[PATCH AUTOSEL for 3.18 43/53] cifs: small underflow in cnvrtDosUnixTm()

From: Dan Carpenter [ Upstream commit 564277eceeca01e02b1ef3e141cfb939184601b4 ] January is month 1. There is no zero-th month. If someone passes a zero month then it means we read from one space before the start of the total_days_of_prev_months[] array. We may as

[PATCH AUTOSEL for 3.18 43/53] cifs: small underflow in cnvrtDosUnixTm()

From: Dan Carpenter [ Upstream commit 564277eceeca01e02b1ef3e141cfb939184601b4 ] January is month 1. There is no zero-th month. If someone passes a zero month then it means we read from one space before the start of the total_days_of_prev_months[] array. We may as well also be strict about

[PATCH AUTOSEL for 3.18 44/53] drm/msm: fix leak in failed get_pages

From: Prakash Kamliya [ Upstream commit 62e3a3e342af3c313ab38603811ecdb1fcc79edb ] get_pages doesn't keep a reference of the pages allocated when it fails later in the code path. This can lead to a memory leak. Keep reference of the allocated pages so that it can be

[PATCH AUTOSEL for 3.18 44/53] drm/msm: fix leak in failed get_pages

From: Prakash Kamliya [ Upstream commit 62e3a3e342af3c313ab38603811ecdb1fcc79edb ] get_pages doesn't keep a reference of the pages allocated when it fails later in the code path. This can lead to a memory leak. Keep reference of the allocated pages so that it can be freed when

[PATCH AUTOSEL for 3.18 35/53] ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP

From: Kishon Vijay Abraham I [ Upstream commit 2c949ce38f4e81d7487f165fa3b8f77d74a2a6c4 ] The PCIe programming sequence in TRM suggests CLKSTCTRL of PCIe should be set to SW_WKUP. There are no issues when CLKSTCTRL is set to HW_AUTO in RC mode. However in EP mode, the host system

[PATCH AUTOSEL for 3.18 45/53] media: bt8xx: Fix err 'bt878_probe()'

From: Christophe JAILLET [ Upstream commit 45392ff6881dbe56d41ef0b17c2e576065f8ffa1 ] This is odd to call 'pci_disable_device()' in an error path before a coresponding successful 'pci_enable_device()'. Return directly instead. Fixes: 77e0be12100a ("V4L/DVB

[PATCH AUTOSEL for 3.18 35/53] ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP

From: Kishon Vijay Abraham I [ Upstream commit 2c949ce38f4e81d7487f165fa3b8f77d74a2a6c4 ] The PCIe programming sequence in TRM suggests CLKSTCTRL of PCIe should be set to SW_WKUP. There are no issues when CLKSTCTRL is set to HW_AUTO in RC mode. However in EP mode, the host system is not able to

[PATCH AUTOSEL for 3.18 45/53] media: bt8xx: Fix err 'bt878_probe()'

From: Christophe JAILLET [ Upstream commit 45392ff6881dbe56d41ef0b17c2e576065f8ffa1 ] This is odd to call 'pci_disable_device()' in an error path before a coresponding successful 'pci_enable_device()'. Return directly instead. Fixes: 77e0be12100a ("V4L/DVB (4176): Bug-fix: Fix memory

[PATCH AUTOSEL for 3.18 37/53] bnx2x: Align RX buffers

From: Scott Wood [ Upstream commit 9b70de6d0266888b3743f03802502e43131043c8 ] The bnx2x driver is not providing proper alignment on the receive buffers it passes to build_skb(), causing skb_shared_info to be misaligned. skb_shared_info contains an atomic, and while PPC

[PATCH AUTOSEL for 3.18 47/53] mmc: avoid removing non-removable hosts during suspend

From: Daniel Drake [ Upstream commit de8dcc3d2c0e08e5068ee1e26fc46415c15e3637 ] The Weibu F3C MiniPC has an onboard AP6255 module, presenting two SDIO functions on a single MMC host (Bluetooth/btsdio and WiFi/brcmfmac), and the mmc layer correctly detects this as

[PATCH AUTOSEL for 3.18 37/53] bnx2x: Align RX buffers

From: Scott Wood [ Upstream commit 9b70de6d0266888b3743f03802502e43131043c8 ] The bnx2x driver is not providing proper alignment on the receive buffers it passes to build_skb(), causing skb_shared_info to be misaligned. skb_shared_info contains an atomic, and while PPC normally supports

[PATCH AUTOSEL for 3.18 47/53] mmc: avoid removing non-removable hosts during suspend

From: Daniel Drake [ Upstream commit de8dcc3d2c0e08e5068ee1e26fc46415c15e3637 ] The Weibu F3C MiniPC has an onboard AP6255 module, presenting two SDIO functions on a single MMC host (Bluetooth/btsdio and WiFi/brcmfmac), and the mmc layer correctly detects this as non-removable. After

[PATCH AUTOSEL for 3.18 46/53] media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart

From: Ron Economos [ Upstream commit 380a6c86457573aa42d27ae11e025eb25941a0b7 ] On faster CPUs a delay is required after the resume command and the restart command. Without the delay, the restart command often returns -EREMOTEIO and the Si2168 does not restart. Note that

[PATCH AUTOSEL for 3.18 34/53] mfd: palmas: Reset the POWERHOLD mux during power off

From: Keerthy [ Upstream commit 85fdaf8eb9bbec1f0f8a52fd5d85659d60738816 ] POWERHOLD signal has higher priority over the DEV_ON bit. So power off will not happen if the POWERHOLD is held high. Hence reset the MUX to GPIO_7 mode to release the POWERHOLD and the DEV_ON bit to

[PATCH AUTOSEL for 3.18 46/53] media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart

From: Ron Economos [ Upstream commit 380a6c86457573aa42d27ae11e025eb25941a0b7 ] On faster CPUs a delay is required after the resume command and the restart command. Without the delay, the restart command often returns -EREMOTEIO and the Si2168 does not restart. Note that this patch fixes the

[PATCH AUTOSEL for 3.18 34/53] mfd: palmas: Reset the POWERHOLD mux during power off

From: Keerthy [ Upstream commit 85fdaf8eb9bbec1f0f8a52fd5d85659d60738816 ] POWERHOLD signal has higher priority over the DEV_ON bit. So power off will not happen if the POWERHOLD is held high. Hence reset the MUX to GPIO_7 mode to release the POWERHOLD and the DEV_ON bit to take effect to

[PATCH AUTOSEL for 3.18 49/53] RDMA/cma: Use correct size when writing netlink stats

From: Parav Pandit [ Upstream commit 7baaa49af3716fb31877c61f59b74d029ce15b75 ] The code was using the src size when formatting the dst. They are almost certainly the same value but it reads wrong. Fixes: ce117ffac2e9 ("RDMA/cma: Export AF_IB statistics") Signed-off-by:

[PATCH AUTOSEL for 3.18 22/53] e1000e: fix timing for 82579 Gigabit Ethernet controller

From: Bernd Faust [ Upstream commit 5313eeccd2d7f486be4e5c7560e3e2be239ec8f7 ] After an upgrade to Linux kernel v4.x the hardware timestamps of the 82579 Gigabit Ethernet Controller are different than expected. The values that are being read are almost four times as big as

[PATCH AUTOSEL for 3.18 49/53] RDMA/cma: Use correct size when writing netlink stats

From: Parav Pandit [ Upstream commit 7baaa49af3716fb31877c61f59b74d029ce15b75 ] The code was using the src size when formatting the dst. They are almost certainly the same value but it reads wrong. Fixes: ce117ffac2e9 ("RDMA/cma: Export AF_IB statistics") Signed-off-by: Parav Pandit

[PATCH AUTOSEL for 3.18 22/53] e1000e: fix timing for 82579 Gigabit Ethernet controller

From: Bernd Faust [ Upstream commit 5313eeccd2d7f486be4e5c7560e3e2be239ec8f7 ] After an upgrade to Linux kernel v4.x the hardware timestamps of the 82579 Gigabit Ethernet Controller are different than expected. The values that are being read are almost four times as big as before the kernel

[PATCH AUTOSEL for 3.18 53/53] clk: si5351: Rename internal plls to avoid name collisions

From: Sergej Sawazki [ Upstream commit cdba9a4fb0b53703959ac861e415816cb61aded4 ] This drivers probe fails due to a clock name collision if a clock named 'plla' or 'pllb' is already registered when registering this drivers internal plls. Fix it by renaming internal plls to

[PATCH AUTOSEL for 3.18 53/53] clk: si5351: Rename internal plls to avoid name collisions

From: Sergej Sawazki [ Upstream commit cdba9a4fb0b53703959ac861e415816cb61aded4 ] This drivers probe fails due to a clock name collision if a clock named 'plla' or 'pllb' is already registered when registering this drivers internal plls. Fix it by renaming internal plls to avoid name

[PATCH AUTOSEL for 3.18 38/53] power: supply: pda_power: move from timer to delayed_work

From: Michael Trimarchi [ Upstream commit 633e8799ddc09431be2744c4a1efdbda13af2b0b ] This changed is needed to avoid locking problem during boot as shown: <5>[8.824096] Registering SWP/SWPB emulation handler <6>[8.977294] clock: disabling unused clocks to

[PATCH AUTOSEL for 3.18 48/53] IB/ipoib: Avoid memory leak if the SA returns a different DGID

From: Erez Shitrit [ Upstream commit 439000892ee17a9c92f1e4297818790ef8bb4ced ] The ipoib path database is organized around DGIDs from the LLADDR, but the SA is free to return a different GID when asked for path. This causes a bug because the SA's modified DGID is copied

[PATCH AUTOSEL for 3.18 39/53] md/raid10: skip spare disk as 'first' disk

From: Shaohua Li [ Upstream commit b506335e5d2b4ec687dde392a3bdbf7601778f1d ] Commit 6f287ca(md/raid10: reset the 'first' at the end of loop) ignores a case in reshape, the first rdev could be a spare disk, which shouldn't be accounted as the first disk since it doesn't include the

[PATCH AUTOSEL for 3.18 39/53] md/raid10: skip spare disk as 'first' disk

From: Shaohua Li [ Upstream commit b506335e5d2b4ec687dde392a3bdbf7601778f1d ] Commit 6f287ca(md/raid10: reset the 'first' at the end of loop) ignores a case in reshape, the first rdev could be a spare disk, which shouldn't be accounted as the first disk since it doesn't include the offset info.

[PATCH AUTOSEL for 3.18 48/53] IB/ipoib: Avoid memory leak if the SA returns a different DGID

From: Erez Shitrit [ Upstream commit 439000892ee17a9c92f1e4297818790ef8bb4ced ] The ipoib path database is organized around DGIDs from the LLADDR, but the SA is free to return a different GID when asked for path. This causes a bug because the SA's modified DGID is copied into the database key,

[PATCH AUTOSEL for 3.18 38/53] power: supply: pda_power: move from timer to delayed_work

From: Michael Trimarchi [ Upstream commit 633e8799ddc09431be2744c4a1efdbda13af2b0b ] This changed is needed to avoid locking problem during boot as shown: <5>[8.824096] Registering SWP/SWPB emulation handler <6>[8.977294] clock: disabling unused clocks to save power <3>[9.108154]

[PATCH AUTOSEL for 3.18 51/53] drm/omap: DMM: Check for DMM readiness after successful transaction commit

From: Peter Ujfalusi [ Upstream commit b7ea6b286c4051e043f691781785e3c4672f014a ] Check the status of the DMM engine after it is reported that the transaction was completed as in rare cases the engine might not reached a working state. The wait_status() will print

[PATCH AUTOSEL for 3.18 50/53] vgacon: Set VGA struct resource types

From: Bjorn Helgaas [ Upstream commit c82084117f79bcae085e40da526253736a247120 ] Set the resource type when we reserve VGA-related I/O port resources. The resource code doesn't actually look at the type, so it inserts resources without a type in the tree correctly even

[PATCH AUTOSEL for 3.18 52/53] pinctrl: Really force states during suspend/resume

From: Florian Fainelli [ Upstream commit 981ed1bfbc6c4660b2ddaa8392893e20a6255048 ] In case a platform only defaults a "default" set of pins, but not a "sleep" set of pins, and this particular platform suspends and resumes in a way that the pin states are not preserved by

[PATCH AUTOSEL for 3.18 51/53] drm/omap: DMM: Check for DMM readiness after successful transaction commit

From: Peter Ujfalusi [ Upstream commit b7ea6b286c4051e043f691781785e3c4672f014a ] Check the status of the DMM engine after it is reported that the transaction was completed as in rare cases the engine might not reached a working state. The wait_status() will print information in case the DMM

[PATCH AUTOSEL for 3.18 50/53] vgacon: Set VGA struct resource types

From: Bjorn Helgaas [ Upstream commit c82084117f79bcae085e40da526253736a247120 ] Set the resource type when we reserve VGA-related I/O port resources. The resource code doesn't actually look at the type, so it inserts resources without a type in the tree correctly even without this change. But

[PATCH AUTOSEL for 3.18 52/53] pinctrl: Really force states during suspend/resume

From: Florian Fainelli [ Upstream commit 981ed1bfbc6c4660b2ddaa8392893e20a6255048 ] In case a platform only defaults a "default" set of pins, but not a "sleep" set of pins, and this particular platform suspends and resumes in a way that the pin states are not preserved by the hardware, when we

[PATCH AUTOSEL for 3.18 33/53] mac80211: don't parse encrypted management frames in ieee80211_frame_acked

From: Emmanuel Grumbach [ Upstream commit cf147085fdda044622973a12e4e06f1c753ab677 ] ieee80211_frame_acked is called when a frame is acked by the peer. In case this is a management frame, we check if this an SMPS frame, in which case we can update our antenna

[PATCH AUTOSEL for 3.18 33/53] mac80211: don't parse encrypted management frames in ieee80211_frame_acked

From: Emmanuel Grumbach [ Upstream commit cf147085fdda044622973a12e4e06f1c753ab677 ] ieee80211_frame_acked is called when a frame is acked by the peer. In case this is a management frame, we check if this an SMPS frame, in which case we can update our antenna configuration. When we parse the

[PATCH AUTOSEL for 3.18 31/53] rndis_wlan: add return value validation

From: Pan Bian [ Upstream commit 9dc7efd3978aa67ae598129d2a3f240b390ce508 ] Function create_singlethread_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function rndis_wlan_bind(), its

[PATCH AUTOSEL for 3.18 31/53] rndis_wlan: add return value validation

From: Pan Bian [ Upstream commit 9dc7efd3978aa67ae598129d2a3f240b390ce508 ] Function create_singlethread_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function rndis_wlan_bind(), its return value is not

[PATCH AUTOSEL for 3.18 19/53] scsi: virtio_scsi: Always try to read VPD pages

From: David Gibson [ Upstream commit 25d1d50e23275e141e3a3fe06c25a99f4c4bf4e0 ] Passed through SCSI targets may have transfer limits which come from the host SCSI controller or something on the host side other than the target itself. To make this work properly, the

[PATCH v2] ssb: use put_device() if device_register fail

Never directly free @dev after calling device_register(), even if it returned an error! Always use put_device() to give up the reference initialized. Signed-off-by: Arvind Yadav --- changes in v2: Removed kfree() call for @dev. drivers/ssb/main.c | 2 +-

[PATCH AUTOSEL for 3.18 19/53] scsi: virtio_scsi: Always try to read VPD pages

From: David Gibson [ Upstream commit 25d1d50e23275e141e3a3fe06c25a99f4c4bf4e0 ] Passed through SCSI targets may have transfer limits which come from the host SCSI controller or something on the host side other than the target itself. To make this work properly, the hypervisor can adjust the

[PATCH v2] ssb: use put_device() if device_register fail

Never directly free @dev after calling device_register(), even if it returned an error! Always use put_device() to give up the reference initialized. Signed-off-by: Arvind Yadav --- changes in v2: Removed kfree() call for @dev. drivers/ssb/main.c | 2 +- 1 file changed, 1

[PATCH AUTOSEL for 3.18 23/53] ALSA: hda - Fix headset microphone detection for ASUS N551 and N751

From: Mikhail Paulyshka [ Upstream commit fc7438b1eb12b6c93d7b7a62423779eb5dfc673c ] Headset microphone does not work out of the box on ASUS Nx51 laptops. This patch fixes it. Patch tested on Asus N551 laptop. Asus N751 part is not tested, but according to [1] this laptop uses

[PATCH AUTOSEL for 3.18 23/53] ALSA: hda - Fix headset microphone detection for ASUS N551 and N751

From: Mikhail Paulyshka [ Upstream commit fc7438b1eb12b6c93d7b7a62423779eb5dfc673c ] Headset microphone does not work out of the box on ASUS Nx51 laptops. This patch fixes it. Patch tested on Asus N551 laptop. Asus N751 part is not tested, but according to [1] this laptop uses the same

[PATCH AUTOSEL for 3.18 28/53] wan: pc300too: abort path on failure

From: Pan Bian [ Upstream commit 2a39e7aa8a98f777f0732ca7125b6c9668791760 ] In function pc300_pci_init_one(), on the ioremap error path, function pc300_pci_remove_one() is called to free the allocated memory. However, the path is not terminated, and the freed memory will be

[PATCH AUTOSEL for 3.18 28/53] wan: pc300too: abort path on failure

From: Pan Bian [ Upstream commit 2a39e7aa8a98f777f0732ca7125b6c9668791760 ] In function pc300_pci_init_one(), on the ioremap error path, function pc300_pci_remove_one() is called to free the allocated memory. However, the path is not terminated, and the freed memory will be used later,

[PATCH AUTOSEL for 3.18 24/53] IB/ipoib: Update broadcast object if PKey value was changed in index 0

From: Feras Daoud [ Upstream commit 9a9b8112699d78e7f317019b37f377e90023f3ed ] Update the broadcast address in the priv->broadcast object when the Pkey value changes in index 0, otherwise the multicast GID value will keep the previous value of the PKey, and will not be

[PATCH AUTOSEL for 3.18 25/53] HSI: ssi_protocol: double free in ssip_pn_xmit()

From: Dan Carpenter [ Upstream commit 3026050179a3a9a6f5c892c414b5e36ecf092081 ] If skb_pad() fails then it frees skb and we don't need to free it again at the end of the function. Fixes: dc7bf5d7 ("HSI: Introduce driver for SSI Protocol") Signed-off-by: Dan Carpenter

[PATCH AUTOSEL for 3.18 24/53] IB/ipoib: Update broadcast object if PKey value was changed in index 0

From: Feras Daoud [ Upstream commit 9a9b8112699d78e7f317019b37f377e90023f3ed ] Update the broadcast address in the priv->broadcast object when the Pkey value changes in index 0, otherwise the multicast GID value will keep the previous value of the PKey, and will not be updated. This leads to

[PATCH AUTOSEL for 3.18 25/53] HSI: ssi_protocol: double free in ssip_pn_xmit()

From: Dan Carpenter [ Upstream commit 3026050179a3a9a6f5c892c414b5e36ecf092081 ] If skb_pad() fails then it frees skb and we don't need to free it again at the end of the function. Fixes: dc7bf5d7 ("HSI: Introduce driver for SSI Protocol") Signed-off-by: Dan Carpenter Signed-off-by: Sebastian

[PATCH AUTOSEL for 3.18 29/53] qlcnic: fix unchecked return value

From: Pan Bian [ Upstream commit 91ec701a553cb3de470fd471c6fefe3ad1125455 ] Function pci_find_ext_capability() may return 0, which is an invalid address. In function qlcnic_sriov_virtid_fn(), its return value is used without validation. This may result in invalid memory

[PATCH AUTOSEL for 3.18 26/53] Fix driver usage of 128B WQEs when WQ_CREATE is V1.

From: James Smart [ Upstream commit 3f247de750b8dd8f50a2c1390e2a1238790a9dff ] There are two versions of a structure for queue creation and setup that the driver shares with FW. The driver was only treating as version 0. Verify WQ_CREATE with 128B WQEs in V0 and V1. Code

[PATCH AUTOSEL for 3.18 30/53] scsi: mac_esp: Replace bogus memory barrier with spinlock

From: Finn Thain [ Upstream commit 4da2b1eb230ba4ad19b58984dc52e05b1073df5f ] Commit da244654c66e ("[SCSI] mac_esp: fix for quadras with two esp chips") added mac_scsi_esp_intr() to handle the IRQ lines from a pair of on-board ESP chips (a normal shared IRQ did not

[PATCH AUTOSEL for 3.18 30/53] scsi: mac_esp: Replace bogus memory barrier with spinlock

From: Finn Thain [ Upstream commit 4da2b1eb230ba4ad19b58984dc52e05b1073df5f ] Commit da244654c66e ("[SCSI] mac_esp: fix for quadras with two esp chips") added mac_scsi_esp_intr() to handle the IRQ lines from a pair of on-board ESP chips (a normal shared IRQ did not work). Proper mutual

[PATCH AUTOSEL for 3.18 29/53] qlcnic: fix unchecked return value

From: Pan Bian [ Upstream commit 91ec701a553cb3de470fd471c6fefe3ad1125455 ] Function pci_find_ext_capability() may return 0, which is an invalid address. In function qlcnic_sriov_virtid_fn(), its return value is used without validation. This may result in invalid memory access bugs. This patch

[PATCH AUTOSEL for 3.18 26/53] Fix driver usage of 128B WQEs when WQ_CREATE is V1.

From: James Smart [ Upstream commit 3f247de750b8dd8f50a2c1390e2a1238790a9dff ] There are two versions of a structure for queue creation and setup that the driver shares with FW. The driver was only treating as version 0. Verify WQ_CREATE with 128B WQEs in V0 and V1. Code review of another bug

[PATCH AUTOSEL for 3.18 27/53] mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()

From: Dan Carpenter [ Upstream commit ec5ab8933772c87f24ad62a4a602fe8949f423c2 ] devm_pinctrl_get() returns error pointers, it never returns NULL. Fixes: 455e5cd6f736 ("mmc: omap_hsmmc: Pin remux workaround to support SDIO interrupt on AM335x") Signed-off-by: Dan

[PATCH AUTOSEL for 3.18 27/53] mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()

From: Dan Carpenter [ Upstream commit ec5ab8933772c87f24ad62a4a602fe8949f423c2 ] devm_pinctrl_get() returns error pointers, it never returns NULL. Fixes: 455e5cd6f736 ("mmc: omap_hsmmc: Pin remux workaround to support SDIO interrupt on AM335x") Signed-off-by: Dan Carpenter Reviewed-by:

[PATCH AUTOSEL for 3.18 12/53] cpufreq/sh: Replace racy task affinity logic

From: Thomas Gleixner [ Upstream commit 205dcc1ecbc566cbc20acf246e68de3b080b3ecf ] The target() callback must run on the affected cpu. This is achieved by temporarily setting the affinity of the calling thread to the requested CPU and reset it to the original affinity

[PATCH AUTOSEL for 3.18 12/53] cpufreq/sh: Replace racy task affinity logic

From: Thomas Gleixner [ Upstream commit 205dcc1ecbc566cbc20acf246e68de3b080b3ecf ] The target() callback must run on the affected cpu. This is achieved by temporarily setting the affinity of the calling thread to the requested CPU and reset it to the original affinity afterwards. That's racy

[PATCH AUTOSEL for 3.18 01/53] usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control()

From: Yuyang Du [ Upstream commit 9f20dfb44d03745d0d3cef2ffb3abf8d8024fa61 ] This fixes the commit: 1cd8fd2887e1 ("usb: gadget: dummy_hcd: add SuperSpeed support"). In the case of ClearPortFeature and USB_PORT_FEAT_POWER, simply clear the right bit regardless of what the

[PATCH AUTOSEL for 4.4 088/101] IB/ipoib: Avoid memory leak if the SA returns a different DGID

From: Erez Shitrit [ Upstream commit 439000892ee17a9c92f1e4297818790ef8bb4ced ] The ipoib path database is organized around DGIDs from the LLADDR, but the SA is free to return a different GID when asked for path. This causes a bug because the SA's modified DGID is copied

[PATCH AUTOSEL for 3.18 01/53] usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control()

From: Yuyang Du [ Upstream commit 9f20dfb44d03745d0d3cef2ffb3abf8d8024fa61 ] This fixes the commit: 1cd8fd2887e1 ("usb: gadget: dummy_hcd: add SuperSpeed support"). In the case of ClearPortFeature and USB_PORT_FEAT_POWER, simply clear the right bit regardless of what the wValue is. Acked-by:

[PATCH AUTOSEL for 4.4 088/101] IB/ipoib: Avoid memory leak if the SA returns a different DGID

From: Erez Shitrit [ Upstream commit 439000892ee17a9c92f1e4297818790ef8bb4ced ] The ipoib path database is organized around DGIDs from the LLADDR, but the SA is free to return a different GID when asked for path. This causes a bug because the SA's modified DGID is copied into the database key,

[PATCH AUTOSEL for 4.4 084/101] media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart

From: Ron Economos [ Upstream commit 380a6c86457573aa42d27ae11e025eb25941a0b7 ] On faster CPUs a delay is required after the resume command and the restart command. Without the delay, the restart command often returns -EREMOTEIO and the Si2168 does not restart. Note that

[PATCH AUTOSEL for 4.4 084/101] media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart

From: Ron Economos [ Upstream commit 380a6c86457573aa42d27ae11e025eb25941a0b7 ] On faster CPUs a delay is required after the resume command and the restart command. Without the delay, the restart command often returns -EREMOTEIO and the Si2168 does not restart. Note that this patch fixes the

[PATCH AUTOSEL for 4.4 089/101] RDMA/cma: Use correct size when writing netlink stats

From: Parav Pandit [ Upstream commit 7baaa49af3716fb31877c61f59b74d029ce15b75 ] The code was using the src size when formatting the dst. They are almost certainly the same value but it reads wrong. Fixes: ce117ffac2e9 ("RDMA/cma: Export AF_IB statistics") Signed-off-by:

[PATCH AUTOSEL for 4.4 089/101] RDMA/cma: Use correct size when writing netlink stats

From: Parav Pandit [ Upstream commit 7baaa49af3716fb31877c61f59b74d029ce15b75 ] The code was using the src size when formatting the dst. They are almost certainly the same value but it reads wrong. Fixes: ce117ffac2e9 ("RDMA/cma: Export AF_IB statistics") Signed-off-by: Parav Pandit

[PATCH AUTOSEL for 4.4 059/101] staging: wilc1000: fix unchecked return value

From: Pan Bian [ Upstream commit 9e96652756ad647b7bcc03cb99ffc9756d7b5f93 ] Function dev_alloc_skb() will return a NULL pointer if there is no enough memory. However, in function WILC_WFI_mon_xmit(), its return value is used without validation. This may result in a bad

[PATCH AUTOSEL for 4.4 059/101] staging: wilc1000: fix unchecked return value

From: Pan Bian [ Upstream commit 9e96652756ad647b7bcc03cb99ffc9756d7b5f93 ] Function dev_alloc_skb() will return a NULL pointer if there is no enough memory. However, in function WILC_WFI_mon_xmit(), its return value is used without validation. This may result in a bad memory access bug. This

[PATCH AUTOSEL for 4.4 057/101] mtip32xx: use runtime tag to initialize command header

From: Ming Lei [ Upstream commit a4e84aae8139aca9fbfbced1f45c51ca81b57488 ] mtip32xx supposes that 'request_idx' passed to .init_request() is tag of the request, and use that as request's tag to initialize command header. After MQ IO scheduler is in, request tag assigned

[PATCH AUTOSEL for 4.4 057/101] mtip32xx: use runtime tag to initialize command header

From: Ming Lei [ Upstream commit a4e84aae8139aca9fbfbced1f45c51ca81b57488 ] mtip32xx supposes that 'request_idx' passed to .init_request() is tag of the request, and use that as request's tag to initialize command header. After MQ IO scheduler is in, request tag assigned isn't same with the

[PATCH AUTOSEL for 4.4 046/101] wan: pc300too: abort path on failure

From: Pan Bian [ Upstream commit 2a39e7aa8a98f777f0732ca7125b6c9668791760 ] In function pc300_pci_init_one(), on the ioremap error path, function pc300_pci_remove_one() is called to free the allocated memory. However, the path is not terminated, and the freed memory will be

[PATCH AUTOSEL for 4.4 046/101] wan: pc300too: abort path on failure

From: Pan Bian [ Upstream commit 2a39e7aa8a98f777f0732ca7125b6c9668791760 ] In function pc300_pci_init_one(), on the ioremap error path, function pc300_pci_remove_one() is called to free the allocated memory. However, the path is not terminated, and the freed memory will be used later,

[PATCH AUTOSEL for 4.4 028/101] KVM: PPC: Book3S PR: Exit KVM on failed mapping

From: Alexey Kardashevskiy [ Upstream commit bd9166ffe624000140fc6b606b256df01fc0d060 ] At the moment kvmppc_mmu_map_page() returns -1 if mmu_hash_ops.hpte_insert() fails for any reason so the page fault handler resumes the guest and it faults on the same address again. This

[PATCH AUTOSEL for 4.4 012/101] regulator: anatop: set default voltage selector for pcie

From: Dong Aisheng [ Upstream commit 9bf944548169f6153c3d3778cf983cb5db251a0e ] Set the initial voltage selector for vddpcie in case it's disabled by default. This fixes the below warning: 20c8000.anatop:regulator-vddpcie: Failed to read a valid default voltage selector.

[PATCH AUTOSEL for 4.4 028/101] KVM: PPC: Book3S PR: Exit KVM on failed mapping

From: Alexey Kardashevskiy [ Upstream commit bd9166ffe624000140fc6b606b256df01fc0d060 ] At the moment kvmppc_mmu_map_page() returns -1 if mmu_hash_ops.hpte_insert() fails for any reason so the page fault handler resumes the guest and it faults on the same address again. This adds distinction

[PATCH AUTOSEL for 4.4 012/101] regulator: anatop: set default voltage selector for pcie

From: Dong Aisheng [ Upstream commit 9bf944548169f6153c3d3778cf983cb5db251a0e ] Set the initial voltage selector for vddpcie in case it's disabled by default. This fixes the below warning: 20c8000.anatop:regulator-vddpcie: Failed to read a valid default voltage selector. anatop_regulator:

[PATCH AUTOSEL for 4.9 173/190] IB/umem: Fix use of npages/nmap fields

From: Artemy Kovalyov [ Upstream commit edf1a84fe37c51290e2c88154ecaf48dadff3d27 ] In ib_umem structure npages holds original number of sg entries, while nmap is number of DMA blocks returned by dma_map_sg. Fixes: c5d76f130b28 ('IB/core: Add umem function to read data

[PATCH AUTOSEL for 4.9 173/190] IB/umem: Fix use of npages/nmap fields

From: Artemy Kovalyov [ Upstream commit edf1a84fe37c51290e2c88154ecaf48dadff3d27 ] In ib_umem structure npages holds original number of sg entries, while nmap is number of DMA blocks returned by dma_map_sg. Fixes: c5d76f130b28 ('IB/core: Add umem function to read data from user-space')

[PATCH AUTOSEL for 4.9 177/190] drm/omap: DMM: Check for DMM readiness after successful transaction commit

From: Peter Ujfalusi [ Upstream commit b7ea6b286c4051e043f691781785e3c4672f014a ] Check the status of the DMM engine after it is reported that the transaction was completed as in rare cases the engine might not reached a working state. The wait_status() will print

[PATCH AUTOSEL for 4.9 180/190] pinctrl: Really force states during suspend/resume

From: Florian Fainelli [ Upstream commit 981ed1bfbc6c4660b2ddaa8392893e20a6255048 ] In case a platform only defaults a "default" set of pins, but not a "sleep" set of pins, and this particular platform suspends and resumes in a way that the pin states are not preserved by

[PATCH AUTOSEL for 4.9 177/190] drm/omap: DMM: Check for DMM readiness after successful transaction commit

From: Peter Ujfalusi [ Upstream commit b7ea6b286c4051e043f691781785e3c4672f014a ] Check the status of the DMM engine after it is reported that the transaction was completed as in rare cases the engine might not reached a working state. The wait_status() will print information in case the DMM

[PATCH AUTOSEL for 4.9 180/190] pinctrl: Really force states during suspend/resume

From: Florian Fainelli [ Upstream commit 981ed1bfbc6c4660b2ddaa8392893e20a6255048 ] In case a platform only defaults a "default" set of pins, but not a "sleep" set of pins, and this particular platform suspends and resumes in a way that the pin states are not preserved by the hardware, when we

[PATCH AUTOSEL for 4.9 151/190] block/mq: Cure cpu hotplug lock inversion

From: Peter Zijlstra [ Upstream commit eabe06595d62cfa9278e2cd012df614bc68a7042 ] By poking at /debug/sched_features I triggered the following splat: [] == [] WARNING: possible circular locking dependency detected []

[PATCH AUTOSEL for 4.9 141/190] net: hns: fix ethtool_get_strings overflow in hns driver

From: Timmy Li [ Upstream commit 412b65d15a7f8a93794653968308fc100f2aa87c ] hns_get_sset_count() returns HNS_NET_STATS_CNT and the data space allocated is not enough for ethtool_get_strings(), which will cause random memory corruption. When SLAB and DEBUG_SLAB are both

[PATCH AUTOSEL for 4.9 137/190] x86/xen: split xen_smp_prepare_boot_cpu()

From: Vitaly Kuznetsov [ Upstream commit a2d1078a35f9a38ae888aa6147e4ca32666154a1 ] Split xen_smp_prepare_boot_cpu() into xen_pv_smp_prepare_boot_cpu() and xen_hvm_smp_prepare_boot_cpu() to support further splitting of smp.c. Signed-off-by: Vitaly Kuznetsov

[PATCH AUTOSEL for 4.9 151/190] block/mq: Cure cpu hotplug lock inversion

From: Peter Zijlstra [ Upstream commit eabe06595d62cfa9278e2cd012df614bc68a7042 ] By poking at /debug/sched_features I triggered the following splat: [] == [] WARNING: possible circular locking dependency detected []

[PATCH AUTOSEL for 4.9 141/190] net: hns: fix ethtool_get_strings overflow in hns driver

From: Timmy Li [ Upstream commit 412b65d15a7f8a93794653968308fc100f2aa87c ] hns_get_sset_count() returns HNS_NET_STATS_CNT and the data space allocated is not enough for ethtool_get_strings(), which will cause random memory corruption. When SLAB and DEBUG_SLAB are both enabled, memory

[PATCH AUTOSEL for 4.9 137/190] x86/xen: split xen_smp_prepare_boot_cpu()

From: Vitaly Kuznetsov [ Upstream commit a2d1078a35f9a38ae888aa6147e4ca32666154a1 ] Split xen_smp_prepare_boot_cpu() into xen_pv_smp_prepare_boot_cpu() and xen_hvm_smp_prepare_boot_cpu() to support further splitting of smp.c. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross

[PATCH AUTOSEL for 4.9 133/190] md/raid10: skip spare disk as 'first' disk

From: Shaohua Li [ Upstream commit b506335e5d2b4ec687dde392a3bdbf7601778f1d ] Commit 6f287ca(md/raid10: reset the 'first' at the end of loop) ignores a case in reshape, the first rdev could be a spare disk, which shouldn't be accounted as the first disk since it doesn't include the

[PATCH AUTOSEL for 4.9 133/190] md/raid10: skip spare disk as 'first' disk

From: Shaohua Li [ Upstream commit b506335e5d2b4ec687dde392a3bdbf7601778f1d ] Commit 6f287ca(md/raid10: reset the 'first' at the end of loop) ignores a case in reshape, the first rdev could be a spare disk, which shouldn't be accounted as the first disk since it doesn't include the offset info.

[PATCH AUTOSEL for 4.9 126/190] qed: Unlock on error in qed_vf_pf_acquire()

From: Dan Carpenter [ Upstream commit 66117a9d9a8ca948680d6554769ef9e88f936954 ] My static checker complains that we're holding a mutex on this error path. Let's goto exit instead of returning directly. Fixes: b0bccb69eba3 ("qed: Change locking scheme for VF

[PATCH AUTOSEL for 4.9 126/190] qed: Unlock on error in qed_vf_pf_acquire()

From: Dan Carpenter [ Upstream commit 66117a9d9a8ca948680d6554769ef9e88f936954 ] My static checker complains that we're holding a mutex on this error path. Let's goto exit instead of returning directly. Fixes: b0bccb69eba3 ("qed: Change locking scheme for VF channel") Signed-off-by: Dan

[PATCH AUTOSEL for 4.9 113/190] IB/hfi1: Fix softlockup issue

From: Tadeusz Struk [ Upstream commit 22546b741af8355cd2e16739b6af4a8f17081839 ] Soft lockups can occur because the mad processing on different CPUs acquire the spin lock dc8051_lock: [534552.835870] [] ? read_dev_port_cntr.isra.37+0x23/0x160 [hfi1] [534552.835880]

[PATCH AUTOSEL for 4.9 112/190] IB/rdmavt: restore IRQs on error path in rvt_create_ah()

From: Dan Carpenter [ Upstream commit f0bb2d44ca26b7090dc7bade8877b77005f07dfc ] We need to call spin_unlock_irqrestore() instead of vanilla spin_unlock() on this error path. Fixes: 119a8e708d16 ("IB/rdmavt: Add AH to rdmavt") Signed-off-by: Dan Carpenter

[PATCH AUTOSEL for 4.9 091/190] libertas: check return value of alloc_workqueue

From: Pan Bian [ Upstream commit dc3f89c38a8406554ffeffa370aad086a9c5e9de ] Function alloc_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function if_spi_probe(), its return value is

[PATCH AUTOSEL for 4.9 113/190] IB/hfi1: Fix softlockup issue

From: Tadeusz Struk [ Upstream commit 22546b741af8355cd2e16739b6af4a8f17081839 ] Soft lockups can occur because the mad processing on different CPUs acquire the spin lock dc8051_lock: [534552.835870] [] ? read_dev_port_cntr.isra.37+0x23/0x160 [hfi1] [534552.835880] []

[PATCH AUTOSEL for 4.9 112/190] IB/rdmavt: restore IRQs on error path in rvt_create_ah()

From: Dan Carpenter [ Upstream commit f0bb2d44ca26b7090dc7bade8877b77005f07dfc ] We need to call spin_unlock_irqrestore() instead of vanilla spin_unlock() on this error path. Fixes: 119a8e708d16 ("IB/rdmavt: Add AH to rdmavt") Signed-off-by: Dan Carpenter Reviewed-by: Leon Romanovsky

[PATCH AUTOSEL for 4.9 091/190] libertas: check return value of alloc_workqueue

From: Pan Bian [ Upstream commit dc3f89c38a8406554ffeffa370aad086a9c5e9de ] Function alloc_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function if_spi_probe(), its return value is not checked. This may

<    6   7   8   9   10   11   12   13   14   15   >