aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-08-05ARC: Make pt_regs regs unsignedVineet Gupta2-37/+37
KGDB fails to build after f51e2f191112 ("ARC: make sure instruction_pointer() returns unsigned value") The hack to force one specific reg to unsigned backfired. There's no reason to keep the regs signed after all. | CC arch/arc/kernel/kgdb.o |../arch/arc/kernel/kgdb.c: In function 'kgdb_trap': | ../arch/arc/kernel/kgdb.c:180:29: error: lvalue required as left operand of assignment | instruction_pointer(regs) -= BREAK_INSTR_SIZE; Reported-by: Yuriy Kolerov <[email protected]> Fixes: f51e2f191112 ("ARC: make sure instruction_pointer() returns unsigned value") Cc: Alexey Brodkin <[email protected]> Signed-off-by: Vineet Gupta <[email protected]>
2015-08-05ALSA: fireworks/firewire-lib: add support for recent firmware quirkTakashi Sakamoto5-2/+23
Fireworks uses TSB43CB43(IceLynx-Micro) as its IEC 61883-1/6 interface. This chip includes ARM7 core, and loads and runs program. The firmware is stored in on-board memory and loaded every powering-on from it. Echo Audio ships several versions of firmwares for each model. These firmwares have each quirk and the quirk changes a sequence of packets. As long as I investigated, AudioFire2/AudioFire4/AudioFirePre8 have a quirk to transfer a first packet with 0x02 in its dbc field. This causes ALSA Fireworks driver to detect discontinuity. In this case, firmware version 5.7.0, 5.7.3 and 5.8.0 are used. Payload CIP CIP quadlets header1 header2 02 00050002 90ffffff <- 42 0005000a 90013000 42 00050012 90014400 42 0005001a 90015800 02 0005001a 90ffffff 42 00050022 90019000 42 0005002a 9001a400 42 00050032 9001b800 02 00050032 90ffffff 42 0005003a 9001d000 42 00050042 9001e400 42 0005004a 9001f800 02 0005004a 90ffffff (AudioFire2 with firmware version 5.7.) $ dmesg snd-fireworks fw1.0: Detect discontinuity of CIP: 00 02 These models, AudioFire8 (since Jul 2009 ) and Gibson Robot Interface Pack series uses the same ARM binary as their firmware. Thus, this quirk may be observed among them. This commit adds a new member for AMDTP structure. This member represents the value of dbc field in a first AMDTP packet. Drivers can set it with a preferred value according to model's quirk. Tested-by: Johannes Oertei <[email protected]> Signed-off-by: Takashi Sakamoto <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-08-05Revert "ALSA: fireworks: add support for AudioFire2 quirk"Takashi Sakamoto3-6/+0
This reverts commit 9c6893e0be38b6ca9a56a854226e51dee0a16a5a. The fix is superseded by the next commit as a better implementation for supporting AudioFire2/AudioFire4/AudioFirePre8 quirks. Signed-off-by: Takashi Sakamoto <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-08-04staging: lustre: Include unaligned.h instead of access_ok.hGuenter Roeck1-1/+1
Including access_ok.h causes the ia64:allmodconfig build (and maybe others) to fail with include/linux/unaligned/le_struct.h:6:19: error: redefinition of 'get_unaligned_le16' include/linux/unaligned/access_ok.h:7:19: note: previous definition of 'get_unaligned_le16' was here include/linux/unaligned/le_struct.h:26:20: error: redefinition of 'put_unaligned_le32' include/linux/unaligned/access_ok.h:42:20: note: previous definition of 'put_unaligned_le32' was here include/linux/unaligned/le_struct.h:31:20: error: redefinition of 'put_unaligned_le64' include/linux/unaligned/access_ok.h:47:20: note: previous definition of 'put_unaligned_le64' was here Include unaligned.h instead and leave it up to the architecture to decide how to implement unaligned accesses. Fixes: 8c4f136497315 ("Staging: lustre: Use put_unaligned_le64") Cc: Vaishali Thakkar <[email protected]> Signed-off-by: Guenter Roeck <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-08-04may_follow_link() should use nd->inodeAl Viro1-1/+1
Now that we can get there in RCU mode, we shouldn't play with nd->path.dentry->d_inode - it's not guaranteed to be stable. Use nd->inode instead. Reported-by: Hugh Dickins <[email protected]> Signed-off-by: Al Viro <[email protected]>
2015-08-05batman-adv: initialize up/down values when adding a gatewaySimon Wunderlich1-0/+2
Without this initialization, gateways which actually announce up/down bandwidth of 0/0 could be added. If these nodes get purged via _batadv_purge_orig() later, the gw_node structure does not get removed since batadv_gw_node_delete() updates the gw_node with up/down bandwidth of 0/0, and the updating function then discards the change and does not free gw_node. This results in leaking the gw_node structures, which references other structures: gw_node -> orig_node -> orig_node_ifinfo -> hardif. When removing the interface later, the open reference on the hardif may cause hangs with the infamous "unregister_netdevice: waiting for mesh1 to become free. Usage count = 1" message. Signed-off-by: Simon Wunderlich <[email protected]> Signed-off-by: Marek Lindner <[email protected]> Signed-off-by: Antonio Quartulli <[email protected]>
2015-08-05batman-adv: protect tt_local_entry from concurrent delete eventsMarek Lindner1-1/+10
The tt_local_entry deletion performed in batadv_tt_local_remove() was neither protecting against simultaneous deletes nor checking whether the element was still part of the list before calling hlist_del_rcu(). Replacing the hlist_del_rcu() call with batadv_hash_remove() provides adequate protection via hash spinlocks as well as an is-element-still-in-hash check to avoid 'blind' hash removal. Fixes: 068ee6e204e1 ("batman-adv: roaming handling mechanism redesign") Reported-by: [email protected] Signed-off-by: Marek Lindner <[email protected]> Signed-off-by: Antonio Quartulli <[email protected]>
2015-08-05batman-adv: fix kernel crash due to missing NULL checksMarek Lindner2-4/+17
batadv_softif_vlan_get() may return NULL which has to be verified by the caller. Fixes: 35df3b298fc8 ("batman-adv: fix TT VLAN inconsistency on VLAN re-add") Reported-by: Ryan Thompson <[email protected]> Signed-off-by: Marek Lindner <[email protected]> Signed-off-by: Antonio Quartulli <[email protected]>
2015-08-05batman-adv: avoid DAT to mess up LAN stateAntonio Quartulli1-5/+13
When a node running DAT receives an ARP request from the LAN for the first time, it is likely that this node will request the ARP entry through the distributed ARP table (DAT) in the mesh. Once a DAT reply is received the asking node must check if the MAC address for which the IP address has been asked is local. If it is, the node must drop the ARP reply bceause the client should have replied on its own locally. Forwarding this reply means fooling any L2 bridge (e.g. Ethernet switches) lying between the batman-adv node and the LAN. This happens because the L2 bridge will think that the client sending the ARP reply lies somewhere in the mesh, while this node is sitting in the same LAN. Reported-by: Simon Wunderlich <[email protected]> Signed-off-by: Marek Lindner <[email protected]> Signed-off-by: Antonio Quartulli <[email protected]>
2015-08-04Merge tag 'pci-v4.2-fixes-1' of ↵Linus Torvalds1-0/+1
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fix from Bjorn Helgaas: "This is a trivial fix for a change that broke user program compilation (QEMU in this case)" * tag 'pci-v4.2-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: Restore PCI_MSIX_FLAGS_BIRMASK definition
2015-08-04Merge tag 'topic/mst-fixes-2015-08-04' of ↵Linus Torvalds4-7/+26
git://anongit.freedesktop.org/drm-intel Pull drm mst fixes from Daniel Vetter: "Special pull request for mst fixes since most of the patches touch code outside of i915 proper. DRM parts have also been reviewed by Thierry (nvidia) since Dave's enjoying vacations" * tag 'topic/mst-fixes-2015-08-04' of git://anongit.freedesktop.org/drm-intel: drm/atomic-helpers: Make encoder picking more robust drm/dp-mst: Remove debug WARN_ON drm/i915: Fixup dp mst encoder selection drm/atomic-helper: Add an atomice best_encoder callback
2015-08-04Merge tag 'for-linus-4.2-rc5-tag' of ↵Linus Torvalds5-17/+62
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen bug fixes from David Vrabel: - don't lose interrupts when offlining CPUs - fix gntdev oops during unmap - drop the balloon lock occasionally to allow domain create/destroy * tag 'for-linus-4.2-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/events/fifo: Handle linked events when closing a port xen: release lock occasionally during ballooning xen/gntdevt: Fix race condition in gntdev_release()
2015-08-04ASoC: topology: fix typo in soc_tplg_kcontrol_bind_io()Mengdong Lin1-1/+1
Signed-off-by: Mengdong Lin <[email protected]> Signed-off-by: Liam Girdwood <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2015-08-04ARM: dts: dra7: Add syscon-pllreset syscon to SATA PHYRoger Quadros1-0/+1
This register is required to be passed to the SATA PHY driver to workaround errata i783 (SATA Lockup After SATA DPLL Unlock/Relock). Signed-off-by: Roger Quadros <[email protected]> Acked-by: Tony Lindgren <[email protected]> Signed-off-by: Kishon Vijay Abraham I <[email protected]>
2015-08-04xen/events/fifo: Handle linked events when closing a portRoss Lagerwall3-9/+53
An event channel bound to a CPU that was offlined may still be linked on that CPU's queue. If this event channel is closed and reused, subsequent events will be lost because the event channel is never unlinked and thus cannot be linked onto the correct queue. When a channel is closed and the event is still linked into a queue, ensure that it is unlinked before completing. If the CPU to which the event channel bound is online, spin until the event is handled by that CPU. If that CPU is offline, it can't handle the event, so clear the event queue during the close, dropping the events. This fixes the missing interrupts (and subsequent disk stalls etc.) when offlining a CPU. Signed-off-by: Ross Lagerwall <[email protected]> Cc: <[email protected]> Signed-off-by: David Vrabel <[email protected]>
2015-08-04Merge branch 'rc-fixes' of ↵Linus Torvalds1-2/+7
git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild Pull kbuild fixes from Michal Marek: "Two fixes for kbuild: - The new ARCH_{CPP,A,C}FLAGS variables are reset before including the arch Makefile - Fix calling make modules_install twice when module compression is enabled" * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild: Makefile: Force gzip and xz on module install kbuild: Do not pick up ARCH_{CPP,A,C}FLAGS from the environment
2015-08-04HID: hid-input: Fix accessing freed memory during device disconnectKrzysztof Kozlowski1-2/+5
During unbinding the driver was dereferencing a pointer to memory already freed by power_supply_unregister(). Driver was freeing its internal description of battery through pointers stored in power_supply structure. However, because the core owns the power supply instance, after calling power_supply_unregister() this memory is freed and the driver cannot access these members. Fix this by storing the pointer to internal description of battery in a local variable before calling power_supply_unregister(), so the pointer remains valid. Signed-off-by: Krzysztof Kozlowski <[email protected]> Reported-by: H.J. Lu <[email protected]> Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core") Cc: <[email protected]> Reviewed-by: Dmitry Torokhov <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
2015-08-04drm/atomic-helpers: Make encoder picking more robustDaniel Vetter1-5/+6
We've had a few issues with atomic where subtle bugs in the encoder picking logic lead to accidental self-stealing of the encoder, resulting in a NULL connector_state->crtc in update_connector_routing and subsequent. Linus applied some duct-tape for an mst regression in commit 27667f4744fc5a0f3e50910e78740bac5670d18b Author: Linus Torvalds <[email protected]> Date: Wed Jul 29 22:18:16 2015 -0700 i915: temporary fix for DP MST docking station NULL pointer dereference But that was incomplete (the code will still oops when debuggin is enabled) and mangled the state even further. So instead WARN and bail out as the more future-proof option. Cc: Theodore Ts'o <[email protected]> Cc: Linus Torvalds <[email protected]> Reviewed-by: Thierry Reding <[email protected]> Reviewed-by: Ander Conselvan de Oliveira <[email protected]> Signed-off-by: Daniel Vetter <[email protected]>
2015-08-04drm/dp-mst: Remove debug WARN_ONDaniel Vetter1-1/+0
Apparently been in there since forever and fairly easy to hit when hotplugging really fast. I can do that since my mst hub has a manual button to flick the hpd line for reprobing. The resulting WARNING spam isn't pretty. Cc: Dave Airlie <[email protected]> Cc: [email protected] Reviewed-by: Thierry Reding <[email protected]> Reviewed-by: Ander Conselvan de Oliveira <[email protected]> Signed-off-by: Daniel Vetter <[email protected]>
2015-08-04drm/i915: Fixup dp mst encoder selectionDaniel Vetter1-0/+11
In commit 8c7b5ccb729870e606321b3703e2c2e698c49a95 Author: Ander Conselvan de Oliveira <[email protected]> Date: Tue Apr 21 17:13:19 2015 +0300 drm/i915: Use atomic helpers for computing changed flags we've switched over to the atomic version to compute the crtc->encoder->connector routing from the i915 variant. That one relies upon the ->best_encoder callback, but the i915-private version relied upon intel_find_encoder. Which didn't matter except for dp mst, where the encoder depends upon the selected crtc. Fix this functional bug by implemented a correct atomic-state based encoder selector for dp mst. Note that we can't get rid of the legacy best_encoder callback since the fbdev emulation uses that still. That means it's incorrect there still, but that's been the case ever since i915 dp mst support was merged so not a regression. Best to fix that by converting fbdev over to atomic too. Cc: Chris Wilson <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Theodore Ts'o <[email protected]> Reviewed-by: Ander Conselvan de Oliveira <[email protected]> Signed-off-by: Daniel Vetter <[email protected]>
2015-08-04drm/atomic-helper: Add an atomice best_encoder callbackDaniel Vetter2-1/+9
With legacy helpers all the routing was already set up when calling best_encoder and so could be inspected. But with atomic it's staged, hence we need a new atomic compliant callback for drivers which need to inspect the requested state and can't just decided the best encoder statically. This is needed to fix up i915 dp mst where we need to pick the right encoder depending upon the requested CRTC for the connector. v2: Don't forget to amend the kerneldoc Cc: Chris Wilson <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Theodore Ts'o <[email protected]> Acked-by: Thierry Reding <[email protected]> Reviewed-by: Ander Conselvan de Oliveira <[email protected]> Signed-off-by: Daniel Vetter <[email protected]>
2015-08-04perf: Fix fasync handling on inherited eventsPeter Zijlstra1-2/+10
Vince reported that the fasync signal stuff doesn't work proper for inherited events. So fix that. Installing fasync allocates memory and sets filp->f_flags |= FASYNC, which upon the demise of the file descriptor ensures the allocation is freed and state is updated. Now for perf, we can have the events stick around for a while after the original FD is dead because of references from child events. So we cannot copy the fasync pointer around. We can however consistently use the parent's fasync, as that will be updated. Reported-and-Tested-by: Vince Weaver <[email protected]> Signed-off-by: Peter Zijlstra (Intel) <[email protected]> Cc: <[email protected]> Cc: Arnaldo Carvalho deMelo <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: [email protected] Link: http://lkml.kernel.org/r/1434011521.1495.71.camel@twins Signed-off-by: Ingo Molnar <[email protected]>
2015-08-03xen-netback: Allocate fraglist early to avoid complex rollbackRoss Lagerwall1-28/+33
Determine if a fraglist is needed in the tx path, and allocate it if necessary before setting up the copy and map operations. Otherwise, undoing the copy and map operations is tricky. This fixes a use-after-free: if allocating the fraglist failed, the copy and map operations that had been set up were still executed, writing over the data area of a freed skb. Signed-off-by: Ross Lagerwall <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-08-03udp: fix dst races with multicast early demuxEric Dumazet1-3/+10
Multicast dst are not cached. They carry DST_NOCACHE. As mentioned in commit f8864972126899 ("ipv4: fix dst race in sk_dst_get()"), these dst need special care before caching them into a socket. Caching them is allowed only if their refcnt was not 0, ie we must use atomic_inc_not_zero() Also, we must use READ_ONCE() to fetch sk->sk_rx_dst, as mentioned in commit d0c294c53a771 ("tcp: prevent fetching dst twice in early demux code") Fixes: 421b3885bf6d ("udp: ipv4: Add udp early demux") Tested-by: Gregory Hoggarth <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Reported-by: Gregory Hoggarth <[email protected]> Reported-by: Alex Gartrell <[email protected]> Cc: Michal Kubeček <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-08-04ALSA: HDA: Dont check return for snd_hdac_chip_readlJeeja KP1-6/+0
The snd_hdac_chip_readl return can never be less than zeros, so no point in checking for the return value This fixes following static checker warnings in snd_hdac_ext_bus_parse_capabilities sound/hda/ext/hdac_ext_controller.c:47 snd_hdac_ext_bus_parse_capabilities() warn: unsigned 'offset' is never less than zero. sound/hda/ext/hdac_ext_controller.c:54 snd_hdac_ext_bus_parse_capabilities() warn: unsigned 'cur_cap' is never less than zero. Signed-off-by: Jeeja KP <[email protected]> Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Vinod Koul <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-08-04ALSA: HDA: Fix stream assignment for host in decoupled modeJeeja KP1-1/+1
This fixes issue in assigning host stream in case of decoupled mode. The check to verify if the stream is already in use was wrong so fix that Signed-off-by: Jeeja KP <[email protected]> Signed-off-by: Vinod Koul <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-08-04ARCv2: spinlock/rwlock: Reset retry delay when starting a new spin-wait cycleVineet Gupta1-3/+3
The previous commit for delayed retry of SCOND needs some fine tuning for spin locks. The backoff from delayed retry in conjunction with spin looping of lock itself can potentially cause the delay counter to reach high values. So to provide fairness to any lock operation, after a lock "seems" available (i.e. just before first SCOND try0, reset the delay counter back to starting value of 1 Essentially reset delay to 1 for a new spin-wait-loop-acquire cycle. Acked-by: Peter Zijlstra (Intel) <[email protected]> Signed-off-by: Vineet Gupta <[email protected]>
2015-08-04ARCv2: spinlock/rwlock/atomics: Delayed retry of failed SCOND with ↵Vineet Gupta4-4/+347
exponential backoff This is to workaround the llock/scond livelock HS38x4 could get into a LLOCK/SCOND livelock in case of multiple overlapping coherency transactions in the SCU. The exclusive line state keeps rotating among contenting cores leading to a never ending cycle. So break the cycle by deferring the retry of failed exclusive access (SCOND). The actual delay needed is function of number of contending cores as well as the unrelated coherency traffic from other cores. To keep the code simple, start off with small delay of 1 which would suffice most cases and in case of contention double the delay. Eventually the delay is sufficient such that the coherency pipeline is drained, thus a subsequent exclusive access would succeed. Link: http://lkml.kernel.org/r/[email protected] Acked-by: Peter Zijlstra (Intel) <[email protected]> Signed-off-by: Vineet Gupta <[email protected]>
2015-08-04ARC: LLOCK/SCOND based rwlockVineet Gupta2-10/+166
With LLOCK/SCOND, the rwlock counter can be atomically updated w/o need for a guarding spin lock. This in turn elides the EXchange instruction based spinning which causes the cacheline transition to exclusive state and concurrent spinning across cores would cause the line to keep bouncing around. LLOCK/SCOND based implementation is superior as spinning on LLOCK keeps the cacheline in shared state. Acked-by: Peter Zijlstra (Intel) <[email protected]> Signed-off-by: Vineet Gupta <[email protected]>
2015-08-04ARC: LLOCK/SCOND based spin_lockVineet Gupta1-7/+69
Current spin_lock uses EXchange instruction to implement the atomic test and set of lock location (reads orig value and ST 1). This however forces the cacheline into exclusive state (because of the ST) and concurrent loops in multiple cores will bounce the line around between cores. Instead, use LLOCK/SCOND to implement the atomic test and set which is better as line is in shared state while lock is spinning on LLOCK The real motivation of this change however is to make way for future changes in atomics to implement delayed retry (with backoff). Initial experiment with delayed retry in atomics combined with orig EX based spinlock was a total disaster (broke even LMBench) as struct sock has a cache line sharing an atomic_t and spinlock. The tight spinning on lock, caused the atomic retry to keep backing off such that it would never finish. Acked-by: Peter Zijlstra (Intel) <[email protected]> Signed-off-by: Vineet Gupta <[email protected]>
2015-08-04ARC: refactor atomic inline asm operands with symbolic namesVineet Gupta1-15/+17
This reduces the diff in forth-coming patches and also helps understand better the incremental changes to inline asm. Acked-by: Peter Zijlstra (Intel) <[email protected]> Signed-off-by: Vineet Gupta <[email protected]>
2015-08-04Revert "ARCv2: STAR 9000837815 workaround hardware exclusive transactions ↵Vineet Gupta1-12/+2
livelock" Extended testing of quad core configuration revealed that this fix was insufficient. Specifically LTP open posix shm_op/23-1 would cause the hardware livelock in llock/scond loop in update_cpu_load_active() So remove this and make way for a proper workaround This reverts commit a5c8b52abe677977883655166796f167ef1e0084. Signed-off-by: Vineet Gupta <[email protected]>
2015-08-04ARCv2: [axs103_smp] Reduce clk for Quad FPGA configsVineet Gupta1-0/+15
Signed-off-by: Vineet Gupta <[email protected]>
2015-08-03dm: fix dm_merge_bvec regression on 32 bit systemsMike Snitzer1-17/+10
A DM regression on 32 bit systems was reported against v4.2-rc3 here: https://lkml.org/lkml/2015/7/29/401 Fix this by reverting both commit 1c220c69 ("dm: fix casting bug in dm_merge_bvec()") and 148e51ba ("dm: improve documentation and code clarity in dm_merge_bvec"). This combined revert is done to eliminate the possibility of a partial revert in stable@ kernels. In hindsight the correct fix, at the time 1c220c69 was applied to fix the regression that 148e51ba introduced, should've been to simply revert 148e51ba. Reported-by: Josh Boyer <[email protected]> Tested-by: Adam Williamson <[email protected]> Acked-by: Joe Thornber <[email protected]> Signed-off-by: Mike Snitzer <[email protected]> Cc: [email protected] # 3.19+
2015-08-03staging: vt6655: vnt_bss_info_changed check conf->beacon_rate is not NULLMalcolm Priestley1-2/+3
conf->beacon_rate can be NULL on association. So check conf->beacon_rate BSS_CHANGED_BEACON_INFO needs to flagged in changed as the beacon_rate will appear later. Signed-off-by: Malcolm Priestley <[email protected]> Cc: <[email protected]> # v3.19+ Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-08-033c59x: Fix resource leaks in vortex_openJia-Ju Bai1-9/+8
When vortex_up is failed, the skb buffers allocated by __netdev_alloc_skb in vortex_open are not released, which may cause resource leaks. This bug has been submitted before. This patch modifies the error handling code to fix it. Signed-off-by: Jia-Ju Bai <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-08-03rds: fix an integer overflow test in rds_info_getsockopt()Dan Carpenter1-1/+1
"len" is a signed integer. We check that len is not negative, so it goes from zero to INT_MAX. PAGE_SIZE is unsigned long so the comparison is type promoted to unsigned long. ULONG_MAX - 4095 is a higher than INT_MAX so the condition can never be true. I don't know if this is harmful but it seems safe to limit "len" to INT_MAX - 4095. Fixes: a8c879a7ee98 ('RDS: Info and stats') Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-08-03Merge branch 'i2c/for-current' of ↵Linus Torvalds5-18/+30
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "A refcounting bugfix for the i2c-core, bugfixes for the generic bus recovery algorithm and for its omap-user, making binary file attributes for EEPROMs behave POSIX compliant, and a small typo fix while we are here" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: fix leaked device refcount on of_find_i2c_* error path i2c: Fix typo in i2c-bfin-twi.c i2c: omap: fix bus recovery setup i2c: core: only use set_scl for bus recovery after calling prepare_recovery misc: eeprom: at24: clean up at24_bin_write() i2c: slave eeprom: clean up sysfs bin attribute read()/write()
2015-08-03drivers/usb: Delete XHCI command timer if necessaryGavin Shan1-1/+2
When xhci_mem_cleanup() is called, it's possible that the command timer isn't initialized and scheduled. For those cases, to delete the command timer causes soft-lockup as below stack dump shows. The patch avoids deleting the command timer if it's not scheduled with the help of timer_pending(). NMI watchdog: BUG: soft lockup - CPU#40 stuck for 23s! [kworker/40:1:8140] : NIP [c000000000150b30] lock_timer_base.isra.34+0x90/0xa0 LR [c000000000150c24] try_to_del_timer_sync+0x34/0xa0 Call Trace: [c000000f67c975e0] [c0000000015b84f8] mon_ops+0x0/0x8 (unreliable) [c000000f67c97620] [c000000000150c24] try_to_del_timer_sync+0x34/0xa0 [c000000f67c97660] [c000000000150cf0] del_timer_sync+0x60/0x80 [c000000f67c97690] [c00000000070ac0c] xhci_mem_cleanup+0x5c/0x5e0 [c000000f67c97740] [c00000000070c2e8] xhci_mem_init+0x1158/0x13b0 [c000000f67c97860] [c000000000700978] xhci_init+0x88/0x110 [c000000f67c978e0] [c000000000701644] xhci_gen_setup+0x2b4/0x590 [c000000f67c97970] [c0000000006d4410] xhci_pci_setup+0x40/0x190 [c000000f67c979f0] [c0000000006b1af8] usb_add_hcd+0x418/0xba0 [c000000f67c97ab0] [c0000000006cb15c] usb_hcd_pci_probe+0x1dc/0x5c0 [c000000f67c97b50] [c0000000006d3ba4] xhci_pci_probe+0x64/0x1f0 [c000000f67c97ba0] [c0000000004fe9ac] local_pci_probe+0x6c/0x130 [c000000f67c97c30] [c0000000000e5ce8] work_for_cpu_fn+0x38/0x60 [c000000f67c97c60] [c0000000000eacb8] process_one_work+0x198/0x470 [c000000f67c97cf0] [c0000000000eb6ac] worker_thread+0x37c/0x5a0 [c000000f67c97d80] [c0000000000f2730] kthread+0x110/0x130 [c000000f67c97e30] [c000000000009660] ret_from_kernel_thread+0x5c/0x7c Cc: <[email protected]> Reported-by: Priya M. A <[email protected]> Signed-off-by: Gavin Shan <[email protected]> Signed-off-by: Mathias Nyman <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-08-03xhci: fix off by one error in TRB DMA address boundary checkMathias Nyman1-1/+1
We need to check that a TRB is part of the current segment before calculating its DMA address. Previously a ring segment didn't use a full memory page, and every new ring segment got a new memory page, so the off by one error in checking the upper bound was never seen. Now that we use a full memory page, 256 TRBs (4096 bytes), the off by one didn't catch the case when a TRB was the first element of the next segment. This is triggered if the virtual memory pages for a ring segment are next to each in increasing order where the ring buffer wraps around and causes errors like: [ 106.398223] xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 0 comp_code 1 [ 106.398230] xhci_hcd 0000:00:14.0: Looking for event-dma fffd3000 trb-start fffd4fd0 trb-end fffd5000 seg-start fffd4000 seg-end fffd4ff0 The trb-end address is one outside the end-seg address. Cc: <[email protected]> Tested-by: Arkadiusz Miśkiewicz <[email protected]> Signed-off-by: Mathias Nyman <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-08-03Merge tag 'fixes-for-v4.2-rc6' of ↵Greg Kroah-Hartman1-0/+1
git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: usb: fixes for v4.2-rc6 Just one major fix which has been pending since January. Somehow it fell through the cracks, but here it is. Basically, this fixes a bug in udc-core when gadget registration fails. Signed-off-by: Felipe Balbi <[email protected]>
2015-08-03act_mirred: avoid calling tcf_hash_release() when bindingWANG Cong1-0/+2
When we share an action within a filter, the bind refcnt should increase, therefore we should not call tcf_hash_release(). Cc: Jamal Hadi Salim <[email protected]> Cc: Daniel Borkmann <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-08-03Input: alps - only Dell laptops have separate button bits for v2 dualpoint ↵Hans de Goede2-4/+10
sticks It turns out that only Dell laptops have the separate button bits for v2 dualpoint sticks and that commit 92bac83dd79e ("Input: alps - non interleaved V2 dualpoint has separate stick button bits") causes regressions on Toshiba laptops. This commit adds a check for Dell laptops to the code for handling these extra button bits, fixing this regression. This patch has been tested on a Dell Latitude D620 to make sure that it does not reintroduce the original problem. Reported-and-tested-by: Douglas Christman <[email protected]> Cc: [email protected] Signed-off-by: Hans de Goede <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2015-08-03Input: axp20x-pek - add module aliasChen-Yu Tsai1-0/+1
Add a proper module alias so the driver can be autoloaded when the parent axp20x mfd driver registers its cells. Signed-off-by: Chen-Yu Tsai <[email protected]> Acked-by: Carlo Caione <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2015-08-03Input: turbografx - fix potential out of bound accessDmitry Torokhov1-1/+1
Patch 17dd3f0f7aa7: "[PATCH] drivers/input/joystick: convert to dynamic input_dev allocation" from Sep 15, 2005, leads to the following static checker warning: drivers/input/joystick/turbografx.c:235 tgfx_probe() error: buffer overflow 'tgfx_buttons' 5 <= 5 drivers/input/joystick/turbografx.c 195 for (i = 0; i < n_devs; i++) { 196 if (n_buttons[i] < 1) 197 continue; 198 199 if (n_buttons[i] > 6) { ^^^^^^^^^^^^^^^^ Possibly off by one. >= 6. Let's change the upper value to ARRAY_SIZE(tgfx_buttons) to ensure we do not reach past the end of the array. Reported-by: Dan Carpenter <[email protected]> Reviewed-by: Dan Carpenter <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2015-08-03openvswitch: Fix L4 checksum handling when dealing with IP fragmentsGlenn Griffin1-4/+12
openvswitch modifies the L4 checksum of a packet when modifying the ip address. When an IP packet is fragmented only the first fragment contains an L4 header and checksum. Prior to this change openvswitch would modify all fragments, modifying application data in non-first fragments, causing checksum failures in the reassembled packet. Signed-off-by: Glenn Griffin <[email protected]> Acked-by: Pravin B Shelar <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-08-03Merge branch 'for-linus' of ↵Linus Torvalds4-24/+23
git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client Pull Ceph fixes from Sage Weil: "There are two critical regression fixes for CephFS from Zheng, and an RBD completion fix for layered images from Ilya" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: rbd: fix copyup completion race ceph: always re-send cap flushes when MDS recovers ceph: fix ceph_encode_locks_to_buffer()
2015-08-03Merge branch 'for-linus' of ↵Linus Torvalds1-0/+1
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull security layer fix from James Morris: "Yama initialization fix" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: Adding YAMA hooks also when YAMA is not stacked.
2015-08-03Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds3-10/+17
Pull crypto fixes from Herbert Xu: "This fixes the following issues: - a bogus BUG_ON in ixp4xx that can be triggered by a dst buffer that is an SG list. - the error handling in hwrngd may cause a crash in case of an error. - fix a race condition in qat registration when multiple devices are present" * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: hwrng: core - correct error check of kthread_run call crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer crypto: qat - Fix invalid synchronization between register/unregister sym algs
2015-08-03Merge tag 'fixes-for-linus' of ↵Linus Torvalds1-2/+6
git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux Pull module fix from Rusty Russell: "Single overzealous locking assertion fix" * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: module: weaken locking assertion for oops path.
Powered by cgit, Gruvboxed by Blaster4385.