aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-05-22bridge: fix parsing of MLDv2 reportsThadeu Lima de Souza Cascardo1-1/+1
When more than a multicast address is present in a MLDv2 report, all but the first address is ignored, because the code breaks out of the loop if there has not been an error adding that address. This has caused failures when two guests connected through the bridge tried to communicate using IPv6. Neighbor discoveries would not be transmitted to the other guest when both used a link-local address and a static address. This only happens when there is a MLDv2 querier in the network. The fix will only break out of the loop when there is a failure adding a multicast address. The mdb before the patch: dev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp dev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp dev ovirtmgmt port bond0.86 grp ff02::2 temp After the patch: dev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp dev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp dev ovirtmgmt port bond0.86 grp ff02::fb temp dev ovirtmgmt port bond0.86 grp ff02::2 temp dev ovirtmgmt port bond0.86 grp ff02::d temp dev ovirtmgmt port vnet0 grp ff02::1:ff00:76 temp dev ovirtmgmt port bond0.86 grp ff02::16 temp dev ovirtmgmt port vnet1 grp ff02::1:ff00:77 temp dev ovirtmgmt port bond0.86 grp ff02::1:ff00:def temp dev ovirtmgmt port bond0.86 grp ff02::1:ffa1:40bf temp Fixes: 08b202b67264 ("bridge br_multicast: IPv6 MLD support.") Reported-by: Rik Theys <[email protected]> Signed-off-by: Thadeu Lima de Souza Cascardo <[email protected]> Tested-by: Rik Theys <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-05-22ARM: zynq: DT: Use the zynq binding with macbNathan Sullivan1-2/+2
Use the new zynq binding for macb ethernet, since it will disable half duplex gigabit like the Zynq TRM says to do. Signed-off-by: Nathan Sullivan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-05-22net: macb: Disable half duplex gigabit on ZynqNathan Sullivan2-0/+13
According to the Zynq TRM, gigabit half duplex is not supported. Add a new cap and compatible string so Zynq can avoid advertising that mode. Signed-off-by: Nathan Sullivan <[email protected]> Acked-by: Nicolas Ferre <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-05-22net: macb: Document zynq gem dt bindingNathan Sullivan1-1/+2
Signed-off-by: Nathan Sullivan <[email protected]> Acked-by: Nicolas Ferre <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-05-22ipv4: fill in table id when replacing a routeMichal Kubeček1-0/+1
When replacing an IPv4 route, tb_id member of the new fib_alias structure is not set in the replace code path so that the new route is ignored. Fixes: 0ddcf43d5d4a ("ipv4: FIB Local/MAIN table collapse") Signed-off-by: Michal Kubecek <[email protected]> Acked-by: Alexander Duyck <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-05-22cdc_ncm: Fix tx_bytes statisticsBjørn Mork1-1/+1
The tx_curr_frame_payload field is u32. When we try to calculate a small negative delta based on it, we end up with a positive integer close to 2^32 instead. So the tx_bytes pointer increases by about 2^32 for every transmitted frame. Fix by calculating the delta as a signed long. Cc: Ben Hutchings <[email protected]> Reported-by: Florian Bruhin <[email protected]> Fixes: 7a1e890e2168 ("usbnet: Fix tx_bytes statistic running backward in cdc_ncm") Signed-off-by: Bjørn Mork <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-05-22Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nfDavid S. Miller8-36/+51
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contain Netfilter fixes for your net tree, they are: 1) Fix a race in nfnetlink_log and nfnetlink_queue that can lead to a crash. This problem is due to wrong order in the per-net registration and netlink socket events. Patch from Francesco Ruggeri. 2) Make sure that counters that userspace pass us are higher than 0 in all the x_tables frontends. Discovered via Trinity, patch from Dave Jones. 3) Revert a patch for br_netfilter to rely on the conntrack status bits. This breaks stateless IPv6 NAT transformations. Patch from Florian Westphal. ==================== Signed-off-by: David S. Miller <[email protected]>
2015-05-22ipv4: Avoid crashing in ip_errorEric W. Biederman1-0/+4
ip_error does not check if in_dev is NULL before dereferencing it. IThe following sequence of calls is possible: CPU A CPU B ip_rcv_finish ip_route_input_noref() ip_route_input_slow() inetdev_destroy() dst_input() With the result that a network device can be destroyed while processing an input packet. A crash was triggered with only unicast packets in flight, and forwarding enabled on the only network device. The error condition was created by the removal of the network device. As such it is likely the that error code was -EHOSTUNREACH, and the action taken by ip_error (if in_dev had been accessible) would have been to not increment any counters and to have tried and likely failed to send an icmp error as the network device is going away. Therefore handle this weird case by just dropping the packet if !in_dev. It will result in dropping the packet sooner, and will not result in an actual change of behavior. Fixes: 251da4130115b ("ipv4: Cache ip_error() routes even when not forwarding.") Reported-by: Vittorio Gambaletta <[email protected]> Tested-by: Vittorio Gambaletta <[email protected]> Signed-off-by: Vittorio Gambaletta <[email protected]> Signed-off-by: "Eric W. Biederman" <[email protected]> Acked-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-05-22tcp: fix a potential deadlock in tcp_get_info()Eric Dumazet4-4/+17
Taking socket spinlock in tcp_get_info() can deadlock, as inet_diag_dump_icsk() holds the &hashinfo->ehash_locks[i], while packet processing can use the reverse locking order. We could avoid this locking for TCP_LISTEN states, but lockdep would certainly get confused as all TCP sockets share same lockdep classes. [ 523.722504] ====================================================== [ 523.728706] [ INFO: possible circular locking dependency detected ] [ 523.734990] 4.1.0-dbg-DEV #1676 Not tainted [ 523.739202] ------------------------------------------------------- [ 523.745474] ss/18032 is trying to acquire lock: [ 523.750002] (slock-AF_INET){+.-...}, at: [<ffffffff81669d44>] tcp_get_info+0x2c4/0x360 [ 523.758129] [ 523.758129] but task is already holding lock: [ 523.763968] (&(&hashinfo->ehash_locks[i])->rlock){+.-...}, at: [<ffffffff816bcb75>] inet_diag_dump_icsk+0x1d5/0x6c0 [ 523.774661] [ 523.774661] which lock already depends on the new lock. [ 523.774661] [ 523.782850] [ 523.782850] the existing dependency chain (in reverse order) is: [ 523.790326] -> #1 (&(&hashinfo->ehash_locks[i])->rlock){+.-...}: [ 523.796599] [<ffffffff811126bb>] lock_acquire+0xbb/0x270 [ 523.802565] [<ffffffff816f5868>] _raw_spin_lock+0x38/0x50 [ 523.808628] [<ffffffff81665af8>] __inet_hash_nolisten+0x78/0x110 [ 523.815273] [<ffffffff816819db>] tcp_v4_syn_recv_sock+0x24b/0x350 [ 523.822067] [<ffffffff81684d41>] tcp_check_req+0x3c1/0x500 [ 523.828199] [<ffffffff81682d09>] tcp_v4_do_rcv+0x239/0x3d0 [ 523.834331] [<ffffffff816842fe>] tcp_v4_rcv+0xa8e/0xc10 [ 523.840202] [<ffffffff81658fa3>] ip_local_deliver_finish+0x133/0x3e0 [ 523.847214] [<ffffffff81659a9a>] ip_local_deliver+0xaa/0xc0 [ 523.853440] [<ffffffff816593b8>] ip_rcv_finish+0x168/0x5c0 [ 523.859624] [<ffffffff81659db7>] ip_rcv+0x307/0x420 Lets use u64_sync infrastructure instead. As a bonus, 64bit arches get optimized, as these are nop for them. Fixes: 0df48c26d841 ("tcp: add tcpi_bytes_acked to tcp_info") Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-05-22ARM: pxa: pxa_cplds: signedness bug in probeRobert Jarzmik1-1/+1
"base_irq" needs to be signed for the error handling to work. Also we can remove the initialization because we re-assign it later. Fixes: aa8d6b73ea33 ('ARM: pxa: pxa_cplds: add lubbock and mainstone IO') Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Robert Jarzmik <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]>
2015-05-22dmaengine: pl330: Fix hang on dmaengine_terminate_all on certain boardsKrzysztof Kozlowski1-0/+3
The pl330 device could hang infinitely on certain boards when DMA channels are terminated. It was caused by lack of runtime resume when executing pl330_terminate_all() which calls the _stop() function. _stop() accesses device register and can loop infinitely while checking for device state. The hang was confirmed by Dinh Nguyen on Altera SOCFPGA Cyclone V board during boot. It can be also triggered with: $ echo 1 > /sys/module/dmatest/parameters/iterations $ echo dma1chan0 > /sys/module/dmatest/parameters/channel $ echo 1 > /sys/module/dmatest/parameters/run $ sleep 1 $ cat /sys/module/dmatest/parameters/run Reported-by: Dinh Nguyen <[email protected]> Signed-off-by: Krzysztof Kozlowski <[email protected]> Fixes: ae43b3289186 ("ARM: 8202/1: dmaengine: pl330: Add runtime Power Management support v12") Cc: <[email protected]> Tested-by: Dinh Nguyen <[email protected]> Signed-off-by: Vinod Koul <[email protected]>
2015-05-22Merge tag 'iwlwifi-for-kalle-2015-05-21' of ↵Kalle Valo11-30/+69
https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes * fix firmware name and other things to enable 3165 * fix bad APMG configuration for 8000 (no AMPG on these devices) * fix MAC address assignment for 8000 * fix firmware debugging triggers (MLME) * fix several bugs in low power states code (net-detect, d0i3)
2015-05-22drm/plane-helper: Adapt cursor hack to transitional helpersDaniel Vetter1-0/+3
In commit f02ad907cd9e7fe3a6405d2d005840912f1ed258 Author: Daniel Vetter <[email protected]> Date: Thu Jan 22 16:36:23 2015 +0100 drm/atomic-helpers: Recover full cursor plane behaviour we've added a hack to atomic helpers to never to vblank waits for cursor updates through the legacy apis since that's what X expects. Unfortunately we've (again) forgotten to adjust the transitional helpers. Do this now. This fixes regressions for drivers only partially converted over to atomic (like i915). Reported-by: Pekka Paalanen <[email protected]> Cc: Pekka Paalanen <[email protected]> Cc: [email protected] Signed-off-by: Daniel Vetter <[email protected]> Reviewed-and-tested-by: Mario Kleiner <[email protected]> Signed-off-by: Jani Nikula <[email protected]>
2015-05-22Merge branch 'drm-fixes-4.1' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie2-11/+11
into drm-fixes Just two small DP fixes for 4.1 * 'drm-fixes-4.1' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: fix error flag checking in native aux path drm/radeon: retry dcpd fetch
2015-05-22Merge tag 'drm-intel-fixes-2015-05-21' of ↵Dave Airlie1-13/+11
git://anongit.freedesktop.org/drm-intel into drm-fixes There's a stable backport from Ander [1] that combines this and a few other commits to fix the flickering on v4.0, reported in [2] among others. Having this upstream is obviously a requirement for stable. * tag 'drm-intel-fixes-2015-05-21' of git://anongit.freedesktop.org/drm-intel: drm/i915: fix screen flickering
2015-05-22crypto: s390/ghash - Fix incorrect ghash icv buffer handling.Harald Freudenberger1-12/+13
Multitheaded tests showed that the icv buffer in the current ghash implementation is not handled correctly. A move of this working ghash buffer value to the descriptor context fixed this. Code is tested and verified with an multithreaded application via af_alg interface. Cc: [email protected] Signed-off-by: Harald Freudenberger <[email protected]> Signed-off-by: Gerald Schaefer <[email protected]> Reported-by: Herbert Xu <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
2015-05-21Merge tag 'for-linus-4.1b-rc4-tag' of ↵Linus Torvalds4-6/+11
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull two xen bugfixes from David Vrabel: - fix ARM build regression. - fix VIRQ_CONSOLE related oops. * tag 'for-linus-4.1b-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/events: don't bind non-percpu VIRQs with percpu chip xen/arm: Define xen_arch_suspend()
2015-05-21Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds11-19/+74
Pull KVM fixes from Paolo Bonzini: "This includes a fix for two oopses, one on PPC and on x86. The rest is fixes for bugs with newer Intel processors" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvm/fpu: Enable eager restore kvm FPU for MPX Revert "KVM: x86: drop fpu_activate hook" kvm: fix crash in kvm_vcpu_reload_apic_access_page KVM: MMU: fix SMAP virtualization KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages KVM: MMU: fix smap permission check KVM: PPC: Book3S HV: Fix list traversal in error case
2015-05-21Merge branch 'for-linus' of ↵Linus Torvalds4-22/+21
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: "Bug fixes. Three for our crypto code, two for eBPF, and one memory management fix to get machines with memory > 8TB working" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/mm: correct return value of pmd_pfn s390/crypto: fix stckf loop s390/zcrypt: Fix invalid domain handling during ap module unload s390/bpf: Fix gcov stack space problem s390/zcrypt: fixed ap poll timer behavior s390/bpf: Adjust ALU64_DIV/MOD to match interpreter change
2015-05-21Merge tag 'sound-4.1-rc5' of ↵Linus Torvalds12-14/+93
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This batch became slightly large, just because I've been on vacation for the last two weeks. Nothing to scare much here, all device-specific fixes, mostly small patches. Majority of patches are for HD-audio, especially Dell machines. The rest are small ASoC fixes for various codecs, and a USB-audio quirk. One PCM fix is included to ease the faulty condition checks in the case of two periods PCM buffers" * tag 'sound-4.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Disable widget power-saving for ALC292 & co ALSA: hda - Reduce verbs by node power-saves ALSA: sound/atmel/ac97c.c: remove unused variable ALSA: usb-audio: Add quirk for MS LifeCam Studio ALSA: pcm: Modify double acknowledged interrupts check condition ALSA: hda/realtek - ALC292 dock fix for Thinkpad L450 ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 ALSA: hda - Fix headset mic and mic-in for a Dell desktop ASoC: wm8994: correct BCLK DIV 348 to 384 ASoC: wm8960: fix "RINPUT3" audio route error ASoC: dapm: Modify widget stream name according to prefix ALSA: hda - Add headset mic quirk for Dell Inspiron 5548 ASoC: rt5645: Fix mask for setting RT5645_DMIC_2_DP_GPIO12 bit ASoC: rt5645: Add ACPI match ID ALSA: hda/realtek - Add ALC298 alias name for Dell ASoC: uda1380: Avoid accessing i2c bus when codec is disabled ALSA: hda/realtek - Fix typo for ALC286/ALC288 ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls ALSA: hda - Add headphone quirk for Lifebook E752 ASoC: davinci-mcasp: Correct pm status check in suspend callback
2015-05-21Merge branch 'for-rc' of ↵Linus Torvalds5-7/+89
git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux Pull thermal fixes from Zhang Rui: "Three fixes for Armada (380) and TI (dra7 and OMAP5) thermal soc drivers" * 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux: thermal: armada: Update Armada 380 thermal sensor coefficients thermal: ti-soc-thermal: OMAP5: Implement Workaround for Errata i813 thermal: ti-soc-thermal: dra7: Implement Workaround for Errata i814
2015-05-21Merge tag 'for-linus' of ↵Linus Torvalds7-53/+101
git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull infiniband/rdma fixes from Doug Ledford: "This should hopefully be the last request for 4.1-rc for the RDMA stack. It contains some late ocrdma fixes that I'm including because they are small and self contained. It also contains two bug fixes that are simple and easily verified. Summary: - a number of small, well contained bug fixes for ocrdma driver - a simple fix for the connection negotiation sequence on IB - fix for broken AF_IB address on UD queue pair support" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: IB/cma: Fix broken AF_IB UD support ib/cm: Change reject message type when destroying cm_id RDMA/ocrdma: Update ocrdma version number RDMA/ocrdma: Fail connection for MTU lesser than 512 RDMA/ocrdma: Fix dmac resolution for link local address RDMA/ocrdma: Prevent allocation of DPP PDs if FW doesnt support it RDMA/ocrdma: Fix the request length for RDMA_QUERY_QP mailbox command to FW. RDMA/ocrdma: Use VID 0 if PFC is enabled and vlan is not configured RDMA/ocrdma: Fix QP state transition in destroy_qp RDMA/ocrdma: Report EQ full fatal error RDMA/ocrdma: Fix EQ destroy failure during driver unload
2015-05-21Merge tag 'mmc-4.1-rc3' of git://git.linaro.org/people/ulf.hansson/mmcLinus Torvalds1-2/+7
Pull MMC fix from Ulf Hansson: "One more mmc fix intended for v4.1 rc5: MMC host: - atmel-mci: fix bad variable type for clkdiv" * tag 'mmc-4.1-rc3' of git://git.linaro.org/people/ulf.hansson/mmc: mmc: atmel-mci: fix bad variable type for clkdiv
2015-05-21Merge branch 'for-linus' of ↵Linus Torvalds7-26/+21
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: "Bugfixes for HID subsystem that should go in 4.1. Important highlights: - the patch that extended support for HID++ protocol for TK820 touchpad turns out to be causing regressions due to firmware issues; patch reverting back to basic support from Benjamin Tissoires - Wacom driver can oops for devices that report non-touch data on touch interfaces. Fix from Ping Cheng - gpiolib is not mandatory for i2c-hid, so the driver shouldn't fail if gpiolib is not enabled. Fix from Mika Westerberg" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: wacom: fix an Oops caused by wacom_wac_finger_count_touches HID: usbhid: Add HID_QUIRK_NOGET for Aten DVI KVM switch HID: hid-sensor-hub: Fix debug lock warning Revert "HID: logitech-hidpp: support combo keyboard touchpad TK820" HID: i2c-hid: Do not fail probing if gpiolib is not enabled
2015-05-21Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds1-5/+4
Pull crypto fix from Herbert Xu: "This fixes a the crash in the newly added algif_aead interface when it tries to link SG lists" * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: algif_aead - fix invalid sgl linking
2015-05-21Input: smtpe-ts - wait 50mS until polling for pen-upMarek Vasut1-1/+1
Wait a little bit longer, 50mS instead of 20mS, until the driver starts polling for pen-up. The problematic behavior before this patch is applied is as follows. The behavior was observed on the STMPE610QTR controller. Upon a physical pen-down event, the touchscreen reports one set of x-y-p coordinates and a pen-down event. After that, the pen-up polling is triggered and since the controller is not ready yet, the polling mistakenly detects a pen-up event while the physical state is still such that the pen is down on the touch surface. The pen-up handling flushes the controller FIFO, so after that, all the samples in the controller are discarded. The controller becomes ready shortly after this bogus pen-up handling and does generate again a pen-down interrupt. This time, the controller contains x-y-p samples which all read as zero. Since pressure value is zero, this set of samples is effectively ignored by userland. In the end, the driver just bounces between pen-down and bogus pen-up handling, generating no useful results. Fix this by giving the controller a bit more time before polling it for pen-up. Signed-off-by: Marek Vasut <[email protected]> Reviewed-by: Viresh Kumar <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2015-05-21Input: smtpe-ts - use msecs_to_jiffies() instead of HZMarek Vasut1-1/+1
Use msecs_to_jiffies(20) instead of plain (HZ / 50), as the former is much more explicit about it's behavior. We want to schedule the task 20 mS from now, so make it explicit in the code. Signed-off-by: Marek Vasut <[email protected]> Reviewed-by: Viresh Kumar <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2015-05-21Merge tag 'clk-fixes-for-linus' of ↵Linus Torvalds8-32/+66
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Michael Turquette: "The first set of clk fixes for 4.1 are all driver bugs, with the exception of a single locking fix in the core code. All driver fixes are for code that was merged recently. The Samsung stuff is mostly fixes around suspend/resume, the Qualcomm fixes are for invalid hardware configuration data and the Silicon Labs patches are fixes following their move away from platform_data to Device Tree" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: si5351: Do not pass struct clk in platform_data clk: si5351: Mention clock-names in the binding documentation clk: add missing lock when call clk_core_enable in clk_set_parent clk: exynos5420: Restore GATE_BUS_TOP on suspend clk: qcom: Fix MSM8916 gfx3d_clk_src configuration clk: qcom: Fix MSM8916 venus divider value clk: exynos5433: Fix wrong PMS value of exynos5433_pll_rates clk: exynos5433: Fix wrong parent clock of sclk_apollo clock clk: exynos5433: Fix CLK_PCLK_MONOTONIC_CNT clk register assignment clk: exynos5433: Fix wrong offset of PCLK_MSCL_SECURE_SMMU_JPEG clk: Use CONFIG_ARCH_EXYNOS instead of CONFIG_ARCH_EXYNOS5433
2015-05-21Merge tag 'hwmon-for-linus-v4.1-rc5' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixlet from Guenter Roeck: "Update location of Jean Delvare's hwmon quilt tree" * tag 'hwmon-for-linus-v4.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: Update the location of my quilt tree
2015-05-21Input: joydev - don't classify the vmmouse as a joystickThomas Hellstrom1-0/+61
Joydev is currently thinking some absolute mice are joystick, and that messes up games in VMware guests, as the cursor typically gets stuck in the top left corner. Try to detect the event signature of a VMmouse input device and back off for such devices. We're still incorrectly detecting, for example, the VMware absolute USB mouse as a joystick, but adding an event signature matching also that device would be considerably more risky, so defer that to a later merge window. Signed-off-by: Thomas Hellstrom <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2015-05-21net: sched: fix call_rcu() race on classifier module unloadsDaniel Borkmann1-0/+5
Vijay reported that a loop as simple as ... while true; do tc qdisc add dev foo root handle 1: prio tc filter add dev foo parent 1: u32 match u32 0 0 flowid 1 tc qdisc del dev foo root rmmod cls_u32 done ... will panic the kernel. Moreover, he bisected the change apparently introducing it to 78fd1d0ab072 ("netlink: Re-add locking to netlink_lookup() and seq walker"). The removal of synchronize_net() from the netlink socket triggering the qdisc to be removed, seems to have uncovered an RCU resp. module reference count race from the tc API. Given that RCU conversion was done after e341694e3eb5 ("netlink: Convert netlink_lookup() to use RCU protected hash table") which added the synchronize_net() originally, occasion of hitting the bug was less likely (not impossible though): When qdiscs that i) support attaching classifiers and, ii) have at least one of them attached, get deleted, they invoke tcf_destroy_chain(), and thus call into ->destroy() handler from a classifier module. After RCU conversion, all classifier that have an internal prio list, unlink them and initiate freeing via call_rcu() deferral. Meanhile, tcf_destroy() releases already reference to the tp->ops->owner module before the queued RCU callback handler has been invoked. Subsequent rmmod on the classifier module is then not prevented since all module references are already dropped. By the time, the kernel invokes the RCU callback handler from the module, that function address is then invalid. One way to fix it would be to add an rcu_barrier() to unregister_tcf_proto_ops() to wait for all pending call_rcu()s to complete. synchronize_rcu() is not appropriate as under heavy RCU callback load, registered call_rcu()s could be deferred longer than a grace period. In case we don't have any pending call_rcu()s, the barrier is allowed to return immediately. Since we came here via unregister_tcf_proto_ops(), there are no users of a given classifier anymore. Further nested call_rcu()s pointing into the module space are not being done anywhere. Only cls_bpf_delete_prog() may schedule a work item, to unlock pages eventually, but that is not in the range/context of cls_bpf anymore. Fixes: 25d8c0d55f24 ("net: rcu-ify tcf_proto") Fixes: 9888faefe132 ("net: sched: cls_basic use RCU") Reported-by: Vijay Subramanian <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Cc: John Fastabend <[email protected]> Cc: Eric Dumazet <[email protected]> Cc: Thomas Graf <[email protected]> Cc: Jamal Hadi Salim <[email protected]> Cc: Alexei Starovoitov <[email protected]> Tested-by: Vijay Subramanian <[email protected]> Acked-by: Alexei Starovoitov <[email protected]> Acked-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-05-21iwlwifi: mvm: avoid use-after-free on iwl_mvm_d0i3_enable_tx()Eliad Peller1-2/+4
qos_seq points (to a struct) inside the command response data. Make sure to free the response only after qos_seq is not needed anymore. Reported-by: Heng Luo <[email protected]> Signed-off-by: Eliad Peller <[email protected]> Signed-off-by: Emmanuel Grumbach <[email protected]>
2015-05-21iwlwifi: mvm: clean net-detect info if device was reset during suspendLuciano Coelho1-4/+5
If the device is reset during suspend with net-detect enabled, we leave the net-detect information dangling and this causes the next suspend to fail with a warning: [21795.351010] WARNING: at /root/iwlwifi/iwlwifi-stack-dev/drivers/net/wireless/iwlwifi/mvm/d3.c:989 __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]() [21795.353253] Modules linked in: iwlmvm(O) iwlwifi(O) mac80211(O) cfg80211(O) compat(O) [...] [21795.366168] CPU: 1 PID: 3645 Comm: bash Tainted: G O 3.10.29-dev #1 [21795.368785] Hardware name: Dell Inc. Latitude E6430/0CPWYR, BIOS A09 12/13/2012 [21795.371441] f8ec6748 f8ec6748 e51f3ce8 c168aa62 e51f3d10 c103a824 c1871238 f8ec6748 [21795.374228] 000003dd f8eb982e f8eb982e 00000000 c3408ed4 c41edbbc e51f3d20 c103a862 [21795.377006] 00000009 00000000 e51f3da8 f8eb982e c41ee3dc 00000004 e7970000 e51f3d74 [21795.379792] Call Trace: [21795.382461] [<c168aa62>] dump_stack+0x16/0x18 [21795.385133] [<c103a824>] warn_slowpath_common+0x64/0x80 [21795.387803] [<f8eb982e>] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm] [21795.390485] [<f8eb982e>] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm] [21795.393124] [<c103a862>] warn_slowpath_null+0x22/0x30 [21795.395787] [<f8eb982e>] __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm] [21795.398464] [<f8eb9d7c>] iwl_mvm_suspend+0xec/0x140 [iwlmvm] [21795.401127] [<c104be11>] ? del_timer_sync+0xa1/0xc0 [21795.403800] [<f8d4107e>] __ieee80211_suspend+0x1de/0xff0 [mac80211] [21795.406459] [<c168e43d>] ? mutex_lock_nested+0x25d/0x350 [21795.409084] [<c1586b64>] ? rtnl_lock+0x14/0x20 [21795.411685] [<f8cf0076>] ieee80211_suspend+0x16/0x20 [mac80211] [21795.414318] [<f8c4e014>] wiphy_suspend+0x74/0x710 [cfg80211] [21795.416916] [<c141e612>] __device_suspend+0x1e2/0x220 [21795.419521] [<f8c4dfa0>] ? addresses_show+0xa0/0xa0 [cfg80211] [21795.422097] [<c141f997>] dpm_suspend+0x67/0x210 [21795.424661] [<c141fd6f>] dpm_suspend_start+0x4f/0x60 [21795.427219] [<c108d8e0>] suspend_devices_and_enter+0x60/0x480 [21795.429768] [<c168646a>] ? printk+0x4d/0x4f [21795.432295] [<c108de76>] pm_suspend+0x176/0x210 [21795.434830] [<c108ca5d>] state_store+0x5d/0xb0 [21795.437410] [<c108ca00>] ? wakeup_count_show+0x50/0x50 [21795.439961] [<c13208db>] kobj_attr_store+0x1b/0x30 [21795.442514] [<c11e3a4b>] sysfs_write_file+0xab/0x100 [21795.445088] [<c11e39a0>] ? sysfs_poll+0xa0/0xa0 [21795.447659] [<c1179655>] vfs_write+0xa5/0x1c0 [21795.450212] [<c1179af7>] SyS_write+0x57/0xa0 [21795.452699] [<c1699ec1>] sysenter_do_call+0x12/0x32 [21795.455146] ---[ end trace faf5321baba2bfdb ]--- To fix this, call the iwl_mvm_free_nd() function in case of any error during resume. Additionally, rename the "out_unlock" label to err to make it clearer that it's only called in error conditions. Cc: [email protected] [3.19+] Signed-off-by: Luciano Coelho <[email protected]> Signed-off-by: Emmanuel Grumbach <[email protected]>
2015-05-21iwlwifi: mvm: take the UCODE_DOWN reference when resumingLuciano Coelho1-1/+8
The __iwl_mvm_resume() function always returns 1, which causes mac80211 to do a reconfig with IEEE80211_RECONFIG_TYPE_RESTART. This type of reconfig calls iwl_mvm_restart_complete(), where we unref the IWL_MVM_REF_UCODE_DOWN, so we should always take the reference in this case. This prevents this kind of warning from happening: [40026.103025] WARNING: at /root/iwlwifi/iwlwifi-stack-dev/drivers/net/wireless/iwlwifi/mvm/mac80211.c:236 iwl_mvm_unref+0xc9/0xd0 [iwlmvm]() [40026.105145] Modules linked in: iwlmvm(O) iwlwifi(O) mac80211(O) cfg80211(O) compat(O) ctr ccm arc4 autofs4 snd_hda_codec_hdmi snd_hda_codec_idt joydev coretemp kvm_intel kvm aesni_intel ablk_helper cryptd lrw aes_i586 snd_hda_intel xts snd_hda_codec gf128mul snd_hwdep snd_pcm snd_seq_midi dell_wmi snd_rawmidi sparse_keymap snd_seq_midi_event snd_seq uvcvideo dell_laptop videobuf2_core dcdbas microcode videodev psmouse snd_timer videobuf2_vmalloc videobuf2_memops serio_raw snd_seq_device btusb i915 snd bluetooth lpc_ich drm_kms_helper soundcore snd_page_alloc drm i2c_algo_bit wmi parport_pc ppdev video binfmt_misc rpcsec_gss_krb5 nfsd mac_hid nfs_acl nfsv4 auth_rpcgss nfs fscache lockd sunrpc msdos lp parport sdhci_pci sdhci ahci libahci e1000e mmc_core ptp pps_core [last unloaded: compat] [40026.117640] CPU: 2 PID: 3827 Comm: bash Tainted: G W O 3.10.29-dev #1 [40026.120216] Hardware name: Dell Inc. Latitude E6430/0CPWYR, BIOS A09 12/13/2012 [40026.122815] f8effd18 f8effd18 e740fd18 c168aa62 e740fd40 c103a824 c1871238 f8effd18 [40026.125527] 000000ec f8ec79c9 f8ec79c9 d5d29ba4 d5d2a20c 00000000 e740fd50 c103a862 [40026.128209] 00000009 00000000 e740fd7c f8ec79c9 f1c591c4 00000400 00000000 f8efb490 [40026.130886] Call Trace: [40026.133506] [<c168aa62>] dump_stack+0x16/0x18 [40026.136115] [<c103a824>] warn_slowpath_common+0x64/0x80 [40026.138727] [<f8ec79c9>] ? iwl_mvm_unref+0xc9/0xd0 [iwlmvm] [40026.141319] [<f8ec79c9>] ? iwl_mvm_unref+0xc9/0xd0 [iwlmvm] [40026.143881] [<c103a862>] warn_slowpath_null+0x22/0x30 [40026.146453] [<f8ec79c9>] iwl_mvm_unref+0xc9/0xd0 [iwlmvm] [40026.149030] [<f8ec7a4d>] iwl_mvm_mac_reconfig_complete+0x7d/0x210 [iwlmvm] [40026.151645] [<f8b74b20>] ? ftrace_raw_event_drv_reconfig_complete+0xc0/0xe0 [mac80211] [40026.154291] [<f8b6769e>] ieee80211_reconfig+0x28e/0x2620 [mac80211] [40026.156920] [<c10ef0ea>] ? ring_buffer_unlock_commit+0xba/0x100 [40026.159585] [<f8b4a04d>] ieee80211_resume+0x6d/0x80 [mac80211] [40026.162206] [<f8a79722>] wiphy_resume+0x72/0x260 [cfg80211] [40026.164799] [<c141e2e7>] ? device_resume+0x57/0x150 [40026.167425] [<f8a796b0>] ? wiphy_suspend+0x710/0x710 [cfg80211] [40026.170075] [<c141e26e>] dpm_run_callback+0x2e/0x50 [40026.172695] [<c141e321>] device_resume+0x91/0x150 [40026.175334] [<c141f636>] dpm_resume+0xf6/0x200 [40026.177922] [<c141f920>] dpm_resume_end+0x10/0x20 [40026.180489] [<c108d9f7>] suspend_devices_and_enter+0x177/0x480 [40026.183037] [<c168646a>] ? printk+0x4d/0x4f [40026.185559] [<c108de76>] pm_suspend+0x176/0x210 [40026.188065] [<c108ca5d>] state_store+0x5d/0xb0 [40026.190581] [<c108ca00>] ? wakeup_count_show+0x50/0x50 [40026.193052] [<c13208db>] kobj_attr_store+0x1b/0x30 [40026.195608] [<c11e3a4b>] sysfs_write_file+0xab/0x100 [40026.198055] [<c11e39a0>] ? sysfs_poll+0xa0/0xa0 [40026.200469] [<c1179655>] vfs_write+0xa5/0x1c0 [40026.202893] [<c1179af7>] SyS_write+0x57/0xa0 [40026.205245] [<c1699ec1>] sysenter_do_call+0x12/0x32 [40026.207619] ---[ end trace db1d5a72a0381b0a ]--- Signed-off-by: Luciano Coelho <[email protected]> Reviewed-by: EliadX Peller <[email protected]> Reviewed-by: Johannes Berg <[email protected]> Signed-off-by: Emmanuel Grumbach <[email protected]>
2015-05-21iwlwifi: mvm: BT Coex - duplicate the command if sent ASYNCEmmanuel Grumbach1-1/+1
There are buses that can't handle ASYNC command without copying them. Duplicate the host command instead. Signed-off-by: Emmanuel Grumbach <[email protected]>
2015-05-21iwlwifi: nvm: force mac from otp in case nvm mac is reservedLiad Kaufman1-1/+10
Take the MAC address from the OTP even if one is present in the NVM, if that MAC address happens to be a reserved one. Signed-off-by: Liad Kaufman <[email protected]> Signed-off-by: Emmanuel Grumbach <[email protected]>
2015-05-21iwlwifi: mvm: Free fw_status after use to avoid memory leakHaim Dreyfuss1-1/+3
fw_status is the only pointer pointing to a block of memory allocated above and should be freed after use. Note: this come from Klockwork static analyzer. Cc: [email protected] [3.19+] Fixes: 2021a89d7b8a ("iwlwifi: mvm: treat netdetect wake up separately") Signed-off-by: Haim Dreyfuss <[email protected]> Signed-off-by: Emmanuel Grumbach <[email protected]>
2015-05-21drm/radeon: fix error flag checking in native aux pathAlex Deucher1-2/+0
That atom table does not check these bits. Fixes aux regressions on some boards. Reported-by: Malte Schröder <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
2015-05-21drm/radeon: retry dcpd fetchAlex Deucher1-9/+11
Retry the dpcd fetch several times. Some eDP panels fail several times before the fetch is successful. bug: https://bugs.freedesktop.org/show_bug.cgi?id=73530 Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
2015-05-21xfrm: Always zero high-order sequence number bitsHerbert Xu1-0/+2
As we're now always including the high bits of the sequence number in the IV generation process we need to ensure that they don't contain crap. This patch ensures that the high sequence bits are always zeroed so that we don't leak random data into the IV. Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Steffen Klassert <[email protected]>
2015-05-21drm/msm/mdp5: fix incorrect parameter for msm_framebuffer_iova()Stephane Viau1-1/+1
The index of ->planes[] array (3rd parameter) cannot be equal to MAX_PLANE. This looks like a typo that is now fixed. Signed-off-by: Stephane Viau <[email protected]> Acked-by: Rob Clark <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2015-05-21md/bitmap: remove rcu annotation from pointer arithmetic.NeilBrown1-1/+6
Evaluating "&mddev->disks" is simple pointer arithmetic, so it does not need 'rcu' annotations - no dereferencing is happening. Also enhance the comment to explain that 'rdev' in that case is not actually a pointer to an rdev. Reported-by: Patrick Marlier <[email protected]> Signed-off-by: NeilBrown <[email protected]>
2015-05-21md/raid0: fix restore to sector variable in raid0_make_requestEric Work1-1/+3
The variable "sector" in "raid0_make_request()" was improperly updated by a call to "sector_div()" which modifies its first argument in place. Commit 47d68979cc968535cb87f3e5f2e6a3533ea48fbd restored this variable after the call for later re-use. Unfortunetly the restore was done after the referenced variable "bio" was advanced. This lead to the original value and the restored value being different. Here we move this line to the proper place. One observed side effect of this bug was discarding a file though unlinking would cause an unrelated file's contents to be discarded. Signed-off-by: NeilBrown <[email protected]> Fixes: 47d68979cc96 ("md/raid0: fix bug with chunksize not a power of 2.") Cc: [email protected] (any that received above backport) URL: https://bugzilla.kernel.org/show_bug.cgi?id=98501
2015-05-21raid5: fix broken async operation chainShaohua Li1-1/+1
ops_run_reconstruct6() doesn't correctly chain asyn operations. The tx returned by async_gen_syndrome should be added as the dependent tx of next stripe. The issue is introduced by commit 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c RAID5: batch adjacent full stripe write Reported-and-tested-by: Maxime Ripard <[email protected]> Signed-off-by: Shaohua Li <[email protected]> Signed-off-by: NeilBrown <[email protected]>
2015-05-20Input: vmmouse - do not reference non-existing version of X driverThomas Hellstrom1-1/+1
The vmmouse Kconfig help text was referring to an incorrect user-space driver version. Fix this. Signed-off-by: Thomas Hellstrom <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2015-05-20Input: alps - fix finger jumps on lifting 2 fingers on v7 touchpadHans de Goede1-0/+5
On v7 touchpads sometimes when 2 fingers are moved down on the touchpad until they "fall of" the touchpad, the second touch will report 0 for y (max y really since the y axis is inverted) and max x as coordinates, rather then reporting 0, 0 as is expected for a non touching finger. This commit detects this and treats these touches as non touching. See the evemu-recording here: https://bugzilla.redhat.com/attachment.cgi?id=1025058 BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1221200 Signed-off-by: Hans de Goede <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2015-05-20Merge tag 'omap-for-v4.1/fixes-rc4' of ↵Arnd Bergmann3-5/+3
git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Merge "Few minimal omap device tree fixes for v4.1-rc series" from Tony Lindgren: - Disable BeagleBone black RTC-only sleep mode because of hardare related issues - Fix NAND on Devkit8000 - Fix WLAN interrupt line on AM335x EVM-SK * tag 'omap-for-v4.1/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: Fix WLAN interrupt line for AM335x EVM-SK ARM: dts: omap3-devkit8000: Fix NAND DT node ARM: dts: am335x-boneblack: disable RTC-only sleep
2015-05-20IB/cma: Fix broken AF_IB UD supportMatthew Finlay1-11/+21
Support for using UD and AF_IB is currently broken. The IB_CM_SIDR_REQ_RECEIVED message is not handled properly in cma_save_net_info() and we end up falling into code that will try and process the request as ipv4/ipv6, which will end up failing. The resolution is to add a check for the SIDR_REQ and call cma_save_ib_info() with a NULL path record. Change cma_save_ib_info() to copy the src sib info from the listen_id when the path record is NULL. Reported-by: Hari Shankar <[email protected]> Signed-off-by: Matt Finlay <[email protected]> Acked-by: Sean Hefty <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2015-05-20irqchip/gicv3-its: ITS table size should not be smaller than PSZMinghuan Lian1-1/+8
When allocating a device table, if the requested allocation is smaller than the default granule size of the ITS then, we need to round up to the default size. Signed-off-by: Minghuan Lian <[email protected]> [ stuart: Added comments and massaged changelog ] Signed-off-by: Stuart Yoder <[email protected]> Reviewed-by: Marc Zygnier <[email protected]> Cc: <[email protected]> Cc: <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]>
2015-05-20CIFS: Fix race condition on RFC1002_NEGATIVE_SESSION_RESPONSEFederico Sauter1-1/+2
This patch fixes a race condition that occurs when connecting to a NT 3.51 host without specifying a NetBIOS name. In that case a RFC1002_NEGATIVE_SESSION_RESPONSE is received and the SMB negotiation is reattempted, but under some conditions it leads SendReceive() to hang forever while waiting for srv_mutex. This, in turn, sets the calling process to an uninterruptible sleep state and makes it unkillable. The solution is to unlock the srv_mutex acquired in the demux thread *before* going to sleep (after the reconnect error) and before reattempting the connection.
Powered by cgit, Gruvboxed by Blaster4385.