aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-12-22net: ethernet: stmicro: stmmac: drop owner assignment from platform_driversWolfram Sang1-1/+0
This platform_driver does not need to set an owner, it will be populated by the driver core. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-12-22net: s6gmac: remove driverDaniel Glöckner3-1071/+0
The s6000 Xtensa support has been removed from the kernel in 4006e565e1500db4. There are no other chips using this driver. While the Mentor/Alcatel PE-MCXMAC IP core is also used in other designs (Freescale Gianfar/UCC, QLogic NetXen, Solarflare, Agere ET-1310, Netlogic XLR/XLS), none of these use this driver as it heavily depends on the s6000 DMA engine. In fact, there is no code sharing across any of the aforementioned devices. Signed-off-by: Daniel Glöckner <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-12-22net: ethernet: micrel: ksz884x.c: Remove unused functionRickard Strandqvist1-6/+0
Remove the function port_cfg_dis_learn() that is not used anywhere. This was partially found by using a static code analysis program called cppcheck. Signed-off-by: Rickard Strandqvist <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-12-22tg3: tg3_disable_ints using uninitialized mailbox value to disable interruptsPrashant Sreedharan1-17/+17
During driver load in tg3_init_one, if the driver detects DMA activity before intializing the chip tg3_halt is called. As part of tg3_halt interrupts are disabled using routine tg3_disable_ints. This routine was using mailbox value which was not initialized (default value is 0). As a result driver was writing 0x00000001 to pci config space register 0, which is the vendor id / device id. This driver bug was exposed because of the commit a7877b17a667 (PCI: Check only the Vendor ID to identify Configuration Request Retry). Also this issue is only seen in older generation chipsets like 5722 because config space write to offset 0 from driver is possible. The newer generation chips ignore writes to offset 0. Also without commit a7877b17a667, for these older chips when a GRC reset is issued the Bootcode would reprogram the vendor id/device id, which is the reason this bug was masked earlier. Fixed by initializing the interrupt mailbox registers before calling tg3_halt. Please queue for -stable. Reported-by: Nils Holland <[email protected]> Reported-by: Marcelo Ricardo Leitner <[email protected]> Signed-off-by: Prashant Sreedharan <[email protected]> Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-12-22in6: fix conflict with glibcstephen hemminger2-1/+5
Resolve conflicts between glibc definition of IPV6 socket options and those defined in Linux headers. Looks like earlier efforts to solve this did not cover all the definitions. It resolves warnings during iproute2 build. Please consider for stable as well. Signed-off-by: Stephen Hemminger <[email protected]> Acked-by: Hannes Frederic Sowa <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-12-22hyperv: Fix some variable name typos in send-buffer init/revokeHaiyang Zhang2-7/+9
The changed names are union fields with the same size, so the existing code still works. But, we now update these variables to the correct names. Signed-off-by: Haiyang Zhang <[email protected]> Reviewed-by: K. Y. Srinivasan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-12-22virtio_net: Fix napi poll list corruptionHerbert Xu1-2/+0
The commit d75b1ade567ffab085e8adbbdacf0092d10cd09c (net: less interrupt masking in NAPI) breaks virtio_net in an insidious way. It is now required that if the entire budget is consumed when poll returns, the napi poll_list must remain empty. However, like some other drivers virtio_net tries to do a last-ditch check and if there is more work it will call napi_schedule and then immediately process some of this new work. Should the entire budget be consumed while processing such new work then we will violate the new caller contract. This patch fixes this by not touching any work when we reschedule in virtio_net. The worst part of this bug is that the list corruption causes other napi users to be moved off-list. In my case I was chasing a stall in IPsec (IPsec uses netif_rx) and I only belatedly realised that it was virtio_net which caused the stall even though the virtio_net poll was still functioning perfectly after IPsec stalled. Signed-off-by: Herbert Xu <[email protected]> Acked-by: Jason Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-12-22stmmac: Don't init ptp again when resume from suspend/hibernationHuacai Chen1-6/+8
Both stmmac_open() and stmmac_resume() call stmmac_hw_setup(), and stmmac_hw_setup() call stmmac_init_ptp() unconditionally. However, only stmmac_release() calls stmmac_release_ptp(). Since stmmac_suspend() doesn't call stmmac_release_ptp(), stmmac_resume() also needn't call stmmac_init_ptp(). This patch also fix a "scheduling while atomic" problem when resume from suspend/hibernation. Because stmmac_init_ptp() will trigger scheduling while stmmac_resume() hold a spinlock. Callgraph of "scheduling while atomic": stmmac_resume() --> stmmac_hw_setup() --> stmmac_init_ptp() --> stmmac_ptp_register() --> ptp_clock_register() --> device_create() --> device_create_groups_vargs() --> device_add() --> devtmpfs_create_node() --> wait_for_common() --> schedule_timeout() --> __schedule() Signed-off-by: Huacai Chen <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-12-22packet: Fixed TPACKET V3 to signal poll when block is closed rather than ↵Dan Collins1-4/+7
every packet Make TPACKET_V3 signal poll when block is closed rather than for every packet. Side effect is that poll will be signaled when block retire timer expires which didn't previously happen. Issue was visible when sending packets at a very low frequency such that all blocks are retired before packets are received by TPACKET_V3. This caused avoidable packet loss. The fix ensures that the signal is sent when blocks are closed which covers the normal path where the block is filled as well as the path where the timer expires. The case where a block is filled without moving to the next block (ie. all blocks are full) will still cause poll to be signaled. Signed-off-by: Dan Collins <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-12-22cifs: make new inode cache when file type is differentNakajima Akira1-3/+7
In spite of different file type, if file is same name and same inode number, old inode cache is used. This causes that you can not cd directory, can not cat SymbolicLink. So this patch is that if file type is different, return error. Reproducible sample : 1. create file 'a' at cifs client. 2. repeat rm and mkdir 'a' 4 times at server, then direcotry 'a' having same inode number is created. (Repeat 4 times, then same inode number is recycled.) (When server is under RHEL 6.6, 1 time is O.K. Always same inode number is recycled.) 3. ls -li at client, then you can not cd directory, can not remove directory. SymbolicLink has same problem. Bug link: https://bugzilla.kernel.org/show_bug.cgi?id=90011 Signed-off-by: Nakajima Akira <[email protected]> Acked-by: Jeff Layton <[email protected]> Signed-off-by: Steve French <[email protected]>
2014-12-22selftests/exec: Use %zu to format size_tGeert Uytterhoeven1-2/+2
On 32-bit: execveat.c: In function 'check_execveat_pathmax': execveat.c:183: warning: format '%lu' expects type 'long unsigned int', but argument 3 has type 'size_t' execveat.c:187: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'size_t' Signed-off-by: Geert Uytterhoeven <[email protected]> Signed-off-by: Shuah Khan <[email protected]>
2014-12-22spi: img-spfi: Enable controller before starting TX DMAAndrew Bresticker1-2/+2
It is recommended that the SPFI controller be enabled (i.e. setting SPFI_EN in SPFI_CONTROL) before TX DMA begins. Signed-off-by: Andrew Bresticker <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2014-12-22audit: correctly record file names with different path name typesPaul Moore1-4/+10
There is a problem with the audit system when multiple audit records are created for the same path, each with a different path name type. The root cause of the problem is in __audit_inode() when an exact match (both the path name and path name type) is not found for a path name record; the existing code creates a new path name record, but it never sets the path name in this record, leaving it NULL. This patch corrects this problem by assigning the path name to these newly created records. There are many ways to reproduce this problem, but one of the easiest is the following (assuming auditd is running): # mkdir /root/tmp/test # touch /root/tmp/test/567 # auditctl -a always,exit -F dir=/root/tmp/test # touch /root/tmp/test/567 Afterwards, or while the commands above are running, check the audit log and pay special attention to the PATH records. A faulty kernel will display something like the following for the file creation: type=SYSCALL msg=audit(1416957442.025:93): arch=c000003e syscall=2 success=yes exit=3 ... comm="touch" exe="/usr/bin/touch" type=CWD msg=audit(1416957442.025:93): cwd="/root/tmp" type=PATH msg=audit(1416957442.025:93): item=0 name="test/" inode=401409 ... nametype=PARENT type=PATH msg=audit(1416957442.025:93): item=1 name=(null) inode=393804 ... nametype=NORMAL type=PATH msg=audit(1416957442.025:93): item=2 name=(null) inode=393804 ... nametype=NORMAL While a patched kernel will show the following: type=SYSCALL msg=audit(1416955786.566:89): arch=c000003e syscall=2 success=yes exit=3 ... comm="touch" exe="/usr/bin/touch" type=CWD msg=audit(1416955786.566:89): cwd="/root/tmp" type=PATH msg=audit(1416955786.566:89): item=0 name="test/" inode=401409 ... nametype=PARENT type=PATH msg=audit(1416955786.566:89): item=1 name="test/567" inode=393804 ... nametype=NORMAL This issue was brought up by a number of people, but special credit should go to [email protected] for reporting the problem along with an explanation of the problem and a patch. While the original patch did have some problems (see the archive link below), it did demonstrate the problem and helped kickstart the fix presented here. * https://lkml.org/lkml/2014/9/5/66 Reported-by: hujianyang <[email protected]> Signed-off-by: Paul Moore <[email protected]> Acked-by: Richard Guy Briggs <[email protected]>
2014-12-22ASoC: Intel: Fix BYTCR machine driver MODULE_ALIASJarkko Nikula1-1/+1
snd_soc_sst_bytcr_dpcm_rt5640 doesn't autoload because MODULE_ALIAS doesn't match with "bytt100_rt5640" platform device. Signed-off-by: Jarkko Nikula <[email protected]> Cc: Subhransu S. Prusty <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2014-12-22ASoC: Intel: Fix BYTCR firmware nameJarkko Nikula1-1/+1
BYTCR DSP firmware is in intel/ subdirectory. See linux-firmware.git commit d562a3b63632 ("linux-firmware: add sst audio firmware for baytrail platforms"). Signed-off-by: Jarkko Nikula <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2014-12-22ASoC: dwc: Iterate over all channelsAndrew Jackson1-19/+16
The Designware core can be configured with up to four stereo channels. Each stereo channel is individually configured so, when the driver's hw_params call is made, each requested stereo channel has to be programmed. Signed-off-by: Andrew Jackson <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2014-12-22ASoC: dwc: Ensure FIFOs are flushed to prevent channel swapAndrew Jackson1-0/+14
Flush the FIFOs when the stream is prepared for use. This avoids an inadvertent swapping of the left/right channels if the FIFOs are not empty at startup. Signed-off-by: Andrew Jackson <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: [email protected]
2014-12-22ASoC: Intel: Add I2C dependency to two new machinesJarkko Nikula1-2/+2
Fix following build error when CONFIG_I2C is not enabled: sound/soc/codecs/rt5640.c:2252:1: warning: data definition has no type or storage class module_i2c_driver(rt5640_i2c_driver); ^ sound/soc/codecs/rt5640.c:2252:1: error: type defaults to ‘int’ in declaration of ‘module_i2c_driver’ [-Werror=implicit-int] sound/soc/codecs/rt5640.c:2252:1: warning: parameter names (without types) in function declaration sound/soc/codecs/rt5640.c:2241:26: warning: ‘rt5640_i2c_driver’ defined but not used [-Wunused-variable] static struct i2c_driver rt5640_i2c_driver = { ^ cc1: some warnings being treated as errors Signed-off-by: Jarkko Nikula <[email protected]> Reported-by: Randy Dunlap <[email protected]> Acked-by: Randy Dunlap <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2014-12-22crypto: af_alg - fix backlog handlingRabin Vincent1-0/+3
If a request is backlogged, it's complete() handler will get called twice: once with -EINPROGRESS, and once with the final error code. af_alg's complete handler, unlike other users, does not handle the -EINPROGRESS but instead always completes the completion that recvmsg() is waiting on. This can lead to a return to user space while the request is still pending in the driver. If userspace closes the sockets before the requests are handled by the driver, this will lead to use-after-frees (and potential crashes) in the kernel due to the tfm having been freed. The crashes can be easily reproduced (for example) by reducing the max queue length in cryptod.c and running the following (from http://www.chronox.de/libkcapi.html) on AES-NI capable hardware: $ while true; do kcapi -x 1 -e -c '__ecb-aes-aesni' \ -k 00000000000000000000000000000000 \ -p 00000000000000000000000000000000 >/dev/null & done Cc: [email protected] Signed-off-by: Rabin Vincent <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
2014-12-22arm64: Replace set_arch_dma_coherent_ops with arch_setup_dma_opsCatalin Marinas1-5/+6
Commit a3a60f81ee6f (dma-mapping: replace set_arch_dma_coherent_ops with arch_setup_dma_ops) changes the of_dma_configure() arch dma_ops callback to arch_setup_dma_ops but only the arch/arm code is updated. Subsequent commit 97890ba9289c (dma-mapping: detect and configure IOMMU in of_dma_configure) changes the arch_setup_dma_ops() prototype further to handle iommu. The patch makes the corresponding arm64 changes. Signed-off-by: Catalin Marinas <[email protected]> Reported-by: Arnd Bergmann <[email protected]> Acked-by: Will Deacon <[email protected]>
2014-12-22thermal: int340x_thermal: drop owner assignment from platform_driversWolfram Sang2-2/+0
This platform_driver does not need to set an owner, it will be populated by the driver core. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Zhang Rui <[email protected]>
2014-12-22thermal: drop owner assignment from platform_driversWolfram Sang1-1/+0
This platform_driver does not need to set an owner, it will be populated by the driver core. Signed-off-by: Wolfram Sang <[email protected]>
2014-12-21ipmi: Fix compile issue with isspace()Corey Minyard1-0/+1
Some arches don't get ctypes.h included from these includes, so add it explicitly. Signed-off-by: Corey Minyard <[email protected]>
2014-12-21ipmi: Finish cleanup of BMC attributesCorey Minyard1-29/+17
The previous cleanup of BMC attributes left a few holes, and if you run with lockdep debugging with a BMC with the proper attributes, you could get a warning. This patch removes all the unused attributes from the BMC structure, since they are all declared in the .data section now. It makes the attributes all static. It fixes the referencing of the attributes in a couple of cases that dynamically added the files depending on BMC information. Signed-off-by: Corey Minyard <[email protected]> Cc: Huang Ying <[email protected]> Tested-by: Alexei Starovoitov <[email protected]>
2014-12-22drm/nouveau/nouveau: Do not BUG_ON(!spin_is_locked()) on UPBruno Prémont2-3/+3
On !SMP systems spinlocks do not exist. Thus checking of they are active will always fail. Use assert_spin_locked(lock); instead of BUG_ON(!spin_is_locked(lock)); to not BUG() on all UP systems. Signed-off-by: Bruno Prémont <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-12-22drm/nv4c/mc: disable msiIlia Mirkin1-8/+0
Several users have, over time, reported issues with MSI on these IGPs. They're old, rarely available, and MSI doesn't provide such huge advantages on them. Just disable. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=87361 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74492 Fixes: fa8c9ac72fe ("drm/nv4c/mc: nv4x igp's have a different msi rearm register") Cc: [email protected] Signed-off-by: Ilia Mirkin <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-12-22drm/nouveau/fb/ram/mcp77: enable NISO pollerPierre Moreau1-5/+39
Signed-off-by: Pierre Moreau <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-12-22drm/nouveau/fb/ram/mcp77: use carveout reg to determine sizeBen Skeggs1-4/+3
Signed-off-by: Ben Skeggs <[email protected]>
2014-12-22drm/nouveau/fb/ram/mcp77: subclass nouveau_ramBen Skeggs1-10/+14
Signed-off-by: Ben Skeggs <[email protected]>
2014-12-22drm/nouveau: wake up the card if necessary during gem callbacksBen Skeggs1-5/+30
The failure paths if we fail to wake the card are less than desirable, but there's not really a graceful way to handle this case currently. I'll keep this situation in mind when I get to fixing other vm-related issues. Signed-off-by: Ben Skeggs <[email protected]>
2014-12-22drm/nouveau/device: Add support for GK208B, resolves bug 86935Sven Köhler1-0/+33
Signed-off-by: Ben Skeggs <[email protected]>
2014-12-22drm/nouveau: fix missing return statement in nouveau_ttm_tt_unpopulateAlexandre Courbot1-1/+3
nouveau_ttm_tt_unpopulate() is supposed to return right after calling ttm_dma_unpopulate() in the case of a coherent buffer. The return statement was omitted, leading to the pages being unmapped twice. Fix this. Signed-off-by: Alexandre Courbot <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-12-22drm/nouveau/bios: fix oops on pre-nv50 chipsetsBen Skeggs1-2/+4
Signed-off-by: Ben Skeggs <[email protected]>
2014-12-21udf: Reduce repeated dereferencesJan Kara2-25/+25
Replace repeated dereferences like dir->i_sb by storing superblock pointer in a variable and using that. Signed-off-by: Jan Kara <[email protected]>
2014-12-21udf: Check component length before reading itJan Kara1-2/+7
Check that length specified in a component of a symlink fits in the input buffer we are reading. Also properly ignore component length for component types that do not use it. Otherwise we read memory after end of buffer for corrupted udf image. Reported-by: Carl Henrik Lunde <[email protected]> CC: [email protected] Signed-off-by: Jan Kara <[email protected]>
2014-12-21Merge branch 'fixes' of ↵Zhang Rui11-269/+177
git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal into thermal-soc
2014-12-21ARM: dts: rockchip: bump sd card pin drive strength up on rk3288-evbDoug Anderson1-0/+30
It seems that ever since (536f6b9 mmc: dw_mmc: Reset DMA before enabling IDMAC) landed upstream that SD cards have been very unhappy on rk3288-evb. They were a little unhappy before that change, but after that change they're REALLY unhappy. It turns out that the above fix happens to fix a corruption when reading card information during probe time. Without the fix we didn't detect that high speed SD cards could actually support high speed. With the fix we suddenly detect that they're high speed and we try to use them at 50MHz. That doesn't work so well on EVB with the default drive strength (maybe because there are two physical SD card slots hooked up to the same pin?). Fix the problem by bumping up the drive strength of the sdmmc lines. Signed-off-by: Doug Anderson <[email protected]> Fixes: 536f6b91d21b ("mmc: dw_mmc: Reset DMA before enabling IDMAC") Signed-off-by: Heiko Stuebner <[email protected]>
2014-12-21thermal: cpu_cooling: document node in struct cpufreq_cooling_deviceJavi Merino1-0/+1
The node field of struct cpufreq_cooling_device was reintroduced in 2dcd851fe4b4 (thermal: cpu_cooling: Update always cpufreq policy with thermal constraints) but without the documentation that it once had. Add it back so that all the fields of struct cpufreq_cooling_device are documented. Cc: Yadwinder Singh Brar <[email protected]> Cc: Eduardo Valentin <[email protected]> Cc: Zhang Rui <[email protected]> Signed-off-by: Javi Merino <[email protected]> Signed-off-by: Zhang Rui <[email protected]>
2014-12-21thermal/powerclamp: add ids for future xeon cpusJacob Pan1-0/+1
Enable Intel Powerclamp driver on Xeon cpu id 0x56, package C-state is available on this CPU for idle injection. Signed-off-by: Jacob Pan <[email protected]> Signed-off-by: Zhang Rui <[email protected]>
2014-12-21Thermal/int340x: Handle properly the case when _trt or _art acpi entry is ↵Ilkka Koskinen1-4/+4
missing If either of the entries was missing, the driver tried to free memory using uninitialized pointer. In addition, it was dereferencing null pointer. Signed-off-by: Ilkka Koskinen <[email protected]> Acked-by: Jacob Pan <[email protected]> Signed-off-by: Zhang Rui <[email protected]>
2014-12-21drm: Put amdkfd before radeon in drm MakefileOded Gabbay1-1/+1
When amdkfd and radeon are compiled inside the kernel image (not as modules), radeon will load before amdkfd, which will cause a bug when radeon will probe the GPUs. When the two drivers are compiled as modules, amdkfd is loaded after radeon is loaded but before radeon starts probing the GPUs. This is done because radeon loads the amdkfd module through symbol_request function. This patch makes amdkfd load before radeon when they are both compiled inside the kernel image, which makes the behavior similar to the case when they are modules, and prevents the kernel bug. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Christian König <[email protected]>
2014-12-22drivers: Move iommu/ before gpu/ in MakefileOded Gabbay1-2/+4
AMD GPU devices are dependent on AMD IOMMU controller functionality to allow the GPU to access a process's virtual memory address space, without the need for pinning the memory. This patch changes the order in the drivers makefile, so iommu/ subsystem is linked before gpu/ subsystem. That way, if the gpu and iommu drivers are compiled inside the kernel image (not as modules), the correct order of device loading is still maintained (iommu module is loaded before gpu module). Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Christian König <[email protected]>
2014-12-21ARM: mvebu: Fix pinctrl configuration for Armada 370 DBGregory CLEMENT1-24/+0
The commit b4607572ef86 (ARM: mvebu: remove conflicting muxing on Armada 370 DB) removes the hog pins muxing. As it is explained in the commit log it solves a warning a boot time, but more important it also allows using the Giga port 0 of the board. Unfortunately in the same time the commit 4904a82a9399 (arm: mvebu: move Armada 370/XP pinctrl node definition armada-370-xp.dtsi) was merged and it introduced again the hog pins muxing. Because of it, the Giga port 0 of the board is no more usable. This commit remove again the conflicting muxing (hopefully for the last time). Signed-off-by: Gregory CLEMENT <[email protected]> [[email protected]: Correct commit IDs] Signed-off-by: Andrew Lunn <[email protected]> Fixes: 4904a82a9399 ("arm: mvebu: move Armada 370/XP pinctrl node definition armada-370-xp.dtsi")
2014-12-21Merge tag 'iwlwifi-fixes-for-kalle-2014-12-18' of ↵Kalle Valo5-9/+30
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes I have here new device IDs and a fix for double free bug I introduced. I also fix an issue with the RFKILL interrupt - the HW needs us to ACK the interrupt again after we reset it. Liad fixes an issue with the firmware debugging infrastructure. While working on torture scenarios of firmware restarts, Eliad found an issue which he fixed.
2014-12-21Merge tag 'pr-20141220-x86-vdso' of ↵Ingo Molnar1-16/+29
git://git.kernel.org/pub/scm/linux/kernel/git/luto/linux into x86/urgent Pull a VDSO fix from Andy Lutomirski: "One vdso fix for a longstanding ASLR bug that's been in the news lately. The vdso base address has always been randomized, and I don't think there's anything particularly wrong with the range over which it's randomized, but the implementation seems to have been buggy since the very beginning. This fixes the implementation to remove a large bias that caused a small fraction of possible vdso load addresess to be vastly more likely than the rest of the possible addresses." Signed-off-by: Ingo Molnar <[email protected]>
2014-12-20Linux 3.19-rc1Linus Torvalds1-2/+2
2014-12-20x86_64, vdso: Fix the vdso address randomization algorithmAndy Lutomirski1-16/+29
The theory behind vdso randomization is that it's mapped at a random offset above the top of the stack. To avoid wasting a page of memory for an extra page table, the vdso isn't supposed to extend past the lowest PMD into which it can fit. Other than that, the address should be a uniformly distributed address that meets all of the alignment requirements. The current algorithm is buggy: the vdso has about a 50% probability of being at the very end of a PMD. The current algorithm also has a decent chance of failing outright due to incorrect handling of the case where the top of the stack is near the top of its PMD. This fixes the implementation. The paxtest estimate of vdso "randomisation" improves from 11 bits to 18 bits. (Disclaimer: I don't know what the paxtest code is actually calculating.) It's worth noting that this algorithm is inherently biased: the vdso is more likely to end up near the end of its PMD than near the beginning. Ideally we would either nix the PMD sharing requirement or jointly randomize the vdso and the stack to reduce the bias. In the mean time, this is a considerable improvement with basically no risk of compatibility issues, since the allowed outputs of the algorithm are unchanged. As an easy test, doing this: for i in `seq 10000` do grep -P vdso /proc/self/maps |cut -d- -f1 done |sort |uniq -d used to produce lots of output (1445 lines on my most recent run). A tiny subset looks like this: 7fffdfffe000 7fffe01fe000 7fffe05fe000 7fffe07fe000 7fffe09fe000 7fffe0bfe000 7fffe0dfe000 Note the suspicious fe000 endings. With the fix, I get a much more palatable 76 repeated addresses. Reviewed-by: Kees Cook <[email protected]> Cc: [email protected] Signed-off-by: Andy Lutomirski <[email protected]>
2014-12-20Merge tag 'for-linus' of ↵Linus Torvalds10-25/+103
git://git.kernel.org/pub/scm/linux/kernel/git/borntraeger/linux Pull ACCESS_ONCE cleanup preparation from Christian Borntraeger: "kernel: Provide READ_ONCE and ASSIGN_ONCE As discussed on LKML http://marc.info/?i=54611D86.4040306%40de.ibm.com ACCESS_ONCE might fail with specific compilers for non-scalar accesses. Here is a set of patches to tackle that problem. The first patch introduce READ_ONCE and ASSIGN_ONCE. If the data structure is larger than the machine word size memcpy is used and a warning is emitted. The next patches fix up several in-tree users of ACCESS_ONCE on non-scalar types. This does not yet contain a patch that forces ACCESS_ONCE to work only on scalar types. This is targetted for the next merge window as Linux next already contains new offenders regarding ACCESS_ONCE vs. non-scalar types" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/borntraeger/linux: s390/kvm: REPLACE barrier fixup with READ_ONCE arm/spinlock: Replace ACCESS_ONCE with READ_ONCE arm64/spinlock: Replace ACCESS_ONCE READ_ONCE mips/gup: Replace ACCESS_ONCE with READ_ONCE x86/gup: Replace ACCESS_ONCE with READ_ONCE x86/spinlock: Replace ACCESS_ONCE with READ_ONCE mm: replace ACCESS_ONCE with READ_ONCE or barriers kernel: Provide READ_ONCE and ASSIGN_ONCE
2014-12-20Merge tag 'clk-for-linus-3.19' of ↵Linus Torvalds94-690/+6663
git://git.linaro.org/people/mike.turquette/linux Pull clk framework updates from Mike Turquette: "This is much later than usual due to several last minute bugs that had to be addressed. As usual the majority of changes are new drivers and modifications to existing drivers. The core recieved many fixes along with the groundwork for several large changes coming in the future which will better parition clock providers from clock consumers" * tag 'clk-for-linus-3.19' of git://git.linaro.org/people/mike.turquette/linux: (86 commits) clk: samsung: Fix Exynos 5420 pinctrl setup and clock disable failure due to domain being gated ARM: OMAP3: clock: fix boot breakage in legacy mode ARM: OMAP2+: clock: fix DPLL code to use new determine rate APIs clk: Really fix deadlock with mmap_sem clk: mmp: fix sparse non static symbol warning clk: Change clk_ops->determine_rate to return a clk_hw as the best parent clk: change clk_debugfs_add_file to take a struct clk_hw clk: Don't expose __clk_get_accuracy clk: Don't try to use a struct clk* after it could have been freed clk: Remove unused function __clk_get_prepare_count clk: samsung: Fix double add of syscore ops after driver rebind clk: samsung: exynos4: set parent of sclk_hdmiphy to hdmi clk: samsung: exynos4415: Fix build with PM_SLEEP disabled clk: samsung: remove unnecessary inclusion of header files from clk.h clk: samsung: remove unnecessary CONFIG_OF from clk.c clk: samsung: Spelling s/bwtween/between/ clk: rockchip: Add support for the mmc clock phases using the framework clk: rockchip: add bindings for the mmc clocks clk: rockchip: rk3288 export i2s0_clkout for use in DT clk: rockchip: use clock ID for DMC (memory controller) on rk3288 ...
2014-12-20Merge branch 'i2c/for-next' of ↵Linus Torvalds7-2804/+252
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: "Included are two bugfixes needing some bigger refactoring (sh_mobile: deferred probe with DMA, mv64xxx: fix offload support) and one deprecated driver removal I thought would go in via ppc but I misunderstood. It has a proper ack from BenH" * 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: sh_mobile: fix uninitialized var when debug is enabled macintosh: therm_pm72: delete deprecated driver i2c: sh_mobile: I2C_SH_MOBILE should depend on HAS_DMA i2c: sh_mobile: rework deferred probing i2c: sh_mobile: refactor DMA setup i2c: mv64xxx: rework offload support to fix several problems i2c: mv64xxx: use BIT() macro for register value definitions
Powered by cgit, Gruvboxed by Blaster4385.