summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-10-28x86, cma: Reserve DMA contiguous area after initmem_init()Weijie Yang
Fengguang Wu reported a boot crash on the x86 platform via the 0-day Linux Kernel Performance Test: cma: dma_contiguous_reserve: reserving 31 MiB for global area BUG: Int 6: CR2 (null) [<41850786>] dump_stack+0x16/0x18 [<41d2b1db>] early_idt_handler+0x6b/0x6b [<41072227>] ? __phys_addr+0x2e/0xca [<41d4ee4d>] cma_declare_contiguous+0x3c/0x2d7 [<41d6d359>] dma_contiguous_reserve_area+0x27/0x47 [<41d6d4d1>] dma_contiguous_reserve+0x158/0x163 [<41d33e0f>] setup_arch+0x79b/0xc68 [<41d2b7cf>] start_kernel+0x9c/0x456 [<41d2b2ca>] i386_start_kernel+0x79/0x7d (See details at: https://lkml.org/lkml/2014/10/8/708) It is because dma_contiguous_reserve() is called before initmem_init() in x86, the variable high_memory is not initialized but accessed by __pa(high_memory) in dma_contiguous_reserve(). This patch moves dma_contiguous_reserve() after initmem_init() so that high_memory is initialized before accessed. Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Weijie Yang <weijie.yang@samsung.com> Acked-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Acked-by: Michal Nazarewicz <mina86@mina86.com> Cc: iamjoonsoo.kim@lge.com Cc: 'Linux-MM' <linux-mm@kvack.org> Cc: 'Weijie Yang' <weijie.yang.kh@gmail.com> Link: http://lkml.kernel.org/r/000101cfef69%2431e528a0%2495af79e0%24%25yang@samsung.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
2014-10-28Revert "powerpc/powernv: Fix endian bug in LPC bus debugfs accessors"Michael Ellerman
This reverts commit bf7588a0859580a45c63cb082825d77c13eca357. Ben says although the code is not correct "[this] fix was completely wrong and does more damages than it fixes things." Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-10-28ipvs: Avoid null-pointer deref in debug codeAlex Gartrell
Use daddr instead of reaching into dest. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Alex Gartrell <agartrell@fb.com> Signed-off-by: Simon Horman <horms@verge.net.au>
2014-10-27bpf: split eBPF out of NETAlexei Starovoitov
introduce two configs: - hidden CONFIG_BPF to select eBPF interpreter that classic socket filters depend on - visible CONFIG_BPF_SYSCALL (default off) that tracing and sockets can use that solves several problems: - tracing and others that wish to use eBPF don't need to depend on NET. They can use BPF_SYSCALL to allow loading from userspace or select BPF to use it directly from kernel in NET-less configs. - in 3.18 programs cannot be attached to events yet, so don't force it on - when the rest of eBPF infra is there in 3.19+, it's still useful to switch it off to minimize kernel size bloat-o-meter on x64 shows: add/remove: 0/60 grow/shrink: 0/2 up/down: 0/-15601 (-15601) tested with many different config combinations. Hopefully didn't miss anything. Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-27Merge branch 'cxgb4-net'David S. Miller
Anish Bhatt says: ==================== cxgb4 : DCBx fixes for apps/host lldp agents This patchset contains some minor fixes for cxgb4 DCBx code. Chiefly, cxgb4 was not cleaning up any apps added to kernel app table when link was lost. Disabling DCBx in firmware would automatically set DCBx state to host-managed and enabled, we now wait for an explicit enable call from an lldp agent instead First patch was originally sent to net-next, but considering it applies to correcting behaviour of code already in net, I think it qualifies as a bug fix. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-27cxgb4 : Handle dcb enable correctlyAnish Bhatt
Disabling DCBx in firmware automatically enables DCBx for control via host lldp agents. Wait for an explicit setstate call from an lldp agents to enable DCBx instead. Fixes: 76bcb31efc06 ("cxgb4 : Add DCBx support codebase and dcbnl_ops") Signed-off-by: Anish Bhatt <anish@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-27cxgb4 : Improve handling of DCB negotiation or loss thereofAnish Bhatt
Clear out any DCB apps we might have added to kernel table when we lose DCB sync (or IEEE equivalent event). These were previously left behind and not cleaned up correctly. IEEE allows individual components to work independently, so improve check for IEEE completion by specifying individual components. Fixes: 10b0046685ab ("cxgb4: IEEE fixes for DCBx state machine") Signed-off-by: Anish Bhatt <anish@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-27Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nfDavid S. Miller
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for your net tree, they are: 1) Allow to recycle a TCP port in conntrack when the change role from server to client, from Marcelo Leitner. 2) Fix possible off by one access in ip_set_nfnl_get_byindex(), patch from Dan Carpenter. 3) alloc_percpu returns NULL on error, no need for IS_ERR() in nf_tables chain statistic updates. From Sabrina Dubroca. 4) Don't compile ip options in bridge netfilter, this mangles the packet and bridge should not alter layer >= 3 headers when forwarding packets. Patch from Herbert Xu and tested by Florian Westphal. 5) Account the final NLMSG_DONE message when calculating the size of the nflog netlink batches. Patch from Florian Westphal. 6) Fix a possible netlink attribute length overflow with large packets. Again from Florian Westphal. 7) Release the skbuff if nfnetlink_log fails to put the final NLMSG_DONE message. This fixes a leak on error. This shouldn't ever happen though, otherwise this means we miscalculate the netlink batch size, so spot a warning if this ever happens so we can track down the problem. This patch from Houcheng Lin. 8) Look at the right list when recycling targets in the nft_compat, patch from Arturo Borrero. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-27cpufreq: cpufreq-dt: Restore default cpumask_setall(policy->cpus)Geert Uytterhoeven
Commit 34e5a5273d6aa0ee ("cpufreq: cpufreq-dt: extend with platform_data") changed cpufreq_init() to only call cpumask_setall(policy->cpus) if the platform data indicates that all CPUs share the same clock. Before, cpufreq_generic_init() did this unconditionally. This causes a crash on r8a7791/koelsch when resuming from s2ram: Enabling non-boot CPUs ... CPU1: Booted secondary processor Unable to handle kernel NULL pointer dereference at virtual address 0000003c pgd = ee71f980 [0000003c] *pgd=6eeb6003, *pmd=6e0e9003, *pte=00000000 Internal error: Oops: a07 [#1] SMP ARM Modules linked in: CPU: 0 PID: 1397 Comm: s2ram Tainted: G W 3.18.0-rc2-koelsch-00762-g7eed2a4e61d2d978 #581 task: ee6b76c0 ti: ee7f0000 task.ti: ee7f0000 PC is at __cpufreq_add_dev.isra.24+0x24c/0x77c LR is at __cpufreq_add_dev.isra.24+0x244/0x77c pc : [<c029e084>] lr : [<c029e07c>] psr: 60000153 sp : ee7f1d48 ip : ee7f1d48 fp : ee7f1d84 r10: c04e8448 r9 : 00000000 r8 : 00000001 r7 : c054a8c4 r6 : 00000001 r5 : 00000001 r4 : 00000000 r3 : 00000000 r2 : 00000000 r1 : 20000153 r0 : c054a950 Flags: nZCv IRQs on FIQs off Mode SVC_32 ISA ARM Segment user Control: 30c5307d Table: 6e71f980 DAC: fffffffd Process s2ram (pid: 1397, stack limit = 0xee7f0240) ... Backtrace: [<c029de38>] (__cpufreq_add_dev.isra.24) from [<c029e620>] (cpufreq_cpu_callback+0x6c/0x74) r10:eec75240 r9:c04e8448 r8:c04ef3a0 r7:00000001 r6:00000012 r5:00000000 r4:00000012 [<c029e5b4>] (cpufreq_cpu_callback) from [<c003f20c>] (notifier_call_chain+0x48/0x70) r4:ffffffdd r3:c029e5b4 [<c003f1c4>] (notifier_call_chain) from [<c003f2cc>] (__raw_notifier_call_chain+0x1c/0x24) r8:00000001 r7:00000010 r6:00000000 r5:00000000 r4:00000012 r3:ffffffff [<c003f2b0>] (__raw_notifier_call_chain) from [<c0026a00>] (__cpu_notify+0x34/0x50) [<c00269cc>] (__cpu_notify) from [<c0026a34>] (cpu_notify+0x18/0x1c) r4:00000001 [<c0026a1c>] (cpu_notify) from [<c0026c44>] (_cpu_up+0x108/0x144) [<c0026b3c>] (_cpu_up) from [<c0381c68>] (enable_nonboot_cpus+0x68/0xb8) r10:00000000 r9:c04e8ee6 r8:00000000 r7:00000003 r6:c04e8528 r5:c0506248 r4:00000001 [<c0381c00>] (enable_nonboot_cpus) from [<c0059038>] (suspend_devices_and_enter+0x29c/0x3e8) r6:c0506e70 r5:00000000 r4:00000000 r3:60000153 Restore the old default of calling cpumask_setall(policy->cpus) if no platform data is available to fix this. Fixes: 34e5a5273d6aa0ee (cpufreq: cpufreq-dt: extend with platform_data) Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-10-27Merge tag 'media/v3.18-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "A series of driver fixes: - a few compilation fixes with randconfigs - one potential compilation breakage on userspace due to the usage of a gcc extension - several warnings fixed - some other random driver fixes" * tag 'media/v3.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (22 commits) [media] s5p-jpeg: Avoid -Wuninitialized warning in s5p_jpeg_parse_hdr [media] s5p-fimc: Only build suspend/resume for PM [media] s5p-jpeg: Only build suspend/resume for PM [media] Remove references to non-existent PLAT_S5P symbol [media] videobuf-dma-contig: set vm_pgoff to be zero to pass the sanity check in vm_iomap_memory() [media] tw68: remove bogus I2C_ALGOBIT dependency [media] usbvision-video: two use after frees [media] tw68: remove deprecated IRQF_DISABLED [media] xc5000: use after free in release() [media] em28xx-input: NULL dereference on error [media] wl128x: fix fmdbg compiler warning Revert "[media] v4l2-dv-timings: fix a sparse warning" [media] hackrf: harmless off by one in debug code [media] cx23885: initialize config structs for T9580 [media] v4l: uvcvideo: Fix buffer completion size check [media] vivid: fix buffer overrun [media] saa7146: Create a device name before it's used [media] em28xx: fix uninitialized variable warning [media] vivid: fix Kconfig FB dependency [media] anysee: make sure loading modules is const ...
2014-10-27Merge tag 'edac_fixes_for_3.18' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp Pull EDAC fixes from Borislav Petkov: "Correct severity of reported errors in several EDAC drivers. From Jason Baron" * tag 'edac_fixes_for_3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: e7xxx_edac: Report CE events properly cpc925_edac: Report UE events properly i82860_edac: Report CE events properly i3200_edac: Report CE events properly
2014-10-27Merge tag 'spi-v3.18-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "Quite a few driver fixes in here, including some fairly substantial ones for the recently added Rockchip driver, plus a fix for spidev to more reliably support bidirectional transfers which is fairly large but basically mechanical. It's a bit more code than I'd like but all fixes" * tag 'spi-v3.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: orion: fix potential NULL pointer de-reference spi/rockchip: spi controller must be disabled in tx callback too spi/rockchip: fix bug that cause spi transfer timed out in DMA duplex mode spi/rockchip: fix bug that case spi can't go as fast as slave request spi: pl022: Fix incorrect dma_unmap_sg spi: spidev: Use separate TX and RX bounce buffers spi: dw: Initialize of_node to discover DT node children
2014-10-27Merge tag 'regulator-v3.18-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of fixes for v3.18, one fix for an incorrect voltage to register mapping in the rk808 driver and a fix for a build failure in some SH defconfigs" * tag 'regulator-v3.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: Include err.h from consumer.h to fix build failure regulator: rk808: Fix min_uV for DCDC1 & DCDC2
2014-10-27netfilter: nft_compat: fix wrong target lookup in nft_target_select_ops()Arturo Borrero
The code looks for an already loaded target, and the correct list to search is nft_target_list, not nft_match_list. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-10-27Revert duplicate "PCI: pciehp: Prevent NULL dereference during probe"Kamal Mostafa
This reverts bceee4a97eb5 ("PCI: pciehp: Prevent NULL dereference during probe") because it was accidentally applied twice: 62e4492c3063 ("PCI: Prevent NULL dereference during pciehp probe") bceee4a97eb5 ("PCI: pciehp: Prevent NULL dereference during probe") Revert the latter to dispose of the duplicated code block. [bhelgaas: tidy changelog, drop stable tag] Signed-off-by: Kamal Mostafa <kamal@canonical.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> CC: Andreas Noever <andreas.noever@gmail.com>
2014-10-27PM / Sleep: fix recovery during resuming from hibernationImre Deak
If a device's dev_pm_ops::freeze callback fails during the QUIESCE phase, we don't rollback things correctly calling the thaw and complete callbacks. This could leave some devices in a suspended state in case of an error during resuming from hibernation. Signed-off-by: Imre Deak <imre.deak@intel.com> Cc: All applicable <stable@vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-10-27PM / Sleep: fix async suspend_late/freeze_late error handlingImre Deak
If an asynchronous suspend_late or freeze_late callback fails during the SUSPEND, FREEZE or QUIESCE phases, we don't propagate the corresponding error correctly, in effect ignoring the error and continuing the suspend-to-ram/hibernation. During suspend-to-ram this could leave some devices without a valid saved context, leading to a failure to reinitialize them during resume. During hibernation this could leave some devices active interfeering with the creation / restoration of the hibernation image. Also this could leave the corresponding devices without a valid saved context and failure to reinitialize them during resume. Fixes: de377b397272 (PM / sleep: Asynchronous threads for suspend_late) Signed-off-by: Imre Deak <imre.deak@intel.com> Cc: 3.15+ <stable@vger.kernel.org> # 3.15+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-10-27ACPI: Use ACPI companion to match only the first physical deviceMika Westerberg
Commit 6ab3430129e2 ("mfd: Add ACPI support") made the MFD subdevices share the parent MFD ACPI companion if no _HID/_CID is specified for the subdevice in mfd_cell description. However, since all the subdevices share the ACPI companion, the match and modalias generation logic started to use the ACPI companion as well resulting this: # cat /sys/bus/platform/devices/HID-SENSOR-200041.6.auto/modalias acpi:INT33D1:PNP0C50: instead of the expected one # cat /sys/bus/platform/devices/HID-SENSOR-200041.6.auto/modalias platform:HID-SENSOR-200041 In other words the subdevice modalias is overwritten by the one taken from ACPI companion. This causes udev not to load the driver anymore. It is useful to be able to share the ACPI companion so that MFD subdevices (and possibly other devices as well) can access the ACPI resources even if they do not have ACPI representation in the namespace themselves. An example where this is used is Minnowboard LPC driver that creates GPIO as a subdevice among other things. Without the ACPI companion gpiolib is not able to lookup the corresponding GPIO controller from ACPI GpioIo resource. To fix this, restrict the match and modalias logic to be limited to the first (primary) physical device associated with the given ACPI comapnion. The secondary devices will still be able to access the ACPI companion, but they will be matched in a different way. Fixes: 6ab3430129e2 (mfd: Add ACPI support) Reported-by: Jarkko Nikula <jarkko.nikula@linux.intel.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-10-27cpufreq: cpufreq-dt: disable unsupported OPPsLucas Stach
If the regulator connected to the CPU voltage plane doesn't support an OPP specified voltage with the acceptable tolerance it's better to just disable the OPP instead of constantly failing the voltage scaling later on. Includes a fix to move initialization of opp_freq outside the loop to avoid an endless loop from Geert Uytterhoeven. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-10-27Merge tag 'mac80211-for-john-2014-10-23' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg <johannes@sipsolutions.net> says: "Here are a few fixes for the wireless stack: one fixes the RTS rate, one for a debugfs file, one to return the correct channel to userspace, a sanity check for a userspace value and the remaining two are just documentation fixes." Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-10-27Merge tag 'iwlwifi-for-john-2014-10-23' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes Emmanuel Grumbach <egrumbach@gmail.com> says: "I revert here a patch that caused interoperability issues. dvm gets a fix for a bug that was reported by many users. Two minor fixes for BT Coex and platform power fix that helps reducing latency when the PCIe link goes to low power states." Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-10-27doc: kernel-parameters.txt: Add ide-generic.probe-maskMaciej W. Rozycki
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org> [ jc: wording tweaked slightly ] Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2014-10-27ALSA: bebob: Uninitialized id returned by saffirepro_both_clk_src_getChristian Vogel
snd_bebob_stream_check_internal_clock() may get an id from saffirepro_both_clk_src_get (via clk_src->get()) that was uninitialized. a) make logic in saffirepro_both_clk_src_get explicit b) test if id used in snd_bebob_stream_check_internal_clock matches array size [fixed missing signed prefix to *_maps[] by tiwai] Signed-off-by: Christian Vogel <vogelchr@vogel.cx> Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-10-27Merge tag 'asoc-v3.18-rc2' of ↵Takashi Iwai
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v3.18 A few small driver fixes for v3.18 plus the removal of the s6000 support since the relevant chip is no longer supported in mainline.
2014-10-27Merge remote-tracking branches 'spi/fix/dw', 'spi/fix/orion', ↵Mark Brown
'spi/fix/pl022', 'spi/fix/rockchip' and 'spi/fix/spidev' into spi-linus
2014-10-27Merge remote-tracking branch 'regulator/fix/rk808' into regulator-linusMark Brown
2014-10-27Merge remote-tracking branch 'regulator/fix/core' into regulator-linusMark Brown
2014-10-27Merge remote-tracking branches 'asoc/fix/adau1761', 'asoc/fix/fsl', ↵Mark Brown
'asoc/fix/intel', 'asoc/fix/s6000' and 'asoc/fix/sgtl5000' into asoc-linus
2014-10-27ALSA: hda/realtek - New SSID for Headset quirkKailang Yang
It is lite version of AIO machine(0x0626). The audio layout of this machine was similar with SSID 0x0626. The audio was same as commit ad8ff99e6beb8708b0bdefd9d5658324e90200f0. Signed-off-by: Kailang Yang <kailang@realtek.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-10-27microblaze: Wire up bpf syscallMichal Simek
Add new bpf syscall. Signed-off-by: Michal Simek <michal.simek@xilinx.com>
2014-10-27ALSA: ad1889: Fix probable mask then right shift defectsJoe Perches
Precedence of & and >> is not the same and is not left to right. shift has higher precedence and should be done after the mask. Add parentheses around the mask. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-10-27ALSA: bebob: fix wrong decoding of clock information for Terratec PHASE 88 ↵Takashi Sakamoto
Rack FW Terratec PHASE 88 rack fw has two registers for source of clock, one is for internal/external, and another is for wordclock/spdif for external. When clock source is internal, information in another register has no meaning. Thus it must be ignored, but current implementation decodes it. This causes over-indexing reference to labels. Reported-by: András Murányi <muranyia@gmail.com> Tested-by: András Murányi <muranyia@gmail.com> Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Acked-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-10-27microblaze: Fix IO space breakage after of_pci_range_to_resource() changeMichal Simek
Commit 0b0b0893d49b "of/pci: Fix the conversion of IO ranges into IO resources" changed the behaviour of of_pci_range_to_resource(). The issue is described here: "powerpc/pci: Fix IO space breakage after of_pci_range_to_resource() change" (sha1: aeba3731b150188685225b510886f1370d8814de) Signed-off-by: Michal Simek <michal.simek@xilinx.com>
2014-10-27microblaze: Fix missing NR_CPUS in menuconfigMichal Simek
The time Kconfig expects that NR_CPUS is defined. This patch remove this config warning: "kernel/time/Kconfig:163:warning: range is invalid" Signed-off-by: Michal Simek <michal.simek@xilinx.com>
2014-10-26net: napi_reuse_skb() should check pfmemallocEric Dumazet
Do not reuse skb if it was pfmemalloc tainted, otherwise future frame might be dropped anyway. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Roman Gushchin <klamm@yandex-team.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-26Merge branch 'mellanox'David S. Miller
Eli Cohen says: ==================== irq sync fixes This two patch series fixes a race where an interrupt handler could access a freed memory. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-26net/mlx4_core: Call synchronize_irq() before freeing EQ bufferEli Cohen
After moving the EQ ownership to software effectively destroying it, call synchronize_irq() to ensure that any handler routines running on other CPU cores finish execution. Only then free the EQ buffer. The same thing is done when we destroy a CQ which is one of the sources generating interrupts. In the case of CQ we want to avoid completion handlers on a CQ that was destroyed. In the case we do the same to avoid receiving asynchronous events after the EQ has been destroyed and its buffers freed. Signed-off-by: Eli Cohen <eli@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-26net/mlx5_core: Call synchronize_irq() before freeing EQ bufferEli Cohen
After destroying the EQ, the object responsible for generating interrupts, call synchronize_irq() to ensure that any handler routines running on other CPU cores finish execution. Only then free the EQ buffer. This patch solves a very rare case when we get panic on driver unload. The same thing is done when we destroy a CQ which is one of the sources generating interrupts. In the case of CQ we want to avoid completion handlers on a CQ that was destroyed. In the case we do the same to avoid receiving asynchronous events after the EQ has been destroyed and its buffers freed. Signed-off-by: Eli Cohen <eli@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-26Linux 3.18-rc2v3.18-rc2Linus Torvalds
2014-10-26ARM/ARM64: arch-timer: fix arch_timer_probed logicMarc Zyngier
Commit c387f07e6205 (clocksource: arm_arch_timer: Discard unavailable timers correctly) changed the way the driver makes sure both the memory and system-register timers have been probed before finalizing the probing. There is a interesting flaw in this logic that leads to this final step never to be executed. Things seems to work pretty well until something actually needs the data that is produced during this final stage. For example, KVM explodes on the first run of a guest when executed on a platform that has both memory and sysreg nodes (Juno, for example). Just fix the damned logic, and enjoy booting VMs again. Tested on a Juno system. Cc: Sudeep Holla <sudeep.holla@arm.com> Cc: Stephen Boyd <sboyd@codeaurora.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Daniel Lezcano <daniel.lezcano@linaro.org> Cc: Christoffer Dall <christoffer.dall@linaro.org> Reported-by: Riku Voipio <riku.voipio@linaro.org> Acked-by: Mark Rutland <mark.rutland@arm.com> Acked-by: Sudeep Holla <sudeep.holla@arm.com> Tested-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
2014-10-26Merge tag 'armsoc-for-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "Another week, another small batch of fixes. Most of these make zynq, socfpga and sunxi platforms work a bit better: - due to new requirements for regulators, DWMMC on socfpga broke past v3.17 - SMP spinup fix for socfpga - a few DT fixes for zynq - another option (FIXED_REGULATOR) for sunxi is needed that used to be selected by other options but no longer is. - a couple of small DT fixes for at91 - ...and a couple for i.MX" * tag 'armsoc-for-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: dts: imx28-evk: Let i2c0 run at 100kHz ARM: i.MX6: Fix "emi" clock name typo ARM: multi_v7_defconfig: enable CONFIG_MMC_DW_ROCKCHIP ARM: sunxi_defconfig: enable CONFIG_REGULATOR_FIXED_VOLTAGE ARM: dts: socfpga: Add a 3.3V fixed regulator node ARM: dts: socfpga: Fix SD card detect ARM: dts: socfpga: rename gpio nodes ARM: at91/dt: sam9263: fix PLLB frequencies power: reset: at91-reset: fix power down register MAINTAINERS: add atmel ssc driver maintainer entry arm: socfpga: fix fetching cpu1start_addr for SMP ARM: zynq: DT: trivial: Fix mc node ARM: zynq: DT: Add cadence watchdog node ARM: zynq: DT: Add missing reference for memory-controller ARM: zynq: DT: Add missing reference for ADC ARM: zynq: DT: Add missing address for L2 pl310 ARM: zynq: DT: Remove 222 MHz OPP ARM: zynq: DT: Fix GEM register area size
2014-10-26Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs updates from Al Viro: "overlayfs merge + leak fix for d_splice_alias() failure exits" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: overlayfs: embed middle into overlay_readdir_data overlayfs: embed root into overlay_readdir_data overlayfs: make ovl_cache_entry->name an array instead of pointer overlayfs: don't hold ->i_mutex over opening the real directory fix inode leaks on d_splice_alias() failure exits fs: limit filesystem stacking depth overlay: overlay filesystem documentation overlayfs: implement show_options overlayfs: add statfs support overlay filesystem shmem: support RENAME_WHITEOUT ext4: support RENAME_WHITEOUT vfs: add RENAME_WHITEOUT vfs: add whiteout support vfs: export check_sticky() vfs: introduce clone_private_mount() vfs: export __inode_permission() to modules vfs: export do_splice_direct() to modules vfs: add i_op->dentry_open()
2014-10-26futex: Fix a race condition between REQUEUE_PI and task deathBrian Silverman
free_pi_state and exit_pi_state_list both clean up futex_pi_state's. exit_pi_state_list takes the hb lock first, and most callers of free_pi_state do too. requeue_pi doesn't, which means free_pi_state can free the pi_state out from under exit_pi_state_list. For example: task A | task B exit_pi_state_list | pi_state = | curr->pi_state_list->next | | futex_requeue(requeue_pi=1) | // pi_state is the same as | // the one in task A | free_pi_state(pi_state) | list_del_init(&pi_state->list) | kfree(pi_state) list_del_init(&pi_state->list) | Move the free_pi_state calls in requeue_pi to before it drops the hb locks which it's already holding. [ tglx: Removed a pointless free_pi_state() call and the hb->lock held debugging. The latter comes via a seperate patch ] Signed-off-by: Brian Silverman <bsilver16384@gmail.com> Cc: austin.linux@gmail.com Cc: darren@dvhart.com Cc: peterz@infradead.org Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1414282837-23092-1-git-send-email-bsilver16384@gmail.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2014-10-26futex: Mention key referencing differences between shared and private futexesDavidlohr Bueso
Update our documentation as of fix 76835b0ebf8 (futex: Ensure get_futex_key_refs() always implies a barrier). Explicitly state that we don't do key referencing for private futexes. Signed-off-by: Davidlohr Bueso <dbueso@suse.de> Cc: Matteo Franchin <Matteo.Franchin@arm.com> Cc: Davidlohr Bueso <davidlohr@hp.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Darren Hart <dvhart@linux.intel.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Link: http://lkml.kernel.org/r/1414121220.817.0.camel@linux-t7sj.site Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2014-10-25Merge tag 'imx-fixes-3.18' of ↵Olof Johansson
git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes Merge "ARM: imx: fixes for 3.18" from Shawn Guo: The i.MX fixes for 3.18: - Revert one patch which increases I2C bus frequency on imx28-evk - Fix a typo on imx6q EIM clock name * tag 'imx-fixes-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx28-evk: Let i2c0 run at 100kHz ARM: i.MX6: Fix "emi" clock name typo Signed-off-by: Olof Johansson <olof@lixom.net>
2014-10-25drivers: net: xgene: Rewrite buggy loop in xgene_enet_ecc_init()Geert Uytterhoeven
drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c: In function ‘xgene_enet_ecc_init’: drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c:126: warning: ‘data’ may be used uninitialized in this function Depending on the arbitrary value on the stack, the loop may terminate too early, and cause a bogus -ENODEV failure. Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-25i40e: _MASK vs _SHIFT typo in i40e_handle_mdd_event()Dan Carpenter
We accidentally mask by the _SHIFT variable. It means that "event" is always zero. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Tested-by: Jim Young <jamesx.m.young@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-25macvlan: fix a race on port dismantle and possible skb leaksEric Dumazet
We need to cancel the work queue after rcu grace period, otherwise it can be rescheduled by incoming packets. We need to purge queue if some skbs are still in it. We can use __skb_queue_head_init() variant in macvlan_process_broadcast() Signed-off-by: Eric Dumazet <edumazet@google.com> Fixes: 412ca1550cbec ("macvlan: Move broadcasts into a work queue") Cc: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-25tcp: md5: do not use alloc_percpu()Eric Dumazet
percpu tcp_md5sig_pool contains memory blobs that ultimately go through sg_set_buf(). -> sg_set_page(sg, virt_to_page(buf), buflen, offset_in_page(buf)); This requires that whole area is in a physically contiguous portion of memory. And that @buf is not backed by vmalloc(). Given that alloc_percpu() can use vmalloc() areas, this does not fit the requirements. Replace alloc_percpu() by a static DEFINE_PER_CPU() as tcp_md5sig_pool is small anyway, there is no gain to dynamically allocate it. Signed-off-by: Eric Dumazet <edumazet@google.com> Fixes: 765cf9976e93 ("tcp: md5: remove one indirection level in tcp_md5sig_pool") Reported-by: Crestez Dan Leonard <cdleonard@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-25Merge branch 'xen-netback'David S. Miller
David Vrabel says: ==================== xen-netback: guest Rx queue drain and stall fixes This series fixes two critical xen-netback bugs. 1. Netback may consume all of host memory by queuing an unlimited number of skb on the internal guest Rx queue. This behaviour is guest triggerable. 2. Carrier flapping under high traffic rates which reduces performance. The first patch is a prerequite. Removing support for frontends with feature-rx-notify makes it easier to reason about the correctness of netback since it no longer has to support this outdated and broken mode. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>