14 Nov, 2014

6 commits

  • Before describing bugs itself, I first explain definition of freepage.

    1. pages on buddy list are counted as freepage.
    2. pages on isolate migratetype buddy list are *not* counted as freepage.
    3. pages on cma buddy list are counted as CMA freepage, too.

    Now, I describe problems and related patch.

    Patch 1: There is race conditions on getting pageblock migratetype that
    it results in misplacement of freepages on buddy list, incorrect
    freepage count and un-availability of freepage.

    Patch 2: Freepages on pcp list could have stale cached information to
    determine migratetype of buddy list to go. This causes misplacement of
    freepages on buddy list and incorrect freepage count.

    Patch 4: Merging between freepages on different migratetype of
    pageblocks will cause freepages accouting problem. This patch fixes it.

    Without patchset [3], above problem doesn't happens on my CMA allocation
    test, because CMA reserved pages aren't used at all. So there is no
    chance for above race.

    With patchset [3], I did simple CMA allocation test and get below
    result:

    - Virtual machine, 4 cpus, 1024 MB memory, 256 MB CMA reservation
    - run kernel build (make -j16) on background
    - 30 times CMA allocation(8MB * 30 = 240MB) attempts in 5 sec interval
    - Result: more than 5000 freepage count are missed

    With patchset [3] and this patchset, I found that no freepage count are
    missed so that I conclude that problems are solved.

    On my simple memory offlining test, these problems also occur on that
    environment, too.

    This patch (of 4):

    There are two paths to reach core free function of buddy allocator,
    __free_one_page(), one is free_one_page()->__free_one_page() and the
    other is free_hot_cold_page()->free_pcppages_bulk()->__free_one_page().
    Each paths has race condition causing serious problems. At first, this
    patch is focused on first type of freepath. And then, following patch
    will solve the problem in second type of freepath.

    In the first type of freepath, we got migratetype of freeing page
    without holding the zone lock, so it could be racy. There are two cases
    of this race.

    1. pages are added to isolate buddy list after restoring orignal
    migratetype

    CPU1 CPU2

    get migratetype => return MIGRATE_ISOLATE
    call free_one_page() with MIGRATE_ISOLATE

    grab the zone lock
    unisolate pageblock
    release the zone lock

    grab the zone lock
    call __free_one_page() with MIGRATE_ISOLATE
    freepage go into isolate buddy list,
    although pageblock is already unisolated

    This may cause two problems. One is that we can't use this page anymore
    until next isolation attempt of this pageblock, because freepage is on
    isolate buddy list. The other is that freepage accouting could be wrong
    due to merging between different buddy list. Freepages on isolate buddy
    list aren't counted as freepage, but ones on normal buddy list are
    counted as freepage. If merge happens, buddy freepage on normal buddy
    list is inevitably moved to isolate buddy list without any consideration
    of freepage accouting so it could be incorrect.

    2. pages are added to normal buddy list while pageblock is isolated.
    It is similar with above case.

    This also may cause two problems. One is that we can't keep these
    freepages from being allocated. Although this pageblock is isolated,
    freepage would be added to normal buddy list so that it could be
    allocated without any restriction. And the other problem is same as
    case 1, that it, incorrect freepage accouting.

    This race condition would be prevented by checking migratetype again
    with holding the zone lock. Because it is somewhat heavy operation and
    it isn't needed in common case, we want to avoid rechecking as much as
    possible. So this patch introduce new variable, nr_isolate_pageblock in
    struct zone to check if there is isolated pageblock. With this, we can
    avoid to re-check migratetype in common case and do it only if there is
    isolated pageblock or migratetype is MIGRATE_ISOLATE. This solve above
    mentioned problems.

    Changes from v3:
    Add one more check in free_one_page() that checks whether migratetype is
    MIGRATE_ISOLATE or not. Without this, abovementioned case 1 could happens.

    Signed-off-by: Joonsoo Kim
    Acked-by: Minchan Kim
    Acked-by: Michal Nazarewicz
    Acked-by: Vlastimil Babka
    Cc: "Kirill A. Shutemov"
    Cc: Mel Gorman
    Cc: Johannes Weiner
    Cc: Yasuaki Ishimatsu
    Cc: Zhang Yanfei
    Cc: Tang Chen
    Cc: Naoya Horiguchi
    Cc: Bartlomiej Zolnierkiewicz
    Cc: Wen Congyang
    Cc: Marek Szyprowski
    Cc: Laura Abbott
    Cc: Heesub Shin
    Cc: "Aneesh Kumar K.V"
    Cc: Ritesh Harjani
    Cc: Gioh Kim
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Joonsoo Kim
     
  • Commit 7d49d8868336 ("mm, compaction: reduce zone checking frequency in
    the migration scanner") has a side-effect that changes the iteration
    range calculation. Before the change, block_end_pfn is calculated using
    start_pfn, but now it blindly adds pageblock_nr_pages to the previous
    value.

    This causes the problem that isolation_start_pfn is larger than
    block_end_pfn when we isolate the page with more than pageblock order.
    In this case, isolation would fail due to an invalid range parameter.

    To prevent this, this patch implements skipping the range until a proper
    target pageblock is met. Without this patch, CMA with more than
    pageblock order always fails but with this patch it will succeed.

    Signed-off-by: Joonsoo Kim
    Cc: Vlastimil Babka
    Cc: Minchan Kim
    Cc: Michal Nazarewicz
    Cc: Naoya Horiguchi
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Joonsoo Kim
     
  • zram could kunmap_atomic() a NULL pointer in a rare situation: a zram
    page becomes a full-zeroed page after a partial write io. The current
    code doesn't handle this case and performs kunmap_atomic() on a NULL
    pointer, which panics the kernel.

    This patch fixes this issue.

    Signed-off-by: Weijie Yang
    Cc: Sergey Senozhatsky
    Cc: Dan Streetman
    Cc: Nitin Gupta
    Cc: Weijie Yang
    Acked-by: Jerome Marchand
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Weijie Yang
     
  • Pull SELinux fixlet from James Morris:
    "WARN_ONCE() here will unnecessarily terrify users"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
    selinux: convert WARN_ONCE() to printk() in selinux_nlmsg_perm()

    Linus Torvalds
     
  • Pull audit fixes from Paul Moore:
    "After he sent the initial audit pull request for 3.18, Eric asked me
    to take over the management of the audit tree, hence this pull request
    to fix a couple of problems with audit.

    As you can see below, the changes are minimal: adding some whitespace
    to a string so userspace parses it correctly, and fixing a problem
    with audit's usage of fsnotify that was causing audit watch rules to
    be lost. Neither of these patches were very controversial on the
    mailing lists and they fix real problems, getting them into 3.18 would
    be a good thing"

    * 'stable-3.18' of git://git.infradead.org/users/pcmoore/audit:
    audit: keep inode pinned
    audit: AUDIT_FEATURE_CHANGE message format missing delimiting space

    Linus Torvalds
     
  • Pull device mapper fixes from Mike Snitzer:

    - stable fix for dm-thin that avoids normal IO racing with discard

    - stable fix for a dm-cache related bug in dm-btree walking code that
    results from using very large fast device (eg 4T) with a very small
    cache blocksize (eg 32K) -- this is a very uncommon configuration

    - a couple fixes for dm-raid (one for stable and the other addresses a
    crash in 3.18-rc1 code)

    - stable fix for dm-thinp that addresses a very rare dm-bufio bug
    having to do with memory reclaimation (via shrinker) when using
    dm-thinp ontop of loopback devices

    - fix a leak in dm-stripe target constructor's error path

    * tag 'dm-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
    dm btree: fix a recursion depth bug in btree walking code
    dm thin: grab a virtual cell before looking up the mapping
    dm raid: fix inaccessible superblocks causing oops in configure_discard_support
    dm raid: ensure superblock's size matches device's logical block size
    dm bufio: change __GFP_IO to __GFP_FS in shrinker callbacks
    dm stripe: fix potential for leak in stripe_ctr error path

    Linus Torvalds
     

13 Nov, 2014

11 commits

  • James Morris
     
  • Pull kvm fixes from Paolo Bonzini:
    "Two fixes --- one of them not exactly a one liner, but things are
    calming down on the KVM front at last"

    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
    KVM: x86: Fix uninitialized op->type for some immediate values
    KVM: s390: virtio_ccw: remove unused variable

    Linus Torvalds
     
  • Pull Xtensa fixes from Chris Zankel:
    - fix umount syscall
    - fix ISS and xtfpga Kconfig dependencies so that more randconfigs are
    buildable
    - add seccomp, getrandom, and memfd_create syscalls
    - add defconfigs for KC705 and SMP LX200
    - implement pgprot_noncached

    * tag 'xtensa-20141109' of git://github.com/czankel/xtensa-linux:
    xtensa: xtfpga: add lx200 SMP DTS and defconfig
    xtensa: xtfpga: add generic KC705 board config
    xtensa: re-wire umount syscall to sys_oldumount
    xtensa: xtfpga: only select ethoc when ethernet is available
    xtensa: add seccomp, getrandom, and memfd_create syscalls
    xtensa: ISS: add BLOCK dependency to BLK_DEV_SIMDISK
    xtensa: implement pgprot_noncached
    xtensa/uapi: Add definition of TIOC[SG]RS485

    Linus Torvalds
     
  • Pull crypto fixes from Herbert Xu:
    - stack corruption fix for pseries hwrng driver
    - add missing DMA unmap in caam crypto driver
    - fix NUMA crash in qat crypto driver
    - fix buggy mapping of zero-length associated data in qat crypto driver

    * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
    hwrng: pseries - port to new read API and fix stack corruption
    crypto: caam - fix missing dma unmap on error path
    crypto: qat - Enforce valid numa configuration
    crypto: qat - Prevent dma mapping zero length assoc data

    Linus Torvalds
     
  • …it/rostedt/linux-trace

    Pull tracing fix from Steven Rostedt:
    "Rabin Vincent found a way that tracing could cause an infinite loop in
    the kernel. The splice logic wants a full page from the ring buffer
    but the ring_buffer_wait() returns when there's any data in the ring
    buffer. The splice code would then continue the loop waiting for a
    full page. But if a full page never happens, the splice code will
    never sleep and just continue to loop.

    There's another case that Rabin fixed that could loop if there's no
    memory and kmalloc() constantly returns NULL"

    * tag 'trace-fixes-v3.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
    tracing: Do not risk busy looping in buffer splice
    tracing: Do not busy wait in buffer splice

    Linus Torvalds
     
  • Pull kernel argument parsing fix from Rusty Russell:
    "Nasty, stupid bug, and I've suddenly had two reports"

    * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
    param: fix crash on bad kernel arguments

    Linus Torvalds
     
  • …el/git/groeck/linux-staging

    Pull hwmon fixes from Guenter Roeck:
    - fix PCI device ID in fam15h_power driver
    - fix suspend/resume behavior in pwm-fan driver
    - reduce logging noise created by ibmpowernv driver

    * tag 'hwmon-for-linus-v3.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
    hwmon: (fam15h_power) Fix NB device ID for F16h M30h
    hwmon: (pwm-fan) Fix suspend/resume behavior
    hwmon: (ibmpowernv) Quieten when probing finds no device

    Linus Torvalds
     
  • Pull thermal driver fixes from Eduardo Valentin:
    "This week we have few fixes:
    - fix in IMX thermal driver to do the correct loading sequence with
    CPUfreq
    - fix in Exynos related to TMU_CONTROL offset in Exynos5260
    - fix the unit conversion in int3403"

    [ Still pulling from Eduardo as Rui Zhang is on a business trip and has
    troubles with his machine ]

    * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal:
    imx: thermal: imx_get_temp might be called before sensor clock is prepared
    thermal: exynos: use correct offset for TMU_CONTROL register on Exynos5260
    thermal: imx: correct driver load sequence for cpu cooling
    Thermal/int3403: Fix thermal hysteresis unit conversion

    Linus Torvalds
     
  • Convert WARN_ONCE() to printk() in selinux_nlmsg_perm().

    After conversion from audit_log() in commit e173fb26, WARN_ONCE() was
    deemed too alarmist, so switch it to printk().

    Signed-off-by: Richard Guy Briggs
    [PM: Changed to printk(WARNING) so we catch all of the different
    invalid netlink messages. In Richard's defense, he brought this
    point up earlier, but I didn't understand his point at the time.]
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     
  • Pull MFD fixes from Lee Jones:
    - register offset fix for stmpe
    - eradicate build warning when !PM in rtsx_pcr
    - fix device ID collision when multiple boards are connected in
    viperboard
    - use correct Regmap handle - fixing unhanded IRQs in max77693
    - unmask MUIC IRQs in max77693
    - clear VBUS & CHG bits so board doesn't reboot instead of poweroff in
    twl4030

    * tag 'mfd-fixes-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd:
    mfd: twl4030-power: Fix poweroff with PM configuration enabled
    mfd: max77693: Fix always masked MUIC interrupts
    mfd: max77693: Use proper regmap for handling MUIC interrupts
    mfd: viperboard: Fix platform-device id collision
    mfd: rtsx: Fix build warnings for !PM
    mfd: stmpe: Fix STMPE24xx GPMR LSB

    Linus Torvalds
     
  • Pull drm fixes from Dave Airlie:
    "Radeon and i915 fixes.

    I probably should have sent these earlier, but nothing too urgent in
    them:

    - i915:
    blackscreen and corruption fixes
    - radeon:
    oops, locking and stability"

    * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
    drm/radeon: add missing crtc unlock when setting up the MC
    drm/radeon: use gart for DMA IB tests
    drm/radeon: make sure mode init is complete in bandwidth_update
    drm/radeon: set correct CE ram size for CIK
    drm/i915: safeguard against too high minimum brightness
    drm/i915: vlv: fix gunit HW state corruption during S4 suspend
    drm/i915: Disable caches for Global GTT.

    Linus Torvalds
     

12 Nov, 2014

4 commits

  • Audit rules disappear when an inode they watch is evicted from the cache.
    This is likely not what we want.

    The guilty commit is "fsnotify: allow marks to not pin inodes in core",
    which didn't take into account that audit_tree adds watches with a zero
    mask.

    Adding any mask should fix this.

    Fixes: 90b1e7a57880 ("fsnotify: allow marks to not pin inodes in core")
    Signed-off-by: Miklos Szeredi
    Cc: stable@vger.kernel.org # 2.6.36+
    Signed-off-by: Paul Moore

    Miklos Szeredi
     
  • F3 device ID is wrongly included in fam15h_power_id_table
    for F16h M30h. It should be F4 device ID. Fix this.

    Signed-off-by: Aravind Gopalakrishnan
    Signed-off-by: Guenter Roeck

    Aravind Gopalakrishnan
     
  • The state of a PWM output is not clearly defined after resume. Some PWM
    drivers do not restore the duty cycle upon resume, thus it is necessary to
    manually restore the correct value.

    Signed-off-by: Kamil Debski
    Signed-off-by: Guenter Roeck

    Kamil Debski
     
  • Because we build kernels with drivers built in for many platforms, it's
    normal for the ibmpowernv driver to be loaded on systems that don't have
    the appropriate hardware.

    Currently the driver spams the log with:

    ibmpowernv ibmpowernv.0: Opal node 'sensors' not found
    ibmpowernv: Platfrom driver probe failed

    But there is no error, this machine is not a powernv and doesn't have
    the hardware. So change the sensors message to dev_dbg(), and only print
    an error about the probe failing if it's not ENODEV.

    Also fix the spelling of "Platfrom" and print the actual error value.

    Signed-off-by: Michael Ellerman
    Reviewed-by: Jean Delvare
    Signed-off-by: Guenter Roeck

    Michael Ellerman
     

11 Nov, 2014

4 commits

  • Currently if the user passes an invalid value on the kernel command line
    then the kernel will crash during argument parsing. On most systems this
    is very hard to debug because the console hasn't been initialized yet.

    This is a regression due to commit 51e158c12aca ("param: hand arguments
    after -- straight to init") which, in response to the systemd debug
    controversy, made it possible to explicitly pass arguments to init. To
    achieve this parse_args() was extended from simply returning an error
    code to returning a pointer. Regretably the new init args logic does not
    perform a proper validity check on the pointer resulting in a crash.

    This patch fixes the validity check. Should the check fail then no arguments
    will be passed to init. This is reasonable and matches how the kernel treats
    its own arguments (i.e. no error recovery).

    Signed-off-by: Daniel Thompson
    Cc: stable@vger.kernel.org
    Signed-off-by: Rusty Russell

    Daniel Thompson
     
  • If the read loop in trace_buffers_splice_read() keeps failing due to
    memory allocation failures without reading even a single page then this
    function will keep busy looping.

    Remove the risk for that by exiting the function if memory allocation
    failures are seen.

    Link: http://lkml.kernel.org/r/1415309167-2373-2-git-send-email-rabin@rab.in

    Signed-off-by: Rabin Vincent
    Signed-off-by: Steven Rostedt

    Rabin Vincent
     
  • On a !PREEMPT kernel, attempting to use trace-cmd results in a soft
    lockup:

    # trace-cmd record -e raw_syscalls:* -F false
    NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [trace-cmd:61]
    ...
    Call Trace:
    [] ? __wake_up_common+0x90/0x90
    [] wait_on_pipe+0x35/0x40
    [] tracing_buffers_splice_read+0x2e3/0x3c0
    [] ? tracing_stats_read+0x2a0/0x2a0
    [] ? _raw_spin_unlock+0x2b/0x40
    [] ? do_read_fault+0x21b/0x290
    [] ? handle_mm_fault+0x2ba/0xbd0
    [] ? trace_event_buffer_lock_reserve+0x40/0x80
    [] ? trace_buffer_lock_reserve+0x22/0x60
    [] ? trace_event_buffer_lock_reserve+0x40/0x80
    [] do_splice_to+0x6d/0x90
    [] SyS_splice+0x7c1/0x800
    [] tracesys_phase2+0xd3/0xd8

    The problem is this: tracing_buffers_splice_read() calls
    ring_buffer_wait() to wait for data in the ring buffers. The buffers
    are not empty so ring_buffer_wait() returns immediately. But
    tracing_buffers_splice_read() calls ring_buffer_read_page() with full=1,
    meaning it only wants to read a full page. When the full page is not
    available, tracing_buffers_splice_read() tries to wait again with
    ring_buffer_wait(), which again returns immediately, and so on.

    Fix this by adding a "full" argument to ring_buffer_wait() which will
    make ring_buffer_wait() wait until the writer has left the reader's
    page, i.e. until full-page reads will succeed.

    Link: http://lkml.kernel.org/r/1415645194-25379-1-git-send-email-rabin@rab.in

    Cc: stable@vger.kernel.org # 3.16+
    Fixes: b1169cc69ba9 ("tracing: Remove mock up poll wait function")
    Signed-off-by: Rabin Vincent
    Signed-off-by: Steven Rostedt

    Rabin Vincent
     
  • The walk code was using a 'ro_spine' to hold it's locked btree nodes.
    But this data structure is designed for the rolling lock scheme, and
    as such automatically unlocks blocks that are two steps up the call
    chain. This is not suitable for the simple recursive walk algorithm,
    which retraces its steps.

    This code is only used by the persistent array code, which in turn is
    only used by dm-cache. In order to trigger it you need to have a
    mapping tree that is more than 2 levels deep; which equates to 8-16
    million cache blocks. For instance a 4T ssd with a very small block
    size of 32k only just triggers this bug.

    The fix just places the locked blocks on the stack, and stops using
    the ro_spine altogether.

    Signed-off-by: Joe Thornber
    Signed-off-by: Mike Snitzer
    Cc: stable@vger.kernel.org

    Joe Thornber
     

10 Nov, 2014

15 commits

  • Commit e7cd1d1eb16f ("mfd: twl4030-power: Add generic reset
    configuration") enabled configuring the PM features for twl4030.

    This caused poweroff command to fail on devices that have the
    BCI charger on twl4030 wired, or have power wired for VBUS.
    Instead of powering off, the device reboots. This is because
    voltage is detected on charger or VBUS with the default bits
    enabled for the power transition registers.

    To fix the issue, let's just clear VBUS and CHG bits as we want
    poweroff command to keep the system powered off.

    Fixes: e7cd1d1eb16f ("mfd: twl4030-power: Add generic reset configuration")
    Cc: stable@vger.kernel.org # v3.16+
    Reported-by: Russell King
    Signed-off-by: Tony Lindgren
    Signed-off-by: Lee Jones

    Tony Lindgren
     
  • All interrupts coming from MUIC were ignored because interrupt source
    register was masked.

    The Maxim 77693 has a "interrupt source" - a separate register and interrupts
    which give information about PMIC block triggering the individual
    interrupt (charger, topsys, MUIC, flash LED).

    By default bootloader could initialize this register to "mask all"
    value. In such case (observed on Trats2 board) MUIC interrupts won't be
    generated regardless of their mask status. Regmap irq chip was unmasking
    individual MUIC interrupts but the source was masked

    Before introducing regmap irq chip this interrupt source was unmasked,
    read and acked. Reading and acking is not necessary but unmasking is.

    Fixes: 342d669c1ee4 ("mfd: max77693: Handle IRQs using regmap")

    Cc:
    Signed-off-by: Krzysztof Kozlowski
    Reviewed-by: Chanwoo Choi
    Signed-off-by: Lee Jones

    Krzysztof Kozlowski
     
  • Interrupts coming from Maxim77693 MUIC block (MicroUSB Interface
    Controller) were not handled at all because wrong regmap was used for
    MUIC's regmap_irq_chip.

    The MUIC component of Maxim 77693 uses different I2C address thus second
    regmap is created and used by max77693 extcon driver. The registers for
    MUIC interrupts are also in that block and should be handled by that
    second regmap.

    However the regmap irq chip for MUIC was configured with default regmap
    which could not read MUIC registers.

    Fixes: 342d669c1ee4 ("mfd: max77693: Handle IRQs using regmap")

    Cc:
    Signed-off-by: Krzysztof Kozlowski
    Reviewed-by: Chanwoo Choi
    Signed-off-by: Lee Jones

    Krzysztof Kozlowski
     
  • Allow more than one viperboard to be connected by registering with
    PLATFORM_DEVID_AUTO instead of PLATFORM_DEVID_NONE.

    The subdevices are currently registered with PLATFORM_DEVID_NONE, which
    will cause a name collision on the platform bus when a second viperboard
    is plugged in:

    viperboard 1-2.4:1.0: version 0.00 found at bus 001 address 004
    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 181 at /home/johan/work/omicron/src/linux/fs/sysfs/dir.c:31 sysfs_warn_dup+0x74/0x84()
    sysfs: cannot create duplicate filename '/bus/platform/devices/viperboard-gpio'
    Modules linked in: i2c_viperboard viperboard netconsole [last unloaded: viperboard]
    CPU: 0 PID: 181 Comm: bash Tainted: G W 3.17.0-rc6 #1
    [] (unwind_backtrace) from [] (show_stack+0x20/0x24)
    [] (show_stack) from [] (dump_stack+0x24/0x28)
    [] (dump_stack) from [] (warn_slowpath_common+0x80/0x98)
    [] (warn_slowpath_common) from [] (warn_slowpath_fmt+0x40/0x48)
    [] (warn_slowpath_fmt) from [] (sysfs_warn_dup+0x74/0x84)
    [] (sysfs_warn_dup) from [] (sysfs_do_create_link_sd.isra.2+0xcc/0xd0)
    [] (sysfs_do_create_link_sd.isra.2) from [] (sysfs_create_link+0x3c/0x48)
    [] (sysfs_create_link) from [] (bus_add_device+0x12c/0x1e0)
    [] (bus_add_device) from [] (device_add+0x410/0x584)
    [] (device_add) from [] (platform_device_add+0xd8/0x26c)
    [] (platform_device_add) from [] (mfd_add_device+0x240/0x344)
    [] (mfd_add_device) from [] (mfd_add_devices+0xb8/0x110)
    [] (mfd_add_devices) from [] (vprbrd_probe+0x160/0x1b0 [viperboard])
    [] (vprbrd_probe [viperboard]) from [] (usb_probe_interface+0x1bc/0x2a8)
    [] (usb_probe_interface) from [] (driver_probe_device+0x14c/0x3ac)
    [] (driver_probe_device) from [] (__driver_attach+0xa4/0xa8)
    [] (__driver_attach) from [] (bus_for_each_dev+0x70/0xa4)
    [] (bus_for_each_dev) from [] (driver_attach+0x2c/0x30)
    [] (driver_attach) from [] (usb_store_new_id+0x170/0x1ac)
    [] (usb_store_new_id) from [] (new_id_store+0x34/0x3c)
    [] (new_id_store) from [] (drv_attr_store+0x30/0x3c)
    [] (drv_attr_store) from [] (sysfs_kf_write+0x5c/0x60)
    [] (sysfs_kf_write) from [] (kernfs_fop_write+0xd4/0x194)
    [] (kernfs_fop_write) from [] (vfs_write+0xb4/0x1c0)
    [] (vfs_write) from [] (SyS_write+0x4c/0xa0)
    [] (SyS_write) from [] (ret_fast_syscall+0x0/0x48)
    ---[ end trace 98e8603c22d65817 ]---
    viperboard 1-2.4:1.0: Failed to add mfd devices to core.
    viperboard: probe of 1-2.4:1.0 failed with error -17

    Signed-off-by: Johan Hovold
    Signed-off-by: Lee Jones

    Johan Hovold
     
  • rtsx_pci_power_off() is called only from rtsx_pci_suspend(), which isn't
    built when PM is disabled.

    Signed-off-by: Thierry Reding
    Signed-off-by: Lee Jones

    Thierry Reding
     
  • The least significat byte of the GPIO value read register
    on the STMPE24xx series is on addres 0xA4 not 0xA5. Correct
    against datasheet and tested on the STMPE2401 hardware.

    Signed-off-by: Linus Walleij
    Signed-off-by: Lee Jones

    Linus Walleij
     
  • Linux 3.18-rc4

    Chris Zankel
     
  • Black screen, screen corruption, hardware state corruption fixes.

    * tag 'drm-intel-fixes-2014-11-07' of git://anongit.freedesktop.org/drm-intel:
    drm/i915: safeguard against too high minimum brightness
    drm/i915: vlv: fix gunit HW state corruption during S4 suspend
    drm/i915: Disable caches for Global GTT.

    Dave Airlie
     
  • Linus Torvalds
     
  • Pull arm64 fixes from Catalin Marinas:
    - enable bpf syscall for compat
    - cpu_suspend fix when checking the idle state type
    - defconfig update

    * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
    arm64: defconfig: update defconfig for 3.18
    arm64: compat: Enable bpf syscall
    arm64: psci: fix cpu_suspend to check idle state type for index

    Linus Torvalds
     
  • Pull ARM SoC fixes from Olof Johansson:
    "Another quiet week:

    - a fix to silence edma probe error on non-supported platforms from
    Arnd
    - a fix to enable the PL clock for Parallella, to make mainline
    usable with the SDK.
    - a somewhat verbose fix for the PLL clock tree on VF610
    - enabling of SD/MMC on one of the VF610-based boards (for testing)
    - a fix for i.MX where CONFIG_SPI used to be implicitly enabled and
    now needs to be added to the defconfig instead
    - another maintainer added for bcm2835: Lee Jones"

    * tag 'armsoc-for-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
    ARM: dts: zynq: Enable PL clocks for Parallella
    dma: edma: move device registration to platform code
    ARM: dts: vf610: add SD node to cosmic dts
    MAINTAINERS: update bcm2835 entry
    ARM: imx: Fix the removal of CONFIG_SPI option
    ARM: imx: clk-vf610: define PLL's clock tree

    Linus Torvalds
     
  • Pull devicetree bugfix from Grant Likely:
    "One buffer overflow bug that shouldn't be left around"

    * 'devicetree/merge' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux:
    of: Fix overflow bug in string property parsing functions

    Linus Torvalds
     
  • Pull btrfs fix from Chris Mason:
    "It's a one liner for an error cleanup path that leads to crashes"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
    Btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup

    Linus Torvalds
     
  • Pull driver core fixes from Greg KH:
    "Here are 3 tiny fixes for 3.18-rc4.

    One fixes up a long-stading race condition in the driver core for
    removing directories in /sys/devices/virtual/ and the other 2 fix up
    the wording of a new Kconfig option that was added in 3.18-rc1"

    * tag 'driver-core-3.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
    tiny: rename ENABLE_DEV_COREDUMP to ALLOW_DEV_COREDUMP
    tiny: reverse logic for DISABLE_DEV_COREDUMP
    sysfs: driver core: Fix glue dir race condition by gdp_mutex

    Linus Torvalds
     
  • Pull staging driver fixes from Greg KH:
    "Here are some staging/iio fixes for 3.18-rc4.

    Nothing major, just a few bugfixes of things that have been reported"

    * tag 'staging-3.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
    staging:iio:ade7758: Remove "raw" from channel name
    staging:iio:ade7758: Fix check if channels are enabled in prenable
    staging:iio:ade7758: Fix NULL pointer deref when enabling buffer
    iio: as3935: allocate correct iio_device size
    io: accel: kxcjk-1013: Fix iio_event_spec direction
    iio: tsl4531: Fix compiler error when CONFIG_PM_OPS is not defined
    iio: adc: mxs-lradc: Disable the clock on probe failure
    iio: st_sensors: Fix buffer copy
    staging:iio:ad5933: Drop "raw" from channel names
    staging:iio:ad5933: Fix NULL pointer deref when enabling buffer

    Linus Torvalds