Linux 3.10.97 (accumulative patch)

commit 66b4554a10194a0fb4272f185b5fc6f2710741de
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri Feb 19 14:22:57 2016 -0800

    Linux 3.10.97

commit d67d24e13204af21c1855460472bbe66491d8625
Author: Maciej W. Rozycki <macro@imgtec.com>
Date:   Mon Oct 26 15:48:19 2015 +0000

    binfmt_elf: Don't clobber passed executable's file header

    commit b582ef5c53040c5feef4c96a8f9585b6831e2441 upstream.

    Do not clobber the buffer space passed from `search_binary_handler' and
    originally preloaded by `prepare_binprm' with the executable's file
    header by overwriting it with its interpreter's file header.  Instead
    keep the buffer space intact and directly use the data structure locally
    allocated for the interpreter's file header, fixing a bug introduced in
    2.1.14 with loadable module support (linux-mips.org commit beb11695
    [Import of Linux/MIPS 2.1.14], predating kernel.org repo's history).
    Adjust the amount of data read from the interpreter's file accordingly.

    This was not an issue before loadable module support, because back then
    `load_elf_binary' was executed only once for a given ELF executable,
    whether the function succeeded or failed.

    With loadable module support supported and enabled, upon a failure of
    `load_elf_binary' -- which may for example be caused by architecture
    code rejecting an executable due to a missing hardware feature requested
    in the file header -- a module load is attempted and then the function
    reexecuted by `search_binary_handler'.  With the executable's file
    header replaced with its interpreter's file header the executable can
    then be erroneously accepted in this subsequent attempt.

    Signed-off-by: Maciej W. Rozycki <macro@imgtec.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 669e0b00cba824568ebe800ee34c14254b917654
Author: Kinglong Mee <kinglongmee@gmail.com>
Date:   Wed Nov 4 15:20:15 2015 +0000

    FS-Cache: Increase reference of parent after registering, netfs success

    commit 86108c2e34a26e4bec3c6ddb23390bf8cedcf391 upstream.

    If netfs exist, fscache should not increase the reference of parent's
    usage and n_children, otherwise, never be decreased.

    v2: thanks David's suggest,
     move increasing reference of parent if success
     use kmem_cache_free() freeing primary_index directly

    v3: don't move "netfs->primary_index->parent = &fscache_fsdef_index;"

    Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 471b81310d2198d0a9dfeddfffdac036b9c9cee7
Author: Mathias Krause <minipli@googlemail.com>
Date:   Mon Feb 1 14:27:30 2016 +0100

    crypto: user - lock crypto_alg_list on alg dump

    commit 63e41ebc6630f39422d87f8a4bade1e793f37a01 upstream.

    We miss to take the crypto_alg_sem semaphore when traversing the
    crypto_alg_list for CRYPTO_MSG_GETALG dumps. This allows a race with
    crypto_unregister_alg() removing algorithms from the list while we're
    still traversing it, thereby leading to a use-after-free as show below:

    [ 3482.071639] general protection fault: 0000 [#1] SMP
    [ 3482.075639] Modules linked in: aes_x86_64 glue_helper lrw ablk_helper cryptd gf128mul ipv6 pcspkr serio_raw virtio_net microcode virtio_pci virtio_ring virtio sr_mod cdrom [last unloaded: aesni_intel]
    [ 3482.075639] CPU: 1 PID: 11065 Comm: crconf Not tainted 4.3.4-grsec+ #126
    [ 3482.075639] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
    [ 3482.075639] task: ffff88001cd41a40 ti: ffff88001cd422c8 task.ti: ffff88001cd422c8
    [ 3482.075639] RIP: 0010:[<ffffffff93722bd3>]  [<ffffffff93722bd3>] strncpy+0x13/0x30
    [ 3482.075639] RSP: 0018:ffff88001f713b60  EFLAGS: 00010202
    [ 3482.075639] RAX: ffff88001f6c4430 RBX: ffff88001f6c43a0 RCX: ffff88001f6c4430
    [ 3482.075639] RDX: 0000000000000040 RSI: fefefefefefeff16 RDI: ffff88001f6c4430
    [ 3482.075639] RBP: ffff88001f713b60 R08: ffff88001f6c4470 R09: ffff88001f6c4480
    [ 3482.075639] R10: 0000000000000002 R11: 0000000000000246 R12: ffff88001ce2aa28
    [ 3482.075639] R13: ffff880000093700 R14: ffff88001f5e4bf8 R15: 0000000000003b20
    [ 3482.075639] FS:  0000033826fa2700(0000) GS:ffff88001e900000(0000) knlGS:0000000000000000
    [ 3482.075639] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 3482.075639] CR2: ffffffffff600400 CR3: 00000000139ec000 CR4: 00000000001606f0
    [ 3482.075639] Stack:
    [ 3482.075639]  ffff88001f713bd8 ffffffff936ccd00 ffff88001e5c4200 ffff880000093700
    [ 3482.075639]  ffff88001f713bd0 ffffffff938ef4bf 0000000000000000 0000000000003b20
    [ 3482.075639]  ffff88001f5e4bf8 ffff88001f5e4848 0000000000000000 0000000000003b20
    [ 3482.075639] Call Trace:
    [ 3482.075639]  [<ffffffff936ccd00>] crypto_report_alg+0xc0/0x3e0
    [ 3482.075639]  [<ffffffff938ef4bf>] ? __alloc_skb+0x16f/0x300
    [ 3482.075639]  [<ffffffff936cd08a>] crypto_dump_report+0x6a/0x90
    [ 3482.075639]  [<ffffffff93935707>] netlink_dump+0x147/0x2e0
    [ 3482.075639]  [<ffffffff93935f99>] __netlink_dump_start+0x159/0x190
    [ 3482.075639]  [<ffffffff936ccb13>] crypto_user_rcv_msg+0xc3/0x130
    [ 3482.075639]  [<ffffffff936cd020>] ? crypto_report_alg+0x3e0/0x3e0
    [ 3482.075639]  [<ffffffff936cc4b0>] ? alg_test_crc32c+0x120/0x120
    [ 3482.075639]  [<ffffffff93933145>] ? __netlink_lookup+0xd5/0x120
    [ 3482.075639]  [<ffffffff936cca50>] ? crypto_add_alg+0x1d0/0x1d0
    [ 3482.075639]  [<ffffffff93938141>] netlink_rcv_skb+0xe1/0x130
    [ 3482.075639]  [<ffffffff936cc4f8>] crypto_netlink_rcv+0x28/0x40
    [ 3482.075639]  [<ffffffff939375a8>] netlink_unicast+0x108/0x180
    [ 3482.075639]  [<ffffffff93937c21>] netlink_sendmsg+0x541/0x770
    [ 3482.075639]  [<ffffffff938e31e1>] sock_sendmsg+0x21/0x40
    [ 3482.075639]  [<ffffffff938e4763>] SyS_sendto+0xf3/0x130
    [ 3482.075639]  [<ffffffff93444203>] ? bad_area_nosemaphore+0x13/0x20
    [ 3482.075639]  [<ffffffff93444470>] ? __do_page_fault+0x80/0x3a0
    [ 3482.075639]  [<ffffffff939d80cb>] entry_SYSCALL_64_fastpath+0x12/0x6e
    [ 3482.075639] Code: 88 4a ff 75 ed 5d 48 0f ba 2c 24 3f c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 85 d2 48 89 f8 48 89 f9 4c 8d 04 17 48 89 e5 74 15 <0f> b6 16 80 fa 01 88 11 48 83 de ff 48 83 c1 01 4c 39 c1 75 eb
    [ 3482.075639] RIP  [<ffffffff93722bd3>] strncpy+0x13/0x30

    To trigger the race run the following loops simultaneously for a while:
      $ while : ; do modprobe aesni-intel; rmmod aesni-intel; done
      $ while : ; do crconf show all > /dev/null; done

    Fix the race by taking the crypto_alg_sem read lock, thereby preventing
    crypto_unregister_alg() from modifying the algorithm list during the
    dump.

    This bug has been detected by the PaX memory sanitize feature.

    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Cc: Steffen Klassert <steffen.klassert@secunet.com>
    Cc: PaX Team <pageexec@freemail.hu>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9250afa47650e39ee56511b86450dd11b3217c3a
Author: Wang, Rui Y <rui.y.wang@intel.com>
Date:   Wed Jan 27 17:08:37 2016 +0800

    crypto: algif_hash - wait for crypto_ahash_init() to complete

    commit fe09786178f9df713a4b2dd6b93c0a722346bf5e upstream.

    hash_sendmsg/sendpage() need to wait for the completion
    of crypto_ahash_init() otherwise it can cause panic.

    Signed-off-by: Rui Wang <rui.y.wang@intel.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 71eec872a94409c9a595b2a02a5d9eb8c9d335c5
Author: Alexandra Yates <alexandra.yates@linux.intel.com>
Date:   Fri Feb 5 15:27:49 2016 -0800

    ahci: Intel DNV device IDs SATA

    commit 342decff2b846b46fa61eb5ee40986fab79a9a32 upstream.

    Adding Intel codename DNV platform device IDs for SATA.

    Signed-off-by: Alexandra Yates <alexandra.yates@linux.intel.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f6c2bfd8a8829cc0cddefe6f952b7436b875cd18
Author: Tejun Heo <tj@kernel.org>
Date:   Fri Jan 15 15:13:05 2016 -0500

    libata: disable forced PORTS_IMPL for >= AHCI 1.3

    commit 566d1827df2ef0cbe921d3d6946ac3007b1a6938 upstream.

    Some early controllers incorrectly reported zero ports in PORTS_IMPL
    register and the ahci driver fabricates PORTS_IMPL from the number of
    ports in those cases.  This hasn't mattered but with the new nvme
    controllers there are cases where zero PORTS_IMPL is valid and should
    be honored.

    Disable the workaround for >= AHCI 1.3.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Andy Lutomirski <luto@amacapital.net>
    Link: http://lkml.kernel.org/g/CALCETrU7yMvXEDhjAUShoHEhDwifJGapdw--BKxsP0jmjKGmRw@mail.gmail.com
    Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d2b76ee2681e369a0ab38fdd7df9ea3ea94c2bd2
Author: Xiangliang Yu <Xiangliang.Yu@amd.com>
Date:   Thu Nov 26 20:27:02 2015 +0800

    AHCI: Fix softreset failed issue of Port Multiplier

    commit 023113d24ef9e1d2b44cb2446872b17e2b01d8b1 upstream.

    Current code doesn't update port value of Port Multiplier(PM) when
    sending FIS of softreset to device, command will fail if FBS is
    enabled.

    There are two ways to fix the issue: the first is to disable FBS
    before sending softreset command to PM device and the second is
    to update port value of PM when sending command.

    For the first way, i can't find any related rule in AHCI Spec. The
    second way can avoid disabling FBS and has better performance.

    Signed-off-by: Xiangliang Yu <Xiangliang.Yu@amd.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f77597b2ef65757d6e24daf96eb58446dfb83491
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Wed Dec 30 20:24:17 2015 +0800

    crypto: af_alg - Fix socket double-free when accept fails

    commit a383292c86663bbc31ac62cc0c04fc77504636a6 upstream.

    When we fail an accept(2) call we will end up freeing the socket
    twice, once due to the direct sk_free call and once again through
    newsock.

    This patch fixes this by removing the sk_free call.

    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5a707f0972e1c9d8a4a921ddae79d0f9dc36a341
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Wed Dec 30 11:47:53 2015 +0800

    crypto: af_alg - Disallow bind/setkey/... after accept(2)

    commit c840ac6af3f8713a71b4d2363419145760bd6044 upstream.

    Each af_alg parent socket obtained by socket(2) corresponds to a
    tfm object once bind(2) has succeeded.  An accept(2) call on that
    parent socket creates a context which then uses the tfm object.

    Therefore as long as any child sockets created by accept(2) exist
    the parent socket must not be modified or freed.

    This patch guarantees this by using locks and a reference count
    on the parent socket.  Any attempt to modify the parent socket will
    fail with EBUSY.

    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 766ac2a01cbbb7762f88127c32bcd9697c97f060
Author: David Turner <novalis@novalis.org>
Date:   Tue Nov 24 14:34:37 2015 -0500

    ext4: Fix handling of extended tv_sec

    commit a4dad1ae24f850410c4e60f22823cba1289b8d52 upstream.

    In ext4, the bottom two bits of {a,c,m}time_extra are used to extend
    the {a,c,m}time fields, deferring the year 2038 problem to the year
    2446.

    When decoding these extended fields, for times whose bottom 32 bits
    would represent a negative number, sign extension causes the 64-bit
    extended timestamp to be negative as well, which is not what's
    intended.  This patch corrects that issue, so that the only negative
    {a,c,m}times are those between 1901 and 1970 (as per 32-bit signed
    timestamps).

    Some older kernels might have written pre-1970 dates with 1,1 in the
    extra bits.  This patch treats those incorrectly-encoded dates as
    pre-1970, instead of post-2311, until kernel 4.20 is released.
    Hopefully by then e2fsck will have fixed up the bad data.

    Also add a comment explaining the encoding of ext4's extra {a,c,m}time
    bits.

    Signed-off-by: David Turner <novalis@novalis.org>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Reported-by: Mark Harris <mh8928@yahoo.com>
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=23732
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6f2db87b6c797290116ef2783815b37b76394430
Author: Peter Hurley <peter@hurleysoftware.com>
Date:   Sun Jan 10 22:40:55 2016 -0800

    tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)

    commit 5c17c861a357e9458001f021a7afa7aab9937439 upstream.

    ioctl(TIOCGETD) retrieves the line discipline id directly from the
    ldisc because the line discipline id (c_line) in termios is untrustworthy;
    userspace may have set termios via ioctl(TCSETS*) without actually
    changing the line discipline via ioctl(TIOCSETD).

    However, directly accessing the current ldisc via tty->ldisc is
    unsafe; the ldisc ptr dereferenced may be stale if the line discipline
    is changing via ioctl(TIOCSETD) or hangup.

    Wait for the line discipline reference (just like read() or write())
    to retrieve the "current" line discipline id.

    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4478e2240dfbbd5491d5aaf9c92e5fb603f1bfdd
Author: John Ernberg <john.ernberg@actia.se>
Date:   Mon Jan 25 12:27:17 2016 +0000

    USB: option: fix Cinterion AHxx enumeration

    commit 4152b387da81617c80cb2946b2d56e3958906b3e upstream.

    In certain kernel configurations where the cdc_ether and option drivers
    are compiled as modules there can occur a race condition in enumeration.
    This causes the option driver to enumerate the ethernet(wwan) interface
    as usb-serial interfaces.

    usb-devices output for the modem:
    T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  5 Spd=480 MxCh= 0
    D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=1e2d ProdID=0055 Rev=00.00
    S:  Manufacturer=Cinterion
    S:  Product=AHx
    C:  #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=10mA
    I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
    I:  If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether

    Signed-off-by: John Ernberg <john.ernberg@actia.se>
    Fixes: 1941138e1c02 ("USB: added support for Cinterion's products...")
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3bee9e6e206d990619cdb3a62df7cef89eb919b4
Author: Daniele Palmas <dnlplm@gmail.com>
Date:   Tue Jan 12 17:22:06 2016 +0100

    USB: serial: option: Adding support for Telit LE922

    commit ff4e2494dc17b173468e1713fdf6237fd8578bc7 upstream.

    This patch adds support for two PIDs of LE922.

    Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e193199af5199c771e1d38e03349d94969759d3b
Author: Peter Dedecker <peter.dedecker@hotmail.com>
Date:   Fri Jan 8 12:34:41 2016 +0100

    USB: cp210x: add ID for IAI USB to RS485 adaptor

    commit f487c54ddd544e1c9172cd510954f697b77b76e3 upstream.

    Added the USB serial console device ID for IAI Corp. RCB-CV-USB
    USB to RS485 adaptor.

    Signed-off-by: Peter Dedecker <peter.dedecker@hotmail.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 03b987cbcf2d1b012e95f9530a2652237a721326
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue Jan 19 23:43:13 2016 -0800

    USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable

    commit e03cdf22a2727c60307be6a729233edab3bfda9c upstream.

    Harald Linden reports that the ftdi_sio driver works properly for the
    Yaesu SCU-18 cable if the device ids are added to the driver.  So let's
    add them.

    Reported-by: Harald Linden <harald.linden@7183.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f1a9ca0d6949ec920c7e34a1eb48dbf55e84f8ed
Author: Johan Hovold <johan@kernel.org>
Date:   Tue Jan 12 12:05:20 2016 +0100

    USB: visor: fix null-deref at probe

    commit cac9b50b0d75a1d50d6c056ff65c005f3224c8e0 upstream.

    Fix null-pointer dereference at probe should a (malicious) Treo device
    lack the expected endpoints.

    Specifically, the Treo port-setup hack was dereferencing the bulk-in and
    interrupt-in urbs without first making sure they had been allocated by
    core.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3b079e37731a962211c65e9aff9928f3ac2e6840
Author: Vladis Dronov <vdronov@redhat.com>
Date:   Tue Jan 12 15:10:50 2016 +0100

    USB: serial: visor: fix crash on detecting device without write_urbs

    commit cb3232138e37129e88240a98a1d2aba2187ff57c upstream.

    The visor driver crashes in clie_5_attach() when a specially crafted USB
    device without bulk-out endpoint is detected. This fix adds a check that
    the device has proper configuration expected by the driver.

    Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
    Signed-off-by: Vladis Dronov <vdronov@redhat.com>
    Fixes: cfb8da8f69b8 ("USB: visor: fix initialisation of UX50/TH55 devices")
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 24e1fdb327b97cde4ff92e7ceca86f9882a723e6
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Wed Dec 23 13:25:54 2015 +0000

    USB: ti_usb_3410_502: Fix ID table size

    Commit 35a2fbc941ac ("USB: serial: ti_usb_3410_5052: new device id for
    Abbot strip port cable") failed to update the size of the
    ti_id_table_3410 array.  This doesn't need to be fixed upstream
    following commit d7ece6515e12 ("USB: ti_usb_3410_5052: remove
    vendor/product module parameters") but should be fixed in stable
    branches older than 3.12.

    Backports of commit c9d09dc7ad10 ("USB: serial: ti_usb_3410_5052: add
    Abbott strip port ID to combined table as well.") similarly failed to
    update the size of the ti_id_table_combined array.

    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d5ce15e88eecfb9657fade8c8cfe4d02d96252ac
Author: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Date:   Thu Feb 4 15:59:43 2016 -0200

    saa7134-alsa: Only frees registered sound cards

    commit ac75fe5d8fe4a0bf063be18fb29684405279e79e upstream.

    That prevents this bug:
    [ 2382.269496] BUG: unable to handle kernel NULL pointer dereference at 0000000000000540
    [ 2382.270013] IP: [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
    [ 2382.270013] PGD 0
    [ 2382.270013] Oops: 0002 [#1] SMP
    [ 2382.270013] Modules linked in: saa7134_alsa(-) tda1004x saa7134_dvb videobuf2_dvb dvb_core tda827x tda8290 tuner saa7134 tveeprom videobuf2_dma_sg videobuf2_memops videobuf2_v4l2 videobuf2_core v4l2_common videodev media auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc tun bridge stp llc ebtables ip6table_filter ip6_tables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack it87 hwmon_vid snd_hda_codec_idt snd_hda_codec_generic iTCO_wdt iTCO_vendor_support snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq pcspkr i2c_i801 snd_seq_device snd_pcm snd_timer lpc_ich snd mfd_core soundcore binfmt_misc i915 video i2c_algo_bit drm_kms_helper drm r8169 ata_generic serio_raw pata_acpi mii i2c_core [last unloaded: videobuf2_memops]
    [ 2382.270013] CPU: 0 PID: 4899 Comm: rmmod Not tainted 4.5.0-rc1+ #4
    [ 2382.270013] Hardware name: PCCHIPS P17G/P17G, BIOS 080012  05/14/2008
    [ 2382.270013] task: ffff880039c38000 ti: ffff88003c764000 task.ti: ffff88003c764000
    [ 2382.270013] RIP: 0010:[<ffffffffa01fe616>]  [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
    [ 2382.270013] RSP: 0018:ffff88003c767ea0  EFLAGS: 00010286
    [ 2382.270013] RAX: ffff88003c767eb8 RBX: 0000000000000000 RCX: 0000000000006260
    [ 2382.270013] RDX: ffffffffa020a060 RSI: ffffffffa0206de1 RDI: ffff88003c767eb0
    [ 2382.270013] RBP: ffff88003c767ed8 R08: 0000000000019960 R09: ffffffff811a5412
    [ 2382.270013] R10: ffffea0000d7c200 R11: 0000000000000000 R12: ffff88003c767ea8
    [ 2382.270013] R13: 00007ffe760617f7 R14: 0000000000000000 R15: 0000557625d7f1e0
    [ 2382.270013] FS:  00007f80bb1c0700(0000) GS:ffff88003f400000(0000) knlGS:0000000000000000
    [ 2382.270013] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    [ 2382.270013] CR2: 0000000000000540 CR3: 000000003c00f000 CR4: 00000000000006f0
    [ 2382.270013] Stack:
    [ 2382.270013]  000000003c767ed8 ffffffff00000000 ffff880000000000 ffff88003c767eb8
    [ 2382.270013]  ffff88003c767eb8 ffffffffa049a890 00007ffe76060060 ffff88003c767ef0
    [ 2382.270013]  ffffffffa049889d ffffffffa049a500 ffff88003c767f48 ffffffff8111079c
    [ 2382.270013] Call Trace:
    [ 2382.270013]  [<ffffffffa049889d>] saa7134_alsa_exit+0x1d/0x780 [saa7134_alsa]
    [ 2382.270013]  [<ffffffff8111079c>] SyS_delete_module+0x19c/0x1f0
    [ 2382.270013]  [<ffffffff8170fc2e>] entry_SYSCALL_64_fastpath+0x12/0x71
    [ 2382.270013] Code: 20 a0 48 c7 c6 e1 6d 20 a0 48 89 e5 41 54 53 4c 8d 65 d0 48 89 fb 48 83 ec 28 c7 45 d0 00 00 00 00 49 8d 7c 24 08 e8 7a 55 ed e0 <4c> 89 a3 40 05 00 00 48 89 df e8 eb fd ff ff 85 c0 75 1a 48 8d
    [ 2382.270013] RIP  [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
    [ 2382.270013]  RSP <ffff88003c767ea0>
    [ 2382.270013] CR2: 0000000000000540

    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 49911dcd7655be44947a0a5f7343bf3dc5d0b3ce
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Feb 9 12:02:32 2016 +0100

    ALSA: timer: Fix race between stop and interrupt

    commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.

    A slave timer element also unlinks at snd_timer_stop() but it takes
    only slave_active_lock.  When a slave is assigned to a master,
    however, this may become a race against the master's interrupt
    handling, eventually resulting in a list corruption.  The actual bug
    could be seen with a syzkaller fuzzer test case in BugLink below.

    As a fix, we need to take timeri->timer->lock when timer isn't NULL,
    i.e. assigned to a master, while the assignment to a master itself is
    protected by slave_active_lock.

    BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e063b1a0b8df95a648dde437f57b2a306caced2e
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Feb 2 15:27:36 2016 +0100

    ALSA: dummy: Implement timer backend switching more safely

    commit ddce57a6f0a2d8d1bfacfa77f06043bc760403c2 upstream.

    Currently the selected timer backend is referred at any moment from
    the running PCM callbacks.  When the backend is switched, it's
    possible to lead to inconsistency from the running backend.  This was
    pointed by syzkaller fuzzer, and the commit [7ee96216c31a: ALSA:
    dummy: Disable switching timer backend via sysfs] disabled the dynamic
    switching for avoiding the crash.

    This patch improves the handling of timer backend switching.  It keeps
    the reference to the selected backend during the whole operation of an
    opened stream so that it won't be changed by other streams.

    Together with this change, the hrtimer parameter is reenabled as
    writable now.

    NOTE: this patch also turned out to fix the still remaining race.
    Namely, ops was still replaced dynamically at dummy_pcm_open:

      static int dummy_pcm_open(struct snd_pcm_substream *substream)
      {
      ....
              dummy->timer_ops = &dummy_systimer_ops;
              if (hrtimer)
                      dummy->timer_ops = &dummy_hrtimer_ops;

    Since dummy->timer_ops is common among all streams, and when the
    replacement happens during accesses of other streams, it may lead to a
    crash.  This was actually triggered by syzkaller fuzzer and KASAN.

    This patch rewrites the code not to use the ops shared by all streams
    any longer, too.

    BugLink: http://lkml.kernel.org/r/CACT4Y+aZ+xisrpuM6cOXbL21DuM0yVxPYXf4cD4Md9uw0C3dBQ@mail.gmail.com
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c5929da4dd38c95d7c9b738c9d3ef597c60331de
Author: Takashi Iwai <tiwai@suse.de>
Date:   Sun Feb 7 09:38:26 2016 +0100

    ALSA: hda - Fix speaker output from VAIO AiO machines

    commit c44d9b1181cf34e0860c72cc8a00e0c47417aac0 upstream.

    Some Sony VAIO AiO models (VGC-JS4EF and VGC-JS25G, both with PCI SSID
    104d:9044) need the same quirk to make the speaker working properly.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112031
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 538d254bc87055e696aa15939c2c9f4f84e92315
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Feb 8 17:36:25 2016 +0100

    ALSA: timer: Fix wrong instance passed to slave callbacks

    commit 117159f0b9d392fb433a7871426fad50317f06f7 upstream.

    In snd_timer_notify1(), the wrong timer instance was passed for slave
    ccallback function.  This leads to the access to the wrong data when
    an incompatible master is handled (e.g. the master is the sequencer
    timer and the slave is a user timer), as spotted by syzkaller fuzzer.

    This patch fixes that wrong assignment.

    BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8a778712b23eb46da3b41bd4d8b6ff2f4084681b
Author: Takashi Iwai <tiwai@suse.de>
Date:   Sat Jan 30 23:09:08 2016 +0100

    ALSA: timer: Fix link corruption due to double start or stop

    commit f784beb75ce82f4136f8a0960d3ee872f7109e09 upstream.

    Although ALSA timer code got hardening for races, it still causes
    use-after-free error.  This is however rather a corrupted linked list,
    not actually the concurrent accesses.  Namely, when timer start is
    triggered twice, list_add_tail() is called twice, too.  This ends
    up with the link corruption and triggers KASAN error.

    The simplest fix would be replacing list_add_tail() with
    list_move_tail(), but fundamentally it's the problem that we don't
    check the double start/stop correctly.  So, the right fix here is to
    add the proper checks to snd_timer_start() and snd_timer_stop() (and
    their variants).

    BugLink: http://lkml.kernel.org/r/CACT4Y+ZyPRoMQjmawbvmCEDrkBD2BQuH7R09=eOkf5ESK8kJAw@mail.gmail.com
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 732bc470a1017cd272b4f200d63691a09b287533
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Feb 4 17:06:13 2016 +0100

    ALSA: timer: Fix leftover link at closing

    commit 094fd3be87b0f102589e2d5c3fa5d06b7e20496d upstream.

    In ALSA timer core, the active timer instance is managed in
    active_list linked list.  Each element is added / removed dynamically
    at timer start, stop and in timer interrupt.  The problem is that
    snd_timer_interrupt() has a thinko and leaves the element in
    active_list when it's the last opened element.  This eventually leads
    to list corruption or use-after-free error.

    This hasn't been revealed because we used to delete the list forcibly
    in snd_timer_stop() in the past.  However, the recent fix avoids the
    double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link
    corruption due to double start or stop]), and this leak hits reality.

    This patch fixes the link management in snd_timer_interrupt().  Now it
    simply unlinks no matter which stream is.

    BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@mail.gmail.com
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 51e9bd72a09bfe3707262917b9562f36ba8d6f07
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jan 14 17:01:46 2016 +0100

    ALSA: timer: Code cleanup

    commit c3b1681375dc6e71d89a3ae00cc3ce9e775a8917 upstream.

    This is a minor code cleanup without any functional changes:
    - Kill keep_flag argument from _snd_timer_stop(), as all callers pass
      only it false.
    - Remove redundant NULL check in _snd_timer_stop().

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e53ec492395424bc75b90d8ef650cb960ef28a79
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Feb 3 08:32:44 2016 +0100

    ALSA: seq: Fix lockdep warnings due to double mutex locks

    commit 7f0973e973cd74aa40747c9d38844560cd184ee8 upstream.

    The port subscription code uses double mutex locks for source and
    destination ports, and this may become racy once when wrongly set up.
    It leads to lockdep warning splat, typically triggered by fuzzer like
    syzkaller, although the actual deadlock hasn't been seen, so far.

    This patch simplifies the handling by reducing to two single locks, so
    that no lockdep warning will be trigger any longer.

    By splitting to two actions, a still-in-progress element shall be
    added in one list while handling another.  For ignoring this element,
    a new check is added in deliver_to_subscribers().

    Along with it, the code to add/remove the subscribers list element was
    cleaned up and refactored.

    BugLink: http://lkml.kernel.org/r/CACT4Y+aKQXV7xkBW9hpQbzaDO7LrUvohxWh-UwMxXjDy-yBD=A@mail.gmail.com
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Tested-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 14bdca3fa46eb56d2f042ce9f0a8b42f800a9a12
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Feb 1 12:06:42 2016 +0100

    ALSA: seq: Fix race at closing in virmidi driver

    commit 2d1b5c08366acd46c35a2e9aba5d650cb5bf5c19 upstream.

    The virmidi driver has an open race at closing its assigned rawmidi
    device, and this may lead to use-after-free in
    snd_seq_deliver_single_event().

    Plug the hole by properly protecting the linked list deletion and
    calling in the right order in snd_virmidi_input_close().

    BugLink: http://lkml.kernel.org/r/CACT4Y+Zd66+w12fNN85-425cVQT=K23kWbhnCEcMB8s3us-Frw@mail.gmail.com
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Tested-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4df6314c220c4943f82fdcb882b48561f5ffebbc
Author: Takashi Iwai <tiwai@suse.de>
Date:   Sat Jan 30 23:30:25 2016 +0100

    ALSA: seq: Fix yet another races among ALSA timer accesses

    commit 2cdc7b636d55cbcf42e1e6c8accd85e62d3e9ae8 upstream.

    ALSA sequencer may open/close and control ALSA timer instance
    dynamically either via sequencer events or direct ioctls.  These are
    done mostly asynchronously, and it may call still some timer action
    like snd_timer_start() while another is calling snd_timer_close().
    Since the instance gets removed by snd_timer_close(), it may lead to
    a use-after-free.

    This patch tries to address such a race by protecting each
    snd_timer_*() call via the existing spinlock and also by avoiding the
    access to timer during close call.

    BugLink: http://lkml.kernel.org/r/CACT4Y+Z6RzW5MBr-HUdV-8zwg71WQfKTdPpYGvOeS7v4cyurNQ@mail.gmail.com
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f042b75af1097cf81265f4db67a1ba38c7ec7207
Author: Vinod Koul <vinod.koul@intel.com>
Date:   Mon Feb 1 22:26:40 2016 +0530

    ASoC: dpcm: fix the BE state on hw_free

    commit 5e82d2be6ee53275c72e964507518d7964c82753 upstream.

    While performing hw_free, DPCM checks the BE state but leaves out
    the suspend state. The suspend state needs to be checked as well,
    as we might be suspended and then usermode closes rather than
    resuming the audio stream.

    This was found by a stress testing of system with playback in
    loop and killed after few seconds running in background and second
    script running suspend-resume test in loop

    Signed-off-by: Vinod Koul <vinod.koul@intel.com>
    Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aae80d6591f9d7c8e7aa48bad5b365c05ee9c2fd
Author: Takashi Iwai <tiwai@suse.de>
Date:   Sun Jan 31 10:32:37 2016 +0100

    ALSA: pcm: Fix potential deadlock in OSS emulation

    commit b248371628aad599a48540962f6b85a21a8a0c3f upstream.

    There are potential deadlocks in PCM OSS emulation code while
    accessing read/write and mmap concurrently.  This comes from the
    infamous mmap_sem usage in copy_from/to_user().  Namely,

       snd_pcm_oss_write() ->
         &runtime->oss.params_lock ->
            copy_to_user() ->
              &mm->mmap_sem
      mmap() ->
        &mm->mmap_sem ->
          snd_pcm_oss_mmap() ->
            &runtime->oss.params_lock

    Since we can't avoid taking params_lock from mmap code path, use
    trylock variant and aborts with -EAGAIN as a workaround of this AB/BA
    deadlock.

    BugLink: http://lkml.kernel.org/r/CACT4Y+bVrBKDG0G2_AcUgUQa+X91VKTeS4v+wN7BSHwHtqn3kQ@mail.gmail.com
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 264df9ec4e1f538b08167eae04ccfeb79678d111
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Feb 3 14:41:22 2016 +0100

    ALSA: rawmidi: Fix race at copying & updating the position

    commit 81f577542af15640cbcb6ef68baa4caa610cbbfc upstream.

    The rawmidi read and write functions manage runtime stream status
    such as runtime->appl_ptr and runtime->avail.  These point where to
    copy the new data and how many bytes have been copied (or to be
    read).  The problem is that rawmidi read/write call copy_from_user()
    or copy_to_user(), and the runtime spinlock is temporarily unlocked
    and relocked while copying user-space.  Since the current code
    advances and updates the runtime status after the spin unlock/relock,
    the copy and the update may be asynchronous, and eventually
    runtime->avail might go to a negative value when many concurrent
    accesses are done.  This may lead to memory corruption in the end.

    For fixing this race, in this patch, the status update code is
    performed in the same lock before the temporary unlock.  Also, the
    spinlock is now taken more widely in snd_rawmidi_kernel_read1() for
    protecting more properly during the whole operation.

    BugLink: http://lkml.kernel.org/r/CACT4Y+b-dCmNf1GpgPKfDO0ih+uZCL2JV4__j-r1kdhPLSgQCQ@mail.gmail.com
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Tested-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f6cbda794bd0faf328e06425922666b371307a33
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Feb 1 12:04:55 2016 +0100

    ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check

    commit cc85f7a634cfaf9f0713c6aa06d08817424db37a upstream.

    NULL user-space buffer can be passed even in a normal path, thus it's
    not good to spew a kernel warning with stack trace at each time.
    Just drop snd_BUG_ON() macro usage there.

    BugLink: http://lkml.kernel.org/r/CACT4Y+YfVJ3L+q0i-4vyQVyyPD7V=OMX0PWPi29x9Bo3QaBLdw@mail.gmail.com
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a04cbfbf93a719d9851a0a27972191e472191ed8
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Jan 25 11:01:47 2016 +0100

    ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()

    commit 599151336638d57b98d92338aa59c048e3a3e97d upstream.

    ALSA sequencer OSS emulation code has a sanity check for currently
    opened devices, but there is a thinko there, eventually it spews
    warnings and skips the operation wrongly like:
      WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311

    Fix this off-by-one error.

    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3e24e598a4663d244bfc90aa4dbdba8f929f0dd2
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jan 28 07:54:16 2016 +0100

    ALSA: dummy: Disable switching timer backend via sysfs

    commit 7ee96216c31aabe1eb42fb91ff50dae9fcd014b2 upstream.

    ALSA dummy driver can switch the timer backend between system timer
    and hrtimer via its hrtimer module option.  This can be also switched
    dynamically via sysfs, but it may lead to a memory corruption when
    switching is done while a PCM stream is running; the stream instance
    for the newly switched timer method tries to access the memory that
    was allocated by another timer method although the sizes differ.

    As the simplest fix, this patch just disables the switch via sysfs by
    dropping the writable bit.

    BugLink: http://lkml.kernel.org/r/CACT4Y+ZGEeEBntHW5WHn2GoeE0G_kRrCmUh6=dWyy-wfzvuJLg@mail.gmail.com
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 074e46b6e22aad0ec94eb38ed3e57a7b7c944d0c
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Jan 25 13:59:21 2016 +0100

    ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures

    commit 462b3f161beb62eeb290f4ec52f5ead29a2f8ac7 upstream.

    Some architectures like PowerPC can handle the maximum struct size in
    an ioctl only up to 13 bits, and struct snd_compr_codec_caps used by
    SNDRV_COMPRESS_GET_CODEC_CAPS ioctl overflows this limit.  This
    problem was revealed recently by a powerpc change, as it's now treated
    as a fatal build error.

    This patch is a stop-gap for that: for architectures with less than 14
    bit ioctl struct size, get rid of the handling of the relevant ioctl.
    We should provide an alternative equivalent ioctl code later, but for
    now just paper over it.  Luckily, the compress API hasn't been used on
    such architectures, so the impact must be effectively zero.

    Reviewed-by: Mark Brown <broonie@kernel.org>
    Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 482c4c1a74eab8c45ece6b353a92d65154b7ea98
Author: Andrey Konovalov <andreyknvl@gmail.com>
Date:   Sat Feb 13 11:08:06 2016 +0300

    ALSA: usb-audio: avoid freeing umidi object twice

    commit 07d86ca93db7e5cdf4743564d98292042ec21af7 upstream.

    The 'umidi' object will be free'd on the error path by snd_usbmidi_free()
    when tearing down the rawmidi interface. So we shouldn't try to free it
    in snd_usbmidi_create() after having registered the rawmidi interface.

    Found by KASAN.

    Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
    Acked-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fc345885783318c63a9860d4476e8cc4257de230
Author: Guillaume Fougnies <guillaume@eulerian.com>
Date:   Tue Jan 26 00:28:27 2016 +0100

    ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay

    commit 5a4ff9ec8d6edd2ab1cfe8ce6a080d6e57cbea9a upstream.

    TEAC UD-501/UD-503/NT-503 fail to switch properly between different
    rate/format. Similar to 'Playback Design', this patch corrects the
    invalid clock source error for TEAC products and avoids complete
    freeze of the usb interface of 503 series.

    Signed-off-by: Guillaume Fougnies <guillaume@eulerian.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 863475041a73939c8c4b637711e4fe87b0464abd
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Mon Nov 23 21:11:08 2015 -0500

    fix sysvfs symlinks

    commit 0ebf7f10d67a70e120f365018f1c5fce9ddc567d upstream.

    The thing got broken back in 2002 - sysvfs does *not* have inline
    symlinks; even short ones have bodies stored in the first block
    of file.  sysv_symlink() handles that correctly; unfortunately,
    attempting to look an existing symlink up will end up confusing
    them for inline symlinks, and interpret the block number containing
    the body as the body itself.

    Nobody has noticed until now, which says something about the level
    of testing sysvfs gets ;-/

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 53587d46617da3b8c2a212c4ffff837ee137c3aa
Author: Tiffany Lin <tiffany.lin@mediatek.com>
Date:   Thu Sep 24 06:02:36 2015 -0300

    media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish

    commit d9a985883fa32453d099d6293188c11d75cef1fa upstream.

    In videobuf2 dma-contig memory type the prepare and finish ops, instead of
    passing the number of entries in the original scatterlist as the "nents"
    parameter to dma_sync_sg_for_device() and dma_sync_sg_for_cpu(), the value
    returned by dma_map_sg() was used. Albeit this has been suggested in
    comments of some implementations (which have since been corrected), this
    is wrong.

    Fixes: 199d101efdba ("v4l: vb2-dma-contig: add prepare/finish to dma-contig allocator")

    Signed-off-by: Tiffany Lin <tiffany.lin@mediatek.com>
    Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1b97331b42c93644cf2798f412f2f8ce53e35044
Author: Andrzej Hajda <a.hajda@samsung.com>
Date:   Mon Aug 31 08:56:15 2015 -0300

    v4l2-compat-ioctl32: fix alignment for ARM64

    commit 655e9780ab913a3a06d4a164d55e3b755524186d upstream.

    Alignment/padding rules on AMD64 and ARM64 differs. To allow properly match
    compatible ioctls on ARM64 kernels without breaking AMD64 some fields
    should be aligned using compat_s64 type and in one case struct should be
    unpacked.

    Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
    [hans.verkuil@cisco.com: use compat_u64 instead of compat_s64 in v4l2_input32]
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 4fdefe95e6c1607e0bfd14e11f53696989dc636d
Author: Helge Deller <deller@gmx.de>
Date:   Sun Jan 10 09:30:42 2016 +0100

    parisc: Fix __ARCH_SI_PREAMBLE_SIZE

    commit e60fc5aa608eb38b47ba4ee058f306f739eb70a0 upstream.

    On a 64bit kernel build the compiler aligns the _sifields union in the
    struct siginfo_t on a 64bit address. The __ARCH_SI_PREAMBLE_SIZE define
    compensates for this alignment and thus fixes the wait testcase of the
    strace package.

    The symptoms of a wrong __ARCH_SI_PREAMBLE_SIZE value is that
    _sigchld.si_stime variable is missed to be copied and thus after a
    copy_siginfo() will have uninitialized values.

    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fedff89dcaa254b09bd0e14ebf82e25912f9f77e
Author: Helge Deller <deller@gmx.de>
Date:   Mon Dec 21 10:03:30 2015 +0100

    parisc: Fix syscall restarts

    commit 71a71fb5374a23be36a91981b5614590b9e722c3 upstream.

    On parisc syscalls which are interrupted by signals sometimes failed to
    restart and instead returned -ENOSYS which in the worst case lead to
    userspace crashes.
    A similiar problem existed on MIPS and was fixed by commit e967ef02
    ("MIPS: Fix restart of indirect syscalls").

    On parisc the current syscall restart code assumes that all syscall
    callers load the syscall number in the delay slot of the ble
    instruction. That's how it is e.g. done in the unistd.h header file:
    	ble 0x100(%sr2, %r0)
    	ldi #syscall_nr, %r20
    Because of that assumption the current code never restored %r20 before
    returning to userspace.

    This assumption is at least not true for code which uses the glibc
    syscall() function, which instead uses this syntax:
    	ble 0x100(%sr2, %r0)
    	copy regX, %r20
    where regX depend on how the compiler optimizes the code and register
    usage.

    This patch fixes this problem by adding code to analyze how the syscall
    number is loaded in the delay branch and - if needed - copy the syscall
    number to regX prior returning to userspace for the syscall restart.

    Signed-off-by: Helge Deller <deller@gmx.de>
    Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d2bb787af44a88804427e7343ce17b7ec7e1d48e
Author: Helge Deller <deller@gmx.de>
Date:   Sun Nov 22 12:14:14 2015 +0100

    parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h

    commit dcbf0d299c00ed4f82ea8d6e359ad88a5182f9b8 upstream.

    Drop the MADV_xxK_PAGES flags, which were never used and were from a proposed
    API which was never integrated into the generic Linux kernel code.

    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1daeb19fa8cbd87b06d7f60f2114ba65fd701973
Author: Andy Leiserson <andy@leiserson.org>
Date:   Sun Oct 18 00:36:29 2015 -0400

    fix calculation of meta_bg descriptor backups

    commit 904dad4742d211b7a8910e92695c0fa957483836 upstream.

    "group" is the group where the backup will be placed, and is
    initialized to zero in the declaration. This meant that backups for
    meta_bg descriptors were erroneously written to the backup block group
    descriptors in groups 1 and (desc_per_block-1).

    Reproduction information:
      mke2fs -Fq -t ext4 -b 1024 -O ^resize_inode /tmp/foo.img 16G
      truncate -s 24G /tmp/foo.img
      losetup /dev/loop0 /tmp/foo.img
      mount /dev/loop0 /mnt
      resize2fs /dev/loop0
      umount /dev/loop0
      dd if=/dev/zero of=/dev/loop0 bs=1024 count=2
      e2fsck -fy /dev/loop0
      losetup -d /dev/loop0

    Signed-off-by: Andy Leiserson <andy@leiserson.org>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1174350e4dba0abb95f9f21154e333c54d97555d
Author: Jan Kara <jack@suse.cz>
Date:   Tue Nov 24 15:34:35 2015 -0500

    jbd2: Fix unreclaimed pages after truncate in data=journal mode

    commit bc23f0c8d7ccd8d924c4e70ce311288cb3e61ea8 upstream.

    Ted and Namjae have reported that truncated pages don't get timely
    reclaimed after being truncated in data=journal mode. The following test
    triggers the issue easily:

    for (i = 0; i < 1000; i++) {
    	pwrite(fd, buf, 1024*1024, 0);
    	fsync(fd);
    	fsync(fd);
    	ftruncate(fd, 0);
    }

    The reason is that journal_unmap_buffer() finds that truncated buffers
    are not journalled (jh->b_transaction == NULL), they are part of
    checkpoint list of a transaction (jh->b_cp_transaction != NULL) and have
    been already written out (!buffer_dirty(bh)). We clean such buffers but
    we leave them in the checkpoint list. Since checkpoint transaction holds
    a reference to the journal head, these buffers cannot be released until
    the checkpoint transaction is cleaned up. And at that point we don't
    call release_buffer_page() anymore so pages detached from mapping are
    lingering in the system waiting for reclaim to find them and free them.

    Fix the problem by removing buffers from transaction checkpoint lists
    when journal_unmap_buffer() finds out they don't have to be there
    anymore.

    Reported-and-tested-by: Namjae Jeon <namjae.jeon@samsung.com>
    Fixes: de1b794130b130e77ffa975bb58cb843744f9ae5
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 98b3bd61b250e6ebe77f475d7dd0660eec20b183
Author: Boris BREZILLON <boris.brezillon@free-electrons.com>
Date:   Thu Jul 30 12:18:03 2015 +0200

    mtd: mtdpart: fix add_mtd_partitions error path

    commit e5bae86797141e4a95e42d825f737cb36d7b8c37 upstream.

    If we fail to allocate a partition structure in the middle of the partition
    creation process, the already allocated partitions are never removed, which
    means they are still present in the partition list and their resources are
    never freed.

    Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
    Signed-off-by: Brian Norris <computersforpeace@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2acba4b8b307985e93a2d86e619f8a16d39a247b
Author: Hon Ching \(Vicky\) Lo <honclo@linux.vnet.ibm.com>
Date:   Wed Oct 7 20:11:51 2015 -0400

    vTPM: fix memory allocation flag for rtce buffer at kernel boot

    commit 60ecd86c4d985750efa0ea3d8610972b09951715 upstream.

    At ibm vtpm initialzation, tpm_ibmvtpm_probe() registers its interrupt
    handler, ibmvtpm_interrupt, which calls ibmvtpm_crq_process to allocate
    memory for rtce buffer.  The current code uses 'GFP_KERNEL' as the
    type of kernel memory allocation, which resulted a warning at
    kernel/lockdep.c.  This patch uses 'GFP_ATOMIC' instead so that the
    allocation is high-priority and does not sleep.

    Signed-off-by: Hon Ching(Vicky) Lo <honclo@linux.vnet.ibm.com>
    Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c0d57f2bd29e813cb12f84cc2dd0d7508134bc26
Author: Uri Mashiach <uri.mashiach@compulab.co.il>
Date:   Thu Dec 24 16:05:00 2015 +0200

    wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)

    commit e47301b06d5a65678690f04c2248fd181db1e59a upstream.

    Fix the below Oops when trying to modprobe wlcore_spi.
    The oops occurs because the wl1271_power_{off,on}()
    function doesn't check the power() function pointer.

    [   23.401447] Unable to handle kernel NULL pointer dereference at
    virtual address 00000000
    [   23.409954] pgd = c0004000
    [   23.412922] [00000000] *pgd=00000000
    [   23.416693] Internal error: Oops: 80000007 [#1] SMP ARM
    [   23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
    musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev
    omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23
    c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma
    snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
    [   23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted
    4.2.0-00002-g951efee-dirty #233
    [   23.461720] Hardware name: Generic AM33XX (Flattened Device Tree)
    [   23.468123] Workqueue: events request_firmware_work_func
    [   23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000
    [   23.479341] PC is at 0x0
    [   23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore]
    [   23.488074] pc : [<00000000>]    lr : [<bf2581f0>]    psr: 60000013
    [   23.488074] sp : de4efe50  ip : 00000002  fp : 00000000
    [   23.500162] r10: de7cdd00  r9 : dc848800  r8 : bf27af00
    [   23.505663] r7 : bf27a1a8  r6 : dcbd8a80  r5 : dce0e2e0  r4 :
    dce0d2e0
    [   23.512536] r3 : 00000000  r2 : 00000000  r1 : 00000001  r0 :
    dc848810
    [   23.519412] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
    Segment kernel
    [   23.527109] Control: 10c5387d  Table: 9cb78019  DAC: 00000015
    [   23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218)
    [   23.539760] Stack: (0xde4efe50 to 0xde4f0000)

    [...]

    [   23.665030] [<bf2581f0>] (wl12xx_set_power_on [wlcore]) from
    [<bf25f7ac>] (wlcore_nvs_cb+0x118/0xa4c [wlcore])
    [   23.675604] [<bf25f7ac>] (wlcore_nvs_cb [wlcore]) from [<c04387ec>]
    (request_firmware_work_func+0x30/0x58)
    [   23.685784] [<c04387ec>] (request_firmware_work_func) from
    [<c0058e2c>] (process_one_work+0x1b4/0x4b4)
    [   23.695591] [<c0058e2c>] (process_one_work) from [<c0059168>]
    (worker_thread+0x3c/0x4a4)
    [   23.704124] [<c0059168>] (worker_thread) from [<c005ee68>]
    (kthread+0xd4/0xf0)
    [   23.711747] [<c005ee68>] (kthread) from [<c000f598>]
    (ret_from_fork+0x14/0x3c)
    [   23.719357] Code: bad PC value
    [   23.722760] ---[ end trace 981be8510db9b3a9 ]---

    Prevent oops by validationg power() pointer value before
    calling the function.

    Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
    Acked-by: Igor Grinberg <grinberg@compulab.co.il>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0d2099937583ef8ed9d7c34f2ac9aa73e098d808
Author: Uri Mashiach <uri.mashiach@compulab.co.il>
Date:   Thu Dec 10 15:12:56 2015 +0200

    wlcore/wl12xx: spi: fix oops on firmware load

    commit 9b2761cb72dc41e1948c8a5512b4efd384eda130 upstream.

    The maximum chunks used by the function is
    (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
    The original commands array had space for
    (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands.
    When the last chunk is used (len > 4 * WSPI_MAX_CHUNK_SIZE), the last
    command is stored outside the bounds of the commands array.

    Oops 5 (page fault) is generated during current wl1271 firmware load
    attempt:

    root@debian-armhf:~# ifconfig wlan0 up
    [  294.312399] Unable to handle kernel paging request at virtual address
    00203fc4
    [  294.320173] pgd = de528000
    [  294.323028] [00203fc4] *pgd=00000000
    [  294.326916] Internal error: Oops: 5 [#1] SMP ARM
    [  294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx
    wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common
    wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys
    hwmon
    [  294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted
    4.2.0-00002-g3e9ad27-dirty #78
    [  294.360154] Hardware name: Generic AM33XX (Flattened Device Tree)
    [  294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000
    [  294.372236] PC is at __spi_validate+0xa8/0x2ac
    [  294.376902] LR is at __spi_sync+0x78/0x210
    [  294.381200] pc : [<c049c760>]    lr : [<c049ebe0>]    psr: 60000013
    [  294.381200] sp : de551998  ip : de5519d8  fp : 00200000
    [  294.393242] r10: de551c8c  r9 : de5519d8  r8 : de3a9000
    [  294.398730] r7 : de3a9258  r6 : de3a9400  r5 : de551a48  r4 :
    00203fbc
    [  294.405577] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 :
    de3a9000
    [  294.412420] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
    Segment user
    [  294.419918] Control: 10c5387d  Table: 9e528019  DAC: 00000015
    [  294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218)
    [  294.432437] Stack: (0xde551998 to 0xde552000)

    ...

    [  294.883613] [<c049c760>] (__spi_validate) from [<c049ebe0>]
    (__spi_sync+0x78/0x210)
    [  294.891670] [<c049ebe0>] (__spi_sync) from [<bf036598>]
    (wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi])
    [  294.901661] [<bf036598>] (wl12xx_spi_raw_write [wlcore_spi]) from
    [<bf21c694>] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore])
    [  294.914038] [<bf21c694>] (wlcore_boot_upload_firmware [wlcore]) from
    [<bf24532c>] (wl12xx_boot+0xc10/0xfac [wl12xx])
    [  294.925161] [<bf24532c>] (wl12xx_boot [wl12xx]) from [<bf20d5cc>]
    (wl1271_op_add_interface+0x5b0/0x910 [wlcore])
    [  294.936364] [<bf20d5cc>] (wl1271_op_add_interface [wlcore]) from
    [<bf15c4ac>] (ieee80211_do_open+0x44c/0xf7c [mac80211])
    [  294.947963] [<bf15c4ac>] (ieee80211_do_open [mac80211]) from
    [<c0537978>] (__dev_open+0xa8/0x110)
    [  294.957307] [<c0537978>] (__dev_open) from [<c0537bf8>]
    (__dev_change_flags+0x88/0x148)
    [  294.965713] [<c0537bf8>] (__dev_change_flags) from [<c0537cd0>]
    (dev_change_flags+0x18/0x48)
    [  294.974576] [<c0537cd0>] (dev_change_flags) from [<c05a55a0>]
    (devinet_ioctl+0x6b4/0x7d0)
    [  294.983191] [<c05a55a0>] (devinet_ioctl) from [<c0517040>]
    (sock_ioctl+0x1e4/0x2bc)
    [  294.991244] [<c0517040>] (sock_ioctl) from [<c017d378>]
    (do_vfs_ioctl+0x420/0x6b0)
    [  294.999208] [<c017d378>] (do_vfs_ioctl) from [<c017d674>]
    (SyS_ioctl+0x6c/0x7c)
    [  295.006880] [<c017d674>] (SyS_ioctl) from [<c000f4c0>]
    (ret_fast_syscall+0x0/0x54)
    [  295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008)
    [  295.021544] ---[ end trace 66ed188198f4e24e ]---

    Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
    Acked-by: Igor Grinberg <grinberg@compulab.co.il>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1dcdf54f2426085c65f00a171259da0f1bd6fd93
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Dec 14 16:16:19 2015 +0100

    spi: fix parent-device reference leak

    commit 157f38f993919b648187ba341bfb05d0e91ad2f6 upstream.

    Fix parent-device reference leak due to SPI-core taking an unnecessary
    reference to the parent when allocating the master structure, a
    reference that was never released.

    Note that driver core takes its own reference to the parent when the
    master device is registered.

    Fixes: 49dce689ad4e ("spi doesn't need class_device")
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 092f4b70fe24ef591430e5111ebeffb67ec241eb
Author: David Mosberger-Tang <davidm@egauge.net>
Date:   Tue Oct 20 14:26:47 2015 +0200

    spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word

    commit 06515f83908d038d9e12ffa3dcca27a1b67f2de0 upstream.

    The DMA-slave configuration depends on the whether <= 8 or > 8 bits
    are transferred per word, so we need to call
    atmel_spi_dma_slave_config() with the correct value.

    Signed-off-by: David Mosberger <davidm@egauge.net>
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0fd9b8b499b31651d3b2d1c837a0f199ea25cc41
Author: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
Date:   Thu Oct 29 10:24:23 2015 -0200

    Revert "dm mpath: fix stalls when handling invalid ioctls"

    commit 47796938c46b943d157ac8a6f9ed4e3b98b83cf4 upstream.

    This reverts commit a1989b330093578ea5470bea0a00f940c444c466.

    That commit introduced a regression at least for the case of the SG_IO ioctl()
    running without CAP_SYS_RAWIO capability (e.g., unprivileged users) when there
    are no active paths: the ioctl() fails with the ENOTTY errno immediately rather
    than blocking due to queue_if_no_path until a path becomes active, for example.

    That case happens to be exercised by QEMU KVM guests with 'scsi-block' devices
    (qemu "-device scsi-block" [1], libvirt "<disk type='block' device='lun'>" [2])
    from multipath devices; which leads to SCSI/filesystem errors in such a guest.

    More general scenarios can hit that regression too. The following demonstration
    employs a SG_IO ioctl() with a standard SCSI INQUIRY command for this objective
    (some output & user changes omitted for brevity and comments added for clarity).

    Reverting that commit restores normal operation (queueing) in failing scenarios;
    tested on linux-next (next-20151022).

    1) Test-case is based on sg_simple0 [3] (just SG_IO; remove SG_GET_VERSION_NUM)

        $ cat sg_simple0.c
        ... see [3] ...
        $ sed '/SG_GET_VERSION_NUM/,/}/d' sg_simple0.c > sgio_inquiry.c
        $ gcc sgio_inquiry.c -o sgio_inquiry

    2) The ioctl() works fine with active paths present.

        # multipath -l 85ag56
        85ag56 (...) dm-19 IBM     ,2145
        size=60G features='1 queue_if_no_path' hwhandler='0' wp=rw
        |-+- policy='service-time 0' prio=0 status=active
        | |- 8:0:11:0  sdz  65:144  active undef running
        | `- 9:0:9:0   sdbf 67:144  active undef running
        `-+- policy='service-time 0' prio=0 status=enabled
          |- 8:0:12:0  sdae 65:224  active undef running
          `- 9:0:12:0  sdbo 68:32   active undef running

        $ ./sgio_inquiry /dev/mapper/85ag56
        Some of the INQUIRY command's response:
            IBM       2145              0000
        INQUIRY duration=0 millisecs, resid=0

    3) The ioctl() fails with ENOTTY errno with _no_ active paths present,
       for unprivileged users (rather than blocking due to queue_if_no_path).

        # for path in $(multipath -l 85ag56 | grep -o 'sd[a-z]\+'); \
              do multipathd -k"fail path $path"; done

        # multipath -l 85ag56
        85ag56 (...) dm-19 IBM     ,2145
        size=60G features='1 queue_if_no_path' hwhandler='0' wp=rw
        |-+- policy='service-time 0' prio=0 status=enabled
        | |- 8:0:11:0  sdz  65:144  failed undef running
        | `- 9:0:9:0   sdbf 67:144  failed undef running
        `-+- policy='service-time 0' prio=0 status=enabled
          |- 8:0:12:0  sdae 65:224  failed undef running
          `- 9:0:12:0  sdbo 68:32   failed undef running

        $ ./sgio_inquiry /dev/mapper/85ag56
        sg_simple0: Inquiry SG_IO ioctl error: Inappropriate ioctl for device

    4) dmesg shows that scsi_verify_blk_ioctl() failed for SG_IO (0x2285);
       it returns -ENOIOCTLCMD, later replaced with -ENOTTY in vfs_ioctl().

        $ dmesg
        <...>
        [] device-mapper: multipath: Failing path 65:144.
        [] device-mapper: multipath: Failing path 67:144.
        [] device-mapper: multipath: Failing path 65:224.
        [] device-mapper: multipath: Failing path 68:32.
        [] sgio_inquiry: sending ioctl 2285 to a partition!

    5) The ioctl() only works if the SYS_CAP_RAWIO capability is present
       (then queueing happens -- in this example, queue_if_no_path is set);
       this is due to a conditional check in scsi_verify_blk_ioctl().

        # capsh --drop=cap_sys_rawio -- -c './sgio_inquiry /dev/mapper/85ag56'
        sg_simple0: Inquiry SG_IO ioctl error: Inappropriate ioctl for device

        # ./sgio_inquiry /dev/mapper/85ag56 &
        [1] 72830

        # cat /proc/72830/stack
        [<c00000171c0df700>] 0xc00000171c0df700
        [<c000000000015934>] __switch_to+0x204/0x350
        [<c000000000152d4c>] msleep+0x5c/0x80
        [<c00000000077dfb0>] dm_blk_ioctl+0x70/0x170
        [<c000000000487c40>] blkdev_ioctl+0x2b0/0x9b0
        [<c0000000003128e4>] block_ioctl+0x64/0xd0
        [<c0000000002dd3b0>] do_vfs_ioctl+0x490/0x780
        [<c0000000002dd774>] SyS_ioctl+0xd4/0xf0
        [<c000000000009358>] system_call+0x38/0xd0

    6) This is the function call chain exercised in this analysis:

    SYSCALL_DEFINE3(ioctl, <...>) @ fs/ioctl.c
        -> do_vfs_ioctl()
            -> vfs_ioctl()
                ...
                error = filp->f_op->unlocked_ioctl(filp, cmd, arg);
                ...
                    -> dm_blk_ioctl() @ drivers/md/dm.c
                        -> multipath_ioctl() @ drivers/md/dm-mpath.c
                            ...
                            (bdev = NULL, due to no active paths)
                            ...
                            if (!bdev || <...>) {
                                int err = scsi_verify_blk_ioctl(NULL, cmd);
                                if (err)
                                    r = err;
                            }
                            ...
                                -> scsi_verify_blk_ioctl() @ block/scsi_ioctl.c
                                    ...
                                    if (bd && bd == bd->bd_contains) // not taken (bd = NULL)
                                        return 0;
                                    ...
                                    if (capable(CAP_SYS_RAWIO)) // not taken (unprivileged user)
                                        return 0;
                                    ...
                                    printk_ratelimited(KERN_WARNING
                                               "%s: sending ioctl %x to a partition!\n" <...>);

                                    return -ENOIOCTLCMD;
                                <-
                            ...
                            return r ? : <...>
                        <-
                ...
                if (error == -ENOIOCTLCMD)
                    error = -ENOTTY;
                 out:
                    return error;
                ...

    Links:
    [1] http://git.qemu.org/?p=qemu.git;a=commit;h=336a6915bc7089fb20fea4ba99972ad9a97c5f52
    [2] https://libvirt.org/formatdomain.html#elementsDisks (see 'disk' -> 'device')
    [3] http://tldp.org/HOWTO/SCSI-Generic-HOWTO/pexample.html (Revision 1.2, 2002-05-03)

    Signed-off-by: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 516932b7059a935f0360e486014fdabbb28f45da
Author: Dmitry V. Levin <ldv@altlinux.org>
Date:   Fri Dec 11 13:41:06 2015 -0800

    sh64: fix __NR_fgetxattr

    commit 2d33fa1059da4c8e816627a688d950b613ec0474 upstream.

    According to arch/sh/kernel/syscalls_64.S and common sense, __NR_fgetxattr
    has to be defined to 259, but it doesn't.  Instead, it's defined to 269,
    which is of course used by another syscall, __NR_sched_setaffinity in this
    case.

    This bug was found by strace test suite.

    Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
    Acked-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bb169b2b585790c58d59aa09e1408e365a7acccc
Author: xuejiufei <xuejiufei@huawei.com>
Date:   Fri Feb 5 15:36:47 2016 -0800

    ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup

    commit c95a51807b730e4681e2ecbdfd669ca52601959e upstream.

    When recovery master down, dlm_do_local_recovery_cleanup() only remove
    the $RECOVERY lock owned by dead node, but do not clear the refmap bit.
    Which will make umount thread falling in dead loop migrating $RECOVERY
    to the dead node.

    Signed-off-by: xuejiufei <xuejiufei@huawei.com>
    Reviewed-by: Joseph Qi <joseph.qi@huawei.com>
    Cc: Mark Fasheh <mfasheh@suse.de>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Junxiao Bi <junxiao.bi@oracle.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 854e6fc9de5bf94952095b544daa6c339b41014b
Author: xuejiufei <xuejiufei@huawei.com>
Date:   Thu Jan 14 15:17:38 2016 -0800

    ocfs2/dlm: ignore cleaning the migration mle that is inuse

    commit bef5502de074b6f6fa647b94b73155d675694420 upstream.

    We have found that migration source will trigger a BUG that the refcount
    of mle is already zero before put when the target is down during
    migration.  The situation is as follows:

    dlm_migrate_lockres
      dlm_add_migration_mle
      dlm_mark_lockres_migrating
      dlm_get_mle_inuse
      <<<<<< Now the refcount of the mle is 2.
      dlm_send_one_lockres and wait for the target to become the
      new master.
      <<<<<< o2hb detect the target down and clean the migration
      mle. Now the refcount is 1.

    dlm_migrate_lockres woken, and put the mle twice when found the target
    goes down which trigger the BUG with the following message:

      "ERROR: bad mle: ".

    Signed-off-by: Jiufei Xue <xuejiufei@huawei.com>
    Reviewed-by: Joseph Qi <joseph.qi@huawei.com>
    Cc: Mark Fasheh <mfasheh@suse.de>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Junxiao Bi <junxiao.bi@oracle.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa17bfe3b7bf53e68be8dc3eda4ebfbfae85d6ea
Author: Richard Weinberger <richard@nod.at>
Date:   Fri Nov 20 15:57:21 2015 -0800

    kernel/signal.c: unexport sigsuspend()

    commit 9d8a765211335cfdad464b90fb19f546af5706ae upstream.

    sigsuspend() is nowhere used except in signal.c itself, so we can mark it
    static do not pollute the global namespace.

    But this patch is more than a boring cleanup patch, it fixes a real issue
    on UserModeLinux.  UML has a special console driver to display ttys using
    xterm, or other terminal emulators, on the host side.  Vegard reported
    that sometimes UML is unable to spawn a xterm and he's facing the
    following warning:

      WARNING: CPU: 0 PID: 908 at include/linux/thread_info.h:128 sigsuspend+0xab/0xc0()

    It turned out that this warning makes absolutely no sense as the UML
    xterm code calls sigsuspend() on the host side, at least it tries.  But
    as the kernel itself offers a sigsuspend() symbol the linker choose this
    one instead of the glibc wrapper.  Interestingly this code used to work
    since ever but always blocked signals on the wrong side.  Some recent
    kernel change made the WARN_ON() trigger and uncovered the bug.

    It is a wonderful example of how much works by chance on computers. :-)

    Fixes: 68f3f16d9ad0f1 ("new helper: sigsuspend()")
    Signed-off-by: Richard Weinberger <richard@nod.at>
    Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
    Tested-by: Vegard Nossum <vegard.nossum@oracle.com>
    Acked-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2ed0426bd1fd55d115787cbdb7c381f4c907a8e5
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Fri Nov 20 18:26:07 2015 +0100

    remoteproc: avoid stack overflow in debugfs file

    commit 92792e48e2ae6051af30468a87994b5432da2f06 upstream.

    Recent gcc versions warn about reading from a negative offset of
    an on-stack array:

    drivers/remoteproc/remoteproc_debugfs.c: In function 'rproc_recovery_write':
    drivers/remoteproc/remoteproc_debugfs.c:167:9: warning: 'buf[4294967295u]' may be used uninitialized in this function [-Wmaybe-uninitialized]

    I don't see anything in sys_write() that prevents us from
    being called with a zero 'count' argument, so we should
    add an extra check in rproc_recovery_write() to prevent the
    access and avoid the warning.

    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Fixes: 2e37abb89a2e ("remoteproc: create a 'recovery' debugfs entry")
    Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e9828fd09906acf8fedb6152f58ec97b24d671e2
Author: Ioan-Adrian Ratiu <adi@adirat.com>
Date:   Fri Nov 20 22:19:02 2015 +0200

    HID: usbhid: fix recursive deadlock

    commit e470127e9606b1fa151c4184243e61296d1e0c0f upstream.

    The critical section protected by usbhid->lock in hid_ctrl() is too
    big and because of this it causes a recursive deadlock. "Too big" means
    the case statement and the call to hid_input_report() do not need to be
    protected by the spinlock (no URB operations are done inside them).

    The deadlock happens because in certain rare cases drivers try to grab
    the lock while handling the ctrl irq which grabs the lock before them
    as described above. For example newer wacom tablets like 056a:033c try
    to reschedule proximity reads from wacom_intuos_schedule_prox_event()
    calling hid_hw_request() -> usbhid_request() -> usbhid_submit_report()
    which tries to grab the usbhid lock already held by hid_ctrl().

    There are two ways to get out of this deadlock:
        1. Make the drivers work "around" the ctrl critical region, in the
        wacom case for ex. by delaying the scheduling of the proximity read
        request itself to a workqueue.
        2. Shrink the critical region so the usbhid lock protects only the
        instructions which modify usbhid state, calling hid_input_report()
        with the spinlock unlocked, allowing the device driver to grab the
        lock first, finish and then grab the lock afterwards in hid_ctrl().

    This patch implements the 2nd solution.

    Signed-off-by: Ioan-Adrian Ratiu <adi@adirat.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6671b052b3d6a885d0fa53d553b71c3d492ba62
Author: Mike Snitzer <snitzer@redhat.com>
Date:   Mon Nov 23 16:24:45 2015 -0500

    dm btree: fix leak of bufio-backed block in btree_split_sibling error path

    commit 30ce6e1cc5a0f781d60227e9096c86e188d2c2bd upstream.

    The block allocated at the start of btree_split_sibling() is never
    released if later insert_at() fails.

    Fix this by releasing the previously allocated bufio block using
    unlock_block().

    Reported-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit daaf3fd914414d67fd656a39c0f1575c07f02985
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Sun Nov 1 17:11:19 2015 +0800

    crypto: algif_hash - Only export and import on sockets with data

    commit 4afa5f9617927453ac04b24b584f6c718dfb4f45 upstream.

    The hash_accept call fails to work on sockets that have not received
    any data.  For some algorithm implementations it may cause crashes.

    This patch fixes this by ensuring that we only export and import on
    sockets that have received data.

    Reported-by: Harsh Jain <harshjain.prof@gmail.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Tested-by: Stephan Mueller <smueller@chronox.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 12c1515f4aae559359aec9d9381c2657fb19498a
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun Jan 31 11:11:58 2016 -0800

    xhci: fix placement of call to usb_disabled()

    In the backport of 1eaf35e4dd592c59041bc1ed3248c46326da1f5f, the call to
    usb_disabled() was too late, after we had already done some allocation.
    Move that call to the top of the function instead, making the logic
    match what is intended and is in the original patch.

    Reported-by: Luis Henriques <luis.henriques@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4bd503f766d2388df8050bb4975918c677709476
Author: libin <huawei.libin@huawei.com>
Date:   Tue Nov 3 08:58:47 2015 +0800

    recordmcount: Fix endianness handling bug for nop_mcount

    commit c84da8b9ad3761eef43811181c7e896e9834b26b upstream.

    In nop_mcount, shdr->sh_offset and welp->r_offset should handle
    endianness properly, otherwise it will trigger Segmentation fault
    if the recordmcount main and file.o have different endianness.

    Link: http://lkml.kernel.org/r/563806C7.7070606@huawei.com

    Signed-off-by: Li Bin <huawei.libin@huawei.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

0 files changed, 0 insertions, 0 deletions