_resv_init
        xfs: verify dirblocklog correctly
        xfs: fix COW writeback race
      3365135d
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 59063744
      Linus Torvalds authored
      Pull btrfs updates from Chris Mason:
       "Some fixes that we've collected from the list.
      
        We still have one more pending to nail down a regression in lzo
        compression, but I wanted to get this batch out the door"
      
      * 'for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: remove ->{get, set}_acl() from btrfs_dir_ro_inode_operations
        Btrfs: disable xattr operations on subvolume directories
        Btrfs: remove old tree_root case in btrfs_read_locked_inode()
        Btrfs: fix truncate down when no_holes feature is enabled
        Btrfs: Fix deadlock between direct IO and fast fsync
        btrfs: fix false enospc error when truncating heavily reflinked file
      59063744
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 2fb78e89
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A set of fixes for this series. This contains:
      
         - Set of fixes for the nvme target code
      
         - A revert of patch from this merge window, causing a regression with
           WRITE_SAME on iSCSI targets at least.
      
         - A fix for a use-after-free in the new O_DIRECT bdev code.
      
         - Two fixes for the xen-blkfront driver"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        Revert "sd: remove __data_len hack for WRITE SAME"
        nvme-fc: use blk_rq_nr_phys_segments
        nvmet-rdma: Fix missing dma sync to nvme data structures
        nvmet: Call fatal_error from keep-alive timout expiration
        nvmet: cancel fatal error and flush async work before free controller
        nvmet: delete controllers deletion upon subsystem release
        nvmet_fc: correct logic in disconnect queue LS handling
        block: fix use after free in __blkdev_direct_IO
        xen-blkfront: correct maximum segment accounting
        xen-blkfront: feature flags handling adjustments
      2fb78e89
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · dd3b9f25
      Linus Torvalds authored
      Pull rdma fixes from Doug Ledford:
       "Second round of -rc fixes for 4.10.
      
        This -rc cycle has been slow for the rdma subsystem. I had already
        sent you the first batch before the Holiday break. After that, we kept
        only getting a few here or there. Up until this week, when I got a
        drop of 13 to one driver (qedr). So, here's the -rc patches I have. I
        currently have none held in reserve, so unless something new comes in,
        this is it until the next merge window opens.
      
        Summary:
      
         - series of iw_cxgb4 fixes to make it work with the drain cq API
      
         - one or two patches each to: srp, iser, cxgb3, vmw_pvrdma, umem,
           rxe, and ipoib
      
         - one big series (13 patches) for the new qedr driver"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: (27 commits)
        RDMA/cma: Fix unknown symbol when CONFIG_IPV6 is not enabled
        IB/rxe: Prevent from completer to operate on non valid QP
        IB/rxe: Fix rxe dev insertion to rxe_dev_list
        IB/umem: Release pid in error and ODP flow
        RDMA/qedr: Dispatch port active event from qedr_add
        RDMA/qedr: Fix and simplify memory leak in PD alloc
        RDMA/qedr: Fix RDMA CM loopback
        RDMA/qedr: Fix formatting
        RDMA/qedr: Mark three functions as static
        RDMA/qedr: Don't reset QP when queues aren't flushed
        RDMA/qedr: Don't spam dmesg if QP is in error state
        RDMA/qedr: Remove CQ spinlock from CM completion handlers
        RDMA/qedr: Return max inline data in QP query result
        RDMA/qedr: Return success when not changing QP state
        RDMA/qedr: Add uapi header qedr-abi.h
        RDMA/qedr: Fix MTU returned from QP query
        RDMA/core: Add the function ib_mtu_int_to_enum
        IB/vmw_pvrdma: Fix incorrect cleanup on pvrdma_pci_probe error path
        IB/vmw_pvrdma: Don't leak info from alloc_ucontext
        IB/cxgb3: fix misspelling in header guard
        ...
      dd3b9f25
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · 69978aa0
      Linus Torvalds authored
      Pull s390 fixes from Martin Schwidefsky:
       "Another two bug fixes:
      
         - ptrace partial write information leak
      
         - a guest page hinting regression introduced with v4.6"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/mm: Fix cmma unused transfer from pgste into pte
        s390/ptrace: Preserve previous registers for short regset write
      69978aa0
    • Linus Torvalds's avatar
      Merge branch 'stable/for-linus-4.10' of... · 2b432150
      Linus Torvalds authored
      Merge branch 'stable/for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb
      
      Pull swiotlb fix from Konrad Rzeszutek Wilk:
       "An ARM fix in the Xen SWIOTLB - mainly the translation of physical to
        bus addresses was done just a tad too late"
      
      * 'stable/for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb:
        swiotlb-xen: update dev_addr after swapping pages
      2b432150
    • Linus Torvalds's avatar
      Merge tag 'vfio-v4.10-rc6' of git://github.com/awilliam/linux-vfio · 3aebae06
      Linus Torvalds authored
      Pull VFIO fix from Alex Williamson:
       "mdev IOMMU groups are not yet compatible with the powerpc SPAPR IOMMU
        backend, detect and fail group attach (Greg Kurz)"
      
      * tag 'vfio-v4.10-rc6' of git://github.com/awilliam/linux-vfio:
        vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null
      3aebae06
    • Jack Morgenstein's avatar
      RDMA/cma: Fix unknown symbol when CONFIG_IPV6 is not enabled · b4cfe397
      Jack Morgenstein authored
      If IPV6 has not been enabled in the underlying kernel, we must avoid
      calling IPV6 procedures in rdma_cm.ko.
      
      This requires using "IS_ENABLED(CONFIG_IPV6)" in "if" statements
      surrounding any code which calls external IPV6 procedures.
      
      In the instance fixed here, procedure cma_bind_addr() called
      ipv6_addr_type() -- which resulted in calling external procedure
      __ipv6_addr_type().
      
      Fixes: 6c26a771 ("RDMA/cma: fix IPv6 address resolution")
      Cc: <stable@vger.kernel.org> # v4.2+
      Cc: Spencer Baugh <sbaugh@catern.com>
      Signed-off-by: default avatarJack Morgenstein <jackm@dev.mellanox.co.il>
      Reviewed-by: default avatarMoni Shoua <monis@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      b4cfe397
    • Jens Axboe's avatar
      Merge branch 'stable/for-jens-4.10' of... · c14024db
      Jens Axboe authored
      Merge branch 'stable/for-jens-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen into for-linus
      
      Konrad writes:
      
      Please pull in your 'for-linus' branch two little fixes for Xen
      block front:
      
      One fix is for handling the XEN_PAGE_SIZE != PAGE_SIZE (4KB vs 64KB
      on ARM for example) mishandling while the other is fixing
      the accounting for the configuration changes.
      c14024db
    • Vineet Gupta's avatar
      ARC: [arcompact] handle unaligned access delay slot corner case · 9aed02fe
      Vineet Gupta authored
      After emulating an unaligned access in delay slot of a branch, we
      pretend as the delay slot never happened - so return back to actual
      branch target (or next PC if branch was not taken).
      
      Curently we did this by handling STATUS32.DE, we also need to clear the
      BTA.T bit, which is disregarded when returning from original misaligned
      exception, but could cause weirdness if it took the interrupt return
      path (in case interrupt was acive too)
      
      One ARC700 customer ran into this when enabling unaligned access fixup
      for kernel mode accesses as well
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarVineet Gupta <vgupta@synopsys.com>
      9aed02fe
    • Linus Torvalds's avatar
      Merge tag 'media/v4.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 9d1d166f
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
      
       - fix a regression on tvp5150 causing failures at input selection and
         image glitches
      
       - CEC was moved out of staging for v4.10. Fix some bugs on it while not
         too late
      
       - fix a regression on pctv452e caused by VM stack changes
      
       - fix suspend issued with smiapp
      
       - fix a regression on cobalt driver
      
       - fix some warnings and Kconfig issues with some random configs.
      
      * tag 'media/v4.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        [media] s5k4ecgx: select CRC32 helper
        [media] dvb: avoid warning in dvb_net
        [media] v4l: tvp5150: Don't override output pinmuxing at stream on/off time
        [media] v4l: tvp5150: Fix comment regarding output pin muxing
        [media] v4l: tvp5150: Reset device at probe time, not in get/set format handlers
        [media] pctv452e: move buffer to heap, no mutex
        [media] media/cobalt: use pci_irq_allocate_vectors
        [media] cec: fix race between configuring and unconfiguring
        [media] cec: move cec_report_phys_addr into cec_config_thread_func
        [media] cec: replace cec_report_features by cec_fill_msg_report_features
        [media] cec: update log_addr[] before finishing configuration
        [media] cec: CEC_MSG_GIVE_FEATURES should abort for CEC version < 2
        [media] cec: when canceling a message, don't overwrite old status info
        [media] cec: fix report_current_latency
        [media] smiapp: Make suspend and resume functions __maybe_unused
        [media] smiapp: Implement power-on and power-off sequences without runtime PM
      9d1d166f
    • Linus Torvalds's avatar
      Merge tag 'mmc-v4.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · b84f0279
      Linus Torvalds authored
      Pull MMC fix from Ulf Hansson:
       "MMC host: fix runtime PM resume path in dw_mmc"
      
      * tag 'mmc-v4.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: dw_mmc: force setup bus if active slots exist
      b84f0279
    • Linus Torvalds's avatar
      Merge branch 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux · ed4d50c4
      Linus Torvalds authored
      Pull thermal management fix from Zhang Rui:
       "A single revert from a recently introduced problem.
      
        Specifics:
      
        Commit 7611fb68 ("thermal: thermal_hwmon: Convert to
        hwmon_device_register_with_info()"), which was introduced in 4.10-rc5,
        uses new hwmon API. But this breaks some soc thermal driver because
        the new hwmon API has a strict rule for the hwmon device name. Revert
        the offending commit as a quick solution for 4.10"
      
      * 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
        Revert "thermal: thermal_hwmon: Convert to hwmon_device_register_with_info()"
      ed4d50c4
    • Brian Foster's avatar
      xfs: prevent quotacheck from overloading inode lru · e0d76fa4
      Brian Foster authored
      Quotacheck runs at mount time in situations where quota accounting must
      be recalculated. In doing so, it uses bulkstat to visit every inode in
      the filesystem. Historically, every inode processed during quotacheck
      was released and immediately tagged for reclaim because quotacheck runs
      before the superblock is marked active by the VFS. In other words,
      the final iput() lead to an immediate ->destroy_inode() call, which
      allowed the XFS background reclaim worker to start reclaiming inodes.
      
      Commit 17c12bcd ("xfs: when replaying bmap operations, don't let
      unlinked inodes get reaped") marks the XFS superblock active sooner as
      part of the mount process to support caching inodes processed during log
      recovery. This occurs before quotacheck and thus means all inodes
      processed by quotacheck are inserted to the LRU on release.  The
      s_umount lock is held until the mount has completed and thus prevents
      the shrinkers from operating on the sb. This means that quotacheck can
      excessively populate the inode LRU and lead to OOM conditions on systems
      without sufficient RAM.
      
      Update the quotacheck bulkstat handler to set XFS_IGET_DONTCACHE on
      inodes processed by quotacheck. This causes ->drop_inode() to return 1
      and in turn causes iput_final() to evict the inode. This preserves the
      original quotacheck behavior and prevents it from overloading the LRU
      and running out of memory.
      
      CC: stable@vger.kernel.org # v4.9
      Reported-by: default avatarMartin Svec <martin.svec@zoner.cz>
      Signed-off-by: default avatarBrian Foster <bfoster@redhat.com>
      Reviewed-by: default avatarEric Sandeen <sandeen@redhat.com>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      e0d76fa4
    • Arnd Bergmann's avatar
      ISDN: eicon: silence misleading array-bounds warning · 950eabbd
      Arnd Bergmann authored
      With some gcc versions, we get a warning about the eicon driver,
      and that currently shows up as the only remaining warning in one
      of the build bots:
      
      In file included from ../drivers/isdn/hardware/eicon/message.c:30:0:
      eicon/message.c: In function 'mixer_notify_update':
      eicon/platform.h:333:18: warning: array subscript is above array bounds [-Warray-bounds]
      
      The code is easily changed to open-code the unusual PUT_WORD() line
      causing this to avoid the warning.
      
      Cc: stable@vger.kernel.org
      Link: http://arm-soc.lixom.net/buildlogs/stable-rc/v4.4.45/Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      950eabbd
    • Sean Nyekjaer's avatar
      net: phy: micrel: add support for KSZ8795 · 9d162ed6
      Sean Nyekjaer authored
      This is adds support for the PHYs in the KSZ8795 5port managed switch.
      
      It will allow to detect the link between the switch and the soc
      and uses the same read_status functions as the KSZ8873MLL switch.
      Signed-off-by: default avatarSean Nyekjaer <sean.nyekjaer@prevas.dk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9d162ed6