aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-01-20Merge tag 'arm64-fixes' of ↵Linus Torvalds6-11/+40
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - avoid potential stack information leak via the ptrace ABI caused by uninitialised variables - SWIOTLB DMA API fall-back allocation fix when the SWIOTLB buffer is not initialised (all RAM is suitable for 32-bit DMA masks) - fix the bad_mode function returning for unhandled exceptions coming from user space - fix name clash in __page_to_voff() * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: avoid returning from bad_mode arm64/ptrace: Reject attempts to set incomplete hardware breakpoint fields arm64/ptrace: Avoid uninitialised struct padding in fpr_set() arm64/ptrace: Preserve previous registers for short regset write arm64/ptrace: Preserve previous registers for short regset write arm64/ptrace: Preserve previous registers for short regset write arm64: mm: avoid name clash in __page_to_voff() arm64: Fix swiotlb fallback allocation
2017-01-20xen-netfront: Fix Rx stall during network stress and OOMVineeth Remanan Pillai1-1/+1
During an OOM scenario, request slots could not be created as skb allocation fails. So the netback cannot pass in packets and netfront wrongly assumes that there is no more work to be done and it disables polling. This causes Rx to stall. The issue is with the retry logic which schedules the timer if the created slots are less than NET_RX_SLOTS_MIN. The count of new request slots to be pushed are calculated as a difference between new req_prod and rsp_cons which could be more than the actual slots, if there are unconsumed responses. The fix is to calculate the count of newly created slots as the difference between new req_prod and old req_prod. Signed-off-by: Vineeth Remanan Pillai <[email protected]> Reviewed-by: Juergen Gross <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-20net/mlx5e: Do not recycle pages from emergency reserveEric Dumazet1-0/+3
A driver using dev_alloc_page() must not reuse a page allocated from emergency memory reserve. Otherwise all packets using this page will be immediately dropped, unless for very specific sockets having SOCK_MEMALLOC bit set. This issue might be hard to debug, because only a fraction of received packets would be dropped. Fixes: 4415a0319f92 ("net/mlx5e: Implement RX mapped page cache for page recycle") Signed-off-by: Eric Dumazet <[email protected]> Cc: Tariq Toukan <[email protected]> Cc: Saeed Mahameed <[email protected]> Acked-by: Saeed Mahameed <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-20bpf: fix samples xdp_tx_iptunnel and tc_l2_redirect with fake KBUILD_MODNAMEJesper Dangaard Brouer2-0/+2
Fix build errors for samples/bpf xdp_tx_iptunnel and tc_l2_redirect, when dynamic debugging is enabled (CONFIG_DYNAMIC_DEBUG) by defining a fake KBUILD_MODNAME. Just like Daniel Borkmann fixed other samples/bpf in commit 96a8eb1eeed2 ("bpf: fix samples to add fake KBUILD_MODNAME"). Fixes: 12d8bb64e3f6 ("bpf: xdp: Add XDP example for head adjustment") Fixes: 90e02896f1a4 ("bpf: Add test for bpf_redirect to ipip/ip6tnl") Signed-off-by: Jesper Dangaard Brouer <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-20Merge tag 'kvm-s390-master-4.10-1' of ↵Radim Krčmář1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux KVM: s390: Fix for 4.10 (via kvm/master) Fix a kernel memory exposure.
2017-01-20bcm63xx_enet: avoid uninitialized variable warningArnd Bergmann1-2/+4
gcc-7 and probably earlier versions get confused by this function and print a harmless warning: drivers/net/ethernet/broadcom/bcm63xx_enet.c: In function 'bcm_enet_open': drivers/net/ethernet/broadcom/bcm63xx_enet.c:1130:3: error: 'phydev' may be used uninitialized in this function [-Werror=maybe-uninitialized] This adds an initialization for the 'phydev' variable when it is unused and changes the check to test for that NULL pointer to make it clear that we always pass a valid pointer here. Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-20qed: avoid possible stack overflow in qed_ll2_acquire_connectionArnd Bergmann3-61/+53
struct qed_ll2_info is rather large, so putting it on the stack can cause an overflow, as this warning tries to tell us: drivers/net/ethernet/qlogic/qed/qed_ll2.c: In function 'qed_ll2_start': drivers/net/ethernet/qlogic/qed/qed_ll2.c:2159:1: error: the frame size of 1056 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] qed_ll2_start_ooo() already uses a dynamic allocation for the structure to work around that problem, and we could do the same in qed_ll2_start() as well as qed_roce_ll2_start(), but since the structure is only used to pass a couple of initialization values here, it seems nicer to replace it with a different structure. Lacking any idea for better naming, I'm adding 'struct qed_ll2_conn', which now contains all the initialization data, and this now simply gets copied into struct qed_ll2_info rather than assigning all members one by one. Signed-off-by: Arnd Bergmann <[email protected]> Acked-by: Yuval Mintz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-20Revert "net: sctp: fix array overrun read on sctp_timer_tbl"David S. Miller1-1/+1
This reverts commit 0e73fc9a56f22f2eec4d2b2910c649f7af67b74d. This fix wasn't correct, a better one is coming right up. Signed-off-by: David S. Miller <[email protected]>
2017-01-20net: sctp: fix array overrun read on sctp_timer_tblColin Ian King1-1/+1
The comparison on the timeout can lead to an array overrun read on sctp_timer_tbl because of an off-by-one error. Fix this by using < instead of <= and also compare to the array size rather than SCTP_EVENT_TIMEOUT_MAX. Fixes CoverityScan CID#1397639 ("Out-of-bounds read") Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-20ipv6: seg6_genl_set_tunsrc() must check kmemdup() return valueEric Dumazet1-0/+2
seg6_genl_get_tunsrc() and set_tun_src() do not handle tun_src being possibly NULL, so we must check kmemdup() return value and abort if it is NULL Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6") Signed-off-by: Eric Dumazet <[email protected]> Cc: David Lebrun <[email protected]> Acked-by: David Lebrun <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-20r8152: fix rtl8152_post_reset functionhayeswang1-0/+2
The rtl8152_post_reset() should sumbit rx urb and interrupt transfer, otherwise the rx wouldn't work and the linking change couldn't be detected. Signed-off-by: Hayes Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-20virtio-net: restore VIRTIO_HDR_F_DATA_VALID on receivingJason Wang5-6/+10
Commit 501db511397f ("virtio: don't set VIRTIO_NET_HDR_F_DATA_VALID on xmit") in fact disables VIRTIO_HDR_F_DATA_VALID on receiving path too, fixing this by adding a hint (has_data_valid) and set it only on the receiving path. Cc: Rolf Neugebauer <[email protected]> Signed-off-by: Jason Wang <[email protected]> Acked-by: Rolf Neugebauer <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-20KVM: s390: do not expose random data via facility bitmapChristian Borntraeger1-2/+2
kvm_s390_get_machine() populates the facility bitmap by copying bytes from the host results that are stored in a 256 byte array in the prefix page. The KVM code does use the size of the target buffer (2k), thus copying and exposing unrelated kernel memory (mostly machine check related logout data). Let's use the size of the source buffer instead. This is ok, as the target buffer will always be greater or equal than the source buffer as the KVM internal buffers (and thus S390_ARCH_FAC_LIST_SIZE_BYTE) cover the maximum possible size that is allowed by STFLE, which is 256 doublewords. All structures are zero allocated so we can leave bytes 256-2047 unchanged. Add a similar fix for kvm_arch_init_vm(). Reported-by: Heiko Carstens <[email protected]> [found with smatch] Signed-off-by: Christian Borntraeger <[email protected]> CC: [email protected] Acked-by: Cornelia Huck <[email protected]>
2017-01-20xhci: remove WARN_ON if dma mask is not set for platform devicesMathias Nyman1-1/+1
The warn on is a bit too much, we will anyway set the dma mask if not set previously. The main reason for this fix is that 4.10-rc1 has a dwc3 change that pass a parent sysdev dev pointer instead of setting the dma mask of its xhci platform device. xhci platform driver can then get more attributes from the sysdev than just the dma mask. The usb core and xhci changes are not yet in 4.10, and a fix like this was preferred instead of taking those big changes this late in the rc-cycle. Signed-off-by: Mathias Nyman <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-01-20swiotlb-xen: update dev_addr after swapping pagesStefano Stabellini1-2/+3
In xen_swiotlb_map_page and xen_swiotlb_map_sg_attrs, if the original page is not suitable, we swap it for another page from the swiotlb pool. In these cases, we don't update the previously calculated dma address for the page before calling xen_dma_map_page. Thus, we end up calling xen_dma_map_page passing the wrong dev_addr, resulting in xen_dma_map_page mistakenly assuming that the page is foreign when it is local. Fix the bug by updating dev_addr appropriately. This change has no effect on x86, because xen_dma_map_page is a stub there. Signed-off-by: Stefano Stabellini <[email protected]> Signed-off-by: Pooya Keshavarzi <[email protected]> Tested-by: Pooya Keshavarzi <[email protected]> Reviewed-by: Boris Ostrovsky <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2017-01-20Merge branches 'thermal-core' and 'thermal-soc' into for-rcZhang Rui1-53/+100
2017-01-20drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablementAndrzej Hajda1-0/+2
DECON_TV requires STANDALONE_UPDATE after output enabling, otherwise it does not start. This change is neutral for DECON. Signed-off-by: Andrzej Hajda <[email protected]> Signed-off-by: Inki Dae <[email protected]>
2017-01-20drm/exynos/decon5433: fix CMU programmingAndrzej Hajda1-4/+0
DECON_CMU register has reserved bits which should not be zeroed, otherwise IP can behave strangely and cause IOMMU faults. Signed-off-by: Andrzej Hajda <[email protected]> Signed-off-by: Inki Dae <[email protected]>
2017-01-20drm/exynos/decon5433: do not disable video after resetAndrzej Hajda1-2/+0
decon_commit is called just after reset so video is disabled anyway. Signed-off-by: Andrzej Hajda <[email protected]> Signed-off-by: Inki Dae <[email protected]>
2017-01-20powerpc: Ignore reserved field in DCSR and PVR reads and writesAnton Blanchard1-5/+5
IBM bit 31 (for the rest of us - bit 0) is a reserved field in the instruction definition of mtspr and mfspr. Hardware is encouraged to (and does) ignore it. As a result, if userspace executes an mtspr DSCR with the reserved bit set, we get a DSCR facility unavailable exception. The kernel fails to match against the expected value/mask, and we silently return to userspace to try and re-execute the same mtspr DSCR instruction. We loop forever until the process is killed. We should do something here, and it seems mirroring what hardware does is the better option vs killing the process. While here, relax the matching of mfspr PVR too. Cc: [email protected] Signed-off-by: Anton Blanchard <[email protected]> Signed-off-by: Michael Ellerman <[email protected]>
2017-01-20powerpc/ptrace: Preserve previous TM fprs/vsrs on short regset writeDave Martin1-0/+7
Ensure that if userspace supplies insufficient data to PTRACE_SETREGSET to fill all the check pointed registers, the thread's old check pointed registers are preserved. Fixes: 9d3918f7c0e5 ("powerpc/ptrace: Enable support for NT_PPC_CVSX") Fixes: 19cbcbf75a0c ("powerpc/ptrace: Enable support for NT_PPC_CFPR") Cc: [email protected] # v4.8+ Signed-off-by: Dave Martin <[email protected]> Signed-off-by: Michael Ellerman <[email protected]>
2017-01-20powerpc/ptrace: Preserve previous fprs/vsrs on short regset writeDave Martin1-0/+7
Ensure that if userspace supplies insufficient data to PTRACE_SETREGSET to fill all the registers, the thread's old registers are preserved. Fixes: c6e6771b87d4 ("powerpc: Introduce VSX thread_struct and CONFIG_VSX") Cc: [email protected] # v2.6.27+ Signed-off-by: Dave Martin <[email protected]> Signed-off-by: Michael Ellerman <[email protected]>
2017-01-20ACPICA: Tables: Fix hidden logic related to acpi_tb_install_standard_table()Lv Zheng2-9/+17
There is a hidden logic for acpi_tb_install_standard_table() as it can be invoked from the boot stage and during runtime. 1. When it is invoked from the OS boot stage, the ACPICA mutex may not have been initialized yet and so acpi_ut_acquire_mutex()/acpi_ut_release_mutex() are not invoked in these code paths: acpi_initialize_tables acpi_tb_parse_root_table acpi_tb_install_standard_table (4 invocations) acpi_install_table acpi_tb_install_standard_table 2. When it is invoked during the runtime, ACPICA mutex is used as appropriate: acpi_ex_load_op acpi_tb_install_and_load_table acpi_tb_install_standard_table acpi_load_table acpi_tb_install_and_load_table acpi_tb_install_standard_table The mutex is now used in acpi_tb_install_and_load_table(), while it actually should be in acpi_tb_install_standard_table(). This introduces another problem in acpi_tb_install_standard_table() where acpi_gbl_table_handler is invoked from and the lock contexts are thus not consistent for the table handlers. This triggers a regression when acpi_get_table()/acpi_put_table() start to hold table mutex during runtime. The regression is noticed by LKP as new errors reported by ACPICA mutex debugging facility. [ 2.043693] ACPI Error: Mutex [ACPI_MTX_Tables] already acquired by this thread [497483776] (20160930/utmutex-254) [ 2.054084] ACPI Error: Mutex [0x2] is not acquired, cannot release (20160930/utmutex-326) And it triggers a deadlock: [ 247.066214] INFO: task swapper/0:1 blocked for more than 120 seconds. ... [ 247.091271] Call Trace: ... [ 247.121523] down_timeout+0x47/0x50 [ 247.125065] acpi_os_wait_semaphore+0x47/0x62 [ 247.129475] acpi_ut_acquire_mutex+0x43/0x81 [ 247.133798] acpi_get_table+0x2d/0x84 [ 247.137513] acpi_table_attr_init+0xcd/0x100 [ 247.146590] acpi_sysfs_table_handler+0x5d/0xb8 [ 247.151174] acpi_bus_table_handler+0x23/0x2a [ 247.155583] acpi_tb_install_standard_table+0xe0/0x213 [ 247.164489] acpi_tb_install_and_load_table+0x3a/0x82 [ 247.169592] acpi_ex_load_op+0x194/0x201 ... [ 247.200108] acpi_ns_evaluate+0x1bb/0x247 [ 247.204170] acpi_evaluate_object+0x178/0x274 [ 247.213249] acpi_processor_set_pdc+0x154/0x17b ... The table mutex is held in acpi_tb_install_and_load_table() and is re-visited by acpi_get_table(). Noticing that the early mutex requirement actually belongs to the OSL layer and has already been handled in acpi_os_wait_semaphore()/acpi_os_signal_semaphore(), the regression canbe fixed by removing this hidden logic from the ACPICA core to the OS-specific code. Fixes: 174cc7187e6f ("ACPICA: Tables: Back port acpi_get_table_with_size() and early_acpi_os_unmap_memory() from Linux kernel") Reported-and-tested-by: Tomi Sarvela <[email protected]> Reported-by: Ye Xiaolong <[email protected]> Signed-off-by: Lv Zheng <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2017-01-20cpufreq: intel_pstate: Fix sysfs limits enforcement for performance policySrinivas Pandruvada1-1/+13
A side effect of keeping intel_pstate sysfs limits in sync with cpufreq is that the now sysfs limits can't enforced under performance policy. For example, if the max_perf_pct is changed from 100 to 80, this will call intel_pstate_set_policy(), which will change the max_perf to 100 again for performance policy. Same issue happens, when no_turbo is set. This change calculates max and min frequency using sysfs performance limits in intel_pstate_verify_policy() and adjusts policy limits by calling cpufreq_verify_within_limits(). Also, it causes the setting of performance limits to be skipped if no_turbo is set. Fixes: 111b8b3fe4fa (cpufreq: intel_pstate: Always keep all limits settings in sync) Signed-off-by: Srinivas Pandruvada <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2017-01-20Revert "PM / sleep / ACPI: Use the ACPI_FADT_LOW_POWER_S0 flag"Rafael J. Wysocki4-15/+3
Revert commit 08b98d329165 (PM / sleep / ACPI: Use the ACPI_FADT_LOW_POWER_S0 flag) as it caused system suspend (in the default configuration) to fail on Dell XPS13 (9360) with the Kaby Lake processor. Fixes: 08b98d329165 (PM / sleep / ACPI: Use the ACPI_FADT_LOW_POWER_S0 flag) Reported-by: Paul Menzel <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2017-01-19Merge tag 'armsoc-fixes' of ↵Linus Torvalds26-40/+47
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "We've been sitting on fixes for a while, and they keep trickling in at a low rate. Nothing in here comes across as particularly scary or noteworthy, for the most part it's a large collection of small DT tweaks" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (24 commits) ARM: dts: da850-evm: fix read access to SPI flash ARM: dts: omap3: Fix Card Detect and Write Protect on Logic PD SOM-LV ARM64: dts: meson-gxbb-odroidc2: Disable SCPI DVFS ARM: dts: OMAP5 / DRA7: indicate that SATA port 0 is available. ARM: dts: NSP: Fix DT ranges error ARM: multi_v7_defconfig: set bcm47xx watchdog ARM: multi_v7_defconfig: fix config typo ARM: dts: dra72-evm-revc: fix typo in ethernet-phy node soc: ti: wkup_m3_ipc: Fix error return code in wkup_m3_ipc_probe() ARM: ux500: fix prcmu_is_cpu_in_wfi() calculation ARM: dts: sunxi: Change node name for pwrseq pin on Olinuxino-lime2-emmc ARM: dts: sun8i: Support DTB build for NanoPi M1 ARM: dts: sun6i: hummingbird: Enable display engine again ARM: dts: sun6i: Disable display pipeline by default ARM, ARM64: dts: drop "arm,amba-bus" in favor of "simple-bus" part 3 ARM: dts: imx6qdl-nitrogen6_som2: fix sgtl5000 pinctrl init ARM: dts: imx6qdl-nitrogen6_max: fix sgtl5000 pinctrl init ARM: OMAP1: DMA: Correct the number of logical channels ARM: dts: am335x-icev2: Remove the duplicated pinmux setting ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate ...
2017-01-19Merge tag 'xfs-for-linux-4.10-rc5-1' of ↵Linus Torvalds6-33/+84
git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "I have a few more patches this week -- one to make the behavior of a quota id ioctl consistent with the other filesystems, and the rest improve validation of i_mode & i_size values coming into xfs so that we don't read off the ends of arrays or crash when handed garbage disk data. Summary: - inode i_mode sanitization - prevent overflows in getnextquota - minor build fixes" * tag 'xfs-for-linux-4.10-rc5-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix xfs_mode_to_ftype() prototype xfs: don't wrap ID in xfs_dq_get_next_id xfs: sanity check inode di_mode xfs: sanity check inode mode when creating new dentry xfs: replace xfs_mode_to_ftype table with switch statement xfs: add missing include dependencies to xfs_dir2.h xfs: sanity check directory inode di_size xfs: make the ASSERT() condition likely
2017-01-19ARM: dts: da850-evm: fix read access to SPI flashFabien Parent1-0/+1
Read access to the SPI flash are broken on da850-evm, i.e. the data read is not what is actually programmed on the flash. According to the datasheet for the M25P64 part present on the da850-evm, if the SPI frequency is higher than 20MHz then the READ command is not usable anymore and only the FAST_READ command can be used to read data. This commit specifies in the DTS that we should use FAST_READ command instead of the READ command. Cc: [email protected] Tested-by: Kevin Hilman <[email protected]> Signed-off-by: Fabien Parent <[email protected]> [[email protected]: subject line adjustment] Signed-off-by: Sekhar Nori <[email protected]> Signed-off-by: Olof Johansson <[email protected]>
2017-01-19virtio/s390: virtio: constify virtio_config_ops structuresBhumika Goyal1-1/+1
Declare virtio_config_ops structure as const as it is only stored in the config field of a virtio_device structure. This field is of type const, so virtio_config_ops structures having this property can be declared const. Done using Coccinelle: @r1 disable optional_qualifier@ identifier i; position p; @@ static struct virtio_config_ops i@p={...}; @ok1@ identifier r1.i; position p; struct virtio_ccw_device x; @@ x.vdev.config=&i@p @bad@ position p!={r1.p,ok1.p}; identifier r1.i; @@ i@p @depends on !bad disable optional_qualifier@ identifier r1.i; @@ +const struct virtio_config_ops i; File size before and after applying the patch remains the same. text data bss dec hex filename 9235 296 32928 42459 a5db drivers/s390/virtio/virtio_ccw.o Signed-off-by: Bhumika Goyal <[email protected]> Message-Id: <[email protected]> Signed-off-by: Christian Borntraeger <[email protected]> Signed-off-by: Cornelia Huck <[email protected]>
2017-01-19virtio/s390: add missing \n to end of dev_err messageColin Ian King1-1/+1
Trival fix, dev_err message is missing a \n, so add it. Signed-off-by: Colin Ian King <[email protected]> Message-Id: <[email protected]> Signed-off-by: Christian Borntraeger <[email protected]> Signed-off-by: Cornelia Huck <[email protected]>
2017-01-19virtio/s390: support READ_STATUS command for virtio-ccwPierre Morel1-0/+25
As virtio-1 introduced the possibility of the device manipulating the status byte, revision 2 of the virtio-ccw transport introduced a means of getting the status byte from the device via READ_STATUS. Let's wire it up for revisions >= 2 and fall back to returning the stored status byte if not supported. Signed-off-by: Pierre Morel <[email protected]> Signed-off-by: Cornelia Huck <[email protected]>
2017-01-19tools/virtio/ringtest: tweaks for s390Halil Pasic1-0/+12
Make ringtest work on s390 too. Signed-off-by: Halil Pasic <[email protected]> Acked-by: Sascha Silbe <[email protected]> Signed-off-by: Cornelia Huck <[email protected]>
2017-01-19tools/virtio/ringtest: fix run-on-all.sh for offline cpusHalil Pasic1-2/+3
Since ef1b144d ("tools/virtio/ringtest: fix run-on-all.sh to work without /dev/cpu") run-on-all.sh uses seq 0 $HOST_AFFINITY as the list of ids of the CPUs to run the command on (assuming ids of online CPUs are consecutive and start from 0), where $HOST_AFFINITY is the highest CPU id in the system previously determined using lscpu. This can fail on systems with offline CPUs. Instead let's use lscpu to determine the list of online CPUs. Signed-off-by: Halil Pasic <[email protected]> Fixes: ef1b144d ("tools/virtio/ringtest: fix run-on-all.sh to work without /dev/cpu") Reviewed-by: Sascha Silbe <[email protected]> Signed-off-by: Cornelia Huck <[email protected]>
2017-01-19virtio_console: fix a crash in config_work_handlerG. Campana1-1/+1
Using control_work instead of config_work as the 3rd argument to container_of results in an invalid portdev pointer. Indeed, the work structure is initialized as below: INIT_WORK(&portdev->config_work, &config_work_handler); It leads to a crash when portdev->vdev is dereferenced later. This bug is triggered when the guest uses a virtio-console without multiport feature and receives a config_changed virtio interrupt. Signed-off-by: G. Campana <[email protected]> Reviewed-by: Amit Shah <[email protected]> Signed-off-by: Michael S. Tsirkin <[email protected]>
2017-01-19vhost/scsi: silence uninitialized variable warningDan Carpenter1-1/+1
This is to silence an uninitialized variable warning in debug output. The problem is this line: pr_debug("vhost_get_vq_desc: head: %d, out: %u in: %u\n", head, out, in); If "head == vq->num" is true on the first iteration then "out" and "in" aren't initialized. We handle that a few lines after the printk. I was tempted to just delete the pr_debug() but I decided to just initialize them to zero instead. Also checkpatch.pl complains if variables are declared as just "unsigned" without the "int". Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Michael S. Tsirkin <[email protected]>
2017-01-19vhost: scsi: constify target_core_fabric_ops structuresBhumika Goyal1-1/+1
Declare target_core_fabric_ops strucrues as const as they are only passed as an argument to the functions target_register_template and target_unregister_template. The arguments are of type const struct target_core_fabric_ops *, so target_core_fabric_ops structures having this property can be declared const. Done using Coccinelle: @r disable optional_qualifier@ identifier i; position p; @@ static struct target_core_fabric_ops i@p={...}; @ok@ position p; identifier r.i; @@ ( target_register_template(&i@p) | target_unregister_template(&i@p) ) @bad@ position p!={r.p,ok.p}; identifier r.i; @@ i@p @depends on !bad disable optional_qualifier@ identifier r.i; @@ +const struct target_core_fabric_ops i; File size before: drivers/vhost/scsi.o text data bss dec hex filename 18063 2985 40 21088 5260 drivers/vhost/scsi.o File size after: drivers/vhost/scsi.o text data bss dec hex filename 18479 2601 40 21120 5280 drivers/vhost/scsi.o Signed-off-by: Bhumika Goyal <[email protected]> Signed-off-by: Michael S. Tsirkin <[email protected]> Acked-by: Jason Wang <[email protected]>
2017-01-19nbd: only set MSG_MORE when we have more to sendJosef Bacik1-4/+2
A user noticed that write performance was horrible over loopback and we traced it to an inversion of when we need to set MSG_MORE. It should be set when we have more bvec's to send, not when we are on the last bvec. This patch made the test go from 20 iops to 78k iops. Signed-off-by: Josef Bacik <[email protected]> Fixes: 429a787be679 ("nbd: fix use-after-free of rq/bio in the xmit path") Signed-off-by: Jens Axboe <[email protected]>
2017-01-19Merge tag 'pci-v4.10-fixes-1' of ↵Linus Torvalds4-11/+23
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - recognize that a PCI-to-PCIe bridge originates a PCIe hierarchy, so we enumerate that hierarchy correctly - X-Gene: fix a change merged for v4.10 that broke MSI - Keystone: avoid reading undefined registers, which can cause asynchronous external aborts - Supermicro X8DTH-i/6/iF/6F: ignore broken _CRS that caused us to change (and break) existing I/O port assignments * tag 'pci-v4.10-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI/MSI: pci-xgene-msi: Fix CPU hotplug registration handling PCI: Enumerate switches below PCI-to-PCIe bridges x86/PCI: Ignore _CRS on Supermicro X8DTH-i/6/iF/6F PCI: designware: Check for iATU unroll only on platforms that use ATU
2017-01-19Merge branch 'for-linus' of ↵Linus Torvalds3-23/+63
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: - regression fix for generic Wacom devices, from Jason Gerecke - DMA-on-stack fixes for hid-corsair driver, from Johan Hovold * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: wacom: Fix sibling detection regression HID: corsair: fix control-transfer error handling HID: corsair: fix DMA buffers on stack
2017-01-19Merge branch 'for-linus' of ↵Linus Torvalds5-49/+70
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull two s390 bug fixes from Martin Schwidefsky: "Two changes, the first is a fix to add a missing memory clobber to the inline assembly to load control registers. This has not caused any issues so far, but who knows what code gcc will generate in future versions. The second change is an update for the default configurations. This includes CONFIG_BUG_ON_DATA_CORRUPTION=y, we want this to be enabled for s390. The usual approach to debug problems on production systems is to use crash on a system dump and for us avoiding data corruptions is priority one" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: update defconfigs s390/ctl_reg: make __ctl_load a full memory barrier
2017-01-19Merge tag 'for-linus-4.10-rc4-tag' of ↵Linus Torvalds1-0/+71
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fix from Juergen Gross: "A fix for Xen running in nested virtualization environment" * tag 'for-linus-4.10-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: partially revert "xen: Remove event channel notification through Xen PCI platform device"
2017-01-19Btrfs: fix truncate down when no_holes feature is enabledLiu Bo1-1/+12
For such a file mapping, [0-4k][hole][8k-12k] In NO_HOLES mode, we don't have the [hole] extent any more. Commit c1aa45759e90 ("Btrfs: fix shrinking truncate when the no_holes feature is enabled") fixed disk isize not being updated in NO_HOLES mode when data is not flushed. However, even if data has been flushed, we can still have trouble in updating disk isize since we updated disk isize to 'start' of the last evicted extent. Reviewed-by: Chris Mason <[email protected]> Signed-off-by: Liu Bo <[email protected]> Signed-off-by: David Sterba <[email protected]>
2017-01-19Btrfs: Fix deadlock between direct IO and fast fsyncChandan Rajendra1-2/+2
The following deadlock is seen when executing generic/113 test, ---------------------------------------------------------+---------------------------------------------------- Direct I/O task Fast fsync task ---------------------------------------------------------+---------------------------------------------------- btrfs_direct_IO __blockdev_direct_IO do_blockdev_direct_IO do_direct_IO btrfs_get_blocks_direct while (blocks needs to written) get_more_blocks (first iteration) btrfs_get_blocks_direct btrfs_create_dio_extent down_read(&BTRFS_I(inode) >dio_sem) Create and add extent map and ordered extent up_read(&BTRFS_I(inode) >dio_sem) btrfs_sync_file btrfs_log_dentry_safe btrfs_log_inode_parent btrfs_log_inode btrfs_log_changed_extents down_write(&BTRFS_I(inode) >dio_sem) Collect new extent maps and ordered extents wait for ordered extent completion get_more_blocks (second iteration) btrfs_get_blocks_direct btrfs_create_dio_extent down_read(&BTRFS_I(inode) >dio_sem) -------------------------------------------------------------------------------------------------------------- In the above description, Btrfs direct I/O code path has not yet started submitting bios for file range covered by the initial ordered extent. Meanwhile, The fast fsync task obtains the write semaphore and waits for I/O on the ordered extent to get completed. However, the Direct I/O task is now blocked on obtaining the read semaphore. To resolve the deadlock, this commit modifies the Direct I/O code path to obtain the read semaphore before invoking __blockdev_direct_IO(). The semaphore is then given up after __blockdev_direct_IO() returns. This allows the Direct I/O code to complete I/O on all the ordered extents it creates. Signed-off-by: Chandan Rajendra <[email protected]> Reviewed-by: Filipe Manana <[email protected]> Signed-off-by: David Sterba <[email protected]>
2017-01-19btrfs: fix false enospc error when truncating heavily reflinked fileWang Xiaoguang1-0/+1
Below test script can reveal this bug: dd if=/dev/zero of=fs.img bs=$((1024*1024)) count=100 dev=$(losetup --show -f fs.img) mkdir -p /mnt/mntpoint mkfs.btrfs -f $dev mount $dev /mnt/mntpoint cd /mnt/mntpoint echo "workdir is: /mnt/mntpoint" blocksize=$((128 * 1024)) dd if=/dev/zero of=testfile bs=$blocksize count=1 sync count=$((17*1024*1024*1024/blocksize)) echo "file size is:" $((count*blocksize)) for ((i = 1; i <= $count; i++)); do dst_offset=$((blocksize * i)) xfs_io -f -c "reflink testfile 0 $dst_offset $blocksize"\ testfile > /dev/null done sync truncate --size 0 testfile The last truncate operation will fail for ENOSPC reason, but indeed it should not fail. In btrfs_truncate(), we use a temporary block_rsv to do truncate operation. With every btrfs_truncate_inode_items() call, we migrate space to this block_rsv, but forget to cleanup previous reservation, which will make this block_rsv's reserved bytes keep growing, and this reserved space will only be released in the end of btrfs_truncate(), this metadata leak will impact other's metadata reservation. In this case, it's "btrfs_start_transaction(root, 2);" fails for enospc error, which make this truncate operation fail. Call btrfs_block_rsv_release() to fix this bug. Signed-off-by: Wang Xiaoguang <[email protected]> Reviewed-by: David Sterba <[email protected]> Signed-off-by: David Sterba <[email protected]>
2017-01-19gianfar: Do not reuse pages from emergency reserveEric Dumazet1-1/+1
A driver using dev_alloc_page() must not reuse a page that had to use emergency memory reserve. Otherwise all packets using this page will be immediately dropped, unless for very specific sockets having SOCK_MEMALLOC bit set. This issue might be hard to debug, because only a fraction of the RX ring buffer would suffer from drops. Fixes: 75354148ce69 ("gianfar: Add paged allocation and Rx S/G") Signed-off-by: Eric Dumazet <[email protected]> Cc: Claudiu Manoil <[email protected]> Acked-by: Claudiu Manoil <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-19tcp: initialize max window for a new fastopen socketAlexey Kodanev1-0/+1
Found that if we run LTP netstress test with large MSS (65K), the first attempt from server to send data comparable to this MSS on fastopen connection will be delayed by the probe timer. Here is an example: < S seq 0:0 win 43690 options [mss 65495 wscale 7 tfo cookie] length 32 > S. seq 0:0 ack 1 win 43690 options [mss 65495 wscale 7] length 0 < . ack 1 win 342 length 0 Inside tcp_sendmsg(), tcp_send_mss() returns max MSS in 'mss_now', as well as in 'size_goal'. This results the segment not queued for transmition until all the data copied from user buffer. Then, inside __tcp_push_pending_frames(), it breaks on send window test and continues with the check probe timer. Fragmentation occurs in tcp_write_wakeup()... +0.2 > P. seq 1:43777 ack 1 win 342 length 43776 < . ack 43777, win 1365 length 0 > P. seq 43777:65001 ack 1 win 342 options [...] length 21224 ... This also contradicts with the fact that we should bound to the half of the window if it is large. Fix this flaw by correctly initializing max_window. Before that, it could have large values that affect further calculations of 'size_goal'. Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path") Signed-off-by: Alexey Kodanev <[email protected]> Acked-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-19net/mlx5e: Remove unused variableArnd Bergmann1-1/+0
A cleanup removed the only user of this variable mlx5/core/en_ethtool.c: In function 'mlx5e_set_channels': mlx5/core/en_ethtool.c:546:6: error: unused variable 'ncv' [-Werror=unused-variable] Let's remove the declaration as well. Fixes: 639e9e94160e ("net/mlx5e: Remove unnecessary checks when setting num channels") Signed-off-by: Arnd Bergmann <[email protected]> Reported-by: Stephen Rothwell <[email protected]> Reviewed-by: Tariq Toukan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-19ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lockKefeng Wang1-3/+1
Just like commit 4acd4945cd1e ("ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock"), it is unnecessary to make addrconf_disable_change() use RCU iteration over the netdev list, since it already holds the RTNL lock, or we may meet Illegal context switch in RCU read-side critical section. Signed-off-by: Kefeng Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-19MAINTAINERS: update cxgb4 maintainerHariprasad Shenai1-1/+1
Ganesg will be taking over as maintainer from now Signed-off-by: Hariprasad Shenai <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-01-19arm64: avoid returning from bad_modeMark Rutland2-5/+25
Generally, taking an unexpected exception should be a fatal event, and bad_mode is intended to cater for this. However, it should be possible to contain unexpected synchronous exceptions from EL0 without bringing the kernel down, by sending a SIGILL to the task. We tried to apply this approach in commit 9955ac47f4ba1c95 ("arm64: don't kill the kernel on a bad esr from el0"), by sending a signal for any bad_mode call resulting from an EL0 exception. However, this also applies to other unexpected exceptions, such as SError and FIQ. The entry paths for these exceptions branch to bad_mode without configuring the link register, and have no kernel_exit. Thus, if we take one of these exceptions from EL0, bad_mode will eventually return to the original user link register value. This patch fixes this by introducing a new bad_el0_sync handler to cater for the recoverable case, and restoring bad_mode to its original state, whereby it calls panic() and never returns. The recoverable case branches to bad_el0_sync with a bl, and returns to userspace via the usual ret_to_user mechanism. Signed-off-by: Mark Rutland <[email protected]> Fixes: 9955ac47f4ba1c95 ("arm64: don't kill the kernel on a bad esr from el0") Reported-by: Mark Salter <[email protected]> Cc: Will Deacon <[email protected]> Cc: [email protected] Signed-off-by: Catalin Marinas <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.