aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-10-22Merge tag 'usb-serial-4.9-rc2' of ↵Greg Kroah-Hartman4-5/+10
git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for v4.9-rc2 Here's a fix for a NULL-deref during probe which could be triggered by a malicious device, and a fix for some missing error handling in cp210x that also leaked some bits from the stack. Included is also a new device id for ftdi_sio. Signed-off-by: Johan Hovold <[email protected]>
2016-10-22reset: uniphier: rename MIO reset to SD reset for Pro5, PXs2, LD20 SoCsMasahiro Yamada2-39/+39
I made a mistake as for naming for this block. The MIO block is not implemented for these 3 SoCs in the first place. The current naming will be a trouble if an SoC with both MIO and SD-ctrl blocks appear in the future. This driver has just been merged in the previous merge window. Rename it before the release. Signed-off-by: Masahiro Yamada <[email protected]> Acked-by: Philipp Zabel <[email protected]>
2016-10-22arm64: uniphier: select ARCH_HAS_RESET_CONTROLLERMasahiro Yamada1-0/+1
The UniPhier reset driver (drivers/reset/reset-uniphier.c) has been merged. Select ARCH_HAS_RESET_CONTROLLER from the SoC Kconfig. Signed-off-by: Masahiro Yamada <[email protected]>
2016-10-22ARM: uniphier: select ARCH_HAS_RESET_CONTROLLERMasahiro Yamada1-0/+1
The UniPhier reset driver (drivers/reset/reset-uniphier.c) has been merged. Select ARCH_HAS_RESET_CONTROLLER from the SoC Kconfig. Signed-off-by: Masahiro Yamada <[email protected]> Acked-by: Philipp Zabel <[email protected]>
2016-10-22x86/boot/smp: Don't try to poke disabled/non-existent APICVille Syrjälä1-7/+9
Apparently trying to poke a disabled or non-existent APIC leads to a box that doesn't even boot. Let's not do that. No real clue if this is the right fix, but at least my P3 machine boots again. Signed-off-by: Ville Syrjälä <[email protected]> Cc: Andy Lutomirski <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Brian Gerst <[email protected]> Cc: Denys Vlasenko <[email protected]> Cc: Eric Biederman <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Jiri Olsa <[email protected]> Cc: Josh Poimboeuf <[email protected]> Cc: Juergen Gross <[email protected]> Cc: Len Brown <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Prarit Bhargava <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Yinghai Lu <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Fixes: 2a51fe083eba ("arch/x86: Handle non enumerated CPU after physical hotplug") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
2016-10-21Merge tag 'powerpc-4.9-3' of ↵Linus Torvalds13-50/+148
git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Fixes marked for stable: - Prevent unlikely crash in copro_calculate_slb() (Frederic Barrat) - cxl: Prevent adapter reset if an active context exists (Vaibhav Jain) Fixes for code merged this cycle: - Fix boot on systems with uncompressed kernel image (Heiner Kallweit) - Drop dump_numa_memory_topology() (Michael Ellerman) - Fix numa topology console print (Aneesh Kumar K.V) - Ignore the pkey system calls for now (Stephen Rothwell)" * tag 'powerpc-4.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: Ignore the pkey system calls for now powerpc: Fix numa topology console print powerpc/mm: Drop dump_numa_memory_topology() cxl: Prevent adapter reset if an active context exists powerpc/boot: Fix boot on systems with uncompressed kernel image powerpc/mm: Prevent unlikely crash in copro_calculate_slb()
2016-10-21Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds6-10/+24
Pull KVM fixes from Radim Krčmář: "ARM: - avoid livelock when walking guest page tables - fix HYP mode static keys without CC_HAVE_ASM_GOTO MIPS: - fix a build error without TRACEPOINTS_ENABLED s390: - reject a malformed userspace configuration x86: - suppress a warning without CONFIG_CPU_FREQ - initialize whole irq_eoi array" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: arm/arm64: KVM: Map the BSS at HYP arm64: KVM: Take S1 walks into account when determining S2 write faults KVM: s390: reject invalid modes for runtime instrumentation kvm: x86: memset whole irq_eoi kvm/x86: Fix unused variable warning in kvm_timer_init() KVM: MIPS: Add missing uaccess.h include
2016-10-21Merge tag 'nfs-for-4.9-2' of git://git.linux-nfs.org/projects/anna/linux-nfsLinus Torvalds2-2/+3
Pull NFS client bugfixes from Anna Schumaker: "Just two bugfixes this time: Stable bugfix: - Fix last_write_offset incorrectly set to page boundary Other bugfix: - Fix missing-braces warning" * tag 'nfs-for-4.9-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: nfs4: fix missing-braces warning pnfs/blocklayout: fix last_write_offset incorrectly set to page boundary
2016-10-21Merge tag 'acpi-4.9-rc2' of ↵Linus Torvalds2-1/+5
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix an issue related to system resume in the new WDAT-based watchdog driver and a return value of a stub function in the ACPI CPPC framework. Specifics: - Update the ACPI WDAT-based watchdog driver to ping the hardware during system resume to prevent a reset from occurring after the resume is complete (Mika Westerberg). - Fix the return value of the pcc_mbox_request_channel() stub for CONFIG_PCC unset (Hoan Tran)" * tag 'acpi-4.9-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: watchdog: wdat_wdt: Ping the watchdog on resume mailbox: PCC: Fix return value of pcc_mbox_request_channel()
2016-10-21badblocks: badblocks_set/clear update unacked_existShaohua Li1-0/+23
When bandblocks_set acknowledges a range or badblocks_clear a range, it's possible all badblocks are acknowledged. We should update unacked_exist if this occurs. Signed-off-by: Shaohua Li <[email protected]> Reviewed-by: Tomasz Majchrzak <[email protected]> Tested-by: Tomasz Majchrzak <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2016-10-21softirq: Display IRQ_POLL for irq-poll statisticsSagi Grimberg1-1/+1
This library was moved to the generic area and was renamed to irq-poll. Hence, update proc/softirqs output accordingly. Signed-off-by: Sagi Grimberg <[email protected]> Reviewed-by: Johannes Thumshirn <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2016-10-22powerpc: Convert cmp to cmpd in idle enter sequenceSegher Boessenkool1-1/+1
PowerPC's "cmp" instruction has four operands. Normally people write "cmpw" or "cmpd" for the second cmp operand 0 or 1. But, frequently people forget, and write "cmp" with just three operands. With older binutils this is silently accepted as if this was "cmpw", while often "cmpd" is wanted. With newer binutils GAS will complain about this for 64-bit code. For 32-bit code it still silently assumes "cmpw" is what is meant. In this instance the code comes directly from ISA v2.07, including the cmp, but cmpd is correct. Backport to stable so that new toolchains can build old kernels. Fixes: 948cf67c4726 ("powerpc: Add NAP mode support on Power7 in HV mode") Cc: [email protected] # v3.0 Reviewed-by: Vaidyanathan Srinivasan <[email protected]> Signed-off-by: Segher Boessenkool <[email protected]> Signed-off-by: Michael Ellerman <[email protected]>
2016-10-22KVM: PPC: Book3S HV: Fix build error when SMP=nMichael Ellerman1-0/+1
Commit 5d375199ea96 ("KVM: PPC: Book3S HV: Set server for passed-through interrupts") broke the SMP=n build: arch/powerpc/kvm/book3s_hv_rm_xics.c:758:2: error: implicit declaration of function 'get_hard_smp_processor_id' That is because we lost the implicit include of asm/smp.h, so include it explicitly to get the definition for get_hard_smp_processor_id(). Fixes: 5d375199ea96 ("KVM: PPC: Book3S HV: Set server for passed-through interrupts") Signed-off-by: Michael Ellerman <[email protected]>
2016-10-21Merge branches 'acpi-wdat' and 'acpi-cppc'Rafael J. Wysocki2-1/+5
* acpi-wdat: watchdog: wdat_wdt: Ping the watchdog on resume * acpi-cppc: mailbox: PCC: Fix return value of pcc_mbox_request_channel()
2016-10-21cpufreq: intel_pstate: Set P-state upfront in performance modeRafael J. Wysocki1-4/+25
After commit a4675fbc4a7a (cpufreq: intel_pstate: Replace timers with utilization update callbacks) the cpufreq governor callbacks may not be invoked on NOHZ_FULL CPUs and, in particular, switching to the "performance" policy via sysfs may not have any effect on them. That is a problem, because it usually is desirable to squeeze the last bit of performance out of those CPUs, so work around it by setting the maximum P-state (within the limits) in intel_pstate_set_policy() upfront when the policy is CPUFREQ_POLICY_PERFORMANCE. Fixes: a4675fbc4a7a (cpufreq: intel_pstate: Replace timers with utilization update callbacks) Signed-off-by: Rafael J. Wysocki <[email protected]> Acked-by: Srinivas Pandruvada <[email protected]>
2016-10-21Merge tag 'gic-fixes-for-4.9-rc2' of ↵Thomas Gleixner3-7/+7
git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull GIC updates from Marc Zyngier: - Fix for 32bit accesses that should be 64bit on 64bit machines - Fix for a field decoding macro - Beautify a warning message
2016-10-21Merge tag 'scsi-fixes' of ↵Linus Torvalds4-11/+6
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Five small fixes. Some of these, like the nested spinlock overwriting saved flags and the Kasan use after free look serious, but they seem not to have been picked up in testing or seen in the field. The biggest user visible issue is probably the wrong device handler for Clariion, which means that alua doesn't bind to the array like it should" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ipr: Fix async error WARN_ON scsi: zfcp: spin_lock_irqsave() is not nestable scsi: Remove one useless stack variable scsi: Fix use-after-free scsi: Replace wrong device handler name for CLARiiON arrays
2016-10-21Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds8-49/+115
Pull block fixes from Jens Axboe: "A set of fixes that missed the merge window, mostly due to me being away around that time. Nothing major here, a mix of nvme cleanups and fixes, and one fix for the badblocks handling" * 'for-linus' of git://git.kernel.dk/linux-block: nvmet: use symbolic constants for CNS values nvme: use symbolic constants for CNS values nvme.h: add an enum for cns values nvme.h: don't use uuid_be nvme.h: resync with nvme-cli nvme: Add tertiary number to NVME_VS nvme : Add sysfs entry for NVMe CMBs when appropriate nvme: don't schedule multiple resets nvme: Delete created IO queues on reset nvme: Stop probing a removed device badblocks: fix overlapping check for clearing
2016-10-21Merge tag 'pci-v4.9-fixes-1' of ↵Linus Torvalds3-3/+3
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: "This includes: - Fix for a Layerscape driver issue that causes a use-before-set crash - Maintainer update for the Synopsis prototyping device driver" * tag 'pci-v4.9-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: designware-plat: Update author email address PCI: layerscape: Fix drvdata usage before assignment PCI: designware-plat: Change maintainer to Jose Abreu
2016-10-21Merge tag 'kvm-arm-for-4.9-rc2' of ↵Radim Krčmář2-5/+13
git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm KVM/ARM updates for 4.9-rc2 - Handle faults generated by the page table walker as being writes - Map the BSS at EL2
2016-10-21Merge remote-tracking branch 'mkp-scsi/4.9/scsi-fixes' into fixesJames Bottomley3-19/+28
2016-10-21arm/arm64: KVM: Map the BSS at HYPMarc Zyngier1-0/+7
When used with a compiler that doesn't implement "asm goto" (such as the AArch64 port of GCC 4.8), jump labels generate a memory access to find out about the value of the key (instead of just patching the code). The key itself is likely to be stored in the BSS. This is perfectly fine, except that we don't map the BSS at HYP, leading to an exploding kernel at the first access. The obvious fix is simply to map the BSS there (which should have been done a long while ago, but hey...). Reported-by: Eric Auger <[email protected]> Tested-by: Eric Auger <[email protected]> Signed-off-by: Marc Zyngier <[email protected]>
2016-10-21arm64: KVM: Take S1 walks into account when determining S2 write faultsWill Deacon1-5/+6
The WnR bit in the HSR/ESR_EL2 indicates whether a data abort was generated by a read or a write instruction. For stage 2 data aborts generated by a stage 1 translation table walk (i.e. the actual page table access faults at EL2), the WnR bit therefore reports whether the instruction generating the walk was a load or a store, *not* whether the page table walker was reading or writing the entry. For page tables marked as read-only at stage 2 (e.g. due to KSM merging them with the tables from another guest), this could result in livelock, where a page table walk generated by a load instruction attempts to set the access flag in the stage 1 descriptor, but fails to trigger CoW in the host since only a read fault is reported. This patch modifies the arm64 kvm_vcpu_dabt_iswrite function to take into account stage 2 faults in stage 1 walks. Since DBM cannot be disabled at EL2 for CPUs that implement it, we assume that these faults are always causes by writes, avoiding the livelock situation at the expense of occasional, spurious CoWs. We could, in theory, do a bit better by checking the guest TCR configuration and inspecting the page table to see why the PTE faulted. However, I doubt this is measurable in practice, and the threat of livelock is real. Cc: <[email protected]> Cc: Julien Grall <[email protected]> Reviewed-by: Marc Zyngier <[email protected]> Reviewed-by: Christoffer Dall <[email protected]> Signed-off-by: Will Deacon <[email protected]>
2016-10-21Merge tag 'drm-fixes-for-v4.9-rc2-part2' of ↵Linus Torvalds12-148/+187
git://people.freedesktop.org/~airlied/linux Pull more drm fixes from Dave Airlie: "Mainly some vmwgfx fixes, but also some fixes for armada, etnaviv and fsl-dcu" * tag 'drm-fixes-for-v4.9-rc2-part2' of git://people.freedesktop.org/~airlied/linux: drm/fsl-dcu: enable pixel clock when enabling CRTC drm/fsl-dcu: do not transfer registers in mode_set_nofb drm/fsl-dcu: do not transfer registers on plane init drm/fsl-dcu: enable TCON bypass mode by default drm/vmwgfx: Adjust checks for null pointers in 13 functions drm/vmwgfx: Use memdup_user() rather than duplicating its implementation drm/vmwgfx: Use kmalloc_array() in vmw_surface_define_ioctl() drm/vmwgfx: Avoid validating views on view destruction drm/vmwgfx: Limit the user-space command buffer size drm/vmwgfx: Remove a leftover debug printout drm/vmwgfx: Allow resource relocations on byte boundaries drm/vmwgfx: Enable SVGA_3D_CMD_DX_TRANSFER_FROM_BUFFER command drm/vmwgfx: Remove call to reservation_object_test_signaled_rcu before wait drm/vmwgfx: Replace numeric parameter like 0444 with macro drm/etnaviv: block 64K of address space behind each cmdstream drm/etnaviv: ensure write caches are flushed at end of user cmdstream drm/armada: fix clock counts
2016-10-21ipv6: fix a potential deadlock in do_ipv6_setsockopt()WANG Cong3-6/+15
Baozeng reported this deadlock case: CPU0 CPU1 ---- ---- lock([ 165.136033] sk_lock-AF_INET6); lock([ 165.136033] rtnl_mutex); lock([ 165.136033] sk_lock-AF_INET6); lock([ 165.136033] rtnl_mutex); Similar to commit 87e9f0315952 ("ipv4: fix a potential deadlock in mcast getsockopt() path") this is due to we still have a case, ipv6_sock_mc_close(), where we acquire sk_lock before rtnl_lock. Close this deadlock with the similar solution, that is always acquire rtnl lock first. Fixes: baf606d9c9b1 ("ipv4,ipv6: grab rtnl before locking the socket") Reported-by: Baozeng Ding <[email protected]> Tested-by: Baozeng Ding <[email protected]> Cc: Marcelo Ricardo Leitner <[email protected]> Signed-off-by: Cong Wang <[email protected]> Reviewed-by: Marcelo Ricardo Leitner <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-10-21PCI: designware-plat: Update author email addressJoao Pinto1-1/+1
Although I am leaving Synopsys, I would like to keep working with the linux kernel community and help in what you might find useful. For that I am sending this patch to change my contact e-mail. Signed-off-by: Joao Pinto <[email protected]> Signed-off-by: Bjorn Helgaas <[email protected]>
2016-10-21USB: serial: fix potential NULL-dereference at probeJohan Hovold1-1/+2
Make sure we have at least one port before attempting to register a console. Currently, at least one driver binds to a "dummy" interface and requests zero ports for it. Should such an interface also lack endpoints, we get a NULL-deref during probe. Fixes: e5b1e2062e05 ("USB: serial: make minor allocation dynamic") Cc: stable <[email protected]> # 3.11 Signed-off-by: Johan Hovold <[email protected]>
2016-10-21Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nfDavid S. Miller14-60/+70
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for your net tree, they are: 1) Fix compilation warning in xt_hashlimit on m68k 32-bits, from Geert Uytterhoeven. 2) Fix wrong timeout in set elements added from packet path via nft_dynset, from Anders K. Pedersen. 3) Remove obsolete nf_conntrack_events_retry_timeout sysctl documentation, from Nicolas Dichtel. 4) Ensure proper initialization of log flags via xt_LOG, from Liping Zhang. 5) Missing alias to autoload ipcomp, also from Liping Zhang. 6) Missing NFTA_HASH_OFFSET attribute validation, again from Liping. 7) Wrong integer type in the new nft_parse_u32_check() function, from Dan Carpenter. 8) Another wrong integer type declaration in nft_exthdr_init, also from Dan Carpenter. 9) Fix insufficient mode validation in nft_range. 10) Fix compilation warning in nft_range due to possible uninitialized value, from Arnd Bergmann. 11) Zero nf_hook_ops allocated via xt_hook_alloc() in x_tables to calm down kmemcheck, from Florian Westphal. 12) Schedule gc_worker() to run again if GC_MAX_EVICTS quota is reached, from Nicolas Dichtel. 13) Fix nf_queue() after conversion to single-linked hook list, related to incorrect bypass flag handling and incorrect hook point of reinjection. ==================== Signed-off-by: David S. Miller <[email protected]>
2016-10-21arm64: dts: Add timer erratum property for LS2080A and LS1043AScott Wood2-0/+2
Both the LS1043A and LS2080A platforms are affected by the Freescale A008585 erratum. Advertise it in their respective device trees. Signed-off-by: Scott Wood <[email protected]> Acked-by: Marc Zyngier <[email protected]> Signed-off-by: Shawn Guo <[email protected]>
2016-10-21gpio: ts4800: Fix module autoloadJavier Martinez Canillas1-0/+1
If the driver is built as a module, autoload won't work because the module alias information is not filled. So user-space can't match the registered device with the corresponding module. Export the module alias information using the MODULE_DEVICE_TABLE() macro. Before this patch: $ modinfo drivers/gpio/gpio-ts4800.ko | grep alias $ After this patch: $ modinfo drivers/gpio/gpio-ts4800.ko | grep alias alias: of:N*T*Ctechnologic,ts4800-gpioC* alias: of:N*T*Ctechnologic,ts4800-gpio Signed-off-by: Javier Martinez Canillas <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2016-10-21gpio: GPIO_GET_LINEEVENT_IOCTL: Reject invalid line and event flagsLars-Peter Clausen1-0/+11
The GPIO_GET_LINEEVENT_IOCTL currently ignores unknown or undefined linehandle and lineevent flags. From a backwards and forwards compatibility viewpoint it is highly desirable to reject unknown flags though. On one hand an application that is using newer flags and is running on an older kernel has no way to detect if the new flags were handled correctly if they are silently discarded. On the other hand an application that (accidentally) passes undefined flags will run fine on an older kernel, but may break on a newer kernel when these flags get defined. Ensure that requests that have undefined flags set are rejected with an error, rather than silently discarding the undefined flags. Cc: [email protected] Fixes: 61f922db7221 ("gpio: userspace ABI for reading GPIO line events") Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2016-10-21gpio: GPIO_GET_LINEHANDLE_IOCTL: Reject invalid line flagsLars-Peter Clausen1-0/+13
The GPIO_GET_LINEHANDLE_IOCTL currently ignores unknown or undefined linehandle flags. From a backwards and forwards compatibility viewpoint it is highly desirable to reject unknown flags though. On one hand an application that is using newer flags and is running on an older kernel has no way to detect if the new flags were handled correctly if they are silently discarded. On the other hand an application that (accidentally) passes undefined flags will run fine on an older kernel, but may break on a newer kernel when these flags get defined. Ensure that requests that have undefined flags set are rejected with an error, rather than silently discarding the undefined flags. Cc: [email protected] Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines") Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2016-10-21batman-adv: fix splat on disabling an interfaceLinus Lüssing1-1/+0
As long as there is still a reference for a hard interface held, there might still be a forwarding packet relying on its attributes. Therefore avoid setting hard_iface->soft_iface to NULL when disabling a hard interface. This fixes the following, potential splat: batman_adv: bat0: Interface deactivated: eth1 batman_adv: bat0: Removing interface: eth1 cgroup: new mount options do not match the existing superblock, will be ignored batman_adv: bat0: Interface deactivated: eth3 batman_adv: bat0: Removing interface: eth3 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1986 at ./net/batman-adv/bat_iv_ogm.c:549 batadv_iv_send_outstanding_bat_ogm_packet+0x145/0x643 [batman_adv] Modules linked in: batman_adv(O-) <...> CPU: 3 PID: 1986 Comm: kworker/u8:2 Tainted: G W O 4.6.0-rc6+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet [batman_adv] 0000000000000000 ffff88001d93bca0 ffffffff8126c26b 0000000000000000 0000000000000000 ffff88001d93bcf0 ffffffff81051615 ffff88001f19f818 000002251d93bd68 0000000000000046 ffff88001dc04a00 ffff88001becbe48 Call Trace: [<ffffffff8126c26b>] dump_stack+0x67/0x90 [<ffffffff81051615>] __warn+0xc7/0xe5 [<ffffffff8105164b>] warn_slowpath_null+0x18/0x1a [<ffffffffa0356f24>] batadv_iv_send_outstanding_bat_ogm_packet+0x145/0x643 [batman_adv] [<ffffffff8108b01f>] ? __lock_is_held+0x32/0x54 [<ffffffff810689a2>] process_one_work+0x2a8/0x4f5 [<ffffffff81068856>] ? process_one_work+0x15c/0x4f5 [<ffffffff81068df2>] worker_thread+0x1d5/0x2c0 [<ffffffff81068c1d>] ? process_scheduled_works+0x2e/0x2e [<ffffffff81068c1d>] ? process_scheduled_works+0x2e/0x2e [<ffffffff8106dd90>] kthread+0xc0/0xc8 [<ffffffff8144de82>] ret_from_fork+0x22/0x40 [<ffffffff8106dcd0>] ? __init_kthread_worker+0x55/0x55 ---[ end trace 647f9f325123dc05 ]--- What happened here is, that there was still a forw_packet (here: a BATMAN IV OGM) in the queue of eth3 with the forw_packet->if_incoming set to eth1 and the forw_packet->if_outgoing set to eth3. When eth3 is to be deactivated and removed, then this thread waits for the forw_packet queued on eth3 to finish. Because eth1 was deactivated and removed earlier and by that had forw_packet->if_incoming->soft_iface, set to NULL, the splat when trying to send/flush the OGM on eth3 occures. Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Linus Lüssing <[email protected]> [[email protected]: Reduced size of Oops message] Signed-off-by: Sven Eckelmann <[email protected]> Signed-off-by: Simon Wunderlich <[email protected]>
2016-10-21gpio: GPIOHANDLE_GET_LINE_VALUES_IOCTL: Fix information leakLars-Peter Clausen1-0/+2
The GPIOHANDLE_GET_LINE_VALUES_IOCTL handler allocates a gpiohandle_data struct on the stack and then passes it to copy_to_user(). But depending on the number of requested line handles the struct is only partially initialized. This exposes the previous, potentially sensitive, stack content to the issuing userspace application. To avoid this make sure that the struct is fully initialized. Cc: [email protected] Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines") Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2016-10-21gpio: GPIO_GET_LINEEVENT_IOCTL: Validate line offsetLars-Peter Clausen1-0/+5
The line offset that is used as an index into the descs array is provided by userspace and might go beyond the bounds of the array. If that happens undefined behavior will occur. Make sure that the offset is within the bounds of the desc array and reject any requests that specify a value outside of it. Cc: [email protected] Fixes: 61f922db7221 ("gpio: userspace ABI for reading GPIO line events") Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2016-10-21gpio: GPIOHANDLE_GET_LINE_VALUES_IOCTL: Fix information leakLars-Peter Clausen1-0/+2
The GPIOHANDLE_GET_LINE_VALUES_IOCTL handler allocates a gpiohandle_data struct on the stack and then passes it to copy_to_user(). But only the first element of the values array in the struct is set, which leaves the struct partially initialized. This exposes the previous, potentially sensitive, stack content to the issuing userspace application. To avoid this make sure that the struct is fully initialized. Cc: [email protected] Fixes: 61f922db7221 ("gpio: userspace ABI for reading GPIO line events") Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2016-10-21gpio: GPIO_GET_LINEHANDLE_IOCTL: Validate line offsetLars-Peter Clausen1-0/+5
The line offset that is used as an index into the descs array is provided by userspace and might go beyond the bounds of the array. If that happens undefined behavior will occur. Make sure that the offset is within the bounds of the desc array and reject any requests that specify a value outside of it. Cc: [email protected] Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines") Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2016-10-21gpio: GPIO_GET_CHIPINFO_IOCTL: Fix information leakLars-Peter Clausen1-0/+2
The GPIO_GET_CHIPINFO_IOCTL handler allocates a gpiochip_info struct on the stack and then passes it to copy_to_user(). But depending on the length of the GPIO chip name and label the struct is only partially initialized. This exposes the previous, potentially sensitive, stack content to the issuing userspace application. To avoid this make sure that the struct is fully initialized. Cc: [email protected] Fixes: 521a2ad6f862 ("gpio: add userspace ABI for GPIO line information") Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2016-10-21gpio: GPIO_GET_CHIPINFO_IOCTL: Fix line offset validationLars-Peter Clausen1-1/+1
The current line offset validation is off by one. Depending on the data stored behind the descs array this can either cause undefined behavior or disclose arbitrary, potentially sensitive, memory to the issuing userspace application. Make sure that offset is within the bounds of the desc array. Cc: [email protected] Fixes: 521a2ad6f862 ("gpio: add userspace ABI for GPIO line information") Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2016-10-21kernel/irq: Export irq_set_parent()Sudip Mukherjee1-0/+1
The TPS65217 driver grew interrupt support which uses irq_set_parent(). While it's not yet clear why this is used in the first place, building the driver as a module fails with: ERROR: ".irq_set_parent" [drivers/mfd/tps65217.ko] undefined! The correctness of the driver change is still investigated, but for now it's less trouble to export irq_set_parent() than dealing with the build wreckage. [ tglx: Rewrote changelog and made the export GPL ] Fixes: 6556bdacf646 ("mfd: tps65217: Add support for IRQs") Signed-off-by: Sudip Mukherjee <[email protected]> Cc: Sudip Mukherjee <[email protected]> Cc: Marcin Niestroj <[email protected]> Cc: Grygorii Strashko <[email protected]> Cc: Tony Lindgren <[email protected]> Cc: Lee Jones <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]>
2016-10-21target/tcm_fc: use CPU affinity for responsesHannes Reinecke1-1/+1
The libfc stack assigns exchange IDs based on the CPU the request was received on, so we need to send the responses via the same CPU. Otherwise the send logic gets confuses and responses will be delayed, causing exchange timeouts on the initiator side. Signed-off-by: Hannes Reinecke <[email protected]> Cc: [email protected] # 4.5+ Signed-off-by: Nicholas Bellinger <[email protected]>
2016-10-21target/tcm_fc: Update debugging statements to match libfc usageHannes Reinecke1-11/+26
Update the debug statements to match those from libfc. Signed-off-by: Hannes Reinecke <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2016-10-21target/tcm_fc: return detailed error in ft_sess_create()Hannes Reinecke1-2/+3
Not every failure is due to out-of-memory; the ACLs might not be set, too. So return a detailed error code in ft_sess_create() instead of just a NULL pointer. Signed-off-by: Hannes Reinecke <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2016-10-21target/tcm_fc: print command pointer in debug messageHannes Reinecke1-1/+1
When allocating a new command we should add the pointer to the debug statements; that allows us to match this with other debug statements for handling data. Signed-off-by: Hannes Reinecke <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2016-10-21target: fix potential race window in target_sess_cmd_list_waiting()Hannes Reinecke1-4/+8
target_sess_cmd_list_waiting() might hit on a condition where the kref for the command is already 0, but the destructor has not been called yet (or is stuck in waiting for a spin lock). Rather than leaving the command on the list we should explicitly remove it to avoid race issues later on. Signed-off-by: Hannes Reinecke <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2016-10-21Merge branch 'drm-etnaviv-fixes' of git://git.pengutronix.de/lst/linux into ↵Dave Airlie2-6/+21
drm-fixes 2 more patches to stabilize the new MMUv2 support. * 'drm-etnaviv-fixes' of git://git.pengutronix.de/lst/linux: drm/etnaviv: block 64K of address space behind each cmdstream drm/etnaviv: ensure write caches are flushed at end of user cmdstream
2016-10-21Merge branch 'drm-vmwgfx-fixes' of ↵Dave Airlie5-73/+146
ssh://people.freedesktop.org/~syeh/repos_linux into drm-fixes vmwgfx cleanups and fixes. * 'drm-vmwgfx-fixes' of ssh://people.freedesktop.org/~syeh/repos_linux: drm/vmwgfx: Adjust checks for null pointers in 13 functions drm/vmwgfx: Use memdup_user() rather than duplicating its implementation drm/vmwgfx: Use kmalloc_array() in vmw_surface_define_ioctl() drm/vmwgfx: Avoid validating views on view destruction drm/vmwgfx: Limit the user-space command buffer size drm/vmwgfx: Remove a leftover debug printout drm/vmwgfx: Allow resource relocations on byte boundaries drm/vmwgfx: Enable SVGA_3D_CMD_DX_TRANSFER_FROM_BUFFER command drm/vmwgfx: Remove call to reservation_object_test_signaled_rcu before wait drm/vmwgfx: Replace numeric parameter like 0444 with macro
2016-10-21Merge branch 'drm-armada-fixes' of git://git.armlinux.org.uk/~rmk/linux-arm ↵Dave Airlie1-8/+10
into drm-fixes One small fix for Armada, where the clock prepare/enable counts were going awry. * 'drm-armada-fixes' of git://git.armlinux.org.uk/~rmk/linux-arm: drm/armada: fix clock counts
2016-10-21Merge branch 'fixes-for-v4.9-rc2' of ↵Dave Airlie4-61/+10
http://git.agner.ch/git/linux-drm-fsl-dcu into drm-fixes This are some fixes which I hoped to still get into v4.9. I used to test them here since about 2 weeks and Meng came around to test it on the second platform making use of this IP too, so they are well tested now. * 'fixes-for-v4.9-rc2' of http://git.agner.ch/git/linux-drm-fsl-dcu: drm/fsl-dcu: enable pixel clock when enabling CRTC drm/fsl-dcu: do not transfer registers in mode_set_nofb drm/fsl-dcu: do not transfer registers on plane init drm/fsl-dcu: enable TCON bypass mode by default
2016-10-20kexec: Export kexec_in_progress to modulesFlorian Fainelli1-0/+1
The bcm_sf2 driver uses kexec_in_progress to know whether it can power down an integrated PHY during shutdown, and can be built as a module. Other modules may be using this in the future, so export it. Fixes: 2399d6143f85 ("net: dsa: bcm_sf2: Prevent GPHY shutdown for kexec'd kernels") Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.