Pull kbuild fixes from Michal Marek:
 "Three more fixes for the relative build dir feature:

   - Shut up make -s again
   - Fix for rpm/deb/tar-pkg with O=<subdir>
   - Fix for CONFIG_EXTRA_FIRMWARE"

* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  firmware: Create directories for external firmware
  kbuild: Fix packaging targets with relative $(srctree)
  kbuild: Do not print the build directory with make -s

Pull ACPI and power management fixes from Rafael Wysocki:
 "These are a few regression fixes for ACPI device enumeration and
  resources management, intel_pstate and cpufreq, a revert of an ACPI
  commit removing user space interfaces in /proc that we incorrectly
  thought were not used any more, fixes for some long-standing
  concurrency issues in the ACPI EC driver, two ACPI battery driver
  fixes, stable-candidate fixes for intel_pstate, an ACPI-related fix
  for i915 and two new ACPI video blacklist entries for Win8-oriented
  BIOSes.

  Specifics:

   - Missing device ID for ACPI enumeration of PNP devices that we
     overlooked during the recent rework of that code from Zhang Rui.

   - Fix for a problem introduced during the 3.14 cycle in the ACPI
     device resources management code and causing it to reject all
     resources of length 0 although some of them are actually valid
     which affects serial ports detection on a number of systems.  From
     Andy Whitcroft.

   - intel_pstate fix for a boot problem on some BayTrail-based systems
     introduced by a previous fix related to that platform during the
     3.13 cycle from Dirk Brandewie.

   - Revert of a 3.13 commit that removed the ACPI AC /proc interface
     which turns out to be still needed by some old utilities
     (kpowersave from kde 3.5.10 in particular) from Lan Tianyu.

   - cpufreq build fix for the davinci ARM platform from Prabhakar Lad
     (the breakage was introduced during the 3.10 cycle).

   - ACPI-related i915 fix preventing firmware on some Thinkpad laptops
     from setting backlight levels incorrectly during AC plug/unplug.
     From Aaron Lu.

   - Fixes for two nasty race conditions in the ACPI embedded controller
     driver that may be responsible for a number of past bug reports
     related to the EC from Lv Zhang and a fix for two memory leaks in
     error code paths in that driver from Colin Ian King.

   - Fixes for a couple of corner-case issues in the intel_pstate driver
     (all candidates for -stable) from Dirk Brandewie and Vincent Minet.

   - Fixes for two corner-case issues in the ACPI battery driver from
     Josef Gajdusek and Lan Tianyu.

   - Two new ACPI video blacklist entries for Acer TravelMate B113 and
     Dell Inspiron 5737 from Edward Lin and Martin Kepplinger"

* tag 'pm+acpi-3.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI / PNP: add soc_button_array device ID to PNP IDs list
  cpufreq: Makefile: fix compilation for davinci platform
  ACPI / video: Add Acer TravelMate B113 to native backlight blacklist
  ACPI / video: Add Dell Inspiron 5737 to the blacklist
  ACPI / i915: ignore firmware requests for backlight change
  ACPI / battery: fix wrong value of capacity_now reported when fully charged
  ACPI / resources: only reject zero length resources based at address zero
  ACPI / battery: Retry to get battery information if failed during probing
  ACPI / EC: Free saved_ec on error exit path
  ACPI / EC: Add detailed fields debugging support of EC_SC(R).
  ACPI / EC: Update revision due to recent changes
  ACPI / EC: Fix race condition in ec_transaction_completed()
  ACPI / EC: Remove duplicated ec_wait_ibf0() waiter
  ACPI / EC: Add asynchronous command byte write support
  ACPI / EC: Avoid race condition related to advance_transaction()
  intel_pstate: Set CPU number before accessing MSRs
  intel_pstate: Update documentation of {max,min}_perf_pct sysfs files
  intel_pstate: don't touch turbo bit if turbo disabled or unavailable.
  intel_pstate: Fix setting VID
  Revert "ACPI / AC: Remove AC's proc directory."

* pm-cpufreq:
  cpufreq: Makefile: fix compilation for davinci platform
  intel_pstate: Set CPU number before accessing MSRs
  intel_pstate: Update documentation of {max,min}_perf_pct sysfs files
  intel_pstate: don't touch turbo bit if turbo disabled or unavailable.
  intel_pstate: Fix setting VID

* acpi-video:
  ACPI / video: Add Acer TravelMate B113 to native backlight blacklist
  ACPI / video: Add Dell Inspiron 5737 to the blacklist
  ACPI / i915: ignore firmware requests for backlight change

* acpi-ec:
  ACPI / EC: Free saved_ec on error exit path
  ACPI / EC: Add detailed fields debugging support of EC_SC(R).
  ACPI / EC: Update revision due to recent changes
  ACPI / EC: Fix race condition in ec_transaction_completed()
  ACPI / EC: Remove duplicated ec_wait_ibf0() waiter
  ACPI / EC: Add asynchronous command byte write support
  ACPI / EC: Avoid race condition related to advance_transaction()

* acpi-resources:
  ACPI / resources: only reject zero length resources based at address zero

* acpi-ac:
  Revert "ACPI / AC: Remove AC's proc directory."

* acpi-scan:
  ACPI / PNP: add soc_button_array device ID to PNP IDs list

* acpi-battery:
  ACPI / battery: fix wrong value of capacity_now reported when fully charged
  ACPI / battery: Retry to get battery information if failed during probing

Pull libata fixes from Tejun Heo:
 "Nothing too interesting.  All fixes are ahci_platform related"

* 'for-3.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
  ahci_xgene: fix the dma state machine lockup for the IDENTIFY DEVICE PIO mode command.
  libahci: export ahci_qc_issue() and ahci_start_fix_rx()
  ata: ahci_imx: warn when disabling ahci link
  ahci: disable ncq feature for hisilicon sata
  ahci: imx: manage only sata_ref_clk in imx_sata_enable[disable]
  libahci_platform: Fail when PHY required but PHY support disabled

Pull cgroup fixes from Tejun Heo:
 "Mostly fixes for the fallouts from the recent cgroup core changes.

  The decoupled nature of cgroup dynamic hierarchy management
  (hierarchies are created dynamically on mount but may or may not be
  reused once unmounted depending on remaining usages) led to more
  ugliness being added to kernfs.

  Hopefully, this is the last of it"

* 'for-3.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cpuset: break kernfs active protection in cpuset_write_resmask()
  cgroup: fix a race between cgroup_mount() and cgroup_kill_sb()
  kernfs: introduce kernfs_pin_sb()
  cgroup: fix mount failure in a corner case
  cpuset,mempolicy: fix sleeping function called from invalid context
  cgroup: fix broken css_has_online_children()

Pull workqueue fixes from Tejun Heo:
 "Two workqueue fixes.  Both are one liners.  One fixes missing uevent
  for workqueue files on sysfs.  The other one fixes missing zeroing of
  NUMA cpu masks which can lead to oopses among other things"

* 'for-3.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
  workqueue: zero cpumask of wq_numa_possible_cpumask on init
  workqueue: fix dev_set_uevent_suppress() imbalance

Pull percpu fix from Tejun Heo:
 "One patch to fix a typo in percpu section name.  Given how long the
  bug has been there and that there hasn't been any report of brekage,
  it's unlikely to cause actual issues"

* 'for-3.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
  core: fix typo in percpu read_mostly section

Pull i2c build fix and cleanup from Wolfram Sang:
 "One buildfix for the i2c subsystem.  While here, I decided to add the
  header cleanup as well"

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: sun6i-p2wi: Remove duplicate inclusion of module.h
  i2c: mux: pca954x: fix dependencies

Pull crypto fixes from Herbert Xu:
 "This push fixes an error in sha512_ssse3 that leads to incorrect
  output as well as a memory leak in caam_jr when the module is
  unloaded"

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: caam - fix memleak in caam_jr module
  crypto: sha512_ssse3 - fix byte count to bit count conversion

This patch fixes a memory leak that appears when caam_jr module is unloaded.

Cc: <stable@vger.kernel.org> # 3.13+
Signed-off-by: Cristian Stoica <cristian.stoica@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Pull PCI fixes from Bjorn Helgaas:
 "Just a fix for the device reset path and an email address update.

  Virtualization
    - Fix "wait for pending transactions" for PCI AF reset (Alex
      Williamson)

  Miscellaneous
    - Update mx6 PCI driver maintainer email (Fabio Estevam)"

* tag 'pci-v3.16-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  MAINTAINERS: Update mx6 PCI driver maintainer's email
  PCI: Fix unaligned access in AF transaction pending test

Pull f2fs bugfixes from Jaegeuk Kim:
 "This includes a couple of bug fixes found by xfstests.  In addition,
  one critical bug was reported by Brian Chadwick, which is falling into
  the infinite loop in balance_dirty_pages.  And it turned out due to
  the IO merging policy in f2fs, which was newly merged in 3.16.

   - fix normal and recovery path for fallocated regions
   - fix error case mishandling
   - recover renamed fsync inodes correctly
   - fix to get out of infinite loops in balance_dirty_pages
   - fix kernel NULL pointer error"

* tag 'f2fs-fixes-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs:
  f2fs: avoid to access NULL pointer in issue_flush_thread
  f2fs: check bdi->dirty_exceeded when trying to skip data writes
  f2fs: do checkpoint for the renamed inode
  f2fs: release new entry page correctly in error path of f2fs_rename
  f2fs: fix error path in init_inode_metadata
  f2fs: check lower bound nid value in check_nid_range
  f2fs: remove unused variables in f2fs_sm_info
  f2fs: fix not to allocate unnecessary blocks during fallocate
  f2fs: recover fallocated data and its i_size together
  f2fs: fix to report newly allocate region as extent

Commit 5180d5f4 ("firmware: Simplify directory creation") broke
including firmware specified in CONFIG_EXTRA_FIRMWARE:

  MK_FW   firmware/amd-ucode/microcode_amd.bin.gen.S
/bin/sh: firmware/amd-ucode/microcode_amd.bin.gen.S: No such file or directory
...
firmware/Makefile:185: recipe for target
'firmware/amd-ucode/microcode_amd.bin.gen.S' failed

It works with O= builds, because the directory is created by
Makefile.build. Create the directory in firmware/Makefile in non-O
builds.
Reported-and-tested-by: Ronald Uitermark <ronald645@gmail.com>
Reported-and-tested-by: Torsten Kaiser <just.for.lkml@googlemail.com>
Signed-off-by: Michal Marek <mmarek@suse.cz>

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=75861

Denis 2014-05-10 11:28:59 UTC reported:
"F2FS-fs (mmcblk0p28): mounting..
 Unable to handle kernel NULL pointer dereference at virtual address 00000018
 ...
 [<c0a2f678>] (_raw_spin_lock+0x3c/0x70) from [<c03a0330>] (issue_flush_thread+0x50/0x17c)
 [<c03a0330>] (issue_flush_thread+0x50/0x17c) from [<c01b4064>] (kthread+0x98/0xa4)
 [<c01b4064>] (kthread+0x98/0xa4) from [<c0108060>] (kernel_thread_exit+0x0/0x8)"

This patch assign cmd_control_info in sm_info before issue_flush_thread is being
created, so this make sure that issue flush thread will have no chance to access
invalid info in fcc.
Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Reviewed-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

If we don't check the current backing device status, balance_dirty_pages can
fall into infinite pausing routine.

This can be occurred when a lot of directories make a small number of dirty
dentry pages including files.
Reported-by: Brian Chadwick <brianchad@westnet.com.au>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

If an inode is renamed, it should be registered as file_lost_pino to conduct
checkpoint at f2fs_sync_file.
Otherwise, the inode cannot be recovered due to no dent_mark in the following
scenario.

Note that, this scenario is from xfstests/322.

1. create "a"
2. fsync "a"
3. rename "a" to "b"
4. fsync "b"
5. Sudden power-cut

After recovery is done, "b" should be seen.
However, the result shows "a", since the recovery procedure does not enter
recover_dentry due to no dent_mark.

The reason is like below.
- The nid of "a" is checkpointed during #2, f2fs_sync_file.
- The inode page for "b" produced by #3 is written without dent_mark by
sync_node_pages.

So, this patch fixes this bug by assinging file_lost_pino to the "a"'s inode.
If the pino is lost, f2fs_sync_file conducts checkpoint, and then recovers
the latest pino and its dentry information for further recovery.
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

This patch correct releasing code of new_page to avoid BUG_ON in error patch of
f2fs_rename.
Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

If we fail in this path:
->init_inode_metadata
  ->make_empty_dir
    ->get_new_data_page
      ->grab_cache_page return -ENOMEM

We will bug on in error path of init_inode_metadata when call remove_inode_page
because i_block = 2 (one inode block will be released later & one dentry block).

We should release the dentry block in init_inode_metadata to avoid this BUG_ON,
and avoid leak of dentry block resource, because we never have second chance to
release that block in ->evict_inode as in upper error path we make this inode
'bad'.
Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

This patch add lower bound verification for nid in check_nid_range, so nids
reserved like 0, node, meta passed by caller could be checked there.

And then check_nid_range could be used in f2fs_nfs_get_inode for simplifying
code.
Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

Remove unused variables in struct f2fs_sm_info.
Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

The soc_button_array PNP driver was introduced in 3.15.
But in commit eec15edb (ACPI / PNP: use device ID list for
PNPACPI device enumeration), when reworking the PNPACPI device
enumeration, we missed the soc_button_array device ID.

This results in a regression in 3.16-rc1 that soc_button_array
pnp device fails to be enumerated.

Fix the problem by adding soc_button_array device ID into the
acpi_pnp scan handler's ID list.

Fixes: eec15edb (ACPI / PNP: use device ID list for PNPACPI device enumeration)
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Since commtit 8a7b1227 (cpufreq: davinci: move cpufreq driver to
drivers/cpufreq) this added dependancy only for CONFIG_ARCH_DAVINCI_DA850
where as davinci_cpufreq_init() call is used by all davinci platform.

This patch fixes following build error:

arch/arm/mach-davinci/built-in.o: In function `davinci_init_late':
:(.init.text+0x928): undefined reference to `davinci_cpufreq_init'
make: *** [vmlinux] Error 1

Fixes: 8a7b1227 (cpufreq: davinci: move cpufreq driver to drivers/cpufreq)
Signed-off-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Pull hwmon fixes from Guenter Roeck:
 "Fix a number of zero-day bugs, mostly found with module test scripts.
  Nothing major, but potentially annoying and worthwhile to fix"

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (adc128d818) Drop write support on inX_input attributes
  hwmon: (emc2103) Clamp limits instead of bailing out
  hwmon: (adm1031) Fix writes to limit registers
  hwmon: (adm1021) Fix cache problem when writing temperature limits
  hwmon: (adm1029) Ensure the fan_div cache is updated in set_fan_div
  hwmon: (amc6821) Fix permissions for temp2_input
  hwmon: (ntc_thermistor) Correct information printed during probe

This patch fixes the dma state machine lockup due to the processing
of IDENTIFY DEVICE PIO mode command. The X-Gene AHCI controller
has an errata in which it cannot clear the BSY bit after the PIO setup
FIS. The dma state machine enters CMFatalErrorUpdate state and locks
up. This patch also removes the dma restart workaround from the read_id
function as the read_id function is only called by libata layer for
ATA_INTERNAL commands. But for some cases eg: PORT MULTIPLIER
and udev, the framework will enumerate using SCSI commands and it will
not call read_id function.
Signed-off-by: Loc Ho <lho@apm.com>
Signed-off-by: Suman Tripathi <stripathi@apm.com>
Signed-off-by: Tejun Heo <tj@kernel.org>

The subsequent patch will make use of them.
Signed-off-by: Loc Ho <lho@apm.com>
Signed-off-by: Suman Tripathi <stripathi@apm.com>
Signed-off-by: Tejun Heo <tj@kernel.org>

Fix backlight control for Acer TravelMate B113 Laptop by adding
it to the video_dmi_table.

A workaround before that was to use acpi_osi=Linux or
acpi_backlight=vendor on boot but even then, only the function-
keys worked.

With this change there is no need for boot parameters and DE's
controls work as well.
Signed-off-by: Martin Kepplinger <martink@posteo.de>
[rjw: Subject]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

With win8 capabiltiy, the ACPI backlight control is broken.
The system also loses backlight setting when resuming from S3.

Add this model to the the ACPI video detect blacklist to make backlight
functionality work.

Although backlight functionality works via video.use_native_backlight=1,
this approach may be safer.
Signed-off-by: Edward Lin <yidi.lin@canonical.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Some Thinkpad laptops' firmware will initiate a backlight level change
request through operation region on the events of AC plug/unplug, but
since we are not using firmware's interface to do the backlight setting
on these affected laptops, we do not want the firmware to use some
arbitrary value from its ASL variable to set the backlight level on
AC plug/unplug either.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=76491
Link: https://bugzilla.kernel.org/show_bug.cgi?id=77091Reported-and-tested-by: Igor Gnatenko <i.gnatenko.brain@gmail.com>
Reported-and-tested-by: Anton Gubarkov <anton.gubarkov@gmail.com>
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Acked-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

It seems that some batteries (noticed on DELL JYPJ136) assume
capacity_now = design_capacity when fully charged. This causes
reported capacity to suddenly jump to >full_charge_capacity (and that
means capacity reported to userspace is >100% and incorrect)
values after 99%. This patch detects capacity_now > full_charge_capacity,
notifies userspace (unless it is the known bug where capacity_now ==
design_capacity) and trims the value to full_charge_capacity.
Signed-off-by: Josef Gajdusek <atx@atx.name>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Pull thermal fixes from Zhang Rui:
 "Specifics:

   - update Email address of Thermal subsystem maintainer Eduardo
     Valentin.

   - fix a problem that unloading thermal module results in kernel crash
     because a non-exist device file is removed on thermal unload.

   - fix a problem that critical trip point is set wrongly on latest
     i.MX6 SOC and results in system critical shutdown.

   - a couple of fixes to Tmon tool, of-thermal code and ti thermal
     driver"

* 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
  tmon: set umask to a reasonable value
  tmon: Check log file for common secuirty issues
  tools/thermal: tmon: fix compilation errors when building statically
  thermal: ti-soc-thermal: ti-bandgap.c: Cleaning up wrong address is checked
  Thermal: imx: correct critical trip temperature setting
  thermal: Bind cooling devices with the correct arguments
  thermal: Add braces around suspect code
  thermal: hwmon: Make the check for critical temp valid consistent
  MAINTAINERS: Update Eduardo Valentin's email address

Pull HID fixes from Jiri Kosina:
 "A few tiny HID subsystem fixes for 3.16"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: use multi input quirk for 22b9:2968
  HID: sensor-hub: fix potential memory leak
  HID: usbhid: quirk for PM1610 and PM1640 Touchscreen.
  HID: rmi: Protect PM-only functions by #ifdef CONFIG_PM
  HID: sensor-hub: introduce Kconfig dependency on IOMEM
  HID: sensor-hub: make dyn_callback_lock IRQ-safe

Pull pin control fixes from Linus Walleij:
 "Two fixes for the pin control subsystem, both relating to the error
  path in probe()

  I'm a bit snowed under by mail but these have boiled in linux-next and
  should propagate to you"

* tag 'pinctrl-v3.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: berlin: fix an error code in berlin_pinctrl_probe()
  pinctrl: sunxi: Fix potential null pointer dereference

The recently merged change (in v3.14-rc6) to ACPI resource detection
(below) causes all zero length ACPI resources to be elided from the
table:

  commit b355cee8
  Author: Zhang Rui <rui.zhang@intel.com>
  Date:   Thu Feb 27 11:37:15 2014 +0800

    ACPI / resources: ignore invalid ACPI device resources

This change has caused a regression in (at least) serial port detection
for a number of machines (see LP#1313981 [1]).  These seem to represent
their IO regions (presumably incorrectly) as a zero length region.
Reverting the above commit restores these serial devices.

Only elide zero length resources which lie at address 0.

Fixes: b355cee8 (ACPI / resources: ignore invalid ACPI device resources)
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Acked-by: Zhang Rui <rui.zhang@intel.com>
Cc: 3.14+ <stable@vger.kernel.org> # 3.14+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Writes into input registers doesn't make sense, even more so since
the writes actually ended up writing into the maximum limit registers.
Drop it.

Cc: stable@vger.kernel.org
Reviewed-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

It is customary to clamp limits instead of bailing out with an error
if a configured limit is out of the range supported by the driver.
This simplifies limit configuration, since the user will not typically
know chip and/or driver specific limits.
Reviewed-by: Jean Delvare <jdelvare@suse.de>
Cc: stable@vger.kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

When hot-adding and onlining CPU, kernel panic occurs, showing following
call trace.

  BUG: unable to handle kernel paging request at 0000000000001d08
  IP: [<ffffffff8114acfd>] __alloc_pages_nodemask+0x9d/0xb10
  PGD 0
  Oops: 0000 [#1] SMP
  ...
  Call Trace:
   [<ffffffff812b8745>] ? cpumask_next_and+0x35/0x50
   [<ffffffff810a3283>] ? find_busiest_group+0x113/0x8f0
   [<ffffffff81193bc9>] ? deactivate_slab+0x349/0x3c0
   [<ffffffff811926f1>] new_slab+0x91/0x300
   [<ffffffff815de95a>] __slab_alloc+0x2bb/0x482
   [<ffffffff8105bc1c>] ? copy_process.part.25+0xfc/0x14c0
   [<ffffffff810a3c78>] ? load_balance+0x218/0x890
   [<ffffffff8101a679>] ? sched_clock+0x9/0x10
   [<ffffffff81105ba9>] ? trace_clock_local+0x9/0x10
   [<ffffffff81193d1c>] kmem_cache_alloc_node+0x8c/0x200
   [<ffffffff8105bc1c>] copy_process.part.25+0xfc/0x14c0
   [<ffffffff81114d0d>] ? trace_buffer_unlock_commit+0x4d/0x60
   [<ffffffff81085a80>] ? kthread_create_on_node+0x140/0x140
   [<ffffffff8105d0ec>] do_fork+0xbc/0x360
   [<ffffffff8105d3b6>] kernel_thread+0x26/0x30
   [<ffffffff81086652>] kthreadd+0x2c2/0x300
   [<ffffffff81086390>] ? kthread_create_on_cpu+0x60/0x60
   [<ffffffff815f20ec>] ret_from_fork+0x7c/0xb0
   [<ffffffff81086390>] ? kthread_create_on_cpu+0x60/0x60

In my investigation, I found the root cause is wq_numa_possible_cpumask.
All entries of wq_numa_possible_cpumask is allocated by
alloc_cpumask_var_node(). And these entries are used without initializing.
So these entries have wrong value.

When hot-adding and onlining CPU, wq_update_unbound_numa() is called.
wq_update_unbound_numa() calls alloc_unbound_pwq(). And alloc_unbound_pwq()
calls get_unbound_pool(). In get_unbound_pool(), worker_pool->node is set
as follow:

3592         /* if cpumask is contained inside a NUMA node, we belong to that node */
3593         if (wq_numa_enabled) {
3594                 for_each_node(node) {
3595                         if (cpumask_subset(pool->attrs->cpumask,
3596                                            wq_numa_possible_cpumask[node])) {
3597                                 pool->node = node;
3598                                 break;
3599                         }
3600                 }
3601         }

But wq_numa_possible_cpumask[node] does not have correct cpumask. So, wrong
node is selected. As a result, kernel panic occurs.

By this patch, all entries of wq_numa_possible_cpumask are allocated by
zalloc_cpumask_var_node to initialize them. And the panic disappeared.
Signed-off-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Reviewed-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
Fixes: bce90380 ("workqueue: add wq_numa_tbl_len and wq_numa_possible_cpumask[]")

This device generates ABS_Z and ABS_RX events instead of ABS_X and
ABS_Y.
Signed-off-by: Wen-chien Jesse Sung <jesse.sung@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>