Commit Graph

3242 Commits

Author SHA1 Message Date
Greg Kroah-Hartman b86d2b1467 Merge 4.9.57 into android-4.9
Changes in 4.9.57
	ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets
	CIFS: Reconnect expired SMB sessions
	nl80211: Define policy for packet pattern attributes
	rcu: Allow for page faults in NMI handlers
	USB: dummy-hcd: Fix deadlock caused by disconnect detection
	MIPS: math-emu: Remove pr_err() calls from fpu_emu()
	dmaengine: edma: Align the memcpy acnt array size with the transfer
	dmaengine: ti-dma-crossbar: Fix possible race condition with dma_inuse
	HID: usbhid: fix out-of-bounds bug
	crypto: shash - Fix zero-length shash ahash digest crash
	KVM: MMU: always terminate page walks at level 1
	KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit
	usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet
	pinctrl/amd: Fix build dependency on pinmux code
	iommu/amd: Finish TLB flush in amd_iommu_unmap()
	device property: Track owner device of device property
	fs/mpage.c: fix mpage_writepage() for pages with buffers
	ALSA: usb-audio: Kill stray URB at exiting
	ALSA: seq: Fix use-after-free at creating a port
	ALSA: seq: Fix copy_from_user() call inside lock
	ALSA: caiaq: Fix stray URB at probe error path
	ALSA: line6: Fix missing initialization before error path
	ALSA: line6: Fix leftover URB at error-path during probe
	drm/i915/edp: Get the Panel Power Off timestamp after panel is off
	drm/i915: Read timings from the correct transcoder in intel_crtc_mode_get()
	drm/i915/bios: parse DDI ports also for CHV for HDMI DDC pin and DP AUX channel
	usb: gadget: configfs: Fix memory leak of interface directory data
	usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options
	direct-io: Prevent NULL pointer access in submit_page_section
	fix unbalanced page refcounting in bio_map_user_iov
	more bio_map_user_iov() leak fixes
	bio_copy_user_iov(): don't ignore ->iov_offset
	USB: serial: ftdi_sio: add id for Cypress WICED dev board
	USB: serial: cp210x: add support for ELV TFD500
	USB: serial: option: add support for TP-Link LTE module
	USB: serial: qcserial: add Dell DW5818, DW5819
	USB: serial: console: fix use-after-free after failed setup
	x86/alternatives: Fix alt_max_short macro to really be a max()
	KVM: nVMX: update last_nonleaf_level when initializing nested EPT
	Linux 4.9.57

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-10-18 09:45:37 +02:00
Jarkko Nikula 2a077f7258 device property: Track owner device of device property
commit 5ab894aee0f171a682bcd90dd5d1930cb53c55dc upstream.

Deletion of subdevice will remove device properties associated to parent
when they share the same firmware node after commit 478573c93a (driver
core: Don't leak secondary fwnode on device removal).  This was observed
with a driver adding subdevice that driver wasn't able to read device
properties after rmmod/modprobe cycle.

Consider the lifecycle of it:

parent device registration
	ACPI_COMPANION_SET()
	device_add_properties()
		pset_copy_set()
		set_secondary_fwnode(dev, &p->fwnode)
	device_add()

parent probe
	read device properties
	ACPI_COMPANION_SET(subdevice, ACPI_COMPANION(parent))
	device_add(subdevice)

parent remove
	device_del(subdevice)
		device_remove_properties()
			set_secondary_fwnode(dev, NULL);
			pset_free()

Parent device will have its primary firmware node pointing to an ACPI
node and secondary firmware node point to device properties.

ACPI_COMPANION_SET() call in parent probe will set the subdevice's
firmware node to point to the same 'struct fwnode_handle' and the
associated secondary firmware node, i.e. the device properties as the
parent.

When subdevice is deleted in parent remove that will remove those
device properties and attempt to read device properties in next
parent probe call will fail.

Fix this by tracking the owner device of device properties and delete
them only when owner device is being deleted.

Fixes: 478573c93a (driver core: Don't leak secondary fwnode on device removal)
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-18 09:35:39 +02:00
Greg Kroah-Hartman cdbe07ad26 Merge 4.9.55 into android-4.9
Changes in 4.9.55
	USB: gadgetfs: Fix crash caused by inadequate synchronization
	USB: gadgetfs: fix copy_to_user while holding spinlock
	usb: gadget: udc: atmel: set vbus irqflags explicitly
	usb: gadget: udc: renesas_usb3: fix for no-data control transfer
	usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
	usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
	usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
	usb-storage: fix bogus hardware error messages for ATA pass-thru devices
	usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
	usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
	ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
	usb: pci-quirks.c: Corrected timeout values used in handshake
	USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
	USB: dummy-hcd: fix connection failures (wrong speed)
	USB: dummy-hcd: fix infinite-loop resubmission bug
	USB: dummy-hcd: Fix erroneous synchronization change
	USB: devio: Don't corrupt user memory
	usb: gadget: mass_storage: set msg_registered after msg registered
	USB: g_mass_storage: Fix deadlock when driver is unbound
	USB: uas: fix bug in handling of alternate settings
	USB: core: harden cdc_parse_cdc_header
	usb: Increase quirk delay for USB devices
	USB: fix out-of-bounds in usb_set_configuration
	xhci: fix finding correct bus_state structure for USB 3.1 hosts
	xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
	xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
	Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
	iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
	iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'
	iio: ad_sigma_delta: Implement a dedicated reset function
	staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
	iio: core: Return error for failed read_reg
	IIO: BME280: Updates to Humidity readings need ctrl_reg write!
	iio: ad7793: Fix the serial interface reset
	iio: adc: mcp320x: Fix readout of negative voltages
	iio: adc: mcp320x: Fix oops on module unload
	uwb: properly check kthread_run return value
	uwb: ensure that endpoint is interrupt
	staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
	mm, oom_reaper: skip mm structs with mmu notifiers
	lib/ratelimit.c: use deferred printk() version
	lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
	ALSA: compress: Remove unused variable
	Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"
	ALSA: usx2y: Suppress kernel warning at page allocation failures
	mlxsw: spectrum: Prevent mirred-related crash on removal
	net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
	sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
	tcp: update skb->skb_mstamp more carefully
	bpf/verifier: reject BPF_ALU64|BPF_END
	tcp: fix data delivery rate
	udpv6: Fix the checksum computation when HW checksum does not apply
	ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
	net: phy: Fix mask value write on gmii2rgmii converter speed register
	ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
	net/sched: cls_matchall: fix crash when used with classful qdisc
	tcp: fastopen: fix on syn-data transmit failure
	net: emac: Fix napi poll list corruption
	packet: hold bind lock when rebinding to fanout hook
	bpf: one perf event close won't free bpf program attached by another perf event
	isdn/i4l: fetch the ppp_write buffer in one shot
	net_sched: always reset qdisc backlog in qdisc_reset()
	net: qcom/emac: specify the correct size when mapping a DMA buffer
	vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
	l2tp: Avoid schedule while atomic in exit_net
	l2tp: fix race condition in l2tp_tunnel_delete
	tun: bail out from tun_get_user() if the skb is empty
	net: dsa: Fix network device registration order
	packet: in packet_do_bind, test fanout with bind_lock held
	packet: only test po->has_vnet_hdr once in packet_snd
	net: Set sk_prot_creator when cloning sockets to the right proto
	netlink: do not proceed if dump's start() errs
	ip6_gre: ip6gre_tap device should keep dst
	ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
	tipc: use only positive error codes in messages
	net: rtnetlink: fix info leak in RTM_GETSTATS call
	socket, bpf: fix possible use after free
	powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
	powerpc/tm: Fix illegal TM state in signal handler
	percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
	driver core: platform: Don't read past the end of "driver_override" buffer
	Drivers: hv: fcopy: restore correct transfer length
	stm class: Fix a use-after-free
	ftrace: Fix kmemleak in unregister_ftrace_graph
	HID: i2c-hid: allocate hid buffers for real worst case
	HID: wacom: leds: Don't try to control the EKR's read-only LEDs
	HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
	HID: wacom: bits shifted too much for 9th and 10th buttons
	rocker: fix rocker_tlv_put_* functions for KASAN
	netlink: fix nla_put_{u8,u16,u32} for KASAN
	iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
	iwlwifi: add workaround to disable wide channels in 5GHz
	scsi: sd: Do not override max_sectors_kb sysfs setting
	brcmfmac: add length check in brcmf_cfg80211_escan_handler()
	brcmfmac: setup passive scan if requested by user-space
	drm/i915/bios: ignore HDMI on port A
	nvme-pci: Use PCI bus address for data/queues in CMB
	mmc: core: add driver strength selection when selecting hs400es
	sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
	vfs: deny copy_file_range() for non regular files
	ext4: fix data corruption for mmap writes
	ext4: Don't clear SGID when inheriting ACLs
	ext4: don't allow encrypted operations without keys
	f2fs: don't allow encrypted operations without keys
	KVM: x86: fix singlestepping over syscall
	Linux 4.9.55

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-10-12 22:31:24 +02:00
Nicolai Stange a97ca4f780 driver core: platform: Don't read past the end of "driver_override" buffer
commit bf563b01c2895a4bfd1a29cc5abc67fe706ecffd upstream.

When printing the driver_override parameter when it is 4095 and 4094 bytes
long, the printing code would access invalid memory because we need count+1
bytes for printing.

Reject driver_override values of these lengths in driver_override_store().

This is in close analogy to commit 4efe874aac ("PCI: Don't read past the
end of sysfs "driver_override" buffer") from Sasha Levin.

Fixes: 3d713e0e38 ("driver core: platform: add device binding path 'driver_override'")
Signed-off-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-12 11:51:24 +02:00
Greg Kroah-Hartman 379e3b2a6d Merge 4.9.53 into android-4.9
Changes in 4.9.53
	cifs: release cifs root_cred after exit_cifs
	cifs: release auth_key.response for reconnect.
	fs/proc: Report eip/esp in /prod/PID/stat for coredumping
	mac80211: fix VLAN handling with TXQs
	mac80211_hwsim: Use proper TX power
	mac80211: flush hw_roc_start work before cancelling the ROC
	genirq: Make sparse_irq_lock protect what it should protect
	KVM: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce()
	KVM: PPC: Book3S HV: Protect updates to spapr_tce_tables list
	tracing: Fix trace_pipe behavior for instance traces
	tracing: Erase irqsoff trace with empty write
	md/raid5: fix a race condition in stripe batch
	md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list
	scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly
	drm/radeon: disable hard reset in hibernate for APUs
	crypto: drbg - fix freeing of resources
	crypto: talitos - Don't provide setkey for non hmac hashing algs.
	crypto: talitos - fix sha224
	crypto: talitos - fix hashing
	security/keys: properly zero out sensitive key material in big_key
	security/keys: rewrite all of big_key crypto
	KEYS: fix writing past end of user-supplied buffer in keyring_read()
	KEYS: prevent creating a different user's keyrings
	KEYS: prevent KEYCTL_READ on negative key
	powerpc/pseries: Fix parent_dn reference leak in add_dt_node()
	powerpc/tm: Flush TM only if CPU has TM feature
	powerpc/ftrace: Pass the correct stack pointer for DYNAMIC_FTRACE_WITH_REGS
	s390/mm: fix write access check in gup_huge_pmd()
	PM: core: Fix device_pm_check_callbacks()
	Fix SMB3.1.1 guest authentication to Samba
	SMB3: Warn user if trying to sign connection that authenticated as guest
	SMB: Validate negotiate (to protect against downgrade) even if signing off
	SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags
	vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets
	nl80211: check for the required netlink attributes presence
	bsg-lib: don't free job in bsg_prepare_job
	iw_cxgb4: remove the stid on listen create failure
	iw_cxgb4: put ep reference in pass_accept_req()
	selftests/seccomp: Support glibc 2.26 siginfo_t.h
	seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter()
	arm64: Make sure SPsel is always set
	arm64: fault: Route pte translation faults via do_translation_fault
	KVM: VMX: extract __pi_post_block
	KVM: VMX: avoid double list add with VT-d posted interrupts
	KVM: VMX: simplify and fix vmx_vcpu_pi_load
	kvm/x86: Handle async PF in RCU read-side critical sections
	KVM: VMX: Do not BUG() on out-of-bounds guest IRQ
	kvm: nVMX: Don't allow L2 to access the hardware CR8
	xfs: validate bdev support for DAX inode flag
	etnaviv: fix gem object list corruption
	PCI: Fix race condition with driver_override
	btrfs: fix NULL pointer dereference from free_reloc_roots()
	btrfs: propagate error to btrfs_cmp_data_prepare caller
	btrfs: prevent to set invalid default subvolid
	x86/mm: Fix fault error path using unsafe vma pointer
	x86/fpu: Don't let userspace set bogus xcomp_bv
	gfs2: Fix debugfs glocks dump
	timer/sysclt: Restrict timer migration sysctl values to 0 and 1
	KVM: VMX: do not change SN bit in vmx_update_pi_irte()
	KVM: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt
	cxl: Fix driver use count
	KVM: VMX: use cmpxchg64
	video: fbdev: aty: do not leak uninitialized padding in clk to userspace
	swiotlb-xen: implement xen_swiotlb_dma_mmap callback
	Linux 4.9.53

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-10-05 10:37:37 +02:00
Rafael J. Wysocki 3a02f8cb55 PM: core: Fix device_pm_check_callbacks()
commit 157c460e10cb6eca29ccbd0f023db159d0c55ec7 upstream.

The device_pm_check_callbacks() function doesn't check legacy
->suspend and ->resume callback pointers under the device's
bus type, class and driver, so in some cases it may set the
no_pm_callbacks flag for the device incorrectly and then the
callbacks may be skipped during system suspend/resume, which
shouldn't happen.

Fixes: aa8e54b559 (PM / sleep: Go direct_complete if driver has no callbacks)
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-05 09:44:01 +02:00
Greg Kroah-Hartman 5316da5fec Merge 4.9.49 into android-4.9
Changes in 4.9.49
	usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
	USB: serial: option: add support for D-Link DWM-157 C1
	usb: Add device quirk for Logitech HD Pro Webcam C920-C
	usb:xhci:Fix regression when ATI chipsets detected
	USB: musb: fix external abort on suspend
	USB: core: Avoid race of async_completed() w/ usbdev_release()
	staging/rts5208: fix incorrect shift to extract upper nybble
	iio: adc: ti-ads1015: fix incorrect data rate setting update
	iio: adc: ti-ads1015: fix scale information for ADS1115
	iio: adc: ti-ads1015: enable conversion when CONFIG_PM is not set
	iio: adc: ti-ads1015: avoid getting stale result after runtime resume
	iio: adc: ti-ads1015: don't return invalid value from buffer setup callbacks
	iio: adc: ti-ads1015: add adequate wait time to get correct conversion
	driver core: bus: Fix a potential double free
	intel_th: pci: Add Cannon Lake PCH-H support
	intel_th: pci: Add Cannon Lake PCH-LP support
	ath10k: fix memory leak in rx ring buffer allocation
	Input: trackpoint - assume 3 buttons when buttons detection fails
	rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter
	Bluetooth: Add support of 13d3:3494 RTL8723BE device
	iwlwifi: pci: add new PCI ID for 7265D
	dlm: avoid double-free on error path in dlm_device_{register,unregister}
	mwifiex: correct channel stat buffer overflows
	MCB: add support for SC31 to mcb-lpc
	s390/mm: avoid empty zero pages for KVM guests to avoid postcopy hangs
	drm/nouveau/pci/msi: disable MSI on big-endian platforms by default
	workqueue: Fix flag collision
	cs5536: add support for IDE controller variant
	scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE
	scsi: sg: recheck MMAP_IO request length with lock held
	drm/bridge: adv7511: Use work_struct to defer hotplug handing to out of irq context
	drm/bridge: adv7511: Switch to using drm_kms_helper_hotplug_event()
	Linux 4.9.49

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-09-11 08:40:40 -07:00
Christophe JAILLET 5555eb956e driver core: bus: Fix a potential double free
commit 0f9b011d3321ca1079c7a46c18cb1956fbdb7bcb upstream.

The .release function of driver_ktype is 'driver_release()'.
This function frees the container_of this kobject.

So, this memory must not be freed explicitly in the error handling path of
'bus_add_driver()'. Otherwise a double free will occur.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-09-09 17:39:38 +02:00
Greg Kroah-Hartman 02f29ab1b9 Merge 4.9.42 into android-4.9
Changes in 4.9.42
	parisc: Handle vma's whose context is not current in flush_cache_range
	cgroup: create dfl_root files on subsys registration
	cgroup: fix error return value from cgroup_subtree_control()
	libata: array underflow in ata_find_dev()
	workqueue: restore WQ_UNBOUND/max_active==1 to be ordered
	iwlwifi: dvm: prevent an out of bounds access
	brcmfmac: fix memleak due to calling brcmf_sdiod_sgtable_alloc() twice
	NFSv4: Fix EXCHANGE_ID corrupt verifier issue
	mmc: sdhci-of-at91: force card detect value for non removable devices
	device property: Make dev_fwnode() public
	mmc: core: Fix access to HS400-ES devices
	mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries
	cpuset: fix a deadlock due to incomplete patching of cpusets_enabled()
	ALSA: hda - Fix speaker output from VAIO VPCL14M1R
	drm/amdgpu: Fix undue fallthroughs in golden registers initialization
	ASoC: do not close shared backend dailink
	KVM: async_pf: make rcu irq exit if not triggered from idle task
	mm/page_alloc: Remove kernel address exposure in free_reserved_area()
	timers: Fix overflow in get_next_timer_interrupt
	powerpc/tm: Fix saving of TM SPRs in core dump
	powerpc/64: Fix __check_irq_replay missing decrementer interrupt
	iommu/amd: Enable ga_log_intr when enabling guest_mode
	gpiolib: skip unwanted events, don't convert them to opposite edge
	ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize
	ext4: fix overflow caused by missing cast in ext4_resize_fs()
	ARM: dts: armada-38x: Fix irq type for pca955
	ARM: dts: tango4: Request RGMII RX and TX clock delays
	media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl
	iscsi-target: Fix initial login PDU asynchronous socket close OOPs
	mmc: dw_mmc: Use device_property_read instead of of_property_read
	mmc: core: Use device_property_read instead of of_property_read
	media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds
	f2fs: sanity check checkpoint segno and blkoff
	Btrfs: fix early ENOSPC due to delalloc
	saa7164: fix double fetch PCIe access condition
	tcp_bbr: cut pacing rate only if filled pipe
	tcp_bbr: introduce bbr_bw_to_pacing_rate() helper
	tcp_bbr: introduce bbr_init_pacing_rate_from_rtt() helper
	tcp_bbr: remove sk_pacing_rate=0 transient during init
	tcp_bbr: init pacing rate on first RTT sample
	ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()
	net: Zero terminate ifr_name in dev_ifname().
	ipv6: avoid overflow of offset in ip6_find_1stfragopt
	net: dsa: b53: Add missing ARL entries for BCM53125
	ipv4: initialize fib_trie prior to register_netdev_notifier call.
	rtnetlink: allocate more memory for dev_set_mac_address()
	mcs7780: Fix initialization when CONFIG_VMAP_STACK is enabled
	openvswitch: fix potential out of bound access in parse_ct
	packet: fix use-after-free in prb_retire_rx_blk_timer_expired()
	ipv6: Don't increase IPSTATS_MIB_FRAGFAILS twice in ip6_fragment()
	net: ethernet: nb8800: Handle all 4 RGMII modes identically
	dccp: fix a memleak that dccp_ipv6 doesn't put reqsk properly
	dccp: fix a memleak that dccp_ipv4 doesn't put reqsk properly
	dccp: fix a memleak for dccp_feat_init err process
	sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
	sctp: fix the check for _sctp_walk_params and _sctp_walk_errors
	net/mlx5: Consider tx_enabled in all modes on remap
	net/mlx5: Fix command bad flow on command entry allocation failure
	net/mlx5e: Fix outer_header_zero() check size
	net/mlx5e: Fix wrong delay calculation for overflow check scheduling
	net/mlx5e: Schedule overflow check work to mlx5e workqueue
	net: phy: Correctly process PHY_HALTED in phy_stop_machine()
	xen-netback: correctly schedule rate-limited queues
	sparc64: Measure receiver forward progress to avoid send mondo timeout
	sparc64: Fix exception handling in UltraSPARC-III memcpy.
	wext: handle NULL extra data in iwe_stream_add_point better
	sh_eth: fix EESIPR values for SH77{34|63}
	sh_eth: R8A7740 supports packet shecksumming
	net: phy: dp83867: fix irq generation
	tg3: Fix race condition in tg3_get_stats64().
	x86/boot: Add missing declaration of string functions
	spi: spi-axi: Free resources on error path
	ASoC: rt5645: set sel_i2s_pre_div1 to 2
	netfilter: use fwmark_reflect in nf_send_reset
	phy state machine: failsafe leave invalid RUNNING state
	ipv4: make tcp_notsent_lowat sysctl knob behave as true unsigned int
	clk/samsung: exynos542x: mark some clocks as critical
	scsi: qla2xxx: Get mutex lock before checking optrom_state
	drm/virtio: fix framebuffer sparse warning
	ARM: dts: sun8i: Support DTB build for NanoPi M1
	ARM: dts: sunxi: Change node name for pwrseq pin on Olinuxino-lime2-emmc
	iw_cxgb4: do not send RX_DATA_ACK CPLs after close/abort
	nbd: blk_mq_init_queue returns an error code on failure, not NULL
	virtio_blk: fix panic in initialization error path
	ARM: 8632/1: ftrace: fix syscall name matching
	mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER
	lib/Kconfig.debug: fix frv build failure
	signal: protect SIGNAL_UNKILLABLE from unintentional clearing.
	mm: don't dereference struct page fields of invalid pages
	net/mlx5: E-Switch, Re-enable RoCE on mode change only after FDB destroy
	ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output
	net: account for current skb length when deciding about UFO
	net: phy: Fix PHY unbind crash
	workqueue: implicit ordered attribute should be overridable
	Linux 4.9.42

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-08-11 13:55:02 -07:00
Sakari Ailus 1f32e67ada device property: Make dev_fwnode() public
commit e44bb0cbdc88686c21e2175a990b40bf6db5d005 upstream.

The function to obtain a fwnode related to a struct device is useful for
drivers that use the fwnode property API: it allows not being aware of the
underlying firmware implementation.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-08-11 08:49:29 -07:00
Greg Kroah-Hartman 9ae2c670d8 Merge 4.9.40 into android-4.9
Changes in 4.9.40
	disable new gcc-7.1.1 warnings for now
	ir-core: fix gcc-7 warning on bool arithmetic
	dm mpath: cleanup -Wbool-operation warning in choose_pgpath()
	s5p-jpeg: don't return a random width/height
	thermal: max77620: fix device-node reference imbalance
	thermal: cpu_cooling: Avoid accessing potentially freed structures
	ath9k: fix tx99 use after free
	ath9k: fix tx99 bus error
	ath9k: fix an invalid pointer dereference in ath9k_rng_stop()
	NFC: fix broken device allocation
	NFC: nfcmrvl_uart: add missing tty-device sanity check
	NFC: nfcmrvl: do not use device-managed resources
	NFC: nfcmrvl: use nfc-device for firmware download
	NFC: nfcmrvl: fix firmware-management initialisation
	nfc: Ensure presence of required attributes in the activate_target handler
	nfc: Fix the sockaddr length sanitization in llcp_sock_connect
	NFC: Add sockaddr length checks before accessing sa_family in bind handlers
	perf intel-pt: Move decoder error setting into one condition
	perf intel-pt: Improve sample timestamp
	perf intel-pt: Fix missing stack clear
	perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP
	perf intel-pt: Fix last_ip usage
	perf intel-pt: Ensure never to set 'last_ip' when packet 'count' is zero
	perf intel-pt: Use FUP always when scanning for an IP
	perf intel-pt: Clear FUP flag on error
	Bluetooth: use constant time memory comparison for secret values
	wlcore: fix 64K page support
	btrfs: Don't clear SGID when inheriting ACLs
	igb: Explicitly select page 0 at initialization
	ASoC: compress: Derive substream from stream based on direction
	PM / Domains: Fix unsafe iteration over modified list of device links
	PM / Domains: Fix unsafe iteration over modified list of domain providers
	PM / Domains: Fix unsafe iteration over modified list of domains
	scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails.
	scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
	iscsi-target: Add login_keys_workaround attribute for non RFC initiators
	xen/scsiback: Fix a TMR related use-after-free
	powerpc/pseries: Fix passing of pp0 in updatepp() and updateboltedpp()
	powerpc/64: Fix atomic64_inc_not_zero() to return an int
	powerpc: Fix emulation of mcrf in emulate_step()
	powerpc: Fix emulation of mfocrf in emulate_step()
	powerpc/asm: Mark cr0 as clobbered in mftb()
	powerpc/mm/radix: Properly clear process table entry
	af_key: Fix sadb_x_ipsecrequest parsing
	PCI: Work around poweroff & suspend-to-RAM issue on Macbook Pro 11
	PCI: rockchip: Use normal register bank for config accessors
	PCI/PM: Restore the status of PCI devices across hibernation
	ipvs: SNAT packet replies only for NATed connections
	xhci: fix 20000ms port resume timeout
	xhci: Fix NULL pointer dereference when cleaning up streams for removed host
	xhci: Bad Ethernet performance plugged in ASM1042A host
	mxl111sf: Fix driver to use heap allocate buffers for USB messages
	usb: storage: return on error to avoid a null pointer dereference
	USB: cdc-acm: add device-id for quirky printer
	usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
	usb: renesas_usbhs: gadget: disable all eps when the driver stops
	md: don't use flush_signals in userspace processes
	x86/xen: allow userspace access during hypercalls
	cx88: Fix regression in initial video standard setting
	libnvdimm, btt: fix btt_rw_page not returning errors
	libnvdimm: fix badblock range handling of ARS range
	ext2: Don't clear SGID when inheriting ACLs
	Raid5 should update rdev->sectors after reshape
	s390/syscalls: Fix out of bounds arguments access
	drm/amd/amdgpu: Return error if initiating read out of range on vram
	drm/radeon/ci: disable mclk switching for high refresh rates (v2)
	drm/radeon: Fix eDP for single-display iMac10,1 (v2)
	ipmi: use rcu lock around call to intf->handlers->sender()
	ipmi:ssif: Add missing unlock in error branch
	xfs: Don't clear SGID when inheriting ACLs
	f2fs: sanity check size of nat and sit cache
	f2fs: Don't clear SGID when inheriting ACLs
	drm/ttm: Fix use-after-free in ttm_bo_clean_mm
	ovl: drop CAP_SYS_RESOURCE from saved mounter's credentials
	vfio: Fix group release deadlock
	vfio: New external user group/file match
	nvme-rdma: remove race conditions from IB signalling
	ftrace: Fix uninitialized variable in match_records()
	MIPS: Fix mips_atomic_set() retry condition
	MIPS: Fix mips_atomic_set() with EVA
	MIPS: Negate error syscall return in trace
	ubifs: Don't leak kernel memory to the MTD
	ACPI / EC: Drop EC noirq hooks to fix a regression
	Revert "ACPI / EC: Enable event freeze mode..." to fix a regression
	x86/acpi: Prevent out of bound access caused by broken ACPI tables
	x86/ioapic: Pass the correct data to unmask_ioapic_irq()
	MIPS: Fix MIPS I ISA /proc/cpuinfo reporting
	MIPS: Save static registers before sysmips
	MIPS: Actually decode JALX in `__compute_return_epc_for_insn'
	MIPS: Fix unaligned PC interpretation in `compute_return_epc'
	MIPS: math-emu: Prevent wrong ISA mode instruction emulation
	MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn'
	MIPS: Rename `sigill_r6' to `sigill_r2r6' in `__compute_return_epc_for_insn'
	MIPS: Send SIGILL for linked branches in `__compute_return_epc_for_insn'
	MIPS: Send SIGILL for R6 branches in `__compute_return_epc_for_insn'
	MIPS: Fix a typo: s/preset/present/ in r2-to-r6 emulation error message
	Input: i8042 - fix crash at boot time
	IB/iser: Fix connection teardown race condition
	IB/core: Namespace is mandatory input for address resolution
	sunrpc: use constant time memory comparison for mac
	NFS: only invalidate dentrys that are clearly invalid.
	udf: Fix deadlock between writeback and udf_setsize()
	target: Fix COMPARE_AND_WRITE caw_sem leak during se_cmd quiesce
	iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done
	perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its target
	Revert "perf/core: Drop kernel samples even though :u is specified"
	staging: rtl8188eu: add TL-WN722N v2 support
	staging: comedi: ni_mio_common: fix AO timer off-by-one regression
	staging: sm750fb: avoid conflicting vesafb
	staging: lustre: ko2iblnd: check copy_from_iter/copy_to_iter return code
	ceph: fix race in concurrent readdir
	RDMA/core: Initialize port_num in qp_attr
	drm/mst: Fix error handling during MST sideband message reception
	drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req()
	drm/mst: Avoid processing partially received up/down message transactions
	mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms[] array
	hfsplus: Don't clear SGID when inheriting ACLs
	ovl: fix random return value on mount
	acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
	of: device: Export of_device_{get_modalias, uvent_modalias} to modules
	spmi: Include OF based modalias in device uevent
	reiserfs: Don't clear SGID when inheriting ACLs
	PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
	tracing: Fix kmemleak in instance_rmdir
	alarmtimer: don't rate limit one-shot timers
	Linux 4.9.40

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-07-27 15:24:43 -07:00
Sudeep Holla 7bd804a05e PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
commit 975e83cfb8dc16e7a2fdc58188c77c0c605876c2 upstream.

If the genpd->attach_dev or genpd->power_on fails, genpd_dev_pm_attach
may return -EPROBE_DEFER initially. However genpd_alloc_dev_data sets
the PM domain for the device unconditionally.

When subsequent attempts are made to call genpd_dev_pm_attach, it may
return -EEXISTS checking dev->pm_domain without re-attempting to call
attach_dev or power_on.

platform_drv_probe then attempts to call drv->probe as the return value
-EEXIST != -EPROBE_DEFER, which may end up in a situation where the
device is accessed without it's power domain switched on.

Fixes: f104e1e5ef (PM / Domains: Re-order initialization of generic_pm_domain_data)
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-27 15:08:08 -07:00
Krzysztof Kozlowski d2bb0af446 PM / Domains: Fix unsafe iteration over modified list of domains
commit a7e2d1bce4c1db471f1cbc0c4666a3112bbf0994 upstream.

of_genpd_remove_last() iterates over list of domains and removes
matching element thus it has to use safe version of list iteration.

Fixes: 17926551c9 (PM / Domains: Add support for removing nested PM domains by provider)
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-27 15:07:59 -07:00
Krzysztof Kozlowski 178aa241fc PM / Domains: Fix unsafe iteration over modified list of domain providers
commit b556b15dc04e9b9b98790f04c21acf5e24f994b2 upstream.

of_genpd_del_provider() iterates over list of domain provides and
removes matching element thus it has to use safe version of list
iteration.

Fixes: aa42240ab2 (PM / Domains: Add generic OF-based PM domain look-up)
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-27 15:07:59 -07:00
Krzysztof Kozlowski b87a32175a PM / Domains: Fix unsafe iteration over modified list of device links
commit c6e83cac3eda5f7dd32ee1453df2f7abb5c6cd46 upstream.

pm_genpd_remove_subdomain() iterates over domain's master_links list and
removes matching element thus it has to use safe version of list
iteration.

Fixes: f721889ff6 ("PM / Domains: Support for generic I/O PM domains (v8)")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-27 15:07:58 -07:00
Greg Kroah-Hartman 14accea70e Merge 4.9.39 into android-4.9
Changes in 4.9.39
	xen-netfront: Rework the fix for Rx stall during OOM and network stress
	net_sched: fix error recovery at qdisc creation
	net: sched: Fix one possible panic when no destroy callback
	net/phy: micrel: configure intterupts after autoneg workaround
	ipv6: avoid unregistering inet6_dev for loopback
	net: dp83640: Avoid NULL pointer dereference.
	tcp: reset sk_rx_dst in tcp_disconnect()
	net: prevent sign extension in dev_get_stats()
	bridge: mdb: fix leak on complete_info ptr on fail path
	rocker: move dereference before free
	bpf: prevent leaking pointer via xadd on unpriviledged
	net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish()
	net/mlx5: Cancel delayed recovery work when unloading the driver
	liquidio: fix bug in soft reset failure detection
	net/mlx5e: Fix TX carrier errors report in get stats ndo
	ipv6: dad: don't remove dynamic addresses if link is down
	vxlan: fix hlist corruption
	net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64
	net: ipv6: Compare lwstate in detecting duplicate nexthops
	vrf: fix bug_on triggered by rx when destroying a vrf
	rds: tcp: use sock_create_lite() to create the accept socket
	brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
	brcmfmac: Fix a memory leak in error handling path in 'brcmf_cfg80211_attach'
	brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain
	sfc: don't read beyond unicast address list
	cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE
	cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
	cfg80211: Check if PMKID attribute is of expected size
	cfg80211: Check if NAN service ID is of expected size
	irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity
	parisc: Report SIGSEGV instead of SIGBUS when running out of stack
	parisc: use compat_sys_keyctl()
	parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs
	parisc/mm: Ensure IRQs are off in switch_mm()
	tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth
	thp, mm: fix crash due race in MADV_FREE handling
	kernel/extable.c: mark core_kernel_text notrace
	mm/list_lru.c: fix list_lru_count_node() to be race free
	fs/dcache.c: fix spin lockup issue on nlru->lock
	checkpatch: silence perl 5.26.0 unescaped left brace warnings
	binfmt_elf: use ELF_ET_DYN_BASE only for PIE
	arm: move ELF_ET_DYN_BASE to 4MB
	arm64: move ELF_ET_DYN_BASE to 4GB / 4MB
	powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB
	s390: reduce ELF_ET_DYN_BASE
	exec: Limit arg stack to at most 75% of _STK_LIM
	ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers
	vt: fix unchecked __put_user() in tioclinux ioctls
	rcu: Add memory barriers for NOCB leader wakeup
	nvmem: core: fix leaks on registration errors
	mnt: In umount propagation reparent in a separate pass
	mnt: In propgate_umount handle visiting mounts in any order
	mnt: Make propagate_umount less slow for overlapping mount propagation trees
	selftests/capabilities: Fix the test_execve test
	mm: fix overflow check in expand_upwards()
	crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
	crypto: atmel - only treat EBUSY as transient if backlog
	crypto: sha1-ssse3 - Disable avx2
	crypto: caam - properly set IV after {en,de}crypt
	crypto: caam - fix signals handling
	Revert "sched/core: Optimize SCHED_SMT"
	sched/fair, cpumask: Export for_each_cpu_wrap()
	sched/topology: Fix building of overlapping sched-groups
	sched/topology: Optimize build_group_mask()
	sched/topology: Fix overlapping sched_group_mask
	PM / wakeirq: Convert to SRCU
	PM / QoS: return -EINVAL for bogus strings
	tracing: Use SOFTIRQ_OFFSET for softirq dectection for more accurate results
	kvm: vmx: Do not disable intercepts for BNDCFGS
	kvm: x86: Guest BNDCFGS requires guest MPX support
	kvm: vmx: Check value written to IA32_BNDCFGS
	kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS
	4.9.39

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-07-21 08:55:50 +02:00
Dan Carpenter cc7d3b7dd1 PM / QoS: return -EINVAL for bogus strings
commit 2ca30331c156ca9e97643ad05dd8930b8fe78b01 upstream.

In the current code, if the user accidentally writes a bogus command to
this sysfs file, then we set the latency tolerance to an uninitialized
variable.

Fixes: 2d984ad132 (PM / QoS: Introcuce latency tolerance device PM QoS type)
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-21 07:42:24 +02:00
Thomas Gleixner 5480437f79 PM / wakeirq: Convert to SRCU
commit ea0212f40c6bc0594c8eff79266759e3ecd4bacc upstream.

The wakeirq infrastructure uses RCU to protect the list of wakeirqs. That
breaks the irq bus locking infrastructure, which is allows sleeping
functions to be called so interrupt controllers behind slow busses,
e.g. i2c, can be handled.

The wakeirq functions hold rcu_read_lock and call into irq functions, which
in case of interrupts using the irq bus locking will trigger a
might_sleep() splat.

Convert the wakeirq infrastructure to Sleepable RCU and unbreak it.

Fixes: 4990d4fe32 (PM / Wakeirq: Add automated device wake IRQ handling)
Reported-by: Brian Norris <briannorris@chromium.org>
Suggested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Tested-by: Tony Lindgren <tony@atomide.com>
Tested-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-21 07:42:24 +02:00
Greg Kroah-Hartman 3f353c3ed4 Merge 4.9.38 into android-4.9
Changes in 4.9.38
	mqueue: fix a use-after-free in sys_mq_notify()
	Add "shutdown" to "struct class".
	tpm: Issue a TPM2_Shutdown for TPM2 devices.
	tools include: Add a __fallthrough statement
	tools string: Use __fallthrough in perf_atoll()
	tools strfilter: Use __fallthrough
	perf top: Use __fallthrough
	perf thread_map: Correctly size buffer used with dirent->dt_name
	perf intel-pt: Use __fallthrough
	perf tests: Avoid possible truncation with dirent->d_name + snprintf
	perf bench numa: Avoid possible truncation when using snprintf()
	perf header: Fix handling of PERF_EVENT_UPDATE__SCALE
	perf scripting perl: Fix compile error with some perl5 versions
	perf probe: Fix to probe on gcc generated symbols for offline kernel
	perf probe: Add error checks to offline probe post-processing
	md: fix incorrect use of lexx_to_cpu in does_sb_need_changing
	md: fix super_offset endianness in super_1_rdev_size_change
	locking/rwsem-spinlock: Fix EINTR branch in __down_write_common()
	staging: vt6556: vnt_start Fix missing call to vnt_key_init_table.
	staging: comedi: fix clean-up of comedi_class in comedi_init()
	crypto: caam - fix gfp allocation flags (part I)
	crypto: rsa-pkcs1pad - use constant time memory comparison for MACs
	ext4: check return value of kstrtoull correctly in reserved_clusters_store
	x86/mm/pat: Don't report PAT on CPUs that don't support it
	saa7134: fix warm Medion 7134 EEPROM read
	Linux 4.9.38

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-07-15 13:31:27 +02:00
Josh Zimmerman 5a1e1c62f3 Add "shutdown" to "struct class".
commit f77af15165847406b15d8f70c382c4cb15846b2a upstream.

The TPM class has some common shutdown code that must be executed for
all drivers. This adds some needed functionality for that.

Signed-off-by: Josh Zimmerman <joshz@google.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: 74d6b3ceaa ("tpm: fix suspend/resume paths for TPM 2.0")
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-15 12:16:11 +02:00
Greg Kroah-Hartman 598195a906 Merge 4.9.37 into android-4.9
Changes in 4.9.37
	fs: add a VALID_OPEN_FLAGS
	fs: completely ignore unknown open flags
	driver core: platform: fix race condition with driver_override
	ceph: choose readdir frag based on previous readdir reply
	tracing/kprobes: Allow to create probe with a module name starting with a digit
	media: entity: Fix stream count check
	drm/virtio: don't leak bo on drm_gem_object_init failure
	usb: dwc3: replace %p with %pK
	USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
	Add USB quirk for HVR-950q to avoid intermittent device resets
	usb: usbip: set buffer pointers to NULL after free
	usb: Fix typo in the definition of Endpoint[out]Request
	USB: core: fix device node leak
	mac80211_hwsim: Replace bogus hrtimer clockid
	sysctl: don't print negative flag for proc_douintvec
	sysctl: report EINVAL if value is larger than UINT_MAX for proc_douintvec
	pinctrl: qcom: ipq4019: add missing pingroups for pins > 70
	pinctrl: cherryview: Add a quirk to make Acer Chromebook keyboard work again
	pinctrl: sh-pfc: r8a7794: Swap ATA signals
	pinctrl: sh-pfc: r8a7791: Fix SCIF2 pinmux data
	pinctrl: sh-pfc: r8a7791: Add missing DVC_MUTE signal
	pinctrl: sh-pfc: r8a7795: Fix hscif2_clk_b and hscif4_ctrl
	pinctrl: meson: meson8b: fix the NAND DQS pins
	pinctrl: stm32: Fix bad function call
	pinctrl: sunxi: Fix SPDIF function name for A83T
	pinctrl: cherryview: Add terminate entry for dmi_system_id tables
	pinctrl: mxs: atomically switch mux and drive strength config
	pinctrl: sh-pfc: r8a7791: Add missing HSCIF1 pinmux data
	pinctrl: sh-pfc: Update info pointer after SoC-specific init
	USB: serial: option: add two Longcheer device ids
	USB: serial: qcserial: new Sierra Wireless EM7305 device ID
	xhci: Limit USB2 port wake support for AMD Promontory hosts
	gfs2: Fix glock rhashtable rcu bug
	tpm: fix a kernel memory leak in tpm-sysfs.c
	x86/tools: Fix gcc-7 warning in relocs.c
	x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings
	ath10k: override CE5 config for QCA9377
	KEYS: Fix an error code in request_master_key()
	crypto: drbg - Fixes panic in wait_for_completion call
	RDMA/uverbs: Check port number supplied by user verbs cmds
	rt286: add Thinkpad Helix 2 to force_combo_jack_table
	Linux 4.9.37

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-07-12 17:07:29 +02:00
Adrian Salido c4c592b2c1 driver core: platform: fix race condition with driver_override
commit 6265539776a0810b7ce6398c27866ddb9c6bd154 upstream.

The driver_override implementation is susceptible to race condition when
different threads are reading vs storing a different driver override.
Add locking to avoid race condition.

Fixes: 3d713e0e38 ("driver core: platform: add device binding path 'driver_override'")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Salido <salidoa@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-12 15:01:02 +02:00
Greg Kroah-Hartman 0d21cf1656 Merge 4.9.33 into android-4.9
Changes in 4.9.33
	PCI/PM: Add needs_resume flag to avoid suspend complete optimization
	drm/i915: Prevent the system suspend complete optimization
	partitions/msdos: FreeBSD UFS2 file systems are not recognized
	netfilter: nf_conntrack_sip: fix wrong memory initialisation
	ibmvnic: Fix endian errors in error reporting output
	ibmvnic: Fix endian error when requesting device capabilities
	net: xilinx_emaclite: fix freezes due to unordered I/O
	net: xilinx_emaclite: fix receive buffer overflow
	tcp: tcp_probe: use spin_lock_bh()
	ipv6: Handle IPv4-mapped src to in6addr_any dst.
	ipv6: Inhibit IPv4-mapped src address on the wire.
	tipc: Fix tipc_sk_reinit race conditions
	gfs2: Use rhashtable walk interface in glock_hash_walk
	NET: Fix /proc/net/arp for AX.25
	ibmvnic: Call napi_disable instead of napi_enable in failure path
	ibmvnic: Initialize completion variables before starting work
	NET: mkiss: Fix panic
	net: hns: Fix the device being used for dma mapping during TX
	sierra_net: Skip validating irrelevant fields for IDLE LSIs
	sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications
	i2c: piix4: Request the SMBUS semaphore inside the mutex
	i2c: piix4: Fix request_region size
	powerpc/powernv: Properly set "host-ipi" on IPIs
	kernel/ucount.c: mark user_header with kmemleak_ignore()
	net: thunderx: Fix PHY autoneg for SGMII QLM mode
	ipv6: addrconf: fix generation of new temporary addresses
	vfio/spapr_tce: Set window when adding additional groups to container
	ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches
	ARM: defconfigs: make NF_CT_PROTO_SCTP and NF_CT_PROTO_UDPLITE built-in
	PM / runtime: Avoid false-positive warnings from might_sleep_if()
	jump label: pass kbuild_cflags when checking for asm goto support
	shmem: fix sleeping from atomic context
	kasan: respect /proc/sys/kernel/traceoff_on_warning
	log2: make order_base_2() behave correctly on const input value zero
	ethtool: do not vzalloc(0) on registers dump
	net: phy: Fix lack of reference count on PHY driver
	net: phy: Fix PHY module checks and NULL deref in phy_attach_direct()
	net: fix ndo_features_check/ndo_fix_features comment ordering
	fscache: Fix dead object requeue
	fscache: Clear outstanding writes when disabling a cookie
	FS-Cache: Initialise stores_lock in netfs cookie
	ipv6: fix flow labels when the traffic class is non-0
	drm/nouveau: prevent userspace from deleting client object
	drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers
	net/mlx4_core: Avoid command timeouts during VF driver device shutdown
	gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page
	pinctrl: baytrail: Rectify debounce support (part 2)
	cec: fix wrong last_la determination
	drm: prevent double-(un)registration for connectors
	drm: Don't race connector registration
	pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES
	net: adaptec: starfire: add checks for dma mapping errors
	drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()
	net/mlx5: E-Switch, Err when retrieving steering name-space fails
	net/mlx5: Return EOPNOTSUPP when failing to get steering name-space
	parisc, parport_gsc: Fixes for printk continuation lines
	net: phy: micrel: add support for KSZ8795
	gtp: add genl family modules alias
	drm/nouveau: Intercept ACPI_VIDEO_NOTIFY_PROBE
	drm/nouveau: Rename acpi_work to hpd_work
	drm/nouveau: Handle fbcon suspend/resume in seperate worker
	drm/nouveau: Don't enabling polling twice on runtime resume
	drm/nouveau: Fix drm poll_helper handling
	drm/ast: Fixed system hanged if disable P2A
	ravb: unmap descriptors when freeing rings
	nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"
	nvmet-rdma: Fix missing dma sync to nvme data structures
	r8152: avoid start_xmit to call napi_schedule during autosuspend
	r8152: check rx after napi is enabled
	r8152: re-schedule napi for tx
	r8152: fix rtl8152_post_reset function
	r8152: avoid start_xmit to schedule napi when napi is disabled
	net-next: ethernet: mediatek: change the compatible string
	bnxt_en: Fix bnxt_reset() in the slow path task.
	bnxt_en: Enhance autoneg support.
	bnxt_en: Fix RTNL lock usage on bnxt_update_link().
	bnxt_en: Fix RTNL lock usage on bnxt_get_port_module_status().
	sctp: sctp gso should set feature with NETIF_F_SG when calling skb_segment
	sctp: sctp_addr_id2transport should verify the addr before looking up assoc
	usb: musb: Fix external abort on non-linefetch for musb_irq_work()
	mn10300: fix build error of missing fpu_save()
	romfs: use different way to generate fsid for BLOCK or MTD
	frv: add atomic64_add_unless()
	frv: add missing atomic64 operations
	proc: add a schedule point in proc_pid_readdir()
	userfaultfd: fix SIGBUS resulting from false rwsem wakeups
	kernel/watchdog.c: move hardlockup detector to separate file
	kernel/watchdog.c: move shared definitions to nmi.h
	kernel/watchdog: prevent false hardlockup on overloaded system
	vhost/vsock: handle vhost_vq_init_access() error
	ARC: smp-boot: Decouple Non masters waiting API from jump to entry point
	ARCv2: smp-boot: wake_flag polling by non-Masters needs to be uncached
	tipc: ignore requests when the connection state is not CONNECTED
	tipc: fix connection refcount error
	tipc: add subscription refcount to avoid invalid delete
	tipc: fix nametbl_lock soft lockup at node/link events
	netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL
	netfilter: nft_log: restrict the log prefix length to 127
	RDMA/qedr: Dispatch port active event from qedr_add
	RDMA/qedr: Fix and simplify memory leak in PD alloc
	RDMA/qedr: Don't reset QP when queues aren't flushed
	RDMA/qedr: Don't spam dmesg if QP is in error state
	RDMA/qedr: Return max inline data in QP query result
	xtensa: don't use linux IRQ #0
	s390/kvm: do not rely on the ILC on kvm host protection fauls
	drm/i915: Workaround VLV/CHV DSI scanline counter hardware fail
	drm/i915: Always recompute watermarks when distrust_bios_wm is set, v2.
	sparc64: make string buffers large enough
	Linux 4.9.33

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-06-27 10:43:04 +02:00
Rafael J. Wysocki 36d9659cde PM / runtime: Avoid false-positive warnings from might_sleep_if()
[ Upstream commit a9306a63631493afc75893a4ac405d4e1cbae6aa ]

The might_sleep_if() assertions in __pm_runtime_idle(),
__pm_runtime_suspend() and __pm_runtime_resume() may generate
false-positive warnings in some situations.  For example, that
happens if a nested pm_runtime_get_sync()/pm_runtime_put() pair
is executed with disabled interrupts within an outer
pm_runtime_get_sync()/pm_runtime_put() section for the same device.
[Generally, pm_runtime_get_sync() may sleep, so it should not be
called with disabled interrupts, but in this particular case the
previous pm_runtime_get_sync() guarantees that the device will not
be suspended, so the inner pm_runtime_get_sync() will return
immediately after incrementing the device's usage counter.]

That started to happen in the i915 driver in 4.10-rc, leading to
the following splat:

 BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1032
 in_atomic(): 1, irqs_disabled(): 0, pid: 1500, name: Xorg
 1 lock held by Xorg/1500:
  #0:  (&dev->struct_mutex){+.+.+.}, at:
  [<ffffffffa0680c13>] i915_mutex_lock_interruptible+0x43/0x140 [i915]
 CPU: 0 PID: 1500 Comm: Xorg Not tainted
 Call Trace:
  dump_stack+0x85/0xc2
  ___might_sleep+0x196/0x260
  __might_sleep+0x53/0xb0
  __pm_runtime_resume+0x7a/0x90
  intel_runtime_pm_get+0x25/0x90 [i915]
  aliasing_gtt_bind_vma+0xaa/0xf0 [i915]
  i915_vma_bind+0xaf/0x1e0 [i915]
  i915_gem_execbuffer_relocate_entry+0x513/0x6f0 [i915]
  i915_gem_execbuffer_relocate_vma.isra.34+0x188/0x250 [i915]
  ? trace_hardirqs_on+0xd/0x10
  ? i915_gem_execbuffer_reserve_vma.isra.31+0x152/0x1f0 [i915]
  ? i915_gem_execbuffer_reserve.isra.32+0x372/0x3a0 [i915]
  i915_gem_do_execbuffer.isra.38+0xa70/0x1a40 [i915]
  ? __might_fault+0x4e/0xb0
  i915_gem_execbuffer2+0xc5/0x260 [i915]
  ? __might_fault+0x4e/0xb0
  drm_ioctl+0x206/0x450 [drm]
  ? i915_gem_execbuffer+0x340/0x340 [i915]
  ? __fget+0x5/0x200
  do_vfs_ioctl+0x91/0x6f0
  ? __fget+0x111/0x200
  ? __fget+0x5/0x200
  SyS_ioctl+0x79/0x90
  entry_SYSCALL_64_fastpath+0x23/0xc6

even though the code triggering it is correct.

Unfortunately, the might_sleep_if() assertions in question are
too coarse-grained to cover such cases correctly, so make them
a bit less sensitive in order to avoid the false-positives.

Reported-and-tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-17 06:41:51 +02:00
yangdongdong 481aeb2911 ANDROID: power: align wakeup_sources format
This aligns every column of elements in wakeup_sources to
conveniently check any specific column for suspicious power
consumption wakeup source or for other easily human readable purpose.

Change-Id: Iac8b0538170fcc0cca9f6857c15d9a4c62c8865e
Signed-off-by: yangdongdong <yangdongdong@xiaomi.com>
2017-03-16 10:42:42 -07:00
Dmitry Shmidt dcb6110067 Merge tag 'v4.9.9' into android-4.9-aosp
This is the 4.9.9 stable release
2017-02-09 10:49:40 -08:00
Toshi Kani 6cb0497aec base/memory, hotplug: fix a kernel oops in show_valid_zones()
commit a96dfddbcc04336bbed50dc2b24823e45e09e80c upstream.

Reading a sysfs "memoryN/valid_zones" file leads to the following oops
when the first page of a range is not backed by struct page.
show_valid_zones() assumes that 'start_pfn' is always valid for
page_zone().

 BUG: unable to handle kernel paging request at ffffea017a000000
 IP: show_valid_zones+0x6f/0x160

This issue may happen on x86-64 systems with 64GiB or more memory since
their memory block size is bumped up to 2GiB.  [1] An example of such
systems is desribed below.  0x3240000000 is only aligned by 1GiB and
this memory block starts from 0x3200000000, which is not backed by
struct page.

 BIOS-e820: [mem 0x0000003240000000-0x000000603fffffff] usable

Since test_pages_in_a_zone() already checks holes, fix this issue by
extending this function to return 'valid_start' and 'valid_end' for a
given range.  show_valid_zones() then proceeds with the valid range.

[1] 'Commit bdee237c03 ("x86: mm: Use 2GB memory block size on
    large-memory x86-64 systems")'

Link: http://lkml.kernel.org/r/20170127222149.30893-3-toshi.kani@hpe.com
Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Zhang Zhen <zhenzhang.zhang@huawei.com>
Cc: Reza Arbab <arbab@linux.vnet.ibm.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-02-09 08:08:28 +01:00
Dmitry Shmidt e37704d2d0 Merge tag 'v4.9.8' into android-4.9
This is the 4.9.8 stable release
2017-02-06 13:13:30 -08:00
Yasuaki Ishimatsu 143a9ad4e6 memory_hotplug: make zone_can_shift() return a boolean value
commit 8a1f780e7f28c7c1d640118242cf68d528c456cd upstream.

online_{kernel|movable} is used to change the memory zone to
ZONE_{NORMAL|MOVABLE} and online the memory.

To check that memory zone can be changed, zone_can_shift() is used.
Currently the function returns minus integer value, plus integer
value and 0. When the function returns minus or plus integer value,
it means that the memory zone can be changed to ZONE_{NORNAL|MOVABLE}.

But when the function returns 0, there are two meanings.

One of the meanings is that the memory zone does not need to be changed.
For example, when memory is in ZONE_NORMAL and onlined by online_kernel
the memory zone does not need to be changed.

Another meaning is that the memory zone cannot be changed. When memory
is in ZONE_NORMAL and onlined by online_movable, the memory zone may
not be changed to ZONE_MOVALBE due to memory online limitation(see
Documentation/memory-hotplug.txt). In this case, memory must not be
onlined.

The patch changes the return type of zone_can_shift() so that memory
online operation fails when memory zone cannot be changed as follows:

Before applying patch:
   # grep -A 35 "Node 2" /proc/zoneinfo
   Node 2, zone   Normal
   <snip>
      node_scanned  0
           spanned  8388608
           present  7864320
           managed  7864320
   # echo online_movable > memory4097/state
   # grep -A 35 "Node 2" /proc/zoneinfo
   Node 2, zone   Normal
   <snip>
      node_scanned  0
           spanned  8388608
           present  8388608
           managed  8388608

   online_movable operation succeeded. But memory is onlined as
   ZONE_NORMAL, not ZONE_MOVABLE.

After applying patch:
   # grep -A 35 "Node 2" /proc/zoneinfo
   Node 2, zone   Normal
   <snip>
      node_scanned  0
           spanned  8388608
           present  7864320
           managed  7864320
   # echo online_movable > memory4097/state
   bash: echo: write error: Invalid argument
   # grep -A 35 "Node 2" /proc/zoneinfo
   Node 2, zone   Normal
   <snip>
      node_scanned  0
           spanned  8388608
           present  7864320
           managed  7864320

   online_movable operation failed because of failure of changing
   the memory zone from ZONE_NORMAL to ZONE_MOVABLE

Fixes: df429ac039 ("memory-hotplug: more general validation of zone during online")
Link: http://lkml.kernel.org/r/2f9c3837-33d7-b6e5-59c0-6ca4372b2d84@gmail.com
Signed-off-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Reviewed-by: Reza Arbab <arbab@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-02-01 08:33:13 +01:00
Dmitry Shmidt cd08287396 Merge tag 'v4.9.6' into android-4.9
This is the 4.9.6 stable release

Change-Id: I318df4b9d706d50c13fe3969d734117c25fc94bc
2017-01-31 13:55:27 -08:00
Ruchi Kandoi 78ab6c4498 ANDROID: wakeup: Add the guard condition for len in pm_get_active_wakeup_sources
Check if the len is not greater than maximum to prevent buffer overflow.

Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Change-Id: I575b0a72bb5448b68353408d71fa8b83420c9088
2017-01-27 13:52:29 -08:00
Ruchi Kandoi 68b6254bb4 ANDROID: wakeup: Add last wake up source logging for suspend abort reason.
There is a possibility that a wakeup source event is received after
the device prepares to suspend which might cause the suspend to abort.

This patch adds the functionality of reporting the last active wakeup
source which is currently not active but caused the suspend to abort reason
via the /sys/kernel/power/last_wakeup_reason file.

Change-Id: I1760d462f497b33e425f5565cb6cff5973932ec3
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
2017-01-27 13:51:55 -08:00
Ruchi Kandoi 6118cb49fd ANDROID: power: Adds functionality to log the last suspend abort reason.
Extends the last_resume_reason to log suspend abort reason. The abort
reasons will have "Abort:" appended at the start to distinguish itself
from the resume reason.

Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Change-Id: I3207f1844e3d87c706dfc298fb10e1c648814c5f
2017-01-27 13:51:52 -08:00
Tony Lindgren 65f796837e PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend
commit bed570307ed78f21b77cb04a1df781dee4a8f05a upstream.

I noticed some wakeirq flakeyness with consumer drivers not using
autosuspend. For drivers not using autosuspend, the wakeirq may never
get unmasked in rpm_suspend() because of irq desc->depth.

We are configuring dedicated wakeirqs to start with IRQ_NOAUTOEN as we
naturally don't want them running until rpm_suspend() is called.

However, when a consumer driver initially calls pm_runtime_get(), we
now wrongly start with disable_irq_nosync() call on the dedicated
wakeirq that is disabled to start with.

This causes desc->depth to toggle between 1 and 2 instead of the usual
0 and 1. This can prevent enable_irq() from unmasking the wakeirq as
that only happens at desc->depth 1.

This does not necessarily show up with drivers using autosuspend as
there is time for disable_irq_nosync() before rpm_suspend() gets called
after the autosuspend timeout.

Let's fix the issue by adding wirq->status that lazily gets set on
the first rpm_suspend(). We also need PM runtime core private functions
for dev_pm_enable_wake_irq_check() and dev_pm_disable_wake_irq_check()
so we can enable the dedicated wakeirq on the first rpm_suspend().

While at it, let's also fix the comments for dev_pm_enable_wake_irq()
and dev_pm_disable_wake_irq(). Those can still be used by the consumer
drivers as needed because the IRQ core manages the interrupt usecount
for us.

Fixes: 4990d4fe32 (PM / Wakeirq: Add automated device wake IRQ handling)
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-12 11:39:31 +01:00
Yves-Alexis Perez b3854cefe3 firmware: fix usermode helper fallback loading
commit 2e700f8d85975f516ccaad821278c1fe66b2cc98 upstream.

When you use the firmware usermode helper fallback with a timeout value set to a
value greater than INT_MAX (2147483647) a cast overflow issue causes the
timeout value to go negative and breaks all usermode helper loading. This
regression was introduced through commit 68ff2a00db ("firmware_loader:
handle timeout via wait_for_completion_interruptible_timeout()") on kernel
v4.0.

The firmware_class drivers relies on the firmware usermode helper
fallback as a mechanism to look for firmware if the direct filesystem
search failed only if:

  a) You've enabled CONFIG_FW_LOADER_USER_HELPER_FALLBACK (not many distros):

  Then all of these callers will rely on the fallback mechanism in case
  the firmware is not found through an initial direct filesystem lookup:

  o request_firmware()
  o request_firmware_into_buf()
  o request_firmware_nowait()

  b) If you've only enabled CONFIG_FW_LOADER_USER_HELPER (most distros):

  Then only callers using request_firmware_nowait() with the second
  argument set to false, this explicitly is requesting the UMH firmware
  fallback to be relied on in case the first filesystem lookup fails.

  Using Coccinelle SmPL grammar we have identified only two drivers
  explicitly requesting the UMH firmware fallback mechanism:

  - drivers/firmware/dell_rbu.c
  - drivers/leds/leds-lp55xx-common.c

Since most distributions only enable CONFIG_FW_LOADER_USER_HELPER the
biggest impact of this regression are users of the dell_rbu and
leds-lp55xx-common device driver which required the UMH to find their
respective needed firmwares.

The default timeout for the UMH is set to 60 seconds always, as of
commit 68ff2a00db ("firmware_loader: handle timeout via
wait_for_completion_interruptible_timeout()") the timeout was bumped
to MAX_JIFFY_OFFSET ((LONG_MAX >> 1)-1). Additionally the MAX_JIFFY_OFFSET
value was also used if the timeout was configured by a user to 0.

The following works:

echo 2147483647 > /sys/class/firmware/timeout

But both of the following set the timeout to MAX_JIFFY_OFFSET even if
we display 0 back to userspace:

echo 2147483648 > /sys/class/firmware/timeout
cat /sys/class/firmware/timeout
0

echo 0> /sys/class/firmware/timeout
cat /sys/class/firmware/timeout
0

A max value of INT_MAX (2147483647) seconds is therefore implicit due to the
another cast with simple_strtol().

This fixes the secondary cast (the first one is simple_strtol() but its an
issue only by forcing an implicit limit) by re-using the timeout variable and
only setting retval in appropriate cases.

Lastly worth noting systemd had ripped out the UMH firmware fallback
mechanism from udev since udev 2014 via commit be2ea723b1d023b3d
("udev: remove userspace firmware loading support"), so as of systemd v217.

Signed-off-by: Yves-Alexis Perez <corsac@corsac.net>
Fixes: 68ff2a00db "firmware_loader: handle timeout via wait_for_completion_interruptible_timeout()"
Cc: Luis R. Rodriguez <mcgrof@kernel.org>
Cc: Ming Lei <ming.lei@canonical.com>
Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Luis R. Rodriguez <mcgrof@kernel.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
[mcgrof@kernel.org: gave commit log a whole lot of love]
Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-09 08:32:22 +01:00
Viresh Kumar 7ac62bcde2 PM / OPP: Don't use OPP structure outside of rcu protected section
commit dc39d06fcd7a4a82d72eae7b71e94e888b96d29e upstream.

The OPP structure must not be used out of the rcu protected section.
Cache the values to be used in separate variables instead.

Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
Tested-by: Dave Gerlach <d-gerlach@ti.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-06 10:40:15 +01:00
Stephen Boyd c7a8a0ac8f PM / OPP: Pass opp_table to dev_pm_opp_put_regulator()
commit 91291d9ad92faa65a56a9a19d658d8049b78d3d4 upstream.

Joonyoung Shim reported an interesting problem on his ARM octa-core
Odoroid-XU3 platform. During system suspend, dev_pm_opp_put_regulator()
was failing for a struct device for which dev_pm_opp_set_regulator() is
called earlier.

This happened because an earlier call to
dev_pm_opp_of_cpumask_remove_table() function (from cpufreq-dt.c file)
removed all the entries from opp_table->dev_list apart from the last CPU
device in the cpumask of CPUs sharing the OPP.

But both dev_pm_opp_set_regulator() and dev_pm_opp_put_regulator()
routines get CPU device for the first CPU in the cpumask. And so the OPP
core failed to find the OPP table for the struct device.

This patch attempts to fix this problem by returning a pointer to the
opp_table from dev_pm_opp_set_regulator() and using that as the
parameter to dev_pm_opp_put_regulator(). This ensures that the
dev_pm_opp_put_regulator() doesn't fail to find the opp table.

Note that similar design problem also exists with other
dev_pm_opp_put_*() APIs, but those aren't used currently by anyone and
so we don't need to update them for now.

Reported-by: Joonyoung Shim <jy0922.shim@samsung.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
[ Viresh: Wrote commit log and tested on exynos 5250 ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-06 10:40:15 +01:00
Linus Torvalds cf2b191cba Merge tag 'driver-core-4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Pull driver core fixes from Greg KH:
 "Here are two driver core fixes for 4.9-rc5.

  The first resolves an issue with some drivers not liking to be unbound
  and bound again (if CONFIG_DEBUG_TEST_DRIVER_REMOVE is enabled), which
  solves some reported problems with graphics and storage drivers. The
  other resolves a smatch error with the 4.9-rc1 driver core changes
  around this feature.

  Both have been in linux-next with no reported issues"

* tag 'driver-core-4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  driver core: fix smatch warning on dev->bus check
  driver core: skip removal test for non-removable drivers
2016-11-13 10:22:07 -08:00
Brian Norris 6f75c3fd56 PM / sleep: don't suspend parent when async child suspend_{noirq, late} fails
Consider two devices, A and B, where B is a child of A, and B utilizes
asynchronous suspend (it does not matter whether A is sync or async). If
B fails to suspend_noirq() or suspend_late(), or is interrupted by a
wakeup (pm_wakeup_pending()), then it aborts and sets the async_error
variable. However, device A does not (immediately) check the async_error
variable; it may continue to run its own suspend_noirq()/suspend_late()
callback. This is bad.

We can resolve this problem by doing our error and wakeup checking
(particularly, for the async_error flag) after waiting for children to
suspend, instead of before. This also helps align the logic for the noirq and
late suspend cases with the logic in __device_suspend().

It's easy to observe this erroneous behavior by, for example, forcing a
device to sleep a bit in its suspend_noirq() (to ensure the parent is
waiting for the child to complete), then return an error, and watch the
parent suspend_noirq() still get called. (Or similarly, fake a wakeup
event at the right (or is it wrong?) time.)

Fixes: de377b3972 (PM / sleep: Asynchronous threads for suspend_late)
Fixes: 28b6fd6e37 (PM / sleep: Asynchronous threads for suspend_noirq)
Reported-by: Jeffy Chen <jeffy.chen@rock-chips.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-11-11 01:29:09 +01:00
Rob Herring bdacd1b426 driver core: fix smatch warning on dev->bus check
Commit d42a09802174 (driver core: skip removal test for non-removable
drivers) introduced a smatch warning:

drivers/base/dd.c:386 really_probe()
         warn: variable dereferenced before check 'dev->bus' (see line 373)

Fix the warning by removing the dev->bus NULL check. dev->bus will never
be NULL, so the check was unnecessary.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-10-31 09:15:22 -06:00
Rob Herring c5f0627488 driver core: skip removal test for non-removable drivers
Some drivers do not support removal/unbinding. These drivers should have
drv->suppress_bind_attrs set to true, so use that to skip the removal
test.

This doesn't fix anything reported so far, but should prevent some other
cases. Some drivers will need fixes to set suppress_bind_attrs to avoid
this test.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=177021
Fixes: bea5b158ff ("driver core: add test of driver remove calls during probe")
Reported-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-10-31 09:15:22 -06:00
Laura Abbott 248ff02165 driver core: Make Kconfig text for DEBUG_TEST_DRIVER_REMOVE stronger
The current state of driver removal is not great.
CONFIG_DEBUG_TEST_DRIVER_REMOVE finds lots of errors. The help text
currently undersells exactly how many errors this option will find. Add
a bit more description to indicate this option shouldn't be turned on
unless you actually want to debug driver removal. The text can be
changed later when more drivers are fixed up.

Signed-off-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-10-27 17:47:12 +02:00
Reza Arbab d66ba15bde memory-hotplug: fix store_mem_state() return value
If store_mem_state() is called to online memory which is already online,
it will return 1, the value it got from device_online().

This is wrong because store_mem_state() is a device_attribute .store
function.  Thus a non-negative return value represents input bytes read.

Set the return value to -EINVAL in this case.

Link: http://lkml.kernel.org/r/1472743777-24266-1-git-send-email-arbab@linux.vnet.ibm.com
Signed-off-by: Reza Arbab <arbab@linux.vnet.ibm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Yaowei Bai <baiyaowei@cmss.chinamobile.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Xishi Qiu <qiuxishi@huawei.com>
Cc: David Vrabel <david.vrabel@citrix.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Andrew Banman <abanman@sgi.com>
Cc: Seth Jennings <sjenning@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-10-07 18:46:28 -07:00
Linus Torvalds d268dbe76a Merge tag 'pinctrl-v4.9-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control updates from Linus Walleij:
 "This is the bulk of pin control changes for the v4.9 cycle.

  General improvements:

   - nicer debugfs output with one pin/config pair per line.

   - continued efforts to strictify module vs bool.

   - constification and similar from Coccinelle engineers.

   - return error from pinctrl_bind_pins()

   - pulling in the ability to selectively disable mapping of unusable
     IRQs from the GPIO subsystem.

  New drivers:

   - new driver for the Aspeed pin controller family: AST2400 (G4) and
     AST2500 (G5) are supported. These are used by OpenBMC on the IBM
     Witherspoon platform.

   - new subdriver for the Allwinner sunxi GR8.

  Driver improvements:

   - drop default IRQ trigger types assigned during IRQ mapping on AT91
     and Nomadik. This error was identified by improvements in the IRQ
     core by Marc Zyngier.

   - active high/low types on the GPIO IRQs for the ST pin controller.

   - IRQ support on GPIOs on the STM32 pin controller.

   - Renesas Super-H/ARM sh-pfc: continued massive developments.

   - misc MXC improvements.

   - SPDIF on the Allwiner A31 SoC

   - IR remote and SPI NOR flash, NAND flash, I2C pins on the AMLogic
     SoC.

   - PWM pins on the Meson.

   - do not map unusable IRQs (taken by BIOS) on the Intel Cherryview.

   - add GPIO IRQ wakeup support to the Intel driver so we can wake up
     from button pushes.

  Deprecation:

   - delete the obsolete STiH415/6 SoC support"

* tag 'pinctrl-v4.9-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (75 commits)
  pinctrl: qcom: fix masking of pinmux functions
  pinctrl: intel: Configure GPIO chip IRQ as wakeup interrupts
  pinctrl: cherryview: Convert to use devm_gpiochip_add_data()
  pinctrl: cherryview: Do not add all southwest and north GPIOs to IRQ domain
  gpiolib: Make it possible to exclude GPIOs from IRQ domain
  pinctrl: nomadik: don't default-flag IRQs as falling
  pinctrl: st: Remove obsolete platforms from pinctrl-st dt doc
  pinctrl: st: Remove STiH415/6 SoC pinctrl driver support.
  pinctrl: amlogic: gxbb: add i2c pins
  pinctrl: amlogic: gxbb: add nand pins
  pinctrl: stm32: add IRQ_DOMAIN_HIERARCHY dependency
  pinctrl: amlogic: gxbb: add spi nor pins
  pinctrl: sh-pfc: r8a7794: Implement voltage switching for SDHI
  pinctrl: sh-pfc: r8a7791: Implement voltage switching for SDHI
  pinctrl: sh-pfc: Add PORT_GP_24 helper macro
  pinctrl: Fix "st,syscfg" definition for STM32 pinctrl
  driver: base: pinctrl: return error from pinctrl_bind_pins()
  pinctrl: meson-gxbb: add the missing SDIO interrupt pin
  pinctrl: aspeed: fix regmap error handling
  pinctrl: mediatek: constify gpio_chip structures
  ...
2016-10-05 11:37:14 -07:00
Linus Torvalds 808c2b0583 Merge tag 'regmap-v4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap updates from Mark Brown:
 "Another quiet release, a few small extensions to the set of register
  maps we support and an improvement in the debugfs code:

   - allow viewing of cached contents for write only registers via
     debugfs.

   - support a wider range of read/write flag masks in register formats.

   - support more little endian formats"

* tag 'regmap-v4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: Add missing little endian functions
  regmap: Allow longer flag masks for read and write
  regmap: debugfs: Add support for dumping write only device registers
  regmap: Add a function to check if a regmap register is cached
2016-10-04 11:12:35 -07:00
Mark Brown f785fb2ec0 Merge remote-tracking branches 'regmap/topic/core' and 'regmap/topic/debugfs' into regmap-next 2016-10-04 05:17:12 +02:00
Linus Torvalds 9929780e86 Merge tag 'driver-core-4.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Pull driver core updates from Greg KH:
 "Here are the "big" driver core patches for 4.9-rc1. Also in here are a
  number of debugfs fixes that cropped up due to the changes that
  happened in 4.8 for that filesystem. Overall, nothing major, just a
  few fixes and cleanups.

  All of these have been in linux-next with no reported issues"

* tag 'driver-core-4.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (23 commits)
  drivers: dma-coherent: Move spinlock in dma_alloc_from_coherent()
  drivers: dma-coherent: Fix DMA coherent size for less than page
  MAINTAINERS: extend firmware_class maintainer list
  debugfs: propagate release() call result
  driver-core: platform: Catch errors from calls to irq_get_irq_data
  sysfs print name of undiscoverable attribute group
  carl9170: fix debugfs crashes
  b43legacy: fix debugfs crash
  b43: fix debugfs crash
  debugfs: introduce a public file_operations accessor
  device core: Remove deprecated create_singlethread_workqueue
  drivers/base dmam_declare_coherent_memory leaks
  platform: don't return 0 from platform_get_irq[_byname]() on error
  cpu: clean up register_cpu func
  dma-mapping: use vma_pages().
  drivers: dma-coherent: use vma_pages().
  attribute_container: Fix typo
  base: soc: make it explicitly non-modular
  drivers: base: dma-mapping: page align the size when unmap_kernel_range
  platform driver: fix use-after-free in platform_device_del()
  ...
2016-10-03 20:03:24 -07:00
Linus Torvalds 999dcbe241 Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq updates from Thomas Gleixner:
 "The irq departement proudly presents:

   - A rework of the core infrastructure to optimally spread interrupt
     for multiqueue devices. The first version was a bit naive and
     failed to take thread siblings and other details into account.
     Developed in cooperation with Christoph and Keith.

   - Proper delegation of softirqs to ksoftirqd, so if ksoftirqd is
     active then no further softirq processsing on interrupt return
     happens. Otherwise we try to delegate and still run another batch
     of network packets in the irq return path, which then tries to
     delegate to ksoftirqd .....

   - A proper machine parseable sysfs based alternative for
     /proc/interrupts.

   - ACPI support for the GICV3-ITS and ARM interrupt remapping

   - Two new irq chips from the ARM SoC zoo: STM32-EXTI and MVEBU-PIC

   - A new irq chip for the JCore (SuperH)

   - The usual pile of small fixlets in core and irqchip drivers"

* 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (42 commits)
  softirq: Let ksoftirqd do its job
  genirq: Make function __irq_do_set_handler() static
  ARM/dts: Add EXTI controller node to stm32f429
  ARM/STM32: Select external interrupts controller
  drivers/irqchip: Add STM32 external interrupts support
  Documentation/dt-bindings: Document STM32 EXTI controller bindings
  irqchip/mips-gic: Use for_each_set_bit to iterate over local IRQs
  pci/msi: Retrieve affinity for a vector
  genirq/affinity: Remove old irq spread infrastructure
  genirq/msi: Switch to new irq spreading infrastructure
  genirq/affinity: Provide smarter irq spreading infrastructure
  genirq/msi: Add cpumask allocation to alloc_msi_entry
  genirq: Expose interrupt information through sysfs
  irqchip/gicv3-its: Use MADT ITS subtable to do PCI/MSI domain initialization
  irqchip/gicv3-its: Factor out PCI-MSI part that might be reused for ACPI
  irqchip/gicv3-its: Probe ITS in the ACPI way
  irqchip/gicv3-its: Refactor ITS DT init code to prepare for ACPI
  irqchip/gicv3-its: Cleanup for ITS domain initialization
  PCI/MSI: Setup MSI domain on a per-device basis using IORT ACPI table
  ACPI: Add new IORT functions to support MSI domain handling
  ...
2016-10-03 19:10:15 -07:00
Linus Torvalds 72d39926f0 Merge tag 'acpi-4.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI updates from Rafael Wysocki:
 "First off, the ACPICA code in the kernel is updated to upstream
  revision 20160831 that brings in a few bug fixes and cleanups. In
  particular, it is possible to mask GPEs now (and the sysfs interface
  for GPE control is fixed on top of that), problems related to the
  table loading mechanism are fixed and all code related to FADT version
  2 (which has never been part of the ACPI specification) is dropped.

  On the new features front, there is a new watchdog driver based on the
  ACPI WDAT (ACPI Watchdog Action Table), needed on some platforms to
  replace the iTCO watchdog that doesn't work there, and some UART
  devices get new definitions of built-in properties (to be accessed via
  the generic device properties API).

  Also, included is a fix for an ACPI-related PCI resorces allocation
  issue and a few problems in the EC driver and in the button and
  battery drivers are fixed.

  In addition to that, the ACPI CPPC library is updated to make batching
  of requests sent over the PCC channel possible (which reduces the PCC
  usage overhead substantially in some cases) and to support functional
  fixed hardware (FFH) type of CPPC registers access (which will allow
  CPPC to be used on x86 too in the future).

  As usual, there are some assorted fixes and cleanups too.

  Specifics:

   - Update of the ACPICA code in the kernel to upstream revision
     20160831 with the following major changes:

      * New mechanism for GPE masking.
      * Fixes for issues related to the LoadTable operator and table
        loading.
      * Fixes for issues related to so-called module-level code (MLC),
        that is AML that doesn't belong to any methods.
      * Change of the return value of the _OSI method to reflect the
        Windows behavior.
      * GAS (Generic Address Structure) support fix related to 32-bit
        FADT addresses.
      * Elimination of unnecessary FADT version 2 support.
      * ACPI tools fixes and cleanups.

     From Bob Moore, Lv Zheng, and Jung-uk Kim.

   - ACPI sysfs interface updates to fix GPE handling (on top of the new
     GPE masking mechanism in ACPICA) and issues related to table
     loading (Lv Zheng).

   - New watchdog driver based on the ACPI WDAT (ACPI Watchdog Action
     Table), needed on some platforms to replace the iTCO watchdog that
     doesn't work there and related updates of the intel_pmc_ipc,
     i2c/i801 and MFD/lcp_ich drivers (Mika Westerberg).

   - Driver core fix to prevent it from leaking secondary fwnode objects
     during device removal (Lukas Wunner).

   - New definitions of built-in properties for UART in ACPI-based x86
     SoC drivers and a 8250_dw driver quirk for the APM X-Gene SoC
     (Heikki Krogerus).

   - New device ID for the Vulcan SPI controller and constification of
     local strucures in the AMD SoC (APD) ACPI driver (Kamlakant Patel,
     Julia Lawall).

   - Fix for a bug causing the allocation of PCI resorces to fail if
     ACPI-enumerated child platform devices are registered below the PCI
     devices in question (Mika Westerberg).

   - Change of the default polarity for PCI legacy IRQs to high on
     systems booting wth ACPI on platforms with a GIC interrupt
     controller model fixing the discrepancy between the specification
     and HW behavior (Lorenzo Pieralisi).

   - Fixes for the handling of system suspend/resume in the ACPI EC
     driver and update of that driver to make it cope with the cases
     when the EC device defined in the ECDT has to be used throughout
     the entire system life cycle (Lv Zheng).

   - Update of the ACPI CPPC library to allow it to batch requests sent
     over the PCC channel (to reduce overhead), to support the fixed
     functional hardware (FFH) CPPC registers access type, to notify the
     mailbox framework about TX completions when the interrupt flag is
     set for the PCC mailbox, and to support HW-Reduced Communication
     Subspace type 2 (Ashwin Chaugule, Prashanth Prakash, Srinivas
     Pandruvada, Hoan Tran).

   - ACPI button driver fix and documentation update related to the
     handling of laptop lids (Lv Zheng).

   - ACPI battery driver initialization fix (Carlos Garnacho).

   - ACPI GPIO enumeration documentation update (Mika Westerberg).

   - Assorted updates of the core ACPI bus type code (Lukas Wunner, Lv
     Zheng).

   - Assorted cleanups of the ACPI table parsing code and the
     x86-specific ACPI code (Al Stone).

   - Fixes for assorted ACPI-related issues found in linux-next (Wei
     Yongjun)"

* tag 'acpi-4.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (98 commits)
  ACPI / documentation: Use recommended name in GPIO property names
  watchdog: wdat_wdt: Fix warning for using 0 as NULL
  watchdog: wdat_wdt: fix return value check in wdat_wdt_probe()
  platform/x86: intel_pmc_ipc: Do not create iTCO watchdog when WDAT table exists
  i2c: i801: Do not create iTCO watchdog when WDAT table exists
  mfd: lpc_ich: Do not create iTCO watchdog when WDAT table exists
  ACPI / bus: Adjust ACPI subsystem initialization for new table loading mode
  ACPICA: Parser: Fix a regression in LoadTable support
  ACPICA: Tables: Fix "UNLOAD" code path lock issues
  ACPI / watchdog: Add support for WDAT hardware watchdog
  ACPI / platform: Pay attention to parent device's resources
  PCI: Add pci_find_resource()
  ACPI / CPPC: Support PCC with interrupt flag
  ACPI / sysfs: Update sysfs signature handling code
  ACPI / sysfs: Fix an issue for LoadTable opcode
  ACPICA: Tables: Fix a regression in acpi_tb_find_table()
  ACPI / tables: Remove duplicated include from tables.c
  ACPI / APD: constify local structures
  x86: ACPI: make variable names clearer in acpi_parse_madt_lapic_entries()
  x86: ACPI: remove extraneous white space after semicolon
  ...
2016-10-03 10:11:58 -07:00
Rafael J. Wysocki e35db92b4f Merge branches 'pm-cpuidle', 'pm-opp' and 'pm-avs'
* pm-cpuidle:
  ARM: cpuidle: Fix error return code

* pm-opp:
  PM / OPP: Don't support OPP if it provides supported-hw but platform does not
  PM / OPP: avoid maybe-uninitialized warning

* pm-avs:
  PM / AVS: SmartReflex: Neaten logging
2016-10-02 01:43:16 +02:00