linux-stable.git, branch v4.2.5

Linux 4.2.5

2015-10-27T00:53:59+00:00

svcrdma: handle rdma read with a non-zero initial page offset

2015-10-27T00:53:43+00:00

commit c91aed9896946721bb30705ea2904edb3725dd61 upstream.

The server rdma_read_chunk_lcl() and rdma_read_chunk_frmr() functions
were not taking into account the initial page_offset when determining
the rdma read length.  This resulted in a read who's starting address
and length exceeded the base/bounds of the frmr.

The server gets an async error from the rdma device and kills the
connection, and the client then reconnects and resends.  This repeats
indefinitely, and the application hangs.

Most work loads don't tickle this bug apparently, but one test hit it
every time: building the linux kernel on a 16 core node with 'make -j
16 O=/mnt/0' where /mnt/0 is a ramdisk mounted via NFSRDMA.

This bug seems to only be tripped with devices having small fastreg page
list depths.  I didn't see it with mlx4, for instance.

Fixes: 0bf4828983df ('svcrdma: refactor marshalling logic')
Signed-off-by: Steve Wise 
Tested-by: Chuck Lever 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Greg Kroah-Hartman

arm64: Fix THP protection change logic

2015-10-27T00:53:43+00:00

commit 1a541b4e3cd6f5795022514114854b3e1345f24e upstream.

6910fa1 ("arm64: enable PTE type bit in the mask for pte_modify") fixes
a problem whereby a large block of PROT_NONE mapped memory is
incorrectly mapped as block descriptors when mprotect is called.

Unfortunately, a subtle bug was introduced by this fix to the THP logic.

If one mmaps a large block of memory, then faults it such that it is
collapsed into THPs; resulting calls to mprotect on this area of memory
will lead to incorrect table descriptors being written instead of block
descriptors. This is because pmd_modify calls pte_modify which is now
allowed to modify the type of the page table entry.

This patch reverts commit 6910fa16dbe142f6a0fd0fd7c249f9883ff7fc8a, and
fixes the problem it was trying to address by adjusting PAGE_NONE to
represent a table entry. Thus no change in pte type is required when
moving from PROT_NONE to a different protection.

Fixes: 6910fa16dbe1 ("arm64: enable PTE type bit in the mask for pte_modify")
Cc:  # 4.0+
Cc: Feng Kan 
Reported-by: Ganapatrao Kulkarni 
Tested-by: Ganapatrao Kulkarni 
Reviewed-by: Catalin Marinas 
[SteveC: backported 1a541b4e3cd6f5795022514114854b3e1345f24e to 4.1 and
 4.2 stable. Just one minor fix to second part to allow patch to apply
cleanly, no logic changed.]
Signed-off-by: Steve Capper 
Signed-off-by: Catalin Marinas 
Signed-off-by: Greg Kroah-Hartman

pinctrl: imx25: ensure that a pin with id i is at position i in the info array

2015-10-27T00:53:43+00:00

commit 9911a2d5e9d14e39692b751929a92cb5a1d9d0e0 upstream.

The code in pinctrl-imx.c only works correctly if in the
imx_pinctrl_soc_info passed to imx_pinctrl_probe we have:

	info->pins[i].number = i
	conf_reg(info->pins[i]) = 4 * i

(which conf_reg(pin) being the offset of the pin's configuration
register).

When the imx25 specific part was introduced in b4a87c9b966f ("pinctrl:
pinctrl-imx: add imx25 pinctrl driver") we had:

	info->pins[i].number = i + 1
	conf_reg(info->pins[i]) = 4 * i

. Commit 34027ca2bbc6 ("pinctrl: imx25: fix numbering for pins") tried
to fix that but made the situation:

	info->pins[i-1].number = i
	conf_reg(info->pins[i-1]) = 4 * i

which is hardly better but fixed the error seen back then.

So insert another reserved entry in the array to finally yield:

	info->pins[i].number = i
	conf_reg(info->pins[i]) = 4 * i

Fixes: 34027ca2bbc6 ("pinctrl: imx25: fix numbering for pins")
Signed-off-by: Uwe Kleine-König 
Signed-off-by: Linus Walleij 
Signed-off-by: Greg Kroah-Hartman

timekeeping: Increment clock_was_set_seq in timekeeping_init()

2015-10-27T00:53:43+00:00

commit 56fd16cabac9cd8f15e2902898a9d0cc96e2fa70 upstream.

timekeeping_init() can set the wall time offset, so we need to
increment the clock_was_set_seq counter. That way hrtimers will pick
up the early offset immediately. Otherwise on a machine which does not
set wall time later in the boot process the hrtimer offset is stale at
0 and wall time timers are going to expire with a delay of 45 years.

Fixes: 868a3e915f7f "hrtimer: Make offset update smarter"
Reported-and-tested-by: Heiko Carstens 
Signed-off-by: Thomas Gleixner 
Cc: Stefan Liebler 
Cc: Peter Zijlstra 
Cc: John Stultz 
Signed-off-by: Greg Kroah-Hartman

rbd: fix double free on rbd_dev->header_name

2015-10-27T00:53:43+00:00

commit 3ebe138ac642a195c7f2efdb918f464734421fd6 upstream.

If rbd_dev_image_probe() in rbd_dev_probe_parent() fails, header_name
is freed twice: once in rbd_dev_probe_parent() and then in its caller
rbd_dev_image_probe() (rbd_dev_image_probe() is called recursively to
handle parent images).

rbd_dev_probe_parent() is responsible for probing the parent, so it
shouldn't muck with clone's fields.

Signed-off-by: Ilya Dryomov 
Reviewed-by: Alex Elder 
Signed-off-by: Greg Kroah-Hartman

dm thin: fix missing pool reference count decrement in pool_ctr error path

2015-10-27T00:53:42+00:00

commit ba30670f4d5292c4e7f7980bbd5071f7c4794cdd upstream.

Fixes: ac8c3f3df ("dm thin: generate event when metadata threshold passed")
Signed-off-by: Mike Snitzer 
Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: Keep the pflip interrupts always enabled v7

2015-10-27T00:53:42+00:00

commit f6c7aba47bcc0b1cc2085c8d8af80f8c02f28269 upstream.

This fixes flickering issues caused by prematurely firing pflip
interrupts.

v2 (chk): add commit message, fix DCE V10/V11 and DM as well
v3: Re-enable pflip interrupt wherever we re-enable a CRTC
v4: Enable pflip interrupt in DAL as well
v5: drop DAL changes for upstream
v6: (agd): only enable interrupts on crtcs that exist
v7: (agd): integrate suggestions from Michel

Signed-off-by: Michel Dänzer 
Signed-off-by: Christian König 
Reviewed-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: check before checking pci bridge registers

2015-10-27T00:53:42+00:00

commit e79d5c0870eedce94e5f5a2ffab30511e48fa144 upstream.

Make sure we are not the root device before attempting to
read the pcie bridge registers to check the pcie gen speeed.

Fixes a crash when the device is passed through to a VM.

Reviewed-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: fix num_crtc on CZ

2015-10-27T00:53:41+00:00

commit 26d0c21db1fd1679fcf07863741c13ba5ce37a65 upstream.

Hw only has 3 crtcs.  copy paste typo.

Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman