kcalloc manages count*sizeof overflow.

Cc: cluster-devel@redhat.com
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

Normally GFP_KERNEL is ok here, but there is now a rarely used code path
relating to deallocation of unlinked inodes (in certain corner cases)
which if hit at times of memory shortage can cause recursion while
trying to free memory.

One solution would be to try and move the gfs2_glock_get() call so
that it is no longer called while another glock is held, but that
doesn't look at all easy, so GFP_NOFS is the best solution for the
time being.
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

We must not leave items on the LRU list with GLF_LOCK set, since
they can be removed if the glock is brought back into use, which
may then potentially result in a hang, waiting for GLF_LOCK to
clear.

It doesn't happen very often, since it requires a glock that has
not been used for a long time to be brought back into use at the
same moment that the shrinker is part way through disposing of
glocks.

The fix is to set GLF_LOCK at a later time, when we already know
that the other locks can be obtained. Also, we now only release
the lru_lock in case a resched is needed, rather than on every
iteration.
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

Function gfs2_glock_dq_wait is supposed to dequeue a glock and then
wait for the lock to be demoted. The problem is, if this is a shared
lock, its demote will depend on the other holders, which means you
might end up waiting forever because the other process is blocked.
This problem is especially apparent when dealing with nested flocks.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

Pull ACPI and power management fixes from Rafael Wysocki:
 "These are fixes mostly (ia64 regression related to the ACPI
  enumeration of devices, cpufreq regressions, fix for I2C controllers
  included in Intel SoCs, mvebu cpuidle driver fix related to sysfs)
  plus additional kernel command line arguments from Kees to make it
  possible to build kernel images with hibernation and the kernel
  address space randomization included simultaneously, a new ACPI
  battery driver quirk for a system with a broken BIOS and a couple of
  ACPI core cleanups.

  Specifics:

   - Fix for an ia64 regression introduced during the 3.11 cycle by a
     commit that modified the hardware initialization ordering and made
     device discovery fail on some systems.

   - Fix for a build problem on systems where the cpufreq-cpu0 driver is
     built-in and the cpu-thermal driver is modular from Arnd Bergmann.

   - Fix for a recently introduced computational mistake in the
     intel_pstate driver that leads to excessive rounding errors from
     Doug Smythies.

   - Fix for a failure code path in cpufreq_update_policy() that fails
     to unlock the locks acquired previously from Aaron Plattner.

   - Fix for the cpuidle mvebu driver to use shorter state names which
     will prevent the sysfs interface from returning mangled strings.
     From Gregory Clement.

   - ACPI LPSS driver fix to make sure that the I2C controllers included
     in BayTrail SoCs are not held in the reset state while they are
     being probed from Mika Westerberg.

   - New kernel command line arguments making it possible to build
     kernel images with hibernation and kASLR included at the same time
     and to select which of them will be used via the command line (they
     are still functionally mutually exclusive, though).  From Kees
     Cook.

   - ACPI battery driver quirk for Acer Aspire V5-573G that fails to
     send battery status change notifications timely from Alexander
     Mezin.

   - Two ACPI core cleanups from Christoph Jaeger and Fabian Frederick"

* tag 'pm+acpi-3.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpuidle: mvebu: Fix the name of the states
  cpufreq: unlock when failing cpufreq_update_policy()
  intel_pstate: Correct rounding in busy calculation
  ACPI: use kstrto*() instead of simple_strto*()
  ACPI / processor replace __attribute__((packed)) by __packed
  ACPI / battery: add quirk for Acer Aspire V5-573G
  ACPI / battery: use callback for setting up quirks
  ACPI / LPSS: Take I2C host controllers out of reset
  x86, kaslr: boot-time selectable with hibernation
  PM / hibernate: introduce "nohibernate" boot parameter
  cpufreq: cpufreq-cpu0: fix CPU_THERMAL dependency
  ACPI / ia64 / sba_iommu: Restore the working initialization ordering

Pull sound fixes from Takashi Iwai:
 "The significant part here is a few security fixes for ALSA core
  control API by Lars.  Besides that, there are a few fixes for ASoC
  sigmadsp (again by Lars) for building properly, and small fixes for
  ASoC rsnd, MMP, PXA and FSL, in addition to a fix for bogus WARNING in
  i915/HD-audio binding"

* tag 'sound-3.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: control: Make sure that id->index does not overflow
  ALSA: control: Handle numid overflow
  ALSA: control: Don't access controls outside of protected regions
  ALSA: control: Fix replacing user controls
  ALSA: control: Protect user controls against concurrent access
  drm/i915, HD-audio: Don't continue probing when nomodeset is given
  ASoC: fsl: Fix build problem
  ASoC: rsnd: fixup index of src/dst mod when capture
  ASoC: fsl_spdif: Fix integer overflow when calculating divisors
  ASoC: fsl_spdif: Fix incorrect usage of regmap_read()
  ASoC: dapm: Make sure register value is in sync with DAPM kcontrol state
  ASoC: sigmadsp: Split regmap and I2C support into separate modules
  ASoC: MMP audio needs sram support
  ASoC: pxa: add I2C dependencies as needed

Pull drm fixes from Dave Airlie:
 "This looks bigger than it is, as one of the nouveau firmware fixes
  ("drm/gf100-/gr: report class data to host on fwmthd failure")
  regenerates a bunch of the firmware files after changing the assembly
  by a few lines, without that, its more of a

    36 files changed, 370 insertions(+), 129 deletions(-)

  It contains some vt.c fixes acked by Greg, for rare hard hangs on i915
  loading, that also fixes hangs on reload and spurious register write
  errors.

  drm core: one fix for uninit memory

  nouveau: displayport rework caused a few regressions, Ben has been
     fixing them as the appear, along with some other fixes

  radeon: pageflipping regression fix, deep color fix, mode validation
     fixes

  i915: fbc disable, vga console kick off, backlight fix, divide-by-zero
     fix"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (33 commits)
  drm: fix uninitialized acquire_ctx fields (v2)
  drm/radeon: Fix radeon_irq_kms_pflip_irq_get/put() imbalance
  Revert "drm/radeon: remove drm_vblank_get|put from pflip handling"
  drm/radeon: improve dvi_mode_valid
  drm/radeon: update mode_valid testing for DP
  drm/radeon: Use dce5/6 hdmi deep color clock setup also on dce8+
  drm/nouveau/disp: fix oops in destructor with headless cards
  drm/gf117/i2c: no aux channels on this chipset
  drm/nouveau/doc: update the thermal documentation
  drm/nouveau/pwr: fix typo in fifo wrap handling
  drm/nv50/disp: fix a potential oops in supervisor handling
  drm/nouveau/disp/dp: don't touch link config after success
  drm/nouveau/kms: reference vblank for crtc during pageflip.
  drm/gk104/fb/ram: fixups from an earlier search+replace
  drm/nv50/gr: remove an unneeded write while initialising PGRAPH
  drm/nv50/gr: fix overlap while zeroing zcull regions
  drm/gf100-/gr: report class data to host on fwmthd failure
  drm/gk104/ibus: increase various random timeouts
  drm/gk104/clk: only touch divider for mode we'll be using
  drm/radeon: Bypass hw lut's for > 8 bpc framebuffer scanout.
  ...

Pull block fixes from Jens Axboe:
 "A smaller collection of fixes for the block core that would be nice to
  have in -rc2.  This pull request contains:

   - Fixes for races in the wait/wakeup logic used in blk-mq from
     Alexander.  No issues have been observed, but it is definitely a
     bit flakey currently.  Alternatively, we may drop the cyclic
     wakeups going forward, but that needs more testing.

   - Some cleanups from Christoph.

   - Fix for an oops in null_blk if queue_mode=1 and softirq completions
     are used.  From me.

   - A fix for a regression caused by the chunk size setting.  It
     inadvertently used max_hw_sectors instead of max_sectors, which is
     incorrect, and causes hangs on btrfs multi-disk setups (where hw
     sectors apparently isn't set).  From me.

   - Removal of WQ_POWER_EFFICIENT in the kblockd creation.  This was a
     recent addition as well, but it actually breaks blk-mq which relies
     on strict scheduling.  If the workqueue power_efficient mode is
     turned on, this breaks blk-mq.  From Matias.

   - null_blk module parameter description fix from Mike"

* 'for-linus' of git://git.kernel.dk/linux-block:
  blk-mq: bitmap tag: fix races in bt_get() function
  blk-mq: bitmap tag: fix race on blk_mq_bitmap_tags::wake_cnt
  blk-mq: bitmap tag: fix races on shared ::wake_index fields
  block: blk_max_size_offset() should check ->max_sectors
  null_blk: fix softirq completions for queue_mode == 1
  blk-mq: merge blk_mq_drain_queue and __blk_mq_drain_queue
  blk-mq: properly drain stopped queues
  block: remove WQ_POWER_EFFICIENT from kblockd
  null_blk: fix name and description of 'queue_mode' module parameter
  block: remove elv_abort_queue and blk_abort_flushes

Pull ARM SoC fixes from Arnd Bergmann:
 "A first set of bug fixes that didn't make it for the merge window, and
  two Kconfig cleanups that still make sense at this point.

  Unfortunately, one of the two cleanups caused an unintended change in
  the original version, so we had to revert one part of it and do some
  more testing to ensure the rest is really fine.  There was also a
  last-minute rebase of the patches to remove another bad commit"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: use menuconfig for sub-arch menus
  ARM: multi_v7_defconfig: re-enable SDHCI drivers
  ARM: EXYNOS: Fix compilation warning
  ARM: exynos: move sysram info to exynos.c
  ARM: dts: Specify the NAND ECC scheme explicitly on Armada 385 DB board
  ARM: dts: Specify the NAND ECC scheme explicitly on Armada 375 DB board
  ARM: exynos: cleanup kconfig option display
  misc: vexpress: fix error handling vexpress_syscfg_regmap_init()
  ARM: Remove ARCH_HAS_CPUFREQ config option
  ARM: integrator: fix section mismatch problem
  ARM: mvebu: DT: fix OpenBlocks AX3-4 RAM size
  ARM: samsung: make SAMSUNG_DMADEV optional
  remoteproc: da8xx: don't select CMA on no-MMU
  bus/arm-cci: add dependency on OF && CPU_V7
  ARM: keystone requires ARM_PATCH_PHYS_VIRT
  ARM: omap2: fix am43xx dependency on l2x0 cache

Pull security maintainership update from James Morris:
 "Add Serge Hallyn as security subsystem co-maintainer"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  security: add Serge Hallyn as a maintainer

Pull Xen fixes from David Vrabel:
 "Xen regression and PVH fixes for 3.16-rc1

   - fix dom0 PVH memory setup on latest unstable Xen releases
   - fix 64-bit x86 PV guest boot failure on Xen 3.1 and earlier
   - fix resume regression on non-PV (auto-translated physmap) guests"

* tag 'stable/for-linus-3.16-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/grant-table: fix suspend for non-PV guests
  x86/xen: no need to explicitly register an NMI callback
  Revert "xen/pvh: Update E820 to work with PVH (v2)"
  x86/xen: fix memory setup for PVH dom0

Pull arm64 fixes from Catalin Marinas:
 "These are primarily bug fixes with a performance improvement patch for
  the GHASH crypto algorithm (which went in during this merging window)
  and dts/defconfig/Kconfig updates.

   - ftrace_return_addr() macro fix for arm (introduced earlier via the
     arm64 tree)
   - stack alignment exception entry code fix
   - GHASH crypto algorithm fix and performance improvement
   - CMA buffer limited to 32-bit (until a better way to describe the
     system topology in DT)
   - UAPI sigcontext.h build fix
   - __kernel_old_{gid,uid}_t definitions fix (affecting 32-bit LTP)
   - ptrace fixes (kernel fault and 32-bit arm core dump)
   - pte_mknotpresent() fix
   - dts updates (APM SoC)
   - defconfig and Kconfig update"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: mm: remove broken &= operator from pmd_mknotpresent
  arm64: fix build error in sigcontext.h
  arm64: dts: Add more serial port nodes in APM X-Gene device tree
  arm64/dma: Removing ARCH_HAS_DMA_GET_REQUIRED_MASK macro
  arm64: ptrace: fix empty registers set in prstatus of aarch32 process core
  arm64: uid16: fix __kernel_old_{gid,uid}_t definitions
  arm64: ptrace: change fs when passing kernel pointer to regset code
  arm64: Limit the CMA buffer to 32-bit if ZONE_DMA
  arm/ftrace: fix ftrace_return_addr() to ftrace_return_address()
  arm64/crypto: improve performance of GHASH algorithm
  arm64/crypto: fix data corruption bug in GHASH algorithm
  arm64: defconfig update for LTP
  arm64: ftrace: Fix comment typo 'CONFIG_FUNCTION_GRAPH_FP_TEST'
  arm64: add ARCH_HAS_OPP to allow enabling OPP library
  arm64: restore alphabetic order in Kconfig
  arm64: Bug fix in stack alignment exception

Pull sparc fixes from David Miller:
 "Sparc sparse fixes from Sam Ravnborg"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next: (67 commits)
  sparc64: fix sparse warnings in int_64.c
  sparc64: fix sparse warning in ftrace.c
  sparc64: fix sparse warning in kprobes.c
  sparc64: fix sparse warning in kgdb_64.c
  sparc64: fix sparse warnings in compat_audit.c
  sparc64: fix sparse warnings in init_64.c
  sparc64: fix sparse warnings in aes_glue.c
  sparc: fix sparse warnings in smp_32.c + smp_64.c
  sparc64: fix sparse warnings in perf_event.c
  sparc64: fix sparse warnings in kprobes.c
  sparc64: fix sparse warning in tsb.c
  sparc64: clean up compat_sigset_t.seta handling
  sparc64: fix sparse "Should it be static?" warnings in signal32.c
  sparc64: fix sparse warnings in sys_sparc32.c
  sparc64: fix sparse warning in pci.c
  sparc64: fix sparse warnings in smp_64.c
  sparc64: fix sparse warning in prom_64.c
  sparc64: fix sparse warning in btext.c
  sparc64: fix sparse warnings in sys_sparc_64.c + unaligned_64.c
  sparc64: fix sparse warning in process_64.c
  ...

Conflicts:
	arch/sparc/include/asm/pgtable_64.h

* pm-cpufreq:
  cpufreq: unlock when failing cpufreq_update_policy()
  intel_pstate: Correct rounding in busy calculation
  cpufreq: cpufreq-cpu0: fix CPU_THERMAL dependency

* pm-cpuidle:
  cpuidle: mvebu: Fix the name of the states

* pm-sleep:
  x86, kaslr: boot-time selectable with hibernation
  PM / hibernate: introduce "nohibernate" boot parameter

* acpi-general:
  ACPI: use kstrto*() instead of simple_strto*()

* acpi-processor:
  ACPI / processor replace __attribute__((packed)) by __packed

* acpi-lpss:
  ACPI / LPSS: Take I2C host controllers out of reset

* acpi-battery:
  ACPI / battery: add quirk for Acer Aspire V5-573G
  ACPI / battery: use callback for setting up quirks

First round of fixes for 3.16-rc, mostly cc: stable, and the vt/vgacon
fixes from Daniel [1] to avoid hangs and unclaimed register errors on
module load/reload.

* tag 'drm-intel-fixes-2014-06-17' of git://anongit.freedesktop.org/drm-intel:
  drm/i915/bdw: remove erroneous chv specific workarounds from bdw code
  drm/i915: fix possible refcount leak when resetting forcewake
  drm/i915: Reorder semaphore deadlock check
  drm/i95: Initialize active ring->pid to -1
  drm/i915: set backlight duty cycle after backlight enable for gen4
  drm/i915: Avoid div-by-zero when pixel_multiplier is zero
  drm/i915: Disable FBC by default also on Haswell and later
  drm/i915: Kick out vga console
  drm/i915: Fixup global gtt cleanup
  vt: Don't ignore unbind errors in vt_unbind
  vt: Fix up unregistration of vt drivers
  vt: Fix replacement console check when unbinding

The acquire ctx will typically be declared on the stack, which means we
could have garbage values for any uninitialized field.  In this case, it
was triggering WARN_ON()s because 'contended' had garbage value.

Go ahead and use memset() to be more future-proof.

v2: now with extra brown paper bag
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

mode validation, deep color and pageflipping fixes.

* 'drm-fixes-3.16' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: Fix radeon_irq_kms_pflip_irq_get/put() imbalance
  Revert "drm/radeon: remove drm_vblank_get|put from pflip handling"
  drm/radeon: improve dvi_mode_valid
  drm/radeon: update mode_valid testing for DP
  drm/radeon: Use dce5/6 hdmi deep color clock setup also on dce8+

Fixes a regression in 3.16-rc1 compared to 3.15.

The unbalanced calls would presumably result in the page flip interrupts
never getting disabled once they are enabled.
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

This reverts commit 75f36d86.

drm_vblank_get() is necessary to ensure the DRM vblank counter value is
up to date in drm_send_vblank_event().

Seems to fix weston hangs waiting for page flips to complete.
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

Make sure we have an HDMI monitor before validating modes with
clocks >165 Mhz on single link connections.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

When we have a passive adapter validate the clocks
against the HMDI/DVI limits.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

Need to use the adjusted clock on dce8 as well.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=80029Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

The length name of the states 2 was too long to fit in the allocated
string (limited to 16 bytes). This lead to improper string displayed
through sysfs.

This patch shorten the name by removing the reference to Marvell and
to the CPU as both are implicit. For coherency the same change have
been done for the states 1.
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Commit bd0fa9bb introduced a failure path to cpufreq_update_policy() if
cpufreq_driver->get(cpu) returns NULL.  However, it jumps to the 'no_policy'
label, which exits without unlocking any of the locks the function acquired
earlier.  This causes later calls into cpufreq to hang.

Fix this by creating a new 'unlock' label and jumping to that instead.

Fixes: bd0fa9bb ("cpufreq: Return error if ->get() failed in cpufreq_update_policy()")
Link: https://devtalk.nvidia.com/default/topic/751903/kernel-3-15-and-nv-drivers-337-340-failed-to-initialize-the-nvidia-kernel-module-gtx-550-ti-/Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Cc: 3.15+ <stable@vger.kernel.org> # 3.15+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

This should be a plain old '&' and could easily lead to undefined
behaviour if the target of a pmd_mknotpresent invocation was the same
as the parameter.

Fixes: 9c7e535f (arm64: mm: Route pmd thp functions through pte equivalents)
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: <stable@vger.kernel.org> # v3.15
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Merge tag 'asoc-v3.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v3.16

Quite a few build coverage fixes in here among the usual small driver
fixes includling the sigmadsp change from Lars - moving the driver to
separate modules per bus (which is basically just code motion) avoids
issues with some combinations of buses being enabled.

The ALSA control code expects that the range of assigned indices to a control is
continuous and does not overflow. Currently there are no checks to enforce this.
If a control with a overflowing index range is created that control becomes
effectively inaccessible and unremovable since snd_ctl_find_id() will not be
able to find it. This patch adds a check that makes sure that controls with a
overflowing index range can not be created.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Each control gets automatically assigned its numids when the control is created.
The allocation is done by incrementing the numid by the amount of allocated
numids per allocation. This means that excessive creation and destruction of
controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to
eventually overflow. Currently when this happens for the control that caused the
overflow kctl->id.numid + kctl->count will also over flow causing it to be
smaller than kctl->id.numid. Most of the code assumes that this is something
that can not happen, so we need to make sure that it won't happen
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

A control that is visible on the card->controls list can be freed at any time.
This means we must not access any of its memory while not holding the
controls_rw_lock. Otherwise we risk a use after free access.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

There are two issues with the current implementation for replacing user
controls. The first is that the code does not check if the control is actually a
user control and neither does it check if the control is owned by the process
that tries to remove it. That allows userspace applications to remove arbitrary
controls, which can cause a user after free if a for example a driver does not
expect a control to be removed from under its feed.

The second issue is that on one hand when a control is replaced the
user_ctl_count limit is not checked and on the other hand the user_ctl_count is
increased (even though the number of user controls does not change). This allows
userspace, once the user_ctl_count limit as been reached, to repeatedly replace
a control until user_ctl_count overflows. Once that happens new controls can be
added effectively bypassing the user_ctl_count limit.

Both issues can be fixed by instead of open-coding the removal of the control
that is to be replaced to use snd_ctl_remove_user_ctl(). This function does
proper permission checks as well as decrements user_ctl_count after the control
has been removed.

Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at
beginning of the function if the control already exists is removed. This is not
a problem though since the check is quite useless, because the lock that is
protecting the control list is released between the check and before adding the
new control to the list, which means that it is possible that a different
control with the same settings is added to the list after the check. Luckily
there is another check that is done while holding the lock in snd_ctl_add(), so
we'll rely on that to make sure that the same control is not added twice.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

The user-control put and get handlers as well as the tlv do not protect against
concurrent access from multiple threads. Since the state of the control is not
updated atomically it is possible that either two write operations or a write
and a read operation race against each other. Both can lead to arbitrary memory
disclosure. This patch introduces a new lock that protects user-controls from
concurrent access. Since applications typically access controls sequentially
than in parallel a single lock per card should be fine.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

I'm seeing this build failure for arm64:

    CC [M]  Documentation/filesystems/configfs/configfs_example_macros.o
  In file included from /usr/include/bits/sigcontext.h:27:0,
                   from /usr/include/signal.h:340,
                   from /usr/include/sys/wait.h:30,
                   from Documentation/accounting/getdelays.c:24:
  .../linux/usr/include/asm/sigcontext.h:61:2: error: unknown type name ‘u64’
    u64 esr;
    ^
  make[2]: *** [Documentation/accounting/getdelays] Error 1

This was introduced by commit 15af1942:

  arm64: Expose ESR_EL1 information to user when SIGSEGV/SIGBUS

Using __u64 instead of u64 fixes the problem.
Signed-off-by: Mark Salter <msalter@redhat.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

APM X-Gene Storm SoC supports 4 serial ports. This patch adds device nodes
for serial ports 1 to 3 (a device node for serial port 0 is already present
in the dts file).
This patch also sets the compatible property of serial nodes to "ns16550a".
Signed-off-by: Vinayak Kale <vkale@apm.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Arm64 does not define dma_get_required_mask() function.
Therefore, it should not define the ARCH_HAS_DMA_GET_REQUIRED_MASK.
This causes build errors in some device drivers (e.g. mpt2sas)
Signed-off-by: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: <stable@vger.kernel.org>

Currently core file of aarch32 process prstatus note has empty
registers set. As result aarch32 core files create by V8 kernel are
not very useful.

It happens because compat_gpr_get and compat_gpr_set functions can
copy registers values to/from either kbuf or ubuf. ELF core file
collection function fill_thread_core_info calls compat_gpr_get
with kbuf set and ubuf set to 0. But current compat_gpr_get and
compat_gpr_set function handle copy to/from only ubuf case.

Fix is to handle kbuf and ubuf as two separate cases in similar
way as other functions like user_regset_copyout, user_regset_copyin do.
Signed-off-by: Victor Kamensky <victor.kamensky@linaro.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Whilst native arm64 applications don't have the 16-bit UID/GID syscalls
wired up, compat tasks can still access them. The 16-bit wrappers for
these syscalls use __kernel_old_uid_t and __kernel_old_gid_t, which must
be 16-bit data types to maintain compatibility with the 16-bit UIDs used
by compat applications.

This patch defines 16-bit __kernel_old_{gid,uid}_t types for arm64
instead of using the 32-bit types provided by asm-generic.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Our compat PTRACE_POKEUSR implementation simply passes the user data to
regset_copy_from_user after some simple range checking. Unfortunately,
the data in question has already been copied to the kernel stack by this
point, so the subsequent access_ok check fails and the ptrace request
returns -EFAULT. This causes problems tracing fork() with older versions
of strace.

This patch briefly changes the fs to KERNEL_DS, so that the access_ok
check passes even with a kernel address.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>