aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-04-04Merge tag 'usb-4.0-rc6' of ↵Linus Torvalds6-5/+26
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes and new device ids for 4.0-rc6. Nothing major, some xhci fixes for reported problems, and some usb-serial device ids. All have been in linux-next for a while" * tag 'usb-4.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: ftdi_sio: Use jtag quirk for SNAP Connect E10 usb: isp1760: fix spin unlock in the error path of isp1760_udc_start usb: xhci: apply XHCI_AVOID_BEI quirk to all Intel xHCI controllers usb: xhci: handle Config Error Change (CEC) in xhci driver USB: keyspan_pda: add new device id USB: ftdi_sio: Added custom PID for Synapse Wireless product
2015-04-04Merge tag 'staging-4.0-rc6' of ↵Linus Torvalds17-91/+132
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some staging driver fixes, well, really all just IIO driver fixes, for 4.0-rc6. They fix issues that have been reported with these drivers. All of these patches have been in linux-next for a while" * tag 'staging-4.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: iio: imu: Use iio_trigger_get for indio_dev->trig assignment iio: adc: vf610: use ADC clock within specification iio/adc/cc10001_adc.c: Fix !HAS_IOMEM build iio: core: Fix double free. iio:inv-mpu6050: Fix inconsistency for the scale channel staging: iio: dummy: Fix undefined symbol build error iio: inv_mpu6050: Clear timestamps fifo while resetting hardware fifo staging: iio: hmc5843: Set iio name property in sysfs iio: bmc150: change sampling frequency iio: fix drivers that check buffer->scan_mask
2015-04-04Merge tag 'tty-4.0-rc6' of ↵Linus Torvalds2-0/+6
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are 3 serial driver fixes for 4.0-rc6. They fix some reported issues with the samsung and fsl_lpuart drivers. All have been in linux-next for a while" * tag 'tty-4.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: serial: fsl_lpuart: clear receive flag on FIFO flush tty: serial: fsl_lpuart: specify transmit FIFO size serial: samsung: Clear operation mode on UART shutdown
2015-04-04ALSA: usb-audio: don't try to get Benchmark DAC1 sample rateEric Wong1-2/+7
Adding this quirk allows us to avoid the noisy "cannot get freq at ep 0x1" message in dmesg output every time playback starts. This ought to affect other Benchmark DAC1 variations using the same "Microchip Technology, Inc." chip as well, but I have only tested with the "Pre" variant. Signed-off-by: Eric Wong <[email protected]> Cc: Joe Turner <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-04-04ALSA: hda/realtek - Support Dell headset mode for ALC256Kailang Yang1-0/+16
Dell new platform of ALC256 audio codec. Support headset mode for Dell ALC256 platform. Signed-off-by: Kailang Yang <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-04-03Merge branch 'for-linus' of ↵Linus Torvalds5-10/+26
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input subsystem fixes from Dmitry Torokhov: "A fix for ALPS driver for issue introduced in the latest update and a tweak for yet another Lenovo box in Synaptics. There will be more ALPS tweaks coming.." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: define INPUT_PROP_ACCELEROMETER behavior Input: synaptics - fix min-max quirk value for E440 Input: synaptics - add quirk for Thinkpad E440 Input: ALPS - fix max coordinates for v5 and v7 protocols Input: add MT_TOOL_PALM
2015-04-03Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds3-3/+15
Pull block layer fix from Jens Axboe: "Just one patch in this pull request, fixing a regression caused by a 'mathematically correct' change to lcm()" * 'for-linus' of git://git.kernel.dk/linux-block: block: fix blk_stack_limits() regression due to lcm() change
2015-04-03Merge branch 'x86-urgent-for-linus' of ↵Linus Torvalds5-20/+35
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: a SYSRET single-stepping fix, a dmi-scan robustization fix, a reboot quirk and a kgdb fixlet" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: kgdb/x86: Fix reporting of 'si' in kgdb on x86_64 x86/asm/entry/64: Disable opportunistic SYSRET if regs->flags has TF set x86/reboot: Add ASRock Q1900DC-ITX mainboard reboot quirk MAINTAINERS: Change the x86 microcode loader maintainer firmware: dmi_scan: Prevent dmi_num integer overflow
2015-04-03Merge branch 'perf-urgent-for-linus' of ↵Linus Torvalds1-5/+5
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Two x86 Intel PMU constraint handling fixes" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Fix Haswell CYCLE_ACTIVITY.* counter constraints perf/x86/intel: Filter branches for PEBS event
2015-04-03Merge tag 'devicetree-for-linus' of ↵Linus Torvalds1-3/+8
git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux Pull devicetree fix from Grant Likely: "Simple bugfix for bad device tree data on the PA-Semi platform" * tag 'devicetree-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux: drivers/of: Add empty ranges quirk for PA-Semi
2015-04-03Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds7-12/+32
Pull CIFS fixes from Steve French: "A set of small cifs fixes fixing a memory leak, kernel oops, and infinite loop (and some spotted by Coverity)" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: Fix warning Fix another dereference before null check warning CIFS: session servername can't be null Fix warning on impossible comparison Fix coverity warning Fix dereference before null check warning Don't ignore errors on encrypting password in SMBTcon Fix warning on uninitialized buftype cifs: potential memory leaks when parsing mnt opts cifs: fix use-after-free bug in find_writable_file cifs: smb2_clone_range() - exit on unhandled error
2015-04-03netns: don't allocate an id for dead netnsNicolas Dichtel1-1/+3
First, let's explain the problem. Suppose you have an ipip interface that stands in the netns foo and its link part in the netns bar (so the netns bar has an nsid into the netns foo). Now, you remove the netns bar: - the bar nsid into the netns foo is removed - the netns exit method of ipip is called, thus our ipip iface is removed: => a netlink message is built in the netns foo to advertise this deletion => this netlink message requests an nsid for bar, thus a new nsid is allocated for bar and never removed. This patch adds a check in peernet2id() so that an id cannot be allocated for a netns which is currently destroyed. Signed-off-by: Nicolas Dichtel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-04-03Revert "netns: don't clear nsid too early on removal"Nicolas Dichtel1-15/+9
This reverts commit 4217291e592d ("netns: don't clear nsid too early on removal"). This is not the right fix, it introduces races. Signed-off-by: Nicolas Dichtel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-04-03cpuidle: ACPI: do not overwrite name and description of C0Thomas Schlichter1-1/+1
Fix a bug that leads to showing the name and description of C-state C0 as "<null>" in sysfs after the ACPI C-states changed (e.g. after AC->DC or DC->AC transition). The function poll_idle_init() in drivers/cpuidle/driver.c initializes the state 0 during cpuidle_register_driver(), so we better do not overwrite it again with '\0' during acpi_processor_cst_has_changed(). Signed-off-by: Thomas Schlichter <[email protected]> Reviewed-by: Bartlomiej Zolnierkiewicz <[email protected]> Cc: 3.13+ <[email protected]> # 3.13+ Signed-off-by: Rafael J. Wysocki <[email protected]>
2015-04-03cpuidle: remove state_count field from struct cpuidle_deviceBartlomiej Zolnierkiewicz3-6/+3
Thomas Schlichter reports the following issue on his Samsung NC20: "The C-states C1 and C2 to the OS when connected to AC, and additionally provides the C3 C-state when disconnected from AC. However, the number of C-states shown in sysfs is fixed to the number of C-states present at boot. If I boot with AC connected, I always only see the C-states up to C2 even if I disconnect AC. The reason is commit 130a5f692425 (ACPI / cpuidle: remove dev->state_count setting). It removes the update of dev->state_count, but sysfs uses exactly this variable to show the C-states. The fix is to use drv->state_count in sysfs. As this is currently the last user of dev->state_count, this variable can be completely removed." Remove dev->state_count as per the above. Reported-by: Thomas Schlichter <[email protected]> Signed-off-by: Bartlomiej Zolnierkiewicz <[email protected]> Signed-off-by: Kyungmin Park <[email protected]> Acked-by: Daniel Lezcano <[email protected]> Cc: 3.14+ <[email protected]> # 3.14+ [ rjw: Changelog ] Signed-off-by: Rafael J. Wysocki <[email protected]>
2015-04-03cpufreq: Schedule work for the first-online CPU on resumeViresh Kumar1-8/+11
All CPUs leaving the first-online CPU are hotplugged out on suspend and and cpufreq core stops managing them. On resume, we need to call cpufreq_update_policy() for this CPU's policy to make sure its frequency is in sync with cpufreq's cached value, as it might have got updated by hardware during suspend/resume. The policies are always added to the top of the policy-list. So, in normal circumstances, CPU 0's policy will be the last one in the list. And so the code checks for the last policy. But there are cases where it will fail. Consider quad-core system, with policy-per core. If CPU0 is hotplugged out and added back again, the last policy will be on CPU1 :( To fix this in a proper way, always look for the policy of the first online CPU. That way we will be sure that we are calling cpufreq_update_policy() for the only CPU that wasn't hotplugged out. Cc: 3.15+ <[email protected]> # 3.15+ Fixes: 2f0aea936360 ("cpufreq: suspend governors on system suspend/hibernate") Reported-by: Saravana Kannan <[email protected]> Signed-off-by: Viresh Kumar <[email protected]> Acked-by: Saravana Kannan <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2015-04-02ip6mr: call del_timer_sync() in ip6mr_free_table()WANG Cong1-1/+1
We need to wait for the flying timers, since we are going to free the mrtable right after it. Cc: Hannes Frederic Sowa <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-04-02net: move fib_rules_unregister() under rtnl lockWANG Cong6-5/+8
We have to hold rtnl lock for fib_rules_unregister() otherwise the following race could happen: fib_rules_unregister(): fib_nl_delrule(): ... ... ... ops = lookup_rules_ops(); list_del_rcu(&ops->list); list_for_each_entry(ops->rules) { fib_rules_cleanup_ops(ops); ... list_del_rcu(); list_del_rcu(); } Note, net->rules_mod_lock is actually not needed at all, either upper layer netns code or rtnl lock guarantees we are safe. Cc: Alexander Duyck <[email protected]> Cc: Thomas Graf <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-04-02ipv4: take rtnl_lock and mark mrt table as freed on namespace cleanupWANG Cong1-0/+5
This is the IPv4 part for commit 905a6f96a1b1 (ipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanup). Cc: Hannes Frederic Sowa <[email protected]> Acked-by: Hannes Frederic Sowa <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-04-02Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds14-29/+58
Pull drm fixes from Dave Airlie: "One drm core fix, one exynos regression fix, two sets of radeon fixes (Alex was a bit behind last week), and two i915 fixes. Nothing too serious we seem to have calmed down i915 since last week" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/radeon: fix wait in radeon_mn_invalidate_range_start drm/radeon: add extra check in radeon_ttm_tt_unpin_userptr drm: Exynos: Respect framebuffer pitch for FIMD/Mixer drm/i915: Reject the colorkey ioctls for primary and cursor planes drm/i915: Skip allocating shadow batch for 0-length batches drm/radeon: programm the VCE fw BAR as well drm/radeon: always dump the ring content if it's available radeon: Do not directly dereference pointers to BIOS area. drm/radeon/dpm: fix 120hz handling harder drm/edid: set ELD for firmware and debugfs override EDIDs
2015-04-02Merge tag 'irqchip-fixes-4.0-2' of git://git.infradead.org/users/jcooper/linuxLinus Torvalds2-9/+65
Pull irqchip fixes from Jason Cooper: "This is the second round of fixes for irqchip. It contains some fixes found while the arm64 guys were writing the kvm gicv3 its emulation. GICv3 ITS: - Small batch of fixes discovered while writing the kvm ITS emulation" * tag 'irqchip-fixes-4.0-2' of git://git.infradead.org/users/jcooper/linux: irqchip: gicv3-its: Use non-cacheable accesses when no shareability irqchip: gicv3-its: Fix PROP/PEND and BASE/CBASE confusion irqchip: gicv3-its: Fix device ID encoding irqchip: gicv3-its: Fix encoding of collection's target redistributor
2015-04-03Merge branch 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie2-7/+8
into drm-fixes Just two small fixes for radeon, both destined for stable. * 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: fix wait in radeon_mn_invalidate_range_start drm/radeon: add extra check in radeon_ttm_tt_unpin_userptr
2015-04-03Merge branch 'exynos-drm-fixes' of ↵Dave Airlie2-10/+15
git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes Fix display on issue to Exynos5250 based Snow(1366x768) board. * 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos: drm: Exynos: Respect framebuffer pitch for FIMD/Mixer
2015-04-03Merge tag 'drm-intel-fixes-2015-04-02' of ↵Dave Airlie2-3/+3
git://anongit.freedesktop.org/drm-intel into drm-fixes one oops fixes and a 0-length allocation fix from next backported. * tag 'drm-intel-fixes-2015-04-02' of git://anongit.freedesktop.org/drm-intel: drm/i915: Reject the colorkey ioctls for primary and cursor planes drm/i915: Skip allocating shadow batch for 0-length batches
2015-04-03Merge tag 'topic/drm-fixes-2015-04-02' of ↵Dave Airlie2-0/+2
git://anongit.freedesktop.org/drm-intel into drm-fixes Here's a single drm core fix, cc: stable, that affects i915 users. * tag 'topic/drm-fixes-2015-04-02' of git://anongit.freedesktop.org/drm-intel: drm/edid: set ELD for firmware and debugfs override EDIDs
2015-04-02[media] rtl28xxu: return success for unimplemented FE callbackAntti Palosaari1-2/+0
Return success for FE callback on case we don't have any special implementation. fc0013 tuner driver calls that callback in order to switch antenna input, even we don't provide antenna switch. Returning error caused fc0013 driver given up tuning. Signed-off-by: Antti Palosaari <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2015-04-02[media] rtl2832: disable regmap register cacheAntti Palosaari1-1/+1
Caching register reads causes some random I/O errors on channel change. Disable caching now in order to avoid those errors. Reverts partly commit dcadb82 Signed-off-by: Antti Palosaari <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2015-04-02Merge tag 'stable/for-linus-4.0-rc6-tag' of ↵Linus Torvalds3-1/+49
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen regression fixes from David Vrabel: "Fix two regressions in the balloon driver's use of memory hotplug when used in a PV guest" * tag 'stable/for-linus-4.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/balloon: before adding hotplugged memory, set frames to invalid x86/xen: prepare p2m list for memory hotplug
2015-04-02Merge tag 'powerpc-4.0-4' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux Pull powerpc fix from Michael Ellerman: "Fix memory corruption by pnv_alloc_idle_core_states" * tag 'powerpc-4.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux: powerpc: fix memory corruption by pnv_alloc_idle_core_states
2015-04-02tcp: fix FRTO undo on cumulative ACK of SACKed rangeNeal Cardwell1-3/+4
On processing cumulative ACKs, the FRTO code was not checking the SACKed bit, meaning that there could be a spurious FRTO undo on a cumulative ACK of a previously SACKed skb. The FRTO code should only consider a cumulative ACK to indicate that an original/unretransmitted skb is newly ACKed if the skb was not yet SACKed. The effect of the spurious FRTO undo would typically be to make the connection think that all previously-sent packets were in flight when they really weren't, leading to a stall and an RTO. Signed-off-by: Neal Cardwell <[email protected]> Signed-off-by: Yuchung Cheng <[email protected]> Fixes: e33099f96d99c ("tcp: implement RFC5682 F-RTO") Signed-off-by: David S. Miller <[email protected]>
2015-04-02Merge tag 'rdma-for-linus' of ↵Linus Torvalds1-0/+8
git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband Pull infiniband/rdma fix from Roland Dreier: "Fix for exploitable integer overflow in uverbs interface" * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic
2015-04-02xen-netfront: transmit fully GSO-sized packetsJonathan Davies1-4/+1
xen-netfront limits transmitted skbs to be at most 44 segments in size. However, GSO permits up to 65536 bytes, which means a maximum of 45 segments of 1448 bytes each. This slight reduction in the size of packets means a slight loss in efficiency. Since c/s 9ecd1a75d, xen-netfront sets gso_max_size to XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER, where XEN_NETIF_MAX_TX_SIZE is 65535 bytes. The calculation used by tcp_tso_autosize (and also tcp_xmit_size_goal since c/s 6c09fa09d) in determining when to split an skb into two is sk->sk_gso_max_size - 1 - MAX_TCP_HEADER. So the maximum permitted size of an skb is calculated to be (XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER) - 1 - MAX_TCP_HEADER. Intuitively, this looks like the wrong formula -- we don't need two TCP headers. Instead, there is no need to deviate from the default gso_max_size of 65536 as this already accommodates the size of the header. Currently, the largest skb transmitted by netfront is 63712 bytes (44 segments of 1448 bytes each), as observed via tcpdump. This patch makes netfront send skbs of up to 65160 bytes (45 segments of 1448 bytes each). Similarly, the maximum allowable mtu does not need to subtract MAX_TCP_HEADER as it relates to the size of the whole packet, including the header. Fixes: 9ecd1a75d977 ("xen-netfront: reduce gso_max_size to account for max TCP header") Signed-off-by: Jonathan Davies <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-04-02Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dmaLinus Torvalds5-1/+19
Pull dmaengine fixes from Vinod Koul: "This time we have addition of caps for jz4740 which fixes intentional warning at boot. Then we have memory leak issues in drivers using virt-dma by Peter on few drive" * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: moxart-dma: Fix memory leak when stopping a running transfer dmaengine: bcm2835-dma: Fix memory leak when stopping a running transfer dmaengine: omap-dma: Fix memory leak when terminating running transfer dmaengine: edma: fix memory leak when terminating running transfers dmaengine: jz4740: Define capabilities
2015-04-02Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds66-391/+758
Pull networking fixes from David Miller: 1) Fix use-after-free with mac80211 RX A-MPDU reorder timer, from Johannes Berg. 2) iwlwifi leaks memory every module load/unload cycles, fix from Larry Finger. 3) Need to use for_each_netdev_safe() in rtnl_group_changelink() otherwise we can crash, from WANG Cong. 4) mlx4 driver does register_netdev() too early in the probe sequence, from Ido Shamay. 5) Don't allow router discovery hop limit to decrease the interface's hop limit, from D.S. Ljungmark. 6) tx_packets and tx_bytes improperly accounted for certain classes of USB network devices, fix from Ben Hutchings. 7) ip{6}mr_rules_init() mistakenly use plain kfree to release the ipmr tables in the error path, they must instead use ip{6}mr_free_table(). Fix from WANG Cong. 8) cxgb4 doesn't properly quiesce all RX activity before unregistering the netdevice. Fix from Hariprasad Shenai. 9) Fix hash corruptions in ipvlan driver, from Jiri Benc. 10) nla_memcpy(), like a real memcpy, should fully initialize the destination buffer, even if the source attribute is smaller. Fix from Jiri Benc. 11) Fix wrong error code returned from iucv_sock_sendmsg(). We should use whatever sock_alloc_send_skb() put into 'err'. From Eugene Crosser. 12) Fix slab object leak on module unload in TIPC, from Ying Xue. 13) Need a READ_ONCE() when reading the cached RX socket route in tcp_v{4,6}_early_demux(). From Michal Kubecek. 14) Still too many problems with TPC support in the ath9k driver, so disable it for now. From Felix Fietkau. 15) When in AP mode the rtlwifi driver can leak DMA mappings, fix from Larry Finger. 16) Missing kzalloc() failure check in gs_usb CAN driver, from Colin Ian King. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits) cxgb4: Fix to dump devlog, even if FW is crashed cxgb4: Firmware macro changes for fw verison 1.13.32.0 bnx2x: Fix kdump when iommu=on bnx2x: Fix kdump on 4-port device mac80211: fix RX A-MPDU session reorder timer deletion MAINTAINERS: Update Intel Wired Ethernet Driver info tipc: fix a slab object leak net/usb/r8152: add device id for Lenovo TP USB 3.0 Ethernet af_iucv: fix AF_IUCV sendmsg() errno openvswitch: Return vport module ref before destruction netlink: pad nla_memcpy dest buffer with zeroes bonding: Bonding Overriding Configuration logic restored. ipvlan: fix check for IP addresses in control path ipvlan: do not use rcu operations for address list ipvlan: protect against concurrent link removal ipvlan: fix addr hash list corruption net: fec: setup right value for mdio hold time net: tcp6: fix double call of tcp_v6_fill_cb() cxgb4vf: Fix sparse warnings netns: don't clear nsid too early on removal ...
2015-04-02IB/uverbs: Prevent integer overflow in ib_umem_get address arithmeticShachar Raindel1-0/+8
Properly verify that the resulting page aligned end address is larger than both the start address and the length of the memory area requested. Both the start and length arguments for ib_umem_get are controlled by the user. A misbehaving user can provide values which will cause an integer overflow when calculating the page aligned end address. This overflow can cause also miscalculation of the number of pages mapped, and additional logic issues. Addresses: CVE-2014-8159 Cc: <[email protected]> Signed-off-by: Shachar Raindel <[email protected]> Signed-off-by: Jack Morgenstein <[email protected]> Signed-off-by: Or Gerlitz <[email protected]> Signed-off-by: Roland Dreier <[email protected]>
2015-04-02perf/x86/intel: Fix Haswell CYCLE_ACTIVITY.* counter constraintsAndi Kleen1-3/+3
Some of the CYCLE_ACTIVITY.* events can only be scheduled on counter 2. Due to a typo Haswell matched those with INTEL_EVENT_CONSTRAINT, which lead to the events never matching as the comparison does not expect anything in the umask too. Fix the typo. Signed-off-by: Andi Kleen <[email protected]> Signed-off-by: Peter Zijlstra (Intel) <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
2015-04-02perf/x86/intel: Filter branches for PEBS eventKan Liang1-2/+2
For supporting Intel LBR branches filtering, Intel LBR sharing logic mechanism is introduced from commit b36817e88630 ("perf/x86: Add Intel LBR sharing logic"). It modifies __intel_shared_reg_get_constraints() to config lbr_sel, which is finally used to set LBR_SELECT. However, the intel_shared_regs_constraints() function is called after intel_pebs_constraints(). The PEBS event will return immediately after intel_pebs_constraints(). So it's impossible to filter branches for PEBS events. This patch moves intel_shared_regs_constraints() ahead of intel_pebs_constraints(). We can safely do that because the intel_shared_regs_constraints() function only returns empty constraint if its rejecting the event, otherwise it returns NULL such that we continue calling intel_pebs_constraints() and x86_get_event_constraint(). Signed-off-by: Kan Liang <[email protected]> Signed-off-by: Peter Zijlstra (Intel) <[email protected]> Cc: [email protected] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
2015-04-02drm/radeon: fix wait in radeon_mn_invalidate_range_startChristian König1-7/+4
We need to wait for all fences, not just the exclusive one. Signed-off-by: Christian König <[email protected]> Cc: <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2015-04-02drm/radeon: add extra check in radeon_ttm_tt_unpin_userptrChristian König1-0/+4
We somehow try to free the SG table twice. Bugs: https://bugs.freedesktop.org/show_bug.cgi?id=89734 Signed-off-by: Christian König <[email protected]> Cc: <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2015-04-02drm: Exynos: Respect framebuffer pitch for FIMD/MixerDaniel Stone2-10/+15
When performing a modeset, use the framebuffer pitch value to set FIMD IMG_SIZE and Mixer SPAN registers. These are both defined as pitch - the distance between contiguous lines (bytes for FIMD, pixels for mixer). Fixes display on Snow (1366x768). Signed-off-by: Daniel Stone <[email protected]> Tested-by: Javier Martinez Canillas <[email protected]> Signed-off-by: Inki Dae <[email protected]>
2015-04-02[media] vb2: Fix dma_dir setting for dma-contig mem typeSakari Ailus1-2/+1
The last argument of vb2_dc_get_user_pages() is of type enum dma_data_direction, but the caller, vb2_dc_get_userptr() passes a value which is the result of comparison dma_dir == DMA_FROM_DEVICE. This results in the write parameter to get_user_pages() being zero in all cases, i.e. that the caller has no intent to write there. This was broken by patch "vb2: replace 'write' by 'dma_dir'". Signed-off-by: Sakari Ailus <[email protected]> Cc: [email protected] # for v3.19 Acked-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2015-04-02kgdb/x86: Fix reporting of 'si' in kgdb on x86_64Steffen Liebergeld1-1/+1
This patch fixes an error in kgdb for x86_64 which would report the value of dx when asked to give the value of si. Signed-off-by: Steffen Liebergeld <[email protected]> Cc: Jason Wessel <[email protected]> Cc: [email protected] Signed-off-by: Ingo Molnar <[email protected]>
2015-04-02x86/asm/entry/64: Disable opportunistic SYSRET if regs->flags has TF setAndy Lutomirski1-1/+15
When I wrote the opportunistic SYSRET code, I missed an important difference between SYSRET and IRET. Both instructions are capable of setting EFLAGS.TF, but they behave differently when doing so: - IRET will not issue a #DB trap after execution when it sets TF. This is critical -- otherwise you'd never be able to make forward progress when returning to userspace. - SYSRET, on the other hand, will trap with #DB immediately after returning to CPL3, and the next instruction will never execute. This breaks anything that opportunistically SYSRETs to a user context with TF set. For example, running this code with TF set and a SIGTRAP handler loaded never gets past 'post_nop': extern unsigned char post_nop[]; asm volatile ("pushfq\n\t" "popq %%r11\n\t" "nop\n\t" "post_nop:" : : "c" (post_nop) : "r11"); In my defense, I can't find this documented in the AMD or Intel manual. Fix it by using IRET to restore TF. Signed-off-by: Andy Lutomirski <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Brian Gerst <[email protected]> Cc: Denys Vlasenko <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Thomas Gleixner <[email protected]> Fixes: 2a23c6b8a9c4 ("x86_64, entry: Use sysret to return to userspace when possible") Link: http://lkml.kernel.org/r/9472f1ca4c19a38ecda45bba9c91b7168135fcfa.1427923514.git.luto@kernel.org Signed-off-by: Ingo Molnar <[email protected]>
2015-04-02drm/i915: Reject the colorkey ioctls for primary and cursor planesVille Syrjälä1-2/+2
The legcy colorkey ioctls are only implemented for sprite planes, so reject the ioctl for primary/cursor planes. If we want to support colorkeying with these planes (assuming we have hw support of course) we should just move ahead with the colorkey property conversion. Testcase: kms_legacy_colorkey Cc: Tommi Rantala <[email protected]> Cc: [email protected] Reference: http://mid.gmane.org/CA+ydwtr+bCo7LJ44JFmUkVRx144UDFgOS+aJTfK6KHtvBDVuAw@mail.gmail.com Reported-and-tested-by: Tommi Rantala <[email protected]> Signed-off-by: Ville Syrjälä <[email protected]> Reviewed-by: Daniel Vetter <[email protected]> Signed-off-by: Jani Nikula <[email protected]>
2015-04-01target: Allow userspace to write 1 to attrib/emulate_fua_writeAndy Grover1-2/+2
Before 4.0, reading attrib/emulate_fua_write has returned 1. Saved configs created on a pre-4.0 kernel will try to write that back when restoring LIO configuration. This should succeed with no effect, and issue a warning. See https://bugzilla.redhat.com/show_bug.cgi?id=1206184 Reported-by: Yanko Kaneti <[email protected]> Reported-by: Juan Quintela <[email protected]> Signed-off-by: Andy Grover <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>
2015-04-01Merge tag 'wireless-drivers-for-davem-2015-04-01' of ↵David S. Miller1-0/+1
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== iwlwifi: * fix a memory leak, we leaked memory each time the module was loaded. ==================== Signed-off-by: David S. Miller <[email protected]>
2015-04-01Merge branch 'cxgb4-net'David S. Miller6-32/+106
Hariprasad Shenai says: ==================== cxgb4 FW macro changes for new FW Fix to dump device log even in the case of firmware crash. Also incorporates changes for new FW. This patch series has been created against net tree and includes patches on cxgb4 driver. We have included all the maintainers of respective drivers. Kindly review the change and let us know in case of any review comments. ==================== Signed-off-by: David S. Miller <[email protected]>
2015-04-01cxgb4: Fix to dump devlog, even if FW is crashedHariprasad Shenai4-26/+65
Add new Common Code routines to retrieve Firmware Device Log parameters from PCIE_FW_PF[7]. The firmware initializes its Device Log very early on and stores the parameters for its location/size in that register. Using the parameters from the register allows us to access the Firmware Device Log even when the firmware crashes very early on or we're not attached to the firmware Based on original work by Casey Leedom <[email protected]> Signed-off-by: Hariprasad Shenai <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-04-01cxgb4: Firmware macro changes for fw verison 1.13.32.0Hariprasad Shenai2-6/+41
Adds new macro and few macro changes for fw version 1.13.32.0 also changes version string in driver to match 1.13.32.0 Signed-off-by: Hariprasad Shenai <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-04-01Merge tag 'mac80211-for-davem-2015-04-01' of ↵David S. Miller3-5/+12
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== This contains just a single fix for a crash I happened to randomly run into today during testing. It's clearly been around for a while, but is pretty hard to trigger, even when I tried explicitly (and modified the code to make it more likely) it rarely did. ==================== Signed-off-by: David S. Miller <[email protected]>