{"push_id":855545274,"size":2,"distinct_size":2,"ref":"refs/heads/master","head":"6a6ef9a2c8694fa9a993338ffe5e58a3ca693e44","before":"b45c272651172afda54c5e8677b2fbec18026eb2","commits":[{"sha":"847fa31ef2e9e9aa060d708a2c7474139dc44721","author":{"email":"a8167b9d27aca9c6624754deb52c4c6420eded04@huawei.com","name":"Zefan Li"},"message":"Linux 3.4.110\n\nhrtimer: Allow concurrent hrtimer_start() for self restarting timers\n\ncommit 5de2755c8c8b3a6b8414870e2c284914a2b42e4d upstream.\n\nBecause we drop cpu_base->lock around calling hrtimer::function, it is\npossible for hrtimer_start() to come in between and enqueue the timer.\n\nIf hrtimer::function then returns HRTIMER_RESTART we'll hit the BUG_ON\nbecause HRTIMER_STATE_ENQUEUED will be set.\n\nSince the above is a perfectly valid scenario, remove the BUG_ON and\nmake the enqueue_hrtimer() call conditional on the timer not being\nenqueued already.\n\nNOTE: in that concurrent scenario its entirely common for both sites\nto want to modify the hrtimer, since hrtimers don't provide\nserialization themselves be sure to provide some such that the\nhrtimer::function and the hrtimer_start() caller don't both try and\nfudge the expiration state at the same time.\n\nTo that effect, add a WARN when someone tries to forward an already\nenqueued timer, the most common way to change the expiry of self\nrestarting timers. Ideally we'd put the WARN in everything modifying\nthe expiry but most of that is inlines and we don't need the bloat.\n\nFixes: 2d44ae4d7135 (\"hrtimer: clean up cpu->base locking tricks\")\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Ben Segall <bsegall@google.com>\nCc: Roman Gushchin <klamm@yandex-team.ru>\nCc: Paul Turner <pjt@google.com>\nLink: http://lkml.kernel.org/r/20150415113105.GT5029@twins.programming.kicks-ass.net\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmtd: fix: avoid race condition when accessing mtd->usecount\n\ncommit 073db4a51ee43ccb827f54a4261c0583b028d5ab upstream.\n\nOn A MIPS 32-cores machine a BUG_ON was triggered because some acesses to\nmtd->usecount were done without taking mtd_table_mutex.\nkernel: Call Trace:\nkernel: [<ffffffff80401818>] __put_mtd_device+0x20/0x50\nkernel: [<ffffffff804086f4>] blktrans_release+0x8c/0xd8\nkernel: [<ffffffff802577e0>] __blkdev_put+0x1a8/0x200\nkernel: [<ffffffff802579a4>] blkdev_close+0x1c/0x30\nkernel: [<ffffffff8022006c>] __fput+0xac/0x250\nkernel: [<ffffffff80171208>] task_work_run+0xd8/0x120\nkernel: [<ffffffff8012c23c>] work_notifysig+0x10/0x18\nkernel:\nkernel:\n        Code: 2442ffff  ac8202d8  000217fe <00020336> dc820128  10400003\n               00000000  0040f809  00000000\nkernel: ---[ end trace 080fbb4579b47a73 ]---\n\nFixed by taking the mutex in blktrans_open and blktrans_release.\n\nNote that this locking is already suggested in\ninclude/linux/mtd/blktrans.h:\n\nstruct mtd_blktrans_ops {\n...\n\t/* Called with mtd_table_mutex held; no race with add/remove */\n\tint (*open)(struct mtd_blktrans_dev *dev);\n\tvoid (*release)(struct mtd_blktrans_dev *dev);\n...\n};\n\nBut we weren't following it.\n\nOriginally reported by (and patched by) Zhang and Giuseppe,\nindependently. Improved and rewritten.\n\nReported-by: Zhang Xingcai <zhangxingcai@huawei.com>\nReported-by: Giuseppe Cantavenera <giuseppe.cantavenera.ext@nokia.com>\nTested-by: Giuseppe Cantavenera <giuseppe.cantavenera.ext@nokia.com>\nAcked-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>\nSigned-off-by: Brian Norris <computersforpeace@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ncrypto: talitos - avoid memleak in talitos_alg_alloc()\n\ncommit 5fa7dadc898567ce14d6d6d427e7bd8ce6eb5d39 upstream.\n\nFixes: 1d11911a8c57 (\"crypto: talitos - fix warning: 'alg' may be used uninitialized in this function\")\nSigned-off-by: Horia Geanta <horia.geanta@freescale.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nASoC: wm8737: Fixup setting VMID Impedance control register\n\ncommit 14ba3ec1de043260cecd9e828ea2e3a0ad302893 upstream.\n\nAccording to the datasheet:\nR10 (0Ah) VMID Impedance Control\n\nBIT 3:2 VMIDSEL DEFAULT 00\n\nDESCRIPTION: VMID impedance selection control\n00: 75kΩ output\n01: 300kΩ output\n10: 2.5kΩ output\n\nWM8737_VMIDSEL_MASK is 0xC (VMIDSEL - [3:2]),\nso it needs to left shift WM8737_VMIDSEL_SHIFT bits for setting these bits.\n\nSigned-off-by: Axel Lin <axel.lin@ingics.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nASoC: wm8903: Fix define for WM8903_VMID_RES_250K\n\ncommit ebb6ad73e645b8f2d098dd3c41d2ff0da4146a02 upstream.\n\nVMID Control 0 BIT[2:1] is VMID Divider Enable and Select\n\n00 = VMID disabled (for OFF mode)\n01 = 2 x 50kΩ divider (for normal operation)\n10 = 2 x 250kΩ divider (for low power standby)\n11 = 2 x 5kΩ divider (for fast start-up)\n\nSo WM8903_VMID_RES_250K should be 2 << 1, which is 4.\n\nSigned-off-by: Axel Lin <axel.lin@ingics.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits\n\ncommit 12c350050538c7dc779c083b7342bfd20f74949c upstream.\n\nWM8955_K_8_0_MASK bits is controlled by WM8955_PLL_CONTROL_3 rather than\nWM8955_PLL_CONTROL_2.\n\nSigned-off-by: Axel Lin <axel.lin@ingics.com>\nAcked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\npktgen: adjust spacing in proc file interface output\n\ncommit d079abd181950a44cdf31daafd1662388a6c4d2e upstream.\n\nToo many spaces were introduced in commit 63adc6fb8ac0 (\"pktgen: cleanup\ncheckpatch warnings\"), thus misaligning \"src_min:\" to other columns.\n\nFixes: 63adc6fb8ac0 (\"pktgen: cleanup checkpatch warnings\")\nSigned-off-by: Jesper Dangaard Brouer <brouer@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\npktgen: document ability to add same device to several threads\n\ncommit 2a1ddf27e8189e1d68336c55dd2f305b224ae8f1 upstream.\n\nThe pktgen.txt documentation still claimed that adding same device to\nmultiple threads were not supported, but it have been since 2008 via\ncommit e6fce5b916cd7 (\"pktgen: multiqueue etc.\").\n\nDocument this and describe the naming scheme dev@X, as the procfile name\nstill need to be unique.\n\nFixes: e6fce5b916cd7 (\"pktgen: multiqueue etc.\")\nSigned-off-by: Jesper Dangaard Brouer <brouer@redhat.com>\nAcked-by: Alexei Starovoitov <ast@plumgrid.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ntty/serial: at91: RS485 mode: 0 is valid for delay_rts_after_send\n\ncommit 8687634b7908c42eb700e0469e110e02833611d1 upstream.\n\nIn RS485 mode, we may want to set the delay_rts_after_send value to 0.\nIn the datasheet, the 0 value is said to \"disable\" the Transmitter Timeguard but\nthis is exactly the expected behavior if we want no delay...\n\nMoreover, if the value was set to non-zero value by device-tree or earlier\nioctl command, it was impossible to change it back to zero.\n\nReported-by: Sami Pietikäinen <Sami.Pietikainen@wapice.com>\nSigned-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nrndis_wlan: harmless issue calling set_bit()\n\ncommit e3958e9d60b4570fff709f397ef5c6b8483f40f7 upstream.\n\nThese are used like:\n\n\tset_bit(WORK_LINK_UP, &priv->work_pending);\n\nThe problem is that set_bit() takes the actual bit number and not a mask\nso static checkers get upset.  It doesn't affect run time because we do\nit consistently, but we may as well clean it up.\n\nFixes: 6010ce07a66c ('rndis_wlan: do link-down state change in worker thread')\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndrm/radeon: take the mode_config mutex when dealing with hpds (v2)\n\ncommit 39fa10f7e21574a70cecf1fed0f9b36535aa68a0 upstream.\n\nSince we are messing with state in the worker.\n\nv2: drop the changes in the mst worker\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nrcu: Correctly handle non-empty Tiny RCU callback list with none ready\n\ncommit 6e91f8cb138625be96070b778d9ba71ce520ea7e upstream.\n\nIf, at the time __rcu_process_callbacks() is invoked,  there are callbacks\nin Tiny RCU's callback list, but none of them are ready to be invoked,\nthe current list-management code will knit the non-ready callbacks out\nof the list.  This can result in hangs and possibly worse.  This commit\ntherefore inserts a check for there being no callbacks that can be\ninvoked immediately.\n\nThis bug is unlikely to occur -- you have to get a new callback between\nthe time rcu_sched_qs() or rcu_bh_qs() was called, but before we get to\n__rcu_process_callbacks().  It was detected by the addition of RCU-bh\ntesting to rcutorture, which in turn was instigated by Iftekhar Ahmed's\nmutation testing.  Although this bug was made much more likely by\n915e8a4fe45e (rcu: Remove fastpath from __rcu_process_callbacks()), this\ndid not cause the bug, but rather made it much more probable.   That\nsaid, it takes more than 40 hours of rcutorture testing, on average,\nfor this bug to appear, so this fix cannot be considered an emergency.\n\nSigned-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>\nReviewed-by: Josh Triplett <josh@joshtriplett.org>\n[lizf: Backported to 3.4: adjust filename ]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmtd: dc21285: use raw spinlock functions for nw_gpio_lock\n\ncommit e5babdf928e5d0c432a8d4b99f20421ce14d1ab6 upstream.\n\nSince commit bd31b85960a7 (which is in 3.2-rc1) nw_gpio_lock is a raw spinlock\nthat needs usage of the corresponding raw functions.\n\nThis fixes:\n\n  drivers/mtd/maps/dc21285.c: In function 'nw_en_write':\n  drivers/mtd/maps/dc21285.c:41:340: warning: passing argument 1 of 'spinlock_check' from incompatible pointer type\n    spin_lock_irqsave(&nw_gpio_lock, flags);\n\n  In file included from include/linux/seqlock.h:35:0,\n                   from include/linux/time.h:5,\n                   from include/linux/stat.h:18,\n                   from include/linux/module.h:10,\n                   from drivers/mtd/maps/dc21285.c:8:\n  include/linux/spinlock.h:299:102: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *'\n   static inline raw_spinlock_t *spinlock_check(spinlock_t *lock)\n                                                                                                        ^\n  drivers/mtd/maps/dc21285.c:43:25: warning: passing argument 1 of 'spin_unlock_irqrestore' from incompatible pointer type\n    spin_unlock_irqrestore(&nw_gpio_lock, flags);\n                           ^\n  In file included from include/linux/seqlock.h:35:0,\n                   from include/linux/time.h:5,\n                   from include/linux/stat.h:18,\n                   from include/linux/module.h:10,\n                   from drivers/mtd/maps/dc21285.c:8:\n  include/linux/spinlock.h:370:91: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *'\n   static inline void spin_unlock_irqrestore(spinlock_t *lock, unsigned long flags)\n\nFixes: bd31b85960a7 (\"locking, ARM: Annotate low level hw locks as raw\")\nSigned-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>\nSigned-off-by: Brian Norris <computersforpeace@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nstaging: rtl8712: prevent buffer overrun in recvbuf2recvframe\n\ncommit cab462140f8a183e3cca0b51c8b59ef715cb6148 upstream.\n\nWith an RTL8191SU USB adaptor, sometimes the hints for a fragmented\npacket are set, but the packet length is too large. Allocate enough\nspace to prevent memory corruption and a resulting kernel panic [1].\n\n[1] http://www.spinics.net/lists/linux-wireless/msg136546.html\n\nSigned-off-by: Haggai Eran <haggai.eran@gmail.com>\nACKed-by: Larry Finger <Larry.Finger@lwfinger.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nusb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset\n\ncommit fb6d1f7df5d25299fd7b3e84b72b8851d3634764 upstream.\n\nFix USB 3.0 devices lost in NOTATTACHED state after a hub port reset.\n\nDissolve the function hub_port_finish_reset() completely and divide the\nactions to be taken into those which need to be done after each reset\nattempt and those which need to be done after the full procedure is\ncomplete, and place them in the appropriate places in hub_port_reset().\nAlso, remove an unneeded forward declaration of hub_port_reset().\n\nVerbose Problem Description:\n\nUSB 3.0 devices may be \"lost for good\" during a hub port reset.\nThis makes Linux unable to boot from USB 3.0 devices in certain\nconstellations of host controllers and devices, because the USB device is\nlost during initialization, preventing the rootfs from being mounted.\n\nThe underlying problem is that in the affected constellations, during the\nprocessing inside hub_port_reset(), the hub link state goes from 0 to\nSS.inactive after the initial reset, and back to 0 again only after the\nfollowing \"warm\" reset.\n\nHowever, hub_port_finish_reset() is called after each reset attempt and\nsets the state the connected USB device based on the \"preliminary\" status\nof the hot reset to USB_STATE_NOTATTACHED due to SS.inactive, yet when\nthe following warm reset is complete and hub_port_finish_reset() is\ncalled again, its call to set the device to USB_STATE_DEFAULT is blocked\nby usb_set_device_state() which does not allow taking USB devices out of\nUSB_STATE_NOTATTACHED state.\n\nThanks to Alan Stern for guiding me to the proper solution and how to\nsubmit it.\n\nLink: http://lkml.kernel.org/r/trinity-25981484-72a9-4d46-bf17-9c1cf9301a31-1432073240136%20()%203capp-gmx-bs27\nSigned-off-by: Robert Schlabbach <robert_s@gmx.net>\nAcked-by: Alan Stern <stern@rowland.harvard.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[lizf: Backported to 3.4:\n - adjust context\n - s/usb_clear_port_feature/clear_port_feature\n - hub_port_warm_reset_required() takes only two arguments]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nfixing infinite OPEN loop in 4.0 stateid recovery\n\ncommit e8d975e73e5fa05f983fbf2723120edcf68e0b38 upstream.\n\nProblem: When an operation like WRITE receives a BAD_STATEID, even though\nrecovery code clears the RECLAIM_NOGRACE recovery flag before recovering\nthe open state, because of clearing delegation state for the associated\ninode, nfs_inode_find_state_and_recover() gets called and it makes the\nsame state with RECLAIM_NOGRACE flag again. As a results, when we restart\nlooking over the open states, we end up in the infinite loop instead of\nbreaking out in the next test of state flags.\n\nSolution: unset the RECLAIM_NOGRACE set because of\ncalling of nfs_inode_find_state_and_recover() after returning from calling\nrecover_open() function.\n\nSigned-off-by: Olga Kornievskaia <kolga@netapp.com>\nSigned-off-by: Trond Myklebust <trond.myklebust@primarydata.com>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nNFS: Fix size of NFSACL SETACL operations\n\ncommit d683cc49daf7c5afca8cd9654aaa1bf63cdf2ad9 upstream.\n\nWhen encoding the NFSACL SETACL operation, reserve just the estimated\nsize of the ACL rather than a fixed maximum. This eliminates needless\nzero padding on the wire that the server ignores.\n\nFixes: ee5dc7732bd5 ('NFS: Fix \"kernel BUG at fs/nfs/nfs3xdr.c:1338!\"')\nSigned-off-by: Chuck Lever <chuck.lever@oracle.com>\nSigned-off-by: Trond Myklebust <trond.myklebust@primarydata.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nSUNRPC: Fix a memory leak in the backchannel code\n\ncommit 88de6af24f2b48b06c514d3c3d0a8f22fafe30bd upstream.\n\nreq->rq_private_buf isn't initialised when xprt_setup_backchannel calls\nxprt_free_allocation.\n\nFixes: fb7a0b9addbdb (\"nfs41: New backchannel helper routines\")\nSigned-off-by: Trond Myklebust <trond.myklebust@primarydata.com>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nipr: Increase default adapter init stage change timeout\n\ncommit 45c44b5ff9caa743ed9c2bfd44307c536c9caf1e upstream.\n\nIncrease the default init stage change timeout from 15 seconds to 30 seconds.\nThis resolves issues we have seen with some adapters not transitioning\nto the first init stage within 15 seconds, which results in adapter\ninitialization failures.\n\nSigned-off-by: Brian King <brking@linux.vnet.ibm.com>\nSigned-off-by: James Bottomley <JBottomley@Odin.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nath9k: fix DMA stop sequence for AR9003+\n\ncommit 300f77c08ded96d33f492aaa02549103852f0c12 upstream.\n\nAR93xx and newer needs to stop rx before tx to avoid getting the DMA\nengine or MAC into a stuck state.\nThis should reduce/fix the occurence of \"Failed to stop Tx DMA\" logspam.\n\nSigned-off-by: Felix Fietkau <nbd@openwrt.org>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\n[lizf: Backported to 3.4:\n - initialize ret\n - ath_drain_all_txq() takes a second argument]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nregulator: core: fix constraints output buffer\n\ncommit a7068e3932eee8268c4ce4e080a338ee7b8a27bf upstream.\n\nThe buffer for condtraints debug isn't big enough to hold the output\nin all cases. So fix this issue by increasing the buffer.\n\nSigned-off-by: Stefan Wahren <stefan.wahren@i2se.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nx86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A\n\ncommit 1dace0116d0b05c967d94644fc4dfe96be2ecd3d upstream.\n\nThe Foxconn K8M890-8237A has two PCI host bridges, and we can't assign\nresources correctly without the information from _CRS that tells us which\naddress ranges are claimed by which bridge.  In the bugs mentioned below,\nwe incorrectly assign a sound card address (this example is from 1033299):\n\n  bus: 00 index 2 [mem 0x80000000-0xfcffffffff]\n  ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-7f])\n  pci_root PNP0A08:00: host bridge window [mem 0x80000000-0xbfefffff] (ignored)\n  pci_root PNP0A08:00: host bridge window [mem 0xc0000000-0xdfffffff] (ignored)\n  pci_root PNP0A08:00: host bridge window [mem 0xf0000000-0xfebfffff] (ignored)\n  ACPI: PCI Root Bridge [PCI1] (domain 0000 [bus 80-ff])\n  pci_root PNP0A08:01: host bridge window [mem 0xbff00000-0xbfffffff] (ignored)\n  pci 0000:80:01.0: [1106:3288] type 0 class 0x000403\n  pci 0000:80:01.0: reg 10: [mem 0xbfffc000-0xbfffffff 64bit]\n  pci 0000:80:01.0: address space collision: [mem 0xbfffc000-0xbfffffff 64bit] conflicts with PCI Bus #00 [mem 0x80000000-0xfcffffffff]\n  pci 0000:80:01.0: BAR 0: assigned [mem 0xfd00000000-0xfd00003fff 64bit]\n  BUG: unable to handle kernel paging request at ffffc90000378000\n  IP: [<ffffffffa0345f63>] azx_create+0x37c/0x822 [snd_hda_intel]\n\nWe assigned 0xfd_0000_0000, but that is not in any of the host bridge\nwindows, and the sound card doesn't work.\n\nTurn on pci=use_crs automatically for this system.\n\nLink: https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368\nLink: https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndmaengine: mv_xor: bug fix for racing condition in descriptors cleanup\n\ncommit 9136291f1dbc1d4d1cacd2840fb35f4f3ce16c46 upstream.\n\nThis patch fixes a bug in the XOR driver where the cleanup function can be\ncalled and free descriptors that never been processed by the engine (which\nresult in data errors).\n\nThe cleanup function will free descriptors based on the ownership bit in\nthe descriptors.\n\nFixes: ff7b04796d98 (\"dmaengine: DMA engine driver for Marvell XOR engine\")\nSigned-off-by: Lior Amsalem <alior@marvell.com>\nSigned-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>\nReviewed-by: Ofer Heifetz <oferh@marvell.com>\nSigned-off-by: Vinod Koul <vinod.koul@intel.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nASoC: wm8960: the enum of \"DAC Polarity\" should be wm8960_enum[1]\n\ncommit a077e81ec61e07a7f86997d045109f06719fbffe upstream.\n\nthe enum of \"DAC Polarity\" should be wm8960_enum[1].\n\nSigned-off-by: Zidan Wang <zidan.wang@freescale.com>\nAcked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\next4: fix race between truncate and __ext4_journalled_writepage()\n\ncommit bdf96838aea6a265f2ae6cbcfb12a778c84a0b8e upstream.\n\nThe commit cf108bca465d: \"ext4: Invert the locking order of page_lock\nand transaction start\" caused __ext4_journalled_writepage() to drop\nthe page lock before the page was written back, as part of changing\nthe locking order to jbd2_journal_start -> page_lock.  However, this\nintroduced a potential race if there was a truncate racing with the\ndata=journalled writeback mode.\n\nFix this by grabbing the page lock after starting the journal handle,\nand then checking to see if page had gotten truncated out from under\nus.\n\nThis fixes a number of different warnings or BUG_ON's when running\nxfstests generic/086 in data=journalled mode, including:\n\njbd2_journal_dirty_metadata: vdc-8: bad jh for block 115643: transaction (ee3fe7\nc0, 164), jh->b_transaction (  (null), 0), jh->b_next_transaction (  (null), 0), jlist 0\n\n\t      \t      \t  - and -\n\nkernel BUG at /usr/projects/linux/ext4/fs/jbd2/transaction.c:2200!\n    ...\nCall Trace:\n [<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117\n [<c02b2de5>] __ext4_journalled_invalidatepage+0x10f/0x117\n [<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117\n [<c027d883>] ? lock_buffer+0x36/0x36\n [<c02b2dfa>] ext4_journalled_invalidatepage+0xd/0x22\n [<c0229139>] do_invalidatepage+0x22/0x26\n [<c0229198>] truncate_inode_page+0x5b/0x85\n [<c022934b>] truncate_inode_pages_range+0x156/0x38c\n [<c0229592>] truncate_inode_pages+0x11/0x15\n [<c022962d>] truncate_pagecache+0x55/0x71\n [<c02b913b>] ext4_setattr+0x4a9/0x560\n [<c01ca542>] ? current_kernel_time+0x10/0x44\n [<c026c4d8>] notify_change+0x1c7/0x2be\n [<c0256a00>] do_truncate+0x65/0x85\n [<c0226f31>] ? file_ra_state_init+0x12/0x29\n\n\t      \t      \t  - and -\n\nWARNING: CPU: 1 PID: 1331 at /usr/projects/linux/ext4/fs/jbd2/transaction.c:1396\nirty_metadata+0x14a/0x1ae()\n    ...\nCall Trace:\n [<c01b879f>] ? console_unlock+0x3a1/0x3ce\n [<c082cbb4>] dump_stack+0x48/0x60\n [<c0178b65>] warn_slowpath_common+0x89/0xa0\n [<c02ef2cf>] ? jbd2_journal_dirty_metadata+0x14a/0x1ae\n [<c0178bef>] warn_slowpath_null+0x14/0x18\n [<c02ef2cf>] jbd2_journal_dirty_metadata+0x14a/0x1ae\n [<c02d8615>] __ext4_handle_dirty_metadata+0xd4/0x19d\n [<c02b2f44>] write_end_fn+0x40/0x53\n [<c02b4a16>] ext4_walk_page_buffers+0x4e/0x6a\n [<c02b59e7>] ext4_writepage+0x354/0x3b8\n [<c02b2f04>] ? mpage_release_unused_pages+0xd4/0xd4\n [<c02b1b21>] ? wait_on_buffer+0x2c/0x2c\n [<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8\n [<c02b5a5b>] __writepage+0x10/0x2e\n [<c0225956>] write_cache_pages+0x22d/0x32c\n [<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8\n [<c02b6ee8>] ext4_writepages+0x102/0x607\n [<c019adfe>] ? sched_clock_local+0x10/0x10e\n [<c01a8a7c>] ? __lock_is_held+0x2e/0x44\n [<c01a8ad5>] ? lock_is_held+0x43/0x51\n [<c0226dff>] do_writepages+0x1c/0x29\n [<c0276bed>] __writeback_single_inode+0xc3/0x545\n [<c0277c07>] writeback_sb_inodes+0x21f/0x36d\n    ...\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nDisable write buffering on Toshiba ToPIC95\n\ncommit 2fb22a8042fe96b4220843f79241c116d90922c4 upstream.\n\nDisable write buffering on the Toshiba ToPIC95 if it is enabled by\nsomebody (it is not supposed to be a power-on default according to\nthe datasheet). On the ToPIC95, practically no 32-bit Cardbus card\nwill work under heavy load without locking up the whole system if\nthis is left enabled. I tried about a dozen. It does not affect\n16-bit cards. This is similar to the O2 bugs in early controller\nrevisions it seems.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=55961\nSigned-off-by: Ryan C. Underwood <nemesis@icequake.net>\nSigned-off-by: Dominik Brodowski <linux@dominikbrodowski.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nsctp: fix ASCONF list handling\n\ncommit 2d45a02d0166caf2627fe91897c6ffc3b19514c4 upstream.\n\n->auto_asconf_splist is per namespace and mangled by functions like\nsctp_setsockopt_auto_asconf() which doesn't guarantee any serialization.\n\nAlso, the call to inet_sk_copy_descendant() was backuping\n->auto_asconf_list through the copy but was not honoring\n->do_auto_asconf, which could lead to list corruption if it was\ndifferent between both sockets.\n\nThis commit thus fixes the list handling by using ->addr_wq_lock\nspinlock to protect the list. A special handling is done upon socket\ncreation and destruction for that. Error handlig on sctp_init_sock()\nwill never return an error after having initialized asconf, so\nsctp_destroy_sock() can be called without addrq_wq_lock. The lock now\nwill be take on sctp_close_sock(), before locking the socket, so we\ndon't do it in inverse order compared to sctp_addr_wq_timeout_handler().\n\nInstead of taking the lock on sctp_sock_migrate() for copying and\nrestoring the list values, it's preferred to avoid rewritting it by\nimplementing sctp_copy_descendant().\n\nIssue was found with a test application that kept flipping sysctl\ndefault_auto_asconf on and off, but one could trigger it by issuing\nsimultaneous setsockopt() calls on multiple sockets or by\ncreating/destroying sockets fast enough. This is only triggerable\nlocally.\n\nFixes: 9f7d653b67ae (\"sctp: Add Auto-ASCONF support (core).\")\nReported-by: Ji Jianwen <jiji@redhat.com>\nSuggested-by: Neil Horman <nhorman@tuxdriver.com>\nSuggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[lizf: Backported to 3.4:\n - use global spinlock instead of per-namespace lock]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\njbd2: use GFP_NOFS in jbd2_cleanup_journal_tail()\n\ncommit b4f1afcd068f6e533230dfed00782cd8a907f96b upstream.\n\njbd2_cleanup_journal_tail() can be invoked by jbd2__journal_start()\nSo allocations should be done with GFP_NOFS\n\n[Full stack trace snipped from 3.10-rh7]\n[<ffffffff815c4bd4>] dump_stack+0x19/0x1b\n[<ffffffff8105dba1>] warn_slowpath_common+0x61/0x80\n[<ffffffff8105dcca>] warn_slowpath_null+0x1a/0x20\n[<ffffffff815c2142>] slab_pre_alloc_hook.isra.31.part.32+0x15/0x17\n[<ffffffff8119c045>] kmem_cache_alloc+0x55/0x210\n[<ffffffff811477f5>] ? mempool_alloc_slab+0x15/0x20\n[<ffffffff811477f5>] mempool_alloc_slab+0x15/0x20\n[<ffffffff81147939>] mempool_alloc+0x69/0x170\n[<ffffffff815cb69e>] ? _raw_spin_unlock_irq+0xe/0x20\n[<ffffffff8109160d>] ? finish_task_switch+0x5d/0x150\n[<ffffffff811f1a8e>] bio_alloc_bioset+0x1be/0x2e0\n[<ffffffff8127ee49>] blkdev_issue_flush+0x99/0x120\n[<ffffffffa019a733>] jbd2_cleanup_journal_tail+0x93/0xa0 [jbd2] -->GFP_KERNEL\n[<ffffffffa019aca1>] jbd2_log_do_checkpoint+0x221/0x4a0 [jbd2]\n[<ffffffffa019afc7>] __jbd2_log_wait_for_space+0xa7/0x1e0 [jbd2]\n[<ffffffffa01952d8>] start_this_handle+0x2d8/0x550 [jbd2]\n[<ffffffff811b02a9>] ? __memcg_kmem_put_cache+0x29/0x30\n[<ffffffff8119c120>] ? kmem_cache_alloc+0x130/0x210\n[<ffffffffa019573a>] jbd2__journal_start+0xba/0x190 [jbd2]\n[<ffffffff811532ce>] ? lru_cache_add+0xe/0x10\n[<ffffffffa01c9549>] ? ext4_da_write_begin+0xf9/0x330 [ext4]\n[<ffffffffa01f2c77>] __ext4_journal_start_sb+0x77/0x160 [ext4]\n[<ffffffffa01c9549>] ext4_da_write_begin+0xf9/0x330 [ext4]\n[<ffffffff811446ec>] generic_file_buffered_write_iter+0x10c/0x270\n[<ffffffff81146918>] __generic_file_write_iter+0x178/0x390\n[<ffffffff81146c6b>] __generic_file_aio_write+0x8b/0xb0\n[<ffffffff81146ced>] generic_file_aio_write+0x5d/0xc0\n[<ffffffffa01bf289>] ext4_file_write+0xa9/0x450 [ext4]\n[<ffffffff811c31d9>] ? pipe_read+0x379/0x4f0\n[<ffffffff811b93f0>] do_sync_write+0x90/0xe0\n[<ffffffff811b9b6d>] vfs_write+0xbd/0x1e0\n[<ffffffff811ba5b8>] SyS_write+0x58/0xb0\n[<ffffffff815d4799>] system_call_fastpath+0x16/0x1b\n\nSigned-off-by: Dmitry Monakhov <dmonakhov@openvz.org>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nregmap: Fix regmap_bulk_read in BE mode\n\ncommit 15b8d2c41fe5839582029f65c5f7004db451cc2b upstream.\n\nIn big endian mode regmap_bulk_read gives incorrect data\nfor byte reads.\n\nThis is because memcpy of a single byte from an address\nafter full word read gives different results when\nendianness differs. ie. we get little-end in LE and big-end in BE.\n\nSigned-off-by: Arun Chandran <achandran@mvista.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\n[lizf: Backported to 3.4: format_val() takes only two arguments]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\njbd2: fix ocfs2 corrupt when updating journal superblock fails\n\ncommit 6f6a6fda294506dfe0e3e0a253bb2d2923f28f0a upstream.\n\nIf updating journal superblock fails after journal data has been\nflushed, the error is omitted and this will mislead the caller as a\nnormal case.  In ocfs2, the checkpoint will be treated successfully\nand the other node can get the lock to update. Since the sb_start is\nstill pointing to the old log block, it will rewrite the journal data\nduring journal recovery by the other node. Thus the new updates will\nbe overwritten and ocfs2 corrupts.  So in above case we have to return\nthe error, and ocfs2_commit_cache will take care of the error and\nprevent the other node to do update first.  And only after recovering\njournal it can do the new updates.\n\nThe issue discussion mail can be found at:\nhttps://oss.oracle.com/pipermail/ocfs2-devel/2015-June/010856.html\nhttp://comments.gmane.org/gmane.comp.file-systems.ext4/48841\n\n[ Fixed bug in patch which allowed a non-negative error return from\n  jbd2_cleanup_journal_tail() to leak out of jbd2_fjournal_flush(); this\n  was causing xfstests ext4/306 to fail. -- Ted ]\n\nReported-by: Yiwen Jiang <jiangyiwen@huawei.com>\nSigned-off-by: Joseph Qi <joseph.qi@huawei.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nTested-by: Yiwen Jiang <jiangyiwen@huawei.com>\nCc: Junxiao Bi <junxiao.bi@oracle.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nideapad: fix software rfkill setting\n\ncommit 4b200b4604bec3388426159f1656109d19fadf6e upstream.\n\nThis fixes a several year old regression that I found while trying\nto get the Yoga 3 11 to work. The ideapad_rfk_set function is meant\nto send a command to the embedded controller through ACPI, but\nas of c1f73658ed, it sends the index of the rfkill device instead\nof the command, and ignores the opcode field.\n\nThis changes it back to the original behavior, which indeed\nflips the rfkill state as seen in the debugfs interface.\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nFixes: c1f73658ed (\"ideapad: pass ideapad_priv as argument (part 2)\")\nSigned-off-by: Darren Hart <dvhart@linux.intel.com>\n[lizf: Backported to 3.4: @data is not a pointer but the device idx]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnfs: increase size of EXCHANGE_ID name string buffer\n\ncommit 764ad8ba8cd4c6f836fca9378f8c5121aece0842 upstream.\n\nThe current buffer is much too small if you have a relatively long\nhostname. Bring it up to the size of the one that SETCLIENTID has.\n\nReported-by: Michael Skralivetsky <michael.skralivetsky@primarydata.com>\nSigned-off-by: Jeff Layton <jeff.layton@primarydata.com>\nSigned-off-by: Trond Myklebust <trond.myklebust@primarydata.com>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nbridge: fix br_stp_set_bridge_priority race conditions\n\ncommit 2dab80a8b486f02222a69daca6859519e05781d9 upstream.\n\nAfter the ->set() spinlocks were removed br_stp_set_bridge_priority\nwas left running without any protection when used via sysfs. It can\nrace with port add/del and could result in use-after-free cases and\ncorrupted lists. Tested by running port add/del in a loop with stp\nenabled while setting priority in a loop, crashes are easily\nreproducible.\nThe spinlocks around sysfs ->set() were removed in commit:\n14f98f258f19 (\"bridge: range check STP parameters\")\nThere's also a race condition in the netlink priority support that is\nfixed by this change, but it was introduced recently and the fixes tag\ncovers it, just in case it's needed the commit is:\naf615762e972 (\"bridge: add ageing_time, stp_state, priority over netlink\")\n\nSigned-off-by: Nikolay Aleksandrov <razor@blackwall.org>\nFixes: 14f98f258f19 (\"bridge: range check STP parameters\")\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\next4: call sync_blockdev() before invalidate_bdev() in put_super()\n\ncommit 89d96a6f8e6491f24fc8f99fd6ae66820e85c6c1 upstream.\n\nNormally all of the buffers will have been forced out to disk before\nwe call invalidate_bdev(), but there will be some cases, where a file\nsystem operation was aborted due to an ext4_error(), where there may\nstill be some dirty buffers in the buffer cache for the device.  So\ntry to force them out to memory before calling invalidate_bdev().\n\nThis fixes a warning triggered by generic/081:\n\nWARNING: CPU: 1 PID: 3473 at /usr/projects/linux/ext4/fs/block_dev.c:56 __blkdev_put+0xb5/0x16f()\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\npacket: read num_members once in packet_rcv_fanout()\n\ncommit f98f4514d07871da7a113dd9e3e330743fd70ae4 upstream.\n\nWe need to tell compiler it must not read f->num_members multiple\ntimes. Otherwise testing if num is not zero is flaky, and we could\nattempt an invalid divide by 0 in fanout_demux_cpu()\n\nNote bug was present in packet_rcv_fanout_hash() and\npacket_rcv_fanout_lb() but final 3.1 had a simple location\nafter commit 95ec3eb417115fb (\"packet: Add 'cpu' fanout policy.\")\n\nFixes: dc99f600698dc (\"packet: Add fanout support.\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Willem de Bruijn <willemb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[lizf: Backported to 3.4: use ACCESS_ONCE() instead of READ_ONCE()]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\npacket: avoid out of bounds read in round robin fanout\n\ncommit 468479e6043c84f5a65299cc07cb08a22a28c2b1 upstream.\n\nPACKET_FANOUT_LB computes f->rr_cur such that it is modulo\nf->num_members. It returns the old value unconditionally, but\nf->num_members may have changed since the last store. Ensure\nthat the return value is always < num.\n\nWhen modifying the logic, simplify it further by replacing the loop\nwith an unconditional atomic increment.\n\nFixes: dc99f600698d (\"packet: Add fanout support.\")\nSuggested-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Willem de Bruijn <willemb@google.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[lizf: Backported to 3.4:\n - adjust context\n - fanout_demux_lb() returns a pointer]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\next4: don't retry file block mapping on bigalloc fs with non-extent file\n\ncommit 292db1bc6c105d86111e858859456bcb11f90f91 upstream.\n\next4 isn't willing to map clusters to a non-extent file.  Don't signal\nthis with an out of space error, since the FS will retry the\nallocation (which didn't fail) forever.  Instead, return EUCLEAN so\nthat the operation will fail immediately all the way back to userspace.\n\n(The fix is either to run e2fsck -E bmap2extent, or to chattr +e the file.)\n\nSigned-off-by: Darrick J. Wong <darrick.wong@oracle.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nwatchdog: omap: assert the counter being stopped before reprogramming\n\ncommit 530c11d432727c697629ad5f9d00ee8e2864d453 upstream.\n\nThe omap watchdog has the annoying behaviour that writes to most\nregisters don't have any effect when the watchdog is already running.\nQuoting the AM335x reference manual:\n\n\tTo modify the timer counter value (the WDT_WCRR register),\n\tprescaler ratio (the WDT_WCLR[4:2] PTV bit field), delay\n\tconfiguration value (the WDT_WDLY[31:0] DLY_VALUE bit field), or\n\tthe load value (the WDT_WLDR[31:0] TIMER_LOAD bit field), the\n\twatchdog timer must be disabled by using the start/stop sequence\n\t(the WDT_WSPR register).\n\nCurrently the timer is stopped in the .probe callback but still there\nare possibilities that yield to a situation where omap_wdt_start is\nentered with the timer running (e.g. when /dev/watchdog is closed\nwithout stopping and then reopened). In such a case programming the\ntimeout silently fails!\n\nTo circumvent this stop the timer before reprogramming.\n\nAssuming one of the first things the watchdog user does is setting the\ntimeout explicitly nothing too bad should happen because this explicit\nsetting works fine.\n\nFixes: 7768a13c252a (\"[PATCH] OMAP: Add Watchdog driver support\")\nSigned-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>\nReviewed-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Wim Van Sebroeck <wim@iguana.be>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nbridge: multicast: restore router configuration on port link down/up\n\ncommit 754bc547f0a79f7568b5b81c7fc0a8d044a6571a upstream.\n\nWhen a port goes through a link down/up the multicast router configuration\nis not restored.\n\nSigned-off-by: Satish Ashok <sashok@cumulusnetworks.com>\nSigned-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\nFixes: 0909e11758bd (\"bridge: Add multicast_router sysfs entries\")\nAcked-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nstmmac: troubleshoot unexpected bits in des0 & des1\n\ncommit f1590670ce069eefeb93916391a67643e6ad1630 upstream.\n\nCurrent implementation of descriptor init procedure only takes\ncare about setting/clearing ownership flag in \"des0\"/\"des1\"\nfields while it is perfectly possible to get unexpected bits\nset because of the following factors:\n\n [1] On driver probe underlying memory allocated with\n     dma_alloc_coherent() might not be zeroed and so\n     it will be filled with garbage.\n\n [2] During driver operation some bits could be set by SD/MMC\n     controller (for example error flags etc).\n\nAnd unexpected and/or randomly set flags in \"des0\"/\"des1\"\nfields may lead to unpredictable behavior of GMAC DMA block.\n\nThis change addresses both items above with:\n\n [1] Use of dma_zalloc_coherent() instead of simple\n     dma_alloc_coherent() to make sure allocated memory is\n     zeroed. That shouldn't affect performance because\n     this allocation only happens once on driver probe.\n\n [2] Do explicit zeroing of both \"des0\" and \"des1\" fields\n     of all buffer descriptors during initialization of\n     DMA transfer.\n\nAnd while at it fixed identation of dma_free_coherent()\ncounterpart as well.\n\nSigned-off-by: Alexey Brodkin <abrodkin@synopsys.com>\nCc: Giuseppe Cavallaro <peppe.cavallaro@st.com>\nCc: arc-linux-dev@synopsys.com\nCc: linux-kernel@vger.kernel.org\nCc: David Miller <davem@davemloft.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[lizf: Backported to 3.4:\n - adjust contest\n - adjust allocations in init_dma_desc_rings()]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmm: kmemleak: allow safe memory scanning during kmemleak disabling\n\ncommit c5f3b1a51a591c18c8b33983908e7fdda6ae417e upstream.\n\nThe kmemleak scanning thread can run for minutes.  Callbacks like\nkmemleak_free() are allowed during this time, the race being taken care\nof by the object->lock spinlock.  Such lock also prevents a memory block\nfrom being freed or unmapped while it is being scanned by blocking the\nkmemleak_free() -> ...  -> __delete_object() function until the lock is\nreleased in scan_object().\n\nWhen a kmemleak error occurs (e.g.  it fails to allocate its metadata),\nkmemleak_enabled is set and __delete_object() is no longer called on\nfreed objects.  If kmemleak_scan is running at the same time,\nkmemleak_free() no longer waits for the object scanning to complete,\nallowing the corresponding memory block to be freed or unmapped (in the\ncase of vfree()).  This leads to kmemleak_scan potentially triggering a\npage fault.\n\nThis patch separates the kmemleak_free() enabling/disabling from the\noverall kmemleak_enabled nob so that we can defer the disabling of the\nobject freeing tracking until the scanning thread completed.  The\nkmemleak_free_part() is deliberately ignored by this patch since this is\nonly called during boot before the scanning thread started.\n\nSigned-off-by: Catalin Marinas <catalin.marinas@arm.com>\nReported-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>\nTested-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndell-laptop: Fix allocating & freeing SMI buffer page\n\ncommit b8830a4e71b15d0364ac8e6c55301eea73f211da upstream.\n\nThis commit fix kernel crash when probing for rfkill devices in dell-laptop\ndriver failed. Function free_page() was incorrectly used on struct page *\ninstead of virtual address of SMI buffer.\n\nThis commit also simplify allocating page for SMI buffer by using\n__get_free_page() function instead of sequential call of functions\nalloc_page() and page_address().\n\nSigned-off-by: Pali Rohár <pali.rohar@gmail.com>\nAcked-by: Michal Hocko <mhocko@suse.cz>\nSigned-off-by: Darren Hart <dvhart@linux.intel.com>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ntracing/filter: Do not WARN on operand count going below zero\n\ncommit b4875bbe7e68f139bd3383828ae8e994a0df6d28 upstream.\n\nWhen testing the fix for the trace filter, I could not come up with\na scenario where the operand count goes below zero, so I added a\nWARN_ON_ONCE(cnt < 0) to the logic. But there is legitimate case\nthat it can happen (although the filter would be wrong).\n\n # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter\n\nThat is, a single operation without any operands will hit the path\nwhere the WARN_ON_ONCE() can trigger. Although this is harmless,\nand the filter is reported as a error. But instead of spitting out\na warning to the kernel dmesg, just fail nicely and report it via\nthe proper channels.\n\nLink: http://lkml.kernel.org/r/558C6082.90608@oracle.com\n\nReported-by: Vince Weaver <vincent.weaver@maine.edu>\nReported-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ntracing/filter: Do not allow infix to exceed end of string\n\ncommit 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 upstream.\n\nWhile debugging a WARN_ON() for filtering, I found that it is possible\nfor the filter string to be referenced after its end. With the filter:\n\n # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter\n\nThe filter_parse() function can call infix_get_op() which calls\ninfix_advance() that updates the infix filter pointers for the cnt\nand tail without checking if the filter is already at the end, which\nwill put the cnt to zero and the tail beyond the end. The loop then calls\ninfix_next() that has\n\n\tps->infix.cnt--;\n\treturn ps->infix.string[ps->infix.tail++];\n\nThe cnt will now be below zero, and the tail that is returned is\nalready passed the end of the filter string. So far the allocation\nof the filter string usually has some buffer that is zeroed out, but\nif the filter string is of the exact size of the allocated buffer\nthere's no guarantee that the charater after the nul terminating\ncharacter will be zero.\n\nLuckily, only root can write to the filter.\n\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\n__bitmap_parselist: fix bug in empty string handling\n\ncommit 2528a8b8f457d7432552d0e2b6f0f4046bb702f4 upstream.\n\nbitmap_parselist(\"\", &mask, nmaskbits) will erroneously set bit zero in\nthe mask.  The same bug is visible in cpumask_parselist() since it is\nlayered on top of the bitmask code, e.g.  if you boot with \"isolcpus=\",\nyou will actually end up with cpu zero isolated.\n\nThe bug was introduced in commit 4b060420a596 (\"bitmap, irq: add\nsmp_affinity_list interface to /proc/irq\") when bitmap_parselist() was\ngeneralized to support userspace as well as kernelspace.\n\nFixes: 4b060420a596 (\"bitmap, irq: add smp_affinity_list interface to /proc/irq\")\nSigned-off-by: Chris Metcalf <cmetcalf@ezchip.com>\nCc: Rasmus Villemoes <linux@rasmusvillemoes.dk>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nagp/intel: Fix typo in needs_ilk_vtd_wa()\n\ncommit 8b572a4200828b4e75cc22ed2f494b58d5372d65 upstream.\n\nIn needs_ilk_vtd_wa(), we pass in the GPU device but compared it against\nthe ids for the mobile GPU and the mobile host bridge. That latter is\nimpossible and so likely was just a typo for the desktop GPU device id\n(which is also buggy).\n\nFixes commit da88a5f7f7d434e2cde1b3e19d952e6d84533662\nAuthor: Chris Wilson <chris@chris-wilson.co.uk>\nDate:   Wed Feb 13 09:31:53 2013 +0000\n\n    drm/i915: Disable WC PTE updates to w/a buggy IOMMU on ILK\n\nReported-by: Ting-Wei Lan <lantw44@gmail.com>\nBugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91127\nReferences: https://bugzilla.freedesktop.org/show_bug.cgi?id=60391\nSigned-off-by: Chris Wilson <chris@chris-wilson.co.uk>\nCc: Daniel Vetter <daniel.vetter@ffwll.ch>\nReviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>\nSigned-off-by: Jani Nikula <jani.nikula@intel.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ncrush: fix a bug in tree bucket decode\n\ncommit 82cd003a77173c91b9acad8033fb7931dac8d751 upstream.\n\nstruct crush_bucket_tree::num_nodes is u8, so ceph_decode_8_safe()\nshould be used.  -Wconversion catches this, but I guess it went\nunnoticed in all the noise it spews.  The actual problem (at least for\ncommon crushmaps) isn't the u32 -> u8 truncation though - it's the\nadvancement by 4 bytes instead of 1 in the crushmap buffer.\n\nFixes: http://tracker.ceph.com/issues/2759\n\nSigned-off-by: Ilya Dryomov <idryomov@gmail.com>\nReviewed-by: Josh Durgin <jdurgin@redhat.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nfuse: initialize fc->release before calling it\n\ncommit 0ad0b3255a08020eaf50e34ef0d6df5bdf5e09ed upstream.\n\nfc->release is called from fuse_conn_put() which was used in the error\ncleanup before fc->release was initialized.\n\n[Jeremiah Mahler <jmmahler@gmail.com>: assign fc->release after calling\nfuse_conn_init(fc) instead of before.]\n\nSigned-off-by: Miklos Szeredi <mszeredi@suse.cz>\nFixes: a325f9b92273 (\"fuse: update fuse_conn_init() and separate out fuse_conn_kill()\")\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nACPICA: Tables: Fix an issue that FACS initialization is performed twice\n\ncommit c04be18448355441a0c424362df65b6422e27bda upstream.\n\nACPICA commit 90f5332a15e9d9ba83831ca700b2b9f708274658\n\nThis patch adds a new FACS initialization flag for acpi_tb_initialize().\nacpi_enable_subsystem() might be invoked several times in OS bootup process,\nand we don't want FACS initialization to be invoked twice. Lv Zheng.\n\nLink: https://github.com/acpica/acpica/commit/90f5332a\nSigned-off-by: Lv Zheng <lv.zheng@intel.com>\nSigned-off-by: Bob Moore <robert.moore@intel.com>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\n[lizf: Backported to 3.4: adjust filename]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nKVM: x86: make vapics_in_nmi_mode atomic\n\ncommit 42720138b06301cc8a7ee8a495a6d021c4b6a9bc upstream.\n\nWrites were a bit racy, but hard to turn into a bug at the same time.\n(Particularly because modern Linux doesn't use this feature anymore.)\n\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\n[Actually the next patch makes it much, much easier to trigger the race\n so I'm including this one for stable@ as well. - Paolo]\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nKVM: x86: properly restore LVT0\n\ncommit db1385624c686fe99fe2d1b61a36e1537b915d08 upstream.\n\nLegacy NMI watchdog didn't work after migration/resume, because\nvapics_in_nmi_mode was left at 0.\n\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\n[lizf: Backported to 3.4:\n - adjust context\n - s/kvm_apic_get_reg/apic_get_reg/]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\n9p: forgetting to cancel request on interrupted zero-copy RPC\n\ncommit a84b69cb6e0a41e86bc593904faa6def3b957343 upstream.\n\nIf we'd already sent a request and decide to abort it, we *must*\nissue TFLUSH properly and not just blindly reuse the tag, or\nwe'll get seriously screwed when response eventually arrives\nand we confuse it for response to later request that had reused\nthe same tag.\n\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nRevert \"drm/i915: Don't skip request retirement if the active list is empty\"\n\ncommit 245ec9d85696c3e539b23e210f248698b478379c upstream.\n\nThis reverts commit 0aedb1626566efd72b369c01992ee7413c82a0c5.\n\nI messed things up while applying [1] to drm-intel-fixes. Rectify.\n\n[1] http://mid.gmane.org/1432827156-9605-1-git-send-email-ville.syrjala@linux.intel.com\n\nFixes: 0aedb1626566 (\"drm/i915: Don't skip request retirement if the active list is empty\")\nAcked-by: Ville Syrjälä <ville.syrjala@linux.intel.com>\nSigned-off-by: Jani Nikula <jani.nikula@intel.com>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nRevert \"drm/radeon: Use drm_calloc_ab for CS relocs\"\n\nThis reverts commit 961bd13539b9e7ca5d2e667668141496b7a1d6bc.\n\nBoth Satoshi-san and Cal reported a kernel crash due to this commit.\n\nReported-by: Satoshi Iwamoto <satoshi.iwamoto@nifty.ne.jp>\nReported-by: Cal Peake <cp@absolutedigital.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndrm/radeon: partially revert \"fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling\"\n\ncommit 7c0411d2fabc2e2702c9871ffb603e251158b317 upstream.\n\nWe have that bug for years and some users report side effects when fixing it on older hardware.\n\nSo revert it for VM_CONTEXT0_PAGE_TABLE_END_ADDR, but keep it for VM 1-15.\n\nSigned-off-by: Christian König <christian.koenig@amd.com>\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\n[lizf: Backported to 3.4: drop the change to clk.c]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ncrypto: s390/ghash: Fix incorrect backport of a1cae34e23b1\n\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nARM: Fix incorrect backport of 0b59d8806a31\n\nReported-by: Jim Faulkner <jfaulkne@ccs.neu.edu>\nFixed-by: Nicolas Schichan <nschichan@freebox.fr>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\njbd2: avoid infinite loop when destroying aborted journal\n\ncommit 841df7df196237ea63233f0f9eaa41db53afd70f upstream.\n\nCommit 6f6a6fda2945 \"jbd2: fix ocfs2 corrupt when updating journal\nsuperblock fails\" changed jbd2_cleanup_journal_tail() to return EIO\nwhen the journal is aborted. That makes logic in\njbd2_log_do_checkpoint() bail out which is fine, except that\njbd2_journal_destroy() expects jbd2_log_do_checkpoint() to always make\na progress in cleaning the journal. Without it jbd2_journal_destroy()\njust loops in an infinite loop.\n\nFix jbd2_journal_destroy() to cleanup journal checkpoint lists of\njbd2_log_do_checkpoint() fails with error.\n\nReported-by: Eryu Guan <guaneryu@gmail.com>\nTested-by: Eryu Guan <guaneryu@gmail.com>\nFixes: 6f6a6fda294506dfe0e3e0a253bb2d2923f28f0a\nSigned-off-by: Jan Kara <jack@suse.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nIB/qib: Change lkey table allocation to support more MRs\n\ncommit d6f1c17e162b2a11e708f28fa93f2f79c164b442 upstream.\n\nThe lkey table is allocated with with a get_user_pages() with an\norder based on a number of index bits from a module parameter.\n\nThe underlying kernel code cannot allocate that many contiguous pages.\n\nThere is no reason the underlying memory needs to be physically\ncontiguous.\n\nThis patch:\n- switches the allocation/deallocation to vmalloc/vfree\n- caps the number of bits to 23 to insure at least 1 generation bit\n  o this matches the module parameter description\n\nReviewed-by: Vinit Agnihotri <vinit.abhay.agnihotri@intel.com>\nSigned-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>\nSigned-off-by: Doug Ledford <dledford@redhat.com>\n[bwh: Backported to 3.2:\n - Adjust context\n - Add definition of qib_dev_warn(), added upstream by commit ddb887658970\n   (\"IB/qib: Convert opcode counters to per-context\")]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndcache: Handle escaped paths in prepend_path\n\ncommit cde93be45a8a90d8c264c776fab63487b5038a65 upstream.\n\nA rename can result in a dentry that by walking up d_parent\nwill never reach it's mnt_root.  For lack of a better term\nI call this an escaped path.\n\nprepend_path is called by four different functions __d_path,\nd_absolute_path, d_path, and getcwd.\n\n__d_path only wants to see paths are connected to the root it passes\nin.  So __d_path needs prepend_path to return an error.\n\nd_absolute_path similarly wants to see paths that are connected to\nsome root.  Escaped paths are not connected to any mnt_root so\nd_absolute_path needs prepend_path to return an error greater\nthan 1.  So escaped paths will be treated like paths on lazily\nunmounted mounts.\n\ngetcwd needs to prepend \"(unreachable)\" so getcwd also needs\nprepend_path to return an error.\n\nd_path is the interesting hold out.  d_path just wants to print\nsomething, and does not care about the weird cases.  Which raises\nthe question what should be printed?\n\nGiven that <escaped_path>/<anything> should result in -ENOENT I\nbelieve it is desirable for escaped paths to be printed as empty\npaths.  As there are not really any meaninful path components when\nconsidered from the perspective of a mount tree.\n\nSo tweak prepend_path to return an empty path with an new error\ncode of 3 when it encounters an escaped path.\n\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nvfs: Test for and handle paths that are unreachable from their mnt_root\n\ncommit 397d425dc26da728396e66d392d5dcb8dac30c37 upstream.\n\nIn rare cases a directory can be renamed out from under a bind mount.\nIn those cases without special handling it becomes possible to walk up\nthe directory tree to the root dentry of the filesystem and down\nfrom the root dentry to every other file or directory on the filesystem.\n\nLike division by zero .. from an unconnected path can not be given\na useful semantic as there is no predicting at which path component\nthe code will realize it is unconnected.  We certainly can not match\nthe current behavior as the current behavior is a security hole.\n\nTherefore when encounting .. when following an unconnected path\nreturn -ENOENT.\n\n- Add a function path_connected to verify path->dentry is reachable\n  from path->mnt.mnt_root.  AKA to validate that rename did not do\n  something nasty to the bind mount.\n\n  To avoid races path_connected must be called after following a path\n  component to it's next path component.\n\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\n\nFailing to send a CLOSE if file is opened WRONLY and server reboots on a 4.x mount\n\ncommit a41cbe86df3afbc82311a1640e20858c0cd7e065 upstream.\n\nA test case is as the description says:\nopen(foobar, O_WRONLY);\nsleep()  --> reboot the server\nclose(foobar)\n\nThe bug is because in nfs4state.c in nfs4_reclaim_open_state() a few\nline before going to restart, there is\nclear_bit(NFS4CLNT_RECLAIM_NOGRACE, &state->flags).\n\nNFS4CLNT_RECLAIM_NOGRACE is a flag for the client states not open\nowner states. Value of NFS4CLNT_RECLAIM_NOGRACE is 4 which is the\nvalue of NFS_O_WRONLY_STATE in nfs4_state->flags. So clearing it wipes\nout state and when we go to close it, “call_close” doesn’t get set as\nstate flag is not set and CLOSE doesn’t go on the wire.\n\nSigned-off-by: Olga Kornievskaia <aglo@umich.edu>\nSigned-off-by: Trond Myklebust <trond.myklebust@primarydata.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\nSigned-off-by: Monish <monishk10@yahoo.com>","distinct":true,"url":"https://api.github.com/repos/monishk10/moshi_cancro/commits/847fa31ef2e9e9aa060d708a2c7474139dc44721"},{"sha":"6a6ef9a2c8694fa9a993338ffe5e58a3ca693e44","author":{"email":"2aba97547a300946d493987d7b87c9f21a8831db@yahoo.com","name":"Monish"},"message":"Defconfig changes ->3.4.110\n\nSigned-off-by: Monish <monishk10@yahoo.com>","distinct":true,"url":"https://api.github.com/repos/monishk10/moshi_cancro/commits/6a6ef9a2c8694fa9a993338ffe5e58a3ca693e44"}]}