Merge tag 'v4.4.68' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into ti-linux-4.4.y

This is the 4.4.68 stable release

* tag 'v4.4.68' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (59 commits)
  Linux 4.4.68
  block: get rid of blk_integrity_revalidate()
  drm/ttm: fix use-after-free races in vm fault handling
  f2fs: sanity check segment count
  bnxt_en: allocate enough space for ->ntp_fltr_bmap
  ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
  ipv6: initialize route null entry in addrconf_init()
  rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string
  ipv4, ipv6: ensure raw socket message is big enough to hold an IP header
  tcp: do not inherit fastopen_req from parent
  tcp: fix wraparound issue in tcp_lp
  bpf, arm64: fix jit branch offset related to ldimm64
  tcp: do not underestimate skb->truesize in tcp_trim_head()
  ALSA: hda - Fix deadlock of controller device lock at unbinding
  staging: emxx_udc: remove incorrect __init annotations
  staging: wlan-ng: add missing byte order conversion
  brcmfmac: Make skb header writable before use
  brcmfmac: Ensure pointer correctly set if skb data location changes
  MIPS: R2-on-R6 MULTU/MADDU/MSUBU emulation bugfix
  scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m
  ...

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>

1 files changed, 13 insertions, 0 deletions

diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 8f3e5e9d8bdb..e6de496bffbe 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2166,7 +2166,20 @@ static void azx_remove(struct pci_dev *pci)
                 /* cancel the pending probing work */
                 chip = card->private_data;
                 hda = container_of(chip, struct hda_intel, chip);
+                /* FIXME: below is an ugly workaround.
+                 * Both device_release_driver() and driver_probe_device()
+                 * take *both* the device's and its parent's lock before
+                 * calling the remove() and probe() callbacks.  The codec
+                 * probe takes the locks of both the codec itself and its
+                 * parent, i.e. the PCI controller dev.  Meanwhile, when
+                 * the PCI controller is unbound, it takes its lock, too
+                 * ==> ouch, a deadlock!
+                 * As a workaround, we unlock temporarily here the controller
+                 * device during cancel_work_sync() call.
+                 */
+                device_unlock(&pci->dev);
                 cancel_work_sync(&hda->probe_work);
+                device_lock(&pci->dev);
 
                 snd_card_free(card);
         }