Commit graph android_kernel_sony_sdm845/kernel
Message SHA1
Merge "sched: improve the scheduler"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-13 17:44:44 -07:00
1fb0f3bece
Revert "kthread: Ensure task isn't preempted before dequeue in kthread_parkme"
The right fix to address the issue has been pulled from upstream commit
"<9cd4f1a4e7a8> smp/hotplug: Move unparking of percpu threads to the
control CPU"

Change-Id: I3721ae1b7c8718c35fca1b7c7ef53ce80044d0cf
Signed-off-by: Channagoud Kadabi <ckadabi@codeaurora.org>

Channagoud Kadabi   commited 2017-07-12 16:20:39 -07:00
ef546abcaf
smp/hotplug: Move unparking of percpu threads to the control CPU
Vikram reported the following backtrace:

   BUG: scheduling while atomic: swapper/7/0/0x00000002
   CPU: 7 PID: 0 Comm: swapper/7 Not tainted 4.9.32-perf+ #680
   schedule
   schedule_hrtimeout_range_clock
   schedule_hrtimeout
   wait_task_inactive
   __kthread_bind_mask
   __kthread_bind
   __kthread_unpark
   kthread_unpark
   cpuhp_online_idle
   cpu_startup_entry
   secondary_start_kernel

He analyzed correctly that a parked cpu hotplug thread of an offlined CPU
was still on the runqueue when the CPU came back online and tried to unpark
it. This causes the thread which invoked kthread_unpark() to call
wait_task_inactive() and subsequently schedule() with preemption disabled.
His proposed workaround was to "make sure" that a parked thread has
scheduled out when the CPU goes offline, so the situation cannot happen.

But that's still wrong because the root cause is not the fact that the
percpu thread is still on the runqueue and neither that preemption is
disabled, which could be simply solved by enabling preemption before
calling kthread_unpark().

The real issue is that the calling thread is the idle task of the upcoming
CPU, which is not supposed to call anything which might sleep.  The moron,
who wrote that code, missed completely that kthread_unpark() might end up
in schedule().

The solution is simpler than expected. The thread which controls the
hotplug operation is waiting for the CPU to call complete() on the hotplug
state completion. So the idle task of the upcoming CPU can set its state to
CPUHP_AP_ONLINE_IDLE and invoke complete(). This in turn wakes the control
task on a different CPU, which then can safely do the unpark and kick the
now unparked hotplug thread of the upcoming CPU to complete the bringup to
the final target state.

Control CPU                     AP

bringup_cpu();
  __cpu_up()  ------------>
				bringup_ap();
  bringup_wait_for_ap()
    wait_for_completion();
                                cpuhp_online_idle();
                <------------    complete();
    unpark(AP->stopper);
    unpark(AP->hotplugthread);
                                while(1)
                                  do_idle();
    kick(AP->hotplugthread);
    wait_for_completion();	hotplug_thread()
				  run_online_callbacks();
				  complete();

Change-Id: Ic743d0a29bb236c724b5e066b2fe203ced47b8f4
Fixes: 8df3e07e7f ("cpu/hotplug: Let upcoming cpu bring itself fully up")
Reported-by: Vikram Mulukutla <markivx@codeaurora.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: Sebastian Sewior <bigeasy@linutronix.de>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Tejun Heo <tj@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1707042218020.2131@nanos
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Git-commit: 9cd4f1a4e7a858849e889a081a99adff83e08e4c
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Channagoud Kadabi <ckadabi@codeaurora.org>

Thomas Gleixner   authored and   Channagoud Kadabi   commited 2017-07-12 16:20:25 -07:00
ceb354b102
Merge "Merge remote-tracking branch '4.9/tmp-184ce81' into msm-4.9"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-11 18:31:21 -07:00
372199553b
Merge "cpufreq: schedutil: Fix sugov_start versus sugov_update_shared race"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-11 10:24:36 -07:00
b5bf247c8c
Merge "kernel: power: qos: Set PM_QOS_SUM type for each cpu"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-09 06:50:08 -07:00
b8c9b35b8d
Merge "sched: compile sched_avg.c only for SMP"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-09 06:50:07 -07:00
e4b4f01e32
Merge "cpufreq: schedutil: Fix race condition in computing hispeed_util"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-09 06:49:48 -07:00
5245fb4ae6
Merge remote-tracking branch '4.9/tmp-184ce81' into msm-4.9
* 4.9/tmp-184ce81:
  Linux 4.9.36
  KVM: nVMX: Fix exception injection
  KVM: x86: zero base3 of unusable segments
  KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh()
  KVM: x86: fix emulation of RSM and IRET instructions
  arm64: fix NULL dereference in have_cpu_die()
  mtd: nand: brcmnand: Check flash #WP pin status before nand erase/program
  i2c: brcmstb: Fix START and STOP conditions
  brcmfmac: avoid writing channel out of allocated array
  infiniband: hns: avoid gcc-7.0.1 warning for uninitialized data
  objtool: Fix another GCC jump table detection issue
  clk: scpi: don't add cpufreq device if the scpi dvfs node is disabled
  cpufreq: s3c2416: double free on driver init error path
  iommu/amd: Fix interrupt remapping when disable guest_mode
  iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid()
  iommu/dma: Don't reserve PCI I/O windows
  iommu: Handle default domain attach failure
  iommu/vt-d: Don't over-free page table directories
  ocfs2: o2hb: revert hb threshold to keep compatible
  x86/mm: Fix flush_tlb_page() on Xen
  x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space
  x86/boot/KASLR: Fix kexec crash due to 'virt_addr' calculation bug
  tools arch: Sync arch/x86/lib/memcpy_64.S with the kernel
  ARM: 8685/1: ensure memblock-limit is pmd-aligned
  ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation
  ARM: dts: OMAP3: Fix MFG ID EEPROM
  ARM: OMAP2+: omap_device: Sync omap_device and pm_runtime after probe defer
  regulator: tps65086: Fix DT node referencing in of_parse_cb
  regulator: tps65086: Fix expected switch DT node names
  spi: fix device-node leaks
  spi: When no dma_chan map buffers with spi_master's parent
  sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting
  watchdog: bcm281xx: Fix use of uninitialized spinlock.
  netfilter: use skb_to_full_sk in ip_route_me_harder
  xfrm: Oops on error in pfkey_msg2xfrm_state()
  xfrm: NULL dereference on allocation failure
  xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
  mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap mappings
  ravb: Fix use-after-free on `ifconfig eth0 down`
  ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets
  sctp: check af before verify address in sctp_addr_id2transport
  net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV
  perf probe: Fix to probe on gcc generated functions in modules
  tipc: allocate user memory with GFP_KERNEL flag
  net: phy: dp83867: allow RGMII_TXID/RGMII_RXID interface types
  perf probe: Fix to show correct locations for events on modules
  be2net: fix MAC addr setting on privileged BE3 VFs
  be2net: don't delete MAC on close on unprivileged BE3 VFs
  be2net: fix status check in be_cmd_pmac_add()
  usb: dwc2: gadget: Fix GUSBCFG.USBTRDTIM value
  s390/ctl_reg: make __ctl_load a full memory barrier
  swiotlb: ensure that page-sized mappings are page-aligned
  coredump: Ensure proper size of sparse core files
  aio: fix lock dep warning
  perf/x86: Reject non sampling events with precise_ip
  perf/core: Fix sys_perf_event_open() vs. hotplug
  x86/mpx: Use compatible types in comparison to fix sparse error
  x86/tsc: Add the Intel Denverton Processor to native_calibrate_tsc()
  mac80211: initialize SMPS field in HT capabilities
  pmem: return EIO on read_pmem() failure
  drm/amd/powerplay: refine vce dpm update code on Cz.
  drm/amd/powerplay: fix vce cg logic error on CZ/St.
  drm/radeon/si: load special ucode for certain MC configs
  net: thunderx: acpi: fix LMAC initialization
  arm64: assembler: make adr_l work in modules under KASLR
  spi: davinci: use dma_mapping_error()
  scsi: lpfc: avoid double free of resource identifiers
  HID: i2c-hid: Add sleep between POWER ON and RESET
  perf/x86/intel: Use ULL constant to prevent undefined shift behaviour
  mac80211: recalculate min channel width on VHT opmode changes
  net: phy: marvell: fix Marvell 88E1512 used in SGMII mode
  pinctrl: intel: Set pin direction properly
  perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code
  drm/etnaviv: trick drm_mm into giving out a low IOVA
  Documentation: devicetree: change the mediatek ethernet compatible string
  kernel/panic.c: add missing \n
  ibmveth: Add a proper check for the availability of the checksum features
  vxlan: do not age static remote mac entries
  ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()
  virtio_net: fix PAGE_SIZE > 64k
  mlxsw: spectrum_router: Correctly reallocate adjacency entries
  vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null
  drm/amdgpu: check ring being ready before using
  net: dsa: Check return value of phy_connect_direct()
  amd-xgbe: Check xgbe_init() return code
  platform/x86: ideapad-laptop: handle ACPI event 1
  iwlwifi: fix kernel crash when unregistering thermal zone
  scsi: virtio_scsi: Reject commands when virtqueue is broken
  xen-netfront: Fix Rx stall during network stress and OOM
  swiotlb-xen: update dev_addr after swapping pages
  virtio_console: fix a crash in config_work_handler
  Btrfs: fix truncate down when no_holes feature is enabled
  Btrfs: Fix deadlock between direct IO and fast fsync
  gianfar: Do not reuse pages from emergency reserve
  objtool: Fix IRET's opcode
  bpf: don't trigger OOM killer under pressure with map alloc
  bnxt_en: Fix "uninitialized variable" bug in TPA code path.
  xen-netback: protect resource cleaning on XenBus disconnect
  xen-netback: fix memory leaks on XenBus disconnect
  net: ethtool: Initialize buffer when querying device channel settings
  powerpc/eeh: Enable IO path on permanent error
  net: korina: Fix NAPI versus resources freeing
  perf/x86/intel: Handle exclusive threadid correctly on CPU hotplug
  net: phy: dp83848: add DP83620 PHY support
  drm/amdgpu: add support for new hainan variants
  drm/amdgpu: fix program vce instance logic error.
  qla2xxx: Fix erroneous invalid handle message
  qla2xxx: Terminate exchange if corrupted
  scsi: lpfc: Set elsiocb contexts to NULL after freeing it
  stmmac: add missing of_node_put
  scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type
  KVM: x86: fix fixing of hypercalls
  xen/blkback: don't free be structure too early
  ARM64: dts: meson-gxbb-odroidc2: fix GbE tx link breakage
  dt: bindings: net: use boolean dt properties for eee broken modes
  net: phy: use boolean dt properties for eee broken modes
  net: phy: fix sign type error in genphy_config_eee_advert
  dt-bindings: net: add EEE capability constants
  net: phy: add an option to disable EEE advertisement
  net: ethtool: add support for 2500BaseT and 5000BaseT link modes
  sparc64: Zero pages on allocation for mondo and error queues.
  sparc64: Handle PIO & MEM non-resumable errors.
  mm: numa: avoid waiting on freed migrated pages
  l2tp: take a reference on sessions used in genetlink handlers
  l2tp: hold session while sending creation notifications
  l2tp: fix duplicate session creation
  l2tp: ensure session can't get removed during pppol2tp_session_ioctl()
  l2tp: fix race in l2tp_recv_common()
  usb: gadget: f_fs: Fix possibe deadlock
  x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds()
  dm thin: do not queue freed thin mapping for next stage processing
  drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
  gpiolib: fix filtering out unwanted events
  NFSv4.1: Fix a race in nfs4_proc_layoutget
  ALSA: hda - set input_path bitmap to zero after moving it to new place
  ALSA: hda - Fix endless loop of codec configure
  MIPS: Fix IRQ tracing & lockdep when rescheduling
  MIPS: pm-cps: Drop manual cache-line alignment of ready_count
  MIPS: Avoid accidental raw backtrace
  MIPS: head: Reorder instructions missing a delay slot
  mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()
  drm/ast: Handle configuration without P2A bridge
  xen/blkback: don't use xen_blkif_get() in xen-blkback kthread
  NFSv4.x/callback: Create the callback service through svc_create_pooled
  NFSv4: fix a reference leak caused WARNING messages
  netfilter: synproxy: fix conntrackd interaction
  netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
  rtnetlink: add IFLA_GROUP to ifla_policy
  ipv6: Do not leak throw route references
  sfc: provide dummy definitions of vswitch functions
  net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
  decnet: always not take dst->__refcnt when inserting dst into hash table
  net/mlx5e: Fix timestamping capabilities reporting
  net/mlx5: Wait for FW readiness before initializing command interface
  net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it
  sctp: return next obj by passing pos + 1 into sctp_transport_get_idx
  ipv6: fix calling in6_ifa_hold incorrectly for dad work
  igmp: add a missing spin_lock_init()
  igmp: acquire pmc lock for ip_mc_clear_src()
  proc: snmp6: Use correct type in memset
  net/mlx5e: Fix wrong indications in DIM due to counter wraparound
  net/mlx5e: Added BW check for DIM decision mechanism
  net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse
  net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
  sctp: disable BH in sctp_for_each_endpoint
  Fix an intermittent pr_emerg warning about lo becoming free.
  af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
  net: vrf: Make add_fib_rules per network namespace flag
  net: Zero ifla_vf_info in rtnl_fill_vfinfo()
  decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb
  net: don't call strlen on non-terminated string in dev_set_alias()
  ipv6: release dst on error in ip6_dst_lookup_tail
  UPSTREAM: selinux: enable genfscon labeling for tracefs

Change-Id: I85271d5ce79a499d0398f7d3cb32bc2d43fe7dc5
Signed-off-by: Kyle Yan <kyan@codeaurora.org>

Kyle Yan   commited 2017-07-07 14:25:13 -07:00
6c3873f1eb
cpufreq: schedutil: Fix sugov_start versus sugov_update_shared race
With a shared policy in place, when one of the CPUs in the policy is
hotplugged out and then brought back online, sugov_stop and
sugov_start are called in order.

sugov_stop removes utilization hooks for each CPU in the policy and
does nothing else in the for_each_cpu loop. sugov_start on the other
hand iterates through the CPUs in the policy and re-initializes the
per-cpu structure _and_ adds the utilization hook. This implies that
the scheduler is allowed to invoke a CPU's utilization update hook
when the rest of the per-cpu structures have yet to be re-inited.

Apart from some strange values in tracepoints this doesn't cause a
problem, but if we do end up accessing a pointer from the per-cpu
sugov_cpu structure somewhere in the sugov_update_shared path,
we will likely see crashes since the memset for another CPU in the
policy is free to race with sugov_update_shared from the CPU that is
ready to go. So let's fix this now to first init all per-cpu
structures, and then add the per-cpu utilization update hooks all at
once.

Change-Id: I399e0e159b3db3ae3258843c9231f92312fe18ef
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>

Vikram Mulukutla   commited 2017-07-07 10:28:40 -07:00
eb843726f6
sched: compile sched_avg.c only for SMP
The stats exported by sched_avg.c like running average of
runnable tasks and CPU load are used to manage the number
of active CPUs in the system. There is no use case for this
on UP system.

Change-Id: I09c454e742e78813ddcf4ac98858b77970eeaa1f
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Pavankumar Kondeti   commited 2017-07-07 10:10:21 +05:30
d4314f03b4
Merge "genirq: Don't allow user space to set IRQ affinity to isolated CPUs"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-06 20:07:11 -07:00
0ff3f2c2af
cpufreq: schedutil: Fix race condition in computing hispeed_util
hispeed_util can be changed in the context of the store function and
scheduler notifications. So, we need to grab the update_lock (used to
protect members of sg_policy) before changing it to avoid any race
conditions.

Change-Id: I0c6336bab0ec265d900d2e16df1fe95824d7b2e8
Signed-off-by: Saravana Kannan <skannan@codeaurora.org>

Saravana Kannan   commited 2017-07-06 17:23:46 -07:00
7493065acc
cpufreq: schedutil: Update hispeed load condition
Checking the utilization against current capacity can cause the hispeed
load condition to be unreliable. This can happen if the hispeed condition
is reevaluated after some other event (say, migration) causes the current
frequency (and thereby current capacity) to change.

So, instead of checking against current capacity, check against the average
capacity that is less temperamental.

Change-Id: Ic1277908f7d42848ded5dd450146d1d04572eaab
Signed-off-by: Saravana Kannan <skannan@codeaurora.org>

Saravana Kannan   commited 2017-07-06 17:23:45 -07:00
36faa2889a
cpufreq: schedutil: Keep track of average policy capacity
Average policy capacity will be used in future patches to improve detection
of hispeed load condition.

Change-Id: Icab992243b83eb5feaae619d16b22510010f54c5
Signed-off-by: Saravana Kannan <skannan@codeaurora.org>

Saravana Kannan   commited 2017-07-06 17:23:45 -07:00
0f34ee93d0
cpufreq: schedutil: Add freq_to_util helper function
Refactor repetitive code into a function.

Change-Id: I30d53adf0cb0c4ce099f7f1c25cbc8c2f6473769
Signed-off-by: Saravana Kannan <skannan@codeaurora.org>

Saravana Kannan   commited 2017-07-06 17:23:45 -07:00
af541e19b6
Merge "sched: introduce sched_{up,down}migrate knobs"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-06 12:27:10 -07:00
39bdb3080c
Merge "Merge remote-tracking branch '4.9/tmp-75d78c7' into 4.9"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-05 20:13:28 -07:00
fbb31c80cb
Merge "genirq: honour default IRQ affinity setting during migration"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-05 20:13:23 -07:00
c41e6a0202
Merge "cpu-hotplug: Keep atleast 1 online and un-isolated CPU"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-05 20:13:23 -07:00
1b338b75fc
Merge "sched: WALT: introduce sched_group_{up,down}_migrate knobs"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-05 20:13:18 -07:00
9721293613
sched: improve the scheduler
This change is for general scheduler improvement.

Change-Id: I17a2530fd3704ece4841340283e754ebfd3d9014
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>

Syed Rameez Mustafa   commited 2017-07-05 16:51:44 -07:00
f3f7bf8b46
sched: cpufreq: Limit governor updates to WALT changes alone
It's not necessary to keep reporting load to the governor
if it doesn't change in a window. Limit updates to when
we expect load changes - after window rollover and when
we send updates related to intercluster migrations.

Change-Id: I3232d40f3d54b0b81cfafdcdb99b534df79327bf
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>

Vikram Mulukutla   commited 2017-07-05 16:13:14 -07:00
f6686697bc
sched: walt: Provide the most recent window_start value to cpufreq
cpufreq may require rq->window_start for various reasons.
Also switch the timestamp passed to the governor from
sched_clock() to sched_ktime_clock() in order to ensure
that cpufreq can compare the timestamp to rq->window_start.

Change-Id: Icb78f8923a678f724b3e1101ef2d4248e7b2a796
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>

Vikram Mulukutla   commited 2017-07-05 16:13:06 -07:00
a65aafed42
Merge remote-tracking branch '4.9/tmp-75d78c7' into 4.9
* 4.9/tmp-75d78c7:
  Linux 4.9.35
  brcmfmac: fix uninitialized warning in brcmf_usb_probe_phase2()
  jump label: fix passing kbuild_cflags when checking for asm goto support
  net: phy: fix marvell phy status reading
  spi: double time out tolerance
  dmaengine: bcm2835: Fix cyclic DMA period splitting
  net: phy: Initialize mdio clock at probe function
  rt2x00: avoid introducing a USB dependency in the rt2x00lib module
  usb: gadget: f_fs: avoid out of bounds access on comp_desc
  mtd: spi-nor: fix spansion quad enable
  of: Add check to of_scan_flat_dt() before accessing initial_boot_params
  rxrpc: Fix several cases where a padded len isn't checked in ticket decode
  drm/amdgpu: adjust default display clock
  drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating
  drm/radeon: add a quirk for Toshiba Satellite L20-183
  drm/radeon: add a PX quirk for another K53TK variant
  iscsi-target: Reject immediate data underflow larger than SCSI transfer length
  iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP
  target: Fix kref->refcount underflow in transport_cmd_finish_abort
  arm64/vdso: Fix nsec handling for CLOCK_MONOTONIC_RAW
  time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
  time: Fix clock->read(clock) race around clocksource changes
  brcmfmac: unbind all devices upon failure in firmware callback
  brcmfmac: use firmware callback upon failure to load
  brcmfmac: add parameter to pass error code in firmware callback
  Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list
  powerpc/64s: Handle data breakpoints in Radix mode
  powerpc/kprobes: Pause function_graph tracing during jprobes handling
  signal: Only reschedule timers on signals timers have sent
  HID: Add quirk for Dell PIXART OEM mouse
  cxgb4: notify uP to route ctrlq compl to rdma rspq
  CIFS: Improve readdir verbosity
  KVM: PPC: Book3S HV: Context-switch EBB registers properly
  KVM: PPC: Book3S HV: Preserve userspace HTM state properly
  KVM: s390: gaccess: fix real-space designation asce handling for gmap shadows
  perf/x86/intel: Add 1G DTLB load/store miss support for SKL
  lib/cmdline.c: fix get_options() overflow while parsing ranges
  autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL
  powerpc/perf: Fix oops when kthread execs user process
  fs/exec.c: account for argv/envp pointers
  ALSA: pcm: Don't treat NULL chmap as a fatal error
  ALSA: firewire-lib: Fix stall of process context at packet error
  xen-blkback: don't leak stack data via response ring
  xen/blkback: fix disconnect while I/Os in flight
  clk: sunxi-ng: a31: Correct lcd1-ch1 clock register offset
  Revert "ANDROID: hardlockup: detect hard lockups without NMIs using secondary cpus"
  Revert "ANDROID: kernel/watchdog: fix unused variable warning"
  UPSTREAM: usb: gadget: f_fs: avoid out of bounds access on comp_desc
  Linux 4.9.34
  mm: fix new crash in unmapped_area_topdown()
  Allow stack to grow up to address space limit
  mm: larger stack guard gap, between vmas
  alarmtimer: Rate limit periodic intervals
  crypto: Work around deallocated stack frame reference gcc bug on sparc.
  vTPM: Fix missing NULL check
  MIPS: .its targets depend on vmlinux
  MIPS: Fix bnezc/jialc return address calculation
  usb: dwc3: exynos fix axius clock error path to do cleanup
  usb: gadget: composite: Fix function used to free memory
  alarmtimer: Prevent overflow of relative timers
  genirq: Release resources in __setup_irq() error path
  sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off()
  iio: imu: inv_mpu6050: add accel lpf setting for chip >= MPU6500
  swap: cond_resched in swap_cgroup_prepare()
  mm/memory-failure.c: use compound_head() flags for huge pages
  USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks
  USB: gadget: fix GPF in gadgetfs
  usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk
  usb: xhci: Fix USB 3.1 supported protocol parsing
  drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
  misc: mic: double free on ioctl error path
  ath10k: fix napi crash during rmmod when probe firmware fails
  usb: r8a66597-hcd: decrease timeout
  usb: r8a66597-hcd: select a different endpoint on timeout
  USB: gadget: dummy_hcd: fix hub-descriptor removable fields
  pvrusb2: reduce stack usage pvr2_eeprom_analyze()
  USB: usbip: fix nonconforming hub descriptor
  usb: core: fix potential memory leak in error path during hcd creation
  USB: hub: fix SS max number of ports
  usb: gadget: udc: renesas_usb3: lock for PN_ registers access
  usb: gadget: udc: renesas_usb3: fix deadlock by spinlock
  usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling
  IB/mlx5: Fix kernel to user leak prevention logic
  iio: adc: ti_am335x_adc: allocating too much in probe
  iio: proximity: as3935: recalibrate RCO after resume
  iio: st_pressure: Fix data sign
  staging: iio: tsl2x7x_core: Fix standard deviation calculation
  staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()
  mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode
  x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init()
  serial: sh-sci: Fix late enablement of AUTORTS
  serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
  drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.
  drm/mediatek: fix mtk_hdmi_setup_vendor_specific_infoframe mistake
  mac80211: don't send SMPS action frame in AP mode when not needed
  mac80211: fix dropped counter in multiqueue RX
  mac80211: strictly check mesh address extension mode
  mac80211: fix IBSS presp allocation size
  mac80211: fix packet statistics for fast-RX
  mac80211: fix CSA in IBSS mode
  usb: musb: dsps: keep VBUS on for host-only mode
  drm/i915: Fix GVT-g PVINFO version compatibility check
  drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions.
  mac80211/wpa: use constant time memory comparison for MACs
  mac80211: don't look at the PM bit of BAR frames
  vb2: Fix an off by one error in 'vb2_plane_vaddr'
  cpufreq: conservative: Allow down_threshold to take values from 1 to 10
  ila_xlat: add missing hash secret initialization
  can: gs_usb: fix memory leak in gs_cmd_reset()
  configfs: Fix race between create_link and configfs_rmdir
  fs: pass on flags in compat_writev
  ANDROID: sdcardfs: remove dead function open_flags_to_access_mode()
  ANDROID: android-base.cfg: split out arm64-specific configs
  Linux 4.9.33
  sparc64: make string buffers large enough
  drm/i915: Always recompute watermarks when distrust_bios_wm is set, v2.
  drm/i915: Workaround VLV/CHV DSI scanline counter hardware fail
  s390/kvm: do not rely on the ILC on kvm host protection fauls
  xtensa: don't use linux IRQ #0
  RDMA/qedr: Return max inline data in QP query result
  RDMA/qedr: Don't spam dmesg if QP is in error state
  RDMA/qedr: Don't reset QP when queues aren't flushed
  RDMA/qedr: Fix and simplify memory leak in PD alloc
  RDMA/qedr: Dispatch port active event from qedr_add
  netfilter: nft_log: restrict the log prefix length to 127
  netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL
  tipc: fix nametbl_lock soft lockup at node/link events
  tipc: add subscription refcount to avoid invalid delete
  tipc: fix connection refcount error
  tipc: ignore requests when the connection state is not CONNECTED
  ARCv2: smp-boot: wake_flag polling by non-Masters needs to be uncached
  ARC: smp-boot: Decouple Non masters waiting API from jump to entry point
  vhost/vsock: handle vhost_vq_init_access() error
  kernel/watchdog: prevent false hardlockup on overloaded system
  kernel/watchdog.c: move shared definitions to nmi.h
  kernel/watchdog.c: move hardlockup detector to separate file
  userfaultfd: fix SIGBUS resulting from false rwsem wakeups
  proc: add a schedule point in proc_pid_readdir()
  frv: add missing atomic64 operations
  frv: add atomic64_add_unless()
  romfs: use different way to generate fsid for BLOCK or MTD
  mn10300: fix build error of missing fpu_save()
  usb: musb: Fix external abort on non-linefetch for musb_irq_work()
  sctp: sctp_addr_id2transport should verify the addr before looking up assoc
  sctp: sctp gso should set feature with NETIF_F_SG when calling skb_segment
  bnxt_en: Fix RTNL lock usage on bnxt_get_port_module_status().
  bnxt_en: Fix RTNL lock usage on bnxt_update_link().
  bnxt_en: Enhance autoneg support.
  bnxt_en: Fix bnxt_reset() in the slow path task.
  net-next: ethernet: mediatek: change the compatible string
  r8152: avoid start_xmit to schedule napi when napi is disabled
  r8152: fix rtl8152_post_reset function
  r8152: re-schedule napi for tx
  r8152: check rx after napi is enabled
  r8152: avoid start_xmit to call napi_schedule during autosuspend
  nvmet-rdma: Fix missing dma sync to nvme data structures
  nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"
  ravb: unmap descriptors when freeing rings
  drm/ast: Fixed system hanged if disable P2A
  drm/nouveau: Fix drm poll_helper handling
  drm/nouveau: Don't enabling polling twice on runtime resume
  drm/nouveau: Handle fbcon suspend/resume in seperate worker
  drm/nouveau: Rename acpi_work to hpd_work
  drm/nouveau: Intercept ACPI_VIDEO_NOTIFY_PROBE
  gtp: add genl family modules alias
  net: phy: micrel: add support for KSZ8795
  parisc, parport_gsc: Fixes for printk continuation lines
  net/mlx5: Return EOPNOTSUPP when failing to get steering name-space
  net/mlx5: E-Switch, Err when retrieving steering name-space fails
  drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()
  net: adaptec: starfire: add checks for dma mapping errors
  pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES
  drm: Don't race connector registration
  drm: prevent double-(un)registration for connectors
  cec: fix wrong last_la determination
  pinctrl: baytrail: Rectify debounce support (part 2)
  gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page
  net/mlx4_core: Avoid command timeouts during VF driver device shutdown
  drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers
  drm/nouveau: prevent userspace from deleting client object
  ipv6: fix flow labels when the traffic class is non-0
  FS-Cache: Initialise stores_lock in netfs cookie
  fscache: Clear outstanding writes when disabling a cookie
  fscache: Fix dead object requeue
  net: fix ndo_features_check/ndo_fix_features comment ordering
  net: phy: Fix PHY module checks and NULL deref in phy_attach_direct()
  net: phy: Fix lack of reference count on PHY driver
  ethtool: do not vzalloc(0) on registers dump
  log2: make order_base_2() behave correctly on const input value zero
  kasan: respect /proc/sys/kernel/traceoff_on_warning
  shmem: fix sleeping from atomic context
  jump label: pass kbuild_cflags when checking for asm goto support
  PM / runtime: Avoid false-positive warnings from might_sleep_if()
  ARM: defconfigs: make NF_CT_PROTO_SCTP and NF_CT_PROTO_UDPLITE built-in
  ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches
  vfio/spapr_tce: Set window when adding additional groups to container
  ipv6: addrconf: fix generation of new temporary addresses
  net: thunderx: Fix PHY autoneg for SGMII QLM mode
  kernel/ucount.c: mark user_header with kmemleak_ignore()
  powerpc/powernv: Properly set "host-ipi" on IPIs
  i2c: piix4: Fix request_region size
  i2c: piix4: Request the SMBUS semaphore inside the mutex
  sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications
  sierra_net: Skip validating irrelevant fields for IDLE LSIs
  net: hns: Fix the device being used for dma mapping during TX
  NET: mkiss: Fix panic
  ibmvnic: Initialize completion variables before starting work
  ibmvnic: Call napi_disable instead of napi_enable in failure path
  NET: Fix /proc/net/arp for AX.25
  gfs2: Use rhashtable walk interface in glock_hash_walk
  tipc: Fix tipc_sk_reinit race conditions
  ipv6: Inhibit IPv4-mapped src address on the wire.
  ipv6: Handle IPv4-mapped src to in6addr_any dst.
  tcp: tcp_probe: use spin_lock_bh()
  net: xilinx_emaclite: fix receive buffer overflow
  net: xilinx_emaclite: fix freezes due to unordered I/O
  ibmvnic: Fix endian error when requesting device capabilities
  ibmvnic: Fix endian errors in error reporting output
  netfilter: nf_conntrack_sip: fix wrong memory initialisation
  partitions/msdos: FreeBSD UFS2 file systems are not recognized
  drm/i915: Prevent the system suspend complete optimization
  PCI/PM: Add needs_resume flag to avoid suspend complete optimization
  usb: gadget: f_fs: Fix possibe deadlock
  FROMLIST: Remove the redundant skb->dev initialization in ip6_fragment
  FROMLIST: bpf: Remove duplicate tcp_filter hook in ipv6
  FROMLIST: ipv6: Initial skb->dev and skb->protocol in ip6_output
  FROMLIST: bpf: cgroup skb progs cannot access ld_abs/ind
  ANDROID: uid_sys_stats: check previous uid_entry before call find_or_register_uid

Conflicts:
	drivers/usb/gadget/function/f_fs.c
	kernel/watchdog.c

Change-Id: Ib91e6121cace8bcdc4dd8b1727792dd5bb6f1535
Signed-off-by: Kyle Yan <kyan@codeaurora.org>

Kyle Yan   commited 2017-07-05 13:17:33 -07:00
2506cb5328
This is the 4.9.36 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAllc3lYACgkQONu9yGCS
 aT7rhBAAoYx4e8Cbp2iUSEOupe4zWD087bWaQELz9EDh5fsr8zgelyzoeK6y0Rxy
 ngwjVViu9gkouqeHY8gLCFcL4Q/2NFMCGmZ+x7rDV1+d7PWrxCtDw9xnlwIzHtlb
 K9KeWs1TTNtmN2ZQMmnnOQZhdwSseHsA+bdn60n/ol3+n5cLcil6B/xOFCLPlynq
 kr3CZg70HV91V1Cy1jj4/QOY+LE19ratIAY3lirLNphrVt/AWFYBUnBwH4Y7Pked
 VrQ5v0UsB7SHzuuWPkoTE2hM103TjVMoA+/SF6zurb0KcxP+uo9o6RPsOzxeBco/
 cfKGI6ZozOFHy/KIEzC+/EDhdlG08t4MMiAS73hYNthMkVSz6AafNrfGQNmgO+lG
 b2jCmzdp3vdAan4JQ2FvGuUYHFQaskJh5FGCSFiWvzOl1fbIBknjBA+Wubj91lKn
 YqC3srZwi5Z+Ol644uEMorBI3mYVPHlkdSvw17dS786x4zL1ATxpRrAGhcbK/jdU
 e8x/S2nr+A3thvLgK75R6nAfr+srnKz4MUaN3vHLnvXYECGNEXddj5FNPO1lSbeK
 28F/5+W8Onm+pBsldLJjzN4v3Fsq+JWtUZGod+aMZJq0l+Mu8bjZ6rtTbepv5YOv
 6RA8MgBt2heLU39thiXXcpk7BPLTHk79cvKV8drQww4cGNuk48k=
 =HbH+
 -----END PGP SIGNATURE-----

Merge 4.9.36 into android-4.9

Changes in 4.9.36
	ipv6: release dst on error in ip6_dst_lookup_tail
	net: don't call strlen on non-terminated string in dev_set_alias()
	decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb
	net: Zero ifla_vf_info in rtnl_fill_vfinfo()
	net: vrf: Make add_fib_rules per network namespace flag
	af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
	Fix an intermittent pr_emerg warning about lo becoming free.
	sctp: disable BH in sctp_for_each_endpoint
	net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
	net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse
	net/mlx5e: Added BW check for DIM decision mechanism
	net/mlx5e: Fix wrong indications in DIM due to counter wraparound
	proc: snmp6: Use correct type in memset
	igmp: acquire pmc lock for ip_mc_clear_src()
	igmp: add a missing spin_lock_init()
	ipv6: fix calling in6_ifa_hold incorrectly for dad work
	sctp: return next obj by passing pos + 1 into sctp_transport_get_idx
	net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it
	net/mlx5: Wait for FW readiness before initializing command interface
	net/mlx5e: Fix timestamping capabilities reporting
	decnet: always not take dst->__refcnt when inserting dst into hash table
	net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
	sfc: provide dummy definitions of vswitch functions
	ipv6: Do not leak throw route references
	rtnetlink: add IFLA_GROUP to ifla_policy
	netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
	netfilter: synproxy: fix conntrackd interaction
	NFSv4: fix a reference leak caused WARNING messages
	NFSv4.x/callback: Create the callback service through svc_create_pooled
	xen/blkback: don't use xen_blkif_get() in xen-blkback kthread
	drm/ast: Handle configuration without P2A bridge
	mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()
	MIPS: head: Reorder instructions missing a delay slot
	MIPS: Avoid accidental raw backtrace
	MIPS: pm-cps: Drop manual cache-line alignment of ready_count
	MIPS: Fix IRQ tracing & lockdep when rescheduling
	ALSA: hda - Fix endless loop of codec configure
	ALSA: hda - set input_path bitmap to zero after moving it to new place
	NFSv4.1: Fix a race in nfs4_proc_layoutget
	gpiolib: fix filtering out unwanted events
	drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
	dm thin: do not queue freed thin mapping for next stage processing
	x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds()
	usb: gadget: f_fs: Fix possibe deadlock
	l2tp: fix race in l2tp_recv_common()
	l2tp: ensure session can't get removed during pppol2tp_session_ioctl()
	l2tp: fix duplicate session creation
	l2tp: hold session while sending creation notifications
	l2tp: take a reference on sessions used in genetlink handlers
	mm: numa: avoid waiting on freed migrated pages
	sparc64: Handle PIO & MEM non-resumable errors.
	sparc64: Zero pages on allocation for mondo and error queues.
	net: ethtool: add support for 2500BaseT and 5000BaseT link modes
	net: phy: add an option to disable EEE advertisement
	dt-bindings: net: add EEE capability constants
	net: phy: fix sign type error in genphy_config_eee_advert
	net: phy: use boolean dt properties for eee broken modes
	dt: bindings: net: use boolean dt properties for eee broken modes
	ARM64: dts: meson-gxbb-odroidc2: fix GbE tx link breakage
	xen/blkback: don't free be structure too early
	KVM: x86: fix fixing of hypercalls
	scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type
	stmmac: add missing of_node_put
	scsi: lpfc: Set elsiocb contexts to NULL after freeing it
	qla2xxx: Terminate exchange if corrupted
	qla2xxx: Fix erroneous invalid handle message
	drm/amdgpu: fix program vce instance logic error.
	drm/amdgpu: add support for new hainan variants
	net: phy: dp83848: add DP83620 PHY support
	perf/x86/intel: Handle exclusive threadid correctly on CPU hotplug
	net: korina: Fix NAPI versus resources freeing
	powerpc/eeh: Enable IO path on permanent error
	net: ethtool: Initialize buffer when querying device channel settings
	xen-netback: fix memory leaks on XenBus disconnect
	xen-netback: protect resource cleaning on XenBus disconnect
	bnxt_en: Fix "uninitialized variable" bug in TPA code path.
	bpf: don't trigger OOM killer under pressure with map alloc
	objtool: Fix IRET's opcode
	gianfar: Do not reuse pages from emergency reserve
	Btrfs: Fix deadlock between direct IO and fast fsync
	Btrfs: fix truncate down when no_holes feature is enabled
	virtio_console: fix a crash in config_work_handler
	swiotlb-xen: update dev_addr after swapping pages
	xen-netfront: Fix Rx stall during network stress and OOM
	scsi: virtio_scsi: Reject commands when virtqueue is broken
	iwlwifi: fix kernel crash when unregistering thermal zone
	platform/x86: ideapad-laptop: handle ACPI event 1
	amd-xgbe: Check xgbe_init() return code
	net: dsa: Check return value of phy_connect_direct()
	drm/amdgpu: check ring being ready before using
	vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null
	mlxsw: spectrum_router: Correctly reallocate adjacency entries
	virtio_net: fix PAGE_SIZE > 64k
	ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()
	vxlan: do not age static remote mac entries
	ibmveth: Add a proper check for the availability of the checksum features
	kernel/panic.c: add missing \n
	Documentation: devicetree: change the mediatek ethernet compatible string
	drm/etnaviv: trick drm_mm into giving out a low IOVA
	perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code
	pinctrl: intel: Set pin direction properly
	net: phy: marvell: fix Marvell 88E1512 used in SGMII mode
	mac80211: recalculate min channel width on VHT opmode changes
	perf/x86/intel: Use ULL constant to prevent undefined shift behaviour
	HID: i2c-hid: Add sleep between POWER ON and RESET
	scsi: lpfc: avoid double free of resource identifiers
	spi: davinci: use dma_mapping_error()
	arm64: assembler: make adr_l work in modules under KASLR
	net: thunderx: acpi: fix LMAC initialization
	drm/radeon/si: load special ucode for certain MC configs
	drm/amd/powerplay: fix vce cg logic error on CZ/St.
	drm/amd/powerplay: refine vce dpm update code on Cz.
	pmem: return EIO on read_pmem() failure
	mac80211: initialize SMPS field in HT capabilities
	x86/tsc: Add the Intel Denverton Processor to native_calibrate_tsc()
	x86/mpx: Use compatible types in comparison to fix sparse error
	perf/core: Fix sys_perf_event_open() vs. hotplug
	perf/x86: Reject non sampling events with precise_ip
	aio: fix lock dep warning
	coredump: Ensure proper size of sparse core files
	swiotlb: ensure that page-sized mappings are page-aligned
	s390/ctl_reg: make __ctl_load a full memory barrier
	usb: dwc2: gadget: Fix GUSBCFG.USBTRDTIM value
	be2net: fix status check in be_cmd_pmac_add()
	be2net: don't delete MAC on close on unprivileged BE3 VFs
	be2net: fix MAC addr setting on privileged BE3 VFs
	perf probe: Fix to show correct locations for events on modules
	net: phy: dp83867: allow RGMII_TXID/RGMII_RXID interface types
	tipc: allocate user memory with GFP_KERNEL flag
	perf probe: Fix to probe on gcc generated functions in modules
	net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV
	sctp: check af before verify address in sctp_addr_id2transport
	ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets
	ravb: Fix use-after-free on `ifconfig eth0 down`
	mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap mappings
	xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
	xfrm: NULL dereference on allocation failure
	xfrm: Oops on error in pfkey_msg2xfrm_state()
	netfilter: use skb_to_full_sk in ip_route_me_harder
	watchdog: bcm281xx: Fix use of uninitialized spinlock.
	sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting
	spi: When no dma_chan map buffers with spi_master's parent
	spi: fix device-node leaks
	regulator: tps65086: Fix expected switch DT node names
	regulator: tps65086: Fix DT node referencing in of_parse_cb
	ARM: OMAP2+: omap_device: Sync omap_device and pm_runtime after probe defer
	ARM: dts: OMAP3: Fix MFG ID EEPROM
	ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation
	ARM: 8685/1: ensure memblock-limit is pmd-aligned
	tools arch: Sync arch/x86/lib/memcpy_64.S with the kernel
	x86/boot/KASLR: Fix kexec crash due to 'virt_addr' calculation bug
	x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space
	x86/mm: Fix flush_tlb_page() on Xen
	ocfs2: o2hb: revert hb threshold to keep compatible
	iommu/vt-d: Don't over-free page table directories
	iommu: Handle default domain attach failure
	iommu/dma: Don't reserve PCI I/O windows
	iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid()
	iommu/amd: Fix interrupt remapping when disable guest_mode
	cpufreq: s3c2416: double free on driver init error path
	clk: scpi: don't add cpufreq device if the scpi dvfs node is disabled
	objtool: Fix another GCC jump table detection issue
	infiniband: hns: avoid gcc-7.0.1 warning for uninitialized data
	brcmfmac: avoid writing channel out of allocated array
	i2c: brcmstb: Fix START and STOP conditions
	mtd: nand: brcmnand: Check flash #WP pin status before nand erase/program
	arm64: fix NULL dereference in have_cpu_die()
	KVM: x86: fix emulation of RSM and IRET instructions
	KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh()
	KVM: x86: zero base3 of unusable segments
	KVM: nVMX: Fix exception injection
	Linux 4.9.36

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Greg Kroah-Hartman   commited 2017-07-05 16:18:14 +02:00
184ce810ce
sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting
commit 6e5f32f7a43f45ee55c401c0b9585eb01f9629a8 upstream.

If we crossed a sample window while in NO_HZ we will add LOAD_FREQ to
the pending sample window time on exit, setting the next update not
one window into the future, but two.

This situation on exiting NO_HZ is described by:

  this_rq->calc_load_update < jiffies < calc_load_update

In this scenario, what we should be doing is:

  this_rq->calc_load_update = calc_load_update		     [ next window ]

But what we actually do is:

  this_rq->calc_load_update = calc_load_update + LOAD_FREQ   [ next+1 window ]

This has the effect of delaying load average updates for potentially
up to ~9seconds.

This can result in huge spikes in the load average values due to
per-cpu uninterruptible task counts being out of sync when accumulated
across all CPUs.

It's safe to update the per-cpu active count if we wake between sample
windows because any load that we left in 'calc_load_idle' will have
been zero'd when the idle load was folded in calc_global_load().

This issue is easy to reproduce before,

  commit 9d89c257df ("sched/fair: Rewrite runnable load and utilization average tracking")

just by forking short-lived process pipelines built from ps(1) and
grep(1) in a loop. I'm unable to reproduce the spikes after that
commit, but the bug still seems to be present from code review.

Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Mike Galbraith <umgwanakikbuti@gmail.com>
Cc: Morten Rasmussen <morten.rasmussen@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Fixes: commit 5167e8d ("sched/nohz: Rewrite and fix load-avg computation -- again")
Link: http://lkml.kernel.org/r/20170217120731.11868-2-matt@codeblueprint.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Matt Fleming   authored and   Greg Kroah-Hartman   commited 2017-07-05 14:40:28 +02:00
478273e115
perf/core: Fix sys_perf_event_open() vs. hotplug
[ Upstream commit 63cae12bce9861cec309798d34701cf3da20bc71 ]

There is problem with installing an event in a task that is 'stuck' on
an offline CPU.

Blocked tasks are not dis-assosciated from offlined CPUs, after all, a
blocked task doesn't run and doesn't require a CPU etc.. Only on
wakeup do we ammend the situation and place the task on a available
CPU.

If we hit such a task with perf_install_in_context() we'll loop until
either that task wakes up or the CPU comes back online, if the task
waking depends on the event being installed, we're stuck.

While looking into this issue, I also spotted another problem, if we
hit a task with perf_install_in_context() that is in the middle of
being migrated, that is we observe the old CPU before sending the IPI,
but run the IPI (on the old CPU) while the task is already running on
the new CPU, things also go sideways.

Rework things to rely on task_curr() -- outside of rq->lock -- which
is rather tricky. Imagine the following scenario where we're trying to
install the first event into our task 't':

CPU0            CPU1            CPU2

                (current == t)

t->perf_event_ctxp[] = ctx;
smp_mb();
cpu = task_cpu(t);

                switch(t, n);
                                migrate(t, 2);
                                switch(p, t);

                                ctx = t->perf_event_ctxp[]; // must not be NULL

smp_function_call(cpu, ..);

                generic_exec_single()
                  func();
                    spin_lock(ctx->lock);
                    if (task_curr(t)) // false

                    add_event_to_ctx();
                    spin_unlock(ctx->lock);

                                perf_event_context_sched_in();
                                  spin_lock(ctx->lock);
                                  // sees event

So its CPU0's store of t->perf_event_ctxp[] that must not go 'missing'.
Because if CPU2's load of that variable were to observe NULL, it would
not try to schedule the ctx and we'd have a task running without its
counter, which would be 'bad'.

As long as we observe !NULL, we'll acquire ctx->lock. If we acquire it
first and not see the event yet, then CPU0 must observe task_curr()
and retry. If the install happens first, then we must see the event on
sched-in and all is well.

I think we can translate the first part (until the 'must not be NULL')
of the scenario to a litmus test like:

  C C-peterz

  {
  }

  P0(int *x, int *y)
  {
          int r1;

          WRITE_ONCE(*x, 1);
          smp_mb();
          r1 = READ_ONCE(*y);
  }

  P1(int *y, int *z)
  {
          WRITE_ONCE(*y, 1);
          smp_store_release(z, 1);
  }

  P2(int *x, int *z)
  {
          int r1;
          int r2;

          r1 = smp_load_acquire(z);
	  smp_mb();
          r2 = READ_ONCE(*x);
  }

  exists
  (0:r1=0 /\ 2:r1=1 /\ 2:r2=0)

Where:
  x is perf_event_ctxp[],
  y is our tasks's CPU, and
  z is our task being placed on the rq of CPU2.

The P0 smp_mb() is the one added by this patch, ordering the store to
perf_event_ctxp[] from find_get_context() and the load of task_cpu()
in task_function_call().

The smp_store_release/smp_load_acquire model the RCpc locking of the
rq->lock and the smp_mb() of P2 is the context switch switching from
whatever CPU2 was running to our task 't'.

This litmus test evaluates into:

  Test C-peterz Allowed
  States 7
  0:r1=0; 2:r1=0; 2:r2=0;
  0:r1=0; 2:r1=0; 2:r2=1;
  0:r1=0; 2:r1=1; 2:r2=1;
  0:r1=1; 2:r1=0; 2:r2=0;
  0:r1=1; 2:r1=0; 2:r2=1;
  0:r1=1; 2:r1=1; 2:r2=0;
  0:r1=1; 2:r1=1; 2:r2=1;
  No
  Witnesses
  Positive: 0 Negative: 7
  Condition exists (0:r1=0 /\ 2:r1=1 /\ 2:r2=0)
  Observation C-peterz Never 0 7
  Hash=e427f41d9146b2a5445101d3e2fcaa34

And the strong and weak model agree.

Reported-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: Will Deacon <will.deacon@arm.com>
Cc: jeremy.linton@arm.com
Link: http://lkml.kernel.org/r/20161209135900.GU3174@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Peter Zijlstra   authored and   Greg Kroah-Hartman   commited 2017-07-05 14:40:26 +02:00
1c68633329
kernel/panic.c: add missing \n
[ Upstream commit ff7a28a074ccbea999dadbb58c46212cf90984c6 ]

When a system panics, the "Rebooting in X seconds.." message is never
printed because it lacks a new line.  Fix it.

Link: http://lkml.kernel.org/r/20170119114751.2724-1-jslaby@suse.cz
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Jiri Slaby   authored and   Greg Kroah-Hartman   commited 2017-07-05 14:40:24 +02:00
c5c8743642
bpf: don't trigger OOM killer under pressure with map alloc
[ Upstream commit d407bd25a204bd66b7346dde24bd3d37ef0e0b05 ]

This patch adds two helpers, bpf_map_area_alloc() and bpf_map_area_free(),
that are to be used for map allocations. Using kmalloc() for very large
allocations can cause excessive work within the page allocator, so i) fall
back earlier to vmalloc() when the attempt is considered costly anyway,
and even more importantly ii) don't trigger OOM killer with any of the
allocators.

Since this is based on a user space request, for example, when creating
maps with element pre-allocation, we really want such requests to fail
instead of killing other user space processes.

Also, don't spam the kernel log with warnings should any of the allocations
fail under pressure. Given that, we can make backend selection in
bpf_map_area_alloc() generic, and convert all maps over to use this API
for spots with potentially large allocation requests.

Note, replacing the one kmalloc_array() is fine as overflow checks happen
earlier in htab_map_alloc(), since it must also protect the multiplication
for vmalloc() should kmalloc_array() fail.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Daniel Borkmann   authored and   Greg Kroah-Hartman   commited 2017-07-05 14:40:21 +02:00
251d00bf13
genirq: Don't allow user space to set IRQ affinity to isolated CPUs
The PM_QOS_CPU_DMA_LATENCY QOS request attached to an IRQ is ignored
if the IRQ is affined to an isolated CPU. As isolated CPUs enter
deep sleep state, it is better not to affine IRQs to those CPUs.

Change-Id: Ieab4a04eca222b91159208b21bc9e14390ecd62e
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Pavankumar Kondeti   commited 2017-07-03 14:31:35 +05:30
f087456b5c
genirq: honour default IRQ affinity setting during migration
Userspace can set the default IRQ affinity setting by writing into
/proc/irq/default_smp_affinity file. When an IRQ affinity is
broken during isolation/hotplug,override the affinity to online and
un-isolated CPUs from the default affinity CPUs. If no such CPU
is available, then only override with cpu_online_mask.

Change-Id: I7578728ed0d7c17c5890d9916cfd6451d1968568
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Pavankumar Kondeti   commited 2017-07-03 14:31:35 +05:30
f817f4536c
cpu-hotplug: Keep atleast 1 online and un-isolated CPU
The PM_QOS_CPU_DMA_LATENCY vote attached to an IRQ is discarded,
if it is affined to an isolated CPU. So we need atleast 1 CPU
in online and un-isolate state. The scheduler rejects isolating
a CPU if it is the only online and un-isolated CPU in the system.
Add the same check for CPU hotplug.

Change-Id: I5bdfe6e3bb0352ed3ae5a2de90097b73d248f3fc
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Pavankumar Kondeti   commited 2017-07-03 14:31:35 +05:30
68435b04f3
genriq: pick only one CPU while overriding the affinity during migration
With commit bfc60d474137 ("genirq: Use irq_set_affinity_locked to change
irq affinity"), affinity listeners receive the notification when the irq
affinity is changed during migration. If there is no online and
un-isolated CPU available from the user specified affinity, the affinity
is overridden with all online and un-isolated CPUs. The same cpumask is
notified to PM QOS affinity listener which applies PM_QOS_CPU_DMA_LATENCY
vote to all those CPUs. As the low level irqchip driver sets affinity to
only one CPU, do the same while overriding the affinity during migration.

Change-Id: I0bcb75dd356658da100fbeeefd33ef8b121f4d6d
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Pavankumar Kondeti   commited 2017-07-03 14:31:35 +05:30
3c61a7d08a
Merge "kthread: Ensure task isn't preempted before dequeue in kthread_parkme"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-07-01 12:27:04 -07:00
8cf19b2765
kernel: power: qos: Set PM_QOS_SUM type for each cpu
If a memory bandwidth constraint is added, pm_qos_set_value_for_cpu()
throws an BUG as PM_QOS_SUM type is not handled. Add the new value to
the target_per_cpu variable to provide an overall memory bandwidth
requirement for each cpu.

Change-Id: I44b2954bb799ea1f8e21de5c590ea6fa483359ac
Signed-off-by: Archana Sathyakumar <asathyak@codeaurora.org>

Archana Sathyakumar   commited 2017-06-29 15:00:18 -06:00
dc7916f262
This is the 4.9.35 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAllU3ecACgkQONu9yGCS
 aT4beg/7BvQP0EyKbL4RollmfE3BiKL5JNfn/Dxl0SeEuL6tcVg6szwPI9gxoTBx
 xVuWIdldPJ0Eb82meDjXibUOq1+5rAPbD0FNJ8AU0pKiNwfTXdmI7kkz8821Za1f
 qXuBRUCtNDC4Ab7jRwfUapiafR3cWGSwTCkv2cThrX3ERr8Ie2mP/LXuEIdc3CBy
 SY6TxpzsNAwZD29PDAo7FAgbzMH3jJ3Lkxhw7/qcJA0ck23eLJaFDOuUISX+2OxS
 65yXXC+nCt/HeSxRUbJKqKpvJs34jqcQKOx967GKhqib7ovuFTIQ3x2v6/6EAXJV
 lQkJv9MHqYY3ItsAxqr3AD5cNHrDClZ0GQcnwC6DpvEj2VIwszU3Xxesb4a1U5BM
 FlxcTlbRbboANy3Y6+Fevkg5G/sk2cDyqOJIorqKF05ey3KXvV2DNJ2whPAG/0q+
 QfCBihDoR259tNz0AzGvQf/d/sLDrrZWLMe4ZG0Dow0woY4S8r2+phz3ywvuqpyr
 2dhHN0VZqRax+hEcT7+ZPrBt4ThFlBM5/QSScUhszvIWjgRNvlJnlxDp4uUrNUWO
 +Nzd67vbwdDAwmZdV73F7jnHIPkgvw+9Xv5rMmkGzoO9h9y0DTf6c3BlY79p6RH4
 vumyxVhyrAybmAA1yQWsF4VCxS2VIRiGPovu/vQ8Km+6Bkm3abM=
 =ivKZ
 -----END PGP SIGNATURE-----

Merge 4.9.35 into android-4.9

Changes in 4.9.35
	clk: sunxi-ng: a31: Correct lcd1-ch1 clock register offset
	xen/blkback: fix disconnect while I/Os in flight
	xen-blkback: don't leak stack data via response ring
	ALSA: firewire-lib: Fix stall of process context at packet error
	ALSA: pcm: Don't treat NULL chmap as a fatal error
	fs/exec.c: account for argv/envp pointers
	powerpc/perf: Fix oops when kthread execs user process
	autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL
	lib/cmdline.c: fix get_options() overflow while parsing ranges
	perf/x86/intel: Add 1G DTLB load/store miss support for SKL
	KVM: s390: gaccess: fix real-space designation asce handling for gmap shadows
	KVM: PPC: Book3S HV: Preserve userspace HTM state properly
	KVM: PPC: Book3S HV: Context-switch EBB registers properly
	CIFS: Improve readdir verbosity
	cxgb4: notify uP to route ctrlq compl to rdma rspq
	HID: Add quirk for Dell PIXART OEM mouse
	signal: Only reschedule timers on signals timers have sent
	powerpc/kprobes: Pause function_graph tracing during jprobes handling
	powerpc/64s: Handle data breakpoints in Radix mode
	Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list
	brcmfmac: add parameter to pass error code in firmware callback
	brcmfmac: use firmware callback upon failure to load
	brcmfmac: unbind all devices upon failure in firmware callback
	time: Fix clock->read(clock) race around clocksource changes
	time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
	arm64/vdso: Fix nsec handling for CLOCK_MONOTONIC_RAW
	target: Fix kref->refcount underflow in transport_cmd_finish_abort
	iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP
	iscsi-target: Reject immediate data underflow larger than SCSI transfer length
	drm/radeon: add a PX quirk for another K53TK variant
	drm/radeon: add a quirk for Toshiba Satellite L20-183
	drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating
	drm/amdgpu: adjust default display clock
	rxrpc: Fix several cases where a padded len isn't checked in ticket decode
	of: Add check to of_scan_flat_dt() before accessing initial_boot_params
	mtd: spi-nor: fix spansion quad enable
	usb: gadget: f_fs: avoid out of bounds access on comp_desc
	rt2x00: avoid introducing a USB dependency in the rt2x00lib module
	net: phy: Initialize mdio clock at probe function
	dmaengine: bcm2835: Fix cyclic DMA period splitting
	spi: double time out tolerance
	net: phy: fix marvell phy status reading
	jump label: fix passing kbuild_cflags when checking for asm goto support
	brcmfmac: fix uninitialized warning in brcmf_usb_probe_phase2()
	Linux 4.9.35

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Greg Kroah-Hartman   commited 2017-06-29 14:26:07 +02:00
75d78c7eda
time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
commit 3d88d56c5873f6eebe23e05c3da701960146b801 upstream.

Due to how the MONOTONIC_RAW accumulation logic was handled,
there is the potential for a 1ns discontinuity when we do
accumulations. This small discontinuity has for the most part
gone un-noticed, but since ARM64 enabled CLOCK_MONOTONIC_RAW
in their vDSO clock_gettime implementation, we've seen failures
with the inconsistency-check test in kselftest.

This patch addresses the issue by using the same sub-ns
accumulation handling that CLOCK_MONOTONIC uses, which avoids
the issue for in-kernel users.

Since the ARM64 vDSO implementation has its own clock_gettime
calculation logic, this patch reduces the frequency of errors,
but failures are still seen. The ARM64 vDSO will need to be
updated to include the sub-nanosecond xtime_nsec values in its
calculation for this issue to be completely fixed.

Signed-off-by: John Stultz <john.stultz@linaro.org>
Tested-by: Daniel Mentz <danielmentz@google.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Stephen Boyd <stephen.boyd@linaro.org>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Miroslav Lichvar <mlichvar@redhat.com>
Link: http://lkml.kernel.org/r/1496965462-20003-3-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

John Stultz   authored and   Greg Kroah-Hartman   commited 2017-06-29 13:00:30 +02:00
a53bfdda06
time: Fix clock->read(clock) race around clocksource changes
commit ceea5e3771ed2378668455fa21861bead7504df5 upstream.

In tests, which excercise switching of clocksources, a NULL
pointer dereference can be observed on AMR64 platforms in the
clocksource read() function:

u64 clocksource_mmio_readl_down(struct clocksource *c)
{
	return ~(u64)readl_relaxed(to_mmio_clksrc(c)->reg) & c->mask;
}

This is called from the core timekeeping code via:

	cycle_now = tkr->read(tkr->clock);

tkr->read is the cached tkr->clock->read() function pointer.
When the clocksource is changed then tkr->clock and tkr->read
are updated sequentially. The code above results in a sequential
load operation of tkr->read and tkr->clock as well.

If the store to tkr->clock hits between the loads of tkr->read
and tkr->clock, then the old read() function is called with the
new clock pointer. As a consequence the read() function
dereferences a different data structure and the resulting 'reg'
pointer can point anywhere including NULL.

This problem was introduced when the timekeeping code was
switched over to use struct tk_read_base. Before that, it was
theoretically possible as well when the compiler decided to
reload clock in the code sequence:

     now = tk->clock->read(tk->clock);

Add a helper function which avoids the issue by reading
tk_read_base->clock once into a local variable clk and then issue
the read function via clk->read(clk). This guarantees that the
read() function always gets the proper clocksource pointer handed
in.

Since there is now no use for the tkr.read pointer, this patch
also removes it, and to address stopping the fast timekeeper
during suspend/resume, it introduces a dummy clocksource to use
rather then just a dummy read function.

Signed-off-by: John Stultz <john.stultz@linaro.org>
Acked-by: Ingo Molnar <mingo@kernel.org>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Stephen Boyd <stephen.boyd@linaro.org>
Cc: Miroslav Lichvar <mlichvar@redhat.com>
Cc: Daniel Mentz <danielmentz@google.com>
Link: http://lkml.kernel.org/r/1496965462-20003-2-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

John Stultz   authored and   Greg Kroah-Hartman   commited 2017-06-29 13:00:30 +02:00
02a37ccd63
signal: Only reschedule timers on signals timers have sent
commit 57db7e4a2d92c2d3dfbca4ef8057849b2682436b upstream.

Thomas Gleixner  wrote:
> The CRIU support added a 'feature' which allows a user space task to send
> arbitrary (kernel) signals to itself. The changelog says:
>
>   The kernel prevents sending of siginfo with positive si_code, because
>   these codes are reserved for kernel.  I think we can allow a task to
>   send such a siginfo to itself.  This operation should not be dangerous.
>
> Quite contrary to that claim, it turns out that it is outright dangerous
> for signals with info->si_code == SI_TIMER. The following code sequence in
> a user space task allows to crash the kernel:
>
>    id = timer_create(CLOCK_XXX, ..... signo = SIGX);
>    timer_set(id, ....);
>    info->si_signo = SIGX;
>    info->si_code = SI_TIMER:
>    info->_sifields._timer._tid = id;
>    info->_sifields._timer._sys_private = 2;
>    rt_[tg]sigqueueinfo(..., SIGX, info);
>    sigemptyset(&sigset);
>    sigaddset(&sigset, SIGX);
>    rt_sigtimedwait(sigset, info);
>
> For timers based on CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID this
> results in a kernel crash because sigwait() dequeues the signal and the
> dequeue code observes:
>
>   info->si_code == SI_TIMER && info->_sifields._timer._sys_private != 0
>
> which triggers the following callchain:
>
>  do_schedule_next_timer() -> posix_cpu_timer_schedule() -> arm_timer()
>
> arm_timer() executes a list_add() on the timer, which is already armed via
> the timer_set() syscall. That's a double list add which corrupts the posix
> cpu timer list. As a consequence the kernel crashes on the next operation
> touching the posix cpu timer list.
>
> Posix clocks which are internally implemented based on hrtimers are not
> affected by this because hrtimer_start() can handle already armed timers
> nicely, but it's a reliable way to trigger the WARN_ON() in
> hrtimer_forward(), which complains about calling that function on an
> already armed timer.

This problem has existed since the posix timer code was merged into
2.5.63. A few releases earlier in 2.5.60 ptrace gained the ability to
inject not just a signal (which linux has supported since 1.0) but the
full siginfo of a signal.

The core problem is that the code will reschedule in response to
signals getting dequeued not just for signals the timers sent but
for other signals that happen to a si_code of SI_TIMER.

Avoid this confusion by testing to see if the queued signal was
preallocated as all timer signals are preallocated, and so far
only the timer code preallocates signals.

Move the check for if a timer needs to be rescheduled up into
collect_signal where the preallocation check must be performed,
and pass the result back to dequeue_signal where the code reschedules
timers.   This makes it clear why the code cares about preallocated
timers.

Reported-by: Thomas Gleixner <tglx@linutronix.de>
History Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git
Reference: 66dd34ad31 ("signal: allow to send any siginfo to itself")
Reference: 1669ce53e2ff ("Add PTRACE_GETSIGINFO and PTRACE_SETSIGINFO")
Fixes: db8b50ba75f2 ("[PATCH] POSIX clocks & timers")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Eric W. Biederman   authored and   Greg Kroah-Hartman   commited 2017-06-29 13:00:29 +02:00
f719f20abe
Merge "trace: ipc_logging: Fix potential dead in ipc_log_write"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-06-28 23:44:28 -07:00
011cf51d44
Merge "Revert "sched: Remove synchronize rcu/sched calls from _cpu_down""
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-06-27 14:34:44 -07:00
e505fce600
This is the 4.9.34 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAllN9TgACgkQONu9yGCS
 aT4MZhAAv4d43UJkriI3sSdMqhbI2KreInwx5uxMwKGkizMEvfatSCqNSJn+HKG+
 VwuVErCOqq1eneF+MW3t0hqFtI2Hcq/5DxwHEl3Xs+7Qsv7F0F+B2/ilba/52XYQ
 ShwGm96bOjHDcDLdeeiHAui09ReH3iwtUKw2rwd6WTS+KMcNTF/e9eZeWniZ5DVE
 okbt++23tyxzm/3f0O8XLXnEYhpQ5zSJRltGnpVZf9FadHD3zFeGb4zWLRVsNfpO
 dpfGmKgYQr0aLeW4uSRCvkrye8htBbQkH+NOAhpY6SZLIJK1qeXwtAjxOmREfTal
 urV4YbGiGDpkPw3JDjBMV1OuHLp4jp5km475od1wXmMKlUjTQVGdAMh0ak6/o0UZ
 GoTKozoZ7vhsukKnLdzfCWN0yShuUyOHnBb63nDi8zs75nYSlwLESlZBRvdXJN1+
 vZKsgebxyp2GHaOEndU27sVvtIV134LWwso/t4O+bG9RcY4nvz7rr+LwsjuXh5AF
 X/or/IeD3GC8n7/nXn53a2An25IU8u8EwYcMicygmhHAyKQCtfU5L0bHVMkRwbsC
 RjYRKCpKbjCryR7SD2aJ+ly2EuhBBZrZnpFIyPNZy0FPbH0kDGDh3YkAN5Qlj6kc
 HlcSR/4jg4KnZe16xAKXR1u4d9/DNcYseYKRMvwBd993P5TH7lU=
 =0xi/
 -----END PGP SIGNATURE-----

Merge 4.9.34 into android-4.9

Changes in 4.9.34
	fs: pass on flags in compat_writev
	configfs: Fix race between create_link and configfs_rmdir
	can: gs_usb: fix memory leak in gs_cmd_reset()
	ila_xlat: add missing hash secret initialization
	cpufreq: conservative: Allow down_threshold to take values from 1 to 10
	vb2: Fix an off by one error in 'vb2_plane_vaddr'
	mac80211: don't look at the PM bit of BAR frames
	mac80211/wpa: use constant time memory comparison for MACs
	drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions.
	drm/i915: Fix GVT-g PVINFO version compatibility check
	usb: musb: dsps: keep VBUS on for host-only mode
	mac80211: fix CSA in IBSS mode
	mac80211: fix packet statistics for fast-RX
	mac80211: fix IBSS presp allocation size
	mac80211: strictly check mesh address extension mode
	mac80211: fix dropped counter in multiqueue RX
	mac80211: don't send SMPS action frame in AP mode when not needed
	drm/mediatek: fix mtk_hdmi_setup_vendor_specific_infoframe mistake
	drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.
	serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
	serial: sh-sci: Fix late enablement of AUTORTS
	x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init()
	mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode
	staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()
	staging: iio: tsl2x7x_core: Fix standard deviation calculation
	iio: st_pressure: Fix data sign
	iio: proximity: as3935: recalibrate RCO after resume
	iio: adc: ti_am335x_adc: allocating too much in probe
	IB/mlx5: Fix kernel to user leak prevention logic
	usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling
	usb: gadget: udc: renesas_usb3: fix deadlock by spinlock
	usb: gadget: udc: renesas_usb3: lock for PN_ registers access
	USB: hub: fix SS max number of ports
	usb: core: fix potential memory leak in error path during hcd creation
	USB: usbip: fix nonconforming hub descriptor
	pvrusb2: reduce stack usage pvr2_eeprom_analyze()
	USB: gadget: dummy_hcd: fix hub-descriptor removable fields
	usb: r8a66597-hcd: select a different endpoint on timeout
	usb: r8a66597-hcd: decrease timeout
	ath10k: fix napi crash during rmmod when probe firmware fails
	misc: mic: double free on ioctl error path
	drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
	usb: xhci: Fix USB 3.1 supported protocol parsing
	usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk
	USB: gadget: fix GPF in gadgetfs
	USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks
	mm/memory-failure.c: use compound_head() flags for huge pages
	swap: cond_resched in swap_cgroup_prepare()
	iio: imu: inv_mpu6050: add accel lpf setting for chip >= MPU6500
	sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off()
	genirq: Release resources in __setup_irq() error path
	alarmtimer: Prevent overflow of relative timers
	usb: gadget: composite: Fix function used to free memory
	usb: dwc3: exynos fix axius clock error path to do cleanup
	MIPS: Fix bnezc/jialc return address calculation
	MIPS: .its targets depend on vmlinux
	vTPM: Fix missing NULL check
	crypto: Work around deallocated stack frame reference gcc bug on sparc.
	alarmtimer: Rate limit periodic intervals
	mm: larger stack guard gap, between vmas
	Allow stack to grow up to address space limit
	mm: fix new crash in unmapped_area_topdown()
	Linux 4.9.34

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Greg Kroah-Hartman   commited 2017-06-27 10:43:56 +02:00
7172a93a70
This is the 4.9.33 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAllEs4kACgkQONu9yGCS
 aT4f0Q/9GqF8IGzm04f/KHJtuWleRAztioQbeHL1PRZdkxUBZGulXjjYIWwxuD8M
 I4JWMNkI3KObU4xKPRa6kwjgMOTACBOFMKcosr3GByOIOkxxFuT57vWEtoB8sKJl
 DUmQIi+uaeoCXvKIalp8pTZTrLSbKgJ7TsKEXTTJiN5HJ+d2BqsG27wjZshZjr9a
 4Wr9qS76gxzFUo7ZtIoRSBPbXxYsbqgJwFc9x/QmGZua3BQepwwsbtlexhFRKB0E
 QSrwyYSpDly2Y1V2flnO6BWBuTMfNw0Jwd42FOW1WvEulcrxhCPvv7+So/e40zWT
 GoujyJaGqdcSxpa43QA3qUut1WiecxAX5iyiLFDcowhgnj0KRfjFrxWH5I3fGbxb
 WWq78vrhq5h7zVm32XOTDzZ9R3M74GXUW9hL0uRYwsnG2pcBnHq1oe1SV3S2xv3G
 v0c+T8DBxlxH5ostBzjnSs0cUDyT3i7jvKG7EJQoVebHj/2w87k3SkoUZ/x7saCM
 4CdnT/ahuXAM/cmQBh/PXdVlj0f228n+GfNFqrd6YOxnDO9A6mmySAtMJS2Ovk4i
 9fD2BQy3FzD8ygeCRyP8Px0BzZjuYBwhDbHlN8zJESqBR+7343u9z2xYV5MqYAO/
 eWMLtIYAtzwZM0H4BNbLMd+QB2KBGm9tmd2UocufyAGmUj8Vx5A=
 =1Dcl
 -----END PGP SIGNATURE-----

Merge 4.9.33 into android-4.9

Changes in 4.9.33
	PCI/PM: Add needs_resume flag to avoid suspend complete optimization
	drm/i915: Prevent the system suspend complete optimization
	partitions/msdos: FreeBSD UFS2 file systems are not recognized
	netfilter: nf_conntrack_sip: fix wrong memory initialisation
	ibmvnic: Fix endian errors in error reporting output
	ibmvnic: Fix endian error when requesting device capabilities
	net: xilinx_emaclite: fix freezes due to unordered I/O
	net: xilinx_emaclite: fix receive buffer overflow
	tcp: tcp_probe: use spin_lock_bh()
	ipv6: Handle IPv4-mapped src to in6addr_any dst.
	ipv6: Inhibit IPv4-mapped src address on the wire.
	tipc: Fix tipc_sk_reinit race conditions
	gfs2: Use rhashtable walk interface in glock_hash_walk
	NET: Fix /proc/net/arp for AX.25
	ibmvnic: Call napi_disable instead of napi_enable in failure path
	ibmvnic: Initialize completion variables before starting work
	NET: mkiss: Fix panic
	net: hns: Fix the device being used for dma mapping during TX
	sierra_net: Skip validating irrelevant fields for IDLE LSIs
	sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications
	i2c: piix4: Request the SMBUS semaphore inside the mutex
	i2c: piix4: Fix request_region size
	powerpc/powernv: Properly set "host-ipi" on IPIs
	kernel/ucount.c: mark user_header with kmemleak_ignore()
	net: thunderx: Fix PHY autoneg for SGMII QLM mode
	ipv6: addrconf: fix generation of new temporary addresses
	vfio/spapr_tce: Set window when adding additional groups to container
	ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches
	ARM: defconfigs: make NF_CT_PROTO_SCTP and NF_CT_PROTO_UDPLITE built-in
	PM / runtime: Avoid false-positive warnings from might_sleep_if()
	jump label: pass kbuild_cflags when checking for asm goto support
	shmem: fix sleeping from atomic context
	kasan: respect /proc/sys/kernel/traceoff_on_warning
	log2: make order_base_2() behave correctly on const input value zero
	ethtool: do not vzalloc(0) on registers dump
	net: phy: Fix lack of reference count on PHY driver
	net: phy: Fix PHY module checks and NULL deref in phy_attach_direct()
	net: fix ndo_features_check/ndo_fix_features comment ordering
	fscache: Fix dead object requeue
	fscache: Clear outstanding writes when disabling a cookie
	FS-Cache: Initialise stores_lock in netfs cookie
	ipv6: fix flow labels when the traffic class is non-0
	drm/nouveau: prevent userspace from deleting client object
	drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers
	net/mlx4_core: Avoid command timeouts during VF driver device shutdown
	gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page
	pinctrl: baytrail: Rectify debounce support (part 2)
	cec: fix wrong last_la determination
	drm: prevent double-(un)registration for connectors
	drm: Don't race connector registration
	pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES
	net: adaptec: starfire: add checks for dma mapping errors
	drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()
	net/mlx5: E-Switch, Err when retrieving steering name-space fails
	net/mlx5: Return EOPNOTSUPP when failing to get steering name-space
	parisc, parport_gsc: Fixes for printk continuation lines
	net: phy: micrel: add support for KSZ8795
	gtp: add genl family modules alias
	drm/nouveau: Intercept ACPI_VIDEO_NOTIFY_PROBE
	drm/nouveau: Rename acpi_work to hpd_work
	drm/nouveau: Handle fbcon suspend/resume in seperate worker
	drm/nouveau: Don't enabling polling twice on runtime resume
	drm/nouveau: Fix drm poll_helper handling
	drm/ast: Fixed system hanged if disable P2A
	ravb: unmap descriptors when freeing rings
	nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"
	nvmet-rdma: Fix missing dma sync to nvme data structures
	r8152: avoid start_xmit to call napi_schedule during autosuspend
	r8152: check rx after napi is enabled
	r8152: re-schedule napi for tx
	r8152: fix rtl8152_post_reset function
	r8152: avoid start_xmit to schedule napi when napi is disabled
	net-next: ethernet: mediatek: change the compatible string
	bnxt_en: Fix bnxt_reset() in the slow path task.
	bnxt_en: Enhance autoneg support.
	bnxt_en: Fix RTNL lock usage on bnxt_update_link().
	bnxt_en: Fix RTNL lock usage on bnxt_get_port_module_status().
	sctp: sctp gso should set feature with NETIF_F_SG when calling skb_segment
	sctp: sctp_addr_id2transport should verify the addr before looking up assoc
	usb: musb: Fix external abort on non-linefetch for musb_irq_work()
	mn10300: fix build error of missing fpu_save()
	romfs: use different way to generate fsid for BLOCK or MTD
	frv: add atomic64_add_unless()
	frv: add missing atomic64 operations
	proc: add a schedule point in proc_pid_readdir()
	userfaultfd: fix SIGBUS resulting from false rwsem wakeups
	kernel/watchdog.c: move hardlockup detector to separate file
	kernel/watchdog.c: move shared definitions to nmi.h
	kernel/watchdog: prevent false hardlockup on overloaded system
	vhost/vsock: handle vhost_vq_init_access() error
	ARC: smp-boot: Decouple Non masters waiting API from jump to entry point
	ARCv2: smp-boot: wake_flag polling by non-Masters needs to be uncached
	tipc: ignore requests when the connection state is not CONNECTED
	tipc: fix connection refcount error
	tipc: add subscription refcount to avoid invalid delete
	tipc: fix nametbl_lock soft lockup at node/link events
	netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL
	netfilter: nft_log: restrict the log prefix length to 127
	RDMA/qedr: Dispatch port active event from qedr_add
	RDMA/qedr: Fix and simplify memory leak in PD alloc
	RDMA/qedr: Don't reset QP when queues aren't flushed
	RDMA/qedr: Don't spam dmesg if QP is in error state
	RDMA/qedr: Return max inline data in QP query result
	xtensa: don't use linux IRQ #0
	s390/kvm: do not rely on the ILC on kvm host protection fauls
	drm/i915: Workaround VLV/CHV DSI scanline counter hardware fail
	drm/i915: Always recompute watermarks when distrust_bios_wm is set, v2.
	sparc64: make string buffers large enough
	Linux 4.9.33

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Greg Kroah-Hartman   commited 2017-06-27 10:43:04 +02:00
0d21cf1656
Revert "ANDROID: hardlockup: detect hard lockups without NMIs using secondary cpus"
This reverts commit aaf78ec6c8.

We need to do this to handle a merge conflict with 4.9.32.  It will be
forward ported after the merge is complete.

Cc: Brian Norris <briannorris@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Greg Kroah-Hartman   commited 2017-06-27 10:31:16 +02:00
a26cd8eba6
Revert "ANDROID: kernel/watchdog: fix unused variable warning"
This reverts commit b5ea92ffa8.

We need to do this for some merge issues with 4.9.32, the commit will be
put back later...

Cc: Brian Norris <briannorris@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Greg Kroah-Hartman   commited 2017-06-27 10:30:33 +02:00
dd670e09a4
sched/fair: remove printk while schedule is in progress
It will cause deadlock and while(1) if call printk while schedule is in
progress. The block state like as below:

cpu0(hold the console sem):
printk->console_unlock->up_sem->spin_lock(&sem->lock)->wake_up_process(cpu1)
->try_to_wake_up(cpu1)->while(p->on_cpu).

cpu1(request console sem):
console_lock->down_sem->schedule->idle_banlance->update_cpu_capacity->
printk->console_trylock->spin_lock(&sem->lock).

p->on_cpu will be 1 forever, because the task is still running on cpu1,
so cpu0 is blocked in while(p->on_cpu), but cpu1 could not get
spin_lock(&sem->lock), it is blocked too, it means the task will running
on cpu1 forever.

Change-Id: I61f5633b5e8dfa4fb6bac801dc1732a5494a0a88
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Git-commit: df232437710122fcb4e4a0484a1eded5aec29a6a
Git-repo: https://android.googlesource.com/kernel/msm
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Caesar Wang   authored and   Vikram Mulukutla   commited 2017-06-26 10:46:47 -07:00
c1fdb2567f
Merge "sched: improve the scheduler"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-06-26 04:31:06 -07:00
0f420b9368
Merge "cpufreq: schedutil: Fix hispeed_freq condition"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-06-25 23:29:11 -07:00
ed4b7a5e45
Merge "kernel: cpu: Handle hotplug failure for state CPUHP_AP_IDLE_DEAD"
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-06-25 23:29:10 -07:00
0c8eb9542e