[PATCH review for 3.18 12/12] [media] bt8xx: fix memory leak

[Levin, Alexander (Sasha Levin)]

From: Sudip Mukherjee 

[ Upstream commit 6792eb0cf9310ec240b7e7c9bfa86dff4c758c68 ]

If dvb_attach() fails then we were just printing an error message and
exiting but the memory allocated to state was not released.

Signed-off-by: Sudip Mukherjee 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
---
 drivers/media/pci/bt8xx/dvb-bt8xx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/pci/bt8xx/dvb-bt8xx.c 
b/drivers/media/pci/bt8xx/dvb-bt8xx.c
index d407244fd1bc..bd0f5b195188 100644
--- a/drivers/media/pci/bt8xx/dvb-bt8xx.c
+++ b/drivers/media/pci/bt8xx/dvb-bt8xx.c
@@ -680,6 +680,7 @@ static void frontend_init(struct dvb_bt8xx_card *card, u32 
type)
/*  DST is not a frontend, attaching the ASIC   */
if (dvb_attach(dst_attach, state, >dvb_adapter) == NULL) {
pr_err("%s: Could not find a Twinhan DST\n", __func__);
+   kfree(state);
break;
}
/*  Attach other DST peripherals if any */
-- 
2.11.0

[PATCH review for 4.4 14/24] dmaengine: sun6i: allow build on ARM64 platforms (sun50i)

[Levin, Alexander (Sasha Levin)]

From: Icenowy Zheng 

[ Upstream commit c429ceb1e18252122ba96b52e689dcf87103c186 ]

As 64-bit Allwinner H5 SoC has the same DMA engine with H3, the DMA
driver should be allowed to be built for ARM64, in order to make it work on H5.

Signed-off-by: Icenowy Zheng 
Acked-by: Maxime Ripard 
Acked-by: Chen-Yu Tsai 
Signed-off-by: Vinod Koul 
Signed-off-by: Sasha Levin 
---
 drivers/dma/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index e6cd1a32025a..27b7b3a9bdd2 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -158,7 +158,7 @@ config DMA_SUN4I
 
 config DMA_SUN6I
tristate "Allwinner A31 SoCs DMA support"
-   depends on MACH_SUN6I || MACH_SUN8I || COMPILE_TEST
+   depends on MACH_SUN6I || MACH_SUN8I || (ARM64 && ARCH_SUNXI) || 
COMPILE_TEST
depends on RESET_CONTROLLER
select DMA_ENGINE
select DMA_VIRTUAL_CHANNELS
-- 
2.11.0

[PATCH review for 4.4 17/24] platform/x86: intel_mid_thermal: Fix module autoload

[Levin, Alexander (Sasha Levin)]

From: Javier Martinez Canillas 

[ Upstream commit a93151a72061e944a4915458b1b1d6d505c03bbf ]

If the driver is built as a module, autoload won't work because the module
alias information is not filled. So user-space can't match the registered
device with the corresponding module.

Export the module alias information using the MODULE_DEVICE_TABLE() macro.

Before this patch:

$ modinfo drivers/platform/x86/intel_mid_thermal.ko | grep alias
$

After this patch:

$ modinfo drivers/platform/x86/intel_mid_thermal.ko | grep alias
alias:  platform:msic_thermal

Signed-off-by: Javier Martinez Canillas 
Signed-off-by: Andy Shevchenko 
Signed-off-by: Sasha Levin 
---
 drivers/platform/x86/intel_mid_thermal.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/intel_mid_thermal.c 
b/drivers/platform/x86/intel_mid_thermal.c
index 9f713b832ba3..5c768c4627d3 100644
--- a/drivers/platform/x86/intel_mid_thermal.c
+++ b/drivers/platform/x86/intel_mid_thermal.c
@@ -550,6 +550,7 @@ static const struct platform_device_id therm_id_table[] = {
{ "msic_thermal", 1 },
{ }
 };
+MODULE_DEVICE_TABLE(platform, therm_id_table);
 
 static struct platform_driver mid_thermal_driver = {
.driver = {
-- 
2.11.0

[PATCH review for 3.18 12/12] [media] bt8xx: fix memory leak

[Levin, Alexander (Sasha Levin)]

From: Sudip Mukherjee 

[ Upstream commit 6792eb0cf9310ec240b7e7c9bfa86dff4c758c68 ]

If dvb_attach() fails then we were just printing an error message and
exiting but the memory allocated to state was not released.

Signed-off-by: Sudip Mukherjee 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
---
 drivers/media/pci/bt8xx/dvb-bt8xx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/pci/bt8xx/dvb-bt8xx.c 
b/drivers/media/pci/bt8xx/dvb-bt8xx.c
index d407244fd1bc..bd0f5b195188 100644
--- a/drivers/media/pci/bt8xx/dvb-bt8xx.c
+++ b/drivers/media/pci/bt8xx/dvb-bt8xx.c
@@ -680,6 +680,7 @@ static void frontend_init(struct dvb_bt8xx_card *card, u32 
type)
/*  DST is not a frontend, attaching the ASIC   */
if (dvb_attach(dst_attach, state, >dvb_adapter) == NULL) {
pr_err("%s: Could not find a Twinhan DST\n", __func__);
+   kfree(state);
break;
}
/*  Attach other DST peripherals if any */
-- 
2.11.0

[PATCH review for 4.4 19/24] staging: lustre: hsm: stack overrun in hai_dump_data_field

[Levin, Alexander (Sasha Levin)]

From: frank zago 

[ Upstream commit 22aadb91c0a0055935109c175f5446abfb130702 ]

The function hai_dump_data_field will do a stack buffer
overrun when cat'ing /sys/fs/lustre/.../hsm/actions if an action has
some data in it.

hai_dump_data_field uses snprintf. But there is no check for
truncation, and the value returned by snprintf is used as-is.  The
coordinator code calls hai_dump_data_field with 12 bytes in the
buffer. The 6th byte of data is printed incompletely to make room for
the terminating NUL. However snprintf still returns 2, so when
hai_dump_data_field writes the final NUL, it does it outside the
reserved buffer, in the 13th byte of the buffer. This stack buffer
overrun hangs my VM.

Fix by checking that there is enough room for the next 2 characters
plus the NUL terminator. Don't print half bytes. Change the format to
02X instead of .2X, which makes more sense.

Signed-off-by: frank zago 
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8171
Reviewed-on: http://review.whamcloud.com/20338
Reviewed-by: John L. Hammond 
Reviewed-by: Jean-Baptiste Riaux 
Reviewed-by: Oleg Drokin 
Signed-off-by: James Simmons 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 .../staging/lustre/lustre/include/lustre/lustre_user.h | 18 --
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/drivers/staging/lustre/lustre/include/lustre/lustre_user.h 
b/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
index 80f8ec529424..8ed4558238fc 100644
--- a/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
+++ b/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
@@ -1063,23 +1063,21 @@ struct hsm_action_item {
  * \retval buffer
  */
 static inline char *hai_dump_data_field(struct hsm_action_item *hai,
-   char *buffer, int len)
+   char *buffer, size_t len)
 {
-   int i, sz, data_len;
+   int i, data_len;
char *ptr;
 
ptr = buffer;
-   sz = len;
data_len = hai->hai_len - sizeof(*hai);
-   for (i = 0 ; (i < data_len) && (sz > 0) ; i++) {
-   int cnt;
-
-   cnt = snprintf(ptr, sz, "%.2X",
-  (unsigned char)hai->hai_data[i]);
-   ptr += cnt;
-   sz -= cnt;
+   for (i = 0; (i < data_len) && (len > 2); i++) {
+   snprintf(ptr, 3, "%02X", (unsigned char)hai->hai_data[i]);
+   ptr += 2;
+   len -= 2;
}
+
*ptr = '\0';
+
return buffer;
 }
 
-- 
2.11.0

[PATCH review for 4.4 19/24] staging: lustre: hsm: stack overrun in hai_dump_data_field

[Levin, Alexander (Sasha Levin)]

From: frank zago 

[ Upstream commit 22aadb91c0a0055935109c175f5446abfb130702 ]

The function hai_dump_data_field will do a stack buffer
overrun when cat'ing /sys/fs/lustre/.../hsm/actions if an action has
some data in it.

hai_dump_data_field uses snprintf. But there is no check for
truncation, and the value returned by snprintf is used as-is.  The
coordinator code calls hai_dump_data_field with 12 bytes in the
buffer. The 6th byte of data is printed incompletely to make room for
the terminating NUL. However snprintf still returns 2, so when
hai_dump_data_field writes the final NUL, it does it outside the
reserved buffer, in the 13th byte of the buffer. This stack buffer
overrun hangs my VM.

Fix by checking that there is enough room for the next 2 characters
plus the NUL terminator. Don't print half bytes. Change the format to
02X instead of .2X, which makes more sense.

Signed-off-by: frank zago 
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8171
Reviewed-on: http://review.whamcloud.com/20338
Reviewed-by: John L. Hammond 
Reviewed-by: Jean-Baptiste Riaux 
Reviewed-by: Oleg Drokin 
Signed-off-by: James Simmons 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 .../staging/lustre/lustre/include/lustre/lustre_user.h | 18 --
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/drivers/staging/lustre/lustre/include/lustre/lustre_user.h 
b/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
index 80f8ec529424..8ed4558238fc 100644
--- a/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
+++ b/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
@@ -1063,23 +1063,21 @@ struct hsm_action_item {
  * \retval buffer
  */
 static inline char *hai_dump_data_field(struct hsm_action_item *hai,
-   char *buffer, int len)
+   char *buffer, size_t len)
 {
-   int i, sz, data_len;
+   int i, data_len;
char *ptr;
 
ptr = buffer;
-   sz = len;
data_len = hai->hai_len - sizeof(*hai);
-   for (i = 0 ; (i < data_len) && (sz > 0) ; i++) {
-   int cnt;
-
-   cnt = snprintf(ptr, sz, "%.2X",
-  (unsigned char)hai->hai_data[i]);
-   ptr += cnt;
-   sz -= cnt;
+   for (i = 0; (i < data_len) && (len > 2); i++) {
+   snprintf(ptr, 3, "%02X", (unsigned char)hai->hai_data[i]);
+   ptr += 2;
+   len -= 2;
}
+
*ptr = '\0';
+
return buffer;
 }
 
-- 
2.11.0

[PATCH review for 4.9 34/50] staging: lustre: llite: don't invoke direct_IO for the EOF case

[Levin, Alexander (Sasha Levin)]

From: Yang Sheng 

[ Upstream commit 77759771fb95420d23876cb104ab65c022613325 ]

The function generic_file_read_iter() does not check EOF
before invoke direct_IO callback. So we have to check it
ourselves.

Signed-off-by: Yang Sheng 
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8969
Reviewed-on: https://review.whamcloud.com/24552
Reviewed-by: Bob Glossman 
Reviewed-by: Bobi Jam 
Reviewed-by: Oleg Drokin 
Signed-off-by: James Simmons 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/staging/lustre/lustre/llite/rw26.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/lustre/lustre/llite/rw26.c 
b/drivers/staging/lustre/lustre/llite/rw26.c
index 26f3a37873a7..0cb70c3a1a0b 100644
--- a/drivers/staging/lustre/lustre/llite/rw26.c
+++ b/drivers/staging/lustre/lustre/llite/rw26.c
@@ -354,6 +354,10 @@ static ssize_t ll_direct_IO_26(struct kiocb *iocb, struct 
iov_iter *iter)
if (!lli->lli_has_smd)
return -EBADF;
 
+   /* Check EOF by ourselves */
+   if (iov_iter_rw(iter) == READ && file_offset >= i_size_read(inode))
+   return 0;
+
/* FIXME: io smaller than PAGE_SIZE is broken on ia64 ??? */
if ((file_offset & ~PAGE_MASK) || (count & ~PAGE_MASK))
return -EINVAL;
-- 
2.11.0

[PATCH review for 4.9 32/50] scsi: aacraid: Process Error for response I/O

[Levin, Alexander (Sasha Levin)]

From: Raghava Aditya Renukunta 

[ Upstream commit 4ec57fb4edaec523f0f78a0449a3b063749ac58b ]

Make sure that the driver processes error conditions even in the fast
response path for response from the adapter.

Signed-off-by: Raghava Aditya Renukunta 
Signed-off-by: Dave Carroll 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
---
 drivers/scsi/aacraid/aachba.c | 289 ++
 1 file changed, 151 insertions(+), 138 deletions(-)

diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 6678d1fd897b..065f11a1964d 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -2954,16 +2954,11 @@ static void aac_srb_callback(void *context, struct fib 
* fibptr)
return;
 
BUG_ON(fibptr == NULL);
-   dev = fibptr->dev;
-
-   scsi_dma_unmap(scsicmd);
 
-   /* expose physical device if expose_physicald flag is on */
-   if (scsicmd->cmnd[0] == INQUIRY && !(scsicmd->cmnd[1] & 0x01)
- && expose_physicals > 0)
-   aac_expose_phy_device(scsicmd);
+   dev = fibptr->dev;
 
srbreply = (struct aac_srb_reply *) fib_data(fibptr);
+
scsicmd->sense_buffer[0] = '\0';  /* Initialize sense valid flag to 
false */
 
if (fibptr->flags & FIB_CONTEXT_FLAG_FASTRESP) {
@@ -2976,158 +2971,176 @@ static void aac_srb_callback(void *context, struct 
fib * fibptr)
 */
scsi_set_resid(scsicmd, scsi_bufflen(scsicmd)
   - le32_to_cpu(srbreply->data_xfer_length));
-   /*
-* First check the fib status
-*/
+   }
 
-   if (le32_to_cpu(srbreply->status) != ST_OK) {
-   int len;
 
-   printk(KERN_WARNING "aac_srb_callback: srb failed, 
status = %d\n", le32_to_cpu(srbreply->status));
-   len = min_t(u32, le32_to_cpu(srbreply->sense_data_size),
-   SCSI_SENSE_BUFFERSIZE);
-   scsicmd->result = DID_ERROR << 16
-   | COMMAND_COMPLETE << 8
-   | SAM_STAT_CHECK_CONDITION;
-   memcpy(scsicmd->sense_buffer,
-   srbreply->sense_data, len);
-   }
+   scsi_dma_unmap(scsicmd);
 
-   /*
-* Next check the srb status
-*/
-   switch ((le32_to_cpu(srbreply->srb_status))&0x3f) {
-   case SRB_STATUS_ERROR_RECOVERY:
-   case SRB_STATUS_PENDING:
-   case SRB_STATUS_SUCCESS:
-   scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
-   break;
-   case SRB_STATUS_DATA_OVERRUN:
-   switch (scsicmd->cmnd[0]) {
-   case  READ_6:
-   case  WRITE_6:
-   case  READ_10:
-   case  WRITE_10:
-   case  READ_12:
-   case  WRITE_12:
-   case  READ_16:
-   case  WRITE_16:
-   if (le32_to_cpu(srbreply->data_xfer_length)
-   < scsicmd->underflow)
-   printk(KERN_WARNING"aacraid: SCSI CMD 
underflow\n");
-   else
-   printk(KERN_WARNING"aacraid: SCSI CMD 
Data Overrun\n");
-   scsicmd->result = DID_ERROR << 16
-   | COMMAND_COMPLETE << 8;
-   break;
-   case INQUIRY: {
-   scsicmd->result = DID_OK << 16
-   | COMMAND_COMPLETE << 8;
-   break;
-   }
-   default:
-   scsicmd->result = DID_OK << 16 | 
COMMAND_COMPLETE << 8;
-   break;
-   }
-   break;
-   case SRB_STATUS_ABORTED:
-   scsicmd->result = DID_ABORT << 16 | ABORT << 8;
-   break;
-   case SRB_STATUS_ABORT_FAILED:
-   /*
-* Not sure about this one - but assuming the
-* hba was trying to abort for some reason
-*/
-   scsicmd->result = DID_ERROR << 16 | ABORT << 8;
-   break;
-   case 

[PATCH review for 4.9 34/50] staging: lustre: llite: don't invoke direct_IO for the EOF case

[Levin, Alexander (Sasha Levin)]

From: Yang Sheng 

[ Upstream commit 77759771fb95420d23876cb104ab65c022613325 ]

The function generic_file_read_iter() does not check EOF
before invoke direct_IO callback. So we have to check it
ourselves.

Signed-off-by: Yang Sheng 
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8969
Reviewed-on: https://review.whamcloud.com/24552
Reviewed-by: Bob Glossman 
Reviewed-by: Bobi Jam 
Reviewed-by: Oleg Drokin 
Signed-off-by: James Simmons 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/staging/lustre/lustre/llite/rw26.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/lustre/lustre/llite/rw26.c 
b/drivers/staging/lustre/lustre/llite/rw26.c
index 26f3a37873a7..0cb70c3a1a0b 100644
--- a/drivers/staging/lustre/lustre/llite/rw26.c
+++ b/drivers/staging/lustre/lustre/llite/rw26.c
@@ -354,6 +354,10 @@ static ssize_t ll_direct_IO_26(struct kiocb *iocb, struct 
iov_iter *iter)
if (!lli->lli_has_smd)
return -EBADF;
 
+   /* Check EOF by ourselves */
+   if (iov_iter_rw(iter) == READ && file_offset >= i_size_read(inode))
+   return 0;
+
/* FIXME: io smaller than PAGE_SIZE is broken on ia64 ??? */
if ((file_offset & ~PAGE_MASK) || (count & ~PAGE_MASK))
return -EINVAL;
-- 
2.11.0

[PATCH review for 4.9 32/50] scsi: aacraid: Process Error for response I/O

[Levin, Alexander (Sasha Levin)]

From: Raghava Aditya Renukunta 

[ Upstream commit 4ec57fb4edaec523f0f78a0449a3b063749ac58b ]

Make sure that the driver processes error conditions even in the fast
response path for response from the adapter.

Signed-off-by: Raghava Aditya Renukunta 
Signed-off-by: Dave Carroll 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
---
 drivers/scsi/aacraid/aachba.c | 289 ++
 1 file changed, 151 insertions(+), 138 deletions(-)

diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 6678d1fd897b..065f11a1964d 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -2954,16 +2954,11 @@ static void aac_srb_callback(void *context, struct fib 
* fibptr)
return;
 
BUG_ON(fibptr == NULL);
-   dev = fibptr->dev;
-
-   scsi_dma_unmap(scsicmd);
 
-   /* expose physical device if expose_physicald flag is on */
-   if (scsicmd->cmnd[0] == INQUIRY && !(scsicmd->cmnd[1] & 0x01)
- && expose_physicals > 0)
-   aac_expose_phy_device(scsicmd);
+   dev = fibptr->dev;
 
srbreply = (struct aac_srb_reply *) fib_data(fibptr);
+
scsicmd->sense_buffer[0] = '\0';  /* Initialize sense valid flag to 
false */
 
if (fibptr->flags & FIB_CONTEXT_FLAG_FASTRESP) {
@@ -2976,158 +2971,176 @@ static void aac_srb_callback(void *context, struct 
fib * fibptr)
 */
scsi_set_resid(scsicmd, scsi_bufflen(scsicmd)
   - le32_to_cpu(srbreply->data_xfer_length));
-   /*
-* First check the fib status
-*/
+   }
 
-   if (le32_to_cpu(srbreply->status) != ST_OK) {
-   int len;
 
-   printk(KERN_WARNING "aac_srb_callback: srb failed, 
status = %d\n", le32_to_cpu(srbreply->status));
-   len = min_t(u32, le32_to_cpu(srbreply->sense_data_size),
-   SCSI_SENSE_BUFFERSIZE);
-   scsicmd->result = DID_ERROR << 16
-   | COMMAND_COMPLETE << 8
-   | SAM_STAT_CHECK_CONDITION;
-   memcpy(scsicmd->sense_buffer,
-   srbreply->sense_data, len);
-   }
+   scsi_dma_unmap(scsicmd);
 
-   /*
-* Next check the srb status
-*/
-   switch ((le32_to_cpu(srbreply->srb_status))&0x3f) {
-   case SRB_STATUS_ERROR_RECOVERY:
-   case SRB_STATUS_PENDING:
-   case SRB_STATUS_SUCCESS:
-   scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
-   break;
-   case SRB_STATUS_DATA_OVERRUN:
-   switch (scsicmd->cmnd[0]) {
-   case  READ_6:
-   case  WRITE_6:
-   case  READ_10:
-   case  WRITE_10:
-   case  READ_12:
-   case  WRITE_12:
-   case  READ_16:
-   case  WRITE_16:
-   if (le32_to_cpu(srbreply->data_xfer_length)
-   < scsicmd->underflow)
-   printk(KERN_WARNING"aacraid: SCSI CMD 
underflow\n");
-   else
-   printk(KERN_WARNING"aacraid: SCSI CMD 
Data Overrun\n");
-   scsicmd->result = DID_ERROR << 16
-   | COMMAND_COMPLETE << 8;
-   break;
-   case INQUIRY: {
-   scsicmd->result = DID_OK << 16
-   | COMMAND_COMPLETE << 8;
-   break;
-   }
-   default:
-   scsicmd->result = DID_OK << 16 | 
COMMAND_COMPLETE << 8;
-   break;
-   }
-   break;
-   case SRB_STATUS_ABORTED:
-   scsicmd->result = DID_ABORT << 16 | ABORT << 8;
-   break;
-   case SRB_STATUS_ABORT_FAILED:
-   /*
-* Not sure about this one - but assuming the
-* hba was trying to abort for some reason
-*/
-   scsicmd->result = DID_ERROR << 16 | ABORT << 8;
-   break;
-   case SRB_STATUS_PARITY_ERROR:
-   scsicmd->result = DID_PARITY << 16
-   | MSG_PARITY_ERROR << 8;
-   

[PATCH review for 4.9 26/50] clk: sunxi-ng: Check kzalloc() for errors and cleanup error path

[Levin, Alexander (Sasha Levin)]

From: Stephen Boyd 

[ Upstream commit 5d806f9fc8e63d7a44e0fd1ef26a7c27efae0e51 ]

This kzalloc() could fail. Let's bail out with -ENOMEM here
instead of NULL dereferencing. That silences static checkers. We
should also cleanup on the error path even though this function
returning an error probably means the system won't boot.

Cc: Chen-Yu Tsai 
Acked-by: Maxime Ripard 
Signed-off-by: Stephen Boyd 
Signed-off-by: Sasha Levin 
---
 drivers/clk/sunxi-ng/ccu_common.c | 15 +++
 1 file changed, 15 insertions(+)

diff --git a/drivers/clk/sunxi-ng/ccu_common.c 
b/drivers/clk/sunxi-ng/ccu_common.c
index 51d4bac97ab3..01d0594c9716 100644
--- a/drivers/clk/sunxi-ng/ccu_common.c
+++ b/drivers/clk/sunxi-ng/ccu_common.c
@@ -70,6 +70,11 @@ int sunxi_ccu_probe(struct device_node *node, void __iomem 
*reg,
goto err_clk_unreg;
 
reset = kzalloc(sizeof(*reset), GFP_KERNEL);
+   if (!reset) {
+   ret = -ENOMEM;
+   goto err_alloc_reset;
+   }
+
reset->rcdev.of_node = node;
reset->rcdev.ops = _reset_ops;
reset->rcdev.owner = THIS_MODULE;
@@ -85,6 +90,16 @@ int sunxi_ccu_probe(struct device_node *node, void __iomem 
*reg,
return 0;
 
 err_of_clk_unreg:
+   kfree(reset);
+err_alloc_reset:
+   of_clk_del_provider(node);
 err_clk_unreg:
+   while (--i >= 0) {
+   struct clk_hw *hw = desc->hw_clks->hws[i];
+
+   if (!hw)
+   continue;
+   clk_hw_unregister(hw);
+   }
return ret;
 }
-- 
2.11.0

[PATCH review for 4.9 26/50] clk: sunxi-ng: Check kzalloc() for errors and cleanup error path

[Levin, Alexander (Sasha Levin)]

From: Stephen Boyd 

[ Upstream commit 5d806f9fc8e63d7a44e0fd1ef26a7c27efae0e51 ]

This kzalloc() could fail. Let's bail out with -ENOMEM here
instead of NULL dereferencing. That silences static checkers. We
should also cleanup on the error path even though this function
returning an error probably means the system won't boot.

Cc: Chen-Yu Tsai 
Acked-by: Maxime Ripard 
Signed-off-by: Stephen Boyd 
Signed-off-by: Sasha Levin 
---
 drivers/clk/sunxi-ng/ccu_common.c | 15 +++
 1 file changed, 15 insertions(+)

diff --git a/drivers/clk/sunxi-ng/ccu_common.c 
b/drivers/clk/sunxi-ng/ccu_common.c
index 51d4bac97ab3..01d0594c9716 100644
--- a/drivers/clk/sunxi-ng/ccu_common.c
+++ b/drivers/clk/sunxi-ng/ccu_common.c
@@ -70,6 +70,11 @@ int sunxi_ccu_probe(struct device_node *node, void __iomem 
*reg,
goto err_clk_unreg;
 
reset = kzalloc(sizeof(*reset), GFP_KERNEL);
+   if (!reset) {
+   ret = -ENOMEM;
+   goto err_alloc_reset;
+   }
+
reset->rcdev.of_node = node;
reset->rcdev.ops = _reset_ops;
reset->rcdev.owner = THIS_MODULE;
@@ -85,6 +90,16 @@ int sunxi_ccu_probe(struct device_node *node, void __iomem 
*reg,
return 0;
 
 err_of_clk_unreg:
+   kfree(reset);
+err_alloc_reset:
+   of_clk_del_provider(node);
 err_clk_unreg:
+   while (--i >= 0) {
+   struct clk_hw *hw = desc->hw_clks->hws[i];
+
+   if (!hw)
+   continue;
+   clk_hw_unregister(hw);
+   }
return ret;
 }
-- 
2.11.0

[PATCH review for 4.9 15/50] ext4: do not use stripe_width if it is not set

[Levin, Alexander (Sasha Levin)]

From: Jan Kara 

[ Upstream commit 5469d7c3087ecaf760f54b447f11af6061b7c897 ]

Avoid using stripe_width for sbi->s_stripe value if it is not actually
set. It prevents using the stride for sbi->s_stripe.

Signed-off-by: Jan Kara 
Signed-off-by: Theodore Ts'o 
Signed-off-by: Sasha Levin 
---
 fs/ext4/super.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index f72535e1898f..1f581791b39d 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2628,9 +2628,9 @@ static unsigned long ext4_get_stripe_size(struct 
ext4_sb_info *sbi)
 
if (sbi->s_stripe && sbi->s_stripe <= sbi->s_blocks_per_group)
ret = sbi->s_stripe;
-   else if (stripe_width <= sbi->s_blocks_per_group)
+   else if (stripe_width && stripe_width <= sbi->s_blocks_per_group)
ret = stripe_width;
-   else if (stride <= sbi->s_blocks_per_group)
+   else if (stride && stride <= sbi->s_blocks_per_group)
ret = stride;
else
ret = 0;
-- 
2.11.0

[PATCH review for 4.9 15/50] ext4: do not use stripe_width if it is not set

[Levin, Alexander (Sasha Levin)]

From: Jan Kara 

[ Upstream commit 5469d7c3087ecaf760f54b447f11af6061b7c897 ]

Avoid using stripe_width for sbi->s_stripe value if it is not actually
set. It prevents using the stride for sbi->s_stripe.

Signed-off-by: Jan Kara 
Signed-off-by: Theodore Ts'o 
Signed-off-by: Sasha Levin 
---
 fs/ext4/super.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index f72535e1898f..1f581791b39d 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2628,9 +2628,9 @@ static unsigned long ext4_get_stripe_size(struct 
ext4_sb_info *sbi)
 
if (sbi->s_stripe && sbi->s_stripe <= sbi->s_blocks_per_group)
ret = sbi->s_stripe;
-   else if (stripe_width <= sbi->s_blocks_per_group)
+   else if (stripe_width && stripe_width <= sbi->s_blocks_per_group)
ret = stripe_width;
-   else if (stride <= sbi->s_blocks_per_group)
+   else if (stride && stride <= sbi->s_blocks_per_group)
ret = stride;
else
ret = 0;
-- 
2.11.0

Re: [PATCH 4.9 086/104] arm64: kasan: avoid bad virt_to_pfn()

[Levin, Alexander (Sasha Levin)]

On Fri, Oct 06, 2017 at 07:13:22PM +0100, Mark Rutland wrote:
>Hi Greg,
>
>On Fri, Oct 06, 2017 at 10:52:04AM +0200, Greg Kroah-Hartman wrote:
>> 4.9-stable review patch.  If anyone has any objections, please let me know.
>
>I'm a little confused as to why this is being backported, given it
>wasn't Cc'd stable or marked as a fix.
>
>The lm_alias() helper was only introduced in v4.10, and I don't recall
>seeing that backported.
>
>What's going on here?

Mark,

We are experimenting with using neural network to aid with patch
selection for stable kernel trees. There are quite a few commits that
were not marked for stable, but are stable material, and we're trying
to get them into their appropriate kernel trees.

-- 

Thanks,
Sasha

Re: [PATCH 4.9 086/104] arm64: kasan: avoid bad virt_to_pfn()

[Levin, Alexander (Sasha Levin)]

On Fri, Oct 06, 2017 at 07:13:22PM +0100, Mark Rutland wrote:
>Hi Greg,
>
>On Fri, Oct 06, 2017 at 10:52:04AM +0200, Greg Kroah-Hartman wrote:
>> 4.9-stable review patch.  If anyone has any objections, please let me know.
>
>I'm a little confused as to why this is being backported, given it
>wasn't Cc'd stable or marked as a fix.
>
>The lm_alias() helper was only introduced in v4.10, and I don't recall
>seeing that backported.
>
>What's going on here?

Mark,

We are experimenting with using neural network to aid with patch
selection for stable kernel trees. There are quite a few commits that
were not marked for stable, but are stable material, and we're trying
to get them into their appropriate kernel trees.

-- 

Thanks,
Sasha

[PATCH v2 2/4] kmemcheck: stop using GFP_NOTRACK and SLAB_NOTRACK

[Levin, Alexander (Sasha Levin)]

Convert all allocations that used a NOTRACK flag to stop using it.

Signed-off-by: Sasha Levin 
---
 arch/arm/include/asm/pgalloc.h   |  2 +-
 arch/arm64/include/asm/pgalloc.h |  2 +-
 arch/powerpc/include/asm/pgalloc.h   |  2 +-
 arch/sh/kernel/dwarf.c   |  4 ++--
 arch/sh/kernel/process.c |  2 +-
 arch/sparc/mm/init_64.c  |  4 ++--
 arch/unicore32/include/asm/pgalloc.h |  2 +-
 arch/x86/kernel/espfix_64.c  |  2 +-
 arch/x86/mm/init.c   |  3 +--
 arch/x86/mm/init_64.c|  2 +-
 arch/x86/mm/pageattr.c   | 10 +-
 arch/x86/mm/pgtable.c|  2 +-
 arch/x86/platform/efi/efi_64.c   |  2 +-
 crypto/xor.c |  7 +--
 include/linux/thread_info.h  |  5 ++---
 init/do_mounts.c |  3 +--
 kernel/fork.c| 12 ++--
 kernel/signal.c  |  3 +--
 mm/kmemcheck.c   |  2 +-
 mm/slab.c|  2 +-
 mm/slab.h|  5 ++---
 mm/slab_common.c |  2 +-
 mm/slub.c|  4 +---
 23 files changed, 36 insertions(+), 48 deletions(-)

diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
index b2902a5cd780..2d7344f0e208 100644
--- a/arch/arm/include/asm/pgalloc.h
+++ b/arch/arm/include/asm/pgalloc.h
@@ -57,7 +57,7 @@ static inline void pud_populate(struct mm_struct *mm, pud_t 
*pud, pmd_t *pmd)
 extern pgd_t *pgd_alloc(struct mm_struct *mm);
 extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
 
-#define PGALLOC_GFP(GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO)
+#define PGALLOC_GFP(GFP_KERNEL | __GFP_ZERO)
 
 static inline void clean_pte_table(pte_t *pte)
 {
diff --git a/arch/arm64/include/asm/pgalloc.h b/arch/arm64/include/asm/pgalloc.h
index d25f4f137c2a..5ca6a573a701 100644
--- a/arch/arm64/include/asm/pgalloc.h
+++ b/arch/arm64/include/asm/pgalloc.h
@@ -26,7 +26,7 @@
 
 #define check_pgt_cache()  do { } while (0)
 
-#define PGALLOC_GFP(GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO)
+#define PGALLOC_GFP(GFP_KERNEL | __GFP_ZERO)
 #define PGD_SIZE   (PTRS_PER_PGD * sizeof(pgd_t))
 
 #if CONFIG_PGTABLE_LEVELS > 2
diff --git a/arch/powerpc/include/asm/pgalloc.h 
b/arch/powerpc/include/asm/pgalloc.h
index 45ae1212ab8a..bb01297b617a 100644
--- a/arch/powerpc/include/asm/pgalloc.h
+++ b/arch/powerpc/include/asm/pgalloc.h
@@ -17,7 +17,7 @@ static inline gfp_t pgtable_gfp_flags(struct mm_struct *mm, 
gfp_t gfp)
 }
 #endif /* MODULE */
 
-#define PGALLOC_GFP (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO)
+#define PGALLOC_GFP (GFP_KERNEL | __GFP_ZERO)
 
 #ifdef CONFIG_PPC_BOOK3S
 #include 
diff --git a/arch/sh/kernel/dwarf.c b/arch/sh/kernel/dwarf.c
index e1d751ae2498..1a2526676a87 100644
--- a/arch/sh/kernel/dwarf.c
+++ b/arch/sh/kernel/dwarf.c
@@ -1172,11 +1172,11 @@ static int __init dwarf_unwinder_init(void)
 
dwarf_frame_cachep = kmem_cache_create("dwarf_frames",
sizeof(struct dwarf_frame), 0,
-   SLAB_PANIC | SLAB_HWCACHE_ALIGN | SLAB_NOTRACK, NULL);
+   SLAB_PANIC | SLAB_HWCACHE_ALIGN, NULL);
 
dwarf_reg_cachep = kmem_cache_create("dwarf_regs",
sizeof(struct dwarf_reg), 0,
-   SLAB_PANIC | SLAB_HWCACHE_ALIGN | SLAB_NOTRACK, NULL);
+   SLAB_PANIC | SLAB_HWCACHE_ALIGN, NULL);
 
dwarf_frame_pool = mempool_create_slab_pool(DWARF_FRAME_MIN_REQ,
dwarf_frame_cachep);
diff --git a/arch/sh/kernel/process.c b/arch/sh/kernel/process.c
index f8a695a223dd..ded55e7461f8 100644
--- a/arch/sh/kernel/process.c
+++ b/arch/sh/kernel/process.c
@@ -58,7 +58,7 @@ void arch_task_cache_init(void)
 
task_xstate_cachep = kmem_cache_create("task_xstate", xstate_size,
   __alignof__(union thread_xstate),
-  SLAB_PANIC | SLAB_NOTRACK, NULL);
+  SLAB_PANIC, NULL);
 }
 
 #ifdef CONFIG_SH_FPU_EMU
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index b2ba410b26f4..78f79004be2c 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2926,7 +2926,7 @@ void __flush_tlb_all(void)
 pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
unsigned long address)
 {
-   struct page *page = alloc_page(GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
+   struct page *page = alloc_page(GFP_KERNEL | __GFP_ZERO);
pte_t *pte = NULL;
 
if (page)
@@ -2938,7 +2938,7 @@ pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 pgtable_t pte_alloc_one(struct mm_struct *mm,
unsigned long address)
 {
-   struct page *page = alloc_page(GFP_KERNEL | __GFP_NOTRACK | 

[PATCH v2 2/4] kmemcheck: stop using GFP_NOTRACK and SLAB_NOTRACK

[Levin, Alexander (Sasha Levin)]

Convert all allocations that used a NOTRACK flag to stop using it.

Signed-off-by: Sasha Levin 
---
 arch/arm/include/asm/pgalloc.h   |  2 +-
 arch/arm64/include/asm/pgalloc.h |  2 +-
 arch/powerpc/include/asm/pgalloc.h   |  2 +-
 arch/sh/kernel/dwarf.c   |  4 ++--
 arch/sh/kernel/process.c |  2 +-
 arch/sparc/mm/init_64.c  |  4 ++--
 arch/unicore32/include/asm/pgalloc.h |  2 +-
 arch/x86/kernel/espfix_64.c  |  2 +-
 arch/x86/mm/init.c   |  3 +--
 arch/x86/mm/init_64.c|  2 +-
 arch/x86/mm/pageattr.c   | 10 +-
 arch/x86/mm/pgtable.c|  2 +-
 arch/x86/platform/efi/efi_64.c   |  2 +-
 crypto/xor.c |  7 +--
 include/linux/thread_info.h  |  5 ++---
 init/do_mounts.c |  3 +--
 kernel/fork.c| 12 ++--
 kernel/signal.c  |  3 +--
 mm/kmemcheck.c   |  2 +-
 mm/slab.c|  2 +-
 mm/slab.h|  5 ++---
 mm/slab_common.c |  2 +-
 mm/slub.c|  4 +---
 23 files changed, 36 insertions(+), 48 deletions(-)

diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
index b2902a5cd780..2d7344f0e208 100644
--- a/arch/arm/include/asm/pgalloc.h
+++ b/arch/arm/include/asm/pgalloc.h
@@ -57,7 +57,7 @@ static inline void pud_populate(struct mm_struct *mm, pud_t 
*pud, pmd_t *pmd)
 extern pgd_t *pgd_alloc(struct mm_struct *mm);
 extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
 
-#define PGALLOC_GFP(GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO)
+#define PGALLOC_GFP(GFP_KERNEL | __GFP_ZERO)
 
 static inline void clean_pte_table(pte_t *pte)
 {
diff --git a/arch/arm64/include/asm/pgalloc.h b/arch/arm64/include/asm/pgalloc.h
index d25f4f137c2a..5ca6a573a701 100644
--- a/arch/arm64/include/asm/pgalloc.h
+++ b/arch/arm64/include/asm/pgalloc.h
@@ -26,7 +26,7 @@
 
 #define check_pgt_cache()  do { } while (0)
 
-#define PGALLOC_GFP(GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO)
+#define PGALLOC_GFP(GFP_KERNEL | __GFP_ZERO)
 #define PGD_SIZE   (PTRS_PER_PGD * sizeof(pgd_t))
 
 #if CONFIG_PGTABLE_LEVELS > 2
diff --git a/arch/powerpc/include/asm/pgalloc.h 
b/arch/powerpc/include/asm/pgalloc.h
index 45ae1212ab8a..bb01297b617a 100644
--- a/arch/powerpc/include/asm/pgalloc.h
+++ b/arch/powerpc/include/asm/pgalloc.h
@@ -17,7 +17,7 @@ static inline gfp_t pgtable_gfp_flags(struct mm_struct *mm, 
gfp_t gfp)
 }
 #endif /* MODULE */
 
-#define PGALLOC_GFP (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO)
+#define PGALLOC_GFP (GFP_KERNEL | __GFP_ZERO)
 
 #ifdef CONFIG_PPC_BOOK3S
 #include 
diff --git a/arch/sh/kernel/dwarf.c b/arch/sh/kernel/dwarf.c
index e1d751ae2498..1a2526676a87 100644
--- a/arch/sh/kernel/dwarf.c
+++ b/arch/sh/kernel/dwarf.c
@@ -1172,11 +1172,11 @@ static int __init dwarf_unwinder_init(void)
 
dwarf_frame_cachep = kmem_cache_create("dwarf_frames",
sizeof(struct dwarf_frame), 0,
-   SLAB_PANIC | SLAB_HWCACHE_ALIGN | SLAB_NOTRACK, NULL);
+   SLAB_PANIC | SLAB_HWCACHE_ALIGN, NULL);
 
dwarf_reg_cachep = kmem_cache_create("dwarf_regs",
sizeof(struct dwarf_reg), 0,
-   SLAB_PANIC | SLAB_HWCACHE_ALIGN | SLAB_NOTRACK, NULL);
+   SLAB_PANIC | SLAB_HWCACHE_ALIGN, NULL);
 
dwarf_frame_pool = mempool_create_slab_pool(DWARF_FRAME_MIN_REQ,
dwarf_frame_cachep);
diff --git a/arch/sh/kernel/process.c b/arch/sh/kernel/process.c
index f8a695a223dd..ded55e7461f8 100644
--- a/arch/sh/kernel/process.c
+++ b/arch/sh/kernel/process.c
@@ -58,7 +58,7 @@ void arch_task_cache_init(void)
 
task_xstate_cachep = kmem_cache_create("task_xstate", xstate_size,
   __alignof__(union thread_xstate),
-  SLAB_PANIC | SLAB_NOTRACK, NULL);
+  SLAB_PANIC, NULL);
 }
 
 #ifdef CONFIG_SH_FPU_EMU
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index b2ba410b26f4..78f79004be2c 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2926,7 +2926,7 @@ void __flush_tlb_all(void)
 pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
unsigned long address)
 {
-   struct page *page = alloc_page(GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
+   struct page *page = alloc_page(GFP_KERNEL | __GFP_ZERO);
pte_t *pte = NULL;
 
if (page)
@@ -2938,7 +2938,7 @@ pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 pgtable_t pte_alloc_one(struct mm_struct *mm,
unsigned long address)
 {
-   struct page *page = alloc_page(GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
+   struct page 

[PATCH v2 1/4] kmemcheck: remove annotations

[Levin, Alexander (Sasha Levin)]

Remove kmemcheck annotations, and calls to kmemcheck from the kernel.

Signed-off-by: Sasha Levin 
---
 arch/arm/include/asm/dma-iommu.h|  1 -
 arch/openrisc/include/asm/dma-mapping.h |  1 -
 arch/x86/Makefile   |  5 -
 arch/x86/include/asm/dma-mapping.h  |  1 -
 arch/x86/include/asm/xor.h  |  5 +
 arch/x86/kernel/traps.c |  5 -
 arch/x86/mm/fault.c |  6 --
 drivers/char/random.c   |  1 -
 drivers/misc/c2port/core.c  |  2 --
 fs/dcache.c |  2 --
 include/linux/c2port.h  |  4 
 include/linux/dma-mapping.h |  4 
 include/linux/filter.h  |  2 --
 include/linux/mm_types.h|  8 
 include/linux/net.h |  3 ---
 include/linux/ring_buffer.h |  3 ---
 include/linux/skbuff.h  |  3 ---
 include/net/inet_sock.h |  3 ---
 include/net/inet_timewait_sock.h|  4 
 include/net/sock.h  |  3 ---
 init/main.c |  1 -
 kernel/bpf/core.c   |  6 --
 kernel/locking/lockdep.c|  3 ---
 kernel/trace/ring_buffer.c  |  3 ---
 mm/kmemleak.c   |  9 -
 mm/page_alloc.c | 14 --
 mm/slab.c   | 14 --
 mm/slab.h   |  2 --
 mm/slub.c   | 20 
 net/core/skbuff.c   |  5 -
 net/core/sock.c |  2 --
 net/ipv4/inet_timewait_sock.c   |  3 ---
 net/ipv4/tcp_input.c|  1 -
 net/socket.c|  1 -
 34 files changed, 1 insertion(+), 149 deletions(-)

diff --git a/arch/arm/include/asm/dma-iommu.h b/arch/arm/include/asm/dma-iommu.h
index c090ec675eac..5ad676f2de22 100644
--- a/arch/arm/include/asm/dma-iommu.h
+++ b/arch/arm/include/asm/dma-iommu.h
@@ -6,7 +6,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 
 #define ARM_MAPPING_ERROR  (~(dma_addr_t)0x0)
diff --git a/arch/openrisc/include/asm/dma-mapping.h 
b/arch/openrisc/include/asm/dma-mapping.h
index f41bd3cb76d9..e212a1f0b6d2 100644
--- a/arch/openrisc/include/asm/dma-mapping.h
+++ b/arch/openrisc/include/asm/dma-mapping.h
@@ -23,7 +23,6 @@
  */
 
 #include 
-#include 
 #include 
 
 extern const struct dma_map_ops or1k_dma_map_ops;
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 6276572259c8..559eb0a282fd 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -157,11 +157,6 @@ ifdef CONFIG_X86_X32
 endif
 export CONFIG_X86_X32_ABI
 
-# Don't unroll struct assignments with kmemcheck enabled
-ifeq ($(CONFIG_KMEMCHECK),y)
-   KBUILD_CFLAGS += $(call cc-option,-fno-builtin-memcpy)
-endif
-
 #
 # If the function graph tracer is used with mcount instead of fentry,
 # '-maccumulate-outgoing-args' is needed to prevent a GCC bug
diff --git a/arch/x86/include/asm/dma-mapping.h 
b/arch/x86/include/asm/dma-mapping.h
index 1387dafdba2d..bd974c04c9aa 100644
--- a/arch/x86/include/asm/dma-mapping.h
+++ b/arch/x86/include/asm/dma-mapping.h
@@ -6,7 +6,6 @@
  * Documentation/DMA-API.txt for documentation.
  */
 
-#include 
 #include 
 #include 
 #include 
diff --git a/arch/x86/include/asm/xor.h b/arch/x86/include/asm/xor.h
index 1f5c5161ead6..45c8605467f1 100644
--- a/arch/x86/include/asm/xor.h
+++ b/arch/x86/include/asm/xor.h
@@ -1,7 +1,4 @@
-#ifdef CONFIG_KMEMCHECK
-/* kmemcheck doesn't handle MMX/SSE/SSE2 instructions */
-# include 
-#elif !defined(_ASM_X86_XOR_H)
+#ifndef _ASM_X86_XOR_H
 #define _ASM_X86_XOR_H
 
 /*
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 67db4f43309e..969bb67e06f4 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -42,7 +42,6 @@
 #include 
 #endif
 
-#include 
 #include 
 #include 
 #include 
@@ -740,10 +739,6 @@ dotraplinkage void do_debug(struct pt_regs *regs, long 
error_code)
if (!dr6 && user_mode(regs))
user_icebp = 1;
 
-   /* Catch kmemcheck conditions! */
-   if ((dr6 & DR_STEP) && kmemcheck_trap(regs))
-   goto exit;
-
/* Store the virtualized DR6 value */
tsk->thread.debugreg6 = dr6;
 
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index e2baeaa053a5..a4f96448bc7a 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -19,7 +19,6 @@
 #include /* boot_cpu_has, ...*/
 #include  /* dotraplinkage, ...   */
 #include/* pgd_*(), ... */
-#include  /* kmemcheck_*(), ...   */
 #include /* VSYSCALL_ADDR
*/
 #include   /* emulate_vsyscall */
 #include   /* struct 

[PATCH v2 3/4] kmemcheck: rip it out

[Levin, Alexander (Sasha Levin)]

Fix up makefiles, remove references, and git rm kmemcheck.

Signed-off-by: Sasha Levin 
---
 Documentation/admin-guide/kernel-parameters.txt |   7 -
 Documentation/dev-tools/index.rst   |   1 -
 Documentation/dev-tools/kmemcheck.rst   | 733 
 MAINTAINERS |  10 -
 arch/x86/Kconfig|   3 +-
 arch/x86/include/asm/kmemcheck.h|  42 --
 arch/x86/include/asm/string_32.h|   9 -
 arch/x86/include/asm/string_64.h|   8 -
 arch/x86/kernel/cpu/intel.c |  15 -
 arch/x86/mm/Makefile|   2 -
 arch/x86/mm/init.c  |   5 +-
 arch/x86/mm/kmemcheck/Makefile  |   1 -
 arch/x86/mm/kmemcheck/error.c   | 227 
 arch/x86/mm/kmemcheck/error.h   |  15 -
 arch/x86/mm/kmemcheck/kmemcheck.c   | 658 -
 arch/x86/mm/kmemcheck/opcode.c  | 106 
 arch/x86/mm/kmemcheck/opcode.h  |   9 -
 arch/x86/mm/kmemcheck/pte.c |  22 -
 arch/x86/mm/kmemcheck/pte.h |  10 -
 arch/x86/mm/kmemcheck/selftest.c|  70 ---
 arch/x86/mm/kmemcheck/selftest.h|   6 -
 arch/x86/mm/kmemcheck/shadow.c  | 173 --
 arch/x86/mm/kmemcheck/shadow.h  |  18 -
 include/linux/interrupt.h   |  15 -
 include/linux/kmemcheck.h   | 171 --
 kernel/softirq.c|  10 -
 kernel/sysctl.c |  10 -
 lib/Kconfig.debug   |   6 +-
 lib/Kconfig.kmemcheck   |  94 ---
 mm/Kconfig.debug|   1 -
 mm/Makefile |   2 -
 mm/kmemcheck.c  | 125 
 mm/slub.c   |   5 +-
 scripts/kernel-doc  |   2 -
 tools/include/linux/kmemcheck.h |   8 -
 35 files changed, 7 insertions(+), 2592 deletions(-)
 delete mode 100644 Documentation/dev-tools/kmemcheck.rst
 delete mode 100644 arch/x86/include/asm/kmemcheck.h
 delete mode 100644 arch/x86/mm/kmemcheck/Makefile
 delete mode 100644 arch/x86/mm/kmemcheck/error.c
 delete mode 100644 arch/x86/mm/kmemcheck/error.h
 delete mode 100644 arch/x86/mm/kmemcheck/kmemcheck.c
 delete mode 100644 arch/x86/mm/kmemcheck/opcode.c
 delete mode 100644 arch/x86/mm/kmemcheck/opcode.h
 delete mode 100644 arch/x86/mm/kmemcheck/pte.c
 delete mode 100644 arch/x86/mm/kmemcheck/pte.h
 delete mode 100644 arch/x86/mm/kmemcheck/selftest.c
 delete mode 100644 arch/x86/mm/kmemcheck/selftest.h
 delete mode 100644 arch/x86/mm/kmemcheck/shadow.c
 delete mode 100644 arch/x86/mm/kmemcheck/shadow.h
 delete mode 100644 include/linux/kmemcheck.h
 delete mode 100644 lib/Kconfig.kmemcheck
 delete mode 100644 mm/kmemcheck.c
 delete mode 100644 tools/include/linux/kmemcheck.h

diff --git a/Documentation/admin-guide/kernel-parameters.txt 
b/Documentation/admin-guide/kernel-parameters.txt
index 05496622b4ef..5e1e0e7ebee3 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1841,13 +1841,6 @@
Built with CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=y,
the default is off.
 
-   kmemcheck=  [X86] Boot-time kmemcheck enable/disable/one-shot mode
-   Valid arguments: 0, 1, 2
-   kmemcheck=0 (disabled)
-   kmemcheck=1 (enabled)
-   kmemcheck=2 (one-shot mode)
-   Default: 2 (one-shot mode)
-
kvm.ignore_msrs=[KVM] Ignore guest accesses to unhandled MSRs.
Default is 0 (don't ignore, but inject #GP)
 
diff --git a/Documentation/dev-tools/index.rst 
b/Documentation/dev-tools/index.rst
index a81787cd47d7..e313925fb0fa 100644
--- a/Documentation/dev-tools/index.rst
+++ b/Documentation/dev-tools/index.rst
@@ -21,7 +21,6 @@ whole; patches welcome!
kasan
ubsan
kmemleak
-   kmemcheck
gdb-kernel-debugging
kgdb
kselftest
diff --git a/Documentation/dev-tools/kmemcheck.rst 
b/Documentation/dev-tools/kmemcheck.rst
deleted file mode 100644
index 7f3d1985de74..
--- a/Documentation/dev-tools/kmemcheck.rst
+++ /dev/null
@@ -1,733 +0,0 @@
-Getting started with kmemcheck
-==
-
-Vegard Nossum 
-
-
-Introduction
-
-
-kmemcheck is a debugging feature for the Linux Kernel. More specifically, it
-is a dynamic checker that detects and warns about some uses of uninitialized
-memory.
-
-Userspace programmers might be familiar with Valgrind's memcheck. The main
-difference between memcheck and 

[PATCH v2 1/4] kmemcheck: remove annotations

[Levin, Alexander (Sasha Levin)]

Remove kmemcheck annotations, and calls to kmemcheck from the kernel.

Signed-off-by: Sasha Levin 
---
 arch/arm/include/asm/dma-iommu.h|  1 -
 arch/openrisc/include/asm/dma-mapping.h |  1 -
 arch/x86/Makefile   |  5 -
 arch/x86/include/asm/dma-mapping.h  |  1 -
 arch/x86/include/asm/xor.h  |  5 +
 arch/x86/kernel/traps.c |  5 -
 arch/x86/mm/fault.c |  6 --
 drivers/char/random.c   |  1 -
 drivers/misc/c2port/core.c  |  2 --
 fs/dcache.c |  2 --
 include/linux/c2port.h  |  4 
 include/linux/dma-mapping.h |  4 
 include/linux/filter.h  |  2 --
 include/linux/mm_types.h|  8 
 include/linux/net.h |  3 ---
 include/linux/ring_buffer.h |  3 ---
 include/linux/skbuff.h  |  3 ---
 include/net/inet_sock.h |  3 ---
 include/net/inet_timewait_sock.h|  4 
 include/net/sock.h  |  3 ---
 init/main.c |  1 -
 kernel/bpf/core.c   |  6 --
 kernel/locking/lockdep.c|  3 ---
 kernel/trace/ring_buffer.c  |  3 ---
 mm/kmemleak.c   |  9 -
 mm/page_alloc.c | 14 --
 mm/slab.c   | 14 --
 mm/slab.h   |  2 --
 mm/slub.c   | 20 
 net/core/skbuff.c   |  5 -
 net/core/sock.c |  2 --
 net/ipv4/inet_timewait_sock.c   |  3 ---
 net/ipv4/tcp_input.c|  1 -
 net/socket.c|  1 -
 34 files changed, 1 insertion(+), 149 deletions(-)

diff --git a/arch/arm/include/asm/dma-iommu.h b/arch/arm/include/asm/dma-iommu.h
index c090ec675eac..5ad676f2de22 100644
--- a/arch/arm/include/asm/dma-iommu.h
+++ b/arch/arm/include/asm/dma-iommu.h
@@ -6,7 +6,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 
 #define ARM_MAPPING_ERROR  (~(dma_addr_t)0x0)
diff --git a/arch/openrisc/include/asm/dma-mapping.h 
b/arch/openrisc/include/asm/dma-mapping.h
index f41bd3cb76d9..e212a1f0b6d2 100644
--- a/arch/openrisc/include/asm/dma-mapping.h
+++ b/arch/openrisc/include/asm/dma-mapping.h
@@ -23,7 +23,6 @@
  */
 
 #include 
-#include 
 #include 
 
 extern const struct dma_map_ops or1k_dma_map_ops;
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 6276572259c8..559eb0a282fd 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -157,11 +157,6 @@ ifdef CONFIG_X86_X32
 endif
 export CONFIG_X86_X32_ABI
 
-# Don't unroll struct assignments with kmemcheck enabled
-ifeq ($(CONFIG_KMEMCHECK),y)
-   KBUILD_CFLAGS += $(call cc-option,-fno-builtin-memcpy)
-endif
-
 #
 # If the function graph tracer is used with mcount instead of fentry,
 # '-maccumulate-outgoing-args' is needed to prevent a GCC bug
diff --git a/arch/x86/include/asm/dma-mapping.h 
b/arch/x86/include/asm/dma-mapping.h
index 1387dafdba2d..bd974c04c9aa 100644
--- a/arch/x86/include/asm/dma-mapping.h
+++ b/arch/x86/include/asm/dma-mapping.h
@@ -6,7 +6,6 @@
  * Documentation/DMA-API.txt for documentation.
  */
 
-#include 
 #include 
 #include 
 #include 
diff --git a/arch/x86/include/asm/xor.h b/arch/x86/include/asm/xor.h
index 1f5c5161ead6..45c8605467f1 100644
--- a/arch/x86/include/asm/xor.h
+++ b/arch/x86/include/asm/xor.h
@@ -1,7 +1,4 @@
-#ifdef CONFIG_KMEMCHECK
-/* kmemcheck doesn't handle MMX/SSE/SSE2 instructions */
-# include 
-#elif !defined(_ASM_X86_XOR_H)
+#ifndef _ASM_X86_XOR_H
 #define _ASM_X86_XOR_H
 
 /*
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 67db4f43309e..969bb67e06f4 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -42,7 +42,6 @@
 #include 
 #endif
 
-#include 
 #include 
 #include 
 #include 
@@ -740,10 +739,6 @@ dotraplinkage void do_debug(struct pt_regs *regs, long 
error_code)
if (!dr6 && user_mode(regs))
user_icebp = 1;
 
-   /* Catch kmemcheck conditions! */
-   if ((dr6 & DR_STEP) && kmemcheck_trap(regs))
-   goto exit;
-
/* Store the virtualized DR6 value */
tsk->thread.debugreg6 = dr6;
 
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index e2baeaa053a5..a4f96448bc7a 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -19,7 +19,6 @@
 #include /* boot_cpu_has, ...*/
 #include  /* dotraplinkage, ...   */
 #include/* pgd_*(), ... */
-#include  /* kmemcheck_*(), ...   */
 #include /* VSYSCALL_ADDR
*/
 #include   /* emulate_vsyscall */
 #include   /* struct vm86  */
@@ 

[PATCH v2 3/4] kmemcheck: rip it out

[Levin, Alexander (Sasha Levin)]

Fix up makefiles, remove references, and git rm kmemcheck.

Signed-off-by: Sasha Levin 
---
 Documentation/admin-guide/kernel-parameters.txt |   7 -
 Documentation/dev-tools/index.rst   |   1 -
 Documentation/dev-tools/kmemcheck.rst   | 733 
 MAINTAINERS |  10 -
 arch/x86/Kconfig|   3 +-
 arch/x86/include/asm/kmemcheck.h|  42 --
 arch/x86/include/asm/string_32.h|   9 -
 arch/x86/include/asm/string_64.h|   8 -
 arch/x86/kernel/cpu/intel.c |  15 -
 arch/x86/mm/Makefile|   2 -
 arch/x86/mm/init.c  |   5 +-
 arch/x86/mm/kmemcheck/Makefile  |   1 -
 arch/x86/mm/kmemcheck/error.c   | 227 
 arch/x86/mm/kmemcheck/error.h   |  15 -
 arch/x86/mm/kmemcheck/kmemcheck.c   | 658 -
 arch/x86/mm/kmemcheck/opcode.c  | 106 
 arch/x86/mm/kmemcheck/opcode.h  |   9 -
 arch/x86/mm/kmemcheck/pte.c |  22 -
 arch/x86/mm/kmemcheck/pte.h |  10 -
 arch/x86/mm/kmemcheck/selftest.c|  70 ---
 arch/x86/mm/kmemcheck/selftest.h|   6 -
 arch/x86/mm/kmemcheck/shadow.c  | 173 --
 arch/x86/mm/kmemcheck/shadow.h  |  18 -
 include/linux/interrupt.h   |  15 -
 include/linux/kmemcheck.h   | 171 --
 kernel/softirq.c|  10 -
 kernel/sysctl.c |  10 -
 lib/Kconfig.debug   |   6 +-
 lib/Kconfig.kmemcheck   |  94 ---
 mm/Kconfig.debug|   1 -
 mm/Makefile |   2 -
 mm/kmemcheck.c  | 125 
 mm/slub.c   |   5 +-
 scripts/kernel-doc  |   2 -
 tools/include/linux/kmemcheck.h |   8 -
 35 files changed, 7 insertions(+), 2592 deletions(-)
 delete mode 100644 Documentation/dev-tools/kmemcheck.rst
 delete mode 100644 arch/x86/include/asm/kmemcheck.h
 delete mode 100644 arch/x86/mm/kmemcheck/Makefile
 delete mode 100644 arch/x86/mm/kmemcheck/error.c
 delete mode 100644 arch/x86/mm/kmemcheck/error.h
 delete mode 100644 arch/x86/mm/kmemcheck/kmemcheck.c
 delete mode 100644 arch/x86/mm/kmemcheck/opcode.c
 delete mode 100644 arch/x86/mm/kmemcheck/opcode.h
 delete mode 100644 arch/x86/mm/kmemcheck/pte.c
 delete mode 100644 arch/x86/mm/kmemcheck/pte.h
 delete mode 100644 arch/x86/mm/kmemcheck/selftest.c
 delete mode 100644 arch/x86/mm/kmemcheck/selftest.h
 delete mode 100644 arch/x86/mm/kmemcheck/shadow.c
 delete mode 100644 arch/x86/mm/kmemcheck/shadow.h
 delete mode 100644 include/linux/kmemcheck.h
 delete mode 100644 lib/Kconfig.kmemcheck
 delete mode 100644 mm/kmemcheck.c
 delete mode 100644 tools/include/linux/kmemcheck.h

diff --git a/Documentation/admin-guide/kernel-parameters.txt 
b/Documentation/admin-guide/kernel-parameters.txt
index 05496622b4ef..5e1e0e7ebee3 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1841,13 +1841,6 @@
Built with CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=y,
the default is off.
 
-   kmemcheck=  [X86] Boot-time kmemcheck enable/disable/one-shot mode
-   Valid arguments: 0, 1, 2
-   kmemcheck=0 (disabled)
-   kmemcheck=1 (enabled)
-   kmemcheck=2 (one-shot mode)
-   Default: 2 (one-shot mode)
-
kvm.ignore_msrs=[KVM] Ignore guest accesses to unhandled MSRs.
Default is 0 (don't ignore, but inject #GP)
 
diff --git a/Documentation/dev-tools/index.rst 
b/Documentation/dev-tools/index.rst
index a81787cd47d7..e313925fb0fa 100644
--- a/Documentation/dev-tools/index.rst
+++ b/Documentation/dev-tools/index.rst
@@ -21,7 +21,6 @@ whole; patches welcome!
kasan
ubsan
kmemleak
-   kmemcheck
gdb-kernel-debugging
kgdb
kselftest
diff --git a/Documentation/dev-tools/kmemcheck.rst 
b/Documentation/dev-tools/kmemcheck.rst
deleted file mode 100644
index 7f3d1985de74..
--- a/Documentation/dev-tools/kmemcheck.rst
+++ /dev/null
@@ -1,733 +0,0 @@
-Getting started with kmemcheck
-==
-
-Vegard Nossum 
-
-
-Introduction
-
-
-kmemcheck is a debugging feature for the Linux Kernel. More specifically, it
-is a dynamic checker that detects and warns about some uses of uninitialized
-memory.
-
-Userspace programmers might be familiar with Valgrind's memcheck. The main
-difference between memcheck and kmemcheck is that memcheck works for userspace
-programs 

[PATCH v2 4/4] kmemcheck: remove whats left of NOTRACK flags

[Levin, Alexander (Sasha Levin)]

Now that kmemcheck is gone, we don't need the NOTRACK flags.

Signed-off-by: Sasha Levin 
---
 arch/x86/include/asm/pgtable.h   |  5 -
 arch/x86/include/asm/pgtable_types.h | 13 -
 include/linux/gfp.h  |  9 -
 include/linux/slab.h |  6 --
 include/trace/events/mmflags.h   |  1 -
 mm/slub.c|  2 --
 tools/perf/builtin-kmem.c|  1 -
 7 files changed, 37 deletions(-)

diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index b714934512b3..d110e38893d1 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -666,11 +666,6 @@ static inline bool pte_accessible(struct mm_struct *mm, 
pte_t a)
return false;
 }
 
-static inline int pte_hidden(pte_t pte)
-{
-   return pte_flags(pte) & _PAGE_HIDDEN;
-}
-
 static inline int pmd_present(pmd_t pmd)
 {
/*
diff --git a/arch/x86/include/asm/pgtable_types.h 
b/arch/x86/include/asm/pgtable_types.h
index f1492473f10e..27e230dec7a4 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -31,7 +31,6 @@
 
 #define _PAGE_BIT_SPECIAL  _PAGE_BIT_SOFTW1
 #define _PAGE_BIT_CPA_TEST _PAGE_BIT_SOFTW1
-#define _PAGE_BIT_HIDDEN   _PAGE_BIT_SOFTW3 /* hidden by kmemcheck */
 #define _PAGE_BIT_SOFT_DIRTY   _PAGE_BIT_SOFTW3 /* software dirty tracking */
 #define _PAGE_BIT_DEVMAP   _PAGE_BIT_SOFTW4
 
@@ -78,18 +77,6 @@
 #define _PAGE_KNL_ERRATUM_MASK 0
 #endif
 
-#ifdef CONFIG_KMEMCHECK
-#define _PAGE_HIDDEN   (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
-#else
-#define _PAGE_HIDDEN   (_AT(pteval_t, 0))
-#endif
-
-/*
- * The same hidden bit is used by kmemcheck, but since kmemcheck
- * works on kernel pages while soft-dirty engine on user space,
- * they do not conflict with each other.
- */
-
 #ifdef CONFIG_MEM_SOFT_DIRTY
 #define _PAGE_SOFT_DIRTY   (_AT(pteval_t, 1) << _PAGE_BIT_SOFT_DIRTY)
 #else
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index f780718b7391..3427fb8d936a 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -36,7 +36,6 @@ struct vm_area_struct;
 #define ___GFP_THISNODE0x4u
 #define ___GFP_ATOMIC  0x8u
 #define ___GFP_ACCOUNT 0x10u
-#define ___GFP_NOTRACK 0x20u
 #define ___GFP_DIRECT_RECLAIM  0x40u
 #define ___GFP_WRITE   0x80u
 #define ___GFP_KSWAPD_RECLAIM  0x100u
@@ -200,19 +199,11 @@ struct vm_area_struct;
  * __GFP_COMP address compound page metadata.
  *
  * __GFP_ZERO returns a zeroed page on success.
- *
- * __GFP_NOTRACK avoids tracking with kmemcheck.
- *
- * __GFP_NOTRACK_FALSE_POSITIVE is an alias of __GFP_NOTRACK. It's a means of
- *   distinguishing in the source between false positives and allocations that
- *   cannot be supported (e.g. page tables).
  */
 #define __GFP_COLD ((__force gfp_t)___GFP_COLD)
 #define __GFP_NOWARN   ((__force gfp_t)___GFP_NOWARN)
 #define __GFP_COMP ((__force gfp_t)___GFP_COMP)
 #define __GFP_ZERO ((__force gfp_t)___GFP_ZERO)
-#define __GFP_NOTRACK  ((__force gfp_t)___GFP_NOTRACK)
-#define __GFP_NOTRACK_FALSE_POSITIVE (__GFP_NOTRACK)
 
 /* Disable lockdep for GFP context tracking */
 #define __GFP_NOLOCKDEP ((__force gfp_t)___GFP_NOLOCKDEP)
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 41473df6dfb0..f35c640687a0 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -77,12 +77,6 @@
 
 #define SLAB_NOLEAKTRACE   0x0080UL/* Avoid kmemleak tracing */
 
-/* Don't track use of uninitialized memory */
-#ifdef CONFIG_KMEMCHECK
-# define SLAB_NOTRACK  0x0100UL
-#else
-# define SLAB_NOTRACK  0xUL
-#endif
 #ifdef CONFIG_FAILSLAB
 # define SLAB_FAILSLAB 0x0200UL/* Fault injection mark */
 #else
diff --git a/include/trace/events/mmflags.h b/include/trace/events/mmflags.h
index fec6291a6703..937d5d54d1b9 100644
--- a/include/trace/events/mmflags.h
+++ b/include/trace/events/mmflags.h
@@ -45,7 +45,6 @@
{(unsigned long)__GFP_RECLAIMABLE,  "__GFP_RECLAIMABLE"},   \
{(unsigned long)__GFP_MOVABLE,  "__GFP_MOVABLE"},   \
{(unsigned long)__GFP_ACCOUNT,  "__GFP_ACCOUNT"},   \
-   {(unsigned long)__GFP_NOTRACK,  "__GFP_NOTRACK"},   \
{(unsigned long)__GFP_WRITE,"__GFP_WRITE"}, \
{(unsigned long)__GFP_RECLAIM,  "__GFP_RECLAIM"},   \
{(unsigned long)__GFP_DIRECT_RECLAIM,   "__GFP_DIRECT_RECLAIM"},\
diff --git a/mm/slub.c b/mm/slub.c
index a3ccf106fc0b..ea182bbd52b6 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5631,8 +5631,6 @@ static char *create_unique_id(struct kmem_cache *s)
*p++ = 'a';
if (s->flags & SLAB_CONSISTENCY_CHECKS)
*p++ = 'F';
-   if (!(s->flags & SLAB_NOTRACK))
-   *p++ = 't';
if (s->flags & SLAB_ACCOUNT)

[PATCH v2 0/4] kmemcheck: kill kmemcheck

[Levin, Alexander (Sasha Levin)]

2 Years ago I proposed to kill kmemcheck:

> As discussed on LSF/MM, kill kmemcheck.
>
> KASan is a replacement that is able to work without the limitation of
> kmemcheck (single CPU, slow). KASan is already upstream.
>
> We are also not aware of any users of kmemcheck (or users who don't consider
> KASan as a suitable replacement).

The only objection was that since KASAN wasn't supported by all GCC
versions provided by distros at that time we should hold off for 2
years, and try again.

Now that 2 years have passed, and all distros provide gcc that supports
KASAN, kill kmemcheck again for the very same reasons.


Changes for v2:
 - Break patch out.


Sasha Levin (4):
  kmemcheck: remove annotations
  kmemcheck: stop using GFP_NOTRACK and SLAB_NOTRACK
  kmemcheck: rip it out
  kmemcheck: remove whats left of NOTRACK flags

 Documentation/admin-guide/kernel-parameters.txt |   7 -
 Documentation/dev-tools/index.rst   |   1 -
 Documentation/dev-tools/kmemcheck.rst   | 733 
 MAINTAINERS |  10 -
 arch/arm/include/asm/dma-iommu.h|   1 -
 arch/arm/include/asm/pgalloc.h  |   2 +-
 arch/arm64/include/asm/pgalloc.h|   2 +-
 arch/openrisc/include/asm/dma-mapping.h |   1 -
 arch/powerpc/include/asm/pgalloc.h  |   2 +-
 arch/sh/kernel/dwarf.c  |   4 +-
 arch/sh/kernel/process.c|   2 +-
 arch/sparc/mm/init_64.c |   4 +-
 arch/unicore32/include/asm/pgalloc.h|   2 +-
 arch/x86/Kconfig|   3 +-
 arch/x86/Makefile   |   5 -
 arch/x86/include/asm/dma-mapping.h  |   1 -
 arch/x86/include/asm/kmemcheck.h|  42 --
 arch/x86/include/asm/pgtable.h  |   5 -
 arch/x86/include/asm/pgtable_types.h|  13 -
 arch/x86/include/asm/string_32.h|   9 -
 arch/x86/include/asm/string_64.h|   8 -
 arch/x86/include/asm/xor.h  |   5 +-
 arch/x86/kernel/cpu/intel.c |  15 -
 arch/x86/kernel/espfix_64.c |   2 +-
 arch/x86/kernel/traps.c |   5 -
 arch/x86/mm/Makefile|   2 -
 arch/x86/mm/fault.c |   6 -
 arch/x86/mm/init.c  |   8 +-
 arch/x86/mm/init_64.c   |   2 +-
 arch/x86/mm/kmemcheck/Makefile  |   1 -
 arch/x86/mm/kmemcheck/error.c   | 227 
 arch/x86/mm/kmemcheck/error.h   |  15 -
 arch/x86/mm/kmemcheck/kmemcheck.c   | 658 -
 arch/x86/mm/kmemcheck/opcode.c  | 106 
 arch/x86/mm/kmemcheck/opcode.h  |   9 -
 arch/x86/mm/kmemcheck/pte.c |  22 -
 arch/x86/mm/kmemcheck/pte.h |  10 -
 arch/x86/mm/kmemcheck/selftest.c|  70 ---
 arch/x86/mm/kmemcheck/selftest.h|   6 -
 arch/x86/mm/kmemcheck/shadow.c  | 173 --
 arch/x86/mm/kmemcheck/shadow.h  |  18 -
 arch/x86/mm/pageattr.c  |  10 +-
 arch/x86/mm/pgtable.c   |   2 +-
 arch/x86/platform/efi/efi_64.c  |   2 +-
 crypto/xor.c|   7 +-
 drivers/char/random.c   |   1 -
 drivers/misc/c2port/core.c  |   2 -
 fs/dcache.c |   2 -
 include/linux/c2port.h  |   4 -
 include/linux/dma-mapping.h |   4 -
 include/linux/filter.h  |   2 -
 include/linux/gfp.h |   9 -
 include/linux/interrupt.h   |  15 -
 include/linux/kmemcheck.h   | 171 --
 include/linux/mm_types.h|   8 -
 include/linux/net.h |   3 -
 include/linux/ring_buffer.h |   3 -
 include/linux/skbuff.h  |   3 -
 include/linux/slab.h|   6 -
 include/linux/thread_info.h |   5 +-
 include/net/inet_sock.h |   3 -
 include/net/inet_timewait_sock.h|   4 -
 include/net/sock.h  |   3 -
 include/trace/events/mmflags.h  |   1 -
 init/do_mounts.c|   3 +-
 init/main.c |   1 -
 kernel/bpf/core.c   |   6 -
 kernel/fork.c   |  12 +-
 kernel/locking/lockdep.c|   3 -
 kernel/signal.c |   3 +-
 kernel/softirq.c|  10 -
 kernel/sysctl.c  

[PATCH v2 4/4] kmemcheck: remove whats left of NOTRACK flags

[Levin, Alexander (Sasha Levin)]

Now that kmemcheck is gone, we don't need the NOTRACK flags.

Signed-off-by: Sasha Levin 
---
 arch/x86/include/asm/pgtable.h   |  5 -
 arch/x86/include/asm/pgtable_types.h | 13 -
 include/linux/gfp.h  |  9 -
 include/linux/slab.h |  6 --
 include/trace/events/mmflags.h   |  1 -
 mm/slub.c|  2 --
 tools/perf/builtin-kmem.c|  1 -
 7 files changed, 37 deletions(-)

diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index b714934512b3..d110e38893d1 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -666,11 +666,6 @@ static inline bool pte_accessible(struct mm_struct *mm, 
pte_t a)
return false;
 }
 
-static inline int pte_hidden(pte_t pte)
-{
-   return pte_flags(pte) & _PAGE_HIDDEN;
-}
-
 static inline int pmd_present(pmd_t pmd)
 {
/*
diff --git a/arch/x86/include/asm/pgtable_types.h 
b/arch/x86/include/asm/pgtable_types.h
index f1492473f10e..27e230dec7a4 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -31,7 +31,6 @@
 
 #define _PAGE_BIT_SPECIAL  _PAGE_BIT_SOFTW1
 #define _PAGE_BIT_CPA_TEST _PAGE_BIT_SOFTW1
-#define _PAGE_BIT_HIDDEN   _PAGE_BIT_SOFTW3 /* hidden by kmemcheck */
 #define _PAGE_BIT_SOFT_DIRTY   _PAGE_BIT_SOFTW3 /* software dirty tracking */
 #define _PAGE_BIT_DEVMAP   _PAGE_BIT_SOFTW4
 
@@ -78,18 +77,6 @@
 #define _PAGE_KNL_ERRATUM_MASK 0
 #endif
 
-#ifdef CONFIG_KMEMCHECK
-#define _PAGE_HIDDEN   (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
-#else
-#define _PAGE_HIDDEN   (_AT(pteval_t, 0))
-#endif
-
-/*
- * The same hidden bit is used by kmemcheck, but since kmemcheck
- * works on kernel pages while soft-dirty engine on user space,
- * they do not conflict with each other.
- */
-
 #ifdef CONFIG_MEM_SOFT_DIRTY
 #define _PAGE_SOFT_DIRTY   (_AT(pteval_t, 1) << _PAGE_BIT_SOFT_DIRTY)
 #else
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index f780718b7391..3427fb8d936a 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -36,7 +36,6 @@ struct vm_area_struct;
 #define ___GFP_THISNODE0x4u
 #define ___GFP_ATOMIC  0x8u
 #define ___GFP_ACCOUNT 0x10u
-#define ___GFP_NOTRACK 0x20u
 #define ___GFP_DIRECT_RECLAIM  0x40u
 #define ___GFP_WRITE   0x80u
 #define ___GFP_KSWAPD_RECLAIM  0x100u
@@ -200,19 +199,11 @@ struct vm_area_struct;
  * __GFP_COMP address compound page metadata.
  *
  * __GFP_ZERO returns a zeroed page on success.
- *
- * __GFP_NOTRACK avoids tracking with kmemcheck.
- *
- * __GFP_NOTRACK_FALSE_POSITIVE is an alias of __GFP_NOTRACK. It's a means of
- *   distinguishing in the source between false positives and allocations that
- *   cannot be supported (e.g. page tables).
  */
 #define __GFP_COLD ((__force gfp_t)___GFP_COLD)
 #define __GFP_NOWARN   ((__force gfp_t)___GFP_NOWARN)
 #define __GFP_COMP ((__force gfp_t)___GFP_COMP)
 #define __GFP_ZERO ((__force gfp_t)___GFP_ZERO)
-#define __GFP_NOTRACK  ((__force gfp_t)___GFP_NOTRACK)
-#define __GFP_NOTRACK_FALSE_POSITIVE (__GFP_NOTRACK)
 
 /* Disable lockdep for GFP context tracking */
 #define __GFP_NOLOCKDEP ((__force gfp_t)___GFP_NOLOCKDEP)
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 41473df6dfb0..f35c640687a0 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -77,12 +77,6 @@
 
 #define SLAB_NOLEAKTRACE   0x0080UL/* Avoid kmemleak tracing */
 
-/* Don't track use of uninitialized memory */
-#ifdef CONFIG_KMEMCHECK
-# define SLAB_NOTRACK  0x0100UL
-#else
-# define SLAB_NOTRACK  0xUL
-#endif
 #ifdef CONFIG_FAILSLAB
 # define SLAB_FAILSLAB 0x0200UL/* Fault injection mark */
 #else
diff --git a/include/trace/events/mmflags.h b/include/trace/events/mmflags.h
index fec6291a6703..937d5d54d1b9 100644
--- a/include/trace/events/mmflags.h
+++ b/include/trace/events/mmflags.h
@@ -45,7 +45,6 @@
{(unsigned long)__GFP_RECLAIMABLE,  "__GFP_RECLAIMABLE"},   \
{(unsigned long)__GFP_MOVABLE,  "__GFP_MOVABLE"},   \
{(unsigned long)__GFP_ACCOUNT,  "__GFP_ACCOUNT"},   \
-   {(unsigned long)__GFP_NOTRACK,  "__GFP_NOTRACK"},   \
{(unsigned long)__GFP_WRITE,"__GFP_WRITE"}, \
{(unsigned long)__GFP_RECLAIM,  "__GFP_RECLAIM"},   \
{(unsigned long)__GFP_DIRECT_RECLAIM,   "__GFP_DIRECT_RECLAIM"},\
diff --git a/mm/slub.c b/mm/slub.c
index a3ccf106fc0b..ea182bbd52b6 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5631,8 +5631,6 @@ static char *create_unique_id(struct kmem_cache *s)
*p++ = 'a';
if (s->flags & SLAB_CONSISTENCY_CHECKS)
*p++ = 'F';
-   if (!(s->flags & SLAB_NOTRACK))
-   *p++ = 't';
if (s->flags & SLAB_ACCOUNT)
*p++ = 'A';

[PATCH v2 0/4] kmemcheck: kill kmemcheck

[Levin, Alexander (Sasha Levin)]

2 Years ago I proposed to kill kmemcheck:

> As discussed on LSF/MM, kill kmemcheck.
>
> KASan is a replacement that is able to work without the limitation of
> kmemcheck (single CPU, slow). KASan is already upstream.
>
> We are also not aware of any users of kmemcheck (or users who don't consider
> KASan as a suitable replacement).

The only objection was that since KASAN wasn't supported by all GCC
versions provided by distros at that time we should hold off for 2
years, and try again.

Now that 2 years have passed, and all distros provide gcc that supports
KASAN, kill kmemcheck again for the very same reasons.


Changes for v2:
 - Break patch out.


Sasha Levin (4):
  kmemcheck: remove annotations
  kmemcheck: stop using GFP_NOTRACK and SLAB_NOTRACK
  kmemcheck: rip it out
  kmemcheck: remove whats left of NOTRACK flags

 Documentation/admin-guide/kernel-parameters.txt |   7 -
 Documentation/dev-tools/index.rst   |   1 -
 Documentation/dev-tools/kmemcheck.rst   | 733 
 MAINTAINERS |  10 -
 arch/arm/include/asm/dma-iommu.h|   1 -
 arch/arm/include/asm/pgalloc.h  |   2 +-
 arch/arm64/include/asm/pgalloc.h|   2 +-
 arch/openrisc/include/asm/dma-mapping.h |   1 -
 arch/powerpc/include/asm/pgalloc.h  |   2 +-
 arch/sh/kernel/dwarf.c  |   4 +-
 arch/sh/kernel/process.c|   2 +-
 arch/sparc/mm/init_64.c |   4 +-
 arch/unicore32/include/asm/pgalloc.h|   2 +-
 arch/x86/Kconfig|   3 +-
 arch/x86/Makefile   |   5 -
 arch/x86/include/asm/dma-mapping.h  |   1 -
 arch/x86/include/asm/kmemcheck.h|  42 --
 arch/x86/include/asm/pgtable.h  |   5 -
 arch/x86/include/asm/pgtable_types.h|  13 -
 arch/x86/include/asm/string_32.h|   9 -
 arch/x86/include/asm/string_64.h|   8 -
 arch/x86/include/asm/xor.h  |   5 +-
 arch/x86/kernel/cpu/intel.c |  15 -
 arch/x86/kernel/espfix_64.c |   2 +-
 arch/x86/kernel/traps.c |   5 -
 arch/x86/mm/Makefile|   2 -
 arch/x86/mm/fault.c |   6 -
 arch/x86/mm/init.c  |   8 +-
 arch/x86/mm/init_64.c   |   2 +-
 arch/x86/mm/kmemcheck/Makefile  |   1 -
 arch/x86/mm/kmemcheck/error.c   | 227 
 arch/x86/mm/kmemcheck/error.h   |  15 -
 arch/x86/mm/kmemcheck/kmemcheck.c   | 658 -
 arch/x86/mm/kmemcheck/opcode.c  | 106 
 arch/x86/mm/kmemcheck/opcode.h  |   9 -
 arch/x86/mm/kmemcheck/pte.c |  22 -
 arch/x86/mm/kmemcheck/pte.h |  10 -
 arch/x86/mm/kmemcheck/selftest.c|  70 ---
 arch/x86/mm/kmemcheck/selftest.h|   6 -
 arch/x86/mm/kmemcheck/shadow.c  | 173 --
 arch/x86/mm/kmemcheck/shadow.h  |  18 -
 arch/x86/mm/pageattr.c  |  10 +-
 arch/x86/mm/pgtable.c   |   2 +-
 arch/x86/platform/efi/efi_64.c  |   2 +-
 crypto/xor.c|   7 +-
 drivers/char/random.c   |   1 -
 drivers/misc/c2port/core.c  |   2 -
 fs/dcache.c |   2 -
 include/linux/c2port.h  |   4 -
 include/linux/dma-mapping.h |   4 -
 include/linux/filter.h  |   2 -
 include/linux/gfp.h |   9 -
 include/linux/interrupt.h   |  15 -
 include/linux/kmemcheck.h   | 171 --
 include/linux/mm_types.h|   8 -
 include/linux/net.h |   3 -
 include/linux/ring_buffer.h |   3 -
 include/linux/skbuff.h  |   3 -
 include/linux/slab.h|   6 -
 include/linux/thread_info.h |   5 +-
 include/net/inet_sock.h |   3 -
 include/net/inet_timewait_sock.h|   4 -
 include/net/sock.h  |   3 -
 include/trace/events/mmflags.h  |   1 -
 init/do_mounts.c|   3 +-
 init/main.c |   1 -
 kernel/bpf/core.c   |   6 -
 kernel/fork.c   |  12 +-
 kernel/locking/lockdep.c|   3 -
 kernel/signal.c |   3 +-
 kernel/softirq.c|  10 -
 kernel/sysctl.c  

Re: [PATCH 3/4] sched: WARN when migrating to an offline CPU

[Levin, Alexander (Sasha Levin)]

On Fri, Sep 29, 2017 at 01:11:26PM +0200, Peter Zijlstra wrote:
>I can't seem to trigger :-(
>
>Can you please run with the below patch and:
>
>  # echo 1 > /proc/sys/kernel/traceoff_on_warning

The call stack trace looks like so:

[ 2073.492089] Unregister pv shared memory for cpu 2
[ 2073.495414] NOHZ: local_softirq_pending 202
[ 2073.516166] [ cut here ]
[ 2073.519047] WARNING: CPU: 2 PID: 24 at kernel/sched/core.c:1178 set_task_cpu 
(kernel/sched/core.c:1157) 
[ 2073.520317] Modules linked in:
[ 2073.520816] CPU: 2 PID: 24 Comm: migration/2 Not tainted 
4.14.0-rc2-next-20170927+ #256
[ 2073.522046] task: 8801ab7cc040 task.stack: 8801ab7d8000
[ 2073.522963] RIP: 0010:set_task_cpu (??:?) 
[ 2073.523655] RSP: 0018:8801ab807b20 EFLAGS: 00010096
[ 2073.524662] RAX: 0002 RBX: 880189810040 RCX: 1100356f993a
[ 2073.525747] RDX:  RSI:  RDI: 0046
[ 2073.526845] RBP: 8801ab807b60 R08:  R09: 
[ 2073.527940] R10:  R11:  R12: 001e5900
[ 2073.529027] R13: 0006 R14: 0002 R15: 8801898100a4
[ 2073.530118] FS:  () GS:8801ab80() 
knlGS:
[ 2073.531556] CS:  0010 DS:  ES:  CR0: 80050033
[ 2073.532443] CR2: 7ffd965f1be8 CR3: 000187ede001 CR4: 000606a0
[ 2073.533546] Call Trace:
[ 2073.533944]  
[ 2073.534280] detach_task.isra.80 (kernel/sched/fair.c:6816) 
[ 2073.534939] load_balance (./include/linux/list.h:78 kernel/sched/fair.c:6902 
kernel/sched/fair.c:8204) 
[ 2073.535543] ? find_busiest_group (kernel/sched/fair.c:8133) 
[ 2073.536252] rebalance_domains (kernel/sched/fair.c:8838) 
[ 2073.536903] ? pick_next_task_fair (kernel/sched/fair.c:8787) 
[ 2073.537628] ? check_preemption_disabled (lib/smp_processor_id.c:52) 
[ 2073.538395] run_rebalance_domains (kernel/sched/fair.c:9062) 
[ 2073.539096] ? check_preemption_disabled (lib/smp_processor_id.c:52) 
[ 2073.539850] __do_softirq (kernel/softirq.c:284 
./include/linux/jump_label.h:141 ./include/trace/events/irq.h:141 
kernel/softirq.c:285) 
[ 2073.540424] ? check_preemption_disabled (lib/smp_processor_id.c:52) 
[ 2073.541189] irq_exit (kernel/softirq.c:364 kernel/softirq.c:405) 
[ 2073.541715] smp_apic_timer_interrupt (./arch/x86/include/asm/irq_regs.h:26 
arch/x86/kernel/apic/apic.c:1043) 
[ 2073.542452] apic_timer_interrupt (arch/x86/entry/entry_64.S:770) 
[ 2073.543116]  
[ 2073.543463] RIP: 0010:multi_cpu_stop (??:?) 
[ 2073.544173] RSP: 0018:8801ab7dfd88 EFLAGS: 0292 ORIG_RAX: 
ff11
[ 2073.545326] RAX: 0007 RBX: 0004 RCX: 000a
[ 2073.546406] RDX:  RSI: 9c46eee0 RDI: 0292
[ 2073.547503] RBP: 8801ab7dfde0 R08:  R09: 
[ 2073.548587] R10:  R11:  R12: 88012aaf7890
[ 2073.549668] R13: 88012aaf78b4 R14: dc00 R15: 0003
[ 2073.550765] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63) 
[ 2073.551501] ? cpu_stop_queue_work (kernel/stop_machine.c:176) 
[ 2073.552195] cpu_stopper_thread (kernel/stop_machine.c:480) 
[ 2073.552845] ? cpu_stop_create (kernel/stop_machine.c:458) 
[ 2073.553462] smpboot_thread_fn (kernel/smpboot.c:164) 
[ 2073.554104] ? sort_range (kernel/smpboot.c:107) 
[ 2073.554671] ? schedule (./arch/x86/include/asm/bitops.h:324 (discriminator 
1) ./include/linux/thread_info.h:79 (discriminator 1) 
./include/linux/sched.h:1605 (discriminator 1) kernel/sched/core.c:3435 
(discriminator 1)) 
[ 2073.555230] ? __kthread_parkme (kernel/kthread.c:188) 
[ 2073.555892] kthread (kernel/kthread.c:242) 
[ 2073.556408] ? sort_range (kernel/smpboot.c:107) 
[ 2073.556963] ? kthread_create_on_node (kernel/kthread.c:198) 
[ 2073.557693] ret_from_fork (arch/x86/entry/entry_64.S:437) 
[ 2073.558261] Code: 09 84 d2 74 05 e8 84 3a 4b 00 f7 83 84 00 00 00 fd ff ff 
ff 0f 84 a0 f9 ff ff 0f ff e9 99 f9 ff ff e8 78 18 ff ff e9 c7 fd ff ff <0f> ff 
e9 ea f9 ff ff e8 67 18 ff ff e9 f5 f9 ff ff e8 fd 85 0f 

All code

   0:   09 84 d2 74 05 e8 84or %eax,-0x7b17fa8c(%rdx,%rdx,8)
   7:   3a 4b 00cmp0x0(%rbx),%cl
   a:   f7 83 84 00 00 00 fdtestl  $0xfffd,0x84(%rbx)
  11:   ff ff ff 
  14:   0f 84 a0 f9 ff ff   je 0xf9ba
  1a:   0f ff   (bad)  
  1c:   e9 99 f9 ff ff  jmpq   0xf9ba
  21:   e8 78 18 ff ff  callq  0x189e
  26:   e9 c7 fd ff ff  jmpq   0xfdf2
  2b:*  0f ff   (bad)   <-- trapping instruction
  2d:   e9 ea f9 ff ff  jmpq   0xfa1c
  32:   e8 67 18 ff ff  callq  0x189e
  37:   e9 f5 f9 ff ff  jmpq   0xfa31
  3c:   e8 fd 85 0f 00  callq  0xf863e

Code starting with the faulting 

Re: [PATCH 3/4] sched: WARN when migrating to an offline CPU

[Levin, Alexander (Sasha Levin)]

On Fri, Sep 29, 2017 at 01:11:26PM +0200, Peter Zijlstra wrote:
>I can't seem to trigger :-(
>
>Can you please run with the below patch and:
>
>  # echo 1 > /proc/sys/kernel/traceoff_on_warning

The call stack trace looks like so:

[ 2073.492089] Unregister pv shared memory for cpu 2
[ 2073.495414] NOHZ: local_softirq_pending 202
[ 2073.516166] [ cut here ]
[ 2073.519047] WARNING: CPU: 2 PID: 24 at kernel/sched/core.c:1178 set_task_cpu 
(kernel/sched/core.c:1157) 
[ 2073.520317] Modules linked in:
[ 2073.520816] CPU: 2 PID: 24 Comm: migration/2 Not tainted 
4.14.0-rc2-next-20170927+ #256
[ 2073.522046] task: 8801ab7cc040 task.stack: 8801ab7d8000
[ 2073.522963] RIP: 0010:set_task_cpu (??:?) 
[ 2073.523655] RSP: 0018:8801ab807b20 EFLAGS: 00010096
[ 2073.524662] RAX: 0002 RBX: 880189810040 RCX: 1100356f993a
[ 2073.525747] RDX:  RSI:  RDI: 0046
[ 2073.526845] RBP: 8801ab807b60 R08:  R09: 
[ 2073.527940] R10:  R11:  R12: 001e5900
[ 2073.529027] R13: 0006 R14: 0002 R15: 8801898100a4
[ 2073.530118] FS:  () GS:8801ab80() 
knlGS:
[ 2073.531556] CS:  0010 DS:  ES:  CR0: 80050033
[ 2073.532443] CR2: 7ffd965f1be8 CR3: 000187ede001 CR4: 000606a0
[ 2073.533546] Call Trace:
[ 2073.533944]  
[ 2073.534280] detach_task.isra.80 (kernel/sched/fair.c:6816) 
[ 2073.534939] load_balance (./include/linux/list.h:78 kernel/sched/fair.c:6902 
kernel/sched/fair.c:8204) 
[ 2073.535543] ? find_busiest_group (kernel/sched/fair.c:8133) 
[ 2073.536252] rebalance_domains (kernel/sched/fair.c:8838) 
[ 2073.536903] ? pick_next_task_fair (kernel/sched/fair.c:8787) 
[ 2073.537628] ? check_preemption_disabled (lib/smp_processor_id.c:52) 
[ 2073.538395] run_rebalance_domains (kernel/sched/fair.c:9062) 
[ 2073.539096] ? check_preemption_disabled (lib/smp_processor_id.c:52) 
[ 2073.539850] __do_softirq (kernel/softirq.c:284 
./include/linux/jump_label.h:141 ./include/trace/events/irq.h:141 
kernel/softirq.c:285) 
[ 2073.540424] ? check_preemption_disabled (lib/smp_processor_id.c:52) 
[ 2073.541189] irq_exit (kernel/softirq.c:364 kernel/softirq.c:405) 
[ 2073.541715] smp_apic_timer_interrupt (./arch/x86/include/asm/irq_regs.h:26 
arch/x86/kernel/apic/apic.c:1043) 
[ 2073.542452] apic_timer_interrupt (arch/x86/entry/entry_64.S:770) 
[ 2073.543116]  
[ 2073.543463] RIP: 0010:multi_cpu_stop (??:?) 
[ 2073.544173] RSP: 0018:8801ab7dfd88 EFLAGS: 0292 ORIG_RAX: 
ff11
[ 2073.545326] RAX: 0007 RBX: 0004 RCX: 000a
[ 2073.546406] RDX:  RSI: 9c46eee0 RDI: 0292
[ 2073.547503] RBP: 8801ab7dfde0 R08:  R09: 
[ 2073.548587] R10:  R11:  R12: 88012aaf7890
[ 2073.549668] R13: 88012aaf78b4 R14: dc00 R15: 0003
[ 2073.550765] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63) 
[ 2073.551501] ? cpu_stop_queue_work (kernel/stop_machine.c:176) 
[ 2073.552195] cpu_stopper_thread (kernel/stop_machine.c:480) 
[ 2073.552845] ? cpu_stop_create (kernel/stop_machine.c:458) 
[ 2073.553462] smpboot_thread_fn (kernel/smpboot.c:164) 
[ 2073.554104] ? sort_range (kernel/smpboot.c:107) 
[ 2073.554671] ? schedule (./arch/x86/include/asm/bitops.h:324 (discriminator 
1) ./include/linux/thread_info.h:79 (discriminator 1) 
./include/linux/sched.h:1605 (discriminator 1) kernel/sched/core.c:3435 
(discriminator 1)) 
[ 2073.555230] ? __kthread_parkme (kernel/kthread.c:188) 
[ 2073.555892] kthread (kernel/kthread.c:242) 
[ 2073.556408] ? sort_range (kernel/smpboot.c:107) 
[ 2073.556963] ? kthread_create_on_node (kernel/kthread.c:198) 
[ 2073.557693] ret_from_fork (arch/x86/entry/entry_64.S:437) 
[ 2073.558261] Code: 09 84 d2 74 05 e8 84 3a 4b 00 f7 83 84 00 00 00 fd ff ff 
ff 0f 84 a0 f9 ff ff 0f ff e9 99 f9 ff ff e8 78 18 ff ff e9 c7 fd ff ff <0f> ff 
e9 ea f9 ff ff e8 67 18 ff ff e9 f5 f9 ff ff e8 fd 85 0f 

All code

   0:   09 84 d2 74 05 e8 84or %eax,-0x7b17fa8c(%rdx,%rdx,8)
   7:   3a 4b 00cmp0x0(%rbx),%cl
   a:   f7 83 84 00 00 00 fdtestl  $0xfffd,0x84(%rbx)
  11:   ff ff ff 
  14:   0f 84 a0 f9 ff ff   je 0xf9ba
  1a:   0f ff   (bad)  
  1c:   e9 99 f9 ff ff  jmpq   0xf9ba
  21:   e8 78 18 ff ff  callq  0x189e
  26:   e9 c7 fd ff ff  jmpq   0xfdf2
  2b:*  0f ff   (bad)   <-- trapping instruction
  2d:   e9 ea f9 ff ff  jmpq   0xfa1c
  32:   e8 67 18 ff ff  callq  0x189e
  37:   e9 f5 f9 ff ff  jmpq   0xfa31
  3c:   e8 fd 85 0f 00  callq  0xf863e

Code starting with the faulting 

Re: [PATCH 4.4 22/50] pinctrl: mvebu: Use seq_puts() in mvebu_pinconf_group_dbg_show()

[Levin, Alexander (Sasha Levin)]

On Fri, Oct 06, 2017 at 11:20:11AM +0200, Greg Kroah-Hartman wrote:
>On Fri, Oct 06, 2017 at 02:09:14AM -0700, Joe Perches wrote:
>> On Fri, 2017-10-06 at 10:53 +0200, Greg Kroah-Hartman wrote:
>> > 4.4-stable review patch.  If anyone has any objections, please let me know.
>>
>> I hope this patch is just to make porting some other patch easier.
>>
>> Otherwise, this has no place in stable as it has no change in
>> functionality and is a completely trivial savings in cpu only.
>
>I thought that was the case when I was reviewing them, but I don't see
>any other patch touching this area anymore.  I'll go drop this from the
>4.4 and 4.9 queues, sorry for missing this.
>
>Sasha, be more careful please :)

Sorry for this.

I appriciate the input and reviews, I look into each "fuck up" and try to 
figure out why both myself and AI considered it stable and try to learn from it.

-- 

Thanks,
Sasha

Re: [PATCH 4.4 22/50] pinctrl: mvebu: Use seq_puts() in mvebu_pinconf_group_dbg_show()

[Levin, Alexander (Sasha Levin)]

On Fri, Oct 06, 2017 at 11:20:11AM +0200, Greg Kroah-Hartman wrote:
>On Fri, Oct 06, 2017 at 02:09:14AM -0700, Joe Perches wrote:
>> On Fri, 2017-10-06 at 10:53 +0200, Greg Kroah-Hartman wrote:
>> > 4.4-stable review patch.  If anyone has any objections, please let me know.
>>
>> I hope this patch is just to make porting some other patch easier.
>>
>> Otherwise, this has no place in stable as it has no change in
>> functionality and is a completely trivial savings in cpu only.
>
>I thought that was the case when I was reviewing them, but I don't see
>any other patch touching this area anymore.  I'll go drop this from the
>4.4 and 4.9 queues, sorry for missing this.
>
>Sasha, be more careful please :)

Sorry for this.

I appriciate the input and reviews, I look into each "fuck up" and try to 
figure out why both myself and AI considered it stable and try to learn from it.

-- 

Thanks,
Sasha

Re: [PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

On Sat, Sep 30, 2017 at 03:57:27PM +0200, Vegard Nossum wrote:
>On 30 September 2017 at 11:48, Steven Rostedt  wrote:
>> On Wed, 27 Sep 2017 17:02:07 +0200
>> Michal Hocko  wrote:
>>
>>> > Now that 2 years have passed, and all distros provide gcc that supports
>>> > KASAN, kill kmemcheck again for the very same reasons.
>>>
>>> This is just too large to review manually. How have you generated the
>>> patch?
>>
>> I agree. This needs to be taken out piece by piece, not in one go,
>> where there could be unexpected fallout.
>
>I have a patch from earlier this year that starts by removing the core
>code and defining all the helpers/flags as no-ops so they can be
>removed bit by bit at a later time. See the attachment. Pekka signed
>off on it too.
>e
>I never actually submitted this because I was waiting for MSAN to be

I'm not sure how much value there is in doing it this way. I agree that the 
patch is big, but most of it is simply removing code under 
arch/x86/mm/kmemcheck.

The difference between Vegard's patch and mine is about 300 lines (out of 
2800+), where those 300 lines are simply removing calls to kmemcheck. There are 
no logic changes. (so something very similar to 's/*kmemcheck*//g' would do the 
trick).

--

Thanks,
Sasha

Re: [PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

On Sat, Sep 30, 2017 at 03:57:27PM +0200, Vegard Nossum wrote:
>On 30 September 2017 at 11:48, Steven Rostedt  wrote:
>> On Wed, 27 Sep 2017 17:02:07 +0200
>> Michal Hocko  wrote:
>>
>>> > Now that 2 years have passed, and all distros provide gcc that supports
>>> > KASAN, kill kmemcheck again for the very same reasons.
>>>
>>> This is just too large to review manually. How have you generated the
>>> patch?
>>
>> I agree. This needs to be taken out piece by piece, not in one go,
>> where there could be unexpected fallout.
>
>I have a patch from earlier this year that starts by removing the core
>code and defining all the helpers/flags as no-ops so they can be
>removed bit by bit at a later time. See the attachment. Pekka signed
>off on it too.
>e
>I never actually submitted this because I was waiting for MSAN to be

I'm not sure how much value there is in doing it this way. I agree that the 
patch is big, but most of it is simply removing code under 
arch/x86/mm/kmemcheck.

The difference between Vegard's patch and mine is about 300 lines (out of 
2800+), where those 300 lines are simply removing calls to kmemcheck. There are 
no logic changes. (so something very similar to 's/*kmemcheck*//g' would do the 
trick).

--

Thanks,
Sasha

Re: [PATCH v3 tip/core/rcu 40/40] rcu: Make non-preemptive schedule be Tasks RCU quiescent state

[Levin, Alexander (Sasha Levin)]

On Thu, Sep 28, 2017 at 06:08:56PM +0200, Peter Zijlstra wrote:
>On Thu, Sep 28, 2017 at 03:38:16PM +0000, Levin, Alexander (Sasha Levin) wrote:
>> On Thu, Sep 28, 2017 at 05:30:55AM -0700, Paul E. McKenney wrote:
>
>> >Hmmm...  kernel/rcu/tree_plugin.h:329 thinks that someone slept (as opposed
>> >to was preempted) in an RCU read-side critical section.
>
>Sasha, was this on one of those kernels that did a printk() from
>scheduler context?

No, it was an older kernel (about a month old -next), I also didn't do
any CPU hotplug in this set of tests.

-- 

Thanks,
Sasha

Re: [PATCH v3 tip/core/rcu 40/40] rcu: Make non-preemptive schedule be Tasks RCU quiescent state

[Levin, Alexander (Sasha Levin)]

On Thu, Sep 28, 2017 at 06:08:56PM +0200, Peter Zijlstra wrote:
>On Thu, Sep 28, 2017 at 03:38:16PM +0000, Levin, Alexander (Sasha Levin) wrote:
>> On Thu, Sep 28, 2017 at 05:30:55AM -0700, Paul E. McKenney wrote:
>
>> >Hmmm...  kernel/rcu/tree_plugin.h:329 thinks that someone slept (as opposed
>> >to was preempted) in an RCU read-side critical section.
>
>Sasha, was this on one of those kernels that did a printk() from
>scheduler context?

No, it was an older kernel (about a month old -next), I also didn't do
any CPU hotplug in this set of tests.

-- 

Thanks,
Sasha

Re: [PATCH v3 tip/core/rcu 40/40] rcu: Make non-preemptive schedule be Tasks RCU quiescent state

[Levin, Alexander (Sasha Levin)]

On Thu, Sep 28, 2017 at 05:30:55AM -0700, Paul E. McKenney wrote:
>On Thu, Sep 28, 2017 at 02:37:20AM -0700, Sasha Levin wrote:
>> On Wed, Apr 19, 2017 at 9:58 AM, Paul E. McKenney
>>  wrote:
>> > Currently, a call to schedule() acts as a Tasks RCU quiescent state
>> > only if a context switch actually takes place.  However, just the
>> > call to schedule() guarantees that the calling task has moved off of
>> > whatever tracing trampoline that it might have been one previously.
>> > This commit therefore plumbs schedule()'s "preempt" parameter into
>> > rcu_note_context_switch(), which then records the Tasks RCU quiescent
>> > state, but only if this call to schedule() was -not- due to a preemption.
>> >
>> > To avoid adding overhead to the common-case context-switch path,
>> > this commit hides the rcu_note_context_switch() check under an existing
>> > non-common-case check.
>> >
>> > Suggested-by: Steven Rostedt 
>> > Signed-off-by: Paul E. McKenney 
>>
>> Hey Paul,
>>
>> I'm seeing the following on the latest -next kernel, and suspect it's
>> caused bit this patch:
>
>Hmmm...  kernel/rcu/tree_plugin.h:329 thinks that someone slept (as opposed
>to was preempted) in an RCU read-side critical section.
>
>If this is reproducible, could you please enable lockdep if you are not
>already doing so?

lockdep was on, as far as I can tell.

It happened once in ~3 weeks of fuzzing, so not sure how easily I can reproduce.

-- 

Thanks,
Sasha

Re: [PATCH v3 tip/core/rcu 40/40] rcu: Make non-preemptive schedule be Tasks RCU quiescent state

[Levin, Alexander (Sasha Levin)]

On Thu, Sep 28, 2017 at 05:30:55AM -0700, Paul E. McKenney wrote:
>On Thu, Sep 28, 2017 at 02:37:20AM -0700, Sasha Levin wrote:
>> On Wed, Apr 19, 2017 at 9:58 AM, Paul E. McKenney
>>  wrote:
>> > Currently, a call to schedule() acts as a Tasks RCU quiescent state
>> > only if a context switch actually takes place.  However, just the
>> > call to schedule() guarantees that the calling task has moved off of
>> > whatever tracing trampoline that it might have been one previously.
>> > This commit therefore plumbs schedule()'s "preempt" parameter into
>> > rcu_note_context_switch(), which then records the Tasks RCU quiescent
>> > state, but only if this call to schedule() was -not- due to a preemption.
>> >
>> > To avoid adding overhead to the common-case context-switch path,
>> > this commit hides the rcu_note_context_switch() check under an existing
>> > non-common-case check.
>> >
>> > Suggested-by: Steven Rostedt 
>> > Signed-off-by: Paul E. McKenney 
>>
>> Hey Paul,
>>
>> I'm seeing the following on the latest -next kernel, and suspect it's
>> caused bit this patch:
>
>Hmmm...  kernel/rcu/tree_plugin.h:329 thinks that someone slept (as opposed
>to was preempted) in an RCU read-side critical section.
>
>If this is reproducible, could you please enable lockdep if you are not
>already doing so?

lockdep was on, as far as I can tell.

It happened once in ~3 weeks of fuzzing, so not sure how easily I can reproduce.

-- 

Thanks,
Sasha

Re: sched: serial port lockdep warning when offlining CPUs

[Levin, Alexander (Sasha Levin)]

On Thu, Sep 28, 2017 at 08:36:07PM +0900, Sergey Senozhatsky wrote:
>On (09/28/17 19:30), Sergey Senozhatsky wrote:
>>  lib/ratelimit.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/lib/ratelimit.c b/lib/ratelimit.c
>> index 08f8043cac61..bddc55834c2e 100644
>> --- a/lib/ratelimit.c
>> +++ b/lib/ratelimit.c
>> @@ -48,7 +48,8 @@ int ___ratelimit(struct ratelimit_state *rs, const char 
>> *func)
>>  if (time_is_before_jiffies(rs->begin + rs->interval)) {
>>  if (rs->missed) {
>>  if (!(rs->flags & RATELIMIT_MSG_ON_RELEASE)) {
>> -pr_warn("%s: %d callbacks suppressed\n", func, 
>> rs->missed);
>> +printk_deferred(KERN_WARN "%s: %d callbacks 
>> suppressed\n",
>
>oops...s/KERN_WARN/KERN_WARNING/
>
>sorry about that.

Okay, that seems to have delt with the callbacks supressed issue.

I also seem to be hitting it as a result of the scheduler triggering a WARN, 
where print_stack_trace(), for example, just uses printk().

Now I'm not sure what's your approach here, do we keep converting printk to 
printk_deferred one by one until we whacked every mole?

-- 

Thanks,
Sasha

Re: sched: serial port lockdep warning when offlining CPUs

[Levin, Alexander (Sasha Levin)]

On Thu, Sep 28, 2017 at 08:36:07PM +0900, Sergey Senozhatsky wrote:
>On (09/28/17 19:30), Sergey Senozhatsky wrote:
>>  lib/ratelimit.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/lib/ratelimit.c b/lib/ratelimit.c
>> index 08f8043cac61..bddc55834c2e 100644
>> --- a/lib/ratelimit.c
>> +++ b/lib/ratelimit.c
>> @@ -48,7 +48,8 @@ int ___ratelimit(struct ratelimit_state *rs, const char 
>> *func)
>>  if (time_is_before_jiffies(rs->begin + rs->interval)) {
>>  if (rs->missed) {
>>  if (!(rs->flags & RATELIMIT_MSG_ON_RELEASE)) {
>> -pr_warn("%s: %d callbacks suppressed\n", func, 
>> rs->missed);
>> +printk_deferred(KERN_WARN "%s: %d callbacks 
>> suppressed\n",
>
>oops...s/KERN_WARN/KERN_WARNING/
>
>sorry about that.

Okay, that seems to have delt with the callbacks supressed issue.

I also seem to be hitting it as a result of the scheduler triggering a WARN, 
where print_stack_trace(), for example, just uses printk().

Now I'm not sure what's your approach here, do we keep converting printk to 
printk_deferred one by one until we whacked every mole?

-- 

Thanks,
Sasha

Re: sched: serial port lockdep warning when offlining CPUs

[Levin, Alexander (Sasha Levin)]

On Thu, Sep 28, 2017 at 11:38:47AM +0200, Peter Zijlstra wrote:
>On Thu, Sep 28, 2017 at 02:19:46AM -0700, Sasha Levin wrote:
>> Hi all,
>>
>> I seem to be hitting the following warning when offlining CPUs on the
>> latest -next kernel:
>>
>> [289683102.607076] Unregister pv shared memory for cpu 8
>> [289683102.622922] select_fallback_rq: 3 callbacks suppressed
>
>This is because you hit a printk() from the scheduler, that's known
>broken (along with the rest of printk).
>
>You forgot to actually include that printk() though I suspect it reads
>like:
>
>  "process %d (%s) no longer affine to cpu%d\n"
>
>Now that uses printk_deferred() which _should_ work lots better, but
>clearly the printk() stuff went wobbly again.

Hm, so is this an actual possible lockup, or just a false positive?

>> [289683102.626292] vprintk_emit (kernel/printk/printk.c:1876)
>> [289683102.626294] vprintk_default (kernel/printk/printk.c:1918)
>> [289683102.626295] vprintk_func (kernel/printk/printk_safe.c:382)
>> [289683102.626297] printk (kernel/printk/printk.c:1943)
>> [289683102.626299] ? show_regs_print_info (kernel/printk/printk.c:1943)
>> [289683102.626301] ? lock_acquire (kernel/locking/lockdep.c:4004)
>> [289683102.626306] ___ratelimit (lib/ratelimit.c:52)
>> [289683102.626309] __printk_ratelimit (kernel/printk/printk.c:2874)
>> [289683102.626311] select_fallback_rq (kernel/sched/core.c:1525 
>> (discriminator 1))
>> [289683102.626313] sched_cpu_dying (kernel/sched/core.c:5500 
>> kernel/sched/core.c:5687)
>
>Also, could you pretty please not line wrap logs?

Sure, I had to resort to using gmail at a conference :(

-- 

Thanks,
Sasha

Re: sched: serial port lockdep warning when offlining CPUs

[Levin, Alexander (Sasha Levin)]

On Thu, Sep 28, 2017 at 11:38:47AM +0200, Peter Zijlstra wrote:
>On Thu, Sep 28, 2017 at 02:19:46AM -0700, Sasha Levin wrote:
>> Hi all,
>>
>> I seem to be hitting the following warning when offlining CPUs on the
>> latest -next kernel:
>>
>> [289683102.607076] Unregister pv shared memory for cpu 8
>> [289683102.622922] select_fallback_rq: 3 callbacks suppressed
>
>This is because you hit a printk() from the scheduler, that's known
>broken (along with the rest of printk).
>
>You forgot to actually include that printk() though I suspect it reads
>like:
>
>  "process %d (%s) no longer affine to cpu%d\n"
>
>Now that uses printk_deferred() which _should_ work lots better, but
>clearly the printk() stuff went wobbly again.

Hm, so is this an actual possible lockup, or just a false positive?

>> [289683102.626292] vprintk_emit (kernel/printk/printk.c:1876)
>> [289683102.626294] vprintk_default (kernel/printk/printk.c:1918)
>> [289683102.626295] vprintk_func (kernel/printk/printk_safe.c:382)
>> [289683102.626297] printk (kernel/printk/printk.c:1943)
>> [289683102.626299] ? show_regs_print_info (kernel/printk/printk.c:1943)
>> [289683102.626301] ? lock_acquire (kernel/locking/lockdep.c:4004)
>> [289683102.626306] ___ratelimit (lib/ratelimit.c:52)
>> [289683102.626309] __printk_ratelimit (kernel/printk/printk.c:2874)
>> [289683102.626311] select_fallback_rq (kernel/sched/core.c:1525 
>> (discriminator 1))
>> [289683102.626313] sched_cpu_dying (kernel/sched/core.c:5500 
>> kernel/sched/core.c:5687)
>
>Also, could you pretty please not line wrap logs?

Sure, I had to resort to using gmail at a conference :(

-- 

Thanks,
Sasha

Re: [PATCH 3/4] sched: WARN when migrating to an offline CPU

[Levin, Alexander (Sasha Levin)]

On Thu, Sep 28, 2017 at 12:35:41PM +0200, Peter Zijlstra wrote:
>On Thu, Sep 28, 2017 at 02:14:15AM -0700, Sasha Levin wrote:
>> On Thu, Sep 7, 2017 at 8:03 AM, Peter Zijlstra  wrote:
>> > Migrating tasks to offline CPUs is a pretty big fail, warn about it.
>>
>> Hey Peter,
>>
>> This seems to get hit on the latest -next:
>>
>> [2035565360.446794] Unregister pv shared memory for cpu 2
>> [2035565360.467930] numa_remove_cpu cpu 2 node 2: mask now 6
>> [2035565360.471431] [ cut here ]
>> [2035565360.472548] WARNING: CPU: 2 PID: 24 at > kernel/sched/core.c:1178 
>> set_task_cpu (kernel/sched/core.c:1157)
>> [2035565360.473840] Modules linked in:
>> [2035565360.474632] CPU: 2 PID: 24 Comm: migration/2 Not tainted > 
>> 4.14.0-rc2-next-20170927+ #252
>
>Urgh, weird. That really shouldn't happen. Can you easily reproduce?

Looks like yes. Seems like it's enough to stress CPU hotplug + trinity.

If you have patches you want me try send them my way.

-- 

Thanks,
Sasha

Re: [PATCH 3/4] sched: WARN when migrating to an offline CPU

[Levin, Alexander (Sasha Levin)]

On Thu, Sep 28, 2017 at 12:35:41PM +0200, Peter Zijlstra wrote:
>On Thu, Sep 28, 2017 at 02:14:15AM -0700, Sasha Levin wrote:
>> On Thu, Sep 7, 2017 at 8:03 AM, Peter Zijlstra  wrote:
>> > Migrating tasks to offline CPUs is a pretty big fail, warn about it.
>>
>> Hey Peter,
>>
>> This seems to get hit on the latest -next:
>>
>> [2035565360.446794] Unregister pv shared memory for cpu 2
>> [2035565360.467930] numa_remove_cpu cpu 2 node 2: mask now 6
>> [2035565360.471431] [ cut here ]
>> [2035565360.472548] WARNING: CPU: 2 PID: 24 at > kernel/sched/core.c:1178 
>> set_task_cpu (kernel/sched/core.c:1157)
>> [2035565360.473840] Modules linked in:
>> [2035565360.474632] CPU: 2 PID: 24 Comm: migration/2 Not tainted > 
>> 4.14.0-rc2-next-20170927+ #252
>
>Urgh, weird. That really shouldn't happen. Can you easily reproduce?

Looks like yes. Seems like it's enough to stress CPU hotplug + trinity.

If you have patches you want me try send them my way.

-- 

Thanks,
Sasha

Re: [PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

On Wed, Sep 27, 2017 at 12:36:27PM -0500, Eric W. Biederman wrote:
>"Levin, Alexander (Sasha Levin)" <alexander.le...@verizon.com> writes:
>
>> On Wed, Sep 27, 2017 at 05:02:07PM +0200, Michal Hocko wrote:
>>>This is just too large to review manually. How have you generated the
>>>patch?
>>
>> Manualy. Note that most of it (~95%) is the result of 'rm 
>> arch/x86/mm/kmemcheck'.
>>
>> Otherwise, I just removed all uses of __GFP_NOWARN/SLAB_NOWARN, and calls to
>> various annotations throughout the code.
>
>Do you mean GFP_NOTRACK? GFP_NOWARN has a different meaning.

uh, yes, thanks Eric!

__GFP_NOTRACK and SLAB_NOTRACK.

-- 

Thanks,
Sasha

Re: [PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

On Wed, Sep 27, 2017 at 12:36:27PM -0500, Eric W. Biederman wrote:
>"Levin, Alexander (Sasha Levin)"  writes:
>
>> On Wed, Sep 27, 2017 at 05:02:07PM +0200, Michal Hocko wrote:
>>>This is just too large to review manually. How have you generated the
>>>patch?
>>
>> Manualy. Note that most of it (~95%) is the result of 'rm 
>> arch/x86/mm/kmemcheck'.
>>
>> Otherwise, I just removed all uses of __GFP_NOWARN/SLAB_NOWARN, and calls to
>> various annotations throughout the code.
>
>Do you mean GFP_NOTRACK? GFP_NOWARN has a different meaning.

uh, yes, thanks Eric!

__GFP_NOTRACK and SLAB_NOTRACK.

-- 

Thanks,
Sasha

Re: [PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

On Wed, Sep 27, 2017 at 05:02:07PM +0200, Michal Hocko wrote:
>This is just too large to review manually. How have you generated the
>patch?

Manualy. Note that most of it (~95%) is the result of 'rm 
arch/x86/mm/kmemcheck'.

Otherwise, I just removed all uses of __GFP_NOWARN/SLAB_NOWARN, and calls to
various annotations throughout the code.

I'm not sure about i386 breakage, will take a look, doesn't seem to be too 
obvious.

-- 

Thanks,
Sasha

Re: [PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

On Wed, Sep 27, 2017 at 05:02:07PM +0200, Michal Hocko wrote:
>This is just too large to review manually. How have you generated the
>patch?

Manualy. Note that most of it (~95%) is the result of 'rm 
arch/x86/mm/kmemcheck'.

Otherwise, I just removed all uses of __GFP_NOWARN/SLAB_NOWARN, and calls to
various annotations throughout the code.

I'm not sure about i386 breakage, will take a look, doesn't seem to be too 
obvious.

-- 

Thanks,
Sasha

Re: [PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

I stupidly forgot to Cc Pekka and Vegard, now Cc'ed.

On Wed, Sep 27, 2017 at 11:27:40AM +, Levin, Alexander (Sasha Levin) wrote:
>2 Years ago I proposed to kill kmemcheck:
>
>> As discussed on LSF/MM, kill kmemcheck.
>>
>> KASan is a replacement that is able to work without the limitation of
>> kmemcheck (single CPU, slow). KASan is already upstream.
>>
>> We are also not aware of any users of kmemcheck (or users who don't consider
>> KASan as a suitable replacement).
>
>The only objection was that since KASAN wasn't supported by all GCC
>versions provided by distros at that time we should hold off for 2
>years, and try again.
>
>Now that 2 years have passed, and all distros provide gcc that supports
>KASAN, kill kmemcheck again for the very same reasons.
>
>Cc: Steven Rostedt (VMware) <rost...@goodmis.org>
>Cc: David S. Miller <da...@davemloft.net>
>Signed-off-by: Sasha Levin <alexander.le...@verizon.com>
>---
> Documentation/admin-guide/kernel-parameters.txt |   7 -
> Documentation/dev-tools/index.rst   |   1 -
> Documentation/dev-tools/kmemcheck.rst   | 733 
> MAINTAINERS |  10 -
> arch/arm/include/asm/dma-iommu.h|   1 -
> arch/arm/include/asm/pgalloc.h  |   2 +-
> arch/arm64/include/asm/pgalloc.h|   2 +-
> arch/openrisc/include/asm/dma-mapping.h |   1 -
> arch/powerpc/include/asm/pgalloc.h  |   2 +-
> arch/sh/kernel/dwarf.c  |   4 +-
> arch/sh/kernel/process.c|   2 +-
> arch/sparc/mm/init_64.c |   4 +-
> arch/unicore32/include/asm/pgalloc.h|   2 +-
> arch/x86/Kconfig|   3 +-
> arch/x86/Makefile   |   5 -
> arch/x86/include/asm/dma-mapping.h  |   1 -
> arch/x86/include/asm/kmemcheck.h|  42 --
> arch/x86/include/asm/pgtable.h  |   5 -
> arch/x86/include/asm/pgtable_types.h|  13 -
> arch/x86/include/asm/string_32.h|   9 -
> arch/x86/include/asm/string_64.h|   8 -
> arch/x86/include/asm/xor.h  |   4 +-
> arch/x86/kernel/cpu/intel.c |  15 -
> arch/x86/kernel/espfix_64.c |   2 +-
> arch/x86/kernel/traps.c |   5 -
> arch/x86/mm/Makefile|   2 -
> arch/x86/mm/fault.c |   6 -
> arch/x86/mm/init.c  |   8 +-
> arch/x86/mm/init_64.c   |   2 +-
> arch/x86/mm/kmemcheck/Makefile  |   1 -
> arch/x86/mm/kmemcheck/error.c   | 227 
> arch/x86/mm/kmemcheck/error.h   |  15 -
> arch/x86/mm/kmemcheck/kmemcheck.c   | 658 -
> arch/x86/mm/kmemcheck/opcode.c  | 106 
> arch/x86/mm/kmemcheck/opcode.h  |   9 -
> arch/x86/mm/kmemcheck/pte.c |  22 -
> arch/x86/mm/kmemcheck/pte.h |  10 -
> arch/x86/mm/kmemcheck/selftest.c|  70 ---
> arch/x86/mm/kmemcheck/selftest.h|   6 -
> arch/x86/mm/kmemcheck/shadow.c  | 173 --
> arch/x86/mm/kmemcheck/shadow.h  |  18 -
> arch/x86/mm/pageattr.c  |  10 +-
> arch/x86/mm/pgtable.c   |   2 +-
> arch/x86/platform/efi/efi_64.c  |   2 +-
> crypto/xor.c|   7 +-
> drivers/char/random.c   |   1 -
> drivers/misc/c2port/core.c  |   2 -
> fs/dcache.c |   2 -
> include/linux/c2port.h  |   4 -
> include/linux/dma-mapping.h |   8 +-
> include/linux/filter.h  |   2 -
> include/linux/gfp.h |   9 -
> include/linux/interrupt.h   |  15 -
> include/linux/kmemcheck.h   | 171 --
> include/linux/mm_types.h|   8 -
> include/linux/net.h |   3 -
> include/linux/ring_buffer.h |   3 -
> include/linux/skbuff.h  |   3 -
> include/linux/slab.h|   6 -
> include/linux/thread_info.h |   5 +-
> include/net/inet_sock.h |   3 -
> include/net/inet_timewait_sock.h|   3 -
> include/net/sock.h  |   2 -
> include/trace/events/m

Re: [PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

I stupidly forgot to Cc Pekka and Vegard, now Cc'ed.

On Wed, Sep 27, 2017 at 11:27:40AM +, Levin, Alexander (Sasha Levin) wrote:
>2 Years ago I proposed to kill kmemcheck:
>
>> As discussed on LSF/MM, kill kmemcheck.
>>
>> KASan is a replacement that is able to work without the limitation of
>> kmemcheck (single CPU, slow). KASan is already upstream.
>>
>> We are also not aware of any users of kmemcheck (or users who don't consider
>> KASan as a suitable replacement).
>
>The only objection was that since KASAN wasn't supported by all GCC
>versions provided by distros at that time we should hold off for 2
>years, and try again.
>
>Now that 2 years have passed, and all distros provide gcc that supports
>KASAN, kill kmemcheck again for the very same reasons.
>
>Cc: Steven Rostedt (VMware) 
>Cc: David S. Miller 
>Signed-off-by: Sasha Levin 
>---
> Documentation/admin-guide/kernel-parameters.txt |   7 -
> Documentation/dev-tools/index.rst   |   1 -
> Documentation/dev-tools/kmemcheck.rst   | 733 
> MAINTAINERS |  10 -
> arch/arm/include/asm/dma-iommu.h|   1 -
> arch/arm/include/asm/pgalloc.h  |   2 +-
> arch/arm64/include/asm/pgalloc.h|   2 +-
> arch/openrisc/include/asm/dma-mapping.h |   1 -
> arch/powerpc/include/asm/pgalloc.h  |   2 +-
> arch/sh/kernel/dwarf.c  |   4 +-
> arch/sh/kernel/process.c|   2 +-
> arch/sparc/mm/init_64.c |   4 +-
> arch/unicore32/include/asm/pgalloc.h|   2 +-
> arch/x86/Kconfig|   3 +-
> arch/x86/Makefile   |   5 -
> arch/x86/include/asm/dma-mapping.h  |   1 -
> arch/x86/include/asm/kmemcheck.h|  42 --
> arch/x86/include/asm/pgtable.h  |   5 -
> arch/x86/include/asm/pgtable_types.h|  13 -
> arch/x86/include/asm/string_32.h|   9 -
> arch/x86/include/asm/string_64.h|   8 -
> arch/x86/include/asm/xor.h  |   4 +-
> arch/x86/kernel/cpu/intel.c |  15 -
> arch/x86/kernel/espfix_64.c |   2 +-
> arch/x86/kernel/traps.c |   5 -
> arch/x86/mm/Makefile|   2 -
> arch/x86/mm/fault.c |   6 -
> arch/x86/mm/init.c  |   8 +-
> arch/x86/mm/init_64.c   |   2 +-
> arch/x86/mm/kmemcheck/Makefile  |   1 -
> arch/x86/mm/kmemcheck/error.c   | 227 
> arch/x86/mm/kmemcheck/error.h   |  15 -
> arch/x86/mm/kmemcheck/kmemcheck.c   | 658 -
> arch/x86/mm/kmemcheck/opcode.c  | 106 
> arch/x86/mm/kmemcheck/opcode.h  |   9 -
> arch/x86/mm/kmemcheck/pte.c |  22 -
> arch/x86/mm/kmemcheck/pte.h |  10 -
> arch/x86/mm/kmemcheck/selftest.c|  70 ---
> arch/x86/mm/kmemcheck/selftest.h|   6 -
> arch/x86/mm/kmemcheck/shadow.c  | 173 --
> arch/x86/mm/kmemcheck/shadow.h  |  18 -
> arch/x86/mm/pageattr.c  |  10 +-
> arch/x86/mm/pgtable.c   |   2 +-
> arch/x86/platform/efi/efi_64.c  |   2 +-
> crypto/xor.c|   7 +-
> drivers/char/random.c   |   1 -
> drivers/misc/c2port/core.c  |   2 -
> fs/dcache.c |   2 -
> include/linux/c2port.h  |   4 -
> include/linux/dma-mapping.h |   8 +-
> include/linux/filter.h  |   2 -
> include/linux/gfp.h |   9 -
> include/linux/interrupt.h   |  15 -
> include/linux/kmemcheck.h   | 171 --
> include/linux/mm_types.h|   8 -
> include/linux/net.h |   3 -
> include/linux/ring_buffer.h |   3 -
> include/linux/skbuff.h  |   3 -
> include/linux/slab.h|   6 -
> include/linux/thread_info.h |   5 +-
> include/net/inet_sock.h |   3 -
> include/net/inet_timewait_sock.h|   3 -
> include/net/sock.h  |   2 -
> include/trace/events/mmflags.h  |   1 -
> init/do_mounts.c

[PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

2 Years ago I proposed to kill kmemcheck:

> As discussed on LSF/MM, kill kmemcheck.
>
> KASan is a replacement that is able to work without the limitation of
> kmemcheck (single CPU, slow). KASan is already upstream.
>
> We are also not aware of any users of kmemcheck (or users who don't consider
> KASan as a suitable replacement).

The only objection was that since KASAN wasn't supported by all GCC
versions provided by distros at that time we should hold off for 2
years, and try again.

Now that 2 years have passed, and all distros provide gcc that supports
KASAN, kill kmemcheck again for the very same reasons.

Cc: Steven Rostedt (VMware) 
Cc: David S. Miller 
Signed-off-by: Sasha Levin 
---
 Documentation/admin-guide/kernel-parameters.txt |   7 -
 Documentation/dev-tools/index.rst   |   1 -
 Documentation/dev-tools/kmemcheck.rst   | 733 
 MAINTAINERS |  10 -
 arch/arm/include/asm/dma-iommu.h|   1 -
 arch/arm/include/asm/pgalloc.h  |   2 +-
 arch/arm64/include/asm/pgalloc.h|   2 +-
 arch/openrisc/include/asm/dma-mapping.h |   1 -
 arch/powerpc/include/asm/pgalloc.h  |   2 +-
 arch/sh/kernel/dwarf.c  |   4 +-
 arch/sh/kernel/process.c|   2 +-
 arch/sparc/mm/init_64.c |   4 +-
 arch/unicore32/include/asm/pgalloc.h|   2 +-
 arch/x86/Kconfig|   3 +-
 arch/x86/Makefile   |   5 -
 arch/x86/include/asm/dma-mapping.h  |   1 -
 arch/x86/include/asm/kmemcheck.h|  42 --
 arch/x86/include/asm/pgtable.h  |   5 -
 arch/x86/include/asm/pgtable_types.h|  13 -
 arch/x86/include/asm/string_32.h|   9 -
 arch/x86/include/asm/string_64.h|   8 -
 arch/x86/include/asm/xor.h  |   4 +-
 arch/x86/kernel/cpu/intel.c |  15 -
 arch/x86/kernel/espfix_64.c |   2 +-
 arch/x86/kernel/traps.c |   5 -
 arch/x86/mm/Makefile|   2 -
 arch/x86/mm/fault.c |   6 -
 arch/x86/mm/init.c  |   8 +-
 arch/x86/mm/init_64.c   |   2 +-
 arch/x86/mm/kmemcheck/Makefile  |   1 -
 arch/x86/mm/kmemcheck/error.c   | 227 
 arch/x86/mm/kmemcheck/error.h   |  15 -
 arch/x86/mm/kmemcheck/kmemcheck.c   | 658 -
 arch/x86/mm/kmemcheck/opcode.c  | 106 
 arch/x86/mm/kmemcheck/opcode.h  |   9 -
 arch/x86/mm/kmemcheck/pte.c |  22 -
 arch/x86/mm/kmemcheck/pte.h |  10 -
 arch/x86/mm/kmemcheck/selftest.c|  70 ---
 arch/x86/mm/kmemcheck/selftest.h|   6 -
 arch/x86/mm/kmemcheck/shadow.c  | 173 --
 arch/x86/mm/kmemcheck/shadow.h  |  18 -
 arch/x86/mm/pageattr.c  |  10 +-
 arch/x86/mm/pgtable.c   |   2 +-
 arch/x86/platform/efi/efi_64.c  |   2 +-
 crypto/xor.c|   7 +-
 drivers/char/random.c   |   1 -
 drivers/misc/c2port/core.c  |   2 -
 fs/dcache.c |   2 -
 include/linux/c2port.h  |   4 -
 include/linux/dma-mapping.h |   8 +-
 include/linux/filter.h  |   2 -
 include/linux/gfp.h |   9 -
 include/linux/interrupt.h   |  15 -
 include/linux/kmemcheck.h   | 171 --
 include/linux/mm_types.h|   8 -
 include/linux/net.h |   3 -
 include/linux/ring_buffer.h |   3 -
 include/linux/skbuff.h  |   3 -
 include/linux/slab.h|   6 -
 include/linux/thread_info.h |   5 +-
 include/net/inet_sock.h |   3 -
 include/net/inet_timewait_sock.h|   3 -
 include/net/sock.h  |   2 -
 include/trace/events/mmflags.h  |   1 -
 init/do_mounts.c|   3 +-
 init/main.c |   1 -
 kernel/bpf/core.c   |   6 -
 kernel/fork.c   |  12 +-
 kernel/locking/lockdep.c|   3 -
 kernel/signal.c |   3 +-
 kernel/softirq.c|  10 -
 kernel/sysctl.c |  10 -
 kernel/trace/ring_buffer.c  

[PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

2 Years ago I proposed to kill kmemcheck:

> As discussed on LSF/MM, kill kmemcheck.
>
> KASan is a replacement that is able to work without the limitation of
> kmemcheck (single CPU, slow). KASan is already upstream.
>
> We are also not aware of any users of kmemcheck (or users who don't consider
> KASan as a suitable replacement).

The only objection was that since KASAN wasn't supported by all GCC
versions provided by distros at that time we should hold off for 2
years, and try again.

Now that 2 years have passed, and all distros provide gcc that supports
KASAN, kill kmemcheck again for the very same reasons.

Cc: Steven Rostedt (VMware) 
Cc: David S. Miller 
Signed-off-by: Sasha Levin 
---
 Documentation/admin-guide/kernel-parameters.txt |   7 -
 Documentation/dev-tools/index.rst   |   1 -
 Documentation/dev-tools/kmemcheck.rst   | 733 
 MAINTAINERS |  10 -
 arch/arm/include/asm/dma-iommu.h|   1 -
 arch/arm/include/asm/pgalloc.h  |   2 +-
 arch/arm64/include/asm/pgalloc.h|   2 +-
 arch/openrisc/include/asm/dma-mapping.h |   1 -
 arch/powerpc/include/asm/pgalloc.h  |   2 +-
 arch/sh/kernel/dwarf.c  |   4 +-
 arch/sh/kernel/process.c|   2 +-
 arch/sparc/mm/init_64.c |   4 +-
 arch/unicore32/include/asm/pgalloc.h|   2 +-
 arch/x86/Kconfig|   3 +-
 arch/x86/Makefile   |   5 -
 arch/x86/include/asm/dma-mapping.h  |   1 -
 arch/x86/include/asm/kmemcheck.h|  42 --
 arch/x86/include/asm/pgtable.h  |   5 -
 arch/x86/include/asm/pgtable_types.h|  13 -
 arch/x86/include/asm/string_32.h|   9 -
 arch/x86/include/asm/string_64.h|   8 -
 arch/x86/include/asm/xor.h  |   4 +-
 arch/x86/kernel/cpu/intel.c |  15 -
 arch/x86/kernel/espfix_64.c |   2 +-
 arch/x86/kernel/traps.c |   5 -
 arch/x86/mm/Makefile|   2 -
 arch/x86/mm/fault.c |   6 -
 arch/x86/mm/init.c  |   8 +-
 arch/x86/mm/init_64.c   |   2 +-
 arch/x86/mm/kmemcheck/Makefile  |   1 -
 arch/x86/mm/kmemcheck/error.c   | 227 
 arch/x86/mm/kmemcheck/error.h   |  15 -
 arch/x86/mm/kmemcheck/kmemcheck.c   | 658 -
 arch/x86/mm/kmemcheck/opcode.c  | 106 
 arch/x86/mm/kmemcheck/opcode.h  |   9 -
 arch/x86/mm/kmemcheck/pte.c |  22 -
 arch/x86/mm/kmemcheck/pte.h |  10 -
 arch/x86/mm/kmemcheck/selftest.c|  70 ---
 arch/x86/mm/kmemcheck/selftest.h|   6 -
 arch/x86/mm/kmemcheck/shadow.c  | 173 --
 arch/x86/mm/kmemcheck/shadow.h  |  18 -
 arch/x86/mm/pageattr.c  |  10 +-
 arch/x86/mm/pgtable.c   |   2 +-
 arch/x86/platform/efi/efi_64.c  |   2 +-
 crypto/xor.c|   7 +-
 drivers/char/random.c   |   1 -
 drivers/misc/c2port/core.c  |   2 -
 fs/dcache.c |   2 -
 include/linux/c2port.h  |   4 -
 include/linux/dma-mapping.h |   8 +-
 include/linux/filter.h  |   2 -
 include/linux/gfp.h |   9 -
 include/linux/interrupt.h   |  15 -
 include/linux/kmemcheck.h   | 171 --
 include/linux/mm_types.h|   8 -
 include/linux/net.h |   3 -
 include/linux/ring_buffer.h |   3 -
 include/linux/skbuff.h  |   3 -
 include/linux/slab.h|   6 -
 include/linux/thread_info.h |   5 +-
 include/net/inet_sock.h |   3 -
 include/net/inet_timewait_sock.h|   3 -
 include/net/sock.h  |   2 -
 include/trace/events/mmflags.h  |   1 -
 init/do_mounts.c|   3 +-
 init/main.c |   1 -
 kernel/bpf/core.c   |   6 -
 kernel/fork.c   |  12 +-
 kernel/locking/lockdep.c|   3 -
 kernel/signal.c |   3 +-
 kernel/softirq.c|  10 -
 kernel/sysctl.c |  10 -
 kernel/trace/ring_buffer.c  |   3 -
 lib/Kconfig.debug 

Re: [PATCH review for 4.4 19/26] i2c: at91: ensure state is restored after suspending

[Levin, Alexander (Sasha Levin)]

On Mon, Sep 25, 2017 at 09:22:34AM +0200, Alexandre Belloni wrote:
>Hi,
>
>I don't think it is worth backporting this patch to 4.4. Cutting VDD
>core will only happen after mainline v4.12 or v4.9 for the vendor kernel.

I'll drop it, thanks Alexandre!

-- 

Thanks,
Sasha

Re: [PATCH review for 4.4 19/26] i2c: at91: ensure state is restored after suspending

[Levin, Alexander (Sasha Levin)]

On Mon, Sep 25, 2017 at 09:22:34AM +0200, Alexandre Belloni wrote:
>Hi,
>
>I don't think it is worth backporting this patch to 4.4. Cutting VDD
>core will only happen after mainline v4.12 or v4.9 for the vendor kernel.

I'll drop it, thanks Alexandre!

-- 

Thanks,
Sasha

[PATCH review for 4.9 15/50] sched/fair: Update rq clock before changing a task's CPU affinity

[Levin, Alexander (Sasha Levin)]

From: Wanpeng Li 

[ Upstream commit a499c3ead88ccf147fc50689e85a530ad923ce36 ]

This is triggered during boot when CONFIG_SCHED_DEBUG is enabled:

 [ cut here ]
 WARNING: CPU: 6 PID: 81 at kernel/sched/sched.h:812 set_next_entity+0x11d/0x380
 rq->clock_update_flags < RQCF_ACT_SKIP
 CPU: 6 PID: 81 Comm: torture_shuffle Not tainted 4.10.0+ #1
 Hardware name: LENOVO ThinkCentre M8500t-N000/SHARKBAY, BIOS FBKTC1AUS 
02/16/2016
 Call Trace:
  dump_stack+0x85/0xc2
  __warn+0xcb/0xf0
  warn_slowpath_fmt+0x5f/0x80
  set_next_entity+0x11d/0x380
  set_curr_task_fair+0x2b/0x60
  do_set_cpus_allowed+0x139/0x180
  __set_cpus_allowed_ptr+0x113/0x260
  set_cpus_allowed_ptr+0x10/0x20
  torture_shuffle+0xfd/0x180
  kthread+0x10f/0x150
  ? torture_shutdown_init+0x60/0x60
  ? kthread_create_on_node+0x60/0x60
  ret_from_fork+0x31/0x40
 ---[ end trace dd94d92344cea9c6 ]---

The task is running && !queued, so there is no rq clock update before calling
set_curr_task().

This patch fixes it by updating rq clock after holding rq->lock/pi_lock
just as what other dequeue + put_prev + enqueue + set_curr story does.

Signed-off-by: Wanpeng Li 
Signed-off-by: Peter Zijlstra (Intel) 
Reviewed-by: Matt Fleming 
Cc: Linus Torvalds 
Cc: Mike Galbraith 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Link: 
http://lkml.kernel.org/r/1487749975-5994-1-git-send-email-wanpeng...@hotmail.com
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin 
---
 kernel/sched/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 2098954c690f..d271a1c387eb 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1141,6 +1141,7 @@ static int __set_cpus_allowed_ptr(struct task_struct *p,
int ret = 0;
 
rq = task_rq_lock(p, );
+   update_rq_clock(rq);
 
if (p->flags & PF_KTHREAD) {
/*
-- 
2.11.0

[PATCH review for 4.9 15/50] sched/fair: Update rq clock before changing a task's CPU affinity

[Levin, Alexander (Sasha Levin)]

From: Wanpeng Li 

[ Upstream commit a499c3ead88ccf147fc50689e85a530ad923ce36 ]

This is triggered during boot when CONFIG_SCHED_DEBUG is enabled:

 [ cut here ]
 WARNING: CPU: 6 PID: 81 at kernel/sched/sched.h:812 set_next_entity+0x11d/0x380
 rq->clock_update_flags < RQCF_ACT_SKIP
 CPU: 6 PID: 81 Comm: torture_shuffle Not tainted 4.10.0+ #1
 Hardware name: LENOVO ThinkCentre M8500t-N000/SHARKBAY, BIOS FBKTC1AUS 
02/16/2016
 Call Trace:
  dump_stack+0x85/0xc2
  __warn+0xcb/0xf0
  warn_slowpath_fmt+0x5f/0x80
  set_next_entity+0x11d/0x380
  set_curr_task_fair+0x2b/0x60
  do_set_cpus_allowed+0x139/0x180
  __set_cpus_allowed_ptr+0x113/0x260
  set_cpus_allowed_ptr+0x10/0x20
  torture_shuffle+0xfd/0x180
  kthread+0x10f/0x150
  ? torture_shutdown_init+0x60/0x60
  ? kthread_create_on_node+0x60/0x60
  ret_from_fork+0x31/0x40
 ---[ end trace dd94d92344cea9c6 ]---

The task is running && !queued, so there is no rq clock update before calling
set_curr_task().

This patch fixes it by updating rq clock after holding rq->lock/pi_lock
just as what other dequeue + put_prev + enqueue + set_curr story does.

Signed-off-by: Wanpeng Li 
Signed-off-by: Peter Zijlstra (Intel) 
Reviewed-by: Matt Fleming 
Cc: Linus Torvalds 
Cc: Mike Galbraith 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Link: 
http://lkml.kernel.org/r/1487749975-5994-1-git-send-email-wanpeng...@hotmail.com
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin 
---
 kernel/sched/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 2098954c690f..d271a1c387eb 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1141,6 +1141,7 @@ static int __set_cpus_allowed_ptr(struct task_struct *p,
int ret = 0;
 
rq = task_rq_lock(p, );
+   update_rq_clock(rq);
 
if (p->flags & PF_KTHREAD) {
/*
-- 
2.11.0

[PATCH review for 4.9 29/50] qede: Prevent index problems in loopback test

[Levin, Alexander (Sasha Levin)]

From: Sudarsana Reddy Kalluru 

[ Upstream commit afe981d664aeeebc8d1bcbd7d2070b5432edaecb ]

Driver currently utilizes the same loop variable in two
nested loops.

Signed-off-by: Sudarsana Reddy Kalluru 
Signed-off-by: Yuval Mintz 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/qlogic/qede/qede_ethtool.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c 
b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
index 7567cc464b88..634e4149af22 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
@@ -1221,7 +1221,7 @@ static int qede_selftest_receive_traffic(struct qede_dev 
*edev)
struct qede_rx_queue *rxq = NULL;
struct sw_rx_data *sw_rx_data;
union eth_rx_cqe *cqe;
-   int i, rc = 0;
+   int i, iter, rc = 0;
u8 *data_ptr;
 
for_each_queue(i) {
@@ -1240,7 +1240,7 @@ static int qede_selftest_receive_traffic(struct qede_dev 
*edev)
 * enabled. This is because the queue 0 is configured as the default
 * queue and that the loopback traffic is not IP.
 */
-   for (i = 0; i < QEDE_SELFTEST_POLL_COUNT; i++) {
+   for (iter = 0; iter < QEDE_SELFTEST_POLL_COUNT; iter++) {
if (!qede_has_rx_work(rxq)) {
usleep_range(100, 200);
continue;
@@ -1287,7 +1287,7 @@ static int qede_selftest_receive_traffic(struct qede_dev 
*edev)
qed_chain_recycle_consumed(>rx_comp_ring);
}
 
-   if (i == QEDE_SELFTEST_POLL_COUNT) {
+   if (iter == QEDE_SELFTEST_POLL_COUNT) {
DP_NOTICE(edev, "Failed to receive the traffic\n");
return -1;
}
-- 
2.11.0

[PATCH review for 4.9 29/50] qede: Prevent index problems in loopback test

[Levin, Alexander (Sasha Levin)]

From: Sudarsana Reddy Kalluru 

[ Upstream commit afe981d664aeeebc8d1bcbd7d2070b5432edaecb ]

Driver currently utilizes the same loop variable in two
nested loops.

Signed-off-by: Sudarsana Reddy Kalluru 
Signed-off-by: Yuval Mintz 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/qlogic/qede/qede_ethtool.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c 
b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
index 7567cc464b88..634e4149af22 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
@@ -1221,7 +1221,7 @@ static int qede_selftest_receive_traffic(struct qede_dev 
*edev)
struct qede_rx_queue *rxq = NULL;
struct sw_rx_data *sw_rx_data;
union eth_rx_cqe *cqe;
-   int i, rc = 0;
+   int i, iter, rc = 0;
u8 *data_ptr;
 
for_each_queue(i) {
@@ -1240,7 +1240,7 @@ static int qede_selftest_receive_traffic(struct qede_dev 
*edev)
 * enabled. This is because the queue 0 is configured as the default
 * queue and that the loopback traffic is not IP.
 */
-   for (i = 0; i < QEDE_SELFTEST_POLL_COUNT; i++) {
+   for (iter = 0; iter < QEDE_SELFTEST_POLL_COUNT; iter++) {
if (!qede_has_rx_work(rxq)) {
usleep_range(100, 200);
continue;
@@ -1287,7 +1287,7 @@ static int qede_selftest_receive_traffic(struct qede_dev 
*edev)
qed_chain_recycle_consumed(>rx_comp_ring);
}
 
-   if (i == QEDE_SELFTEST_POLL_COUNT) {
+   if (iter == QEDE_SELFTEST_POLL_COUNT) {
DP_NOTICE(edev, "Failed to receive the traffic\n");
return -1;
}
-- 
2.11.0

[PATCH review for 4.9 14/50] f2fs: do SSR for data when there is enough free space

[Levin, Alexander (Sasha Levin)]

From: Yunlong Song 

[ Upstream commit 035e97adab26c1121cedaeb9bd04cf48a8e8cf51 ]

In allocate_segment_by_default(), need_SSR() already detected it's time to do
SSR. So, let's try to find victims for data segments more aggressively in time.

Signed-off-by: Yunlong Song 
Signed-off-by: Jaegeuk Kim 
Signed-off-by: Sasha Levin 
---
 fs/f2fs/segment.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 74a2b06d..e10f61684ea4 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1263,7 +1263,7 @@ static int get_ssr_segment(struct f2fs_sb_info *sbi, int 
type)
struct curseg_info *curseg = CURSEG_I(sbi, type);
const struct victim_selection *v_ops = DIRTY_I(sbi)->v_ops;
 
-   if (IS_NODESEG(type) || !has_not_enough_free_secs(sbi, 0, 0))
+   if (IS_NODESEG(type))
return v_ops->get_victim(sbi,
&(curseg)->next_segno, BG_GC, type, SSR);
 
-- 
2.11.0

[PATCH review for 4.9 26/50] ASoC: mediatek: add I2C dependency for CS42XX8

[Levin, Alexander (Sasha Levin)]

From: Arnd Bergmann 

[ Upstream commit 72cedf599fcebfd6cd2550274d7855838068d28c ]

We should not select drivers that depend on I2C when that is disabled,
as it results in a build error:

warning: (SND_SOC_MT2701_CS42448) selects SND_SOC_CS42XX8_I2C which has unmet 
direct dependencies (SOUND && !M68K && !UML && SND && SND_SOC && I2C)
sound/soc/codecs/cs42xx8-i2c.c:60:1: warning: data definition has no type or 
storage class
 module_i2c_driver(cs42xx8_i2c_driver);
sound/soc/codecs/cs42xx8-i2c.c:60:1: error: type defaults to 'int' in 
declaration of 'module_i2c_driver' [-Werror=implicit-int]

Fixes: 1f458d53f76c ("ASoC: mediatek: Add mt2701-cs42448 driver and config 
option.")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin 
---
 sound/soc/mediatek/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/mediatek/Kconfig b/sound/soc/mediatek/Kconfig
index 05cf809cf9e1..d7013bde6f45 100644
--- a/sound/soc/mediatek/Kconfig
+++ b/sound/soc/mediatek/Kconfig
@@ -13,7 +13,7 @@ config SND_SOC_MT2701
 
 config SND_SOC_MT2701_CS42448
tristate "ASoc Audio driver for MT2701 with CS42448 codec"
-   depends on SND_SOC_MT2701
+   depends on SND_SOC_MT2701 && I2C
select SND_SOC_CS42XX8_I2C
select SND_SOC_BT_SCO
help
-- 
2.11.0

[PATCH review for 4.9 14/50] f2fs: do SSR for data when there is enough free space

[Levin, Alexander (Sasha Levin)]

From: Yunlong Song 

[ Upstream commit 035e97adab26c1121cedaeb9bd04cf48a8e8cf51 ]

In allocate_segment_by_default(), need_SSR() already detected it's time to do
SSR. So, let's try to find victims for data segments more aggressively in time.

Signed-off-by: Yunlong Song 
Signed-off-by: Jaegeuk Kim 
Signed-off-by: Sasha Levin 
---
 fs/f2fs/segment.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 74a2b06d..e10f61684ea4 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1263,7 +1263,7 @@ static int get_ssr_segment(struct f2fs_sb_info *sbi, int 
type)
struct curseg_info *curseg = CURSEG_I(sbi, type);
const struct victim_selection *v_ops = DIRTY_I(sbi)->v_ops;
 
-   if (IS_NODESEG(type) || !has_not_enough_free_secs(sbi, 0, 0))
+   if (IS_NODESEG(type))
return v_ops->get_victim(sbi,
&(curseg)->next_segno, BG_GC, type, SSR);
 
-- 
2.11.0

[PATCH review for 4.9 26/50] ASoC: mediatek: add I2C dependency for CS42XX8

[Levin, Alexander (Sasha Levin)]

From: Arnd Bergmann 

[ Upstream commit 72cedf599fcebfd6cd2550274d7855838068d28c ]

We should not select drivers that depend on I2C when that is disabled,
as it results in a build error:

warning: (SND_SOC_MT2701_CS42448) selects SND_SOC_CS42XX8_I2C which has unmet 
direct dependencies (SOUND && !M68K && !UML && SND && SND_SOC && I2C)
sound/soc/codecs/cs42xx8-i2c.c:60:1: warning: data definition has no type or 
storage class
 module_i2c_driver(cs42xx8_i2c_driver);
sound/soc/codecs/cs42xx8-i2c.c:60:1: error: type defaults to 'int' in 
declaration of 'module_i2c_driver' [-Werror=implicit-int]

Fixes: 1f458d53f76c ("ASoC: mediatek: Add mt2701-cs42448 driver and config 
option.")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin 
---
 sound/soc/mediatek/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/mediatek/Kconfig b/sound/soc/mediatek/Kconfig
index 05cf809cf9e1..d7013bde6f45 100644
--- a/sound/soc/mediatek/Kconfig
+++ b/sound/soc/mediatek/Kconfig
@@ -13,7 +13,7 @@ config SND_SOC_MT2701
 
 config SND_SOC_MT2701_CS42448
tristate "ASoc Audio driver for MT2701 with CS42448 codec"
-   depends on SND_SOC_MT2701
+   depends on SND_SOC_MT2701 && I2C
select SND_SOC_CS42XX8_I2C
select SND_SOC_BT_SCO
help
-- 
2.11.0

[PATCH review for 4.9 24/50] slub: do not merge cache if slub_debug contains a never-merge flag

[Levin, Alexander (Sasha Levin)]

From: Grygorii Maistrenko 

[ Upstream commit c6e28895a4372992961888ffaadc9efc643b5bfe ]

In case CONFIG_SLUB_DEBUG_ON=n, find_mergeable() gets debug features from
commandline but never checks if there are features from the
SLAB_NEVER_MERGE set.

As a result selected by slub_debug caches are always mergeable if they
have been created without a custom constructor set or without one of the
SLAB_* debug features on.

This moves the SLAB_NEVER_MERGE check below the flags update from
commandline to make sure it won't merge the slab cache if one of the debug
features is on.

Link: http://lkml.kernel.org/r/20170101124451.GA4740@lp-laptop-d
Signed-off-by: Grygorii Maistrenko 
Reviewed-by: Pekka Enberg 
Acked-by: David Rientjes 
Acked-by: Christoph Lameter 
Cc: Joonsoo Kim 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
---
 mm/slab_common.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mm/slab_common.c b/mm/slab_common.c
index 5d2f24fbafc5..622f6b6ae844 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -255,7 +255,7 @@ struct kmem_cache *find_mergeable(size_t size, size_t align,
 {
struct kmem_cache *s;
 
-   if (slab_nomerge || (flags & SLAB_NEVER_MERGE))
+   if (slab_nomerge)
return NULL;
 
if (ctor)
@@ -266,6 +266,9 @@ struct kmem_cache *find_mergeable(size_t size, size_t align,
size = ALIGN(size, align);
flags = kmem_cache_flags(size, flags, name, NULL);
 
+   if (flags & SLAB_NEVER_MERGE)
+   return NULL;
+
list_for_each_entry_reverse(s, _caches, list) {
if (slab_unmergeable(s))
continue;
-- 
2.11.0

[PATCH review for 4.9 07/50] ALSA: hda: Add Geminilake HDMI codec ID

[Levin, Alexander (Sasha Levin)]

From: Vinod Koul 

[ Upstream commit 126cfa2f5e15ae2ca7f70be71b07e6cd8d2b44d1 ]

Geminilake HDMI codec 0x280d is similar to previous platforms, so add it with
similar ops as previous.

Signed-off-by: Senthilnathan Veppur 
Signed-off-by: Vinod Koul 
Signed-off-by: Takashi Iwai 
Signed-off-by: Sasha Levin 
---
 sound/pci/hda/patch_hdmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 775c67818bf1..bd650222e711 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -3685,6 +3685,7 @@ HDA_CODEC_ENTRY(0x80862808, "Broadwell HDMI", 
patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x80862809, "Skylake HDMI",patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x8086280a, "Broxton HDMI",patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x8086280b, "Kabylake HDMI",   patch_i915_hsw_hdmi),
+HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI", patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI", patch_generic_hdmi),
 HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI",patch_i915_byt_hdmi),
 HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI",   patch_i915_byt_hdmi),
-- 
2.11.0

[PATCH review for 4.9 17/50] f2fs: do not wait for writeback in write_begin

[Levin, Alexander (Sasha Levin)]

From: Jaegeuk Kim 

[ Upstream commit 86d54795c94532075d862aa0a79f0c981dab4bdd ]

Otherwise we can get livelock like below.

[79880.428136] dbench  D0 18405  18404 0x
[79880.428139] Call Trace:
[79880.428142]  __schedule+0x219/0x6b0
[79880.428144]  schedule+0x36/0x80
[79880.428147]  schedule_timeout+0x243/0x2e0
[79880.428152]  ? update_sd_lb_stats+0x16b/0x5f0
[79880.428155]  ? ktime_get+0x3c/0xb0
[79880.428157]  io_schedule_timeout+0xa6/0x110
[79880.428161]  __lock_page+0xf7/0x130
[79880.428164]  ? unlock_page+0x30/0x30
[79880.428167]  pagecache_get_page+0x16b/0x250
[79880.428171]  grab_cache_page_write_begin+0x20/0x40
[79880.428182]  f2fs_write_begin+0xa2/0xdb0 [f2fs]
[79880.428192]  ? f2fs_mark_inode_dirty_sync+0x16/0x30 [f2fs]
[79880.428197]  ? kmem_cache_free+0x79/0x200
[79880.428203]  ? __mark_inode_dirty+0x17f/0x360
[79880.428206]  generic_perform_write+0xbb/0x190
[79880.428213]  ? file_update_time+0xa4/0xf0
[79880.428217]  __generic_file_write_iter+0x19b/0x1e0
[79880.428226]  f2fs_file_write_iter+0x9c/0x180 [f2fs]
[79880.428231]  __vfs_write+0xc5/0x140
[79880.428235]  vfs_write+0xb2/0x1b0
[79880.428238]  SyS_write+0x46/0xa0
[79880.428242]  entry_SYSCALL_64_fastpath+0x1e/0xad

Fixes: cae96a5c8ab6 ("f2fs: check io submission more precisely")
Reviewed-by: Chao Yu 
Signed-off-by: Jaegeuk Kim 
Signed-off-by: Sasha Levin 
---
 fs/f2fs/data.c | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 14db4b712021..99432b59c5cb 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1619,7 +1619,12 @@ static int f2fs_write_begin(struct file *file, struct 
address_space *mapping,
goto fail;
}
 repeat:
-   page = grab_cache_page_write_begin(mapping, index, flags);
+   /*
+* Do not use grab_cache_page_write_begin() to avoid deadlock due to
+* wait_for_stable_page. Will wait that below with our IO control.
+*/
+   page = pagecache_get_page(mapping, index,
+   FGP_LOCK | FGP_WRITE | FGP_CREAT, GFP_NOFS);
if (!page) {
err = -ENOMEM;
goto fail;
-- 
2.11.0

[PATCH review for 4.9 18/50] md/linear: shutup lockdep warnning

[Levin, Alexander (Sasha Levin)]

From: Shaohua Li 

[ Upstream commit d939cdfde34f50b95254b375f498447c82190b3e ]

Commit 03a9e24(md linear: fix a race between linear_add() and
linear_congested()) introduces the warnning.

Acked-by: Coly Li 
Signed-off-by: Shaohua Li 
Signed-off-by: Sasha Levin 
---
 drivers/md/linear.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index b0c0aef92a37..12abf69d568a 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -223,7 +223,8 @@ static int linear_add(struct mddev *mddev, struct md_rdev 
*rdev)
 * oldconf until no one uses it anymore.
 */
mddev_suspend(mddev);
-   oldconf = rcu_dereference(mddev->private);
+   oldconf = rcu_dereference_protected(mddev->private,
+   lockdep_is_held(>reconfig_mutex));
mddev->raid_disks++;
WARN_ONCE(mddev->raid_disks != newconf->raid_disks,
"copied raid_disks doesn't match mddev->raid_disks");
-- 
2.11.0

[PATCH review for 4.9 24/50] slub: do not merge cache if slub_debug contains a never-merge flag

[Levin, Alexander (Sasha Levin)]

From: Grygorii Maistrenko 

[ Upstream commit c6e28895a4372992961888ffaadc9efc643b5bfe ]

In case CONFIG_SLUB_DEBUG_ON=n, find_mergeable() gets debug features from
commandline but never checks if there are features from the
SLAB_NEVER_MERGE set.

As a result selected by slub_debug caches are always mergeable if they
have been created without a custom constructor set or without one of the
SLAB_* debug features on.

This moves the SLAB_NEVER_MERGE check below the flags update from
commandline to make sure it won't merge the slab cache if one of the debug
features is on.

Link: http://lkml.kernel.org/r/20170101124451.GA4740@lp-laptop-d
Signed-off-by: Grygorii Maistrenko 
Reviewed-by: Pekka Enberg 
Acked-by: David Rientjes 
Acked-by: Christoph Lameter 
Cc: Joonsoo Kim 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
---
 mm/slab_common.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mm/slab_common.c b/mm/slab_common.c
index 5d2f24fbafc5..622f6b6ae844 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -255,7 +255,7 @@ struct kmem_cache *find_mergeable(size_t size, size_t align,
 {
struct kmem_cache *s;
 
-   if (slab_nomerge || (flags & SLAB_NEVER_MERGE))
+   if (slab_nomerge)
return NULL;
 
if (ctor)
@@ -266,6 +266,9 @@ struct kmem_cache *find_mergeable(size_t size, size_t align,
size = ALIGN(size, align);
flags = kmem_cache_flags(size, flags, name, NULL);
 
+   if (flags & SLAB_NEVER_MERGE)
+   return NULL;
+
list_for_each_entry_reverse(s, _caches, list) {
if (slab_unmergeable(s))
continue;
-- 
2.11.0

[PATCH review for 4.9 07/50] ALSA: hda: Add Geminilake HDMI codec ID

[Levin, Alexander (Sasha Levin)]

From: Vinod Koul 

[ Upstream commit 126cfa2f5e15ae2ca7f70be71b07e6cd8d2b44d1 ]

Geminilake HDMI codec 0x280d is similar to previous platforms, so add it with
similar ops as previous.

Signed-off-by: Senthilnathan Veppur 
Signed-off-by: Vinod Koul 
Signed-off-by: Takashi Iwai 
Signed-off-by: Sasha Levin 
---
 sound/pci/hda/patch_hdmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 775c67818bf1..bd650222e711 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -3685,6 +3685,7 @@ HDA_CODEC_ENTRY(0x80862808, "Broadwell HDMI", 
patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x80862809, "Skylake HDMI",patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x8086280a, "Broxton HDMI",patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x8086280b, "Kabylake HDMI",   patch_i915_hsw_hdmi),
+HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI", patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI", patch_generic_hdmi),
 HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI",patch_i915_byt_hdmi),
 HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI",   patch_i915_byt_hdmi),
-- 
2.11.0

[PATCH review for 4.9 17/50] f2fs: do not wait for writeback in write_begin

[Levin, Alexander (Sasha Levin)]

From: Jaegeuk Kim 

[ Upstream commit 86d54795c94532075d862aa0a79f0c981dab4bdd ]

Otherwise we can get livelock like below.

[79880.428136] dbench  D0 18405  18404 0x
[79880.428139] Call Trace:
[79880.428142]  __schedule+0x219/0x6b0
[79880.428144]  schedule+0x36/0x80
[79880.428147]  schedule_timeout+0x243/0x2e0
[79880.428152]  ? update_sd_lb_stats+0x16b/0x5f0
[79880.428155]  ? ktime_get+0x3c/0xb0
[79880.428157]  io_schedule_timeout+0xa6/0x110
[79880.428161]  __lock_page+0xf7/0x130
[79880.428164]  ? unlock_page+0x30/0x30
[79880.428167]  pagecache_get_page+0x16b/0x250
[79880.428171]  grab_cache_page_write_begin+0x20/0x40
[79880.428182]  f2fs_write_begin+0xa2/0xdb0 [f2fs]
[79880.428192]  ? f2fs_mark_inode_dirty_sync+0x16/0x30 [f2fs]
[79880.428197]  ? kmem_cache_free+0x79/0x200
[79880.428203]  ? __mark_inode_dirty+0x17f/0x360
[79880.428206]  generic_perform_write+0xbb/0x190
[79880.428213]  ? file_update_time+0xa4/0xf0
[79880.428217]  __generic_file_write_iter+0x19b/0x1e0
[79880.428226]  f2fs_file_write_iter+0x9c/0x180 [f2fs]
[79880.428231]  __vfs_write+0xc5/0x140
[79880.428235]  vfs_write+0xb2/0x1b0
[79880.428238]  SyS_write+0x46/0xa0
[79880.428242]  entry_SYSCALL_64_fastpath+0x1e/0xad

Fixes: cae96a5c8ab6 ("f2fs: check io submission more precisely")
Reviewed-by: Chao Yu 
Signed-off-by: Jaegeuk Kim 
Signed-off-by: Sasha Levin 
---
 fs/f2fs/data.c | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 14db4b712021..99432b59c5cb 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1619,7 +1619,12 @@ static int f2fs_write_begin(struct file *file, struct 
address_space *mapping,
goto fail;
}
 repeat:
-   page = grab_cache_page_write_begin(mapping, index, flags);
+   /*
+* Do not use grab_cache_page_write_begin() to avoid deadlock due to
+* wait_for_stable_page. Will wait that below with our IO control.
+*/
+   page = pagecache_get_page(mapping, index,
+   FGP_LOCK | FGP_WRITE | FGP_CREAT, GFP_NOFS);
if (!page) {
err = -ENOMEM;
goto fail;
-- 
2.11.0

[PATCH review for 4.9 18/50] md/linear: shutup lockdep warnning

[Levin, Alexander (Sasha Levin)]

From: Shaohua Li 

[ Upstream commit d939cdfde34f50b95254b375f498447c82190b3e ]

Commit 03a9e24(md linear: fix a race between linear_add() and
linear_congested()) introduces the warnning.

Acked-by: Coly Li 
Signed-off-by: Shaohua Li 
Signed-off-by: Sasha Levin 
---
 drivers/md/linear.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index b0c0aef92a37..12abf69d568a 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -223,7 +223,8 @@ static int linear_add(struct mddev *mddev, struct md_rdev 
*rdev)
 * oldconf until no one uses it anymore.
 */
mddev_suspend(mddev);
-   oldconf = rcu_dereference(mddev->private);
+   oldconf = rcu_dereference_protected(mddev->private,
+   lockdep_is_held(>reconfig_mutex));
mddev->raid_disks++;
WARN_ONCE(mddev->raid_disks != newconf->raid_disks,
"copied raid_disks doesn't match mddev->raid_disks");
-- 
2.11.0

[PATCH review for 4.9 03/50] watchdog: kempld: fix gcc-4.3 build

[Levin, Alexander (Sasha Levin)]

From: Arnd Bergmann 

[ Upstream commit 3736d4eb6af37492aeded7fec0072dedd959c842 ]

gcc-4.3 can't decide whether the constant value in
kempld_prescaler[PRESCALER_21] is built-time constant or
not, and gets confused by the logic in do_div():

drivers/watchdog/kempld_wdt.o: In function `kempld_wdt_set_stage_timeout':
kempld_wdt.c:(.text.kempld_wdt_set_stage_timeout+0x130): undefined reference to 
`__aeabi_uldivmod'

This adds a call to ACCESS_ONCE() to force it to not consider
it to be constant, and leaves the more efficient normal case
in place for modern compilers, using an #ifdef to annotate
why we do this hack.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Guenter Roeck 
Signed-off-by: Sasha Levin 
---
 drivers/watchdog/kempld_wdt.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/watchdog/kempld_wdt.c b/drivers/watchdog/kempld_wdt.c
index 8e302d0e346c..3efa295ac627 100644
--- a/drivers/watchdog/kempld_wdt.c
+++ b/drivers/watchdog/kempld_wdt.c
@@ -140,12 +140,19 @@ static int kempld_wdt_set_stage_timeout(struct 
kempld_wdt_data *wdt_data,
unsigned int timeout)
 {
struct kempld_device_data *pld = wdt_data->pld;
-   u32 prescaler = kempld_prescaler[PRESCALER_21];
+   u32 prescaler;
u64 stage_timeout64;
u32 stage_timeout;
u32 remainder;
u8 stage_cfg;
 
+#if GCC_VERSION < 40400
+   /* work around a bug compiling do_div() */
+   prescaler = READ_ONCE(kempld_prescaler[PRESCALER_21]);
+#else
+   prescaler = kempld_prescaler[PRESCALER_21];
+#endif
+
if (!stage)
return -EINVAL;
 
-- 
2.11.0

[PATCH review for 4.9 10/50] net/mlx4_en: fix overflow in mlx4_en_init_timestamp()

[Levin, Alexander (Sasha Levin)]

From: Eric Dumazet 

[ Upstream commit 47d3a07528ecbbccf53bc4390d70b4e3d1c04fcf ]

The cited commit makes a great job of finding optimal shift/multiplier
values assuming a 10 seconds wrap around, but forgot to change the
overflow_period computation.

It overflows in cyclecounter_cyc2ns(), and the final result is 804 ms,
which is silly.

Lets simply use 5 seconds, no need to recompute this, given how it is
supposed to work.

Later, we will use a timer instead of a work queue, since the new RX
allocation schem will no longer need mlx4_en_recover_from_oom() and the
service_task firing every 250 ms.

Fixes: 31c128b66e5b ("net/mlx4_en: Choose time-stamping shift value according 
to HW frequency")
Signed-off-by: Eric Dumazet 
Cc: Tariq Toukan 
Cc: Eugenia Emantayev 
Reviewed-by: Tariq Toukan 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/mellanox/mlx4/en_clock.c | 18 --
 drivers/net/ethernet/mellanox/mlx4/mlx4_en.h  |  1 -
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_clock.c 
b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
index a5fc46bbcbe2..d4d97ca12e83 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
@@ -88,10 +88,17 @@ void mlx4_en_remove_timestamp(struct mlx4_en_dev *mdev)
}
 }
 
+#define MLX4_EN_WRAP_AROUND_SEC10UL
+/* By scheduling the overflow check every 5 seconds, we have a reasonably
+ * good chance we wont miss a wrap around.
+ * TOTO: Use a timer instead of a work queue to increase the guarantee.
+ */
+#define MLX4_EN_OVERFLOW_PERIOD (MLX4_EN_WRAP_AROUND_SEC * HZ / 2)
+
 void mlx4_en_ptp_overflow_check(struct mlx4_en_dev *mdev)
 {
bool timeout = time_is_before_jiffies(mdev->last_overflow_check +
- mdev->overflow_period);
+ MLX4_EN_OVERFLOW_PERIOD);
unsigned long flags;
 
if (timeout) {
@@ -236,7 +243,6 @@ static const struct ptp_clock_info mlx4_en_ptp_clock_info = 
{
.enable = mlx4_en_phc_enable,
 };
 
-#define MLX4_EN_WRAP_AROUND_SEC10ULL
 
 /* This function calculates the max shift that enables the user range
  * of MLX4_EN_WRAP_AROUND_SEC values in the cycles register.
@@ -261,7 +267,6 @@ void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev)
 {
struct mlx4_dev *dev = mdev->dev;
unsigned long flags;
-   u64 ns, zero = 0;
 
/* mlx4_en_init_timestamp is called for each netdev.
 * mdev->ptp_clock is common for all ports, skip initialization if
@@ -285,13 +290,6 @@ void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev)
 ktime_to_ns(ktime_get_real()));
write_unlock_irqrestore(>clock_lock, flags);
 
-   /* Calculate period in seconds to call the overflow watchdog - to make
-* sure counter is checked at least once every wrap around.
-*/
-   ns = cyclecounter_cyc2ns(>cycles, mdev->cycles.mask, zero, );
-   do_div(ns, NSEC_PER_SEC / 2 / HZ);
-   mdev->overflow_period = ns;
-
/* Configure the PHC */
mdev->ptp_clock_info = mlx4_en_ptp_clock_info;
snprintf(mdev->ptp_clock_info.name, 16, "mlx4 ptp");
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h 
b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index a3528dd1e72e..df0f39611c5e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -419,7 +419,6 @@ struct mlx4_en_dev {
struct cyclecounter cycles;
struct timecounter  clock;
unsigned long   last_overflow_check;
-   unsigned long   overflow_period;
struct ptp_clock*ptp_clock;
struct ptp_clock_info   ptp_clock_info;
struct notifier_block   nb;
-- 
2.11.0

[PATCH review for 4.9 04/50] irqchip/crossbar: Fix incorrect type of local variables

[Levin, Alexander (Sasha Levin)]

From: Franck Demathieu 

[ Upstream commit b28ace12661fbcfd90959c1e84ff5a85113a82a1 ]

The max and entry variables are unsigned according to the dt-bindings.
Fix following 3 sparse issues (-Wtypesign):

  drivers/irqchip/irq-crossbar.c:222:52: warning: incorrect type in argument 3 
(different signedness)
  drivers/irqchip/irq-crossbar.c:222:52:expected unsigned int [usertype] 
*out_value
  drivers/irqchip/irq-crossbar.c:222:52:got int *

  drivers/irqchip/irq-crossbar.c:245:56: warning: incorrect type in argument 4 
(different signedness)
  drivers/irqchip/irq-crossbar.c:245:56:expected unsigned int [usertype] 
*out_value
  drivers/irqchip/irq-crossbar.c:245:56:got int *

  drivers/irqchip/irq-crossbar.c:263:56: warning: incorrect type in argument 4 
(different signedness)
  drivers/irqchip/irq-crossbar.c:263:56:expected unsigned int [usertype] 
*out_value
  drivers/irqchip/irq-crossbar.c:263:56:got int *

Signed-off-by: Franck Demathieu 
Cc: marc.zyng...@arm.com
Cc: ja...@lakedaemon.net
Link: http://lkml.kernel.org/r/20170223094855.6546-1-fdemath...@gmail.com
Signed-off-by: Thomas Gleixner 
Signed-off-by: Sasha Levin 
---
 drivers/irqchip/irq-crossbar.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
index 1eef56a89b1f..05bbf171df37 100644
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -198,7 +198,8 @@ static const struct irq_domain_ops crossbar_domain_ops = {
 
 static int __init crossbar_of_init(struct device_node *node)
 {
-   int i, size, max = 0, reserved = 0, entry;
+   int i, size, reserved = 0;
+   u32 max = 0, entry;
const __be32 *irqsr;
int ret = -ENOMEM;
 
-- 
2.11.0

[PATCH review for 4.9 02/50] locking/lockdep: Add nest_lock integrity test

[Levin, Alexander (Sasha Levin)]

From: Peter Zijlstra 

[ Upstream commit 7fb4a2cea6b18dab56d609530d077f168169ed6b ]

Boqun reported that hlock->references can overflow. Add a debug test
for that to generate a clear error when this happens.

Without this, lockdep is likely to report a mysterious failure on
unlock.

Reported-by: Boqun Feng 
Signed-off-by: Peter Zijlstra (Intel) 
Cc: Andrew Morton 
Cc: Chris Wilson 
Cc: Linus Torvalds 
Cc: Nicolai Hähnle 
Cc: Paul E. McKenney 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin 
---
 kernel/locking/lockdep.c | 11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 4d7ffc0a0d00..6599c7f3071d 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -3260,10 +3260,17 @@ static int __lock_acquire(struct lockdep_map *lock, 
unsigned int subclass,
if (depth) {
hlock = curr->held_locks + depth - 1;
if (hlock->class_idx == class_idx && nest_lock) {
-   if (hlock->references)
+   if (hlock->references) {
+   /*
+* Check: unsigned int references:12, overflow.
+*/
+   if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 
<< 12)-1))
+   return 0;
+
hlock->references++;
-   else
+   } else {
hlock->references = 2;
+   }
 
return 1;
}
-- 
2.11.0

[PATCH review for 4.9 03/50] watchdog: kempld: fix gcc-4.3 build

[Levin, Alexander (Sasha Levin)]

From: Arnd Bergmann 

[ Upstream commit 3736d4eb6af37492aeded7fec0072dedd959c842 ]

gcc-4.3 can't decide whether the constant value in
kempld_prescaler[PRESCALER_21] is built-time constant or
not, and gets confused by the logic in do_div():

drivers/watchdog/kempld_wdt.o: In function `kempld_wdt_set_stage_timeout':
kempld_wdt.c:(.text.kempld_wdt_set_stage_timeout+0x130): undefined reference to 
`__aeabi_uldivmod'

This adds a call to ACCESS_ONCE() to force it to not consider
it to be constant, and leaves the more efficient normal case
in place for modern compilers, using an #ifdef to annotate
why we do this hack.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Guenter Roeck 
Signed-off-by: Sasha Levin 
---
 drivers/watchdog/kempld_wdt.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/watchdog/kempld_wdt.c b/drivers/watchdog/kempld_wdt.c
index 8e302d0e346c..3efa295ac627 100644
--- a/drivers/watchdog/kempld_wdt.c
+++ b/drivers/watchdog/kempld_wdt.c
@@ -140,12 +140,19 @@ static int kempld_wdt_set_stage_timeout(struct 
kempld_wdt_data *wdt_data,
unsigned int timeout)
 {
struct kempld_device_data *pld = wdt_data->pld;
-   u32 prescaler = kempld_prescaler[PRESCALER_21];
+   u32 prescaler;
u64 stage_timeout64;
u32 stage_timeout;
u32 remainder;
u8 stage_cfg;
 
+#if GCC_VERSION < 40400
+   /* work around a bug compiling do_div() */
+   prescaler = READ_ONCE(kempld_prescaler[PRESCALER_21]);
+#else
+   prescaler = kempld_prescaler[PRESCALER_21];
+#endif
+
if (!stage)
return -EINVAL;
 
-- 
2.11.0

[PATCH review for 4.9 10/50] net/mlx4_en: fix overflow in mlx4_en_init_timestamp()

[Levin, Alexander (Sasha Levin)]

From: Eric Dumazet 

[ Upstream commit 47d3a07528ecbbccf53bc4390d70b4e3d1c04fcf ]

The cited commit makes a great job of finding optimal shift/multiplier
values assuming a 10 seconds wrap around, but forgot to change the
overflow_period computation.

It overflows in cyclecounter_cyc2ns(), and the final result is 804 ms,
which is silly.

Lets simply use 5 seconds, no need to recompute this, given how it is
supposed to work.

Later, we will use a timer instead of a work queue, since the new RX
allocation schem will no longer need mlx4_en_recover_from_oom() and the
service_task firing every 250 ms.

Fixes: 31c128b66e5b ("net/mlx4_en: Choose time-stamping shift value according 
to HW frequency")
Signed-off-by: Eric Dumazet 
Cc: Tariq Toukan 
Cc: Eugenia Emantayev 
Reviewed-by: Tariq Toukan 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/mellanox/mlx4/en_clock.c | 18 --
 drivers/net/ethernet/mellanox/mlx4/mlx4_en.h  |  1 -
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_clock.c 
b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
index a5fc46bbcbe2..d4d97ca12e83 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
@@ -88,10 +88,17 @@ void mlx4_en_remove_timestamp(struct mlx4_en_dev *mdev)
}
 }
 
+#define MLX4_EN_WRAP_AROUND_SEC10UL
+/* By scheduling the overflow check every 5 seconds, we have a reasonably
+ * good chance we wont miss a wrap around.
+ * TOTO: Use a timer instead of a work queue to increase the guarantee.
+ */
+#define MLX4_EN_OVERFLOW_PERIOD (MLX4_EN_WRAP_AROUND_SEC * HZ / 2)
+
 void mlx4_en_ptp_overflow_check(struct mlx4_en_dev *mdev)
 {
bool timeout = time_is_before_jiffies(mdev->last_overflow_check +
- mdev->overflow_period);
+ MLX4_EN_OVERFLOW_PERIOD);
unsigned long flags;
 
if (timeout) {
@@ -236,7 +243,6 @@ static const struct ptp_clock_info mlx4_en_ptp_clock_info = 
{
.enable = mlx4_en_phc_enable,
 };
 
-#define MLX4_EN_WRAP_AROUND_SEC10ULL
 
 /* This function calculates the max shift that enables the user range
  * of MLX4_EN_WRAP_AROUND_SEC values in the cycles register.
@@ -261,7 +267,6 @@ void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev)
 {
struct mlx4_dev *dev = mdev->dev;
unsigned long flags;
-   u64 ns, zero = 0;
 
/* mlx4_en_init_timestamp is called for each netdev.
 * mdev->ptp_clock is common for all ports, skip initialization if
@@ -285,13 +290,6 @@ void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev)
 ktime_to_ns(ktime_get_real()));
write_unlock_irqrestore(>clock_lock, flags);
 
-   /* Calculate period in seconds to call the overflow watchdog - to make
-* sure counter is checked at least once every wrap around.
-*/
-   ns = cyclecounter_cyc2ns(>cycles, mdev->cycles.mask, zero, );
-   do_div(ns, NSEC_PER_SEC / 2 / HZ);
-   mdev->overflow_period = ns;
-
/* Configure the PHC */
mdev->ptp_clock_info = mlx4_en_ptp_clock_info;
snprintf(mdev->ptp_clock_info.name, 16, "mlx4 ptp");
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h 
b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index a3528dd1e72e..df0f39611c5e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -419,7 +419,6 @@ struct mlx4_en_dev {
struct cyclecounter cycles;
struct timecounter  clock;
unsigned long   last_overflow_check;
-   unsigned long   overflow_period;
struct ptp_clock*ptp_clock;
struct ptp_clock_info   ptp_clock_info;
struct notifier_block   nb;
-- 
2.11.0

[PATCH review for 4.9 04/50] irqchip/crossbar: Fix incorrect type of local variables

[Levin, Alexander (Sasha Levin)]

From: Franck Demathieu 

[ Upstream commit b28ace12661fbcfd90959c1e84ff5a85113a82a1 ]

The max and entry variables are unsigned according to the dt-bindings.
Fix following 3 sparse issues (-Wtypesign):

  drivers/irqchip/irq-crossbar.c:222:52: warning: incorrect type in argument 3 
(different signedness)
  drivers/irqchip/irq-crossbar.c:222:52:expected unsigned int [usertype] 
*out_value
  drivers/irqchip/irq-crossbar.c:222:52:got int *

  drivers/irqchip/irq-crossbar.c:245:56: warning: incorrect type in argument 4 
(different signedness)
  drivers/irqchip/irq-crossbar.c:245:56:expected unsigned int [usertype] 
*out_value
  drivers/irqchip/irq-crossbar.c:245:56:got int *

  drivers/irqchip/irq-crossbar.c:263:56: warning: incorrect type in argument 4 
(different signedness)
  drivers/irqchip/irq-crossbar.c:263:56:expected unsigned int [usertype] 
*out_value
  drivers/irqchip/irq-crossbar.c:263:56:got int *

Signed-off-by: Franck Demathieu 
Cc: marc.zyng...@arm.com
Cc: ja...@lakedaemon.net
Link: http://lkml.kernel.org/r/20170223094855.6546-1-fdemath...@gmail.com
Signed-off-by: Thomas Gleixner 
Signed-off-by: Sasha Levin 
---
 drivers/irqchip/irq-crossbar.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
index 1eef56a89b1f..05bbf171df37 100644
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -198,7 +198,8 @@ static const struct irq_domain_ops crossbar_domain_ops = {
 
 static int __init crossbar_of_init(struct device_node *node)
 {
-   int i, size, max = 0, reserved = 0, entry;
+   int i, size, reserved = 0;
+   u32 max = 0, entry;
const __be32 *irqsr;
int ret = -ENOMEM;
 
-- 
2.11.0

[PATCH review for 4.9 02/50] locking/lockdep: Add nest_lock integrity test

[Levin, Alexander (Sasha Levin)]

From: Peter Zijlstra 

[ Upstream commit 7fb4a2cea6b18dab56d609530d077f168169ed6b ]

Boqun reported that hlock->references can overflow. Add a debug test
for that to generate a clear error when this happens.

Without this, lockdep is likely to report a mysterious failure on
unlock.

Reported-by: Boqun Feng 
Signed-off-by: Peter Zijlstra (Intel) 
Cc: Andrew Morton 
Cc: Chris Wilson 
Cc: Linus Torvalds 
Cc: Nicolai Hähnle 
Cc: Paul E. McKenney 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin 
---
 kernel/locking/lockdep.c | 11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 4d7ffc0a0d00..6599c7f3071d 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -3260,10 +3260,17 @@ static int __lock_acquire(struct lockdep_map *lock, 
unsigned int subclass,
if (depth) {
hlock = curr->held_locks + depth - 1;
if (hlock->class_idx == class_idx && nest_lock) {
-   if (hlock->references)
+   if (hlock->references) {
+   /*
+* Check: unsigned int references:12, overflow.
+*/
+   if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 
<< 12)-1))
+   return 0;
+
hlock->references++;
-   else
+   } else {
hlock->references = 2;
+   }
 
return 1;
}
-- 
2.11.0

[PATCH review for 4.9 05/50] initramfs: finish fput() before accessing any binary from initramfs

[Levin, Alexander (Sasha Levin)]

From: Lokesh Vutla 

[ Upstream commit 08865514805d2de8e7002fa8149c5de3e391f412 ]

Commit 4a9d4b024a31 ("switch fput to task_work_add") implements a
schedule_work() for completing fput(), but did not guarantee calling
__fput() after unpacking initramfs.  Because of this, there is a
possibility that during boot a driver can see ETXTBSY when it tries to
load a binary from initramfs as fput() is still pending on that binary.

This patch makes sure that fput() is completed after unpacking initramfs
and removes the call to flush_delayed_fput() in kernel_init() which
happens very late after unpacking initramfs.

Link: http://lkml.kernel.org/r/20170201140540.22051-1-lokeshvu...@ti.com
Signed-off-by: Lokesh Vutla 
Reported-by: Murali Karicheri 
Cc: Al Viro 
Cc: Tero Kristo 
Cc: Sekhar Nori 
Cc: Nishanth Menon 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
---
 init/initramfs.c | 2 ++
 init/main.c  | 3 ---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/init/initramfs.c b/init/initramfs.c
index b32ad7d97ac9..981f286c1d16 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -18,6 +18,7 @@
 #include 
 #include 
 #include 
+#include 
 
 static ssize_t __init xwrite(int fd, const char *p, size_t count)
 {
@@ -647,6 +648,7 @@ static int __init populate_rootfs(void)
printk(KERN_EMERG "Initramfs unpacking failed: %s\n", 
err);
free_initrd();
 #endif
+   flush_delayed_fput();
/*
 * Try loading default modules from initramfs.  This gives
 * us a chance to load before device_initcalls.
diff --git a/init/main.c b/init/main.c
index ae3996ae9bac..25bac88bc66e 100644
--- a/init/main.c
+++ b/init/main.c
@@ -70,7 +70,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -947,8 +946,6 @@ static int __ref kernel_init(void *unused)
system_state = SYSTEM_RUNNING;
numa_default_policy();
 
-   flush_delayed_fput();
-
rcu_end_inkernel_boot();
 
if (ramdisk_execute_command) {
-- 
2.11.0

[PATCH review for 4.9 12/50] netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value.

[Levin, Alexander (Sasha Levin)]

From: Jarno Rajahalme 

[ Upstream commit 4b86c459c7bee3acaf92f0e2b4c6ac803eaa1a58 ]

Commit 4dee62b1b9b4 ("netfilter: nf_ct_expect: nf_ct_expect_insert()
returns void") inadvertently changed the successful return value of
nf_ct_expect_related_report() from 0 to 1 due to
__nf_ct_expect_check() returning 1 on success.  Prevent this
regression in the future by changing the return value of
__nf_ct_expect_check() to 0 on success.

Signed-off-by: Jarno Rajahalme 
Acked-by: Joe Stringer 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Sasha Levin 
---
 net/netfilter/nf_conntrack_expect.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_expect.c 
b/net/netfilter/nf_conntrack_expect.c
index f8dbacf66795..0d6c72d6b9ba 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -411,7 +411,7 @@ static inline int __nf_ct_expect_check(struct 
nf_conntrack_expect *expect)
struct net *net = nf_ct_exp_net(expect);
struct hlist_node *next;
unsigned int h;
-   int ret = 1;
+   int ret = 0;
 
if (!master_help) {
ret = -ESHUTDOWN;
@@ -461,7 +461,7 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect 
*expect,
 
spin_lock_bh(_conntrack_expect_lock);
ret = __nf_ct_expect_check(expect);
-   if (ret <= 0)
+   if (ret < 0)
goto out;
 
ret = nf_ct_expect_insert(expect);
-- 
2.11.0

[PATCH review for 4.9 01/50] xen-netback: Use GFP_ATOMIC to allocate hash

[Levin, Alexander (Sasha Levin)]

From: Anoob Soman 

[ Upstream commit 9f674e48c13dcbc31ac903433727837795b81efe ]

Allocation of new_hash, inside xenvif_new_hash(), always happen
in softirq context, so use GFP_ATOMIC instead of GFP_KERNEL for new
hash allocation.

Signed-off-by: Anoob Soman 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/xen-netback/hash.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c
index e8c5dddc54ba..3c4c58b9fe76 100644
--- a/drivers/net/xen-netback/hash.c
+++ b/drivers/net/xen-netback/hash.c
@@ -39,7 +39,7 @@ static void xenvif_add_hash(struct xenvif *vif, const u8 *tag,
unsigned long flags;
bool found;
 
-   new = kmalloc(sizeof(*entry), GFP_KERNEL);
+   new = kmalloc(sizeof(*entry), GFP_ATOMIC);
if (!new)
return;
 
-- 
2.11.0

[PATCH review for 4.9 06/50] mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length

[Levin, Alexander (Sasha Levin)]

From: Johannes Berg 

[ Upstream commit ff4dd73dd2b4806419f8ff65cbce11d5019548d0 ]

Unfortunately, the nla policy was defined to have HWSIM_ATTR_RADIO_NAME
as an NLA_STRING, rather than NLA_NUL_STRING, so we can't use it as a
NUL-terminated string in the kernel.

Rather than break the API, kasprintf() the string to a new buffer to
guarantee NUL termination.

Reported-by: Andrew Zaborowski 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin 
---
 drivers/net/wireless/mac80211_hwsim.c | 28 +---
 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/mac80211_hwsim.c 
b/drivers/net/wireless/mac80211_hwsim.c
index 0fd7d7ed07ce..77528d647b6e 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -3048,6 +3048,7 @@ static int hwsim_register_received_nl(struct sk_buff 
*skb_2,
 static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
 {
struct hwsim_new_radio_params param = { 0 };
+   const char *hwname = NULL;
 
param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
@@ -3061,8 +3062,14 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, 
struct genl_info *info)
if (info->attrs[HWSIM_ATTR_NO_VIF])
param.no_vif = true;
 
-   if (info->attrs[HWSIM_ATTR_RADIO_NAME])
-   param.hwname = nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]);
+   if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
+   hwname = kasprintf(GFP_KERNEL, "%.*s",
+  nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
+  (char 
*)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]));
+   if (!hwname)
+   return -ENOMEM;
+   param.hwname = hwname;
+   }
 
if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
param.use_chanctx = true;
@@ -3090,11 +3097,15 @@ static int hwsim_del_radio_nl(struct sk_buff *msg, 
struct genl_info *info)
s64 idx = -1;
const char *hwname = NULL;
 
-   if (info->attrs[HWSIM_ATTR_RADIO_ID])
+   if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
-   else if (info->attrs[HWSIM_ATTR_RADIO_NAME])
-   hwname = (void *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]);
-   else
+   } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
+   hwname = kasprintf(GFP_KERNEL, "%.*s",
+  nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
+  (char 
*)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]));
+   if (!hwname)
+   return -ENOMEM;
+   } else
return -EINVAL;
 
spin_lock_bh(_radio_lock);
@@ -3103,7 +3114,8 @@ static int hwsim_del_radio_nl(struct sk_buff *msg, struct 
genl_info *info)
if (data->idx != idx)
continue;
} else {
-   if (strcmp(hwname, wiphy_name(data->hw->wiphy)))
+   if (!hwname ||
+   strcmp(hwname, wiphy_name(data->hw->wiphy)))
continue;
}
 
@@ -3114,10 +3126,12 @@ static int hwsim_del_radio_nl(struct sk_buff *msg, 
struct genl_info *info)
spin_unlock_bh(_radio_lock);
mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
 info);
+   kfree(hwname);
return 0;
}
spin_unlock_bh(_radio_lock);
 
+   kfree(hwname);
return -ENODEV;
 }
 
-- 
2.11.0

[PATCH review for 4.9 05/50] initramfs: finish fput() before accessing any binary from initramfs

[Levin, Alexander (Sasha Levin)]

From: Lokesh Vutla 

[ Upstream commit 08865514805d2de8e7002fa8149c5de3e391f412 ]

Commit 4a9d4b024a31 ("switch fput to task_work_add") implements a
schedule_work() for completing fput(), but did not guarantee calling
__fput() after unpacking initramfs.  Because of this, there is a
possibility that during boot a driver can see ETXTBSY when it tries to
load a binary from initramfs as fput() is still pending on that binary.

This patch makes sure that fput() is completed after unpacking initramfs
and removes the call to flush_delayed_fput() in kernel_init() which
happens very late after unpacking initramfs.

Link: http://lkml.kernel.org/r/20170201140540.22051-1-lokeshvu...@ti.com
Signed-off-by: Lokesh Vutla 
Reported-by: Murali Karicheri 
Cc: Al Viro 
Cc: Tero Kristo 
Cc: Sekhar Nori 
Cc: Nishanth Menon 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
---
 init/initramfs.c | 2 ++
 init/main.c  | 3 ---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/init/initramfs.c b/init/initramfs.c
index b32ad7d97ac9..981f286c1d16 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -18,6 +18,7 @@
 #include 
 #include 
 #include 
+#include 
 
 static ssize_t __init xwrite(int fd, const char *p, size_t count)
 {
@@ -647,6 +648,7 @@ static int __init populate_rootfs(void)
printk(KERN_EMERG "Initramfs unpacking failed: %s\n", 
err);
free_initrd();
 #endif
+   flush_delayed_fput();
/*
 * Try loading default modules from initramfs.  This gives
 * us a chance to load before device_initcalls.
diff --git a/init/main.c b/init/main.c
index ae3996ae9bac..25bac88bc66e 100644
--- a/init/main.c
+++ b/init/main.c
@@ -70,7 +70,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -947,8 +946,6 @@ static int __ref kernel_init(void *unused)
system_state = SYSTEM_RUNNING;
numa_default_policy();
 
-   flush_delayed_fput();
-
rcu_end_inkernel_boot();
 
if (ramdisk_execute_command) {
-- 
2.11.0

[PATCH review for 4.9 12/50] netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value.

[Levin, Alexander (Sasha Levin)]

From: Jarno Rajahalme 

[ Upstream commit 4b86c459c7bee3acaf92f0e2b4c6ac803eaa1a58 ]

Commit 4dee62b1b9b4 ("netfilter: nf_ct_expect: nf_ct_expect_insert()
returns void") inadvertently changed the successful return value of
nf_ct_expect_related_report() from 0 to 1 due to
__nf_ct_expect_check() returning 1 on success.  Prevent this
regression in the future by changing the return value of
__nf_ct_expect_check() to 0 on success.

Signed-off-by: Jarno Rajahalme 
Acked-by: Joe Stringer 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Sasha Levin 
---
 net/netfilter/nf_conntrack_expect.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_expect.c 
b/net/netfilter/nf_conntrack_expect.c
index f8dbacf66795..0d6c72d6b9ba 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -411,7 +411,7 @@ static inline int __nf_ct_expect_check(struct 
nf_conntrack_expect *expect)
struct net *net = nf_ct_exp_net(expect);
struct hlist_node *next;
unsigned int h;
-   int ret = 1;
+   int ret = 0;
 
if (!master_help) {
ret = -ESHUTDOWN;
@@ -461,7 +461,7 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect 
*expect,
 
spin_lock_bh(_conntrack_expect_lock);
ret = __nf_ct_expect_check(expect);
-   if (ret <= 0)
+   if (ret < 0)
goto out;
 
ret = nf_ct_expect_insert(expect);
-- 
2.11.0

[PATCH review for 4.9 01/50] xen-netback: Use GFP_ATOMIC to allocate hash

[Levin, Alexander (Sasha Levin)]

From: Anoob Soman 

[ Upstream commit 9f674e48c13dcbc31ac903433727837795b81efe ]

Allocation of new_hash, inside xenvif_new_hash(), always happen
in softirq context, so use GFP_ATOMIC instead of GFP_KERNEL for new
hash allocation.

Signed-off-by: Anoob Soman 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/xen-netback/hash.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c
index e8c5dddc54ba..3c4c58b9fe76 100644
--- a/drivers/net/xen-netback/hash.c
+++ b/drivers/net/xen-netback/hash.c
@@ -39,7 +39,7 @@ static void xenvif_add_hash(struct xenvif *vif, const u8 *tag,
unsigned long flags;
bool found;
 
-   new = kmalloc(sizeof(*entry), GFP_KERNEL);
+   new = kmalloc(sizeof(*entry), GFP_ATOMIC);
if (!new)
return;
 
-- 
2.11.0

[PATCH review for 4.9 06/50] mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length

[Levin, Alexander (Sasha Levin)]

From: Johannes Berg 

[ Upstream commit ff4dd73dd2b4806419f8ff65cbce11d5019548d0 ]

Unfortunately, the nla policy was defined to have HWSIM_ATTR_RADIO_NAME
as an NLA_STRING, rather than NLA_NUL_STRING, so we can't use it as a
NUL-terminated string in the kernel.

Rather than break the API, kasprintf() the string to a new buffer to
guarantee NUL termination.

Reported-by: Andrew Zaborowski 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin 
---
 drivers/net/wireless/mac80211_hwsim.c | 28 +---
 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/mac80211_hwsim.c 
b/drivers/net/wireless/mac80211_hwsim.c
index 0fd7d7ed07ce..77528d647b6e 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -3048,6 +3048,7 @@ static int hwsim_register_received_nl(struct sk_buff 
*skb_2,
 static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
 {
struct hwsim_new_radio_params param = { 0 };
+   const char *hwname = NULL;
 
param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
@@ -3061,8 +3062,14 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, 
struct genl_info *info)
if (info->attrs[HWSIM_ATTR_NO_VIF])
param.no_vif = true;
 
-   if (info->attrs[HWSIM_ATTR_RADIO_NAME])
-   param.hwname = nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]);
+   if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
+   hwname = kasprintf(GFP_KERNEL, "%.*s",
+  nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
+  (char 
*)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]));
+   if (!hwname)
+   return -ENOMEM;
+   param.hwname = hwname;
+   }
 
if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
param.use_chanctx = true;
@@ -3090,11 +3097,15 @@ static int hwsim_del_radio_nl(struct sk_buff *msg, 
struct genl_info *info)
s64 idx = -1;
const char *hwname = NULL;
 
-   if (info->attrs[HWSIM_ATTR_RADIO_ID])
+   if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
-   else if (info->attrs[HWSIM_ATTR_RADIO_NAME])
-   hwname = (void *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]);
-   else
+   } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
+   hwname = kasprintf(GFP_KERNEL, "%.*s",
+  nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
+  (char 
*)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]));
+   if (!hwname)
+   return -ENOMEM;
+   } else
return -EINVAL;
 
spin_lock_bh(_radio_lock);
@@ -3103,7 +3114,8 @@ static int hwsim_del_radio_nl(struct sk_buff *msg, struct 
genl_info *info)
if (data->idx != idx)
continue;
} else {
-   if (strcmp(hwname, wiphy_name(data->hw->wiphy)))
+   if (!hwname ||
+   strcmp(hwname, wiphy_name(data->hw->wiphy)))
continue;
}
 
@@ -3114,10 +3126,12 @@ static int hwsim_del_radio_nl(struct sk_buff *msg, 
struct genl_info *info)
spin_unlock_bh(_radio_lock);
mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
 info);
+   kfree(hwname);
return 0;
}
spin_unlock_bh(_radio_lock);
 
+   kfree(hwname);
return -ENODEV;
 }
 
-- 
2.11.0

[PATCH review for 4.9 16/50] Btrfs: send, fix failure to rename top level inode due to name collision

[Levin, Alexander (Sasha Levin)]

From: Robbie Ko 

[ Upstream commit 4dd9920d991745c4a16f53a8f615f706fbe4b3f7 ]

Under certain situations, an incremental send operation can fail due to a
premature attempt to create a new top level inode (a direct child of the
subvolume/snapshot root) whose name collides with another inode that was
removed from the send snapshot.

Consider the following example scenario.

Parent snapshot:

  . (ino 256, gen 8)
  | a1/ (ino 257, gen 9)
  | a2/ (ino 258, gen 9)

Send snapshot:

  . (ino 256, gen 3)
  | a2/ (ino 257, gen 7)

In this scenario, when receiving the incremental send stream, the btrfs
receive command fails like this (ran in verbose mode, -vv argument):

  rmdir a1
  mkfile o257-7-0
  rename o257-7-0 -> a2
  ERROR: rename o257-7-0 -> a2 failed: Is a directory

What happens when computing the incremental send stream is:

1) An operation to remove the directory with inode number 257 and
   generation 9 is issued.

2) An operation to create the inode with number 257 and generation 7 is
   issued. This creates the inode with an orphanized name of "o257-7-0".

3) An operation rename the new inode 257 to its final name, "a2", is
   issued. This is incorrect because inode 258, which has the same name
   and it's a child of the same parent (root inode 256), was not yet
   processed and therefore no rmdir operation for it was yet issued.
   The rename operation is issued because we fail to detect that the
   name of the new inode 257 collides with inode 258, because their
   parent, a subvolume/snapshot root (inode 256) has a different
   generation in both snapshots.

So fix this by ignoring the generation value of a parent directory that
matches a root inode (number 256) when we are checking if the name of the
inode currently being processed collides with the name of some other
inode that was not yet processed.

We can achieve this scenario of different inodes with the same number but
different generation values either by mounting a filesystem with the inode
cache option (-o inode_cache) or by creating and sending snapshots across
different filesystems, like in the following example:

  $ mkfs.btrfs -f /dev/sdb
  $ mount /dev/sdb /mnt
  $ mkdir /mnt/a1
  $ mkdir /mnt/a2
  $ btrfs subvolume snapshot -r /mnt /mnt/snap1
  $ btrfs send /mnt/snap1 -f /tmp/1.snap
  $ umount /mnt

  $ mkfs.btrfs -f /dev/sdc
  $ mount /dev/sdc /mnt
  $ touch /mnt/a2
  $ btrfs subvolume snapshot -r /mnt /mnt/snap2
  $ btrfs receive /mnt -f /tmp/1.snap
  # Take note that once the filesystem is created, its current
  # generation has value 7 so the inode from the second snapshot has
  # a generation value of 7. And after receiving the first snapshot
  # the filesystem is at a generation value of 10, because the call to
  # create the second snapshot bumps the generation to 8 (the snapshot
  # creation ioctl does a transaction commit), the receive command calls
  # the snapshot creation ioctl to create the first snapshot, which bumps
  # the filesystem's generation to 9, and finally when the receive
  # operation finishes it calls an ioctl to transition the first snapshot
  # (snap1) from RW mode to RO mode, which does another transaction commit
  # and bumps the filesystem's generation to 10.
  $ rm -f /tmp/1.snap
  $ btrfs send /mnt/snap1 -f /tmp/1.snap
  $ btrfs send -p /mnt/snap1 /mnt/snap2 -f /tmp/2.snap
  $ umount /mnt

  $ mkfs.btrfs -f /dev/sdd
  $ mount /dev/sdd /mnt
  $ btrfs receive /mnt /tmp/1.snap
  # Receive of snapshot snap2 used to fail.
  $ btrfs receive /mnt /tmp/2.snap

Signed-off-by: Robbie Ko 
Reviewed-by: Filipe Manana 
[Rewrote changelog to be more precise and clear]
Signed-off-by: Filipe Manana 

Signed-off-by: Sasha Levin 
---
 fs/btrfs/send.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 71261b459863..77f9efc1f7aa 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -1680,6 +1680,9 @@ static int is_inode_existent(struct send_ctx *sctx, u64 
ino, u64 gen)
 {
int ret;
 
+   if (ino == BTRFS_FIRST_FREE_OBJECTID)
+   return 1;
+
ret = get_cur_inode_state(sctx, ino, gen);
if (ret < 0)
goto out;
@@ -1865,7 +1868,7 @@ static int will_overwrite_ref(struct send_ctx *sctx, u64 
dir, u64 dir_gen,
 * not deleted and then re-created, if it was then we have no overwrite
 * and we can just unlink this entry.
 */
-   if (sctx->parent_root) {
+   if (sctx->parent_root && dir != BTRFS_FIRST_FREE_OBJECTID) {
ret = get_inode_info(sctx->parent_root, dir, NULL, , NULL,
 NULL, NULL, NULL);
if (ret < 0 && ret != -ENOENT)
-- 
2.11.0

[PATCH review for 4.9 32/50] i2c: at91: ensure state is restored after suspending

[Levin, Alexander (Sasha Levin)]

From: Alexandre Belloni 

[ Upstream commit e3ccc921b7d8fd1fcd10a00720e09823d8078666 ]

When going to suspend, the I2C registers may be lost because the power to
VDDcore is cut. Restore them when resuming.

Signed-off-by: Alexandre Belloni 
Acked-by: Ludovic Desroches 
Signed-off-by: Wolfram Sang 
Signed-off-by: Sasha Levin 
---
 drivers/i2c/busses/i2c-at91.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
index 0b86c6173e07..c925a690cb32 100644
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -1180,6 +1180,7 @@ static int at91_twi_suspend_noirq(struct device *dev)
 
 static int at91_twi_resume_noirq(struct device *dev)
 {
+   struct at91_twi_dev *twi_dev = dev_get_drvdata(dev);
int ret;
 
if (!pm_runtime_status_suspended(dev)) {
@@ -1191,6 +1192,8 @@ static int at91_twi_resume_noirq(struct device *dev)
pm_runtime_mark_last_busy(dev);
pm_request_autosuspend(dev);
 
+   at91_init_twi_bus(twi_dev);
+
return 0;
 }
 
-- 
2.11.0

[PATCH review for 4.9 33/50] ceph: don't update_dentry_lease unless we actually got one

[Levin, Alexander (Sasha Levin)]

From: Jeff Layton 

[ Upstream commit 80d025ffede88969f6adf7266fbdedfd5641148a ]

This if block updates the dentry lease even in the case where
the MDS didn't grant one.

Signed-off-by: Jeff Layton 
Reviewed-by: Yan, Zheng 
Signed-off-by: Ilya Dryomov 
Signed-off-by: Sasha Levin 
---
 fs/ceph/inode.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 953275b651bc..4a6df2ce0f76 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1323,8 +1323,8 @@ retry_lookup:
ceph_dir_clear_ordered(dir);
dout("d_delete %p\n", dn);
d_delete(dn);
-   } else {
-   if (have_lease && d_unhashed(dn))
+   } else if (have_lease) {
+   if (d_unhashed(dn))
d_add(dn, NULL);
update_dentry_lease(dn, rinfo->dlease,
session,
-- 
2.11.0

[PATCH review for 4.9 08/50] qed: Don't use attention PTT for configuring BW

[Levin, Alexander (Sasha Levin)]

From: "Mintz, Yuval" 

[ Upstream commit 6f437d431930ff86e4a971d29321951faadb97c7 ]

Commit 653d2ffd6405 ("qed*: Fix link indication race") introduced another
race - one of the inner functions called from the link-change flow is
explicitly using the slowpath context dedicated PTT instead of gaining
that PTT from the caller. Since this flow can now be called from
a different context as well, we're in risk of the PTT breaking.

Fixes: 653d2ffd6405 ("qed*: Fix link indication race")
Signed-off-by: Yuval Mintz 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/qlogic/qed/qed.h | 4 +++-
 drivers/net/ethernet/qlogic/qed/qed_dev.c | 6 +++---
 drivers/net/ethernet/qlogic/qed/qed_mcp.c | 3 ++-
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed.h 
b/drivers/net/ethernet/qlogic/qed/qed.h
index 653bb5735f0c..433f8be57847 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -642,7 +642,9 @@ static inline u8 qed_concrete_to_sw_fid(struct qed_dev 
*cdev,
 #define OOO_LB_TC 9
 
 int qed_configure_vport_wfq(struct qed_dev *cdev, u16 vp_id, u32 rate);
-void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev, u32 
min_pf_rate);
+void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev,
+struct qed_ptt *p_ptt,
+u32 min_pf_rate);
 
 void qed_clean_wfq_db(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
 #define QED_LEADING_HWFN(dev)   (>hwfns[0])
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c 
b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index edae5fc5fccd..41367c490a7f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -2732,7 +2732,8 @@ int qed_configure_vport_wfq(struct qed_dev *cdev, u16 
vp_id, u32 rate)
 }
 
 /* API to configure WFQ from mcp link change */
-void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev, u32 min_pf_rate)
+void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev,
+struct qed_ptt *p_ptt, u32 min_pf_rate)
 {
int i;
 
@@ -2746,8 +2747,7 @@ void qed_configure_vp_wfq_on_link_change(struct qed_dev 
*cdev, u32 min_pf_rate)
for_each_hwfn(cdev, i) {
struct qed_hwfn *p_hwfn = >hwfns[i];
 
-   __qed_configure_vp_wfq_on_link_change(p_hwfn,
- p_hwfn->p_dpc_ptt,
+   __qed_configure_vp_wfq_on_link_change(p_hwfn, p_ptt,
  min_pf_rate);
}
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c 
b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index bdc9ba92f6d4..8b7d2f963ee1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -628,7 +628,8 @@ static void qed_mcp_handle_link_change(struct qed_hwfn 
*p_hwfn,
 
/* Min bandwidth configuration */
__qed_configure_pf_min_bandwidth(p_hwfn, p_ptt, p_link, min_bw);
-   qed_configure_vp_wfq_on_link_change(p_hwfn->cdev, p_link->min_pf_rate);
+   qed_configure_vp_wfq_on_link_change(p_hwfn->cdev, p_ptt,
+   p_link->min_pf_rate);
 
p_link->an = !!(status & LINK_STATUS_AUTO_NEGOTIATE_ENABLED);
p_link->an_complete = !!(status &
-- 
2.11.0

[PATCH review for 4.9 16/50] Btrfs: send, fix failure to rename top level inode due to name collision

[Levin, Alexander (Sasha Levin)]

From: Robbie Ko 

[ Upstream commit 4dd9920d991745c4a16f53a8f615f706fbe4b3f7 ]

Under certain situations, an incremental send operation can fail due to a
premature attempt to create a new top level inode (a direct child of the
subvolume/snapshot root) whose name collides with another inode that was
removed from the send snapshot.

Consider the following example scenario.

Parent snapshot:

  . (ino 256, gen 8)
  | a1/ (ino 257, gen 9)
  | a2/ (ino 258, gen 9)

Send snapshot:

  . (ino 256, gen 3)
  | a2/ (ino 257, gen 7)

In this scenario, when receiving the incremental send stream, the btrfs
receive command fails like this (ran in verbose mode, -vv argument):

  rmdir a1
  mkfile o257-7-0
  rename o257-7-0 -> a2
  ERROR: rename o257-7-0 -> a2 failed: Is a directory

What happens when computing the incremental send stream is:

1) An operation to remove the directory with inode number 257 and
   generation 9 is issued.

2) An operation to create the inode with number 257 and generation 7 is
   issued. This creates the inode with an orphanized name of "o257-7-0".

3) An operation rename the new inode 257 to its final name, "a2", is
   issued. This is incorrect because inode 258, which has the same name
   and it's a child of the same parent (root inode 256), was not yet
   processed and therefore no rmdir operation for it was yet issued.
   The rename operation is issued because we fail to detect that the
   name of the new inode 257 collides with inode 258, because their
   parent, a subvolume/snapshot root (inode 256) has a different
   generation in both snapshots.

So fix this by ignoring the generation value of a parent directory that
matches a root inode (number 256) when we are checking if the name of the
inode currently being processed collides with the name of some other
inode that was not yet processed.

We can achieve this scenario of different inodes with the same number but
different generation values either by mounting a filesystem with the inode
cache option (-o inode_cache) or by creating and sending snapshots across
different filesystems, like in the following example:

  $ mkfs.btrfs -f /dev/sdb
  $ mount /dev/sdb /mnt
  $ mkdir /mnt/a1
  $ mkdir /mnt/a2
  $ btrfs subvolume snapshot -r /mnt /mnt/snap1
  $ btrfs send /mnt/snap1 -f /tmp/1.snap
  $ umount /mnt

  $ mkfs.btrfs -f /dev/sdc
  $ mount /dev/sdc /mnt
  $ touch /mnt/a2
  $ btrfs subvolume snapshot -r /mnt /mnt/snap2
  $ btrfs receive /mnt -f /tmp/1.snap
  # Take note that once the filesystem is created, its current
  # generation has value 7 so the inode from the second snapshot has
  # a generation value of 7. And after receiving the first snapshot
  # the filesystem is at a generation value of 10, because the call to
  # create the second snapshot bumps the generation to 8 (the snapshot
  # creation ioctl does a transaction commit), the receive command calls
  # the snapshot creation ioctl to create the first snapshot, which bumps
  # the filesystem's generation to 9, and finally when the receive
  # operation finishes it calls an ioctl to transition the first snapshot
  # (snap1) from RW mode to RO mode, which does another transaction commit
  # and bumps the filesystem's generation to 10.
  $ rm -f /tmp/1.snap
  $ btrfs send /mnt/snap1 -f /tmp/1.snap
  $ btrfs send -p /mnt/snap1 /mnt/snap2 -f /tmp/2.snap
  $ umount /mnt

  $ mkfs.btrfs -f /dev/sdd
  $ mount /dev/sdd /mnt
  $ btrfs receive /mnt /tmp/1.snap
  # Receive of snapshot snap2 used to fail.
  $ btrfs receive /mnt /tmp/2.snap

Signed-off-by: Robbie Ko 
Reviewed-by: Filipe Manana 
[Rewrote changelog to be more precise and clear]
Signed-off-by: Filipe Manana 

Signed-off-by: Sasha Levin 
---
 fs/btrfs/send.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 71261b459863..77f9efc1f7aa 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -1680,6 +1680,9 @@ static int is_inode_existent(struct send_ctx *sctx, u64 
ino, u64 gen)
 {
int ret;
 
+   if (ino == BTRFS_FIRST_FREE_OBJECTID)
+   return 1;
+
ret = get_cur_inode_state(sctx, ino, gen);
if (ret < 0)
goto out;
@@ -1865,7 +1868,7 @@ static int will_overwrite_ref(struct send_ctx *sctx, u64 
dir, u64 dir_gen,
 * not deleted and then re-created, if it was then we have no overwrite
 * and we can just unlink this entry.
 */
-   if (sctx->parent_root) {
+   if (sctx->parent_root && dir != BTRFS_FIRST_FREE_OBJECTID) {
ret = get_inode_info(sctx->parent_root, dir, NULL, , NULL,
 NULL, NULL, NULL);
if (ret < 0 && ret != -ENOENT)
-- 
2.11.0

[PATCH review for 4.9 32/50] i2c: at91: ensure state is restored after suspending

[Levin, Alexander (Sasha Levin)]

From: Alexandre Belloni 

[ Upstream commit e3ccc921b7d8fd1fcd10a00720e09823d8078666 ]

When going to suspend, the I2C registers may be lost because the power to
VDDcore is cut. Restore them when resuming.

Signed-off-by: Alexandre Belloni 
Acked-by: Ludovic Desroches 
Signed-off-by: Wolfram Sang 
Signed-off-by: Sasha Levin 
---
 drivers/i2c/busses/i2c-at91.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
index 0b86c6173e07..c925a690cb32 100644
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -1180,6 +1180,7 @@ static int at91_twi_suspend_noirq(struct device *dev)
 
 static int at91_twi_resume_noirq(struct device *dev)
 {
+   struct at91_twi_dev *twi_dev = dev_get_drvdata(dev);
int ret;
 
if (!pm_runtime_status_suspended(dev)) {
@@ -1191,6 +1192,8 @@ static int at91_twi_resume_noirq(struct device *dev)
pm_runtime_mark_last_busy(dev);
pm_request_autosuspend(dev);
 
+   at91_init_twi_bus(twi_dev);
+
return 0;
 }
 
-- 
2.11.0

[PATCH review for 4.9 33/50] ceph: don't update_dentry_lease unless we actually got one

[Levin, Alexander (Sasha Levin)]

From: Jeff Layton 

[ Upstream commit 80d025ffede88969f6adf7266fbdedfd5641148a ]

This if block updates the dentry lease even in the case where
the MDS didn't grant one.

Signed-off-by: Jeff Layton 
Reviewed-by: Yan, Zheng 
Signed-off-by: Ilya Dryomov 
Signed-off-by: Sasha Levin 
---
 fs/ceph/inode.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 953275b651bc..4a6df2ce0f76 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1323,8 +1323,8 @@ retry_lookup:
ceph_dir_clear_ordered(dir);
dout("d_delete %p\n", dn);
d_delete(dn);
-   } else {
-   if (have_lease && d_unhashed(dn))
+   } else if (have_lease) {
+   if (d_unhashed(dn))
d_add(dn, NULL);
update_dentry_lease(dn, rinfo->dlease,
session,
-- 
2.11.0

[PATCH review for 4.9 08/50] qed: Don't use attention PTT for configuring BW

[Levin, Alexander (Sasha Levin)]

From: "Mintz, Yuval" 

[ Upstream commit 6f437d431930ff86e4a971d29321951faadb97c7 ]

Commit 653d2ffd6405 ("qed*: Fix link indication race") introduced another
race - one of the inner functions called from the link-change flow is
explicitly using the slowpath context dedicated PTT instead of gaining
that PTT from the caller. Since this flow can now be called from
a different context as well, we're in risk of the PTT breaking.

Fixes: 653d2ffd6405 ("qed*: Fix link indication race")
Signed-off-by: Yuval Mintz 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/qlogic/qed/qed.h | 4 +++-
 drivers/net/ethernet/qlogic/qed/qed_dev.c | 6 +++---
 drivers/net/ethernet/qlogic/qed/qed_mcp.c | 3 ++-
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed.h 
b/drivers/net/ethernet/qlogic/qed/qed.h
index 653bb5735f0c..433f8be57847 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -642,7 +642,9 @@ static inline u8 qed_concrete_to_sw_fid(struct qed_dev 
*cdev,
 #define OOO_LB_TC 9
 
 int qed_configure_vport_wfq(struct qed_dev *cdev, u16 vp_id, u32 rate);
-void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev, u32 
min_pf_rate);
+void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev,
+struct qed_ptt *p_ptt,
+u32 min_pf_rate);
 
 void qed_clean_wfq_db(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
 #define QED_LEADING_HWFN(dev)   (>hwfns[0])
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c 
b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index edae5fc5fccd..41367c490a7f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -2732,7 +2732,8 @@ int qed_configure_vport_wfq(struct qed_dev *cdev, u16 
vp_id, u32 rate)
 }
 
 /* API to configure WFQ from mcp link change */
-void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev, u32 min_pf_rate)
+void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev,
+struct qed_ptt *p_ptt, u32 min_pf_rate)
 {
int i;
 
@@ -2746,8 +2747,7 @@ void qed_configure_vp_wfq_on_link_change(struct qed_dev 
*cdev, u32 min_pf_rate)
for_each_hwfn(cdev, i) {
struct qed_hwfn *p_hwfn = >hwfns[i];
 
-   __qed_configure_vp_wfq_on_link_change(p_hwfn,
- p_hwfn->p_dpc_ptt,
+   __qed_configure_vp_wfq_on_link_change(p_hwfn, p_ptt,
  min_pf_rate);
}
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c 
b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index bdc9ba92f6d4..8b7d2f963ee1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -628,7 +628,8 @@ static void qed_mcp_handle_link_change(struct qed_hwfn 
*p_hwfn,
 
/* Min bandwidth configuration */
__qed_configure_pf_min_bandwidth(p_hwfn, p_ptt, p_link, min_bw);
-   qed_configure_vp_wfq_on_link_change(p_hwfn->cdev, p_link->min_pf_rate);
+   qed_configure_vp_wfq_on_link_change(p_hwfn->cdev, p_ptt,
+   p_link->min_pf_rate);
 
p_link->an = !!(status & LINK_STATUS_AUTO_NEGOTIATE_ENABLED);
p_link->an_complete = !!(status &
-- 
2.11.0

[PATCH review for 4.9 20/50] net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs

[Levin, Alexander (Sasha Levin)]

From: Majd Dibbiny 

[ Upstream commit 95f1ba9a24af9769f6e20dfe9a77c863f253f311 ]

In the VF driver, module parameter mlx4_log_num_mgm_entry_size was
mistakenly overwritten -- and in a manner which overrode the
device-managed flow steering option encoded in the parameter.

log_num_mgm_entry_size is a global module parameter which
affects all ConnectX-3 PFs installed on that host.
If a VF changes log_num_mgm_entry_size, this will affect all PFs
which are probed subsequent to the change (by disabling DMFS for
those PFs).

Fixes: 3c439b5586e9 ("mlx4_core: Allow choosing flow steering mode")
Signed-off-by: Majd Dibbiny 
Reviewed-by: Jack Morgenstein 
Signed-off-by: Tariq Toukan 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/mellanox/mlx4/main.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c 
b/drivers/net/ethernet/mellanox/mlx4/main.c
index ba652d8a2b93..727122de7df0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -841,8 +841,6 @@ static int mlx4_slave_cap(struct mlx4_dev *dev)
return -ENOSYS;
}
 
-   mlx4_log_num_mgm_entry_size = hca_param.log_mc_entry_sz;
-
dev->caps.hca_core_clock = hca_param.hca_core_clock;
 
memset(_cap, 0, sizeof(dev_cap));
-- 
2.11.0

[PATCH review for 4.9 42/50] hrtimer: Catch invalid clockids again

[Levin, Alexander (Sasha Levin)]

From: Marc Zyngier 

[ Upstream commit 336a9cde10d641e70bac67d90ae91b3190c3edca ]

commit 82e88ff1ea94 ("hrtimer: Revert CLOCK_MONOTONIC_RAW support") removed
unfortunately a sanity check in the hrtimer code which was part of that
MONOTONIC_RAW patch series.

It would have caught the bogus usage of CLOCK_MONOTONIC_RAW in the wireless
code. So bring it back.

It is way too easy to take any random clockid and feed it to the hrtimer
subsystem. At best, it gets mapped to a monotonic base, but it would be
better to just catch illegal values as early as possible.

Detect invalid clockids, map them to CLOCK_MONOTONIC and emit a warning.

[ tglx: Replaced the BUG by a WARN and gracefully map to CLOCK_MONOTONIC ]

Signed-off-by: Marc Zyngier 
Cc: Tomasz Nowicki 
Cc: Christoffer Dall 
Link: 
http://lkml.kernel.org/r/1452879670-16133-3-git-send-email-marc.zyng...@arm.com
Signed-off-by: Thomas Gleixner 
Signed-off-by: Sasha Levin 
---
 kernel/time/hrtimer.c | 20 +++-
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index bb5ec425dfe0..eeb7f2f5698d 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -94,17 +94,15 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
 };
 
 static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = {
+   /* Make sure we catch unsupported clockids */
+   [0 ... MAX_CLOCKS - 1]  = HRTIMER_MAX_CLOCK_BASES,
+
[CLOCK_REALTIME]= HRTIMER_BASE_REALTIME,
[CLOCK_MONOTONIC]   = HRTIMER_BASE_MONOTONIC,
[CLOCK_BOOTTIME]= HRTIMER_BASE_BOOTTIME,
[CLOCK_TAI] = HRTIMER_BASE_TAI,
 };
 
-static inline int hrtimer_clockid_to_base(clockid_t clock_id)
-{
-   return hrtimer_clock_to_base_table[clock_id];
-}
-
 /*
  * Functions and macros which are different for UP/SMP systems are kept in a
  * single place
@@ -1112,6 +1110,18 @@ u64 hrtimer_get_next_event(void)
 }
 #endif
 
+static inline int hrtimer_clockid_to_base(clockid_t clock_id)
+{
+   if (likely(clock_id < MAX_CLOCKS)) {
+   int base = hrtimer_clock_to_base_table[clock_id];
+
+   if (likely(base != HRTIMER_MAX_CLOCK_BASES))
+   return base;
+   }
+   WARN(1, "Invalid clockid %d. Using MONOTONIC\n", clock_id);
+   return HRTIMER_BASE_MONOTONIC;
+}
+
 static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id,
   enum hrtimer_mode mode)
 {
-- 
2.11.0

[PATCH review for 4.9 20/50] net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs

[Levin, Alexander (Sasha Levin)]

From: Majd Dibbiny 

[ Upstream commit 95f1ba9a24af9769f6e20dfe9a77c863f253f311 ]

In the VF driver, module parameter mlx4_log_num_mgm_entry_size was
mistakenly overwritten -- and in a manner which overrode the
device-managed flow steering option encoded in the parameter.

log_num_mgm_entry_size is a global module parameter which
affects all ConnectX-3 PFs installed on that host.
If a VF changes log_num_mgm_entry_size, this will affect all PFs
which are probed subsequent to the change (by disabling DMFS for
those PFs).

Fixes: 3c439b5586e9 ("mlx4_core: Allow choosing flow steering mode")
Signed-off-by: Majd Dibbiny 
Reviewed-by: Jack Morgenstein 
Signed-off-by: Tariq Toukan 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/mellanox/mlx4/main.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c 
b/drivers/net/ethernet/mellanox/mlx4/main.c
index ba652d8a2b93..727122de7df0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -841,8 +841,6 @@ static int mlx4_slave_cap(struct mlx4_dev *dev)
return -ENOSYS;
}
 
-   mlx4_log_num_mgm_entry_size = hca_param.log_mc_entry_sz;
-
dev->caps.hca_core_clock = hca_param.hca_core_clock;
 
memset(_cap, 0, sizeof(dev_cap));
-- 
2.11.0

[PATCH review for 4.9 42/50] hrtimer: Catch invalid clockids again

[Levin, Alexander (Sasha Levin)]

From: Marc Zyngier 

[ Upstream commit 336a9cde10d641e70bac67d90ae91b3190c3edca ]

commit 82e88ff1ea94 ("hrtimer: Revert CLOCK_MONOTONIC_RAW support") removed
unfortunately a sanity check in the hrtimer code which was part of that
MONOTONIC_RAW patch series.

It would have caught the bogus usage of CLOCK_MONOTONIC_RAW in the wireless
code. So bring it back.

It is way too easy to take any random clockid and feed it to the hrtimer
subsystem. At best, it gets mapped to a monotonic base, but it would be
better to just catch illegal values as early as possible.

Detect invalid clockids, map them to CLOCK_MONOTONIC and emit a warning.

[ tglx: Replaced the BUG by a WARN and gracefully map to CLOCK_MONOTONIC ]

Signed-off-by: Marc Zyngier 
Cc: Tomasz Nowicki 
Cc: Christoffer Dall 
Link: 
http://lkml.kernel.org/r/1452879670-16133-3-git-send-email-marc.zyng...@arm.com
Signed-off-by: Thomas Gleixner 
Signed-off-by: Sasha Levin 
---
 kernel/time/hrtimer.c | 20 +++-
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index bb5ec425dfe0..eeb7f2f5698d 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -94,17 +94,15 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
 };
 
 static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = {
+   /* Make sure we catch unsupported clockids */
+   [0 ... MAX_CLOCKS - 1]  = HRTIMER_MAX_CLOCK_BASES,
+
[CLOCK_REALTIME]= HRTIMER_BASE_REALTIME,
[CLOCK_MONOTONIC]   = HRTIMER_BASE_MONOTONIC,
[CLOCK_BOOTTIME]= HRTIMER_BASE_BOOTTIME,
[CLOCK_TAI] = HRTIMER_BASE_TAI,
 };
 
-static inline int hrtimer_clockid_to_base(clockid_t clock_id)
-{
-   return hrtimer_clock_to_base_table[clock_id];
-}
-
 /*
  * Functions and macros which are different for UP/SMP systems are kept in a
  * single place
@@ -1112,6 +1110,18 @@ u64 hrtimer_get_next_event(void)
 }
 #endif
 
+static inline int hrtimer_clockid_to_base(clockid_t clock_id)
+{
+   if (likely(clock_id < MAX_CLOCKS)) {
+   int base = hrtimer_clock_to_base_table[clock_id];
+
+   if (likely(base != HRTIMER_MAX_CLOCK_BASES))
+   return base;
+   }
+   WARN(1, "Invalid clockid %d. Using MONOTONIC\n", clock_id);
+   return HRTIMER_BASE_MONOTONIC;
+}
+
 static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id,
   enum hrtimer_mode mode)
 {
-- 
2.11.0

[PATCH review for 4.9 19/50] sparc64: Migrate hvcons irq to panicked cpu

[Levin, Alexander (Sasha Levin)]

From: Vijay Kumar 

[ Upstream commit 7dd4fcf5b70694dc961eb6b954673e4fc9730dbd ]

On panic, all other CPUs are stopped except the one which had
hit panic. To keep console alive, we need to migrate hvcons irq
to panicked CPU.

Signed-off-by: Vijay Kumar 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 arch/sparc/include/asm/setup.h | 5 -
 arch/sparc/kernel/smp_64.c | 6 +-
 drivers/tty/serial/sunhv.c | 6 ++
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/arch/sparc/include/asm/setup.h b/arch/sparc/include/asm/setup.h
index be0cc1beed41..3fae200dd251 100644
--- a/arch/sparc/include/asm/setup.h
+++ b/arch/sparc/include/asm/setup.h
@@ -59,8 +59,11 @@ extern atomic_t dcpage_flushes;
 extern atomic_t dcpage_flushes_xcall;
 
 extern int sysctl_tsb_ratio;
-#endif
 
+#ifdef CONFIG_SERIAL_SUNHV
+void sunhv_migrate_hvcons_irq(int cpu);
+#endif
+#endif
 void sun_do_break(void);
 extern int stop_a_enabled;
 extern int scons_pwroff;
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index 2deb89ef1d5f..ca7cb8e57ab0 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -1465,8 +1465,12 @@ void smp_send_stop(void)
int cpu;
 
if (tlb_type == hypervisor) {
+   int this_cpu = smp_processor_id();
+#ifdef CONFIG_SERIAL_SUNHV
+   sunhv_migrate_hvcons_irq(this_cpu);
+#endif
for_each_online_cpu(cpu) {
-   if (cpu == smp_processor_id())
+   if (cpu == this_cpu)
continue;
 #ifdef CONFIG_SUN_LDOMS
if (ldom_domaining_enabled) {
diff --git a/drivers/tty/serial/sunhv.c b/drivers/tty/serial/sunhv.c
index 4e603d060e80..59828d819145 100644
--- a/drivers/tty/serial/sunhv.c
+++ b/drivers/tty/serial/sunhv.c
@@ -398,6 +398,12 @@ static struct uart_driver sunhv_reg = {
 
 static struct uart_port *sunhv_port;
 
+void sunhv_migrate_hvcons_irq(int cpu)
+{
+   /* Migrate hvcons irq to param cpu */
+   irq_force_affinity(sunhv_port->irq, cpumask_of(cpu));
+}
+
 /* Copy 's' into the con_write_page, decoding "\n" into
  * "\r\n" along the way.  We have to return two lengths
  * because the caller needs to know how much to advance
-- 
2.11.0

[PATCH review for 4.9 19/50] sparc64: Migrate hvcons irq to panicked cpu

[Levin, Alexander (Sasha Levin)]

From: Vijay Kumar 

[ Upstream commit 7dd4fcf5b70694dc961eb6b954673e4fc9730dbd ]

On panic, all other CPUs are stopped except the one which had
hit panic. To keep console alive, we need to migrate hvcons irq
to panicked CPU.

Signed-off-by: Vijay Kumar 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 arch/sparc/include/asm/setup.h | 5 -
 arch/sparc/kernel/smp_64.c | 6 +-
 drivers/tty/serial/sunhv.c | 6 ++
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/arch/sparc/include/asm/setup.h b/arch/sparc/include/asm/setup.h
index be0cc1beed41..3fae200dd251 100644
--- a/arch/sparc/include/asm/setup.h
+++ b/arch/sparc/include/asm/setup.h
@@ -59,8 +59,11 @@ extern atomic_t dcpage_flushes;
 extern atomic_t dcpage_flushes_xcall;
 
 extern int sysctl_tsb_ratio;
-#endif
 
+#ifdef CONFIG_SERIAL_SUNHV
+void sunhv_migrate_hvcons_irq(int cpu);
+#endif
+#endif
 void sun_do_break(void);
 extern int stop_a_enabled;
 extern int scons_pwroff;
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index 2deb89ef1d5f..ca7cb8e57ab0 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -1465,8 +1465,12 @@ void smp_send_stop(void)
int cpu;
 
if (tlb_type == hypervisor) {
+   int this_cpu = smp_processor_id();
+#ifdef CONFIG_SERIAL_SUNHV
+   sunhv_migrate_hvcons_irq(this_cpu);
+#endif
for_each_online_cpu(cpu) {
-   if (cpu == smp_processor_id())
+   if (cpu == this_cpu)
continue;
 #ifdef CONFIG_SUN_LDOMS
if (ldom_domaining_enabled) {
diff --git a/drivers/tty/serial/sunhv.c b/drivers/tty/serial/sunhv.c
index 4e603d060e80..59828d819145 100644
--- a/drivers/tty/serial/sunhv.c
+++ b/drivers/tty/serial/sunhv.c
@@ -398,6 +398,12 @@ static struct uart_driver sunhv_reg = {
 
 static struct uart_port *sunhv_port;
 
+void sunhv_migrate_hvcons_irq(int cpu)
+{
+   /* Migrate hvcons irq to param cpu */
+   irq_force_affinity(sunhv_port->irq, cpumask_of(cpu));
+}
+
 /* Copy 's' into the con_write_page, decoding "\n" into
  * "\r\n" along the way.  We have to return two lengths
  * because the caller needs to know how much to advance
-- 
2.11.0

[PATCH review for 4.9 09/50] mac80211: fix power saving clients handling in iwlwifi

[Levin, Alexander (Sasha Levin)]

From: Emmanuel Grumbach 

[ Upstream commit d98937f4ea713d21e0fcc345919f86c877dd8d6f ]

iwlwifi now supports RSS and can't let mac80211 track the
PS state based on the Rx frames since they can come out of
order. iwlwifi is now advertising AP_LINK_PS, and uses
explicit notifications to teach mac80211 about the PS state
of the stations and the PS poll / uAPSD trigger frames
coming our way from the peers.

Because of that, the TIM stopped being maintained in
mac80211. I tried to fix this in commit c68df2e7be0c
("mac80211: allow using AP_LINK_PS with mac80211-generated TIM IE")
but that was later reverted by Felix in commit 6c18a6b4e799
("Revert "mac80211: allow using AP_LINK_PS with mac80211-generated TIM IE")
since it broke drivers that do not implement set_tim.

Since none of the drivers that set AP_LINK_PS have the
set_tim() handler set besides iwlwifi, I can bail out in
__sta_info_recalc_tim if AP_LINK_PS AND .set_tim is not
implemented.

Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin 
---
 net/mac80211/sta_info.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index b2c823ffad74..348700b424ea 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -688,7 +688,7 @@ static void __sta_info_recalc_tim(struct sta_info *sta, 
bool ignore_pending)
}
 
/* No need to do anything if the driver does all */
-   if (ieee80211_hw_check(>hw, AP_LINK_PS))
+   if (ieee80211_hw_check(>hw, AP_LINK_PS) && !local->ops->set_tim)
return;
 
if (sta->dead)
-- 
2.11.0

[PATCH review for 4.9 13/50] iio: adc: xilinx: Fix error handling

[Levin, Alexander (Sasha Levin)]

From: Christophe JAILLET 

[ Upstream commit ca1c39ef76376b67303d01f94fe98bb68bb3861a ]

Reorder error handling labels in order to match the way resources have
been allocated.

Signed-off-by: Christophe JAILLET 
Acked-by: Lars-Peter Clausen 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin 
---
 drivers/iio/adc/xilinx-xadc-core.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/adc/xilinx-xadc-core.c 
b/drivers/iio/adc/xilinx-xadc-core.c
index 0a6beb3d99cb..56cf5907a5f0 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -1208,7 +1208,7 @@ static int xadc_probe(struct platform_device *pdev)
 
ret = xadc->ops->setup(pdev, indio_dev, irq);
if (ret)
-   goto err_free_samplerate_trigger;
+   goto err_clk_disable_unprepare;
 
ret = request_irq(irq, xadc->ops->interrupt_handler, 0,
dev_name(>dev), indio_dev);
@@ -1268,6 +1268,8 @@ static int xadc_probe(struct platform_device *pdev)
 
 err_free_irq:
free_irq(irq, indio_dev);
+err_clk_disable_unprepare:
+   clk_disable_unprepare(xadc->clk);
 err_free_samplerate_trigger:
if (xadc->ops->flags & XADC_FLAGS_BUFFERED)
iio_trigger_free(xadc->samplerate_trigger);
@@ -1277,8 +1279,6 @@ err_free_convst_trigger:
 err_triggered_buffer_cleanup:
if (xadc->ops->flags & XADC_FLAGS_BUFFERED)
iio_triggered_buffer_cleanup(indio_dev);
-err_clk_disable_unprepare:
-   clk_disable_unprepare(xadc->clk);
 err_device_free:
kfree(indio_dev->channels);
 
-- 
2.11.0