aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-04-18net: sctp: cache auth_enable per endpointVlad Yasevich7-60/+92
Currently, it is possible to create an SCTP socket, then switch auth_enable via sysctl setting to 1 and crash the system on connect: Oops[#1]: CPU: 0 PID: 0 Comm: swapper Not tainted 3.14.1-mipsgit-20140415 #1 task: ffffffff8056ce80 ti: ffffffff8055c000 task.ti: ffffffff8055c000 [...] Call Trace: [<ffffffff8043c4e8>] sctp_auth_asoc_set_default_hmac+0x68/0x80 [<ffffffff8042b300>] sctp_process_init+0x5e0/0x8a4 [<ffffffff8042188c>] sctp_sf_do_5_1B_init+0x234/0x34c [<ffffffff804228c8>] sctp_do_sm+0xb4/0x1e8 [<ffffffff80425a08>] sctp_endpoint_bh_rcv+0x1c4/0x214 [<ffffffff8043af68>] sctp_rcv+0x588/0x630 [<ffffffff8043e8e8>] sctp6_rcv+0x10/0x24 [<ffffffff803acb50>] ip6_input+0x2c0/0x440 [<ffffffff8030fc00>] __netif_receive_skb_core+0x4a8/0x564 [<ffffffff80310650>] process_backlog+0xb4/0x18c [<ffffffff80313cbc>] net_rx_action+0x12c/0x210 [<ffffffff80034254>] __do_softirq+0x17c/0x2ac [<ffffffff800345e0>] irq_exit+0x54/0xb0 [<ffffffff800075a4>] ret_from_irq+0x0/0x4 [<ffffffff800090ec>] rm7k_wait_irqoff+0x24/0x48 [<ffffffff8005e388>] cpu_startup_entry+0xc0/0x148 [<ffffffff805a88b0>] start_kernel+0x37c/0x398 Code: dd0900b8 000330f8 0126302d <dcc60000> 50c0fff1 0047182a a48306a0 03e00008 00000000 ---[ end trace b530b0551467f2fd ]--- Kernel panic - not syncing: Fatal exception in interrupt What happens while auth_enable=0 in that case is, that ep->auth_hmacs is initialized to NULL in sctp_auth_init_hmacs() when endpoint is being created. After that point, if an admin switches over to auth_enable=1, the machine can crash due to NULL pointer dereference during reception of an INIT chunk. When we enter sctp_process_init() via sctp_sf_do_5_1B_init() in order to respond to an INIT chunk, the INIT verification succeeds and while we walk and process all INIT params via sctp_process_param() we find that net->sctp.auth_enable is set, therefore do not fall through, but invoke sctp_auth_asoc_set_default_hmac() instead, and thus, dereference what we have set to NULL during endpoint initialization phase. The fix is to make auth_enable immutable by caching its value during endpoint initialization, so that its original value is being carried along until destruction. The bug seems to originate from the very first days. Fix in joint work with Daniel Borkmann. Reported-by: Joshua Kinard <kumba@gentoo.org> Signed-off-by: Vlad Yasevich <vyasevic@redhat.com> Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Tested-by: Joshua Kinard <kumba@gentoo.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-18Merge branch 'for-davem' of ↵David S. Miller18-132/+258
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless John W. Linville says: ==================== pull request: wireless 2014-04-17 Please pull this batch of fixes intended for the 3.15 stream... For the mac80211 bits, Johannes says: "We have a fix from Chun-Yeow to not look at management frame bitrates that are typically really low, two fixes from Felix for AP_VLAN interfaces, a fix from Ido to disable SMPS settings when a monitor interface is enabled, a radar detection fix from Michał and a fix from myself for a very old remain-on-channel bug." For the iwlwifi bits, Emmanuel says: "I have new device IDs and a new firmware API. These are the trivial ones. The less trivial ones are Johannes's fix that delays the enablement of an interrupt coalescing hardware until after association - this fixes a few connection problems seen in the field. Eyal has a bunch of rate control fixes. I decided to add these for 3.15 because they fix some disconnection and packet loss scenarios which were reported by the field. I also have a fix for a memory leak that happens only with a very new NIC." Along with those... Amitkumar Karwar fixes a couple of problems relating to driver/firmware interactions in mwifiex. Christian Engelmayer avoids a couple of potential memory leaks in the new rsi driver. Eliad Peller provides a wl18xx mailbox alignment fix for problems when using new firmware. Frederic Danis adds a couple of missing debugging strings to the cw1200 driver. Geert Uytterhoeven adds a variable initialization inside of the rsi driver. Luciano Coelho patches the wlcore code to ignore dummy packet events in PLT mode in order to work around a firmware bug. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-18tg3: update rx_jumbo_pending ring param only when jumbo frames are enabledIvan Vecera1-1/+3
The patch fixes a problem with dropped jumbo frames after usage of 'ethtool -G ... rx'. Scenario: 1. ip link set eth0 up 2. ethtool -G eth0 rx N # <- This zeroes rx-jumbo 3. ip link set mtu 9000 dev eth0 The ethtool command set rx_jumbo_pending to zero so any received jumbo packets are dropped and you need to use 'ethtool -G eth0 rx-jumbo N' to workaround the issue. The patch changes the logic so rx_jumbo_pending value is changed only if jumbo frames are enabled (MTU > 1500). Signed-off-by: Ivan Vecera <ivecera@redhat.com> Acked-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-18vlan: Fix lockdep warning when vlan dev handle notificationdingtianhong2-5/+42
When I open the LOCKDEP config and run these steps: modprobe 8021q vconfig add eth2 20 vconfig add eth2.20 30 ifconfig eth2 xx.xx.xx.xx then the Call Trace happened: [32524.386288] ============================================= [32524.386293] [ INFO: possible recursive locking detected ] [32524.386298] 3.14.0-rc2-0.7-default+ #35 Tainted: G O [32524.386302] --------------------------------------------- [32524.386306] ifconfig/3103 is trying to acquire lock: [32524.386310] (&vlan_netdev_addr_lock_key/1){+.....}, at: [<ffffffff814275f4>] dev_mc_sync+0x64/0xb0 [32524.386326] [32524.386326] but task is already holding lock: [32524.386330] (&vlan_netdev_addr_lock_key/1){+.....}, at: [<ffffffff8141af83>] dev_set_rx_mode+0x23/0x40 [32524.386341] [32524.386341] other info that might help us debug this: [32524.386345] Possible unsafe locking scenario: [32524.386345] [32524.386350] CPU0 [32524.386352] ---- [32524.386354] lock(&vlan_netdev_addr_lock_key/1); [32524.386359] lock(&vlan_netdev_addr_lock_key/1); [32524.386364] [32524.386364] *** DEADLOCK *** [32524.386364] [32524.386368] May be due to missing lock nesting notation [32524.386368] [32524.386373] 2 locks held by ifconfig/3103: [32524.386376] #0: (rtnl_mutex){+.+.+.}, at: [<ffffffff81431d42>] rtnl_lock+0x12/0x20 [32524.386387] #1: (&vlan_netdev_addr_lock_key/1){+.....}, at: [<ffffffff8141af83>] dev_set_rx_mode+0x23/0x40 [32524.386398] [32524.386398] stack backtrace: [32524.386403] CPU: 1 PID: 3103 Comm: ifconfig Tainted: G O 3.14.0-rc2-0.7-default+ #35 [32524.386409] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 [32524.386414] ffffffff81ffae40 ffff8800d9625ae8 ffffffff814f68a2 ffff8800d9625bc8 [32524.386421] ffffffff810a35fb ffff8800d8a8d9d0 00000000d9625b28 ffff8800d8a8e5d0 [32524.386428] 000003cc00000000 0000000000000002 ffff8800d8a8e5f8 0000000000000000 [32524.386435] Call Trace: [32524.386441] [<ffffffff814f68a2>] dump_stack+0x6a/0x78 [32524.386448] [<ffffffff810a35fb>] __lock_acquire+0x7ab/0x1940 [32524.386454] [<ffffffff810a323a>] ? __lock_acquire+0x3ea/0x1940 [32524.386459] [<ffffffff810a4874>] lock_acquire+0xe4/0x110 [32524.386464] [<ffffffff814275f4>] ? dev_mc_sync+0x64/0xb0 [32524.386471] [<ffffffff814fc07a>] _raw_spin_lock_nested+0x2a/0x40 [32524.386476] [<ffffffff814275f4>] ? dev_mc_sync+0x64/0xb0 [32524.386481] [<ffffffff814275f4>] dev_mc_sync+0x64/0xb0 [32524.386489] [<ffffffffa0500cab>] vlan_dev_set_rx_mode+0x2b/0x50 [8021q] [32524.386495] [<ffffffff8141addf>] __dev_set_rx_mode+0x5f/0xb0 [32524.386500] [<ffffffff8141af8b>] dev_set_rx_mode+0x2b/0x40 [32524.386506] [<ffffffff8141b3cf>] __dev_open+0xef/0x150 [32524.386511] [<ffffffff8141b177>] __dev_change_flags+0xa7/0x190 [32524.386516] [<ffffffff8141b292>] dev_change_flags+0x32/0x80 [32524.386524] [<ffffffff8149ca56>] devinet_ioctl+0x7d6/0x830 [32524.386532] [<ffffffff81437b0b>] ? dev_ioctl+0x34b/0x660 [32524.386540] [<ffffffff814a05b0>] inet_ioctl+0x80/0xa0 [32524.386550] [<ffffffff8140199d>] sock_do_ioctl+0x2d/0x60 [32524.386558] [<ffffffff81401a52>] sock_ioctl+0x82/0x2a0 [32524.386568] [<ffffffff811a7123>] do_vfs_ioctl+0x93/0x590 [32524.386578] [<ffffffff811b2705>] ? rcu_read_lock_held+0x45/0x50 [32524.386586] [<ffffffff811b39e5>] ? __fget_light+0x105/0x110 [32524.386594] [<ffffffff811a76b1>] SyS_ioctl+0x91/0xb0 [32524.386604] [<ffffffff815057e2>] system_call_fastpath+0x16/0x1b ======================================================================== The reason is that all of the addr_lock_key for vlan dev have the same class, so if we change the status for vlan dev, the vlan dev and its real dev will hold the same class of addr_lock_key together, so the warning happened. we should distinguish the lock depth for vlan dev and its real dev. v1->v2: Convert the vlan_netdev_addr_lock_key to an array of eight elements, which could support to add 8 vlan id on a same vlan dev, I think it is enough for current scene, because a netdev's name is limited to IFNAMSIZ which could not hold 8 vlan id, and the vlan dev would not meet the same class key with its real dev. The new function vlan_dev_get_lockdep_subkey() will return the subkey and make the vlan dev could get a suitable class key. v2->v3: According David's suggestion, I use the subclass to distinguish the lock key for vlan dev and its real dev, but it make no sense, because the difference for subclass in the lock_class_key doesn't mean that the difference class for lock_key, so I use lock_depth to distinguish the different depth for every vlan dev, the same depth of the vlan dev could have the same lock_class_key, I import the MAX_LOCK_DEPTH from the include/linux/sched.h, I think it is enough here, the lockdep should never exceed that value. v3->v4: Add a huge array of locking keys will waste static kernel memory and is not a appropriate method, we could use _nested() variants to fix the problem, calculate the depth for every vlan dev, and use the depth as the subclass for addr_lock_key. Signed-off-by: Ding Tianhong <dingtianhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-18Merge tag 'rdma-for-linus' of ↵Linus Torvalds15-125/+270
git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband Pull infiniband/rdma updates from Roland Dreier: - mostly cxgb4 fixes unblocked by the merge of some prerequisites via the net tree - drop deprecated MSI-X API use. - a couple other miscellaneous things. * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: RDMA/cxgb4: Fix over-dereference when terminating RDMA/cxgb4: Use uninitialized_var() RDMA/cxgb4: Add missing debug stats RDMA/cxgb4: Initialize reserved fields in a FW work request RDMA/cxgb4: Use pr_warn_ratelimited RDMA/cxgb4: Max fastreg depth depends on DSGL support RDMA/cxgb4: SQ flush fix RDMA/cxgb4: rmb() after reading valid gen bit RDMA/cxgb4: Endpoint timeout fixes RDMA/cxgb4: Use the BAR2/WC path for kernel QPs and T5 devices IB/mlx5: Add block multicast loopback support IB/mthca: Use pci_enable_msix_exact() instead of pci_enable_msix() IB/qib: Use pci_enable_msix_range() instead of pci_enable_msix()
2014-04-18ARC: Delete stale barrier.hVineet Gupta1-37/+0
Commit 93ea02bb8435 ("arch: Clean up asm/barrier.h implementations") wired generic barrier.h for ARC, but failed to delete the existing file. In 3.15, due to rcupdate.h updates, this causes a build breakage on ARC: CC arch/arc/kernel/asm-offsets.s In file included from include/linux/sched.h:45:0, from arch/arc/kernel/asm-offsets.c:9: include/linux/rculist.h: In function __list_add_rcu: include/linux/rculist.h:54:2: error: implicit declaration of function smp_store_release [-Werror=implicit-function-declaration] rcu_assign_pointer(list_next_rcu(prev), new); ^ Cc: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Vineet Gupta <vgupta@synopsys.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-18Merge tag 'pci-v3.15-fixes-1' of ↵Linus Torvalds4-13/+32
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI updates from Bjorn Helgaas: "These are fixes for a powerpc NULL pointer dereference, an OF interrupt mapping issue on some of the new host bridges, and a DesignWare iATU issue. Host bridge drivers - Fix OF interrupt mapping for DesignWare, R-Car, Tegra (Lucas Stach) - Fix DesignWare iATU programming (Mohit Kumar) Miscellaneous - Fix powerpc NULL dereference from list_for_each_entry() update (Mike Qiu)" * tag 'pci-v3.15-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: tegra: Use new OF interrupt mapping when possible PCI: rcar: Use new OF interrupt mapping when possible PCI: designware: Use new OF interrupt mapping when possible PCI: designware: Fix iATU programming for cfg1, io and mem viewport PCI: designware: Fix comment for setting number of lanes powerpc/PCI: Fix NULL dereference in sys_pciconfig_iobase() list traversal
2014-04-18Merge branch 'for-linus' of ↵Linus Torvalds5-13/+10
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: - fix for merge window mismerge in hid-sony, from Frank Praznik - fix for Surface Type/Touch Cover 2 device, from Benjamin Tissoires - quirk for ThinkPad Helix sensor hub from Stephen Chandler Paul * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: core: do not scan constant input report Revert "HID: microsoft: Add ID's for Surface Type/Touch Cover 2" HID: sensor-hub: add sensor hub quirk for ThinkPad Helix HID: sony: Fix cancel_work_sync mismerge
2014-04-18Merge tag 'sound-3.15-rc2' of ↵Linus Torvalds2-5/+10
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Just a copule of HD-audio device/codec-specific quirks, and a trivial replacement of udelay() with mdelay() in the old es18xx driver code. All should be safe to apply" * tag 'sound-3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek - Add headset Mic support for Dell machine ALSA: hda - add headset mic detect quirk for a Dell laptop ALSA: es18xx driver should use udelay error ALSA: hda/realtek - Add support of ALC288 codec
2014-04-18Merge tag 'dt-fixes-for-3.15' of ↵Linus Torvalds6-9/+139
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - fix error handling in of_update_property - fix section mismatch warnings in __reserved_mem_check_root - add empty of_find_node_by_path for !OF builds - add various missing binding documentation * tag 'dt-fixes-for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of: add empty of_find_node_by_path() for !OF of: Clean up of_update_property DT: add vendor prefix for EBV Elektronik of: Fix the section mismatch warnings. of: Add vendor prefix for Digi International Inc. DT: I2C: Add trivial bindings used by kirkwood boards DT: Vendor: Add prefixes used by Kirkwood devices DT: bindings: add missing Marvell Kirkwood SoC documentation dt-bindings: add vendor-prefix for Newhaven Display of: add vendor prefix for I2SE GmbH of: add vendor prefix for ISEE 2007 S.L.
2014-04-18Merge tag 'xfs-for-linus-3.15-rc2' of git://oss.sgi.com/xfs/xfsLinus Torvalds10-33/+147
Pull xfs bug fixes from Dave Chinner: "The fixes are for data corruption issues, memory corruption and regressions for changes merged in -rc1. Data corruption fixes: - fix a bunch of delayed allocation state mismatches - fix collapse/zero range bugs - fix a direct IO block mapping bug @ EOF Other fixes: - fix a use after free on metadata IO error - fix a use after free on IO error during unmount - fix an incorrect error sign on direct IO write errors - add missing O_TMPFILE inode security context initialisation" * tag 'xfs-for-linus-3.15-rc2' of git://oss.sgi.com/xfs/xfs: xfs: fix tmpfile/selinux deadlock and initialize security xfs: fix buffer use after free on IO error xfs: wrong error sign conversion during failed DIO writes xfs: unmount does not wait for shutdown during unmount xfs: collapse range is delalloc challenged xfs: don't map ranges that span EOF for direct IO xfs: zeroing space needs to punch delalloc blocks xfs: xfs_vm_write_end truncates too much on failure xfs: write failure beyond EOF truncates too much data xfs: kill buffers over failed write ranges properly
2014-04-18Merge tag 'trace-fixes-v3.15-rc1' of ↵Linus Torvalds2-6/+16
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "This contains two fixes. The first is to remove a duplication of creating debugfs files that already exist and causes an error report to be printed due to the failure of the second creation. The second is a memory leak fix that was introduced in 3.14" * tag 'trace-fixes-v3.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing/uprobes: Fix uprobe_cpu_buffer memory leak tracing: Do not try to recreated toplevel set_ftrace_* files
2014-04-18of: add empty of_find_node_by_path() for !OFAlexander Shiyan1-0/+5
Add an empty version of of_find_node_by_path(). This fixes following build error for asoc tree: sound/soc/fsl/fsl_ssi.c: In function 'fsl_ssi_probe': sound/soc/fsl/fsl_ssi.c:1471:2: error: implicit declaration of function 'of_find_node_by_path' [-Werror=implicit-function-declaration] sprop = of_get_property(of_find_node_by_path("/"), "compatible", NULL); Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Alexander Shiyan <shc_work@mail.ru> Signed-off-by: Rob Herring <robh@kernel.org>
2014-04-18perf/x86/intel: Use rdmsrl_safe() when initializing RAPL PMUVenkatesh Srinivas1-3/+9
CPUs which should support the RAPL counters according to Family/Model/Stepping may still issue #GP when attempting to access the RAPL MSRs. This may happen when Linux is running under KVM and we are passing-through host F/M/S data, for example. Use rdmsrl_safe to first access the RAPL_POWER_UNIT MSR; if this fails, do not attempt to use this PMU. Signed-off-by: Venkatesh Srinivas <venkateshs@google.com> Signed-off-by: Peter Zijlstra <peterz@infradead.org> Link: http://lkml.kernel.org/r/1394739386-22260-1-git-send-email-venkateshs@google.com Cc: zheng.z.yan@intel.com Cc: eranian@google.com Cc: ak@linux.intel.com Cc: linux-kernel@vger.kernel.org [ The patch also silently fixes another bug: rapl_pmu_init() didn't handle the memory alloc failure case previously. ] Signed-off-by: Ingo Molnar <mingo@kernel.org>
2014-04-18drm: bochs: drop unused struct fieldsGerd Hoffmann2-3/+0
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-04-18drm: bochs: add power management supportGerd Hoffmann2-0/+45
bochs kms driver lacks power management support, thus the vga display doesn't work any more after S3 resume. Fix this by adding suspend and resume functions. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-04-18drm: cirrus: add power management supportGerd Hoffmann2-0/+45
cirrus kms driver lacks power management support, thus the vga display doesn't work any more after S3 resume. Fix this by adding suspend and resume functions. Also make the mode_set function unblank the screen. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-04-18drm: Split out drm_probe_helper.c from drm_crtc_helper.cDaniel Vetter5-372/+437
This is leftover stuff from my previous doc round which I kinda wanted to do but didn't yet due to rebase hell. The modeset helpers and the probing helpers a independent and e.g. i915 uses the probing stuff but has its own modeset infrastructure. It hence makes to split this up. While at it add a DOC: comment for the probing libraray. It would be rather neat to pull some of the DocBook documenting these two helpers into in-line DOC: comments. But unfortunately kerneldoc doesn't support markdown or something similar to make nice-looking documentation, so the current state is better. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-04-18drm/plane-helper: Don't fake-implement primary plane disablingDaniel Vetter1-28/+5
After thinking about this topic a bit more I've reached the conclusion that implementing this doesn't make sense: - The locking is all wrong: set_config(NULL) will also unlink encoders and connectors, but those links are protected with the mode_config mutex. In the ->disable_plane callback we only hold all modeset locks, but eventually we want to switch to just grabbing the per-crtc (and maybe per-plane) locks as needed, maybe based on ww_mutexes. Having a callback which absolutely needs all modeset locks is bad for this conversion. Note that the same isn't true for the provided ->update_plane since we've audited the crtc helpers to make sure that not encoder or connector links are changed. - There's no way to re-enable the plane with an ->update_plane: The connectors/encoder links are lost and so we can't re-enable the CRTC. Even without that issue the driver might have reassigned some shared resources (as opposed to e.g. DPMS off, where drivers are not allowed to do that to make sure the CRTC can be enabled again). - The semantics don't make much sense: Userspace asked to scan out black (or some other color if the driver supports a background color), not that the screen be disabled. - Implementing proper primary plane support (i.e. actually disabling the primary plane without disabling the CRTC) is really simple, at least if all the hw needs is flipping a bit. The big task is auditing all the interactions with other ioctls when the CRTC is on but there's no primary plane (e.g. pageflips). And some of that work still needs to be done. Cc: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-04-18drm/ast: fix value check in cbr_scan2Dave Airlie1-1/+1
this is a typo vs the ums driver, fix to check correct value. Found initially by Coverity. Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-04-18drm/nouveau/bios: fix a bit shift error introduced by 457e77bSergei Antonov1-1/+1
Commit 457e77b26428ab4a24998eecfb99f27fa4195397 added two checks applied to a value received from nv_rd32(bios, 0x619f04). But after this new piece of code is executed, the addr local variable does not hold the same value it used to hold before the commit. Here is what is was assigned in the original code: (u64)(nv_rd32(bios, 0x619f04) & 0xffffff00) << 8 in the committed code it ends up with this value: (u64)(nv_rd32(bios, 0x619f04) >> 8) << 8 These expressions are obviously not equivalent. My Nvidia video card does not show anything on the display when I boot a kernel containing this commit. The patch fixes the code so that the new checks are still done, but the side effect of an incorrect addr value is gone. Cc: Ben Skeggs <bskeggs@redhat.com> Cc: Dave Airlie <airlied@redhat.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sergei Antonov <saproj@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-04-18Merge tag 'omapdrm-fixes-3.15' of ↵Dave Airlie7-42/+133
git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux into drm-next Fixes for omapdrm, some of which were already present in 3.14, and some which appeared in 3.15-rc1: - fixes for primary-plane handling which caused crashes - fix all kinds of uninit issues which prevented from unloading the omapdrm module. - fixes for HDMI enable/disable issues * tag 'omapdrm-fixes-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: drm/omap: fix the handling of fb ref counts drm/omap: protect omap_crtc's event with event_lock spinlock drm/omap: Use old_fb to synchronize between successive page flips drm/omap: Fix crash when using LCD3 overlay manager drm/omap: gem sync: wait on correct events drm/omap: Fix memory leak in omap_gem_op_async drm/omap: remove warn from debugfs drm/omap: remove extra plane->destroy from crtc destroy drm/omap: print warning when rotating non-TILER fb drm/omap: fix missing unref to fb's buf object drm/omap: fix plane rotation drm/omap: fix enabling/disabling of video pipeline drm/omap: fix missing disable for unused encoder drm/omap: fix race issue when unloading omapdrm drm/omap: fix DMM driver (un)registration drm/omap: fix uninit order in pdev_remove() drm/omap: fix output enable/disable sequence
2014-04-18Merge branch 'drm-fixes-3.15' of ↵Dave Airlie12-78/+115
git://people.freedesktop.org/~deathsimple/linux into drm-next 1. Fixing PLL regressions 2. A couple of memory reclocking and DPM fixes 3. Small cleanups * 'drm-fixes-3.15' of git://people.freedesktop.org/~deathsimple/linux: drm/radeon/ci: make sure mc ucode is loaded before checking the size drm/radeon/si: make sure mc ucode is loaded before checking the size drm/radeon: improve PLL params if we don't match exactly v2 drm/radeon: memory leak on bo reservation failure. v2 drm/radeon: fix VCE fence command drm/radeon: re-enable mclk dpm on R7 260X asics drm/radeon: add support for newer mc ucode on CI (v2) drm/radeon: add support for newer mc ucode on SI (v2) drm/radeon: apply more strict limits for PLL params v2 drm/radeon: update CI DPM powertune settings drm/radeon: fix runpm handling on APUs (v4) drm/radeon: disable mclk dpm on R7 260X
2014-04-18Merge tag 'drm/tegra/for-3.15-rc2' of ↵Dave Airlie2-3/+2
git://anongit.freedesktop.org/tegra/linux into drm-next drm/tegra: Fixes for v3.15-rc2 This contains a fix for the host1x driver writing to non-existent syncpt registers. A second commit removes an excess pad field in the parameter structure for the DRM_TEGRA_SUBMIT IOCTL. Archeaology on earlier versions of this file indicates that this was once there to pad an uneven number of u32 u32 fields, of which one was subsequently removed. Unfortunately nobody remembered to get rid of the padding when that happened. Both of these commits are Cc: stable because they fix issues that were introduced back in v3.10. * tag 'drm/tegra/for-3.15-rc2' of git://anongit.freedesktop.org/tegra/linux: drm/tegra: Remove gratuitous pad field gpu: host1x: handle the correct # of syncpt regs
2014-04-17Merge branch 'timers-urgent-for-linus' of ↵Linus Torvalds2-2/+5
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Thomas Gleixner: "Viresh unearthed the following three hickups in the timer/timekeeping code: - Negated check for the result of a clock event selection - A missing early exit in the jiffies update path which causes update_wall_time to be called for nothing causing lock contention and wasted cycles in the timer interrupt - Checking a variable in the NOHZ code enable code for true which can only be set by that very code after the check succeeds. That results in a rock solid runtime disablement of that feature" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tick-sched: Check tick_nohz_enabled in tick_nohz_switch_to_nohz() tick-sched: Don't call update_wall_time() when delta is lesser than tick_period tick-common: Fix wrong check in tick_check_replacement()
2014-04-17Merge branch 'parisc-3.15' of ↵Linus Torvalds6-14/+14
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "There are two major changes in this patchset: The major fix is that the epoll_pwait() syscall for 32bit userspace was not using the compat wrapper on a 64bit kernel. Secondly we changed the value of SHMLBA from 4MB to PAGE_SIZE to reflect that we can actually mmap to any multiple of PAGE_SIZE. The only thing which needs care is that shared mmaps need to be mapped at the same offset inside the 4MB cache window" * 'parisc-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: fix epoll_pwait syscall on compat kernel parisc: change value of SHMLBA from 0x00400000 to PAGE_SIZE parisc: Replace __get_cpu_var uses for address calculation
2014-04-17Merge branch 'ipmi' (emailed ipmi fixes)Linus Torvalds7-155/+261
Merge ipmi fixes from Corey Minyard: "Things collected since last kernel release. Some of these are pretty important. The first three are bug fixes. The next two are to hopefully make everyone happy about allowing ACPI to be on all the time and not have IPMI have an effect on the system when not in use. The last is a little cleanup" * emailed patches from Corey Minyard <cminyard@mvista.com>: ipmi: boolify some things ipmi: Turn off all activity on an idle ipmi interface ipmi: Turn off default probing of interfaces ipmi: Reset the KCS timeout when starting error recovery ipmi: Fix a race restarting the timer Char: ipmi_bt_sm, fix infinite loop
2014-04-17ipmi: boolify some thingsCorey Minyard3-40/+38
Convert some ints to bools. Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-17ipmi: Turn off all activity on an idle ipmi interfaceCorey Minyard4-97/+182
The IPMI driver would wake up periodically looking for events and watchdog pretimeouts. If there is nothing waiting for these events, it's really kind of pointless to be checking for them. So modify the driver so the message handler can pass down if it needs the lower layer to be waiting for these. Modify the system interface lower layer to turn off all timer and thread activity if the upper layer doesn't need anything and it is not currently handling messages. And modify the message handler to not restart the timer if its timer is not needed. The timers and kthread will still be enabled if: - the SI interface is handling a message. - a user has enabled watching for events. - the IPMI watchdog timer is in use (since it uses pretimeouts). - the message handler is waiting on a remote response. - a user has registered to receive commands. This mostly affects interfaces without interrupts. Interfaces with interrupts already don't use CPU in the system interface when the interface is idle. Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-17ipmi: Turn off default probing of interfacesCorey Minyard2-1/+13
The default probing can cause problems with some system, slow booting, extra CPU usages, etc. Turn it off by default and give a config option to enable it. From: Matthew Garrett <matthew.garrett@nebula.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-17ipmi: Reset the KCS timeout when starting error recoveryCorey Minyard1-2/+3
The OBF timer in KCS was not reset in one situation when error recovery was started, resulting in an immediate timeout. Reported-by: Bodo Stroesser <bstroesser@ts.fujitsu.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-17ipmi: Fix a race restarting the timerBodo Stroesser1-18/+28
With recent changes it is possible for the timer handler to detect an idle interface and not start the timer, but the thread to start an operation at the same time. The thread will not start the timer in that instance, resulting in the timer not running. Instead, move all timer operations under the lock and start the timer in the thread if it detect non-idle and the timer is not already running. Moving under locks allows the last timeout to be set in both the thread and the timer. 'Timer is not running' means that the timer is not pending and smi_timeout() is not running. So we need a flag to detect this correctly. Also fix a few other timeout bugs: setting the last timeout when the interrupt has to be disabled and the timer started, and setting the last timeout in check_start_timer_thread possibly racing with the timer Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-17Char: ipmi_bt_sm, fix infinite loopJiri Slaby1-1/+1
In read_all_bytes, we do unsigned char i; ... bt->read_data[0] = BMC2HOST; bt->read_count = bt->read_data[0]; ... for (i = 1; i <= bt->read_count; i++) bt->read_data[i] = BMC2HOST; If bt->read_data[0] == bt->read_count == 255, we loop infinitely in the 'for' loop. Make 'i' an 'int' instead of 'char' to get rid of the overflow and finish the loop after 255 iterations every time. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Reported-and-debugged-by: Rui Hui Dian <rhdian@novell.com> Cc: Tomas Cech <tcech@suse.cz> Cc: Corey Minyard <minyard@acm.org> Cc: <openipmi-developer@lists.sourceforge.net> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-17Merge tag 'stable/for-linus-3.15-rc1-tag' of ↵Linus Torvalds7-16/+98
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull Xen fixes from David Vrabel: "Xen regression and bug fixes for 3.15-rc1: - fix completely broken 32-bit PV guests caused by x86 refactoring 32-bit thread_info. - only enable ticketlock slow path on Xen (not bare metal) - fix two bugs with PV guests not shutting down when requested - fix a minor memory leak in xen-pciback error path" * tag 'stable/for-linus-3.15-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/manage: Poweroff forcefully if user-space is not yet up. xen/xenbus: Avoid synchronous wait on XenBus stalling shutdown/restart. xen/spinlock: Don't enable them unconditionally. xen-pciback: silence an unwanted debug printk xen: fix memory leak in __xen_pcibk_add_pci_dev() x86/xen: Fix 32-bit PV guests's usage of kernel_stack
2014-04-17Merge tag '3.15-fixes' of git://neil.brown.name/mdLinus Torvalds1-2/+1
Pull md bugfix from Neil Brown: "One BUG fix for md for recent commit" * tag '3.15-fixes' of git://neil.brown.name/md: raid5: fix a race of stripe count check
2014-04-17Merge tag 'fbdev-reorder-3.15' of ↵Linus Torvalds482-2666/+2682
git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux Pull fbdev renaming patches from Tomi Valkeinen: "Reorder drivers/video/ directory so that all fbdev drivers are now located in drivers/video/fbdev/ and the fbdev framework core files are located in drivers/video/fbdev/core/ The drivers/video/Kconfig is modified so that the DRM and the fbdev menu options are in separate submenus, instead of both being mixed in the same 'Graphics support' menu level" * tag 'fbdev-reorder-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: video: Kconfig: move drm and fb into separate menus fbdev: move fbdev core files to separate directory video: move fbdev to drivers/video/fbdev
2014-04-17Revert "serial: 8250, disable "too much work" messages"Greg Kroah-Hartman1-1/+2
This reverts commit f4f653e9875e573860e783fecbebde284a8626f5. Jiri writes: No, please drop this one. We need a better solution as it turned out that some boxes need 16k loops and it will increase with new processors :(. Cc: Jiri Slaby <jslaby@suse.cz> Cc: Martin Pluskal <mpluskal@suse.com> Cc: Takashi Iwai <tiwai@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-17tracing/uprobes: Fix uprobe_cpu_buffer memory leakzhangwei(Jovi)1-0/+6
Forgot to free uprobe_cpu_buffer percpu page in uprobe_buffer_disable(). Link: http://lkml.kernel.org/p/534F8B3F.1090407@huawei.com Cc: stable@vger.kernel.org # v3.14+ Acked-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: zhangwei(Jovi) <jovi.zhangwei@huawei.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2014-04-17Merge branch 'master' of ↵John W. Linville18-132/+258
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2014-04-17drm/radeon/ci: make sure mc ucode is loaded before checking the sizeAlex Deucher1-1/+3
Avoid a possible segfault. Noticed-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-17drm/radeon/si: make sure mc ucode is loaded before checking the sizeAlex Deucher1-1/+3
Avoid a possible segfault. Noticed-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-17drm/radeon: improve PLL params if we don't match exactly v2Christian König1-6/+7
Otherwise we might be quite off on older chipsets. v2: keep ref_div minimum Signed-off-by: Christian König <christian.koenig@amd.com>
2014-04-17drm/radeon: memory leak on bo reservation failure. v2Quentin Casasnovas1-2/+7
On bo reservation failure, we end up leaking fpriv. v2 (chk): rebased and added missing free on vm failure as well Fixes: 5e386b574cf7e1 ("drm/radeon: fix missing bo reservation") Cc: stable@vger.kernel.org Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com> Signed-off-by: Christian König <christian.koenig@amd.com>
2014-04-17drm/radeon: fix VCE fence commandChristoph Jaeger1-1/+1
Due to a type mismatch that causes an implicit type conversion, the upper 32 bits of the GPU address have been zeroed out when adding to the command buffer. Picked up by Coverity - CID 1198624. Signed-off-by: Christoph Jaeger <christophjaeger@linux.com>
2014-04-17drm/radeon: re-enable mclk dpm on R7 260X asicsAlex Deucher1-2/+6
If the new mc ucode is available. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-17drm/radeon: add support for newer mc ucode on CI (v2)Alex Deucher2-10/+20
Fixes mclk stability on certain asics. v2: print out mc firmware version used and size bug: https://bugs.freedesktop.org/show_bug.cgi?id=75992 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-17drm/radeon: add support for newer mc ucode on SI (v2)Alex Deucher2-13/+25
May fix stability issues with some newer cards. v2: print out mc firmware version used and size Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-17drm/radeon: apply more strict limits for PLL params v2Christian König1-0/+3
Letting post and refernce divider get to big is bad for signal stability. v2: increase the limit to 210 Signed-off-by: Christian König <christian.koenig@amd.com>
2014-04-17drm/radeon: update CI DPM powertune settingsAlex Deucher1-12/+13
As per internal recommendations. Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-04-17drm/radeon: fix runpm handling on APUs (v4)Alex Deucher6-34/+27
Don't try and runtime suspend the APU in PX systems. We only want to power down the dGPU. v2: fix harder v3: fix stupid typo v4: consolidate runpm enablement to a single flag bugs: https://bugs.freedesktop.org/show_bug.cgi?id=75127 https://bugzilla.kernel.org/show_bug.cgi?id=72701 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
Powered by cgit, Gruvboxed by Blaster4385.