aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-03-12Merge remote-tracking branches 'asoc/topic/wm8961', 'asoc/topic/wm8962', ↵Mark Brown9-157/+165
'asoc/topic/wm8974', 'asoc/topic/wm8983', 'asoc/topic/wm8988', 'asoc/topic/wm8990', 'asoc/topic/wm8991', 'asoc/topic/wm8993' and 'asoc/topic/wm8994' into asoc-next
2014-03-12Merge remote-tracking branches 'asoc/topic/wm5100', 'asoc/topic/wm8523', ↵Mark Brown10-165/+164
'asoc/topic/wm8731', 'asoc/topic/wm8737', 'asoc/topic/wm8741', 'asoc/topic/wm8753', 'asoc/topic/wm8903', 'asoc/topic/wm8904', 'asoc/topic/wm8940' and 'asoc/topic/wm8955' into asoc-next
2014-03-12Merge remote-tracking branches 'asoc/topic/tlv320aic23', ↵Mark Brown14-150/+336
'asoc/topic/tlv320aic26', 'asoc/topic/tlv320aic32x4', 'asoc/topic/tlv320aic3x', 'asoc/topic/tlv320dac33', 'asoc/topic/twl4030', 'asoc/topic/twl6040', 'asoc/topic/uda1380', 'asoc/topic/wl1273' and 'asoc/topic/wm2200' into asoc-next
2014-03-12Merge remote-tracking branches 'asoc/topic/samsung', 'asoc/topic/sgtl5000', ↵Mark Brown33-433/+1564
'asoc/topic/sh', 'asoc/topic/simple', 'asoc/topic/sirf', 'asoc/topic/sn95031', 'asoc/topic/ssm2602' and 'asoc/topic/stac9766' into asoc-next
2014-03-12Merge remote-tracking branches 'asoc/topic/ml26124', 'asoc/topic/of', ↵Mark Brown48-974/+9844
'asoc/topic/omap', 'asoc/topic/pxa' and 'asoc/topic/rcar' into asoc-next
2014-03-12Merge remote-tracking branches 'asoc/topic/da7213', 'asoc/topic/da732x', ↵Mark Brown30-533/+972
'asoc/topic/da9055', 'asoc/topic/davinci', 'asoc/topic/fsl', 'asoc/topic/fsl-esai', 'asoc/topic/fsl-sai' and 'asoc/topic/fsl-spdif' into asoc-next
2014-03-12Merge remote-tracking branches 'asoc/topic/arizona', 'asoc/topic/atmel', ↵Mark Brown18-307/+427
'asoc/topic/cirrus', 'asoc/topic/cs4271', 'asoc/topic/cs42l51', 'asoc/topic/cs42l52', 'asoc/topic/cs42l73' and 'asoc/topic/da7210' into asoc-next
2014-03-12Merge remote-tracking branches 'asoc/topic/88pm860x', 'asoc/topic/ad1836', ↵Mark Brown25-546/+1880
'asoc/topic/ad193x', 'asoc/topic/adau1977', 'asoc/topic/ak4104', 'asoc/topic/ak4641', 'asoc/topic/ak4671' and 'asoc/topic/alc5623' into asoc-next
2014-03-12Merge remote-tracking branch 'asoc/topic/pcm512x' into asoc-nextMark Brown7-0/+953
2014-03-12Merge remote-tracking branch 'asoc/topic/pcm1792a' into asoc-nextMark Brown1-11/+22
2014-03-12Merge remote-tracking branch 'asoc/topic/pcm1681' into asoc-nextMark Brown1-5/+10
2014-03-12Merge remote-tracking branch 'asoc/topic/enum' into asoc-nextMark Brown27-787/+538
2014-03-12Merge remote-tracking branch 'asoc/topic/dapm' into asoc-nextMark Brown16-184/+324
2014-03-12Merge remote-tracking branch 'asoc/topic/core' into asoc-nextMark Brown15-261/+275
2014-03-12Merge remote-tracking branch 'asoc/fix/spear' into asoc-linusMark Brown1-8/+2
2014-03-12Merge tag 'asoc-v3.14-rc6' into asoc-linusMark Brown4-2/+10
ASoC: Fixes for v3.14 A few things here: - Avoid memory leaks in error cases with DPCM, this code has never been that well tested in mainline due to the lack of mainline drivers but we now have one queued for the merge window! - Fix the N810 audio driver to load when booted with DT since the platform was converted to DT during the merge window. - Fixes for initialisation of some MFD drivers that are probably unused in mainline # gpg: Signature made Mon 10 Mar 2014 18:21:32 GMT using RSA key ID 7EA229BD # gpg: Good signature from "Mark Brown <[email protected]>" # gpg: aka "Mark Brown <[email protected]>" # gpg: aka "Mark Brown <[email protected]>" # gpg: aka "Mark Brown <[email protected]>" # gpg: aka "Mark Brown <[email protected]>" # gpg: aka "Mark Brown <[email protected]>"
2014-03-12Merge tag 'sound-3.14-rc7' of ↵Linus Torvalds5-2/+29
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A few fixes for ASoC (N810 DT init fix, DPCM error path fix and a couple of MFD init fixes), and a fix for a Lenovo laptop. All small and trivial fixes, suitable for rc7" * tag 'sound-3.14-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: 88pm860: Fix IO setup ASoC: si476x: Fix IO setup ALSA: hda - Fix loud click noise with IdeaPad 410Y ASoC: pcm: free path list before exiting from error conditions ASoC: n810: fix init with DT boot
2014-03-12ASoC: tlv320aic23: Remove spurious bits per word settingMark Brown1-1/+0
regmap should handle any byte ordering issues required, it is looking for a byte stream from the bus, so don't set 16 bits per word. This is likely to have tested out OK due to use of an unmerged SPI controller driver. Signed-off-by: Mark Brown <[email protected]> Tested-by: Max Filippov <[email protected]>
2014-03-12net: socket: error on a negative msg_namelenMatthew Leach1-0/+4
When copying in a struct msghdr from the user, if the user has set the msg_namelen parameter to a negative value it gets clamped to a valid size due to a comparison between signed and unsigned values. Ensure the syscall errors when the user passes in a negative value. Signed-off-by: Matthew Leach <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-12drm/radeon/cik: properly set compute ring status on disableAlex Deucher1-1/+4
When we disable the rings, set the status properly. If not other code pathes may try and use the rings which are not functional at this point. Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
2014-03-12MAINTAINERS: Add tools/net to NETWORKING [GENERAL]Tobias Klauser1-0/+1
Make sure patches for these tools go to the netdev list as well. References: https://marc.info/?l=linux-kernel&m=139450284501328&w=2 Cc: David S. Miller <[email protected]> Cc: Daniel Borkmann <[email protected]> Signed-off-by: Tobias Klauser <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-12packet: doc: Spelling s/than/that/Geert Uytterhoeven1-1/+1
Signed-off-by: Geert Uytterhoeven <[email protected]> Cc: David S. Miller <[email protected]> Cc: [email protected] Signed-off-by: David S. Miller <[email protected]>
2014-03-12Merge branch 'mlx4'David S. Miller3-3/+12
Or Gerlitz says: ==================== mlx4 fixes These short series fixes two bugs related to the vxlan support and a missing req module call for the IB driver which is needed to support IB/RDMA over Ethernet. Pathes done over the net tree, commit dd38743 "vlan: Set correct source MAC address with TX VLAN offload enabled" ==================== Signed-off-by: David S. Miller <[email protected]>
2014-03-12net/mlx4_core: Load the IB driver when the device supports IBoEOr Gerlitz1-1/+1
When checking what protocol drivers to load, the IB driver should be requested also over Ethernet ports, if the device supports IBoE (RoCE). Fixes: b046ffe 'net/mlx4_core: Load higher level modules according to ports type' Signed-off-by: Or Gerlitz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-12net/mlx4_en: Handle vxlan steering rules for mac address changesOr Gerlitz1-0/+8
When the device mac address is changed, we must deregister the vxlan steering rule associated with the previous mac, and register a new steering rule using the new mac. Signed-off-by: Or Gerlitz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-12net/mlx4_core: Fix wrong dump of the vxlan offloads device capabilityOr Gerlitz1-2/+3
Fix the value used to dump the vxlan offloads device capability to align with the MLX4_DEV_CAP_FLAG2_yyy definition. While on that, add dump to the IPoIB flow-steering device capability and fix small typo. The vxlan cap value wasn't fully handled when a conflict was resolved between MLX4_DEV_CAP_FLAG2_DMFS_IPOIB coming from the IB tree to MLX4_DEV_CAP_FLAG2_VXLAN_OFFLOADS coming from net-next. Signed-off-by: Or Gerlitz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-12drm/radeon/cik: stop the sdma engines in the enable() functionAlex Deucher1-7/+5
We always stop the rings when disabling the engines so just call the stop functions directly from the sdma enable function. This way the rings' status is set correctly on suspend so there are no problems on resume. Fixes resume failures that result in acceleration getting disabled. Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
2014-03-12drm/radeon/cik: properly set sdma ring status on disableAlex Deucher1-0/+2
When we disable the rings, set the status properly. If not other code pathes may try and use the rings which are not functional at this point. Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
2014-03-12drm/radeon: fix runpm disabling on non-PX harderAlex Deucher1-1/+9
Make sure runtime pm is disabled on non-PX hardware. Should fix powerdown problems without displays attached. Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
2014-03-12xen-netback: use skb_is_gso in xenvif_start_xmitWei Liu1-2/+1
In 5bd076708 ("Xen-netback: Fix issue caused by using gso_type wrongly") we use skb_is_gso to determine if we need an extra slot to accommodate the SKB. There's similar error in interface.c. Change that to use skb_is_gso as well. Signed-off-by: Wei Liu <[email protected]> Cc: Annie Li <[email protected]> Cc: Ian Campbell <[email protected]> Cc: Paul Durrant <[email protected]> Acked-by: Ian Campbell <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-12drm/ttm: don't oops if no invalidate_caches()Rob Clark1-3/+5
A few of the simpler TTM drivers (cirrus, ast, mgag200) do not implement this function. Yet can end up somehow with an evicted bo: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [< (null)>] (null) PGD 16e761067 PUD 16e6cf067 PMD 0 Oops: 0010 [#1] SMP Modules linked in: bnep bluetooth rfkill fuse ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg btrfs zlib_deflate raid6_pq xor dm_queue_length iTCO_wdt iTCO_vendor_support coretemp kvm dcdbas dm_service_time microcode serio_raw pcspkr lpc_ich mfd_core i7core_edac edac_core ses enclosure ipmi_si ipmi_msghandler shpchp acpi_power_meter mperf nfsd auth_rpcgss nfs_acl lockd uinput sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sr_mod cdrom sd_mod usb_storage mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit lpfc drm_kms_helper ttm crc32c_intel ata_piix bfa drm ixgbe libata i2c_core mdio crc_t10dif ptp crct10dif_common pps_core scsi_transport_fc dca scsi_tgt megaraid_sas bnx2 dm_mirror dm_region_hash dm_log dm_mod CPU: 16 PID: 2572 Comm: X Not tainted 3.10.0-86.el7.x86_64 #1 Hardware name: Dell Inc. PowerEdge R810/0H235N, BIOS 0.3.0 11/14/2009 task: ffff8801799dabc0 ti: ffff88016c884000 task.ti: ffff88016c884000 RIP: 0010:[<0000000000000000>] [< (null)>] (null) RSP: 0018:ffff88016c885ad8 EFLAGS: 00010202 RAX: ffffffffa04e94c0 RBX: ffff880178937a20 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000240004 RDI: ffff880178937a00 RBP: ffff88016c885b60 R08: 00000000000171a0 R09: ffff88007cf171a0 R10: ffffea0005842540 R11: ffffffff810487b9 R12: ffff880178937b30 R13: ffff880178937a00 R14: ffff88016c885b78 R15: ffff880179929400 FS: 00007f81ba2ef980(0000) GS:ffff88007cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000016e763000 CR4: 00000000000007e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Stack: ffffffffa0306fae ffff8801799295c0 0000000000260004 0000000000000001 ffff88016c885b60 ffffffffa0307669 00ff88007cf17738 ffff88017cf17700 ffff880178937a00 ffff880100000000 ffff880100000000 0000000079929400 Call Trace: [<ffffffffa0306fae>] ? ttm_bo_handle_move_mem+0x54e/0x5b0 [ttm] [<ffffffffa0307669>] ? ttm_bo_mem_space+0x169/0x340 [ttm] [<ffffffffa0307bd7>] ttm_bo_move_buffer+0x117/0x130 [ttm] [<ffffffff81130001>] ? perf_event_init_context+0x141/0x220 [<ffffffffa0307cb1>] ttm_bo_validate+0xc1/0x130 [ttm] [<ffffffffa04e7377>] mgag200_bo_pin+0x87/0xc0 [mgag200] [<ffffffffa04e56c4>] mga_crtc_cursor_set+0x474/0xbb0 [mgag200] [<ffffffff811971d2>] ? __mem_cgroup_commit_charge+0x152/0x3b0 [<ffffffff815c4182>] ? mutex_lock+0x12/0x2f [<ffffffffa0201433>] drm_mode_cursor_common+0x123/0x170 [drm] [<ffffffffa0205231>] drm_mode_cursor_ioctl+0x41/0x50 [drm] [<ffffffffa01f5ca2>] drm_ioctl+0x502/0x630 [drm] [<ffffffff815cbab4>] ? __do_page_fault+0x1f4/0x510 [<ffffffff8101cb68>] ? __restore_xstate_sig+0x218/0x4f0 [<ffffffff811b4445>] do_vfs_ioctl+0x2e5/0x4d0 [<ffffffff8124488e>] ? file_has_perm+0x8e/0xa0 [<ffffffff811b46b1>] SyS_ioctl+0x81/0xa0 [<ffffffff815d05d9>] system_call_fastpath+0x16/0x1b Code: Bad RIP value. RIP [< (null)>] (null) RSP <ffff88016c885ad8> CR2: 0000000000000000 Signed-off-by: Rob Clark <[email protected]> Reviewed-by: Jérôme Glisse <[email protected]> Reviewed-by: Thomas Hellstrom <[email protected]> Cc: [email protected]
2014-03-12dm cache: fix access beyond end of origin deviceHeinz Mauelshagen1-5/+3
In order to avoid wasting cache space a partial block at the end of the origin device is not cached. Unfortunately, the check for such a partial block at the end of the origin device was flawed. Fix accesses beyond the end of the origin device that occured due to attempted promotion of an undetected partial block by: - initializing the per bio data struct to allow cache_end_io to work properly - recognizing access to the partial block at the end of the origin device - avoiding out of bounds access to the discard bitset Otherwise, users can experience errors like the following: attempt to access beyond end of device dm-5: rw=0, want=20971520, limit=20971456 ... device-mapper: cache: promotion failed; couldn't copy block Signed-off-by: Heinz Mauelshagen <[email protected]> Acked-by: Joe Thornber <[email protected]> Signed-off-by: Mike Snitzer <[email protected]> Cc: [email protected]
2014-03-12dm cache: fix truncation bug when copying a block to/from >2TB fast deviceHeinz Mauelshagen1-1/+2
During demotion or promotion to a cache's >2TB fast device we must not truncate the cache block's associated sector to 32bits. The 32bit temporary result of from_cblock() caused a 32bit multiplication when calculating the sector of the fast device in issue_copy_real(). Use an intermediate 64bit type to store the 32bit from_cblock() to allow for proper 64bit multiplication. Here is an example of how this bug manifests on an ext4 filesystem: EXT4-fs error (device dm-0): ext4_mb_generate_buddy:756: group 17136, 32768 clusters in bitmap, 30688 in gd; block bitmap corrupt. JBD2: Spotted dirty metadata buffer (dev = dm-0, blocknr = 0). There's a risk of filesystem corruption in case of system crash. Signed-off-by: Heinz Mauelshagen <[email protected]> Acked-by: Joe Thornber <[email protected]> Signed-off-by: Mike Snitzer <[email protected]> Cc: [email protected]
2014-03-12KVM: SVM: fix cr8 intercept windowRadim Krčmář1-3/+3
We always disable cr8 intercept in its handler, but only re-enable it if handling KVM_REQ_EVENT, so there can be a window where we do not intercept cr8 writes, which allows an interrupt to disrupt a higher priority task. Fix this by disabling intercepts in the same function that re-enables them when needed. This fixes BSOD in Windows 2008. Cc: <[email protected]> Signed-off-by: Radim Krčmář <[email protected]> Reviewed-by: Marcelo Tosatti <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]>
2014-03-12PCI: Don't check resource_size() in pci_bus_alloc_resource()Bjorn Helgaas1-2/+0
Paul reported that after f75b99d5a77d ("PCI: Enforce bus address limits in resource allocation") on a 32-bit kernel (CONFIG_PHYS_ADDR_T_64BIT not set), intel-gtt complained "can't ioremap flush page - no chipset flushing". In addition, other PCI resource allocations, e.g., for bridge windows, failed. This happens because we incorrectly skip bus resources of [mem 0x00000000-0xffffffff] because we think they are of size zero. When resource_size_t is 32 bits wide, resource_size() on [mem 0x00000000-0xffffffff] returns 0 because (r->end - r->start + 1) overflows. Therefore, we can't use "resource_size() == 0" to decide that allocation from this resource will fail. allocate_resource() should fail anyway if it can't satisfy the address constraints, so we should just depend on that. A [mem 0x00000000-0xffffffff] bus resource is obviously not really valid, but we do fall back to it as a default when we don't have information about host bridge apertures. Link: https://bugzilla.kernel.org/show_bug.cgi?id=71611 Fixes: f75b99d5a77d PCI: Enforce bus address limits in resource allocation Reported-and-tested-by: Paul Bolle <[email protected]> Signed-off-by: Bjorn Helgaas <[email protected]>
2014-03-12PCI: Enable INTx in pci_reenable_device() only when MSI/MSI-X not enabledBjorn Helgaas1-0/+3
Andreas reported that after 1f42db786b14 ("PCI: Enable INTx if BIOS left them disabled"), pciehp surprise removal stopped working. This happens because pci_reenable_device() on the hotplug bridge (used in the pciehp_configure_device() path) clears the Interrupt Disable bit, which apparently breaks the bridge's MSI hotplug event reporting. Previously we cleared the Interrupt Disable bit in do_pci_enable_device(), which is used by both pci_enable_device() and pci_reenable_device(). But we use pci_reenable_device() after the driver may have enabled MSI or MSI-X, and we *set* Interrupt Disable as part of enabling MSI/MSI-X. This patch clears Interrupt Disable only when MSI/MSI-X has not been enabled. Fixes: 1f42db786b14 PCI: Enable INTx if BIOS left them disabled Link: https://bugzilla.kernel.org/show_bug.cgi?id=71691 Reported-and-tested-by: Andreas Noever <[email protected]> Signed-off-by: Bjorn Helgaas <[email protected]> CC: [email protected] CC: Sarah Sharp <[email protected]>
2014-03-12drm/ttm: Work around performance regression with VM_PFNMAPThomas Hellstrom1-5/+7
A performance regression was introduced in TTM in linux 3.13 when we started using VM_PFNMAP for shared mappings. In theory this should've been faster due to less page book-keeping but it appears like VM_PFNMAP + x86 PAT + write-combine is a particularly cpu-hungry combination, as seen by largely increased cpu-usage on r200 GL video playback. Until we've sorted out why, revert to always use VM_MIXEDMAP. Reference: freedesktop.org bugzilla bug #75719 Reported-and-tested-by: <[email protected]> Acked-by: Alex Deucher <[email protected]> Signed-off-by: Thomas Hellstrom <[email protected]> Cc: [email protected]
2014-03-12ASoC: Fix use after freeLars-Peter Clausen1-2/+3
Freeing the current list element while iterating over the list will cause a use after free since the iterator function will still use the current element to look up the next. Use list_for_each_safe() and remove the element from the list before freeing it to avoid this. Fixes: 1438c2f60b ("ASoC: Add a per component dai list") Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2014-03-12[SCSI] storvsc: NULL pointer dereference fixAles Novak1-0/+3
If the initialization of storvsc fails, the storvsc_device_destroy() causes NULL pointer dereference. storvsc_bus_scan() scsi_scan_target() __scsi_scan_target() scsi_probe_and_add_lun(hostdata=NULL) scsi_alloc_sdev(hostdata=NULL) sdev->hostdata = hostdata now the host allocation fails __scsi_remove_device(sdev) calls sdev->host->hostt->slave_destroy() == storvsc_device_destroy(sdev) access of sdev->hostdata->request_mempool Signed-off-by: Ales Novak <[email protected]> Signed-off-by: Thomas Abraham <[email protected]> Reviewed-by: Jiri Kosina <[email protected]> Acked-by: K. Y. Srinivasan <[email protected]> Cc: [email protected] Signed-off-by: James Bottomley <[email protected]>
2014-03-12r8169: fix the incorrect tx descriptor versionhayeswang1-1/+1
The tx descriptor version of RTL8111B belong to RTL_TD_0. Signed-off-by: Hayes Wang <[email protected]> Acked-by: Francois Romieu <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-12tools/net/Makefile: Define PACKAGE to fix build problemsMarkos Chandras1-1/+1
Fixes the following build problem with binutils-2.24 gcc -Wall -O2 -c -o bpf_jit_disasm.o bpf_jit_disasm.c In file included from bpf_jit_disasm.c:25:0: /usr/include/bfd.h:35:2: error: #error config.h must be included before this header #error config.h must be included before this header This is similar to commit 3ce711a6abc27abce1554e1d671a8762b7187690 "perf tools: bfd.h/libbfd detection fails with recent binutils" See: https://sourceware.org/bugzilla/show_bug.cgi?id=14243 CC: David S. Miller <[email protected]> CC: Daniel Borkmann <[email protected]> CC: [email protected] Acked-by: Daniel Borkmann <[email protected]> Signed-off-by: Markos Chandras <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-11x86: bpf_jit: support negative offsetsAlexei Starovoitov1-1/+1
Commit a998d4342337 claimed to introduce negative offset support to x86 jit, but it couldn't be working, since at the time of the execution of LD+ABS or LD+IND instructions via call into bpf_internal_load_pointer_neg_helper() the %edx (3rd argument of this func) had junk value instead of access size in bytes (1 or 2 or 4). Store size into %edx instead of %ecx (what original commit intended to do) Fixes: a998d4342337 ("bpf jit: Let the x86 jit handle negative offsets") Signed-off-by: Alexei Starovoitov <[email protected]> Cc: Jan Seiffert <[email protected]> Cc: Eric Dumazet <[email protected]> Acked-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-11bridge: multicast: enable snooping on general queries onlyLinus Lüssing1-3/+5
Without this check someone could easily create a denial of service by injecting multicast-specific queries to enable the bridge snooping part if no real querier issuing periodic general queries is present on the link which would result in the bridge wrongly shutting down ports for multicast traffic as the bridge did not learn about these listeners. With this patch the snooping code is enabled upon receiving valid, general queries only. Signed-off-by: Linus Lüssing <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-11bridge: multicast: add sanity check for general query destinationLinus Lüssing1-0/+19
General IGMP and MLD queries are supposed to have the multicast link-local all-nodes address as their destination according to RFC2236 section 9, RFC3376 section 4.1.12/9.1, RFC2710 section 8 and RFC3810 section 5.1.15. Without this check, such malformed IGMP/MLD queries can result in a denial of service: The queries are ignored by most IGMP/MLD listeners therefore they will not respond with an IGMP/MLD report. However, without this patch these malformed MLD queries would enable the snooping part in the bridge code, potentially shutting down the according ports towards these hosts for multicast traffic as the bridge did not learn about these listeners. Reported-by: Jan Stancek <[email protected]> Signed-off-by: Linus Lüssing <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-11tcp: tcp_release_cb() should release socket ownershipEric Dumazet3-1/+20
Lars Persson reported following deadlock : -000 |M:0x0:0x802B6AF8(asm) <-- arch_spin_lock -001 |tcp_v4_rcv(skb = 0x8BD527A0) <-- sk = 0x8BE6B2A0 -002 |ip_local_deliver_finish(skb = 0x8BD527A0) -003 |__netif_receive_skb_core(skb = 0x8BD527A0, ?) -004 |netif_receive_skb(skb = 0x8BD527A0) -005 |elk_poll(napi = 0x8C770500, budget = 64) -006 |net_rx_action(?) -007 |__do_softirq() -008 |do_softirq() -009 |local_bh_enable() -010 |tcp_rcv_established(sk = 0x8BE6B2A0, skb = 0x87D3A9E0, th = 0x814EBE14, ?) -011 |tcp_v4_do_rcv(sk = 0x8BE6B2A0, skb = 0x87D3A9E0) -012 |tcp_delack_timer_handler(sk = 0x8BE6B2A0) -013 |tcp_release_cb(sk = 0x8BE6B2A0) -014 |release_sock(sk = 0x8BE6B2A0) -015 |tcp_sendmsg(?, sk = 0x8BE6B2A0, ?, ?) -016 |sock_sendmsg(sock = 0x8518C4C0, msg = 0x87D8DAA8, size = 4096) -017 |kernel_sendmsg(?, ?, ?, ?, size = 4096) -018 |smb_send_kvec() -019 |smb_send_rqst(server = 0x87C4D400, rqst = 0x87D8DBA0) -020 |cifs_call_async() -021 |cifs_async_writev(wdata = 0x87FD6580) -022 |cifs_writepages(mapping = 0x852096E4, wbc = 0x87D8DC88) -023 |__writeback_single_inode(inode = 0x852095D0, wbc = 0x87D8DC88) -024 |writeback_sb_inodes(sb = 0x87D6D800, wb = 0x87E4A9C0, work = 0x87D8DD88) -025 |__writeback_inodes_wb(wb = 0x87E4A9C0, work = 0x87D8DD88) -026 |wb_writeback(wb = 0x87E4A9C0, work = 0x87D8DD88) -027 |wb_do_writeback(wb = 0x87E4A9C0, force_wait = 0) -028 |bdi_writeback_workfn(work = 0x87E4A9CC) -029 |process_one_work(worker = 0x8B045880, work = 0x87E4A9CC) -030 |worker_thread(__worker = 0x8B045880) -031 |kthread(_create = 0x87CADD90) -032 |ret_from_kernel_thread(asm) Bug occurs because __tcp_checksum_complete_user() enables BH, assuming it is running from softirq context. Lars trace involved a NIC without RX checksum support but other points are problematic as well, like the prequeue stuff. Problem is triggered by a timer, that found socket being owned by user. tcp_release_cb() should call tcp_write_timer_handler() or tcp_delack_timer_handler() in the appropriate context : BH disabled and socket lock held, but 'owned' field cleared, as if they were running from timer handlers. Fixes: 6f458dfb4092 ("tcp: improve latencies of timer triggered events") Reported-by: Lars Persson <[email protected]> Tested-by: Lars Persson <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-11Merge branch 'skb_frags'David S. Miller1-46/+54
Michael S. Tsirkin says: ==================== skbuff: fix skb_segment with zero copy skbs This fixes a bug in skb_segment where it moves frags between skbs without orphaning them. This causes userspace to assume it's safe to reuse the buffer, and receiver gets corrupted data. This further might leak information from the transmitter on the wire. To fix track which skb does a copied frag belong to, and orphan frags when copying them. As we are tracking multiple skbs here, using short names (skb,nskb,fskb,skb_frag,frag) becomes confusing. So before adding another one, I refactor these names slightly. Patch is split out to make it easier to verify that all trasformations are trivially correct. The problem was observed in the field, so I think that the patch is necessary on stable as well. ==================== Signed-off-by: David S. Miller <[email protected]> Acked-by: Herbert Xu <[email protected]>
2014-03-11skbuff: skb_segment: orphan frags before copyingMichael S. Tsirkin1-0/+6
skb_segment copies frags around, so we need to copy them carefully to avoid accessing user memory after reporting completion to userspace through a callback. skb_segment doesn't normally happen on datapath: TSO needs to be disabled - so disabling zero copy in this case does not look like a big deal. Signed-off-by: Michael S. Tsirkin <[email protected]> Acked-by: Herbert Xu <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-11skbuff: skb_segment: s/fskb/list_skb/Michael S. Tsirkin1-13/+13
fskb is unrelated to frag: it's coming from frag_list. Rename it list_skb to avoid confusion. Signed-off-by: Michael S. Tsirkin <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-11skbuff: skb_segment: s/skb/head_skb/Michael S. Tsirkin1-22/+24
rename local variable to make it easier to tell at a glance that we are dealing with a head skb. Signed-off-by: Michael S. Tsirkin <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-03-11skbuff: skb_segment: s/skb_frag/frag/Michael S. Tsirkin1-7/+7
skb_frag can in fact point at either skb or fskb so rename it generally "frag". Signed-off-by: Michael S. Tsirkin <[email protected]> Signed-off-by: David S. Miller <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.