Commit Graph

87724 Commits

Author SHA1 Message Date
Chris Redpath
8d40f58e90 ANDROID: trace:sched: Make util_avg in load_avg trace reflect PELT/WALT as used
With the ability to choose between WALT and PELT for utilisation tracking
we can have the situation where we're using WALT to make all the
decisions and reporting PELT figures in the sched_load_avg_(cpu|task)
trace points. This is not too much of an issue, but when analysing trace
it is nice to see numbers representing what the scheduler is using rather
than needing to add in additional sched_walt_* traces to figure it out.

Add reporting for both types, and make the util_avg member reflect what
will be seen from cpu or task_util functions in the scheduler.

Change-Id: I2abbd2c5fa70822096d0f3372b4c12b1c6af1590
Signed-off-by: Chris Redpath <chris.redpath@arm.com>
[renamed macros according to 172895e6b5]
Signed-off-by: Quentin Perret <quentin.perret@arm.com>
2017-08-03 15:30:31 -07:00
Dietmar Eggemann
af88a165ec ANDROID: sched/fair: Add eas (& cas) specific rq, sd and task stats
The statistic counter are placed in the eas (& cas) wakeup path. Each
of them has one representation for the runqueue (rq), the sched_domain
(sd) and the task.
A task counter is always incremented. A rq counter is always
incremented for the rq the scheduler is currently running on. A sd
counter is only incremented if a relation to a sd exists.

The counters are exposed:

(1) In /proc/schedstat for rq's and sd's:

$ cat /proc/schedstat
...
cpu0 71422 0 2321254 ...
eas  44144 0 0 19446 0 24698 568435 51621 156932 133 222011 17459 120279 516814 83 0 156962 359235 176439 139981
  <- runqueue for cpu0
...
domain0 3 42430 42331 ...
eas 0 0 0 14200 0 0 0 0 0 0 0 0 0 0 0 0 0 0 66355 0  <- MC sched domain for cpu0
...

The per-cpu eas vector has the following elements:

sis_attempts  sis_idle   sis_cache_affine sis_suff_cap    sis_idle_cpu    sis_count               ||
secb_attempts secb_sync  secb_idle_bt     secb_insuff_cap secb_no_nrg_sav secb_nrg_sav secb_count ||
fbt_attempts  fbt_no_cpu fbt_no_sd        fbt_pref_idle   fbt_count                               ||
cas_attempts  cas_count

The following relations exist between these counters (from cpu0 eas
vector above):

sis_attempts = sis_idle + sis_cache_affine + sis_suff_cap + sis_idle_cpu + sis_count

44144        = 0        + 0                + 19446        + 0            + 24698

secb_attempts = secb_sync + secb_idle_bt + secb_insuff_cap + secb_no_nrg_sav + secb_nrg_sav + secb_count

568435        = 51621     + 156932       + 133             + 222011          + 17459        + 120279

fbt_attempts = fbt_no_cpu + fbt_no_sd + fbt_pref_idle + fbt_count + (return -1)

516814       = 83         + 0         + 156962        + 359235    + (534)

cas_attempts = cas_count + (return -1 or smp_processor_id())

176439       = 139981    + (36458)

(2) In /proc/$PROCESS_PID/task/$TASK_PID/sched for a task.

example: main thread of system_server

$ cat /proc/1083/task/1083/sched

...
se.statistics.nr_wakeups_sis_attempts        :                  945
se.statistics.nr_wakeups_sis_idle            :                    0
se.statistics.nr_wakeups_sis_cache_affine    :                    0
se.statistics.nr_wakeups_sis_suff_cap        :                  219
se.statistics.nr_wakeups_sis_idle_cpu        :                    0
se.statistics.nr_wakeups_sis_count           :                  726
se.statistics.nr_wakeups_secb_attempts       :                10376
se.statistics.nr_wakeups_secb_sync           :                 1462
se.statistics.nr_wakeups_secb_idle_bt        :                 6984
se.statistics.nr_wakeups_secb_insuff_cap     :                    3
se.statistics.nr_wakeups_secb_no_nrg_sav     :                  927
se.statistics.nr_wakeups_secb_nrg_sav        :                  206
se.statistics.nr_wakeups_secb_count          :                  794
se.statistics.nr_wakeups_fbt_attempts        :                 8914
se.statistics.nr_wakeups_fbt_no_cpu          :                    0
se.statistics.nr_wakeups_fbt_no_sd           :                    0
se.statistics.nr_wakeups_fbt_pref_idle       :                 6987
se.statistics.nr_wakeups_fbt_count           :                 1554
se.statistics.nr_wakeups_cas_attempts        :                 3107
se.statistics.nr_wakeups_cas_count           :                 1195
...

The same relation between the counters as in the per-cpu case apply.

Change-Id: Ie7d01267c78a3f41f60a3ef52917d5a5d463f195
Signed-off-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Signed-off-by: Chris Redpath <chris.redpath@arm.com>
[fixed schedstat macros calls to match modifications
made in commit ae92882e56]
Signed-off-by: Quentin Perret <quentin.perret@arm.com>
2017-08-03 15:30:31 -07:00
Dietmar Eggemann
ea5a7f2df0 ANDROID: sched: Remove sysctl_sched_is_big_little
With the new wakeup approach this sysctl is not necessary any more.

Change-Id: I52114b3c918791f6a4f9f30f50002919ccbc1a9c
Signed-off-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
(cherry picked from commit 885c0d503bcdf0ef4e9b46822496f16b20aa3bbd)
Signed-off-by: Chris Redpath <chris.redpath@arm.com>
Signed-off-by: Quentin Perret <quentin.perret@arm.com>
2017-08-03 15:30:22 -07:00
Juri Lelli
4328ce34ef ANDROID: trace/sched: add rq utilization signal for WALT
It is useful to be able to check current capacity against rq utilization
signal generated by WALT (to check how a cpufreq governor is behaving
for example).

Add rq utilization signal (same scale as capacity) to the walt_update_
task_ravg tracepoint.

Change-Id: I9aae3884a741d23ac494bef80d2303f107f135ce
Signed-off-by: Juri Lelli <juri.lelli@arm.com>
[renamed macros according to 172895e6b5]
Signed-off-by: Quentin Perret <quentin.perret@arm.com>
2017-08-03 12:58:00 -07:00
Greg Kroah-Hartman
9ae2c670d8 Merge 4.9.40 into android-4.9
Changes in 4.9.40
	disable new gcc-7.1.1 warnings for now
	ir-core: fix gcc-7 warning on bool arithmetic
	dm mpath: cleanup -Wbool-operation warning in choose_pgpath()
	s5p-jpeg: don't return a random width/height
	thermal: max77620: fix device-node reference imbalance
	thermal: cpu_cooling: Avoid accessing potentially freed structures
	ath9k: fix tx99 use after free
	ath9k: fix tx99 bus error
	ath9k: fix an invalid pointer dereference in ath9k_rng_stop()
	NFC: fix broken device allocation
	NFC: nfcmrvl_uart: add missing tty-device sanity check
	NFC: nfcmrvl: do not use device-managed resources
	NFC: nfcmrvl: use nfc-device for firmware download
	NFC: nfcmrvl: fix firmware-management initialisation
	nfc: Ensure presence of required attributes in the activate_target handler
	nfc: Fix the sockaddr length sanitization in llcp_sock_connect
	NFC: Add sockaddr length checks before accessing sa_family in bind handlers
	perf intel-pt: Move decoder error setting into one condition
	perf intel-pt: Improve sample timestamp
	perf intel-pt: Fix missing stack clear
	perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP
	perf intel-pt: Fix last_ip usage
	perf intel-pt: Ensure never to set 'last_ip' when packet 'count' is zero
	perf intel-pt: Use FUP always when scanning for an IP
	perf intel-pt: Clear FUP flag on error
	Bluetooth: use constant time memory comparison for secret values
	wlcore: fix 64K page support
	btrfs: Don't clear SGID when inheriting ACLs
	igb: Explicitly select page 0 at initialization
	ASoC: compress: Derive substream from stream based on direction
	PM / Domains: Fix unsafe iteration over modified list of device links
	PM / Domains: Fix unsafe iteration over modified list of domain providers
	PM / Domains: Fix unsafe iteration over modified list of domains
	scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails.
	scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
	iscsi-target: Add login_keys_workaround attribute for non RFC initiators
	xen/scsiback: Fix a TMR related use-after-free
	powerpc/pseries: Fix passing of pp0 in updatepp() and updateboltedpp()
	powerpc/64: Fix atomic64_inc_not_zero() to return an int
	powerpc: Fix emulation of mcrf in emulate_step()
	powerpc: Fix emulation of mfocrf in emulate_step()
	powerpc/asm: Mark cr0 as clobbered in mftb()
	powerpc/mm/radix: Properly clear process table entry
	af_key: Fix sadb_x_ipsecrequest parsing
	PCI: Work around poweroff & suspend-to-RAM issue on Macbook Pro 11
	PCI: rockchip: Use normal register bank for config accessors
	PCI/PM: Restore the status of PCI devices across hibernation
	ipvs: SNAT packet replies only for NATed connections
	xhci: fix 20000ms port resume timeout
	xhci: Fix NULL pointer dereference when cleaning up streams for removed host
	xhci: Bad Ethernet performance plugged in ASM1042A host
	mxl111sf: Fix driver to use heap allocate buffers for USB messages
	usb: storage: return on error to avoid a null pointer dereference
	USB: cdc-acm: add device-id for quirky printer
	usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
	usb: renesas_usbhs: gadget: disable all eps when the driver stops
	md: don't use flush_signals in userspace processes
	x86/xen: allow userspace access during hypercalls
	cx88: Fix regression in initial video standard setting
	libnvdimm, btt: fix btt_rw_page not returning errors
	libnvdimm: fix badblock range handling of ARS range
	ext2: Don't clear SGID when inheriting ACLs
	Raid5 should update rdev->sectors after reshape
	s390/syscalls: Fix out of bounds arguments access
	drm/amd/amdgpu: Return error if initiating read out of range on vram
	drm/radeon/ci: disable mclk switching for high refresh rates (v2)
	drm/radeon: Fix eDP for single-display iMac10,1 (v2)
	ipmi: use rcu lock around call to intf->handlers->sender()
	ipmi:ssif: Add missing unlock in error branch
	xfs: Don't clear SGID when inheriting ACLs
	f2fs: sanity check size of nat and sit cache
	f2fs: Don't clear SGID when inheriting ACLs
	drm/ttm: Fix use-after-free in ttm_bo_clean_mm
	ovl: drop CAP_SYS_RESOURCE from saved mounter's credentials
	vfio: Fix group release deadlock
	vfio: New external user group/file match
	nvme-rdma: remove race conditions from IB signalling
	ftrace: Fix uninitialized variable in match_records()
	MIPS: Fix mips_atomic_set() retry condition
	MIPS: Fix mips_atomic_set() with EVA
	MIPS: Negate error syscall return in trace
	ubifs: Don't leak kernel memory to the MTD
	ACPI / EC: Drop EC noirq hooks to fix a regression
	Revert "ACPI / EC: Enable event freeze mode..." to fix a regression
	x86/acpi: Prevent out of bound access caused by broken ACPI tables
	x86/ioapic: Pass the correct data to unmask_ioapic_irq()
	MIPS: Fix MIPS I ISA /proc/cpuinfo reporting
	MIPS: Save static registers before sysmips
	MIPS: Actually decode JALX in `__compute_return_epc_for_insn'
	MIPS: Fix unaligned PC interpretation in `compute_return_epc'
	MIPS: math-emu: Prevent wrong ISA mode instruction emulation
	MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn'
	MIPS: Rename `sigill_r6' to `sigill_r2r6' in `__compute_return_epc_for_insn'
	MIPS: Send SIGILL for linked branches in `__compute_return_epc_for_insn'
	MIPS: Send SIGILL for R6 branches in `__compute_return_epc_for_insn'
	MIPS: Fix a typo: s/preset/present/ in r2-to-r6 emulation error message
	Input: i8042 - fix crash at boot time
	IB/iser: Fix connection teardown race condition
	IB/core: Namespace is mandatory input for address resolution
	sunrpc: use constant time memory comparison for mac
	NFS: only invalidate dentrys that are clearly invalid.
	udf: Fix deadlock between writeback and udf_setsize()
	target: Fix COMPARE_AND_WRITE caw_sem leak during se_cmd quiesce
	iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done
	perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its target
	Revert "perf/core: Drop kernel samples even though :u is specified"
	staging: rtl8188eu: add TL-WN722N v2 support
	staging: comedi: ni_mio_common: fix AO timer off-by-one regression
	staging: sm750fb: avoid conflicting vesafb
	staging: lustre: ko2iblnd: check copy_from_iter/copy_to_iter return code
	ceph: fix race in concurrent readdir
	RDMA/core: Initialize port_num in qp_attr
	drm/mst: Fix error handling during MST sideband message reception
	drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req()
	drm/mst: Avoid processing partially received up/down message transactions
	mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms[] array
	hfsplus: Don't clear SGID when inheriting ACLs
	ovl: fix random return value on mount
	acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
	of: device: Export of_device_{get_modalias, uvent_modalias} to modules
	spmi: Include OF based modalias in device uevent
	reiserfs: Don't clear SGID when inheriting ACLs
	PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
	tracing: Fix kmemleak in instance_rmdir
	alarmtimer: don't rate limit one-shot timers
	Linux 4.9.40

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-07-27 15:24:43 -07:00
Alex Williamson
8f9dec0c2d vfio: New external user group/file match
commit 5d6dee80a1 upstream.

At the point where the kvm-vfio pseudo device wants to release its
vfio group reference, we can't always acquire a new reference to make
that happen.  The group can be in a state where we wouldn't allow a
new reference to be added.  This new helper function allows a caller
to match a file to a group to facilitate this.  Given a file and
group, report if they match.  Thus the caller needs to already have a
group reference to match to the file.  This allows the deletion of a
group without acquiring a new reference.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-27 15:08:03 -07:00
Nicholas Bellinger
732e3c76cf iscsi-target: Add login_keys_workaround attribute for non RFC initiators
commit 138d351eef upstream.

This patch re-introduces part of a long standing login workaround that
was recently dropped by:

  commit 1c99de981f
  Author: Nicholas Bellinger <nab@linux-iscsi.org>
  Date:   Sun Apr 2 13:36:44 2017 -0700

      iscsi-target: Drop work-around for legacy GlobalSAN initiator

Namely, the workaround for FirstBurstLength ended up being required by
Mellanox Flexboot PXE boot ROMs as reported by Robert.

So this patch re-adds the work-around for FirstBurstLength within
iscsi_check_proposer_for_optional_reply(), and makes the key optional
to respond when the initiator does not propose, nor respond to it.

Also as requested by Arun, this patch introduces a new TPG attribute
named 'login_keys_workaround' that controls the use of both the
FirstBurstLength workaround, as well as the two other existing
workarounds for gPXE iSCSI boot client.

By default, the workaround is enabled with login_keys_workaround=1,
since Mellanox FlexBoot requires it, and Arun has verified the Qlogic
MSFT initiator already proposes FirstBurstLength, so it's uneffected
by this re-adding this part of the original work-around.

Reported-by: Robert LeBlanc <robert@leblancnet.us>
Cc: Robert LeBlanc <robert@leblancnet.us>
Reviewed-by: Arun Easi <arun.easi@cavium.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-27 15:07:59 -07:00
Ewan D. Milne
fc866b296a scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
commit f9279c968c upstream.

The addition of the STARGET_REMOVE state had the side effect of
introducing a race condition that can cause a crash.

scsi_target_reap_ref_release() checks the starget->state to
see if it still in STARGET_CREATED, and if so, skips calling
transport_remove_device() and device_del(), because the starget->state
is only set to STARGET_RUNNING after scsi_target_add() has called
device_add() and transport_add_device().

However, if an rport loss occurs while a target is being scanned,
it can happen that scsi_remove_target() will be called while the
starget is still in the STARGET_CREATED state.  In this case, the
starget->state will be set to STARGET_REMOVE, and as a result,
scsi_target_reap_ref_release() will take the wrong path.  The end
result is a panic:

[ 1255.356653] Oops: 0000 [#1] SMP
[ 1255.360154] Modules linked in: x86_pkg_temp_thermal kvm_intel kvm irqbypass crc32c_intel ghash_clmulni_i
[ 1255.393234] CPU: 5 PID: 149 Comm: kworker/u96:4 Tainted: G        W       4.11.0+ #8
[ 1255.401879] Hardware name: Dell Inc. PowerEdge R320/08VT7V, BIOS 2.0.22 11/19/2013
[ 1255.410327] Workqueue: scsi_wq_6 fc_scsi_scan_rport [scsi_transport_fc]
[ 1255.417720] task: ffff88060ca8c8c0 task.stack: ffffc900048a8000
[ 1255.424331] RIP: 0010:kernfs_find_ns+0x13/0xc0
[ 1255.429287] RSP: 0018:ffffc900048abbf0 EFLAGS: 00010246
[ 1255.435123] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 1255.443083] RDX: 0000000000000000 RSI: ffffffff8188d659 RDI: 0000000000000000
[ 1255.451043] RBP: ffffc900048abc10 R08: 0000000000000000 R09: 0000012433fe0025
[ 1255.459005] R10: 0000000025e5a4b5 R11: 0000000025e5a4b5 R12: ffffffff8188d659
[ 1255.466972] R13: 0000000000000000 R14: ffff8805f55e5088 R15: 0000000000000000
[ 1255.474931] FS:  0000000000000000(0000) GS:ffff880616b40000(0000) knlGS:0000000000000000
[ 1255.483959] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1255.490370] CR2: 0000000000000068 CR3: 0000000001c09000 CR4: 00000000000406e0
[ 1255.498332] Call Trace:
[ 1255.501058]  kernfs_find_and_get_ns+0x31/0x60
[ 1255.505916]  sysfs_unmerge_group+0x1d/0x60
[ 1255.510498]  dpm_sysfs_remove+0x22/0x60
[ 1255.514783]  device_del+0xf4/0x2e0
[ 1255.518577]  ? device_remove_file+0x19/0x20
[ 1255.523241]  attribute_container_class_device_del+0x1a/0x20
[ 1255.529457]  transport_remove_classdev+0x4e/0x60
[ 1255.534607]  ? transport_add_class_device+0x40/0x40
[ 1255.540046]  attribute_container_device_trigger+0xb0/0xc0
[ 1255.546069]  transport_remove_device+0x15/0x20
[ 1255.551025]  scsi_target_reap_ref_release+0x25/0x40
[ 1255.556467]  scsi_target_reap+0x2e/0x40
[ 1255.560744]  __scsi_scan_target+0xaa/0x5b0
[ 1255.565312]  scsi_scan_target+0xec/0x100
[ 1255.569689]  fc_scsi_scan_rport+0xb1/0xc0 [scsi_transport_fc]
[ 1255.576099]  process_one_work+0x14b/0x390
[ 1255.580569]  worker_thread+0x4b/0x390
[ 1255.584651]  kthread+0x109/0x140
[ 1255.588251]  ? rescuer_thread+0x330/0x330
[ 1255.592730]  ? kthread_park+0x60/0x60
[ 1255.596815]  ret_from_fork+0x29/0x40
[ 1255.600801] Code: 24 08 48 83 42 40 01 5b 41 5c 5d c3 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90
[ 1255.621876] RIP: kernfs_find_ns+0x13/0xc0 RSP: ffffc900048abbf0
[ 1255.628479] CR2: 0000000000000068
[ 1255.632756] ---[ end trace 34a69ba0477d036f ]---

Fix this by adding another scsi_target state STARGET_CREATED_REMOVE
to distinguish this case.

Fixes: f05795d3d7 ("scsi: Add intermediate STARGET_REMOVE state to scsi_target_state")
Reported-by: David Jeffery <djeffery@redhat.com>
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Reviewed-by: Laurence Oberman <loberman@redhat.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-27 15:07:59 -07:00
Greg Kroah-Hartman
14accea70e Merge 4.9.39 into android-4.9
Changes in 4.9.39
	xen-netfront: Rework the fix for Rx stall during OOM and network stress
	net_sched: fix error recovery at qdisc creation
	net: sched: Fix one possible panic when no destroy callback
	net/phy: micrel: configure intterupts after autoneg workaround
	ipv6: avoid unregistering inet6_dev for loopback
	net: dp83640: Avoid NULL pointer dereference.
	tcp: reset sk_rx_dst in tcp_disconnect()
	net: prevent sign extension in dev_get_stats()
	bridge: mdb: fix leak on complete_info ptr on fail path
	rocker: move dereference before free
	bpf: prevent leaking pointer via xadd on unpriviledged
	net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish()
	net/mlx5: Cancel delayed recovery work when unloading the driver
	liquidio: fix bug in soft reset failure detection
	net/mlx5e: Fix TX carrier errors report in get stats ndo
	ipv6: dad: don't remove dynamic addresses if link is down
	vxlan: fix hlist corruption
	net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64
	net: ipv6: Compare lwstate in detecting duplicate nexthops
	vrf: fix bug_on triggered by rx when destroying a vrf
	rds: tcp: use sock_create_lite() to create the accept socket
	brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
	brcmfmac: Fix a memory leak in error handling path in 'brcmf_cfg80211_attach'
	brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain
	sfc: don't read beyond unicast address list
	cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE
	cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
	cfg80211: Check if PMKID attribute is of expected size
	cfg80211: Check if NAN service ID is of expected size
	irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity
	parisc: Report SIGSEGV instead of SIGBUS when running out of stack
	parisc: use compat_sys_keyctl()
	parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs
	parisc/mm: Ensure IRQs are off in switch_mm()
	tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth
	thp, mm: fix crash due race in MADV_FREE handling
	kernel/extable.c: mark core_kernel_text notrace
	mm/list_lru.c: fix list_lru_count_node() to be race free
	fs/dcache.c: fix spin lockup issue on nlru->lock
	checkpatch: silence perl 5.26.0 unescaped left brace warnings
	binfmt_elf: use ELF_ET_DYN_BASE only for PIE
	arm: move ELF_ET_DYN_BASE to 4MB
	arm64: move ELF_ET_DYN_BASE to 4GB / 4MB
	powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB
	s390: reduce ELF_ET_DYN_BASE
	exec: Limit arg stack to at most 75% of _STK_LIM
	ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers
	vt: fix unchecked __put_user() in tioclinux ioctls
	rcu: Add memory barriers for NOCB leader wakeup
	nvmem: core: fix leaks on registration errors
	mnt: In umount propagation reparent in a separate pass
	mnt: In propgate_umount handle visiting mounts in any order
	mnt: Make propagate_umount less slow for overlapping mount propagation trees
	selftests/capabilities: Fix the test_execve test
	mm: fix overflow check in expand_upwards()
	crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
	crypto: atmel - only treat EBUSY as transient if backlog
	crypto: sha1-ssse3 - Disable avx2
	crypto: caam - properly set IV after {en,de}crypt
	crypto: caam - fix signals handling
	Revert "sched/core: Optimize SCHED_SMT"
	sched/fair, cpumask: Export for_each_cpu_wrap()
	sched/topology: Fix building of overlapping sched-groups
	sched/topology: Optimize build_group_mask()
	sched/topology: Fix overlapping sched_group_mask
	PM / wakeirq: Convert to SRCU
	PM / QoS: return -EINVAL for bogus strings
	tracing: Use SOFTIRQ_OFFSET for softirq dectection for more accurate results
	kvm: vmx: Do not disable intercepts for BNDCFGS
	kvm: x86: Guest BNDCFGS requires guest MPX support
	kvm: vmx: Check value written to IA32_BNDCFGS
	kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS
	4.9.39

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-07-21 08:55:50 +02:00
Peter Zijlstra
542ebc96c2 sched/fair, cpumask: Export for_each_cpu_wrap()
commit c6508a39640b9a27fc2bc10cb708152672c82045 upstream.

commit c743f0a5c5 upstream.

More users for for_each_cpu_wrap() have appeared. Promote the construct
to generic cpumask interface.

The implementation is slightly modified to reduce arguments.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Lauro Ramos Venancio <lvenanci@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: lwang@redhat.com
Link: http://lkml.kernel.org/r/20170414122005.o35me2h5nowqkxbv@hirez.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-21 07:42:23 +02:00
Sahitya Tummala
a48542e8b4 mm/list_lru.c: fix list_lru_count_node() to be race free
commit 2c80cd57c7 upstream.

list_lru_count_node() iterates over all memcgs to get the total number of
entries on the node but it can race with memcg_drain_all_list_lrus(),
which migrates the entries from a dead cgroup to another.  This can return
incorrect number of entries from list_lru_count_node().

Fix this by keeping track of entries per node and simply return it in
list_lru_count_node().

Link: http://lkml.kernel.org/r/1498707555-30525-1-git-send-email-stummala@codeaurora.org
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Acked-by: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Alexander Polakov <apolyakov@beget.ru>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-21 07:42:21 +02:00
David Ahern
0bc26d1ca3 net: ipv6: Compare lwstate in detecting duplicate nexthops
commit f06b7549b7 upstream.

Lennert reported a failure to add different mpls encaps in a multipath
route:

  $ ip -6 route add 1234::/16 \
        nexthop encap mpls 10 via fe80::1 dev ens3 \
        nexthop encap mpls 20 via fe80::1 dev ens3
  RTNETLINK answers: File exists

The problem is that the duplicate nexthop detection does not compare
lwtunnel configuration. Add it.

Fixes: 19e42e4515 ("ipv6: support for fib route lwtunnel encap attributes")
Signed-off-by: David Ahern <dsahern@gmail.com>
Reported-by: João Taveira Araújo <joao.taveira@gmail.com>
Reported-by: Lennert Buytenhek <buytenh@wantstofly.org>
Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Tested-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-21 07:42:19 +02:00
Jiri Benc
beabc60327 vxlan: fix hlist corruption
[ Upstream commit 69e766612c ]

It's not a good idea to add the same hlist_node to two different hash lists.
This leads to various hard to debug memory corruptions.

Fixes: b1be00a6c3 ("vxlan: support both IPv4 and IPv6 sockets in a single vxlan device")
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-21 07:42:18 +02:00
Mohamad Haj Yahia
e20204dc2c net/mlx5: Cancel delayed recovery work when unloading the driver
commit 2a0165a034 upstream.

Draining the health workqueue will ignore future health works including
the one that report hardware failure and thus we can't enter error state
Instead cancel the recovery flow and make sure only recovery flow won't
be scheduled.

Fixes: 5e44fca504 ('net/mlx5: Only cancel recovery work when cleaning up device')
Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-21 07:42:18 +02:00
Colin Cross
833babb39f Add BINDER_GET_NODE_DEBUG_INFO ioctl
The BINDER_GET_NODE_DEBUG_INFO ioctl will return debug info on
a node.  Each successive call reusing the previous return value
will return the next node.  The data will be used by
libmemunreachable to mark the pointers with kernel references
as reachable.

Bug: 28275695
Change-Id: Idbbafa648a33822dc023862cd92b51a595cf7c1c
Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: Martijn Coenen <maco@android.com>
2017-07-19 10:35:09 +02:00
Martijn Coenen
c46810c235 ANDROID: binder: add RT inheritance flag to node.
Allows a binder node to specify whether it wants to
inherit real-time scheduling policy from a caller.

Change-Id: I375b6094bf441c19f19cba06d5a6be02cd07d714
Signed-off-by: Martijn Coenen <maco@android.com>
2017-07-19 10:12:53 +02:00
Martijn Coenen
6aac9798d8 ANDROID: binder: add min sched_policy to node.
This change adds flags to flat_binder_object.flags
to allow indicating a minimum scheduling policy for
the node. It also clarifies the valid value range
for the priority bits in the flags.

Internally, we use the priority map that the kernel
uses, e.g. [0..99] for real-time policies and [100..139]
for the SCHED_NORMAL/SCHED_BATCH policies.

Bug: 34461621
Bug: 37293077
Change-Id: I12438deecb53df432da18c6fc77460768ae726d2
Signed-off-by: Martijn Coenen <maco@google.com>
2017-07-19 10:12:52 +02:00
Greg Kroah-Hartman
3f353c3ed4 Merge 4.9.38 into android-4.9
Changes in 4.9.38
	mqueue: fix a use-after-free in sys_mq_notify()
	Add "shutdown" to "struct class".
	tpm: Issue a TPM2_Shutdown for TPM2 devices.
	tools include: Add a __fallthrough statement
	tools string: Use __fallthrough in perf_atoll()
	tools strfilter: Use __fallthrough
	perf top: Use __fallthrough
	perf thread_map: Correctly size buffer used with dirent->dt_name
	perf intel-pt: Use __fallthrough
	perf tests: Avoid possible truncation with dirent->d_name + snprintf
	perf bench numa: Avoid possible truncation when using snprintf()
	perf header: Fix handling of PERF_EVENT_UPDATE__SCALE
	perf scripting perl: Fix compile error with some perl5 versions
	perf probe: Fix to probe on gcc generated symbols for offline kernel
	perf probe: Add error checks to offline probe post-processing
	md: fix incorrect use of lexx_to_cpu in does_sb_need_changing
	md: fix super_offset endianness in super_1_rdev_size_change
	locking/rwsem-spinlock: Fix EINTR branch in __down_write_common()
	staging: vt6556: vnt_start Fix missing call to vnt_key_init_table.
	staging: comedi: fix clean-up of comedi_class in comedi_init()
	crypto: caam - fix gfp allocation flags (part I)
	crypto: rsa-pkcs1pad - use constant time memory comparison for MACs
	ext4: check return value of kstrtoull correctly in reserved_clusters_store
	x86/mm/pat: Don't report PAT on CPUs that don't support it
	saa7134: fix warm Medion 7134 EEPROM read
	Linux 4.9.38

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-07-15 13:31:27 +02:00
Josh Zimmerman
5a1e1c62f3 Add "shutdown" to "struct class".
commit f77af15165 upstream.

The TPM class has some common shutdown code that must be executed for
all drivers. This adds some needed functionality for that.

Signed-off-by: Josh Zimmerman <joshz@google.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: 74d6b3ceaa ("tpm: fix suspend/resume paths for TPM 2.0")
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-15 12:16:11 +02:00
Greg Kroah-Hartman
598195a906 Merge 4.9.37 into android-4.9
Changes in 4.9.37
	fs: add a VALID_OPEN_FLAGS
	fs: completely ignore unknown open flags
	driver core: platform: fix race condition with driver_override
	ceph: choose readdir frag based on previous readdir reply
	tracing/kprobes: Allow to create probe with a module name starting with a digit
	media: entity: Fix stream count check
	drm/virtio: don't leak bo on drm_gem_object_init failure
	usb: dwc3: replace %p with %pK
	USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
	Add USB quirk for HVR-950q to avoid intermittent device resets
	usb: usbip: set buffer pointers to NULL after free
	usb: Fix typo in the definition of Endpoint[out]Request
	USB: core: fix device node leak
	mac80211_hwsim: Replace bogus hrtimer clockid
	sysctl: don't print negative flag for proc_douintvec
	sysctl: report EINVAL if value is larger than UINT_MAX for proc_douintvec
	pinctrl: qcom: ipq4019: add missing pingroups for pins > 70
	pinctrl: cherryview: Add a quirk to make Acer Chromebook keyboard work again
	pinctrl: sh-pfc: r8a7794: Swap ATA signals
	pinctrl: sh-pfc: r8a7791: Fix SCIF2 pinmux data
	pinctrl: sh-pfc: r8a7791: Add missing DVC_MUTE signal
	pinctrl: sh-pfc: r8a7795: Fix hscif2_clk_b and hscif4_ctrl
	pinctrl: meson: meson8b: fix the NAND DQS pins
	pinctrl: stm32: Fix bad function call
	pinctrl: sunxi: Fix SPDIF function name for A83T
	pinctrl: cherryview: Add terminate entry for dmi_system_id tables
	pinctrl: mxs: atomically switch mux and drive strength config
	pinctrl: sh-pfc: r8a7791: Add missing HSCIF1 pinmux data
	pinctrl: sh-pfc: Update info pointer after SoC-specific init
	USB: serial: option: add two Longcheer device ids
	USB: serial: qcserial: new Sierra Wireless EM7305 device ID
	xhci: Limit USB2 port wake support for AMD Promontory hosts
	gfs2: Fix glock rhashtable rcu bug
	tpm: fix a kernel memory leak in tpm-sysfs.c
	x86/tools: Fix gcc-7 warning in relocs.c
	x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings
	ath10k: override CE5 config for QCA9377
	KEYS: Fix an error code in request_master_key()
	crypto: drbg - Fixes panic in wait_for_completion call
	RDMA/uverbs: Check port number supplied by user verbs cmds
	rt286: add Thinkpad Helix 2 to force_combo_jack_table
	Linux 4.9.37

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-07-12 17:07:29 +02:00
Benjamin Herrenschmidt
18b3abb543 usb: Fix typo in the definition of Endpoint[out]Request
commit 7cf916bd63 upstream.

The current definition is wrong. This breaks my upcoming
Aspeed virtual hub driver.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-12 15:01:03 +02:00
Christoph Hellwig
6efb1b0b6c fs: add a VALID_OPEN_FLAGS
commit 80f18379a7 upstream.

Add a central define for all valid open flags, and use it in the uniqueness
check.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-12 15:01:02 +02:00
Greg Kroah-Hartman
184ce810ce Merge 4.9.36 into android-4.9
Changes in 4.9.36
	ipv6: release dst on error in ip6_dst_lookup_tail
	net: don't call strlen on non-terminated string in dev_set_alias()
	decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb
	net: Zero ifla_vf_info in rtnl_fill_vfinfo()
	net: vrf: Make add_fib_rules per network namespace flag
	af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
	Fix an intermittent pr_emerg warning about lo becoming free.
	sctp: disable BH in sctp_for_each_endpoint
	net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
	net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse
	net/mlx5e: Added BW check for DIM decision mechanism
	net/mlx5e: Fix wrong indications in DIM due to counter wraparound
	proc: snmp6: Use correct type in memset
	igmp: acquire pmc lock for ip_mc_clear_src()
	igmp: add a missing spin_lock_init()
	ipv6: fix calling in6_ifa_hold incorrectly for dad work
	sctp: return next obj by passing pos + 1 into sctp_transport_get_idx
	net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it
	net/mlx5: Wait for FW readiness before initializing command interface
	net/mlx5e: Fix timestamping capabilities reporting
	decnet: always not take dst->__refcnt when inserting dst into hash table
	net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
	sfc: provide dummy definitions of vswitch functions
	ipv6: Do not leak throw route references
	rtnetlink: add IFLA_GROUP to ifla_policy
	netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
	netfilter: synproxy: fix conntrackd interaction
	NFSv4: fix a reference leak caused WARNING messages
	NFSv4.x/callback: Create the callback service through svc_create_pooled
	xen/blkback: don't use xen_blkif_get() in xen-blkback kthread
	drm/ast: Handle configuration without P2A bridge
	mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()
	MIPS: head: Reorder instructions missing a delay slot
	MIPS: Avoid accidental raw backtrace
	MIPS: pm-cps: Drop manual cache-line alignment of ready_count
	MIPS: Fix IRQ tracing & lockdep when rescheduling
	ALSA: hda - Fix endless loop of codec configure
	ALSA: hda - set input_path bitmap to zero after moving it to new place
	NFSv4.1: Fix a race in nfs4_proc_layoutget
	gpiolib: fix filtering out unwanted events
	drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
	dm thin: do not queue freed thin mapping for next stage processing
	x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds()
	usb: gadget: f_fs: Fix possibe deadlock
	l2tp: fix race in l2tp_recv_common()
	l2tp: ensure session can't get removed during pppol2tp_session_ioctl()
	l2tp: fix duplicate session creation
	l2tp: hold session while sending creation notifications
	l2tp: take a reference on sessions used in genetlink handlers
	mm: numa: avoid waiting on freed migrated pages
	sparc64: Handle PIO & MEM non-resumable errors.
	sparc64: Zero pages on allocation for mondo and error queues.
	net: ethtool: add support for 2500BaseT and 5000BaseT link modes
	net: phy: add an option to disable EEE advertisement
	dt-bindings: net: add EEE capability constants
	net: phy: fix sign type error in genphy_config_eee_advert
	net: phy: use boolean dt properties for eee broken modes
	dt: bindings: net: use boolean dt properties for eee broken modes
	ARM64: dts: meson-gxbb-odroidc2: fix GbE tx link breakage
	xen/blkback: don't free be structure too early
	KVM: x86: fix fixing of hypercalls
	scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type
	stmmac: add missing of_node_put
	scsi: lpfc: Set elsiocb contexts to NULL after freeing it
	qla2xxx: Terminate exchange if corrupted
	qla2xxx: Fix erroneous invalid handle message
	drm/amdgpu: fix program vce instance logic error.
	drm/amdgpu: add support for new hainan variants
	net: phy: dp83848: add DP83620 PHY support
	perf/x86/intel: Handle exclusive threadid correctly on CPU hotplug
	net: korina: Fix NAPI versus resources freeing
	powerpc/eeh: Enable IO path on permanent error
	net: ethtool: Initialize buffer when querying device channel settings
	xen-netback: fix memory leaks on XenBus disconnect
	xen-netback: protect resource cleaning on XenBus disconnect
	bnxt_en: Fix "uninitialized variable" bug in TPA code path.
	bpf: don't trigger OOM killer under pressure with map alloc
	objtool: Fix IRET's opcode
	gianfar: Do not reuse pages from emergency reserve
	Btrfs: Fix deadlock between direct IO and fast fsync
	Btrfs: fix truncate down when no_holes feature is enabled
	virtio_console: fix a crash in config_work_handler
	swiotlb-xen: update dev_addr after swapping pages
	xen-netfront: Fix Rx stall during network stress and OOM
	scsi: virtio_scsi: Reject commands when virtqueue is broken
	iwlwifi: fix kernel crash when unregistering thermal zone
	platform/x86: ideapad-laptop: handle ACPI event 1
	amd-xgbe: Check xgbe_init() return code
	net: dsa: Check return value of phy_connect_direct()
	drm/amdgpu: check ring being ready before using
	vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null
	mlxsw: spectrum_router: Correctly reallocate adjacency entries
	virtio_net: fix PAGE_SIZE > 64k
	ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()
	vxlan: do not age static remote mac entries
	ibmveth: Add a proper check for the availability of the checksum features
	kernel/panic.c: add missing \n
	Documentation: devicetree: change the mediatek ethernet compatible string
	drm/etnaviv: trick drm_mm into giving out a low IOVA
	perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code
	pinctrl: intel: Set pin direction properly
	net: phy: marvell: fix Marvell 88E1512 used in SGMII mode
	mac80211: recalculate min channel width on VHT opmode changes
	perf/x86/intel: Use ULL constant to prevent undefined shift behaviour
	HID: i2c-hid: Add sleep between POWER ON and RESET
	scsi: lpfc: avoid double free of resource identifiers
	spi: davinci: use dma_mapping_error()
	arm64: assembler: make adr_l work in modules under KASLR
	net: thunderx: acpi: fix LMAC initialization
	drm/radeon/si: load special ucode for certain MC configs
	drm/amd/powerplay: fix vce cg logic error on CZ/St.
	drm/amd/powerplay: refine vce dpm update code on Cz.
	pmem: return EIO on read_pmem() failure
	mac80211: initialize SMPS field in HT capabilities
	x86/tsc: Add the Intel Denverton Processor to native_calibrate_tsc()
	x86/mpx: Use compatible types in comparison to fix sparse error
	perf/core: Fix sys_perf_event_open() vs. hotplug
	perf/x86: Reject non sampling events with precise_ip
	aio: fix lock dep warning
	coredump: Ensure proper size of sparse core files
	swiotlb: ensure that page-sized mappings are page-aligned
	s390/ctl_reg: make __ctl_load a full memory barrier
	usb: dwc2: gadget: Fix GUSBCFG.USBTRDTIM value
	be2net: fix status check in be_cmd_pmac_add()
	be2net: don't delete MAC on close on unprivileged BE3 VFs
	be2net: fix MAC addr setting on privileged BE3 VFs
	perf probe: Fix to show correct locations for events on modules
	net: phy: dp83867: allow RGMII_TXID/RGMII_RXID interface types
	tipc: allocate user memory with GFP_KERNEL flag
	perf probe: Fix to probe on gcc generated functions in modules
	net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV
	sctp: check af before verify address in sctp_addr_id2transport
	ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets
	ravb: Fix use-after-free on `ifconfig eth0 down`
	mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap mappings
	xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
	xfrm: NULL dereference on allocation failure
	xfrm: Oops on error in pfkey_msg2xfrm_state()
	netfilter: use skb_to_full_sk in ip_route_me_harder
	watchdog: bcm281xx: Fix use of uninitialized spinlock.
	sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting
	spi: When no dma_chan map buffers with spi_master's parent
	spi: fix device-node leaks
	regulator: tps65086: Fix expected switch DT node names
	regulator: tps65086: Fix DT node referencing in of_parse_cb
	ARM: OMAP2+: omap_device: Sync omap_device and pm_runtime after probe defer
	ARM: dts: OMAP3: Fix MFG ID EEPROM
	ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation
	ARM: 8685/1: ensure memblock-limit is pmd-aligned
	tools arch: Sync arch/x86/lib/memcpy_64.S with the kernel
	x86/boot/KASLR: Fix kexec crash due to 'virt_addr' calculation bug
	x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space
	x86/mm: Fix flush_tlb_page() on Xen
	ocfs2: o2hb: revert hb threshold to keep compatible
	iommu/vt-d: Don't over-free page table directories
	iommu: Handle default domain attach failure
	iommu/dma: Don't reserve PCI I/O windows
	iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid()
	iommu/amd: Fix interrupt remapping when disable guest_mode
	cpufreq: s3c2416: double free on driver init error path
	clk: scpi: don't add cpufreq device if the scpi dvfs node is disabled
	objtool: Fix another GCC jump table detection issue
	infiniband: hns: avoid gcc-7.0.1 warning for uninitialized data
	brcmfmac: avoid writing channel out of allocated array
	i2c: brcmstb: Fix START and STOP conditions
	mtd: nand: brcmnand: Check flash #WP pin status before nand erase/program
	arm64: fix NULL dereference in have_cpu_die()
	KVM: x86: fix emulation of RSM and IRET instructions
	KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh()
	KVM: x86: zero base3 of unusable segments
	KVM: nVMX: Fix exception injection
	Linux 4.9.36

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-07-05 16:18:14 +02:00
Sabrina Dubroca
1e1666257c xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
commit 9b3eb54106 upstream.

When CONFIG_XFRM_SUB_POLICY=y, xfrm_dst stores a copy of the flowi for
that dst. Unfortunately, the code that allocates and fills this copy
doesn't care about what type of flowi (flowi, flowi4, flowi6) gets
passed. In multiple code paths (from raw_sendmsg, from TCP when
replying to a FIN, in vxlan, geneve, and gre), the flowi that gets
passed to xfrm is actually an on-stack flowi4, so we end up reading
stuff from the stack past the end of the flowi4 struct.

Since xfrm_dst->origin isn't used anywhere following commit
ca116922af ("xfrm: Eliminate "fl" and "pol" args to
xfrm_bundle_ok()."), just get rid of it.  xfrm_dst->partner isn't used
either, so get rid of that too.

Fixes: 9d6ec93801 ("ipv4: Use flowi4 in public route lookup interfaces.")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-05 14:40:28 +02:00
Dave Kleikamp
68a5dc3857 coredump: Ensure proper size of sparse core files
[ Upstream commit 4d22c75d4c ]

If the last section of a core file ends with an unmapped or zero page,
the size of the file does not correspond with the last dump_skip() call.
gdb complains that the file is truncated and can be confusing to users.

After all of the vma sections are written, make sure that the file size
is no smaller than the current file position.

This problem can be demonstrated with gdb's bigcore testcase on the
sparc architecture.

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-05 14:40:26 +02:00
Daniel Borkmann
251d00bf13 bpf: don't trigger OOM killer under pressure with map alloc
[ Upstream commit d407bd25a2 ]

This patch adds two helpers, bpf_map_area_alloc() and bpf_map_area_free(),
that are to be used for map allocations. Using kmalloc() for very large
allocations can cause excessive work within the page allocator, so i) fall
back earlier to vmalloc() when the attempt is considered costly anyway,
and even more importantly ii) don't trigger OOM killer with any of the
allocators.

Since this is based on a user space request, for example, when creating
maps with element pre-allocation, we really want such requests to fail
instead of killing other user space processes.

Also, don't spam the kernel log with warnings should any of the allocations
fail under pressure. Given that, we can make backend selection in
bpf_map_area_alloc() generic, and convert all maps over to use this API
for spots with potentially large allocation requests.

Note, replacing the one kmalloc_array() is fine as overflow checks happen
earlier in htab_map_alloc(), since it must also protect the multiplication
for vmalloc() should kmalloc_array() fail.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-05 14:40:21 +02:00
jbrunet
8bface142a dt: bindings: net: use boolean dt properties for eee broken modes
[ Upstream commit 308d3165d8 ]

The patches regarding eee-broken-modes was merged before all people
involved could find an agreement on the best way to move forward.

While we agreed on having a DT property to mark particular modes as broken,
the value used for eee-broken-modes mapped the phy register in very direct
way. Because of this, the concern is that it could be used to implement
configuration policies instead of describing a broken HW.

In the end, having a boolean property for each mode seems to be preferred
over one bit field value mapping the register (too) directly.

Cc: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-05 14:40:20 +02:00
jbrunet
752ba680eb dt-bindings: net: add EEE capability constants
[ Upstream commit 1fc31357ad ]

Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Tested-by: Yegor Yefremov <yegorslists@googlemail.com>
Tested-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-05 14:40:19 +02:00
jbrunet
97ace18307 net: phy: add an option to disable EEE advertisement
[ Upstream commit d853d145ea ]

This patch adds an option to disable EEE advertisement in the generic PHY
by providing a mask of prohibited modes corresponding to the value found in
the MDIO_AN_EEE_ADV register.

On some platforms, PHY Low power idle seems to be causing issues, even
breaking the link some cases. The patch provides a convenient way for these
platforms to disable EEE advertisement and work around the issue.

Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Tested-by: Yegor Yefremov <yegorslists@googlemail.com>
Tested-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-05 14:40:19 +02:00
Pavel Belous
0e8eca987e net: ethtool: add support for 2500BaseT and 5000BaseT link modes
[ Upstream commit 94842b4fc4 ]

This patch introduce support for 2500BaseT and 5000BaseT link modes.
These modes are included in the new IEEE 802.3bz standard.

Signed-off-by: Pavel Belous <pavel.s.belous@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-05 14:40:19 +02:00
Greg Kroah-Hartman
75d78c7eda Merge 4.9.35 into android-4.9
Changes in 4.9.35
	clk: sunxi-ng: a31: Correct lcd1-ch1 clock register offset
	xen/blkback: fix disconnect while I/Os in flight
	xen-blkback: don't leak stack data via response ring
	ALSA: firewire-lib: Fix stall of process context at packet error
	ALSA: pcm: Don't treat NULL chmap as a fatal error
	fs/exec.c: account for argv/envp pointers
	powerpc/perf: Fix oops when kthread execs user process
	autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL
	lib/cmdline.c: fix get_options() overflow while parsing ranges
	perf/x86/intel: Add 1G DTLB load/store miss support for SKL
	KVM: s390: gaccess: fix real-space designation asce handling for gmap shadows
	KVM: PPC: Book3S HV: Preserve userspace HTM state properly
	KVM: PPC: Book3S HV: Context-switch EBB registers properly
	CIFS: Improve readdir verbosity
	cxgb4: notify uP to route ctrlq compl to rdma rspq
	HID: Add quirk for Dell PIXART OEM mouse
	signal: Only reschedule timers on signals timers have sent
	powerpc/kprobes: Pause function_graph tracing during jprobes handling
	powerpc/64s: Handle data breakpoints in Radix mode
	Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list
	brcmfmac: add parameter to pass error code in firmware callback
	brcmfmac: use firmware callback upon failure to load
	brcmfmac: unbind all devices upon failure in firmware callback
	time: Fix clock->read(clock) race around clocksource changes
	time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
	arm64/vdso: Fix nsec handling for CLOCK_MONOTONIC_RAW
	target: Fix kref->refcount underflow in transport_cmd_finish_abort
	iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP
	iscsi-target: Reject immediate data underflow larger than SCSI transfer length
	drm/radeon: add a PX quirk for another K53TK variant
	drm/radeon: add a quirk for Toshiba Satellite L20-183
	drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating
	drm/amdgpu: adjust default display clock
	rxrpc: Fix several cases where a padded len isn't checked in ticket decode
	of: Add check to of_scan_flat_dt() before accessing initial_boot_params
	mtd: spi-nor: fix spansion quad enable
	usb: gadget: f_fs: avoid out of bounds access on comp_desc
	rt2x00: avoid introducing a USB dependency in the rt2x00lib module
	net: phy: Initialize mdio clock at probe function
	dmaengine: bcm2835: Fix cyclic DMA period splitting
	spi: double time out tolerance
	net: phy: fix marvell phy status reading
	jump label: fix passing kbuild_cflags when checking for asm goto support
	brcmfmac: fix uninitialized warning in brcmf_usb_probe_phase2()
	Linux 4.9.35

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-06-29 14:26:07 +02:00
John Stultz
a53bfdda06 time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
commit 3d88d56c58 upstream.

Due to how the MONOTONIC_RAW accumulation logic was handled,
there is the potential for a 1ns discontinuity when we do
accumulations. This small discontinuity has for the most part
gone un-noticed, but since ARM64 enabled CLOCK_MONOTONIC_RAW
in their vDSO clock_gettime implementation, we've seen failures
with the inconsistency-check test in kselftest.

This patch addresses the issue by using the same sub-ns
accumulation handling that CLOCK_MONOTONIC uses, which avoids
the issue for in-kernel users.

Since the ARM64 vDSO implementation has its own clock_gettime
calculation logic, this patch reduces the frequency of errors,
but failures are still seen. The ARM64 vDSO will need to be
updated to include the sub-nanosecond xtime_nsec values in its
calculation for this issue to be completely fixed.

Signed-off-by: John Stultz <john.stultz@linaro.org>
Tested-by: Daniel Mentz <danielmentz@google.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Stephen Boyd <stephen.boyd@linaro.org>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Miroslav Lichvar <mlichvar@redhat.com>
Link: http://lkml.kernel.org/r/1496965462-20003-3-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-29 13:00:30 +02:00
John Stultz
02a37ccd63 time: Fix clock->read(clock) race around clocksource changes
commit ceea5e3771 upstream.

In tests, which excercise switching of clocksources, a NULL
pointer dereference can be observed on AMR64 platforms in the
clocksource read() function:

u64 clocksource_mmio_readl_down(struct clocksource *c)
{
	return ~(u64)readl_relaxed(to_mmio_clksrc(c)->reg) & c->mask;
}

This is called from the core timekeeping code via:

	cycle_now = tkr->read(tkr->clock);

tkr->read is the cached tkr->clock->read() function pointer.
When the clocksource is changed then tkr->clock and tkr->read
are updated sequentially. The code above results in a sequential
load operation of tkr->read and tkr->clock as well.

If the store to tkr->clock hits between the loads of tkr->read
and tkr->clock, then the old read() function is called with the
new clock pointer. As a consequence the read() function
dereferences a different data structure and the resulting 'reg'
pointer can point anywhere including NULL.

This problem was introduced when the timekeeping code was
switched over to use struct tk_read_base. Before that, it was
theoretically possible as well when the compiler decided to
reload clock in the code sequence:

     now = tk->clock->read(tk->clock);

Add a helper function which avoids the issue by reading
tk_read_base->clock once into a local variable clk and then issue
the read function via clk->read(clk). This guarantees that the
read() function always gets the proper clocksource pointer handed
in.

Since there is now no use for the tkr.read pointer, this patch
also removes it, and to address stopping the fast timekeeper
during suspend/resume, it introduces a dummy clocksource to use
rather then just a dummy read function.

Signed-off-by: John Stultz <john.stultz@linaro.org>
Acked-by: Ingo Molnar <mingo@kernel.org>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Stephen Boyd <stephen.boyd@linaro.org>
Cc: Miroslav Lichvar <mlichvar@redhat.com>
Cc: Daniel Mentz <danielmentz@google.com>
Link: http://lkml.kernel.org/r/1496965462-20003-2-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-29 13:00:30 +02:00
Greg Kroah-Hartman
7172a93a70 Merge 4.9.34 into android-4.9
Changes in 4.9.34
	fs: pass on flags in compat_writev
	configfs: Fix race between create_link and configfs_rmdir
	can: gs_usb: fix memory leak in gs_cmd_reset()
	ila_xlat: add missing hash secret initialization
	cpufreq: conservative: Allow down_threshold to take values from 1 to 10
	vb2: Fix an off by one error in 'vb2_plane_vaddr'
	mac80211: don't look at the PM bit of BAR frames
	mac80211/wpa: use constant time memory comparison for MACs
	drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions.
	drm/i915: Fix GVT-g PVINFO version compatibility check
	usb: musb: dsps: keep VBUS on for host-only mode
	mac80211: fix CSA in IBSS mode
	mac80211: fix packet statistics for fast-RX
	mac80211: fix IBSS presp allocation size
	mac80211: strictly check mesh address extension mode
	mac80211: fix dropped counter in multiqueue RX
	mac80211: don't send SMPS action frame in AP mode when not needed
	drm/mediatek: fix mtk_hdmi_setup_vendor_specific_infoframe mistake
	drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.
	serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
	serial: sh-sci: Fix late enablement of AUTORTS
	x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init()
	mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode
	staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()
	staging: iio: tsl2x7x_core: Fix standard deviation calculation
	iio: st_pressure: Fix data sign
	iio: proximity: as3935: recalibrate RCO after resume
	iio: adc: ti_am335x_adc: allocating too much in probe
	IB/mlx5: Fix kernel to user leak prevention logic
	usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling
	usb: gadget: udc: renesas_usb3: fix deadlock by spinlock
	usb: gadget: udc: renesas_usb3: lock for PN_ registers access
	USB: hub: fix SS max number of ports
	usb: core: fix potential memory leak in error path during hcd creation
	USB: usbip: fix nonconforming hub descriptor
	pvrusb2: reduce stack usage pvr2_eeprom_analyze()
	USB: gadget: dummy_hcd: fix hub-descriptor removable fields
	usb: r8a66597-hcd: select a different endpoint on timeout
	usb: r8a66597-hcd: decrease timeout
	ath10k: fix napi crash during rmmod when probe firmware fails
	misc: mic: double free on ioctl error path
	drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
	usb: xhci: Fix USB 3.1 supported protocol parsing
	usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk
	USB: gadget: fix GPF in gadgetfs
	USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks
	mm/memory-failure.c: use compound_head() flags for huge pages
	swap: cond_resched in swap_cgroup_prepare()
	iio: imu: inv_mpu6050: add accel lpf setting for chip >= MPU6500
	sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off()
	genirq: Release resources in __setup_irq() error path
	alarmtimer: Prevent overflow of relative timers
	usb: gadget: composite: Fix function used to free memory
	usb: dwc3: exynos fix axius clock error path to do cleanup
	MIPS: Fix bnezc/jialc return address calculation
	MIPS: .its targets depend on vmlinux
	vTPM: Fix missing NULL check
	crypto: Work around deallocated stack frame reference gcc bug on sparc.
	alarmtimer: Rate limit periodic intervals
	mm: larger stack guard gap, between vmas
	Allow stack to grow up to address space limit
	mm: fix new crash in unmapped_area_topdown()
	Linux 4.9.34

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-06-27 10:43:56 +02:00
Greg Kroah-Hartman
0d21cf1656 Merge 4.9.33 into android-4.9
Changes in 4.9.33
	PCI/PM: Add needs_resume flag to avoid suspend complete optimization
	drm/i915: Prevent the system suspend complete optimization
	partitions/msdos: FreeBSD UFS2 file systems are not recognized
	netfilter: nf_conntrack_sip: fix wrong memory initialisation
	ibmvnic: Fix endian errors in error reporting output
	ibmvnic: Fix endian error when requesting device capabilities
	net: xilinx_emaclite: fix freezes due to unordered I/O
	net: xilinx_emaclite: fix receive buffer overflow
	tcp: tcp_probe: use spin_lock_bh()
	ipv6: Handle IPv4-mapped src to in6addr_any dst.
	ipv6: Inhibit IPv4-mapped src address on the wire.
	tipc: Fix tipc_sk_reinit race conditions
	gfs2: Use rhashtable walk interface in glock_hash_walk
	NET: Fix /proc/net/arp for AX.25
	ibmvnic: Call napi_disable instead of napi_enable in failure path
	ibmvnic: Initialize completion variables before starting work
	NET: mkiss: Fix panic
	net: hns: Fix the device being used for dma mapping during TX
	sierra_net: Skip validating irrelevant fields for IDLE LSIs
	sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications
	i2c: piix4: Request the SMBUS semaphore inside the mutex
	i2c: piix4: Fix request_region size
	powerpc/powernv: Properly set "host-ipi" on IPIs
	kernel/ucount.c: mark user_header with kmemleak_ignore()
	net: thunderx: Fix PHY autoneg for SGMII QLM mode
	ipv6: addrconf: fix generation of new temporary addresses
	vfio/spapr_tce: Set window when adding additional groups to container
	ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches
	ARM: defconfigs: make NF_CT_PROTO_SCTP and NF_CT_PROTO_UDPLITE built-in
	PM / runtime: Avoid false-positive warnings from might_sleep_if()
	jump label: pass kbuild_cflags when checking for asm goto support
	shmem: fix sleeping from atomic context
	kasan: respect /proc/sys/kernel/traceoff_on_warning
	log2: make order_base_2() behave correctly on const input value zero
	ethtool: do not vzalloc(0) on registers dump
	net: phy: Fix lack of reference count on PHY driver
	net: phy: Fix PHY module checks and NULL deref in phy_attach_direct()
	net: fix ndo_features_check/ndo_fix_features comment ordering
	fscache: Fix dead object requeue
	fscache: Clear outstanding writes when disabling a cookie
	FS-Cache: Initialise stores_lock in netfs cookie
	ipv6: fix flow labels when the traffic class is non-0
	drm/nouveau: prevent userspace from deleting client object
	drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers
	net/mlx4_core: Avoid command timeouts during VF driver device shutdown
	gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page
	pinctrl: baytrail: Rectify debounce support (part 2)
	cec: fix wrong last_la determination
	drm: prevent double-(un)registration for connectors
	drm: Don't race connector registration
	pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES
	net: adaptec: starfire: add checks for dma mapping errors
	drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()
	net/mlx5: E-Switch, Err when retrieving steering name-space fails
	net/mlx5: Return EOPNOTSUPP when failing to get steering name-space
	parisc, parport_gsc: Fixes for printk continuation lines
	net: phy: micrel: add support for KSZ8795
	gtp: add genl family modules alias
	drm/nouveau: Intercept ACPI_VIDEO_NOTIFY_PROBE
	drm/nouveau: Rename acpi_work to hpd_work
	drm/nouveau: Handle fbcon suspend/resume in seperate worker
	drm/nouveau: Don't enabling polling twice on runtime resume
	drm/nouveau: Fix drm poll_helper handling
	drm/ast: Fixed system hanged if disable P2A
	ravb: unmap descriptors when freeing rings
	nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"
	nvmet-rdma: Fix missing dma sync to nvme data structures
	r8152: avoid start_xmit to call napi_schedule during autosuspend
	r8152: check rx after napi is enabled
	r8152: re-schedule napi for tx
	r8152: fix rtl8152_post_reset function
	r8152: avoid start_xmit to schedule napi when napi is disabled
	net-next: ethernet: mediatek: change the compatible string
	bnxt_en: Fix bnxt_reset() in the slow path task.
	bnxt_en: Enhance autoneg support.
	bnxt_en: Fix RTNL lock usage on bnxt_update_link().
	bnxt_en: Fix RTNL lock usage on bnxt_get_port_module_status().
	sctp: sctp gso should set feature with NETIF_F_SG when calling skb_segment
	sctp: sctp_addr_id2transport should verify the addr before looking up assoc
	usb: musb: Fix external abort on non-linefetch for musb_irq_work()
	mn10300: fix build error of missing fpu_save()
	romfs: use different way to generate fsid for BLOCK or MTD
	frv: add atomic64_add_unless()
	frv: add missing atomic64 operations
	proc: add a schedule point in proc_pid_readdir()
	userfaultfd: fix SIGBUS resulting from false rwsem wakeups
	kernel/watchdog.c: move hardlockup detector to separate file
	kernel/watchdog.c: move shared definitions to nmi.h
	kernel/watchdog: prevent false hardlockup on overloaded system
	vhost/vsock: handle vhost_vq_init_access() error
	ARC: smp-boot: Decouple Non masters waiting API from jump to entry point
	ARCv2: smp-boot: wake_flag polling by non-Masters needs to be uncached
	tipc: ignore requests when the connection state is not CONNECTED
	tipc: fix connection refcount error
	tipc: add subscription refcount to avoid invalid delete
	tipc: fix nametbl_lock soft lockup at node/link events
	netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL
	netfilter: nft_log: restrict the log prefix length to 127
	RDMA/qedr: Dispatch port active event from qedr_add
	RDMA/qedr: Fix and simplify memory leak in PD alloc
	RDMA/qedr: Don't reset QP when queues aren't flushed
	RDMA/qedr: Don't spam dmesg if QP is in error state
	RDMA/qedr: Return max inline data in QP query result
	xtensa: don't use linux IRQ #0
	s390/kvm: do not rely on the ILC on kvm host protection fauls
	drm/i915: Workaround VLV/CHV DSI scanline counter hardware fail
	drm/i915: Always recompute watermarks when distrust_bios_wm is set, v2.
	sparc64: make string buffers large enough
	Linux 4.9.33

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-06-27 10:43:04 +02:00
Greg Kroah-Hartman
a26cd8eba6 Revert "ANDROID: hardlockup: detect hard lockups without NMIs using secondary cpus"
This reverts commit aaf78ec6c8.

We need to do this to handle a merge conflict with 4.9.32.  It will be
forward ported after the merge is complete.

Cc: Brian Norris <briannorris@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-06-27 10:31:16 +02:00
Hugh Dickins
cfc0eb4038 mm: larger stack guard gap, between vmas
commit 1be7107fbe upstream.

Stack guard page is a useful feature to reduce a risk of stack smashing
into a different mapping. We have been using a single page gap which
is sufficient to prevent having stack adjacent to a different mapping.
But this seems to be insufficient in the light of the stack usage in
userspace. E.g. glibc uses as large as 64kB alloca() in many commonly
used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX]
which is 256kB or stack strings with MAX_ARG_STRLEN.

This will become especially dangerous for suid binaries and the default
no limit for the stack size limit because those applications can be
tricked to consume a large portion of the stack and a single glibc call
could jump over the guard page. These attacks are not theoretical,
unfortunatelly.

Make those attacks less probable by increasing the stack guard gap
to 1MB (on systems with 4k pages; but make it depend on the page size
because systems with larger base pages might cap stack allocations in
the PAGE_SIZE units) which should cover larger alloca() and VLA stack
allocations. It is obviously not a full fix because the problem is
somehow inherent, but it should reduce attack space a lot.

One could argue that the gap size should be configurable from userspace,
but that can be done later when somebody finds that the new 1MB is wrong
for some special case applications.  For now, add a kernel command line
option (stack_guard_gap) to specify the stack gap size (in page units).

Implementation wise, first delete all the old code for stack guard page:
because although we could get away with accounting one extra page in a
stack vma, accounting a larger gap can break userspace - case in point,
a program run with "ulimit -S -v 20000" failed when the 1MB gap was
counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK
and strict non-overcommit mode.

Instead of keeping gap inside the stack vma, maintain the stack guard
gap as a gap between vmas: using vm_start_gap() in place of vm_start
(or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few
places which need to respect the gap - mainly arch_get_unmapped_area(),
and and the vma tree's subtree_gap support for that.

Original-patch-by: Oleg Nesterov <oleg@redhat.com>
Original-patch-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Tested-by: Helge Deller <deller@gmx.de> # parisc
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[wt: backport to 4.11: adjust context]
[wt: backport to 4.9: adjust context ; kernel doc was not in admin-guide]
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-24 07:11:18 +02:00
Johan Hovold
12bfbe157d USB: hub: fix SS max number of ports
commit 93491ced3c upstream.

Add define for the maximum number of ports on a SuperSpeed hub as per
USB 3.1 spec Table 10-5, and use it when verifying the retrieved hub
descriptor.

This specifically avoids benign attempts to update the DeviceRemovable
mask for non-existing ports (should we get that far).

Fixes: dbe79bbe9d ("USB 3.0 Hub Changes")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-24 07:11:15 +02:00
Liping Zhang
c47538f610 netfilter: nft_log: restrict the log prefix length to 127
[ Upstream commit 5ce6b04ce9 ]

First, log prefix will be truncated to NF_LOG_PREFIXLEN-1, i.e. 127,
at nf_log_packet(), so the extra part is useless.

Second, after adding a log rule with a very very long prefix, we will
fail to dump the nft rules after this _special_ one, but acctually,
they do exist. For example:
  # name_65000=$(printf "%0.sQ" {1..65000})
  # nft add rule filter output log prefix "$name_65000"
  # nft add rule filter output counter
  # nft add rule filter output counter
  # nft list chain filter output
  table ip filter {
      chain output {
          type filter hook output priority 0; policy accept;
      }
  }

So now, restrict the log prefix length to NF_LOG_PREFIXLEN-1.

Fixes: 96518518cc ("netfilter: add nftables")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:58 +02:00
Don Zickus
b13b3b706a kernel/watchdog: prevent false hardlockup on overloaded system
[ Upstream commit b94f51183b ]

On an overloaded system, it is possible that a change in the watchdog
threshold can be delayed long enough to trigger a false positive.

This can easily be achieved by having a cpu spinning indefinitely on a
task, while another cpu updates watchdog threshold.

What happens is while trying to park the watchdog threads, the hrtimers
on the other cpus trigger and reprogram themselves with the new slower
watchdog threshold.  Meanwhile, the nmi watchdog is still programmed
with the old faster threshold.

Because the one cpu is blocked, it prevents the thread parking on the
other cpus from completing, which is needed to shutdown the nmi watchdog
and reprogram it correctly.  As a result, a false positive from the nmi
watchdog is reported.

Fix this by setting a park_in_progress flag to block all lockups until
the parking is complete.

Fix provided by Ulrich Obergfell.

[akpm@linux-foundation.org: s/park_in_progress/watchdog_park_in_progress/]
Link: http://lkml.kernel.org/r/1481041033-192236-1-git-send-email-dzickus@redhat.com
Signed-off-by: Don Zickus <dzickus@redhat.com>
Reviewed-by: Aaron Tomlin <atomlin@redhat.com>
Cc: Ulrich Obergfell <uobergfe@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:57 +02:00
Babu Moger
0ce66ee6ae kernel/watchdog.c: move shared definitions to nmi.h
[ Upstream commit 249e52e355 ]

Patch series "Clean up watchdog handlers", v2.

This is an attempt to cleanup watchdog handlers.  Right now,
kernel/watchdog.c implements both softlockup and hardlockup detectors.
Softlockup code is generic.  Hardlockup code is arch specific.  Some
architectures don't use hardlockup detectors.  They use their own
watchdog detectors.  To make both these combination work, we have
numerous #ifdefs in kernel/watchdog.c.

We are trying here to make these handlers independent of each other.
Also provide an interface for architectures to implement their own
handlers.  watchdog_nmi_enable and watchdog_nmi_disable will be defined
as weak such that architectures can override its definitions.

Thanks to Don Zickus for his suggestions.
Here are our previous discussions
http://www.spinics.net/lists/sparclinux/msg16543.html
http://www.spinics.net/lists/sparclinux/msg16441.html

This patch (of 3):

Move shared macros and definitions to nmi.h so that watchdog.c, new file
watchdog_hld.c or any other architecture specific handler can use those
definitions.

Link: http://lkml.kernel.org/r/1478034826-43888-2-git-send-email-babu.moger@oracle.com
Signed-off-by: Babu Moger <babu.moger@oracle.com>
Acked-by: Don Zickus <dzickus@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Yaowei Bai <baiyaowei@cmss.chinamobile.com>
Cc: Aaron Tomlin <atomlin@redhat.com>
Cc: Ulrich Obergfell <uobergfe@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
Cc: Josh Hunt <johunt@akamai.com>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:57 +02:00
Sean Nyekjaer
7dddbfcd96 net: phy: micrel: add support for KSZ8795
[ Upstream commit 9d162ed69f ]

This is adds support for the PHYs in the KSZ8795 5port managed switch.

It will allow to detect the link between the switch and the soc
and uses the same read_status functions as the KSZ8873MLL switch.

Signed-off-by: Sean Nyekjaer <sean.nyekjaer@prevas.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:54 +02:00
Daniel Vetter
326fdffd70 drm: Don't race connector registration
[ Upstream commit e6e7b48b29 ]

I was under the misconception that the sysfs dev stuff can be fully
set up, and then registered all in one step with device_add. That's
true for properties and property groups, but not for parents and child
devices. Those must be fully registered before you can register a
child.

Add a bit of tracking to make sure that asynchronous mst connector
hotplugging gets this right. For consistency we rely upon the implicit
barriers of the connector->mutex, which is taken anyway, to ensure
that at least either the connector or device registration call will
work out.

Mildly tested since I can't reliably reproduce this on my mst box
here.

Reported-by: Dave Hansen <dave.hansen@intel.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Acked-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1484237756-2720-1-git-send-email-daniel.vetter@ffwll.ch
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:53 +02:00
Daniel Vetter
82b6693bd4 drm: prevent double-(un)registration for connectors
[ Upstream commit e73ab00e9a ]

If we're unlucky then the registration from a hotplugged connector
might race with the final registration step on driver load. And since
MST topology discover is asynchronous that's even somewhat likely.

v2: Also update the kerneldoc for @registered!

v3: Review from Chris:
- Improve kerneldoc for late_register/early_unregister callbacks.
- Use mutex_destroy.

Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Sean Paul <seanpaul@chromium.org>
Reported-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161218133545.2106-1-daniel.vetter@ffwll.ch
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:53 +02:00
Dimitris Michailidis
16f733d8db ipv6: fix flow labels when the traffic class is non-0
[ Upstream commit 90427ef5d2 ]

ip6_make_flowlabel() determines the flow label for IPv6 packets. It's
supposed to be passed a flow label, which it returns as is if non-0 and
in some other cases, otherwise it calculates a new value.

The problem is callers often pass a flowi6.flowlabel, which may also
contain traffic class bits. If the traffic class is non-0
ip6_make_flowlabel() mistakes the non-0 it gets as a flow label and
returns the whole thing. Thus it can return a 'flow label' longer than
20b and the low 20b of that is typically 0 resulting in packets with 0
label. Moreover, different packets of a flow may be labeled differently.
For a TCP flow with ECN non-payload and payload packets get different
labels as exemplified by this pair of consecutive packets:

(pure ACK)
Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
    0110 .... = Version: 6
    .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
        .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
        .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    .... .... .... 0001 1100 1110 0100 1001 = Flow Label: 0x1ce49
    Payload Length: 32
    Next Header: TCP (6)

(payload)
Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
    0110 .... = Version: 6
    .... 0000 0010 .... .... .... .... .... = Traffic Class: 0x02 (DSCP: CS0, ECN: ECT(0))
        .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
        .... .... ..10 .... .... .... .... .... = Explicit Congestion Notification: ECN-Capable Transport codepoint '10' (2)
    .... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
    Payload Length: 688
    Next Header: TCP (6)

This patch allows ip6_make_flowlabel() to be passed more than just a
flow label and has it extract the part it really wants. This was simpler
than modifying the callers. With this patch packets like the above become

Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
    0110 .... = Version: 6
    .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
        .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
        .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    .... .... .... 1010 1111 1010 0101 1110 = Flow Label: 0xafa5e
    Payload Length: 32
    Next Header: TCP (6)

Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
    0110 .... = Version: 6
    .... 0000 0010 .... .... .... .... .... = Traffic Class: 0x02 (DSCP: CS0, ECN: ECT(0))
        .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
        .... .... ..10 .... .... .... .... .... = Explicit Congestion Notification: ECN-Capable Transport codepoint '10' (2)
    .... .... .... 1010 1111 1010 0101 1110 = Flow Label: 0xafa5e
    Payload Length: 688
    Next Header: TCP (6)

Signed-off-by: Dimitris Michailidis <dmichail@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:52 +02:00
David Howells
11696dcea2 fscache: Fix dead object requeue
[ Upstream commit e26bfebdfc ]

Under some circumstances, an fscache object can become queued such that it
fscache_object_work_func() can be called once the object is in the
OBJECT_DEAD state.  This results in the kernel oopsing when it tries to
invoke the handler for the state (which is hard coded to 0x2).

The way this comes about is something like the following:

 (1) The object dispatcher is processing a work state for an object.  This
     is done in workqueue context.

 (2) An out-of-band event comes in that isn't masked, causing the object to
     be queued, say EV_KILL.

 (3) The object dispatcher finishes processing the current work state on
     that object and then sees there's another event to process, so,
     without returning to the workqueue core, it processes that event too.
     It then follows the chain of events that initiates until we reach
     OBJECT_DEAD without going through a wait state (such as
     WAIT_FOR_CLEARANCE).

     At this point, object->events may be 0, object->event_mask will be 0
     and oob_event_mask will be 0.

 (4) The object dispatcher returns to the workqueue processor, and in due
     course, this sees that the object's work item is still queued and
     invokes it again.

 (5) The current state is a work state (OBJECT_DEAD), so the dispatcher
     jumps to it - resulting in an OOPS.

When I'm seeing this, the work state in (1) appears to have been either
LOOK_UP_OBJECT or CREATE_OBJECT (object->oob_table is
fscache_osm_lookup_oob).

The window for (2) is very small:

 (A) object->event_mask is cleared whilst the event dispatch process is
     underway - though there's no memory barrier to force this to the top
     of the function.

     The window, therefore is from the time the object was selected by the
     workqueue processor and made requeueable to the time the mask was
     cleared.

 (B) fscache_raise_event() will only queue the object if it manages to set
     the event bit and the corresponding event_mask bit was set.

     The enqueuement is then deferred slightly whilst we get a ref on the
     object and get the per-CPU variable for workqueue congestion.  This
     slight deferral slightly increases the probability by allowing extra
     time for the workqueue to make the item requeueable.

Handle this by giving the dead state a processor function and checking the
for the dead state address rather than seeing if the processor function is
address 0x2.  The dead state processor function can then set a flag to
indicate that it's occurred and give a warning if it occurs more than once
per object.

If this race occurs, an oops similar to the following is seen (note the RIP
value):

BUG: unable to handle kernel NULL pointer dereference at 0000000000000002
IP: [<0000000000000002>] 0x1
PGD 0
Oops: 0010 [#1] SMP
Modules linked in: ...
CPU: 17 PID: 16077 Comm: kworker/u48:9 Not tainted 3.10.0-327.18.2.el7.x86_64 #1
Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 12/27/2015
Workqueue: fscache_object fscache_object_work_func [fscache]
task: ffff880302b63980 ti: ffff880717544000 task.ti: ffff880717544000
RIP: 0010:[<0000000000000002>]  [<0000000000000002>] 0x1
RSP: 0018:ffff880717547df8  EFLAGS: 00010202
RAX: ffffffffa0368640 RBX: ffff880edf7a4480 RCX: dead000000200200
RDX: 0000000000000002 RSI: 00000000ffffffff RDI: ffff880edf7a4480
RBP: ffff880717547e18 R08: 0000000000000000 R09: dfc40a25cb3a4510
R10: dfc40a25cb3a4510 R11: 0000000000000400 R12: 0000000000000000
R13: ffff880edf7a4510 R14: ffff8817f6153400 R15: 0000000000000600
FS:  0000000000000000(0000) GS:ffff88181f420000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000002 CR3: 000000000194a000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Stack:
 ffffffffa0363695 ffff880edf7a4510 ffff88093f16f900 ffff8817faa4ec00
 ffff880717547e60 ffffffff8109d5db 00000000faa4ec18 0000000000000000
 ffff8817faa4ec18 ffff88093f16f930 ffff880302b63980 ffff88093f16f900
Call Trace:
 [<ffffffffa0363695>] ? fscache_object_work_func+0xa5/0x200 [fscache]
 [<ffffffff8109d5db>] process_one_work+0x17b/0x470
 [<ffffffff8109e4ac>] worker_thread+0x21c/0x400
 [<ffffffff8109e290>] ? rescuer_thread+0x400/0x400
 [<ffffffff810a5acf>] kthread+0xcf/0xe0
 [<ffffffff810a5a00>] ? kthread_create_on_node+0x140/0x140
 [<ffffffff816460d8>] ret_from_fork+0x58/0x90
 [<ffffffff810a5a00>] ? kthread_create_on_node+0x140/0x140

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Jeremy McNicoll <jeremymc@redhat.com>
Tested-by: Frank Sorenson <sorenson@redhat.com>
Tested-by: Benjamin Coddington <bcodding@redhat.com>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:52 +02:00
Dimitris Michailidis
f4d2d05ffb net: fix ndo_features_check/ndo_fix_features comment ordering
[ Upstream commit 1a2a14444d ]

Commit cdba756f58 ("net: move ndo_features_check() close to
ndo_start_xmit()") inadvertently moved the doc comment for
.ndo_fix_features instead of .ndo_features_check. Fix the comment
ordering.

Fixes: cdba756f58 ("net: move ndo_features_check() close to ndo_start_xmit()")
Signed-off-by: Dimitris Michailidis <dmichail@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:52 +02:00
Ard Biesheuvel
8de6ea44af log2: make order_base_2() behave correctly on const input value zero
commit 29905b52fa upstream.

The function order_base_2() is defined (according to the comment block)
as returning zero on input zero, but subsequently passes the input into
roundup_pow_of_two(), which is explicitly undefined for input zero.

This has gone unnoticed until now, but optimization passes in GCC 7 may
produce constant folded function instances where a constant value of
zero is passed into order_base_2(), resulting in link errors against the
deliberately undefined '____ilog2_NaN'.

So update order_base_2() to adhere to its own documented interface.

[ See

     http://marc.info/?l=linux-kernel&m=147672952517795&w=2

  and follow-up discussion for more background. The gcc "optimization
  pass" is really just broken, but now the GCC trunk problem seems to
  have escaped out of just specially built daily images, so we need to
  work around it in mainline.    - Linus ]

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:51 +02:00
Imre Deak
b372d35a52 PCI/PM: Add needs_resume flag to avoid suspend complete optimization
commit 4d071c3238 upstream.

Some drivers - like i915 - may not support the system suspend direct
complete optimization due to differences in their runtime and system
suspend sequence.  Add a flag that when set resumes the device before
calling the driver's system suspend handlers which effectively disables
the optimization.

Needed by a future patch fixing suspend/resume on i915.

Suggested by Rafael.

Signed-off-by: Imre Deak <imre.deak@intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: stable@vger.kernel.org
(rebased on v4.8, added kernel version to commit message stable tag)
Signed-off-by: Imre Deak <imre.deak@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:48 +02:00
Greg Kroah-Hartman
da3493c028 Merge 4.9.32 into android-4.9
Changes in 4.9.32
	bnx2x: Fix Multi-Cos
	vxlan: eliminate cached dst leak
	ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()
	cxgb4: avoid enabling napi twice to the same queue
	tcp: disallow cwnd undo when switching congestion control
	vxlan: fix use-after-free on deletion
	ipv6: Fix leak in ipv6_gso_segment().
	net: ping: do not abuse udp_poll()
	net/ipv6: Fix CALIPSO causing GPF with datagram support
	net: ethoc: enable NAPI before poll may be scheduled
	net: stmmac: fix completely hung TX when using TSO
	net: bridge: start hello timer only if device is up
	sparc64: Add __multi3 for gcc 7.x and later.
	sparc64: mm: fix copy_tsb to correctly copy huge page TSBs
	sparc: Machine description indices can vary
	sparc64: reset mm cpumask after wrap
	sparc64: combine activate_mm and switch_mm
	sparc64: redefine first version
	sparc64: add per-cpu mm of secondary contexts
	sparc64: new context wrap
	sparc64: delete old wrap code
	arch/sparc: support NR_CPUS = 4096
	serial: ifx6x60: fix use-after-free on module unload
	ptrace: Properly initialize ptracer_cred on fork
	crypto: asymmetric_keys - handle EBUSY due to backlog correctly
	KEYS: fix dereferencing NULL payload with nonzero length
	KEYS: fix freeing uninitialized memory in key_update()
	KEYS: encrypted: avoid encrypting/decrypting stack buffers
	crypto: drbg - wait for crypto op not signal safe
	crypto: gcm - wait for crypto op not signal safe
	drm/amdgpu/ci: disable mclk switching for high refresh rates (v2)
	nfsd4: fix null dereference on replay
	nfsd: Fix up the "supattr_exclcreat" attributes
	efi: Don't issue error message when booted under Xen
	kvm: async_pf: fix rcu_irq_enter() with irqs enabled
	KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation
	arm64: KVM: Preserve RES1 bits in SCTLR_EL2
	arm64: KVM: Allow unaligned accesses at EL2
	arm: KVM: Allow unaligned accesses at HYP
	KVM: async_pf: avoid async pf injection when in guest mode
	KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt
	KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt
	dmaengine: usb-dmac: Fix DMAOR AE bit definition
	dmaengine: ep93xx: Always start from BASE0
	dmaengine: ep93xx: Don't drain the transfers in terminate_all()
	dmaengine: mv_xor_v2: handle mv_xor_v2_prep_sw_desc() error properly
	dmaengine: mv_xor_v2: properly handle wrapping in the array of HW descriptors
	dmaengine: mv_xor_v2: do not use descriptors not acked by async_tx
	dmaengine: mv_xor_v2: enable XOR engine after its configuration
	dmaengine: mv_xor_v2: fix tx_submit() implementation
	dmaengine: mv_xor_v2: remove interrupt coalescing
	dmaengine: mv_xor_v2: set DMA mask to 40 bits
	cfq-iosched: fix the delay of cfq_group's vdisktime under iops mode
	xen/privcmd: Support correctly 64KB page granularity when mapping memory
	ext4: fix SEEK_HOLE
	ext4: keep existing extra fields when inode expands
	ext4: fix data corruption with EXT4_GET_BLOCKS_ZERO
	ext4: fix fdatasync(2) after extent manipulation operations
	drm: Fix oops + Xserver hang when unplugging USB drm devices
	usb: gadget: f_mass_storage: Serialize wake and sleep execution
	usb: chipidea: udc: fix NULL pointer dereference if udc_start failed
	usb: chipidea: debug: check before accessing ci_role
	staging/lustre/lov: remove set_fs() call from lov_getstripe()
	iio: adc: bcm_iproc_adc: swap primary and secondary isr handler's
	iio: light: ltr501 Fix interchanged als/ps register field
	iio: proximity: as3935: fix AS3935_INT mask
	iio: proximity: as3935: fix iio_trigger_poll issue
	mei: make sysfs modalias format similar as uevent modalias
	cpufreq: cpufreq_register_driver() should return -ENODEV if init fails
	target: Re-add check to reject control WRITEs with overflow data
	drm/msm: Expose our reservation object when exporting a dmabuf.
	ahci: Acer SA5-271 SSD Not Detected Fix
	cgroup: Prevent kill_css() from being called more than once
	Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabled
	cpuset: consider dying css as offline
	fs: add i_blocksize()
	ufs: restore proper tail allocation
	fix ufs_isblockset()
	ufs: restore maintaining ->i_blocks
	ufs: set correct ->s_maxsize
	ufs_extend_tail(): fix the braino in calling conventions of ufs_new_fragments()
	ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path
	cxl: Fix error path on bad ioctl
	cxl: Avoid double free_irq() for psl,slice interrupts
	btrfs: use correct types for page indices in btrfs_page_exists_in_range
	btrfs: fix memory leak in update_space_info failure path
	KVM: arm/arm64: Handle possible NULL stage2 pud when ageing pages
	scsi: qla2xxx: don't disable a not previously enabled PCI device
	scsi: qla2xxx: Modify T262 FW dump template to specify same start/end to debug customer issues
	scsi: qla2xxx: Set bit 15 for DIAG_ECHO_TEST MBC
	scsi: qla2xxx: Fix mailbox pointer error in fwdump capture
	powerpc/sysdev/simple_gpio: Fix oops in gpio save_regs function
	powerpc/numa: Fix percpu allocations to be NUMA aware
	powerpc/hotplug-mem: Fix missing endian conversion of aa_index
	powerpc/kernel: Fix FP and vector register restoration
	powerpc/kernel: Initialize load_tm on task creation
	perf/core: Drop kernel samples even though :u is specified
	drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()
	drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()
	drm/vmwgfx: Make sure backup_handle is always valid
	drm/nouveau/tmr: fully separate alarm execution/pending lists
	ALSA: timer: Fix race between read and ioctl
	ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT
	ASoC: Fix use-after-free at card unregistration
	cpu/hotplug: Drop the device lock on error
	drivers: char: mem: Fix wraparound check to allow mappings up to the end
	serial: sh-sci: Fix panic when serial console and DMA are enabled
	arm64: traps: fix userspace cache maintenance emulation on a tagged pointer
	arm64: hw_breakpoint: fix watchpoint matching for tagged pointers
	arm64: entry: improve data abort handling of tagged pointers
	ARM: 8636/1: Cleanup sanity_check_meminfo
	ARM: 8637/1: Adjust memory boundaries after reservations
	usercopy: Adjust tests to deal with SMAP/PAN
	drm/i915/vbt: don't propagate errors from intel_bios_init()
	drm/i915/vbt: split out defaults that are set when there is no VBT
	cpufreq: schedutil: move cached_raw_freq to struct sugov_policy
	cpufreq: schedutil: Fix per-CPU structure initialization in sugov_start()
	netfilter: nft_set_rbtree: handle element re-addition after deletion
	Linux 4.9.32

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-06-14 16:42:56 +02:00