Linux v4.5-12596-g11caf57f6a4b

- asm-generic, pm+acpi, rtc, hwmon, block, mtd, ubifs, nfsd, kbuild, parisc,
  h8, arm64, armsoc

config-armv7

@@ -356,6 +356,7 @@ CONFIG_QCOM_WCNSS_CTRL=m
 CONFIG_QCOM_SMSM=y
 CONFIG_QCOM_SMP2P=m
 CONFIG_PCIE_QCOM=y
+CONFIG_MTD_NAND_QCOM=m
 
 # i.MX
 # CONFIG_MXC_DEBUG_BOARD is not set

config-generic

@@ -4685,6 +4685,8 @@ CONFIG_NFSD_V3=y
 CONFIG_NFSD_V3_ACL=y
 CONFIG_NFSD_V4=y
 CONFIG_NFSD_PNFS=y
+CONFIG_NFSD_BLOCKLAYOUT=y
+CONFIG_NFSD_SCSILAYOUT=y
 CONFIG_NFSD_V4_SECURITY_LABEL=y
 CONFIG_NFS_FSCACHE=y
 # CONFIG_NFS_USE_LEGACY_DNS is not set

gitrev

@@ -1 +1 @@
-e46b4e2b46e173889b19999b8bd033d5e8b3acf0
+11caf57f6a4b8e380001548b8af0a3ae3f7b4354

intel_pstate-Do-not-call-wrmsrl_on_cpu-with-disabled.patch

@@ -1,241 +0,0 @@
-From c517e903c4dbc9271b3cfb43b27d303dd6f03cd7 Mon Sep 17 00:00:00 2001
-From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
-Date: Fri, 18 Mar 2016 15:36:25 +0100
-Subject: [PATCH] intel_pstate: Do not call wrmsrl_on_cpu() with disabled
- interrupts
-
-After commit a4675fbc4a7a (cpufreq: intel_pstate: Replace timers with
-utilization update callbacks) wrmsrl_on_cpu() cannot be called in the
-intel_pstate_adjust_busy_pstate() path as that is executed with
-disabled interrupts.  However, atom_set_pstate() called from there
-via intel_pstate_set_pstate() uses wrmsrl_on_cpu() to update the
-IA32_PERF_CTL MSR which triggers the WARN_ON_ONCE() in
-smp_call_function_single().
-
-The reason why wrmsrl_on_cpu() is used by atom_set_pstate() is
-because intel_pstate_set_pstate() calling it is also invoked during
-the initialization and cleanup of the driver and in those cases it is
-not guaranteed to be run on the CPU that is being updated.  However,
-in the case when intel_pstate_set_pstate() is called by
-intel_pstate_adjust_busy_pstate(), wrmsrl() can be used to update
-the register safely.  Moreover, intel_pstate_set_pstate() already
-contains code that only is executed if the function is called by
-intel_pstate_adjust_busy_pstate() and there is a special argument
-passed to it because of that.
-
-To fix the problem at hand, rearrange the code taking the above
-observations into account.
-
-First, replace the ->set() callback in struct pstate_funcs with a
-->get_val() one that will return the value to be written to the
-IA32_PERF_CTL MSR without updating the register.
-
-Second, split intel_pstate_set_pstate() into two functions,
-intel_pstate_update_pstate() to be called by
-intel_pstate_adjust_busy_pstate() that will contain all of the
-intel_pstate_set_pstate() code which only needs to be executed in
-that case and will use wrmsrl() to update the MSR (after obtaining
-the value to write to it from the ->get_val() callback), and
-intel_pstate_set_min_pstate() to be invoked during the
-initialization and cleanup that will set the P-state to the
-minimum one and will update the MSR using wrmsrl_on_cpu().
-
-Finally, move the code shared between intel_pstate_update_pstate()
-and intel_pstate_set_min_pstate() to a new static inline function
-intel_pstate_record_pstate() and make them both call it.
-
-Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
-Fixes: a4675fbc4a7a (cpufreq: intel_pstate: Replace timers with utilization update callbacks)
----
- drivers/cpufreq/intel_pstate.c | 73 +++++++++++++++++++++++++-----------------
- 1 file changed, 43 insertions(+), 30 deletions(-)
-
-diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index cb5607495816..4b644526fd59 100644
---- a/drivers/cpufreq/intel_pstate.c
-+++ b/drivers/cpufreq/intel_pstate.c
-@@ -134,7 +134,7 @@ struct pstate_funcs {
- 	int (*get_min)(void);
- 	int (*get_turbo)(void);
- 	int (*get_scaling)(void);
--	void (*set)(struct cpudata*, int pstate);
-+	u64 (*get_val)(struct cpudata*, int pstate);
- 	void (*get_vid)(struct cpudata *);
- 	int32_t (*get_target_pstate)(struct cpudata *);
- };
-@@ -565,7 +565,7 @@ static int atom_get_turbo_pstate(void)
- 	return value & 0x7F;
- }
- 
--static void atom_set_pstate(struct cpudata *cpudata, int pstate)
-+static u64 atom_get_val(struct cpudata *cpudata, int pstate)
- {
- 	u64 val;
- 	int32_t vid_fp;
-@@ -585,9 +585,7 @@ static void atom_set_pstate(struct cpudata *cpudata, int pstate)
- 	if (pstate > cpudata->pstate.max_pstate)
- 		vid = cpudata->vid.turbo;
- 
--	val |= vid;
--
--	wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val);
-+	return val | vid;
- }
- 
- static int silvermont_get_scaling(void)
-@@ -711,7 +709,7 @@ static inline int core_get_scaling(void)
- 	return 100000;
- }
- 
--static void core_set_pstate(struct cpudata *cpudata, int pstate)
-+static u64 core_get_val(struct cpudata *cpudata, int pstate)
- {
- 	u64 val;
- 
-@@ -719,7 +717,7 @@ static void core_set_pstate(struct cpudata *cpudata, int pstate)
- 	if (limits->no_turbo && !limits->turbo_disabled)
- 		val |= (u64)1 << 32;
- 
--	wrmsrl(MSR_IA32_PERF_CTL, val);
-+	return val;
- }
- 
- static int knl_get_turbo_pstate(void)
-@@ -750,7 +748,7 @@ static struct cpu_defaults core_params = {
- 		.get_min = core_get_min_pstate,
- 		.get_turbo = core_get_turbo_pstate,
- 		.get_scaling = core_get_scaling,
--		.set = core_set_pstate,
-+		.get_val = core_get_val,
- 		.get_target_pstate = get_target_pstate_use_performance,
- 	},
- };
-@@ -769,7 +767,7 @@ static struct cpu_defaults silvermont_params = {
- 		.get_max_physical = atom_get_max_pstate,
- 		.get_min = atom_get_min_pstate,
- 		.get_turbo = atom_get_turbo_pstate,
--		.set = atom_set_pstate,
-+		.get_val = atom_get_val,
- 		.get_scaling = silvermont_get_scaling,
- 		.get_vid = atom_get_vid,
- 		.get_target_pstate = get_target_pstate_use_cpu_load,
-@@ -790,7 +788,7 @@ static struct cpu_defaults airmont_params = {
- 		.get_max_physical = atom_get_max_pstate,
- 		.get_min = atom_get_min_pstate,
- 		.get_turbo = atom_get_turbo_pstate,
--		.set = atom_set_pstate,
-+		.get_val = atom_get_val,
- 		.get_scaling = airmont_get_scaling,
- 		.get_vid = atom_get_vid,
- 		.get_target_pstate = get_target_pstate_use_cpu_load,
-@@ -812,7 +810,7 @@ static struct cpu_defaults knl_params = {
- 		.get_min = core_get_min_pstate,
- 		.get_turbo = knl_get_turbo_pstate,
- 		.get_scaling = core_get_scaling,
--		.set = core_set_pstate,
-+		.get_val = core_get_val,
- 		.get_target_pstate = get_target_pstate_use_performance,
- 	},
- };
-@@ -839,25 +837,24 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
- 	*min = clamp_t(int, min_perf, cpu->pstate.min_pstate, max_perf);
- }
- 
--static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate, bool force)
-+static inline void intel_pstate_record_pstate(struct cpudata *cpu, int pstate)
- {
--	int max_perf, min_perf;
--
--	if (force) {
--		update_turbo_state();
--
--		intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
--
--		pstate = clamp_t(int, pstate, min_perf, max_perf);
--
--		if (pstate == cpu->pstate.current_pstate)
--			return;
--	}
- 	trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu);
--
- 	cpu->pstate.current_pstate = pstate;
-+}
- 
--	pstate_funcs.set(cpu, pstate);
-+static void intel_pstate_set_min_pstate(struct cpudata *cpu)
-+{
-+	int pstate = cpu->pstate.min_pstate;
-+
-+	intel_pstate_record_pstate(cpu, pstate);
-+	/*
-+	 * Generally, there is no guarantee that this code will always run on
-+	 * the CPU being updated, so force the register update to run on the
-+	 * right CPU.
-+	 */
-+	wrmsrl_on_cpu(cpu->cpu, MSR_IA32_PERF_CTL,
-+		      pstate_funcs.get_val(cpu, pstate));
- }
- 
- static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
-@@ -870,7 +867,8 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
- 
- 	if (pstate_funcs.get_vid)
- 		pstate_funcs.get_vid(cpu);
--	intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate, false);
-+
-+	intel_pstate_set_min_pstate(cpu);
- }
- 
- static inline void intel_pstate_calc_busy(struct cpudata *cpu)
-@@ -997,6 +995,21 @@ static inline int32_t get_target_pstate_use_performance(struct cpudata *cpu)
- 	return cpu->pstate.current_pstate - pid_calc(&cpu->pid, core_busy);
- }
- 
-+static inline void intel_pstate_update_pstate(struct cpudata *cpu, int pstate)
-+{
-+	int max_perf, min_perf;
-+
-+	update_turbo_state();
-+
-+	intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
-+	pstate = clamp_t(int, pstate, min_perf, max_perf);
-+	if (pstate == cpu->pstate.current_pstate)
-+		return;
-+
-+	intel_pstate_record_pstate(cpu, pstate);
-+	wrmsrl(MSR_IA32_PERF_CTL, pstate_funcs.get_val(cpu, pstate));
-+}
-+
- static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
- {
- 	int from, target_pstate;
-@@ -1006,7 +1019,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
- 
- 	target_pstate = pstate_funcs.get_target_pstate(cpu);
- 
--	intel_pstate_set_pstate(cpu, target_pstate, true);
-+	intel_pstate_update_pstate(cpu, target_pstate);
- 
- 	sample = &cpu->sample;
- 	trace_pstate_sample(fp_toint(sample->core_pct_busy),
-@@ -1180,7 +1193,7 @@ static void intel_pstate_stop_cpu(struct cpufreq_policy *policy)
- 	if (hwp_active)
- 		return;
- 
--	intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate, false);
-+	intel_pstate_set_min_pstate(cpu);
- }
- 
- static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
-@@ -1255,7 +1268,7 @@ static void copy_cpu_funcs(struct pstate_funcs *funcs)
- 	pstate_funcs.get_min   = funcs->get_min;
- 	pstate_funcs.get_turbo = funcs->get_turbo;
- 	pstate_funcs.get_scaling = funcs->get_scaling;
--	pstate_funcs.set       = funcs->set;
-+	pstate_funcs.get_val   = funcs->get_val;
- 	pstate_funcs.get_vid   = funcs->get_vid;
- 	pstate_funcs.get_target_pstate = funcs->get_target_pstate;
- 
--- 
-2.5.0
-

kernel.spec

@@ -69,7 +69,7 @@ Summary: The Linux kernel
 # The rc snapshot level
 %define rcrev 0
 # The git snapshot level
-%define gitrev 25
+%define gitrev 26
 # Set rpm version accordingly
 %define rpmversion 4.%{upstream_sublevel}.0
 %endif
@@ -612,8 +612,6 @@ Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
 #CVE-2016-3134 rhbz 1317383 1317384
 Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
 
-Patch667: intel_pstate-Do-not-call-wrmsrl_on_cpu-with-disabled.patch
-
 #CVE-2016-3137 rhbz 1317010 1316996
 Patch672: cypress_m8-add-sanity-checking.patch
 
@@ -637,6 +635,8 @@ Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch
 #CVE-2016-3136 rhbz 1317007 1317010
 Patch687: mct_u232-sanity-checking-in-probe.patch
 
+Patch688: sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2159,6 +2159,11 @@ fi
 #
 # 
 %changelog
+* Fri Mar 25 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.0-0.rc0.git26.1
+- Linux v4.5-12596-g11caf57f6a4b
+- asm-generic, pm+acpi, rtc, hwmon, block, mtd, ubifs, nfsd, kbuild, parisc,
+  h8, arm64, armsoc
+
 * Thu Mar 24 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.0-0.rc0.git25.1
 - Linux v4.5-12330-ge46b4e2b46e1
 - trace, thermal, nfsd merges

sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch

@@ -0,0 +1,80 @@
+From cef7f62d5881e886cd514436bc386a7202af25f1 Mon Sep 17 00:00:00 2001
+From: Nicolai Stange <nicstange@gmail.com>
+Date: Tue, 15 Mar 2016 13:35:06 +0100
+Subject: [PATCH] sound/usb: fix NULL dereference in usb_audio_probe()
+
+With commit
+
+  aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
+                 media resources")
+
+an access to quirk->media_device without checking for quirk != NULL has
+been introduced in usb_audio_probe().
+
+With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
+this results in the following splat at boot time:
+
+  BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
+  IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
+  Oops: 0000 [#1] SMP
+  [...]
+  CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
+  Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
+  task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
+  RIP: 0010:[<ffffffffa089aa6c>]  [<ffffffffa089aa6c>]
+                                usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
+  [...]
+  Call Trace:
+   [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
+   [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
+   [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
+   [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
+   [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
+   [<ffffffff815095ce>] driver_attach+0x1e/0x20
+   [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
+   [<ffffffff8150ab10>] driver_register+0x60/0xe0
+   [<ffffffff815a7711>] usb_register_driver+0x81/0x140
+   [<ffffffffa08c7000>] ? 0xffffffffa08c7000
+   [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
+   [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
+   [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
+   [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
+   [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
+   [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
+   [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
+   [<ffffffff81129870>] ? __symbol_put+0x60/0x60
+   [<ffffffff81241690>] ? vfs_read+0x110/0x130
+   [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
+   [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
+   [<ffffffff81003d94>] do_syscall_64+0x64/0x110
+   [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
+
+After encountering this, the system-udevd process seems to be blocked
+until it is killed when hitting its timeout of 3min.
+
+In analogy to the other accesses to members of quirk in usb_audio_probe(),
+check for quirk != NULL before accessing its ->media_device.
+
+Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
+                      media resources")
+Signed-off-by: Nicolai Stange <nicstange@gmail.com>
+---
+ sound/usb/card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 63244bbba8c7..479621e775bc 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
+ 	if (err < 0)
+ 		goto __error;
+ 
+-	if (quirk->media_device) {
++	if (quirk && quirk->media_device) {
+ 		/* don't want to fail when media_snd_device_create() fails */
+ 		media_snd_device_create(chip, intf);
+ 	}
+-- 
+2.5.5
+

sources

@@ -1,3 +1,3 @@
 a60d48eee08ec0536d5efb17ca819aef  linux-4.5.tar.xz
 6f557fe90b800b615c85c2ca04da6154  perf-man-4.5.tar.gz
-573ece27cbf9ecd41037469878838473  patch-4.5-git25.xz
+54ded8d8f3ae3bcf894d8c399ddbe016  patch-4.5-git26.xz