[PATCH for 4.9 28/39] iommu/io-pgtable-arm: Check for leaf entry before dereferencing it

From: Oleksandr Tyshchenko [ Upstream commit ed46e66cc1b3d684042f92dfa2ab15ee917b4cac ] Do a check for already installed leaf entry at the current level before dereferencing it in order to avoid walking the page table down with wrong pointer to the next level.

[PATCH for 4.9 28/39] iommu/io-pgtable-arm: Check for leaf entry before dereferencing it

From: Oleksandr Tyshchenko [ Upstream commit ed46e66cc1b3d684042f92dfa2ab15ee917b4cac ] Do a check for already installed leaf entry at the current level before dereferencing it in order to avoid walking the page table down with wrong pointer to the next level. Signed-off-by: Oleksandr

[PATCH for 4.9 23/39] parisc: perf: Fix potential NULL pointer dereference

From: Arvind Yadav [ Upstream commit 74e3f6e63da6c8e8246fba1689e040bc926b4a1a ] Fix potential NULL pointer dereference and clean up coding style errors (code indent, trailing whitespaces). Signed-off-by: Arvind Yadav Signed-off-by: Helge

[PATCH for 4.9 23/39] parisc: perf: Fix potential NULL pointer dereference

From: Arvind Yadav [ Upstream commit 74e3f6e63da6c8e8246fba1689e040bc926b4a1a ] Fix potential NULL pointer dereference and clean up coding style errors (code indent, trailing whitespaces). Signed-off-by: Arvind Yadav Signed-off-by: Helge Deller Signed-off-by: Sasha Levin ---

[PATCH for 4.9 36/39] ASoC: wm_adsp: Return an error on write to a disabled volatile control

From: Charles Keepax [ Upstream commit 67430a39ca7a6af28aade5acb92d43ee257c1014 ] Volatile controls should only be accessed when the firmware is active, currently however writes to these controls will succeed, but the data will be lost, if the firmware is

[PATCH for 4.9 36/39] ASoC: wm_adsp: Return an error on write to a disabled volatile control

From: Charles Keepax [ Upstream commit 67430a39ca7a6af28aade5acb92d43ee257c1014 ] Volatile controls should only be accessed when the firmware is active, currently however writes to these controls will succeed, but the data will be lost, if the firmware is powered down. Update this behaviour

[PATCH for 4.9 37/39] libata: transport: Remove circular dependency at free time

From: Gwendal Grignou [ Upstream commit d85fc67dd11e9a32966140677d4d6429ca540b25 ] Without this patch, failed probe would not free resources like irq. ata port tdev object currently hold a reference to the ata port object. Therefore the ata port object release function

[PATCH for 4.9 38/39] ARM: dts: BCM5301X: Fix memory start address

From: Jon Mason [ Upstream commit 88d1fa70c21d7b431386cfe70cdc514d98b0c9c4 ] Memory starts at 0x8000, not 0. 0 "works" due to mirrior of the first 128M of RAM to that address. Anything greater than 128M will quickly find nothing there. Correcting the starting

[PATCH for 4.9 29/39] arm64: kasan: avoid bad virt_to_pfn()

From: Mark Rutland [ Upstream commit b0de0ccc8b9edd8846828e0ecdc35deacdf186b0 ] Booting a v4.11-rc1 kernel with DEBUG_VIRTUAL and KASAN enabled produces the following splat (trimmed for brevity): [0.00] virt_to_phys used for non-linear address: 2808

[PATCH for 4.9 37/39] libata: transport: Remove circular dependency at free time

From: Gwendal Grignou [ Upstream commit d85fc67dd11e9a32966140677d4d6429ca540b25 ] Without this patch, failed probe would not free resources like irq. ata port tdev object currently hold a reference to the ata port object. Therefore the ata port object release function will not get called

[PATCH for 4.9 38/39] ARM: dts: BCM5301X: Fix memory start address

From: Jon Mason [ Upstream commit 88d1fa70c21d7b431386cfe70cdc514d98b0c9c4 ] Memory starts at 0x8000, not 0. 0 "works" due to mirrior of the first 128M of RAM to that address. Anything greater than 128M will quickly find nothing there. Correcting the starting address has everything

[PATCH for 4.9 29/39] arm64: kasan: avoid bad virt_to_pfn()

From: Mark Rutland [ Upstream commit b0de0ccc8b9edd8846828e0ecdc35deacdf186b0 ] Booting a v4.11-rc1 kernel with DEBUG_VIRTUAL and KASAN enabled produces the following splat (trimmed for brevity): [0.00] virt_to_phys used for non-linear address: 2808 (0x2808) [

[PATCH for 4.9 39/39] tools/power turbostat: bugfix: GFXMHz column not changing

From: Len Brown [ Upstream commit 22048c5485503749754b3b5daf9d99ef89fcacdc ] turbostat displays a GFXMHz column, which comes from reading /sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz But GFXMHz was not changing, even when a manual cat

[PATCH for 4.9 39/39] tools/power turbostat: bugfix: GFXMHz column not changing

From: Len Brown [ Upstream commit 22048c5485503749754b3b5daf9d99ef89fcacdc ] turbostat displays a GFXMHz column, which comes from reading /sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz But GFXMHz was not changing, even when a manual cat

[PATCH for 4.9 32/39] md/raid10: submit bio directly to replacement disk

From: Shaohua Li [ Upstream commit 6d399783e9d4e9bd44931501948059d24ad96ff8 ] Commit 57c67df(md/raid10: submit IO from originating thread instead of md thread) submits bio directly for normal disks but not for replacement disks. There is no point we shouldn't do this for

[PATCH for 4.9 32/39] md/raid10: submit bio directly to replacement disk

From: Shaohua Li [ Upstream commit 6d399783e9d4e9bd44931501948059d24ad96ff8 ] Commit 57c67df(md/raid10: submit IO from originating thread instead of md thread) submits bio directly for normal disks but not for replacement disks. There is no point we shouldn't do this for replacement disks. Cc:

[PATCH for 4.9 31/39] rds: ib: add error handle

From: Zhu Yanjun [ Upstream commit 3b12f73a5c2977153f28a224392fd4729b50d1dc ] In the function rds_ib_setup_qp, the error handle is missing. When some error occurs, it is possible that memory leak occurs. As such, error handle is added. Cc: Joe Jin

[PATCH for 4.9 30/39] mm/cgroup: avoid panic when init with low memory

From: Laurent Dufour [ Upstream commit bfc7228b9a9647e1c353e50b40297a2929801759 ] The system may panic when initialisation is done when almost all the memory is assigned to the huge pages using the kernel command line parameter hugepage=. Panic may occur like

[PATCH for 4.9 35/39] xfs: remove kmem_zalloc_greedy

From: "Darrick J. Wong" [ Upstream commit 08b005f1333154ae5b404ca28766e0ffb9f1c150 ] The sole remaining caller of kmem_zalloc_greedy is bulkstat, which uses it to grab 1-4 pages for staging of inobt records. The infinite loop in the greedy allocation function is

[PATCH for 4.9 31/39] rds: ib: add error handle

From: Zhu Yanjun [ Upstream commit 3b12f73a5c2977153f28a224392fd4729b50d1dc ] In the function rds_ib_setup_qp, the error handle is missing. When some error occurs, it is possible that memory leak occurs. As such, error handle is added. Cc: Joe Jin Reviewed-by: Junxiao Bi Reviewed-by:

[PATCH for 4.9 30/39] mm/cgroup: avoid panic when init with low memory

From: Laurent Dufour [ Upstream commit bfc7228b9a9647e1c353e50b40297a2929801759 ] The system may panic when initialisation is done when almost all the memory is assigned to the huge pages using the kernel command line parameter hugepage=. Panic may occur like this: Unable to handle

[PATCH for 4.9 35/39] xfs: remove kmem_zalloc_greedy

From: "Darrick J. Wong" [ Upstream commit 08b005f1333154ae5b404ca28766e0ffb9f1c150 ] The sole remaining caller of kmem_zalloc_greedy is bulkstat, which uses it to grab 1-4 pages for staging of inobt records. The infinite loop in the greedy allocation function is causing hangs[1] in

[PATCH for 4.9 24/39] nfs: make nfs4_cb_sv_ops static

From: Jason Yan [ Upstream commit 05fae7bbc237bc7de0ee9c3dcf85b2572a80e3b5 ] Fixes the following sparse warning: fs/nfs/callback.c:235:21: warning: symbol 'nfs4_cb_sv_ops' was not declared. Should it be static? Signed-off-by: Jason Yan Signed-off-by:

[PATCH for 4.9 34/39] i2c: meson: fix wrong variable usage in meson_i2c_put_data

From: Heiner Kallweit [ Upstream commit 3b0277f198ac928f323c42e180680d2f79aa980d ] Most likely a copy & paste error. Signed-off-by: Heiner Kallweit Acked-by: Jerome Brunet Signed-off-by: Wolfram Sang

[PATCH for 4.9 24/39] nfs: make nfs4_cb_sv_ops static

From: Jason Yan [ Upstream commit 05fae7bbc237bc7de0ee9c3dcf85b2572a80e3b5 ] Fixes the following sparse warning: fs/nfs/callback.c:235:21: warning: symbol 'nfs4_cb_sv_ops' was not declared. Should it be static? Signed-off-by: Jason Yan Signed-off-by: Anna Schumaker Signed-off-by: Sasha

[PATCH for 4.9 34/39] i2c: meson: fix wrong variable usage in meson_i2c_put_data

From: Heiner Kallweit [ Upstream commit 3b0277f198ac928f323c42e180680d2f79aa980d ] Most likely a copy & paste error. Signed-off-by: Heiner Kallweit Acked-by: Jerome Brunet Signed-off-by: Wolfram Sang Fixes: 30021e3707a7 ("i2c: add support for Amlogic Meson I2C controller") Signed-off-by:

[PATCH for 4.9 18/39] iommu/exynos: Block SYSMMU while invalidating FLPD cache

From: Marek Szyprowski [ Upstream commit 7d2aa6b814476a2e2794960f844344519246df72 ] Documentation specifies that SYSMMU should be in blocked state while performing TLB/FLPD cache invalidation, so add needed calls to sysmmu_block/unblock. Fixes: 66a7ed84b345d

[PATCH for 4.9 18/39] iommu/exynos: Block SYSMMU while invalidating FLPD cache

From: Marek Szyprowski [ Upstream commit 7d2aa6b814476a2e2794960f844344519246df72 ] Documentation specifies that SYSMMU should be in blocked state while performing TLB/FLPD cache invalidation, so add needed calls to sysmmu_block/unblock. Fixes: 66a7ed84b345d ("iommu/exynos: Apply workaround of

[PATCH for 4.9 25/39] ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs

From: Nathan Fontenot [ Upstream commit 9501df3cd9204f5859f649182431616a31ee88a1 ] The pointer array for the tx/rx sub crqs should be free'ed when releasing the tx/rx sub crqs. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller

[PATCH for 4.9 25/39] ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs

From: Nathan Fontenot [ Upstream commit 9501df3cd9204f5859f649182431616a31ee88a1 ] The pointer array for the tx/rx sub crqs should be free'ed when releasing the tx/rx sub crqs. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller Signed-off-by: Sasha Levin ---

[PATCH for 4.9 27/39] x86/acpi: Restore the order of CPU IDs

From: Dou Liyang [ Upstream commit 2b85b3d22920db7473e5fed5719e7955c0ec323e ] The following commits: f7c28833c2 ("x86/acpi: Enable acpi to register all possible cpus at boot time") and 8f54969dc8 ("x86/acpi: Introduce persistent storage for cpuid <-> apicid

[PATCH for 4.9 27/39] x86/acpi: Restore the order of CPU IDs

From: Dou Liyang [ Upstream commit 2b85b3d22920db7473e5fed5719e7955c0ec323e ] The following commits: f7c28833c2 ("x86/acpi: Enable acpi to register all possible cpus at boot time") and 8f54969dc8 ("x86/acpi: Introduce persistent storage for cpuid <-> apicid mapping") ... registered all the

[PATCH for 4.9 19/39] [media] exynos-gsc: Do not swap cb/cr for semi planar formats

From: Thibault Saunier [ Upstream commit d7f3e33df4fbdc9855fb151f4a328ec46447e3ba ] In the case of semi planar formats cb and cr are in the same plane in memory, meaning that will be set to 'cb' whatever the format is, and whatever the (packed) order of those

[PATCH for 4.9 20/39] MIPS: smp-cps: Fix retrieval of VPE mask on big endian CPUs

From: Matt Redfearn [ Upstream commit fb2155e3c30dc2043b52020e26965067a3e7779c ] The vpe_mask member of struct core_boot_config is of type atomic_t, which is a 32bit type. In cps-vec.S this member was being retrieved by a PTR_L macro, which on 64bit systems is a 64bit

[PATCH for 4.9 20/39] MIPS: smp-cps: Fix retrieval of VPE mask on big endian CPUs

From: Matt Redfearn [ Upstream commit fb2155e3c30dc2043b52020e26965067a3e7779c ] The vpe_mask member of struct core_boot_config is of type atomic_t, which is a 32bit type. In cps-vec.S this member was being retrieved by a PTR_L macro, which on 64bit systems is a 64bit load. On little endian

[PATCH for 4.9 19/39] [media] exynos-gsc: Do not swap cb/cr for semi planar formats

From: Thibault Saunier [ Upstream commit d7f3e33df4fbdc9855fb151f4a328ec46447e3ba ] In the case of semi planar formats cb and cr are in the same plane in memory, meaning that will be set to 'cb' whatever the format is, and whatever the (packed) order of those components are. Suggested-by:

[PATCH for 4.9 13/39] hugetlbfs: initialize shared policy as part of inode allocation

From: Mike Kravetz [ Upstream commit 4742a35d9de745e867405b4311e1aac412f0ace1 ] Any time after inode allocation, destroy_inode can be called. The hugetlbfs inode contains a shared_policy structure, and mpol_free_shared_policy is unconditionally called as part of

[PATCH for 4.9 08/39] mmc: sdio: fix alignment issue in struct sdio_func

From: Heiner Kallweit [ Upstream commit 5ef1ecf060f28ecef313b5723f1fd39bf5a35f56 ] Certain 64-bit systems (e.g. Amlogic Meson GX) require buffers to be used for DMA to be 8-byte-aligned. struct sdio_func has an embedded small DMA buffer not meeting this requirement. When

[PATCH for 4.9 08/39] mmc: sdio: fix alignment issue in struct sdio_func

From: Heiner Kallweit [ Upstream commit 5ef1ecf060f28ecef313b5723f1fd39bf5a35f56 ] Certain 64-bit systems (e.g. Amlogic Meson GX) require buffers to be used for DMA to be 8-byte-aligned. struct sdio_func has an embedded small DMA buffer not meeting this requirement. When testing switching to

[PATCH for 4.9 13/39] hugetlbfs: initialize shared policy as part of inode allocation

From: Mike Kravetz [ Upstream commit 4742a35d9de745e867405b4311e1aac412f0ace1 ] Any time after inode allocation, destroy_inode can be called. The hugetlbfs inode contains a shared_policy structure, and mpol_free_shared_policy is unconditionally called as part of hugetlbfs_destroy_inode.

[PATCH for 4.9 03/39] team: fix memory leaks

From: Pan Bian [ Upstream commit 72ec0bc64b9a5d8e0efcb717abfc757746b101b7 ] In functions team_nl_send_port_list_get() and team_nl_send_options_get(), pointer skb keeps the return value of nlmsg_new(). When the call to genlmsg_put() fails, the memory is not freed(). This

[PATCH for 4.9 03/39] team: fix memory leaks

From: Pan Bian [ Upstream commit 72ec0bc64b9a5d8e0efcb717abfc757746b101b7 ] In functions team_nl_send_port_list_get() and team_nl_send_options_get(), pointer skb keeps the return value of nlmsg_new(). When the call to genlmsg_put() fails, the memory is not freed(). This will result in memory

[PATCH for 4.9 14/39] kasan: do not sanitize kexec purgatory

From: Mike Galbraith [ Upstream commit 13a6798e4a03096b11bf402a063786a7be55d426 ] Fixes this: kexec: Undefined symbol: __asan_load8_noabort kexec-bzImage64: Loading purgatory failed Link: http://lkml.kernel.org/r/1489672155.4458.7.ca...@gmx.de Signed-off-by: Mike Galbraith

[PATCH for 4.9 14/39] kasan: do not sanitize kexec purgatory

From: Mike Galbraith [ Upstream commit 13a6798e4a03096b11bf402a063786a7be55d426 ] Fixes this: kexec: Undefined symbol: __asan_load8_noabort kexec-bzImage64: Loading purgatory failed Link: http://lkml.kernel.org/r/1489672155.4458.7.ca...@gmx.de Signed-off-by: Mike Galbraith Cc: Alexander

[PATCH for 4.9 16/39] netfilter: invoke synchronize_rcu after set the _hook_ to NULL

From: Liping Zhang [ Upstream commit 3b7dabf029478bb80507a6c4500ca94132a2bc0b ] Otherwise, another CPU may access the invalid pointer. For example: CPU0CPU1 - rcu_read_lock(); - pfunc = _hook_; _hook_ = NULL;

[PATCH for 4.9 16/39] netfilter: invoke synchronize_rcu after set the _hook_ to NULL

From: Liping Zhang [ Upstream commit 3b7dabf029478bb80507a6c4500ca94132a2bc0b ] Otherwise, another CPU may access the invalid pointer. For example: CPU0CPU1 - rcu_read_lock(); - pfunc = _hook_; _hook_ = NULL; - mod unload

[PATCH for 4.9 06/39] net: dsa: b53: Include IMP/CPU port in dumb forwarding mode

From: Florian Fainelli [ Upstream commit a424f0de61638cbb5047e0a888c54da9cf471f90 ] Since Broadcom tags are not enabled in b53 (DSA_PROTO_TAG_NONE), we need to make sure that the IMP/CPU port is included in the forwarding decision. Without this change, switching between

[PATCH for 4.9 07/39] qed: Fix possible system hang in the dcbnl-getdcbx() path.

From: "sudarsana.kall...@cavium.com" [ Upstream commit 62289ba27558553871fd047baadaaeda886c6a63 ] qed_dcbnl_get_dcbx() API uses kmalloc in GFT_KERNEL mode. The API gets invoked in the interrupt context by qed_dcbnl_getdcbx callback. Need to invoke this kmalloc in

[PATCH for 4.9 06/39] net: dsa: b53: Include IMP/CPU port in dumb forwarding mode

From: Florian Fainelli [ Upstream commit a424f0de61638cbb5047e0a888c54da9cf471f90 ] Since Broadcom tags are not enabled in b53 (DSA_PROTO_TAG_NONE), we need to make sure that the IMP/CPU port is included in the forwarding decision. Without this change, switching between non-management ports

[PATCH for 4.9 07/39] qed: Fix possible system hang in the dcbnl-getdcbx() path.

From: "sudarsana.kall...@cavium.com" [ Upstream commit 62289ba27558553871fd047baadaaeda886c6a63 ] qed_dcbnl_get_dcbx() API uses kmalloc in GFT_KERNEL mode. The API gets invoked in the interrupt context by qed_dcbnl_getdcbx callback. Need to invoke this kmalloc in atomic mode. Signed-off-by:

[PATCH for 4.9 05/39] udp: disable inner UDP checksum offloads in IPsec case

From: Ansis Atteka [ Upstream commit b40c5f4fde22fb98eff205b3aece05b471c24eed ] Otherwise, UDP checksum offloads could corrupt ESP packets by attempting to calculate UDP checksum when this inner UDP packet is already protected by IPsec. One way to reproduce this bug is to have

[PATCH for 4.9 05/39] udp: disable inner UDP checksum offloads in IPsec case

From: Ansis Atteka [ Upstream commit b40c5f4fde22fb98eff205b3aece05b471c24eed ] Otherwise, UDP checksum offloads could corrupt ESP packets by attempting to calculate UDP checksum when this inner UDP packet is already protected by IPsec. One way to reproduce this bug is to have a VM with

[PATCH for 4.9 12/39] sata_via: Enable hotplug only on VT6421

From: Ondrej Zary [ Upstream commit 3cf864520e877505158f09075794a08abab11bbe ] Commit 57e5568fda27 ("sata_via: Implement hotplug for VT6421") adds hotplug IRQ handler for VT6421 but enables hotplug on all chips. This is a bug because it causes "irq xx: nobody cared"

[PATCH for 4.9 17/39] MIPS: IRQ Stack: Unwind IRQ stack onto task stack

From: Matt Redfearn [ Upstream commit db8466c581cca1a08b505f1319c3ecd246f16fa8 ] When the separate IRQ stack was introduced, stack unwinding only proceeded as far as the top of the IRQ stack, leading to kernel backtraces being less useful, lacking the trace of what was

[PATCH for 4.9 12/39] sata_via: Enable hotplug only on VT6421

From: Ondrej Zary [ Upstream commit 3cf864520e877505158f09075794a08abab11bbe ] Commit 57e5568fda27 ("sata_via: Implement hotplug for VT6421") adds hotplug IRQ handler for VT6421 but enables hotplug on all chips. This is a bug because it causes "irq xx: nobody cared" error on VT6420 when

[PATCH for 4.9 17/39] MIPS: IRQ Stack: Unwind IRQ stack onto task stack

From: Matt Redfearn [ Upstream commit db8466c581cca1a08b505f1319c3ecd246f16fa8 ] When the separate IRQ stack was introduced, stack unwinding only proceeded as far as the top of the IRQ stack, leading to kernel backtraces being less useful, lacking the trace of what was interrupted. Fix this by

[PATCH for 4.9 02/39] net/packet: check length in getsockopt() called with PACKET_HDRLEN

From: Alexander Potapenko [ Upstream commit fd2c83b35752f0a8236b976978ad4658df14a59f ] In the case getsockopt() is called with PACKET_HDRLEN and optlen < 4 |val| remains uninitialized and the syscall may behave differently depending on its value, and even copy garbage to

[PATCH for 4.9 02/39] net/packet: check length in getsockopt() called with PACKET_HDRLEN

From: Alexander Potapenko [ Upstream commit fd2c83b35752f0a8236b976978ad4658df14a59f ] In the case getsockopt() is called with PACKET_HDRLEN and optlen < 4 |val| remains uninitialized and the syscall may behave differently depending on its value, and even copy garbage to userspace on certain

[PATCH for 4.9 11/39] Btrfs: fix potential use-after-free for cloned bio

From: Liu Bo [ Upstream commit a967efb30b3afa3d858edd6a17f544f9e9e46eea ] KASAN reports that there is a use-after-free case of bio in btrfs_map_bio. If we need to submit IOs to several disks at a time, the original bio would get cloned and mapped to the destination disk,

[PATCH for 4.9 11/39] Btrfs: fix potential use-after-free for cloned bio

From: Liu Bo [ Upstream commit a967efb30b3afa3d858edd6a17f544f9e9e46eea ] KASAN reports that there is a use-after-free case of bio in btrfs_map_bio. If we need to submit IOs to several disks at a time, the original bio would get cloned and mapped to the destination disk, but we really should

[PATCH for 4.9 10/39] Btrfs: fix segmentation fault when doing dio read

From: Liu Bo [ Upstream commit 97bf5a5589aa3a59c60aa775fc12ec0483fc5002 ] Commit 2dabb3248453 ("Btrfs: Direct I/O read: Work on sectorsized blocks") introduced this bug during iterating bio pages in dio read's endio hook, and it could end up with segment fault of the dio

[PATCH for 4.9 04/39] usb: plusb: Add support for PL-27A1

From: Roman Spychała [ Upstream commit 6f2aee0c0de6501bbc26fe50c9c7b09a37f7 ] This patch adds support for the PL-27A1 by adding the appropriate USB ID's. This chip is used in the goobay Active USB 3.0 Data Link and Unitek Y-3501 cables. Signed-off-by: Roman Spychała

[PATCH for 4.9 10/39] Btrfs: fix segmentation fault when doing dio read

From: Liu Bo [ Upstream commit 97bf5a5589aa3a59c60aa775fc12ec0483fc5002 ] Commit 2dabb3248453 ("Btrfs: Direct I/O read: Work on sectorsized blocks") introduced this bug during iterating bio pages in dio read's endio hook, and it could end up with segment fault of the dio reading task. So the

[PATCH for 4.9 04/39] usb: plusb: Add support for PL-27A1

From: Roman Spychała [ Upstream commit 6f2aee0c0de6501bbc26fe50c9c7b09a37f7 ] This patch adds support for the PL-27A1 by adding the appropriate USB ID's. This chip is used in the goobay Active USB 3.0 Data Link and Unitek Y-3501 cables. Signed-off-by: Roman Spychała Signed-off-by: David

[PATCH for 4.9 01/39] net: core: Prevent from dereferencing null pointer when releasing SKB

From: Myungho Jung [ Upstream commit 9899886d5e8ec5b343b1efe44f185a0e68dc6454 ] Added NULL check to make __dev_kfree_skb_irq consistent with kfree family of functions. Link: https://bugzilla.kernel.org/show_bug.cgi?id=195289 Signed-off-by: Myungho Jung

[PATCH for 4.9 01/39] net: core: Prevent from dereferencing null pointer when releasing SKB

From: Myungho Jung [ Upstream commit 9899886d5e8ec5b343b1efe44f185a0e68dc6454 ] Added NULL check to make __dev_kfree_skb_irq consistent with kfree family of functions. Link: https://bugzilla.kernel.org/show_bug.cgi?id=195289 Signed-off-by: Myungho Jung Signed-off-by: David S. Miller

[PATCH for 4.9 15/39] drivers/rapidio/devices/tsi721.c: make module parameter variable name unique

From: Randy Dunlap [ Upstream commit 4785603bd05b0b029c647080937674d9991600f9 ] kbuild test robot reported a non-static variable name collision between a staging driver and a RapidIO driver, with a generic variable name of 'dbg_level'. Both drivers should be changed so

[PATCH for 4.9 09/39] bridge: netlink: register netdevice before executing changelink

From: Ido Schimmel [ Upstream commit 5b8d5429daa05bebef6ffd3297df3b502cc6f184 ] Peter reported a kernel oops when executing the following command: $ ip link add name test type bridge vlan_default_pvid 1 [13634.939408] BUG: unable to handle kernel NULL pointer dereference

[PATCH for 4.9 15/39] drivers/rapidio/devices/tsi721.c: make module parameter variable name unique

From: Randy Dunlap [ Upstream commit 4785603bd05b0b029c647080937674d9991600f9 ] kbuild test robot reported a non-static variable name collision between a staging driver and a RapidIO driver, with a generic variable name of 'dbg_level'. Both drivers should be changed so that they don't use this

[PATCH for 4.9 09/39] bridge: netlink: register netdevice before executing changelink

From: Ido Schimmel [ Upstream commit 5b8d5429daa05bebef6ffd3297df3b502cc6f184 ] Peter reported a kernel oops when executing the following command: $ ip link add name test type bridge vlan_default_pvid 1 [13634.939408] BUG: unable to handle kernel NULL pointer dereference at 0190

Re: [PATCH for 4.9 39/59] arm: dts: mt2701: Add subsystem clock controller device nodes

On Fri, Sep 15, 2017 at 01:15:43PM +0200, Matthias Brugger wrote: >On 09/14/2017 05:51 PM, Levin, Alexander (Sasha Levin) wrote: >>From: James Liao <jamesjj.l...@mediatek.com> >> >>[ Upstream commit f235c7e7a75325f28a33559a71f25a0eca6112db ] >> >>Add MT27

Re: [PATCH for 4.9 39/59] arm: dts: mt2701: Add subsystem clock controller device nodes

On Fri, Sep 15, 2017 at 01:15:43PM +0200, Matthias Brugger wrote: >On 09/14/2017 05:51 PM, Levin, Alexander (Sasha Levin) wrote: >>From: James Liao >> >>[ Upstream commit f235c7e7a75325f28a33559a71f25a0eca6112db ] >> >>Add MT2701 subsystem clock controllers,

Re: [PATCH for 4.9 07/59] clk: sunxi-ng: set the parent rate when adjustin CPUX clock on A33

On Fri, Sep 15, 2017 at 10:02:04AM +0800, icen...@aosc.io wrote: >在 2017-09-14 23:51，Levin, Alexander (Sasha Levin) 写道： >>From: Icenowy Zheng <icen...@aosc.xyz> >> >>[ Upstream commit bb021cda2ccf45ee9470bf0f8c55323ad1c761ae ] > >As DVFS for A33 doesn't exist in 4

Re: [PATCH for 4.9 07/59] clk: sunxi-ng: set the parent rate when adjustin CPUX clock on A33

On Fri, Sep 15, 2017 at 10:02:04AM +0800, icen...@aosc.io wrote: >在 2017-09-14 23:51，Levin, Alexander (Sasha Levin) 写道： >>From: Icenowy Zheng >> >>[ Upstream commit bb021cda2ccf45ee9470bf0f8c55323ad1c761ae ] > >As DVFS for A33 doesn't exist in 4.9, this patch doesn't a

Re: [PATCH for 4.9 11/59] MIPS: fix mem=X@Y commandline processing

On Thu, Sep 14, 2017 at 08:59:05PM +0200, Mathieu Malaterre wrote: >On Thu, Sep 14, 2017 at 5:51 PM, Levin, Alexander (Sasha Levin) ><alexander.le...@verizon.com> wrote: >> From: Marcin Nowakowski <marcin.nowakow...@imgtec.com> >> >> [ Upstream commit 73fb

Re: [PATCH for 4.9 11/59] MIPS: fix mem=X@Y commandline processing

On Thu, Sep 14, 2017 at 08:59:05PM +0200, Mathieu Malaterre wrote: >On Thu, Sep 14, 2017 at 5:51 PM, Levin, Alexander (Sasha Levin) > wrote: >> From: Marcin Nowakowski >> >> [ Upstream commit 73fbc1eba7ffa3bf0ad12486232a8a1edb4e4411 ] >> >> When

[PATCH for 4.9 01/59] drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define

From: "Kristian H. Kristensen" [ Upstream commit af913418261d6d3e7a29f06cf35f04610ead667c ] We need to define DRM_FORMAT_MOD_VENDOR_NONE for the fourcc_mod_code() macro to work correctly. Signed-off-by: Kristian H. Kristensen Signed-off-by: Daniel

[PATCH for 4.9 01/59] drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define

From: "Kristian H. Kristensen" [ Upstream commit af913418261d6d3e7a29f06cf35f04610ead667c ] We need to define DRM_FORMAT_MOD_VENDOR_NONE for the fourcc_mod_code() macro to work correctly. Signed-off-by: Kristian H. Kristensen Signed-off-by: Daniel Vetter Link:

[PATCH for 4.9 18/59] igb: re-assign hw address pointer on reset after PCI error

From: Guilherme G Piccoli [ Upstream commit 69b97cf6dbce7403845a28bbc75d57f5be7b12ac ] Whenever the igb driver detects the result of a read operation returns a value composed only by F's (like 0x), it will detach the net_device, clear the hw_addr pointer and

[PATCH for 4.9 18/59] igb: re-assign hw address pointer on reset after PCI error

From: Guilherme G Piccoli [ Upstream commit 69b97cf6dbce7403845a28bbc75d57f5be7b12ac ] Whenever the igb driver detects the result of a read operation returns a value composed only by F's (like 0x), it will detach the net_device, clear the hw_addr pointer and warn to the user that

[PATCH for 4.9 09/59] ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes

From: Simon Horman [ Upstream commit 654450baf2afba86cf328e1849ccac61ec4630af ] Use recently added R-Car Gen 2 fallback binding for msiof nodes in DT for r8a7790 SoC. This has no run-time effect for the current driver as the initialisation sequence is the same for

[PATCH for 4.9 09/59] ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes

From: Simon Horman [ Upstream commit 654450baf2afba86cf328e1849ccac61ec4630af ] Use recently added R-Car Gen 2 fallback binding for msiof nodes in DT for r8a7790 SoC. This has no run-time effect for the current driver as the initialisation sequence is the same for the SoC-specific binding for

[PATCH for 4.9 02/59] drm: bridge: add DT bindings for TI ths8135

From: Bartosz Golaszewski [ Upstream commit 2e644be30fcc08c736f66b60f4898d274d4873ab ] THS8135 is a configurable video DAC. Add DT bindings for this chip. Signed-off-by: Bartosz Golaszewski Reviewed-by: Laurent Pinchart

[PATCH for 4.9 02/59] drm: bridge: add DT bindings for TI ths8135

From: Bartosz Golaszewski [ Upstream commit 2e644be30fcc08c736f66b60f4898d274d4873ab ] THS8135 is a configurable video DAC. Add DT bindings for this chip. Signed-off-by: Bartosz Golaszewski Reviewed-by: Laurent Pinchart Acked-by: Rob Herring Signed-off-by: Archit Taneja Link:

[PATCH for 4.9 24/59] usb: make the MTK XHCI driver compile for older MIPS SoCs

From: John Crispin [ Upstream commit 808cf33d4817c730008de9b2736b357708a3d7f6 ] The MIPS based MT7621 shares the same XHCI core as the newer generation of ARM based SoCs. The driver works out of the box and we only need to make it buildable in Kconfig. Signed-off-by: John

[PATCH for 4.9 24/59] usb: make the MTK XHCI driver compile for older MIPS SoCs

From: John Crispin [ Upstream commit 808cf33d4817c730008de9b2736b357708a3d7f6 ] The MIPS based MT7621 shares the same XHCI core as the newer generation of ARM based SoCs. The driver works out of the box and we only need to make it buildable in Kconfig. Signed-off-by: John Crispin

[PATCH for 4.9 25/59] hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes

From: Guenter Roeck [ Upstream commit 87cdfa9d60f4f40e6d71b04b10b36d9df3c89282 ] Writes into limit attributes can overflow due to multplications and additions with unbound input values. Writing into fan limit attributes can result in a crash with a division by zero if very

[PATCH for 4.9 25/59] hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes

From: Guenter Roeck [ Upstream commit 87cdfa9d60f4f40e6d71b04b10b36d9df3c89282 ] Writes into limit attributes can overflow due to multplications and additions with unbound input values. Writing into fan limit attributes can result in a crash with a division by zero if very large values are

[PATCH for 4.9 21/59] sh_eth: use correct name for ECMR_MPDE bit

From: Niklas Söderlund [ Upstream commit 6dcf45e514974a1ff10755015b5e06746a033e5f ] This bit was wrongly named due to a typo, Sergei checked the SH7734/63 manuals and this bit should be named MPDE. Suggested-by: Sergei Shtylyov

[PATCH for 4.9 21/59] sh_eth: use correct name for ECMR_MPDE bit

From: Niklas Söderlund [ Upstream commit 6dcf45e514974a1ff10755015b5e06746a033e5f ] This bit was wrongly named due to a typo, Sergei checked the SH7734/63 manuals and this bit should be named MPDE. Suggested-by: Sergei Shtylyov Signed-off-by: Niklas Söderlund Signed-off-by: David S. Miller

[PATCH for 4.9 23/59] clk: wm831x: fix usleep_range with bad range

From: Nicholas Mc Guire [ Upstream commit ed784c532a3d0959db488f40a96c5127f63d42dc ] The delay here is not in atomic context and does not seem critical with respect to precision, but usleep_range(min,max) with min==max results in giving the timer subsystem no room to optimize

[PATCH for 4.9 23/59] clk: wm831x: fix usleep_range with bad range

From: Nicholas Mc Guire [ Upstream commit ed784c532a3d0959db488f40a96c5127f63d42dc ] The delay here is not in atomic context and does not seem critical with respect to precision, but usleep_range(min,max) with min==max results in giving the timer subsystem no room to optimize uncritical delays.

[PATCH for 4.9 12/59] MIPS: kexec: Do not reserve invalid crashkernel memory on boot

From: Marcin Nowakowski [ Upstream commit a8f108d70c74d83574c157648383eb2e4285a190 ] Do not reserve memory for the crashkernel if the commandline argument points to a wrong location. This can happen if the location is specified wrong or if the same commandline is

[PATCH for 4.9 12/59] MIPS: kexec: Do not reserve invalid crashkernel memory on boot

From: Marcin Nowakowski [ Upstream commit a8f108d70c74d83574c157648383eb2e4285a190 ] Do not reserve memory for the crashkernel if the commandline argument points to a wrong location. This can happen if the location is specified wrong or if the same commandline is reused when starting the

[PATCH for 4.9 28/59] iio: adc: hx711: Add DT binding for avia,hx711

From: Andreas Klinger [ Upstream commit ff1293f67734da68e23fecb6ecdae7112b8c43f9 ] Add DT bindings for avia,hx711 Add vendor avia to vendor list Signed-off-by: Andreas Klinger Acked-by: Rob Herring Signed-off-by: Jonathan Cameron

[PATCH for 4.9 28/59] iio: adc: hx711: Add DT binding for avia,hx711

From: Andreas Klinger [ Upstream commit ff1293f67734da68e23fecb6ecdae7112b8c43f9 ] Add DT bindings for avia,hx711 Add vendor avia to vendor list Signed-off-by: Andreas Klinger Acked-by: Rob Herring Signed-off-by: Jonathan Cameron Signed-off-by: Sasha Levin ---

[PATCH for 4.9 06/59] clk: sunxi-ng: fix PLL_CPUX adjusting on H3

From: Ondrej Jirman [ Upstream commit a43c96427e713bea94e9ef50e8be1f493afc0691 ] When adjusting PLL_CPUX on H3, the PLL is temporarily driven too high, and the system becomes unstable (oopses or hangs). Add a notifier to avoid this situation by temporarily switching to a

[PATCH for 4.9 06/59] clk: sunxi-ng: fix PLL_CPUX adjusting on H3

From: Ondrej Jirman [ Upstream commit a43c96427e713bea94e9ef50e8be1f493afc0691 ] When adjusting PLL_CPUX on H3, the PLL is temporarily driven too high, and the system becomes unstable (oopses or hangs). Add a notifier to avoid this situation by temporarily switching to a known stable 24 MHz

[PATCH for 4.9 04/59] drm/i915: Fix the overlay frontbuffer tracking

From: Ville Syrjälä [ Upstream commit 58d09ebdb4edf5d3ab3a2aee851ab0168bc83ec6 ] Do the overlay frontbuffer tracking properly so that it matches the state of the overlay on/off/continue requests. One slight problem is that intel_frontbuffer_flip_complete() may

[PATCH for 4.9 04/59] drm/i915: Fix the overlay frontbuffer tracking

From: Ville Syrjälä [ Upstream commit 58d09ebdb4edf5d3ab3a2aee851ab0168bc83ec6 ] Do the overlay frontbuffer tracking properly so that it matches the state of the overlay on/off/continue requests. One slight problem is that intel_frontbuffer_flip_complete() may get delayed by an arbitrarily

<    8   9   10   11   12   13   14   15   16   17   >