aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-03-24Merge tag 'vfio-v4.11-rc4' of git://github.com/awilliam/linux-vfioLinus Torvalds1-3/+5
Pull VFIO fix from Alex Williamson: "Rework sanity check for mdev driver group notifier de-registration (Alex Williamson)" * tag 'vfio-v4.11-rc4' of git://github.com/awilliam/linux-vfio: vfio: Rework group release notifier warning
2017-03-24Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds7-71/+82
Pull block fixes from Jens Axboe: "A few fixes for the current series that should go into -rc4. This contains: - a fix for a potential corruption of un-started requests from Ming. - a blk-stat fix from Omar, ensuring we flush the stat batch before checking nr_samples. - a set of fixes from Sagi for the nvmeof family" * 'for-linus' of git://git.kernel.dk/linux-block: blk-mq: don't complete un-started request in timeout handler nvme-loop: handle cpu unplug when re-establishing the controller nvme-rdma: handle cpu unplug when re-establishing the controller nvmet-rdma: Fix a possible uninitialized variable dereference nvmet: confirm sq percpu has scheduled and switched to atomic nvme-loop: fix a possible use-after-free when destroying the admin queue blk-stat: fix blk_stat_sum() if all samples are batched
2017-03-24Merge tag 'ceph-for-4.11-rc4' of git://github.com/ceph/ceph-clientLinus Torvalds1-0/+6
Pull ceph fix from Ilya Dryomov: "A fix for a writeback deadlock caused by a GFP_KERNEL allocation on the reclaim path, tagged for stable" * tag 'ceph-for-4.11-rc4' of git://github.com/ceph/ceph-client: libceph: force GFP_NOIO for socket allocations
2017-03-24Merge tag 'armsoc-fixes' of ↵Linus Torvalds30-241/+122
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Arnd Bergmann: - a couple of OMAP 4.11 regression fixes, including a boot regression for SmartReflex, hypervisor mode in thumb2 mode, and reference counting of device nodes - a fix for cpu_idle on at91 - minor DT fixes on across several platforms: sunxi, bcm53xx, at91, nsp, ns2, ux500, omap - a fix to correct an API change in the reset controllers * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (22 commits) arm64: dts: NS2: Add dma-coherent to relevant DT entries reset: fix optional reset_control_get stubs to return NULL ARM: sun8i: a23/a33: drop bl_en_pin GPIO pinmux in reference design DTSI ARM: dts: sun7i: lamobo-r1: Fix CPU port RGMII settings ARM: dts: NSP: GPIO reboot open-source ARM: at91: pm: cpu_idle: switch DDR to power-down mode ARM: dts: add the AB8500 clocks to the device tree ARM: dts: imx6sx-udoo-neo: Fix reboot hang ARM: sun8i: Fix the mali clock rate ARM: dts: BCM5301X: Correct GIC_PPI interrupt flags ARM: dts: BCM5301X: Fix memory start address ARM: dts: BCM5301X: Fix UARTs on bcm953012k Revert "ARM: at91/dt: sama5d2: Use new compatible for ohci node" ARM: OMAP2+: Release device node after it is no longer needed. ARM: OMAP2+: Fix device node reference counts ARM: OMAP2+: Remove legacy gpmc-nand.c ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure ARM: dts: am335x-pcm953: Fix legacy wakeup source binding ARM: omap2plus_defconfig: Enable INPUT_MOUSEDEV as loadable modules ARM: dts: am57xx-idk: tpic2810 is on I2C bus, not SPI ...
2017-03-24Merge tag 'for-linus-4.11b-rc4-tag' of ↵Linus Torvalds1-9/+27
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Fixes for PM under Xen" * tag 'for-linus-4.11b-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/acpi: upload PM state from init-domain to Xen xen/acpi: Replace hard coded "ACPI0007"
2017-03-24Merge tag 'arm64-fixes' of ↵Linus Torvalds4-5/+19
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "There's a kaslr fix and then two patches to update our native and compat syscall tables. Arnd asked that we take the addition of statx to the asm-generic unistd.h via arm64, as he didn't have anything queued in the asm-generic tree. Summary: - Fix mapping of kernel image under certain kaslr offsets - Hook up new statx syscall in asm-generic syscall table - Update compat syscall table to match arch/arm/ (pkeys and statx)" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: kaslr: Fix up the kernel image alignment arm64: compat: Update compat syscalls generic syscalls: Wire up statx syscall
2017-03-24Merge branch 'linus' of ↵Linus Torvalds5-25/+75
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes regressions in the crypto ccp driver and the hwrng drivers for amd and geode" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: hwrng: geode - Revert managed API changes hwrng: amd - Revert managed API changes crypto: ccp - Assign DMA commands to the channel's CCP
2017-03-24infiniband: Fix alignment of mmap cookies to support VIPT cachingJason Gunthorpe2-4/+4
When vmalloc_user is used to create memory that is supposed to be mmap'd to user space, it is necessary for the mmap cookie (eg the offset) to be aligned to SHMLBA. This creates a situation where all virtual mappings of the same physical page share the same virtual cache index and guarantees VIPT coherence. Otherwise the cache is non-coherent and the kernel will not see writes by userspace when reading the shared page (or vice-versa). Reported-by: Josh Beavers <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2017-03-24Revert "e1000e: driver trying to free already-free irq"Jeff Kirsher1-1/+1
This reverts commit 7e54d9d063fa239c95c21548c5267f0ef419ff56. After additional regression testing, several users are experiencing kernel panics during shutdown on e1000e devices. Reverting this change resolves the issue. Signed-off-by: Jeff Kirsher <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24Merge tag 'iommu-fixes-v4.11-rc3' of ↵Linus Torvalds10-19/+41
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: "A few fixes piled up: - fix a NULL-ptr dereference that happens in VT-d on some platforms - a fix for ARM MSI region reporting, so that a sane interface makes it to a released kernel - fixes for leaf-checking in ARM io-page-table code - two fixes for IO/TLB flushing code on ARM Exynos platforms" * tag 'iommu-fixes-v4.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu: Disambiguate MSI region types iommu/exynos: Workaround FLPD cache flush issues for SYSMMU v5 iommu/exynos: Block SYSMMU while invalidating FLPD cache iommu/vt-d: Fix NULL pointer dereference in device_to_iommu iommu/io-pgtable-arm-v7s: Check for leaf entry before dereferencing it iommu/io-pgtable-arm: Check for leaf entry before dereferencing it
2017-03-24IB/core: Protect against self-requeue of a cq work itemSagi Grimberg1-1/+1
We need to make sure that the cq work item does not run when we are destroying the cq. Unlike flush_work, cancel_work_sync protects against self-requeue of the work item (which we can do in ib_cq_poll_work). Signed-off-by: Sagi Grimberg <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Reviewed-by: Bart Van Assche <[email protected]>-- Reviewed-by: Leon Romanovsky <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2017-03-24Merge tag 'mmc-v4.11-rc2' of ↵Linus Torvalds9-18/+41
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull mmc fixes from Ulf Hansson: "Here are a couple of mmc fixes intended for v4.11 rc4. MMC core: - Fix initialization of HS400-ES eMMC cards - A couple of fixes for the mmc block device driver - Resolved a compiler warning MMC host: - sdhci: Do not disable IRQs while waiting for clock - sdhci-pci: Do not disable IRQs in sdhci_intel_set_power - sdhci-of-arasan: Fix incorrect timeout clock - mediatek: Fix bug for setting wrong clock frequency - sdhci-of-at91: Use regulator to fix cmd timeout errors - ushc: Fix NULL-deref at probe - rockchip-dw-mshc: Rename RK1108 to RV1108 in DT" * tag 'mmc-v4.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-pci: Do not disable interrupts in sdhci_intel_set_power mmc: sdhci: Do not disable interrupts while waiting for clock mmc: ushc: fix NULL-deref at probe mmc: sdhci-of-at91: Support external regulators mmc: core: mmc_blk_rw_cmd_err - remove unused variable mmc: mediatek: Fixed bug where clock frequency could be set wrong mmc: block: Fix cmd error reset failure path mmc: block: Fix is_waiting_last_req set incorrectly mmc: core: Fix access to HS400-ES devices mmc: sdhci-of-arasan: fix incorrect timeout clock dt-bindings: rockchip-dw-mshc: rename RK1108 to RV1108
2017-03-24ARC: vdk: Fix support of UIOAlexey Brodkin1-7/+13
MotherBoard section has its "ranges" set to 0xE000_0000-0xF000_0000. But UIO node maps 4 different areas in different memory locations and all outside MB's ranges. That obviously breaks UIO mappings in runtime. Cc: Ruud Derwig <[email protected]> Cc: [email protected] Signed-off-by: Alexey Brodkin <[email protected]> Signed-off-by: Vineet Gupta <[email protected]>
2017-03-24Merge tag 'media/v4.11-3' of ↵Linus Torvalds4-14/+14
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - dvb-usb-firmware: don't do DMA on stack - coda/imx-vdoa: platform_driver should not be const - bdisp: Clean up file handle in open() error path - exynos-gsc: Do not swap cb/cr for semi planar formats * tag 'media/v4.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] exynos-gsc: Do not swap cb/cr for semi planar formats [media] bdisp: Clean up file handle in open() error path [media] coda/imx-vdoa: platform_driver should not be const [media] dvb-usb-firmware: don't do DMA on stack
2017-03-24i40iw: Receive netdev events post INET_NOTIFIER stateShiraz Saleem1-0/+8
Netdev notification events are de-registered only when all client iwdev instances are removed. If a single client is closed and re-opened, netdev events could arrive even before the Control Queue-Pair (CQP) is created, causing a NULL pointer dereference crash in i40iw_get_cqp_request. Fix this by allowing netdev event notification only after we have reached the INET_NOTIFIER state with respect to device initialization. Reported-by: Stefan Assmann <[email protected]> Signed-off-by: Shiraz Saleem <[email protected]> Reviewed-by: Yuval Shaia <[email protected]> Signed-off-by: Doug Ledford <[email protected]>
2017-03-24Merge tag 'drm-fixes-for-v4.11-rc4' of ↵Linus Torvalds53-414/+559
git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: - one core drm/fbdev regression fix - a set of i915 fixes including a few GVT related fixes, along with some reset fixes - one new PCI id for amdgpu, and some minor workaround regression fixes - .. and a set of exynos fixes, dropping support for an old unsupported SoC, some vblank timing fixes, and an info leak fix * tag 'drm-fixes-for-v4.11-rc4' of git://people.freedesktop.org/~airlied/linux: (34 commits) drm/fb-helper: Allow var->x/yres(_virtual) < fb->width/height again drm/i915: make context status notifier head be per engine drm/i915: Avoid rcu_barrier() from reclaim paths (shrinker) drm/exynos/dsi: make te-gpios optional drm/exynos: Print kernel pointers in a restricted form drm/exynos/decon5433: fix software trigger mask drm/exynos/fimd: signal frame done interrupt at front porch drm/exynos/decon5433: signal frame done interrupt at front porch drm/exynos/decon5433: fix vblank event handling drm/exynos: move crtc event handling to drivers callbacks drm/exynos: Remove support for Exynos4415 (SoC not supported anymore) drm/exynos/decon5433: & vs | typo drm/amd/amdgpu: add POLARIS12 PCI ID drm/i915/gvt: Fix gvt scheduler interval time drm/i915/gvt: GVT pin/unpin shadow context drm/i915/gvt: scan shadow indirect context image when valid drm/i915/kvmgt: fix suspicious rcu dereference usage drm/i915/gvt: add enable_execlists check before enable gvt drm/i915/gvt: Remove bogus retry around i915_wait_request drm/i915/gvt: correct the ggtt valid bit check in pipe control command ...
2017-03-24kcm: return immediately after copy_from_user() failureWANG Cong1-3/+3
There is no reason to continue after a copy_from_user() failure. Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") Cc: Tom Herbert <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24bna: avoid writing uninitialized data into hw registersArnd Bergmann1-3/+7
The latest gcc-7 snapshot warns about bfa_ioc_send_enable/bfa_ioc_send_disable writing undefined values into the hardware registers: drivers/net/ethernet/brocade/bna/bfa_ioc.c: In function 'bfa_iocpf_sm_disabling_entry': arch/arm/include/asm/io.h:109:22: error: '*((void *)&disable_req+4)' is used uninitialized in this function [-Werror=uninitialized] arch/arm/include/asm/io.h:109:22: error: '*((void *)&disable_req+8)' is used uninitialized in this function [-Werror=uninitialized] The two functions look like they should do the same thing, but only one of them initializes the time stamp and clscode field. The fact that we only get a warning for one of the two functions seems to be arbitrary, based on the inlining decisions in the compiler. To address this, I'm making both functions do the same thing: - set the clscode from the ioc structure in both - set the time stamp from ktime_get_real_seconds (which also avoids the signed-integer overflow in 2038 and extends the well-defined behavior until 2106). - zero-fill the reserved field Fixes: 8b230ed8ec96 ("bna: Brocade 10Gb Ethernet device driver") Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24Merge branch 's390-net'David S. Miller5-18/+17
Ursula Braun says: ==================== s390/qeth patches for net here are 2 s390/qeth patches built for net fixing a problem with AF_IUCV traffic through HiperSockets. And we come up with an update for the MAINTAINERS file to establish Julian as Co-Maintainer for drivers/s390/net and net/iucv. ==================== Signed-off-by: David S. Miller <[email protected]>
2017-03-24MAINTAINERS: add Julian WiedmannUrsula Braun1-0/+2
Add Julian Wiedmann as additional maintainer for drivers/s390/net and net/iucv. Signed-off-by: Ursula Braun <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24s390/qeth: no ETH header for outbound AF_IUCVJulian Wiedmann1-11/+4
With AF_IUCV traffic, the skb passed to hard_start_xmit() has a 14 byte slot at skb->data, intended for an ETH header. qeth_l3_fill_af_iucv_hdr() fills this ETH header... and then immediately moves it to the skb's headroom, where it disappears and is never seen again. But it's still possible for us to return NETDEV_TX_BUSY after the skb has been modified. Since we didn't get a private copy of the skb, the next time the skb is delivered to hard_start_xmit() it no longer has the expected layout (we moved the ETH header to the headroom, so skb->data now starts at the IUCV_TRANS header). So when qeth_l3_fill_af_iucv_hdr() does another round of rebuilding, the resulting qeth header ends up all wrong. On transmission, the buffer is then rejected by the HiperSockets device with SBALF15 = x'04'. When this error is passed back to af_iucv as TX_NOTIFY_UNREACHABLE, it tears down the offending socket. As the ETH header for AF_IUCV serves no purpose, just align the code to what we do for IP traffic on L3 HiperSockets: keep the ETH header at skb->data, and pass down data_offset = ETH_HLEN to qeth_fill_buffer(). When mapping the payload into the SBAL elements, the ETH header is then stripped off. This avoids the skb manipulations in qeth_l3_fill_af_iucv_hdr(), and any buffer re-entering hard_start_xmit() after NETDEV_TX_BUSY is now processed properly. Signed-off-by: Julian Wiedmann <[email protected]> Signed-off-by: Ursula Braun <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24s390/qeth: size calculation outbound buffersJulian Wiedmann4-7/+11
Depending on the device type, hard_start_xmit() builds different output buffer formats. For instance with HiperSockets, on both L2 and L3 we strip the ETH header from the skb - L3 doesn't need it, and L2 carries it in the buffer's header element. For this, we pass data_offset = ETH_HLEN all the way down to __qeth_fill_buffer(), where skb->data is then adjusted accordingly. But the initial size calculation still considers the *full* skb length (including the ETH header). So qeth_get_elements_no() can erroneously reject a skb as too big, even though it would actually fit into an output buffer once the ETH header has been trimmed off later. Fix this by passing an additional offset to qeth_get_elements_no(), that indicates where in the skb the on-wire data actually begins. Since the current code uses data_offset=-1 for some special handling on OSA, we need to clamp data_offset to 0... On HiperSockets this helps when sending ~MTU-size skbs with weird page alignment. No change for OSA or AF_IUCV. Signed-off-by: Julian Wiedmann <[email protected]> Signed-off-by: Ursula Braun <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24Merge branch 'aquantia-fixes'David S. Miller6-10/+30
Pavel Belous says: ==================== net:ethernet:aquantia: Misc fixes for atlantic driver. The following patchset containg several fixes for aQuantia AQtion driver for net tree: A couple fixes for IPv6 and other fixes. v1->v2: Fix compilation error (using HW_ATL_A0_TXD_CTL_CMD_IPV6 instead HW_ATL_B0_TXD_CTL_CMD_IPV6). v2->v3: Added "Fixes" tags. ==================== Signed-off-by: David S. Miller <[email protected]>
2017-03-24net:ethernet:aquantia: Reset is_gso flag when EOP reached.Pavel Belous2-0/+2
We need to reset is_gso flag when EOP reached (entire LSO packet processed). Fixes: bab6de8fd180 ("net: ethernet: aquantia: Atlantic A0 and B0 specific functions.") Signed-off-by: Pavel Belous <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24net:ethernet:aquantia: Fix for LSO with IPv6.Pavel Belous4-1/+11
Fix Context Command bit: L3 type = "0" for IPv4, "1" for IPv6. Fixes: bab6de8fd180 ("net: ethernet: aquantia: Atlantic A0 and B0 specific functions.") Signed-off-by: Pavel Belous <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24net:ethernet:aquantia: Missing spinlock initialization.Pavel Belous1-0/+1
Fix for missing initialization aq_ring header.lock spinlock. Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code") Signed-off-by: Pavel Belous <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24net:ethernet:aquantia: Fix packet type detection (TCP/UDP) for IPv6.Pavel Belous1-4/+16
In order for the checksum offloads to work correctly we need to set the packet type bit (TCP/UDP) in the TX context buffer. Fixes: 97bde5c4f909 ("net: ethernet: aquantia: Support for NIC-specific code") Signed-off-by: Pavel Belous <[email protected]> Tested-by: David Arcari <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24net:ethernet:aquantia: Remove adapter re-opening when MTU changed.Pavel Belous1-5/+0
Closing/opening the adapter is not needed at all. The new MTU settings take effect immediately. Fixes: 97bde5c4f909 ("net: ethernet: aquantia: Support for NIC-specific code") Signed-off-by: Pavel Belous <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24r8152: prevent the driver from transmitting packets with carrier offhayeswang1-2/+16
The linking status may be changed when autosuspend. And, after autoresume, the driver may try to transmit packets when the device is carrier off, because the interrupt transfer doesn't update the linking status, yet. And, if the device is in ALDPS mode, the device would stop working. The another similar case is 1. unplug the cable. 2. interrupt transfer queue a work_queue for linking change. 3. device enters the ALDPS mode. 4. a tx occurs before the work_queue is called. Signed-off-by: Hayes Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24net: phy: handle state correctly in phy_stop_machineNathan Sullivan1-1/+1
If the PHY is halted on stop, then do not set the state to PHY_UP. This ensures the phy will be restarted later in phy_start when the machine is started again. Fixes: 00db8189d984 ("This patch adds a PHY Abstraction Layer to the Linux Kernel, enabling ethernet drivers to remain as ignorant as is reasonable of the connected PHY's design and operation details.") Signed-off-by: Nathan Sullivan <[email protected]> Signed-off-by: Brad Mouring <[email protected]> Acked-by: Xander Huff <[email protected]> Acked-by: Kyle Roeschley <[email protected]> Reviewed-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-24ASoC: simple-card: fix simple_dai clk lookupLucas Stach1-0/+1
The clock needs to be stored in the simple_dai structure, so it can be enabled later on. This has been broken during the conversion to use devm_* functions for the clk lookup. Fixes: e984fd61e860 (ASoC: simple-card: use devm_get_clk_from_child()) Signed-off-by: Lucas Stach <[email protected]> Acked-by: Kuninori Morimoto <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2017-03-24ASoC: STI: Fix reader substream pointer setArnaud Pouliquen1-0/+3
reader->substream is used in IRQ handler for error case but is never set. Set value to pcm substream on DAI startup and clean it on dai shutdown. Signed-off-by: Arnaud Pouliquen <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2017-03-24Merge tag 'arm-soc/for-4.11/devicetree-arm64-fixes' of ↵Arnd Bergmann1-0/+11
http://github.com/Broadcom/stblinux into fixes Pull "Broadcom arm64 Device Tree fixes for 4.11" from Florian Fainelli: This pull request contains Broadcom ARM64-based SoCs Device Tree fixes for 4.11, please pull the following: - Jon adds missing "dma-coherent" property to the Northstar 2 DTS include file in order to fix both performance and cache problems for: PCIe, Ethernet, PDC/mailbox, SATA3 and SDHCI * tag 'arm-soc/for-4.11/devicetree-arm64-fixes' of http://github.com/Broadcom/stblinux: arm64: dts: NS2: Add dma-coherent to relevant DT entries
2017-03-24Merge tag 'arm-soc/for-4.11/devicetree-fixes-2' of ↵Arnd Bergmann7-0/+7
http://github.com/Broadcom/stblinux into fixes Pull "Broadcom arm Device Tree fixes for 4.11 (part 2)" from Florian Fainelli: This pull request contains Broadcom ARM-based SoCs Device Tree fixes for 4.11, please pull the following: - Jon fixes a reboot issue on most Northstar Plus platforms by adding the "open-source" property to the "gpio-restart" Device Tree nodes * tag 'arm-soc/for-4.11/devicetree-fixes-2' of http://github.com/Broadcom/stblinux: ARM: dts: NSP: GPIO reboot open-source
2017-03-24ALSA: seq: Fix race during FIFO resizeTakashi Iwai1-0/+4
When a new event is queued while processing to resize the FIFO in snd_seq_fifo_clear(), it may lead to a use-after-free, as the old pool that is being queued gets removed. For avoiding this race, we need to close the pool to be deleted and sync its usage before actually deleting it. The issue was spotted by syzkaller. Reported-by: Dmitry Vyukov <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2017-03-24iwlwifi: mvm: support ibss in dqa modeLiad Kaufman3-6/+13
Allow working IBSS also when working in DQA mode. This is done by setting it to treat the queues the same as a BSS AP treats the queues. Fixes: 7948b87308a4 ("iwlwifi: mvm: enable dynamic queue allocation mode") Signed-off-by: Liad Kaufman <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-03-24iwlwifi: mvm: writing zero bytes to debugfs causes a crashDan Carpenter1-0/+2
This is a static analysis fix. The warning is: drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c:912 iwl_mvm_fw_dbg_collect() warn: integer overflows 'sizeof(*desc) + len' I guess this code is supposed to take a NUL character, but if we write zero bytes then it tries to write -1 characters and crashes. Fixes: c91b865cb14d ("iwlwifi: mvm: support description for user triggered fw dbg collection") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-03-24iwlwifi: mvm: fix accessing fw_id_to_mac_idSara Sharon1-1/+1
Access should be by rcu_dereference. Issue was found by sparse. Fixes: 65e254821cee ("iwlwifi: mvm: use firmware station PM notification for AP_LINK_PS") Signed-off-by: Sara Sharon <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-03-24HID: xinmo: fix for out of range for THT 2P arcade controller.Peter Stein3-0/+3
There is a new clone of the XIN MO arcade controller which has same issue with out of range like the original. This fix will solve the issue where 2 directions on the joystick are not recognized by the new THT 2P arcade controller with device ID 0x75e1. In details the new device ID is added the hid-id list and the hid-xinmo source code. Signed-off-by: Peter Stein <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
2017-03-24crypto: xts,lrw - fix out-of-bounds write after kmalloc failureEric Biggers2-4/+10
In the generic XTS and LRW algorithms, for input data > 128 bytes, a temporary buffer is allocated to hold the values to be XOR'ed with the data before and after encryption or decryption. If the allocation fails, the fixed-size buffer embedded in the request buffer is meant to be used as a fallback --- resulting in more calls to the ECB algorithm, but still producing the correct result. However, we weren't correctly limiting subreq->cryptlen in this case, resulting in pre_crypt() overrunning the embedded buffer. Fix this by setting subreq->cryptlen correctly. Fixes: f1c131b45410 ("crypto: xts - Convert to skcipher") Fixes: 700cb3f5fe75 ("crypto: lrw - Convert to skcipher") Cc: [email protected] # v4.10+ Reported-by: Dmitry Vyukov <[email protected]> Signed-off-by: Eric Biggers <[email protected]> Acked-by: David S. Miller <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
2017-03-24crypto: ccp - Make some CCP DMA channels privateGary R Hook3-0/+47
The CCP registers its queues as channels capable of handling general DMA operations. The NTB driver will use DMA if directed, but as public channels can be reserved for use in asynchronous operations some channels should be held back as private. Since the public/private determination is handled at a device level, reserve the "other" (secondary) CCP channels as private. Add a module parameter that allows for override, to be applied to all channels on all devices. CC: <[email protected]> # 4.10.x- Signed-off-by: Gary R Hook <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
2017-03-24padata: avoid race in reorderingJason A. Donenfeld1-2/+3
Under extremely heavy uses of padata, crashes occur, and with list debugging turned on, this happens instead: [87487.298728] WARNING: CPU: 1 PID: 882 at lib/list_debug.c:33 __list_add+0xae/0x130 [87487.301868] list_add corruption. prev->next should be next (ffffb17abfc043d0), but was ffff8dba70872c80. (prev=ffff8dba70872b00). [87487.339011] [<ffffffff9a53d075>] dump_stack+0x68/0xa3 [87487.342198] [<ffffffff99e119a1>] ? console_unlock+0x281/0x6d0 [87487.345364] [<ffffffff99d6b91f>] __warn+0xff/0x140 [87487.348513] [<ffffffff99d6b9aa>] warn_slowpath_fmt+0x4a/0x50 [87487.351659] [<ffffffff9a58b5de>] __list_add+0xae/0x130 [87487.354772] [<ffffffff9add5094>] ? _raw_spin_lock+0x64/0x70 [87487.357915] [<ffffffff99eefd66>] padata_reorder+0x1e6/0x420 [87487.361084] [<ffffffff99ef0055>] padata_do_serial+0xa5/0x120 padata_reorder calls list_add_tail with the list to which its adding locked, which seems correct: spin_lock(&squeue->serial.lock); list_add_tail(&padata->list, &squeue->serial.list); spin_unlock(&squeue->serial.lock); This therefore leaves only place where such inconsistency could occur: if padata->list is added at the same time on two different threads. This pdata pointer comes from the function call to padata_get_next(pd), which has in it the following block: next_queue = per_cpu_ptr(pd->pqueue, cpu); padata = NULL; reorder = &next_queue->reorder; if (!list_empty(&reorder->list)) { padata = list_entry(reorder->list.next, struct padata_priv, list); spin_lock(&reorder->lock); list_del_init(&padata->list); atomic_dec(&pd->reorder_objects); spin_unlock(&reorder->lock); pd->processed++; goto out; } out: return padata; I strongly suspect that the problem here is that two threads can race on reorder list. Even though the deletion is locked, call to list_entry is not locked, which means it's feasible that two threads pick up the same padata object and subsequently call list_add_tail on them at the same time. The fix is thus be hoist that lock outside of that block. Signed-off-by: Jason A. Donenfeld <[email protected]> Acked-by: Steffen Klassert <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
2017-03-24dt-bindings: rng: clocks property on omap_rng not always mandatoryThomas Petazzoni1-1/+2
Commit 52060836f79 ("dt-bindings: omap-rng: Document SafeXcel IP-76 device variant") update the omap_rng Device Tree binding to add support for the IP-76 variation of the IP. As part of this change, a "clocks" property was added, but is indicated as "Required", without indicated it's actually only required for some compatible strings. This commit fixes that, by explicitly stating that the clocks property is only required with the inside-secure,safexcel-eip76 compatible string. Fixes: 52060836f79 ("dt-bindings: omap-rng: Document SafeXcel IP-76 device variant") Cc: <[email protected]> Signed-off-by: Thomas Petazzoni <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
2017-03-24i2c: mux: pca954x: Add missing pca9546 definition to chip_descMike Looijmans1-1/+5
The spec for the pca9546 was missing. This chip is the same as the pca9545 except that it lacks interrupt lines. While the i2c_device_id table mapped the pca9546 to the pca9545 definition the compatible table did not. Signed-off-by: Mike Looijmans <[email protected]> Signed-off-by: Peter Rosin <[email protected]>
2017-03-24x86/mm/KASLR: Exclude EFI region from KASLR VA space randomizationBaoquan He1-2/+2
Currently KASLR is enabled on three regions: the direct mapping of physical memory, vamlloc and vmemmap. However the EFI region is also mistakenly included for VA space randomization because of misusing EFI_VA_START macro and assuming EFI_VA_START < EFI_VA_END. (This breaks kexec and possibly other things that rely on stable addresses.) The EFI region is reserved for EFI runtime services virtual mapping which should not be included in KASLR ranges. In Documentation/x86/x86_64/mm.txt, we can see: ffffffef00000000 - fffffffeffffffff (=64 GB) EFI region mapping space EFI uses the space from -4G to -64G thus EFI_VA_START > EFI_VA_END, Here EFI_VA_START = -4G, and EFI_VA_END = -64G. Changing EFI_VA_START to EFI_VA_END in mm/kaslr.c fixes this problem. Signed-off-by: Baoquan He <[email protected]> Reviewed-by: Bhupesh Sharma <[email protected]> Acked-by: Dave Young <[email protected]> Acked-by: Thomas Garnier <[email protected]> Cc: <[email protected]> #4.8+ Cc: Andrew Morton <[email protected]> Cc: Andy Lutomirski <[email protected]> Cc: Ard Biesheuvel <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Brian Gerst <[email protected]> Cc: Denys Vlasenko <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Josh Poimboeuf <[email protected]> Cc: Kees Cook <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Masahiro Yamada <[email protected]> Cc: Matt Fleming <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: [email protected] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
2017-03-24lib/syscall: Clear return values when no stackKees Cook1-0/+1
Commit: aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()") ... added logic to handle a process stack not existing, but left sp and pc uninitialized, which can be later reported via /proc/$pid/syscall for zombie processes, potentially exposing kernel memory to userspace. Zombie /proc/$pid/syscall before: -1 0xffffffff9a060100 0xffff92f42d6ad900 Zombie /proc/$pid/syscall after: -1 0x0 0x0 Reported-by: Robert Święcki <[email protected]> Signed-off-by: Kees Cook <[email protected]> Reviewed-by: Andy Lutomirski <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Brian Gerst <[email protected]> Cc: Denys Vlasenko <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Josh Poimboeuf <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: [email protected] # v4.9+ Fixes: aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()") Link: http://lkml.kernel.org/r/20170323224616.GA92694@beast Signed-off-by: Ingo Molnar <[email protected]>
2017-03-23net: neigh: guard against NULL solicit() methodEric Dumazet1-1/+2
Dmitry posted a nice reproducer of a bug triggering in neigh_probe() when dereferencing a NULL neigh->ops->solicit method. This can happen for arp_direct_ops/ndisc_direct_ops and similar, which can be used for NUD_NOARP neighbours (created when dev->header_ops is NULL). Admin can then force changing nud_state to some other state that would fire neigh timer. Signed-off-by: Eric Dumazet <[email protected]> Reported-by: Dmitry Vyukov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-03-23Merge tag 'pm-4.11-rc4' of ↵Linus Torvalds4-130/+72
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "One of these is an intel_pstate regression fix and it is not a small change, but it mostly removes code that shouldn't be there. That code was acquired by mistake and has been a source of constant pain since then, so the time has come to get rid of it finally. We have not seen problems with this change in the lab, so fingers crossed. The rest is more usual: one more intel_pstate commit removing useless code, a cpufreq core fix to make it restore policy limits on CPU online (which prevents the limits from being reset over system suspend/resume), a schedutil cpufreq governor initialization fix to make it actually work as advertised on all systems and an extra sanity check in the cpuidle core to prevent crashes from happening if the arch code messes things up. Specifics: - Make intel_pstate use one set of global P-state limits in the active mode regardless of the scaling_governor settings for individual CPUs instead of switching back and forth between two of them in a way that is hard to control (Rafael Wysocki). - Drop a useless function from intel_pstate to prevent it from modifying the maximum supported frequency value unexpectedly which may confuse the cpufreq core (Rafael Wysocki). - Fix the cpufreq core to restore policy limits on CPU online so that the limits are not reset over system suspend/resume, among other things (Viresh Kumar). - Fix the initialization of the schedutil cpufreq governor to make the IO-wait boosting mechanism in it actually work on systems with one CPU per cpufreq policy (Rafael Wysocki). - Add a sanity check to the cpuidle core to prevent crashes from happening if the architecture code initialization fails to set up things as expected (Vaidyanathan Srinivasan)" * tag 'pm-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: Restore policy min/max limits on CPU online cpuidle: Validate cpu_dev in cpuidle_add_sysfs() cpufreq: intel_pstate: Fix policy data management in passive mode cpufreq: schedutil: Fix per-CPU structure initialization in sugov_start() cpufreq: intel_pstate: One set of global limits in active mode
2017-03-23Merge branch 'for-linus' of ↵Linus Torvalds12-29/+116
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: "Fixes to various USB drivers to validate existence of endpoints before trying to use them, fixes to APLS v8 protocol, and a couple of i8042 quirks" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ALPS - fix trackstick button handling on V8 devices Input: ALPS - fix V8+ protocol handling (73 03 28) Input: sur40 - validate number of endpoints before using them Input: kbtab - validate number of endpoints before using them Input: hanwang - validate number of endpoints before using them Input: yealink - validate number of endpoints before using them Input: ims-pcu - validate number of endpoints before using them Input: cm109 - validate number of endpoints before using them Input: iforce - validate number of endpoints before using them Input: elan_i2c - add ASUS EeeBook X205TA special touchpad fw Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list Input: synaptics-rmi4 - prevent null pointer dereference in f30 Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000
2017-03-24Merge branch 'drm-fixes-4.11' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie4-8/+17
into drm-fixes A few small fixes for 4.11 * 'drm-fixes-4.11' of git://people.freedesktop.org/~agd5f/linux: drm/amd/amdgpu: add POLARIS12 PCI ID drm/amdgpu: fix the clearing wb size drm/amdgpu: reinstate oland workaround for sclk drm/radeon: reinstate oland workaround for sclk
Powered by cgit, Gruvboxed by Blaster4385.