1. 11 Jun, 2017 9 commits
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 9cd9cb0b
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some small driver fixes for 4.12-rc5. Nothing major here,
        just some small bugfixes found by people testing, and a MAINTAINERS
        file update for the genwqe driver.
      
        All have been in linux-next with no reported issues"
      
      [ The cxl driver fix came in through the powerpc tree earlier ]
      
      * tag 'char-misc-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        cxl: Avoid double free_irq() for psl,slice interrupts
        mei: make sysfs modalias format similar as uevent modalias
        drivers: char: mem: Fix wraparound check to allow mappings up to the end
        MAINTAINERS: Change maintainer of genwqe driver
        goldfish_pipe: use GFP_ATOMIC under spin lock
        firmware: vpd: do not leak kobjects
        firmware: vpd: avoid potential use-after-free when destroying section
        firmware: vpd: do not leave freed section attributes to the list
      9cd9cb0b
    • Linus Torvalds's avatar
      Merge tag 'staging-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 21c9eb7c
      Linus Torvalds authored
      Pull staging/IIO fixes from Greg KH:
       "These are mostly all IIO driver fixes, resolving a number of tiny
        issues. There's also a ccree and lustre fix in here as well, both fix
        problems found in those codebases.
      
        All have been in linux-next with no reported issues"
      
      * tag 'staging-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: ccree: fix buffer copy
        staging/lustre/lov: remove set_fs() call from lov_getstripe()
        staging: ccree: add CRYPTO dependency
        iio: adc: sun4i-gpadc-iio: fix parent device being used in devm function
        iio: light: ltr501 Fix interchanged als/ps register field
        iio: adc: bcm_iproc_adc: swap primary and secondary isr handler's
        iio: trigger: fix NULL pointer dereference in iio_trigger_write_current()
        iio: adc: max9611: Fix attribute measure unit
        iio: adc: ti_am335x_adc: allocating too much in probe
        iio: adc: sun4i-gpadc-iio: Fix module autoload when OF devices are registered
        iio: adc: sun4i-gpadc-iio: Fix module autoload when PLATFORM devices are registered
        iio: proximity: as3935: fix iio_trigger_poll issue
        iio: proximity: as3935: fix AS3935_INT mask
        iio: adc: Max9611: checking for ERR_PTR instead of NULL in probe
        iio: proximity: as3935: recalibrate RCO after resume
      21c9eb7c
    • Linus Torvalds's avatar
      Merge tag 'usb-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 246baac2
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are some small USB fixes for 4.12-rc5
      
        They are for some reported issues in the chipidea and gadget drivers.
        Nothing major. All have been in linux-next for a while with no
        reported issues"
      
      * tag 'usb-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: gadget: udc: renesas_usb3: Fix PN_INT_ENA disabling timing
        usb: gadget: udc: renesas_usb3: lock for PN_ registers access
        usb: gadget: udc: renesas_usb3: fix deadlock by spinlock
        usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling
        usb: gadget: f_mass_storage: Serialize wake and sleep execution
        usb: dwc2: add support for the DWC2 controller on Meson8 SoCs
        phy: qualcomm: phy-qcom-qmp: fix application of sizeof to pointer
        usb: musb: dsps: keep VBUS on for host-only mode
        usb: chipidea: core: check before accessing ci_role in ci_role_show
        usb: chipidea: debug: check before accessing ci_role
        phy: qcom-qmp: fix return value check in qcom_qmp_phy_create()
        usb: chipidea: udc: fix NULL pointer dereference if udc_start failed
        usb: chipidea: imx: Do not access CLKONOFF on i.MX51
      246baac2
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · ef918d3c
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "This is a set of user visible fixes (excepting one format string
        change).
      
        Four of the qla2xxx fixes only affect the firmware dump path, but it's
        still important to the enterprise. The rest are various NULL pointer
        crash conditions or outright driver hangs"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: cxgb4i: libcxgbi: in error case RST tcp conn
        scsi: scsi_debug: Avoid PI being disabled when TPGS is enabled
        scsi: qla2xxx: Fix extraneous ref on sp's after adapter break
        scsi: lpfc: prevent potential null pointer dereference
        scsi: lpfc: Avoid NULL pointer dereference in lpfc_els_abort()
        scsi: lpfc: nvmet_fc: fix format string
        scsi: qla2xxx: Fix crash due to NULL pointer dereference of ctx
        scsi: qla2xxx: Fix mailbox pointer error in fwdump capture
        scsi: qla2xxx: Set bit 15 for DIAG_ECHO_TEST MBC
        scsi: qla2xxx: Modify T262 FW dump template to specify same start/end to debug customer issues
        scsi: qla2xxx: Fix crash due to mismatch mumber of Q-pair creation for Multi queue
        scsi: qla2xxx: Fix NULL pointer access due to redundant fc_host_port_name call
        scsi: qla2xxx: Fix recursive loop during target mode configuration for ISP25XX leaving system unresponsive
        scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats()
        scsi: qla2xxx: don't disable a not previously enabled PCI device
      ef918d3c
    • Linus Torvalds's avatar
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · 8f56821d
      Linus Torvalds authored
      Pull libnvdimm fix from Dan Williams:
       "We expanded the device-dax fs type in 4.12 to be a generic provider of
        a struct dax_device with an embedded inode. However, Sasha found some
        basic negative testing was not run to verify that this fs cleanly
        handles being mounted directly.
      
        Note that the fresh rebase was done to remove an unnecessary Cc:
        <stable> tag, but this commit otherwise had a build success
        notification from the 0day robot."
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        device-dax: fix 'dax' device filesystem inode destruction crash
      8f56821d
    • Linus Torvalds's avatar
      Merge tag 'hexagon-for-linus-v4.12-rc5' of... · 9d66af6b
      Linus Torvalds authored
      Merge tag 'hexagon-for-linus-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hexagon fix from Guenter Roeck:
       "This fixes a build error seen when building hexagon images.
      
        Richard sent me an Ack, but didn't reply when asked if he wants me to
        send the patch to you directly, so I figured I'd just do it"
      
      * tag 'hexagon-for-linus-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hexagon: Use raw_copy_to_user
      9d66af6b
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 9d0eb462
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "Bug fixes (ARM, s390, x86)"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: async_pf: avoid async pf injection when in guest mode
        KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation
        arm: KVM: Allow unaligned accesses at HYP
        arm64: KVM: Allow unaligned accesses at EL2
        arm64: KVM: Preserve RES1 bits in SCTLR_EL2
        KVM: arm/arm64: Handle possible NULL stage2 pud when ageing pages
        KVM: nVMX: Fix exception injection
        kvm: async_pf: fix rcu_irq_enter() with irqs enabled
        KVM: arm/arm64: vgic-v3: Fix nr_pre_bits bitfield extraction
        KVM: s390: fix ais handling vs cpu model
        KVM: arm/arm64: Fix isues with GICv2 on GICv3 migration
      9d0eb462
    • Wanpeng Li's avatar
      KVM: async_pf: avoid async pf injection when in guest mode · 9bc1f09f
      Wanpeng Li authored
       INFO: task gnome-terminal-:1734 blocked for more than 120 seconds.
             Not tainted 4.12.0-rc4+ #8
       "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
       gnome-terminal- D    0  1734   1015 0x00000000
       Call Trace:
        __schedule+0x3cd/0xb30
        schedule+0x40/0x90
        kvm_async_pf_task_wait+0x1cc/0x270
        ? __vfs_read+0x37/0x150
        ? prepare_to_swait+0x22/0x70
        do_async_page_fault+0x77/0xb0
        ? do_async_page_fault+0x77/0xb0
        async_page_fault+0x28/0x30
      
      This is triggered by running both win7 and win2016 on L1 KVM simultaneously,
      and then gives stress to memory on L1, I can observed this hang on L1 when
      at least ~70% swap area is occupied on L0.
      
      This is due to async pf was injected to L2 which should be injected to L1,
      L2 guest starts receiving pagefault w/ bogus %cr2(apf token from the host
      actually), and L1 guest starts accumulating tasks stuck in D state in
      kvm_async_pf_task_wait() since missing PAGE_READY async_pfs.
      
      This patch fixes the hang by doing async pf when executing L1 guest.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Radim Krčmář <rkrcmar@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarWanpeng Li <wanpeng.li@hotmail.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      9bc1f09f
    • Guenter Roeck's avatar
      hexagon: Use raw_copy_to_user · 4d801cca
      Guenter Roeck authored
      Commit ac4691fa ("hexagon: switch to RAW_COPY_USER") replaced
      __copy_to_user_hexagon() with raw_copy_to_user(), but did not catch
      all callers, resulting in the following build error.
      
      arch/hexagon/mm/uaccess.c: In function '__clear_user_hexagon':
      arch/hexagon/mm/uaccess.c:40:3: error:
      	implicit declaration of function '__copy_to_user_hexagon'
      
      Fixes: ac4691fa ("hexagon: switch to RAW_COPY_USER")
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Acked-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Acked-by: default avatarRichard Kuo <rkuo@codeaurora.org>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      4d801cca
  2. 10 Jun, 2017 14 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 5faab9e0
      Linus Torvalds authored
      Pull UFS fixes from Al Viro:
       "This is just the obvious backport fodder; I'm pretty sure that there
        will be more - definitely so wrt performance and quite possibly
        correctness as well"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        ufs: we need to sync inode before freeing it
        excessive checks in ufs_write_failed() and ufs_evict_inode()
        ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path
        ufs_extend_tail(): fix the braino in calling conventions of ufs_new_fragments()
        ufs: set correct ->s_maxsize
        ufs: restore maintaining ->i_blocks
        fix ufs_isblockset()
        ufs: restore proper tail allocation
      5faab9e0
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 66cea28a
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "Some fixes that Dave Sterba collected.
      
        We've been hitting an early enospc problem on production machines that
        Omar tracked down to an old int->u64 mistake. I waited a bit on this
        pull to make sure it was really the problem from production, but it's
        on ~2100 hosts now and I think we're good.
      
        Omar also noticed a commit in the queue would make new early ENOSPC
        problems. I pulled that out for now, which is why the top three
        commits are younger than the rest.
      
        Otherwise these are all fixes, some explaining very old bugs that
        we've been poking at for a while"
      
      * 'for-linus-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: fix delalloc accounting leak caused by u32 overflow
        Btrfs: clear EXTENT_DEFRAG bits in finish_ordered_io
        btrfs: tree-log.c: Wrong printk information about namelen
        btrfs: fix race with relocation recovery and fs_root setup
        btrfs: fix memory leak in update_space_info failure path
        btrfs: use correct types for page indices in btrfs_page_exists_in_range
        btrfs: fix incorrect error return ret being passed to mapping_set_error
        btrfs: Make flush bios explicitely sync
        btrfs: fiemap: Cache and merge fiemap extent before submit it to user
      66cea28a
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · ac1a14a2
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Misc fixes: a Geode fix plus a microcode loader fix"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/microcode/intel: Clear patch pointer before jettisoning the initrd
        x86/cpu/cyrix: Add alternative Device ID of Geode GX1 SoC
      ac1a14a2
    • Linus Torvalds's avatar
      Merge branch 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 45b44f0f
      Linus Torvalds authored
      Pull CPU hotplug fix from Ingo Molnar:
       "An error handling corner case fix"
      
      * 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        cpu/hotplug: Drop the device lock on error
      45b44f0f
    • Linus Torvalds's avatar
      Merge branch 'rcu-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 6b7ed458
      Linus Torvalds authored
      Pull RCU fixes from Ingo Molnar:
       "Fix an SRCU bug affecting KVM IRQ injection"
      
      * 'rcu-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        srcu: Allow use of Classic SRCU from both process and interrupt context
        srcu: Allow use of Tiny/Tree SRCU from both process and interrupt context
      6b7ed458
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f701d860
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "This is mostly tooling fixes, plus an instruction pointer filtering
        fix.
      
        It's more fixes than usual - Arnaldo got back from a longer vacation
        and there was a backlog"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits)
        perf symbols: Kill dso__build_id_is_kmod()
        perf symbols: Keep DSO->symtab_type after decompress
        perf tests: Decompress kernel module before objdump
        perf tools: Consolidate error path in __open_dso()
        perf tools: Decompress kernel module when reading DSO data
        perf annotate: Use dso__decompress_kmodule_path()
        perf tools: Introduce dso__decompress_kmodule_{fd,path}
        perf tools: Fix a memory leak in __open_dso()
        perf annotate: Fix symbolic link of build-id cache
        perf/core: Drop kernel samples even though :u is specified
        perf script python: Remove dups in documentation examples
        perf script python: Updated trace_unhandled() signature
        perf script python: Fix wrong code snippets in documentation
        perf script: Fix documentation errors
        perf script: Fix outdated comment for perf-trace-python
        perf probe: Fix examples section of documentation
        perf report: Ensure the perf DSO mapping matches what libdw sees
        perf report: Include partial stacks unwound with libdw
        perf annotate: Add missing powerpc triplet
        perf test: Disable breakpoint signal tests for powerpc
        ...
      f701d860
    • Linus Torvalds's avatar
      Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 9376906c
      Linus Torvalds authored
      Pull EFI fix from Ingo Molnar:
       "A boot crash fix for certain systems where the kernel would trust a
        piece of firmware data it should not have"
      
      * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        efi: Fix boot panic because of invalid BGRT image address
      9376906c
    • Al Viro's avatar
      ufs: we need to sync inode before freeing it · 67a70017
      Al Viro authored
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      67a70017
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 179145e6
      Linus Torvalds authored
      Pull IOMMU fixes from Joerg Roedel:
      
       - another compile-fix for my header cleanup
      
       - a couple of fixes for the recently merged IOMMU probe deferal code
      
       - fixes for ACPI/IORT code necessary with IOMMU probe deferal
      
      * tag 'iommu-fixes-v4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        arm: dma-mapping: Reset the device's dma_ops
        ACPI/IORT: Move the check to get iommu_ops from translated fwspec
        ARM: dma-mapping: Don't tear down third-party mappings
        ACPI/IORT: Ignore all errors except EPROBE_DEFER
        iommu/of: Ignore all errors except EPROBE_DEFER
        iommu/of: Fix check for returning EPROBE_DEFER
        iommu/dma: Fix function declaration
      179145e6
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · c7a1aefc
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
      
       - mark "guest" RMI device as pass-through port to avoid "phantom" ALPS
         toouchpad on newer Lenovo Carbons
      
       - add two more laptops to the Elantech's lists of devices using CRC
         mode
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: synaptics-rmi4 - register F03 port as pass-through serio
        Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabled
      c7a1aefc
    • Linus Torvalds's avatar
      Merge tag 'md/4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md · 2833b7e9
      Linus Torvalds authored
      Pull MD bugfix from Shaohua Li:
       "One bug fix from Neil Brown for MD. The bug was introduced in this
        cycle"
      
      * tag 'md/4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
        md: initialise ->writes_pending in personality modules.
      2833b7e9
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 42211f6c
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A set of fixes in the area of block IO, that should go into the next
        -rc release. This contains:
      
         - An OOPS fix from Dmitry, fixing a regression with the bio integrity
           code in this series.
      
         - Fix truncation of elevator io context cache name, from Eric
           Biggers.
      
         - NVMe pull from Christoph includes FC fixes from James, APST
           fixes/tweaks from Kai-Heng, removal fix from Rakesh, and an RDMA
           fix from Sagi.
      
         - Two tweaks for the block throttling code. One from Joseph Qi,
           fixing an oops from the timer code, and one from Shaohua, improving
           the behavior on rotatonal storage.
      
         - Two blk-mq fixes from Ming, fixing corner cases with the direct
           issue code.
      
         - Locking fix for bfq cgroups from Paolo"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        block, bfq: access and cache blkg data only when safe
        Fix loop device flush before configure v3
        blk-throttle: set default latency baseline for harddisk
        blk-throttle: fix NULL pointer dereference in throtl_schedule_pending_timer
        nvme: relax APST default max latency to 100ms
        nvme: only consider exit latency when choosing useful non-op power states
        nvme-fc: fix missing put reference on controller create failure
        nvme-fc: on lldd/transport io error, terminate association
        nvme-rdma: fast fail incoming requests while we reconnect
        nvme-pci: fix multiple ctrl removal scheduling
        nvme: fix hang in remove path
        elevator: fix truncation of icq_cache_name
        blk-mq: fix direct issue
        blk-mq: pass correct hctx to blk_mq_try_issue_directly
        bio-integrity: Do not allocate integrity context for bio w/o data
      42211f6c
    • Linus Torvalds's avatar
      Merge tag 'sound-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 39e4edfd
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This update contains a slightly hight amount of changes due to the
        pending ASoC fixes:
      
         - ALSA timer core got a couple of fixes for races between read and
           ioctl, leading to potential read of uninitialized kmalloced memory
      
         - ASoC core fixed the de-registration pattern for use-after-free bug
      
         - The rewrite of probe code in ASoC Intel Skylake for i915 component
      
         - ASoC R-snd got a series of fixes for SSI
      
         - ASoC simple-card, atmel, da7213, and rt286 trivial fixes
      
         - HD-audio ALC269 quirk and rearrangement of quirk table"
      
      * tag 'sound-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT
        ALSA: timer: Fix race between read and ioctl
        ALSA: hda/realtek - Reorder ALC269 ASUS quirk entries
        ALSA: hda/realtek: Fix mic and headset jack sense on Asus X705UD
        ASoC: rsnd: fixup parent_clk_name of AUDIO_CLKOUTx
        ASoC: Intel: Skylake: Fix to parse consecutive string tkns in manifest
        ASoC: Intel: Skylake: Fix IPC rx_list corruption
        ASoC: rsnd: SSI PIO adjust to 24bit mode
        MAINTAINERS: Update email address for patches to Wolfson parts
        ASoC: Fix use-after-free at card unregistration
        ASoC: simple-card: fix mic jack initialization
        ASoC: rsnd: don't call free_irq() on Parent SSI
        ASoC: atmel-classd: sync regcache when resuming
        ASoC: rsnd: don't use PDTA bit for 24bit on SSI
        ASoC: da7213: Fix incorrect usage of bitwise '&' operator for SRM check
        rt286: add Thinkpad Helix 2 to force_combo_jack_table
        ASoC: Intel: Skylake: Move i915 registration to worker thread
      39e4edfd
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.12-rc5' of git://people.freedesktop.org/~airlied/linux · 6107cc58
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Intel, nouveau, rockchip, vmwgfx, imx, meson, mediatek and core fixes.
      
        Bit more spread out fixes this time, fixes for 7 drivers + a couple of
        core fixes.
      
        i915 and vmwgfx are the main ones. The vmwgfx ones fix a bunch of
        regressions in their atomic rework, and a few fixes destined for
        stable. i915 has some 4.12 regressions and older things that need to
        be fixed in stable as well.
      
        nouveau also has some runtime pm fixes and a timer list handling fix,
        otherwise a couple of core and small driver regression fixes"
      
      * tag 'drm-fixes-for-v4.12-rc5' of git://people.freedesktop.org/~airlied/linux: (37 commits)
        drm/i915: fix warning for unused variable
        drm/meson: Fix driver bind when only CVBS is available
        drm/i915: Fix 90/270 rotated coordinates for FBC
        drm/i915: Restore has_fbc=1 for ILK-M
        drm/i915: Workaround VLV/CHV DSI scanline counter hardware fail
        drm/i915: Fix logical inversion for gen4 quirking
        drm/i915: Guard against i915_ggtt_disable_guc() being invoked unconditionally
        drm/i915: Always recompute watermarks when distrust_bios_wm is set, v2.
        drm/i915: Prevent the system suspend complete optimization
        drm/i915/psr: disable psr2 for resolution greater than 32X20
        drm/i915: Hold a wakeref for probing the ring registers
        drm/i915: Short-circuit i915_gem_wait_for_idle() if already idle
        drm/i915: Disable decoupled MMIO
        drm/i915/guc: Remove stale comment for q_fail
        drm/vmwgfx: Bump driver minor and date
        drm/vmwgfx: Remove unused legacy cursor functions
        drm/vmwgfx: fix spelling mistake "exeeds" -> "exceeds"
        drm/vmwgfx: Fix large topology crash
        drm/vmwgfx: Make sure to update STDU when FB is updated
        drm/vmwgfx: Make sure backup_handle is always valid
        ...
      6107cc58
  3. 09 Jun, 2017 17 commits
    • Al Viro's avatar
      excessive checks in ufs_write_failed() and ufs_evict_inode() · babef37d
      Al Viro authored
      As it is, short copy in write() to append-only file will fail
      to truncate the excessive allocated blocks.  As the matter of
      fact, all checks in ufs_truncate_blocks() are either redundant
      or wrong for that caller.  As for the only other caller
      (ufs_evict_inode()), we only need the file type checks there.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      babef37d
    • Al Viro's avatar
      ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path · 006351ac
      Al Viro authored
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      006351ac
    • Al Viro's avatar
      ufs_extend_tail(): fix the braino in calling conventions of ufs_new_fragments() · 940ef1a0
      Al Viro authored
      ... and it really needs splitting into "new" and "extend" cases, but that's for
      later
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      940ef1a0
    • Al Viro's avatar
      ufs: set correct ->s_maxsize · 6b0d144f
      Al Viro authored
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      6b0d144f
    • Al Viro's avatar
      ufs: restore maintaining ->i_blocks · eb315d2a
      Al Viro authored
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      eb315d2a
    • Al Viro's avatar
      fix ufs_isblockset() · 414cf718
      Al Viro authored
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      414cf718
    • Al Viro's avatar
      ufs: restore proper tail allocation · 8785d84d
      Al Viro authored
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      8785d84d
    • Omar Sandoval's avatar
      Btrfs: fix delalloc accounting leak caused by u32 overflow · 70e7af24
      Omar Sandoval authored
      btrfs_calc_trans_metadata_size() does an unsigned 32-bit multiplication,
      which can overflow if num_items >= 4 GB / (nodesize * BTRFS_MAX_LEVEL * 2).
      For a nodesize of 16kB, this overflow happens at 16k items. Usually,
      num_items is a small constant passed to btrfs_start_transaction(), but
      we also use btrfs_calc_trans_metadata_size() for metadata reservations
      for extent items in btrfs_delalloc_{reserve,release}_metadata().
      
      In drop_outstanding_extents(), num_items is calculated as
      inode->reserved_extents - inode->outstanding_extents. The difference
      between these two counters is usually small, but if many delalloc
      extents are reserved and then the outstanding extents are merged in
      btrfs_merge_extent_hook(), the difference can become large enough to
      overflow in btrfs_calc_trans_metadata_size().
      
      The overflow manifests itself as a leak of a multiple of 4 GB in
      delalloc_block_rsv and the metadata bytes_may_use counter. This in turn
      can cause early ENOSPC errors. Additionally, these WARN_ONs in
      extent-tree.c will be hit when unmounting:
      
          WARN_ON(fs_info->delalloc_block_rsv.size > 0);
          WARN_ON(fs_info->delalloc_block_rsv.reserved > 0);
          WARN_ON(space_info->bytes_pinned > 0 ||
                  space_info->bytes_reserved > 0 ||
                  space_info->bytes_may_use > 0);
      
      Fix it by casting nodesize to a u64 so that
      btrfs_calc_trans_metadata_size() does a full 64-bit multiplication.
      While we're here, do the same in btrfs_calc_trunc_metadata_size(); this
      can't overflow with any existing uses, but it's better to be safe here
      than have another hard-to-debug problem later on.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarOmar Sandoval <osandov@fb.com>
      Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarChris Mason <clm@fb.com>
      70e7af24
    • Liu Bo's avatar
      Btrfs: clear EXTENT_DEFRAG bits in finish_ordered_io · 452e62b7
      Liu Bo authored
      Before this, we use 'filled' mode here, ie. if all range has been
      filled with EXTENT_DEFRAG bits, get to clear it, but if the defrag
      range joins the adjacent delalloc range, then we'll have EXTENT_DEFRAG
      bits in extent_state until releasing this inode's pages, and that
      prevents extent_data from being freed.
      
      This clears the bit if any was found within the ordered extent.
      Signed-off-by: default avatarLiu Bo <bo.li.liu@oracle.com>
      Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarChris Mason <clm@fb.com>
      452e62b7
    • Su Yue's avatar
      btrfs: tree-log.c: Wrong printk information about namelen · 286b92f4
      Su Yue authored
      In verify_dir_item, it wants to printk name_len of dir_item but
      printk data_len acutally.
      
      Fix it by calling btrfs_dir_name_len instead of btrfs_dir_data_len.
      Signed-off-by: default avatarSu Yue <suy.fnst@cn.fujitsu.com>
      Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarChris Mason <clm@fb.com>
      286b92f4
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.12b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · eb4125df
      Linus Torvalds authored
      Pull xen fix from Juergen Gross:
       "A fix for Xen on ARM when dealing with 64kB page size of a guest"
      
      * tag 'for-linus-4.12b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen/privcmd: Support correctly 64KB page granularity when mapping memory
      eb4125df
    • Dmitry Torokhov's avatar
      Input: synaptics-rmi4 - register F03 port as pass-through serio · a0897d5f
      Dmitry Torokhov authored
      The 5th generation Thinkpad X1 Carbons use Synaptics touchpads accessible
      over SMBus/RMI, combined with ALPS or Elantech trackpoint devices instead
      of classic IBM/Lenovo trackpoints. Unfortunately there is no way for ALPS
      driver to detect whether it is dealing with touchpad + trackpoint
      combination or just a trackpoint, so we end up with a "phantom" dualpoint
      ALPS device in addition to real touchpad and trackpoint.
      
      Given that we do not have any special advanced handling for ALPS or
      Elantech trackpoints (unlike IBM trackpoints that have separate driver and
      a host of options) we are better off keeping the trackpoints in PS/2
      emulation mode. We achieve that by setting serio type to SERIO_PS_PSTHRU,
      which will limit number of protocols psmouse driver will try. In addition
      to getting rid of the "phantom" touchpads, this will also speed up probing
      of F03 pass-through port.
      Reported-by: default avatarDamjan Georgievski <gdamjan@gmail.com>
      Suggested-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Acked-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      a0897d5f
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.12-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · a92f63cd
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "Mostly fairly minor, of note are:
      
         - Fix percpu allocations to be NUMA aware
      
         - Limit 4k page size config to 64TB virtual address space
      
         - Avoid needlessly restoring FP and vector registers
      
        Thanks to Aneesh Kumar K.V, Breno Leitao, Christophe Leroy, Frederic
        Barrat, Madhavan Srinivasan, Michael Bringmann, Nicholas Piggin,
        Vaibhav Jain"
      
      * tag 'powerpc-4.12-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/book3s64: Move PPC_DT_CPU_FTRs and enable it by default
        powerpc/mm/4k: Limit 4k page size config to 64TB virtual address space
        cxl: Fix error path on bad ioctl
        powerpc/perf: Fix Power9 test_adder fields
        powerpc/numa: Fix percpu allocations to be NUMA aware
        cxl: Avoid double free_irq() for psl,slice interrupts
        powerpc/kernel: Initialize load_tm on task creation
        powerpc/kernel: Fix FP and vector register restoration
        powerpc/64: Reclaim CPU_FTR_SUBCORE
        powerpc/hotplug-mem: Fix missing endian conversion of aa_index
        powerpc/sysdev/simple_gpio: Fix oops in gpio save_regs function
        powerpc/spufs: Fix coredump of SPU contexts
        powerpc/64s: Add dt_cpu_ftrs boot time setup option
      a92f63cd
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 788a73f4
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "Been sitting on these for a couple of weeks waiting on some larger
        batches to come in but it's been pretty quiet.
      
        Just your garden variety fixes here:
      
         - A few maintainers updates (ep93xx, Exynos, TI, Marvell)
         - Some PM fixes for Atmel/at91 and Marvell
         - A few DT fixes for Marvell, Versatile, TI Keystone, bcm283x
         - A reset driver patch to set module license for symbol access"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        MAINTAINERS: EP93XX: Update maintainership
        MAINTAINERS: remove kernel@stlinux.com obsolete mailing list
        ARM: dts: versatile: use #include "..." to include local DT
        MAINTAINERS: add device-tree files to TI DaVinci entry
        ARM: at91: select CONFIG_ARM_CPU_SUSPEND
        ARM: dts: keystone-k2l: fix broken Ethernet due to disabled OSR
        arm64: defconfig: enable some core options for 64bit Rockchip socs
        arm64: marvell: dts: fix interrupts in 7k/8k crypto nodes
        reset: hi6220: Set module license so that it can be loaded
        MAINTAINERS: add irqchip related drivers to Marvell EBU maintainers
        MAINTAINERS: sort F entries for Marvell EBU maintainers
        ARM: davinci: PM: Do not free useful resources in normal path in 'davinci_pm_init'
        ARM: davinci: PM: Free resources in error handling path in 'davinci_pm_init'
        ARM: dts: bcm283x: Reserve first page for firmware
        memory: atmel-ebi: mark PM ops as __maybe_unused
        MAINTAINERS: Remove Javier Martinez Canillas as reviewer for Exynos
      788a73f4
    • Dan Williams's avatar
      device-dax: fix 'dax' device filesystem inode destruction crash · b9d39d17
      Dan Williams authored
      The inode destruction path for the 'dax' device filesystem incorrectly
      assumes that the inode was initialized through 'alloc_dax()'. However,
      if someone attempts to directly mount the dax filesystem with 'mount -t
      dax dax mnt' that will bypass 'alloc_dax()' and the following failure
      signatures may occur as a result:
      
       kill_dax() must be called before final iput()
       WARNING: CPU: 2 PID: 1188 at drivers/dax/super.c:243 dax_destroy_inode+0x48/0x50
       RIP: 0010:dax_destroy_inode+0x48/0x50
       Call Trace:
        destroy_inode+0x3b/0x60
        evict+0x139/0x1c0
        iput+0x1f9/0x2d0
        dentry_unlink_inode+0xc3/0x160
        __dentry_kill+0xcf/0x180
        ? dput+0x37/0x3b0
        dput+0x3a3/0x3b0
        do_one_tree+0x36/0x40
        shrink_dcache_for_umount+0x2d/0x90
        generic_shutdown_super+0x1f/0x120
        kill_anon_super+0x12/0x20
        deactivate_locked_super+0x43/0x70
        deactivate_super+0x4e/0x60
      
       general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
       RIP: 0010:kfree+0x6d/0x290
       Call Trace:
        <IRQ>
        dax_i_callback+0x22/0x60
        ? dax_destroy_inode+0x50/0x50
        rcu_process_callbacks+0x298/0x740
      
       ida_remove called for id=0 which is not allocated.
       WARNING: CPU: 0 PID: 0 at lib/idr.c:383 ida_remove+0x110/0x120
       [..]
       Call Trace:
        <IRQ>
        ida_simple_remove+0x2b/0x50
        ? dax_destroy_inode+0x50/0x50
        dax_i_callback+0x3c/0x60
        rcu_process_callbacks+0x298/0x740
      
      Add missing initialization of the 'struct dax_device' and inode so that
      the destruction path does not kfree() or ida_simple_remove()
      uninitialized data.
      
      Fixes: 7b6be844 ("dax: refactor dax-fs into a generic provider of 'struct dax_device' instances")
      Reported-by: default avatarSasha Levin <alexander.levin@verizon.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      b9d39d17
    • Dave Young's avatar
      efi: Fix boot panic because of invalid BGRT image address · 792ef14d
      Dave Young authored
      Maniaxx reported a kernel boot crash in the EFI code, which I emulated
      by using same invalid phys addr in code:
      
        BUG: unable to handle kernel paging request at ffffffffff280001
        IP: efi_bgrt_init+0xfb/0x153
        ...
        Call Trace:
         ? bgrt_init+0xbc/0xbc
         acpi_parse_bgrt+0xe/0x12
         acpi_table_parse+0x89/0xb8
         acpi_boot_init+0x445/0x4e2
         ? acpi_parse_x2apic+0x79/0x79
         ? dmi_ignore_irq0_timer_override+0x33/0x33
         setup_arch+0xb63/0xc82
         ? early_idt_handler_array+0x120/0x120
         start_kernel+0xb7/0x443
         ? early_idt_handler_array+0x120/0x120
         x86_64_start_reservations+0x29/0x2b
         x86_64_start_kernel+0x154/0x177
         secondary_startup_64+0x9f/0x9f
      
      There is also a similar bug filed in bugzilla.kernel.org:
      
        https://bugzilla.kernel.org/show_bug.cgi?id=195633
      
      The crash is caused by this commit:
      
        7b0a9114 efi/x86: Move the EFI BGRT init code to early init code
      
      The root cause is the firmware on those machines provides invalid BGRT
      image addresses.
      
      In a kernel before above commit BGRT initializes late and uses ioremap()
      to map the image address. Ioremap validates the address, if it is not a
      valid physical address ioremap() just fails and returns. However in current
      kernel EFI BGRT initializes early and uses early_memremap() which does not
      validate the image address, and kernel panic happens.
      
      According to ACPI spec the BGRT image address should fall into
      EFI_BOOT_SERVICES_DATA, see the section 5.2.22.4 of below document:
      
        http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf
      
      Fix this issue by validating the image address in efi_bgrt_init(). If the
      image address does not fall into any EFI_BOOT_SERVICES_DATA areas we just
      bail out with a warning message.
      Reported-by: default avatarManiaxx <tripleshiftone@gmail.com>
      Signed-off-by: default avatarDave Young <dyoung@redhat.com>
      Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Matt Fleming <matt@codeblueprint.co.uk>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: linux-efi@vger.kernel.org
      Fixes: 7b0a9114 ("efi/x86: Move the EFI BGRT init code to early init code")
      Link: http://lkml.kernel.org/r/20170609084558.26766-2-ard.biesheuvel@linaro.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      792ef14d
    • Vaibhav Jain's avatar
      cxl: Avoid double free_irq() for psl,slice interrupts · ed45509b
      Vaibhav Jain authored
      During an eeh call to cxl_remove can result in double free_irq of
      psl,slice interrupts. This can happen if perst_reloads_same_image == 1
      and call to cxl_configure_adapter() fails during slot_reset
      callback. In such a case we see a kernel oops with following back-trace:
      
      Oops: Kernel access of bad area, sig: 11 [#1]
      Call Trace:
        free_irq+0x88/0xd0 (unreliable)
        cxl_unmap_irq+0x20/0x40 [cxl]
        cxl_native_release_psl_irq+0x78/0xd8 [cxl]
        pci_deconfigure_afu+0xac/0x110 [cxl]
        cxl_remove+0x104/0x210 [cxl]
        pci_device_remove+0x6c/0x110
        device_release_driver_internal+0x204/0x2e0
        pci_stop_bus_device+0xa0/0xd0
        pci_stop_and_remove_bus_device+0x28/0x40
        pci_hp_remove_devices+0xb0/0x150
        pci_hp_remove_devices+0x68/0x150
        eeh_handle_normal_event+0x140/0x580
        eeh_handle_event+0x174/0x360
        eeh_event_handler+0x1e8/0x1f0
      
      This patch fixes the issue of double free_irq by checking that
      variables that hold the virqs (err_hwirq, serr_hwirq, psl_virq) are
      not '0' before un-mapping and resetting these variables to '0' when
      they are un-mapped.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarVaibhav Jain <vaibhav@linux.vnet.ibm.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      ed45509b