Age | Commit message (Collapse) | Author | Files | Lines |
|
Use DMI_BOARD_NAME to determine if we are running on a MinnowBoard and
set the uart clock to 50MHz if so. This removes the need to pass the
user_uartclk to the kernel at boot time.
Signed-off-by: Darren Hart <[email protected]>
Cc: Jiri Slaby <[email protected]>
Cc: "H. Peter Anvin" <[email protected]>
Cc: Peter Waskiewicz <[email protected]>
Cc: Andy Shevchenko <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
This patch fixes the below 3 warnings running "make htmldocs",
by adding descriptions for recently added structure members:
DOCPROC Documentation/DocBook/device-drivers.xml
Warning(/work/git.free-electrons.com/users/michael-opdenacker/linux//include/linux/device.h:116): No description found for parameter 'lock_key'
Warning(/work/git.free-electrons.com/users/michael-opdenacker/linux//include/linux/device.h:723): No description found for parameter 'cma_area'
Warning(/work/git.free-electrons.com/users/michael-opdenacker/linux//include/linux/device.h:723): No description found for parameter 'iommu_group'
Don't hesitate to propose better descriptions!
Signed-off-by: Michael Opdenacker <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
This patch fixes another compiling warning with PM_SLEEP unset:
drivers/base/firmware_class.c:221:29: warning: 'fw_lookup_buf' defined
but not used [-Wunused-function]
This time I do build kernel with both PM_SLEEP set and unset, and no
warning found any more with the patch.
Reported-by: Stephen Rothwell <[email protected]>
Signed-off-by: Ming Lei <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
This eliminates having an #ifdef returning NULL for the case
when OF is disabled.
Signed-off-by: Sachin Kamat <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
commit 20d49e9ccfece526db755940721aa13e331936d4
(ARM: OMAP5: voltagedomain data: Add OMAP5 voltage domain data)
Introduced dummy volt data for OMAP5 with OMAP4460 voltage information.
However with the fixes introduced in later patches
commit cd8abed1da91a3250aa4b3857479613a2b446f84
(ARM: OMAP2+: Powerdomain: Remove the need to always have a voltdm
associated to a pwrdm)
We are no longer restricted in that respect. Further, OPP voltage
information is supposed to be provided by dts information. This needs
to be added in future patches as various voltage modules are converted
to dts.
This also fixes the build breakage for voltagedomains54xx_data.c when just
OMAP5 SoC is enabled: https://patchwork.kernel.org/patch/2764191/
Reported-by: Arnd Bergmann <[email protected]>
Signed-off-by: Nishanth Menon <[email protected]>
Cc: Benoit Cousson <[email protected]>
Cc: Santosh Shilimkar <[email protected]>
Cc: Paul Walmsley <[email protected]>
Cc: Tony Lindgren <[email protected]>
Cc: [email protected]
Signed-off-by: Kevin Hilman <[email protected]>
|
|
When the EEH error is the result of a fenced host bridge, MMIO accesses
can be very slow (milliseconds) to timeout and return all 1's,
thus causing the driver various timeout loops to take way too long and
trigger soft-lockup warnings (in addition to taking minutes to recover).
It might be worthwhile to check if for any of these cases, ffffffff is
a valid possible value, and if not, bail early since that means the HW
is either gone or isolated. In the meantime, checking that the PCI channel
is offline would be workaround of the problem.
Cc: <[email protected]> # v3.0+
Signed-off-by: Gavin Shan <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
it does not compile since 09fc7d ("usb: musb: fix incorrect usage of
resource pointer"). What makes me wonder most is if source of the
Tested-by tag :)
Acked-by: Felipe Balbi <[email protected]>
Signed-off-by: Sebastian Andrzej Siewior <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
commit ea1418b5f1a (usb: chipidea: i.MX: use devm_usb_get_phy_by_phandle to get
phy) causes the USB host to miss the disconnect/connect events.
In order to reproduce this problem:
- Insert a USB thumb into the USB host port (connection is detected)
- Remove it (no disconnect event will be reported)
- Insert the USB thumb again (connection is not detected)
Fix this problem by accessing the usb_phy structure using the private data
instead of accessing a local structure.
Tested on a mx28evk board.
Signed-off-by: Fabio Estevam <[email protected]>
Acked-by: Peter Chen <[email protected]>
Signed-off-by: Alexander Shishkin <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
This patch adds missing unlocks on error paths in the
xhci_free_streams and xhci_configure_endpoint functions.
Signed-off-by: Emil Goode <[email protected]>
Signed-off-by: Sarah Sharp <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
We should check the return value of ipv6_get_lladdr in inet6_set_iftoken.
A possible situation, which could leave ll_addr unassigned is, when
the user removed her link-local address but a global scoped address was
already set. In this case the interface would still be IF_READY and not
dead. In that case the RS source address is some value from the stack.
v2: Daniel Borkmann noted a small indent inconstancy; no semantic
changes.
Cc: Daniel Borkmann <[email protected]>
Acked-by: Daniel Borkmann <[email protected]>
Reviewed-by: Flavio Leitner <[email protected]>
Signed-off-by: Hannes Frederic Sowa <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
get user pages might fail partially in macvtap zero copy
mode. To recover we need to put all pages that we got,
but code used a wrong index resulting in double-free
errors.
Reported-by: Brad Hubbard <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Acked-by: Jason Wang <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
get user pages might fail partially in tun zero copy
mode. To recover we need to put all pages that we got,
but code used a wrong index resulting in double-free
errors.
Reported-by: Brad Hubbard <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Acked-by: Jason Wang <[email protected]>
Acked-by: Neil Horman <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
commit 68c331631143 ("v4 GRE: Add TCP segmentation offload for GRE")
added a possible skb leak, because it frees only the head of segment
list, in case a skb_linearize() call fails.
This patch adds a kfree_skb_list() helper to fix the bug.
Signed-off-by: Eric Dumazet <[email protected]>
Cc: Pravin B Shelar <[email protected]>
Cc: Daniel Borkmann <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
John W. Linville says:
====================
A few more late-breaking fixes hoping for 3.10...
Regarding the Bluetooth fix, Gustavo says:
"A important fix to 3.10, this patch fixes an issues that was preventing
the l2cap info response command to be handled properly."
Also for that Bluetooth fix, Johan adds:
"Once the code gives up parsing this PDU it also gives up essential
parts of the L2CAP connection creation process, i.e. without this
patch the stack will fail to establish connections properly."
Moving onto ath9k, Felix Fietkau fixes an RCU locking issue in
the transmit path. As for ath9k_htc, Sujith Manoharan fixes some
authentication timeouts by ensuring that a chip reset is done when
IDLE is turned off.
I think these are all micro-fixes that shouldn't cause any trouble.
Please let me know if there are problems!
====================
Signed-off-by: David S. Miller <[email protected]>
|
|
Router Alert option is marked in skb.
Previously, IP6CB(skb)->ra was set to positive value for such packets.
Since commit dd3332bf ("ipv6: Store Router Alert option in IP6CB
directly."), IP6SKB_ROUTERALERT is set in IP6CB(skb)->flags, and
the value of Router Alert option (in network byte order) is set
to IP6CB(skb)->ra for such packets.
Multicast forwarding path uses that flag and value, but unicast
forwarding path does not use the flag and misuses IP6CB(skb)->ra
value.
Signed-off-by: YOSHIFUJI Hideaki <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Avoid waking up every thread sleeping in a futex_wait call during
suspend and resume by calling a freezable blocking call. Previous
patches modified the freezer to avoid sending wakeups to threads
that are blocked in freezable blocking calls.
This call was selected to be converted to a freezable call because
it doesn't hold any locks or release any resources when interrupted
that might be needed by another freezing task or a kernel driver
during suspend, and is a common site where idle userspace tasks are
blocked.
Signed-off-by: Colin Cross <[email protected]>
Cc: Rafael J. Wysocki <[email protected]>
Cc: [email protected]
Cc: Tejun Heo <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: Darren Hart <[email protected]>
Cc: Randy Dunlap <[email protected]>
Cc: Al Viro <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Thomas Gleixner <[email protected]>
|
|
The futex_keys of process shared futexes are generated from the page
offset, the mapping host and the mapping index of the futex user space
address. This should result in an unique identifier for each futex.
Though this is not true when futexes are located in different subpages
of an hugepage. The reason is, that the mapping index for all those
futexes evaluates to the index of the base page of the hugetlbfs
mapping. So a futex at offset 0 of the hugepage mapping and another
one at offset PAGE_SIZE of the same hugepage mapping have identical
futex_keys. This happens because the futex code blindly uses
page->index.
Steps to reproduce the bug:
1. Map a file from hugetlbfs. Initialize pthread_mutex1 at offset 0
and pthread_mutex2 at offset PAGE_SIZE of the hugetlbfs
mapping.
The mutexes must be initialized as PTHREAD_PROCESS_SHARED because
PTHREAD_PROCESS_PRIVATE mutexes are not affected by this issue as
their keys solely depend on the user space address.
2. Lock mutex1 and mutex2
3. Create thread1 and in the thread function lock mutex1, which
results in thread1 blocking on the locked mutex1.
4. Create thread2 and in the thread function lock mutex2, which
results in thread2 blocking on the locked mutex2.
5. Unlock mutex2. Despite the fact that mutex2 got unlocked, thread2
still blocks on mutex2 because the futex_key points to mutex1.
To solve this issue we need to take the normal page index of the page
which contains the futex into account, if the futex is in an hugetlbfs
mapping. In other words, we calculate the normal page mapping index of
the subpage in the hugetlbfs mapping.
Mappings which are not based on hugetlbfs are not affected and still
use page->index.
Thanks to Mel Gorman who provided a patch for adding proper evaluation
functions to the hugetlbfs code to avoid exposing hugetlbfs specific
details to the futex code.
[ tglx: Massaged changelog ]
Signed-off-by: Zhang Yi <[email protected]>
Reviewed-by: Jiang Biao <[email protected]>
Tested-by: Ma Chenggong <[email protected]>
Reviewed-by: 'Mel Gorman' <[email protected]>
Acked-by: 'Darren Hart' <[email protected]>
Cc: 'Peter Zijlstra' <[email protected]>
Cc: [email protected]
Link: http://lkml.kernel.org/r/000101ce71a6%24a83c5880%24f8b50980%24@com
Signed-off-by: Thomas Gleixner <[email protected]>
|
|
* pm-fixes:
cpufreq: fix NULL pointer deference at od_set_powersave_bias()
|
|
* acpi-fixes:
libata-acpi: add back ACPI based hotplug functionality
ACPI / dock / PCI: Synchronous handling of dock events for PCI devices
PCI / ACPI: Use boot-time resource allocation rules during hotplug
ACPI / dock: Initialize ACPI dock subsystem upfront
|
|
From Srinivas Kandagatla <[email protected]>:
This patch-set adds basic support for STMicroelectronics STi series SOCs
which includes STiH415 and STiH416 with B2000 and B2020 board support.
STiH415 and STiH416 are dual-core ARM Cortex-A9 CPU, designed for
use in Set-top-boxes. The SOC support is available in mach-sti which
contains support code for STiH415, STiH416 SOCs including the generic
board support.
The reason for adding two SOCs at this patch set is to show that no new
C code is required for second SOC(STiH416) support.
* sti/soc:
ARM: stih41x: Add B2020 board support
ARM: stih41x: Add B2000 board support
ARM: sti: Add DEBUG_LL console support
ARM: sti: Add STiH416 SOC support
ARM: sti: Add STiH415 SOC support
Signed-off-by: Olof Johansson <[email protected]>
|
|
From Daniel Tang <[email protected]>
This is the initial platform code for the TI-Nspire graphing
calculators. The platform support is rather unspectacular, but still
contains platform data for the LCD panel, which will get removed once
there is a DT binding for the AMBA CLCD driver.
* nspire/soc:
arm: Add Initial TI-Nspire support
arm: Add device trees for TI-Nspire hardware
Signed-off-by: Olof Johansson <[email protected]>
|
|
B2020 ADI board is reference board for STIH415/416 SOCs, it has 2 x
UART, 4x USB, 1 x Ethernet, 1 x SATA, 1 x PCIe, and 2GB RAM with
standard set-top box IPs.
This patch adds initial support to B2020 with STiH415/416 with SBC_UART1
as console and a heard beat LED.
Signed-off-by: Srinivas Kandagatla <[email protected]>
CC: Stephen Gallimore <[email protected]>
CC: Stuart Menefy <[email protected]>
CC: Arnd Bergmann <[email protected]>
Signed-off-by: Srinivas Kandagatla <[email protected]>
Signed-off-by: Olof Johansson <[email protected]>
|
|
B2000 board is reference board for STIH415/416 SOCs, it has
2 x UART, 4x USB, 2 x Ethernet, 1 x SATA, 1 x PCIe, and 1GB RAM.
This patch add initial support to b2000 with STiH415/416 with UART2 as
console and a heard beat LED.
Signed-off-by: Srinivas Kandagatla <[email protected]>
CC: Stephen Gallimore <[email protected]>
CC: Arnd Bergmann <[email protected]>
Signed-off-by: Olof Johansson <[email protected]>
|
|
When initializing the default powersave_bias value, we need to first
make sure that this policy is running the ondemand governor.
Reported-and-tested-by: Tim Gardner <[email protected]>
Signed-off-by: Jacob Shin <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
This patch adds low level debug uart support to sti based SOCs.
Signed-off-by: Srinivas Kandagatla <[email protected]>
CC: Arnd Bergmann <[email protected]>
Signed-off-by: Olof Johansson <[email protected]>
|
|
The STiH416 is advanced HD AVC processor with 3D graphics acceleration
and 1.2-GHz ARM Cortex-A9 SMP CPU.
Signed-off-by: Srinivas Kandagatla <[email protected]>
CC: Stephen Gallimore <[email protected]>
CC: Stuart Menefy <[email protected]>
CC: Arnd Bergmann <[email protected]>
CC: Linus Walleij <[email protected]>
Signed-off-by: Srinivas Kandagatla <[email protected]>
Signed-off-by: Olof Johansson <[email protected]>
|
|
The STiH415 is the next generation of HD, AVC set-top box processors for
satellite, cable, terrestrial and IP-STB markets. It is an ARM Cortex-A9
1.0 GHz, dual-core CPU.
Signed-off-by: Srinivas Kandagatla <[email protected]>
CC: Stephen Gallimore <[email protected]>
CC: Stuart Menefy <[email protected]>
CC: Arnd Bergmann <[email protected]>
CC: Linus Walleij <[email protected]>
Signed-off-by: Srinivas Kandagatla <[email protected]>
Signed-off-by: Olof Johansson <[email protected]>
|
|
rbd_dev_v2_header_onetime() fetches striping information, and
checks whether the image can be read by compariing the stripe unit
to the object size. It determines the object size by shifting
the object order, which is 0 at this point since it has not been
read yet. Move the call to get the image size and object order
before rbd_dev_v2_header_onetime() so it is set before use.
Signed-off-by: Josh Durgin <[email protected]>
Reviewed-by: Sage Weil <[email protected]>
|
|
fcoe_xmit was coded such that it would skip the vlan net device/layer
and instead set some vlan flags and transmit on the real net device.
The real net device has code that would add the vlan tag for fcoe skbs.
This avoids some extra processing for data frames and provides a small
performance improvement.
Since fcoe_xmit was not using the vlan net device, __vlan_put_tag
within the real net device's xmit routine was ultimately being
called to set the vlan tag.
With the below change the behavior of __vlan_put_tag changed slightly,
it now sets the skb->protocol = vlan_proto. vlan_proto was not a field
being set by fcoe_xmit, so the skb->protocol is now not being set to
ETH_P_8021Q, as it should be.
This patch converts fcoe_xmit to use the vlan_put_tag routine which
will tag the skb and fcoe will continue to transmit fcoe skbs on the
real net device.
For reference, the below change was the one that altered the
__vlan_put_tag behavior.
commit 86a9bad3ab6b6f858fd4443b48738cabbb6d094c
Author: Patrick McHardy <[email protected]>
Date: Fri Apr 19 02:04:30 2013 +0000
net: vlan: add protocol argument to packet tagging functions
Add a protocol argument to the VLAN packet tagging functions. In case of HW
tagging, we need that protocol available in the ndo_start_xmit functions,
so it is stored in a new field in the skb. The new field fits into a hole
(on 64 bit) and doesn't increase the sks's size.
Signed-off-by: Robert Love <[email protected]>
Acked-by: Neil Horman <[email protected]>
Acked-by: John Fastabend <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Martin Schwidefsky:
"A couple of last-minute fixes: a build regression for !SMP, a recent
memory detection patch caused kdump to break, a regression in regard
to sscanf vs reboot from FCP, and two fixes in the DMA mapping code
for PCI"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/ipl: Fix FCP WWPN and LUN format strings for read
s390/mem_detect: fix memory hole handling
s390/dma: support debug_dma_mapping_error
s390/dma: fix mapping_error detection
s390/irq: Only define synchronize_irq() on SMP
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
Pull powerpc bugfix from Ben Herrenschmidt:
"This is a fix for a regression causing a freescale "83xx" based
platforms to crash on boot due to some PCI breakage"
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc/pci: Fix boot panic on mpc83xx (regression)
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse
Pull fuse bugfix from Miklos Szeredi:
"This fixes a race between fallocate() and truncate()"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
fuse: hold i_mutex in fuse_file_fallocate()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson into next/drivers
From Linus Walleij:
DMA40 fixes for earlier submitted driver patches:
- Fix various error path and sparse bugs in the DMA40 driver
- Fix various compile errors in the ux500 crypto driver
(dependent on the DMA40 changes).
* tag 'ux500-dma40-for-arm-soc-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson:
crypto: ux500: use dmaengine_submit API
crypto: ux500: use dmaengine_prep_slave_sg API
crypto: ux500: use dmaengine_device_control API
crypto: ux500/crypt: add missing __iomem qualifiers
crypto: ux500/hash: add missing static qualifiers
crypto: ux500/hash: use readl on iomem addresses
dmaengine: ste_dma40: Declare memcpy config as static
dmaengine: ste_dma40: fix error return code in d40_probe()
Signed-off-by: Olof Johansson <[email protected]>
|
|
tegra_pmc_parse_dt() references __initconst data. Fix it to be __init.
This matches its only usage; a call from tegra_pmc_init() which is
already __init. This fixes:
WARNING: vmlinux.o(.text.unlikely+0x580): Section mismatch in reference
from the function tegra_pmc_parse_dt() to the (unknown reference)
.init.rodata:(unknown)
Signed-off-by: Stephen Warren <[email protected]>
Signed-off-by: Olof Johansson <[email protected]>
|
|
Log an error message if the dlm user daemon exits
before all the lockspaces have been removed.
Signed-off-by: David Teigland <[email protected]>
|
|
for NUL terminated string, need alway set '\0' in the end.
Signed-off-by: Zhao Hongjiang <[email protected]>
Signed-off-by: David Teigland <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
|
|
into next/fixes-non-critical
From Jason Cooper:
- mv78260: catch missing fix for mvneta register length
* tag 'fixes-non-3.11-2' of git://git.infradead.org/users/jcooper/linux:
ARM: mvebu: fix length of ethernet registers in mv78260 dtsi
Signed-off-by: Olof Johansson <[email protected]>
|
|
The SOC interrupt controller driver for the Abilis Systems TB10x series of
SOCs based on ARC700 CPUs.
Signed-off-by: Christian Ruppert <[email protected]>
Signed-off-by: Pierrick Hascoet <[email protected]>
Cc: Vineet Gupta <[email protected]>
Cc: Grant Likely <[email protected]>
Cc: Rob Herring <[email protected]>
Cc: Rob Landley <[email protected]>
Cc: [email protected]
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Thomas Gleixner <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into next/late
From Kukjin Kim, this adds pinctrl support for Exynos 5420.
* tag 'soc-exynos5420-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
pinctrl: exynos: add exynos5420 SoC specific data
ARM: dts: add pinctrl support to EXYNOS5420
Signed-off-by: Olof Johansson <[email protected]>
|
|
Use dmaengine_submit instead of calling desc->tx_submit manually.
Signed-off-by: Fabio Baltieri <[email protected]>
Acked-by: Herbert Xu <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
|
|
Use dmaengine_prep_slave_sg inline function instead of going through the
structures manually.
Signed-off-by: Fabio Baltieri <[email protected]>
Acked-by: Herbert Xu <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
|
|
Use dmaengine_device_control inline function instead of going through the
structures manually.
Signed-off-by: Fabio Baltieri <[email protected]>
Acked-by: Herbert Xu <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
|
|
Add missing __iomem to struct cryp_register pointers, this solve some
"incorrect type in initializer (different address spaces)" sparse
warnings.
Signed-off-by: Fabio Baltieri <[email protected]>
Acked-by: Herbert Xu <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
|
|
Add missing static qualifiers to hash_process_data and hash_hw_final.
Signed-off-by: Fabio Baltieri <[email protected]>
Acked-by: Herbert Xu <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
|
|
Always use readl when reading memory mapped registers.
Signed-off-by: Fabio Baltieri <[email protected]>
Acked-by: Herbert Xu <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
|
|
On Thu, Jun 20, 2013 at 10:00:21AM +0200, Daniel Borkmann wrote:
> After having fixed a NULL pointer dereference in SCTP 1abd165e ("net:
> sctp: fix NULL pointer dereference in socket destruction"), I ran into
> the following NULL pointer dereference in the crypto subsystem with
> the same reproducer, easily hit each time:
>
> BUG: unable to handle kernel NULL pointer dereference at (null)
> IP: [<ffffffff81070321>] __wake_up_common+0x31/0x90
> PGD 0
> Oops: 0000 [#1] SMP
> Modules linked in: padlock_sha(F-) sha256_generic(F) sctp(F) libcrc32c(F) [..]
> CPU: 6 PID: 3326 Comm: cryptomgr_probe Tainted: GF 3.10.0-rc5+ #1
> Hardware name: Dell Inc. PowerEdge T410/0H19HD, BIOS 1.6.3 02/01/2011
> task: ffff88007b6cf4e0 ti: ffff88007b7cc000 task.ti: ffff88007b7cc000
> RIP: 0010:[<ffffffff81070321>] [<ffffffff81070321>] __wake_up_common+0x31/0x90
> RSP: 0018:ffff88007b7cde08 EFLAGS: 00010082
> RAX: ffffffffffffffe8 RBX: ffff88003756c130 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff88003756c130
> RBP: ffff88007b7cde48 R08: 0000000000000000 R09: ffff88012b173200
> R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000282
> R13: ffff88003756c138 R14: 0000000000000000 R15: 0000000000000000
> FS: 0000000000000000(0000) GS:ffff88012fc60000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> CR2: 0000000000000000 CR3: 0000000001a0b000 CR4: 00000000000007e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> Stack:
> ffff88007b7cde28 0000000300000000 ffff88007b7cde28 ffff88003756c130
> 0000000000000282 ffff88003756c128 ffffffff81227670 0000000000000000
> ffff88007b7cde78 ffffffff810722b7 ffff88007cdcf000 ffffffff81a90540
> Call Trace:
> [<ffffffff81227670>] ? crypto_alloc_pcomp+0x20/0x20
> [<ffffffff810722b7>] complete_all+0x47/0x60
> [<ffffffff81227708>] cryptomgr_probe+0x98/0xc0
> [<ffffffff81227670>] ? crypto_alloc_pcomp+0x20/0x20
> [<ffffffff8106760e>] kthread+0xce/0xe0
> [<ffffffff81067540>] ? kthread_freezable_should_stop+0x70/0x70
> [<ffffffff815450dc>] ret_from_fork+0x7c/0xb0
> [<ffffffff81067540>] ? kthread_freezable_should_stop+0x70/0x70
> Code: 41 56 41 55 41 54 53 48 83 ec 18 66 66 66 66 90 89 75 cc 89 55 c8
> 4c 8d 6f 08 48 8b 57 08 41 89 cf 4d 89 c6 48 8d 42 e
> RIP [<ffffffff81070321>] __wake_up_common+0x31/0x90
> RSP <ffff88007b7cde08>
> CR2: 0000000000000000
> ---[ end trace b495b19270a4d37e ]---
>
> My assumption is that the following is happening: the minimal SCTP
> tool runs under ``echo 1 > /proc/sys/net/sctp/auth_enable'', hence
> it's making use of crypto_alloc_hash() via sctp_auth_init_hmacs().
> It forks itself, heavily allocates, binds, listens and waits in
> accept on sctp sockets, and then randomly kills some of them (no
> need for an actual client in this case to hit this). Then, again,
> allocating, binding, etc, and then killing child processes.
>
> The problem that might be happening here is that cryptomgr requests
> the module to probe/load through cryptomgr_schedule_probe(), but
> before the thread handler cryptomgr_probe() returns, we return from
> the wait_for_completion_interruptible() function and probably already
> have cleared up larval, thus we run into a NULL pointer dereference
> when in cryptomgr_probe() complete_all() is being called.
>
> If we wait with wait_for_completion() instead, this panic will not
> occur anymore. This is valid, because in case a signal is pending,
> cryptomgr_probe() returns from probing anyway with properly calling
> complete_all().
The use of wait_for_completion_interruptible is intentional so that
we don't lock up the thread if a bug causes us to never wake up.
This bug is caused by the helper thread using the larval without
holding a reference count on it. If the helper thread completes
after the original thread requesting for help has gone away and
destroyed the larval, then we get the crash above.
So the fix is to hold a reference count on the larval.
Cc: <[email protected]> # 3.6+
Reported-by: Daniel Borkmann <[email protected]>
Tested-by: Daniel Borkmann <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>
|
|
Use irq_get_trigger_type() to get the IRQ trigger type flags
instead calling irqd_get_trigger_type(irq_desc_get_irq_data(virq))
Signed-off-by: Javier Martinez Canillas <[email protected]>
Acked-by: Grant Likely <[email protected]>
Cc: Linus Walleij <[email protected]>
Cc: Samuel Ortiz <[email protected]>
Cc: Jason Cooper <[email protected]>
Cc: Andrew Lunn <[email protected]>
Cc: Russell King <[email protected]>
Cc: Ralf Baechle <[email protected]>
Cc: Benjamin Herrenschmidt <[email protected]>
Cc: [email protected]
Cc: [email protected]
Link: http://lkml.kernel.org/r/1371228049-27080-8-git-send-email-javier.martinez@collabora.co.uk
Signed-off-by: Thomas Gleixner <[email protected]>
|
|
Use irq_get_trigger_type() to get the IRQ trigger type flags
instead calling irqd_get_trigger_type(irq_desc_get_irq_data(irq))
Signed-off-by: Javier Martinez Canillas <[email protected]>
Acked-by: David Daney <[email protected]>
Cc: Grant Likely <[email protected]>
Cc: Linus Walleij <[email protected]>
Cc: Samuel Ortiz <[email protected]>
Cc: Jason Cooper <[email protected]>
Cc: Andrew Lunn <[email protected]>
Cc: Russell King <[email protected]>
Cc: Ralf Baechle <[email protected]>
Cc: Benjamin Herrenschmidt <[email protected]>
Cc: [email protected]
Cc: [email protected]
Link: http://lkml.kernel.org/r/1371228049-27080-7-git-send-email-javier.martinez@collabora.co.uk
Signed-off-by: Thomas Gleixner <[email protected]>
|
|
Use irq_get_trigger_type() to get the IRQ trigger type flags
instead calling irqd_get_trigger_type(irq_get_irq_data(irq))
Signed-off-by: Javier Martinez Canillas <[email protected]>
Cc: Grant Likely <[email protected]>
Cc: Linus Walleij <[email protected]>
Cc: Samuel Ortiz <[email protected]>
Acked-by: Jason Cooper <[email protected]>
Cc: Andrew Lunn <[email protected]>
Cc: Russell King <[email protected]>
Cc: Ralf Baechle <[email protected]>
Cc: Benjamin Herrenschmidt <[email protected]>
Cc: [email protected]
Cc: [email protected]
Link: http://lkml.kernel.org/r/1371228049-27080-6-git-send-email-javier.martinez@collabora.co.uk
Signed-off-by: Thomas Gleixner <[email protected]>
|