aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-06-06IB/mad: Fix indentationBart Van Assche1-3/+3
Make indentation consistent. Detected by smatch. Signed-off-by: Bart Van Assche <[email protected]> Cc: Hal Rosenstock <[email protected]> Cc: Ira Weiny <[email protected]> Reviewed-By: Ira Weiny <[email protected]> Reviewed-by: Hal Rosenstock <[email protected]> Reviewed-by: Sagi Grimberg <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2016-06-06RDMA/core: Fix indentationBart Van Assche1-1/+1
Make indentation consistent. Detected by smatch. Signed-off-by: Bart Van Assche <[email protected]> Cc: Tatyana Nikolova <[email protected]> Cc: Steve Wise <[email protected]> Reviewed-by: Steve Wise <[email protected]> Reviewed-by: Sagi Grimberg <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2016-06-06IB/srp: Fix srp_map_sg_dma()Bart Van Assche1-2/+1
Because patch "IB/srp: Move common code into the caller" was applied partially srp_map_sg_dma() doesn't work properly. Fix this by applying the remainder of that patch. See also http://thread.gmane.org/gmane.linux.drivers.rdma/35803/focus=35811. Fixes: 3849e44d1c4b ("IB/srp: Move common code into the caller") Signed-off-by: Bart Van Assche <[email protected]> Cc: Mike Marciniszyn <[email protected]> Cc: Sagi Grimberg <[email protected]> Cc: Christoph Hellwig <[email protected]> Cc: Laurence Oberman <[email protected]> Reviewed-by: Sagi Grimberg <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2016-06-06IB/srp: Always initialize use_fast_reg and use_fmrBart Van Assche1-3/+1
Avoid that mapping fails due to use_fast_reg != 0 or use_fmr != 0 if both member variables should be zero (if never_register == 1 or if neither FMR nor FR is supported). Remove an initialization that became superfluous due to changing a kmalloc() into a kzalloc() call. Fixes: 509c5f33f4f6 ("IB/srp: Prevent mapping failures") Cc: Sagi Grimberg <[email protected]> Cc: Christoph Hellwig <[email protected]> Cc: Laurence Oberman <[email protected]> Signed-off-by: Bart Van Assche <[email protected]> Reviewed-by: Leon Romanovsky <[email protected]> Reviewed-by: Sagi Grimberg <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2016-06-06IB/mlx4: Fix device managed flow steering support testBart Van Assche1-2/+2
Perform the test for device managed flow steering support even if memory windows are not supported. I noticed this because smatch reported inconsistent indentation for the device managed flow steering support test. Signed-off-by: Bart Van Assche <[email protected]> Reviewed-by: Sagi Grimberg <[email protected]> Cc: Yishai Hadas <[email protected]> Reviewed-by: Leon Romanovsky <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2016-06-06IB/usnic: Remove unused DMA attributesKrzysztof Kozlowski1-5/+0
The DMA attributes are set but never used. Signed-off-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2016-06-06IB/core: fix null pointer deref and mem leak in error handlingColin Ian King1-3/+4
The current error handling in setup_hw_stats has a couple of issues. It is possible to generate a null pointer deference on the kfree of hsag->attrs[i] because two of the early error exit paths jump to the kfree when hsags NULL and not allocated. Fix this by moving the kfree on stats and jumping to that, avoiding the hsag freeing. Secondly, there is a memory leak of stats if the hsag allocation fails; instead of returning, jump to the kfree on stats. Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2016-06-06IB/core: fix an error code in ib_core_init()Dan Carpenter1-1/+2
We should return the error code if ib_add_ibnl_clients() fails. The current code returns success. Fixes: 735c631ae99d ('IB/core: Register SA ibnl client during ib_core initialization') Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Mark Bloch <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2016-06-06IB/hfi1: Avoid large frame size warningLeon Romanovsky1-17/+14
When CONFIG_FRAME_WARN is set to 1024 bytes, which is useful to find stack consumers, we get a warning in hfi1 driver. drivers/infiniband/hw/hfi1/affinity.c: In function ‘hfi1_get_proc_affinity’: drivers/infiniband/hw/hfi1/affinity.c:415:1: warning: the frame size of 1056 bytes is larger than 1024 bytes [-Wframe-larger-than=] This change removes unneeded buf[1024] declaration and usage. Fixes: f48ad614c100 ("IB/hfi1: Move driver out of staging") Signed-off-by: Leon Romanovsky <[email protected]> Acked-by: Dennis Dalessandro <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2016-06-06IB/hfi1: fix some indentingDan Carpenter1-1/+1
That extra tabs are misleading. Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Bart Van Assche <[email protected]> Acked-by: Dennis Dalessandro <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2016-06-06IB/cm: Fix a recently introduced locking bugBart Van Assche1-2/+2
ib_cm_notify() can be called from interrupt context. Hence do not reenable interrupts unconditionally in cm_establish(). This patch avoids that lockdep reports the following warning: WARNING: CPU: 0 PID: 23317 at kernel/locking/lockdep.c:2624 trace _hardirqs_on_caller+0x112/0x1b0 DEBUG_LOCKS_WARN_ON(current->hardirq_context) Call Trace: <IRQ> [<ffffffff812bd0e5>] dump_stack+0x67/0x92 [<ffffffff81056f21>] __warn+0xc1/0xe0 [<ffffffff81056f8a>] warn_slowpath_fmt+0x4a/0x50 [<ffffffff810a5932>] trace_hardirqs_on_caller+0x112/0x1b0 [<ffffffff810a59dd>] trace_hardirqs_on+0xd/0x10 [<ffffffff815992c7>] _raw_spin_unlock_irq+0x27/0x40 [<ffffffffa0382e9c>] ib_cm_notify+0x25c/0x290 [ib_cm] [<ffffffffa068fbc1>] srpt_qp_event+0xa1/0xf0 [ib_srpt] [<ffffffffa04efb97>] mlx4_ib_qp_event+0x67/0xd0 [mlx4_ib] [<ffffffffa034ec0a>] mlx4_qp_event+0x5a/0xc0 [mlx4_core] [<ffffffffa03365f8>] mlx4_eq_int+0x3d8/0xcf0 [mlx4_core] [<ffffffffa0336f9c>] mlx4_msi_x_interrupt+0xc/0x20 [mlx4_core] [<ffffffff810b0914>] handle_irq_event_percpu+0x64/0x100 [<ffffffff810b09e4>] handle_irq_event+0x34/0x60 [<ffffffff810b3a6a>] handle_edge_irq+0x6a/0x150 [<ffffffff8101ad05>] handle_irq+0x15/0x20 [<ffffffff8101a66c>] do_IRQ+0x5c/0x110 [<ffffffff8159a2c9>] common_interrupt+0x89/0x89 [<ffffffff81297a17>] blk_run_queue_async+0x37/0x40 [<ffffffffa0163e53>] rq_completed+0x43/0x70 [dm_mod] [<ffffffffa0164896>] dm_softirq_done+0x176/0x280 [dm_mod] [<ffffffff812a26c2>] blk_done_softirq+0x52/0x90 [<ffffffff8105bc1f>] __do_softirq+0x10f/0x230 [<ffffffff8105bec8>] irq_exit+0xa8/0xb0 [<ffffffff8103653e>] smp_trace_call_function_single_interrupt+0x2e/0x30 [<ffffffff81036549>] smp_call_function_single_interrupt+0x9/0x10 [<ffffffff8159a959>] call_function_single_interrupt+0x89/0x90 <EOI> Fixes: commit be4b499323bf (IB/cm: Do not queue work to a device that's going away) Signed-off-by: Bart Van Assche <[email protected]> Cc: Erez Shitrit <[email protected]> Cc: Sean Hefty <[email protected]> Cc: Nikolay Borisov <[email protected]> Cc: stable <[email protected]> # v4.2+ Acked-by: Erez Shitrit <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2016-06-06soreuseport: add compat case for setsockopt SO_ATTACH_REUSEPORT_CBPFHelge Deller1-1/+2
Commit 538950a1b752 ("soreuseport: setsockopt SO_ATTACH_REUSEPORT_[CE]BPF") missed to add the compat case for the SO_ATTACH_REUSEPORT_CBPF option. Signed-off-by: Helge Deller <[email protected]> Acked-by: Daniel Borkmann <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-06-06soreuseport: Fix reuseport_bpf testcase on 32bit architecturesHelge Deller1-5/+5
This fixes the following compiler warnings when compiling the reuseport_bpf testcase on a 32 bit platform: reuseport_bpf.c: In function ‘attach_ebpf’: reuseport_bpf.c:114:15: warning: cast from pointer to integer of ifferent size [-Wpointer-to-int-cast] Signed-off-by: Helge Deller <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-06-07drm/nouveau/disp/sor/gm107: training pattern registers are like gm200Ben Skeggs6-18/+64
Signed-off-by: Ben Skeggs <[email protected]> Cc: [email protected]
2016-06-07drm/nouveau/disp/sor/gf119: both links use the same training registerBen Skeggs1-2/+1
It appears that, for whatever reason, both link A and B use the same register to control the training pattern. It's a little odd, as the GPUs before this (Tesla/Fermi1) have per-link registers, as do newer GPUs (Maxwell). Fixes the third DP output on NVS 510 (GK107). Signed-off-by: Ben Skeggs <[email protected]> Cc: [email protected]
2016-06-06drm/vc4: Make pageflip completion handling more robust.Mario Kleiner2-10/+22
Protect both the setup of the pageflip event and the latching of the new requested displaylist head pointer by the event lock, so we can't get into a situation where vc4_atomic_flush latches the new display list via HVS_WRITE, then immediately gets preempted before queueing the pageflip event, then the page-flip completes in hw and the vc4_crtc_handle_page_flip() runs and no-ops due to lack of a pending pageflip event, then vc4_atomic_flush continues and only then queues the pageflip event - after the page flip handling already no-oped. This would cause flip completion handling only at the next vblank - one frame too late. In vc4_crtc_handle_page_flip() check the actual DL head pointer in SCALER_DISPLACTX against the requested pointer for page flip to make sure that the flip actually really completed in the current vblank and doesn't get deferred to the next one because the DL head pointer was written a bit too late into SCALER_DISPLISTX, after start of vblank, and missed the boat. This avoids handling a pageflip completion too early - one frame too early. According to Eric, DL head pointer updates which were written into the HVS DISPLISTX reg get committed to hardware at the last pixel of active scanout. Our vblank interrupt handler, as triggered by PV_INT_VFP_START irq, gets to run earliest at the first pixel of HBLANK at the end of the last scanline of active scanout, ie. vblank irq handling runs at least 1 pixel duration after a potential pageflip completion happened in hardware. This ordering of events in the hardware, together with the lock protection and SCALER_DISPLACTX sampling of this patch, guarantees that pageflip completion handling only runs at exactly the vblank irq of actual pageflip completion in all cases. Background info from Eric about the relative timing of HVS, PV's and trigger points for interrupts, DL updates: https://lists.freedesktop.org/archives/dri-devel/2016-May/107510.html Tested on RPi 2B with hardware timing measurement equipment and shown to no longer complete flips too early or too late. Signed-off-by: Mario Kleiner <[email protected]> Reviewed-by: Eric Anholt <[email protected]>
2016-06-06drm/vc4: Fix ioctl permissions for render nodes.Herve Jourdain1-6/+6
Contrary to other flags to DRM_IOCTL_DEF_DRV(), which restrict usage, the flag for render node is an enabler (the IOCTL can't be used from render node if it's not present). So DRM_RENDER_ALLOW needs to be added to all the flags that were previously 0. Signed-off-by: Herve Jourdain <[email protected]> Reviewed-by: Eric Anholt <[email protected]> Fixes: 0cd3e2747662 ("drm/vc4: Add missing render node support")
2016-06-06Merge tag 'edac_fixes_for_4.7' of ↵Linus Torvalds2-14/+24
git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp Pull EDAC fixes from Borislav Petkov: "EDAC fixes to recent fallout from workqueue cleanup and Broadwell enablement: - sb_edac fallout fixes from recent Broadwell enablement (Tony Luck) - EDAC workqueue poll period resetting fix (Nicholas Krause)" * tag 'edac_fixes_for_4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: EDAC, sb_edac: Readd accidentally dropped Broadwell-D support EDAC: Fix workqueues poll period resetting EDAC, sb_edac: Fix rank lookup on Broadwell
2016-06-06Btrfs: self-tests: Fix extent buffer bitmap test fail on BE systemFeifei Xu1-1/+11
In __test_eb_bitmaps(), we write random data to a bitmap. Then copy the bitmap to another bitmap that resides inside an extent buffer. Later we verify the values of corresponding bits in the bitmap and the bitmap inside the extent buffer. However, extent_buffer_test_bit() reads in byte granularity while test_bit() reads in unsigned long granularity. Hence we end up comparing wrong bits on big-endian systems such as ppc64. This commit fixes the issue by reading the bitmap in byte granularity. Reviewed-by: Josef Bacik <[email protected]> Reviewed-by: Chandan Rajendra <[email protected]> Signed-off-by: Feifei Xu <[email protected]> Signed-off-by: David Sterba <[email protected]>
2016-06-06Btrfs: self-tests: Fix test_bitmaps fail on 64k sectorsizeFeifei Xu1-1/+7
With 64K sectorsize, 1G sized block group cannot span across bitmaps. To execute test_bitmaps() function, this commit allocates "BITS_PER_BITMAP * sectorsize + PAGE_SIZE" sized block group. Reviewed-by: Josef Bacik <[email protected]> Reviewed-by: Chandan Rajendra <[email protected]> Signed-off-by: Feifei Xu <[email protected]> Signed-off-by: David Sterba <[email protected]>
2016-06-06Btrfs: self-tests: Use macros instead of constants and add missing newlineFeifei Xu3-18/+31
This commit replaces numerical constants with appropriate preprocessor macros. Reviewed-by: Josef Bacik <[email protected]> Signed-off-by: Chandan Rajendra <[email protected]> Signed-off-by: Feifei Xu <[email protected]> Signed-off-by: David Sterba <[email protected]>
2016-06-06Btrfs: self-tests: Support testing all possible sectorsizes and nodesizesFeifei Xu1-22/+32
To test all possible sectorsizes, this commit adds a sectorsize array. This commit executes the tests for all possible sectorsizes and nodesizes. Reviewed-by: Josef Bacik <[email protected]> Signed-off-by: Chandan Rajendra <[email protected]> Signed-off-by: Feifei Xu <[email protected]> Signed-off-by: David Sterba <[email protected]>
2016-06-06Btrfs: self-tests: Execute page straddling test only when nodesize < PAGE_SIZEFeifei Xu1-19/+30
On ppc64, PAGE_SIZE is 64k which is same as BTRFS_MAX_METADATA_BLOCKSIZE. In such a scenario, we will never be able to have an extent buffer containing more than one page. Hence in such cases this commit does not execute the page straddling tests. Reviewed-by: Josef Bacik <[email protected]> Signed-off-by: Feifei Xu <[email protected]> Signed-off-by: Chandan Rajendra <[email protected]> Signed-off-by: David Sterba <[email protected]>
2016-06-06x86/msr: Use the proper trace point conditional for writesDr. David Alan Gilbert1-2/+2
The msr tracing for writes is incorrectly conditional on the read trace. Fixes: 7f47d8cc039f "x86, tracing, perf: Add trace point for MSR accesses" Signed-off-by: Dr. David Alan Gilbert <[email protected]> Cc: [email protected] Cc: [email protected] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]>
2016-06-06btrfs: advertise which crc32c implementation is being used at module loadJeff Mahoney3-2/+9
Since several architectures support hardware-accelerated crc32c calculation, it would be nice to confirm that btrfs is actually using it. We can see an elevated use count for the module, but it doesn't actually show who the users are. This patch simply prints the name of the driver after successfully initializing the shash. Signed-off-by: Jeff Mahoney <[email protected]> [ added a helper and used in module load-time message ] Signed-off-by: David Sterba <[email protected]>
2016-06-06Btrfs: add validadtion checks for chunk loadingLiu Bo1-15/+67
To prevent fuzzed filesystem images from panic the whole system, we need various validation checks to refuse to mount such an image if btrfs finds any invalid value during loading chunks, including both sys_array and regular chunks. Note that these checks may not be sufficient to cover all corner cases, feel free to add more checks. Reported-by: Vegard Nossum <[email protected]> Reported-by: Quentin Casasnovas <[email protected]> Reviewed-by: David Sterba <[email protected]> Signed-off-by: Liu Bo <[email protected]> Signed-off-by: David Sterba <[email protected]>
2016-06-06Btrfs: add more validation checks for superblockLiu Bo2-0/+35
This adds validation checks for super_total_bytes, super_bytes_used and super_stripesize, super_num_devices. Reported-by: Vegard Nossum <[email protected]> Reported-by: Quentin Casasnovas <[email protected]> Reviewed-by: David Sterba <[email protected]> Signed-off-by: Liu Bo <[email protected]> Signed-off-by: David Sterba <[email protected]>
2016-06-06Btrfs: clear uptodate flags of pages in sys_array ebLiu Bo1-0/+2
We set uptodate flag to pages in the temporary sys_array eb, but do not clear the flag after free eb. As the special btree inode may still hold a reference on those pages, the uptodate flag can remain alive in them. If btrfs_super_chunk_root has been intentionally changed to the offset of this sys_array eb, reading chunk_root will read content of sys_array and it will skip our beautiful checks in btree_readpage_end_io_hook() because of "pages of eb are uptodate => eb is uptodate" This adds the 'clear uptodate' part to force it to read from disk. Reviewed-by: Josef Bacik <[email protected]> Signed-off-by: Liu Bo <[email protected]> Signed-off-by: David Sterba <[email protected]>
2016-06-06ARM: exynos_defconfig: Save defconfig on current linux-nextKrzysztof Kozlowski1-10/+4
Save defconfig on next-20160602. Most of changes are just re-ordering of symbols. Removed symbols: - FHANDLE (default y), - THERMAL, EXYNOS_THERMAL (selected by ARCH_EXYNOS), - CHROME_PLATFORMS (selected by MFD_CROS_EC), - EXT4_FS (selected by EXT3_FS) - SND_SOC_ODROIDX2 (obsolete since commit ee12a817bb4b ("ASoC: samsung: Remove unused Odroid x2/u3 machine driver"), replaced with SND_SIMPLE_CARD). Cc: Sylwester Nawrocki <[email protected]> Signed-off-by: Krzysztof Kozlowski <[email protected]> Acked-by: Arnd Bergmann <[email protected]> Reviewed-by: Sylwester Nawrocki <[email protected]> Reviewed-by: Javier Martinez Canillas <[email protected]>
2016-06-06ARM: multi_v7_defconfig: Enable s5p-secss driverKrzysztof Kozlowski1-0/+1
The Exynos SoC provides a Security SubSystem block for accelerating some cryptographic operations. Enable the driver for it - s5p-secss to utilize the hardware acceleration. Currently the s5p-secss driver supports AES in CBC and ECB modes. However its usefulness could be doubted. Excerpt of tests on Odroid XU3 (Exynos5422), for 256 bit key, encryption, performance CPU freq governor: algorithm | block size [b] | average speed [MB/s] | cbc-aes-s5p | 16 | 11.5 | cbc-aes-s5p | 64 | 25.4 | cbc-aes-s5p | 256 | 41.0 | cbc-aes-s5p | 1024 | 47.4 | cbc-aes-s5p | 8192 | 49.0 | cbc(aes-generic) | 16 | 0.4 | cbc(aes-generic) | 64 | 1.8 | cbc(aes-generic) | 256 | 6.6 | cbc(aes-generic) | 1024 | 25.2 | cbc(aes-generic) | 8192 | 83.1 | Anyway enable the driver so it will get some testing coverage by community. Signed-off-by: Krzysztof Kozlowski <[email protected]> Acked-by: Arnd Bergmann <[email protected]> Reviewed-by: Javier Martinez Canillas <[email protected]>
2016-06-06ARM: multi_v7_defconfig: Enable drivers for Exynos4210 Universal C210 boardKrzysztof Kozlowski1-1/+8
Enable drivers needed to get Exynos 4210 Universal C210 board working: MAX8998 MFD and regulators, GPIO-based bit-bang SPI, Exynos DRM FIMD parallel output and Samsung LD9040 RGB panel. Signed-off-by: Krzysztof Kozlowski <[email protected]> Acked-by: Arnd Bergmann <[email protected]> Reviewed-by: Javier Martinez Canillas <[email protected]>
2016-06-06ARM: multi_v7_defconfig: Enable Trats2 audio codec, touchscreen and sensorsKrzysztof Kozlowski1-3/+7
The Exynos4412-based Trats2 board has CM36651 proximity/ambient light sensor, MMS114 touchscreen and Wolfson Microelectronics WM1811 CODEC. Enable them in defconfig to get some testing coverage and use its features. While saving defconfig the SND_SOC_ODROIDX2 is removed because it does not exist since commit ee12a817bb4b ("ASoC: samsung: Remove unused Odroid x2/u3 machine driver"). Signed-off-by: Krzysztof Kozlowski <[email protected]> Acked-by: Arnd Bergmann <[email protected]> Reviewed-by: Javier Martinez Canillas <[email protected]>
2016-06-05bnx2x: allow adding VLANs while interface is downMichal Schmidt1-89/+62
Since implementing VLAN filtering in commit 05cc5a39ddb74 ("bnx2x: add vlan filtering offload") bnx2x refuses to add a VLAN while the interface is down: # ip link add link enp3s0f0 enp3s0f0_10 type vlan id 10 RTNETLINK answers: Bad address and in dmesg (with bnx2x.debug=0x20): bnx2x: [bnx2x_vlan_rx_add_vid:12941(enp3s0f0)]Ignoring VLAN configuration the interface is down Other drivers have no problem with this. Fix this peculiar behavior in the following way: - Accept requests to add/kill VID regardless of the device state. Maintain the requested list of VIDs in the bp->vlan_reg list. - If the device is up, try to configure the VID list into the hardware. If we run out of VLAN credits or encounter a failure configuring an entry, fall back to accepting all VLANs. If we successfully configure all entries from the list, turn the fallback off. - Use the same code for reconfiguring VLANs during NIC load. Signed-off-by: Michal Schmidt <[email protected]> Acked-by: Yuval Mintz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-06-06powerpc/pseries: Fix PCI config address for DDWGavin Shan1-2/+2
In commit 8445a87f7092 "powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism", the PE address was replaced with the PCI config address in order to remove dependency on EEH. According to PAPR spec, firmware (pHyp or QEMU) should accept "xxBBSSxx" format PCI config address, not "xxxxBBSS" provided by the patch. Note that "BB" is PCI bus number and "SS" is the combination of slot and function number. This fixes the PCI address passed to DDW RTAS calls. Fixes: 8445a87f7092 ("powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism") Cc: [email protected] # v3.4+ Reported-by: Guilherme G. Piccoli <[email protected]> Signed-off-by: Gavin Shan <[email protected]> Tested-by: Guilherme G. Piccoli <[email protected]> Signed-off-by: Michael Ellerman <[email protected]>
2016-06-06powerpc/ptrace: Fix out of bounds array access warningKhem Raj1-2/+2
gcc-6 correctly warns about a out of bounds access arch/powerpc/kernel/ptrace.c:407:24: warning: index 32 denotes an offset greater than size of 'u64[32][1] {aka long long unsigned int[32][1]}' [-Warray-bounds] offsetof(struct thread_fp_state, fpr[32][0])); ^ check the end of array instead of beginning of next element to fix this Signed-off-by: Khem Raj <[email protected]> Cc: Kees Cook <[email protected]> Cc: Michael Ellerman <[email protected]> Cc: Segher Boessenkool <[email protected]> Tested-by: Aaro Koskinen <[email protected]> Acked-by: Olof Johansson <[email protected]> Signed-off-by: Michael Ellerman <[email protected]>
2016-06-06ipvs: update real-server binding of outgoing connections in SIP-peMarco Angaroni3-5/+7
Previous patch that introduced handling of outgoing packets in SIP persistent-engine did not call ip_vs_check_template() in case packet was matching a connection template. Assumption was that real-server was healthy, since it was sending a packet just in that moment. There are however real-server fault conditions requiring that association between call-id and real-server (represented by connection template) gets updated. Here is an example of the sequence of events: 1) RS1 is a back2back user agent that handled call-id1 and call-id2 2) RS1 is down and was marked as unavailable 3) new message from outside comes to IPVS with call-id1 4) IPVS reschedules the message to RS2, which becomes new call handler 5) RS2 forwards the message outside, translating call-id1 to call-id2 6) inside pe->conn_out() IPVS matches call-id2 with existing template 7) IPVS does not change association call-id2 <-> RS1 8) new message comes from client with call-id2 9) IPVS reschedules the message to a real-server potentially different from RS2, which is now the correct destination This patch introduces ip_vs_check_template() call in the handling of outgoing packets for SIP-pe. And also introduces a second optional argument for ip_vs_check_template() that allows to check if dest associated to a connection template is the same dest that was identified as the source of the packet. This is to change the real-server bound to a particular call-id independently from its availability status: the idea is that it's more reliable, for in->out direction (where internal network can be considered trusted), to always associate a call-id with the last real-server that used it in one of its messages. Think about above sequence of events where, just after step 5, RS1 returns instead to be available. Comparison of dests is done by simply comparing pointers to struct ip_vs_dest; there should be no cases where struct ip_vs_dest keeps its memory address, but represent a different real-server in terms of ip-address / port. Fixes: 39b972231536 ("ipvs: handle connections started by real-servers") Signed-off-by: Marco Angaroni <[email protected]> Acked-by: Julian Anastasov <[email protected]> Signed-off-by: Simon Horman <[email protected]>
2016-06-05Linux 4.7-rc2Linus Torvalds1-1/+1
2016-06-05Merge branch 'parisc-4.7-2' of ↵Linus Torvalds5-18/+29
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: - Fix printk time stamps on SMP systems which got wrong due to a patch which was added during the merge window - Fix two bugs in the stack backtrace code: Races in module unloading and possible invalid accesses to memory due to wrong instruction decoding (Mikulas Patocka) - Fix userspace crash when syscalls access invalid unaligned userspace addresses. Those syscalls will now return EFAULT as expected. (tagged for stable kernel series) * 'parisc-4.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Move die_if_kernel() prototype into traps.h header parisc: Fix pagefault crash in unaligned __get_user() call parisc: Fix printk time during boot parisc: Fix backtrace on PA-RISC
2016-06-05Merge branch 'for-linus' of ↵Linus Torvalds5-7/+17
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull key handling update from James Morris: "This alters a new keyctl function added in the current merge window to allow for a future extension planned for the next merge window" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: KEYS: Add placeholder for KDF usage with DH
2016-06-05devpts: Make each mount of devpts an independent filesystem.Eric W. Biederman7-296/+126
The /dev/ptmx device node is changed to lookup the directory entry "pts" in the same directory as the /dev/ptmx device node was opened in. If there is a "pts" entry and that entry is a devpts filesystem /dev/ptmx uses that filesystem. Otherwise the open of /dev/ptmx fails. The DEVPTS_MULTIPLE_INSTANCES configuration option is removed, so that userspace can now safely depend on each mount of devpts creating a new instance of the filesystem. Each mount of devpts is now a separate and equal filesystem. Reserved ttys are now available to all instances of devpts where the mounter is in the initial mount namespace. A new vfs helper path_pts is introduced that finds a directory entry named "pts" in the directory of the passed in path, and changes the passed in path to point to it. The helper path_pts uses a function path_parent_directory that was factored out of follow_dotdot. In the implementation of devpts: - devpts_mnt is killed as it is no longer meaningful if all mounts of devpts are equal. - pts_sb_from_inode is replaced by just inode->i_sb as all cached inodes in the tty layer are now from the devpts filesystem. - devpts_add_ref is rolled into the new function devpts_ptmx. And the unnecessary inode hold is removed. - devpts_del_ref is renamed devpts_release and reduced to just a deacrivate_super. - The newinstance mount option continues to be accepted but is now ignored. In devpts_fs.h definitions for when !CONFIG_UNIX98_PTYS are removed as they are never used. Documentation/filesystems/devices.txt is updated to describe the current situation. This has been verified to work properly on openwrt-15.05, centos5, centos6, centos7, debian-6.0.2, debian-7.9, debian-8.2, ubuntu-14.04.3, ubuntu-15.10, fedora23, magia-5, mint-17.3, opensuse-42.1, slackware-14.1, gentoo-20151225 (13.0?), archlinux-2015-12-01. With the caveat that on centos6 and on slackware-14.1 that there wind up being two instances of the devpts filesystem mounted on /dev/pts, the lower copy does not end up getting used. Signed-off-by: "Eric W. Biederman" <[email protected]> Cc: Greg KH <[email protected]> Cc: Peter Hurley <[email protected]> Cc: Peter Anvin <[email protected]> Cc: Andy Lutomirski <[email protected]> Cc: Al Viro <[email protected]> Cc: Serge Hallyn <[email protected]> Cc: Willy Tarreau <[email protected]> Cc: Aurelien Jarno <[email protected]> Cc: One Thousand Gnomes <[email protected]> Cc: Jann Horn <[email protected]> Cc: Jiri Slaby <[email protected]> Cc: Florian Weimer <[email protected]> Cc: Konstantin Khlebnikov <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-06-05parisc: Move die_if_kernel() prototype into traps.h headerHelge Deller2-2/+3
Signed-off-by: Helge Deller <[email protected]>
2016-06-05parisc: Fix pagefault crash in unaligned __get_user() callHelge Deller1-1/+9
One of the debian buildd servers had this crash in the syslog without any other information: Unaligned handler failed, ret = -2 clock_adjtime (pid 22578): Unaligned data reference (code 28) CPU: 1 PID: 22578 Comm: clock_adjtime Tainted: G E 4.5.0-2-parisc64-smp #1 Debian 4.5.4-1 task: 000000007d9960f8 ti: 00000001bde7c000 task.ti: 00000001bde7c000 YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI PSW: 00001000000001001111100000001111 Tainted: G E r00-03 000000ff0804f80f 00000001bde7c2b0 00000000402d2be8 00000001bde7c2b0 r04-07 00000000409e1fd0 00000000fa6f7fff 00000001bde7c148 00000000fa6f7fff r08-11 0000000000000000 00000000ffffffff 00000000fac9bb7b 000000000002b4d4 r12-15 000000000015241c 000000000015242c 000000000000002d 00000000fac9bb7b r16-19 0000000000028800 0000000000000001 0000000000000070 00000001bde7c218 r20-23 0000000000000000 00000001bde7c210 0000000000000002 0000000000000000 r24-27 0000000000000000 0000000000000000 00000001bde7c148 00000000409e1fd0 r28-31 0000000000000001 00000001bde7c320 00000001bde7c350 00000001bde7c218 sr00-03 0000000001200000 0000000001200000 0000000000000000 0000000001200000 sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000 IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000402d2e84 00000000402d2e88 IIR: 0ca0d089 ISR: 0000000001200000 IOR: 00000000fa6f7fff CPU: 1 CR30: 00000001bde7c000 CR31: ffffffffffffffff ORIG_R28: 00000002369fe628 IAOQ[0]: compat_get_timex+0x2dc/0x3c0 IAOQ[1]: compat_get_timex+0x2e0/0x3c0 RP(r2): compat_get_timex+0x40/0x3c0 Backtrace: [<00000000402d4608>] compat_SyS_clock_adjtime+0x40/0xc0 [<0000000040205024>] syscall_exit+0x0/0x14 This means the userspace program clock_adjtime called the clock_adjtime() syscall and then crashed inside the compat_get_timex() function. Syscalls should never crash programs, but instead return EFAULT. The IIR register contains the executed instruction, which disassebles into "ldw 0(sr3,r5),r9". This load-word instruction is part of __get_user() which tried to read the word at %r5/IOR (0xfa6f7fff). This means the unaligned handler jumped in. The unaligned handler is able to emulate all ldw instructions, but it fails if it fails to read the source e.g. because of page fault. The following program reproduces the problem: #define _GNU_SOURCE #include <unistd.h> #include <sys/syscall.h> #include <sys/mman.h> int main(void) { /* allocate 8k */ char *ptr = mmap(NULL, 2*4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); /* free second half (upper 4k) and make it invalid. */ munmap(ptr+4096, 4096); /* syscall where first int is unaligned and clobbers into invalid memory region */ /* syscall should return EFAULT */ return syscall(__NR_clock_adjtime, 0, ptr+4095); } To fix this issue we simply need to check if the faulting instruction address is in the exception fixup table when the unaligned handler failed. If it is, call the fixup routine instead of crashing. While looking at the unaligned handler I found another issue as well: The target register should not be modified if the handler was unsuccessful. Signed-off-by: Helge Deller <[email protected]> Cc: [email protected]
2016-06-05parisc: Fix printk time during bootHelge Deller2-7/+3
Avoid showing invalid printk time stamps during boot. Signed-off-by: Helge Deller <[email protected]> Reviewed-by: Aaro Koskinen <[email protected]>
2016-06-05autofs braino fix for do_last()Al Viro1-4/+4
It's an analogue of commit 7500c38a (fix the braino in "namei: massage lookup_slow() to be usable by lookup_one_len_unlocked()"). The same problem (->lookup()-returned unhashed negative dentry just might be an autofs one with ->d_manage() that would wait until the daemon makes it positive) applies in do_last() - we need to do follow_managed() first. Fortunately, remaining callers of follow_managed() are OK - only autofs has that weirdness (negative dentry that does not mean an instant -ENOENT)) and autofs never has its negative dentries hashed, so we can't pick one from a dcache lookup. ->d_manage() is a bloody mess ;-/ Cc: [email protected] # v4.6 Spotted-by: Ian Kent <[email protected]> Signed-off-by: Al Viro <[email protected]>
2016-06-04Merge tag 'wireless-drivers-for-davem-2016-06-04' of ↵David S. Miller4-3/+22
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.7 brcmfmac * add fallback RSSI report for devices that do not report per-chain values * fix a null pointer derefence regression on PCIe full dongle devices rtlwifi * fix scheduling while atomic regression from commit 49f86ec21c01 MAINTAINERS * add file patterns for wireless device tree bindings ==================== Signed-off-by: David S. Miller <[email protected]>
2016-06-04parisc: Fix backtrace on PA-RISCMikulas Patocka1-8/+14
This patch fixes backtrace on PA-RISC There were several problems: 1) The code that decodes instructions handles instructions that subtract from the stack pointer incorrectly. If the instruction subtracts the number X from the stack pointer the code increases the frame size by (0x100000000-X). This results in invalid accesses to memory and recursive page faults. 2) Because gcc reorders blocks, handling instructions that subtract from the frame pointer is incorrect. For example, this function int f(int a) { if (__builtin_expect(a, 1)) return a; g(); return a; } is compiled in such a way, that the code that decreases the stack pointer for the first "return a" is placed before the code for "g" call. If we recognize this decrement, we mistakenly believe that the frame size for the "g" call is zero. To fix problems 1) and 2), the patch doesn't recognize instructions that decrease the stack pointer at all. To further safeguard the unwind code against nonsense values, we don't allow frame size larger than Total_frame_size. 3) The backtrace is not locked. If stack dump races with module unload, invalid table can be accessed. This patch adds a spinlock when processing module tables. Note, that for correct backtrace, you need recent binutils. Binutils 2.18 from Debian 5 produce garbage unwind tables. Binutils 2.21 work better (it sometimes forgets function frames, but at least it doesn't generate garbage). Signed-off-by: Mikulas Patocka <[email protected]> Signed-off-by: Helge Deller <[email protected]>
2016-06-04Merge tag 'drm-fixes-for-v4.7-rc2' of ↵Linus Torvalds46-228/+227
git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "A bunch of ARM drivers got into the fixes vibe this time around, so this contains a bunch of fixes for imx, atmel hlcdc, arm hdlcd (only so many combos of hlcd), mediatek and omap drm. Other than that there is one mgag200 fix and a few core drm regression fixes" * tag 'drm-fixes-for-v4.7-rc2' of git://people.freedesktop.org/~airlied/linux: (34 commits) drm/omap: fix unused variable warning. drm: hdlcd: Add information about the underlying framebuffers in debugfs drm: hdlcd: Cleanup the atomic plane operations drm/hdlcd: Fix up crtc_state->event handling drm: hdlcd: Revamp runtime power management drm/mediatek: mtk_dsi: Remove spurious drm_connector_unregister drm/mediatek: mtk_dpi: remove invalid error message drm: atmel-hlcdc: fix a NULL check drm: atmel-hlcdc: fix atmel_hlcdc_crtc_reset() implementation drm/mgag200: Black screen fix for G200e rev 4 drm: Wrap direct calls to driver->gem_free_object from CMA drm: fix fb refcount issue with atomic modesetting drm: make drm_atomic_set_mode_prop_for_crtc() more reliable drm/sti: remove extra mode fixup drm: add missing drm_mode_set_crtcinfo call drm/omap: include gpio/consumer.h where needed drm/omap: include linux/seq_file.h where needed Revert "drm/omap: no need to select OMAP2_DSS" drm/omap: Remove regulator API abuse OMAPDSS: HDMI5: Change DDC timings ...
2016-06-04Merge tag 'vfio-v4.7-rc2' of git://github.com/awilliam/linux-vfioLinus Torvalds3-5/+6
Pull VFIO fixes from Alex Williamson: "Fix irqfd shutdown ordering, build warning, and VPD short read" * tag 'vfio-v4.7-rc2' of git://github.com/awilliam/linux-vfio: vfio/pci: Allow VPD short read vfio/type1: Fix build warning vfio/pci: Fix ordering of eventfd vs virqfd shutdown
2016-06-04Merge tag 'mmc-v4.7-rc1-2' of git://git.linaro.org/people/ulf.hansson/mmcLinus Torvalds2-9/+4
Pull MMC fixes from Ulf Hansson: "MMC core: - Fix/restore behaviour when selecting bus width for (e)MMC MMC host: - sunxi: Fix eMMC HS-DDR modes on Allwinner A80" * tag 'mmc-v4.7-rc1-2' of git://git.linaro.org/people/ulf.hansson/mmc: mmc: sunxi: Re-enable eMMC HS-DDR modes on Allwinner A80 mmc: sunxi: Fix DDR MMC timings for A80 mmc: fix mmc mode selection for HS-DDR and higher
2016-06-04Merge branch 'for-linus-4.7' of ↵Linus Torvalds8-18/+103
git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs Pull btrfs fixes from Chris Mason: "The important part of this pull is Filipe's set of fixes for btrfs device replacement. Filipe fixed a few issues seen on the list and a number he found on his own" * 'for-linus-4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: Btrfs: deal with duplciates during extent_map insertion in btrfs_get_extent Btrfs: fix race between device replace and read repair Btrfs: fix race between device replace and discard Btrfs: fix race between device replace and chunk allocation Btrfs: fix race setting block group back to RW mode during device replace Btrfs: fix unprotected assignment of the left cursor for device replace Btrfs: fix race setting block group readonly during device replace Btrfs: fix race between device replace and block group removal Btrfs: fix race between readahead and device replace/removal
Powered by cgit, Gruvboxed by Blaster4385.