aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-11-14Merge branch 'efi-urgent-for-linus' of ↵Linus Torvalds2-24/+58
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Ingo Molnar: "A boot crash fix and a build warning fix" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/efi: Prevent mixed mode boot corruption with CONFIG_VMAP_STACK=y x86/efi: Fix EFI memmap pointer size warning
2016-11-14Merge tag 'ntb-4.9' of git://github.com/jonmason/ntbLinus Torvalds4-12/+15
Pull NTB fixes from Jon Mason: "NTB bug fixes for ntb_hw_intel, ntb_perf, and ntb_pingpong. Also, a fixup to use jiffies in schedule_timeout_* call instead of a constant" * tag 'ntb-4.9' of git://github.com/jonmason/ntb: ntb_perf: potential info leak in debugfs ntb: ntb_hw_intel: init peer_addr in struct intel_ntb_dev ntb: make DMA_OUT_RESOURCE_TO HZ independent ntb_transport: make DMA_OUT_RESOURCE_TO HZ independent NTB: ntb_hw_intel: Fix typo in module parameter descriptions ntb_pingpong: Fix db_init parameter description
2016-11-14sunrpc: svc_age_temp_xprts_now should not call setsockopt non-tcp transportsScott Mayhew4-10/+29
This fixes the following panic that can occur with NFSoRDMA. general protection fault: 0000 [#1] SMP Modules linked in: rpcrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp scsi_tgt ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm mlx5_ib ib_core intel_powerclamp coretemp kvm_intel kvm sg ioatdma ipmi_devintf ipmi_ssif dcdbas iTCO_wdt iTCO_vendor_support pcspkr irqbypass sb_edac shpchp dca crc32_pclmul ghash_clmulni_intel edac_core lpc_ich aesni_intel lrw gf128mul glue_helper ablk_helper mei_me mei ipmi_si cryptd wmi ipmi_msghandler acpi_pad acpi_power_meter nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt ahci fb_sys_fops ttm libahci mlx5_core tg3 crct10dif_pclmul drm crct10dif_common ptp i2c_core libata crc32c_intel pps_core fjes dm_mirror dm_region_hash dm_log dm_mod CPU: 1 PID: 120 Comm: kworker/1:1 Not tainted 3.10.0-514.el7.x86_64 #1 Hardware name: Dell Inc. PowerEdge R320/0KM5PX, BIOS 2.4.2 01/29/2015 Workqueue: events check_lifetime task: ffff88031f506dd0 ti: ffff88031f584000 task.ti: ffff88031f584000 RIP: 0010:[<ffffffff8168d847>] [<ffffffff8168d847>] _raw_spin_lock_bh+0x17/0x50 RSP: 0018:ffff88031f587ba8 EFLAGS: 00010206 RAX: 0000000000020000 RBX: 20041fac02080072 RCX: ffff88031f587fd8 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 20041fac02080072 RBP: ffff88031f587bb0 R08: 0000000000000008 R09: ffffffff8155be77 R10: ffff880322a59b00 R11: ffffea000bf39f00 R12: 20041fac02080072 R13: 000000000000000d R14: ffff8800c4fbd800 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff880322a40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3c52d4547e CR3: 00000000019ba000 CR4: 00000000001407e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Stack: 20041fac02080002 ffff88031f587bd0 ffffffff81557830 20041fac02080002 ffff88031f587c78 ffff88031f587c40 ffffffff8155ae08 000000010157df32 0000000800000001 ffff88031f587c20 ffffffff81096acb ffffffff81aa37d0 Call Trace: [<ffffffff81557830>] lock_sock_nested+0x20/0x50 [<ffffffff8155ae08>] sock_setsockopt+0x78/0x940 [<ffffffff81096acb>] ? lock_timer_base.isra.33+0x2b/0x50 [<ffffffff8155397d>] kernel_setsockopt+0x4d/0x50 [<ffffffffa0386284>] svc_age_temp_xprts_now+0x174/0x1e0 [sunrpc] [<ffffffffa03b681d>] nfsd_inetaddr_event+0x9d/0xd0 [nfsd] [<ffffffff81691ebc>] notifier_call_chain+0x4c/0x70 [<ffffffff810b687d>] __blocking_notifier_call_chain+0x4d/0x70 [<ffffffff810b68b6>] blocking_notifier_call_chain+0x16/0x20 [<ffffffff815e8538>] __inet_del_ifa+0x168/0x2d0 [<ffffffff815e8cef>] check_lifetime+0x25f/0x270 [<ffffffff810a7f3b>] process_one_work+0x17b/0x470 [<ffffffff810a8d76>] worker_thread+0x126/0x410 [<ffffffff810a8c50>] ? rescuer_thread+0x460/0x460 [<ffffffff810b052f>] kthread+0xcf/0xe0 [<ffffffff810b0460>] ? kthread_create_on_node+0x140/0x140 [<ffffffff81696418>] ret_from_fork+0x58/0x90 [<ffffffff810b0460>] ? kthread_create_on_node+0x140/0x140 Code: ca 75 f1 5d c3 0f 1f 80 00 00 00 00 eb d9 66 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 53 48 89 fb e8 7e 04 a0 ff b8 00 00 02 00 <f0> 0f c1 03 89 c2 c1 ea 10 66 39 c2 75 03 5b 5d c3 83 e2 fe 0f RIP [<ffffffff8168d847>] _raw_spin_lock_bh+0x17/0x50 RSP <ffff88031f587ba8> Signed-off-by: Scott Mayhew <[email protected]> Fixes: c3d4879e ("sunrpc: Add a function to close temporary transports immediately") Reviewed-by: Chuck Lever <[email protected]> Signed-off-by: J. Bruce Fields <[email protected]>
2016-11-14dmaengine: cpp41: Fix handling of error pathTony Lindgren1-2/+9
If we return early on pm_runtime_get() error, we need to also call pm_runtime_put_noidle() as pointed out in a musb related thread by Johan Hovold <[email protected]>. This is to keep the PM runtime use counts happy. Fixes: fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support") Cc: Johan Hovold <[email protected]> Signed-off-by: Tony Lindgren <[email protected]> Signed-off-by: Vinod Koul <[email protected]>
2016-11-14dmaengine: cppi41: Fix unpaired pm runtime when only a USB hub is connectedTony Lindgren1-2/+8
On am335x with musb host we can end up with unpaired pm runtime calls if a hub with no devices is connected and disconnected. This is because of the conditional pm runtime calls which are always a bad idea. Let's fix the issue by making them unconditional and paired in each function. Fixes: fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support") Signed-off-by: Tony Lindgren <[email protected]> Signed-off-by: Vinod Koul <[email protected]>
2016-11-14dmaengine: cppi41: Fix list not empty warning on module removalTony Lindgren1-0/+5
If musb controller is configured with USB peripherals and we have enumerated with a USB host, we can get warnings on removal of the modules: WARNING: CPU: 0 PID: 1269 at drivers/dma/cppi41.c:391 cppi41_dma_free_chan_resources Fix the issue by adding the missing pm_runtime_get to cppi41_dma_free_chan_resources to make sure the pending work list is cleared on removal. Fixes: fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support") Signed-off-by: Tony Lindgren <[email protected]> Signed-off-by: Vinod Koul <[email protected]>
2016-11-14dmaengine: sun6i: fix the uninitialized value for v_lliAxl-zhang1-1/+1
dma_pool_alloc does not initialize the value of the newly allocated block for the v_lli, and the uninitilize value make the tests failed which is on pine64 with dmatest. we can fix it just change the "|=" to "=" for the v_lli->cfg. Signed-off-by: Hao Zhang <[email protected]> Acked-by: Maxime Ripard <[email protected]> Signed-off-by: Vinod Koul <[email protected]>
2016-11-14nvmet-rdma: drain the queue-pair just before freeing itSagi Grimberg1-1/+1
draining the qp right after disconnect might not suffice because the nvmet sq is not fully drained (in nvmet_sq_destroy) and we might see completions after the drain. Instead, drain right before the qp destroy which comes after the sq destruction and we can be sure that no posts come after the drain. Tested-by: Steve Wise <[email protected]> Signed-off-by: Sagi Grimberg <[email protected]>
2016-11-14nvme-rdma: stop and free io queues on connect failureSteve Wise1-2/+9
While testing nvme-rdma with the spdk nvmf target over iw_cxgb4, I configured the target (mistakenly) to generate an error creating the NVMF IO queues. This resulted a "Invalid SQE Parameter" error sent back to the host on the first IO queue connect: [ 9610.928182] nvme nvme1: queue_size 128 > ctrl maxcmd 120, clamping down [ 9610.938745] nvme nvme1: creating 32 I/O queues. So nvmf_connect_io_queue() returns an error to nvmf_connect_io_queue() / nvmf_connect_io_queues(), and that is returned to nvme_rdma_create_io_queues(). In the error path, nvmf_rdma_create_io_queues() frees the queue tagset memory _before_ stopping and freeing the IB queues, which causes yet another touch-after-free crash due to SQ CQEs being flushed after the ib_cqe structs pointed-to by the flushed WRs have been freed (since they are part of the nvme_rdma_request struct). The fix is to stop and free the queues in nvmf_connect_io_queues() if there is an error connecting any of the queues. Signed-off-by: Steve Wise <[email protected]> Signed-off-by: Sagi Grimberg <[email protected]>
2016-11-14nvmet-rdma: don't forget to delete a queue from the list of connection failedSagi Grimberg1-1/+7
In case we accepted a queue connection and it failed, we might not remove the queue from the list until we unload and clean it up. We should delete it from the queue list on the relevant handler. Signed-off-by: Sagi Grimberg <[email protected]>
2016-11-14nvmet: Don't queue fatal error work if csts.cfs is setSagi Grimberg1-3/+7
In the transport, in case of an interal queue error like error completion in rdma we trigger a fatal error. However, multiple queues in the same controller can serr error completions and we don't want to trigger fatal error work more than once. Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Sagi Grimberg <[email protected]>
2016-11-14nvme-rdma: reject non-connect commands before the queue is liveChristoph Hellwig1-1/+30
If we reconncect we might have command queue up that get resent as soon as the queue is restarted. But until the connect command succeeded we can't send other command. Add a new flag that marks a queue as live when connect finishes, and delay any non-connect command until the queue is live based on it. Signed-off-by: Christoph Hellwig <[email protected]> Reported-by: Steve Wise <[email protected]> Tested-by: Steve Wise <[email protected]> [sagig: fixes admin queue LIVE setting] Signed-off-by: Sagi Grimberg <[email protected]>
2016-11-14nvmet-rdma: Fix possible NULL deref when handling rdma cm eventsBart Van Assche1-1/+7
When we initiate queue teardown sequence we call rdma_destroy_qp which clears cm_id->qp, afterwards we call rdma_destroy_id, but we might see a rdma_cm event in between with a cleared cm_id->qp so watch out for that and silently ignore the event because this means that the queue teardown sequence is in progress. Signed-off-by: Bart Van Assche <[email protected]> Signed-off-by: Sagi Grimberg <[email protected]>
2016-11-13ntb_perf: potential info leak in debugfsDan Carpenter1-3/+3
This is a static checker warning, not something I'm desperately concerned about. But snprintf() returns the number of bytes that would have been copied if there were space. We really care about the number of bytes that actually were copied so we should use scnprintf() instead. It probably won't overrun, and in that case we may as well just use sprintf() but these sorts of things make static checkers and code reviewers happier. Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Dave Jiang <[email protected]> Signed-off-by: Jon Mason <[email protected]>
2016-11-13ntb: ntb_hw_intel: init peer_addr in struct intel_ntb_devDave Jiang1-0/+3
The peer_addr member of intel_ntb_dev is not set, therefore when acquiring ntb_peer_db and ntb_peer_spad we only get the offset rather than the actual physical address. Adding fix to correct that. Signed-off-by: Dave Jiang <[email protected]> Acked-by: Allen Hubbe <[email protected]> Signed-off-by: Jon Mason <[email protected]>
2016-11-13ntb: make DMA_OUT_RESOURCE_TO HZ independentNicholas Mc Guire1-1/+1
schedule_timeout_* takes a timeout in jiffies but the code currently is passing in a constant which makes this timeout HZ dependent, so pass it through msecs_to_jiffies() to fix this up. Signed-off-by: Nicholas Mc Guire <[email protected]> Acked-by: Dave Jiang <[email protected]> Signed-off-by: Jon Mason <[email protected]>
2016-11-13ntb_transport: make DMA_OUT_RESOURCE_TO HZ independentNicholas Mc Guire1-1/+1
schedule_timeout_* takes a timeout in jiffies but the code currently is passing in a constant which makes this timeout HZ dependent, so pass it through msecs_to_jiffies() to fix this up. Signed-off-by: Nicholas Mc Guire <[email protected]> Signed-off-by: Jon Mason <[email protected]>
2016-11-13NTB: ntb_hw_intel: Fix typo in module parameter descriptionsWei Yongjun1-6/+6
Fix typo in module parameter descriptions. Signed-off-by: Wei Yongjun <[email protected]> Acked-by: Allen Hubbe <[email protected]> Signed-off-by: Jon Mason <[email protected]>
2016-11-13ntb_pingpong: Fix db_init parameter descriptionWei Yongjun1-1/+1
Fix 'db_init' parameter description. Signed-off-by: Wei Yongjun <[email protected]> Acked-by: Allen Hubbe <[email protected]> Signed-off-by: Jon Mason <[email protected]>
2016-11-13net: ethernet: ixp4xx_eth: fix spelling mistake in debug messageColin Ian King1-2/+1
Trivial fix to spelling mistake "successed" to "succeeded" in debug message. Also unwrap multi-line literal string. Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13ibmvnic: Fix size of debugfs name bufferThomas Falcon1-1/+1
This mistake was causing debugfs directory creation failures when multiple ibmvnic devices were probed. Signed-off-by: Thomas Falcon <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13ibmvnic: Unmap ibmvnic_statistics structureThomas Falcon1-0/+3
This structure was mapped but never subsequently unmapped. Signed-off-by: Thomas Falcon <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13sfc: clear napi_hash state when copying channelsBert Kenward1-0/+3
efx_copy_channel() doesn't correctly clear the napi_hash related state. This means that when napi_hash_add is called for that channel nothing is done, and we are left with a copy of the napi_hash_node from the old channel. When we later call napi_hash_del() on this channel we have a stale napi_hash_node. Corruption is only seen when there are multiple entries in one of the napi_hash lists. This is made more likely by having a very large number of channels. Testing was carried out with 512 channels - 32 channels on each of 16 ports. This failure typically appears as protection faults within napi_by_id() or napi_hash_add(). efx_copy_channel() is only used when tx or rx ring sizes are changed (ethtool -G). Fixes: 36763266bbe8 ("sfc: Add support for busy polling") Signed-off-by: Bert Kenward <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13Linux 4.9-rc5Linus Torvalds1-1/+1
2016-11-13Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds12-23/+112
Pull KVM fixes from Paolo Bonzini: "ARM fixes. There are a couple pending x86 patches but they'll have to wait for next week" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: arm/arm64: vgic: Kick VCPUs when queueing already pending IRQs KVM: arm/arm64: vgic: Prevent access to invalid SPIs arm/arm64: KVM: Perform local TLB invalidation when multiplexing vcpus on a single CPU
2016-11-13Merge branch 'media-fixes' (patches from Mauro)Linus Torvalds14-249/+310
Merge media fixes from Mauro Carvalho Chehab: "This contains two patches fixing problems with my patch series meant to make USB drivers to work again after the DMA on stack changes. The last patch on this series is actually not related to DMA on stack. It solves a longstanding bug affecting module unload, causing module_put() to be called twice. It was reported by the user who reported and tested the issues with the gp8psk driver with the DMA fixup patches. As we're late at -rc cycle, maybe you prefer to not apply it right now. If this is the case, I'll add to the pile of patches for 4.10. Exceptionally this time, I'm sending the patches via e-mail, because I'm on another trip, and won't be able to use the usual procedure until Monday. Also, it is only three patches, and you followed already the discussions about the first one" * emailed patches from Mauro Carvalho Chehab <[email protected]>: gp8psk: Fix DVB frontend attach gp8psk: fix gp8psk_usb_in_op() logic dvb-usb: move data_mutex to struct dvb_usb_device
2016-11-13Merge tag 'char-misc-4.9-rc5' of ↵Linus Torvalds4-6/+3
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are three small driver fixes for some reported issues for 4.9-rc5. One for the hyper-v subsystem, fixing up a naming issue that showed up in 4.9-rc1, one mei driver fix, and one fix for parallel ports, resolving a reported regression. All have been in linux-next with no reported issues" * tag 'char-misc-4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: ppdev: fix double-free of pp->pdev->name vmbus: make sysfs names consistent with PCI mei: bus: fix received data size check in NFC fixup
2016-11-13Merge tag 'driver-core-4.9-rc5' of ↵Linus Torvalds1-2/+3
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are two driver core fixes for 4.9-rc5. The first resolves an issue with some drivers not liking to be unbound and bound again (if CONFIG_DEBUG_TEST_DRIVER_REMOVE is enabled), which solves some reported problems with graphics and storage drivers. The other resolves a smatch error with the 4.9-rc1 driver core changes around this feature. Both have been in linux-next with no reported issues" * tag 'driver-core-4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: driver core: fix smatch warning on dev->bus check driver core: skip removal test for non-removable drivers
2016-11-13Merge tag 'staging-4.9-rc5' of ↵Linus Torvalds10-53/+63
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging/IIO fixes from Grek KH: "Here are a few small staging and iio driver fixes for reported issues. The last one was cherry-picked from my -next branch to resolve a build warning that Arnd fixed, in his quest to be able to turn -Wmaybe-uninitialized back on again. That patch, and all of the others, have been in linux-next for a while with no reported issues" * tag 'staging-4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: iio: maxim_thermocouple: detect invalid storage size in read() staging: nvec: remove managed resource from PS2 driver Revert "staging: nvec: ps2: change serio type to passthrough" drivers: staging: nvec: remove bogus reset command for PS/2 interface staging: greybus: arche-platform: fix device reference leak staging: comedi: ni_tio: fix buggy ni_tio_clock_period_ps() return value staging: sm750fb: Fix bugs introduced by early commits iio: hid-sensors: Increase the precision of scale to fix wrong reading interpretation. iio: orientation: hid-sensor-rotation: Add PM function (fix non working driver) iio: st_sensors: fix scale configuration for h3lis331dl staging: iio: ad5933: avoid uninitialized variable in error case
2016-11-13Merge tag 'usb-4.9-rc5' of ↵Linus Torvalds13-37/+42
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / PHY fixes from Greg KH: "Here are a number of small USB and PHY driver fixes for 4.9-rc5 Nothing major, just small fixes for reported issues, all of these have been in linux-next for a while with no reported issues" * tag 'usb-4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: cdc-acm: fix TIOCMIWAIT cdc-acm: fix uninitialized variable drivers/usb: Skip auto handoff for TI and RENESAS usb controllers usb: musb: remove duplicated actions usb: musb: da8xx: Don't print phy error on -EPROBE_DEFER phy: sun4i: check PMU presence when poking unknown bit of pmu phy-rockchip-pcie: remove deassert of phy_rst from exit callback phy: da8xx-usb: rename the ohci device to ohci-da8xx phy: Add reset callback for not generic phy uwb: fix device reference leaks usb: gadget: u_ether: remove interrupt throttling usb: dwc3: st: add missing <linux/pinctrl/consumer.h> include usb: dwc3: Fix error handling for core init
2016-11-13Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds2-42/+1
Pull more block fixes from Jens Axboe: "Since I mistakenly left out the lightnvm regression fix yesterday and the aoeblk seems adequately tested at this point, might as well send out another pull to make -rc5" * 'for-linus' of git://git.kernel.dk/linux-block: aoe: fix crash in page count manipulation lightnvm: invalid offset calculation for lba_shift
2016-11-13Merge tag 'scsi-fixes' of ↵Linus Torvalds7-8/+29
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "The megaraid_sas patch in here fixes a major regression in the last fix set that made all megaraid_sas cards unusable. It turns out no-one had actually tested such an "obvious" fix, sigh. The fix for the fix has been tested ... The next most serious is the vmw_pvscsi abort problem which basically means that aborts don't work on the vmware paravirt devices and error handling always escalates to reset. The rest are an assortment of missed reference counting in certain paths and corner case bugs that show up on some architectures" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression scsi: qla2xxx: fix invalid DMA access after command aborts in PCI device remove scsi: qla2xxx: do not queue commands when unloading scsi: libcxgbi: fix incorrect DDP resource cleanup scsi: qla2xxx: Fix scsi scan hang triggered if adapter fails during init scsi: scsi_dh_alua: Fix a reference counting bug scsi: vmw_pvscsi: return SUCCESS for successful command aborts scsi: mpt3sas: Fix for block device of raid exists even after deleting raid disk scsi: scsi_dh_alua: fix missing kref_put() in alua_rtpg_work()
2016-11-13Merge tag 'clk-fixes-for-linus' of ↵Linus Torvalds8-29/+37
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "The typical collection of minor bug fixes in clk drivers. We don't have anything in the core framework here, just driver fixes. There's a boot fix for Samsung devices and a safety measure for qoriq to prevent CPUs from running too fast. There's also a fix for i.MX6Q to properly handle audio clock rates. We also have some "that's obviously wrong" fixes like bad NULL pointer checks in the MPP driver and a poor usage of __pa in the xgene clk driver that are fixed here" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: mmp: pxa910: fix return value check in pxa910_clk_init() clk: mmp: pxa168: fix return value check in pxa168_clk_init() clk: mmp: mmp2: fix return value check in mmp2_clk_init() clk: qoriq: Don't allow CPU clocks higher than starting value clk: imx: fix integer overflow in AV PLL round rate clk: xgene: Don't call __pa on ioremaped address clk/samsung: Use CLK_OF_DECLARE_DRIVER initialization method for CLKOUT clk: rockchip: don't return NULL when failing to register ddrclk branch
2016-11-13gp8psk: Fix DVB frontend attachMauro Carvalho Chehab7-152/+246
The DVB binding schema at the DVB core assumes that the frontend is a separate driver. Faling to do that causes OOPS when the module is removed, as it tries to do a symbol_put_addr on an internal symbol, causing craches like: WARNING: CPU: 1 PID: 28102 at kernel/module.c:1108 module_put+0x57/0x70 Modules linked in: dvb_usb_gp8psk(-) dvb_usb dvb_core nvidia_drm(PO) nvidia_modeset(PO) snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd soundcore nvidia(PO) [last unloaded: rc_core] CPU: 1 PID: 28102 Comm: rmmod Tainted: P WC O 4.8.4-build.1 #1 Hardware name: MSI MS-7309/MS-7309, BIOS V1.12 02/23/2009 Call Trace: dump_stack+0x44/0x64 __warn+0xfa/0x120 module_put+0x57/0x70 module_put+0x57/0x70 warn_slowpath_null+0x23/0x30 module_put+0x57/0x70 gp8psk_fe_set_frontend+0x460/0x460 [dvb_usb_gp8psk] symbol_put_addr+0x27/0x50 dvb_usb_adapter_frontend_exit+0x3a/0x70 [dvb_usb] From Derek's tests: "Attach bug is fixed, tuning works, module unloads without crashing. Everything seems ok!" Reported-by: Derek <[email protected]> Tested-by: Derek <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-11-13gp8psk: fix gp8psk_usb_in_op() logicMauro Carvalho Chehab1-2/+3
Commit bc29131ecb10 ("[media] gp8psk: don't do DMA on stack") fixed the usage of DMA on stack, but the memcpy was wrong for gp8psk_usb_in_op(). Fix it. From Derek's email: "Fix confirmed using 2 different Skywalker models with HD mpeg4, SD mpeg2." Suggested-by: Johannes Stezenbach <[email protected]> Fixes: bc29131ecb10 ("[media] gp8psk: don't do DMA on stack") Tested-by: Derek <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-11-13dvb-usb: move data_mutex to struct dvb_usb_deviceMauro Carvalho Chehab7-95/+61
The data_mutex is initialized too late, as it is needed for each device driver's power control, causing an OOPS: dvb-usb: found a 'TerraTec/qanu USB2.0 Highspeed DVB-T Receiver' in warm state. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff846617af>] __mutex_lock_slowpath+0x6f/0x100 PGD 0 Oops: 0002 [#1] SMP Modules linked in: dvb_usb_cinergyT2(+) dvb_usb CPU: 0 PID: 2029 Comm: modprobe Not tainted 4.9.0-rc4-dvbmod #24 Hardware name: FUJITSU LIFEBOOK A544/FJNBB35 , BIOS Version 1.17 05/09/2014 task: ffff88020e943840 task.stack: ffff8801f36ec000 RIP: 0010:[<ffffffff846617af>] [<ffffffff846617af>] __mutex_lock_slowpath+0x6f/0x100 RSP: 0018:ffff8801f36efb10 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88021509bdc8 RCX: 00000000c0000100 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff88021509bdcc RBP: ffff8801f36efb58 R08: ffff88021f216320 R09: 0000000000100000 R10: ffff88021f216320 R11: 00000023fee6c5a1 R12: ffff88020e943840 R13: ffff88021509bdcc R14: 00000000ffffffff R15: ffff88021509bdd0 FS: 00007f21adb86740(0000) GS:ffff88021f200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000215bce000 CR4: 00000000001406f0 Call Trace: mutex_lock+0x16/0x25 cinergyt2_power_ctrl+0x1f/0x60 [dvb_usb_cinergyT2] dvb_usb_device_init+0x21e/0x5d0 [dvb_usb] cinergyt2_usb_probe+0x21/0x50 [dvb_usb_cinergyT2] usb_probe_interface+0xf3/0x2a0 driver_probe_device+0x208/0x2b0 __driver_attach+0x87/0x90 driver_probe_device+0x2b0/0x2b0 bus_for_each_dev+0x52/0x80 bus_add_driver+0x1a3/0x220 driver_register+0x56/0xd0 usb_register_driver+0x77/0x130 do_one_initcall+0x46/0x180 free_vmap_area_noflush+0x38/0x70 kmem_cache_alloc+0x84/0xc0 do_init_module+0x50/0x1be load_module+0x1d8b/0x2100 find_symbol_in_section+0xa0/0xa0 SyS_finit_module+0x89/0x90 entry_SYSCALL_64_fastpath+0x13/0x94 Code: e8 a7 1d 00 00 8b 03 83 f8 01 0f 84 97 00 00 00 48 8b 43 10 4c 8d 7b 08 48 89 63 10 4c 89 3c 24 41 be ff ff ff ff 48 89 44 24 08 <48> 89 20 4c 89 64 24 10 eb 1a 49 c7 44 24 08 02 00 00 00 c6 43 RIP [<ffffffff846617af>] __mutex_lock_slowpath+0x6f/0x100 RSP <ffff8801f36efb10> CR2: 0000000000000000 So, move it to the struct dvb_usb_device and initialize it before calling the driver's callbacks. Reported-by: Jörg Otte <[email protected]> Tested-by: Jörg Otte <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-11-13Merge branch 'mlxsw-fixes'David S. Miller2-2/+24
Jiri Pirko says: ==================== mlxsw: Couple of fixes Please, queue-up both for stable. Thanks! ==================== Signed-off-by: David S. Miller <[email protected]>
2016-11-13mlxsw: spectrum_router: Correctly dump neighbour activityArkadi Sharshevsky1-1/+21
The device's neighbour table is periodically dumped in order to update the kernel about active neighbours. A single dump session may span multiple queries, until the response carries less records than requested or when a record (can contain up to four neighbour entries) is not full. Current code stops the session when the number of returned records is zero, which can result in infinite loop in case of high packet rate. Fix this by stopping the session according to the above logic. Fixes: c723c735fa6b ("mlxsw: spectrum_router: Periodically update the kernel's neigh table") Signed-off-by: Arkadi Sharshevsky <[email protected]> Signed-off-by: Ido Schimmel <[email protected]> Signed-off-by: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13mlxsw: spectrum: Fix refcount bug on span entriesYotam Gigi1-1/+3
When binding port to a newly created span entry, its refcount is initialized to zero even though it has a bound port. That leads to unexpected behaviour when the user tries to delete that port from the span entry. Fix this by initializing the reference count to 1. Also add a warning to put function. Fixes: 763b4b70afcd ("mlxsw: spectrum: Add support in matchall mirror TC offloading") Signed-off-by: Yotam Gigi <[email protected]> Reviewed-by: Ido Schimmel <[email protected]> Signed-off-by: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13Merge branch 'bnxt_en-fixes'David S. Miller2-7/+8
Michael Chan says: ==================== bnxt_en: 2 bug fixes. Bug fixes in bnxt_setup_tc() and VF vitual link state. ==================== Signed-off-by: David S. Miller <[email protected]>
2016-11-13bnxt_en: Fix VF virtual link state.Michael Chan1-2/+2
If the physical link is down and the VF virtual link is set to "enable", the current code does not always work. If the link is down but the cable is attached, the firmware returns LINK_SIGNAL instead of NO_LINK. The current code is treating LINK_SIGNAL as link up. The fix is to treat link as down when the link_status != LINK. Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13bnxt_en: Fix ring arithmetic in bnxt_setup_tc().Michael Chan1-5/+6
The logic is missing the check on whether the tx and rx rings are sharing completion rings or not. Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13Revert "include/uapi/linux/atm_zatm.h: include linux/time.h"Mike Frysinger1-1/+0
This reverts commit cf00713a655d ("include/uapi/linux/atm_zatm.h: include linux/time.h"). This attempted to fix userspace breakage that no longer existed when the patch was merged. Almost one year earlier, commit 70ba07b675b5 ("atm: remove 'struct zatm_t_hist'") deleted the struct in question. After this patch was merged, we now have to deal with people being unable to include this header in conjunction with standard C library headers like stdlib.h (which linux-atm does). Example breakage: x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../.. -I./../q2931 -I./../saal \ -I. -DCPPFLAGS_TEST -I../../src/include -O2 -march=native -pipe -g \ -frecord-gcc-switches -freport-bug -Wimplicit-function-declaration \ -Wnonnull -Wstrict-aliasing -Wparentheses -Warray-bounds \ -Wfree-nonheap-object -Wreturn-local-addr -fno-strict-aliasing -Wall \ -Wshadow -Wpointer-arith -Wwrite-strings -Wstrict-prototypes -c zntune.c In file included from /usr/include/linux/atm_zatm.h:17:0, from zntune.c:17: /usr/include/linux/time.h:9:8: error: redefinition of ‘struct timespec’ struct timespec { ^ In file included from /usr/include/sys/select.h:43:0, from /usr/include/sys/types.h:219, from /usr/include/stdlib.h:314, from zntune.c:9: /usr/include/time.h:120:8: note: originally defined here struct timespec ^ Signed-off-by: Mike Frysinger <[email protected]> Acked-by: Mikko Rapeli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13tcp: take care of truncations done by sk_filter()Eric Dumazet3-3/+23
With syzkaller help, Marco Grassi found a bug in TCP stack, crashing in tcp_collapse() Root cause is that sk_filter() can truncate the incoming skb, but TCP stack was not really expecting this to happen. It probably was expecting a simple DROP or ACCEPT behavior. We first need to make sure no part of TCP header could be removed. Then we need to adjust TCP_SKB_CB(skb)->end_seq Many thanks to syzkaller team and Marco for giving us a reproducer. Signed-off-by: Eric Dumazet <[email protected]> Reported-by: Marco Grassi <[email protected]> Reported-by: Vladis Dronov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13ipv4: use new_gw for redirect neigh lookupStephen Suryaputra Lin1-1/+3
In v2.6, ip_rt_redirect() calls arp_bind_neighbour() which returns 0 and then the state of the neigh for the new_gw is checked. If the state isn't valid then the redirected route is deleted. This behavior is maintained up to v3.5.7 by check_peer_redirect() because rt->rt_gateway is assigned to peer->redirect_learned.a4 before calling ipv4_neigh_lookup(). After commit 5943634fc559 ("ipv4: Maintain redirect and PMTU info in struct rtable again."), ipv4_neigh_lookup() is performed without the rt_gateway assigned to the new_gw. In the case when rt_gateway (old_gw) isn't zero, the function uses it as the key. The neigh is most likely valid since the old_gw is the one that sends the ICMP redirect message. Then the new_gw is assigned to fib_nh_exception. The problem is: the new_gw ARP may never gets resolved and the traffic is blackholed. So, use the new_gw for neigh lookup. Changes from v1: - use __ipv4_neigh_lookup instead (per Eric Dumazet). Fixes: 5943634fc559 ("ipv4: Maintain redirect and PMTU info in struct rtable again.") Signed-off-by: Stephen Suryaputra Lin <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13r8152: Fix error path in open functionGuenter Roeck1-7/+10
If usb_submit_urb() called from the open function fails, the following crash may be observed. r8152 8-1:1.0 eth0: intr_urb submit failed: -19 ... r8152 8-1:1.0 eth0: v1.08.3 Unable to handle kernel paging request at virtual address 6b6b6b6b6b6b6b7b pgd = ffffffc0e7305000 [6b6b6b6b6b6b6b7b] *pgd=0000000000000000, *pud=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP ... PC is at notifier_chain_register+0x2c/0x58 LR is at blocking_notifier_chain_register+0x54/0x70 ... Call trace: [<ffffffc0002407f8>] notifier_chain_register+0x2c/0x58 [<ffffffc000240bdc>] blocking_notifier_chain_register+0x54/0x70 [<ffffffc00026991c>] register_pm_notifier+0x24/0x2c [<ffffffbffc183200>] rtl8152_open+0x3dc/0x3f8 [r8152] [<ffffffc000808000>] __dev_open+0xac/0x104 [<ffffffc0008082f8>] __dev_change_flags+0xb0/0x148 [<ffffffc0008083c4>] dev_change_flags+0x34/0x70 [<ffffffc000818344>] do_setlink+0x2c8/0x888 [<ffffffc0008199d4>] rtnl_newlink+0x328/0x644 [<ffffffc000819e98>] rtnetlink_rcv_msg+0x1a8/0x1d4 [<ffffffc0008373c8>] netlink_rcv_skb+0x68/0xd0 [<ffffffc000817990>] rtnetlink_rcv+0x2c/0x3c [<ffffffc000836d1c>] netlink_unicast+0x16c/0x234 [<ffffffc00083720c>] netlink_sendmsg+0x340/0x364 [<ffffffc0007e85d0>] sock_sendmsg+0x48/0x60 [<ffffffc0007e9c30>] SyS_sendto+0xe0/0x120 [<ffffffc0007e9cb0>] SyS_send+0x40/0x4c [<ffffffc000203e34>] el0_svc_naked+0x24/0x28 Clean up error handling to avoid registering the notifier if the open function is going to fail. Signed-off-by: Guenter Roeck <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-13crypto: caam - do not register AES-XTS mode on LP unitsSven Ebenfeld1-0/+9
When using AES-XTS on a Wandboard, we receive a Mode error: caam_jr 2102000.jr1: 20001311: CCB: desc idx 19: AES: Mode error. According to the Security Reference Manual, the Low Power AES units of the i.MX6 do not support the XTS mode. Therefore we must not register XTS implementations in the Crypto API. Signed-off-by: Sven Ebenfeld <[email protected]> Reviewed-by: Horia Geantă <[email protected]> Cc: <[email protected]> # 4.4+ Fixes: c6415a6016bf "crypto: caam - add support for acipher xts(aes)" Signed-off-by: Herbert Xu <[email protected]>
2016-11-13iio: maxim_thermocouple: detect invalid storage size in read()Arnd Bergmann1-0/+2
As found by gcc -Wmaybe-uninitialized, having a storage_bytes value other than 2 or 4 will result in undefined behavior: drivers/iio/temperature/maxim_thermocouple.c: In function 'maxim_thermocouple_read': drivers/iio/temperature/maxim_thermocouple.c:141:5: error: 'ret' may be used uninitialized in this function [-Werror=maybe-uninitialized] This probably cannot happen, but returning -EINVAL here is appropriate and makes gcc happy and the code more robust. Fixes: 231147ee77f3 ("iio: maxim_thermocouple: Align 16 bit big endian value of raw reads") Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Jonathan Cameron <[email protected]> (cherry picked from commit 32cb7d27e65df9daa7cee8f1fdf7b259f214bee2) Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-11-13x86/efi: Prevent mixed mode boot corruption with CONFIG_VMAP_STACK=yMatt Fleming1-23/+57
Booting an EFI mixed mode kernel has been crashing since commit: e37e43a497d5 ("x86/mm/64: Enable vmapped stacks (CONFIG_HAVE_ARCH_VMAP_STACK=y)") The user-visible effect in my test setup was the kernel being unable to find the root file system ramdisk. This was likely caused by silent memory or page table corruption. Enabling CONFIG_DEBUG_VIRTUAL=y immediately flagged the thunking code as abusing virt_to_phys() because it was passing addresses that were not part of the kernel direct mapping. Use the slow version instead, which correctly handles all memory regions by performing a page table walk. Suggested-by: Andy Lutomirski <[email protected]> Signed-off-by: Matt Fleming <[email protected]> Cc: Andy Lutomirski <[email protected]> Cc: Ard Biesheuvel <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Brian Gerst <[email protected]> Cc: Denys Vlasenko <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Josh Poimboeuf <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: [email protected] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
2016-11-13x86/efi: Fix EFI memmap pointer size warningBorislav Petkov1-1/+1
Fix this when building on 32-bit: arch/x86/platform/efi/efi.c: In function ‘__efi_enter_virtual_mode’: arch/x86/platform/efi/efi.c:911:5: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] (efi_memory_desc_t *)pa); ^ arch/x86/platform/efi/efi.c:918:5: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] (efi_memory_desc_t *)pa); ^ The @pa local variable is declared as phys_addr_t and that is a u64 when CONFIG_PHYS_ADDR_T_64BIT=y. (The last is enabled on 32-bit on a PAE build.) However, its value comes from __pa() which is basically doing pointer arithmetic and checking, and returns unsigned long as it is the native pointer width. So let's use an unsigned long too. It should be fine to do so because the later users cast it to a pointer too. Signed-off-by: Borislav Petkov <[email protected]> Signed-off-by: Matt Fleming <[email protected]> Cc: Andy Lutomirski <[email protected]> Cc: Ard Biesheuvel <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Brian Gerst <[email protected]> Cc: Denys Vlasenko <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Josh Poimboeuf <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: [email protected] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.