linux-stable.git/drivers, branch v4.9.40

PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present

2017-07-27T22:08:08+00:00

commit 975e83cfb8dc16e7a2fdc58188c77c0c605876c2 upstream.

If the genpd->attach_dev or genpd->power_on fails, genpd_dev_pm_attach
may return -EPROBE_DEFER initially. However genpd_alloc_dev_data sets
the PM domain for the device unconditionally.

When subsequent attempts are made to call genpd_dev_pm_attach, it may
return -EEXISTS checking dev->pm_domain without re-attempting to call
attach_dev or power_on.

platform_drv_probe then attempts to call drv->probe as the return value
-EEXIST != -EPROBE_DEFER, which may end up in a situation where the
device is accessed without it's power domain switched on.

Fixes: f104e1e5ef57 (PM / Domains: Re-order initialization of generic_pm_domain_data)
Signed-off-by: Sudeep Holla 
Acked-by: Ulf Hansson 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman

spmi: Include OF based modalias in device uevent

2017-07-27T22:08:08+00:00

commit d50daa2af2618dab6d21634e65a5fbcf4ae437d6 upstream.

Include the OF-based modalias in the uevent sent when registering SPMI
devices, so that user space has a chance to autoload the kernel module
for the device.

Tested-by: Rob Clark 
Reported-by: Rob Clark 
Reviewed-by: Stephen Boyd 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

of: device: Export of_device_{get_modalias, uvent_modalias} to modules

2017-07-27T22:08:08+00:00

commit 7a3b7cd332db08546f3cdd984f11773e0d1999e7 upstream.

The ULPI bus can be built as a module, and it will soon be
calling these functions when it supports probing devices from DT.
Export them so they can be used by the ULPI module.

Acked-by: Rob Herring 
Cc: 
Signed-off-by: Stephen Boyd 
Signed-off-by: Peter Chen 
Signed-off-by: Greg Kroah-Hartman

acpi/nfit: Fix memory corruption/Unregister mce decoder on failure

2017-07-27T22:08:07+00:00

commit 7e700d2c59e5853c9126642976b4f5768f64c9b3 upstream.

nfit_init() calls nfit_mce_register() on module load.  When the module
load fails the nfit mce decoder is not unregistered.  The module's
memory is freed leaving the decoder chain referencing junk.  This will
cause panics as future registrations will reference the free'd memory.

Unregister the nfit mce decoder on module init failure.

[v2]: register and then unregister mce handler to avoid losing mce events
[v3]: also cleanup nfit workqueue

Fixes: 6839a6d96f4e ("nfit: do an ARS scrub on hitting a latent media error")
Cc: "Rafael J. Wysocki" 
Cc: Len Brown 
Cc: Vishal Verma 
Cc: "Lee, Chun-Yi" 
Cc: Linda Knippers 
Cc: lszubowi@redhat.com
Acked-by: Jeff Moyer 
Signed-off-by: Prarit Bhargava 
Reviewed-by: Vishal Verma 
Signed-off-by: Dan Williams 
Signed-off-by: Greg Kroah-Hartman

mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms[] array

2017-07-27T22:08:07+00:00

commit 99975cd4fda52974a767aa44fe0b1a8f74950d9d upstream.

ib_map_mr_sg() can pass an SG-list to .map_mr_sg() that is larger
than what fits into a single MR. .map_mr_sg() must not attempt to
map more SG-list elements than what fits into a single MR.
Hence make sure that mlx5_ib_sg_to_klms() does not write outside
the MR klms[] array.

Fixes: b005d3164713 ("mlx5: Add arbitrary sg list support")
Signed-off-by: Bart Van Assche 
Reviewed-by: Max Gurtovoy 
Cc: Sagi Grimberg 
Cc: Leon Romanovsky 
Cc: Israel Rukshin 
Acked-by: Leon Romanovsky 
Reviewed-by: Sagi Grimberg 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

drm/mst: Avoid processing partially received up/down message transactions

2017-07-27T22:08:07+00:00

commit 636c4c3e762b62aa93632c645ca65879285b16e3 upstream.

Currently we may process up/down message transactions containing
uninitialized data. This can happen if there was an error during the
reception of any message in the transaction, but we happened to receive
the last message correctly with the end-of-message flag set.

To avoid this abort the reception of the transaction when the first
error is detected, rejecting any messages until a message with the
start-of-message flag is received (which will start a new transaction).
This is also what the DP 1.4 spec 2.11.8.2 calls for in this case.

In addtion this also prevents receiving bogus transactions without the
first message with the the start-of-message flag set.

v2:
- unchanged
v3:
- git add the part that actually skips messages after an error in
  drm_dp_sideband_msg_build()

Cc: Dave Airlie 
Cc: Lyude 
Cc: Daniel Vetter 
Signed-off-by: Imre Deak 
Reviewed-by: Lyude 
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20170719134632.13366-1-imre.deak@intel.com
Signed-off-by: Greg Kroah-Hartman

drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req()

2017-07-27T22:08:07+00:00

commit 7f8b3987da54cb4d41ad2545cd4d7958b9a36bdf upstream.

In case of an unknown broadcast message is sent mstb will remain unset,
so check for this.

Cc: Dave Airlie 
Cc: Lyude 
Cc: Daniel Vetter 
Signed-off-by: Imre Deak 
Reviewed-by: Lyude 
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20170719114330.26540-3-imre.deak@intel.com
Signed-off-by: Greg Kroah-Hartman

drm/mst: Fix error handling during MST sideband message reception

2017-07-27T22:08:07+00:00

commit 448421b5e93b9177c5698f0cf6f5e72d2995eeca upstream.

Handle any error due to partial reads, timeouts etc. to avoid parsing
uninitialized data subsequently. Also bail out if the parsing itself
fails.

Cc: Dave Airlie 
Cc: Lyude 
Cc: Daniel Vetter 
Signed-off-by: Imre Deak 
Reviewed-by: Lyude 
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20170719114330.26540-2-imre.deak@intel.com
Signed-off-by: Greg Kroah-Hartman

RDMA/core: Initialize port_num in qp_attr

2017-07-27T22:08:07+00:00

commit a62ab66b13a0f9bcb17b7b761f6670941ed5cd62 upstream.

Initialize the port_num for iWARP in rdma_init_qp_attr.

Fixes: 5ecce4c9b17b("Check port number supplied by user verbs cmds")
Reviewed-by: Steve Wise 
Signed-off-by: Mustafa Ismail 
Tested-by: Mike Marciniszyn 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

staging: lustre: ko2iblnd: check copy_from_iter/copy_to_iter return code

2017-07-27T22:08:06+00:00

commit 566e1ce22e04426fa52328b2adcdf1df49acd98e upstream.

We now get a helpful warning for code that calls copy_{from,to}_iter
without checking the return value, introduced by commit aa28de275a24
("iov_iter/hardening: move object size checks to inlined part").

drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c: In function 'kiblnd_send':
drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c:1643:2: error: ignoring return value of 'copy_from_iter', declared with attribute warn_unused_result [-Werror=unused-result]
drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c: In function 'kiblnd_recv':
drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c:1744:3: error: ignoring return value of 'copy_to_iter', declared with attribute warn_unused_result [-Werror=unused-result]

In case we get short copies here, we may get incorrect behavior.
I've added failure handling for both rx and tx now, returning
-EFAULT as expected.

Signed-off-by: Arnd Bergmann 
Signed-off-by: James Simmons 
Signed-off-by: Greg Kroah-Hartman