aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-07-24Merge tag 'topic/drm-fixes-2015-07-23' of ↵Dave Airlie1-4/+1
git://anongit.freedesktop.org/drm-intel into drm-fixes Regression fix for systemd getting confused about unknown connector state after resume. Just stop setting the state to unknown, turned out to be a silly idea anyway. What drivers imo really should do (and i915 still does that) is forcing a full reprobe on resume to make sure connector changes while suspended are caught. Most drivers seem to get this wrong. Otoh it took us years to get fixes merged where some probe races resulted in eating uevents, I guess userspace expectations for reliable hpd are just really low :( * tag 'topic/drm-fixes-2015-07-23' of git://anongit.freedesktop.org/drm-intel: drm: Stop resetting connector state to unknown
2015-07-24Merge tag 'drm-intel-fixes-2015-07-23' of ↵Dave Airlie2-7/+27
git://anongit.freedesktop.org/drm-intel into drm-fixes arb_timer kernel side fix from Chris. * tag 'drm-intel-fixes-2015-07-23' of git://anongit.freedesktop.org/drm-intel: drm/i915: Use two 32bit reads for select 64bit REG_READ ioctls
2015-07-24Merge branch 'drm-fixes-4.2' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie7-16/+117
into drm-fixes Some amdgpu fixes. * 'drm-fixes-4.2' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu/cz/dpm: properly report UVD and VCE clock levels drm/amdgpu/cz: implement voltage validation properly drm/amdgpu: add VCE harvesting instance query drm/amdgpu: implement VCE 3.0 harvesting support (v4) drm/amdgpu/dce10: Re-set VBLANK interrupt state when enabling a CRTC drm/amdgpu/dce11: Re-set VBLANK interrupt state when enabling a CRTC
2015-07-24drm/ttm: recognize ARM64 arch in ioprot handlerAlexandre Courbot1-1/+2
Return proper pgprot for ARM64. This is required for objects like Nouveau fences to be mapped with expected coherency. Signed-off-by: Alexandre Courbot <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2015-07-23tty: vt: Fix !TASK_RUNNING diagnostic warning from paste_selection()Peter Hurley1-0/+1
Pasting text with gpm on a VC produced warning [1]. Reset task state to TASK_RUNNING in the paste_selection() loop, if the loop did not sleep. [1] WARNING: CPU: 6 PID: 1960 at /home/peter/src/kernels/mainline/kernel/sched/core.c:7286 __might_sleep+0x7f/0x90() do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff8151805e>] paste_selection+0x9e/0x1a0 Modules linked in: btrfs xor raid6_pq ufs qnx4 hfsplus hfs minix ntfs msdos jfs xfs libcrc32c ..... CPU: 6 PID: 1960 Comm: gpm Not tainted 4.1.0-rc7+tty-xeon+debug #rc7+tty Hardware name: Dell Inc. Precision WorkStation T5400 /0RW203, BIOS A11 04/30/2012 ffffffff81c9c0a0 ffff8802b0fd3ac8 ffffffff8185778a 0000000000000001 ffff8802b0fd3b18 ffff8802b0fd3b08 ffffffff8108039a ffffffff82ae8510 ffffffff81c9ce00 0000000000000015 0000000000000000 0000000000000000 Call Trace: [<ffffffff8185778a>] dump_stack+0x4f/0x7b [<ffffffff8108039a>] warn_slowpath_common+0x8a/0xc0 [<ffffffff81080416>] warn_slowpath_fmt+0x46/0x50 [<ffffffff810ddced>] ? __lock_acquire+0xe2d/0x13a0 [<ffffffff8151805e>] ? paste_selection+0x9e/0x1a0 [<ffffffff8151805e>] ? paste_selection+0x9e/0x1a0 [<ffffffff810ad4ff>] __might_sleep+0x7f/0x90 [<ffffffff8185f76a>] down_read+0x2a/0xa0 [<ffffffff810bb1d8>] ? sched_clock_cpu+0xb8/0xe0 [<ffffffff8150d1dc>] n_tty_receive_buf_common+0x4c/0xba0 [<ffffffff810dc875>] ? mark_held_locks+0x75/0xa0 [<ffffffff81861c95>] ? _raw_spin_unlock_irqrestore+0x65/0x80 [<ffffffff810b49a1>] ? get_parent_ip+0x11/0x50 [<ffffffff8150dd44>] n_tty_receive_buf2+0x14/0x20 [<ffffffff81518117>] paste_selection+0x157/0x1a0 [<ffffffff810b77b0>] ? wake_up_state+0x20/0x20 [<ffffffff815203f8>] tioclinux+0xb8/0x2c0 [<ffffffff81515bfe>] vt_ioctl+0xaee/0x11a0 [<ffffffff810baf75>] ? sched_clock_local+0x25/0x90 [<ffffffff810bbe11>] ? vtime_account_user+0x91/0xa0 [<ffffffff8150810c>] tty_ioctl+0x20c/0xe20 [<ffffffff810bbe11>] ? vtime_account_user+0x91/0xa0 [<ffffffff810b49a1>] ? get_parent_ip+0x11/0x50 [<ffffffff810b4a69>] ? preempt_count_sub+0x49/0x50 [<ffffffff811ab71c>] ? context_tracking_exit+0x5c/0x290 [<ffffffff811ab71c>] ? context_tracking_exit+0x5c/0x290 [<ffffffff81248b98>] do_vfs_ioctl+0x318/0x570 [<ffffffff810dca8d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff810dc9b5>] ? trace_hardirqs_on_caller+0x115/0x1e0 [<ffffffff81254acc>] ? __fget_light+0x6c/0xa0 [<ffffffff81248e71>] SyS_ioctl+0x81/0xa0 [<ffffffff81862832>] system_call_fastpath+0x16/0x7a Signed-off-by: Peter Hurley <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-23serial: core: Fix crashes while echoing when closingPeter Hurley1-1/+2
While closing, new rx data may be received after the input buffers have been flushed but before stop_rx() halts receiving [1]. The new data might not be processed by flush_to_ldisc() until after uart_shutdown() and normal input processing is re-enabled (ie., tty->closing = 0). The race is outlined below: CPU 0 | CPU 1 | uart_close() | tty_port_close_start() | tty->closing = 1 | tty_ldisc_flush() | | => IRQ | while (LSR & data ready) | uart_insert_char() | tty_flip_buffer_push() | <= EOI stop_rx() | . uart_shutdown() | . free xmit.buf | . tty_port_tty_set(NULL) | . tty->closing = 0 | . | flush_to_ldisc() | n_tty_receive_buf_common() | __receive_buf() | ... | commit_echoes() | uart_flush_chars() | __uart_start() | ** OOPS on port.tty deref ** tty_ldisc_flush() | Input processing must be prevented from echoing (tty->closing = 1) until _after_ the input buffers have been flushed again at the end of uart_close(). [1] In fact, some input may actually be buffered _after_ stop_rx() since the rx interrupt may have already triggered but not yet been handled when stop_rx() disables rx interrupts. Fixes: 2e758910832d ("serial: core: Flush ldisc after dropping port mutex in uart_close()") Reported-by: Robert Elliott <[email protected]> Signed-off-by: Peter Hurley <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-23m32r: Add ioreadXX/iowriteXX big-endian mmio accessorsPeter Hurley1-0/+5
commit c627f2ceb692 ("serial: 8250: Add support for big-endian MMIO accesses") added support for 32-bit big-endian mmio to the 8250 driver. Support for ioreadXXbe/iowriteXXbe io accessors was missing from m32r arch, which caused build errors. Add trivial macro mmio accessors. Reported-by: Fengguang Wu <[email protected]> Cc: Kevin Cernekee <[email protected]> Signed-off-by: Peter Hurley <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-23Revert "serial: imx: initialized DMA w/o HW flow enabled"David Jander1-8/+7
This reverts commit 068500e08dc87ea9a453cc4a500cf3ab28d0f936. According to some tests, SDMA support is broken at least for i.MX6 without HW flow control. Different forms of data-corruption appear either with the ROM firmware for the SDMA controller as well as when loading Freescale provided SDMA firmware versions 1.1 or 3.1. Signed-off-by: David Jander <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-23sc16is7xx: fix FIFO address of secondary UARTBo Svangård1-7/+23
Calls to regmap_raw_read/write needed register rewrite in a similar way as function calls to regmap_read/write already had. This enables reading/writing the serial datastream to the device. Signed-off-by: Bo Svangård <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]> Signed-off-by: Jon Ringle <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-23sc16is7xx: fix Kconfig dependenciesJakub Kicinski1-1/+1
When I2C=m and SPI=y or-ing them will produce =y while what we need is the lower bound, i.e. =m. Fortunately SPI is a boolean so we need to handle only one special case. Reported-by: kbuild test robot <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-23serial: etraxfs-uart: Fix release etraxfs_uart_portsAxel Lin1-1/+1
In probe, we use dev_id as array index of etraxfs_uart_ports and store the index in port->line. So etraxfs_uart_ports[port->line] should be released when unload the module. Signed-off-by: Axel Lin <[email protected]> Acked-by: Niklas Cassel <[email protected]> Acked-by: Jesper Nilsson <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-23block: Do a full clone when splitting discard biosMartin K. Petersen1-3/+12
This fixes a data corruption bug when using discard on top of MD linear, raid0 and raid10 personalities. Commit 20d0189b1012 "block: Introduce new bio_split()" permits sharing the bio_vec between the two resulting bios. That is fine for read/write requests where the bio_vec is immutable. For discards, however, we need to be able to attach a payload and update the bio_vec so the page can get mapped to a scatterlist entry. Therefore the bio_vec can not be shared when splitting discards and we must do a full clone. Signed-off-by: Martin K. Petersen <[email protected]> Reported-by: Seunguk Shin <[email protected]> Tested-by: Seunguk Shin <[email protected]> Cc: Seunguk Shin <[email protected]> Cc: Jens Axboe <[email protected]> Cc: Kent Overstreet <[email protected]> Cc: <[email protected]> # v3.14+ Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2015-07-23tty/vt: Fix the memory leak in visual_initDongxing Zhang1-0/+2
If vc->vc_uni_pagedir_loc is not NULL, its refcount needs to be decreased before vc_uni_pagedir_loc is re-assigned. unreferenced object 0xffff88002cdd13b0 (size 512): comm "setfont", pid 503, jiffies 4294896503 (age 722.828s) hex dump (first 32 bytes): 40 92 61 2b 00 88 ff ff 00 00 00 00 00 00 00 00 @.a+............ 00 00 00 00 00 00 00 00 a0 ad 61 2b 00 88 ff ff ..........a+.... backtrace: [<ffffffff817b755e>] kmemleak_alloc+0x4e/0xb0 [<ffffffff811d4898>] kmem_cache_alloc_trace+0x1c8/0x240 [<ffffffff814ae7d3>] con_do_clear_unimap.isra.2+0x83/0xe0 [<ffffffff814ae9b2>] con_clear_unimap+0x22/0x40 [<ffffffff814a8db8>] vt_ioctl+0xeb8/0x1170 [<ffffffff8149b458>] tty_ioctl+0x208/0xca0 [<ffffffff81207858>] do_vfs_ioctl+0x2f8/0x510 [<ffffffff81207af1>] SyS_ioctl+0x81/0xa0 [<ffffffff817ca2b2>] system_call_fastpath+0x16/0x75 [<ffffffffffffffff>] 0xffffffffffffffff unreferenced object 0xffff88002b619240 (size 256): comm "setfont", pid 503, jiffies 4294896503 (age 722.828s) hex dump (first 32 bytes): 90 bc 84 d5 00 88 ff ff 58 85 84 d5 00 88 ff ff ........X....... 88 ac 84 d5 00 88 ff ff e0 b1 84 d5 00 88 ff ff ................ backtrace: [<ffffffff817b755e>] kmemleak_alloc+0x4e/0xb0 [<ffffffff811d4898>] kmem_cache_alloc_trace+0x1c8/0x240 [<ffffffff814ae286>] con_insert_unipair+0x86/0x170 [<ffffffff814af107>] con_set_unimap+0x1b7/0x280 [<ffffffff814a8d65>] vt_ioctl+0xe65/0x1170 [<ffffffff8149b458>] tty_ioctl+0x208/0xca0 [<ffffffff81207858>] do_vfs_ioctl+0x2f8/0x510 [<ffffffff81207af1>] SyS_ioctl+0x81/0xa0 [<ffffffff817ca2b2>] system_call_fastpath+0x16/0x75 [<ffffffffffffffff>] 0xffffffffffffffff Signed-off-by: Dongxing Zhang <[email protected]> Signed-off-by: Xiaoming Wang <[email protected]> Reviewed-by: Peter Hurley <[email protected]> Tested-by: Konstantin Khlebnikov <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-23serial: amba-pl011: Fix devm_ioremap_resource return value checkKrzysztof Kozlowski1-2/+2
Value returned by devm_ioremap_resource() was checked for non-NULL but devm_ioremap_resource() returns IOMEM_ERR_PTR, not NULL. In case of error this could lead to dereference of ERR_PTR. Signed-off-by: Krzysztof Kozlowski <[email protected]> Cc: <[email protected]> Fixes: 3873e2d7f63a ("drivers: PL011: refactor pl011_probe()") Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-23n_tty: signal and flush atomicallyPeter Hurley1-3/+13
When handling signalling char, claim the termios write lock before signalling waiting readers and writers to prevent further i/o before flushing the echo and output buffers. This prevents a userspace signal handler which may output from racing the terminal flush. Reference: Bugzilla #99351 ("Output truncated in ssh session after...") Fixes: commit d2b6f44779d3 ("n_tty: Fix signal handling flushes") Reported-by: Filipe Brandenburger <[email protected]> Signed-off-by: Peter Hurley <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-23Input: usbtouchscreen - avoid unresponsive TSC-30 touch screenBernhard Bender1-0/+3
This patch fixes a problem in the usbtouchscreen driver for DMC TSC-30 touch screen. Due to a missing delay between the RESET and SET_RATE commands, the touch screen may become unresponsive during system startup or driver loading. According to the DMC documentation, a delay is needed after the RESET command to allow the chip to complete its internal initialization. As this delay is not guaranteed, we had a system where the touch screen occasionally did not send any touch data. There was no other indication of the problem. The patch fixes the problem by adding a 150ms delay between the RESET and SET_RATE commands. Cc: [email protected] Suggested-by: Jakob Mustafa <[email protected]> Signed-off-by: Bernhard Bender <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2015-07-23Merge tag 'iio-fixes-for-4.2c' of ↵Greg Kroah-Hartman8-26/+31
git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: 3rd round of IIO fixes for the 4.2 cycle. * bmc150_magn - add missing regmap dependency and ensure on a wrong chip case report hte chip id rather than a previous return value. * mmc35240 - Fill a null pointer derefrence and wrong SET / RESET logic that results in North and South being swapped. * mlx96014 - correct the offset value reported to userspace (wrong sign) * vf610 - Prevent non aligned register reading. * mcp320x - Another null pointer deference bug. * mma8452 - change threshold type from THRESH to MAG to reflect the fact that the sign of the signal is not known when the event is signaled. * stk3310 - move device registert to end of probe to avoid race conditions when coming up, check for invalid client->irq values and make it work for both endian types of host.
2015-07-23Merge branch 'for-linus' of ↵Linus Torvalds2-11/+33
git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull namespace fixes from Eric Biederman: "While reading through the code of detach_mounts I realized the code was slightly off. Testing it revealed two buggy corner cases that can send the code of detach_mounts into an infinite loop. Fixing the code to do the right thing removes the possibility of these user triggered infinite loops in the code" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: mnt: In detach_mounts detach the appropriate unmounted mount mnt: Clarify and correct the disconnect logic in umount_tree
2015-07-23Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhostLinus Torvalds11-20/+91
Pull virtio/vhost fixes from Michael Tsirkin: "Bugfixes and documentation fixes. Igor's patch that allows users to tweak memory table size is borderline, but it does fix known crashes, so I merged it" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost: add max_mem_regions module parameter vhost: extend memory regions allocation to vmalloc 9p/trans_virtio: reset virtio device on remove virtio/s390: rename drivers/s390/kvm -> drivers/s390/virtio MAINTAINERS: separate section for s390 virtio drivers virtio: define virtio_pci_cfg_cap in header. virtio: Fix typecast of pointer in vring_init() virtio scsi: fix unused variable warning vhost: use binary search instead of linear in find_region() virtio_net: document VIRTIO_NET_CTRL_GUEST_OFFLOADS
2015-07-23block: export bio_associate_*() and wbc_account_io()Tejun Heo2-0/+3
bio_associate_blkcg(), bio_associate_current() and wbc_account_io() are used to implement cgroup writeback support for filesystems and thus need to be exported. Export them. Signed-off-by: Tejun Heo <[email protected]> Reported-by: Stephen Rothwell <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2015-07-23Merge tag 'iommu-fixes-v4.2-rc3' of ↵Linus Torvalds3-17/+55
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: "The fixes include: - a couple of fixes for the new ARM-SMMUv3 driver to fix issues found on the first real implementation of that hardware. - a patch for the Intel VT-d driver to fix a domain-id leak" * tag 'iommu-fixes-v4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Fix VM domain ID leak iommu/arm-smmu: Skip the execution of CMD_PREFETCH_CONFIG iommu/arm-smmu: Enlarge STRTAB_L1_SZ_SHIFT to support larger sidsize iommu/arm-smmu: Fix the values of ARM64_TCR_{I,O}RGN0_SHIFT iommu/arm-smmu: Fix LOG2SIZE setting for 2-level stream tables iommu/arm-smmu: Fix the index calculation of strtab
2015-07-23drm/amdgpu/cz/dpm: properly report UVD and VCE clock levelsAlex Deucher1-16/+45
VCE, UVD DPM work similarly to SCLK DPM. Report the current clock levels for UVD and VCE via debugfs. Signed-off-by: Alex Deucher <[email protected]>
2015-07-23drm/amdgpu/cz: implement voltage validation properlyAlex Deucher1-7/+16
CZ uses a different set of registers compared to previous asics and supports separate NB and GFX planes. Reviewed-by: Jammy Zhou <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2015-07-23tile: use free_bootmem_late() for initrdChris Metcalf1-1/+1
We were previously using free_bootmem() and just getting lucky that nothing too bad happened. Signed-off-by: Chris Metcalf <[email protected]> Cc: [email protected]
2015-07-23mnt: In detach_mounts detach the appropriate unmounted mountEric W. Biederman1-5/+2
The handling of in detach_mounts of unmounted but connected mounts is buggy and can lead to an infinite loop. Correct the handling of unmounted mounts in detach_mount. When the mountpoint of an unmounted but connected mount is connected to a dentry, and that dentry is deleted we need to disconnect that mount from the parent mount and the deleted dentry. Nothing changes for the unmounted and connected children. They can be safely ignored. Cc: [email protected] Fixes: ce07d891a0891d3c0d0c2d73d577490486b809e1 mnt: Honor MNT_LOCKED when detaching mounts Signed-off-by: "Eric W. Biederman" <[email protected]>
2015-07-23drm/amdgpu: add VCE harvesting instance queryLeo Liu2-0/+3
Signed-off-by: Leo Liu <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Reviewed-by: Christian König <[email protected]>
2015-07-23drm/amdgpu: implement VCE 3.0 harvesting support (v4)Alex Deucher2-0/+52
For boards with bad VCE blocks, only configure the working block. v2: use the harvest info for pipe setup v3: fix mask check as noted by Leo v4: add dGPU support Reviewed-by: Christian König <[email protected]> (v2) Signed-off-by: Alex Deucher <[email protected]>
2015-07-23drm/amdgpu/dce10: Re-set VBLANK interrupt state when enabling a CRTCMichel Dänzer1-0/+4
This doesn't seem strictly necessary with Tonga right now, but that might change with future power management enhancements. Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Michel Dänzer <[email protected]>
2015-07-23drm/amdgpu/dce11: Re-set VBLANK interrupt state when enabling a CRTCMichel Dänzer1-0/+4
Something (ATOM BIOS?) seems to be clobbering the LB_INTERRUPT_MASK register while the CRTC is off, which caused e.g. glxgears or gnome-shell to hang after a modeset. Reviewed-and-Tested-by: Alex Deucher <[email protected]> Tested-by: Sonny Jiang <[email protected]> Signed-off-by: Michel Dänzer <[email protected]>
2015-07-23Bluetooth: Fix NULL pointer dereference in smp_conn_securityJohan Hedberg1-0/+4
The l2cap_conn->smp pointer may be NULL for various valid reasons where SMP has failed to initialize properly. One such scenario is when crypto support is missing, another when the adapter has been powered on through a legacy method. The smp_conn_security() function should have the appropriate check for this situation to avoid NULL pointer dereferences. Signed-off-by: Johan Hedberg <[email protected]> Signed-off-by: Marcel Holtmann <[email protected]> Cc: [email protected] # 4.0+
2015-07-23ARM: OMAP2+: hwmod: Fix _wait_target_ready() for hwmods without syscRoger Quadros1-8/+16
For hwmods without sysc, _init_mpu_rt_base(oh) won't be called and so _find_mpu_rt_port(oh) will return NULL thus preventing ready state check on those modules after the module is enabled. This can potentially cause a bus access error if the module is accessed before the module is ready. Fix this by unconditionally calling _init_mpu_rt_base() during hwmod _init(). Do ioremap only if we need SYSC access. Eventhough _wait_target_ready() check doesn't really need MPU RT port but just the PRCM registers, we still mandate that the hwmod must have an MPU RT port if ready state check needs to be done. Else it would mean that the module is not accessible by MPU so there is no point in waiting for target to be ready. e.g. this fixes the below DCAN bus access error on AM437x-gp-evm. [ 16.672978] ------------[ cut here ]------------ [ 16.677885] WARNING: CPU: 0 PID: 1580 at drivers/bus/omap_l3_noc.c:147 l3_interrupt_handler+0x234/0x35c() [ 16.687946] 44000000.ocp:L3 Custom Error: MASTER M2 (64-bit) TARGET L4_PER_0 (Read): Data Access in User mode during Functional access [ 16.700654] Modules linked in: xhci_hcd btwilink ti_vpfe dwc3 videobuf2_core ov2659 bluetooth v4l2_common videodev ti_am335x_adc kfifo_buf industrialio c_can_platform videobuf2_dma_contig media snd_soc_tlv320aic3x pixcir_i2c_ts c_can dc [ 16.731144] CPU: 0 PID: 1580 Comm: rpc.statd Not tainted 3.14.26-02561-gf733aa036398 #180 [ 16.739747] Backtrace: [ 16.742336] [<c0011108>] (dump_backtrace) from [<c00112a4>] (show_stack+0x18/0x1c) [ 16.750285] r6:00000093 r5:00000009 r4:eab5b8a8 r3:00000000 [ 16.756252] [<c001128c>] (show_stack) from [<c05a4418>] (dump_stack+0x20/0x28) [ 16.763870] [<c05a43f8>] (dump_stack) from [<c0037120>] (warn_slowpath_common+0x6c/0x8c) [ 16.772408] [<c00370b4>] (warn_slowpath_common) from [<c00371e4>] (warn_slowpath_fmt+0x38/0x40) [ 16.781550] r8:c05d1f90 r7:c0730844 r6:c0730448 r5:80080003 r4:ed0cd210 [ 16.788626] [<c00371b0>] (warn_slowpath_fmt) from [<c027fa94>] (l3_interrupt_handler+0x234/0x35c) [ 16.797968] r3:ed0cd480 r2:c0730508 [ 16.801747] [<c027f860>] (l3_interrupt_handler) from [<c0063758>] (handle_irq_event_percpu+0x54/0x1bc) [ 16.811533] r10:ed005600 r9:c084855b r8:0000002a r7:00000000 r6:00000000 r5:0000002a [ 16.819780] r4:ed0e6d80 [ 16.822453] [<c0063704>] (handle_irq_event_percpu) from [<c00638f0>] (handle_irq_event+0x30/0x40) [ 16.831789] r10:eb2b6938 r9:eb2b6960 r8:bf011420 r7:fa240100 r6:00000000 r5:0000002a [ 16.840052] r4:ed005600 [ 16.842744] [<c00638c0>] (handle_irq_event) from [<c00661d8>] (handle_fasteoi_irq+0x74/0x128) [ 16.851702] r4:ed005600 r3:00000000 [ 16.855479] [<c0066164>] (handle_fasteoi_irq) from [<c0063068>] (generic_handle_irq+0x28/0x38) [ 16.864523] r4:0000002a r3:c0066164 [ 16.868294] [<c0063040>] (generic_handle_irq) from [<c000ef60>] (handle_IRQ+0x38/0x8c) [ 16.876612] r4:c081c640 r3:00000202 [ 16.880380] [<c000ef28>] (handle_IRQ) from [<c00084f0>] (gic_handle_irq+0x30/0x5c) [ 16.888328] r6:eab5ba38 r5:c0804460 r4:fa24010c r3:00000100 [ 16.894303] [<c00084c0>] (gic_handle_irq) from [<c05a8d80>] (__irq_svc+0x40/0x50) [ 16.902193] Exception stack(0xeab5ba38 to 0xeab5ba80) [ 16.907499] ba20: 00000000 00000006 [ 16.916108] ba40: fa1d0000 fa1d0008 ed3d3000 eab5bab4 ed3d3460 c0842af4 bf011420 eb2b6960 [ 16.924716] ba60: eb2b6938 eab5ba8c eab5ba90 eab5ba80 bf035220 bf07702c 600f0013 ffffffff [ 16.933317] r7:eab5ba6c r6:ffffffff r5:600f0013 r4:bf07702c [ 16.939317] [<bf077000>] (c_can_plat_read_reg_aligned_to_16bit [c_can_platform]) from [<bf035220>] (c_can_get_berr_counter+0x38/0x64 [c_can]) [ 16.952696] [<bf0351e8>] (c_can_get_berr_counter [c_can]) from [<bf010294>] (can_fill_info+0x124/0x15c [can_dev]) [ 16.963480] r5:ec8c9740 r4:ed3d3000 [ 16.967253] [<bf010170>] (can_fill_info [can_dev]) from [<c0502fa8>] (rtnl_fill_ifinfo+0x58c/0x8fc) [ 16.976749] r6:ec8c9740 r5:ed3d3000 r4:eb2b6780 [ 16.981613] [<c0502a1c>] (rtnl_fill_ifinfo) from [<c0503408>] (rtnl_dump_ifinfo+0xf0/0x1dc) [ 16.990401] r10:ec8c9740 r9:00000000 r8:00000000 r7:00000000 r6:ebd4d1b4 r5:ed3d3000 [ 16.998671] r4:00000000 [ 17.001342] [<c0503318>] (rtnl_dump_ifinfo) from [<c050e6e4>] (netlink_dump+0xa8/0x1e0) [ 17.009772] r10:00000000 r9:00000000 r8:c0503318 r7:ebf3e6c0 r6:ebd4d1b4 r5:ec8c9740 [ 17.018050] r4:ebd4d000 [ 17.020714] [<c050e63c>] (netlink_dump) from [<c050ec10>] (__netlink_dump_start+0x104/0x154) [ 17.029591] r6:eab5bd34 r5:ec8c9980 r4:ebd4d000 [ 17.034454] [<c050eb0c>] (__netlink_dump_start) from [<c0505604>] (rtnetlink_rcv_msg+0x110/0x1f4) [ 17.043778] r7:00000000 r6:ec8c9980 r5:00000f40 r4:ebf3e6c0 [ 17.049743] [<c05054f4>] (rtnetlink_rcv_msg) from [<c05108e8>] (netlink_rcv_skb+0xb4/0xc8) [ 17.058449] r8:eab5bdac r7:ec8c9980 r6:c05054f4 r5:ec8c9980 r4:ebf3e6c0 [ 17.065534] [<c0510834>] (netlink_rcv_skb) from [<c0504134>] (rtnetlink_rcv+0x24/0x2c) [ 17.073854] r6:ebd4d000 r5:00000014 r4:ec8c9980 r3:c0504110 [ 17.079846] [<c0504110>] (rtnetlink_rcv) from [<c05102ac>] (netlink_unicast+0x180/0x1ec) [ 17.088363] r4:ed0c6800 r3:c0504110 [ 17.092113] [<c051012c>] (netlink_unicast) from [<c0510670>] (netlink_sendmsg+0x2ac/0x380) [ 17.100813] r10:00000000 r8:00000008 r7:ec8c9980 r6:ebd4d000 r5:eab5be70 r4:eab5bee4 [ 17.109083] [<c05103c4>] (netlink_sendmsg) from [<c04dfdb4>] (sock_sendmsg+0x90/0xb0) [ 17.117305] r10:00000000 r9:eab5a000 r8:becdda3c r7:0000000c r6:ea978400 r5:eab5be70 [ 17.125563] r4:c05103c4 [ 17.128225] [<c04dfd24>] (sock_sendmsg) from [<c04e1c28>] (SyS_sendto+0xb8/0xdc) [ 17.136001] r6:becdda5c r5:00000014 r4:ecd37040 [ 17.140876] [<c04e1b70>] (SyS_sendto) from [<c000e680>] (ret_fast_syscall+0x0/0x30) [ 17.148923] r10:00000000 r8:c000e804 r7:00000122 r6:becdda5c r5:0000000c r4:becdda5c [ 17.157169] ---[ end trace 2b71e15b38f58bad ]--- Fixes: 6423d6df1440 ("ARM: OMAP2+: hwmod: check for module address space during init") Signed-off-by: Roger Quadros <[email protected]> Signed-off-by: Paul Walmsley <[email protected]> Cc: <[email protected]>
2015-07-23iommu/vt-d: Fix VM domain ID leakAlex Williamson1-3/+6
This continues the attempt to fix commit fb170fb4c548 ("iommu/vt-d: Introduce helper functions to make code symmetric for readability"). The previous attempt in commit 71684406905f ("iommu/vt-d: Detach domain *only* from attached iommus") overlooked the fact that dmar_domain.iommu_bmp gets cleared for VM domains when devices are detached: intel_iommu_detach_device domain_remove_one_dev_info domain_detach_iommu The domain is detached from the iommu, but the iommu is still attached to the domain, for whatever reason. Thus when we get to domain_exit(), we can't rely on iommu_bmp for VM domains to find the active iommus, we must check them all. Without that, the corresponding bit in intel_iommu.domain_ids doesn't get cleared and repeated VM domain creation and destruction will run out of domain IDs. Meanwhile we still can't call iommu_detach_domain() on arbitrary non-VM domains or we risk clearing in-use domain IDs, as 71684406905f attempted to address. It's tempting to modify iommu_detach_domain() to test the domain iommu_bmp, but the call ordering from domain_remove_one_dev_info() prevents it being able to work as fb170fb4c548 seems to have intended. Caching of unused VM domains on the iommu object seems to be the root of the problem, but this code is far too fragile for that kind of rework to be proposed for stable, so we simply revert this chunk to its state prior to fb170fb4c548. Fixes: fb170fb4c548 ("iommu/vt-d: Introduce helper functions to make code symmetric for readability") Fixes: 71684406905f ("iommu/vt-d: Detach domain *only* from attached iommus") Signed-off-by: Alex Williamson <[email protected]> Cc: Jiang Liu <[email protected]> Cc: [email protected] # v3.17+ Signed-off-by: Joerg Roedel <[email protected]>
2015-07-23crypto: ixp4xx - Remove bogus BUG_ON on scattered dst bufferHerbert Xu1-1/+0
This patch removes a bogus BUG_ON in the ablkcipher path that triggers when the destination buffer is different from the source buffer and is scattered. Cc: [email protected] Signed-off-by: Herbert Xu <[email protected]>
2015-07-23crypto: qat - Fix invalid synchronization between register/unregister sym algsTadeusz Struk1-8/+16
The synchronization method used atomic was bogus. Use a proper synchronization with mutex. Cc: [email protected] Signed-off-by: Tadeusz Struk <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
2015-07-23macintosh/ans-lcd: fix build failure after module_init/exit relocationLuis Henriques1-1/+1
After commit 0fd972a7d91d ("module: relocate module_init from init.h to module.h") ans-lcd module fails to build with: drivers/macintosh/ans-lcd.c:201:1: warning: data definition has no type or storage class [enabled by default] module_init(anslcd_init); ^ drivers/macintosh/ans-lcd.c:201:1: error: type defaults to 'int' in declaration of 'module_init' [-Werror=implicit-int] drivers/macintosh/ans-lcd.c:201:1: warning: parameter names (without types) in function declaration [enabled by default] drivers/macintosh/ans-lcd.c:202:1: warning: data definition has no type or storage class [enabled by default] module_exit(anslcd_exit); ^ drivers/macintosh/ans-lcd.c:202:1: error: type defaults to 'int' in declaration of 'module_exit' [-Werror=implicit-int] drivers/macintosh/ans-lcd.c:202:1: warning: parameter names (without types) in function declaration [enabled by default] drivers/macintosh/ans-lcd.c:155:1: warning: 'anslcd_init' defined but not used [-Wunused-function] anslcd_init(void) ^ drivers/macintosh/ans-lcd.c:195:1: warning: 'anslcd_exit' defined but not used [-Wunused-function] anslcd_exit(void) ^ This commit fixes it by replacing linux/init.h by linux/module.h. Fixes: 0fd972a7d91d ("module: relocate module_init from init.h to module.h") Signed-off-by: Luis Henriques <[email protected]> Acked-by: Paul Gortmaker <[email protected]> Signed-off-by: Michael Ellerman <[email protected]>
2015-07-23powerpc/powernv/ioda2: Fix calculation for memory allocated for TCE tableAlexey Kardashevskiy1-5/+6
The existing code stores the amount of memory allocated for a TCE table. At the moment it uses @offset which is a virtual offset in the TCE table which is only correct for a one level tables and it does not include memory allocated for intermediate levels. When multilevel TCE table is requested, WARN_ON in tce_iommu_create_table() prints a warning. This adds an additional counter to pnv_pci_ioda2_table_do_alloc_pages() to count actually allocated memory. Signed-off-by: Alexey Kardashevskiy <[email protected]> Reviewed-by: David Gibson <[email protected]> Signed-off-by: Michael Ellerman <[email protected]>
2015-07-23KVM: x86: rename quirk constants to KVM_X86_QUIRK_*Paolo Bonzini4-5/+5
Make them clearly architecture-dependent; the capability is valid for all architectures, but the argument is not. Signed-off-by: Paolo Bonzini <[email protected]>
2015-07-23KVM: vmx: obey KVM_QUIRK_CD_NW_CLEAREDXiao Guangrong1-1/+4
OVMF depends on WB to boot fast, because it only clears caches after it has set up MTRRs---which is too late. Let's do writeback if CR0.CD is set to make it happy, similar to what SVM is already doing. Signed-off-by: Xiao Guangrong <[email protected]> Tested-by: Alex Williamson <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]>
2015-07-23KVM: x86: introduce kvm_check_has_quirkPaolo Bonzini3-2/+7
The logic of the disabled_quirks field usually results in a double negation. Wrap it in a simple function that checks the bit and negates it. Based on a patch from Xiao Guangrong. Signed-off-by: Paolo Bonzini <[email protected]>
2015-07-23KVM: MTRR: simplify kvm_mtrr_get_guest_memory_typeXiao Guangrong1-9/+10
kvm_mtrr_get_guest_memory_type never returns -1 which is implied in the current code since if @type = -1 (means no MTRR contains the range), iter.partial_map must be true Simplify the code to indicate this fact Signed-off-by: Xiao Guangrong <[email protected]> Tested-by: Alex Williamson <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]>
2015-07-23KVM: MTRR: fix memory type handling if MTRR is completely disabledXiao Guangrong1-1/+20
Currently code uses default memory type if MTRR is fully disabled, fix it by using UC instead. Signed-off-by: Xiao Guangrong <[email protected]> Tested-by: Alex Williamson <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]>
2015-07-22mei: prevent unloading mei hw modules while the device is opened.Tomas Winkler1-1/+1
chrdev_open() increases reference counter on cdev->owner. Instead of assigning the owner to mei subsystem, the owner has to be set to the underlaying HW module (mei_me or mei_txe), so once the device is opened the HW module cannot be unloaded. Cc: <[email protected]> #3.17+ Signed-off-by: Tomas Winkler <[email protected]> Signed-off-by: Alexander Usyskin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-22misc: mic: scif bug fix for vmalloc_to_page crashSudeep Dutt1-10/+5
v4.2-rc1 enabled huge page support for ioremap(..). Calling vmalloc_to_page after v4.2-rc1 results in the crash shown below on the host upon booting X100 coprocessors: BUG: unable to handle kernel paging request at ffffc47c00000000 IP: [<ffffffff811a2c0c>] vmalloc_to_page+0x6c/0xb0 This patch fixes this crash by obtaining the fake struct page pointer which is required to be passed into dma_map_sg(..) by calling pfn_to_page(..) instead of vmalloc_to_page(..). Link: https://lkml.org/lkml/2015/7/18/110 Reviewed-by: Nikhil Rao <[email protected]> Suggested-by: Toshi Kani <[email protected]> Signed-off-by: Ashutosh Dixit <[email protected]> Signed-off-by: Sudeep Dutt <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-22parport: fix freeing freed memorySudip Mukherjee1-4/+4
After the reference count becomes 0 when put_device() is called, it will execute the release callback where we are freeing all the allocated memory associated with the device. So if we just continue on the error path then we are again freeing devname and trying to dereference par_dev which has already been free-ed in the release callback. Signed-off-by: Sudip Mukherjee <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-22parport: fix memory leakSudip Mukherjee1-0/+1
After the reference count becomes 0 when put_device() is called, it will execute the release callback where we are freeing all the allocated memory associated with the device. We missed freeing par_dev->state. Signed-off-by: Sudip Mukherjee <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-22parport: fix error handlingSudip Mukherjee1-1/+2
After registering the device if exclusive access fails for any reason then we need to unregister the device to remove all references. Signed-off-by: Sudip Mukherjee <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2015-07-22mnt: Clarify and correct the disconnect logic in umount_treeEric W. Biederman2-6/+31
rmdir mntpoint will result in an infinite loop when there is a mount locked on the mountpoint in another mount namespace. This is because the logic to test to see if a mount should be disconnected in umount_tree is buggy. Move the logic to decide if a mount should remain connected to it's mountpoint into it's own function disconnect_mount so that clarity of expression instead of terseness of expression becomes a virtue. When the conditions where it is invalid to leave a mount connected are first ruled out, the logic for deciding if a mount should be disconnected becomes much clearer and simpler. Fixes: e0c9c0afd2fc958ffa34b697972721d81df8a56f mnt: Update detach_mounts to leave mounts connected Fixes: ce07d891a0891d3c0d0c2d73d577490486b809e1 mnt: Honor MNT_LOCKED when detaching mounts Cc: [email protected] Signed-off-by: "Eric W. Biederman" <[email protected]>
2015-07-22Btrfs: fix quick exhaustion of the system array in the superblockFilipe Manana1-0/+18
Omar reported that after commit 4fbcdf669454 ("Btrfs: fix -ENOSPC when finishing block group creation"), introduced in 4.2-rc1, the following test was failing due to exhaustion of the system array in the superblock: #!/bin/bash truncate -s 100T big.img mkfs.btrfs big.img mount -o loop big.img /mnt/loop num=5 sz=10T for ((i = 0; i < $num; i++)); do echo fallocate $i $sz fallocate -l $sz /mnt/loop/testfile$i done btrfs filesystem sync /mnt/loop for ((i = 0; i < $num; i++)); do echo rm $i rm /mnt/loop/testfile$i btrfs filesystem sync /mnt/loop done umount /mnt/loop This made btrfs_add_system_chunk() fail with -EFBIG due to excessive allocation of system block groups. This happened because the test creates a large number of data block groups per transaction and when committing the transaction we start the writeout of the block group caches for all the new new (dirty) block groups, which results in pre-allocating space for each block group's free space cache using the same transaction handle. That in turn often leads to creation of more block groups, and all get attached to the new_bgs list of the same transaction handle to the point of getting a list with over 1500 elements, and creation of new block groups leads to the need of reserving space in the chunk block reserve and often creating a new system block group too. So that made us quickly exhaust the chunk block reserve/system space info, because as of the commit mentioned before, we do reserve space for each new block group in the chunk block reserve, unlike before where we would not and would at most allocate one new system block group and therefore would only ensure that there was enough space in the system space info to allocate 1 new block group even if we ended up allocating thousands of new block groups using the same transaction handle. That worked most of the time because the computed required space at check_system_chunk() is very pessimistic (assumes a chunk tree height of BTRFS_MAX_LEVEL/8 and that all nodes/leafs in a path will be COWed and split) and since the updates to the chunk tree all happen at btrfs_create_pending_block_groups it is unlikely that a path needs to be COWed more than once (unless writepages() for the btree inode is called by mm in between) and that compensated for the need of creating any new nodes/leads in the chunk tree. So fix this by ensuring we don't accumulate a too large list of new block groups in a transaction's handles new_bgs list, inserting/updating the chunk tree for all accumulated new block groups and releasing the unused space from the chunk block reserve whenever the list becomes sufficiently large. This is a generic solution even though the problem currently can only happen when starting the writeout of the free space caches for all dirty block groups (btrfs_start_dirty_block_groups()). Reported-by: Omar Sandoval <[email protected]> Signed-off-by: Filipe Manana <[email protected]> Tested-by: Omar Sandoval <[email protected]> Signed-off-by: Chris Mason <[email protected]>
2015-07-22btrfs: its btrfs_err() instead of btrfs_error()Anand Jain1-1/+1
sorry I indented to use btrfs_err() and I have no idea how btrfs_error() got there. infact I was thinking about these kind of oversights since these two func are too closely named. Signed-off-by: Anand Jain <[email protected]> Reviewed-by: Liu Bo <[email protected]> Reviewed-by: David Sterba <[email protected]> Signed-off-by: Chris Mason <[email protected]>
2015-07-22btrfs: Avoid NULL pointer dereference of free_extent_buffer when ↵Zhao Lei1-1/+2
read_tree_block() fail When read_tree_block() failed, we can see following dmesg: [ 134.371389] BUG: unable to handle kernel NULL pointer dereference at 0000000000000063 [ 134.372236] IP: [<ffffffff813a4a51>] free_extent_buffer+0x21/0x90 [ 134.372236] PGD 0 [ 134.372236] Oops: 0000 [#1] SMP [ 134.372236] Modules linked in: [ 134.372236] CPU: 0 PID: 2289 Comm: mount Not tainted 4.2.0-rc1_HEAD_c65b99f046843d2455aa231747b5a07a999a9f3d_+ #115 [ 134.372236] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 [ 134.372236] task: ffff88003b6e1a00 ti: ffff880011e60000 task.ti: ffff880011e60000 [ 134.372236] RIP: 0010:[<ffffffff813a4a51>] [<ffffffff813a4a51>] free_extent_buffer+0x21/0x90 ... [ 134.372236] Call Trace: [ 134.372236] [<ffffffff81379aa1>] free_root_extent_buffers+0x91/0xb0 [ 134.372236] [<ffffffff81379c3d>] free_root_pointers+0x17d/0x190 [ 134.372236] [<ffffffff813801b0>] open_ctree+0x1ca0/0x25b0 [ 134.372236] [<ffffffff8144d017>] ? disk_name+0x97/0xb0 [ 134.372236] [<ffffffff813558aa>] btrfs_mount+0x8fa/0xab0 ... Reason: read_tree_block() changed to return error number on fail, and this value(not NULL) is set to tree_root->node, then subsequent code will run to: free_root_pointers() ->free_root_extent_buffers() ->free_extent_buffer() ->atomic_read((extent_buffer *)(-E_XXX)->refs); and trigger above error. Fix: Set tree_root->node to NULL on fail to make error_handle code happy. Signed-off-by: Zhao Lei <[email protected]> Signed-off-by: Chris Mason <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.