aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-06-25ibmvscsi: Abort init sequence during error recoveryBrian King1-1/+2
If a CRQ reset is triggered for some reason while in the middle of performing VSCSI adapter initialization, we don't want to call the done function for the initialization MAD commands as this will only result in two threads attempting initialization at the same time, resulting in failures. Signed-off-by: Brian King <[email protected]> Acked-by: Nathan Fontenot <[email protected]> Cc: [email protected] Signed-off-by: Christoph Hellwig <[email protected]>
2014-06-25qla2xxx: Fix sparse warning in qla_target.c.Quinn Tran2-8/+13
Signed-off-by: Quinn Tran <[email protected]> Signed-off-by: Saurav Kashyap <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]>
2014-06-25bnx2fc: Improve stats update mechanismNeil Horman1-12/+4
Recently had this warning reported: [ 290.489047] Call Trace: [ 290.489053] [<ffffffff8169efec>] dump_stack+0x19/0x1b [ 290.489055] [<ffffffff810ac7a9>] __might_sleep+0x179/0x230 [ 290.489057] [<ffffffff816a4ad5>] mutex_lock_nested+0x55/0x520 [ 290.489061] [<ffffffffa01b9905>] ? bnx2fc_l2_rcv_thread+0xc5/0x4c0 [bnx2fc] [ 290.489065] [<ffffffffa0174c1a>] fc_vport_id_lookup+0x3a/0xa0 [libfc] [ 290.489068] [<ffffffffa01b9a6c>] bnx2fc_l2_rcv_thread+0x22c/0x4c0 [bnx2fc] [ 290.489070] [<ffffffffa01b9840>] ? bnx2fc_vport_destroy+0x110/0x110 [bnx2fc] [ 290.489073] [<ffffffff8109e0cd>] kthread+0xed/0x100 [ 290.489075] [<ffffffff8109dfe0>] ? insert_kthread_work+0x80/0x80 [ 290.489077] [<ffffffff816b2fec>] ret_from_fork+0x7c/0xb0 [ 290.489078] [<ffffffff8109dfe0>] ? insert_kthread_work+0x80/0x80 Its due to the fact that we call a potentially sleeping function from the bnx2fc rcv path with preemption disabled (via the get_cpu call embedded in the per-cpu variable stats lookup in bnx2fc_l2_rcv_thread. Easy enough fix, we can just move the stats collection later in the function where we are sure we won't preempt or sleep. This also allows us to not have to enable pre-emption when doing a per-cpu lookup, since we're certain not to get rescheduled. Signed-off-by: Neil Horman <[email protected]> Acked-by: Eddie Wai <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]>
2014-06-25bnx2fc: do not scan uninitialized lists in case of error.Maurizio Lombardi1-0/+2
In case of of error, the bnx2fc_cmd_mgr_alloc() function will call the bnx2fc_cmd_mgr_free() to perform the cleanup. The problem is that in one case the latter may try to scan some not-yet initialized lists, resulting in a kernel panic. This patch prevents this from happening by freeing the lists before calling bnx2fc_cmd_mgr_free(). Signed-off-by: Maurizio Lombardi <[email protected]> Acked-by: Eddie Wai <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]>
2014-06-25fc: ensure scan_work isn't active when freeing fc_rportNeil Horman1-0/+1
debugfs caught this: WARNING: at lib/debugobjects.c:260 debug_print_object+0x83/0xa0() ODEBUG: free active (active state 0) object type: work_struct hint: fc_scsi_scan_rport+0x0/0xd0 [scsi_transport_fc] CPU: 1 PID: 184 Comm: kworker/1:1 Tainted: G W -------------- 3.10.0-123.el7.x86_64.debug #1 Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013 Workqueue: fc_wq_5 fc_rport_final_delete [scsi_transport_fc] Call Trace: [<ffffffff8169efec>] dump_stack+0x19/0x1b [<ffffffff8106cbd1>] warn_slowpath_common+0x61/0x80 [<ffffffff8106cc4c>] warn_slowpath_fmt+0x5c/0x80 [<ffffffff8133e003>] debug_print_object+0x83/0xa0 [<ffffffffa04e2f40>] ? fc_parse_wwn+0x100/0x100 [<ffffffff8133f23b>] debug_check_no_obj_freed+0x22b/0x270 [<ffffffffa04e127e>] ? fc_rport_dev_release+0x1e/0x30 [<ffffffff811db3e9>] kfree+0xd9/0x2d0 [<ffffffffa04e127e>] fc_rport_dev_release+0x1e/0x30 [<ffffffff81428032>] device_release+0x32/0xa0 [<ffffffff8132701e>] kobject_release+0x7e/0x1b0 [<ffffffff81326ed8>] kobject_put+0x28/0x60 [<ffffffff81428397>] put_device+0x17/0x20 [<ffffffffa04e5025>] fc_rport_final_delete+0x165/0x210 [<ffffffff810959b0>] process_one_work+0x220/0x710 [<ffffffff81095944>] ? process_one_work+0x1b4/0x710 [<ffffffff81095fbb>] worker_thread+0x11b/0x3a0 [<ffffffff81095ea0>] ? process_one_work+0x710/0x710 [<ffffffff8109e0cd>] kthread+0xed/0x100 [<ffffffff8109dfe0>] ? insert_kthread_work+0x80/0x80 [<ffffffff816b2fec>] ret_from_fork+0x7c/0xb0 [<ffffffff8109dfe0>] ? insert_kthread_work+0x80/0x80 Seems to be because the scan_work work_struct might be active when the housing fc_rport struct gets freed. Ensure that we cancel it prior to freeing the rport Signed-off-by: Neil Horman <[email protected]> Reviewed-by: Vasu Dev <[email protected]> Reviewed-by: Hannes Reinecke <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]>
2014-06-25pm8001: Fix potential null pointer dereference and memory leak.Maurizio Lombardi1-3/+10
The pm8001_get_phy_settings_info() function does not check the kzalloc() return value and does not free the allocated memory. Signed-off-by: Maurizio Lombardi <[email protected]> Acked-by: Suresh Thiagarajan <[email protected]> Acked-by: Jack Wang <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]>
2014-06-25MAINTAINERS: Update LSILOGIC MPT FUSION DRIVERS (FC/SAS/SPI) maintainers ↵Reddy, Sreekanth1-4/+5
Email IDs Updating maintainers Email Ids for the entry LSILOGIC MPT FUSION DRIVERS in MAINTAINERS file Signed-off-by: Sreekanth Reddy <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]>
2014-06-25be2iscsi: remove potential junk pointer freeTomas Henzl1-3/+1
commit 0e7c60c [SCSI] be2iscsi: fix memory leak in error path fixed an potential junk pointer free if mgmt_get_if_info() returned an error fix it on one more place Signed-off-by: Tomas Henzl <[email protected]> Reviewed-by: Mike Christie <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]>
2014-06-25be2iscsi: add an missing goto in error pathTomas Henzl1-0/+2
a jump to 'free_memory' is apparently missing Signed-off-by: Tomas Henzl <[email protected]> Reviewed-by: Mike Christie <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]>
2014-06-25drm/i915: vlv_prepare_pll is only needed in case of non DSI interfacesShobhit Kumar1-3/+4
For MIPI, DSI PLL is configured separately in vlv_configure_dsi_pll during the DSI enable sequence Causing WARN dump otherwise in dpio_reads v2: Add IS_CHERRYVIEW check as suggested by Ville Signed-off-by: Shobhit Kumar <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Signed-off-by: Jani Nikula <[email protected]>
2014-06-25Merge tag 'perf-urgent-for-mingo' of ↵Ingo Molnar2-37/+38
git://git.kernel.org/pub/scm/linux/kernel/git/jolsa/perf into perf/urgent Pull perf/urgent fixes from Jiri Olsa: * Fix kernel start address lookup in report code (Simon Que) * Fix segfault in cumulative.callchain report (Jiri Olsa) Signed-off-by: Jiri Olsa <[email protected]> Signed-off-by: Ingo Molnar <[email protected]>
2014-06-25Merge branch 'urgent.2014.06.23a' of ↵Ingo Molnar7-92/+137
git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/urgent Pull RCU fixes from Paul E. McKenney: " This series includes the following: 1. Export a pair of debug-object interfaces for RCU that will allow the slab allocators to avoid a recursion bug located by Sasha Levin. Strictly speaking, this is not a regression, but it would be good to enable the fix. 2. Address a serious performance regression on an open/close micro-benchmark located by Dave Hansen. The offending commit is ac1bea85781e (Make cond_resched() report RCU quiescent states). " Signed-off-by: Ingo Molnar <[email protected]>
2014-06-25Merge branch 'exynos-drm-fixes' of ↵Dave Airlie7-21/+63
git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes This pull-request fixes hdmi power-off order issue, mixer issues related to power on/off, and includes trivial fixups. * 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos: drm/exynos: enable vsync interrupt while waiting for vblank drm/exynos: soft reset mixer before reconfigure after power-on drm/exynos: allow multiple layer updates per vsync for mixer drm/exynos: stop mixer before gating clocks during poweroff drm/exynos: set power state variable after enabling clocks and power drm/exynos: disable unused windows on apply drm/exynos: Fix de-registration ordering drm/exynos: change zero to NULL for sparse drm/exynos: dpi: Fix NULL pointer dereference with legacy bindings drm/exynos: hdmi: fix power order issue
2014-06-25Merge branch 'msm-fixes-3.16' of ↵Dave Airlie10-10/+58
git://people.freedesktop.org/~robclark/linux into drm-fixes A handful of fixes from various folks. * 'msm-fixes-3.16' of git://people.freedesktop.org/~robclark/linux: drm/msm: fix IOMMU cleanup for -EPROBE_DEFER drm/msm: use PAGE_ALIGNED instead of IS_ALIGNED(PAGE_SIZE) drm/msm/hdmi: set hdp clock rate before prepare_enable drm/msm: storage class should be before const qualifier drm/msm: Replace type of paddr to uint32_t.
2014-06-25drm: fix NULL pointer access by wrong ioctlZhaowei Yuan1-1/+2
If user uses wrong ioctl command with _IOC_NONE and argument size greater than 0, it can cause NULL pointer access from memset of line 463. If _IOC_NONE, don't memset to 0 for kdata. Signed-off-by: Zhaowei Yuan <[email protected]> Reviewed-by: David Herrmann <[email protected]> Cc: <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2014-06-25powerpc: Don't skip ePAPR spin-table CPUsScott Wood1-1/+9
Commit 59a53afe70fd530040bdc69581f03d880157f15a "powerpc: Don't setup CPUs with bad status" broke ePAPR SMP booting. ePAPR says that CPUs that aren't presently running shall have status of disabled, with enable-method being used to determine whether the CPU can be enabled. Fix by checking for spin-table, which is currently the only supported enable-method. Signed-off-by: Scott Wood <[email protected]> Cc: Michael Neuling <[email protected]> Cc: Emil Medve <[email protected]> Cc: [email protected] Signed-off-by: Benjamin Herrenschmidt <[email protected]>
2014-06-25powerpc/module: Fix TOC symbol CRCLaurent Dufour1-1/+10
The commit 71ec7c55ed91 introduced the magic symbol ".TOC." for ELFv2 ABI. This symbol is built manually and has no CRC value computed. A zero value is put in the CRC section to avoid modpost complaining about a missing CRC. Unfortunately, this breaks the kernel module loading when the kernel is relocated (kdump case for instance) because of the relocation applied to the kcrctab values. This patch compute a CRC value for the TOC symbol which will match the one compute by the kernel when it is relocated - aka '0 - relocate_start' done in maybe_relocated called by check_version (module.c). Signed-off-by: Laurent Dufour <[email protected]> Cc: Anton Blanchard <[email protected]> Signed-off-by: Benjamin Herrenschmidt <[email protected]>
2014-06-25powerpc/powernv: Remove OPAL v1 takeoverMichael Ellerman7-392/+2
In commit 27f4488872d9 "Add OPAL takeover from PowerVM" we added support for "takeover" on OPAL v1 machines. This was a mode of operation where we would boot under pHyp, and query for the presence of OPAL. If detected we would then do a special sequence to take over the machine, and the kernel would end up running in hypervisor mode. OPAL v1 was never a supported product, and was never shipped outside IBM. As far as we know no one is still using it. Newer versions of OPAL do not use the takeover mechanism. Although the query for OPAL should be harmless on machines with newer OPAL, we have seen a machine where it causes a crash in Open Firmware. The code in early_init_devtree() to copy boot_command_line into cmd_line was added in commit 817c21ad9a1f "Get kernel command line accross OPAL takeover", and AFAIK is only used by takeover, so should also be removed. Signed-off-by: Michael Ellerman <[email protected]> Signed-off-by: Benjamin Herrenschmidt <[email protected]>
2014-06-24cxgb4: Not need to hold the adap_rcu_lock lock when read adap_rcu_listLi RongQing1-9/+7
cxgb4_netdev maybe lead to dead lock, since it uses a spin lock, and be called in both thread and softirq context, but not disable BH, the lockdep report is below; In fact, cxgb4_netdev only reads adap_rcu_list with RCU protection, so not need to hold spin lock again. ================================= [ INFO: inconsistent lock state ] 3.14.7+ #24 Tainted: G C O --------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. radvd/3794 [HC0[0]:SC1[1]:HE1:SE0] takes: (adap_rcu_lock){+.?...}, at: [<ffffffffa09989ea>] clip_add+0x2c/0x116 [cxgb4] {SOFTIRQ-ON-W} state was registered at: [<ffffffff810fca81>] __lock_acquire+0x34a/0xe48 [<ffffffff810fd98b>] lock_acquire+0x82/0x9d [<ffffffff815d6ff8>] _raw_spin_lock+0x34/0x43 [<ffffffffa09989ea>] clip_add+0x2c/0x116 [cxgb4] [<ffffffffa0998beb>] cxgb4_inet6addr_handler+0x117/0x12c [cxgb4] [<ffffffff815da98b>] notifier_call_chain+0x32/0x5c [<ffffffff815da9f9>] __atomic_notifier_call_chain+0x44/0x6e [<ffffffff815daa32>] atomic_notifier_call_chain+0xf/0x11 [<ffffffff815b1356>] inet6addr_notifier_call_chain+0x16/0x18 [<ffffffffa01f72e5>] ipv6_add_addr+0x404/0x46e [ipv6] [<ffffffffa01f8df0>] addrconf_add_linklocal+0x5f/0x95 [ipv6] [<ffffffffa01fc3e9>] addrconf_notify+0x632/0x841 [ipv6] [<ffffffff815da98b>] notifier_call_chain+0x32/0x5c [<ffffffff810e09a1>] __raw_notifier_call_chain+0x9/0xb [<ffffffff810e09b2>] raw_notifier_call_chain+0xf/0x11 [<ffffffff8151b3b7>] call_netdevice_notifiers_info+0x4e/0x56 [<ffffffff8151b3d0>] call_netdevice_notifiers+0x11/0x13 [<ffffffff8151c0a6>] netdev_state_change+0x1f/0x38 [<ffffffff8152f004>] linkwatch_do_dev+0x3b/0x49 [<ffffffff8152f184>] __linkwatch_run_queue+0x10b/0x144 [<ffffffff8152f1dd>] linkwatch_event+0x20/0x27 [<ffffffff810d7bc0>] process_one_work+0x1cb/0x2ee [<ffffffff810d7e3b>] worker_thread+0x12e/0x1fc [<ffffffff810dd391>] kthread+0xc4/0xcc [<ffffffff815dc48c>] ret_from_fork+0x7c/0xb0 irq event stamp: 3388 hardirqs last enabled at (3388): [<ffffffff810c6c85>] __local_bh_enable_ip+0xaa/0xd9 hardirqs last disabled at (3387): [<ffffffff810c6c2d>] __local_bh_enable_ip+0x52/0xd9 softirqs last enabled at (3288): [<ffffffffa01f1d5b>] rcu_read_unlock_bh+0x0/0x2f [ipv6] softirqs last disabled at (3289): [<ffffffff815ddafc>] do_softirq_own_stack+0x1c/0x30 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(adap_rcu_lock); <Interrupt> lock(adap_rcu_lock); *** DEADLOCK *** 5 locks held by radvd/3794: #0: (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffffa020b85a>] rawv6_sendmsg+0x74b/0xa4d [ipv6] #1: (rcu_read_lock){.+.+..}, at: [<ffffffff8151ac6b>] rcu_lock_acquire+0x0/0x29 #2: (rcu_read_lock){.+.+..}, at: [<ffffffffa01f4cca>] rcu_lock_acquire.constprop.16+0x0/0x30 [ipv6] #3: (rcu_read_lock){.+.+..}, at: [<ffffffff810e09b4>] rcu_lock_acquire+0x0/0x29 #4: (rcu_read_lock){.+.+..}, at: [<ffffffffa0998782>] rcu_lock_acquire.constprop.40+0x0/0x30 [cxgb4] stack backtrace: CPU: 7 PID: 3794 Comm: radvd Tainted: G C O 3.14.7+ #24 Hardware name: Supermicro X7DBU/X7DBU, BIOS 6.00 12/03/2007 ffffffff81f15990 ffff88012fdc36a8 ffffffff815d0016 0000000000000006 ffff8800c80dc2a0 ffff88012fdc3708 ffffffff815cc727 0000000000000001 0000000000000001 ffff880100000000 ffffffff81015b02 ffff8800c80dcb58 Call Trace: <IRQ> [<ffffffff815d0016>] dump_stack+0x4e/0x71 [<ffffffff815cc727>] print_usage_bug+0x1ec/0x1fd [<ffffffff81015b02>] ? save_stack_trace+0x27/0x44 [<ffffffff810fbfaa>] ? check_usage_backwards+0xa0/0xa0 [<ffffffff810fc640>] mark_lock+0x11b/0x212 [<ffffffff810fca0b>] __lock_acquire+0x2d4/0xe48 [<ffffffff810fbfaa>] ? check_usage_backwards+0xa0/0xa0 [<ffffffff810fbff6>] ? check_usage_forwards+0x4c/0xa6 [<ffffffff810c6c8a>] ? __local_bh_enable_ip+0xaf/0xd9 [<ffffffff810fd98b>] lock_acquire+0x82/0x9d [<ffffffffa09989ea>] ? clip_add+0x2c/0x116 [cxgb4] [<ffffffffa0998782>] ? rcu_read_unlock+0x23/0x23 [cxgb4] [<ffffffff815d6ff8>] _raw_spin_lock+0x34/0x43 [<ffffffffa09989ea>] ? clip_add+0x2c/0x116 [cxgb4] [<ffffffffa09987b0>] ? rcu_lock_acquire.constprop.40+0x2e/0x30 [cxgb4] [<ffffffffa0998782>] ? rcu_read_unlock+0x23/0x23 [cxgb4] [<ffffffffa09989ea>] clip_add+0x2c/0x116 [cxgb4] [<ffffffffa0998beb>] cxgb4_inet6addr_handler+0x117/0x12c [cxgb4] [<ffffffff810fd99d>] ? lock_acquire+0x94/0x9d [<ffffffff810e09b4>] ? raw_notifier_call_chain+0x11/0x11 [<ffffffff815da98b>] notifier_call_chain+0x32/0x5c [<ffffffff815da9f9>] __atomic_notifier_call_chain+0x44/0x6e [<ffffffff815daa32>] atomic_notifier_call_chain+0xf/0x11 [<ffffffff815b1356>] inet6addr_notifier_call_chain+0x16/0x18 [<ffffffffa01f72e5>] ipv6_add_addr+0x404/0x46e [ipv6] [<ffffffff810fde6a>] ? trace_hardirqs_on+0xd/0xf [<ffffffffa01fb634>] addrconf_prefix_rcv+0x385/0x6ea [ipv6] [<ffffffffa0207950>] ndisc_rcv+0x9d3/0xd76 [ipv6] [<ffffffffa020d536>] icmpv6_rcv+0x592/0x67b [ipv6] [<ffffffff810c6c85>] ? __local_bh_enable_ip+0xaa/0xd9 [<ffffffff810c6c85>] ? __local_bh_enable_ip+0xaa/0xd9 [<ffffffff810fd8dc>] ? lock_release+0x14e/0x17b [<ffffffffa020df97>] ? rcu_read_unlock+0x21/0x23 [ipv6] [<ffffffff8150df52>] ? rcu_read_unlock+0x23/0x23 [<ffffffffa01f4ede>] ip6_input_finish+0x1e4/0x2fc [ipv6] [<ffffffffa01f540b>] ip6_input+0x33/0x38 [ipv6] [<ffffffffa01f5557>] ip6_mc_input+0x147/0x160 [ipv6] [<ffffffffa01f4ba3>] ip6_rcv_finish+0x7c/0x81 [ipv6] [<ffffffffa01f5397>] ipv6_rcv+0x3a1/0x3e2 [ipv6] [<ffffffff8151ef96>] __netif_receive_skb_core+0x4ab/0x511 [<ffffffff810fdc94>] ? mark_held_locks+0x71/0x99 [<ffffffff8151f0c0>] ? process_backlog+0x69/0x15e [<ffffffff8151f045>] __netif_receive_skb+0x49/0x5b [<ffffffff8151f0cf>] process_backlog+0x78/0x15e [<ffffffff8151f571>] ? net_rx_action+0x1a2/0x1cc [<ffffffff8151f47b>] net_rx_action+0xac/0x1cc [<ffffffff810c69b7>] ? __do_softirq+0xad/0x218 [<ffffffff810c69ff>] __do_softirq+0xf5/0x218 [<ffffffff815ddafc>] do_softirq_own_stack+0x1c/0x30 <EOI> [<ffffffff810c6bb6>] do_softirq+0x38/0x5d [<ffffffffa01f1d5b>] ? ip6_copy_metadata+0x156/0x156 [ipv6] [<ffffffff810c6c78>] __local_bh_enable_ip+0x9d/0xd9 [<ffffffffa01f1d88>] rcu_read_unlock_bh+0x2d/0x2f [ipv6] [<ffffffffa01f28b4>] ip6_finish_output2+0x381/0x3d8 [ipv6] [<ffffffffa01f49ef>] ip6_finish_output+0x6e/0x73 [ipv6] [<ffffffffa01f4a70>] ip6_output+0x7c/0xa8 [ipv6] [<ffffffff815b1bfa>] dst_output+0x18/0x1c [<ffffffff815b1c9e>] ip6_local_out+0x1c/0x21 [<ffffffffa01f2489>] ip6_push_pending_frames+0x37d/0x427 [ipv6] [<ffffffff81558af8>] ? skb_orphan+0x39/0x39 [<ffffffffa020b85a>] ? rawv6_sendmsg+0x74b/0xa4d [ipv6] [<ffffffffa020ba51>] rawv6_sendmsg+0x942/0xa4d [ipv6] [<ffffffff81584cd2>] inet_sendmsg+0x3d/0x66 [<ffffffff81508930>] __sock_sendmsg_nosec+0x25/0x27 [<ffffffff8150b0d7>] sock_sendmsg+0x5a/0x7b [<ffffffff810fd8dc>] ? lock_release+0x14e/0x17b [<ffffffff8116d756>] ? might_fault+0x9e/0xa5 [<ffffffff8116d70d>] ? might_fault+0x55/0xa5 [<ffffffff81508cb1>] ? copy_from_user+0x2a/0x2c [<ffffffff8150b70c>] ___sys_sendmsg+0x226/0x2d9 [<ffffffff810fcd25>] ? __lock_acquire+0x5ee/0xe48 [<ffffffff810fde01>] ? trace_hardirqs_on_caller+0x145/0x1a1 [<ffffffff8118efcb>] ? slab_free_hook.isra.71+0x50/0x59 [<ffffffff8115c81f>] ? release_pages+0xbc/0x181 [<ffffffff810fd99d>] ? lock_acquire+0x94/0x9d [<ffffffff81115e97>] ? read_seqcount_begin.constprop.25+0x73/0x90 [<ffffffff8150c408>] __sys_sendmsg+0x3d/0x5b [<ffffffff8150c433>] SyS_sendmsg+0xd/0x19 [<ffffffff815dc53d>] system_call_fastpath+0x1a/0x1f Reported-by: Ben Greear <[email protected]> Cc: Casey Leedom <[email protected]> Cc: Hariprasad Shenai <[email protected]> Signed-off-by: Li RongQing <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Acked-by: Casey Leedom <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-06-24NFSv4: test SECINFO RPC_AUTH_GSS pseudoflavors for supportAndy Adamson4-45/+58
Fix nfs4_negotiate_security to create an rpc_clnt used to test each SECINFO returned pseudoflavor. Check credential creation (and gss_context creation) which is important for RPC_AUTH_GSS pseudoflavors which can fail for multiple reasons including mis-configuration. Don't call nfs4_negotiate in nfs4_submount as it was just called by nfs4_proc_lookup_mountpoint (nfs4_proc_lookup_common) Signed-off-by: Andy Adamson <[email protected]> [Trond: fix corrupt return value from nfs_find_best_sec()] Signed-off-by: Trond Myklebust <[email protected]>
2014-06-24NFS Return -EPERM if no supported or matching SECINFO flavorAndy Adamson1-7/+4
Do not return RPC_AUTH_UNIX if SEINFO reply tests fail. This prevents an infinite loop of NFS4ERR_WRONGSEC for non RPC_AUTH_UNIX mounts. Without this patch, a mount with no sec= option to a server that does not include RPC_AUTH_UNIX in the SECINFO return can be presented with an attemtp to use RPC_AUTH_UNIX which will result in an NFS4ERR_WRONG_SEC which will prompt the SECINFO call which will again try RPC_AUTH_UNIX.... Signed-off-by: Andy Adamson <[email protected]> Tested-By: Steve Dickson <[email protected]> Signed-off-by: Trond Myklebust <[email protected]>
2014-06-24NFS check the return of nfs4_negotiate_security in nfs4_submountAndy Adamson1-2/+5
Signed-off-by: Andy Adamson <[email protected]> Tested-By: Steve Dickson <[email protected]> Signed-off-by: Trond Myklebust <[email protected]>
2014-06-24NFS: Don't mark the data cache as invalid if it has been flushedTrond Myklebust1-35/+40
Now that we have functions such as nfs_write_pageuptodate() that use the cache_validity flags to check if the data cache is valid or not, it is a little more important to keep the flags in sync with the state of the data cache. In particular, we'd like to ensure that if the data cache is empty, we don't start marking it as needing revalidation. Reported-by: Scott Mayhew <[email protected]> Signed-off-by: Trond Myklebust <[email protected]>
2014-06-24NFS: Clear NFS_INO_REVAL_PAGECACHE when we update the file sizeTrond Myklebust1-0/+1
In nfs_update_inode(), if the change attribute is seen to change on the server, then we set NFS_INO_REVAL_PAGECACHE in order to make sure that we check the file size. However, if we also update the file size in the same function, we don't need to check it again. So make sure that we clear the NFS_INO_REVAL_PAGECACHE that was set earlier. Signed-off-by: Trond Myklebust <[email protected]>
2014-06-24nfs: Fix cache_validity check in nfs_write_pageuptodate()Scott Mayhew1-1/+3
NFS_INO_INVALID_DATA cannot be ignored, even if we have a delegation. We're still having some problems with data corruption when multiple clients are appending to a file and those clients are being granted write delegations on open. To reproduce: Client A: vi /mnt/`hostname -s` while :; do echo "XXXXXXXXXXXXXXX" >>/mnt/file; sleep $(( $RANDOM % 5 )); done Client B: vi /mnt/`hostname -s` while :; do echo "YYYYYYYYYYYYYYY" >>/mnt/file; sleep $(( $RANDOM % 5 )); done What's happening is that in nfs_update_inode() we're recognizing that the file size has changed and we're setting NFS_INO_INVALID_DATA accordingly, but then we ignore the cache_validity flags in nfs_write_pageuptodate() because we have a delegation. As a result, in nfs_updatepage() we're extending the write to cover the full page even though we've not read in the data to begin with. Signed-off-by: Scott Mayhew <[email protected]> Cc: <[email protected]> # v3.11+ Signed-off-by: Trond Myklebust <[email protected]>
2014-06-24block: add support for limiting gaps in SG listsJens Axboe4-0/+28
Another restriction inherited for NVMe - those devices don't support SG lists that have "gaps" in them. Gaps refers to cases where the previous SG entry doesn't end on a page boundary. For NVMe, all SG entries must start at offset 0 (except the first) and end on a page boundary (except the last). Signed-off-by: Jens Axboe <[email protected]>
2014-06-24bio: remove unused macro bip_vec_idx()Gu Zheng1-4/+0
Macro bip_vec_idx() was used by bio integrity originally, but no longer used now. So remove it. Signed-off-by: Gu Zheng <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-06-24ata: ahci_imx: warn when disabling ahci linkRussell King1-0/+3
When the AHCI link is disabled, it can't be re-enabled except by resetting the entire SoC. Rather than doing this silently print some kernel messages to inform the user, along with how to avoid this. tj: Put a long printf format string on a single line. Signed-off-by: Russell King <[email protected]> Signed-off-by: Tejun Heo <[email protected]>
2014-06-24Merge git://git.kvack.org/~bcrl/aio-fixesLinus Torvalds1-2/+4
Pull aio fixes from Ben LaHaise: "These fix a kernel memory disclosure issue (arbitrary kmap() & copy_to_user()) revealed in CVE-2014-0206 by changes that were introduced in v3.10" * git://git.kvack.org/~bcrl/aio-fixes: aio: fix kernel memory disclosure in io_getevents() introduced in v3.10 aio: fix aio request leak when events are reaped by userspace
2014-06-24Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-armLinus Torvalds10-20/+25
Pull ARM fixes from Russell King: "A number of low impact fixes, the most noticable one is the thumb2 frame pointer fix. We also fix a regression caused during this merge window with ARM925 CPUs running with caches disabled, and fix a number of warnings" * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: ARM: arm925: ensure assembly sets up writethrough mapping ARM: perf: fix compiler warning with gcc 4.6.4 (and tidy code) ARM: l2c: fix dependencies on PL310 errata symbols ARM: 8069/1: Make thread_save_fp macro aware of THUMB2 mode ARM: 8068/1: scoop: Remove unused variable
2014-06-24ahci: disable ncq feature for hisilicon sataKefeng Wang1-1/+1
NCQ feature is unsupported on hisilicon sata controller, so disable it. This version of IP is used by hip04 and hix5hd2 soc. tj: "|=" was replaced with "=" for no reason. Restored "|=". Signed-off-by: Kefeng Wang <[email protected]> Sigend-off-by: Tejun Heo <[email protected]>
2014-06-24x86/vdso: Error out in vdso2c if DT_RELA is presentAndy Lutomirski1-1/+1
vdso2c was checking for various types of relocations to detect when the vdso had undefined symbols or was otherwise dependent on relocation at load time. Undefined symbols in the vdso would fail if accessed at runtime, and certain implementation errors (e.g. branch profiling or incorrect symbol visibilities) could result in data access through the GOT that requires relocations. This could be as simple as: extern char foo; return foo; Without some kind of visibility control, the compiler would assume that foo could be interposed at load time and would generate a relocation. x86-64 and x32 (as opposed to i386) use explicit-addent (RELA) instead of implicit-addent (REL) relocations for data access, and vdso2c forgot to detect those. Whether these bad relocations would actually fail at runtime depends on what the linker sticks in the unrelocated references. Nonetheless, these relocations have no business existing in the vDSO and should be fixed rather than silently ignored. This error could trigger on some configurations due to branch profiling. The previous patch fixed that. Signed-off-by: Andy Lutomirski <[email protected]> Link: http://lkml.kernel.org/r/74ef0c00b4d2a3b573e00a4113874e62f772e348.1403642755.git.luto@amacapital.net Signed-off-by: H. Peter Anvin <[email protected]>
2014-06-24x86/vdso: Move DISABLE_BRANCH_PROFILING into the vdso makefileAndy Lutomirski2-4/+3
DISABLE_BRANCH_PROFILING turns off branch profiling (i.e. a redefinition of 'if'). Branch profiling depends on a bunch of kernel-internal symbols and generates extra output sections, none of which are useful or functional in the vDSO. It's currently turned off for vclock_gettime.c, but vgetcpu.c also triggers branch profiling, so just turn it off in the makefile. This fixes the build on some configurations: the vdso could contain undefined symbols, and the fake section table overflowed due to ftrace's added sections. Signed-off-by: Andy Lutomirski <[email protected]> Link: http://lkml.kernel.org/r/bf1ec29e03b2bbc081f6dcaefa64db1c3a83fb21.1403642755.git.luto@amacapital.net Signed-off-by: H. Peter Anvin <[email protected]>
2014-06-24iwlwifi: mvm: Fix broadcast filteringIlan Peer1-6/+6
Current code did not allow sending the broadcast filtering command for P2P Client interfaces. However, this was not enough, since once broadcast filtering command was issued over the station interface after the P2P Client connected, the command also attached the filters to the P2P Client MAC which is not allowed (FW ASSERT 1063). Fix this skipping P2P Client interfaces when constructing the broadcast filtering command Signed-off-by: Ilan Peer <[email protected]> Reviewed-by: ArikX Nemtsov <[email protected]> Signed-off-by: Emmanuel Grumbach <[email protected]>
2014-06-24Revert "iwlwifi: remove IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT flag"Arik Nemtsov2-0/+8
This reverts commit dc9a19296a872644f19a06d8eeb5db222d327b41. 3610 cards don't support UAPSD. Signed-off-by: Arik Nemtsov <[email protected]> Signed-off-by: Emmanuel Grumbach <[email protected]>
2014-06-24iwlwifi: update the 7265 series HW IDsOren Givon1-1/+2
Add one more 7265 series HW ID. Edit one existing 7265 series HW ID. CC: <[email protected]> [3.13+] Signed-off-by: Oren Givon <[email protected]> Signed-off-by: Emmanuel Grumbach <[email protected]>
2014-06-24aio: fix kernel memory disclosure in io_getevents() introduced in v3.10Benjamin LaHaise1-0/+3
A kernel memory disclosure was introduced in aio_read_events_ring() in v3.10 by commit a31ad380bed817aa25f8830ad23e1a0480fef797. The changes made to aio_read_events_ring() failed to correctly limit the index into ctx->ring_pages[], allowing an attacked to cause the subsequent kmap() of an arbitrary page with a copy_to_user() to copy the contents into userspace. This vulnerability has been assigned CVE-2014-0206. Thanks to Mateusz and Petr for disclosing this issue. This patch applies to v3.12+. A separate backport is needed for 3.10/3.11. Signed-off-by: Benjamin LaHaise <[email protected]> Cc: Mateusz Guzik <[email protected]> Cc: Petr Matousek <[email protected]> Cc: Kent Overstreet <[email protected]> Cc: Jeff Moyer <[email protected]> Cc: [email protected]
2014-06-24aio: fix aio request leak when events are reaped by userspaceBenjamin LaHaise1-2/+1
The aio cleanups and optimizations by kmo that were merged into the 3.10 tree added a regression for userspace event reaping. Specifically, the reference counts are not decremented if the event is reaped in userspace, leading to the application being unable to submit further aio requests. This patch applies to 3.12+. A separate backport is required for 3.10/3.11. This issue was uncovered as part of CVE-2014-0206. Signed-off-by: Benjamin LaHaise <[email protected]> Cc: [email protected] Cc: Kent Overstreet <[email protected]> Cc: Mateusz Guzik <[email protected]> Cc: Petr Matousek <[email protected]>
2014-06-24xhci: Fix runtime suspended xhci from blocking system suspend.Wang, Yu1-3/+7
The system suspend flow as following: 1, Freeze all user processes and kenrel threads. 2, Try to suspend all devices. 2.1, If pci device is in RPM suspended state, then pci driver will try to resume it to RPM active state in the prepare stage. 2.2, xhci_resume function calls usb_hcd_resume_root_hub to queue two workqueue items to resume usb2&usb3 roothub devices. 2.3, Call suspend callbacks of devices. 2.3.1, All suspend callbacks of all hcd's children, including roothub devices are called. 2.3.2, Finally, hcd_pci_suspend callback is called. Due to workqueue threads were already frozen in step 1, the workqueue items can't be scheduled, and the roothub devices can't be resumed in this flow. The HCD_FLAG_WAKEUP_PENDING flag which is set in usb_hcd_resume_root_hub won't be cleared. Finally, hcd_pci_suspend will return -EBUSY, and system suspend fails. The reason why this issue doesn't show up very often is due to that choose_wakeup will be called in step 2.3.1. In step 2.3.1, if udev->do_remote_wakeup is not equal to device_may_wakeup(&udev->dev), then udev will resume to RPM active for changing the wakeup settings. This has been a lucky hit which hides this issue. For some special xHCI controllers which have no USB2 port, then roothub will not match hub driver due to probe failed. Then its do_remote_wakeup will be set to zero, and we won't be as lucky. xhci driver doesn't need to resume roothub devices everytime like in the above case. It's only needed when there are pending event TRBs. This patch should be back-ported to kernels as old as 3.2, that contains the commit f69e3120df82391a0ee8118e0a156239a06b2afb "USB: XHCI: resume root hubs when the controller resumes" Cc: [email protected] # 3.2 Signed-off-by: Wang, Yu <[email protected]> Acked-by: Alan Stern <[email protected]> [use readl() instead of removed xhci_readl(), reword commit message -Mathias] Signed-off-by: Mathias Nyman <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-06-24xhci: clear root port wake on bits if controller isn't wake-up capableLu Baolu1-1/+4
When xHCI PCI host is suspended, if do_wakeup is false in xhci_pci_suspend, xhci_bus_suspend needs to clear all root port wake on bits. Otherwise some Intel platforms may get a spurious wakeup, even if PCI PME# is disabled. This patch should be back-ported to kernels as old as 2.6.37, that contains the commit 9777e3ce907d4cb5a513902a87ecd03b52499569 "USB: xHCI: bus power management implementation". Cc: [email protected] # 2.6.37 Signed-off-by: Lu Baolu <[email protected]> Signed-off-by: Mathias Nyman <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-06-24xhci: correct burst count field for isoc transfers on 1.0 xhci hostsMathias Nyman1-1/+1
The transfer burst count (TBC) field in xhci 1.0 hosts should be set to the number of bursts needed to transfer all packets in a isoc TD. Supported values are 0-2 (1 to 3 bursts per service interval). Formula for TBC calculation is given in xhci spec section 4.11.2.3: TBC = roundup( Transfer Descriptor Packet Count / Max Burst Size +1 ) - 1 This patch should be applied to stable kernels since 3.0 that contain the commit 5cd43e33b9519143f06f507dd7cbee6b7a621885 "xhci 1.0: Set transfer burst count field." Cc: [email protected] # 3.0 Suggested-by: ShiChun Ma <[email protected]> Signed-off-by: Mathias Nyman <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-06-24xhci: Use correct SLOT ID when handling a reset device commandMathias Nyman1-2/+5
Command completion events normally include command completion status, SLOT_ID, and a pointer to the original command. Reset device command completion SLOT_ID may be zero according to xhci specs 4.6.11. VIA controllers set the SLOT_ID to zero, triggering a WARN_ON in the command completion handler. Use the SLOT ID found from the original command instead. This patch should be applied to stable kernels since 3.13 that contain the commit 20e7acb13ff48fbc884d5918c3697c27de63922a "xhci: use completion event's slot id rather than dig it out of command" Cc: [email protected] # 3.13 Reported-by: Saran Neti <[email protected]> Tested-by: Saran Neti <[email protected]> Signed-off-by: Mathias Nyman <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-06-24regulator: tps65218: Correct the the config register for LDO1Keerthy1-1/+1
Correct the the config register for LDO1. Fixes: 90e7d5262796 (regulator: tps65218: Add Regulator driver for TPS65218 PMIC) Signed-off-by: Keerthy <[email protected]> Signed-off-by: Felipe Balbi <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: <[email protected]> # v3.15
2014-06-24regulator: tps65218: Add the missing of_node assignment in probeKeerthy1-0/+1
Add the missing of_node assignment in probe. Fixes: 90e7d5262796 (regulator: tps65218: Add Regulator driver for TPS65218 PMIC) Signed-off-by: Keerthy <[email protected]> Signed-off-by: Felipe Balbi <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: <[email protected]> # v3.15
2014-06-24scsi_error: set DID_TIME_OUT correctlyHannes Reinecke1-7/+7
Any callbacks in scsi_timeout_out() might return BLK_EH_RESET_TIMER, in which case we should leave the result alone and not set DID_TIME_OUT, as the command didn't actually timeout. Signed-off-by: Hannes Reinecke <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]> Reviewed-by: Ewan D. Milne <[email protected]>
2014-06-24scsi_error: fix invalid setting of host byteUlrich Obergfell1-4/+4
After scsi_try_to_abort_cmd returns, the eh_abort_handler may have already found that the command has completed in the device, causing the host_byte to be nonzero (e.g. it could be DID_ABORT). When this happens, ORing DID_TIME_OUT into the host byte will corrupt the result field and initiate an unwanted command retry. Fix this by using set_host_byte instead, following the model of commit 2082ebc45af9c9c648383b8cde0dc1948eadbf31. Cc: [email protected] Signed-off-by: Ulrich Obergfell <[email protected]> [Fix all instances according to review comments. - Paolo] Signed-off-by: Paolo Bonzini <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]> Reviewed-by: Ewan D. Milne <[email protected]> Reviewed-by: Hannes Reinecke <[email protected]>
2014-06-24drm/exynos: enable vsync interrupt while waiting for vblankRahul Sharma1-0/+4
mixer_wait_for_vblank function expects that the upcoming vsync interrupt handler routine will clear the wait_vsync_event atomic variable. For this to happen, interrupts should be enabled and disabled properly. Signed-off-by: Rahul Sharma <[email protected]> Signed-off-by: Inki Dae <[email protected]>
2014-06-24drm/exynos: soft reset mixer before reconfigure after power-onRahul Sharma1-0/+2
Mixer soft reset is a recommended step before reconfiguring the mixer after power on. Mixer looses the previous state of DMAs if soft reset. This is the recommendation from the hardware team. Signed-off-by: Rahul Sharma <[email protected]> Signed-off-by: Inki Dae <[email protected]>
2014-06-24drm/exynos: allow multiple layer updates per vsync for mixerRahul Sharma1-6/+1
Allowing only one layer update per vsync can cause issues while there are update available for both layers. There is a good amount of possibility to loose updates if we allow single update per vsync. Signed-off-by: Rahul Sharma <[email protected]> Signed-off-by: Inki Dae <[email protected]>
2014-06-24nl80211: move set_qos_map command into split stateJohannes Berg1-6/+5
The non-split wiphy state shouldn't be increased in size so move the new set_qos_map command into the split if statement. Cc: [email protected] (3.14+) Fixes: fa9ffc745610 ("cfg80211: Add support for QoS mapping") Reviewed-by: Emmanuel Grumbach <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.