{"push_id":1576143816,"size":24,"distinct_size":1,"ref":"refs/heads/odroidxu4-mdrjr-4.9.y","head":"5bd505235281d077015de112d1a5707fa437ad80","before":"929b5a1e4f9b2b4aa5be41a6acd22435bb47338a","commits":[{"sha":"166a2464cdcf20d4809cc8bb4004241816393a7f","author":{"name":"Miklos Szeredi","email":"c27ee2952768e22f4d3ab9aec0e78ac5f4ddea98@redhat.com"},"message":"vfs: fix uninitialized flags in splice_to_pipe()\n\ncommit 5a81e6a171cdbd1fa8bc1fdd80c23d3d71816fac upstream.\n\nFlags (PIPE_BUF_FLAG_PACKET, PIPE_BUF_FLAG_GIFT) could remain on the\nunused part of the pipe ring buffer.  Previously splice_to_pipe() left\nthe flags value alone, which could result in incorrect behavior.\n\nUninitialized flags appears to have been there from the introduction of\nthe splice syscall.\n\nSigned-off-by: Miklos Szeredi <mszeredi@redhat.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/166a2464cdcf20d4809cc8bb4004241816393a7f"},{"sha":"6cf921be8fb98351b4b394d5c03a5ff718a0e679","author":{"name":"Mauro Carvalho Chehab","email":"ea19850a825a0b2eb1de0168fb2a06f5170bd9e2@s-opensource.com"},"message":"siano: make it work again with CONFIG_VMAP_STACK\n\ncommit f9c85ee67164b37f9296eab3b754e543e4e96a1c upstream.\n\nReported as a Kaffeine bug:\n\thttps://bugs.kde.org/show_bug.cgi?id=375811\n\nThe USB control messages require DMA to work. We cannot pass\na stack-allocated buffer, as it is not warranted that the\nstack would be into a DMA enabled area.\n\nOn Kernel 4.9, the default is to not accept DMA on stack anymore\non x86 architecture. On other architectures, this has been a\nrequirement since Kernel 2.2. So, after this patch, this driver\nshould likely work fine on all archs.\n\nTested with USB ID 2040:5510: Hauppauge Windham\n\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/6cf921be8fb98351b4b394d5c03a5ff718a0e679"},{"sha":"7283448f8273e661c09001909345af2e41fc4a5f","author":{"name":"Sahitya Tummala","email":"b7bf508aab3e5632db28abf288bf9b4635713caf@codeaurora.org"},"message":"fuse: fix use after free issue in fuse_dev_do_read()\n\ncommit 6ba4d2722d06960102c981322035239cd66f7316 upstream.\n\nThere is a potential race between fuse_dev_do_write()\nand request_wait_answer() contexts as shown below:\n\nTASK 1:\n__fuse_request_send():\n  |--spin_lock(&fiq->waitq.lock);\n  |--queue_request();\n  |--spin_unlock(&fiq->waitq.lock);\n  |--request_wait_answer():\n       |--if (test_bit(FR_SENT, &req->flags))\n       <gets pre-empted after it is validated true>\n                                   TASK 2:\n                                   fuse_dev_do_write():\n                                     |--clears bit FR_SENT,\n                                     |--request_end():\n                                        |--sets bit FR_FINISHED\n                                        |--spin_lock(&fiq->waitq.lock);\n                                        |--list_del_init(&req->intr_entry);\n                                        |--spin_unlock(&fiq->waitq.lock);\n                                        |--fuse_put_request();\n       |--queue_interrupt();\n       <request gets queued to interrupts list>\n            |--wake_up_locked(&fiq->waitq);\n       |--wait_event_freezable();\n       <as FR_FINISHED is set, it returns and then\n       the caller frees this request>\n\nNow, the next fuse_dev_do_read(), see interrupts list is not empty\nand then calls fuse_read_interrupt() which tries to access the request\nwhich is already free'd and gets the below crash:\n\n[11432.401266] Unable to handle kernel paging request at virtual address\n6b6b6b6b6b6b6b6b\n...\n[11432.418518] Kernel BUG at ffffff80083720e0\n[11432.456168] PC is at __list_del_entry+0x6c/0xc4\n[11432.463573] LR is at fuse_dev_do_read+0x1ac/0x474\n...\n[11432.679999] [<ffffff80083720e0>] __list_del_entry+0x6c/0xc4\n[11432.687794] [<ffffff80082c65e0>] fuse_dev_do_read+0x1ac/0x474\n[11432.693180] [<ffffff80082c6b14>] fuse_dev_read+0x6c/0x78\n[11432.699082] [<ffffff80081d5638>] __vfs_read+0xc0/0xe8\n[11432.704459] [<ffffff80081d5efc>] vfs_read+0x90/0x108\n[11432.709406] [<ffffff80081d67f0>] SyS_read+0x58/0x94\n\nAs FR_FINISHED bit is set before deleting the intr_entry with input\nqueue lock in request completion path, do the testing of this flag and\nqueueing atomically with the same lock in queue_interrupt().\n\nSigned-off-by: Sahitya Tummala <stummala@codeaurora.org>\nSigned-off-by: Miklos Szeredi <mszeredi@redhat.com>\nFixes: fd22d62ed0c3 (\"fuse: no fc->lock for iqueue parts\")\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/7283448f8273e661c09001909345af2e41fc4a5f"},{"sha":"80a0477665d050e6e8aed0519f62a691a573fd07","author":{"name":"Miklos Szeredi","email":"c27ee2952768e22f4d3ab9aec0e78ac5f4ddea98@redhat.com"},"message":"fuse: fix uninitialized flags in pipe_buffer\n\ncommit 84588a93d097bace24b9233930f82511d4f34210 upstream.\n\nSigned-off-by: Miklos Szeredi <mszeredi@redhat.com>\nFixes: d82718e348fe (\"fuse_dev_splice_read(): switch to add_to_pipe()\")\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/80a0477665d050e6e8aed0519f62a691a573fd07"},{"sha":"ef746a305de321a117723e664d57f7f4c2e2ac99","author":{"name":"Anssi Hannula","email":"1b4c071b3f3bf02e24b0834e519d7627bef136a7@bitwise.fi"},"message":"mmc: core: fix multi-bit bus width without high-speed mode\n\ncommit 3d4ef329757cfd5e0b23cce97cdeca7e2df89c99 upstream.\n\nCommit 577fb13199b1 (\"mmc: rework selection of bus speed mode\")\nrefactored bus width selection code to mmc_select_bus_width().\n\nHowever, it also altered the behavior to not call the selection code in\nnon-high-speed modes anymore.\n\nThis causes 1-bit mode to always be used when the high-speed mode is not\nenabled, even though 4-bit and 8-bit bus are valid bus widths in the\nbackwards-compatibility (legacy) mode as well (see e.g. 5.3.2 Bus Speed\nModes in JEDEC 84-B50). This results in a significant regression in\ntransfer speeds.\n\nFix the code to allow 4-bit and 8-bit widths even without high-speed\nmode, as before.\n\nTested with a Zynq-7000 PicoZed 7020 board.\n\nFixes: 577fb13199b1 (\"mmc: rework selection of bus speed mode\")\nSigned-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>\nSigned-off-by: Ulf Hansson <ulf.hansson@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/ef746a305de321a117723e664d57f7f4c2e2ac99"},{"sha":"920b60aa3cc2ca5b1f018bbd06f66cdf06b6eac7","author":{"name":"Paul Mackerras","email":"b848d7d196719b06ca69c3524d28631335b2ab79@ozlabs.org"},"message":"powerpc/64: Disable use of radix under a hypervisor\n\ncommit 3f91a89d424a79f8082525db5a375e438887bb3e upstream.\n\nCurrently, if the kernel is running on a POWER9 processor under a\nhypervisor, it may try to use the radix MMU even though it doesn't have\nthe necessary code to do so (it doesn't negotiate use of radix, and it\ndoesn't do the H_REGISTER_PROC_TBL hcall).  If the hypervisor supports\nboth radix and HPT, then it will set up the guest to use HPT (since the\nguest doesn't request radix in the CAS call), but if the radix feature\nbit is set in the ibm,pa-features property (which is valid, since\nibm,pa-features is defined to represent the capabilities of the\nprocessor) the guest will try to use radix, resulting in a crash when\nit turns the MMU on.\n\nThis makes the minimal fix for the current code, which is to disable\nradix unless we are running in hypervisor mode.\n\nFixes: 2bfd65e45e87 (\"powerpc/mm/radix: Add radix callbacks for early init routines\")\nSigned-off-by: Paul Mackerras <paulus@ozlabs.org>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/920b60aa3cc2ca5b1f018bbd06f66cdf06b6eac7"},{"sha":"a026c97e8824cdc0d9574e360128b0c2bb0355a5","author":{"name":"Johannes Thumshirn","email":"d9c2033816690d520874e8fc0d5751e487468597@suse.de"},"message":"scsi: don't BUG_ON() empty DMA transfers\n\ncommit fd3fc0b4d7305fa7246622dcc0dec69c42443f45 upstream.\n\nDon't crash the machine just because of an empty transfer. Use WARN_ON()\ncombined with returning an error.\n\nFound by Dmitry Vyukov and syzkaller.\n\n[ Changed to \"WARN_ON_ONCE()\". Al has a patch that should fix the root\n  cause, but a BUG_ON() is not acceptable in any case, and a WARN_ON()\n  might still be a cause of excessive log spamming.\n\n  NOTE! If this warning ever triggers, we may end up leaking resources,\n  since this doesn't bother to try to clean the command up. So this\n  WARN_ON_ONCE() triggering does imply real problems. But BUG_ON() is\n  much worse.\n\n  People really need to stop using BUG_ON() for \"this shouldn't ever\n  happen\". It makes pretty much any bug worse.     - Linus ]\n\nSigned-off-by: Johannes Thumshirn <jthumshirn@suse.de>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: James Bottomley <jejb@linux.vnet.ibm.com>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/a026c97e8824cdc0d9574e360128b0c2bb0355a5"},{"sha":"a975e8e81e5533786b2120d053203b47e07d6c1d","author":{"name":"Al Viro","email":"2a537e97523ffee458777df5f34a2f8c9964f945@ZenIV.linux.org.uk"},"message":"Fix missing sanity check in /dev/sg\n\ncommit 137d01df511b3afe1f05499aea05f3bafc0fb221 upstream.\n\nWhat happens is that a write to /dev/sg is given a request with non-zero\n->iovec_count combined with zero ->dxfer_len.  Or with ->dxferp pointing\nto an array full of empty iovecs.\n\nHaving write permission to /dev/sg shouldn't be equivalent to the\nability to trigger BUG_ON() while holding spinlocks...\n\nFound by Dmitry Vyukov and syzkaller.\n\n[ The BUG_ON() got changed to a WARN_ON_ONCE(), but this fixes the\n  underlying issue.  - Linus ]\n\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nReviewed-by: Christoph Hellwig <hch@lst.de>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/a975e8e81e5533786b2120d053203b47e07d6c1d"},{"sha":"19d2d869d00e37004e6c49ed0384167f701b3bdd","author":{"name":"IHARA Hiroka","email":"e9015150552134ec9a86f812613116c82502f75c@live.jp"},"message":"Input: elan_i2c - add ELAN0605 to the ACPI table\n\ncommit 722c5ac708b4f5c1fcfad5fed4c95234c8b06590 upstream.\n\nELAN0605 has been confirmed to be a variant of ELAN0600, which is\nblacklisted in the hid-core to be managed by elan_i2c. This device can be\nfound in Lenovo ideapad 310s (80U4000).\n\nSigned-off-by: Hiroka IHARA <ihara_h@live.jp>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/19d2d869d00e37004e6c49ed0384167f701b3bdd"},{"sha":"7499da90c0ccaabea9b2b71f3f9c5603585715db","author":{"name":"Michel Dänzer","email":"04e02e363b23f600e6da8ae785c28c5ce9396c71@amd.com"},"message":"drm/radeon: Use mode h/vdisplay fields to hide out of bounds HW cursor\n\ncommit d74c67dd7800fc7aae381f272875c337f268806c upstream.\n\nThe crtc_h/vdisplay fields may not match the CRTC viewport dimensions\nwith special modes such as interlaced ones.\n\nFixes the HW cursor disappearing in the bottom half of the screen with\ninterlaced modes.\n\nFixes: 6b16cf7785a4 (\"drm/radeon: Hide the HW cursor while it's out of bounds\")\nReported-by: Ashutosh Kumar <ashutosh.kumar@amd.com>\nTested-by: Sonny Jiang <sonny.jiang@amd.com>\nReviewed-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Michel Dänzer <michel.daenzer@amd.com>\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/7499da90c0ccaabea9b2b71f3f9c5603585715db"},{"sha":"dfe8f5757ec4889bff8e534d44db0a3ecfac11eb","author":{"name":"Pierre-Louis Bossart","email":"2275b185d55a2f0d0d05e3b2f2d9bbd1bbef63d1@linux.intel.com"},"message":"drm/dp/mst: fix kernel oops when turning off secondary monitor\n\ncommit bb08c04dc867b5f392caec635c097d5d5fcd8c9f upstream.\n\n100% reproducible issue found on SKL SkullCanyon NUC with two external\nDP daisy-chained monitors in DP/MST mode. When turning off or changing\nthe input of the second monitor the machine stops with a kernel\noops. This issue happened with 4.8.8 as well as drm/drm-intel-nightly.\n\nThis issue is traced to an inconsistent control flow in\ndrm_dp_update_payload_part1(): the 'port' pointer is set to NULL at the\nsame time as 'req_payload.num_slots' is set to zero, but the pointer is\ndereferenced even when req_payload.num_slot is zero.\n\nThe problematic dereference was introduced in commit dfda0df34\n(\"drm/mst: rework payload table allocation to conform better\") and may\nimpact all versions since v3.18\n\nThe fix suggested by Chris Wilson removes the kernel oops and was found to\nwork well after 10mn of monkey-testing with the second monitor power and\ninput buttons\n\nBugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98990\nFixes: dfda0df34264 (\"drm/mst: rework payload table allocation to conform better.\")\nCc: Dave Airlie <airlied@redhat.com>\nCc: Chris Wilson <chris@chris-wilson.co.uk>\nCc: Nathan D Ciobanu <nathan.d.ciobanu@linux.intel.com>\nCc: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>\nCc: Sean Paul <seanpaul@chromium.org>\nTested-by: Nathan D Ciobanu <nathan.d.ciobanu@linux.intel.com>\nReviewed-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>\nSigned-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>\nSigned-off-by: Jani Nikula <jani.nikula@intel.com>\nLink: http://patchwork.freedesktop.org/patch/msgid/1487076561-2169-1-git-send-email-jani.nikula@intel.com\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/dfe8f5757ec4889bff8e534d44db0a3ecfac11eb"},{"sha":"808de347ebd45575e12c2f20bebbdf4233270952","author":{"name":"Yang Yang","email":"0bd27d56950584a54d98c22681c76fa81edbc5c9@zte.com.cn"},"message":"futex: Move futex_init() to core_initcall\n\ncommit 25f71d1c3e98ef0e52371746220d66458eac75bc upstream.\n\nThe UEVENT user mode helper is enabled before the initcalls are executed\nand is available when the root filesystem has been mounted.\n\nThe user mode helper is triggered by device init calls and the executable\nmight use the futex syscall.\n\nfutex_init() is marked __initcall which maps to device_initcall, but there\nis no guarantee that futex_init() is invoked _before_ the first device init\ncall which triggers the UEVENT user mode helper.\n\nIf the user mode helper uses the futex syscall before futex_init() then the\nsyscall crashes with a NULL pointer dereference because the futex subsystem\nhas not been initialized yet.\n\nMove futex_init() to core_initcall so futexes are initialized before the\nroot filesystem is mounted and the usermode helper becomes available.\n\n[ tglx: Rewrote changelog ]\n\nSigned-off-by: Yang Yang <yang.yang29@zte.com.cn>\nCc: jiang.biao2@zte.com.cn\nCc: jiang.zhengxiong@zte.com.cn\nCc: zhong.weidong@zte.com.cn\nCc: deng.huali@zte.com.cn\nCc: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/r/1483085875-6130-1-git-send-email-yang.yang29@zte.com.cn\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/808de347ebd45575e12c2f20bebbdf4233270952"},{"sha":"17c443421458ea699e044bf2903c236aabbe304a","author":{"name":"Kees Cook","email":"999bfbbf6e15a9d6aba3dfebadcec55340f87c3f@chromium.org"},"message":"ARM: 8658/1: uaccess: fix zeroing of 64-bit get_user()\n\ncommit 9e3440481845b2ec22508f60837ee2cab2b6054f upstream.\n\nThe 64-bit get_user() wasn't clearing the high word due to a typo in the\nerror handler. The exception handler entry was already correct, though.\nNoticed during recent usercopy test additions in lib/test_user_copy.c.\n\nSigned-off-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: Russell King <rmk+kernel@armlinux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/17c443421458ea699e044bf2903c236aabbe304a"},{"sha":"48a41582788243a0258a3e2462bd6e06a18900cc","author":{"name":"Jarkko Nikula","email":"3289860d32dee0033f845597987235550e76fa15@linux.intel.com"},"message":"Revert \"i2c: designware: detect when dynamic tar update is possible\"\n\ncommit 12688dc21f71f4dcc9e2b8b5556b0c6cc8df1491 upstream.\n\nThis reverts commit 63d0f0a6952a1a02bc4f116b7da7c7887e46efa3.\n\nIt caused a regression on platforms where I2C controller is synthesized\nwith dynamic TAR update disabled. Detection code is testing is bit\nDW_IC_CON_10BITADDR_MASTER in register DW_IC_CON read-only but fails to\nrestore original value in case bit is read-write.\n\nInstead of fixing this we revert the commit since it was preparation for\nthe commit 0317e6c0f1dc (\"i2c: designware: do not disable adapter after\ntransfer\") which was also reverted.\n\nReported-by: Shah Nehal-Bakulchandra <Nehal-bakulchandra.Shah@amd.com>\nReported-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>\nAcked-By: Lucas De Marchi <lucas.demarchi@intel.com>\nFixes: 63d0f0a6952a (\"i2c: designware: detect when dynamic tar update is possible\")\nSigned-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>\nSigned-off-by: Wolfram Sang <wsa@the-dreams.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/48a41582788243a0258a3e2462bd6e06a18900cc"},{"sha":"5c3765bbc1dbc54b6805e834deed0008e9afc1dd","author":{"name":"Yinghai Lu","email":"a937ac6bd902974249c050ded6c056a9879800aa@kernel.org"},"message":"PCI/PME: Restore pcie_pme_driver.remove\n\ncommit afe3e4d11bdf50a4c3965eb6465ba6bebbcf5dcf upstream.\n\nIn addition to making PME non-modular, d7def2040077 (\"PCI/PME: Make\nexplicitly non-modular\") removed the pcie_pme_driver .remove() method,\npcie_pme_remove().\n\npcie_pme_remove() freed the PME IRQ that was requested in pci_pme_probe().\nThe fact that we don't free the IRQ after d7def2040077 causes the following\ncrash when removing a PCIe port device via /sys:\n\n  ------------[ cut here ]------------\n  kernel BUG at drivers/pci/msi.c:370!\n  invalid opcode: 0000 [#1] SMP\n  Modules linked in:\n  CPU: 1 PID: 14509 Comm: sh Tainted: G    W  4.8.0-rc1-yh-00012-gd29438d\n  RIP: 0010:[<ffffffff9758bbf5>]  free_msi_irqs+0x65/0x190\n  ...\n  Call Trace:\n   [<ffffffff9758cda4>] pci_disable_msi+0x34/0x40\n   [<ffffffff97583817>] cleanup_service_irqs+0x27/0x30\n   [<ffffffff97583e9a>] pcie_port_device_remove+0x2a/0x40\n   [<ffffffff97584250>] pcie_portdrv_remove+0x40/0x50\n   [<ffffffff97576d7b>] pci_device_remove+0x4b/0xc0\n   [<ffffffff9785ebe6>] __device_release_driver+0xb6/0x150\n   [<ffffffff9785eca5>] device_release_driver+0x25/0x40\n   [<ffffffff975702e4>] pci_stop_bus_device+0x74/0xa0\n   [<ffffffff975704ea>] pci_stop_and_remove_bus_device_locked+0x1a/0x30\n   [<ffffffff97578810>] remove_store+0x50/0x70\n   [<ffffffff9785a378>] dev_attr_store+0x18/0x30\n   [<ffffffff97260b64>] sysfs_kf_write+0x44/0x60\n   [<ffffffff9725feae>] kernfs_fop_write+0x10e/0x190\n   [<ffffffff971e13f8>] __vfs_write+0x28/0x110\n   [<ffffffff970b0fa4>] ? percpu_down_read+0x44/0x80\n   [<ffffffff971e53a7>] ? __sb_start_write+0xa7/0xe0\n   [<ffffffff971e53a7>] ? __sb_start_write+0xa7/0xe0\n   [<ffffffff971e1f04>] vfs_write+0xc4/0x180\n   [<ffffffff971e3089>] SyS_write+0x49/0xa0\n   [<ffffffff97001a46>] do_syscall_64+0xa6/0x1b0\n   [<ffffffff9819201e>] entry_SYSCALL64_slow_path+0x25/0x25\n  ...\n   RIP  [<ffffffff9758bbf5>] free_msi_irqs+0x65/0x190\n   RSP <ffff89ad3085bc48>\n  ---[ end trace f4505e1dac5b95d3 ]---\n  Segmentation fault\n\nRestore pcie_pme_remove().\n\n[bhelgaas: changelog]\nFixes: d7def2040077 (\"PCI/PME: Make explicitly non-modular\")\nSigned-off-by: Yinghai Lu <yinghai@kernel.org>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nAcked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/5c3765bbc1dbc54b6805e834deed0008e9afc1dd"},{"sha":"7ee210365adf1cfc0b5c3ca9fc7b55241e7fd225","author":{"name":"Sergey Senozhatsky","email":"570a3d76c58b9b54de6bb70914e873361b66b749@gmail.com"},"message":"printk: use rcuidle console tracepoint\n\ncommit fc98c3c8c9dcafd67adcce69e6ce3191d5306c9c upstream.\n\nUse rcuidle console tracepoint because, apparently, it may be issued\nfrom an idle CPU:\n\n  hw-breakpoint: Failed to enable monitor mode on CPU 0.\n  hw-breakpoint: CPU 0 failed to disable vector catch\n\n  ===============================\n  [ ERR: suspicious RCU usage.  ]\n  4.10.0-rc8-next-20170215+ #119 Not tainted\n  -------------------------------\n  ./include/trace/events/printk.h:32 suspicious rcu_dereference_check() usage!\n\n  other info that might help us debug this:\n\n  RCU used illegally from idle CPU!\n  rcu_scheduler_active = 2, debug_locks = 0\n  RCU used illegally from extended quiescent state!\n  2 locks held by swapper/0/0:\n   #0:  (cpu_pm_notifier_lock){......}, at: [<c0237e2c>] cpu_pm_exit+0x10/0x54\n   #1:  (console_lock){+.+.+.}, at: [<c01ab350>] vprintk_emit+0x264/0x474\n\n  stack backtrace:\n  CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.10.0-rc8-next-20170215+ #119\n  Hardware name: Generic OMAP4 (Flattened Device Tree)\n    console_unlock\n    vprintk_emit\n    vprintk_default\n    printk\n    reset_ctrl_regs\n    dbg_cpu_pm_notify\n    notifier_call_chain\n    cpu_pm_exit\n    omap_enter_idle_coupled\n    cpuidle_enter_state\n    cpuidle_enter_state_coupled\n    do_idle\n    cpu_startup_entry\n    start_kernel\n\nThis RCU warning, however, is suppressed by lockdep_off() in printk().\nlockdep_off() increments the ->lockdep_recursion counter and thus\ndisables RCU_LOCKDEP_WARN() and debug_lockdep_rcu_enabled(), which want\nlockdep to be enabled \"current->lockdep_recursion == 0\".\n\nLink: http://lkml.kernel.org/r/20170217015932.11898-1-sergey.senozhatsky@gmail.com\nSigned-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>\nReported-by: Tony Lindgren <tony@atomide.com>\nTested-by: Tony Lindgren <tony@atomide.com>\nAcked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>\nAcked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nCc: Petr Mladek <pmladek@suse.com>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Tony Lindgren <tony@atomide.com>\nCc: Russell King <rmk@armlinux.org.uk>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/7ee210365adf1cfc0b5c3ca9fc7b55241e7fd225"},{"sha":"215d4d62ccfd585854b17f621342762784dde8c3","author":{"name":"Sergey Senozhatsky","email":"570a3d76c58b9b54de6bb70914e873361b66b749@gmail.com"},"message":"timekeeping: Use deferred printk() in debug code\n\ncommit f222449c9dfad7c9bb8cb53e64c5c407b172ebbc upstream.\n\nWe cannot do printk() from tk_debug_account_sleep_time(), because\ntk_debug_account_sleep_time() is called under tk_core seq lock.\nThe reason why printk() is unsafe there is that console_sem may\ninvoke scheduler (up()->wake_up_process()->activate_task()), which,\nin turn, can return back to timekeeping code, for instance, via\nget_time()->ktime_get(), deadlocking the system on tk_core seq lock.\n\n[   48.950592] ======================================================\n[   48.950622] [ INFO: possible circular locking dependency detected ]\n[   48.950622] 4.10.0-rc7-next-20170213+ #101 Not tainted\n[   48.950622] -------------------------------------------------------\n[   48.950622] kworker/0:0/3 is trying to acquire lock:\n[   48.950653]  (tk_core){----..}, at: [<c01cc624>] retrigger_next_event+0x4c/0x90\n[   48.950683]\n               but task is already holding lock:\n[   48.950683]  (hrtimer_bases.lock){-.-...}, at: [<c01cc610>] retrigger_next_event+0x38/0x90\n[   48.950714]\n               which lock already depends on the new lock.\n\n[   48.950714]\n               the existing dependency chain (in reverse order) is:\n[   48.950714]\n               -> #5 (hrtimer_bases.lock){-.-...}:\n[   48.950744]        _raw_spin_lock_irqsave+0x50/0x64\n[   48.950775]        lock_hrtimer_base+0x28/0x58\n[   48.950775]        hrtimer_start_range_ns+0x20/0x5c8\n[   48.950775]        __enqueue_rt_entity+0x320/0x360\n[   48.950805]        enqueue_rt_entity+0x2c/0x44\n[   48.950805]        enqueue_task_rt+0x24/0x94\n[   48.950836]        ttwu_do_activate+0x54/0xc0\n[   48.950836]        try_to_wake_up+0x248/0x5c8\n[   48.950836]        __setup_irq+0x420/0x5f0\n[   48.950836]        request_threaded_irq+0xdc/0x184\n[   48.950866]        devm_request_threaded_irq+0x58/0xa4\n[   48.950866]        omap_i2c_probe+0x530/0x6a0\n[   48.950897]        platform_drv_probe+0x50/0xb0\n[   48.950897]        driver_probe_device+0x1f8/0x2cc\n[   48.950897]        __driver_attach+0xc0/0xc4\n[   48.950927]        bus_for_each_dev+0x6c/0xa0\n[   48.950927]        bus_add_driver+0x100/0x210\n[   48.950927]        driver_register+0x78/0xf4\n[   48.950958]        do_one_initcall+0x3c/0x16c\n[   48.950958]        kernel_init_freeable+0x20c/0x2d8\n[   48.950958]        kernel_init+0x8/0x110\n[   48.950988]        ret_from_fork+0x14/0x24\n[   48.950988]\n               -> #4 (&rt_b->rt_runtime_lock){-.-...}:\n[   48.951019]        _raw_spin_lock+0x40/0x50\n[   48.951019]        rq_offline_rt+0x9c/0x2bc\n[   48.951019]        set_rq_offline.part.2+0x2c/0x58\n[   48.951049]        rq_attach_root+0x134/0x144\n[   48.951049]        cpu_attach_domain+0x18c/0x6f4\n[   48.951049]        build_sched_domains+0xba4/0xd80\n[   48.951080]        sched_init_smp+0x68/0x10c\n[   48.951080]        kernel_init_freeable+0x160/0x2d8\n[   48.951080]        kernel_init+0x8/0x110\n[   48.951080]        ret_from_fork+0x14/0x24\n[   48.951110]\n               -> #3 (&rq->lock){-.-.-.}:\n[   48.951110]        _raw_spin_lock+0x40/0x50\n[   48.951141]        task_fork_fair+0x30/0x124\n[   48.951141]        sched_fork+0x194/0x2e0\n[   48.951141]        copy_process.part.5+0x448/0x1a20\n[   48.951171]        _do_fork+0x98/0x7e8\n[   48.951171]        kernel_thread+0x2c/0x34\n[   48.951171]        rest_init+0x1c/0x18c\n[   48.951202]        start_kernel+0x35c/0x3d4\n[   48.951202]        0x8000807c\n[   48.951202]\n               -> #2 (&p->pi_lock){-.-.-.}:\n[   48.951232]        _raw_spin_lock_irqsave+0x50/0x64\n[   48.951232]        try_to_wake_up+0x30/0x5c8\n[   48.951232]        up+0x4c/0x60\n[   48.951263]        __up_console_sem+0x2c/0x58\n[   48.951263]        console_unlock+0x3b4/0x650\n[   48.951263]        vprintk_emit+0x270/0x474\n[   48.951293]        vprintk_default+0x20/0x28\n[   48.951293]        printk+0x20/0x30\n[   48.951324]        kauditd_hold_skb+0x94/0xb8\n[   48.951324]        kauditd_thread+0x1a4/0x56c\n[   48.951324]        kthread+0x104/0x148\n[   48.951354]        ret_from_fork+0x14/0x24\n[   48.951354]\n               -> #1 ((console_sem).lock){-.....}:\n[   48.951385]        _raw_spin_lock_irqsave+0x50/0x64\n[   48.951385]        down_trylock+0xc/0x2c\n[   48.951385]        __down_trylock_console_sem+0x24/0x80\n[   48.951385]        console_trylock+0x10/0x8c\n[   48.951416]        vprintk_emit+0x264/0x474\n[   48.951416]        vprintk_default+0x20/0x28\n[   48.951416]        printk+0x20/0x30\n[   48.951446]        tk_debug_account_sleep_time+0x5c/0x70\n[   48.951446]        __timekeeping_inject_sleeptime.constprop.3+0x170/0x1a0\n[   48.951446]        timekeeping_resume+0x218/0x23c\n[   48.951477]        syscore_resume+0x94/0x42c\n[   48.951477]        suspend_enter+0x554/0x9b4\n[   48.951477]        suspend_devices_and_enter+0xd8/0x4b4\n[   48.951507]        enter_state+0x934/0xbd4\n[   48.951507]        pm_suspend+0x14/0x70\n[   48.951507]        state_store+0x68/0xc8\n[   48.951538]        kernfs_fop_write+0xf4/0x1f8\n[   48.951538]        __vfs_write+0x1c/0x114\n[   48.951538]        vfs_write+0xa0/0x168\n[   48.951568]        SyS_write+0x3c/0x90\n[   48.951568]        __sys_trace_return+0x0/0x10\n[   48.951568]\n               -> #0 (tk_core){----..}:\n[   48.951599]        lock_acquire+0xe0/0x294\n[   48.951599]        ktime_get_update_offsets_now+0x5c/0x1d4\n[   48.951629]        retrigger_next_event+0x4c/0x90\n[   48.951629]        on_each_cpu+0x40/0x7c\n[   48.951629]        clock_was_set_work+0x14/0x20\n[   48.951660]        process_one_work+0x2b4/0x808\n[   48.951660]        worker_thread+0x3c/0x550\n[   48.951660]        kthread+0x104/0x148\n[   48.951690]        ret_from_fork+0x14/0x24\n[   48.951690]\n               other info that might help us debug this:\n\n[   48.951690] Chain exists of:\n                 tk_core --> &rt_b->rt_runtime_lock --> hrtimer_bases.lock\n\n[   48.951721]  Possible unsafe locking scenario:\n\n[   48.951721]        CPU0                    CPU1\n[   48.951721]        ----                    ----\n[   48.951721]   lock(hrtimer_bases.lock);\n[   48.951751]                                lock(&rt_b->rt_runtime_lock);\n[   48.951751]                                lock(hrtimer_bases.lock);\n[   48.951751]   lock(tk_core);\n[   48.951782]\n                *** DEADLOCK ***\n\n[   48.951782] 3 locks held by kworker/0:0/3:\n[   48.951782]  #0:  (\"events\"){.+.+.+}, at: [<c0156590>] process_one_work+0x1f8/0x808\n[   48.951812]  #1:  (hrtimer_work){+.+...}, at: [<c0156590>] process_one_work+0x1f8/0x808\n[   48.951843]  #2:  (hrtimer_bases.lock){-.-...}, at: [<c01cc610>] retrigger_next_event+0x38/0x90\n[   48.951843]   stack backtrace:\n[   48.951873] CPU: 0 PID: 3 Comm: kworker/0:0 Not tainted 4.10.0-rc7-next-20170213+\n[   48.951904] Workqueue: events clock_was_set_work\n[   48.951904] [<c0110208>] (unwind_backtrace) from [<c010c224>] (show_stack+0x10/0x14)\n[   48.951934] [<c010c224>] (show_stack) from [<c04ca6c0>] (dump_stack+0xac/0xe0)\n[   48.951934] [<c04ca6c0>] (dump_stack) from [<c019b5cc>] (print_circular_bug+0x1d0/0x308)\n[   48.951965] [<c019b5cc>] (print_circular_bug) from [<c019d2a8>] (validate_chain+0xf50/0x1324)\n[   48.951965] [<c019d2a8>] (validate_chain) from [<c019ec18>] (__lock_acquire+0x468/0x7e8)\n[   48.951995] [<c019ec18>] (__lock_acquire) from [<c019f634>] (lock_acquire+0xe0/0x294)\n[   48.951995] [<c019f634>] (lock_acquire) from [<c01d0ea0>] (ktime_get_update_offsets_now+0x5c/0x1d4)\n[   48.952026] [<c01d0ea0>] (ktime_get_update_offsets_now) from [<c01cc624>] (retrigger_next_event+0x4c/0x90)\n[   48.952026] [<c01cc624>] (retrigger_next_event) from [<c01e4e24>] (on_each_cpu+0x40/0x7c)\n[   48.952056] [<c01e4e24>] (on_each_cpu) from [<c01cafc4>] (clock_was_set_work+0x14/0x20)\n[   48.952056] [<c01cafc4>] (clock_was_set_work) from [<c015664c>] (process_one_work+0x2b4/0x808)\n[   48.952087] [<c015664c>] (process_one_work) from [<c0157774>] (worker_thread+0x3c/0x550)\n[   48.952087] [<c0157774>] (worker_thread) from [<c015d644>] (kthread+0x104/0x148)\n[   48.952087] [<c015d644>] (kthread) from [<c0107830>] (ret_from_fork+0x14/0x24)\n\nReplace printk() with printk_deferred(), which does not call into\nthe scheduler.\n\nFixes: 0bf43f15db85 (\"timekeeping: Prints the amounts of time spent during suspend\")\nReported-and-tested-by: Tony Lindgren <tony@atomide.com>\nSigned-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>\nCc: Petr Mladek <pmladek@suse.com>\nCc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: \"Rafael J . Wysocki\" <rjw@rjwysocki.net>\nCc: Steven Rostedt <rostedt@goodmis.org>\nCc: John Stultz <john.stultz@linaro.org>\nLink: http://lkml.kernel.org/r/20170215044332.30449-1-sergey.senozhatsky@gmail.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/215d4d62ccfd585854b17f621342762784dde8c3"},{"sha":"43325382fc7a216f2087d7dfdc662e30e952adf1","author":{"name":"Allen Hubbe","email":"7daa6ac9835de563baa952a173b9517eb688ecdf@dell.com"},"message":"NTB: ntb_transport: fix debugfs_remove_recursive\n\ncommit dd62245e73de9138333cb0e7a42c8bc1215c3ce6 upstream.\n\nThe call to debugfs_remove_recursive(qp->debugfs_dir) of the sub-level\ndirectory must not be later than\ndebugfs_remove_recursive(nt_debugfs_dir) of the top-level directory.\nOtherwise, the sub-level directory will not exist, and it would be\ninvalid (panic) to attempt to remove it.  This removes the top-level\ndirectory last, after sub-level directories have been cleaned up.\n\nSigned-off-by: Allen Hubbe <Allen.Hubbe@dell.com>\nFixes: e26a5843f (\"NTB: Split ntb_hw_intel and ntb_transport drivers\")\nSigned-off-by: Jon Mason <jdmason@kudzu.us>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/43325382fc7a216f2087d7dfdc662e30e952adf1"},{"sha":"f4202601509465c3d2e96b6bfd4a1237ac4268d1","author":{"name":"Dave Jiang","email":"5304e2b965dc776590d7d213427d123c2b919f82@intel.com"},"message":"ntb: ntb_perf missing dmaengine_unmap_put\n\ncommit 9644347c5240d0ee3ba7472ef332aaa4ff4db398 upstream.\n\nIn the normal I/O execution path, ntb_perf is missing a call to\ndmaengine_unmap_put() after submission. That causes us to leak\nunmap objects.\n\nSigned-off-by: Dave Jiang <dave.jiang@intel.com>\nFixes: 8a7b6a77 (\"ntb: ntb perf tool\")\nSigned-off-by: Jon Mason <jdmason@kudzu.us>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/f4202601509465c3d2e96b6bfd4a1237ac4268d1"},{"sha":"68214ad3926c7dd829e2f810b6af6fe7c76fd3da","author":{"name":"Thomas VanSelus","email":"258fde3b26a6652bca590f1d599e245f6147bd1f@xes-inc.com"},"message":"ntb_transport: Pick an unused queue\n\ncommit 8fcd0950c021d7be8493280541332b924b9de962 upstream.\n\nFix typo causing ntb_transport_create_queue to select the first\nqueue every time, instead of using the next free queue.\n\nSigned-off-by: Thomas VanSelus <tvanselus@xes-inc.com>\nSigned-off-by: Aaron Sierra <asierra@xes-inc.com>\nAcked-by: Allen Hubbe <Allen.Hubbe@dell.com>\nFixes: fce8a7bb5 (\"PCI-Express Non-Transparent Bridge Support\")\nSigned-off-by: Jon Mason <jdmason@kudzu.us>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Dmole/linux/commits/68214ad3926c7dd829e2f810b6af6fe7c76fd3da"}]}
{"actor":{"display_login":"Dmole"}}