aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-07-25parport: Revert "parport: fix memory leak"Sudip Mukherjee1-1/+0
This reverts commit 23c405912b88 ("parport: fix memory leak") par_dev->state was already being removed in parport_unregister_device(). Reported-by: Ying Huang <[email protected]> Signed-off-by: Sudip Mukherjee <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-25Merge tag 'trace-v4.2-rc2-fix3' of ↵Linus Torvalds2-18/+37
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull ftrace fix from Steven Rostedt: "Back in 3.16 the ftrace code was redesigned and cleaned up to remove the double iteration list (one for registered ftrace ops, and one for registered "global" ops), to just use one list. That simplified the code but also broke the function tracing filtering on pid. This updates the code to handle the filtering again with the new logic" * tag 'trace-v4.2-rc2-fix3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: ftrace: Fix breakage of set_ftrace_pid
2015-07-25Merge branch 'libnvdimm-fixes' of ↵Linus Torvalds1-0/+5
git://git.kernel.org/pub/scm/linux/kernel/git/djbw/nvdimm Pull libnvdimm fix from Dan Williams: "A minor fix for the libnvdimm subsystem. This is not critical. The problem can be worked around in userspace by putting the namespace temporarily into raw mode (ndctl_namespace_set_raw_mode() from libndctl), but that is awkward for management utilities. * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/nvdimm: libnvdimm: fix namespace seed creation
2015-07-25Merge tag 'md/4.2-fixes' of git://neil.brown.name/mdLinus Torvalds8-27/+71
Pull md fixes from Neil Brown: "Some md fixes for 4.2 Several are tagged for -stable. A few aren't because they are not very, serious or because they are in the 'experimental' cluster code" * tag 'md/4.2-fixes' of git://neil.brown.name/md: md/raid5: clear R5_NeedReplace when no longer needed. Fix read-balancing during node failure md-cluster: fix bitmap sub-offset in bitmap_read_sb md: Return error if request_module fails and returns positive value md: Skip cluster setup in case of error while reading bitmap md/raid1: fix test for 'was read error from last working device'. md: Skip cluster setup for dm-raid md: flush ->event_work before stopping array. md/raid10: always set reshape_safe when initializing reshape_position. md/raid5: avoid races when changing cache size.
2015-07-25Merge tag 'for-linus-20150724' of git://git.infradead.org/linux-mtdLinus Torvalds2-5/+11
Pull MTD fixes from Brian Norris: "Two trivial updates. I meant to send these much earlier, but I've been preoccupied. - Add MAINTAINERS entry for diskonchip g3 driver - Fix an overlooked conflict in bitfield value assignments The latter update is a bit overdue, but there's no reason to wait any longer" * tag 'for-linus-20150724' of git://git.infradead.org/linux-mtd: mtd: nand: Fix NAND_USE_BOUNCE_BUFFER flag conflict MAINTAINERS: mtd: docg3: add docg3 maintainer
2015-07-25libnvdimm: fix namespace seed creationDan Williams1-0/+5
A new BLK namespace "seed" device is created whenever the current seed is successfully probed. However, if that namespace is assigned to a BTT it may never directly experience a successful probe as it is a subordinate device to a BTT configuration. The effect of the current code is that no new namespaces can be instantiated, after the seed namespace, to consume available BLK DPA capacity. Fix this by treating a successful BTT probe event as a successful probe event for the backing namespace. Reported-by: Nicholas Moulin <[email protected]> Signed-off-by: Dan Williams <[email protected]>
2015-07-25f2fs: call set_page_dirty to attach i_wb for cgroupJaegeuk Kim5-6/+13
The cgroup attaches inode->i_wb via mark_inode_dirty and when set_page_writeback is called, __inc_wb_stat() updates i_wb's stat. So, we need to explicitly call set_page_dirty->__mark_inode_dirty in prior to any writebacking pages. This patch should resolve the following kernel panic reported by Andreas Reis. https://bugzilla.kernel.org/show_bug.cgi?id=101801 --- Comment #2 from Andreas Reis <[email protected]> --- BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 IP: [<ffffffff8149deea>] __percpu_counter_add+0x1a/0x90 PGD 2951ff067 PUD 2df43f067 PMD 0 Oops: 0000 [#1] PREEMPT SMP Modules linked in: CPU: 7 PID: 10356 Comm: gcc Tainted: G W 4.2.0-1-cu #1 Hardware name: Gigabyte Technology Co., Ltd. G1.Sniper M5/G1.Sniper M5, BIOS T01 02/03/2015 task: ffff880295044f80 ti: ffff880295140000 task.ti: ffff880295140000 RIP: 0010:[<ffffffff8149deea>] [<ffffffff8149deea>] __percpu_counter_add+0x1a/0x90 RSP: 0018:ffff880295143ac8 EFLAGS: 00010082 RAX: 0000000000000003 RBX: ffffea000a526d40 RCX: 0000000000000001 RDX: 0000000000000020 RSI: 0000000000000001 RDI: 0000000000000088 RBP: ffff880295143ae8 R08: 0000000000000000 R09: ffff88008f69bb30 R10: 00000000fffffffa R11: 0000000000000000 R12: 0000000000000088 R13: 0000000000000001 R14: ffff88041d099000 R15: ffff880084a205d0 FS: 00007f8549374700(0000) GS:ffff88042f3c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000a8 CR3: 000000033e1d5000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: 0000000000000000 ffffea000a526d40 ffff880084a20738 ffff880084a20750 ffff880295143b48 ffffffff811cc91e ffff880000000000 0000000000000296 0000000000000000 ffff880417090198 0000000000000000 ffffea000a526d40 Call Trace: [<ffffffff811cc91e>] __test_set_page_writeback+0xde/0x1d0 [<ffffffff813fee87>] do_write_data_page+0xe7/0x3a0 [<ffffffff813faeea>] gc_data_segment+0x5aa/0x640 [<ffffffff813fb0b8>] do_garbage_collect+0x138/0x150 [<ffffffff813fb3fe>] f2fs_gc+0x1be/0x3e0 [<ffffffff81405541>] f2fs_balance_fs+0x81/0x90 [<ffffffff813ee357>] f2fs_unlink+0x47/0x1d0 [<ffffffff81239329>] vfs_unlink+0x109/0x1b0 [<ffffffff8123e3d7>] do_unlinkat+0x287/0x2c0 [<ffffffff8123ebc6>] SyS_unlink+0x16/0x20 [<ffffffff81942e2e>] entry_SYSCALL_64_fastpath+0x12/0x71 Code: 41 5e 5d c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 55 49 89 f5 41 54 49 89 fc 53 48 83 ec 08 65 ff 05 e6 d9 b6 7e <48> 8b 47 20 48 63 ca 65 8b 18 48 63 db 48 01 f3 48 39 cb 7d 0a RIP [<ffffffff8149deea>] __percpu_counter_add+0x1a/0x90 RSP <ffff880295143ac8> CR2: 00000000000000a8 ---[ end trace 5132449a58ed93a3 ]--- note: gcc[10356] exited with preempt_count 2 Signed-off-by: Jaegeuk Kim <[email protected]>
2015-07-25f2fs: handle error cases in move_encrypted_blockJaegeuk Kim1-8/+15
This patch fixes some missing error handlers. Reviewed-by: Chao Yu <[email protected]> Signed-off-by: Jaegeuk Kim <[email protected]>
2015-07-25Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nfDavid S. Miller13-79/+164
Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains ten Netfilter/IPVS fixes, they are: 1) Address refcount leak when creating an expectation from the ctnetlink interface. 2) Fix bug splat in the IDLETIMER target related to sysfs, from Dmitry Torokhov. 3) Resolve panic for unreachable route in IPVS with locally generated traffic in the output path, from Alex Gartrell. 4) Fix wrong source address in rare cases for tunneled traffic in IPVS, from Julian Anastasov. 5) Fix crash if scheduler is changed via ipvsadm -E, again from Julian. 6) Make sure skb->sk is unset for forwarded traffic through IPVS, again from Alex Gartrell. 7) Fix crash with IPVS sync protocol v0 and FTP, from Julian. 8) Reset sender cpu for forwarded traffic in IPVS, also from Julian. 9) Allocate template conntracks through kmalloc() to resolve netns dependency problems with the conntrack kmem_cache. 10) Fix zones with expectations that clash using the same tuple, from Joe Stringer. ==================== Signed-off-by: David S. Miller <[email protected]>
2015-07-25cgroup: net_cls: fix false-positive "suspicious RCU usage"Konstantin Khlebnikov1-1/+2
In dev_queue_xmit() net_cls protected with rcu-bh. [ 270.730026] =============================== [ 270.730029] [ INFO: suspicious RCU usage. ] [ 270.730033] 4.2.0-rc3+ #2 Not tainted [ 270.730036] ------------------------------- [ 270.730040] include/linux/cgroup.h:353 suspicious rcu_dereference_check() usage! [ 270.730041] other info that might help us debug this: [ 270.730043] rcu_scheduler_active = 1, debug_locks = 1 [ 270.730045] 2 locks held by dhclient/748: [ 270.730046] #0: (rcu_read_lock_bh){......}, at: [<ffffffff81682b70>] __dev_queue_xmit+0x50/0x960 [ 270.730085] #1: (&qdisc_tx_lock){+.....}, at: [<ffffffff81682d60>] __dev_queue_xmit+0x240/0x960 [ 270.730090] stack backtrace: [ 270.730096] CPU: 0 PID: 748 Comm: dhclient Not tainted 4.2.0-rc3+ #2 [ 270.730098] Hardware name: OpenStack Foundation OpenStack Nova, BIOS Bochs 01/01/2011 [ 270.730100] 0000000000000001 ffff8800bafeba58 ffffffff817ad487 0000000000000007 [ 270.730103] ffff880232a0a780 ffff8800bafeba88 ffffffff810ca4f2 ffff88022fb23e00 [ 270.730105] ffff880232a0a780 ffff8800bafebb68 ffff8800bafebb68 ffff8800bafebaa8 [ 270.730108] Call Trace: [ 270.730121] [<ffffffff817ad487>] dump_stack+0x4c/0x65 [ 270.730148] [<ffffffff810ca4f2>] lockdep_rcu_suspicious+0xe2/0x120 [ 270.730153] [<ffffffff816a62d2>] task_cls_state+0x92/0xa0 [ 270.730158] [<ffffffffa00b534f>] cls_cgroup_classify+0x4f/0x120 [cls_cgroup] [ 270.730164] [<ffffffff816aac74>] tc_classify_compat+0x74/0xc0 [ 270.730166] [<ffffffff816ab573>] tc_classify+0x33/0x90 [ 270.730170] [<ffffffffa00bcb0a>] htb_enqueue+0xaa/0x4a0 [sch_htb] [ 270.730172] [<ffffffff81682e26>] __dev_queue_xmit+0x306/0x960 [ 270.730174] [<ffffffff81682b70>] ? __dev_queue_xmit+0x50/0x960 [ 270.730176] [<ffffffff816834a3>] dev_queue_xmit_sk+0x13/0x20 [ 270.730185] [<ffffffff81787770>] dev_queue_xmit+0x10/0x20 [ 270.730187] [<ffffffff8178b91c>] packet_snd.isra.62+0x54c/0x760 [ 270.730190] [<ffffffff8178be25>] packet_sendmsg+0x2f5/0x3f0 [ 270.730203] [<ffffffff81665245>] ? sock_def_readable+0x5/0x190 [ 270.730210] [<ffffffff817b64bb>] ? _raw_spin_unlock+0x2b/0x40 [ 270.730216] [<ffffffff8173bcbc>] ? unix_dgram_sendmsg+0x5cc/0x640 [ 270.730219] [<ffffffff8165f367>] sock_sendmsg+0x47/0x50 [ 270.730221] [<ffffffff8165f42f>] sock_write_iter+0x7f/0xd0 [ 270.730232] [<ffffffff811fd4c7>] __vfs_write+0xa7/0xf0 [ 270.730234] [<ffffffff811fe5b8>] vfs_write+0xb8/0x190 [ 270.730236] [<ffffffff811fe8c2>] SyS_write+0x52/0xb0 [ 270.730239] [<ffffffff817b6bae>] entry_SYSCALL_64_fastpath+0x12/0x76 Signed-off-by: Konstantin Khlebnikov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-07-25ALSA: hda - Fix the headset mic that will not work on Dell desktop machineWoodrow Shen1-0/+22
When the headset was plugged in the Dell desktop, the mic of headset can't be detected and workable. According to the alsa-info, we found the differece between alsa and init_pin_configs on the machine, so we need to add the pin configs to make headset work. Codec: Realtek ALC3234 Vendor Id: 0x10ec0255 Subsystem Id: 0x102806bb BugLink: https://bugs.launchpad.net/bugs/1477900 Signed-off-by: Woodrow Shen <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-07-25ALSA: hda - fix cs4210_spdif_automute()Dan Carpenter1-3/+1
Smatch complains that we have nested checks for "spdif_present". It turns out the current behavior isn't correct, we should remove the first check and keep the second. Fixes: 1077a024812d ('ALSA: hda - Use generic parser for Cirrus codec driver') Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-07-24sch_choke: drop all packets in queue during resetWANG Cong1-0/+13
Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-07-24sch_plug: purge buffered packets during resetWANG Cong1-0/+1
Otherwise the skbuff related structures are not correctly refcount'ed. Cc: Jamal Hadi Salim <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-07-24Merge branch 'fib_select_default-fixes'David S. Miller5-15/+35
Julian Anastasov says: ==================== ipv4: fib_select_default changes This patchset contains 2 changes for the alternative routes, one to add tb_id/fa_slen check needed after the recent fib_trie optimizations for fib aliases and the second change attempts to support alternative routes with TOS requirement. Sorry that I don't have access to the original report from Hagen Paul Pfeifer. I hope he will see this change. The second change adds fa_default field to the fib aliases (which can be many) and if the feature to filter the alternative routes by TOS is not worth it, this second patch can be scrapped. ==================== Signed-off-by: David S. Miller <[email protected]>
2015-07-24ipv4: consider TOS in fib_select_defaultJulian Anastasov5-15/+30
fib_select_default considers alternative routes only when res->fi is for the first alias in res->fa_head. In the common case this can happen only when the initial lookup matches the first alias with highest TOS value. This prevents the alternative routes to require specific TOS. This patch solves the problem as follows: - routes that require specific TOS should be returned by fib_select_default only when TOS matches, as already done in fib_table_lookup. This rule implies that depending on the TOS we can have many different lists of alternative gateways and we have to keep the last used gateway (fa_default) in first alias for the TOS instead of using single tb_default value. - as the aliases are ordered by many keys (TOS desc, fib_priority asc), we restrict the possible results to routes with matching TOS and lowest metric (fib_priority) and routes that match any TOS, again with lowest metric. For example, packet with TOS 8 can not use gw3 (not lowest metric), gw4 (different TOS) and gw6 (not lowest metric), all other gateways can be used: tos 8 via gw1 metric 2 <--- res->fa_head and res->fi tos 8 via gw2 metric 2 tos 8 via gw3 metric 3 tos 4 via gw4 tos 0 via gw5 tos 0 via gw6 metric 1 Reported-by: Hagen Paul Pfeifer <[email protected]> Signed-off-by: Julian Anastasov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-07-24ipv4: fib_select_default should match the prefixJulian Anastasov1-0/+5
fib_trie starting from 4.1 can link fib aliases from different prefixes in same list. Make sure the alternative gateways are in same table and for same prefix (0) by checking tb_id and fa_slen. Fixes: 79e5ad2ceb00 ("fib_trie: Remove leaf_info") Signed-off-by: Julian Anastasov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-07-25ARM: dts: i.MX35: Fix can support.Denis Carikli1-4/+4
Since commit 3d42a379b6fa5b46058e3302b1802b29f64865bb ("can: flexcan: add 2nd clock to support imx53 and newer") the can driver requires a dt nodes to have a second clock. Add them to imx35 to fix probing the flex can driver on the respective platforms. Signed-off-by: Denis Carikli <[email protected]> Cc: <[email protected]> Signed-off-by: Shawn Guo <[email protected]>
2015-07-24Documentation/target: Fix tcm_mod_builder.py build breakageSebastian Herbszt1-7/+14
Fix build breakage and set the protocol identifier based on the parameter. Fixes: 9ac8928e6a3e ("target: simplify the target template registration API") Fixes: e4aae5af810e ("target: change core_tpg_register prototype") Signed-off-by: Sebastian Herbszt <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds4-13/+29
Pull block fixes from Jens Axboe: "Four smaller fixes for the current series. This contains: - A fix for clones of discard bio's, that can cause data corruption. From Martin. - A fix for null_blk, where in certain queue modes it could access a request after it had been freed. From Mike Krinkin. - An error handling leak fix for blkcg, from Tejun. - Also from Tejun, export of the functions that a file system needs to implement cgroup writeback support" * 'for-linus' of git://git.kernel.dk/linux-block: block: Do a full clone when splitting discard bios block: export bio_associate_*() and wbc_account_io() blkcg: fix gendisk reference leak in blkg_conf_prep() null_blk: fix use-after-free problem
2015-07-24Merge branch 'for-4.2-fixes' of ↵Linus Torvalds6-4/+32
git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata Pull libata fixes from Tejun Heo: "A couple important fixes. - A block layer change which removed restriction on max transfer size led to silent data corruption on some devices. A new quirk is added to restore the old size limit for the reported device. If it gets reported on more devices, we might have to consider restoring the restriction for ATA devices by default. - There finally is a SSD which is confirmed to cause data corruption on TRIM regardless of which flavor is used. A new quirk is added and the device is blacklisted - Other device-specific workarounds" * 'for-4.2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: libata: Do not blacklist M510DC libata: increase the timeout when setting transfer mode libata: add ATA_HORKAGE_MAX_SEC_1024 to revert back to previous max_sectors limit libata: force disable trim for SuperSSpeed S238 libata: add ATA_HORKAGE_NOTRIM libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER ata: pmp: add quirk for Marvell 4140 SATA PMP
2015-07-24Merge tag 'mmc-4.2-rc3' of git://git.linaro.org/people/ulf.hansson/mmcLinus Torvalds42-187/+202
Pull MMC fixes from Ulf Hansson: "Here are some mmc fixes intended for v4.2 rc4. Note, most of the changes are for the sdhci-esdhc-imx controller, which also required us to modify some related DTS files. Those changes have been acked by the SoC maintainer. MMC core: - Fix a reference inbalance issue for power_ro_lock_show() sysfs handler MMC host: - omap_hsmmc: Fix IRQ errorhandling for CD, DTO, and CRC - sdhci: Prevent a kernel panic while using DMA - mtk-sd: Let it depend on HAS_DMA to prevent build errors - sdhci-esdhc: Make 8BIT bus work - sdhci-esdhc-imx: Fix some regressions for DT based platforms - sdhci-pxav3: Fix a regression for DT based platforms" * tag 'mmc-4.2-rc3' of git://git.linaro.org/people/ulf.hansson/mmc: mmc: sdhci-pxav3: fix platform_data is not initialized dts: mmc: fsl-imx-esdhc: remove fsl,cd-controller support mmc: sdhci-esdhc-imx: clear f_max in boarddata mmc: sdhci-esdhc-imx: remove duplicated dts parsing mmc: sdhci: make max-frequency property in device tree work mmc: sdhci-esdhc-imx: move all non dt probe code into one function mmc: sdhci-esdhc-imx: fix cd regression for dt platform dts: imx7: fix sd card gpio polarity specified in device tree dts: imx25: fix sd card gpio polarity specified in device tree dts: imx6: fix sd card gpio polarity specified in device tree dts: imx53: fix sd card gpio polarity specified in device tree dts: imx51: fix sd card gpio polarity specified in device tree mmc: sdhci-esdhc: Make 8BIT bus work mmc: block: Add missing mmc_blk_put() in power_ro_lock_show() mmc: MMC_MTK should depend on HAS_DMA mmc: sdhci check parameters before call dma_free_coherent mmc: omap_hsmmc: Handle BADA, DEB and CEB interrupts mmc: omap_hsmmc: Fix DTO and DCRC handling
2015-07-24Merge branch 'for-linus' of ↵Linus Torvalds5-8/+62
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: "A fix for the warnings/oops when handling HID devices with "unnamed" LEDs and couple of other driver fixups"" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: goodix - fix touch coordinates on WinBook TW100 and TW700 Input: LEDs - skip unnamed LEDs Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen Input: elantech - force resolution of 31 u/mm Input: zforce - don't overwrite the stack
2015-07-24iser-target: Fix REJECT CM event use-after-free OOPsNicholas Bellinger1-5/+11
This patch fixes a bug in iser-target code where the REJECT CM event handler code currently performs a isert_put_conn() for the final isert_conn->kref put, while iscsi_np process context is still blocked in isert_get_login_rx(). Once isert_get_login_rx() is awoking due to login timeout, iscsi_np process context will attempt to invoke iscsi_target_login_sess_out() to cleanup iscsi_conn as expected, and calls isert_wait_conn() + isert_free_conn() which triggers the use-after-free OOPs. To address this bug, move the kref_get_unless_zero() call from isert_connected_handler() into isert_connect_request() immediately preceeding isert_rdma_accept() to ensure the CM handler cleanup paths and isert_free_conn() are always operating with two refs. Cc: Sagi Grimberg <[email protected]> Cc: <[email protected]> # v3.10+ Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24iscsi-target: Fix iser explicit logout TX kthread leakNicholas Bellinger1-2/+16
This patch fixes a regression introduced with the following commit in v4.0-rc1 code, where an explicit iser-target logout would result in ->tx_thread_active being incorrectly cleared by the logout post handler, and subsequent TX kthread leak: commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca Author: Nicholas Bellinger <[email protected]> Date: Thu Feb 26 22:19:15 2015 -0800 iscsi-target: Convert iscsi_thread_set usage to kthread.h To address this bug, change iscsit_logout_post_handler_closesession() and iscsit_logout_post_handler_samecid() to only cmpxchg() on ->tx_thread_active for traditional iscsi/tcp connections. This is required because iscsi/tcp connections are invoking logout post handler logic directly from TX kthread context, while iser connections are invoking logout post handler logic from a seperate workqueue context. Cc: Sagi Grimberg <[email protected]> Cc: <[email protected]> # v3.10+ Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24iscsi-target: Fix iscsit_start_kthreads failure OOPsNicholas Bellinger5-33/+68
This patch fixes a regression introduced with the following commit in v4.0-rc1 code, where a iscsit_start_kthreads() failure triggers a NULL pointer dereference OOPs: commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca Author: Nicholas Bellinger <[email protected]> Date: Thu Feb 26 22:19:15 2015 -0800 iscsi-target: Convert iscsi_thread_set usage to kthread.h To address this bug, move iscsit_start_kthreads() immediately preceeding the transmit of last login response, before signaling a successful transition into full-feature-phase within existing iscsi_target_do_tx_login_io() logic. This ensures that no target-side resource allocation failures can occur after the final login response has been successfully sent. Also, it adds a iscsi_conn->rx_login_comp to allow the RX thread to sleep to prevent other socket related failures until the final iscsi_post_login_handler() call is able to complete. Cc: Sagi Grimberg <[email protected]> Cc: <[email protected]> # v3.10+ Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24iscsi-target: Fix use-after-free during TPG session shutdownNicholas Bellinger1-4/+8
This patch fixes a use-after-free bug in iscsit_release_sessions_for_tpg() where se_portal_group->session_lock was incorrectly released/re-acquired while walking the active se_portal_group->tpg_sess_list. The can result in a NULL pointer dereference when iscsit_close_session() shutdown happens in the normal path asynchronously to this code, causing a bogus dereference of an already freed list entry to occur. To address this bug, walk the session list checking for the same state as before, but move entries to a local list to avoid dropping the lock while walking the active list. As before, signal using iscsi_session->session_restatement=1 for those list entries to be released locally by iscsit_free_session() code. Reported-by: Sunilkumar Nadumuttlu <[email protected]> Cc: Sunilkumar Nadumuttlu <[email protected]> Cc: <[email protected]> # v3.1+ Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: terminate exchange when command is aborted by LIOAlexei Potashnik3-35/+20
The newly introduced aborted_task TFO callback has to terminate exchange with QLogic driver, since command is being deleted and no status will be queued to the driver at a later point. This patch also moves the burden of releasing one cmd refcount to the aborted_task handler. Changed iSCSI aborted_task logic to satisfy the above requirement. Cc: <[email protected]> # v3.18+ Signed-off-by: Alexei Potashnik <[email protected]> Acked-by: Quinn Tran <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: drop cmds/tmrs arrived while session is being deletedAlexei Potashnik1-0/+28
If a new initiator (different WWN) shows up on the same fcport, old initiator's session is scheduled for deletion. But there is a small window between it being marked with QLA_SESS_DELETION_IN_PROGRESS and qlt_unret_sess getting called when new session's commands will keep finding old session in the fcport map. This patch drops cmds/tmrs if they find session in the progress of being deleted. Cc: <[email protected]> # v3.18+ Signed-off-by: Alexei Potashnik <[email protected]> Acked-by: Quinn Tran <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: disable scsi_transport_fc registration in target modeAlexei Potashnik2-4/+13
There are multiple reasons for disabling this: 1. It provides no functional benefit. We pretty much only get a few more sysfs entries for each port, but all that information is already available from /sys/kernel/debug/target/qla-session-X 2. It already only works in private-loop mode. By disabling we'll be getting more uniform behavior with fabric mode. 3. It creates complications for the new PLOGI handling mechanism: scsi_transport_fc port deletion timer could race with new session from initiator and cause logout after successful login. Cc: <[email protected]> # v3.18+ Signed-off-by: Alexei Potashnik <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: added sess generations to detect RSCN update racesAlexei Potashnik6-26/+83
RSCN processing in qla2xxx driver can run in parallel with ELS/IO processing. As such the decision to remove disappeared fc port's session could be stale, because a new login sequence has occurred since and created a brand new session. Previous mechanism of dealing with this by delaying deletion request was prone to erroneous deletions if the event that was supposed to cancel the deletion never arrived or has been delayed in processing. New mechanism relies on a time-like generation counter to serialize RSCN updates relative to ELS/IO updates. Cc: <[email protected]> # v3.18+ Signed-off-by: Alexei Potashnik <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: Abort stale cmds on qla_tgt_wq when plogi arrivesAlexei Potashnik1-0/+35
cancel any commands from initiator's s_id that are still waiting on qla_tgt_wq when PLOGI arrives. Cc: <[email protected]> # v3.18+ Signed-off-by: Alexei Potashnik <[email protected]> Acked-by: Quinn Tran <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: delay plogi/prli ack until existing sessions are deletedAlexei Potashnik7-22/+481
- keep qla_tgt_sess object on the session list until it's freed - modify use of sess->deleted flag to differentiate delayed session deletion that can be cancelled from irreversible one: QLA_SESS_DELETION_PENDING vs QLA_SESS_DELETION_IN_PROGRESS - during IN_PROGRESS deletion all newly arrived commands and TMRs will be rejected, existing commands and TMRs will be terminated when given by the core to the fabric or simply dropped if session logout has already happened (logout terminates all existing exchanges) - new PLOGI will initiate deletion of the following sessions (unless deletion is already IN_PROGRESS): - with the same port_name (with logout) - different port_name, different loop_id but the same port_id (with logout) - different port_name, different port_id, but the same loop_id (without logout) - additionally each new PLOGI will store imm notify iocb in the same port_name session being deleted. When deletion process completes this iocb will be acked. Only the most recent PLOGI iocb is stored. The older ones will be terminated when replaced. - new PRLI will initiate deletion of the following sessions (unless deletion is already IN_PROGRESS): - different port_name, different port_id, but the same loop_id (without logout) Cc: <[email protected]> # v3.18+ Signed-off-by: Alexei Potashnik <[email protected]> Acked-by: Quinn Tran <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: cleanup cmd in qla workqueue before processing TMRSwapnil Nagle6-13/+140
Since cmds go into qla_tgt_wq and TMRs don't, it's possible that TMR like TASK_ABORT can be queued over the cmd for which it was meant. To avoid this race, use a per-port list to keep track of cmds that are enqueued to qla_tgt_wq but not yet processed. When a TMR arrives, iterate through this list and remove any cmds that match the TMR. This patch supports TASK_ABORT and LUN_RESET. Cc: <[email protected]> # v3.18+ Signed-off-by: Swapnil Nagle <[email protected]> Signed-off-by: Alexei Potashnik <[email protected]> Acked-by: Quinn Tran <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: kill sessions/log out initiator on RSCN and port down eventsRoland Dreier3-31/+117
To fix some issues talking to ESX, this patch modifies the qla2xxx driver so that it never logs into remote ports. This has the side effect of getting rid of the "rports" entirely, which means we never log out of initiators and never tear down sessions when an initiator goes away. This is mostly OK, except that we can run into trouble if we have initiator A assigned FC address X:Y:Z by the fabric talking to us, and then initiator A goes away. Some time (could be a long time) later, initiator B comes along and also gets FC address X:Y:Z (which is available again, because initiator A is gone). If initiator B starts talking to us, then we'll still have the session for initiator A, and since we look up incoming IO based on the FC address X:Y:Z, initiator B will end up using ACLs for initiator A. Fix this by: 1. Handling RSCN events somewhat differently; instead of completely skipping the processing of fcports, we look through the list, and if an fcport disappears, we tell the target code the tear down the session and tell the HBA FW to release the N_Port handle. 2. Handling "port down" events by flushing all of our sessions. The firmware was already releasing the N_Port handle but we want the target code to drop all the sessions too. Cc: <[email protected]> # v3.18+ Signed-off-by: Roland Dreier <[email protected]> Signed-off-by: Alexei Potashnik <[email protected]> Acked-by: Quinn Tran <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: fix command initialization in target mode.Kanoj Sarcar1-5/+5
Cc: <[email protected]> # v3.18+ Signed-off-by: Kanoj Sarcar <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Reviewed-by: Nicholas Bellinger <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: Remove msleep in qlt_send_term_exchangeHimanshu Madhani1-6/+7
Remove unnecessary msleep from qlt_send_term_exchange as it adds latency of 250 msec while sending terminate exchange to an aborted task. Cc: <[email protected]> # v3.18+ Signed-off-by: Himanshu Madhani <[email protected]> Signed-off-by: Giridhar Malavali <[email protected]> Reviewed-by: Nicholas Bellinger <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: adjust debug flagsQuinn Tran3-5/+8
Adjust debug flag to match debug comment. Signed-off-by: Quinn Tran <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Reviewed-by: Nicholas Bellinger <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: release request queue reservation.Quinn Tran1-3/+7
Request IOCB queue element(s) is reserved during good path IO. Under error condition such as unable to allocate IOCB handle condition, the IOCB count that was reserved is not released. Cc: <[email protected]> # v3.18+ Signed-off-by: Quinn Tran <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Reviewed-by: Nicholas Bellinger <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: Add flush after updating ATIOQ consumer index.Quinn Tran1-0/+1
After updating the consumer index of ATIO Q, a read is required to flush the write to the adapter register. Signed-off-by: Quinn Tran <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Reviewed-by: Nicholas Bellinger <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: Enable target mode for ISP27XXHimanshu Madhani7-12/+14
Signed-off-by: Himanshu Madhani <[email protected]> Signed-off-by: Giridhar Malavali <[email protected]> Reviewed-by: Nicholas Bellinger <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24qla2xxx: Fix hardware lock/unlock issue causing kernel panic.Saurav Kashyap2-6/+4
[ Upstream commit ef86cb2059a14b4024c7320999ee58e938873032 ] This patch fixes a kernel panic for qla2xxx Target core Module driver introduced by a fix in the qla2xxx initiator code. Commit ef86cb2 ("qla2xxx: Mark port lost when we receive an RSCN for it.") introduced the regression for qla2xxx Target driver. Stack trace will have following signature --- <NMI exception stack> --- [ffff88081faa3cc8] _raw_spin_lock_irqsave at ffffffff815b1f03 [ffff88081faa3cd0] qlt_fc_port_deleted at ffffffffa096ccd0 [qla2xxx] [ffff88081faa3d20] qla2x00_schedule_rport_del at ffffffffa0913831[qla2xxx] [ffff88081faa3d50] qla2x00_mark_device_lost at ffffffffa09159c5[qla2xxx] [ffff88081faa3db0] qla2x00_async_event at ffffffffa0938d59 [qla2xxx] [ffff88081faa3e30] qla24xx_msix_default at ffffffffa093a326 [qla2xxx] [ffff88081faa3e90] handle_irq_event_percpu at ffffffff810a7b8d [ffff88081faa3ee0] handle_irq_event at ffffffff810a7d32 [ffff88081faa3f10] handle_edge_irq at ffffffff810ab6b9 [ffff88081faa3f30] handle_irq at ffffffff8100619c [ffff88081faa3f70] do_IRQ at ffffffff815b4b1c --- <IRQ stack> --- Cc: <[email protected]> # v3.18+ Signed-off-by: Saurav Kashyap <[email protected]> Signed-off-by: Himanshu Madhani <[email protected]> Reviewed-by: Nicholas Bellinger <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-07-24vfio: Fix lockdep issueAlex Williamson1-37/+54
When we open a device file descriptor, we currently have the following: vfio_group_get_device_fd() mutex_lock(&group->device_lock); open() ... if (ret) release() If we hit that error case, we call the backend driver release path, which for vfio-pci looks like this: vfio_pci_release() vfio_pci_disable() vfio_pci_try_bus_reset() vfio_pci_get_devs() vfio_device_get_from_dev() vfio_group_get_device() mutex_lock(&group->device_lock); Whoops, we've stumbled back onto group.device_lock and created a deadlock. There's a low likelihood of ever seeing this play out, but obviously it needs to be fixed. To do that we can use a reference to the vfio_device for vfio_group_get_device_fd() rather than holding the lock. There was a loop in this function, theoretically allowing multiple devices with the same name, but in practice we don't expect such a thing to happen and the code is already aborting from the loop with break on any sort of error rather than continuing and only parsing the first match anyway, so the loop was effectively unused already. Signed-off-by: Alex Williamson <[email protected]> Fixes: 20f300175a1e ("vfio/pci: Fix racy vfio_device_get_from_dev() call") Reported-by: Joerg Roedel <[email protected]> Tested-by: Joerg Roedel <[email protected]>
2015-07-24Merge tag 'regulator-fix-v4.2-rc3' of ↵Linus Torvalds4-10/+27
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "As well as some driver specific fixes there's several fixes here for the core support for regulators supplying other regulators fixing both an issue with ACPI support (which had never been tested before) and some error handling and device removal issues that Javier noticed" * tag 'regulator-fix-v4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: Fix memory leak in regulator_resolve_supply() regulator: core: Increase refcount for regulator supply's module regulator: core: Handle full constraints systems when resolving supplies regulator: 88pm800: fix LDO vsel_mask value regulator: max8973: Fix up control flag option for bias control regulator: s2mps11: Fix GPIO suspend enable shift wrapping bug
2015-07-24Merge tag 'spi-fix-v4.2-rc3' of ↵Linus Torvalds5-3/+8
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of pretty much unremarkable driver specific fixes here plus the addition of a new device ID to spidev which requires no other code changes" * tag 'spi-fix-v4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: imx: Fix small DMA transfers spi: zynq: missing break statement spi: SPI_ZYNQMP_GQSPI should depend on HAS_DMA spi: spidev: add compatible value for LTC2488 spi: img-spfi: fix support for speeds up to 1/4th input clock
2015-07-24Merge tag 'sound-4.2-rc4' of ↵Linus Torvalds6-18/+57
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This has been a calm week again: one minor lockdep fix for PCM core, and the most of the rest are HD-audio quirks and fixups for various chips and machines" * tag 'sound-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Add headset mic pin quirk for a Dell device ALSA: hda - remove one pin from ALC292_STANDARD_PINS ALSA: hda - Add new GPU codec ID 0x10de007d to snd-hda ALSA: hda: add new AMD PCI IDs with proper driver caps ALSA: hda - Fix Skylake codec timeout ALSA: hda - Add headset mic support for Acer Aspire V5-573G ALSA: sparc: Add missing kfree in error path ALSA: pcm: Fix lockdep warning with nonatomic PCM ops
2015-07-24Merge branch 'for-linus' of ↵Linus Torvalds5-2/+19
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: - kernel crash fixes for multitouch and wacom drivers, by Brent Adam and Dan Carpenter - cp2112 data packet race condition corruption fix, by Antonio Borneo - a few new device IDs for wacom and microsoft drivers * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: cp2112: fix to force single data-report reply HID: wacom: Enable pad device for older Bamboo Touch tablets HID: multitouch: Fix fields from pen report ID being interpreted for multitouch HID: microsoft: Add quirk for MS Surface Type/Touch cover HID: wacom: NULL dereferences on error in probe()
2015-07-24Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds13-34/+154
Pull drm fixes from Dave Airlie: "Aome amdgpu, one i915, one ttm and one hlcdc, nothing too scary. All seems fine for about this time" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/ttm: recognize ARM64 arch in ioprot handler drm/amdgpu/cz/dpm: properly report UVD and VCE clock levels drm/amdgpu/cz: implement voltage validation properly drm/amdgpu: add VCE harvesting instance query drm/amdgpu: implement VCE 3.0 harvesting support (v4) drm/amdgpu/dce10: Re-set VBLANK interrupt state when enabling a CRTC drm/amdgpu/dce11: Re-set VBLANK interrupt state when enabling a CRTC drm: Stop resetting connector state to unknown drm/i915: Use two 32bit reads for select 64bit REG_READ ioctls drm: atmel-hlcdc: fix vblank initial state
2015-07-24Merge branch 'stable' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile Pull arch/tile bugfix from Chris Metcalf: "This fixes a bug in freeing the initramfs memory" * 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: tile: use free_bootmem_late() for initrd
2015-07-24Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds6-15/+43
Pull KVM fixes from Paolo Bonzini: "Everything related to the new quirks and memory type features: - small improvements to the quirks API - extending one of the quirks from just AMD to Intel as well, because 4.2 can show the same problem with problematic firmware on Intel too" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: rename quirk constants to KVM_X86_QUIRK_* KVM: vmx: obey KVM_QUIRK_CD_NW_CLEARED KVM: x86: introduce kvm_check_has_quirk KVM: MTRR: simplify kvm_mtrr_get_guest_memory_type KVM: MTRR: fix memory type handling if MTRR is completely disabled
Powered by cgit, Gruvboxed by Blaster4385.