origin

GIT 4469942

commit fc1a812
Author: Alex Williamson <[email protected]>
Date:   Tue Aug 4 10:58:26 2015 -0600

    KVM: MTRR: Use default type for non-MTRR-covered gfn before WARN_ON
    
    The patch was munged on commit to re-order these tests resulting in
    excessive warnings when trying to do device assignment.  Return to
    original ordering: https://lkml.org/lkml/2015/7/15/769
    
    Fixes: 3e5d2fd ("KVM: MTRR: simplify kvm_mtrr_get_guest_memory_type")
    Signed-off-by: Alex Williamson <[email protected]>
    Reviewed-by: Xiao Guangrong <[email protected]>
    Signed-off-by: Paolo Bonzini <[email protected]>

commit ecf5fc6
Author: Michal Hocko <[email protected]>
Date:   Tue Aug 4 14:36:58 2015 -0700

    mm, vmscan: Do not wait for page writeback for GFP_NOFS allocations
    
    Nikolay has reported a hang when a memcg reclaim got stuck with the
    following backtrace:
    
    PID: 18308  TASK: ffff883d7c9b0a30  CPU: 1   COMMAND: "rsync"
      #0 __schedule at ffffffff815ab152
      #1 schedule at ffffffff815ab76e
      #2 schedule_timeout at ffffffff815ae5e5
      #3 io_schedule_timeout at ffffffff815aad6a
      #4 bit_wait_io at ffffffff815abfc6
      #5 __wait_on_bit at ffffffff815abda5
      torvalds#6 wait_on_page_bit at ffffffff8111fd4f
      torvalds#7 shrink_page_list at ffffffff81135445
      torvalds#8 shrink_inactive_list at ffffffff81135845
      torvalds#9 shrink_lruvec at ffffffff81135ead
     torvalds#10 shrink_zone at ffffffff811360c3
     torvalds#11 shrink_zones at ffffffff81136eff
     torvalds#12 do_try_to_free_pages at ffffffff8113712f
     torvalds#13 try_to_free_mem_cgroup_pages at ffffffff811372be
     torvalds#14 try_charge at ffffffff81189423
     torvalds#15 mem_cgroup_try_charge at ffffffff8118c6f5
     torvalds#16 __add_to_page_cache_locked at ffffffff8112137d
     torvalds#17 add_to_page_cache_lru at ffffffff81121618
     torvalds#18 pagecache_get_page at ffffffff8112170b
     torvalds#19 grow_dev_page at ffffffff811c8297
     torvalds#20 __getblk_slow at ffffffff811c91d6
     torvalds#21 __getblk_gfp at ffffffff811c92c1
     torvalds#22 ext4_ext_grow_indepth at ffffffff8124565c
     torvalds#23 ext4_ext_create_new_leaf at ffffffff81246ca8
     torvalds#24 ext4_ext_insert_extent at ffffffff81246f09
     torvalds#25 ext4_ext_map_blocks at ffffffff8124a848
     torvalds#26 ext4_map_blocks at ffffffff8121a5b7
     torvalds#27 mpage_map_one_extent at ffffffff8121b1fa
     torvalds#28 mpage_map_and_submit_extent at ffffffff8121f07b
     torvalds#29 ext4_writepages at ffffffff8121f6d5
     torvalds#30 do_writepages at ffffffff8112c490
     torvalds#31 __filemap_fdatawrite_range at ffffffff81120199
     torvalds#32 filemap_flush at ffffffff8112041c
     torvalds#33 ext4_alloc_da_blocks at ffffffff81219da1
     torvalds#34 ext4_rename at ffffffff81229b91
     torvalds#35 ext4_rename2 at ffffffff81229e32
     torvalds#36 vfs_rename at ffffffff811a08a5
     torvalds#37 SYSC_renameat2 at ffffffff811a3ffc
     torvalds#38 sys_renameat2 at ffffffff811a408e
     torvalds#39 sys_rename at ffffffff8119e51e
     torvalds#40 system_call_fastpath at ffffffff815afa89
    
    Dave Chinner has properly pointed out that this is a deadlock in the
    reclaim code because ext4 doesn't submit pages which are marked by
    PG_writeback right away.
    
    The heuristic was introduced by commit e62e384 ("memcg: prevent OOM
    with too many dirty pages") and it was applied only when may_enter_fs
    was specified.  The code has been changed by c3b94f4 ("memcg:
    further prevent OOM with too many dirty pages") which has removed the
    __GFP_FS restriction with a reasoning that we do not get into the fs
    code.  But this is not sufficient apparently because the fs doesn't
    necessarily submit pages marked PG_writeback for IO right away.
    
    ext4_bio_write_page calls io_submit_add_bh but that doesn't necessarily
    submit the bio.  Instead it tries to map more pages into the bio and
    mpage_map_one_extent might trigger memcg charge which might end up
    waiting on a page which is marked PG_writeback but hasn't been submitted
    yet so we would end up waiting for something that never finishes.
    
    Fix this issue by replacing __GFP_IO by may_enter_fs check (for case 2)
    before we go to wait on the writeback.  The page fault path, which is
    the only path that triggers memcg oom killer since 3.12, shouldn't
    require GFP_NOFS and so we shouldn't reintroduce the premature OOM
    killer issue which was originally addressed by the heuristic.
    
    As per David Chinner the xfs is doing similar thing since 2.6.15 already
    so ext4 is not the only affected filesystem.  Moreover he notes:
    
    : For example: IO completion might require unwritten extent conversion
    : which executes filesystem transactions and GFP_NOFS allocations. The
    : writeback flag on the pages can not be cleared until unwritten
    : extent conversion completes. Hence memory reclaim cannot wait on
    : page writeback to complete in GFP_NOFS context because it is not
    : safe to do so, memcg reclaim or otherwise.
    
    Cc: [email protected] # 3.9+
    [[email protected]: corrected the control flow]
    Fixes: c3b94f4 ("memcg: further prevent OOM with too many dirty pages")
    Reported-by: Nikolay Borisov <[email protected]>
    Signed-off-by: Michal Hocko <[email protected]>
    Signed-off-by: Hugh Dickins <[email protected]>
    Signed-off-by: Linus Torvalds <[email protected]>

commit fcdf31a
Author: Ross Lagerwall <[email protected]>
Date:   Fri Jul 31 14:30:42 2015 +0100

    xen/events/fifo: Handle linked events when closing a port
    
    An event channel bound to a CPU that was offlined may still be linked
    on that CPU's queue.  If this event channel is closed and reused,
    subsequent events will be lost because the event channel is never
    unlinked and thus cannot be linked onto the correct queue.
    
    When a channel is closed and the event is still linked into a queue,
    ensure that it is unlinked before completing.
    
    If the CPU to which the event channel bound is online, spin until the
    event is handled by that CPU. If that CPU is offline, it can't handle
    the event, so clear the event queue during the close, dropping the
    events.
    
    This fixes the missing interrupts (and subsequent disk stalls etc.)
    when offlining a CPU.
    
    Signed-off-by: Ross Lagerwall <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: David Vrabel <[email protected]>

commit 6ea76f3
Author: Daniel Vetter <[email protected]>
Date:   Mon Aug 3 17:24:11 2015 +0200

    drm/atomic-helpers: Make encoder picking more robust
    
    We've had a few issues with atomic where subtle bugs in the encoder
    picking logic lead to accidental self-stealing of the encoder,
    resulting in a NULL connector_state->crtc in update_connector_routing
    and subsequent.
    
    Linus applied some duct-tape for an mst regression in
    
    commit 27667f4
    Author: Linus Torvalds <[email protected]>
    Date:   Wed Jul 29 22:18:16 2015 -0700
    
        i915: temporary fix for DP MST docking station NULL pointer dereference
    
    But that was incomplete (the code will still oops when debuggin is
    enabled) and mangled the state even further. So instead WARN and bail
    out as the more future-proof option.
    
    Cc: Theodore Ts'o <[email protected]>
    Cc: Linus Torvalds <[email protected]>
    Reviewed-by: Thierry Reding <[email protected]>
    Reviewed-by: Ander Conselvan de Oliveira <[email protected]>
    Signed-off-by: Daniel Vetter <[email protected]>

commit 42639ba
Author: Daniel Vetter <[email protected]>
Date:   Mon Aug 3 17:24:10 2015 +0200

    drm/dp-mst: Remove debug WARN_ON
    
    Apparently been in there since forever and fairly easy to hit when
    hotplugging really fast. I can do that since my mst hub has a manual
    button to flick the hpd line for reprobing. The resulting WARNING spam
    isn't pretty.
    
    Cc: Dave Airlie <[email protected]>
    Cc: [email protected]
    Reviewed-by: Thierry Reding <[email protected]>
    Reviewed-by: Ander Conselvan de Oliveira <[email protected]>
    Signed-off-by: Daniel Vetter <[email protected]>

commit 459485a
Author: Daniel Vetter <[email protected]>
Date:   Mon Aug 3 17:24:09 2015 +0200

    drm/i915: Fixup dp mst encoder selection
    
    In
    
    commit 8c7b5cc
    Author: Ander Conselvan de Oliveira <[email protected]>
    Date:   Tue Apr 21 17:13:19 2015 +0300
    
        drm/i915: Use atomic helpers for computing changed flags
    
    we've switched over to the atomic version to compute the
    crtc->encoder->connector routing from the i915 variant. That one
    relies upon the ->best_encoder callback, but the i915-private version
    relied upon intel_find_encoder. Which didn't matter except for dp mst,
    where the encoder depends upon the selected crtc.
    
    Fix this functional bug by implemented a correct atomic-state based
    encoder selector for dp mst.
    
    Note that we can't get rid of the legacy best_encoder callback since
    the fbdev emulation uses that still. That means it's incorrect there
    still, but that's been the case ever since i915 dp mst support was
    merged so not a regression. Best to fix that by converting fbdev over
    to atomic too.
    
    Cc: Chris Wilson <[email protected]>
    Cc: Linus Torvalds <[email protected]>
    Cc: Theodore Ts'o <[email protected]>
    Reviewed-by: Ander Conselvan de Oliveira <[email protected]>
    Signed-off-by: Daniel Vetter <[email protected]>

commit 3b8a684
Author: Daniel Vetter <[email protected]>
Date:   Mon Aug 3 17:24:08 2015 +0200

    drm/atomic-helper: Add an atomice best_encoder callback
    
    With legacy helpers all the routing was already set up when calling
    best_encoder and so could be inspected. But with atomic it's staged,
    hence we need a new atomic compliant callback for drivers which need
    to inspect the requested state and can't just decided the best encoder
    statically.
    
    This is needed to fix up i915 dp mst where we need to pick the right
    encoder depending upon the requested CRTC for the connector.
    
    v2: Don't forget to amend the kerneldoc
    
    Cc: Chris Wilson <[email protected]>
    Cc: Linus Torvalds <[email protected]>
    Cc: Theodore Ts'o <[email protected]>
    Acked-by: Thierry Reding <[email protected]>
    Reviewed-by: Ander Conselvan de Oliveira <[email protected]>
    Signed-off-by: Daniel Vetter <[email protected]>

commit 5413fcd
Author: Salvatore Mesoraca <[email protected]>
Date:   Mon Aug 3 12:40:51 2015 +0200

    Adding YAMA hooks also when YAMA is not stacked.
    
    Without this patch YAMA will not work at all if it is chosen
    as the primary LSM instead of being "stacked".
    
    Signed-off-by: Salvatore Mesoraca <[email protected]>
    Acked-by: Kees Cook <[email protected]>
    Signed-off-by: James Morris <[email protected]>

commit 49895bc
Author: NeilBrown <[email protected]>
Date:   Mon Aug 3 17:09:57 2015 +1000

    md/raid5: don't let shrink_slab shrink too far.
    
    I have a report of drop_one_stripe() called from
    raid5_cache_scan() apparently finding ->max_nr_stripes == 0.
    
    This should not be allowed.
    
    So add a test to keep max_nr_stripes above min_nr_stripes.
    
    Also use a 'mask' rather than a 'mod' in drop_one_stripe
    to ensure 'hash' is valid even if max_nr_stripes does reach zero.
    
    
    Fixes: edbe83a ("md/raid5: allow the stripe_cache to grow and shrink.")
    Cc: [email protected] (4.1 - please release with 2d5b569)
    Reported-by: Tomas Papan <[email protected]>
    Signed-off-by: NeilBrown <[email protected]>

commit b6878d9
Author: Benjamin Randazzo <[email protected]>
Date:   Sat Jul 25 16:36:50 2015 +0200

    md: use kzalloc() when bitmap is disabled
    
    In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a
    mdu_bitmap_file_t called "file".
    
    5769         file = kmalloc(sizeof(*file), GFP_NOIO);
    5770         if (!file)
    5771                 return -ENOMEM;
    
    This structure is copied to user space at the end of the function.
    
    5786         if (err == 0 &&
    5787             copy_to_user(arg, file, sizeof(*file)))
    5788                 err = -EFAULT
    
    But if bitmap is disabled only the first byte of "file" is initialized
    with zero, so it's possible to read some bytes (up to 4095) of kernel
    space memory from user space. This is an information leak.
    
    5775         /* bitmap disabled, zero the first byte and copy out */
    5776         if (!mddev->bitmap_info.file)
    5777                 file->pathname[0] = '\0';
    
    Signed-off-by: Benjamin Randazzo <[email protected]>
    Signed-off-by: NeilBrown <[email protected]>

commit 423f04d
Author: NeilBrown <[email protected]>
Date:   Mon Jul 27 11:48:52 2015 +1000

    md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies
    
    raid1_end_read_request() assumes that the In_sync bits are consistent
    with the ->degaded count.
    raid1_spare_active updates the In_sync bit before the ->degraded count
    and so exposes an inconsistency, as does error()
    So extend the spinlock in raid1_spare_active() and error() to hide those
    inconsistencies.
    
    This should probably be part of
      Commit: 34cab6f ("md/raid1: fix test for 'was read error from
      last working device'.")
    as it addresses the same issue.  It fixes the same bug and should go
    to -stable for same reasons.
    
    Fixes: 7607305 ("md/raid1: clean up read_balance.")
    Cc: [email protected] (v3.0+)
    Signed-off-by: NeilBrown <[email protected]>

commit e331146
Author: Vladimir Zapolskiy <[email protected]>
Date:   Mon Jul 27 17:30:48 2015 +0300

    i2c: fix leaked device refcount on of_find_i2c_* error path
    
    If of_find_i2c_device_by_node() or of_find_i2c_adapter_by_node() find
    a device by node, but its type does not match, a reference to that
    device is still held. This change fixes the problem.
    
    Signed-off-by: Vladimir Zapolskiy <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit 8fcd461
Author: Jeff Layton <[email protected]>
Date:   Thu Jul 30 06:57:46 2015 -0400

    nfsd: do nfs4_check_fh in nfs4_check_file instead of nfs4_check_olstateid
    
    Currently, preprocess_stateid_op calls nfs4_check_olstateid which
    verifies that the open stateid corresponds to the current filehandle in the
    call by calling nfs4_check_fh.
    
    If the stateid is a NFS4_DELEG_STID however, then no such check is done.
    This could cause incorrect enforcement of permissions, because the
    nfsd_permission() call in nfs4_check_file uses current the current
    filehandle, but any subsequent IO operation will use the file descriptor
    in the stateid.
    
    Move the call to nfs4_check_fh into nfs4_check_file instead so that it
    can be done for all stateid types.
    
    Signed-off-by: Jeff Layton <[email protected]>
    Cc: [email protected]
    [bfields: moved fh check to avoid NULL deref in special stateid case]
    Signed-off-by: J. Bruce Fields <[email protected]>

commit e952849
Author: Masanari Iida <[email protected]>
Date:   Tue Jul 28 20:11:23 2015 +0900

    i2c: Fix typo in i2c-bfin-twi.c
    
    This patch fix some typos found in a printk message and
    MODULE_DESCRIPTION.
    
    Signed-off-by: Masanari Iida <[email protected]>
    Acked-by: Sonic Zhang <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit 828e66c
Author: Jan Luebbe <[email protected]>
Date:   Wed Jul 8 16:35:27 2015 +0200

    i2c: omap: fix bus recovery setup
    
    At least on the AM335x, enabling OMAP_I2C_SYSTEST_ST_EN is not enough to
    allow direct access to the SCL and SDA pins. In addition to ST_EN, we
    need to set the TMODE to 0b11 (Loop back & SDA/SCL IO mode select).
    Also, as the reset values of SCL_O and SDA_O are 0 (which means "drive
    low level"), we need to set them to 1 (which means "high-impedance") to
    avoid unwanted changes on the pins.
    
    As a precaution, reset all these bits to their default values after
    recovery is complete.
    
    Signed-off-by: Jan Luebbe <[email protected]>
    Tested-by: Alexander Sverdlin <[email protected]>
    Reviewed-by: Grygorii Strashko <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit 8b06260
Author: Jan Luebbe <[email protected]>
Date:   Wed Jul 8 16:35:06 2015 +0200

    i2c: core: only use set_scl for bus recovery after calling prepare_recovery
    
    Using set_scl may be ineffective before calling the driver specific
    prepare_recovery callback, which might change into a test mode. So
    instead of setting SCL in i2c_generic_scl_recovery, move it to
    i2c_generic_recovery (after the optional prepare_recovery).
    
    Signed-off-by: Jan Luebbe <[email protected]>
    Acked-by: Alexander Sverdlin <[email protected]>
    Tested-by: Alexander Sverdlin <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit d12c0aa
Author: Vladimir Zapolskiy <[email protected]>
Date:   Mon Jul 27 00:18:51 2015 +0300

    misc: eeprom: at24: clean up at24_bin_write()
    
    The change removes redundant sysfs binary file boundary check, since
    this task is already done on caller side in fs/sysfs/file.c
    
    Signed-off-by: Vladimir Zapolskiy <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit 1f02329
Author: Vladimir Zapolskiy <[email protected]>
Date:   Mon Jul 27 00:16:31 2015 +0300

    i2c: slave eeprom: clean up sysfs bin attribute read()/write()
    
    The change removes redundant sysfs binary file boundary checks,
    since this task is already done on caller side in fs/sysfs/file.c
    
    Note, on file size overflow read() now returns 0, and this is a
    correct and expected EOF notification according to POSIX.
    
    Signed-off-by: Vladimir Zapolskiy <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit 2761713
Author: Ilya Dryomov <[email protected]>
Date:   Thu Jul 16 17:36:11 2015 +0300

    rbd: fix copyup completion race
    
    For write/discard obj_requests that involved a copyup method call, the
    opcode of the first op is CEPH_OSD_OP_CALL and the ->callback is
    rbd_img_obj_copyup_callback().  The latter frees copyup pages, sets
    ->xferred and delegates to rbd_img_obj_callback(), the "normal" image
    object callback, for reporting to block layer and putting refs.
    
    rbd_osd_req_callback() however treats CEPH_OSD_OP_CALL as a trivial op,
    which means obj_request is marked done in rbd_osd_trivial_callback(),
    *before* ->callback is invoked and rbd_img_obj_copyup_callback() has
    a chance to run.  Marking obj_request done essentially means giving
    rbd_img_obj_callback() a license to end it at any moment, so if another
    obj_request from the same img_request is being completed concurrently,
    rbd_img_obj_end_request() may very well be called on such prematurally
    marked done request:
    
    <obj_request-1/2 reply>
    handle_reply()
      rbd_osd_req_callback()
        rbd_osd_trivial_callback()
        rbd_obj_request_complete()
        rbd_img_obj_copyup_callback()
        rbd_img_obj_callback()
                                        <obj_request-2/2 reply>
                                        handle_reply()
                                          rbd_osd_req_callback()
                                            rbd_osd_trivial_callback()
          for_each_obj_request(obj_request->img_request) {
            rbd_img_obj_end_request(obj_request-1/2)
            rbd_img_obj_end_request(obj_request-2/2) <--
          }
    
    Calling rbd_img_obj_end_request() on such a request leads to trouble,
    in particular because its ->xfferred is 0.  We report 0 to the block
    layer with blk_update_request(), get back 1 for "this request has more
    data in flight" and then trip on
    
        rbd_assert(more ^ (which == img_request->obj_request_count));
    
    with rhs (which == ...) being 1 because rbd_img_obj_end_request() has
    been called for both requests and lhs (more) being 1 because we haven't
    got a chance to set ->xfferred in rbd_img_obj_copyup_callback() yet.
    
    To fix this, leverage that rbd wants to call class methods in only two
    cases: one is a generic method call wrapper (obj_request is standalone)
    and the other is a copyup (obj_request is part of an img_request).  So
    make a dedicated handler for CEPH_OSD_OP_CALL and directly invoke
    rbd_img_obj_copyup_callback() from it if obj_request is part of an
    img_request, similar to how CEPH_OSD_OP_READ handler invokes
    rbd_img_obj_request_read_callback().
    
    Since rbd_img_obj_copyup_callback() is now being called from the OSD
    request callback (only), it is renamed to rbd_osd_copyup_callback().
    
    Cc: Alex Elder <[email protected]>
    Cc: [email protected] # 3.10+, needs backporting for < 3.18
    Signed-off-by: Ilya Dryomov <[email protected]>
    Reviewed-by: Alex Elder <[email protected]>

commit fc927cd
Author: Yan, Zheng <[email protected]>
Date:   Mon Jul 20 09:50:58 2015 +0800

    ceph: always re-send cap flushes when MDS recovers
    
    commit e548e9b makes the kclient
    only re-send cap flush once during MDS failover. If the kclient sends
    a cap flush after MDS enters reconnect stage but before MDS recovers.
    The kclient will skip re-sending the same cap flush when MDS recovers.
    
    This causes problem for newly created inode. The MDS handles cap
    flushes before replaying unsafe requests, so it's possible that MDS
    find corresponding inode is missing when handling cap flush. The fix
    is reverting to old behaviour: always re-send when MDS recovers
    
    Signed-off-by: Yan, Zheng <[email protected]>
    Signed-off-by: Ilya Dryomov <[email protected]>

commit f6762cb
Author: Yan, Zheng <[email protected]>
Date:   Tue Jul 7 16:18:46 2015 +0800

    ceph: fix ceph_encode_locks_to_buffer()
    
    posix locks should be in ctx->flc_posix list
    
    Signed-off-by: Yan, Zheng <[email protected]>
    Signed-off-by: Ilya Dryomov <[email protected]>

commit 586b7cc
Author: Christian Borntraeger <[email protected]>
Date:   Tue Jul 28 15:03:05 2015 +0200

    KVM: s390: Fix hang VCPU hang/loop regression
    
    commit 785dbef ("KVM: s390: optimize round trip time in request
    handling") introduced a regression. This regression was seen with
    CPU hotplug in the guest and switching between 1 or 2 CPUs. This will
    set/reset the IBS control via synced request.
    
    Whenever we make a synced request, we first set the vcpu->requests
    bit and then block the vcpu. The handler, on the other hand, unblocks
    itself, processes vcpu->requests (by clearing them) and unblocks itself
    once again.
    
    Now, if the requester sleeps between setting of vcpu->requests and
    blocking, the handler will clear the vcpu->requests bit and try to
    unblock itself (although no bit is set). When the requester wakes up,
    it blocks the VCPU and we have a blocked VCPU without requests.
    
    Solution is to always unset the block bit.
    
    Signed-off-by: Christian Borntraeger <[email protected]>
    Reviewed-by: David Hildenbrand <[email protected]>
    Fixes: 785dbef ("KVM: s390: optimize round trip time in request handling")

commit fe0d34d
Author: Rusty Russell <[email protected]>
Date:   Wed Jul 29 05:52:14 2015 +0930

    module: weaken locking assertion for oops path.
    
    We don't actually hold the module_mutex when calling find_module_all
    from module_kallsyms_lookup_name: that's because it's used by the oops
    code and we don't want to deadlock.
    
    However, access to the list read-only is safe if preempt is disabled,
    so we can weaken the assertion.  Keep a strong version for external
    callers though.
    
    Fixes: 0be964b ("module: Sanitize RCU usage and locking")
    Reported-by: He Kuang <[email protected]>
    Cc: [email protected]
    Acked-by: Peter Zijlstra (Intel) <[email protected]>
    Signed-off-by: Rusty Russell <[email protected]>

commit 17fb874
Author: Martin Schwidefsky <[email protected]>
Date:   Fri Jul 24 13:13:30 2015 +0200

    hwrng: core - correct error check of kthread_run call
    
    The kthread_run() function can return two different error values
    but the hwrng core only checks for -ENOMEM. If the other error
    value -EINTR is returned it is assigned to hwrng_fill and later
    used on a kthread_stop() call which naturally crashes.
    
    Cc: [email protected]
    Signed-off-by: Martin Schwidefsky <[email protected]>
    Signed-off-by: Herbert Xu <[email protected]>

commit f898c52
Author: Herbert Xu <[email protected]>
Date:   Wed Jul 22 18:05:35 2015 +0800

    crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer
    
    This patch removes a bogus BUG_ON in the ablkcipher path that
    triggers when the destination buffer is different from the source
    buffer and is scattered.
    
    Cc: [email protected]
    Signed-off-by: Herbert Xu <[email protected]>

commit 6f043b5
Author: Tadeusz Struk <[email protected]>
Date:   Tue Jul 21 22:07:47 2015 -0700

    crypto: qat - Fix invalid synchronization between register/unregister sym algs
    
    The synchronization method used atomic was bogus.
    Use a proper synchronization with mutex.
    
    Cc: [email protected]
    Signed-off-by: Tadeusz Struk <[email protected]>
    Signed-off-by: Herbert Xu <[email protected]>

commit 3d1450d
Author: Jason A. Donenfeld <[email protected]>
Date:   Tue Jul 7 20:26:07 2015 +0200

    Makefile: Force gzip and xz on module install
    
    Running `make modules_install` ordinarily will overwrite existing
    modules. This is the desired behavior, and is how pretty much every
    other `make install` target works.
    
    However, if CONFIG_MODULE_COMPRESS is enabled, modules are passed
    through gzip and xz which then do the file writing. Both gzip and xz
    will error out if the file already exists, unless -f is passed.
    
    This patch adds -f so that the behavior is uniform.
    
    Signed-off-by: Jason A. Donenfeld <[email protected]>
    Signed-off-by: Michal Marek <[email protected]>

commit 6dd3f13
Author: Michal Marek <[email protected]>
Date:   Thu Jul 16 18:23:53 2015 +0200

    kbuild: Do not pick up ARCH_{CPP,A,C}FLAGS from the environment
    
    Initialize the ARCH_* overrides before including the arch Makefile, to
    avoid picking up the values from the environment. The variables can
    still be overriden on the make command line, but this won't happen
    by accident.
    
    Signed-off-by: Michal Marek <[email protected]>

commit 1ca4b88
Author: Kinglong Mee <[email protected]>
Date:   Thu Jul 9 17:38:26 2015 +0800

    nfsd: Fix a file leak on nfsd4_layout_setlease failure
    
    If nfsd4_layout_setlease fails, nfsd will not put ls->ls_file.
    
    Fix commit c5c707f "nfsd: implement pNFS layout recalls".
    
    Signed-off-by: Kinglong Mee <[email protected]>
    Signed-off-by: J. Bruce Fields <[email protected]>

commit c2227a3
Author: Kinglong Mee <[email protected]>
Date:   Tue Jul 7 10:16:37 2015 +0800

    nfsd: Drop BUG_ON and ignore SECLABEL on absent filesystem
    
    On an absent filesystem (one served by another server), we need to be
    able to handle requests for certain attributest (like fs_locations, so
    the client can find out which server does have the filesystem), but
    others we can't.
    
    We forgot to take that into account when adding another attribute
    bitmask work for the SECURITY_LABEL attribute.
    
    There an export entry with the "refer" option can result in:
    
    [   88.414272] kernel BUG at fs/nfsd/nfs4xdr.c:2249!
    [   88.414828] invalid opcode: 0000 [#1] SMP
    [   88.415368] Modules linked in: rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache nfsd xfs libcrc32c iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi iosf_mbi ppdev btrfs coretemp crct10dif_pclmul crc32_pclmul crc32c_intel xor ghash_clmulni_intel raid6_pq vmw_balloon parport_pc parport i2c_piix4 shpchp vmw_vmci acpi_cpufreq auth_rpcgss nfs_acl lockd grace sunrpc vmwgfx drm_kms_helper ttm drm mptspi mptscsih serio_raw mptbase e1000 scsi_transport_spi ata_generic pata_acpi [last unloaded: nfsd]
    [   88.417827] CPU: 0 PID: 2116 Comm: nfsd Not tainted 4.0.7-300.fc22.x86_64 #1
    [   88.418448] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/20/2014
    [   88.419093] task: ffff880079146d50 ti: ffff8800785d8000 task.ti: ffff8800785d8000
    [   88.419729] RIP: 0010:[<ffffffffa04b3c10>]  [<ffffffffa04b3c10>] nfsd4_encode_fattr+0x820/0x1f00 [nfsd]
    [   88.420376] RSP: 0000:ffff8800785db998  EFLAGS: 00010206
    [   88.421027] RAX: 0000000000000001 RBX: 000000000018091a RCX: ffff88006668b980
    [   88.421676] RDX: 00000000fffef7fc RSI: 0000000000000000 RDI: ffff880078d05000
    [   88.422315] RBP: ffff8800785dbb58 R08: ffff880078d043f8 R09: ffff880078d4a000
    [   88.422968] R10: 0000000000010000 R11: 0000000000000002 R12: 0000000000b0a23a
    [   88.423612] R13: ffff880078d05000 R14: ffff880078683100 R15: ffff88006668b980
    [   88.424295] FS:  0000000000000000(0000) GS:ffff88007c600000(0000) knlGS:0000000000000000
    [   88.424944] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [   88.425597] CR2: 00007f40bc370f90 CR3: 0000000035af5000 CR4: 00000000001407f0
    [   88.426285] Stack:
    [   88.426921]  ffff8800785dbaa8 ffffffffa049e4af ffff8800785dba08 ffffffff813298f0
    [   88.427585]  ffff880078683300 ffff8800769b0de8 0000089d00000001 0000000087f805e0
    [   88.428228]  ffff880000000000 ffff880079434a00 0000000000000000 ffff88006668b980
    [   88.428877] Call Trace:
    [   88.429527]  [<ffffffffa049e4af>] ? exp_get_by_name+0x7f/0xb0 [nfsd]
    [   88.430168]  [<ffffffff813298f0>] ? inode_doinit_with_dentry+0x210/0x6a0
    [   88.430807]  [<ffffffff8123833e>] ? d_lookup+0x2e/0x60
    [   88.431449]  [<ffffffff81236133>] ? dput+0x33/0x230
    [   88.432097]  [<ffffffff8123f214>] ? mntput+0x24/0x40
    [   88.432719]  [<ffffffff812272b2>] ? path_put+0x22/0x30
    [   88.433340]  [<ffffffffa049ac87>] ? nfsd_cross_mnt+0xb7/0x1c0 [nfsd]
    [   88.433954]  [<ffffffffa04b54e0>] nfsd4_encode_dirent+0x1b0/0x3d0 [nfsd]
    [   88.434601]  [<ffffffffa04b5330>] ? nfsd4_encode_getattr+0x40/0x40 [nfsd]
    [   88.435172]  [<ffffffffa049c991>] nfsd_readdir+0x1c1/0x2a0 [nfsd]
    [   88.435710]  [<ffffffffa049a530>] ? nfsd_direct_splice_actor+0x20/0x20 [nfsd]
    [   88.436447]  [<ffffffffa04abf30>] nfsd4_encode_readdir+0x120/0x220 [nfsd]
    [   88.437011]  [<ffffffffa04b58cd>] nfsd4_encode_operation+0x7d/0x190 [nfsd]
    [   88.437566]  [<ffffffffa04aa6dd>] nfsd4_proc_compound+0x24d/0x6f0 [nfsd]
    [   88.438157]  [<ffffffffa0496103>] nfsd_dispatch+0xc3/0x220 [nfsd]
    [   88.438680]  [<ffffffffa006f0cb>] svc_process_common+0x43b/0x690 [sunrpc]
    [   88.439192]  [<ffffffffa0070493>] svc_process+0x103/0x1b0 [sunrpc]
    [   88.439694]  [<ffffffffa0495a57>] nfsd+0x117/0x190 [nfsd]
    [   88.440194]  [<ffffffffa0495940>] ? nfsd_destroy+0x90/0x90 [nfsd]
    [   88.440697]  [<ffffffff810bb728>] kthread+0xd8/0xf0
    [   88.441260]  [<ffffffff810bb650>] ? kthread_worker_fn+0x180/0x180
    [   88.441762]  [<ffffffff81789e58>] ret_from_fork+0x58/0x90
    [   88.442322]  [<ffffffff810bb650>] ? kthread_worker_fn+0x180/0x180
    [   88.442879] Code: 0f 84 93 05 00 00 83 f8 ea c7 85 a0 fe ff ff 00 00 27 30 0f 84 ba fe ff ff 85 c0 0f 85 a5 fe ff ff e9 e3 f9 ff ff 0f 1f 44 00 00 <0f> 0b 66 0f 1f 44 00 00 be 04 00 00 00 4c 89 ef 4c 89 8d 68 fe
    [   88.444052] RIP  [<ffffffffa04b3c10>] nfsd4_encode_fattr+0x820/0x1f00 [nfsd]
    [   88.444658]  RSP <ffff8800785db998>
    [   88.445232] ---[ end trace 6cb9d0487d94a29f ]---
    
    Signed-off-by: Kinglong Mee <[email protected]>
    Cc: [email protected]
    Signed-off-by: J. Bruce Fields <[email protected]>

commit 929423f
Author: Juergen Gross <[email protected]>
Date:   Mon Jul 20 13:49:39 2015 +0200

    xen: release lock occasionally during ballooning
    
    When dom0 is being ballooned balloon_process() will hold the balloon
    mutex until it is finished. This will block e.g. creation of new
    domains as the device backends for the new domain need some
    autoballooned pages for the ring buffers.
    
    Avoid this by releasing the balloon mutex from time to time during
    ballooning. Adjust the comment above balloon_process() regarding
    multiple instances of balloon_process().
    
    Instead of open coding it, just use cond_resched().
    
    Signed-off-by: Juergen Gross <[email protected]>
    Signed-off-by: David Vrabel <[email protected]>

commit c9ddbac
Author: Michael S. Tsirkin <[email protected]>
Date:   Tue Jul 14 18:27:46 2015 -0500

    PCI: Restore PCI_MSIX_FLAGS_BIRMASK definition
    
    09a2c73 ("PCI: Remove unused PCI_MSIX_FLAGS_BIRMASK definition")
    removed PCI_MSIX_FLAGS_BIRMASK from an exported header because it was
    unused in the kernel.  But that breaks user programs that were using it
    (QEMU in particular).
    
    Restore the PCI_MSIX_FLAGS_BIRMASK definition.
    
    [bhelgaas: changelog]
    Signed-off-by: Michael S. Tsirkin <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    CC: [email protected]	# v3.13+

commit 30b03d0
Author: Marek Marczykowski-Górecki <[email protected]>
Date:   Fri Jun 26 03:28:24 2015 +0200

    xen/gntdevt: Fix race condition in gntdev_release()
    
    While gntdev_release() is called the MMU notifier is still registered
    and can traverse priv->maps list even if no pages are mapped (which is
    the case -- gntdev_release() is called after all). But
    gntdev_release() will clear that list, so make sure that only one of
    those things happens at the same time.
    
    Signed-off-by: Marek Marczykowski-Górecki <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: David Vrabel <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>

Author: mmotm auto import

Makefile

@@ -597,6 +597,11 @@ endif # $(dot-config)
 # Defaults to vmlinux, but the arch makefile usually adds further targets
 all: vmlinux
 
+# The arch Makefile can set ARCH_{CPP,A,C}FLAGS to override the default
+# values of the respective KBUILD_* variables
+ARCH_CPPFLAGS :=
+ARCH_AFLAGS :=
+ARCH_CFLAGS :=
 include arch/$(SRCARCH)/Makefile
 
 KBUILD_CFLAGS	+= $(call cc-option,-fno-delete-null-pointer-checks,)
@@ -848,10 +853,10 @@ export mod_strip_cmd
 mod_compress_cmd = true
 ifdef CONFIG_MODULE_COMPRESS
   ifdef CONFIG_MODULE_COMPRESS_GZIP
-    mod_compress_cmd = gzip -n
+    mod_compress_cmd = gzip -n -f
   endif # CONFIG_MODULE_COMPRESS_GZIP
   ifdef CONFIG_MODULE_COMPRESS_XZ
-    mod_compress_cmd = xz
+    mod_compress_cmd = xz -f
   endif # CONFIG_MODULE_COMPRESS_XZ
 endif # CONFIG_MODULE_COMPRESS
 export mod_compress_cmd

arch/s390/kvm/kvm-s390.c

@@ -1742,10 +1742,10 @@ static bool ibs_enabled(struct kvm_vcpu *vcpu)
 
 static int kvm_s390_handle_requests(struct kvm_vcpu *vcpu)
 {
-	if (!vcpu->requests)
-		return 0;
 retry:
 	kvm_s390_vcpu_request_handled(vcpu);
+	if (!vcpu->requests)
+		return 0;
 	/*
 	 * We use MMU_RELOAD just to re-arm the ipte notifier for the
 	 * guest prefix page. gmap_ipte_notify will wait on the ptl lock.

arch/x86/kvm/mtrr.c

@@ -672,16 +672,16 @@ u8 kvm_mtrr_get_guest_memory_type(struct kvm_vcpu *vcpu, gfn_t gfn)
 	if (iter.mtrr_disabled)
 		return mtrr_disabled_type();
 
+	/* not contained in any MTRRs. */
+	if (type == -1)
+		return mtrr_default_type(mtrr_state);
+
 	/*
 	 * We just check one page, partially covered by MTRRs is
 	 * impossible.
 	 */
 	WARN_ON(iter.partial_map);
 
-	/* not contained in any MTRRs. */
-	if (type == -1)
-		return mtrr_default_type(mtrr_state);
-
 	return type;
 }
 EXPORT_SYMBOL_GPL(kvm_mtrr_get_guest_memory_type);

drivers/block/rbd.c

@@ -523,6 +523,7 @@ void rbd_warn(struct rbd_device *rbd_dev, const char *fmt, ...)
 #  define rbd_assert(expr)	((void) 0)
 #endif /* !RBD_DEBUG */
 
+static void rbd_osd_copyup_callback(struct rbd_obj_request *obj_request);
 static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request);
 static void rbd_img_parent_read(struct rbd_obj_request *obj_request);
 static void rbd_dev_remove_parent(struct rbd_device *rbd_dev);
@@ -1818,6 +1819,16 @@ static void rbd_osd_stat_callback(struct rbd_obj_request *obj_request)
 	obj_request_done_set(obj_request);
 }
 
+static void rbd_osd_call_callback(struct rbd_obj_request *obj_request)
+{
+	dout("%s: obj %p\n", __func__, obj_request);
+
+	if (obj_request_img_data_test(obj_request))
+		rbd_osd_copyup_callback(obj_request);
+	else
+		obj_request_done_set(obj_request);
+}
+
 static void rbd_osd_req_callback(struct ceph_osd_request *osd_req,
 				struct ceph_msg *msg)
 {
@@ -1866,6 +1877,8 @@ static void rbd_osd_req_callback(struct ceph_osd_request *osd_req,
 		rbd_osd_discard_callback(obj_request);
 		break;
 	case CEPH_OSD_OP_CALL:
+		rbd_osd_call_callback(obj_request);
+		break;
 	case CEPH_OSD_OP_NOTIFY_ACK:
 	case CEPH_OSD_OP_WATCH:
 		rbd_osd_trivial_callback(obj_request);
@@ -2530,13 +2543,15 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request,
 }
 
 static void
-rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request)
+rbd_osd_copyup_callback(struct rbd_obj_request *obj_request)
 {
 	struct rbd_img_request *img_request;
 	struct rbd_device *rbd_dev;
 	struct page **pages;
 	u32 page_count;
 
+	dout("%s: obj %p\n", __func__, obj_request);
+
 	rbd_assert(obj_request->type == OBJ_REQUEST_BIO ||
 		obj_request->type == OBJ_REQUEST_NODATA);
 	rbd_assert(obj_request_img_data_test(obj_request));
@@ -2563,9 +2578,7 @@ rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request)
 	if (!obj_request->result)
 		obj_request->xferred = obj_request->length;
 
-	/* Finish up with the normal image object callback */
-
-	rbd_img_obj_callback(obj_request);
+	obj_request_done_set(obj_request);
 }
 
 static void
@@ -2650,7 +2663,6 @@ rbd_img_obj_parent_read_full_callback(struct rbd_img_request *img_request)
 
 	/* All set, send it off. */
 
-	orig_request->callback = rbd_img_obj_copyup_callback;
 	osdc = &rbd_dev->rbd_client->client->osdc;
 	img_result = rbd_obj_request_submit(osdc, orig_request);
 	if (!img_result)

drivers/char/hw_random/core.c

@@ -429,7 +429,7 @@ static int hwrng_fillfn(void *unused)
 static void start_khwrngd(void)
 {
 	hwrng_fill = kthread_run(hwrng_fillfn, NULL, "hwrng");
-	if (hwrng_fill == ERR_PTR(-ENOMEM)) {
+	if (IS_ERR(hwrng_fill)) {
 		pr_err("hwrng_fill thread creation failed");
 		hwrng_fill = NULL;
 	}

drivers/crypto/ixp4xx_crypto.c

@@ -905,7 +905,6 @@ static int ablk_perform(struct ablkcipher_request *req, int encrypt)
 		crypt->mode |= NPE_OP_NOT_IN_PLACE;
 		/* This was never tested by Intel
 		 * for more than one dst buffer, I think. */
-		BUG_ON(req->dst->length < nbytes);
 		req_ctx->dst = NULL;
 		if (!chainup_buffers(dev, req->dst, nbytes, &dst_hook,
 					flags, DMA_FROM_DEVICE))

drivers/crypto/qat/qat_common/qat_algs.c

@@ -73,7 +73,8 @@
 				       ICP_QAT_HW_CIPHER_KEY_CONVERT, \
 				       ICP_QAT_HW_CIPHER_DECRYPT)
 
-static atomic_t active_dev;
+static DEFINE_MUTEX(algs_lock);
+static unsigned int active_devs;
 
 struct qat_alg_buf {
 	uint32_t len;
@@ -1280,7 +1281,10 @@ static struct crypto_alg qat_algs[] = { {
 
 int qat_algs_register(void)
 {
-	if (atomic_add_return(1, &active_dev) == 1) {
+	int ret = 0;
+
+	mutex_lock(&algs_lock);
+	if (++active_devs == 1) {
 		int i;
 
 		for (i = 0; i < ARRAY_SIZE(qat_algs); i++)
@@ -1289,21 +1293,25 @@ int qat_algs_register(void)
 				CRYPTO_ALG_TYPE_AEAD | CRYPTO_ALG_ASYNC :
 				CRYPTO_ALG_TYPE_ABLKCIPHER | CRYPTO_ALG_ASYNC;
 
-		return crypto_register_algs(qat_algs, ARRAY_SIZE(qat_algs));
+		ret = crypto_register_algs(qat_algs, ARRAY_SIZE(qat_algs));
 	}
-	return 0;
+	mutex_unlock(&algs_lock);
+	return ret;
 }
 
 int qat_algs_unregister(void)
 {
-	if (atomic_sub_return(1, &active_dev) == 0)
-		return crypto_unregister_algs(qat_algs, ARRAY_SIZE(qat_algs));
-	return 0;
+	int ret = 0;
+
+	mutex_lock(&algs_lock);
+	if (--active_devs == 0)
+		ret = crypto_unregister_algs(qat_algs, ARRAY_SIZE(qat_algs));
+	mutex_unlock(&algs_lock);
+	return ret;
 }
 
 int qat_algs_init(void)
 {
-	atomic_set(&active_dev, 0);
 	crypto_get_default_rng();
 	return 0;
 }

drivers/gpu/drm/drm_atomic_helper.c

@@ -196,7 +196,12 @@ update_connector_routing(struct drm_atomic_state *state, int conn_idx)
 	}
 
 	funcs = connector->helper_private;
-	new_encoder = funcs->best_encoder(connector);
+
+	if (funcs->atomic_best_encoder)
+		new_encoder = funcs->atomic_best_encoder(connector,
+							 connector_state);
+	else
+		new_encoder = funcs->best_encoder(connector);
 
 	if (!new_encoder) {
 		DRM_DEBUG_ATOMIC("No suitable encoder found for [CONNECTOR:%d:%s]\n",
@@ -229,13 +234,14 @@ update_connector_routing(struct drm_atomic_state *state, int conn_idx)
 		}
 	}
 
+	if (WARN_ON(!connector_state->crtc))
+		return -EINVAL;
+
 	connector_state->best_encoder = new_encoder;
-	if (connector_state->crtc) {
-		idx = drm_crtc_index(connector_state->crtc);
+	idx = drm_crtc_index(connector_state->crtc);
 
-		crtc_state = state->crtc_states[idx];
-		crtc_state->mode_changed = true;
-	}
+	crtc_state = state->crtc_states[idx];
+	crtc_state->mode_changed = true;
 
 	DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] using [ENCODER:%d:%s] on [CRTC:%d]\n",
 			 connector->base.id,

drivers/gpu/drm/drm_dp_mst_topology.c

@@ -1294,7 +1294,6 @@ static int drm_dp_send_sideband_msg(struct drm_dp_mst_topology_mgr *mgr,
 				goto retry;
 			}
 			DRM_DEBUG_KMS("failed to dpcd write %d %d\n", tosend, ret);
-			WARN(1, "fail\n");
 
 			return -EIO;
 		}

drivers/gpu/drm/i915/intel_dp_mst.c

@@ -357,6 +357,16 @@ intel_dp_mst_mode_valid(struct drm_connector *connector,
 	return MODE_OK;
 }
 
+static struct drm_encoder *intel_mst_atomic_best_encoder(struct drm_connector *connector,
+							 struct drm_connector_state *state)
+{
+	struct intel_connector *intel_connector = to_intel_connector(connector);
+	struct intel_dp *intel_dp = intel_connector->mst_port;
+	struct intel_crtc *crtc = to_intel_crtc(state->crtc);
+
+	return &intel_dp->mst_encoders[crtc->pipe]->base.base;
+}
+
 static struct drm_encoder *intel_mst_best_encoder(struct drm_connector *connector)
 {
 	struct intel_connector *intel_connector = to_intel_connector(connector);
@@ -367,6 +377,7 @@ static struct drm_encoder *intel_mst_best_encoder(struct drm_connector *connecto
 static const struct drm_connector_helper_funcs intel_dp_mst_connector_helper_funcs = {
 	.get_modes = intel_dp_mst_get_modes,
 	.mode_valid = intel_dp_mst_mode_valid,
+	.atomic_best_encoder = intel_mst_atomic_best_encoder,
 	.best_encoder = intel_mst_best_encoder,
 };
 

drivers/i2c/busses/i2c-bfin-twi.c

@@ -692,7 +692,7 @@ static int i2c_bfin_twi_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, iface);
 
-	dev_info(&pdev->dev, "Blackfin BF5xx on-chip I2C TWI Contoller, "
+	dev_info(&pdev->dev, "Blackfin BF5xx on-chip I2C TWI Controller, "
 		"regs_base@%p\n", iface->regs_base);
 
 	return 0;
@@ -735,6 +735,6 @@ subsys_initcall(i2c_bfin_twi_init);
 module_exit(i2c_bfin_twi_exit);
 
 MODULE_AUTHOR("Bryan Wu, Sonic Zhang");
-MODULE_DESCRIPTION("Blackfin BF5xx on-chip I2C TWI Contoller Driver");
+MODULE_DESCRIPTION("Blackfin BF5xx on-chip I2C TWI Controller Driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:i2c-bfin-twi");

drivers/i2c/busses/i2c-omap.c

@@ -1247,7 +1247,14 @@ static void omap_i2c_prepare_recovery(struct i2c_adapter *adap)
 	u32 reg;
 
 	reg = omap_i2c_read_reg(dev, OMAP_I2C_SYSTEST_REG);
+	/* enable test mode */
 	reg |= OMAP_I2C_SYSTEST_ST_EN;
+	/* select SDA/SCL IO mode */
+	reg |= 3 << OMAP_I2C_SYSTEST_TMODE_SHIFT;
+	/* set SCL to high-impedance state (reset value is 0) */
+	reg |= OMAP_I2C_SYSTEST_SCL_O;
+	/* set SDA to high-impedance state (reset value is 0) */
+	reg |= OMAP_I2C_SYSTEST_SDA_O;
 	omap_i2c_write_reg(dev, OMAP_I2C_SYSTEST_REG, reg);
 }
 
@@ -1257,7 +1264,11 @@ static void omap_i2c_unprepare_recovery(struct i2c_adapter *adap)
 	u32 reg;
 
 	reg = omap_i2c_read_reg(dev, OMAP_I2C_SYSTEST_REG);
+	/* restore reset values */
 	reg &= ~OMAP_I2C_SYSTEST_ST_EN;
+	reg &= ~OMAP_I2C_SYSTEST_TMODE_MASK;
+	reg &= ~OMAP_I2C_SYSTEST_SCL_O;
+	reg &= ~OMAP_I2C_SYSTEST_SDA_O;
 	omap_i2c_write_reg(dev, OMAP_I2C_SYSTEST_REG, reg);
 }
 

drivers/i2c/i2c-core.c

@@ -567,6 +567,9 @@ static int i2c_generic_recovery(struct i2c_adapter *adap)
 	if (bri->prepare_recovery)
 		bri->prepare_recovery(adap);
 
+	bri->set_scl(adap, val);
+	ndelay(RECOVERY_NDELAY);
+
 	/*
 	 * By this time SCL is high, as we need to give 9 falling-rising edges
 	 */
@@ -597,7 +600,6 @@ static int i2c_generic_recovery(struct i2c_adapter *adap)
 
 int i2c_generic_scl_recovery(struct i2c_adapter *adap)
 {
-	adap->bus_recovery_info->set_scl(adap, 1);
 	return i2c_generic_recovery(adap);
 }
 EXPORT_SYMBOL_GPL(i2c_generic_scl_recovery);
@@ -1338,27 +1340,35 @@ static int of_dev_node_match(struct device *dev, void *data)
 struct i2c_client *of_find_i2c_device_by_node(struct device_node *node)
 {
 	struct device *dev;
+	struct i2c_client *client;
 
-	dev = bus_find_device(&i2c_bus_type, NULL, node,
-					 of_dev_node_match);
+	dev = bus_find_device(&i2c_bus_type, NULL, node, of_dev_node_match);
 	if (!dev)
 		return NULL;
 
-	return i2c_verify_client(dev);
+	client = i2c_verify_client(dev);
+	if (!client)
+		put_device(dev);
+
+	return client;
 }
 EXPORT_SYMBOL(of_find_i2c_device_by_node);
 
 /* must call put_device() when done with returned i2c_adapter device */
 struct i2c_adapter *of_find_i2c_adapter_by_node(struct device_node *node)
 {
 	struct device *dev;
+	struct i2c_adapter *adapter;
 
-	dev = bus_find_device(&i2c_bus_type, NULL, node,
-					 of_dev_node_match);
+	dev = bus_find_device(&i2c_bus_type, NULL, node, of_dev_node_match);
 	if (!dev)
 		return NULL;
 
-	return i2c_verify_adapter(dev);
+	adapter = i2c_verify_adapter(dev);
+	if (!adapter)
+		put_device(dev);
+
+	return adapter;
 }
 EXPORT_SYMBOL(of_find_i2c_adapter_by_node);
 #else

drivers/i2c/i2c-slave-eeprom.c

@@ -80,9 +80,6 @@ static ssize_t i2c_slave_eeprom_bin_read(struct file *filp, struct kobject *kobj
 	struct eeprom_data *eeprom;
 	unsigned long flags;
 
-	if (off + count > attr->size)
-		return -EFBIG;
-
 	eeprom = dev_get_drvdata(container_of(kobj, struct device, kobj));
 
 	spin_lock_irqsave(&eeprom->buffer_lock, flags);
@@ -98,9 +95,6 @@ static ssize_t i2c_slave_eeprom_bin_write(struct file *filp, struct kobject *kob
 	struct eeprom_data *eeprom;
 	unsigned long flags;
 
-	if (off + count > attr->size)
-		return -EFBIG;
-
 	eeprom = dev_get_drvdata(container_of(kobj, struct device, kobj));
 
 	spin_lock_irqsave(&eeprom->buffer_lock, flags);

drivers/md/md.c

@@ -5759,7 +5759,7 @@ static int get_bitmap_file(struct mddev *mddev, void __user * arg)
 	char *ptr;
 	int err;
 
-	file = kmalloc(sizeof(*file), GFP_NOIO);
+	file = kzalloc(sizeof(*file), GFP_NOIO);
 	if (!file)
 		return -ENOMEM;