Re: [PATCH for 4.9 07/59] clk: sunxi-ng: set the parent rate when adjustin CPUX clock on A33

[Levin, Alexander (Sasha Levin)]

On Fri, Sep 15, 2017 at 10:02:04AM +0800, icen...@aosc.io wrote:
>在 2017-09-14 23:51，Levin, Alexander (Sasha Levin) 写道：
>>From: Icenowy Zheng <icen...@aosc.xyz>
>>
>>[ Upstream commit bb021cda2ccf45ee9470bf0f8c55323ad1c761ae ]
>
>As DVFS for A33 doesn't exist in 4.9, this patch doesn't affect 4.9
>at all.

Dropped, thanks!

-- 

Thanks,
Sasha

Re: [PATCH for 4.9 01/39] net: core: Prevent from dereferencing null pointer when releasing SKB

[Levin, Alexander (Sasha Levin)]

On Mon, Sep 18, 2017 at 08:41:02AM +0200, Greg KH wrote:
>On Mon, Sep 18, 2017 at 12:19:36AM +0000, Levin, Alexander (Sasha Levin) wrote:
>> From: Myungho Jung <mhju...@gmail.com>
>>
>> [ Upstream commit 9899886d5e8ec5b343b1efe44f185a0e68dc6454 ]
>>
>> Added NULL check to make __dev_kfree_skb_irq consistent with kfree
>> family of functions.
>>
>> Link: 
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__bugzilla.kernel.org_show-5Fbug.cgi-3Fid-3D195289=DwIBAg=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ=bUtaaC9mlBij4OjEG_D-KPul_335azYzfC4Rjgomobo=iXzciSQOaZF7sggj-m_1eQCbmqf43dsIy8ogFRdIvSE=kZBpt2uE3l0TtR50y0QmqJyb1Wp3A-FB-GVfkwnTgVI=
>>
>> Signed-off-by: Myungho Jung <mhju...@gmail.com>
>> Signed-off-by: David S. Miller <da...@davemloft.net>
>> Signed-off-by: Sasha Levin <alexander.le...@verizon.com>
>
>Is this a different series from your original XX/59 patch series that
>you feel is ready to go into the stable tree, or are you still asking
>for review for these before they get submitted?

This is a different series. Figured I'd do 2-3 in parallel to speed up things.

-- 

Thanks,
Sasha

Re: [PATCH for 4.9 01/39] net: core: Prevent from dereferencing null pointer when releasing SKB

[Levin, Alexander (Sasha Levin)]

On Mon, Sep 18, 2017 at 10:13:21AM -0400, Sasha Levin wrote:
>On Mon, Sep 18, 2017 at 08:41:02AM +0200, Greg KH wrote:
>>On Mon, Sep 18, 2017 at 12:19:36AM +0000, Levin, Alexander (Sasha Levin) 
>>wrote:
>>>From: Myungho Jung <mhju...@gmail.com>
>>>
>>>[ Upstream commit 9899886d5e8ec5b343b1efe44f185a0e68dc6454 ]
>>>
>>>Added NULL check to make __dev_kfree_skb_irq consistent with kfree
>>>family of functions.
>>>
>>>Link: 
>>>https://urldefense.proofpoint.com/v2/url?u=https-3A__bugzilla.kernel.org_show-5Fbug.cgi-3Fid-3D195289=DwIBAg=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ=bUtaaC9mlBij4OjEG_D-KPul_335azYzfC4Rjgomobo=iXzciSQOaZF7sggj-m_1eQCbmqf43dsIy8ogFRdIvSE=kZBpt2uE3l0TtR50y0QmqJyb1Wp3A-FB-GVfkwnTgVI=
>>>
>>>Signed-off-by: Myungho Jung <mhju...@gmail.com>
>>>Signed-off-by: David S. Miller <da...@davemloft.net>
>>>Signed-off-by: Sasha Levin <alexander.le...@verizon.com>
>>
>>Is this a different series from your original XX/59 patch series that
>>you feel is ready to go into the stable tree, or are you still asking
>>for review for these before they get submitted?
>
>This is a different series. Figured I'd do 2-3 in parallel to speed up things.

Sorry, just to clarify, I'm waiting for reviews on this one.

I'll improve the patch subject prefix next time to clearify that.

-- 

Thanks,
Sasha

[PATCH review for 4.4 27/47] audit: log 32-bit socketcalls

[Levin, Alexander (Sasha Levin)]

From: Richard Guy Briggs 

[ Upstream commit 62bc306e2083436675e33b5bdeb6a77907d35971 ]

32-bit socketcalls were not being logged by audit on x86_64 systems.
Log them.  This is basically a duplicate of the call from
net/socket.c:sys_socketcall(), but it addresses the impedance mismatch
between 32-bit userspace process and 64-bit kernel audit.

See: https://github.com/linux-audit/audit-kernel/issues/14

Signed-off-by: Richard Guy Briggs 
Acked-by: David S. Miller 
Signed-off-by: Paul Moore 
Signed-off-by: Sasha Levin 
---
 include/linux/audit.h | 20 
 net/compat.c  | 17 ++---
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 20eba1eb0a3c..faac391badac 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -281,6 +281,20 @@ static inline int audit_socketcall(int nargs, unsigned 
long *args)
return __audit_socketcall(nargs, args);
return 0;
 }
+
+static inline int audit_socketcall_compat(int nargs, u32 *args)
+{
+   unsigned long a[AUDITSC_ARGS];
+   int i;
+
+   if (audit_dummy_context())
+   return 0;
+
+   for (i = 0; i < nargs; i++)
+   a[i] = (unsigned long)args[i];
+   return __audit_socketcall(nargs, a);
+}
+
 static inline int audit_sockaddr(int len, void *addr)
 {
if (unlikely(!audit_dummy_context()))
@@ -407,6 +421,12 @@ static inline int audit_socketcall(int nargs, unsigned 
long *args)
 {
return 0;
 }
+
+static inline int audit_socketcall_compat(int nargs, u32 *args)
+{
+   return 0;
+}
+
 static inline void audit_fd_pair(int fd1, int fd2)
 { }
 static inline int audit_sockaddr(int len, void *addr)
diff --git a/net/compat.c b/net/compat.c
index 5cfd26a0006f..0ccf3ecf6bbb 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -22,6 +22,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 
 #include 
@@ -767,14 +768,24 @@ COMPAT_SYSCALL_DEFINE5(recvmmsg, int, fd, struct 
compat_mmsghdr __user *, mmsg,
 
 COMPAT_SYSCALL_DEFINE2(socketcall, int, call, u32 __user *, args)
 {
-   int ret;
-   u32 a[6];
+   u32 a[AUDITSC_ARGS];
+   unsigned int len;
u32 a0, a1;
+   int ret;
 
if (call < SYS_SOCKET || call > SYS_SENDMMSG)
return -EINVAL;
-   if (copy_from_user(a, args, nas[call]))
+   len = nas[call];
+   if (len > sizeof(a))
+   return -EINVAL;
+
+   if (copy_from_user(a, args, len))
return -EFAULT;
+
+   ret = audit_socketcall_compat(len / sizeof(a[0]), a);
+   if (ret)
+   return ret;
+
a0 = a[0];
a1 = a[1];
 
-- 
2.11.0

[PATCH review for 3.18 12/30] IB/ipoib: Replace list_del of the neigh->list with list_del_init

[Levin, Alexander (Sasha Levin)]

From: Feras Daoud 

[ Upstream commit c586071d1dc8227a7182179b8e50ee92cc43f6d2 ]

In order to resolve a situation where a few process delete
the same list element in sequence and cause panic, list_del
is replaced with list_del_init. In this case if the first
process that calls list_del releases the lock before acquiring
it again, other processes who can acquire the lock will call
list_del_init.

Fixes: b63b70d87741 ("IPoIB: Use a private hash table for path lookup")
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Reviewed-by: Alex Vesker 
Signed-off-by: Leon Romanovsky 
Reviewed-by: Yuval Shaia 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/ulp/ipoib/ipoib_main.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c 
b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 5e08db6f9d8c..eab9eda0e7bd 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -958,7 +958,7 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
   
rcu_dereference_protected(neigh->hnext,
 
lockdep_is_held(>lock)));
/* remove from path/mc list */
-   list_del(>list);
+   list_del_init(>list);
call_rcu(>rcu, ipoib_neigh_reclaim);
} else {
np = >hnext;
@@ -1121,7 +1121,7 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
   
rcu_dereference_protected(neigh->hnext,
 
lockdep_is_held(>lock)));
/* remove from parent list */
-   list_del(>list);
+   list_del_init(>list);
call_rcu(>rcu, ipoib_neigh_reclaim);
return;
} else {
@@ -1206,7 +1206,7 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 
*gid)
   
rcu_dereference_protected(neigh->hnext,
 
lockdep_is_held(>lock)));
/* remove from parent list */
-   list_del(>list);
+   list_del_init(>list);
call_rcu(>rcu, ipoib_neigh_reclaim);
} else {
np = >hnext;
@@ -1248,7 +1248,7 @@ static void ipoib_flush_neighs(struct ipoib_dev_priv 
*priv)
   
rcu_dereference_protected(neigh->hnext,
 
lockdep_is_held(>lock)));
/* remove from path/mc list */
-   list_del(>list);
+   list_del_init(>list);
call_rcu(>rcu, ipoib_neigh_reclaim);
}
}
-- 
2.11.0

[PATCH review for 3.18 28/30] md/raid10: submit bio directly to replacement disk

[Levin, Alexander (Sasha Levin)]

From: Shaohua Li 

[ Upstream commit 6d399783e9d4e9bd44931501948059d24ad96ff8 ]

Commit 57c67df(md/raid10: submit IO from originating thread instead of
md thread) submits bio directly for normal disks but not for replacement
disks. There is no point we shouldn't do this for replacement disks.

Cc: NeilBrown 
Signed-off-by: Shaohua Li 
Signed-off-by: Sasha Levin 
---
 drivers/md/raid10.c | 19 ---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1b49827757b5..d207748fdc41 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1514,11 +1514,24 @@ retry_write:
mbio->bi_private = r10_bio;
 
atomic_inc(_bio->remaining);
+
+   cb = blk_check_plugged(raid10_unplug, mddev,
+  sizeof(*plug));
+   if (cb)
+   plug = container_of(cb, struct raid10_plug_cb,
+   cb);
+   else
+   plug = NULL;
spin_lock_irqsave(>device_lock, flags);
-   bio_list_add(>pending_bio_list, mbio);
-   conf->pending_count++;
+   if (plug) {
+   bio_list_add(>pending, mbio);
+   plug->pending_cnt++;
+   } else {
+   bio_list_add(>pending_bio_list, mbio);
+   conf->pending_count++;
+   }
spin_unlock_irqrestore(>device_lock, flags);
-   if (!mddev_check_plugged(mddev))
+   if (!plug)
md_wakeup_thread(mddev->thread);
}
}
-- 
2.11.0

[PATCH review for 3.18 26/30] parisc: perf: Fix potential NULL pointer dereference

[Levin, Alexander (Sasha Levin)]

From: Arvind Yadav 

[ Upstream commit 74e3f6e63da6c8e8246fba1689e040bc926b4a1a ]

Fix potential NULL pointer dereference and clean up
coding style errors (code indent, trailing whitespaces).

Signed-off-by: Arvind Yadav 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin 
---
 arch/parisc/kernel/perf.c | 94 ---
 1 file changed, 49 insertions(+), 45 deletions(-)

diff --git a/arch/parisc/kernel/perf.c b/arch/parisc/kernel/perf.c
index ba0c053e25ae..2a2fff407ac4 100644
--- a/arch/parisc/kernel/perf.c
+++ b/arch/parisc/kernel/perf.c
@@ -39,7 +39,7 @@
  *  the PDC INTRIGUE calls.  This is done to eliminate bugs introduced
  *  in various PDC revisions.  The code is much more maintainable
  *  and reliable this way vs having to debug on every version of PDC
- *  on every box. 
+ *  on every box.
  */
 
 #include 
@@ -195,8 +195,8 @@ static int perf_config(uint32_t *image_ptr);
 static int perf_release(struct inode *inode, struct file *file);
 static int perf_open(struct inode *inode, struct file *file);
 static ssize_t perf_read(struct file *file, char __user *buf, size_t cnt, 
loff_t *ppos);
-static ssize_t perf_write(struct file *file, const char __user *buf, size_t 
count, 
-   loff_t *ppos);
+static ssize_t perf_write(struct file *file, const char __user *buf,
+   size_t count, loff_t *ppos);
 static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 static void perf_start_counters(void);
 static int perf_stop_counters(uint32_t *raddr);
@@ -222,7 +222,7 @@ extern void perf_intrigue_disable_perf_counters (void);
 /*
  * configure:
  *
- * Configure the cpu with a given data image.  First turn off the counters, 
+ * Configure the cpu with a given data image.  First turn off the counters,
  * then download the image, then turn the counters back on.
  */
 static int perf_config(uint32_t *image_ptr)
@@ -234,7 +234,7 @@ static int perf_config(uint32_t *image_ptr)
error = perf_stop_counters(raddr);
if (error != 0) {
printk("perf_config: perf_stop_counters = %ld\n", error);
-   return -EINVAL; 
+   return -EINVAL;
}
 
 printk("Preparing to write image\n");
@@ -242,7 +242,7 @@ printk("Preparing to write image\n");
error = perf_write_image((uint64_t *)image_ptr);
if (error != 0) {
printk("perf_config: DOWNLOAD = %ld\n", error);
-   return -EINVAL; 
+   return -EINVAL;
}
 
 printk("Preparing to start counters\n");
@@ -254,7 +254,7 @@ printk("Preparing to start counters\n");
 }
 
 /*
- * Open the device and initialize all of its memory.  The device is only 
+ * Open the device and initialize all of its memory.  The device is only
  * opened once, but can be "queried" by multiple processes that know its
  * file descriptor.
  */
@@ -298,8 +298,8 @@ static ssize_t perf_read(struct file *file, char __user 
*buf, size_t cnt, loff_t
  * called on the processor that the download should happen
  * on.
  */
-static ssize_t perf_write(struct file *file, const char __user *buf, size_t 
count, 
-   loff_t *ppos)
+static ssize_t perf_write(struct file *file, const char __user *buf,
+   size_t count, loff_t *ppos)
 {
int err;
size_t image_size;
@@ -307,11 +307,11 @@ static ssize_t perf_write(struct file *file, const char 
__user *buf, size_t coun
uint32_t interface_type;
uint32_t test;
 
-   if (perf_processor_interface == ONYX_INTF) 
+   if (perf_processor_interface == ONYX_INTF)
image_size = PCXU_IMAGE_SIZE;
-   else if (perf_processor_interface == CUDA_INTF) 
+   else if (perf_processor_interface == CUDA_INTF)
image_size = PCXW_IMAGE_SIZE;
-   else 
+   else
return -EFAULT;
 
if (!capable(CAP_SYS_ADMIN))
@@ -331,22 +331,22 @@ static ssize_t perf_write(struct file *file, const char 
__user *buf, size_t coun
 
/* First check the machine type is correct for
   the requested image */
-if (((perf_processor_interface == CUDA_INTF) &&
-  (interface_type != CUDA_INTF)) ||
-   ((perf_processor_interface == ONYX_INTF) &&
-  (interface_type != ONYX_INTF))) 
+   if (((perf_processor_interface == CUDA_INTF) &&
+   (interface_type != CUDA_INTF)) ||
+   ((perf_processor_interface == ONYX_INTF) &&
+   (interface_type != ONYX_INTF)))
return -EINVAL;
 
/* Next check to make sure the requested image
   is valid */
-   if (((interface_type == CUDA_INTF) && 
+   if (((interface_type == CUDA_INTF) &&
   (test >= MAX_CUDA_IMAGES)) ||
-   ((interface_type == ONYX_INTF) && 
-  (test >= MAX_ONYX_IMAGES))) 
+   

[PATCH review for 4.4 42/47] iommu/io-pgtable-arm: Check for leaf entry before dereferencing it

[Levin, Alexander (Sasha Levin)]

From: Oleksandr Tyshchenko 

[ Upstream commit ed46e66cc1b3d684042f92dfa2ab15ee917b4cac ]

Do a check for already installed leaf entry at the current level before
dereferencing it in order to avoid walking the page table down with
wrong pointer to the next level.

Signed-off-by: Oleksandr Tyshchenko 
CC: Will Deacon 
CC: Robin Murphy 
Signed-off-by: Will Deacon 
Signed-off-by: Sasha Levin 
---
 drivers/iommu/io-pgtable-arm.c | 6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index dad768caa9c5..18751b1dfd3d 100644
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -335,8 +335,12 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable 
*data, unsigned long iova,
if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS)
pte |= ARM_LPAE_PTE_NSTABLE;
__arm_lpae_set_pte(ptep, pte, cfg);
-   } else {
+   } else if (!iopte_leaf(pte, lvl)) {
cptep = iopte_deref(pte, data);
+   } else {
+   /* We require an unmap first */
+   WARN_ON(!selftest_running);
+   return -EEXIST;
}
 
/* Rinse, repeat */
-- 
2.11.0

[PATCH review for 4.4 07/47] MIPS: kexec: Do not reserve invalid crashkernel memory on boot

[Levin, Alexander (Sasha Levin)]

From: Marcin Nowakowski 

[ Upstream commit a8f108d70c74d83574c157648383eb2e4285a190 ]

Do not reserve memory for the crashkernel if the commandline argument
points to a wrong location. This can happen if the location is specified
wrong or if the same commandline is reused when starting the crashkernel
- in the latter case the reserved memory would point to the location
from which the crashkernel is executing.

Signed-off-by: Marcin Nowakowski 
Cc: linux-m...@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14612/
Signed-off-by: Ralf Baechle 
Signed-off-by: Sasha Levin 
---
 arch/mips/kernel/setup.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 8acae316f26b..68f1118d10ad 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -596,6 +596,11 @@ static void __init mips_parse_crashkernel(void)
if (ret != 0 || crash_size <= 0)
return;
 
+   if (!memory_region_available(crash_base, crash_size)) {
+   pr_warn("Invalid memory region reserved for crash kernel\n");
+   return;
+   }
+
crashk_res.start = crash_base;
crashk_res.end   = crash_base + crash_size - 1;
 }
-- 
2.11.0

[PATCH review for 4.4 39/47] [media] exynos-gsc: Do not swap cb/cr for semi planar formats

[Levin, Alexander (Sasha Levin)]

From: Thibault Saunier 

[ Upstream commit d7f3e33df4fbdc9855fb151f4a328ec46447e3ba ]

In the case of semi planar formats cb and cr are in the same plane
in memory, meaning that will be set to 'cb' whatever the format is,
and whatever the (packed) order of those components are.

Suggested-by: Nicolas Dufresne 
Signed-off-by: Thibault Saunier 
Signed-off-by: Javier Martinez Canillas 
Acked-by: Sylwester Nawrocki 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
---
 drivers/media/platform/exynos-gsc/gsc-core.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c 
b/drivers/media/platform/exynos-gsc/gsc-core.c
index 9b9e423e4fc4..15c543d4b366 100644
--- a/drivers/media/platform/exynos-gsc/gsc-core.c
+++ b/drivers/media/platform/exynos-gsc/gsc-core.c
@@ -849,9 +849,7 @@ int gsc_prepare_addr(struct gsc_ctx *ctx, struct vb2_buffer 
*vb,
 
if ((frame->fmt->pixelformat == V4L2_PIX_FMT_VYUY) ||
(frame->fmt->pixelformat == V4L2_PIX_FMT_YVYU) ||
-   (frame->fmt->pixelformat == V4L2_PIX_FMT_NV61) ||
(frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420) ||
-   (frame->fmt->pixelformat == V4L2_PIX_FMT_NV21) ||
(frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420M))
swap(addr->cb, addr->cr);
 
-- 
2.11.0

[PATCH review for 4.4 04/47] RDS: RDMA: Fix the composite message user notification

[Levin, Alexander (Sasha Levin)]

From: Santosh Shilimkar 

[ Upstream commit 941f8d55f6d613a460a5e080d25a38509f45eb75 ]

When application sends an RDS RDMA composite message consist of
RDMA transfer to be followed up by non RDMA payload, it expect to
be notified *only* when the full message gets delivered. RDS RDMA
notification doesn't behave this way though.

Thanks to Venkat for debug and root casuing the issue
where only first part of the message(RDMA) was
successfully delivered but remainder payload delivery failed.
In that case, application should not be notified with
a false positive of message delivery success.

Fix this case by making sure the user gets notified only after
the full message delivery.

Reviewed-by: Venkat Venkatsubra 
Signed-off-by: Santosh Shilimkar 
Signed-off-by: Sasha Levin 
---
 net/rds/ib_send.c | 25 +++--
 net/rds/rdma.c| 10 ++
 net/rds/rds.h |  1 +
 net/rds/send.c|  4 +++-
 4 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index eac30bf486d7..094e2a12860a 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -68,16 +68,6 @@ static void rds_ib_send_complete(struct rds_message *rm,
complete(rm, notify_status);
 }
 
-static void rds_ib_send_unmap_data(struct rds_ib_connection *ic,
-  struct rm_data_op *op,
-  int wc_status)
-{
-   if (op->op_nents)
-   ib_dma_unmap_sg(ic->i_cm_id->device,
-   op->op_sg, op->op_nents,
-   DMA_TO_DEVICE);
-}
-
 static void rds_ib_send_unmap_rdma(struct rds_ib_connection *ic,
   struct rm_rdma_op *op,
   int wc_status)
@@ -138,6 +128,21 @@ static void rds_ib_send_unmap_atomic(struct 
rds_ib_connection *ic,
rds_ib_stats_inc(s_ib_atomic_fadd);
 }
 
+static void rds_ib_send_unmap_data(struct rds_ib_connection *ic,
+  struct rm_data_op *op,
+  int wc_status)
+{
+   struct rds_message *rm = container_of(op, struct rds_message, data);
+
+   if (op->op_nents)
+   ib_dma_unmap_sg(ic->i_cm_id->device,
+   op->op_sg, op->op_nents,
+   DMA_TO_DEVICE);
+
+   if (rm->rdma.op_active && rm->data.op_notify)
+   rds_ib_send_unmap_rdma(ic, >rdma, wc_status);
+}
+
 /*
  * Unmap the resources associated with a struct send_work.
  *
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 4c93badeabf2..8d3a851a3476 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -626,6 +626,16 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct 
rds_message *rm,
}
op->op_notifier->n_user_token = args->user_token;
op->op_notifier->n_status = RDS_RDMA_SUCCESS;
+
+   /* Enable rmda notification on data operation for composite
+* rds messages and make sure notification is enabled only
+* for the data operation which follows it so that application
+* gets notified only after full message gets delivered.
+*/
+   if (rm->data.op_sg) {
+   rm->rdma.op_notify = 0;
+   rm->data.op_notify = !!(args->flags & 
RDS_RDMA_NOTIFY_ME);
+   }
}
 
/* The cookie contains the R_Key of the remote memory region, and
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 0e2797bdc316..4588860f4c3b 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -378,6 +378,7 @@ struct rds_message {
} rdma;
struct rm_data_op {
unsigned intop_active:1;
+   unsigned intop_notify:1;
unsigned intop_nents;
unsigned intop_count;
unsigned intop_dmasg;
diff --git a/net/rds/send.c b/net/rds/send.c
index c9cdb358ea88..6815f03324d7 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -467,12 +467,14 @@ void rds_rdma_send_complete(struct rds_message *rm, int 
status)
struct rm_rdma_op *ro;
struct rds_notifier *notifier;
unsigned long flags;
+   unsigned int notify = 0;
 
spin_lock_irqsave(>m_rs_lock, flags);
 
+   notify =  rm->rdma.op_notify | rm->data.op_notify;
ro = >rdma;
if (test_bit(RDS_MSG_ON_SOCK, >m_flags) &&
-   ro->op_active && ro->op_notify && ro->op_notifier) {
+   ro->op_active && notify && ro->op_notifier) {
notifier = ro->op_notifier;
rs = rm->m_rs;
sock_hold(rds_rs_to_sk(rs));
-- 
2.11.0

[PATCH review for 4.4 22/47] USB: serial: mos7720: fix control-message error handling

[Levin, Alexander (Sasha Levin)]

From: Johan Hovold 

[ Upstream commit 0d130367abf582e7cbf60075c2a7ab53817b1d14 ]

Make sure to log an error on short transfers when reading a device
register.

Also clear the provided buffer (which if often an uninitialised
automatic variable) on errors as the driver currently does not bother to
check for errors.

Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: Johan Hovold 
Signed-off-by: Sasha Levin 
---
 drivers/usb/serial/mos7720.c | 9 +++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index e56cdb436de3..4581fa1dec98 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -234,11 +234,16 @@ static int read_mos_reg(struct usb_serial *serial, 
unsigned int serial_portnum,
 
status = usb_control_msg(usbdev, pipe, request, requesttype, value,
 index, buf, 1, MOS_WDR_TIMEOUT);
-   if (status == 1)
+   if (status == 1) {
*data = *buf;
-   else if (status < 0)
+   } else {
dev_err(>dev,
"mos7720: usb_control_msg() failed: %d\n", status);
+   if (status >= 0)
+   status = -EIO;
+   *data = 0;
+   }
+
kfree(buf);
 
return status;
-- 
2.11.0

[PATCH review for 4.4 21/47] drm/amdkfd: fix improper return value on error

[Levin, Alexander (Sasha Levin)]

From: Pan Bian 

[ Upstream commit 8bf793883da213864efc50c274d2b38ec0ca58b2 ]

In function kfd_wait_on_events(), when the call to copy_from_user()
fails, the value of return variable ret is 0. 0 indicates success, which
is inconsistent with the execution status. This patch fixes the bug by
assigning "-EFAULT" to ret when copy_from_user() returns an unexpected
value.

Signed-off-by: Pan Bian 
Signed-off-by: Oded Gabbay 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_events.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
index b6e28dcaea1d..1fb1daa0b366 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
@@ -739,8 +739,10 @@ int kfd_wait_on_events(struct kfd_process *p,
struct kfd_event_data event_data;
 
if (copy_from_user(_data, [i],
-   sizeof(struct kfd_event_data)))
+   sizeof(struct kfd_event_data))) {
+   ret = -EFAULT;
goto fail;
+   }
 
ret = init_event_waiter(p, _waiters[i],
event_data.event_id, i);
-- 
2.11.0

[PATCH review for 4.4 18/47] IB/ipoib: Fix deadlock over vlan_mutex

[Levin, Alexander (Sasha Levin)]

From: Feras Daoud 

[ Upstream commit 1c3098cdb05207e740715857df7b0998e372f527 ]

This patch fixes Deadlock while executing ipoib_vlan_delete.

The function takes the vlan_rwsem semaphore and calls
unregister_netdevice. The later function calls
ipoib_mcast_stop_thread that cause workqueue flush.

When the queue has one of the ipoib_ib_dev_flush_xxx events,
a deadlock occur because these events also tries to catch the
same vlan_rwsem semaphore.

To fix, unregister_netdevice should be called after releasing
the semaphore.

Fixes: cbbe1efa4972 ("IPoIB: Fix deadlock between ipoib_open() and child 
interface create")
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Reviewed-by: Alex Vesker 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c 
b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 57a34f87dedf..3a647fd50f09 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -185,7 +185,6 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned 
short pkey)
list_for_each_entry_safe(priv, tpriv, >child_intfs, list) {
if (priv->pkey == pkey &&
priv->child_type == IPOIB_LEGACY_CHILD) {
-   unregister_netdevice(priv->dev);
list_del(>list);
dev = priv->dev;
break;
@@ -193,6 +192,11 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned 
short pkey)
}
up_write(>vlan_rwsem);
 
+   if (dev) {
+   ipoib_dbg(ppriv, "delete child vlan %s\n", dev->name);
+   unregister_netdevice(dev);
+   }
+
rtnl_unlock();
 
if (dev) {
-- 
2.11.0

[PATCH review for 4.4 35/47] mmc: sdio: fix alignment issue in struct sdio_func

[Levin, Alexander (Sasha Levin)]

From: Heiner Kallweit 

[ Upstream commit 5ef1ecf060f28ecef313b5723f1fd39bf5a35f56 ]

Certain 64-bit systems (e.g. Amlogic Meson GX) require buffers to be
used for DMA to be 8-byte-aligned. struct sdio_func has an embedded
small DMA buffer not meeting this requirement.
When testing switching to descriptor chain mode in meson-gx driver
SDIO is broken therefore. Fix this by allocating the small DMA buffer
separately as kmalloc ensures that the returned memory area is
properly aligned for every basic data type.

Signed-off-by: Heiner Kallweit 
Tested-by: Helmut Klein 
Signed-off-by: Ulf Hansson 
Signed-off-by: Sasha Levin 
---
 drivers/mmc/core/sdio_bus.c   | 12 +++-
 include/linux/mmc/sdio_func.h |  2 +-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
index 7e327a6dd53d..c23bc4f331bd 100644
--- a/drivers/mmc/core/sdio_bus.c
+++ b/drivers/mmc/core/sdio_bus.c
@@ -266,7 +266,7 @@ static void sdio_release_func(struct device *dev)
sdio_free_func_cis(func);
 
kfree(func->info);
-
+   kfree(func->tmpbuf);
kfree(func);
 }
 
@@ -281,6 +281,16 @@ struct sdio_func *sdio_alloc_func(struct mmc_card *card)
if (!func)
return ERR_PTR(-ENOMEM);
 
+   /*
+* allocate buffer separately to make sure it's properly aligned for
+* DMA usage (incl. 64 bit DMA)
+*/
+   func->tmpbuf = kmalloc(4, GFP_KERNEL);
+   if (!func->tmpbuf) {
+   kfree(func);
+   return ERR_PTR(-ENOMEM);
+   }
+
func->card = card;
 
device_initialize(>dev);
diff --git a/include/linux/mmc/sdio_func.h b/include/linux/mmc/sdio_func.h
index aab032a6ae61..97ca105347a6 100644
--- a/include/linux/mmc/sdio_func.h
+++ b/include/linux/mmc/sdio_func.h
@@ -53,7 +53,7 @@ struct sdio_func {
unsigned intstate;  /* function state */
 #define SDIO_STATE_PRESENT (1<<0)  /* present in sysfs */
 
-   u8  tmpbuf[4];  /* DMA:able scratch buffer */
+   u8  *tmpbuf;/* DMA:able scratch buffer */
 
unsignednum_info;   /* number of info strings */
const char  **info; /* info strings */
-- 
2.11.0

[PATCH review for 3.18 13/30] USB: serial: mos7720: fix control-message error handling

[Levin, Alexander (Sasha Levin)]

From: Johan Hovold 

[ Upstream commit 0d130367abf582e7cbf60075c2a7ab53817b1d14 ]

Make sure to log an error on short transfers when reading a device
register.

Also clear the provided buffer (which if often an uninitialised
automatic variable) on errors as the driver currently does not bother to
check for errors.

Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: Johan Hovold 
Signed-off-by: Sasha Levin 
---
 drivers/usb/serial/mos7720.c | 9 +++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index c3b8ae360424..5e3a609fbab4 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -236,11 +236,16 @@ static int read_mos_reg(struct usb_serial *serial, 
unsigned int serial_portnum,
 
status = usb_control_msg(usbdev, pipe, request, requesttype, value,
 index, buf, 1, MOS_WDR_TIMEOUT);
-   if (status == 1)
+   if (status == 1) {
*data = *buf;
-   else if (status < 0)
+   } else {
dev_err(>dev,
"mos7720: usb_control_msg() failed: %d\n", status);
+   if (status >= 0)
+   status = -EIO;
+   *data = 0;
+   }
+
kfree(buf);
 
return status;
-- 
2.11.0

[PATCH review for 4.4 43/47] rds: ib: add error handle

[Levin, Alexander (Sasha Levin)]

From: Zhu Yanjun 

[ Upstream commit 3b12f73a5c2977153f28a224392fd4729b50d1dc ]

In the function rds_ib_setup_qp, the error handle is missing. When some
error occurs, it is possible that memory leak occurs. As such, error
handle is added.

Cc: Joe Jin 
Reviewed-by: Junxiao Bi 
Reviewed-by: Guanglei Li 
Signed-off-by: Zhu Yanjun 
Acked-by: Santosh Shilimkar 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/rds/ib_cm.c | 47 ---
 1 file changed, 36 insertions(+), 11 deletions(-)

diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index da5a7fb98c77..a6f5b3d21571 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -381,7 +381,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
ret = PTR_ERR(ic->i_send_cq);
ic->i_send_cq = NULL;
rdsdebug("ib_create_cq send failed: %d\n", ret);
-   goto out;
+   goto rds_ibdev_out;
}
 
cq_attr.cqe = ic->i_recv_ring.w_nr;
@@ -392,19 +392,19 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
ret = PTR_ERR(ic->i_recv_cq);
ic->i_recv_cq = NULL;
rdsdebug("ib_create_cq recv failed: %d\n", ret);
-   goto out;
+   goto send_cq_out;
}
 
ret = ib_req_notify_cq(ic->i_send_cq, IB_CQ_NEXT_COMP);
if (ret) {
rdsdebug("ib_req_notify_cq send failed: %d\n", ret);
-   goto out;
+   goto recv_cq_out;
}
 
ret = ib_req_notify_cq(ic->i_recv_cq, IB_CQ_SOLICITED);
if (ret) {
rdsdebug("ib_req_notify_cq recv failed: %d\n", ret);
-   goto out;
+   goto recv_cq_out;
}
 
/* XXX negotiate max send/recv with remote? */
@@ -428,7 +428,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
ret = rdma_create_qp(ic->i_cm_id, ic->i_pd, );
if (ret) {
rdsdebug("rdma_create_qp failed: %d\n", ret);
-   goto out;
+   goto recv_cq_out;
}
 
ic->i_send_hdrs = ib_dma_alloc_coherent(dev,
@@ -438,7 +438,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_send_hdrs) {
ret = -ENOMEM;
rdsdebug("ib_dma_alloc_coherent send failed\n");
-   goto out;
+   goto qp_out;
}
 
ic->i_recv_hdrs = ib_dma_alloc_coherent(dev,
@@ -448,7 +448,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_recv_hdrs) {
ret = -ENOMEM;
rdsdebug("ib_dma_alloc_coherent recv failed\n");
-   goto out;
+   goto send_hdrs_dma_out;
}
 
ic->i_ack = ib_dma_alloc_coherent(dev, sizeof(struct rds_header),
@@ -456,7 +456,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_ack) {
ret = -ENOMEM;
rdsdebug("ib_dma_alloc_coherent ack failed\n");
-   goto out;
+   goto recv_hdrs_dma_out;
}
 
ic->i_sends = vzalloc_node(ic->i_send_ring.w_nr * sizeof(struct 
rds_ib_send_work),
@@ -464,7 +464,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_sends) {
ret = -ENOMEM;
rdsdebug("send allocation failed\n");
-   goto out;
+   goto ack_dma_out;
}
 
ic->i_recvs = vzalloc_node(ic->i_recv_ring.w_nr * sizeof(struct 
rds_ib_recv_work),
@@ -472,7 +472,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_recvs) {
ret = -ENOMEM;
rdsdebug("recv allocation failed\n");
-   goto out;
+   goto sends_out;
}
 
rds_ib_recv_init_ack(ic);
@@ -480,8 +480,33 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
rdsdebug("conn %p pd %p cq %p %p\n", conn, ic->i_pd,
 ic->i_send_cq, ic->i_recv_cq);
 
-out:
+   return ret;
+
+sends_out:
+   vfree(ic->i_sends);
+ack_dma_out:
+   ib_dma_free_coherent(dev, sizeof(struct rds_header),
+ic->i_ack, ic->i_ack_dma);
+recv_hdrs_dma_out:
+   ib_dma_free_coherent(dev, ic->i_recv_ring.w_nr *
+   sizeof(struct rds_header),
+   ic->i_recv_hdrs, ic->i_recv_hdrs_dma);
+send_hdrs_dma_out:
+   ib_dma_free_coherent(dev, ic->i_send_ring.w_nr *
+   sizeof(struct rds_header),
+   ic->i_send_hdrs, ic->i_send_hdrs_dma);
+qp_out:
+   rdma_destroy_qp(ic->i_cm_id);
+recv_cq_out:
+   if (!ib_destroy_cq(ic->i_recv_cq))
+   

[PATCH review for 4.4 09/47] igb: re-assign hw address pointer on reset after PCI error

[Levin, Alexander (Sasha Levin)]

From: Guilherme G Piccoli 

[ Upstream commit 69b97cf6dbce7403845a28bbc75d57f5be7b12ac ]

Whenever the igb driver detects the result of a read operation returns
a value composed only by F's (like 0x), it will detach the
net_device, clear the hw_addr pointer and warn to the user that adapter's
link is lost - those steps happen on igb_rd32().

In case a PCI error happens on Power architecture, there's a recovery
mechanism called EEH, that will reset the PCI slot and call driver's
handlers to reset the adapter and network functionality as well.

We observed that once hw_addr is NULL after the error is detected on
igb_rd32(), it's never assigned back, so in the process of resetting
the network functionality we got a NULL pointer dereference in both
igb_configure_tx_ring() and igb_configure_rx_ring(). In order to avoid
such bug, this patch re-assigns the hw_addr value in the slot_reset
handler.

Reported-by: Anthony H Thai 
Reported-by: Harsha Thyagaraja 
Signed-off-by: Guilherme G Piccoli 
Tested-by: Aaron Brown 
Signed-off-by: Jeff Kirsher 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/intel/igb/igb_main.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c 
b/drivers/net/ethernet/intel/igb/igb_main.c
index fa3b4cbea23b..a481ea64e287 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -7658,6 +7658,11 @@ static pci_ers_result_t igb_io_slot_reset(struct pci_dev 
*pdev)
pci_enable_wake(pdev, PCI_D3hot, 0);
pci_enable_wake(pdev, PCI_D3cold, 0);
 
+   /* In case of PCI error, adapter lose its HW address
+* so we should re-assign it here.
+*/
+   hw->hw_addr = adapter->io_addr;
+
igb_reset(adapter);
wr32(E1000_WUS, ~0);
result = PCI_ERS_RESULT_RECOVERED;
-- 
2.11.0

[PATCH review for 4.4 20/47] IB/ipoib: Replace list_del of the neigh->list with list_del_init

[Levin, Alexander (Sasha Levin)]

From: Feras Daoud 

[ Upstream commit c586071d1dc8227a7182179b8e50ee92cc43f6d2 ]

In order to resolve a situation where a few process delete
the same list element in sequence and cause panic, list_del
is replaced with list_del_init. In this case if the first
process that calls list_del releases the lock before acquiring
it again, other processes who can acquire the lock will call
list_del_init.

Fixes: b63b70d87741 ("IPoIB: Use a private hash table for path lookup")
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Reviewed-by: Alex Vesker 
Signed-off-by: Leon Romanovsky 
Reviewed-by: Yuval Shaia 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/ulp/ipoib/ipoib_main.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c 
b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 6699ecd855f0..bad76eed06b3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1239,7 +1239,7 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv 
*priv)
   
rcu_dereference_protected(neigh->hnext,
 
lockdep_is_held(>lock)));
/* remove from path/mc list */
-   list_del(>list);
+   list_del_init(>list);
call_rcu(>rcu, ipoib_neigh_reclaim);
} else {
np = >hnext;
@@ -1406,7 +1406,7 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
   
rcu_dereference_protected(neigh->hnext,
 
lockdep_is_held(>lock)));
/* remove from parent list */
-   list_del(>list);
+   list_del_init(>list);
call_rcu(>rcu, ipoib_neigh_reclaim);
return;
} else {
@@ -1491,7 +1491,7 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 
*gid)
   
rcu_dereference_protected(neigh->hnext,
 
lockdep_is_held(>lock)));
/* remove from parent list */
-   list_del(>list);
+   list_del_init(>list);
call_rcu(>rcu, ipoib_neigh_reclaim);
} else {
np = >hnext;
@@ -1533,7 +1533,7 @@ static void ipoib_flush_neighs(struct ipoib_dev_priv 
*priv)
   
rcu_dereference_protected(neigh->hnext,
 
lockdep_is_held(>lock)));
/* remove from path/mc list */
-   list_del(>list);
+   list_del_init(>list);
call_rcu(>rcu, ipoib_neigh_reclaim);
}
}
-- 
2.11.0

[PATCH review for 3.18 01/30] drm: bridge: add DT bindings for TI ths8135

[Levin, Alexander (Sasha Levin)]

From: Bartosz Golaszewski 

[ Upstream commit 2e644be30fcc08c736f66b60f4898d274d4873ab ]

THS8135 is a configurable video DAC. Add DT bindings for this chip.

Signed-off-by: Bartosz Golaszewski 
Reviewed-by: Laurent Pinchart 
Acked-by: Rob Herring 
Signed-off-by: Archit Taneja 
Link: 
http://patchwork.freedesktop.org/patch/msgid/1481623759-12786-3-git-send-email-bgolaszew...@baylibre.com
Signed-off-by: Sasha Levin 
---
 .../bindings/display/bridge/ti,ths8135.txt | 46 ++
 1 file changed, 46 insertions(+)
 create mode 100644 
Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt

diff --git a/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt 
b/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt
new file mode 100644
index ..6ec1a880ac18
--- /dev/null
+++ b/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt
@@ -0,0 +1,46 @@
+THS8135 Video DAC
+-
+
+This is the binding for Texas Instruments THS8135 Video DAC bridge.
+
+Required properties:
+
+- compatible: Must be "ti,ths8135"
+
+Required nodes:
+
+This device has two video ports. Their connections are modelled using the OF
+graph bindings specified in Documentation/devicetree/bindings/graph.txt.
+
+- Video port 0 for RGB input
+- Video port 1 for VGA output
+
+Example
+---
+
+vga-bridge {
+   compatible = "ti,ths8135";
+   #address-cells = <1>;
+   #size-cells = <0>;
+
+   ports {
+   #address-cells = <1>;
+   #size-cells = <0>;
+
+   port@0 {
+   reg = <0>;
+
+   vga_bridge_in: endpoint {
+   remote-endpoint = <_out_vga>;
+   };
+   };
+
+   port@1 {
+   reg = <1>;
+
+   vga_bridge_out: endpoint {
+   remote-endpoint = <_con_in>;
+   };
+   };
+   };
+};
-- 
2.11.0

[PATCH review for 4.4 46/47] xfs: remove kmem_zalloc_greedy

[Levin, Alexander (Sasha Levin)]

From: "Darrick J. Wong" 

[ Upstream commit 08b005f1333154ae5b404ca28766e0ffb9f1c150 ]

The sole remaining caller of kmem_zalloc_greedy is bulkstat, which uses
it to grab 1-4 pages for staging of inobt records.  The infinite loop in
the greedy allocation function is causing hangs[1] in generic/269, so
just get rid of the greedy allocator in favor of kmem_zalloc_large.
This makes bulkstat somewhat more likely to ENOMEM if there's really no
pages to spare, but eliminates a source of hangs.

[1] 
http://lkml.kernel.org/r/20170301044634.rgidgdqqiiwsmfpj%40XZHOUW.usersys.redhat.com

Signed-off-by: Darrick J. Wong 
Reviewed-by: Christoph Hellwig 
---
v2: remove single-page fallback

Signed-off-by: Sasha Levin 
---
 fs/xfs/kmem.c   | 18 --
 fs/xfs/kmem.h   |  2 --
 fs/xfs/xfs_itable.c |  6 ++
 3 files changed, 2 insertions(+), 24 deletions(-)

diff --git a/fs/xfs/kmem.c b/fs/xfs/kmem.c
index 686ba6fb20dd..8067364c602f 100644
--- a/fs/xfs/kmem.c
+++ b/fs/xfs/kmem.c
@@ -24,24 +24,6 @@
 #include "kmem.h"
 #include "xfs_message.h"
 
-/*
- * Greedy allocation.  May fail and may return vmalloced memory.
- */
-void *
-kmem_zalloc_greedy(size_t *size, size_t minsize, size_t maxsize)
-{
-   void*ptr;
-   size_t  kmsize = maxsize;
-
-   while (!(ptr = vzalloc(kmsize))) {
-   if ((kmsize >>= 1) <= minsize)
-   kmsize = minsize;
-   }
-   if (ptr)
-   *size = kmsize;
-   return ptr;
-}
-
 void *
 kmem_alloc(size_t size, xfs_km_flags_t flags)
 {
diff --git a/fs/xfs/kmem.h b/fs/xfs/kmem.h
index cc6b768fc068..ae45f77ce33b 100644
--- a/fs/xfs/kmem.h
+++ b/fs/xfs/kmem.h
@@ -69,8 +69,6 @@ static inline void  kmem_free(const void *ptr)
 }
 
 
-extern void *kmem_zalloc_greedy(size_t *, size_t, size_t);
-
 static inline void *
 kmem_zalloc(size_t size, xfs_km_flags_t flags)
 {
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index 930ebd86beba..99a4891c00ab 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -351,7 +351,6 @@ xfs_bulkstat(
xfs_agino_t agino;  /* inode # in allocation group */
xfs_agnumber_t  agno;   /* allocation group number */
xfs_btree_cur_t *cur;   /* btree cursor for ialloc btree */
-   size_t  irbsize; /* size of irec buffer in bytes */
xfs_inobt_rec_incore_t  *irbuf; /* start of irec buffer */
int nirbuf; /* size of irbuf */
int ubcount; /* size of user's buffer */
@@ -378,11 +377,10 @@ xfs_bulkstat(
*ubcountp = 0;
*done = 0;
 
-   irbuf = kmem_zalloc_greedy(, PAGE_SIZE, PAGE_SIZE * 4);
+   irbuf = kmem_zalloc_large(PAGE_SIZE * 4, KM_SLEEP);
if (!irbuf)
return -ENOMEM;
-
-   nirbuf = irbsize / sizeof(*irbuf);
+   nirbuf = (PAGE_SIZE * 4) / sizeof(*irbuf);
 
/*
 * Loop over the allocation groups, starting from the last
-- 
2.11.0

[PATCH review for 3.18 14/30] USB: serial: mos7840: fix control-message error handling

[Levin, Alexander (Sasha Levin)]

From: Johan Hovold 

[ Upstream commit cd8db057e93ddaacbec025b567490555d2bca280 ]

Make sure to detect short transfers when reading a device register.

The modem-status handling had sufficient error checks in place, but move
handling of short transfers into the register accessor function itself
for consistency.

Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: Johan Hovold 
Signed-off-by: Sasha Levin 
---
 drivers/usb/serial/mos7840.c | 19 +++
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 0b547d9e2aeb..a0dca81dfaca 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -285,9 +285,15 @@ static int mos7840_get_reg_sync(struct usb_serial_port 
*port, __u16 reg,
ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
  MCS_RD_RTYPE, 0, reg, buf, VENDOR_READ_LENGTH,
  MOS_WDR_TIMEOUT);
+   if (ret < VENDOR_READ_LENGTH) {
+   if (ret >= 0)
+   ret = -EIO;
+   goto out;
+   }
+
*val = buf[0];
dev_dbg(>dev, "%s offset is %x, return val %x\n", __func__, reg, 
*val);
-
+out:
kfree(buf);
return ret;
 }
@@ -353,8 +359,13 @@ static int mos7840_get_uart_reg(struct usb_serial_port 
*port, __u16 reg,
ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
  MCS_RD_RTYPE, Wval, reg, buf, VENDOR_READ_LENGTH,
  MOS_WDR_TIMEOUT);
+   if (ret < VENDOR_READ_LENGTH) {
+   if (ret >= 0)
+   ret = -EIO;
+   goto out;
+   }
*val = buf[0];
-
+out:
kfree(buf);
return ret;
 }
@@ -1518,10 +1529,10 @@ static int mos7840_tiocmget(struct tty_struct *tty)
return -ENODEV;
 
status = mos7840_get_uart_reg(port, MODEM_STATUS_REGISTER, );
-   if (status != 1)
+   if (status < 0)
return -EIO;
status = mos7840_get_uart_reg(port, MODEM_CONTROL_REGISTER, );
-   if (status != 1)
+   if (status < 0)
return -EIO;
result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)
| ((mcr & MCR_RTS) ? TIOCM_RTS : 0)
-- 
2.11.0

[PATCH review for 3.18 30/30] libata: transport: Remove circular dependency at free time

[Levin, Alexander (Sasha Levin)]

From: Gwendal Grignou 

[ Upstream commit d85fc67dd11e9a32966140677d4d6429ca540b25 ]

Without this patch, failed probe would not free resources like irq.

ata port tdev object currently hold a reference to the ata port
object.  Therefore the ata port object release function will not get
called until the ata_tport_release is called. But that would never
happen, releasing the last reference of ata port dev is done by
scsi_host_release, which is called by ata_host_release when the ata
port object is released.

The ata device objects actually do not need to explicitly hold a
reference to their real counterpart, given the transport objects are
the children of these objects and device_add() is call for each child.
We know the parent will not be deleted until we call the child's
device_del().

Reported-by: Matthew Whitehead 
Tested-by: Matthew Whitehead 
Suggested-by: Tejun Heo 
Signed-off-by: Gwendal Grignou 
Signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin 
---
 drivers/ata/libata-transport.c | 9 +++--
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
index fd29b7224082..43d4fbb377da 100644
--- a/drivers/ata/libata-transport.c
+++ b/drivers/ata/libata-transport.c
@@ -223,7 +223,6 @@ static DECLARE_TRANSPORT_CLASS(ata_port_class,
 
 static void ata_tport_release(struct device *dev)
 {
-   put_device(dev->parent);
 }
 
 /**
@@ -283,7 +282,7 @@ int ata_tport_add(struct device *parent,
device_initialize(dev);
dev->type = _port_type;
 
-   dev->parent = get_device(parent);
+   dev->parent = parent;
dev->release = ata_tport_release;
dev_set_name(dev, "ata%d", ap->print_id);
transport_setup_device(dev);
@@ -347,7 +346,6 @@ static DECLARE_TRANSPORT_CLASS(ata_link_class,
 
 static void ata_tlink_release(struct device *dev)
 {
-   put_device(dev->parent);
 }
 
 /**
@@ -409,7 +407,7 @@ int ata_tlink_add(struct ata_link *link)
int error;
 
device_initialize(dev);
-   dev->parent = get_device(>tdev);
+   dev->parent = >tdev;
dev->release = ata_tlink_release;
if (ata_is_host_link(link))
dev_set_name(dev, "link%d", ap->print_id);
@@ -587,7 +585,6 @@ static DECLARE_TRANSPORT_CLASS(ata_dev_class,
 
 static void ata_tdev_release(struct device *dev)
 {
-   put_device(dev->parent);
 }
 
 /**
@@ -660,7 +657,7 @@ static int ata_tdev_add(struct ata_device *ata_dev)
int error;
 
device_initialize(dev);
-   dev->parent = get_device(>tdev);
+   dev->parent = >tdev;
dev->release = ata_tdev_release;
if (ata_is_host_link(link))
dev_set_name(dev, "dev%d.%d", ap->print_id,ata_dev->devno);
-- 
2.11.0

[PATCH review for 4.4 28/47] usb: chipidea: vbus event may exist before starting gadget

[Levin, Alexander (Sasha Levin)]

From: Peter Chen 

[ Upstream commit c3b674a04b8ab62a1d35e86714d466af0a0ecc18 ]

At some situations, the vbus may already be there before starting
gadget. So we need to check vbus event after switching to gadget in
order to handle missing vbus event. The typical use cases are plugging
vbus cable before driver load or the vbus has already been there
after stopping host but before starting gadget.

Signed-off-by: Peter Chen 
Tested-by: Stephen Boyd 
Reported-by: Stephen Boyd 
Signed-off-by: Sasha Levin 
---
 drivers/usb/chipidea/otg.c | 17 -
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
index 0cf149e8..f36a1ac3bfbd 100644
--- a/drivers/usb/chipidea/otg.c
+++ b/drivers/usb/chipidea/otg.c
@@ -134,9 +134,9 @@ void ci_handle_vbus_change(struct ci_hdrc *ci)
if (!ci->is_otg)
return;
 
-   if (hw_read_otgsc(ci, OTGSC_BSV))
+   if (hw_read_otgsc(ci, OTGSC_BSV) && !ci->vbus_active)
usb_gadget_vbus_connect(>gadget);
-   else
+   else if (!hw_read_otgsc(ci, OTGSC_BSV) && ci->vbus_active)
usb_gadget_vbus_disconnect(>gadget);
 }
 
@@ -175,14 +175,21 @@ static void ci_handle_id_switch(struct ci_hdrc *ci)
 
ci_role_stop(ci);
 
-   if (role == CI_ROLE_GADGET)
+   if (role == CI_ROLE_GADGET &&
+   IS_ERR(ci->platdata->vbus_extcon.edev))
/*
-* wait vbus lower than OTGSC_BSV before connecting
-* to host
+* Wait vbus lower than OTGSC_BSV before connecting
+* to host. If connecting status is from an external
+* connector instead of register, we don't need to
+* care vbus on the board, since it will not affect
+* external connector status.
 */
hw_wait_vbus_lower_bsv(ci);
 
ci_role_start(ci, role);
+   /* vbus change may have already occurred */
+   if (role == CI_ROLE_GADGET)
+   ci_handle_vbus_change(ci);
}
 }
 /**
-- 
2.11.0

[PATCH review for 4.4 02/47] drm: bridge: add DT bindings for TI ths8135

[Levin, Alexander (Sasha Levin)]

From: Bartosz Golaszewski 

[ Upstream commit 2e644be30fcc08c736f66b60f4898d274d4873ab ]

THS8135 is a configurable video DAC. Add DT bindings for this chip.

Signed-off-by: Bartosz Golaszewski 
Reviewed-by: Laurent Pinchart 
Acked-by: Rob Herring 
Signed-off-by: Archit Taneja 
Link: 
http://patchwork.freedesktop.org/patch/msgid/1481623759-12786-3-git-send-email-bgolaszew...@baylibre.com
Signed-off-by: Sasha Levin 
---
 .../bindings/display/bridge/ti,ths8135.txt | 46 ++
 1 file changed, 46 insertions(+)
 create mode 100644 
Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt

diff --git a/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt 
b/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt
new file mode 100644
index ..6ec1a880ac18
--- /dev/null
+++ b/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt
@@ -0,0 +1,46 @@
+THS8135 Video DAC
+-
+
+This is the binding for Texas Instruments THS8135 Video DAC bridge.
+
+Required properties:
+
+- compatible: Must be "ti,ths8135"
+
+Required nodes:
+
+This device has two video ports. Their connections are modelled using the OF
+graph bindings specified in Documentation/devicetree/bindings/graph.txt.
+
+- Video port 0 for RGB input
+- Video port 1 for VGA output
+
+Example
+---
+
+vga-bridge {
+   compatible = "ti,ths8135";
+   #address-cells = <1>;
+   #size-cells = <0>;
+
+   ports {
+   #address-cells = <1>;
+   #size-cells = <0>;
+
+   port@0 {
+   reg = <0>;
+
+   vga_bridge_in: endpoint {
+   remote-endpoint = <_out_vga>;
+   };
+   };
+
+   port@1 {
+   reg = <1>;
+
+   vga_bridge_out: endpoint {
+   remote-endpoint = <_con_in>;
+   };
+   };
+   };
+};
-- 
2.11.0

[PATCH review for 4.4 01/47] drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define

[Levin, Alexander (Sasha Levin)]

From: "Kristian H. Kristensen" 

[ Upstream commit af913418261d6d3e7a29f06cf35f04610ead667c ]

We need to define DRM_FORMAT_MOD_VENDOR_NONE for the fourcc_mod_code()
macro to work correctly.

Signed-off-by: Kristian H. Kristensen 
Signed-off-by: Daniel Vetter 
Link: 
http://patchwork.freedesktop.org/patch/msgid/1481657272-25975-1-git-send-email-hoegsb...@google.com
Signed-off-by: Sasha Levin 
---
 include/uapi/drm/drm_fourcc.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h
index 0b69a7753558..f28f79966e9e 100644
--- a/include/uapi/drm/drm_fourcc.h
+++ b/include/uapi/drm/drm_fourcc.h
@@ -150,6 +150,7 @@
 
 /* Vendor Ids: */
 #define DRM_FORMAT_MOD_NONE   0
+#define DRM_FORMAT_MOD_VENDOR_NONE0
 #define DRM_FORMAT_MOD_VENDOR_INTEL   0x01
 #define DRM_FORMAT_MOD_VENDOR_AMD 0x02
 #define DRM_FORMAT_MOD_VENDOR_NV  0x03
-- 
2.11.0

[PATCH review for 4.4 30/47] MIPS: Lantiq: Fix another request_mem_region() return code check

[Levin, Alexander (Sasha Levin)]

From: Arnd Bergmann 

[ Upstream commit 98ea51cb0c8ce009d9da1fd7b48f0ff1d7a9bbb0 ]

Hauke already fixed a couple of them, but one instance remains
that checks for a negative integer when it should check
for a NULL pointer:

arch/mips/lantiq/xway/sysctrl.c: In function 'ltq_soc_init':
arch/mips/lantiq/xway/sysctrl.c:473:19: error: ordered comparison of pointer 
with integer zero [-Werror=extra]

Fixes: 6e807852676a ("MIPS: Lantiq: Fix check for return value of 
request_mem_region()")
Signed-off-by: Arnd Bergmann 
Cc: John Crispin 
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/15043/
Signed-off-by: Ralf Baechle 
Signed-off-by: Sasha Levin 
---
 arch/mips/lantiq/xway/sysctrl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
index daf580ce5ca2..2528181232fd 100644
--- a/arch/mips/lantiq/xway/sysctrl.c
+++ b/arch/mips/lantiq/xway/sysctrl.c
@@ -469,8 +469,8 @@ void __init ltq_soc_init(void)
panic("Failed to load xbar nodes from devicetree");
if (of_address_to_resource(np_xbar, 0, _xbar))
panic("Failed to get xbar resources");
-   if (request_mem_region(res_xbar.start, resource_size(_xbar),
-   res_xbar.name) < 0)
+   if (!request_mem_region(res_xbar.start, 
resource_size(_xbar),
+   res_xbar.name))
panic("Failed to get xbar resources");
 
ltq_xbar_membase = ioremap_nocache(res_xbar.start,
-- 
2.11.0

[PATCH review for 4.4 03/47] GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next

[Levin, Alexander (Sasha Levin)]

From: Dan Carpenter 

[ Upstream commit 14d37564fa3dc4e5d4c6828afcd26ac14e6796c5 ]

This patch fixes a place where function gfs2_glock_iter_next can
reference an invalid error pointer.

Signed-off-by: Dan Carpenter 
Signed-off-by: Bob Peterson 
Signed-off-by: Sasha Levin 
---
 fs/gfs2/glock.c | 12 +++-
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 070901e76653..1a20817ee1d7 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1798,16 +1798,18 @@ void gfs2_glock_exit(void)
 
 static void gfs2_glock_iter_next(struct gfs2_glock_iter *gi)
 {
-   do {
-   gi->gl = rhashtable_walk_next(>hti);
+   while ((gi->gl = rhashtable_walk_next(>hti))) {
if (IS_ERR(gi->gl)) {
if (PTR_ERR(gi->gl) == -EAGAIN)
continue;
gi->gl = NULL;
+   return;
}
-   /* Skip entries for other sb and dead entries */
-   } while ((gi->gl) && ((gi->sdp != gi->gl->gl_name.ln_sbd) ||
- __lockref_is_dead(>gl->gl_lockref)));
+   /* Skip entries for other sb and dead entries */
+   if (gi->sdp == gi->gl->gl_name.ln_sbd &&
+   !__lockref_is_dead(>gl->gl_lockref))
+   return;
+   }
 }
 
 static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos)
-- 
2.11.0

[PATCH review for 4.4 17/47] tty: goldfish: Fix a parameter of a call to free_irq

[Levin, Alexander (Sasha Levin)]

From: Christophe JAILLET 

[ Upstream commit 1a5c2d1de7d35f5eb9793266237903348989502b ]

'request_irq()' and 'free_irq()' should be called with the same dev_id.

Signed-off-by: Christophe JAILLET 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/tty/goldfish.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c
index 0f82c0b146f6..e04b57f79df8 100644
--- a/drivers/tty/goldfish.c
+++ b/drivers/tty/goldfish.c
@@ -293,7 +293,7 @@ static int goldfish_tty_probe(struct platform_device *pdev)
return 0;
 
 err_tty_register_device_failed:
-   free_irq(irq, pdev);
+   free_irq(irq, qtty);
 err_request_irq_failed:
goldfish_tty_current_line_count--;
if (goldfish_tty_current_line_count == 0)
-- 
2.11.0

[PATCH review for 3.18 09/30] tty: goldfish: Fix a parameter of a call to free_irq

[Levin, Alexander (Sasha Levin)]

From: Christophe JAILLET 

[ Upstream commit 1a5c2d1de7d35f5eb9793266237903348989502b ]

'request_irq()' and 'free_irq()' should be called with the same dev_id.

Signed-off-by: Christophe JAILLET 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/tty/goldfish.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c
index 09495f515fa9..beb3142a1414 100644
--- a/drivers/tty/goldfish.c
+++ b/drivers/tty/goldfish.c
@@ -295,7 +295,7 @@ static int goldfish_tty_probe(struct platform_device *pdev)
 
tty_unregister_device(goldfish_tty_driver, i);
 err_tty_register_device_failed:
-   free_irq(irq, pdev);
+   free_irq(irq, qtty);
 err_request_irq_failed:
goldfish_tty_current_line_count--;
if (goldfish_tty_current_line_count == 0)
-- 
2.11.0

[PATCH review for 4.4 45/47] i2c: meson: fix wrong variable usage in meson_i2c_put_data

[Levin, Alexander (Sasha Levin)]

From: Heiner Kallweit 

[ Upstream commit 3b0277f198ac928f323c42e180680d2f79aa980d ]

Most likely a copy & paste error.

Signed-off-by: Heiner Kallweit 
Acked-by: Jerome Brunet 
Signed-off-by: Wolfram Sang 
Fixes: 30021e3707a7 ("i2c: add support for Amlogic Meson I2C controller")
Signed-off-by: Sasha Levin 
---
 drivers/i2c/busses/i2c-meson.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
index 71d3929adf54..8d65f33af5da 100644
--- a/drivers/i2c/busses/i2c-meson.c
+++ b/drivers/i2c/busses/i2c-meson.c
@@ -175,7 +175,7 @@ static void meson_i2c_put_data(struct meson_i2c *i2c, char 
*buf, int len)
wdata1 |= *buf++ << ((i - 4) * 8);
 
writel(wdata0, i2c->regs + REG_TOK_WDATA0);
-   writel(wdata0, i2c->regs + REG_TOK_WDATA1);
+   writel(wdata1, i2c->regs + REG_TOK_WDATA1);
 
dev_dbg(i2c->dev, "%s: data %08x %08x len %d\n", __func__,
wdata0, wdata1, len);
-- 
2.11.0

[PATCH review for 4.4 44/47] md/raid10: submit bio directly to replacement disk

[Levin, Alexander (Sasha Levin)]

From: Shaohua Li 

[ Upstream commit 6d399783e9d4e9bd44931501948059d24ad96ff8 ]

Commit 57c67df(md/raid10: submit IO from originating thread instead of
md thread) submits bio directly for normal disks but not for replacement
disks. There is no point we shouldn't do this for replacement disks.

Cc: NeilBrown 
Signed-off-by: Shaohua Li 
Signed-off-by: Sasha Levin 
---
 drivers/md/raid10.c | 19 ---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index e5ee4e9e0ea5..a8a86d450d76 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1414,11 +1414,24 @@ retry_write:
mbio->bi_private = r10_bio;
 
atomic_inc(_bio->remaining);
+
+   cb = blk_check_plugged(raid10_unplug, mddev,
+  sizeof(*plug));
+   if (cb)
+   plug = container_of(cb, struct raid10_plug_cb,
+   cb);
+   else
+   plug = NULL;
spin_lock_irqsave(>device_lock, flags);
-   bio_list_add(>pending_bio_list, mbio);
-   conf->pending_count++;
+   if (plug) {
+   bio_list_add(>pending, mbio);
+   plug->pending_cnt++;
+   } else {
+   bio_list_add(>pending_bio_list, mbio);
+   conf->pending_count++;
+   }
spin_unlock_irqrestore(>device_lock, flags);
-   if (!mddev_check_plugged(mddev))
+   if (!plug)
md_wakeup_thread(mddev->thread);
}
}
-- 
2.11.0

[PATCH review for 3.18 10/30] IB/ipoib: Fix deadlock over vlan_mutex

[Levin, Alexander (Sasha Levin)]

From: Feras Daoud 

[ Upstream commit 1c3098cdb05207e740715857df7b0998e372f527 ]

This patch fixes Deadlock while executing ipoib_vlan_delete.

The function takes the vlan_rwsem semaphore and calls
unregister_netdevice. The later function calls
ipoib_mcast_stop_thread that cause workqueue flush.

When the queue has one of the ipoib_ib_dev_flush_xxx events,
a deadlock occur because these events also tries to catch the
same vlan_rwsem semaphore.

To fix, unregister_netdevice should be called after releasing
the semaphore.

Fixes: cbbe1efa4972 ("IPoIB: Fix deadlock between ipoib_open() and child 
interface create")
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Reviewed-by: Alex Vesker 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c 
b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index c995681befee..cae1b8223abe 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -187,7 +187,6 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned 
short pkey)
list_for_each_entry_safe(priv, tpriv, >child_intfs, list) {
if (priv->pkey == pkey &&
priv->child_type == IPOIB_LEGACY_CHILD) {
-   unregister_netdevice(priv->dev);
list_del(>list);
dev = priv->dev;
break;
@@ -195,6 +194,11 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned 
short pkey)
}
up_write(>vlan_rwsem);
 
+   if (dev) {
+   ipoib_dbg(ppriv, "delete child vlan %s\n", dev->name);
+   unregister_netdevice(dev);
+   }
+
rtnl_unlock();
 
if (dev) {
-- 
2.11.0

[PATCH review for 4.4 33/47] team: fix memory leaks

[Levin, Alexander (Sasha Levin)]

From: Pan Bian 

[ Upstream commit 72ec0bc64b9a5d8e0efcb717abfc757746b101b7 ]

In functions team_nl_send_port_list_get() and
team_nl_send_options_get(), pointer skb keeps the return value of
nlmsg_new(). When the call to genlmsg_put() fails, the memory is not
freed(). This will result in memory leak bugs.

Fixes: 9b00cf2d1024 ("team: implement multipart netlink messages for options 
transfers")
Signed-off-by: Pan Bian 
Acked-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/team/team.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index a5f392ae30d5..61cd53838360 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2343,8 +2343,10 @@ start_again:
 
hdr = genlmsg_put(skb, portid, seq, _nl_family, flags | 
NLM_F_MULTI,
  TEAM_CMD_OPTIONS_GET);
-   if (!hdr)
+   if (!hdr) {
+   nlmsg_free(skb);
return -EMSGSIZE;
+   }
 
if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
goto nla_put_failure;
@@ -2611,8 +2613,10 @@ start_again:
 
hdr = genlmsg_put(skb, portid, seq, _nl_family, flags | 
NLM_F_MULTI,
  TEAM_CMD_PORT_LIST_GET);
-   if (!hdr)
+   if (!hdr) {
+   nlmsg_free(skb);
return -EMSGSIZE;
+   }
 
if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
goto nla_put_failure;
-- 
2.11.0

[PATCH review for 4.4 29/47] ASoC: dapm: fix some pointer error handling

[Levin, Alexander (Sasha Levin)]

From: Linus Walleij 

[ Upstream commit 639467c8f26d834c934215e8b59129ce442475fe ]

commit 66feeec9322132689d42723df2537d60f96f8e44
"RFC: ASoC: dapm: handle probe deferrals"
forgot a to update some two sites where the call
was used. The static codechecks quickly found them.

Reported-by: Dan Carpenter 
Fixes: 66feeec93221 ("RFC: ASoC: dapm: handle probe deferrals")
Signed-off-by: Linus Walleij 
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin 
---
 sound/soc/soc-dapm.c | 20 
 1 file changed, 20 insertions(+)

diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index df036afb2197..6a438a361592 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3794,6 +3794,16 @@ int snd_soc_dapm_new_dai_widgets(struct 
snd_soc_dapm_context *dapm,
template.name);
 
w = snd_soc_dapm_new_control_unlocked(dapm, );
+   if (IS_ERR(w)) {
+   int ret = PTR_ERR(w);
+
+   /* Do not nag about probe deferrals */
+   if (ret != -EPROBE_DEFER)
+   dev_err(dapm->dev,
+   "ASoC: Failed to create %s widget (%d)\n",
+   dai->driver->playback.stream_name, ret);
+   return ret;
+   }
if (!w) {
dev_err(dapm->dev, "ASoC: Failed to create %s widget\n",
dai->driver->playback.stream_name);
@@ -3813,6 +3823,16 @@ int snd_soc_dapm_new_dai_widgets(struct 
snd_soc_dapm_context *dapm,
template.name);
 
w = snd_soc_dapm_new_control_unlocked(dapm, );
+   if (IS_ERR(w)) {
+   int ret = PTR_ERR(w);
+
+   /* Do not nag about probe deferrals */
+   if (ret != -EPROBE_DEFER)
+   dev_err(dapm->dev,
+   "ASoC: Failed to create %s widget (%d)\n",
+   dai->driver->playback.stream_name, ret);
+   return ret;
+   }
if (!w) {
dev_err(dapm->dev, "ASoC: Failed to create %s widget\n",
dai->driver->capture.stream_name);
-- 
2.11.0

[PATCH review for 4.4 26/47] ASoC: dapm: handle probe deferrals

[Levin, Alexander (Sasha Levin)]

From: Linus Walleij 

[ Upstream commit 37e1df8c95e2c8a57c77eafc097648f6e40a60ff ]

This starts to handle probe deferrals on regulators and clocks
on the ASoC DAPM.

I came to this patch after audio stopped working on Ux500 ages
ago and I finally looked into it to see what is wrong. I had
messages like this in the console since a while back:

ab8500-codec.0: ASoC: Failed to request audioclk: -517
ab8500-codec.0: ASoC: Failed to create DAPM control audioclk
ab8500-codec.0: Failed to create new controls -12
snd-soc-mop500.0: ASoC: failed to instantiate card -12
snd-soc-mop500.0: Error: snd_soc_register_card failed (-12)!
snd-soc-mop500: probe of snd-soc-mop500.0 failed with error -12

Apparently because the widget table for the codec looks like
this (sound/soc/codecs/ab8500-codec.c):

static const struct snd_soc_dapm_widget ab8500_dapm_widgets[] = {

/* Clocks */
SND_SOC_DAPM_CLOCK_SUPPLY("audioclk"),

/* Regulators */
SND_SOC_DAPM_REGULATOR_SUPPLY("V-AUD", 0, 0),
SND_SOC_DAPM_REGULATOR_SUPPLY("V-AMIC1", 0, 0),
SND_SOC_DAPM_REGULATOR_SUPPLY("V-AMIC2", 0, 0),
SND_SOC_DAPM_REGULATOR_SUPPLY("V-DMIC", 0, 0),

So when we call snd_soc_register_codec() and any of these widgets
get a deferred probe we do not get an -EPROBE_DEFER (-517) back as
we should and instead we just fail. Apparently the code assumes
that clocks and regulators must be available at this point and
not defer.

After this patch it rather looks like this:

ab8500-codec.0: Failed to create new controls -517
snd-soc-mop500.0: ASoC: failed to instantiate card -517
snd-soc-mop500.0: Error: snd_soc_register_card failed (-517)!
(...)
abx500-clk.0: registered clocks for ab850x
snd-soc-mop500.0: ab8500-codec-dai.0 <-> ux500-msp-i2s.1 mapping ok
snd-soc-mop500.0: ab8500-codec-dai.1 <-> ux500-msp-i2s.3 mapping ok

I'm pretty happy about the patch as it it, but I'm a bit
uncertain on how to proceed: there are a lot of users of the
external functions snd_soc_dapm_new_control() (111 sites)
and that will now return an occassional error pointer, which
is not handled in the calling sites.

I want an indication from the maintainers whether I should just
go in and augment all these call sites, or if deferred probe
is frowned upon when it leads to this much overhead.

Signed-off-by: Linus Walleij 
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin 
---
 sound/soc/soc-dapm.c | 42 ++
 sound/soc/soc-topology.c |  9 +
 2 files changed, 51 insertions(+)

diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index b8a256dfed7e..df036afb2197 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -358,6 +358,10 @@ static int dapm_kcontrol_data_alloc(struct 
snd_soc_dapm_widget *widget,
snd_soc_dapm_new_control_unlocked(widget->dapm,
);
kfree(name);
+   if (IS_ERR(data->widget)) {
+   ret = PTR_ERR(data->widget);
+   goto err_data;
+   }
if (!data->widget) {
ret = -ENOMEM;
goto err_data;
@@ -392,6 +396,10 @@ static int dapm_kcontrol_data_alloc(struct 
snd_soc_dapm_widget *widget,
data->widget = snd_soc_dapm_new_control_unlocked(
widget->dapm, );
kfree(name);
+   if (IS_ERR(data->widget)) {
+   ret = PTR_ERR(data->widget);
+   goto err_data;
+   }
if (!data->widget) {
ret = -ENOMEM;
goto err_data;
@@ -3278,11 +3286,22 @@ snd_soc_dapm_new_control(struct snd_soc_dapm_context 
*dapm,
 
mutex_lock_nested(>card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
w = snd_soc_dapm_new_control_unlocked(dapm, widget);
+   /* Do not nag about probe deferrals */
+   if (IS_ERR(w)) {
+   int ret = PTR_ERR(w);
+
+   if (ret != -EPROBE_DEFER)
+   dev_err(dapm->dev,
+   "ASoC: Failed to create DAPM control %s (%d)\n",
+   widget->name, ret);
+   goto out_unlock;
+   }
if (!w)
dev_err(dapm->dev,
"ASoC: Failed to create DAPM control %s\n",
widget->name);
 
+out_unlock:
mutex_unlock(>card->dapm_mutex);
return w;
 }
@@ -3304,6 +3323,8 @@ snd_soc_dapm_new_control_unlocked(struct 
snd_soc_dapm_context *dapm,
w->regulator = devm_regulator_get(dapm->dev, w->name);
if (IS_ERR(w->regulator)) {
 

[PATCH review for 4.4 38/47] MIPS: IRQ Stack: Unwind IRQ stack onto task stack

[Levin, Alexander (Sasha Levin)]

From: Matt Redfearn 

[ Upstream commit db8466c581cca1a08b505f1319c3ecd246f16fa8 ]

When the separate IRQ stack was introduced, stack unwinding only
proceeded as far as the top of the IRQ stack, leading to kernel
backtraces being less useful, lacking the trace of what was interrupted.

Fix this by providing a means for the kernel to unwind the IRQ stack
onto the interrupted task stack. The processor state is saved to the
kernel task stack on interrupt. The IRQ_STACK_START macro reserves an
unsigned long at the top of the IRQ stack where the interrupted task
stack pointer can be saved. After the active stack is switched to the
IRQ stack, save the interrupted tasks stack pointer to the reserved
location.

Fix the stack unwinding code to look for the frame being the top of the
IRQ stack and if so get the next frame from the saved location. The
existing test does not work with the separate stack since the ra is no
longer pointed at ret_from_{irq,exception}.

The test to stop unwinding the stack 32 bytes from the top of a stack
must be modified to allow unwinding to continue up to the location of
the saved task stack pointer when on the IRQ stack. The low / high marks
of the stack are set depending on whether the sp is on an irq stack or
not.

Signed-off-by: Matt Redfearn 
Cc: Paolo Bonzini 
Cc: Marcin Nowakowski 
Cc: Masanari Iida 
Cc: Chris Metcalf 
Cc: James Hogan 
Cc: Paul Burton 
Cc: Ingo Molnar 
Cc: Jason A. Donenfeld 
Cc: Andrew Morton 
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/15788/
Signed-off-by: Ralf Baechle 
Signed-off-by: Sasha Levin 
---
 arch/mips/include/asm/irq.h| 15 +++
 arch/mips/kernel/asm-offsets.c |  1 +
 arch/mips/kernel/genex.S   |  8 --
 arch/mips/kernel/process.c | 56 --
 4 files changed, 60 insertions(+), 20 deletions(-)

diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
index ebb9efb02502..77edb22f855d 100644
--- a/arch/mips/include/asm/irq.h
+++ b/arch/mips/include/asm/irq.h
@@ -18,9 +18,24 @@
 #include 
 
 #define IRQ_STACK_SIZE THREAD_SIZE
+#define IRQ_STACK_START(IRQ_STACK_SIZE - 
sizeof(unsigned long))
 
 extern void *irq_stack[NR_CPUS];
 
+/*
+ * The highest address on the IRQ stack contains a dummy frame put down in
+ * genex.S (handle_int & except_vec_vi_handler) which is structured as follows:
+ *
+ *   top 
+ *   | task sp  | <- irq_stack[cpu] + IRQ_STACK_START
+ *   
+ *   |  | <- First frame of IRQ context
+ *   
+ *
+ * task sp holds a copy of the task stack pointer where the struct pt_regs
+ * from exception entry can be found.
+ */
+
 static inline bool on_irq_stack(int cpu, unsigned long sp)
 {
unsigned long low = (unsigned long)irq_stack[cpu];
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index ec053ce7bb38..7ab8004c1659 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -102,6 +102,7 @@ void output_thread_info_defines(void)
DEFINE(_THREAD_SIZE, THREAD_SIZE);
DEFINE(_THREAD_MASK, THREAD_MASK);
DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
+   DEFINE(_IRQ_STACK_START, IRQ_STACK_START);
BLANK();
 }
 
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index 619e30e2c4f0..bb72f3ce7e29 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -216,9 +216,11 @@ NESTED(handle_int, PT_SIZE, sp)
beq t0, t1, 2f
 
/* Switch to IRQ stack */
-   li  t1, _IRQ_STACK_SIZE
+   li  t1, _IRQ_STACK_START
PTR_ADD sp, t0, t1
 
+   /* Save task's sp on IRQ stack so that unwinding can follow it */
+   LONG_S  s1, 0(sp)
 2:
jal plat_irq_dispatch
 
@@ -326,9 +328,11 @@ NESTED(except_vec_vi_handler, 0, sp)
beq t0, t1, 2f
 
/* Switch to IRQ stack */
-   li  t1, _IRQ_STACK_SIZE
+   li  t1, _IRQ_STACK_START
PTR_ADD sp, t0, t1
 
+   /* Save task's sp on IRQ stack so that unwinding can follow it */
+   LONG_S  s1, 0(sp)
 2:
jalrv0
 
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 8c26ecac930d..477ba026c3e5 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -483,31 +483,52 @@ unsigned long notrace unwind_stack_by_address(unsigned 
long stack_page,
  unsigned long pc,
  unsigned long *ra)
 {
+   unsigned long low, high, irq_stack_high;
struct 

[PATCH review for 4.4 25/47] partitions/efi: Fix integer overflow in GPT size calculation

[Levin, Alexander (Sasha Levin)]

From: Alden Tondettar 

[ Upstream commit c5082b70adfe8e1ea1cf4a8eff92c9f260e364d2 ]

If a GUID Partition Table claims to have more than 2**25 entries, the
calculation of the partition table size in alloc_read_gpt_entries() will
overflow a 32-bit integer and not enough space will be allocated for the
table.

Nothing seems to get written out of bounds, but later efi_partition() will
read up to 32768 bytes from a 128 byte buffer, possibly OOPSing or exposing
information to /proc/partitions and uevents.

The problem exists on both 64-bit and 32-bit platforms.

Fix the overflow and also print a meaningful debug message if the table
size is too large.

Signed-off-by: Alden Tondettar 
Acked-by: Ard Biesheuvel 
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin 
---
 block/partitions/efi.c | 17 -
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/block/partitions/efi.c b/block/partitions/efi.c
index 26cb624ace05..d26d0d27f5fd 100644
--- a/block/partitions/efi.c
+++ b/block/partitions/efi.c
@@ -293,7 +293,7 @@ static gpt_entry *alloc_read_gpt_entries(struct 
parsed_partitions *state,
if (!gpt)
return NULL;
 
-   count = le32_to_cpu(gpt->num_partition_entries) *
+   count = (size_t)le32_to_cpu(gpt->num_partition_entries) *
 le32_to_cpu(gpt->sizeof_partition_entry);
if (!count)
return NULL;
@@ -352,7 +352,7 @@ static int is_gpt_valid(struct parsed_partitions *state, 
u64 lba,
gpt_header **gpt, gpt_entry **ptes)
 {
u32 crc, origcrc;
-   u64 lastlba;
+   u64 lastlba, pt_size;
 
if (!ptes)
return 0;
@@ -434,13 +434,20 @@ static int is_gpt_valid(struct parsed_partitions *state, 
u64 lba,
goto fail;
}
 
+   /* Sanity check partition table size */
+   pt_size = (u64)le32_to_cpu((*gpt)->num_partition_entries) *
+   le32_to_cpu((*gpt)->sizeof_partition_entry);
+   if (pt_size > KMALLOC_MAX_SIZE) {
+   pr_debug("GUID Partition Table is too large: %llu > %lu 
bytes\n",
+(unsigned long long)pt_size, KMALLOC_MAX_SIZE);
+   goto fail;
+   }
+
if (!(*ptes = alloc_read_gpt_entries(state, *gpt)))
goto fail;
 
/* Check the GUID Partition Entry Array CRC */
-   crc = efi_crc32((const unsigned char *) (*ptes),
-   le32_to_cpu((*gpt)->num_partition_entries) *
-   le32_to_cpu((*gpt)->sizeof_partition_entry));
+   crc = efi_crc32((const unsigned char *) (*ptes), pt_size);
 
if (crc != le32_to_cpu((*gpt)->partition_entry_array_crc32)) {
pr_debug("GUID Partitition Entry Array CRC check failed.\n");
-- 
2.11.0

[PATCH review for 4.4 14/47] iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications

[Levin, Alexander (Sasha Levin)]

From: Hans de Goede 

[ Upstream commit fa2849e9649b5180ffc4cb3c3b005261c403093a ]

For some reason the axp288_adc driver was modifying the
AXP288_ADC_TS_PIN_CTRL register, changing bits 0-1 depending on
whether the GP_ADC channel or another channel was written.

These bits control when a bias current is send to the TS_PIN, the
GP_ADC has its own pin and a separate bit in another register to
control the bias current.

Not only does changing when to enable the TS_PIN bias current
(always or only when sampling) when reading the GP_ADC make no sense
at all, the code is modifying these bits is writing the entire register,
assuming that all the other bits have their default value.

So if the firmware has configured a different bias-current for either
pin, then that change gets clobbered by the write, likewise if the
firmware has set bit 2 to indicate that the battery has no thermal sensor,
this will get clobbered by the write.

This commit fixes all this, by simply removing all writes to the
AXP288_ADC_TS_PIN_CTRL register, they are not needed to read the
GP_ADC pin, and can actually be harmful.

Signed-off-by: Hans de Goede 
Acked-by: Chen-Yu Tsai 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin 
---
 drivers/iio/adc/axp288_adc.c | 32 +---
 1 file changed, 1 insertion(+), 31 deletions(-)

diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
index 0c904edd6c00..f684fe31f832 100644
--- a/drivers/iio/adc/axp288_adc.c
+++ b/drivers/iio/adc/axp288_adc.c
@@ -28,8 +28,6 @@
 #include 
 
 #define AXP288_ADC_EN_MASK 0xF1
-#define AXP288_ADC_TS_PIN_GPADC0xF2
-#define AXP288_ADC_TS_PIN_ON   0xF3
 
 enum axp288_adc_id {
AXP288_ADC_TS,
@@ -123,16 +121,6 @@ static int axp288_adc_read_channel(int *val, unsigned long 
address,
return IIO_VAL_INT;
 }
 
-static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
-   unsigned long address)
-{
-   /* channels other than GPADC do not need to switch TS pin */
-   if (address != AXP288_GP_ADC_H)
-   return 0;
-
-   return regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
-}
-
 static int axp288_adc_read_raw(struct iio_dev *indio_dev,
struct iio_chan_spec const *chan,
int *val, int *val2, long mask)
@@ -143,16 +131,7 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
mutex_lock(_dev->mlock);
switch (mask) {
case IIO_CHAN_INFO_RAW:
-   if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
-   chan->address)) {
-   dev_err(_dev->dev, "GPADC mode\n");
-   ret = -EINVAL;
-   break;
-   }
ret = axp288_adc_read_channel(val, chan->address, info->regmap);
-   if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
-   chan->address))
-   dev_err(_dev->dev, "TS pin restore\n");
break;
default:
ret = -EINVAL;
@@ -162,15 +141,6 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
return ret;
 }
 
-static int axp288_adc_set_state(struct regmap *regmap)
-{
-   /* ADC should be always enabled for internal FG to function */
-   if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
-   return -EIO;
-
-   return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
-}
-
 static const struct iio_info axp288_adc_iio_info = {
.read_raw = _adc_read_raw,
.driver_module = THIS_MODULE,
@@ -199,7 +169,7 @@ static int axp288_adc_probe(struct platform_device *pdev)
 * Set ADC to enabled state at all time, including system suspend.
 * otherwise internal fuel gauge functionality may be affected.
 */
-   ret = axp288_adc_set_state(axp20x->regmap);
+   ret = regmap_write(info->regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
if (ret) {
dev_err(>dev, "unable to enable ADC device\n");
return ret;
-- 
2.11.0

[PATCH review for 3.18 18/30] net: core: Prevent from dereferencing null pointer when releasing SKB

[Levin, Alexander (Sasha Levin)]

From: Myungho Jung 

[ Upstream commit 9899886d5e8ec5b343b1efe44f185a0e68dc6454 ]

Added NULL check to make __dev_kfree_skb_irq consistent with kfree
family of functions.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=195289

Signed-off-by: Myungho Jung 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/core/dev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index 22ad4e433b3a..21b0bd976699 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2225,6 +2225,9 @@ void __dev_kfree_skb_irq(struct sk_buff *skb, enum 
skb_free_reason reason)
 {
unsigned long flags;
 
+   if (unlikely(!skb))
+   return;
+
if (likely(atomic_read(>users) == 1)) {
smp_rmb();
atomic_set(>users, 0);
-- 
2.11.0

[PATCH review for 3.18 21/30] usb: plusb: Add support for PL-27A1

[Levin, Alexander (Sasha Levin)]

From: Roman Spychała 

[ Upstream commit 6f2aee0c0de6501bbc26fe50c9c7b09a37f7 ]

This patch adds support for the PL-27A1 by adding the appropriate
USB ID's. This chip is used in the goobay Active USB 3.0 Data Link
and Unitek Y-3501 cables.

Signed-off-by: Roman Spychała 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/usb/Kconfig |  2 +-
 drivers/net/usb/plusb.c | 15 +--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 37eed4d84e9c..bf7553ed73bc 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -350,7 +350,7 @@ config USB_NET_NET1080
  optionally with LEDs that indicate traffic
 
 config USB_NET_PLUSB
-   tristate "Prolific PL-2301/2302/25A1 based cables"
+   tristate "Prolific PL-2301/2302/25A1/27A1 based cables"
# if the handshake/init/reset problems, from original 'plusb',
# are ever resolved ... then remove "experimental"
depends on USB_USBNET
diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c
index 1bfe0fcaccf5..7c02231c1a1b 100644
--- a/drivers/net/usb/plusb.c
+++ b/drivers/net/usb/plusb.c
@@ -102,7 +102,7 @@ static int pl_reset(struct usbnet *dev)
 }
 
 static const struct driver_infoprolific_info = {
-   .description =  "Prolific PL-2301/PL-2302/PL-25A1",
+   .description =  "Prolific PL-2301/PL-2302/PL-25A1/PL-27A1",
.flags =FLAG_POINTTOPOINT | FLAG_NO_SETINT,
/* some PL-2302 versions seem to fail usb_set_interface() */
.reset =pl_reset,
@@ -139,6 +139,17 @@ static const struct usb_device_id  products [] = {
 * Host-to-Host Cable
 */
.driver_info =  (unsigned long) _info,
+
+},
+
+/* super speed cables */
+{
+   USB_DEVICE(0x067b, 0x27a1), /* PL-27A1, no eeprom
+* also: goobay Active USB 3.0
+* Data Link,
+* Unitek Y-3501
+*/
+   .driver_info =  (unsigned long) _info,
 },
 
{ },// END
@@ -158,5 +169,5 @@ static struct usb_driver plusb_driver = {
 module_usb_driver(plusb_driver);
 
 MODULE_AUTHOR("David Brownell");
-MODULE_DESCRIPTION("Prolific PL-2301/2302/25A1 USB Host to Host Link Driver");
+MODULE_DESCRIPTION("Prolific PL-2301/2302/25A1/27A1 USB Host to Host Link 
Driver");
 MODULE_LICENSE("GPL");
-- 
2.11.0

[PATCH review for 3.18 27/30] rds: ib: add error handle

[Levin, Alexander (Sasha Levin)]

From: Zhu Yanjun 

[ Upstream commit 3b12f73a5c2977153f28a224392fd4729b50d1dc ]

In the function rds_ib_setup_qp, the error handle is missing. When some
error occurs, it is possible that memory leak occurs. As such, error
handle is added.

Cc: Joe Jin 
Reviewed-by: Junxiao Bi 
Reviewed-by: Guanglei Li 
Signed-off-by: Zhu Yanjun 
Acked-by: Santosh Shilimkar 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/rds/ib_cm.c | 47 ---
 1 file changed, 36 insertions(+), 11 deletions(-)

diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 31b74f5e61ad..662122470bfa 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -298,7 +298,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
ret = PTR_ERR(ic->i_send_cq);
ic->i_send_cq = NULL;
rdsdebug("ib_create_cq send failed: %d\n", ret);
-   goto out;
+   goto rds_ibdev_out;
}
 
ic->i_recv_cq = ib_create_cq(dev, rds_ib_recv_cq_comp_handler,
@@ -308,19 +308,19 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
ret = PTR_ERR(ic->i_recv_cq);
ic->i_recv_cq = NULL;
rdsdebug("ib_create_cq recv failed: %d\n", ret);
-   goto out;
+   goto send_cq_out;
}
 
ret = ib_req_notify_cq(ic->i_send_cq, IB_CQ_NEXT_COMP);
if (ret) {
rdsdebug("ib_req_notify_cq send failed: %d\n", ret);
-   goto out;
+   goto recv_cq_out;
}
 
ret = ib_req_notify_cq(ic->i_recv_cq, IB_CQ_SOLICITED);
if (ret) {
rdsdebug("ib_req_notify_cq recv failed: %d\n", ret);
-   goto out;
+   goto recv_cq_out;
}
 
/* XXX negotiate max send/recv with remote? */
@@ -344,7 +344,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
ret = rdma_create_qp(ic->i_cm_id, ic->i_pd, );
if (ret) {
rdsdebug("rdma_create_qp failed: %d\n", ret);
-   goto out;
+   goto recv_cq_out;
}
 
ic->i_send_hdrs = ib_dma_alloc_coherent(dev,
@@ -354,7 +354,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_send_hdrs) {
ret = -ENOMEM;
rdsdebug("ib_dma_alloc_coherent send failed\n");
-   goto out;
+   goto qp_out;
}
 
ic->i_recv_hdrs = ib_dma_alloc_coherent(dev,
@@ -364,7 +364,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_recv_hdrs) {
ret = -ENOMEM;
rdsdebug("ib_dma_alloc_coherent recv failed\n");
-   goto out;
+   goto send_hdrs_dma_out;
}
 
ic->i_ack = ib_dma_alloc_coherent(dev, sizeof(struct rds_header),
@@ -372,7 +372,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_ack) {
ret = -ENOMEM;
rdsdebug("ib_dma_alloc_coherent ack failed\n");
-   goto out;
+   goto recv_hdrs_dma_out;
}
 
ic->i_sends = vzalloc_node(ic->i_send_ring.w_nr * sizeof(struct 
rds_ib_send_work),
@@ -380,7 +380,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_sends) {
ret = -ENOMEM;
rdsdebug("send allocation failed\n");
-   goto out;
+   goto ack_dma_out;
}
 
ic->i_recvs = vzalloc_node(ic->i_recv_ring.w_nr * sizeof(struct 
rds_ib_recv_work),
@@ -388,7 +388,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_recvs) {
ret = -ENOMEM;
rdsdebug("recv allocation failed\n");
-   goto out;
+   goto sends_out;
}
 
rds_ib_recv_init_ack(ic);
@@ -396,8 +396,33 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
rdsdebug("conn %p pd %p mr %p cq %p %p\n", conn, ic->i_pd, ic->i_mr,
 ic->i_send_cq, ic->i_recv_cq);
 
-out:
+   return ret;
+
+sends_out:
+   vfree(ic->i_sends);
+ack_dma_out:
+   ib_dma_free_coherent(dev, sizeof(struct rds_header),
+ic->i_ack, ic->i_ack_dma);
+recv_hdrs_dma_out:
+   ib_dma_free_coherent(dev, ic->i_recv_ring.w_nr *
+   sizeof(struct rds_header),
+   ic->i_recv_hdrs, ic->i_recv_hdrs_dma);
+send_hdrs_dma_out:
+   ib_dma_free_coherent(dev, ic->i_send_ring.w_nr *
+   sizeof(struct rds_header),
+   ic->i_send_hdrs, ic->i_send_hdrs_dma);
+qp_out:
+   rdma_destroy_qp(ic->i_cm_id);
+recv_cq_out:
+   if 

[PATCH review for 3.18 23/30] netfilter: invoke synchronize_rcu after set the _hook_ to NULL

[Levin, Alexander (Sasha Levin)]

From: Liping Zhang 

[ Upstream commit 3b7dabf029478bb80507a6c4500ca94132a2bc0b ]

Otherwise, another CPU may access the invalid pointer. For example:
CPU0CPU1
 -  rcu_read_lock();
 -  pfunc = _hook_;
  _hook_ = NULL;  -
  mod unload  -
 - pfunc(); // invalid, panic
 - rcu_read_unlock();

So we must call synchronize_rcu() to wait the rcu reader to finish.

Also note, in nf_nat_snmp_basic_fini, synchronize_rcu() will be invoked
by later nf_conntrack_helper_unregister, but I'm inclined to add a
explicit synchronize_rcu after set the nf_nat_snmp_hook to NULL. Depend
on such obscure assumptions is not a good idea.

Last, in nfnetlink_cttimeout, we use kfree_rcu to free the time object,
so in cttimeout_exit, invoking rcu_barrier() is not necessary at all,
remove it too.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Sasha Levin 
---
 net/ipv4/netfilter/nf_nat_snmp_basic.c | 1 +
 net/netfilter/nf_conntrack_ecache.c| 2 ++
 net/netfilter/nf_conntrack_netlink.c   | 1 +
 net/netfilter/nf_nat_core.c| 2 ++
 net/netfilter/nfnetlink_cttimeout.c| 1 +
 5 files changed, 7 insertions(+)

diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c 
b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 7c676671329d..cc626e1b06d3 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1304,6 +1304,7 @@ static int __init nf_nat_snmp_basic_init(void)
 static void __exit nf_nat_snmp_basic_fini(void)
 {
RCU_INIT_POINTER(nf_nat_snmp_hook, NULL);
+   synchronize_rcu();
nf_conntrack_helper_unregister(_trap_helper);
 }
 
diff --git a/net/netfilter/nf_conntrack_ecache.c 
b/net/netfilter/nf_conntrack_ecache.c
index 4e78c57b818f..f3b92ce463b0 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -200,6 +200,7 @@ void nf_conntrack_unregister_notifier(struct net *net,
BUG_ON(notify != new);
RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, NULL);
mutex_unlock(_ct_ecache_mutex);
+   /* synchronize_rcu() is called from ctnetlink_exit. */
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
 
@@ -236,6 +237,7 @@ void nf_ct_expect_unregister_notifier(struct net *net,
BUG_ON(notify != new);
RCU_INIT_POINTER(net->ct.nf_expect_event_cb, NULL);
mutex_unlock(_ct_ecache_mutex);
+   /* synchronize_rcu() is called from ctnetlink_exit. */
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);
 
diff --git a/net/netfilter/nf_conntrack_netlink.c 
b/net/netfilter/nf_conntrack_netlink.c
index 4aaf09be..de9ea452dd60 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3242,6 +3242,7 @@ static void __exit ctnetlink_exit(void)
 #ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT
RCU_INIT_POINTER(nfq_ct_hook, NULL);
 #endif
+   synchronize_rcu();
 }
 
 module_init(ctnetlink_init);
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 4e0b47831d43..56e175efb66e 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -888,6 +888,8 @@ static void __exit nf_nat_cleanup(void)
 #ifdef CONFIG_XFRM
RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL);
 #endif
+   synchronize_rcu();
+
for (i = 0; i < NFPROTO_NUMPROTO; i++)
kfree(nf_nat_l4protos[i]);
synchronize_net();
diff --git a/net/netfilter/nfnetlink_cttimeout.c 
b/net/netfilter/nfnetlink_cttimeout.c
index 476accd17145..3dfe3b7271e4 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -578,6 +578,7 @@ static void __exit cttimeout_exit(void)
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
+   synchronize_rcu();
 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 }
 
-- 
2.11.0

[PATCH review for 3.18 15/30] pinctrl: mvebu: Use seq_puts() in mvebu_pinconf_group_dbg_show()

[Levin, Alexander (Sasha Levin)]

From: Markus Elfring 

[ Upstream commit 420dc61642920849d824a0de2aa853db59f5244f ]

Strings which did not contain data format specifications should be put
into a sequence. Thus use the corresponding function "seq_puts".

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring 
Signed-off-by: Linus Walleij 
Signed-off-by: Sasha Levin 
---
 drivers/pinctrl/mvebu/pinctrl-mvebu.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/pinctrl/mvebu/pinctrl-mvebu.c 
b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
index f3b426cdaf8f..6e7b4b54c3bc 100644
--- a/drivers/pinctrl/mvebu/pinctrl-mvebu.c
+++ b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
@@ -195,11 +195,12 @@ static void mvebu_pinconf_group_dbg_show(struct 
pinctrl_dev *pctldev,
seq_printf(s, "o");
seq_printf(s, ")");
}
-   } else
-   seq_printf(s, "current: UNKNOWN");
+   } else {
+   seq_puts(s, "current: UNKNOWN");
+   }
 
if (grp->num_settings > 1) {
-   seq_printf(s, ", available = [");
+   seq_puts(s, ", available = [");
for (n = 0; n < grp->num_settings; n++) {
if (curr == >settings[n])
continue;
@@ -222,7 +223,7 @@ static void mvebu_pinconf_group_dbg_show(struct pinctrl_dev 
*pctldev,
seq_printf(s, ")");
}
}
-   seq_printf(s, " ]");
+   seq_puts(s, " ]");
}
return;
 }
-- 
2.11.0

[PATCH review for 3.18 22/30] mmc: sdio: fix alignment issue in struct sdio_func

[Levin, Alexander (Sasha Levin)]

From: Heiner Kallweit 

[ Upstream commit 5ef1ecf060f28ecef313b5723f1fd39bf5a35f56 ]

Certain 64-bit systems (e.g. Amlogic Meson GX) require buffers to be
used for DMA to be 8-byte-aligned. struct sdio_func has an embedded
small DMA buffer not meeting this requirement.
When testing switching to descriptor chain mode in meson-gx driver
SDIO is broken therefore. Fix this by allocating the small DMA buffer
separately as kmalloc ensures that the returned memory area is
properly aligned for every basic data type.

Signed-off-by: Heiner Kallweit 
Tested-by: Helmut Klein 
Signed-off-by: Ulf Hansson 
Signed-off-by: Sasha Levin 
---
 drivers/mmc/core/sdio_bus.c   | 12 +++-
 include/linux/mmc/sdio_func.h |  2 +-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
index 6da97b170563..8d246f815658 100644
--- a/drivers/mmc/core/sdio_bus.c
+++ b/drivers/mmc/core/sdio_bus.c
@@ -265,7 +265,7 @@ static void sdio_release_func(struct device *dev)
sdio_free_func_cis(func);
 
kfree(func->info);
-
+   kfree(func->tmpbuf);
kfree(func);
 }
 
@@ -280,6 +280,16 @@ struct sdio_func *sdio_alloc_func(struct mmc_card *card)
if (!func)
return ERR_PTR(-ENOMEM);
 
+   /*
+* allocate buffer separately to make sure it's properly aligned for
+* DMA usage (incl. 64 bit DMA)
+*/
+   func->tmpbuf = kmalloc(4, GFP_KERNEL);
+   if (!func->tmpbuf) {
+   kfree(func);
+   return ERR_PTR(-ENOMEM);
+   }
+
func->card = card;
 
device_initialize(>dev);
diff --git a/include/linux/mmc/sdio_func.h b/include/linux/mmc/sdio_func.h
index 50f0bc952328..2d6cc69db1fe 100644
--- a/include/linux/mmc/sdio_func.h
+++ b/include/linux/mmc/sdio_func.h
@@ -53,7 +53,7 @@ struct sdio_func {
unsigned intstate;  /* function state */
 #define SDIO_STATE_PRESENT (1<<0)  /* present in sysfs */
 
-   u8  tmpbuf[4];  /* DMA:able scratch buffer */
+   u8  *tmpbuf;/* DMA:able scratch buffer */
 
unsignednum_info;   /* number of info strings */
const char  **info; /* info strings */
-- 
2.11.0

[PATCH review for 3.18 05/30] sh_eth: use correct name for ECMR_MPDE bit

[Levin, Alexander (Sasha Levin)]

From: Niklas Söderlund 

[ Upstream commit 6dcf45e514974a1ff10755015b5e06746a033e5f ]

This bit was wrongly named due to a typo, Sergei checked the SH7734/63
manuals and this bit should be named MPDE.

Suggested-by: Sergei Shtylyov 
Signed-off-by: Niklas Söderlund 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/renesas/sh_eth.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/renesas/sh_eth.h 
b/drivers/net/ethernet/renesas/sh_eth.h
index 22301bf9c21d..be909fe4fc7a 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -326,7 +326,7 @@ enum FELIC_MODE_BIT {
ECMR_DPAD = 0x0020, ECMR_RZPF = 0x0010,
ECMR_ZPF = 0x0008, ECMR_PFR = 0x0004, ECMR_RXF = 0x0002,
ECMR_TXF = 0x0001, ECMR_MCT = 0x2000, ECMR_PRCEF = 0x1000,
-   ECMR_PMDE = 0x0200, ECMR_RE = 0x0040, ECMR_TE = 0x0020,
+   ECMR_MPDE = 0x0200, ECMR_RE = 0x0040, ECMR_TE = 0x0020,
ECMR_RTM = 0x0010, ECMR_ILB = 0x0008, ECMR_ELB = 0x0004,
ECMR_DM = 0x0002, ECMR_PRM = 0x0001,
 };
-- 
2.11.0

[PATCH review for 4.4 06/47] MIPS: Ensure bss section ends on a long-aligned address

[Levin, Alexander (Sasha Levin)]

From: Paul Burton 

[ Upstream commit 3f00f4d8f083bc61005d0a1ef592b149f5c88bbd ]

When clearing the .bss section in kernel_entry we do so using LONG_S
instructions, and branch whilst the current write address doesn't equal
the end of the .bss section minus the size of a long integer. The .bss
section always begins at a long-aligned address and we always increment
the write pointer by the size of a long integer - we therefore rely upon
the .bss section ending at a long-aligned address. If this is not the
case then the long-aligned write address can never be equal to the
non-long-aligned end address & we will continue to increment past the
end of the .bss section, attempting to zero the rest of memory.

Despite this requirement that .bss end at a long-aligned address we pass
0 as the end alignment requirement to the BSS_SECTION macro and thus
don't guarantee any particular alignment, allowing us to hit the error
condition described above.

Fix this by instead passing 8 bytes as the end alignment argument to
the BSS_SECTION macro, ensuring that the end of the .bss section is
always at least long-aligned.

Signed-off-by: Paul Burton 
Cc: linux-m...@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14526/
Signed-off-by: Ralf Baechle 
Signed-off-by: Sasha Levin 
---
 arch/mips/kernel/vmlinux.lds.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index 0a93e83cd014..2026203c41e2 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -159,7 +159,7 @@ SECTIONS
 * Force .bss to 64K alignment so that .bss..swapper_pg_dir
 * gets that alignment.  .sbss should be empty, so there will be
 * no holes after __init_end. */
-   BSS_SECTION(0, 0x1, 0)
+   BSS_SECTION(0, 0x1, 8)
 
_end = . ;
 
-- 
2.11.0

[PATCH review for 4.4 41/47] parisc: perf: Fix potential NULL pointer dereference

[Levin, Alexander (Sasha Levin)]

From: Arvind Yadav 

[ Upstream commit 74e3f6e63da6c8e8246fba1689e040bc926b4a1a ]

Fix potential NULL pointer dereference and clean up
coding style errors (code indent, trailing whitespaces).

Signed-off-by: Arvind Yadav 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin 
---
 arch/parisc/kernel/perf.c | 94 ---
 1 file changed, 49 insertions(+), 45 deletions(-)

diff --git a/arch/parisc/kernel/perf.c b/arch/parisc/kernel/perf.c
index 518f4f5f1f43..d63d42533133 100644
--- a/arch/parisc/kernel/perf.c
+++ b/arch/parisc/kernel/perf.c
@@ -39,7 +39,7 @@
  *  the PDC INTRIGUE calls.  This is done to eliminate bugs introduced
  *  in various PDC revisions.  The code is much more maintainable
  *  and reliable this way vs having to debug on every version of PDC
- *  on every box. 
+ *  on every box.
  */
 
 #include 
@@ -195,8 +195,8 @@ static int perf_config(uint32_t *image_ptr);
 static int perf_release(struct inode *inode, struct file *file);
 static int perf_open(struct inode *inode, struct file *file);
 static ssize_t perf_read(struct file *file, char __user *buf, size_t cnt, 
loff_t *ppos);
-static ssize_t perf_write(struct file *file, const char __user *buf, size_t 
count, 
-   loff_t *ppos);
+static ssize_t perf_write(struct file *file, const char __user *buf,
+   size_t count, loff_t *ppos);
 static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 static void perf_start_counters(void);
 static int perf_stop_counters(uint32_t *raddr);
@@ -222,7 +222,7 @@ extern void perf_intrigue_disable_perf_counters (void);
 /*
  * configure:
  *
- * Configure the cpu with a given data image.  First turn off the counters, 
+ * Configure the cpu with a given data image.  First turn off the counters,
  * then download the image, then turn the counters back on.
  */
 static int perf_config(uint32_t *image_ptr)
@@ -234,7 +234,7 @@ static int perf_config(uint32_t *image_ptr)
error = perf_stop_counters(raddr);
if (error != 0) {
printk("perf_config: perf_stop_counters = %ld\n", error);
-   return -EINVAL; 
+   return -EINVAL;
}
 
 printk("Preparing to write image\n");
@@ -242,7 +242,7 @@ printk("Preparing to write image\n");
error = perf_write_image((uint64_t *)image_ptr);
if (error != 0) {
printk("perf_config: DOWNLOAD = %ld\n", error);
-   return -EINVAL; 
+   return -EINVAL;
}
 
 printk("Preparing to start counters\n");
@@ -254,7 +254,7 @@ printk("Preparing to start counters\n");
 }
 
 /*
- * Open the device and initialize all of its memory.  The device is only 
+ * Open the device and initialize all of its memory.  The device is only
  * opened once, but can be "queried" by multiple processes that know its
  * file descriptor.
  */
@@ -298,8 +298,8 @@ static ssize_t perf_read(struct file *file, char __user 
*buf, size_t cnt, loff_t
  * called on the processor that the download should happen
  * on.
  */
-static ssize_t perf_write(struct file *file, const char __user *buf, size_t 
count, 
-   loff_t *ppos)
+static ssize_t perf_write(struct file *file, const char __user *buf,
+   size_t count, loff_t *ppos)
 {
int err;
size_t image_size;
@@ -307,11 +307,11 @@ static ssize_t perf_write(struct file *file, const char 
__user *buf, size_t coun
uint32_t interface_type;
uint32_t test;
 
-   if (perf_processor_interface == ONYX_INTF) 
+   if (perf_processor_interface == ONYX_INTF)
image_size = PCXU_IMAGE_SIZE;
-   else if (perf_processor_interface == CUDA_INTF) 
+   else if (perf_processor_interface == CUDA_INTF)
image_size = PCXW_IMAGE_SIZE;
-   else 
+   else
return -EFAULT;
 
if (!capable(CAP_SYS_ADMIN))
@@ -331,22 +331,22 @@ static ssize_t perf_write(struct file *file, const char 
__user *buf, size_t coun
 
/* First check the machine type is correct for
   the requested image */
-if (((perf_processor_interface == CUDA_INTF) &&
-  (interface_type != CUDA_INTF)) ||
-   ((perf_processor_interface == ONYX_INTF) &&
-  (interface_type != ONYX_INTF))) 
+   if (((perf_processor_interface == CUDA_INTF) &&
+   (interface_type != CUDA_INTF)) ||
+   ((perf_processor_interface == ONYX_INTF) &&
+   (interface_type != ONYX_INTF)))
return -EINVAL;
 
/* Next check to make sure the requested image
   is valid */
-   if (((interface_type == CUDA_INTF) && 
+   if (((interface_type == CUDA_INTF) &&
   (test >= MAX_CUDA_IMAGES)) ||
-   ((interface_type == ONYX_INTF) && 
-  (test >= MAX_ONYX_IMAGES))) 
+   

[PATCH review for 4.4 31/47] net: core: Prevent from dereferencing null pointer when releasing SKB

[Levin, Alexander (Sasha Levin)]

From: Myungho Jung 

[ Upstream commit 9899886d5e8ec5b343b1efe44f185a0e68dc6454 ]

Added NULL check to make __dev_kfree_skb_irq consistent with kfree
family of functions.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=195289

Signed-off-by: Myungho Jung 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/core/dev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index 24d243084aab..dac52fa60f25 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2338,6 +2338,9 @@ void __dev_kfree_skb_irq(struct sk_buff *skb, enum 
skb_free_reason reason)
 {
unsigned long flags;
 
+   if (unlikely(!skb))
+   return;
+
if (likely(atomic_read(>users) == 1)) {
smp_rmb();
atomic_set(>users, 0);
-- 
2.11.0

[PATCH review for 4.4 34/47] usb: plusb: Add support for PL-27A1

[Levin, Alexander (Sasha Levin)]

From: Roman Spychała 

[ Upstream commit 6f2aee0c0de6501bbc26fe50c9c7b09a37f7 ]

This patch adds support for the PL-27A1 by adding the appropriate
USB ID's. This chip is used in the goobay Active USB 3.0 Data Link
and Unitek Y-3501 cables.

Signed-off-by: Roman Spychała 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/usb/Kconfig |  2 +-
 drivers/net/usb/plusb.c | 15 +--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 7f83504dfa69..1f6893ebce16 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -364,7 +364,7 @@ config USB_NET_NET1080
  optionally with LEDs that indicate traffic
 
 config USB_NET_PLUSB
-   tristate "Prolific PL-2301/2302/25A1 based cables"
+   tristate "Prolific PL-2301/2302/25A1/27A1 based cables"
# if the handshake/init/reset problems, from original 'plusb',
# are ever resolved ... then remove "experimental"
depends on USB_USBNET
diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c
index 1bfe0fcaccf5..7c02231c1a1b 100644
--- a/drivers/net/usb/plusb.c
+++ b/drivers/net/usb/plusb.c
@@ -102,7 +102,7 @@ static int pl_reset(struct usbnet *dev)
 }
 
 static const struct driver_infoprolific_info = {
-   .description =  "Prolific PL-2301/PL-2302/PL-25A1",
+   .description =  "Prolific PL-2301/PL-2302/PL-25A1/PL-27A1",
.flags =FLAG_POINTTOPOINT | FLAG_NO_SETINT,
/* some PL-2302 versions seem to fail usb_set_interface() */
.reset =pl_reset,
@@ -139,6 +139,17 @@ static const struct usb_device_id  products [] = {
 * Host-to-Host Cable
 */
.driver_info =  (unsigned long) _info,
+
+},
+
+/* super speed cables */
+{
+   USB_DEVICE(0x067b, 0x27a1), /* PL-27A1, no eeprom
+* also: goobay Active USB 3.0
+* Data Link,
+* Unitek Y-3501
+*/
+   .driver_info =  (unsigned long) _info,
 },
 
{ },// END
@@ -158,5 +169,5 @@ static struct usb_driver plusb_driver = {
 module_usb_driver(plusb_driver);
 
 MODULE_AUTHOR("David Brownell");
-MODULE_DESCRIPTION("Prolific PL-2301/2302/25A1 USB Host to Host Link Driver");
+MODULE_DESCRIPTION("Prolific PL-2301/2302/25A1/27A1 USB Host to Host Link 
Driver");
 MODULE_LICENSE("GPL");
-- 
2.11.0

[PATCH review for 3.18 03/30] MIPS: Ensure bss section ends on a long-aligned address

[Levin, Alexander (Sasha Levin)]

From: Paul Burton 

[ Upstream commit 3f00f4d8f083bc61005d0a1ef592b149f5c88bbd ]

When clearing the .bss section in kernel_entry we do so using LONG_S
instructions, and branch whilst the current write address doesn't equal
the end of the .bss section minus the size of a long integer. The .bss
section always begins at a long-aligned address and we always increment
the write pointer by the size of a long integer - we therefore rely upon
the .bss section ending at a long-aligned address. If this is not the
case then the long-aligned write address can never be equal to the
non-long-aligned end address & we will continue to increment past the
end of the .bss section, attempting to zero the rest of memory.

Despite this requirement that .bss end at a long-aligned address we pass
0 as the end alignment requirement to the BSS_SECTION macro and thus
don't guarantee any particular alignment, allowing us to hit the error
condition described above.

Fix this by instead passing 8 bytes as the end alignment argument to
the BSS_SECTION macro, ensuring that the end of the .bss section is
always at least long-aligned.

Signed-off-by: Paul Burton 
Cc: linux-m...@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14526/
Signed-off-by: Ralf Baechle 
Signed-off-by: Sasha Levin 
---
 arch/mips/kernel/vmlinux.lds.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index 3b46f7ce9ca7..77733b403c09 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -141,7 +141,7 @@ SECTIONS
 * Force .bss to 64K alignment so that .bss..swapper_pg_dir
 * gets that alignment.  .sbss should be empty, so there will be
 * no holes after __init_end. */
-   BSS_SECTION(0, 0x1, 0)
+   BSS_SECTION(0, 0x1, 8)
 
_end = . ;
 
-- 
2.11.0

[PATCH review for 4.4 23/47] USB: serial: mos7840: fix control-message error handling

[Levin, Alexander (Sasha Levin)]

From: Johan Hovold 

[ Upstream commit cd8db057e93ddaacbec025b567490555d2bca280 ]

Make sure to detect short transfers when reading a device register.

The modem-status handling had sufficient error checks in place, but move
handling of short transfers into the register accessor function itself
for consistency.

Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: Johan Hovold 
Signed-off-by: Sasha Levin 
---
 drivers/usb/serial/mos7840.c | 19 +++
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index d17685cc00c9..ed883a7ad533 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -285,9 +285,15 @@ static int mos7840_get_reg_sync(struct usb_serial_port 
*port, __u16 reg,
ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
  MCS_RD_RTYPE, 0, reg, buf, VENDOR_READ_LENGTH,
  MOS_WDR_TIMEOUT);
+   if (ret < VENDOR_READ_LENGTH) {
+   if (ret >= 0)
+   ret = -EIO;
+   goto out;
+   }
+
*val = buf[0];
dev_dbg(>dev, "%s offset is %x, return val %x\n", __func__, reg, 
*val);
-
+out:
kfree(buf);
return ret;
 }
@@ -353,8 +359,13 @@ static int mos7840_get_uart_reg(struct usb_serial_port 
*port, __u16 reg,
ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
  MCS_RD_RTYPE, Wval, reg, buf, VENDOR_READ_LENGTH,
  MOS_WDR_TIMEOUT);
+   if (ret < VENDOR_READ_LENGTH) {
+   if (ret >= 0)
+   ret = -EIO;
+   goto out;
+   }
*val = buf[0];
-
+out:
kfree(buf);
return ret;
 }
@@ -1490,10 +1501,10 @@ static int mos7840_tiocmget(struct tty_struct *tty)
return -ENODEV;
 
status = mos7840_get_uart_reg(port, MODEM_STATUS_REGISTER, );
-   if (status != 1)
+   if (status < 0)
return -EIO;
status = mos7840_get_uart_reg(port, MODEM_CONTROL_REGISTER, );
-   if (status != 1)
+   if (status < 0)
return -EIO;
result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)
| ((mcr & MCR_RTS) ? TIOCM_RTS : 0)
-- 
2.11.0

[PATCH review for 4.4 24/47] pinctrl: mvebu: Use seq_puts() in mvebu_pinconf_group_dbg_show()

[Levin, Alexander (Sasha Levin)]

From: Markus Elfring 

[ Upstream commit 420dc61642920849d824a0de2aa853db59f5244f ]

Strings which did not contain data format specifications should be put
into a sequence. Thus use the corresponding function "seq_puts".

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring 
Signed-off-by: Linus Walleij 
Signed-off-by: Sasha Levin 
---
 drivers/pinctrl/mvebu/pinctrl-mvebu.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/pinctrl/mvebu/pinctrl-mvebu.c 
b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
index 77d2221d379d..076c2ee2ff70 100644
--- a/drivers/pinctrl/mvebu/pinctrl-mvebu.c
+++ b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
@@ -195,11 +195,12 @@ static void mvebu_pinconf_group_dbg_show(struct 
pinctrl_dev *pctldev,
seq_printf(s, "o");
seq_printf(s, ")");
}
-   } else
-   seq_printf(s, "current: UNKNOWN");
+   } else {
+   seq_puts(s, "current: UNKNOWN");
+   }
 
if (grp->num_settings > 1) {
-   seq_printf(s, ", available = [");
+   seq_puts(s, ", available = [");
for (n = 0; n < grp->num_settings; n++) {
if (curr == >settings[n])
continue;
@@ -222,7 +223,7 @@ static void mvebu_pinconf_group_dbg_show(struct pinctrl_dev 
*pctldev,
seq_printf(s, ")");
}
}
-   seq_printf(s, " ]");
+   seq_puts(s, " ]");
}
return;
 }
-- 
2.11.0

[PATCH review for 4.4 40/47] netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max

[Levin, Alexander (Sasha Levin)]

From: Liping Zhang 

[ Upstream commit ae5c682113f9f94cc5e76f92cf041ee624c173ee ]

The helper->expect_class_max must be set to the total number of
expect_policy minus 1, since we will use the statement "if (class >
helper->expect_class_max)" to validate the CTA_EXPECT_CLASS attr in
ctnetlink_alloc_expect.

So for compatibility, set the helper->expect_class_max to the
NFCTH_POLICY_SET_NUM attr's value minus 1.

Also: it's invalid when the NFCTH_POLICY_SET_NUM attr's value is zero.
1. this will result "expect_policy = kzalloc(0, GFP_KERNEL);";
2. we cannot set the helper->expect_class_max to a proper value.

So if nla_get_be32(tb[NFCTH_POLICY_SET_NUM]) is zero, report -EINVAL to
the userspace.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Sasha Levin 
---
 net/netfilter/nfnetlink_cthelper.c | 20 +++-
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/net/netfilter/nfnetlink_cthelper.c 
b/net/netfilter/nfnetlink_cthelper.c
index 54330fb5efaf..6d10002d23f8 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -161,6 +161,7 @@ nfnl_cthelper_parse_expect_policy(struct 
nf_conntrack_helper *helper,
int i, ret;
struct nf_conntrack_expect_policy *expect_policy;
struct nlattr *tb[NFCTH_POLICY_SET_MAX+1];
+   unsigned int class_max;
 
ret = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
   nfnl_cthelper_expect_policy_set);
@@ -170,19 +171,18 @@ nfnl_cthelper_parse_expect_policy(struct 
nf_conntrack_helper *helper,
if (!tb[NFCTH_POLICY_SET_NUM])
return -EINVAL;
 
-   helper->expect_class_max =
-   ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
-
-   if (helper->expect_class_max != 0 &&
-   helper->expect_class_max > NF_CT_MAX_EXPECT_CLASSES)
+   class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
+   if (class_max == 0)
+   return -EINVAL;
+   if (class_max > NF_CT_MAX_EXPECT_CLASSES)
return -EOVERFLOW;
 
expect_policy = kzalloc(sizeof(struct nf_conntrack_expect_policy) *
-   helper->expect_class_max, GFP_KERNEL);
+   class_max, GFP_KERNEL);
if (expect_policy == NULL)
return -ENOMEM;
 
-   for (i=0; iexpect_class_max; i++) {
+   for (i = 0; i < class_max; i++) {
if (!tb[NFCTH_POLICY_SET+i])
goto err;
 
@@ -191,6 +191,8 @@ nfnl_cthelper_parse_expect_policy(struct 
nf_conntrack_helper *helper,
if (ret < 0)
goto err;
}
+
+   helper->expect_class_max = class_max - 1;
helper->expect_policy = expect_policy;
return 0;
 err:
@@ -377,10 +379,10 @@ nfnl_cthelper_dump_policy(struct sk_buff *skb,
goto nla_put_failure;
 
if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM,
-htonl(helper->expect_class_max)))
+htonl(helper->expect_class_max + 1)))
goto nla_put_failure;
 
-   for (i=0; iexpect_class_max; i++) {
+   for (i = 0; i < helper->expect_class_max + 1; i++) {
nest_parms2 = nla_nest_start(skb,
(NFCTH_POLICY_SET+i) | NLA_F_NESTED);
if (nest_parms2 == NULL)
-- 
2.11.0

[PATCH review for 4.4 16/47] ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM

[Levin, Alexander (Sasha Levin)]

From: Afzal Mohammed 

[ Upstream commit 8a792e9afbce84a0fdaf213fe42bb97382487094 ]

REMAP_VECTORS_TO_RAM depends on DRAM_BASE, but since DRAM_BASE is a
hex, REMAP_VECTORS_TO_RAM could never get enabled. Also depending on
DRAM_BASE is redundant as whenever REMAP_VECTORS_TO_RAM makes itself
available to Kconfig, DRAM_BASE also is available as the Kconfig
gets sourced on !MMU.

Signed-off-by: Afzal Mohammed 
Reviewed-by: Vladimir Murzin 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin 
---
 arch/arm/Kconfig-nommu | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm/Kconfig-nommu b/arch/arm/Kconfig-nommu
index aed66d5df7f1..b7576349528c 100644
--- a/arch/arm/Kconfig-nommu
+++ b/arch/arm/Kconfig-nommu
@@ -34,8 +34,7 @@ config PROCESSOR_ID
  used instead of the auto-probing which utilizes the register.
 
 config REMAP_VECTORS_TO_RAM
-   bool 'Install vectors to the beginning of RAM' if DRAM_BASE
-   depends on DRAM_BASE
+   bool 'Install vectors to the beginning of RAM'
help
  The kernel needs to change the hardware exception vectors.
  In nommu mode, the hardware exception vectors are normally
-- 
2.11.0

[PATCH review for 4.4 37/47] netfilter: invoke synchronize_rcu after set the _hook_ to NULL

[Levin, Alexander (Sasha Levin)]

From: Liping Zhang 

[ Upstream commit 3b7dabf029478bb80507a6c4500ca94132a2bc0b ]

Otherwise, another CPU may access the invalid pointer. For example:
CPU0CPU1
 -  rcu_read_lock();
 -  pfunc = _hook_;
  _hook_ = NULL;  -
  mod unload  -
 - pfunc(); // invalid, panic
 - rcu_read_unlock();

So we must call synchronize_rcu() to wait the rcu reader to finish.

Also note, in nf_nat_snmp_basic_fini, synchronize_rcu() will be invoked
by later nf_conntrack_helper_unregister, but I'm inclined to add a
explicit synchronize_rcu after set the nf_nat_snmp_hook to NULL. Depend
on such obscure assumptions is not a good idea.

Last, in nfnetlink_cttimeout, we use kfree_rcu to free the time object,
so in cttimeout_exit, invoking rcu_barrier() is not necessary at all,
remove it too.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Sasha Levin 
---
 net/ipv4/netfilter/nf_nat_snmp_basic.c | 1 +
 net/netfilter/nf_conntrack_ecache.c| 2 ++
 net/netfilter/nf_conntrack_netlink.c   | 1 +
 net/netfilter/nf_nat_core.c| 2 ++
 net/netfilter/nfnetlink_cttimeout.c| 2 +-
 5 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c 
b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index ddb894ac1458..2689c9c4f1a0 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1304,6 +1304,7 @@ static int __init nf_nat_snmp_basic_init(void)
 static void __exit nf_nat_snmp_basic_fini(void)
 {
RCU_INIT_POINTER(nf_nat_snmp_hook, NULL);
+   synchronize_rcu();
nf_conntrack_helper_unregister(_trap_helper);
 }
 
diff --git a/net/netfilter/nf_conntrack_ecache.c 
b/net/netfilter/nf_conntrack_ecache.c
index 4e78c57b818f..f3b92ce463b0 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -200,6 +200,7 @@ void nf_conntrack_unregister_notifier(struct net *net,
BUG_ON(notify != new);
RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, NULL);
mutex_unlock(_ct_ecache_mutex);
+   /* synchronize_rcu() is called from ctnetlink_exit. */
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
 
@@ -236,6 +237,7 @@ void nf_ct_expect_unregister_notifier(struct net *net,
BUG_ON(notify != new);
RCU_INIT_POINTER(net->ct.nf_expect_event_cb, NULL);
mutex_unlock(_ct_ecache_mutex);
+   /* synchronize_rcu() is called from ctnetlink_exit. */
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);
 
diff --git a/net/netfilter/nf_conntrack_netlink.c 
b/net/netfilter/nf_conntrack_netlink.c
index e565b2becb14..660939df7c94 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3415,6 +3415,7 @@ static void __exit ctnetlink_exit(void)
 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
RCU_INIT_POINTER(nfnl_ct_hook, NULL);
 #endif
+   synchronize_rcu();
 }
 
 module_init(ctnetlink_init);
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 06a9f45771ab..44516c90118a 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -892,6 +892,8 @@ static void __exit nf_nat_cleanup(void)
 #ifdef CONFIG_XFRM
RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL);
 #endif
+   synchronize_rcu();
+
for (i = 0; i < NFPROTO_NUMPROTO; i++)
kfree(nf_nat_l4protos[i]);
synchronize_net();
diff --git a/net/netfilter/nfnetlink_cttimeout.c 
b/net/netfilter/nfnetlink_cttimeout.c
index c7a2d0e1c462..ed9153bd7e73 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -611,8 +611,8 @@ static void __exit cttimeout_exit(void)
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
+   synchronize_rcu();
 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-   rcu_barrier();
 }
 
 module_init(cttimeout_init);
-- 
2.11.0

[PATCH review for 4.4 08/47] MIPS: ralink: Fix incorrect assignment on ralink_soc

[Levin, Alexander (Sasha Levin)]

From: Colin Ian King 

[ Upstream commit 08d90c81b714482dceb5323d14f6617bcf55ee61 ]

ralink_soc sould be assigned to RT3883_SOC, replace incorrect
comparision with assignment.

Signed-off-by: Colin Ian King 
Fixes: 418d29c87061 ("MIPS: ralink: Unify SoC id handling")
Cc: John Crispin 
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14903/
Signed-off-by: Ralf Baechle 
Signed-off-by: Sasha Levin 
---
 arch/mips/ralink/rt3883.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/ralink/rt3883.c b/arch/mips/ralink/rt3883.c
index 3c575093f8f1..f2a6e1b8cce0 100644
--- a/arch/mips/ralink/rt3883.c
+++ b/arch/mips/ralink/rt3883.c
@@ -144,5 +144,5 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
 
rt2880_pinmux_data = rt3883_pinmux_data;
 
-   ralink_soc == RT3883_SOC;
+   ralink_soc = RT3883_SOC;
 }
-- 
2.11.0

[PATCH review for 4.4 05/47] ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes

[Levin, Alexander (Sasha Levin)]

From: Simon Horman 

[ Upstream commit 654450baf2afba86cf328e1849ccac61ec4630af ]

Use recently added R-Car Gen 2 fallback binding for msiof nodes in
DT for r8a7790 SoC.

This has no run-time effect for the current driver as the initialisation
sequence is the same for the SoC-specific binding for r8a7790 and the
fallback binding for R-Car Gen 2.

Signed-off-by: Simon Horman 
Reviewed-by: Geert Uytterhoeven 
Signed-off-by: Sasha Levin 
---
 arch/arm/boot/dts/r8a7790.dtsi | 12 
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi
index e07ae5d45e19..7b39d8fae61e 100644
--- a/arch/arm/boot/dts/r8a7790.dtsi
+++ b/arch/arm/boot/dts/r8a7790.dtsi
@@ -1409,7 +1409,8 @@
};
 
msiof0: spi@e6e2 {
-   compatible = "renesas,msiof-r8a7790";
+   compatible = "renesas,msiof-r8a7790",
+"renesas,rcar-gen2-msiof";
reg = <0 0xe6e2 0 0x0064>;
interrupts = <0 156 IRQ_TYPE_LEVEL_HIGH>;
clocks = <_clks R8A7790_CLK_MSIOF0>;
@@ -1422,7 +1423,8 @@
};
 
msiof1: spi@e6e1 {
-   compatible = "renesas,msiof-r8a7790";
+   compatible = "renesas,msiof-r8a7790",
+"renesas,rcar-gen2-msiof";
reg = <0 0xe6e1 0 0x0064>;
interrupts = <0 157 IRQ_TYPE_LEVEL_HIGH>;
clocks = <_clks R8A7790_CLK_MSIOF1>;
@@ -1435,7 +1437,8 @@
};
 
msiof2: spi@e6e0 {
-   compatible = "renesas,msiof-r8a7790";
+   compatible = "renesas,msiof-r8a7790",
+"renesas,rcar-gen2-msiof";
reg = <0 0xe6e0 0 0x0064>;
interrupts = <0 158 IRQ_TYPE_LEVEL_HIGH>;
clocks = <_clks R8A7790_CLK_MSIOF2>;
@@ -1448,7 +1451,8 @@
};
 
msiof3: spi@e6c9 {
-   compatible = "renesas,msiof-r8a7790";
+   compatible = "renesas,msiof-r8a7790",
+"renesas,rcar-gen2-msiof";
reg = <0 0xe6c9 0 0x0064>;
interrupts = <0 159 IRQ_TYPE_LEVEL_HIGH>;
clocks = <_clks R8A7790_CLK_MSIOF3>;
-- 
2.11.0

[PATCH review for 4.4 19/47] IB/ipoib: rtnl_unlock can not come after free_netdev

[Levin, Alexander (Sasha Levin)]

From: Feras Daoud 

[ Upstream commit 89a3987ab7a923c047c6dec008e60ad6f41fac22 ]

The ipoib_vlan_add function calls rtnl_unlock after free_netdev,
rtnl_unlock not only releases the lock, but also calls netdev_run_todo.
The latter function browses the net_todo_list array and completes the
unregistration of all its net_device instances. If we call free_netdev
before rtnl_unlock, then netdev_run_todo call over the freed device causes
panic.
To fix, move rtnl_unlock call before free_netdev call.

Fixes: 9baa0b036410 ("IB/ipoib: Add rtnl_link_ops support")
Cc: Or Gerlitz 
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Reviewed-by: Yuval Shaia 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c 
b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 3a647fd50f09..9b47a437d6c9 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -160,11 +160,11 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned 
short pkey)
 out:
up_write(>vlan_rwsem);
 
+   rtnl_unlock();
+
if (result)
free_netdev(priv->dev);
 
-   rtnl_unlock();
-
return result;
 }
 
-- 
2.11.0

[PATCH review for 4.4 15/47] iio: adc: hx711: Add DT binding for avia,hx711

[Levin, Alexander (Sasha Levin)]

From: Andreas Klinger 

[ Upstream commit ff1293f67734da68e23fecb6ecdae7112b8c43f9 ]

Add DT bindings for avia,hx711
Add vendor avia to vendor list

Signed-off-by: Andreas Klinger 
Acked-by: Rob Herring 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin 
---
 .../devicetree/bindings/iio/adc/avia-hx711.txt | 18 ++
 Documentation/devicetree/bindings/vendor-prefixes.txt  |  1 +
 2 files changed, 19 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/iio/adc/avia-hx711.txt

diff --git a/Documentation/devicetree/bindings/iio/adc/avia-hx711.txt 
b/Documentation/devicetree/bindings/iio/adc/avia-hx711.txt
new file mode 100644
index ..b3629405f568
--- /dev/null
+++ b/Documentation/devicetree/bindings/iio/adc/avia-hx711.txt
@@ -0,0 +1,18 @@
+* AVIA HX711 ADC chip for weight cells
+  Bit-banging driver
+
+Required properties:
+ - compatible: Should be "avia,hx711"
+ - sck-gpios:  Definition of the GPIO for the clock
+ - dout-gpios: Definition of the GPIO for data-out
+   See Documentation/devicetree/bindings/gpio/gpio.txt
+ - avdd-supply:Definition of the regulator used as analog supply
+
+Example:
+weight@0 {
+   compatible = "avia,hx711";
+   sck-gpios = < 10 GPIO_ACTIVE_HIGH>;
+   dout-gpios = < 7 GPIO_ACTIVE_HIGH>;
+   avdd-suppy = <>;
+};
+
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt 
b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 55df1d444e9f..98dc17507a84 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -31,6 +31,7 @@ asahi-kasei   Asahi Kasei Corp.
 atmel  Atmel Corporation
 auoAU Optronics Corporation
 avago  Avago Technologies
+avia   avia semiconductor
 avic   Shanghai AVIC Optoelectronics Co., Ltd.
 axis   Axis Communications AB
 bosch  Bosch Sensortec GmbH
-- 
2.11.0

[PATCH review for 4.4 13/47] hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes

[Levin, Alexander (Sasha Levin)]

From: Guenter Roeck 

[ Upstream commit 87cdfa9d60f4f40e6d71b04b10b36d9df3c89282 ]

Writes into limit attributes can overflow due to multplications and
additions with unbound input values. Writing into fan limit attributes
can result in a crash with a division by zero if very large values are
written and the fan divider is larger than 1.

Signed-off-by: Guenter Roeck 
Signed-off-by: Sasha Levin 
---
 drivers/hwmon/gl520sm.c | 25 -
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/drivers/hwmon/gl520sm.c b/drivers/hwmon/gl520sm.c
index dee93ec87d02..84e0994aafdd 100644
--- a/drivers/hwmon/gl520sm.c
+++ b/drivers/hwmon/gl520sm.c
@@ -208,11 +208,13 @@ static ssize_t get_cpu_vid(struct device *dev, struct 
device_attribute *attr,
 }
 static DEVICE_ATTR(cpu0_vid, S_IRUGO, get_cpu_vid, NULL);
 
-#define VDD_FROM_REG(val) (((val) * 95 + 2) / 4)
-#define VDD_TO_REG(val) clamp_valval) * 4 + 47) / 95), 0, 255)
+#define VDD_FROM_REG(val)  DIV_ROUND_CLOSEST((val) * 95, 4)
+#define VDD_CLAMP(val) clamp_val(val, 0, 255 * 95 / 4)
+#define VDD_TO_REG(val)DIV_ROUND_CLOSEST(VDD_CLAMP(val) * 4, 
95)
 
-#define IN_FROM_REG(val) ((val) * 19)
-#define IN_TO_REG(val) clamp_valval) + 9) / 19), 0, 255)
+#define IN_FROM_REG(val)   ((val) * 19)
+#define IN_CLAMP(val)  clamp_val(val, 0, 255 * 19)
+#define IN_TO_REG(val) DIV_ROUND_CLOSEST(IN_CLAMP(val), 19)
 
 static ssize_t get_in_input(struct device *dev, struct device_attribute *attr,
char *buf)
@@ -349,8 +351,13 @@ static SENSOR_DEVICE_ATTR(in4_max, S_IRUGO | S_IWUSR,
 
 #define DIV_FROM_REG(val) (1 << (val))
 #define FAN_FROM_REG(val, div) ((val) == 0 ? 0 : (48 / ((val) << (div
-#define FAN_TO_REG(val, div) ((val) <= 0 ? 0 : \
-   clamp_val((48 + ((val) << ((div)-1))) / ((val) << (div)), 1, 255))
+
+#define FAN_BASE(div)  (48 >> (div))
+#define FAN_CLAMP(val, div)clamp_val(val, FAN_BASE(div) / 255, \
+ FAN_BASE(div))
+#define FAN_TO_REG(val, div)   ((val) == 0 ? 0 : \
+DIV_ROUND_CLOSEST(48, \
+   FAN_CLAMP(val, div) << (div)))
 
 static ssize_t get_fan_input(struct device *dev, struct device_attribute *attr,
 char *buf)
@@ -513,9 +520,9 @@ static SENSOR_DEVICE_ATTR(fan2_div, S_IRUGO | S_IWUSR,
 static DEVICE_ATTR(fan1_off, S_IRUGO | S_IWUSR,
get_fan_off, set_fan_off);
 
-#define TEMP_FROM_REG(val) (((val) - 130) * 1000)
-#define TEMP_TO_REG(val) clamp_val(val) < 0 ? \
-   (val) - 500 : (val) + 500) / 1000) + 130), 0, 255)
+#define TEMP_FROM_REG(val) (((val) - 130) * 1000)
+#define TEMP_CLAMP(val)clamp_val(val, -13, 125000)
+#define TEMP_TO_REG(val)   (DIV_ROUND_CLOSEST(TEMP_CLAMP(val), 1000) + 130)
 
 static ssize_t get_temp_input(struct device *dev, struct device_attribute 
*attr,
  char *buf)
-- 
2.11.0

[PATCH review for 4.4 11/47] sh_eth: use correct name for ECMR_MPDE bit

[Levin, Alexander (Sasha Levin)]

From: Niklas Söderlund 

[ Upstream commit 6dcf45e514974a1ff10755015b5e06746a033e5f ]

This bit was wrongly named due to a typo, Sergei checked the SH7734/63
manuals and this bit should be named MPDE.

Suggested-by: Sergei Shtylyov 
Signed-off-by: Niklas Söderlund 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/renesas/sh_eth.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/renesas/sh_eth.h 
b/drivers/net/ethernet/renesas/sh_eth.h
index 72fcfc924589..0d18be0fed8e 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -339,7 +339,7 @@ enum FELIC_MODE_BIT {
ECMR_DPAD = 0x0020, ECMR_RZPF = 0x0010,
ECMR_ZPF = 0x0008, ECMR_PFR = 0x0004, ECMR_RXF = 0x0002,
ECMR_TXF = 0x0001, ECMR_MCT = 0x2000, ECMR_PRCEF = 0x1000,
-   ECMR_PMDE = 0x0200, ECMR_RE = 0x0040, ECMR_TE = 0x0020,
+   ECMR_MPDE = 0x0200, ECMR_RE = 0x0040, ECMR_TE = 0x0020,
ECMR_RTM = 0x0010, ECMR_ILB = 0x0008, ECMR_ELB = 0x0004,
ECMR_DM = 0x0002, ECMR_PRM = 0x0001,
 };
-- 
2.11.0

[PATCH review for 4.4 12/47] clk: wm831x: fix usleep_range with bad range

[Levin, Alexander (Sasha Levin)]

From: Nicholas Mc Guire 

[ Upstream commit ed784c532a3d0959db488f40a96c5127f63d42dc ]

The delay here is not in atomic context and does not seem critical with
respect to precision, but usleep_range(min,max) with min==max results in
giving the timer subsystem no room to optimize uncritical delays. Fix
this by setting the range to 2000,3000 us.

Fixes: commit f05259a6ffa4 ("clk: wm831x: Add initial WM831x clock driver")
Signed-off-by: Nicholas Mc Guire 
Acked-by: Charles Keepax 
Signed-off-by: Stephen Boyd 
Signed-off-by: Sasha Levin 
---
 drivers/clk/clk-wm831x.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/clk-wm831x.c b/drivers/clk/clk-wm831x.c
index 763aed2de893..dfedcf5bc429 100644
--- a/drivers/clk/clk-wm831x.c
+++ b/drivers/clk/clk-wm831x.c
@@ -101,7 +101,8 @@ static int wm831x_fll_prepare(struct clk_hw *hw)
if (ret != 0)
dev_crit(wm831x->dev, "Failed to enable FLL: %d\n", ret);
 
-   usleep_range(2000, 2000);
+   /* wait 2-3 ms for new frequency taking effect */
+   usleep_range(2000, 3000);
 
return ret;
 }
-- 
2.11.0

[PATCH review for 3.18 08/30] ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM

[Levin, Alexander (Sasha Levin)]

From: Afzal Mohammed 

[ Upstream commit 8a792e9afbce84a0fdaf213fe42bb97382487094 ]

REMAP_VECTORS_TO_RAM depends on DRAM_BASE, but since DRAM_BASE is a
hex, REMAP_VECTORS_TO_RAM could never get enabled. Also depending on
DRAM_BASE is redundant as whenever REMAP_VECTORS_TO_RAM makes itself
available to Kconfig, DRAM_BASE also is available as the Kconfig
gets sourced on !MMU.

Signed-off-by: Afzal Mohammed 
Reviewed-by: Vladimir Murzin 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin 
---
 arch/arm/Kconfig-nommu | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm/Kconfig-nommu b/arch/arm/Kconfig-nommu
index aed66d5df7f1..b7576349528c 100644
--- a/arch/arm/Kconfig-nommu
+++ b/arch/arm/Kconfig-nommu
@@ -34,8 +34,7 @@ config PROCESSOR_ID
  used instead of the auto-probing which utilizes the register.
 
 config REMAP_VECTORS_TO_RAM
-   bool 'Install vectors to the beginning of RAM' if DRAM_BASE
-   depends on DRAM_BASE
+   bool 'Install vectors to the beginning of RAM'
help
  The kernel needs to change the hardware exception vectors.
  In nommu mode, the hardware exception vectors are normally
-- 
2.11.0

[PATCH review for 3.18 06/30] clk: wm831x: fix usleep_range with bad range

[Levin, Alexander (Sasha Levin)]

From: Nicholas Mc Guire 

[ Upstream commit ed784c532a3d0959db488f40a96c5127f63d42dc ]

The delay here is not in atomic context and does not seem critical with
respect to precision, but usleep_range(min,max) with min==max results in
giving the timer subsystem no room to optimize uncritical delays. Fix
this by setting the range to 2000,3000 us.

Fixes: commit f05259a6ffa4 ("clk: wm831x: Add initial WM831x clock driver")
Signed-off-by: Nicholas Mc Guire 
Acked-by: Charles Keepax 
Signed-off-by: Stephen Boyd 
Signed-off-by: Sasha Levin 
---
 drivers/clk/clk-wm831x.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/clk-wm831x.c b/drivers/clk/clk-wm831x.c
index ef67719f4e52..b9a0eddf44de 100644
--- a/drivers/clk/clk-wm831x.c
+++ b/drivers/clk/clk-wm831x.c
@@ -102,7 +102,8 @@ static int wm831x_fll_prepare(struct clk_hw *hw)
if (ret != 0)
dev_crit(wm831x->dev, "Failed to enable FLL: %d\n", ret);
 
-   usleep_range(2000, 2000);
+   /* wait 2-3 ms for new frequency taking effect */
+   usleep_range(2000, 3000);
 
return ret;
 }
-- 
2.11.0

[PATCH review for 4.4 36/47] bridge: netlink: register netdevice before executing changelink

[Levin, Alexander (Sasha Levin)]

From: Ido Schimmel 

[ Upstream commit 5b8d5429daa05bebef6ffd3297df3b502cc6f184 ]

Peter reported a kernel oops when executing the following command:

$ ip link add name test type bridge vlan_default_pvid 1

[13634.939408] BUG: unable to handle kernel NULL pointer dereference at
0190
[13634.939436] IP: __vlan_add+0x73/0x5f0
[...]
[13634.939783] Call Trace:
[13634.939791]  ? pcpu_next_unpop+0x3b/0x50
[13634.939801]  ? pcpu_alloc+0x3d2/0x680
[13634.939810]  ? br_vlan_add+0x135/0x1b0
[13634.939820]  ? __br_vlan_set_default_pvid.part.28+0x204/0x2b0
[13634.939834]  ? br_changelink+0x120/0x4e0
[13634.939844]  ? br_dev_newlink+0x50/0x70
[13634.939854]  ? rtnl_newlink+0x5f5/0x8a0
[13634.939864]  ? rtnl_newlink+0x176/0x8a0
[13634.939874]  ? mem_cgroup_commit_charge+0x7c/0x4e0
[13634.939886]  ? rtnetlink_rcv_msg+0xe1/0x220
[13634.939896]  ? lookup_fast+0x52/0x370
[13634.939905]  ? rtnl_newlink+0x8a0/0x8a0
[13634.939915]  ? netlink_rcv_skb+0xa1/0xc0
[13634.939925]  ? rtnetlink_rcv+0x24/0x30
[13634.939934]  ? netlink_unicast+0x177/0x220
[13634.939944]  ? netlink_sendmsg+0x2fe/0x3b0
[13634.939954]  ? _copy_from_user+0x39/0x40
[13634.939964]  ? sock_sendmsg+0x30/0x40
[13634.940159]  ? ___sys_sendmsg+0x29d/0x2b0
[13634.940326]  ? __alloc_pages_nodemask+0xdf/0x230
[13634.940478]  ? mem_cgroup_commit_charge+0x7c/0x4e0
[13634.940592]  ? mem_cgroup_try_charge+0x76/0x1a0
[13634.940701]  ? __handle_mm_fault+0xdb9/0x10b0
[13634.940809]  ? __sys_sendmsg+0x51/0x90
[13634.940917]  ? entry_SYSCALL_64_fastpath+0x1e/0xad

The problem is that the bridge's VLAN group is created after setting the
default PVID, when registering the netdevice and executing its
ndo_init().

Fix this by changing the order of both operations, so that
br_changelink() is only processed after the netdevice is registered,
when the VLAN group is already initialized.

Fixes: b6677449dff6 ("bridge: netlink: call br_changelink() during 
br_dev_newlink()")
Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: Ido Schimmel 
Reported-by: Peter V. Saveliev 
Tested-by: Peter V. Saveliev 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/bridge/br_netlink.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index ff8bb41d713f..a1f697ec4fc2 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1073,11 +1073,14 @@ static int br_dev_newlink(struct net *src_net, struct 
net_device *dev,
spin_unlock_bh(>lock);
}
 
-   err = br_changelink(dev, tb, data);
+   err = register_netdevice(dev);
if (err)
return err;
 
-   return register_netdevice(dev);
+   err = br_changelink(dev, tb, data);
+   if (err)
+   unregister_netdevice(dev);
+   return err;
 }
 
 static size_t br_get_size(const struct net_device *brdev)
-- 
2.11.0

[PATCH review for 3.18 02/30] RDS: RDMA: Fix the composite message user notification

[Levin, Alexander (Sasha Levin)]

From: Santosh Shilimkar 

[ Upstream commit 941f8d55f6d613a460a5e080d25a38509f45eb75 ]

When application sends an RDS RDMA composite message consist of
RDMA transfer to be followed up by non RDMA payload, it expect to
be notified *only* when the full message gets delivered. RDS RDMA
notification doesn't behave this way though.

Thanks to Venkat for debug and root casuing the issue
where only first part of the message(RDMA) was
successfully delivered but remainder payload delivery failed.
In that case, application should not be notified with
a false positive of message delivery success.

Fix this case by making sure the user gets notified only after
the full message delivery.

Reviewed-by: Venkat Venkatsubra 
Signed-off-by: Santosh Shilimkar 
Signed-off-by: Sasha Levin 
---
 net/rds/ib_send.c | 25 +++--
 net/rds/rdma.c| 10 ++
 net/rds/rds.h |  1 +
 net/rds/send.c|  4 +++-
 4 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index 1dde91e3dc70..5deecf4cce71 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -102,16 +102,6 @@ static void rds_ib_send_complete(struct rds_message *rm,
complete(rm, notify_status);
 }
 
-static void rds_ib_send_unmap_data(struct rds_ib_connection *ic,
-  struct rm_data_op *op,
-  int wc_status)
-{
-   if (op->op_nents)
-   ib_dma_unmap_sg(ic->i_cm_id->device,
-   op->op_sg, op->op_nents,
-   DMA_TO_DEVICE);
-}
-
 static void rds_ib_send_unmap_rdma(struct rds_ib_connection *ic,
   struct rm_rdma_op *op,
   int wc_status)
@@ -172,6 +162,21 @@ static void rds_ib_send_unmap_atomic(struct 
rds_ib_connection *ic,
rds_ib_stats_inc(s_ib_atomic_fadd);
 }
 
+static void rds_ib_send_unmap_data(struct rds_ib_connection *ic,
+  struct rm_data_op *op,
+  int wc_status)
+{
+   struct rds_message *rm = container_of(op, struct rds_message, data);
+
+   if (op->op_nents)
+   ib_dma_unmap_sg(ic->i_cm_id->device,
+   op->op_sg, op->op_nents,
+   DMA_TO_DEVICE);
+
+   if (rm->rdma.op_active && rm->data.op_notify)
+   rds_ib_send_unmap_rdma(ic, >rdma, wc_status);
+}
+
 /*
  * Unmap the resources associated with a struct send_work.
  *
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 40084d843e9f..3738b1920c09 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -625,6 +625,16 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct 
rds_message *rm,
}
op->op_notifier->n_user_token = args->user_token;
op->op_notifier->n_status = RDS_RDMA_SUCCESS;
+
+   /* Enable rmda notification on data operation for composite
+* rds messages and make sure notification is enabled only
+* for the data operation which follows it so that application
+* gets notified only after full message gets delivered.
+*/
+   if (rm->data.op_sg) {
+   rm->rdma.op_notify = 0;
+   rm->data.op_notify = !!(args->flags & 
RDS_RDMA_NOTIFY_ME);
+   }
}
 
/* The cookie contains the R_Key of the remote memory region, and
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 48f8ffc60f8f..42af715b63fc 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -360,6 +360,7 @@ struct rds_message {
} rdma;
struct rm_data_op {
unsigned intop_active:1;
+   unsigned intop_notify:1;
unsigned intop_nents;
unsigned intop_count;
struct scatterlist  *op_sg;
diff --git a/net/rds/send.c b/net/rds/send.c
index 0bae8d43b012..45b800c3cc83 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -425,12 +425,14 @@ void rds_rdma_send_complete(struct rds_message *rm, int 
status)
struct rm_rdma_op *ro;
struct rds_notifier *notifier;
unsigned long flags;
+   unsigned int notify = 0;
 
spin_lock_irqsave(>m_rs_lock, flags);
 
+   notify =  rm->rdma.op_notify | rm->data.op_notify;
ro = >rdma;
if (test_bit(RDS_MSG_ON_SOCK, >m_flags) &&
-   ro->op_active && ro->op_notify && ro->op_notifier) {
+   ro->op_active && notify && ro->op_notifier) {
notifier = ro->op_notifier;
rs = rm->m_rs;
sock_hold(rds_rs_to_sk(rs));
-- 
2.11.0

[PATCH review for 3.18 07/30] hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes

[Levin, Alexander (Sasha Levin)]

From: Guenter Roeck 

[ Upstream commit 87cdfa9d60f4f40e6d71b04b10b36d9df3c89282 ]

Writes into limit attributes can overflow due to multplications and
additions with unbound input values. Writing into fan limit attributes
can result in a crash with a division by zero if very large values are
written and the fan divider is larger than 1.

Signed-off-by: Guenter Roeck 
Signed-off-by: Sasha Levin 
---
 drivers/hwmon/gl520sm.c | 25 -
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/drivers/hwmon/gl520sm.c b/drivers/hwmon/gl520sm.c
index dee93ec87d02..84e0994aafdd 100644
--- a/drivers/hwmon/gl520sm.c
+++ b/drivers/hwmon/gl520sm.c
@@ -208,11 +208,13 @@ static ssize_t get_cpu_vid(struct device *dev, struct 
device_attribute *attr,
 }
 static DEVICE_ATTR(cpu0_vid, S_IRUGO, get_cpu_vid, NULL);
 
-#define VDD_FROM_REG(val) (((val) * 95 + 2) / 4)
-#define VDD_TO_REG(val) clamp_valval) * 4 + 47) / 95), 0, 255)
+#define VDD_FROM_REG(val)  DIV_ROUND_CLOSEST((val) * 95, 4)
+#define VDD_CLAMP(val) clamp_val(val, 0, 255 * 95 / 4)
+#define VDD_TO_REG(val)DIV_ROUND_CLOSEST(VDD_CLAMP(val) * 4, 
95)
 
-#define IN_FROM_REG(val) ((val) * 19)
-#define IN_TO_REG(val) clamp_valval) + 9) / 19), 0, 255)
+#define IN_FROM_REG(val)   ((val) * 19)
+#define IN_CLAMP(val)  clamp_val(val, 0, 255 * 19)
+#define IN_TO_REG(val) DIV_ROUND_CLOSEST(IN_CLAMP(val), 19)
 
 static ssize_t get_in_input(struct device *dev, struct device_attribute *attr,
char *buf)
@@ -349,8 +351,13 @@ static SENSOR_DEVICE_ATTR(in4_max, S_IRUGO | S_IWUSR,
 
 #define DIV_FROM_REG(val) (1 << (val))
 #define FAN_FROM_REG(val, div) ((val) == 0 ? 0 : (48 / ((val) << (div
-#define FAN_TO_REG(val, div) ((val) <= 0 ? 0 : \
-   clamp_val((48 + ((val) << ((div)-1))) / ((val) << (div)), 1, 255))
+
+#define FAN_BASE(div)  (48 >> (div))
+#define FAN_CLAMP(val, div)clamp_val(val, FAN_BASE(div) / 255, \
+ FAN_BASE(div))
+#define FAN_TO_REG(val, div)   ((val) == 0 ? 0 : \
+DIV_ROUND_CLOSEST(48, \
+   FAN_CLAMP(val, div) << (div)))
 
 static ssize_t get_fan_input(struct device *dev, struct device_attribute *attr,
 char *buf)
@@ -513,9 +520,9 @@ static SENSOR_DEVICE_ATTR(fan2_div, S_IRUGO | S_IWUSR,
 static DEVICE_ATTR(fan1_off, S_IRUGO | S_IWUSR,
get_fan_off, set_fan_off);
 
-#define TEMP_FROM_REG(val) (((val) - 130) * 1000)
-#define TEMP_TO_REG(val) clamp_val(val) < 0 ? \
-   (val) - 500 : (val) + 500) / 1000) + 130), 0, 255)
+#define TEMP_FROM_REG(val) (((val) - 130) * 1000)
+#define TEMP_CLAMP(val)clamp_val(val, -13, 125000)
+#define TEMP_TO_REG(val)   (DIV_ROUND_CLOSEST(TEMP_CLAMP(val), 1000) + 130)
 
 static ssize_t get_temp_input(struct device *dev, struct device_attribute 
*attr,
  char *buf)
-- 
2.11.0

[PATCH review for 3.18 04/30] MIPS: kexec: Do not reserve invalid crashkernel memory on boot

[Levin, Alexander (Sasha Levin)]

From: Marcin Nowakowski 

[ Upstream commit a8f108d70c74d83574c157648383eb2e4285a190 ]

Do not reserve memory for the crashkernel if the commandline argument
points to a wrong location. This can happen if the location is specified
wrong or if the same commandline is reused when starting the crashkernel
- in the latter case the reserved memory would point to the location
from which the crashkernel is executing.

Signed-off-by: Marcin Nowakowski 
Cc: linux-m...@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14612/
Signed-off-by: Ralf Baechle 
Signed-off-by: Sasha Levin 
---
 arch/mips/kernel/setup.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index f3b635f86c39..e3f552642a68 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -585,6 +585,11 @@ static void __init mips_parse_crashkernel(void)
if (ret != 0 || crash_size <= 0)
return;
 
+   if (!memory_region_available(crash_base, crash_size)) {
+   pr_warn("Invalid memory region reserved for crash kernel\n");
+   return;
+   }
+
crashk_res.start = crash_base;
crashk_res.end   = crash_base + crash_size - 1;
 }
-- 
2.11.0

[PATCH review for 3.18 11/30] IB/ipoib: rtnl_unlock can not come after free_netdev

[Levin, Alexander (Sasha Levin)]

From: Feras Daoud 

[ Upstream commit 89a3987ab7a923c047c6dec008e60ad6f41fac22 ]

The ipoib_vlan_add function calls rtnl_unlock after free_netdev,
rtnl_unlock not only releases the lock, but also calls netdev_run_todo.
The latter function browses the net_todo_list array and completes the
unregistration of all its net_device instances. If we call free_netdev
before rtnl_unlock, then netdev_run_todo call over the freed device causes
panic.
To fix, move rtnl_unlock call before free_netdev call.

Fixes: 9baa0b036410 ("IB/ipoib: Add rtnl_link_ops support")
Cc: Or Gerlitz 
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Reviewed-by: Yuval Shaia 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c 
b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index cae1b8223abe..67182d4e8138 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -162,11 +162,11 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned 
short pkey)
 out:
up_write(>vlan_rwsem);
 
+   rtnl_unlock();
+
if (result)
free_netdev(priv->dev);
 
-   rtnl_unlock();
-
return result;
 }
 
-- 
2.11.0

Re: [PATCH review for 4.4 12/47] clk: wm831x: fix usleep_range with bad range

[Levin, Alexander (Sasha Levin)]

On Fri, Sep 22, 2017 at 09:46:28AM +0100, Charles Keepax wrote:
>On Wed, Sep 20, 2017 at 04:45:02AM +0000, Levin, Alexander (Sasha Levin) wrote:
>> From: Nicholas Mc Guire <hof...@osadl.org>
>>
>> [ Upstream commit ed784c532a3d0959db488f40a96c5127f63d42dc ]
>>
>> The delay here is not in atomic context and does not seem critical with
>> respect to precision, but usleep_range(min,max) with min==max results in
>> giving the timer subsystem no room to optimize uncritical delays. Fix
>> this by setting the range to 2000,3000 us.
>>
>> Fixes: commit f05259a6ffa4 ("clk: wm831x: Add initial WM831x clock driver")
>> Signed-off-by: Nicholas Mc Guire <hof...@osadl.org>
>> Acked-by: Charles Keepax <ckee...@opensource.wolfsonmicro.com>
>> Signed-off-by: Stephen Boyd <sb...@codeaurora.org>
>> Signed-off-by: Sasha Levin <alexander.le...@verizon.com>
>> ---
>>  drivers/clk/clk-wm831x.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/clk/clk-wm831x.c b/drivers/clk/clk-wm831x.c
>> index 763aed2de893..dfedcf5bc429 100644
>> --- a/drivers/clk/clk-wm831x.c
>> +++ b/drivers/clk/clk-wm831x.c
>> @@ -101,7 +101,8 @@ static int wm831x_fll_prepare(struct clk_hw *hw)
>>  if (ret != 0)
>>  dev_crit(wm831x->dev, "Failed to enable FLL: %d\n", ret);
>>
>> -usleep_range(2000, 2000);
>> +/* wait 2-3 ms for new frequency taking effect */
>> +usleep_range(2000, 3000);
>
>Does this patch really make sense for stable, isn't this really
>just a small optimisation? The patch is pretty harmless so I
>can't see applying it causing any problems, just curious what
>problems not having it is causing.

Looking back at this, I think I misunderstood a scenario in the scheduler this 
might be causing. What you say makes sense, I'll drop it.

-- 

Thanks,
Sasha

Re: [PATCH for 4.9 39/59] arm: dts: mt2701: Add subsystem clock controller device nodes

[Levin, Alexander (Sasha Levin)]

On Fri, Sep 15, 2017 at 01:15:43PM +0200, Matthias Brugger wrote:
>On 09/14/2017 05:51 PM, Levin, Alexander (Sasha Levin) wrote:
>>From: James Liao <jamesjj.l...@mediatek.com>
>>
>>[ Upstream commit f235c7e7a75325f28a33559a71f25a0eca6112db ]
>>
>>Add MT2701 subsystem clock controllers, inlcude mmsys, imgsys,
>>vdecsys, hifsys, ethsys and bdpsys.
>>
>>Signed-off-by: James Liao <jamesjj.l...@mediatek.com>
>>Signed-off-by: Matthias Brugger <matthias@gmail.com>
>>Signed-off-by: Sasha Levin <alexander.le...@verizon.com>
>>---
>>  arch/arm/boot/dts/mt2701.dtsi | 36 
>>  1 file changed, 36 insertions(+)
>>
>
>It's not clear to me which bug in v4.9.y you are fixing with this. Can 
>you please explain.

Hi Matthias,

Note that beyond bug fixes, stable kernel rules also allow for:

"""
 - New device IDs and quirks are also accepted.
"""

In general, patches that enable devices which use existing in-kernel drivers 
are also accepted to the stable kernel tree.

If this is not the case here, or you have a reason to keep it out, please let 
me know.


-- 

Thanks,
Sasha

[PATCH for 4.9 15/39] drivers/rapidio/devices/tsi721.c: make module parameter variable name unique

[Levin, Alexander (Sasha Levin)]

From: Randy Dunlap 

[ Upstream commit 4785603bd05b0b029c647080937674d9991600f9 ]

kbuild test robot reported a non-static variable name collision between
a staging driver and a RapidIO driver, with a generic variable name of
'dbg_level'.

Both drivers should be changed so that they don't use this generic
public variable name.  This patch fixes the RapidIO driver but does not
change the user interface (name) for the module parameter.

  drivers/staging/built-in.o:(.bss+0x109d0): multiple definition of `dbg_level'
  drivers/rapidio/built-in.o:(.bss+0x16c): first defined here

Link: 
http://lkml.kernel.org/r/ab527fc5-aa3c-4b07-5d48-eef5de703...@infradead.org
Signed-off-by: Randy Dunlap 
Reported-by: kbuild test robot 
Cc: Greg Kroah-Hartman 
Cc: Matt Porter 
Cc: Alexandre Bounine 
Cc: Jérémy Lefaure 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
---
 drivers/rapidio/devices/tsi721.c | 4 ++--
 drivers/rapidio/devices/tsi721.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 9d19b9a62011..315a4be8dc1e 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -37,8 +37,8 @@
 #include "tsi721.h"
 
 #ifdef DEBUG
-u32 dbg_level;
-module_param(dbg_level, uint, S_IWUSR | S_IRUGO);
+u32 tsi_dbg_level;
+module_param_named(dbg_level, tsi_dbg_level, uint, S_IWUSR | S_IRUGO);
 MODULE_PARM_DESC(dbg_level, "Debugging output level (default 0 = none)");
 #endif
 
diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
index 5941437cbdd1..957eadc58150 100644
--- a/drivers/rapidio/devices/tsi721.h
+++ b/drivers/rapidio/devices/tsi721.h
@@ -40,11 +40,11 @@ enum {
 };
 
 #ifdef DEBUG
-extern u32 dbg_level;
+extern u32 tsi_dbg_level;
 
 #define tsi_debug(level, dev, fmt, arg...) \
do {\
-   if (DBG_##level & dbg_level)\
+   if (DBG_##level & tsi_dbg_level)
\
dev_dbg(dev, "%s: " fmt "\n", __func__, ##arg); \
} while (0)
 #else
-- 
2.11.0

[PATCH for 4.9 09/39] bridge: netlink: register netdevice before executing changelink

[Levin, Alexander (Sasha Levin)]

From: Ido Schimmel 

[ Upstream commit 5b8d5429daa05bebef6ffd3297df3b502cc6f184 ]

Peter reported a kernel oops when executing the following command:

$ ip link add name test type bridge vlan_default_pvid 1

[13634.939408] BUG: unable to handle kernel NULL pointer dereference at
0190
[13634.939436] IP: __vlan_add+0x73/0x5f0
[...]
[13634.939783] Call Trace:
[13634.939791]  ? pcpu_next_unpop+0x3b/0x50
[13634.939801]  ? pcpu_alloc+0x3d2/0x680
[13634.939810]  ? br_vlan_add+0x135/0x1b0
[13634.939820]  ? __br_vlan_set_default_pvid.part.28+0x204/0x2b0
[13634.939834]  ? br_changelink+0x120/0x4e0
[13634.939844]  ? br_dev_newlink+0x50/0x70
[13634.939854]  ? rtnl_newlink+0x5f5/0x8a0
[13634.939864]  ? rtnl_newlink+0x176/0x8a0
[13634.939874]  ? mem_cgroup_commit_charge+0x7c/0x4e0
[13634.939886]  ? rtnetlink_rcv_msg+0xe1/0x220
[13634.939896]  ? lookup_fast+0x52/0x370
[13634.939905]  ? rtnl_newlink+0x8a0/0x8a0
[13634.939915]  ? netlink_rcv_skb+0xa1/0xc0
[13634.939925]  ? rtnetlink_rcv+0x24/0x30
[13634.939934]  ? netlink_unicast+0x177/0x220
[13634.939944]  ? netlink_sendmsg+0x2fe/0x3b0
[13634.939954]  ? _copy_from_user+0x39/0x40
[13634.939964]  ? sock_sendmsg+0x30/0x40
[13634.940159]  ? ___sys_sendmsg+0x29d/0x2b0
[13634.940326]  ? __alloc_pages_nodemask+0xdf/0x230
[13634.940478]  ? mem_cgroup_commit_charge+0x7c/0x4e0
[13634.940592]  ? mem_cgroup_try_charge+0x76/0x1a0
[13634.940701]  ? __handle_mm_fault+0xdb9/0x10b0
[13634.940809]  ? __sys_sendmsg+0x51/0x90
[13634.940917]  ? entry_SYSCALL_64_fastpath+0x1e/0xad

The problem is that the bridge's VLAN group is created after setting the
default PVID, when registering the netdevice and executing its
ndo_init().

Fix this by changing the order of both operations, so that
br_changelink() is only processed after the netdevice is registered,
when the VLAN group is already initialized.

Fixes: b6677449dff6 ("bridge: netlink: call br_changelink() during 
br_dev_newlink()")
Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: Ido Schimmel 
Reported-by: Peter V. Saveliev 
Tested-by: Peter V. Saveliev 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/bridge/br_netlink.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 7625ec8458de..5d4006e589cb 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1098,11 +1098,14 @@ static int br_dev_newlink(struct net *src_net, struct 
net_device *dev,
spin_unlock_bh(>lock);
}
 
-   err = br_changelink(dev, tb, data);
+   err = register_netdevice(dev);
if (err)
return err;
 
-   return register_netdevice(dev);
+   err = br_changelink(dev, tb, data);
+   if (err)
+   unregister_netdevice(dev);
+   return err;
 }
 
 static size_t br_get_size(const struct net_device *brdev)
-- 
2.11.0

[PATCH for 4.9 01/39] net: core: Prevent from dereferencing null pointer when releasing SKB

[Levin, Alexander (Sasha Levin)]

From: Myungho Jung 

[ Upstream commit 9899886d5e8ec5b343b1efe44f185a0e68dc6454 ]

Added NULL check to make __dev_kfree_skb_irq consistent with kfree
family of functions.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=195289

Signed-off-by: Myungho Jung 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/core/dev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index 1d0a7369d5a2..8d5db08f79f3 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2355,6 +2355,9 @@ void __dev_kfree_skb_irq(struct sk_buff *skb, enum 
skb_free_reason reason)
 {
unsigned long flags;
 
+   if (unlikely(!skb))
+   return;
+
if (likely(atomic_read(>users) == 1)) {
smp_rmb();
atomic_set(>users, 0);
-- 
2.11.0

[PATCH for 4.9 10/39] Btrfs: fix segmentation fault when doing dio read

[Levin, Alexander (Sasha Levin)]

From: Liu Bo 

[ Upstream commit 97bf5a5589aa3a59c60aa775fc12ec0483fc5002 ]

Commit 2dabb3248453 ("Btrfs: Direct I/O read: Work on sectorsized blocks")
introduced this bug during iterating bio pages in dio read's endio hook,
and it could end up with segment fault of the dio reading task.

So the reason is 'if (nr_sectors--)', and it makes the code assume that
there is one more block in the same page, so page offset is increased and
the bio which is created to repair the bad block then has an incorrect
bvec.bv_offset, and a later access of the page content would throw a
segmentation fault.

This also adds ASSERT to check page offset against page size.

Signed-off-by: Liu Bo 
Reviewed-by: David Sterba 
Signed-off-by: David Sterba 
Signed-off-by: Sasha Levin 
---
 fs/btrfs/inode.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 8a05fa7e2152..f089d7d8afe7 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -8050,8 +8050,10 @@ static int __btrfs_correct_data_nocsum(struct inode 
*inode,
 
start += sectorsize;
 
-   if (nr_sectors--) {
+   nr_sectors--;
+   if (nr_sectors) {
pgoff += sectorsize;
+   ASSERT(pgoff < PAGE_SIZE);
goto next_block_or_try_again;
}
}
@@ -8157,8 +8159,10 @@ static int __btrfs_subio_endio_read(struct inode *inode,
 
ASSERT(nr_sectors);
 
-   if (--nr_sectors) {
+   nr_sectors--;
+   if (nr_sectors) {
pgoff += sectorsize;
+   ASSERT(pgoff < PAGE_SIZE);
goto next_block;
}
}
-- 
2.11.0

[PATCH for 4.9 04/39] usb: plusb: Add support for PL-27A1

[Levin, Alexander (Sasha Levin)]

From: Roman Spychała 

[ Upstream commit 6f2aee0c0de6501bbc26fe50c9c7b09a37f7 ]

This patch adds support for the PL-27A1 by adding the appropriate
USB ID's. This chip is used in the goobay Active USB 3.0 Data Link
and Unitek Y-3501 cables.

Signed-off-by: Roman Spychała 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/usb/Kconfig |  2 +-
 drivers/net/usb/plusb.c | 15 +--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index cdde59089f72..3a7286256db0 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -364,7 +364,7 @@ config USB_NET_NET1080
  optionally with LEDs that indicate traffic
 
 config USB_NET_PLUSB
-   tristate "Prolific PL-2301/2302/25A1 based cables"
+   tristate "Prolific PL-2301/2302/25A1/27A1 based cables"
# if the handshake/init/reset problems, from original 'plusb',
# are ever resolved ... then remove "experimental"
depends on USB_USBNET
diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c
index 22e1a9a99a7d..6fe59373cba9 100644
--- a/drivers/net/usb/plusb.c
+++ b/drivers/net/usb/plusb.c
@@ -102,7 +102,7 @@ static int pl_reset(struct usbnet *dev)
 }
 
 static const struct driver_infoprolific_info = {
-   .description =  "Prolific PL-2301/PL-2302/PL-25A1",
+   .description =  "Prolific PL-2301/PL-2302/PL-25A1/PL-27A1",
.flags =FLAG_POINTTOPOINT | FLAG_NO_SETINT,
/* some PL-2302 versions seem to fail usb_set_interface() */
.reset =pl_reset,
@@ -139,6 +139,17 @@ static const struct usb_device_id  products [] = {
 * Host-to-Host Cable
 */
.driver_info =  (unsigned long) _info,
+
+},
+
+/* super speed cables */
+{
+   USB_DEVICE(0x067b, 0x27a1), /* PL-27A1, no eeprom
+* also: goobay Active USB 3.0
+* Data Link,
+* Unitek Y-3501
+*/
+   .driver_info =  (unsigned long) _info,
 },
 
{ },// END
@@ -158,5 +169,5 @@ static struct usb_driver plusb_driver = {
 module_usb_driver(plusb_driver);
 
 MODULE_AUTHOR("David Brownell");
-MODULE_DESCRIPTION("Prolific PL-2301/2302/25A1 USB Host to Host Link Driver");
+MODULE_DESCRIPTION("Prolific PL-2301/2302/25A1/27A1 USB Host to Host Link 
Driver");
 MODULE_LICENSE("GPL");
-- 
2.11.0

[PATCH for 4.9 12/39] sata_via: Enable hotplug only on VT6421

[Levin, Alexander (Sasha Levin)]

From: Ondrej Zary 

[ Upstream commit 3cf864520e877505158f09075794a08abab11bbe ]

Commit 57e5568fda27 ("sata_via: Implement hotplug for VT6421") adds
hotplug IRQ handler for VT6421 but enables hotplug on all chips. This
is a bug because it causes "irq xx: nobody cared" error on VT6420 when
hot-(un)plugging a drive:

[  381.839948] irq 20: nobody cared (try booting with the "irqpoll" option)
[  381.840014] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.10.0-rc5+ #148
[  381.840066] Hardware name:  P4VM800/P4VM800, BIOS P1.60 05/29/2006
[  381.840117] Call Trace:
[  381.840167]  
[  381.840225]  ? dump_stack+0x44/0x58
[  381.840278]  ? __report_bad_irq+0x14/0x97
[  381.840327]  ? handle_edge_irq+0xa5/0xa5
[  381.840376]  ? note_interrupt+0x155/0x1cf
[  381.840426]  ? handle_edge_irq+0xa5/0xa5
[  381.840474]  ? handle_irq_event_percpu+0x32/0x38
[  381.840524]  ? handle_irq_event+0x1f/0x38
[  381.840573]  ? handle_fasteoi_irq+0x69/0xb8
[  381.840625]  ? handle_irq+0x4f/0x5d
[  381.840672]  
[  381.840726]  ? do_IRQ+0x2e/0x8b
[  381.840782]  ? common_interrupt+0x2c/0x34
[  381.840836]  ? mwait_idle+0x60/0x82
[  381.840892]  ? arch_cpu_idle+0x6/0x7
[  381.840949]  ? do_idle+0x96/0x18e
[  381.841002]  ? cpu_startup_entry+0x16/0x1a
[  381.841057]  ? start_kernel+0x319/0x31c
[  381.84]  ? startup_32_smp+0x166/0x168
[  381.841165] handlers:
[  381.841219] [] ata_bmdma_interrupt
[  381.841274] Disabling IRQ #20

Seems that VT6420 can do hotplug too (there's no documentation) but the
comments say that SCR register access (required for detecting hotplug
events) can cause problems on these chips.

For now, just keep hotplug disabled on anything other than VT6421.

Signed-off-by: Ondrej Zary 
Signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin 
---
 drivers/ata/sata_via.c | 18 ++
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index 0636d84fbefe..f3f538eec7b3 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -644,14 +644,16 @@ static void svia_configure(struct pci_dev *pdev, int 
board_id,
pci_write_config_byte(pdev, SATA_NATIVE_MODE, tmp8);
}
 
-   /* enable IRQ on hotplug */
-   pci_read_config_byte(pdev, SVIA_MISC_3, );
-   if ((tmp8 & SATA_HOTPLUG) != SATA_HOTPLUG) {
-   dev_dbg(>dev,
-   "enabling SATA hotplug (0x%x)\n",
-   (int) tmp8);
-   tmp8 |= SATA_HOTPLUG;
-   pci_write_config_byte(pdev, SVIA_MISC_3, tmp8);
+   if (board_id == vt6421) {
+   /* enable IRQ on hotplug */
+   pci_read_config_byte(pdev, SVIA_MISC_3, );
+   if ((tmp8 & SATA_HOTPLUG) != SATA_HOTPLUG) {
+   dev_dbg(>dev,
+   "enabling SATA hotplug (0x%x)\n",
+   (int) tmp8);
+   tmp8 |= SATA_HOTPLUG;
+   pci_write_config_byte(pdev, SVIA_MISC_3, tmp8);
+   }
}
 
/*
-- 
2.11.0

[PATCH for 4.9 17/39] MIPS: IRQ Stack: Unwind IRQ stack onto task stack

[Levin, Alexander (Sasha Levin)]

From: Matt Redfearn 

[ Upstream commit db8466c581cca1a08b505f1319c3ecd246f16fa8 ]

When the separate IRQ stack was introduced, stack unwinding only
proceeded as far as the top of the IRQ stack, leading to kernel
backtraces being less useful, lacking the trace of what was interrupted.

Fix this by providing a means for the kernel to unwind the IRQ stack
onto the interrupted task stack. The processor state is saved to the
kernel task stack on interrupt. The IRQ_STACK_START macro reserves an
unsigned long at the top of the IRQ stack where the interrupted task
stack pointer can be saved. After the active stack is switched to the
IRQ stack, save the interrupted tasks stack pointer to the reserved
location.

Fix the stack unwinding code to look for the frame being the top of the
IRQ stack and if so get the next frame from the saved location. The
existing test does not work with the separate stack since the ra is no
longer pointed at ret_from_{irq,exception}.

The test to stop unwinding the stack 32 bytes from the top of a stack
must be modified to allow unwinding to continue up to the location of
the saved task stack pointer when on the IRQ stack. The low / high marks
of the stack are set depending on whether the sp is on an irq stack or
not.

Signed-off-by: Matt Redfearn 
Cc: Paolo Bonzini 
Cc: Marcin Nowakowski 
Cc: Masanari Iida 
Cc: Chris Metcalf 
Cc: James Hogan 
Cc: Paul Burton 
Cc: Ingo Molnar 
Cc: Jason A. Donenfeld 
Cc: Andrew Morton 
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/15788/
Signed-off-by: Ralf Baechle 
Signed-off-by: Sasha Levin 
---
 arch/mips/include/asm/irq.h| 15 +++
 arch/mips/kernel/asm-offsets.c |  1 +
 arch/mips/kernel/genex.S   |  8 --
 arch/mips/kernel/process.c | 56 --
 4 files changed, 60 insertions(+), 20 deletions(-)

diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
index 956db6e201d1..ddd1c918103b 100644
--- a/arch/mips/include/asm/irq.h
+++ b/arch/mips/include/asm/irq.h
@@ -18,9 +18,24 @@
 #include 
 
 #define IRQ_STACK_SIZE THREAD_SIZE
+#define IRQ_STACK_START(IRQ_STACK_SIZE - 
sizeof(unsigned long))
 
 extern void *irq_stack[NR_CPUS];
 
+/*
+ * The highest address on the IRQ stack contains a dummy frame put down in
+ * genex.S (handle_int & except_vec_vi_handler) which is structured as follows:
+ *
+ *   top 
+ *   | task sp  | <- irq_stack[cpu] + IRQ_STACK_START
+ *   
+ *   |  | <- First frame of IRQ context
+ *   
+ *
+ * task sp holds a copy of the task stack pointer where the struct pt_regs
+ * from exception entry can be found.
+ */
+
 static inline bool on_irq_stack(int cpu, unsigned long sp)
 {
unsigned long low = (unsigned long)irq_stack[cpu];
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index 4be2763f835d..bfff6ea45d51 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -103,6 +103,7 @@ void output_thread_info_defines(void)
DEFINE(_THREAD_SIZE, THREAD_SIZE);
DEFINE(_THREAD_MASK, THREAD_MASK);
DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
+   DEFINE(_IRQ_STACK_START, IRQ_STACK_START);
BLANK();
 }
 
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index 2ac6c2625c13..ae810da4d499 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -215,9 +215,11 @@ NESTED(handle_int, PT_SIZE, sp)
beq t0, t1, 2f
 
/* Switch to IRQ stack */
-   li  t1, _IRQ_STACK_SIZE
+   li  t1, _IRQ_STACK_START
PTR_ADD sp, t0, t1
 
+   /* Save task's sp on IRQ stack so that unwinding can follow it */
+   LONG_S  s1, 0(sp)
 2:
jal plat_irq_dispatch
 
@@ -325,9 +327,11 @@ NESTED(except_vec_vi_handler, 0, sp)
beq t0, t1, 2f
 
/* Switch to IRQ stack */
-   li  t1, _IRQ_STACK_SIZE
+   li  t1, _IRQ_STACK_START
PTR_ADD sp, t0, t1
 
+   /* Save task's sp on IRQ stack so that unwinding can follow it */
+   LONG_S  s1, 0(sp)
 2:
jalrv0
 
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index fbbf5fcc695a..1b50958a1373 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -487,31 +487,52 @@ unsigned long notrace unwind_stack_by_address(unsigned 
long stack_page,
  unsigned long pc,
  unsigned long *ra)
 {
+   unsigned long low, high, irq_stack_high;
struct 

[PATCH for 4.9 06/39] net: dsa: b53: Include IMP/CPU port in dumb forwarding mode

[Levin, Alexander (Sasha Levin)]

From: Florian Fainelli 

[ Upstream commit a424f0de61638cbb5047e0a888c54da9cf471f90 ]

Since Broadcom tags are not enabled in b53 (DSA_PROTO_TAG_NONE), we need
to make sure that the IMP/CPU port is included in the forwarding
decision.

Without this change, switching between non-management ports would work,
but not between management ports and non-management ports thus breaking
the default state in which DSA switch are brought up.

Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch")
Reported-by: Eric Anholt 
Signed-off-by: Florian Fainelli 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/dsa/b53/b53_common.c | 10 ++
 drivers/net/dsa/b53/b53_regs.h   |  4 
 2 files changed, 14 insertions(+)

diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 3ec573c13dac..c26debc531ee 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -326,6 +326,7 @@ static void b53_get_vlan_entry(struct b53_device *dev, u16 
vid,
 
 static void b53_set_forwarding(struct b53_device *dev, int enable)
 {
+   struct dsa_switch *ds = dev->ds;
u8 mgmt;
 
b53_read8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, );
@@ -336,6 +337,15 @@ static void b53_set_forwarding(struct b53_device *dev, int 
enable)
mgmt &= ~SM_SW_FWD_EN;
 
b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, mgmt);
+
+   /* Include IMP port in dumb forwarding mode when no tagging protocol is
+* set
+*/
+   if (ds->ops->get_tag_protocol(ds) == DSA_TAG_PROTO_NONE) {
+   b53_read8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, );
+   mgmt |= B53_MII_DUMB_FWDG_EN;
+   b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, mgmt);
+   }
 }
 
 static void b53_enable_vlan(struct b53_device *dev, bool enable)
diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
index dac0af4e2cd0..81044000ce75 100644
--- a/drivers/net/dsa/b53/b53_regs.h
+++ b/drivers/net/dsa/b53/b53_regs.h
@@ -104,6 +104,10 @@
 #define  B53_UC_FWD_EN BIT(6)
 #define  B53_MC_FWD_EN BIT(7)
 
+/* Switch control (8 bit) */
+#define B53_SWITCH_CTRL0x22
+#define  B53_MII_DUMB_FWDG_EN  BIT(6)
+
 /* (16 bit) */
 #define B53_UC_FLOOD_MASK  0x32
 #define B53_MC_FLOOD_MASK  0x34
-- 
2.11.0

[PATCH for 4.9 07/39] qed: Fix possible system hang in the dcbnl-getdcbx() path.

[Levin, Alexander (Sasha Levin)]

From: "sudarsana.kall...@cavium.com" 

[ Upstream commit 62289ba27558553871fd047baadaaeda886c6a63 ]

qed_dcbnl_get_dcbx() API uses kmalloc in GFT_KERNEL mode. The API gets
invoked in the interrupt context by qed_dcbnl_getdcbx callback. Need
to invoke this kmalloc in atomic mode.

Signed-off-by: Sudarsana Reddy Kalluru 
Signed-off-by: Yuval Mintz 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c 
b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index a4789a93b692..9d59cb85c012 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -1222,7 +1222,7 @@ static struct qed_dcbx_get *qed_dcbnl_get_dcbx(struct 
qed_hwfn *hwfn,
 {
struct qed_dcbx_get *dcbx_info;
 
-   dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
+   dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_ATOMIC);
if (!dcbx_info)
return NULL;
 
-- 
2.11.0

[PATCH for 4.9 02/39] net/packet: check length in getsockopt() called with PACKET_HDRLEN

[Levin, Alexander (Sasha Levin)]

From: Alexander Potapenko 

[ Upstream commit fd2c83b35752f0a8236b976978ad4658df14a59f ]

In the case getsockopt() is called with PACKET_HDRLEN and optlen < 4
|val| remains uninitialized and the syscall may behave differently
depending on its value, and even copy garbage to userspace on certain
architectures. To fix this we now return -EINVAL if optlen is too small.

This bug has been detected with KMSAN.

Signed-off-by: Alexander Potapenko 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/packet/af_packet.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ae7bfd26cd91..2cf706f7defa 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3878,6 +3878,8 @@ static int packet_getsockopt(struct socket *sock, int 
level, int optname,
case PACKET_HDRLEN:
if (len > sizeof(int))
len = sizeof(int);
+   if (len < sizeof(int))
+   return -EINVAL;
if (copy_from_user(, optval, len))
return -EFAULT;
switch (val) {
-- 
2.11.0

[PATCH for 4.9 16/39] netfilter: invoke synchronize_rcu after set the _hook_ to NULL

[Levin, Alexander (Sasha Levin)]

From: Liping Zhang 

[ Upstream commit 3b7dabf029478bb80507a6c4500ca94132a2bc0b ]

Otherwise, another CPU may access the invalid pointer. For example:
CPU0CPU1
 -  rcu_read_lock();
 -  pfunc = _hook_;
  _hook_ = NULL;  -
  mod unload  -
 - pfunc(); // invalid, panic
 - rcu_read_unlock();

So we must call synchronize_rcu() to wait the rcu reader to finish.

Also note, in nf_nat_snmp_basic_fini, synchronize_rcu() will be invoked
by later nf_conntrack_helper_unregister, but I'm inclined to add a
explicit synchronize_rcu after set the nf_nat_snmp_hook to NULL. Depend
on such obscure assumptions is not a good idea.

Last, in nfnetlink_cttimeout, we use kfree_rcu to free the time object,
so in cttimeout_exit, invoking rcu_barrier() is not necessary at all,
remove it too.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Sasha Levin 
---
 net/ipv4/netfilter/nf_nat_snmp_basic.c | 1 +
 net/netfilter/nf_conntrack_ecache.c| 2 ++
 net/netfilter/nf_conntrack_netlink.c   | 1 +
 net/netfilter/nf_nat_core.c| 2 ++
 net/netfilter/nfnetlink_cttimeout.c| 2 +-
 5 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c 
b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index c9b52c361da2..5a8f7c360887 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1304,6 +1304,7 @@ static int __init nf_nat_snmp_basic_init(void)
 static void __exit nf_nat_snmp_basic_fini(void)
 {
RCU_INIT_POINTER(nf_nat_snmp_hook, NULL);
+   synchronize_rcu();
nf_conntrack_helper_unregister(_trap_helper);
 }
 
diff --git a/net/netfilter/nf_conntrack_ecache.c 
b/net/netfilter/nf_conntrack_ecache.c
index da9df2d56e66..22fc32143e9c 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -290,6 +290,7 @@ void nf_conntrack_unregister_notifier(struct net *net,
BUG_ON(notify != new);
RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, NULL);
mutex_unlock(_ct_ecache_mutex);
+   /* synchronize_rcu() is called from ctnetlink_exit. */
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
 
@@ -326,6 +327,7 @@ void nf_ct_expect_unregister_notifier(struct net *net,
BUG_ON(notify != new);
RCU_INIT_POINTER(net->ct.nf_expect_event_cb, NULL);
mutex_unlock(_ct_ecache_mutex);
+   /* synchronize_rcu() is called from ctnetlink_exit. */
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);
 
diff --git a/net/netfilter/nf_conntrack_netlink.c 
b/net/netfilter/nf_conntrack_netlink.c
index 04111c1c3988..d5caed5bcfb1 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3413,6 +3413,7 @@ static void __exit ctnetlink_exit(void)
 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
RCU_INIT_POINTER(nfnl_ct_hook, NULL);
 #endif
+   synchronize_rcu();
 }
 
 module_init(ctnetlink_init);
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index dde64c4565d2..2916f4815c9c 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -892,6 +892,8 @@ static void __exit nf_nat_cleanup(void)
 #ifdef CONFIG_XFRM
RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL);
 #endif
+   synchronize_rcu();
+
for (i = 0; i < NFPROTO_NUMPROTO; i++)
kfree(nf_nat_l4protos[i]);
 
diff --git a/net/netfilter/nfnetlink_cttimeout.c 
b/net/netfilter/nfnetlink_cttimeout.c
index 139e0867e56e..47d6656c9119 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -646,8 +646,8 @@ static void __exit cttimeout_exit(void)
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
+   synchronize_rcu();
 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-   rcu_barrier();
 }
 
 module_init(cttimeout_init);
-- 
2.11.0

[PATCH for 4.9 05/39] udp: disable inner UDP checksum offloads in IPsec case

[Levin, Alexander (Sasha Levin)]

From: Ansis Atteka 

[ Upstream commit b40c5f4fde22fb98eff205b3aece05b471c24eed ]

Otherwise, UDP checksum offloads could corrupt ESP packets by attempting
to calculate UDP checksum when this inner UDP packet is already protected
by IPsec.

One way to reproduce this bug is to have a VM with virtio_net driver (UFO
set to ON in the guest VM); and then encapsulate all guest's Ethernet
frames in Geneve; and then further encrypt Geneve with IPsec.  In this
case following symptoms are observed:
1. If using ixgbe NIC, then it will complain with following error message:
   ixgbe :01:00.1: partial checksum but l4 proto=32!
2. Receiving IPsec stack will drop all the corrupted ESP packets and
   increase XfrmInStateProtoError counter in /proc/net/xfrm_stat.
3. iperf UDP test from the VM with packet sizes above MTU will not work at
   all.
4. iperf TCP test from the VM will get ridiculously low performance because.

Signed-off-by: Ansis Atteka 
Co-authored-by: Steffen Klassert 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/ipv4/udp_offload.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 6de016f80f17..0932c85b42af 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -29,6 +29,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct 
sk_buff *skb,
u16 mac_len = skb->mac_len;
int udp_offset, outer_hlen;
__wsum partial;
+   bool need_ipsec;
 
if (unlikely(!pskb_may_pull(skb, tnl_hlen)))
goto out;
@@ -62,8 +63,10 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct 
sk_buff *skb,
 
ufo = !!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP);
 
+   need_ipsec = skb_dst(skb) && dst_xfrm(skb_dst(skb));
/* Try to offload checksum if possible */
offload_csum = !!(need_csum &&
+ !need_ipsec &&
  (skb->dev->features &
   (is_ipv6 ? (NETIF_F_HW_CSUM | NETIF_F_IPV6_CSUM) :
  (NETIF_F_HW_CSUM | NETIF_F_IP_CSUM;
-- 
2.11.0

[PATCH for 4.9 19/39] [media] exynos-gsc: Do not swap cb/cr for semi planar formats

[Levin, Alexander (Sasha Levin)]

From: Thibault Saunier 

[ Upstream commit d7f3e33df4fbdc9855fb151f4a328ec46447e3ba ]

In the case of semi planar formats cb and cr are in the same plane
in memory, meaning that will be set to 'cb' whatever the format is,
and whatever the (packed) order of those components are.

Suggested-by: Nicolas Dufresne 
Signed-off-by: Thibault Saunier 
Signed-off-by: Javier Martinez Canillas 
Acked-by: Sylwester Nawrocki 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
---
 drivers/media/platform/exynos-gsc/gsc-core.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c 
b/drivers/media/platform/exynos-gsc/gsc-core.c
index 787bd16c19e5..bbb5feef8308 100644
--- a/drivers/media/platform/exynos-gsc/gsc-core.c
+++ b/drivers/media/platform/exynos-gsc/gsc-core.c
@@ -849,9 +849,7 @@ int gsc_prepare_addr(struct gsc_ctx *ctx, struct vb2_buffer 
*vb,
 
if ((frame->fmt->pixelformat == V4L2_PIX_FMT_VYUY) ||
(frame->fmt->pixelformat == V4L2_PIX_FMT_YVYU) ||
-   (frame->fmt->pixelformat == V4L2_PIX_FMT_NV61) ||
(frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420) ||
-   (frame->fmt->pixelformat == V4L2_PIX_FMT_NV21) ||
(frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420M))
swap(addr->cb, addr->cr);
 
-- 
2.11.0

[PATCH for 4.9 27/39] x86/acpi: Restore the order of CPU IDs

[Levin, Alexander (Sasha Levin)]

From: Dou Liyang 

[ Upstream commit 2b85b3d22920db7473e5fed5719e7955c0ec323e ]

The following commits:

  f7c28833c2 ("x86/acpi: Enable acpi to register all possible cpus at
boot time") and 8f54969dc8 ("x86/acpi: Introduce persistent storage
for cpuid <-> apicid mapping")

... registered all the possible CPUs at boot time via ACPI tables to
make the mapping of cpuid <-> apicid fixed. Both enabled and disabled
CPUs could have a logical CPU ID after boot time.

But, ACPI tables are unreliable. the number amd order of Local APIC
entries which depends on the firmware is often inconsistent with the
physical devices. Even if they are consistent, The disabled CPUs which
take up some logical CPU IDs will also make the order discontinuous.

Revert the part of disabled CPUs registration, keep the allocation
logic of logical CPU IDs and also keep some code location changes.

Signed-off-by: Dou Liyang 
Tested-by: Xiaolong Ye 
Cc: r...@rjwysocki.net
Cc: linux-a...@vger.kernel.org
Cc: guzhe...@huawei.com
Cc: izumi.t...@jp.fujitsu.com
Cc: l...@kernel.org
Link: 
http://lkml.kernel.org/r/1488528147-2279-4-git-send-email-douly.f...@cn.fujitsu.com
Signed-off-by: Thomas Gleixner 
Signed-off-by: Sasha Levin 
---
 arch/x86/kernel/acpi/boot.c |  7 ++-
 arch/x86/kernel/apic/apic.c | 26 +++---
 2 files changed, 13 insertions(+), 20 deletions(-)

diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index d3e0d049a0c2..b89bef95f63b 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -176,10 +176,15 @@ static int acpi_register_lapic(int id, u32 acpiid, u8 
enabled)
return -EINVAL;
}
 
+   if (!enabled) {
+   ++disabled_cpus;
+   return -EINVAL;
+   }
+
if (boot_cpu_physical_apicid != -1U)
ver = boot_cpu_apic_version;
 
-   cpu = __generic_processor_info(id, ver, enabled);
+   cpu = generic_processor_info(id, ver);
if (cpu >= 0)
early_per_cpu(x86_cpu_to_acpiid, cpu) = acpiid;
 
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index f2234918e494..e2ead34da465 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -2070,7 +2070,7 @@ static int allocate_logical_cpuid(int apicid)
return nr_logical_cpuids++;
 }
 
-int __generic_processor_info(int apicid, int version, bool enabled)
+int generic_processor_info(int apicid, int version)
 {
int cpu, max = nr_cpu_ids;
bool boot_cpu_detected = physid_isset(boot_cpu_physical_apicid,
@@ -2128,11 +2128,9 @@ int __generic_processor_info(int apicid, int version, 
bool enabled)
if (num_processors >= nr_cpu_ids) {
int thiscpu = max + disabled_cpus;
 
-   if (enabled) {
-   pr_warning("APIC: NR_CPUS/possible_cpus limit of %i "
-  "reached. Processor %d/0x%x ignored.\n",
-  max, thiscpu, apicid);
-   }
+   pr_warning("APIC: NR_CPUS/possible_cpus limit of %i "
+  "reached. Processor %d/0x%x ignored.\n",
+  max, thiscpu, apicid);
 
disabled_cpus++;
return -EINVAL;
@@ -2184,23 +2182,13 @@ int __generic_processor_info(int apicid, int version, 
bool enabled)
apic->x86_32_early_logical_apicid(cpu);
 #endif
set_cpu_possible(cpu, true);
-
-   if (enabled) {
-   num_processors++;
-   physid_set(apicid, phys_cpu_present_map);
-   set_cpu_present(cpu, true);
-   } else {
-   disabled_cpus++;
-   }
+   physid_set(apicid, phys_cpu_present_map);
+   set_cpu_present(cpu, true);
+   num_processors++;
 
return cpu;
 }
 
-int generic_processor_info(int apicid, int version)
-{
-   return __generic_processor_info(apicid, version, true);
-}
-
 int hard_smp_processor_id(void)
 {
return read_apic_id();
-- 
2.11.0

[PATCH for 4.9 20/39] MIPS: smp-cps: Fix retrieval of VPE mask on big endian CPUs

[Levin, Alexander (Sasha Levin)]

From: Matt Redfearn 

[ Upstream commit fb2155e3c30dc2043b52020e26965067a3e7779c ]

The vpe_mask member of struct core_boot_config is of type atomic_t,
which is a 32bit type. In cps-vec.S this member was being retrieved by a
PTR_L macro, which on 64bit systems is a 64bit load. On little endian
systems this is OK, since the double word that is retrieved will have
the required less significant word in the correct position. However, on
big endian systems the less significant word of the load is retrieved
from address+4, and the more significant from address+0. The destination
register therefore ends up with the required word in the more
significant word
e.g. when starting the second VP of a big endian 64bit system, the load

PTR_Lta2, COREBOOTCFG_VPEMASK(a0)

ends up setting register ta2 to 0x0003

When this value is written to the CPC it is ignored, since it is
invalid to write anything larger than 4 bits. This results in any VP
other than VP0 in a core failing to start in 64bit big endian systems.

Change the load to a 32bit load word instruction to fix the bug.

Fixes: f12401d7219f ("MIPS: smp-cps: Pull boot config retrieval out of 
mips_cps_boot_vpes")
Signed-off-by: Matt Redfearn 
Cc: Paul Burton 
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/15787/
Signed-off-by: Ralf Baechle 
Signed-off-by: Sasha Levin 
---
 arch/mips/kernel/cps-vec.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
index 59476a607add..a00e87b0256d 100644
--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -361,7 +361,7 @@ LEAF(mips_cps_get_bootcfg)
END(mips_cps_get_bootcfg)
 
 LEAF(mips_cps_boot_vpes)
-   PTR_L   ta2, COREBOOTCFG_VPEMASK(a0)
+   lw  ta2, COREBOOTCFG_VPEMASK(a0)
PTR_L   ta3, COREBOOTCFG_VPECONFIG(a0)
 
 #if defined(CONFIG_CPU_MIPSR6)
-- 
2.11.0

[PATCH for 4.9 25/39] ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs

[Levin, Alexander (Sasha Levin)]

From: Nathan Fontenot 

[ Upstream commit 9501df3cd9204f5859f649182431616a31ee88a1 ]

The pointer array for the tx/rx sub crqs should be free'ed when
releasing the tx/rx sub crqs.

Signed-off-by: Nathan Fontenot 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/ibm/ibmvnic.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c 
b/drivers/net/ethernet/ibm/ibmvnic.c
index 9f2184be55dc..b8778e7b1f79 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1253,6 +1253,7 @@ static void release_sub_crqs(struct ibmvnic_adapter 
*adapter)
release_sub_crq_queue(adapter,
  adapter->tx_scrq[i]);
}
+   kfree(adapter->tx_scrq);
adapter->tx_scrq = NULL;
}
 
@@ -1265,6 +1266,7 @@ static void release_sub_crqs(struct ibmvnic_adapter 
*adapter)
release_sub_crq_queue(adapter,
  adapter->rx_scrq[i]);
}
+   kfree(adapter->rx_scrq);
adapter->rx_scrq = NULL;
}
 
-- 
2.11.0

[PATCH for 4.9 18/39] iommu/exynos: Block SYSMMU while invalidating FLPD cache

[Levin, Alexander (Sasha Levin)]

From: Marek Szyprowski 

[ Upstream commit 7d2aa6b814476a2e2794960f844344519246df72 ]

Documentation specifies that SYSMMU should be in blocked state while
performing TLB/FLPD cache invalidation, so add needed calls to
sysmmu_block/unblock.

Fixes: 66a7ed84b345d ("iommu/exynos: Apply workaround of caching fault page 
table entries")
Signed-off-by: Marek Szyprowski 
Signed-off-by: Joerg Roedel 
Signed-off-by: Sasha Levin 
---
 drivers/iommu/exynos-iommu.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index 30808e91b775..c7820b3ea80e 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -542,7 +542,10 @@ static void sysmmu_tlb_invalidate_flpdcache(struct 
sysmmu_drvdata *data,
spin_lock_irqsave(>lock, flags);
if (is_sysmmu_active(data) && data->version >= MAKE_MMU_VER(3, 3)) {
clk_enable(data->clk_master);
-   __sysmmu_tlb_invalidate_entry(data, iova, 1);
+   if (sysmmu_block(data)) {
+   __sysmmu_tlb_invalidate_entry(data, iova, 1);
+   sysmmu_unblock(data);
+   }
clk_disable(data->clk_master);
}
spin_unlock_irqrestore(>lock, flags);
-- 
2.11.0

[PATCH for 4.9 31/39] rds: ib: add error handle

[Levin, Alexander (Sasha Levin)]

From: Zhu Yanjun 

[ Upstream commit 3b12f73a5c2977153f28a224392fd4729b50d1dc ]

In the function rds_ib_setup_qp, the error handle is missing. When some
error occurs, it is possible that memory leak occurs. As such, error
handle is added.

Cc: Joe Jin 
Reviewed-by: Junxiao Bi 
Reviewed-by: Guanglei Li 
Signed-off-by: Zhu Yanjun 
Acked-by: Santosh Shilimkar 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/rds/ib_cm.c | 47 ---
 1 file changed, 36 insertions(+), 11 deletions(-)

diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 5b2ab95afa07..169156cfd4c8 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -405,7 +405,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
ret = PTR_ERR(ic->i_send_cq);
ic->i_send_cq = NULL;
rdsdebug("ib_create_cq send failed: %d\n", ret);
-   goto out;
+   goto rds_ibdev_out;
}
 
cq_attr.cqe = ic->i_recv_ring.w_nr;
@@ -416,19 +416,19 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
ret = PTR_ERR(ic->i_recv_cq);
ic->i_recv_cq = NULL;
rdsdebug("ib_create_cq recv failed: %d\n", ret);
-   goto out;
+   goto send_cq_out;
}
 
ret = ib_req_notify_cq(ic->i_send_cq, IB_CQ_NEXT_COMP);
if (ret) {
rdsdebug("ib_req_notify_cq send failed: %d\n", ret);
-   goto out;
+   goto recv_cq_out;
}
 
ret = ib_req_notify_cq(ic->i_recv_cq, IB_CQ_SOLICITED);
if (ret) {
rdsdebug("ib_req_notify_cq recv failed: %d\n", ret);
-   goto out;
+   goto recv_cq_out;
}
 
/* XXX negotiate max send/recv with remote? */
@@ -453,7 +453,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
ret = rdma_create_qp(ic->i_cm_id, ic->i_pd, );
if (ret) {
rdsdebug("rdma_create_qp failed: %d\n", ret);
-   goto out;
+   goto recv_cq_out;
}
 
ic->i_send_hdrs = ib_dma_alloc_coherent(dev,
@@ -463,7 +463,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_send_hdrs) {
ret = -ENOMEM;
rdsdebug("ib_dma_alloc_coherent send failed\n");
-   goto out;
+   goto qp_out;
}
 
ic->i_recv_hdrs = ib_dma_alloc_coherent(dev,
@@ -473,7 +473,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_recv_hdrs) {
ret = -ENOMEM;
rdsdebug("ib_dma_alloc_coherent recv failed\n");
-   goto out;
+   goto send_hdrs_dma_out;
}
 
ic->i_ack = ib_dma_alloc_coherent(dev, sizeof(struct rds_header),
@@ -481,7 +481,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_ack) {
ret = -ENOMEM;
rdsdebug("ib_dma_alloc_coherent ack failed\n");
-   goto out;
+   goto recv_hdrs_dma_out;
}
 
ic->i_sends = vzalloc_node(ic->i_send_ring.w_nr * sizeof(struct 
rds_ib_send_work),
@@ -489,7 +489,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_sends) {
ret = -ENOMEM;
rdsdebug("send allocation failed\n");
-   goto out;
+   goto ack_dma_out;
}
 
ic->i_recvs = vzalloc_node(ic->i_recv_ring.w_nr * sizeof(struct 
rds_ib_recv_work),
@@ -497,7 +497,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
if (!ic->i_recvs) {
ret = -ENOMEM;
rdsdebug("recv allocation failed\n");
-   goto out;
+   goto sends_out;
}
 
rds_ib_recv_init_ack(ic);
@@ -505,8 +505,33 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
rdsdebug("conn %p pd %p cq %p %p\n", conn, ic->i_pd,
 ic->i_send_cq, ic->i_recv_cq);
 
-out:
+   return ret;
+
+sends_out:
+   vfree(ic->i_sends);
+ack_dma_out:
+   ib_dma_free_coherent(dev, sizeof(struct rds_header),
+ic->i_ack, ic->i_ack_dma);
+recv_hdrs_dma_out:
+   ib_dma_free_coherent(dev, ic->i_recv_ring.w_nr *
+   sizeof(struct rds_header),
+   ic->i_recv_hdrs, ic->i_recv_hdrs_dma);
+send_hdrs_dma_out:
+   ib_dma_free_coherent(dev, ic->i_send_ring.w_nr *
+   sizeof(struct rds_header),
+   ic->i_send_hdrs, ic->i_send_hdrs_dma);
+qp_out:
+   rdma_destroy_qp(ic->i_cm_id);
+recv_cq_out:
+   if (!ib_destroy_cq(ic->i_recv_cq))
+   

[PATCH for 4.9 30/39] mm/cgroup: avoid panic when init with low memory

[Levin, Alexander (Sasha Levin)]

From: Laurent Dufour 

[ Upstream commit bfc7228b9a9647e1c353e50b40297a2929801759 ]

The system may panic when initialisation is done when almost all the
memory is assigned to the huge pages using the kernel command line
parameter hugepage=.  Panic may occur like this:

  Unable to handle kernel paging request for data at address 0x
  Faulting instruction address: 0xc0302b88
  Oops: Kernel access of bad area, sig: 11 [#1]
  SMP NR_CPUS=2048 [0.082424] NUMA
  pSeries
  Modules linked in:
  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.9.0-15-generic #16-Ubuntu
  task: c0021ed01600 task.stack: c0010d108000
  NIP: c0302b88 LR: c0270e04 CTR: c016cfd0
  REGS: c0010d10b2c0 TRAP: 0300   Not tainted (4.9.0-15-generic)
  MSR: 82009033 [ 0.082770]   CR: 28424422  
XER: 
  CFAR: c03d28b8 DAR:  DSISR: 4000 SOFTE: 1
  GPR00: c0270e04 c0010d10b540 c141a300 c0010fff6300
  GPR04:  026012c0 c0010d10b630 000487ab
  GPR08: 00010ee9 c1454fd8  
  GPR12: 4400 cfb8 026012c0 026012c0
  GPR16: 026012c0   0002
  GPR20: 000c   024200c0
  GPR24: c16eef48  c0010fff7d00 026012c0
  GPR28:  c0010fff7d00 c0010fff6300 c0010d10b6d0
  NIP mem_cgroup_soft_limit_reclaim+0xf8/0x4f0
  LR do_try_to_free_pages+0x1b4/0x450
  Call Trace:
do_try_to_free_pages+0x1b4/0x450
try_to_free_pages+0xf8/0x270
__alloc_pages_nodemask+0x7a8/0xff0
new_slab+0x104/0x8e0
___slab_alloc+0x620/0x700
__slab_alloc+0x34/0x60
kmem_cache_alloc_node_trace+0xdc/0x310
mem_cgroup_init+0x158/0x1c8
do_one_initcall+0x68/0x1d0
kernel_init_freeable+0x278/0x360
kernel_init+0x24/0x170
ret_from_kernel_thread+0x5c/0x74
  Instruction dump:
  eb81ffe0 eba1ffe8 ebc1fff0 ebe1fff8 4e800020 3d230001 e9499a42 3d220004
  3929acd8 794a1f24 7d295214 eac90100  2fa9 419eff74 3b20
  ---[ end trace 342f5208b00d01b6 ]---

This is a chicken and egg issue where the kernel try to get free memory
when allocating per node data in mem_cgroup_init(), but in that path
mem_cgroup_soft_limit_reclaim() is called which assumes that these data
are allocated.

As mem_cgroup_soft_limit_reclaim() is best effort, it should return when
these data are not yet allocated.

This patch also fixes potential null pointer access in
mem_cgroup_remove_from_trees() and mem_cgroup_update_tree().

Link: 
http://lkml.kernel.org/r/1487856999-16581-2-git-send-email-lduf...@linux.vnet.ibm.com
Signed-off-by: Laurent Dufour 
Acked-by: Michal Hocko 
Acked-by: Johannes Weiner 
Acked-by: Balbir Singh 
Cc: Vladimir Davydov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
---
 mm/memcontrol.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 47559cc0cdcc..2a800c4a39bd 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -462,6 +462,8 @@ static void mem_cgroup_update_tree(struct mem_cgroup 
*memcg, struct page *page)
struct mem_cgroup_tree_per_node *mctz;
 
mctz = soft_limit_tree_from_page(page);
+   if (!mctz)
+   return;
/*
 * Necessary to update all ancestors when hierarchy is used.
 * because their event counter is not touched.
@@ -499,7 +501,8 @@ static void mem_cgroup_remove_from_trees(struct mem_cgroup 
*memcg)
for_each_node(nid) {
mz = mem_cgroup_nodeinfo(memcg, nid);
mctz = soft_limit_tree_node(nid);
-   mem_cgroup_remove_exceeded(mz, mctz);
+   if (mctz)
+   mem_cgroup_remove_exceeded(mz, mctz);
}
 }
 
@@ -2565,7 +2568,7 @@ unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t 
*pgdat, int order,
 * is empty. Do it lockless to prevent lock bouncing. Races
 * are acceptable as soft limit is best effort anyway.
 */
-   if (RB_EMPTY_ROOT(>rb_root))
+   if (!mctz || RB_EMPTY_ROOT(>rb_root))
return 0;
 
/*
-- 
2.11.0

[PATCH for 4.9 35/39] xfs: remove kmem_zalloc_greedy

[Levin, Alexander (Sasha Levin)]

From: "Darrick J. Wong" 

[ Upstream commit 08b005f1333154ae5b404ca28766e0ffb9f1c150 ]

The sole remaining caller of kmem_zalloc_greedy is bulkstat, which uses
it to grab 1-4 pages for staging of inobt records.  The infinite loop in
the greedy allocation function is causing hangs[1] in generic/269, so
just get rid of the greedy allocator in favor of kmem_zalloc_large.
This makes bulkstat somewhat more likely to ENOMEM if there's really no
pages to spare, but eliminates a source of hangs.

[1] 
http://lkml.kernel.org/r/20170301044634.rgidgdqqiiwsmfpj%40XZHOUW.usersys.redhat.com

Signed-off-by: Darrick J. Wong 
Reviewed-by: Christoph Hellwig 
---
v2: remove single-page fallback

Signed-off-by: Sasha Levin 
---
 fs/xfs/kmem.c   | 18 --
 fs/xfs/kmem.h   |  2 --
 fs/xfs/xfs_itable.c |  6 ++
 3 files changed, 2 insertions(+), 24 deletions(-)

diff --git a/fs/xfs/kmem.c b/fs/xfs/kmem.c
index 339c696bbc01..bb2beaef531a 100644
--- a/fs/xfs/kmem.c
+++ b/fs/xfs/kmem.c
@@ -24,24 +24,6 @@
 #include "kmem.h"
 #include "xfs_message.h"
 
-/*
- * Greedy allocation.  May fail and may return vmalloced memory.
- */
-void *
-kmem_zalloc_greedy(size_t *size, size_t minsize, size_t maxsize)
-{
-   void*ptr;
-   size_t  kmsize = maxsize;
-
-   while (!(ptr = vzalloc(kmsize))) {
-   if ((kmsize >>= 1) <= minsize)
-   kmsize = minsize;
-   }
-   if (ptr)
-   *size = kmsize;
-   return ptr;
-}
-
 void *
 kmem_alloc(size_t size, xfs_km_flags_t flags)
 {
diff --git a/fs/xfs/kmem.h b/fs/xfs/kmem.h
index 689f746224e7..f0fc84fcaac2 100644
--- a/fs/xfs/kmem.h
+++ b/fs/xfs/kmem.h
@@ -69,8 +69,6 @@ static inline void  kmem_free(const void *ptr)
 }
 
 
-extern void *kmem_zalloc_greedy(size_t *, size_t, size_t);
-
 static inline void *
 kmem_zalloc(size_t size, xfs_km_flags_t flags)
 {
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index d8a77dbf4e3a..26d67ce3c18d 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -361,7 +361,6 @@ xfs_bulkstat(
xfs_agino_t agino;  /* inode # in allocation group */
xfs_agnumber_t  agno;   /* allocation group number */
xfs_btree_cur_t *cur;   /* btree cursor for ialloc btree */
-   size_t  irbsize; /* size of irec buffer in bytes */
xfs_inobt_rec_incore_t  *irbuf; /* start of irec buffer */
int nirbuf; /* size of irbuf */
int ubcount; /* size of user's buffer */
@@ -388,11 +387,10 @@ xfs_bulkstat(
*ubcountp = 0;
*done = 0;
 
-   irbuf = kmem_zalloc_greedy(, PAGE_SIZE, PAGE_SIZE * 4);
+   irbuf = kmem_zalloc_large(PAGE_SIZE * 4, KM_SLEEP);
if (!irbuf)
return -ENOMEM;
-
-   nirbuf = irbsize / sizeof(*irbuf);
+   nirbuf = (PAGE_SIZE * 4) / sizeof(*irbuf);
 
/*
 * Loop over the allocation groups, starting from the last
-- 
2.11.0

[PATCH for 4.9 32/39] md/raid10: submit bio directly to replacement disk

[Levin, Alexander (Sasha Levin)]

From: Shaohua Li 

[ Upstream commit 6d399783e9d4e9bd44931501948059d24ad96ff8 ]

Commit 57c67df(md/raid10: submit IO from originating thread instead of
md thread) submits bio directly for normal disks but not for replacement
disks. There is no point we shouldn't do this for replacement disks.

Cc: NeilBrown 
Signed-off-by: Shaohua Li 
Signed-off-by: Sasha Levin 
---
 drivers/md/raid10.c | 19 ---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 4c4aab02e311..b19b551bb34b 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1407,11 +1407,24 @@ static void __make_request(struct mddev *mddev, struct 
bio *bio)
mbio->bi_private = r10_bio;
 
atomic_inc(_bio->remaining);
+
+   cb = blk_check_plugged(raid10_unplug, mddev,
+  sizeof(*plug));
+   if (cb)
+   plug = container_of(cb, struct raid10_plug_cb,
+   cb);
+   else
+   plug = NULL;
spin_lock_irqsave(>device_lock, flags);
-   bio_list_add(>pending_bio_list, mbio);
-   conf->pending_count++;
+   if (plug) {
+   bio_list_add(>pending, mbio);
+   plug->pending_cnt++;
+   } else {
+   bio_list_add(>pending_bio_list, mbio);
+   conf->pending_count++;
+   }
spin_unlock_irqrestore(>device_lock, flags);
-   if (!mddev_check_plugged(mddev))
+   if (!plug)
md_wakeup_thread(mddev->thread);
}
}
-- 
2.11.0

[PATCH for 4.9 37/39] libata: transport: Remove circular dependency at free time

[Levin, Alexander (Sasha Levin)]

From: Gwendal Grignou 

[ Upstream commit d85fc67dd11e9a32966140677d4d6429ca540b25 ]

Without this patch, failed probe would not free resources like irq.

ata port tdev object currently hold a reference to the ata port
object.  Therefore the ata port object release function will not get
called until the ata_tport_release is called. But that would never
happen, releasing the last reference of ata port dev is done by
scsi_host_release, which is called by ata_host_release when the ata
port object is released.

The ata device objects actually do not need to explicitly hold a
reference to their real counterpart, given the transport objects are
the children of these objects and device_add() is call for each child.
We know the parent will not be deleted until we call the child's
device_del().

Reported-by: Matthew Whitehead 
Tested-by: Matthew Whitehead 
Suggested-by: Tejun Heo 
Signed-off-by: Gwendal Grignou 
Signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin 
---
 drivers/ata/libata-transport.c | 9 +++--
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
index 7ef16c085058..20e2b7ad8925 100644
--- a/drivers/ata/libata-transport.c
+++ b/drivers/ata/libata-transport.c
@@ -224,7 +224,6 @@ static DECLARE_TRANSPORT_CLASS(ata_port_class,
 
 static void ata_tport_release(struct device *dev)
 {
-   put_device(dev->parent);
 }
 
 /**
@@ -284,7 +283,7 @@ int ata_tport_add(struct device *parent,
device_initialize(dev);
dev->type = _port_type;
 
-   dev->parent = get_device(parent);
+   dev->parent = parent;
dev->release = ata_tport_release;
dev_set_name(dev, "ata%d", ap->print_id);
transport_setup_device(dev);
@@ -348,7 +347,6 @@ static DECLARE_TRANSPORT_CLASS(ata_link_class,
 
 static void ata_tlink_release(struct device *dev)
 {
-   put_device(dev->parent);
 }
 
 /**
@@ -410,7 +408,7 @@ int ata_tlink_add(struct ata_link *link)
int error;
 
device_initialize(dev);
-   dev->parent = get_device(>tdev);
+   dev->parent = >tdev;
dev->release = ata_tlink_release;
if (ata_is_host_link(link))
dev_set_name(dev, "link%d", ap->print_id);
@@ -589,7 +587,6 @@ static DECLARE_TRANSPORT_CLASS(ata_dev_class,
 
 static void ata_tdev_release(struct device *dev)
 {
-   put_device(dev->parent);
 }
 
 /**
@@ -662,7 +659,7 @@ static int ata_tdev_add(struct ata_device *ata_dev)
int error;
 
device_initialize(dev);
-   dev->parent = get_device(>tdev);
+   dev->parent = >tdev;
dev->release = ata_tdev_release;
if (ata_is_host_link(link))
dev_set_name(dev, "dev%d.%d", ap->print_id,ata_dev->devno);
-- 
2.11.0

[PATCH for 4.9 38/39] ARM: dts: BCM5301X: Fix memory start address

[Levin, Alexander (Sasha Levin)]

From: Jon Mason 

[ Upstream commit 88d1fa70c21d7b431386cfe70cdc514d98b0c9c4 ]

Memory starts at 0x8000, not 0.  0 "works" due to mirrior of the
first 128M of RAM to that address.  Anything greater than 128M will
quickly find nothing there.  Correcting the starting address has
everything working again.

Signed-off-by: Jon Mason 
Fixes: 7eb05f6d ("ARM: dts: bcm5301x: Add BCM SVK DT files")
Signed-off-by: Florian Fainelli 
Signed-off-by: Sasha Levin 
---
 arch/arm/boot/dts/bcm953012k.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/bcm953012k.dts b/arch/arm/boot/dts/bcm953012k.dts
index 05a985a20378..6208e85acd9d 100644
--- a/arch/arm/boot/dts/bcm953012k.dts
+++ b/arch/arm/boot/dts/bcm953012k.dts
@@ -48,7 +48,7 @@
};
 
memory {
-   reg = <0x 0x1000>;
+   reg = <0x8000 0x1000>;
};
 };
 
-- 
2.11.0

[PATCH for 4.9 29/39] arm64: kasan: avoid bad virt_to_pfn()

[Levin, Alexander (Sasha Levin)]

From: Mark Rutland 

[ Upstream commit b0de0ccc8b9edd8846828e0ecdc35deacdf186b0 ]

Booting a v4.11-rc1 kernel with DEBUG_VIRTUAL and KASAN enabled produces
the following splat (trimmed for brevity):

[0.00] virt_to_phys used for non-linear address: 2808 
(0x2808)
[0.00] WARNING: CPU: 0 PID: 0 at arch/arm64/mm/physaddr.c:14 
__virt_to_phys+0x48/0x70
[0.00] PC is at __virt_to_phys+0x48/0x70
[0.00] LR is at __virt_to_phys+0x48/0x70
[0.00] Call trace:
[0.00] [] __virt_to_phys+0x48/0x70
[0.00] [] kasan_init+0x1c0/0x498
[0.00] [] setup_arch+0x2fc/0x948
[0.00] [] start_kernel+0xb8/0x570
[0.00] [] __primary_switched+0x6c/0x74

This is because we use virt_to_pfn() on a kernel image address when
trying to figure out its nid, so that we can allocate its shadow from
the same node.

As with other recent changes, this patch uses lm_alias() to solve this.

We could instead use NUMA_NO_NODE, as x86 does for all shadow
allocations, though we'll likely want the "real" memory shadow to be
backed from its corresponding nid anyway, so we may as well be
consistent and find the nid for the image shadow.

Cc: Catalin Marinas 
Cc: Will Deacon 
Acked-by: Laura Abbott 
Signed-off-by: Mark Rutland 
Signed-off-by: Will Deacon 
Signed-off-by: Sasha Levin 
---
 arch/arm64/mm/kasan_init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c
index 757009daa9ed..ff43da269fe8 100644
--- a/arch/arm64/mm/kasan_init.c
+++ b/arch/arm64/mm/kasan_init.c
@@ -153,7 +153,7 @@ void __init kasan_init(void)
clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);
 
vmemmap_populate(kimg_shadow_start, kimg_shadow_end,
-pfn_to_nid(virt_to_pfn(_text)));
+pfn_to_nid(virt_to_pfn(lm_alias(_text;
 
/*
 * vmemmap_populate() has populated the shadow region that covers the
-- 
2.11.0

[PATCH for 4.9 36/39] ASoC: wm_adsp: Return an error on write to a disabled volatile control

[Levin, Alexander (Sasha Levin)]

From: Charles Keepax 

[ Upstream commit 67430a39ca7a6af28aade5acb92d43ee257c1014 ]

Volatile controls should only be accessed when the firmware is active,
currently however writes to these controls will succeed, but the data
will be lost, if the firmware is powered down. Update this behaviour such
that an error is returned the same as it is for reads.

Signed-off-by: Charles Keepax 
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin 
---
 sound/soc/codecs/wm_adsp.c | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index b943dde8dbe5..3bdd81930486 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -789,7 +789,10 @@ static int wm_coeff_put(struct snd_kcontrol *kctl,
 
mutex_lock(>dsp->pwr_lock);
 
-   memcpy(ctl->cache, p, ctl->len);
+   if (ctl->flags & WMFW_CTL_FLAG_VOLATILE)
+   ret = -EPERM;
+   else
+   memcpy(ctl->cache, p, ctl->len);
 
ctl->set = 1;
if (ctl->enabled && ctl->dsp->running)
@@ -816,6 +819,8 @@ static int wm_coeff_tlv_put(struct snd_kcontrol *kctl,
ctl->set = 1;
if (ctl->enabled && ctl->dsp->running)
ret = wm_coeff_write_control(ctl, ctl->cache, size);
+   else if (ctl->flags & WMFW_CTL_FLAG_VOLATILE)
+   ret = -EPERM;
}
 
mutex_unlock(>dsp->pwr_lock);
-- 
2.11.0

[PATCH for 4.9 24/39] nfs: make nfs4_cb_sv_ops static

[Levin, Alexander (Sasha Levin)]

From: Jason Yan 

[ Upstream commit 05fae7bbc237bc7de0ee9c3dcf85b2572a80e3b5 ]

Fixes the following sparse warning:

fs/nfs/callback.c:235:21: warning: symbol 'nfs4_cb_sv_ops' was not
declared. Should it be static?

Signed-off-by: Jason Yan 
Signed-off-by: Anna Schumaker 
Signed-off-by: Sasha Levin 
---
 fs/nfs/callback.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 0a2115084c3f..a227bd835439 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -231,12 +231,12 @@ static struct svc_serv_ops nfs41_cb_sv_ops = {
.svo_module = THIS_MODULE,
 };
 
-struct svc_serv_ops *nfs4_cb_sv_ops[] = {
+static struct svc_serv_ops *nfs4_cb_sv_ops[] = {
[0] = _cb_sv_ops,
[1] = _cb_sv_ops,
 };
 #else
-struct svc_serv_ops *nfs4_cb_sv_ops[] = {
+static struct svc_serv_ops *nfs4_cb_sv_ops[] = {
[0] = _cb_sv_ops,
[1] = NULL,
 };
-- 
2.11.0

[PATCH for 4.9 34/39] i2c: meson: fix wrong variable usage in meson_i2c_put_data

[Levin, Alexander (Sasha Levin)]

From: Heiner Kallweit 

[ Upstream commit 3b0277f198ac928f323c42e180680d2f79aa980d ]

Most likely a copy & paste error.

Signed-off-by: Heiner Kallweit 
Acked-by: Jerome Brunet 
Signed-off-by: Wolfram Sang 
Fixes: 30021e3707a7 ("i2c: add support for Amlogic Meson I2C controller")
Signed-off-by: Sasha Levin 
---
 drivers/i2c/busses/i2c-meson.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
index 2aa61bbbd307..73b97c71a484 100644
--- a/drivers/i2c/busses/i2c-meson.c
+++ b/drivers/i2c/busses/i2c-meson.c
@@ -175,7 +175,7 @@ static void meson_i2c_put_data(struct meson_i2c *i2c, char 
*buf, int len)
wdata1 |= *buf++ << ((i - 4) * 8);
 
writel(wdata0, i2c->regs + REG_TOK_WDATA0);
-   writel(wdata0, i2c->regs + REG_TOK_WDATA1);
+   writel(wdata1, i2c->regs + REG_TOK_WDATA1);
 
dev_dbg(i2c->dev, "%s: data %08x %08x len %d\n", __func__,
wdata0, wdata1, len);
-- 
2.11.0

[PATCH for 4.9 39/39] tools/power turbostat: bugfix: GFXMHz column not changing

[Levin, Alexander (Sasha Levin)]

From: Len Brown 

[ Upstream commit 22048c5485503749754b3b5daf9d99ef89fcacdc ]

turbostat displays a GFXMHz column, which comes from reading
/sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz

But GFXMHz was not changing, even when a manual
cat /sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz
showed a new value.

It turns out that a rewind() on the open file is not sufficient,
fflush() (or a close/open) is needed to read fresh values.

Reported-by: Yaroslav Isakov 
Signed-off-by: Len Brown 
Signed-off-by: Sasha Levin 
---
 tools/power/x86/turbostat/turbostat.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/power/x86/turbostat/turbostat.c 
b/tools/power/x86/turbostat/turbostat.c
index 3e199b508a96..9664b1ff4285 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -2003,8 +2003,10 @@ int snapshot_gfx_mhz(void)
 
if (fp == NULL)
fp = 
fopen_or_die("/sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz", "r");
-   else
+   else {
rewind(fp);
+   fflush(fp);
+   }
 
retval = fscanf(fp, "%d", _cur_mhz);
if (retval != 1)
-- 
2.11.0