aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-09-22net/mlx4_core: Fix to clean devlink resourcesKamal Heib1-0/+3
This patch cleans devlink resources by calling devlink_port_unregister() to avoid the following issues: - Kernel panic when triggering reset flow. - Memory leak due to unfreed resources in mlx4_init_port_info(). Fixes: 09d4d087cd48 ("mlx4: Implement devlink interface") Signed-off-by: Kamal Heib <[email protected]> Signed-off-by: Tariq Toukan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-21Merge tag 'wireless-drivers-for-davem-2016-09-20' of ↵David S. Miller1-10/+9
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.8 iwlwifi * fix to prevent firmware crash when sending off-channel frames ==================== Signed-off-by: David S. Miller <[email protected]>
2016-09-21btrfs: ensure that file descriptor used with subvol ioctls is a dirJeff Mahoney1-0/+12
If the subvol/snapshot create/destroy ioctls are passed a regular file with execute permissions set, we'll eventually Oops while trying to do inode->i_op->lookup via lookup_one_len. This patch ensures that the file descriptor refers to a directory. Fixes: cb8e70901d (Btrfs: Fix subvolume creation locking rules) Fixes: 76dda93c6a (Btrfs: add snapshot/subvolume destroy ioctl) Cc: <[email protected]> #v2.6.29+ Signed-off-by: Jeff Mahoney <[email protected]> Signed-off-by: Chris Mason <[email protected]>
2016-09-21Btrfs: handle quota reserve failure properlyJosef Bacik1-6/+3
btrfs/022 was spitting a warning for the case that we exceed the quota. If we fail to make our quota reservation we need to clean up our data space reservation. Thanks, Signed-off-by: Josef Bacik <[email protected]> Tested-by: Jeff Mahoney <[email protected]> Signed-off-by: Chris Mason <[email protected]>
2016-09-21i2c: mux: pca954x: retry updating the mux selection on failurePeter Rosin1-1/+1
The cached value of the last selected channel prevents retries on the next call, even on failure to update the selected channel. Fix that. Signed-off-by: Peter Rosin <[email protected]> Signed-off-by: Wolfram Sang <[email protected]> Cc: [email protected]
2016-09-21i2c-eg20t: fix race between i2c init and interrupt enableYadi.hu1-7/+11
the eg20t driver call request_irq() function before the pch_base_address, base address of i2c controller's register, is assigned an effective value. there is one possible scenario that an interrupt which isn't inside eg20t arrives immediately after request_irq() is executed when i2c controller shares an interrupt number with others. since the interrupt handler pch_i2c_handler() has already active as shared action, it will be called and read its own register to determine if this interrupt is from itself. At that moment, since base address of i2c registers is not remapped in kernel space yet,so the INT handler will access an illegal address and then a error occurs. Signed-off-by: Yadi.hu <[email protected]> Signed-off-by: Wolfram Sang <[email protected]> Cc: [email protected]
2016-09-21MIPS: vDSO: Fix Malta EVA mapping to vDSO page structsJames Hogan1-4/+4
The page structures associated with the vDSO pages in the kernel image are calculated using virt_to_page(), which uses __pa() under the hood to find the pfn associated with the virtual address. The vDSO data pointers however point to kernel symbols, so __pa_symbol() should really be used instead. Since there is no equivalent to virt_to_page() which uses __pa_symbol(), fix init_vdso_image() to work directly with pfns, calculated with __phys_to_pfn(__pa_symbol(...)). This issue broke the Malta Enhanced Virtual Addressing (EVA) configuration which has a non-default implementation of __pa_symbol(). This is because it uses a physical alias so that the kernel executes from KSeg0 (VA 0x80000000 -> PA 0x00000000), while RAM is provided to the kernel in the KUSeg range (VA 0x00000000 -> PA 0x80000000) which uses the same underlying RAM. Since there are no page structures associated with the low physical address region, some arbitrary kernel memory would be interpreted as a page structure for the vDSO pages and badness ensues. Fixes: ebb5e78cc634 ("MIPS: Initial implementation of a VDSO") Signed-off-by: James Hogan <[email protected]> Cc: Leonid Yegoshin <[email protected]> Cc: [email protected] Cc: <[email protected]> # 4.4.x- Patchwork: https://patchwork.linux-mips.org/patch/14229/ Signed-off-by: Ralf Baechle <[email protected]>
2016-09-21drm/rockchip: Balance irq refcount on failureSean Paul1-1/+5
If create_crtc fails in vop bind, ensure the irq refcount is zeroed back out before exiting. Reviewed-by: Daniel Kurtz <[email protected]> Signed-off-by: Sean Paul <[email protected]>
2016-09-21drm/rockchip: Kill vop_plane_stateTomasz Figa1-79/+15
After changes introduced by last patches, there is no useful data stored in vop_plane_state struct. Let's remove it and make the driver use generic plane state alone. Signed-off-by: Tomasz Figa <[email protected]>
2016-09-21drm/rockchip: Always signal event in next vblank after cfg_doneTomasz Figa1-44/+10
This patch makes the driver send the pending vblank event in next vblank following the commit, relying on vblank signalling improvements done in previous patches. This gives us vblank events that always represent the real moment of changes hitting on the screen (which was the case only for complete FB changes before) and lets us remove the manual window update check. Signed-off-by: Tomasz Figa <[email protected]>
2016-09-21drm/rockchip: Do not enable vblank without eventTomasz Figa1-11/+4
Originally we needed to enable vblank for any atomic commit to kick the PSR machine, but that was changed and we no longer need to do so from a vblank interrupt. Let's return to original behavior of enabling vblank only if it is really necessary. This essentially reverts commit 5b6804034ae9 ("drm/rockchip: Enable vblank without event"). Signed-off-by: Tomasz Figa <[email protected]>
2016-09-21drm/rockchip: Replace custom wait_for_vblanks with helperTomasz Figa3-78/+1
Currently the driver uses a custom function to wait for flip to complete after an atomic commit. It was needed before because of two problems: - there is no hardware vblank counter, so the original helper would have a race condition with the vblank interrupt, - the driver didn't support unreferencing cursor framebuffers asynchronously to the commit, which was what the helper expected. Since both problems have been solved by previous patches, we can now make the driver use the generic helper and remove custom waiting code. Signed-off-by: Tomasz Figa <[email protected]>
2016-09-21drm/rockchip: Unreference framebuffers from flip workTomasz Figa1-0/+41
Currently the driver waits for vblank and then unreferences old framebuffers from atomic commit code path. This is however breaking the legacy cursor API, which requires the updates to be fully asynchronous. Instead of just adding a special case for cursor, we can have actually smaller amount of code to unreference any changed framebuffer from a flip work. Signed-off-by: Tomasz Figa <[email protected]>
2016-09-21drm/rockchip: Avoid race with vblank count incrementTomasz Figa1-0/+34
Since VOP does not have a hardware vblank count register, the ongoing commit might be racing with a requested vblank interrupt, which would increment the software vblank counter before the changes being committed actually happen. To avoid this, we can extend .atomic_flush(), so after it sets cfg_done bit, it polls the vblank interrupt bit until it's inactive to make sure that any old vblank interrupt gets to the handler and then uses synchronize_irq(vop->irq) to make sure the handler finishes running. The polling case should happen very rarely, but even if, the total wait time should be relatively low and in practice almost equal to the vop hardirq handler running time. Signed-off-by: Tomasz Figa <[email protected]>
2016-09-21drm/rockchip: Get rid of some unnecessary codeTomasz Figa1-18/+0
Current code implements prepare_fb and cleanup_fb callbacks only to grab/release fb references, which is already done by atomic framework when creating/destryoing plane state. Let's remove these unused bits. Signed-off-by: Tomasz Figa <[email protected]>
2016-09-21drm/rockchip: Clear interrupt status bits before enablingTomasz Figa1-0/+3
The enable register only masks the raw status bits to signal CPU interrupt only for enabled interrupts. The status bits are activated regardless of the enable register. This means that we might have an old interrupt event queued, which we are not interested in. To avoid getting a spurious interrupt signalled, we have to clear the old bit before we update the enable register. Signed-off-by: Tomasz Figa <[email protected]>
2016-09-21drm/rockchip: Fix up bug in psr state machineSean Paul1-3/+5
The ->set() callback would always be called when transitioning from FLUSH->DISABLE since we assign state to psr->state right above the skip condition. Reported-by: Daniel Kurtz <[email protected]> Reviewed-by: Daniel Kurtz <[email protected]> Signed-off-by: Sean Paul <[email protected]>
2016-09-21drm/bridge: analogix_dp: Remove duplicated codeTomeu Vizoso3-555/+210
Remove code for reading the EDID and DPCD fields and use the helpers instead. Besides the obvious code reduction, other helpers are being added to the core that could be used in this driver and will be good to be able to use them instead of duplicating them. Signed-off-by: Tomeu Vizoso <[email protected]> Tested-by: Javier Martinez Canillas <[email protected]> Tested-by: Sean Paul <[email protected]> Reviewed-by: Sean Paul <[email protected]> Reviewed-by: Yakir Yang <[email protected]> Signed-off-by: Sean Paul <[email protected]> Cc: Javier Martinez Canillas <[email protected]> Cc: Mika Kahola <[email protected]> Cc: Yakir Yang <[email protected]> Cc: Daniel Vetter <[email protected]> Cc: Archit Taneja <[email protected]>
2016-09-21drm/rockchip: Reduce psr flush time to 100msSean Paul1-1/+1
3 seconds is a bit too conservative, drop this to 100ms for better power savings. Reviewed-by: Yakir Yang <[email protected]> Signed-off-by: Sean Paul <[email protected]>
2016-09-21drm/rockchip: Don't key off vblank for psrSean Paul4-30/+62
Instead of keying off vblank for psr, just flush every time we get an atomic update. This ensures that cursor updates will properly disable psr (without turning vblank on/off), and unifies the paths between fb_dirty and atomic psr enable/disable. Reviewed-by: Yakir Yang <[email protected]> Signed-off-by: Sean Paul <[email protected]>
2016-09-21drm: Fix typo in encoder docsDhinakaran Pandiyan1-8/+9
Corrected typo in bridge and encoder comparison. Also, added a one-line encoder description from the previous documentation. Cc: Daniel Vetter <[email protected]> Cc: Archit Taneja <[email protected]> Signed-off-by: Dhinakaran Pandiyan <[email protected]> Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2016-09-21GPU-DRM: Replace a kzalloc() call by kcalloc() in drm_legacy_addbufs_sg()Markus Elfring1-2/+1
The script "checkpatch.pl" can point information out like the following. WARNING: Prefer kcalloc over kzalloc with multiply Thus fix the affected source code place. Signed-off-by: Markus Elfring <[email protected]> Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2016-09-21GPU-DRM: Replace a kzalloc() call by kcalloc() in drm_legacy_addbufs_agp()Markus Elfring1-1/+1
The script "checkpatch.pl" can point information out like the following. WARNING: Prefer kcalloc over kzalloc with multiply Thus fix the affected source code place. Signed-off-by: Markus Elfring <[email protected]> Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2016-09-21GPU-DRM: Replace two kzalloc() calls by kcalloc() in drm_legacy_addbufs_pci()Markus Elfring1-2/+2
The script "checkpatch.pl" can point information out like the following. WARNING: Prefer kcalloc over kzalloc with multiply Thus fix the affected source code places. Signed-off-by: Markus Elfring <[email protected]> Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2016-09-21GPU-DRM: Use kmalloc_array() in drm_legacy_addbufs_pci()Markus Elfring1-2/+3
A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kmalloc_array". This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <[email protected]> Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2016-09-21net: can: ifi: Configure transmitter delayMarek Vasut1-1/+10
Configure the transmitter delay register at +0x1c to correctly handle the CAN FD bitrate switch (BRS). This moves the SSP (secondary sample point) to a proper offset, so that the TDC mechanism works and won't generate error frames on the CAN link. Signed-off-by: Marek Vasut <[email protected]> Cc: Marc Kleine-Budde <[email protected]> Cc: Mark Rutland <[email protected]> Cc: Oliver Hartkopp <[email protected]> Cc: Wolfgang Grandegger <[email protected]> Cc: linux-stable <[email protected]> Signed-off-by: Marc Kleine-Budde <[email protected]>
2016-09-21vti6: fix input pathNicolas Dichtel4-10/+16
Since commit 1625f4529957, vti6 is broken, all input packets are dropped (LINUX_MIB_XFRMINNOSTATES is incremented). XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 is set by vti6_rcv() before calling xfrm6_rcv()/xfrm6_rcv_spi(), thus we cannot set to NULL that value in xfrm6_rcv_spi(). A new function xfrm6_rcv_tnl() that enables to pass a value to xfrm6_rcv_spi() is added, so that xfrm6_rcv() is not touched (this function is used in several handlers). CC: Alexey Kodanev <[email protected]> Fixes: 1625f4529957 ("net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key") Signed-off-by: Nicolas Dichtel <[email protected]> Signed-off-by: Steffen Klassert <[email protected]>
2016-09-21drm/msm: bump kernel api version for explicit fencingRob Clark1-1/+2
Signed-off-by: Rob Clark <[email protected]>
2016-09-21ipmr, ip6mr: return lastuse relative to nowNikolay Aleksandrov2-4/+10
When I introduced the lastuse member I made a subtle error because it was returned as an absolute value but that is meaningless to user-space as it doesn't allow to see how old exactly an entry is. Let's make it similar to how the bridge returns such values and make it relative to "now" (jiffies). This allows us to show the actual age of the entries and is much more useful (e.g. user-space daemons can age out entries, iproute2 can display the lastuse properly). Fixes: 43b9e1274060 ("net: ipmr/ip6mr: add support for keeping an entry age") Reported-by: Satish Ashok <[email protected]> Signed-off-by: Nikolay Aleksandrov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-21Merge branch 'r8152-phy-fixes'David S. Miller1-135/+146
Hayes Wang says: ==================== r8152: correct the flow of PHY First, to enable the PHY as early as possible. Some settings may fail if the PHY is power down. Move the other PHY settings to hw_phy_cfg() to make sure the order is correct. Finally, disable ALDPS and EEE before updating the PHY for RTL8153. ==================== Signed-off-by: David S. Miller <[email protected]>
2016-09-21r8152: disable ALDPS and EEE before setting PHYhayeswang1-2/+8
Disable ALDPS and EEE to avoid the possible failure when setting the PHY. Signed-off-by: Hayes Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-21r8152: remove r8153_enable_eeehayeswang1-7/+3
Remove r8153_enable_eee(). Signed-off-by: Hayes Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-21r8152: move PHY settings to hw_phy_cfghayeswang1-6/+8
Move the PHY relative settings together to hw_phy_cfg(). Signed-off-by: Hayes Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-21r8152: move enabling PHYhayeswang1-18/+25
Move enabling PHY to init(), otherwise some other settings may fail. Signed-off-by: Hayes Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-21r8152: move some functionshayeswang1-112/+112
Move the following functions forward. r8152_mmd_indirect() r8152_mmd_read() r8152_mmd_write() r8152_eee_en() r8152b_enable_eee() r8153_eee_en() r8153_enable_eee() r8152b_enable_fc() r8153_aldps_en() Signed-off-by: Hayes Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-21cxgb4/cxgb4vf: Allocate more queues for 25G and 100G adapterHariprasad Shenai6-11/+45
We were missing check for 25G and 100G while checking port speed, which lead to less number of queues getting allocated for 25G & 100G adapters and leading to low throughput. Adding the missing check for both NIC and vNIC driver. Also fixes port advertisement for 25G and 100G in ethtool output. Signed-off-by: Hariprasad Shenai <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-21powerpc/powernv/pci: Fix m64 checks for SR-IOV and window alignmentRussell Currey1-2/+9
Commit 5958d19a143e checks for prefetchable m64 BARs by comparing the addresses instead of using resource flags. This broke SR-IOV as the m64 check in pnv_pci_ioda_fixup_iov_resources() fails. The condition in pnv_pci_window_alignment() also changed to checking only IORESOURCE_MEM_64 instead of both IORESOURCE_MEM_64 and IORESOURCE_PREFETCH. Revert these cases to the previous behaviour, adding a new helper function to do so. This is named pnv_pci_is_m64_flags() to make it clear this function is only looking at resource flags and should not be relied on for non-SRIOV resources. Fixes: 5958d19a143e ("Fix incorrect PE reservation attempt on some 64-bit BARs") Reported-by: Alexey Kardashevskiy <[email protected]> Signed-off-by: Russell Currey <[email protected]> Tested-by: Alexey Kardashevskiy <[email protected]> Signed-off-by: Michael Ellerman <[email protected]>
2016-09-20Merge tag 'linux-can-fixes-for-4.8-20160919' of ↵David S. Miller1-5/+8
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2016-09-19 this is a pull request of one patch for the upcoming linux-4.8 release. The patch by Fabio Estevam fixes the pm handling in the flexcan driver. ==================== Signed-off-by: David S. Miller <[email protected]>
2016-09-20Merge tag 'usercopy-v4.8-rc8' of ↵Linus Torvalds1-1/+4
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull usercopy hardening fix from Kees Cook: "Expand the arm64 vmalloc check to include skipping the module space too" * tag 'usercopy-v4.8-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: mm: usercopy: Check for module addresses
2016-09-20fix fault_in_multipages_...() on architectures with no-op access_ok()Al Viro1-19/+19
Switching iov_iter fault-in to multipages variants has exposed an old bug in underlying fault_in_multipages_...(); they break if the range passed to them wraps around. Normally access_ok() done by callers will prevent such (and it's a guaranteed EFAULT - ERR_PTR() values fall into such a range and they should not point to any valid objects). However, on architectures where userland and kernel live in different MMU contexts (e.g. s390) access_ok() is a no-op and on those a range with a wraparound can reach fault_in_multipages_...(). Since any wraparound means EFAULT there, the fix is trivial - turn those while (uaddr <= end) ... into if (unlikely(uaddr > end)) return -EFAULT; do ... while (uaddr <= end); Reported-by: Jan Stancek <[email protected]> Tested-by: Jan Stancek <[email protected]> Cc: [email protected] # v3.5+ Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-20mm: usercopy: Check for module addressesLaura Abbott1-1/+4
While running a compile on arm64, I hit a memory exposure usercopy: kernel memory exposure attempt detected from fffffc0000f3b1a8 (buffer_head) (1 bytes) ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:75! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_broute bridge stp llc ebtable_nat ip6table_security ip6table_raw ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle iptable_security iptable_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle ebtable_filter ebtables ip6table_filter ip6_tables vfat fat xgene_edac xgene_enet edac_core i2c_xgene_slimpro i2c_core at803x realtek xgene_dma mdio_xgene gpio_dwapb gpio_xgene_sb xgene_rng mailbox_xgene_slimpro nfsd auth_rpcgss nfs_acl lockd grace sunrpc xfs libcrc32c sdhci_of_arasan sdhci_pltfm sdhci mmc_core xhci_plat_hcd gpio_keys CPU: 0 PID: 19744 Comm: updatedb Tainted: G W 4.8.0-rc3-threadinfo+ #1 Hardware name: AppliedMicro X-Gene Mustang Board/X-Gene Mustang Board, BIOS 3.06.12 Aug 12 2016 task: fffffe03df944c00 task.stack: fffffe00d128c000 PC is at __check_object_size+0x70/0x3f0 LR is at __check_object_size+0x70/0x3f0 ... [<fffffc00082b4280>] __check_object_size+0x70/0x3f0 [<fffffc00082cdc30>] filldir64+0x158/0x1a0 [<fffffc0000f327e8>] __fat_readdir+0x4a0/0x558 [fat] [<fffffc0000f328d4>] fat_readdir+0x34/0x40 [fat] [<fffffc00082cd8f8>] iterate_dir+0x190/0x1e0 [<fffffc00082cde58>] SyS_getdents64+0x88/0x120 [<fffffc0008082c70>] el0_svc_naked+0x24/0x28 fffffc0000f3b1a8 is a module address. Modules may have compiled in strings which could get copied to userspace. In this instance, it looks like "." which matches with a size of 1 byte. Extend the is_vmalloc_addr check to be is_vmalloc_or_module_addr to cover all possible cases. Signed-off-by: Laura Abbott <[email protected]> Signed-off-by: Kees Cook <[email protected]>
2016-09-20irqchip/mips-gic: Fix local interruptsPaul Burton1-55/+50
Since the device hierarchy domain was added by commit c98c1822ee13 ("irqchip/mips-gic: Add device hierarchy domain"), GIC local interrupts have been broken. Users attempting to setup a per-cpu local IRQ, for example the GIC timer clock events code in drivers/clocksource/mips-gic-timer.c, the setup_percpu_irq function would refuse with -EINVAL because the GIC irqchip driver never called irq_set_percpu_devid so the IRQ_PER_CPU_DEVID flag was never set for the IRQ. This happens because irq_set_percpu_devid was being called from the gic_irq_domain_map function which is no longer called. Doing only that runs into further problems because gic_dev_domain_alloc set the struct irq_chip for all interrupts, local or shared, to gic_level_irq_controller despite that only being suitable for shared interrupts. The typical outcome of this is that gic_level_irq_controller callback functions are called for local interrupts, and then hwirq number calculations overflow & the driver ends up attempting to access some invalid register with an address calculated from an invalid hwirq number. Best case scenario is that this then leads to a bus error. This is fixed by abstracting the setup of the hwirq & chip to a new function gic_setup_dev_chip which is used by both the root GIC IRQ domain & the device domain. Finally, decoding local interrupts failed because gic_dev_domain_alloc only called irq_domain_alloc_irqs_parent for shared interrupts. Local ones were therefore never associated with hwirqs in the root GIC IRQ domain and the virq in gic_handle_local_int would always be 0. This is fixed by calling irq_domain_alloc_irqs_parent unconditionally & having gic_irq_domain_alloc handle both local & shared interrupts, which is easy due to the aforementioned abstraction of chip setup into gic_setup_dev_chip. This fixes use of the MIPS GIC timer for clock events, which has been broken since c98c1822ee13 ("irqchip/mips-gic: Add device hierarchy domain") but hadn't been noticed due to a silent fallback to the MIPS coprocessor 0 count/compare clock events device. Fixes: c98c1822ee13 ("irqchip/mips-gic: Add device hierarchy domain") Signed-off-by: Paul Burton <[email protected]> Cc: [email protected] Cc: Jason Cooper <[email protected]> Cc: Qais Yousef <[email protected]> Cc: [email protected] Cc: Marc Zyngier <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]>
2016-09-20fs/proc/kcore.c: Add bounce buffer for ktext dataJiri Olsa1-1/+6
We hit hardened usercopy feature check for kernel text access by reading kcore file: usercopy: kernel memory exposure attempt detected from ffffffff8179a01f (<kernel text>) (4065 bytes) kernel BUG at mm/usercopy.c:75! Bypassing this check for kcore by adding bounce buffer for ktext data. Reported-by: Steve Best <[email protected]> Fixes: f5509cc18daa ("mm: Hardened usercopy") Suggested-by: Kees Cook <[email protected]> Signed-off-by: Jiri Olsa <[email protected]> Acked-by: Kees Cook <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-20fs/proc/kcore.c: Make bounce buffer global for readJiri Olsa1-10/+14
Next patch adds bounce buffer for ktext area, so it's convenient to have single bounce buffer for both vmalloc/module and ktext cases. Suggested-by: Linus Torvalds <[email protected]> Signed-off-by: Jiri Olsa <[email protected]> Acked-by: Kees Cook <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-21Merge branch 'for-next' of http://git.agner.ch/git/linux-drm-fsl-dcu into ↵Dave Airlie2-6/+11
drm-next fsl-dcu fixes. * 'for-next' of http://git.agner.ch/git/linux-drm-fsl-dcu: drm/fsl-dcu: disable clock on error path drm/fsl-dcu: use PTR_ERR_OR_ZERO() to simplify the code drm/fsl-dcu: fix endian issue when using clk_register_divider
2016-09-20Merge tag 'efi-urgent' of ↵Ingo Molnar2-11/+12
git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into efi/urgent Pull EFI fixes from Matt Fleming: * Fix a boot hang on large memory machines (multiple terabyte) caused by type conversion errors in the x86 PAT code (Matt Fleming) Signed-off-by: Ingo Molnar <[email protected]>
2016-09-20perf/x86/intel/bts: Make sure debug store is validSebastian Andrzej Siewior1-1/+1
Since commit 4d4c47412464 ("perf/x86/intel/bts: Fix BTS PMI detection") my box goes boom on boot: | .... node #0, CPUs: #1 #2 #3 #4 #5 #6 #7 | BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 | IP: [<ffffffff8100c463>] intel_bts_interrupt+0x43/0x130 | Call Trace: | <NMI> d [<ffffffff8100b341>] intel_pmu_handle_irq+0x51/0x4b0 | [<ffffffff81004d47>] perf_event_nmi_handler+0x27/0x40 This happens because the code introduced in this commit dereferences the debug store pointer unconditionally. The debug store is not guaranteed to be available, so a NULL pointer check as on other places is required. Fixes: 4d4c47412464 ("perf/x86/intel/bts: Fix BTS PMI detection") Signed-off-by: Sebastian Andrzej Siewior <[email protected]> Reviewed-by: Alexander Shishkin <[email protected]> Cc: Arnaldo Carvalho de Melo <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: [email protected] Cc: [email protected] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]>
2016-09-20x86/efi: Only map RAM into EFI page tables if in mixed-modeMatt Fleming1-1/+1
Waiman reported that booting with CONFIG_EFI_MIXED enabled on his multi-terabyte HP machine results in boot crashes, because the EFI region mapping functions loop forever while trying to map those regions describing RAM. While this patch doesn't fix the underlying hang, there's really no reason to map EFI_CONVENTIONAL_MEMORY regions into the EFI page tables when mixed-mode is not in use at runtime. Reported-by: Waiman Long <[email protected]> Cc: Ard Biesheuvel <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Linus Torvalds <[email protected]> CC: Theodore Ts'o <[email protected]> Cc: Arnd Bergmann <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: Scott J Norton <[email protected]> Cc: Douglas Hatch <[email protected]> Cc: <[email protected]> # v4.6+ Signed-off-by: Matt Fleming <[email protected]>
2016-09-20x86/mm/pat: Prevent hang during boot when mapping pagesMatt Fleming1-10/+11
There's a mixture of signed 32-bit and unsigned 32-bit and 64-bit data types used for keeping track of how many pages have been mapped. This leads to hangs during boot when mapping large numbers of pages (multiple terabytes, as reported by Waiman) because those values are interpreted as being negative. commit 742563777e8d ("x86/mm/pat: Avoid truncation when converting cpa->numpages to address") fixed one of those bugs, but there is another lurking in __change_page_attr_set_clr(). Additionally, the return value type for the populate_*() functions can return negative values when a large number of pages have been mapped, triggering the error paths even though no error occurred. Consistently use 64-bit types on 64-bit platforms when counting pages. Even in the signed case this gives us room for regions 8PiB (pebibytes) in size whilst still allowing the usual negative value error checking idiom. Reported-by: Waiman Long <[email protected]> Cc: Ard Biesheuvel <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Linus Torvalds <[email protected]> CC: Theodore Ts'o <[email protected]> Cc: Arnd Bergmann <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: Scott J Norton <[email protected]> Cc: Douglas Hatch <[email protected]> Signed-off-by: Matt Fleming <[email protected]>
2016-09-20drm/sti: remove stih415-416 platform supportVincent Abriou9-480/+14
stih415 and stih416 platform are obsolete and no more supported. Only stih407 and stih410 platform are maintained. Signed-off-by: Vincent Abriou <[email protected]> Acked-by: Benjamin Gaignard <[email protected]> Acked-by: Peter Griffin <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.