aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-12-16fsl-ifc: add missing include on ARM64Lijun Pan1-0/+1
Need to include sched.h to fix the following compilation error if FSL_IFC is enabled on ARM64 machine. In file included from include/linux/mmzone.h:9:0, from include/linux/gfp.h:5, from include/linux/kmod.h:22, from include/linux/module.h:13, from drivers/memory/fsl_ifc.c:22: drivers/memory/fsl_ifc.c: In function ‘check_nand_stat’: include/linux/wait.h:165:35: error: ‘TASK_NORMAL’ undeclared (first use in this function) #define wake_up(x) __wake_up(x, TASK_NORMAL, 1, NULL) ^ drivers/memory/fsl_ifc.c:136:3: note: in expansion of macro ‘wake_up’ wake_up(&ctrl->nand_wait); ^ include/linux/wait.h:165:35: note: each undeclared identifier is reported only once for each function it appears in #define wake_up(x) __wake_up(x, TASK_NORMAL, 1, NULL) ^ drivers/memory/fsl_ifc.c:136:3: note: in expansion of macro ‘wake_up’ wake_up(&ctrl->nand_wait); ^ Analysis is as follows: I put some instrumental code and get the following .h files inclusion sequence: In file included from ./arch/arm64/include/asm/compat.h:25:0, from ./arch/arm64/include/asm/stat.h:23, from include/linux/stat.h:5, from include/linux/module.h:10, from drivers/memory/fsl_ifc.c:23: include/linux/sched.h:113:1: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘struct’ struct sched_attr { ^ CONFIG_COMPAT=y is enabled while 39 and 48 bit VA is selected. When 42 bit VA is selected, it does not enable CONFIG_COMPAT=y In ./arch/arm64/include/asm/stat.h:23, it has "#ifdef CONFIG_COMPAT" "#include <asm/compat.h>" "..." "#endif" Since ./arch/arm64/include/asm/stat.h does not include ./arch/arm64/include/asm/compat.h, then it will not include include/linux/sched.h Hence we have to manually add "#include <linux/sched.h>" in drivers/memory/fsl_ifc.c Signed-off-by: Lijun Pan <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]>
2015-12-15Revert "scatterlist: use sg_phys()"Dan Williams5-7/+8
commit db0fa0cb0157 "scatterlist: use sg_phys()" did replacements of the form: phys_addr_t phys = page_to_phys(sg_page(s)); phys_addr_t phys = sg_phys(s) & PAGE_MASK; However, this breaks platforms where sizeof(phys_addr_t) > sizeof(unsigned long). Revert for 4.3 and 4.4 to make room for a combined helper in 4.5. Cc: <[email protected]> Cc: Jens Axboe <[email protected]> Cc: Christoph Hellwig <[email protected]> Cc: Russell King <[email protected]> Cc: David Woodhouse <[email protected]> Cc: Andrew Morton <[email protected]> Fixes: db0fa0cb0157 ("scatterlist: use sg_phys()") Suggested-by: Joerg Roedel <[email protected]> Reported-by: Vitaly Lavrov <[email protected]> Signed-off-by: Dan Williams <[email protected]>
2015-12-15net: fix uninitialized variable issue[email protected]1-0/+1
msg_iocb needs to be initialized on the recv/recvfrom path. Otherwise afalg will wrongly interpret it as an async call. Cc: [email protected] Reported-by: Harald Freudenberger <[email protected]> Signed-off-by: Tadeusz Struk <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15bluetooth: Validate socket address length in sco_sock_bind().David S. Miller1-0/+3
Signed-off-by: David S. Miller <[email protected]>
2015-12-15Input: elan_i2c - set input device's vendor and product IDsCharlie Mooney1-0/+3
Previously the "vendor" and "product" IDs for the elan_i2c driver simply reported 0000. This patch modifies the elan_i2c driver to include the Elan vendor ID and the touchpad's product id under input/input*/{vendor,product}. Specifically, this is to allow us to apply a generic Elan gestures config that will apply to all Elan touchpads on ChromeOS. These configs match to input devices in various ways, but one major way is by matching on vendor ID. Adding this patch allows the default Elan touchpad config to be applied to Elan touchpads in this kernel by matching on devices that have vendor ID 04f3. Note that product ID is also available via custom sysfs entry "product_id" as well. Signed-off-by: Charlie Mooney <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2015-12-15Merge tag 'dmaengine-fix-4.4-rc6' of ↵Linus Torvalds6-57/+110
git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "This has fixes spread thru driver, notably among them: - edma fixes for recent edma DT changes which went into 4.4 - odd fixes for at_hdmac - minor fixes on bc dma and mic dma" * tag 'dmaengine-fix-4.4-rc6' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: at_xdmac: fix at_xdmac_prep_dma_memcpy() dmaengine: edma: DT: Change reserved slot array from 16bit to 32bit type dmaengine: edma: DT: Change memcpy channel array from 16bit to 32bit type dmaengine: mic_x100: add missing spin_unlock dmaengine: bcm2835-dma: Convert to use DMA pool dmaengine: at_xdmac: fix bad behavior in interleaved mode dmaengine: at_xdmac: fix false condition for memset_sg transfers dmaengine: at_xdmac: fix macro typo
2015-12-15Merge tag 'fbdev-fixes-4.4' of ↵Linus Torvalds2-1/+24
git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux Pull two fbdev fixes from Tomi Valkeinen: - OMAP: fix analog tv-out when using omapdrm - fsl: Fix kernel crash when diu_ops is not implemented * tag 'fbdev-fixes-4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: OMAPDSS: fix timings for VENC to match what omapdrm expects video: fbdev: fsl: Fix kernel crash when diu_ops is not implemented
2015-12-15Merge tag 'please-pull-mlock2' of ↵Linus Torvalds3-1/+3
git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux Pull ia64 fix from Tony Luck: "Wire up mlock2() syscall for ia64" * tag 'please-pull-mlock2' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux: [IA64] Enable mlock2 syscall for ia64
2015-12-15net_sched: make qdisc_tree_decrease_qlen() work for non mqEric Dumazet1-1/+1
Stas Nichiporovich reported a regression in his HFSC qdisc setup on a non multi queue device. It turns out I mistakenly added a TCQ_F_NOPARENT flag on all qdisc allocated in qdisc_create() for non multi queue devices, which was rather buggy. I was clearly mislead by the TCQ_F_ONETXQUEUE that is also set here for no good reason, since it only matters for the root qdisc. Fixes: 4eaf3b84f288 ("net_sched: fix qdisc_tree_decrease_qlen() races") Reported-by: Stas Nichiporovich <[email protected]> Tested-by: Stas Nichiporovich <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15Merge branch 'ser_gigaset-platform-device-dealloc'David S. Miller1-12/+11
Paul Bolle says: ==================== ser_gigaset: fix deallocation of platform device structure Sascha Levin reported that the syzkaller fuzzer triggered a WARNING in ser_gigaset (see https://lkml.kernel.org/g/[email protected] ). It turned out that ser_gigaset has always deallocated its platform device structure incorrectly. Tilman submitted the patch that fixes that (3/4) and a related cleanup (4/4). Tilman also submitted a minor cleanup of some NULL checks (1/4) that prompted Alan to turn those checks into WARN_ONs (2/4). If no one hits these WARN_ONs in the next couple of releases these WARN_ONs should be removed. ==================== Signed-off-by: David S. Miller <[email protected]>
2015-12-15ser_gigaset: remove unnecessary kfree() calls from release methodTilman Schmidt1-5/+0
device->platform_data and platform_device->resource are never used and remain NULL through their entire life. Drops the kfree() calls for them from the device release method. Signed-off-by: Tilman Schmidt <[email protected]> Signed-off-by: Paul Bolle <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15ser_gigaset: fix deallocation of platform device structureTilman Schmidt1-3/+7
When shutting down the device, the struct ser_cardstate must not be kfree()d immediately after the call to platform_device_unregister() since the embedded struct platform_device is still in use. Move the kfree() call to the release method instead. Signed-off-by: Tilman Schmidt <[email protected]> Fixes: 2869b23e4b95 ("drivers/isdn/gigaset: new M101 driver (v2)") Reported-by: Sasha Levin <[email protected]> Signed-off-by: Paul Bolle <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15ser_gigaset: turn nonsense checks into WARN_ONAlan Cox1-5/+5
These checks do nothing useful to protect the code from races. On the other hand if the old code has been masking a real bug we would like to know about it. The check for tiocmset is kept because it is valid for a tty driver to have a NULL tiocmset method. That in itself is probably a mistake given modern coding practices - but needs fixing in the tty layer. Signed-off-by: Alan Cox <[email protected]> Acked-by: Tilman Schmidt <[email protected]> Signed-off-by: Paul Bolle <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15ser_gigaset: fix up NULL checksTilman Schmidt1-3/+3
Commit f34d7a5b7010 ("tty: The big operations rework") changed tty->driver to tty->ops but left NULL checks for tty->driver untouched. Fix. Signed-off-by: Tilman Schmidt <[email protected]> [pebolle: removed Fixes tag] Signed-off-by: Paul Bolle <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15Merge branch 'linus' of ↵Linus Torvalds2-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "This fixes a boundary condition in the blkcipher SG walking code that can lead to a crash when used with the new chacha20 algorithm" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: skcipher - Copy iv from desc even for 0-len walks
2015-12-15Fix user-visible spelling errorLinus Torvalds1-1/+1
Pavel Machek reports a warning about W+X pages found in the "Persisent" kmap area. After grepping for it (using the correct spelling), and not finding it, I noticed how the debug printk was just misspelled. Fix it. The actual mapping bug that Pavel reported is still open. It's apparently a separate issue from the known EFI page tables, looks like it's related to the HIGHMEM mappings. Signed-off-by: Linus Torvalds <[email protected]>
2015-12-15qlcnic: fix a timeout loopDan Carpenter1-1/+2
The problem here is that at the end of the loop we test for if idc->vnic_wait_limit is zero, but since idc->vnic_wait_limit-- is a post-op, it actually ends up set to (u8)-1. I have fixed this by moving the decrement inside the loop. Fixes: 486a5bc77a4a ('qlcnic: Add support for 83xx suspend and resume.') Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15sfc: fix a timeout loopDan Carpenter1-1/+1
We test for if "tries" is zero at the end but "tries--" is a post-op so it will end with "tries" set to -1. I have changed it to a pre-op instead. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15qlge: fix a timeout loop in ql_change_rx_buffers()Dan Carpenter1-2/+3
The problem here is that after the loop we test for "if (!i) " but because "i--" is a post-op we exit with i set to -1. I have fixed this by changing it to a pre-op instead. I had to change the starting value from 3 to 4 so that we still iterate 3 times. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15amd-xgbe: fix a couple timeout loopsDan Carpenter1-2/+2
At the end of the loop we test "if (!count)" but because "count--" is a post-op then the loop will end with count set to -1. I have fixed this by changing it to --count. Fixes: c5aa9e3b8156 ('amd-xgbe: Initial AMD 10GbE platform driver') Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15mISDN: fix a loop countDan Carpenter1-4/+3
There are two issue here. 1) cnt starts as maxloop + 1 so all these loops iterate one more time than intended. 2) At the end of the loop we test for "if (maxloop && !cnt)" but for the first two loops, we end with cnt equal to -1. Changing this to a pre-op means we end with cnt set to 0. Fixes: cae86d4a4e56 ('mISDN: Add driver for Infineon ISDN chipset family') Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15Merge branch 'for-chris-4.4' of ↵Chris Mason5-8/+10
git://git.kernel.org/pub/scm/linux/kernel/git/fdmanana/linux into for-linus-4.4
2015-12-15Btrfs: check prepare_uptodate_page() error code earlierChris Mason1-4/+14
prepare_pages() may end up calling prepare_uptodate_page() twice if our write only spans a single page. But if the first call returns an error, our page will be unlocked and its not safe to call it again. This bug goes all the way back to 2011, and it's not something commonly hit. While we're here, add a more explicit check for the page being truncated away. The bare lock_page() alone is protected only by good thoughts and i_mutex, which we're sure to regret eventually. Reported-by: Dave Jones <[email protected]> Signed-off-by: Chris Mason <[email protected]>
2015-12-15Btrfs: check for empty bitmap list in setup_cluster_bitmapsChris Mason1-3/+5
Dave Jones found a warning from kasan in setup_cluster_bitmaps() ================================================================== BUG: KASAN: stack-out-of-bounds in setup_cluster_bitmap+0xc4/0x5a0 at addr ffff88039bef6828 Read of size 8 by task nfsd/1009 page:ffffea000e6fbd80 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x8000000000000000() page dumped because: kasan: bad access detected CPU: 1 PID: 1009 Comm: nfsd Tainted: G W 4.4.0-rc3-backup-debug+ #1 ffff880065647b50 000000006bb712c2 ffff88039bef6640 ffffffffa680a43e 0000004559c00000 ffff88039bef66c8 ffffffffa62638d1 ffffffffa61121c0 ffff8803a5769de8 0000000000000296 ffff8803a5769df0 0000000000046280 Call Trace: [<ffffffffa680a43e>] dump_stack+0x4b/0x6d [<ffffffffa62638d1>] kasan_report_error+0x501/0x520 [<ffffffffa61121c0>] ? debug_show_all_locks+0x1e0/0x1e0 [<ffffffffa6263948>] kasan_report+0x58/0x60 [<ffffffffa6814b00>] ? rb_last+0x10/0x40 [<ffffffffa66f8af4>] ? setup_cluster_bitmap+0xc4/0x5a0 [<ffffffffa6262ead>] __asan_load8+0x5d/0x70 [<ffffffffa66f8af4>] setup_cluster_bitmap+0xc4/0x5a0 [<ffffffffa66f675a>] ? setup_cluster_no_bitmap+0x6a/0x400 [<ffffffffa66fcd16>] btrfs_find_space_cluster+0x4b6/0x640 [<ffffffffa66fc860>] ? btrfs_alloc_from_cluster+0x4e0/0x4e0 [<ffffffffa66fc36e>] ? btrfs_return_cluster_to_free_space+0x9e/0xb0 [<ffffffffa702dc37>] ? _raw_spin_unlock+0x27/0x40 [<ffffffffa666a1a1>] find_free_extent+0xba1/0x1520 Andrey noticed this was because we were doing list_first_entry on a list that might be empty. Rework the tests a bit so we don't do that. Signed-off-by: Chris Mason <[email protected]> Reprorted-by: Andrey Ryabinin <[email protected]> Reported-by: Dave Jones <[email protected]>
2015-12-15net/mlx4_core: fix handling return value of mlx4_slave_convert_portAndrzej Hajda1-2/+3
The function can return negative values, so its result should be assigned to signed variable. The problem has been detected using proposed semantic patch scripts/coccinelle/tests/assign_signed_to_unsigned.cocci [1]. [1]: http://permalink.gmane.org/gmane.linux.kernel/2046107 Fixes: fc48866f7 ('net/mlx4: Adapt code for N-Port VF') Signed-off-by: Andrzej Hajda <[email protected]> Acked-by: Or Gerlitz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2ndTakashi Iwai1-0/+1
Apply the same fixup for Thinkpad with dock to Thinkpad X1 Carbon 2nd, too. This reduces the annoying loud cracking noise problem, as well as the support of missing docking port. Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=958439 Reported-and-tested-by: Benjamin Poirier <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-12-15ALSA: hda - Set codec to D3 at reboot/shutdown on ThinkpadsTakashi Iwai1-1/+22
Lenovo Thinkpads with Realtek codecs may still have some loud crackling noises at reboot/shutdown even though a few previous fixes have been applied. It's because the previous fix (disabling the default shutup callback) takes effect only at transition of the codec power state. Meanwhile, at reboot or shutdown, we don't take down the codec power as default, thus it triggers the same problem unless the codec is powered down casually by runtime PM. This patch tries to address the issue. It gives two things: - implement the separate reboot_notify hook to struct alc_spec, and call it optionally if defined. - turn off the codec to D3 for Thinkpad models via this new callback Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=958439 Reported-and-tested-by: Benjamin Poirier <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-12-15ALSA: hda - Apply click noise workaround for Thinkpads genericallyTakashi Iwai1-13/+2
It seems that a workaround for Thinkpad T440s crackling noise can be applied generically to all Thinkpad models: namely, disabling the default alc269 shutup callback. This patch moves it to the existing alc_fixup_tpt440_dock() while also replacing the rest code with another existing alc_fixup_disable_aamix(). It resulted in a good code reduction. Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=958439 Reported-and-tested-by: Benjamin Poirier <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-12-15ALSA: hda - Fix headphone mic input on a few Dell ALC293 machinesDavid Henningsson1-5/+12
These laptops support both headphone, headset and mic modes for the 3.5mm jack. Cc: [email protected] BugLink: https://bugs.launchpad.net/bugs/1526330 Signed-off-by: David Henningsson <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-12-15mac80211: handle width changes from opmode notification IE in beaconEyal Shapira5-14/+8
An AP can send an operating channel width change in a beacon opmode notification IE as long as there's a change in the nss as well (See 802.11ac-2013 section 10.41). So don't limit updating to nss only from an opmode notification IE. Signed-off-by: Eyal Shapira <[email protected]> Signed-off-by: Emmanuel Grumbach <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2015-12-15mac80211: suppress unchanged "limiting TX power" messagesJohannes Berg1-5/+10
When the AP is advertising limited TX power, the message can be printed over and over again. Suppress it when the power level isn't changing. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=106011 Signed-off-by: Johannes Berg <[email protected]>
2015-12-15mac80211: reprogram in interface orderJohannes Berg1-39/+37
During reprogramming, mac80211 currently first adds all the channel contexts, then binds them to the vifs and then goes to reconfigure all the interfaces. Drivers might, perhaps implicitly, rely on the operation order for certain things that typically happen within a single function elsewhere in mac80211. To avoid problems with that, reorder the code in mac80211's restart/reprogramming to work fully within the interface loop so that the order of operations is like in normal operation. For iwlwifi, this fixes a firmware crash when reprogramming with an AP/GO interface active. Reported-by: David Spinadel <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2015-12-15mac80211: run scan completed work on reconfig failureJohannes Berg1-11/+26
When reconfiguration during resume fails while a scan is pending for completion work, that work will never run, and the scan will be stuck forever. Factor out the code to recover this and call it also in ieee80211_handle_reconfig_failure(). Signed-off-by: Johannes Berg <[email protected]>
2015-12-15nl80211: Fix potential memory leak in nl80211_connectOla Olsson1-1/+3
Free cached keys if the last early return path is taken. Signed-off-by: Ola Olsson <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2015-12-15nl80211: Fix potential memory leak in nl80211_set_wowlanOla Olsson1-0/+1
Compared to cfg80211_rdev_free_wowlan in core.h, the error goto label lacks the freeing of nd_config. Fix that. Signed-off-by: Ola Olsson <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2015-12-15nl80211: fix a few memory leaks in reg.cOla Olsson1-1/+4
The first leak occurs when entering the default case in the switch for the initiator in set_regdom. The second leaks a platform_device struct if the platform registration in regulatory_init succeeds but the sub sequent regulatory hint fails due to no memory. Signed-off-by: Ola Olsson <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2015-12-15ARM: 8475/1: SWP emulation: Restore original *data when failedShengjiu Wang1-3/+3
__user_swpX_asm maybe failed in first STREX operation, emulate_swpX will try again, but the *data has been changed in first time. which causes the result is wrong. This patch is to fix this issue. When STREX succeed, change the *data. if it fail, *data is not changed. Signed-off-by: Shengjiu Wang <[email protected]> Signed-off-by: Russell King <[email protected]>
2015-12-15ARM: 8471/1: need to save/restore arm register(r11) when it is corruptedAnson Huang1-2/+2
In cpu_v7_do_suspend routine, r11 is used while it is NOT saved/restored, different compiler may have different usage of ARM general registers, so it may cause issues during calling cpu_v7_do_suspend. We meet kernel fault occurs when using GCC 4.8.3, r11 contains valid value before calling into cpu_v7_do_suspend, but when returned from this routine, r11 is corrupted and lead to kernel fault. Doing save/restore for those corrupted registers is a must in assemble code. Signed-off-by: Anson Huang <[email protected]> Reviewed-by: Nicolas Pitre <[email protected]> Cc: <[email protected]> # v3.3+ Signed-off-by: Russell King <[email protected]>
2015-12-15ARM: fix uaccess_with_memcpy() with SW_DOMAIN_PANRussell King2-6/+27
The uaccess_with_memcpy() code is currently incompatible with the SW PAN code: it takes locks within the region that we've changed the DACR, potentially sleeping as a result. As we do not save and restore the DACR across co-operative sleep events, can lead to an incorrect DACR value later in this code path. Reported-by: Peter Rosin <[email protected]> Tested-by: Peter Rosin <[email protected]> Signed-off-by: Russell King <[email protected]>
2015-12-15ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boardsKrzysztof Hałasa5-5/+5
Gateworks Ventana boards seem to need "RGMII-ID" (internal delay) PHY mode, instead of simple "RGMII", for their Marvell 88E1510 transceiver. Otherwise, the Ethernet MAC doesn't work with Marvell PHY driver (TX doesn't seem to work correctly). Tested on GW5400 rev. C. This bug affects ARM Fedora 23. Signed-off-by: Krzysztof Hałasa <[email protected]> Acked-by: Tim Harvey <[email protected]> Cc: <[email protected]> Signed-off-by: Shawn Guo <[email protected]>
2015-12-15ARM: dts: imx: Fix the assigned-clock mismatch issue on imx6q/dlBai Ping1-3/+3
The 'assigned-clock-parents' and 'assigned-clock-rates' list should corresponding to the 'assigned-clocks' property clock list. Signed-off-by: Bai Ping <[email protected]> Fixes: ed339363de1b ("ARM: dts: imx6qdl-sabreauto: Allow HDMI and LVDS to work simultaneously") Cc: <[email protected]> Signed-off-by: Shawn Guo <[email protected]>
2015-12-15skbuff: Fix offset error in skb_reorder_vlan_headerVlad Yasevich1-1/+1
skb_reorder_vlan_header is called after the vlan header has been pulled. As a result the offset of the begining of the mac header has been incrased by 4 bytes (VLAN_HLEN). When moving the mac addresses, include this incrase in the offset calcualation so that the mac addresses are copied correctly. Fixes: a6e18ff1117 (vlan: Fix untag operations of stacked vlans with REORDER_HEADER off) CC: Nicolas Dichtel <[email protected]> CC: Patrick McHardy <[email protected]> Signed-off-by: Vladislav Yasevich <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15pptp: verify sockaddr_len in pptp_bind() and pptp_connect()WANG Cong1-0/+6
Reported-by: Dmitry Vyukov <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15ravb: Add disable 10baseKazuya Mizuguchi1-0/+3
Ethernet AVB does not support 10 Mbps transfer speed. Signed-off-by: Kazuya Mizuguchi <[email protected]> Signed-off-by: Yoshihiro Kaneko <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15sh_eth: fix descriptor access endiannessSergei Shtylyov1-10/+14
The driver never calls cpu_to_edmac() when writing the descriptor address and edmac_to_cpu() when reading it, although it should -- fix this. Note that the frame/buffer length descriptor field accesses also need fixing but since they are both 16-bit we can't use {cpu|edmac}_to_{edmac|cpu}()... Signed-off-by: Sergei Shtylyov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15sh_eth: fix TX buffer byte-swappingSergei Shtylyov1-2/+1
For the little-endian SH771x kernels the driver has to byte-swap the RX/TX buffers, however yet unset physcial address from the TX descriptor is used to call sh_eth_soft_swap(). Use 'skb->data' instead... Fixes: 31fcb99d9958 ("net: sh_eth: remove __flush_purge_region") Signed-off-by: Sergei Shtylyov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-14net: fix IP early demux racesEric Dumazet4-6/+37
David Wilder reported crashes caused by dst reuse. <quote David> I am seeing a crash on a distro V4.2.3 kernel caused by a double release of a dst_entry. In ipv4_dst_destroy() the call to list_empty() finds a poisoned next pointer, indicating the dst_entry has already been removed from the list and freed. The crash occurs 18 to 24 hours into a run of a network stress exerciser. </quote> Thanks to his detailed report and analysis, we were able to understand the core issue. IP early demux can associate a dst to skb, after a lookup in TCP/UDP sockets. When socket cache is not properly set, we want to store into sk->sk_dst_cache the dst for future IP early demux lookups, by acquiring a stable refcount on the dst. Problem is this acquisition is simply using an atomic_inc(), which works well, unless the dst was queued for destruction from dst_release() noticing dst refcount went to zero, if DST_NOCACHE was set on dst. We need to make sure current refcount is not zero before incrementing it, or risk double free as David reported. This patch, being a stable candidate, adds two new helpers, and use them only from IP early demux problematic paths. It might be possible to merge in net-next skb_dst_force() and skb_dst_force_safe(), but I prefer having the smallest patch for stable kernels : Maybe some skb_dst_force() callers do not expect skb->dst can suddenly be cleared. Can probably be backported back to linux-3.6 kernels Reported-by: David J. Wilder <[email protected]> Tested-by: David J. Wilder <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-15drm: Don't overwrite UNVERFIED mode status to OKVille Syrjälä1-1/+2
The way the mode probing works is this: 1. All modes currently on the mode list are marked as UNVERIFIED 2. New modes are on the probed_modes list (they start with status OK) 3. Modes are moved from the probed_modes list to the actual mode list. If a mode already on the mode list is deemed to match one of the probed modes, the duplicate is dropped and the mode status updated to OK. After this the probed_modes list will be empty. 4. All modes on the mode list are verified to not violate any constraints. Any that do are marked as such. 5. Any mode left with a non-OK status is pruned from the list, with an appropriate debug message. What all this means is that any mode on the original list that didn't have a duplicate on the probed_modes list, should be left with status UNVERFIED (or previously could have been left with some other status, but never OK). I broke that in commit 05acaec334fc ("drm: Reorganize probed mode validation") by always assigning something to the mode->status during the validation step. So any mode from the old list that still passed the validation would be left on the list with status OK in the end. Fix this by not doing the basic mode validation unless the mode already has status OK (meaning it came from the probed_modes list, or at least a duplicate of it was on that list). This way we will correctly prune away any mode from the old mode list that didn't appear on the probed_modes list. Cc: [email protected] Cc: Adam Jackson <[email protected]> Fixes: 05acaec334fc ("drm: Reorganize probed mode validation") Signed-off-by: Ville Syrjälä <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] Testcase: igt/kms_force_connector_basic/prune-stale-modes Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93332 [danvet: Also applying to drm-misc to avoid too much conflict hell - there's a big pile of patches from Ville on top of this one.] Signed-off-by: Daniel Vetter <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2015-12-14Merge tag 'sunxi-fixes-for-4.4' of ↵Kevin Hilman2-2/+3
https://git.kernel.org/pub/scm/linux/kernel/git/mripard/linux into fixes Merge "Allwinner fixes for 4.4" from Maxime Ripard: Allwinner fixes for 4.4 Two patches, one to fix the touchscreen axis on one Allwinner board, and the other one fixing a mutex unlocking issue on one error path in the RSB driver. * tag 'sunxi-fixes-for-4.4' of https://git.kernel.org/pub/scm/linux/kernel/git/mripard/linux: bus: sunxi-rsb: unlock on error in sunxi_rsb_read() ARM: dts: sunxi: sun6i-a31s-primo81.dts: add touchscreen axis swapping property
2015-12-15Merge tag 'drm-intel-fixes-2015-12-11' of ↵Dave Airlie3-6/+5
git://anongit.freedesktop.org/drm-intel into drm-fixes Here are some i915 fixes for v4.4, sorry for being late this week. * tag 'drm-intel-fixes-2015-12-11' of git://anongit.freedesktop.org/drm-intel: drm/i915: Do a better job at disabling primary plane in the noatomic case. drm/i915/skl: Double RC6 WRL always on drm/i915/skl: Disable coarse power gating up until F0 drm/i915: Remove incorrect warning in context cleanup
Powered by cgit, Gruvboxed by Blaster4385.