| 16cf45c | Linus Torvalds | 28 November 2014, 21:54:53 UTC | Merge tag 'sound-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "No excitement, here are only minor fixes: an endian fix for the new DSD format we added in 3.18, a fix for HP mute LED, and a fix for Native Instrument quirk" * tag 'sound-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: pcm: Add big-endian DSD sample formats and fix XMOS DSD sample format ALSA: hda - One more HP machine needs to change mute led quirk ALSA: usb-audio: Use snd_usb_ctl_msg() for Native Instruments quirk | 28 November 2014, 21:54:53 UTC |
| 615b994 | Linus Torvalds | 28 November 2014, 21:34:32 UTC | Merge tag 'armsoc-for-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Arnd Bergmann: "Not much interesting going on fixes-wise for us this week, as it should be for an -rc7. I'm not expecting Olof to work much over Thanksgiving weekend, so I decided to take over again and push these out to you. Just four simple fixes this week: - one missing of_node_put() on armv7 based mvebu - forcing the USB host into the right mode on Chromebook (exynos5-snow) - enabling two important drivers for exynos_defconfig - fixing a noncritical bug for tegra that would cause a regression with common code patches queued for 3.19" * tag 'armsoc-for-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: tegra: irq: fix buggy usage of irq_data irq field ARM: exynos_defconfig: Enable max77802 rtc and clock drivers ARM: dts: Explicitly set dr_mode on exynos5250-snow ARM: mvebu: add missing of_node_put() call in coherency.c | 28 November 2014, 21:34:32 UTC |
| e818d5e | Linus Torvalds | 28 November 2014, 21:32:47 UTC | Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "Another round of relatively small ARM fixes. Thomas spotted that the strex backoff delay bit was a disable bit, so it needed to be clear for this to work. Vladimir spotted that using a restart block for the cache flush operation would return -EINTR, which userspace was not expecting. Dmitry spotted that the auxiliary control register accesses for Xscale were not correct" * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: ARM: 8226/1: cacheflush: get rid of restarting block ARM: 8222/1: mvebu: enable strex backoff delay ARM: 8216/1: xscale: correct auxiliary register in suspend/resume | 28 November 2014, 21:32:47 UTC |
| 98e8d2e | Linus Torvalds | 28 November 2014, 02:32:49 UTC | Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus Pull mips fixes from Ralf Baechle: "The hopefully final round of fixes for 3.18: - Fix a number of build errors affecting particular configurations. - Handle EVA correctly when flushing a signal trampoline and dcache lines. - Fix printks printing jibberish. - Handle 64 bit memory addresses correctly when adding memory chunk on 32 bit kernels. - Fix a race condition in the hardware tablewalker code" * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: MIPS: tlbex: Fix potential HTW race on TLBL/M/S handlers MIPS: Fix address type used for early memory detection. MIPS: Kconfig: Don't allow both microMIPS and SmartMIPS to be selected. MIPS: kernel: cps-vec: Set ISA level to mips32r2 for the MIPS MT ASE MIPS: Netlogic: handle modular AHCI builds MIPS: Netlogic: handle modular USB case MIPS: Loongson: Make platform serial setup always built-in. MIPS: fix EVA & non-SMP non-FPU FP context signal handling MIPS: cpu-probe: Set the FTLB probability bit on supported cores MIPS: BMIPS: Fix ".previous without corresponding .section" warnings MIPS: uaccess.h: Fix strnlen_user comment. MIPS: r4kcache: Add EVA case for protected_writeback_dcache_line MIPS: Fix info about plat_setup in arch_mem_init comment MIPS: rtlx: Remove KERN_DEBUG from pr_debug() arguments in rtlx.c MIPS: SEAD3: Fix LED device registration. MIPS: Fix a copy & paste error in unistd.h | 28 November 2014, 02:32:49 UTC |
| 21f122f | Linus Torvalds | 28 November 2014, 02:23:41 UTC | Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux Pull powerpc fixes from Michael Ellerman: "Here are five fixes for you to pull please. They're all CC'ed to stable except the "Fix PE state format" one which went in this release" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux: powerpc: 32 bit getcpu VDSO function uses 64 bit instructions powerpc/powernv: Replace OPAL_DEASSERT_RESET with EEH_RESET_DEACTIVATE powerpc/eeh: Fix PE state format powerpc/pseries: Fix endiannes issue in RTAS call from xmon powerpc/powernv: Fix the hmi event version check. | 28 November 2014, 02:23:41 UTC |
| ae97943 | Linus Torvalds | 28 November 2014, 02:19:25 UTC | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc fixlet from David Miller: "Aparc fix to add dma_cache_sync(), even if a nop it should be provided if dma_{alloc,free}_noncoherent() is provided too" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc: Add NOP dma_cache_sync() implementation. | 28 November 2014, 02:19:25 UTC |
| 8e84597 | Linus Torvalds | 28 November 2014, 02:05:05 UTC | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "Several small fixes here: 1) Don't crash in tg3 driver when the number of tx queues has been configured to be different from the number of rx queues. From Thadeu Lima de Souza Cascardo. 2) VLAN filter not disabled properly in promisc mode in ixgbe driver, from Vlad Yasevich. 3) Fix OOPS on dellink op in VTI tunnel driver, from Xin Long. 4) IPV6 GRE driver WCCP code checks skb->protocol for ETH_P_IP instead of ETH_P_IPV6, whoops. From Yuri Chislov. 5) Socket matching in ping driver is buggy when packet AF does not match socket's AF. Fix from Jane Zhou. 6) Fix checksum calculation errors in VXLAN due to where the udp_tunnel6_xmit_skb() helper gets it's saddr/daddr from. From Alexander Duyck. 7) Fix 5G detection problem in rtlwifi driver, from Larry Finger. 8) Fix NULL deref in tcp_v{4,6}_send_reset, from Eric Dumazet. 9) Various missing netlink attribute verifications in bridging code, from Thomas Graf. 10) tcp_recvmsg() unconditionally calls ipv4 ip_recv_error even for ipv6 sockets, whoops. Fix from Willem de Bruijn" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (29 commits) net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks bridge: Sanitize IFLA_EXT_MASK for AF_BRIDGE:RTM_GETLINK bridge: Add missing policy entry for IFLA_BRPORT_FAST_LEAVE net: Check for presence of IFLA_AF_SPEC net: Validate IFLA_BRIDGE_MODE attribute length bridge: Validate IFLA_BRIDGE_FLAGS attribute length stmmac: platform: fix default values of the filter bins setting net/mlx4_core: Limit count field to 24 bits in qp_alloc_res net: dsa: bcm_sf2: reset switch prior to initialization net: dsa: bcm_sf2: fix unmapping registers in case of errors tg3: fix ring init when there are more TX than RX channels tcp: fix possible NULL dereference in tcp_vX_send_reset() rtlwifi: Change order in device startup rtlwifi: rtl8821ae: Fix 5G detection problem Revert "netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse" vxlan: Fix boolean flip in VXLAN_F_UDP_ZERO_CSUM6_[TX|RX] ip6_udp_tunnel: Fix checksum calculation net-timestamp: Fix a documentation typo net/ping: handle protocol mismatching scenario af_packet: fix sparse warning ... | 28 November 2014, 02:05:05 UTC |
| 190fc9d | Linus Torvalds | 28 November 2014, 01:55:42 UTC | Merge tag 'spi-v3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "There's a couple of driver fixes here, plus one core fix for the DMA mapping which wasn't doing the right thing for vmalloc()ed addresses that hadn't been through kmap(). It's fairly rare to use vmalloc() with SPI and it's a subset of those users who might fail so it's unsurprising that this wasn't noticed sooner" * tag 'spi-v3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: sirf: fix word width configuration spi: Fix mapping from vmalloc-ed buffer to scatter list spi: dw: Fix dynamic speed change. | 28 November 2014, 01:55:42 UTC |
| 0210bb6 | Linus Torvalds | 28 November 2014, 01:51:50 UTC | Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input layer fixes from Dmitry Torokhov: "The main change is to fix breakage in Elantech driver introduced by the recent commit adding trackpoint reporting to protocol v4. Now we are trusting the hardware to advertise the trackpoint properly and do not try to decode the data as trackpoint if firmware told us it is not present" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: xpad - use proper endpoint type Input: elantech - trust firmware about trackpoint presence Input: synaptics - adjust min/max on Thinkpad E540 | 28 November 2014, 01:51:50 UTC |
| 070e76c | Leonid Yegoshin | 27 November 2014, 11:13:08 UTC | MIPS: tlbex: Fix potential HTW race on TLBL/M/S handlers There is a potential race when probing the TLB in TLBL/M/S exception handlers for a matching entry. Between the time we hit a TLBL/S/M exception and the time we get to execute the TLBP instruction, the HTW may have replaced the TLB entry we are interested in hence the TLB probe may fail. However, in the existing handlers, we never checked the status of the TLBP (ie check the result in the C0/Index register). We fix this by adding such a check when the core implements the HTW. If we couldn't find a matching entry, we return back and try again. Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> Reviewed-by: James Hogan <james.hogan@imgtec.com> Cc: <stable@vger.kernel.org> # v3.17+ Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8599/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 27 November 2014, 16:21:56 UTC |
| 3f4aa45 | Vladimir Murzin | 27 November 2014, 10:39:04 UTC | ARM: 8226/1: cacheflush: get rid of restarting block We cannot restart cacheflush safely if a process provides user-defined signal handler and signal is pending. In this case -EINTR is returned and it is expected that process re-invokes syscall. However, there are a few problems with that: * looks like nobody bothers checking return value from cacheflush * but if it did, we don't provide the restart address for that, so the process has to use the same range again * ...and again, what might lead to looping forever So, remove cacheflush restarting code and terminate cache flushing as early as fatal signal is pending. Cc: stable@vger.kernel.org # 3.12+ Reported-by: Chanho Min <chanho.min@lge.com> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Acked-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> | 27 November 2014, 15:55:35 UTC |
| 995ab51 | Thomas Petazzoni | 25 November 2014, 17:43:15 UTC | ARM: 8222/1: mvebu: enable strex backoff delay Under extremely rare conditions, in an MPCore node consisting of at least 3 CPUs, two CPUs trying to perform a STREX to data on the same shared cache line can enter a livelock situation. This patch enables the HW mechanism that overcomes the bug. This fixes the incorrect setup of the STREX backoff delay bit due to a wrong description in the specification. Note that enabling the STREX backoff delay mechanism is done by leaving the bit *cleared*, while the bit was currently being set by the proc-v7.S code. [Thomas: adapt to latest mainline, slightly reword the commit log, add stable markers.] Fixes: de4901933f6d ("arm: mm: Add support for PJ4B cpu and init routines") Cc: <stable@vger.kernel.org> # v3.8+ Signed-off-by: Nadav Haklai <nadavh@marvell.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com> Acked-by: Jason Cooper <jason@lakedaemon.net> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> | 27 November 2014, 15:55:04 UTC |
| 96ba18f | Arnd Bergmann | 27 November 2014, 13:29:23 UTC | Merge tag 'mvebu-fixes-3.18-2' of git://git.infradead.org/linux-mvebu into fixes Pull "mvebu fixes for v3.18 (round 2)" frm Jason Cooper: - mvebu - coherency.c needed an of_node_put() * tag 'mvebu-fixes-3.18-2' of git://git.infradead.org/linux-mvebu: ARM: mvebu: add missing of_node_put() call in coherency.c Signed-off-by: Arnd Bergmann <arnd@arndb.de> | 27 November 2014, 13:29:23 UTC |
| a572c9d | Arnd Bergmann | 27 November 2014, 13:26:52 UTC | Merge tag 'samsung-defconfig-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes Pull "Samsung defconfig update for v3.18" from Kukjin Kim: - enable max77802 rtc and clock drivers for exynos_defconfig : enable the kernel config options to have the drivers for max77802 including rtc and 2-ch 32kHz clock outputs * tag 'samsung-defconfig-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: exynos_defconfig: Enable max77802 rtc and clock drivers Signed-off-by: Arnd Bergmann <arnd@arndb.de> | 27 November 2014, 13:26:52 UTC |
| d168c85 | Arnd Bergmann | 27 November 2014, 13:24:41 UTC | Merge tag 'samsung-fixes-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes Pull "Samsung fixes for v3.18" from Kukjin Kim: - explicitly set dr_mode on exynos5250-snow this is required when kernel is built with USB gadget support. * tag 'samsung-fixes-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: dts: Explicitly set dr_mode on exynos5250-snow Signed-off-by: Arnd Bergmann <arnd@arndb.de> | 27 November 2014, 13:24:41 UTC |
| 9a343b9 | Marc Zyngier | 26 November 2014, 17:55:31 UTC | ARM: tegra: irq: fix buggy usage of irq_data irq field The crazy gic_arch_extn thing that Tegra uses contains multiple references to the irq field in struct irq_data, and uses this to directly poke hardware register. But irq is the *virtual* irq number, something that has nothing to do with the actual HW irq (stored in the hwirq field). And once we put the stacked domain code in action, the whole thing explodes, as these two values are *very* different: root@bacon-fat:~# cat /proc/interrupts CPU0 CPU1 16: 25801 2075 GIC 29 twd 17: 0 0 GIC 73 timer0 112: 0 0 GPIO 58 c8000600.sdhci cd 123: 0 0 GPIO 69 c8000200.sdhci cd 279: 1126 0 GIC 122 serial 281: 0 0 GIC 70 7000c000.i2c 282: 0 0 GIC 116 7000c400.i2c 283: 0 0 GIC 124 7000c500.i2c 284: 300 0 GIC 85 7000d000.i2c [...] Just replacing all instances of irq with hwirq fixes the issue. Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Acked-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de> | 27 November 2014, 13:01:55 UTC |
| 152d44a | Anton Blanchard | 26 November 2014, 21:11:28 UTC | powerpc: 32 bit getcpu VDSO function uses 64 bit instructions I used some 64 bit instructions when adding the 32 bit getcpu VDSO function. Fix it. Fixes: 18ad51dd342a ("powerpc: Add VDSO version of getcpu") Cc: stable@vger.kernel.org Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> | 26 November 2014, 22:42:12 UTC |
| 360d88a | Gavin Shan | 24 November 2014, 22:26:59 UTC | powerpc/powernv: Replace OPAL_DEASSERT_RESET with EEH_RESET_DEACTIVATE The flag passed to ioda_eeh_phb_reset() should be EEH_RESET_DEACTIVATE, which is translated to OPAL_DEASSERT_RESET or something else by the EEH backend accordingly. The patch replaces OPAL_DEASSERT_RESET with EEH_RESET_DEACTIVATE for ioda_eeh_phb_reset(). Cc: stable@vger.kernel.org Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> | 26 November 2014, 22:40:32 UTC |
| 7531473 | Gavin Shan | 24 November 2014, 22:26:58 UTC | powerpc/eeh: Fix PE state format Obviously I had wrong format given to the PE state output from /sys/bus/pci/devices/xxxx/eeh_pe_state with some typoes, which was introduced by commit 2013add4ce73. The patch fixes it up. Fixes: 2013add4ce73 ("powerpc/eeh: Show hex prefix for PE state sysfs") Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> | 26 November 2014, 22:32:58 UTC |
| 3b8a3c0 | Laurent Dufour | 24 November 2014, 14:07:53 UTC | powerpc/pseries: Fix endiannes issue in RTAS call from xmon On pseries system (LPAR) xmon failed to enter when running in LE mode, system is hunging. Inititating xmon will lead to such an output on the console: SysRq : Entering xmon cpu 0x15: Vector: 0 at [c0000003f39ffb10] pc: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70 lr: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70 sp: c0000003f39ffc70 msr: 8000000000009033 current = 0xc0000003fafa7180 paca = 0xc000000007d75e80 softe: 0 irq_happened: 0x01 pid = 14617, comm = bash Bad kernel stack pointer fafb4b0 at eca7cc4 cpu 0x15: Vector: 300 (Data Access) at [c000000007f07d40] pc: 000000000eca7cc4 lr: 000000000eca7c44 sp: fafb4b0 msr: 8000000000001000 dar: 10000000 dsisr: 42000000 current = 0xc0000003fafa7180 paca = 0xc000000007d75e80 softe: 0 irq_happened: 0x01 pid = 14617, comm = bash cpu 0x15: Exception 300 (Data Access) in xmon, returning to main loop xmon: WARNING: bad recursive fault on cpu 0x15 The root cause is that xmon is calling RTAS to turn off the surveillance when entering xmon, and RTAS is requiring big endian parameters. This patch is byte swapping the RTAS arguments when running in LE mode. Cc: stable@vger.kernel.org Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> | 26 November 2014, 22:32:57 UTC |
| 6acbc5a | Mahesh Salgaonkar | 20 November 2014, 04:14:36 UTC | powerpc/powernv: Fix the hmi event version check. The current HMI event structure is an ABI and carries a version field to accommodate future changes without affecting/rearranging current structure members that are valid for previous versions. The current version check "if (hmi_evt->version != OpalHMIEvt_V1)" doesn't accomodate the fact that the version number may change in future. If firmware starts returning an HMI event with version > 1, this check will fail and no HMI information will be printed on older kernels. This patch fixes this issue. Cc: stable@vger.kernel.org # 3.17+ Signed-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com> [mpe: Reword changelog] Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> | 26 November 2014, 22:32:52 UTC |
| d1c637c | David S. Miller | 26 November 2014, 21:38:35 UTC | Merge tag 'master-2014-11-25' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless John W. Linville says: ==================== pull request: wireless 2014-11-26 Please pull this little batch of fixes intended for the 3.18 stream... For the iwlwifi one, Emmanuel says: "Not all the firmware know how to handle the HOT_SPOT_CMD. Make sure that the firmware will know this command before sending it. This avoids a firmware crash." Along with that, Larry sends a pair of rtlwifi fixes to address some discrepancies from moving drivers out of staging. Larry says: "These two patches are needed to fix a regression introduced when driver rtl8821ae was moved from staging to the regular wireless tree." Please let me know if there are problems! ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 21:38:35 UTC |
| 0d1d909 | David S. Miller | 26 November 2014, 21:36:41 UTC | sparc: Add NOP dma_cache_sync() implementation. This can be a NOP because we forward dma_{alloc,free}_noncoherent to dma_{alloc,free}_coherent. Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 21:36:41 UTC |
| f4713a3 | Willem de Bruijn | 26 November 2014, 19:53:02 UTC | net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks TCP timestamping introduced MSG_ERRQUEUE handling for TCP sockets. If the socket is of family AF_INET6, call ipv6_recv_error instead of ip_recv_error. This change is more complex than a single branch due to the loadable ipv6 module. It reuses a pre-existing indirect function call from ping. The ping code is safe to call, because it is part of the core ipv6 module and always present when AF_INET6 sockets are active. Fixes: 4ed2d765 (net-timestamp: TCP timestamping) Signed-off-by: Willem de Bruijn <willemb@google.com> ---- It may also be worthwhile to add WARN_ON_ONCE(sk->family == AF_INET6) to ip_recv_error. Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 20:45:04 UTC |
| a765023 | David S. Miller | 26 November 2014, 20:29:10 UTC | Merge branch 'bridge_nl_validation' Thomas Graf says: ==================== bridge: Fix missing Netlink message validations Adds various missing length checks in the bridging code for Netlink messages and corresponding attributes provided by user space. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 20:29:10 UTC |
| aa68c20 | Thomas Graf | 26 November 2014, 12:42:20 UTC | bridge: Sanitize IFLA_EXT_MASK for AF_BRIDGE:RTM_GETLINK Only search for IFLA_EXT_MASK if the message actually carries a ifinfomsg header and validate minimal length requirements for IFLA_EXT_MASK. Fixes: 6cbdceeb ("bridge: Dump vlan information from a bridge port") Cc: Vlad Yasevich <vyasevic@redhat.com> Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 20:29:01 UTC |
| 6f705d8 | Thomas Graf | 26 November 2014, 12:42:19 UTC | bridge: Add missing policy entry for IFLA_BRPORT_FAST_LEAVE Fixes: c2d3babf ("bridge: implement multicast fast leave") Cc: David S. Miller <davem@davemloft.net> Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 20:29:01 UTC |
| 4ea85e8 | Thomas Graf | 26 November 2014, 12:42:18 UTC | net: Check for presence of IFLA_AF_SPEC ndo_bridge_setlink() is currently only called on the slave if IFLA_AF_SPEC is set but this is a very fragile assumption and may change in the future. Cc: Ajit Khaparde <ajit.khaparde@emulex.com> Cc: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: Thomas Graf <tgraf@suug.ch> Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 20:29:01 UTC |
| b7c1a31 | Thomas Graf | 26 November 2014, 12:42:17 UTC | net: Validate IFLA_BRIDGE_MODE attribute length Payload is currently accessed blindly and may exceed valid message boundaries. Fixes: a77dcb8c8 ("be2net: set and query VEB/VEPA mode of the PF interface") Fixes: 815cccbf1 ("ixgbe: add setlink, getlink support to ixgbe and ixgbevf") Cc: Ajit Khaparde <ajit.khaparde@emulex.com> Cc: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: Thomas Graf <tgraf@suug.ch> Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Acked-by: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 20:29:00 UTC |
| 6e8d1c5 | Thomas Graf | 26 November 2014, 12:42:16 UTC | bridge: Validate IFLA_BRIDGE_FLAGS attribute length Payload is currently accessed blindly and may exceed valid message boundaries. Fixes: 407af3299 ("bridge: Add netlink interface to configure vlans on bridge ports") Cc: Vlad Yasevich <vyasevic@redhat.com> Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 20:29:00 UTC |
| 3314bf6 | Linus Torvalds | 26 November 2014, 19:16:44 UTC | Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Last minute KVM/ARM fixes; even the generic change actually affects nothing but ARM" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvm: fix kvm_is_mmio_pfn() and rename to kvm_is_reserved_pfn() arm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn() arm/arm64: KVM: vgic: Fix error code in kvm_vgic_create() arm64: KVM: Handle traps of ICC_SRE_EL1 as RAZ/WI arm64: KVM: fix unmapping with 48-bit VAs | 26 November 2014, 19:16:44 UTC |
| ec05861 | Mark Brown | 26 November 2014, 19:05:25 UTC | Merge remote-tracking branches 'spi/fix/dw' and 'spi/fix/sirf' into spi-linus | 26 November 2014, 19:05:25 UTC |
| 13616c7 | Mark Brown | 26 November 2014, 19:05:25 UTC | Merge remote-tracking branch 'spi/fix/dma' into spi-linus | 26 November 2014, 19:05:25 UTC |
| 571dcfd | Huacai Chen | 26 November 2014, 02:38:06 UTC | stmmac: platform: fix default values of the filter bins setting The commit 3b57de958e2a brought the support for a different amount of the filter bins, but didn't update the platform driver that without CONFIG_OF. Fixes: 3b57de958e2a (net: stmmac: Support devicetree configs for mcast and ucast filter entries) Signed-off-by: Huacai Chen <chenhc@lemote.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 17:28:45 UTC |
| 2d5c57d | Jack Morgenstein | 25 November 2014, 09:54:31 UTC | net/mlx4_core: Limit count field to 24 bits in qp_alloc_res Some VF drivers use the upper byte of "param1" (the qp count field) in mlx4_qp_reserve_range() to pass flags which are used to optimize the range allocation. Under the current code, if any of these flags are set, the 32-bit count field yields a count greater than 2^24, which is out of range, and this VF fails. As these flags represent a "best-effort" allocation hint anyway, they may safely be ignored. Therefore, the PF driver may simply mask out the bits. Fixes: c82e9aa0a8 "mlx4_core: resource tracking for HCA resources used by guests" Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 17:04:49 UTC |
| fbe4d0d | David S. Miller | 26 November 2014, 17:04:14 UTC | Merge branch 'bcm_sf2' Florian Fainelli says: ==================== net: dsa: bcm_sf2: misc bugfixes This patch series contains two bug fixes: - first patch fixes an issue on the error path of the driver where we could have left some of our registers mapped - second patch enforces the use of a software reset of the switch to guarantee the HW is in a consistent state prior to software initialization ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 17:04:14 UTC |
| 33f8461 | Florian Fainelli | 26 November 2014, 02:08:49 UTC | net: dsa: bcm_sf2: reset switch prior to initialization Our boot agent may have left the switch in an certain configuration state, make sure we issue a software reset prior to configuring the switch in order to ensure the HW is in a consistent state, in particular transmit queues and internal buffers. Fixes: 246d7f773c13 ("net: dsa: add Broadcom SF2 switch driver") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 17:03:56 UTC |
| a566059 | Florian Fainelli | 26 November 2014, 02:08:48 UTC | net: dsa: bcm_sf2: fix unmapping registers in case of errors In case we fail to ioremap() one of our registers, we would be leaking existing mappings, unwind those accordingly on errors. Fixes: 246d7f773c13 ("net: dsa: add Broadcom SF2 switch driver") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 November 2014, 17:03:56 UTC |
| d3fccc7 | Ard Biesheuvel | 10 November 2014, 08:33:56 UTC | kvm: fix kvm_is_mmio_pfn() and rename to kvm_is_reserved_pfn() This reverts commit 85c8555ff0 ("KVM: check for !is_zero_pfn() in kvm_is_mmio_pfn()") and renames the function to kvm_is_reserved_pfn. The problem being addressed by the patch above was that some ARM code based the memory mapping attributes of a pfn on the return value of kvm_is_mmio_pfn(), whose name indeed suggests that such pfns should be mapped as device memory. However, kvm_is_mmio_pfn() doesn't do quite what it says on the tin, and the existing non-ARM users were already using it in a way which suggests that its name should probably have been 'kvm_is_reserved_pfn' from the beginning, e.g., whether or not to call get_page/put_page on it etc. This means that returning false for the zero page is a mistake and the patch above should be reverted. Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | 26 November 2014, 13:40:45 UTC |
| bb55e9b | Ard Biesheuvel | 10 November 2014, 08:33:55 UTC | arm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn() Instead of using kvm_is_mmio_pfn() to decide whether a host region should be stage 2 mapped with device attributes, add a new static function kvm_is_device_pfn() that disregards RAM pages with the reserved bit set, as those should usually not be mapped as device memory. Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | 26 November 2014, 13:40:45 UTC |
| 6b50f54 | Christoffer Dall | 06 November 2014, 11:47:39 UTC | arm/arm64: KVM: vgic: Fix error code in kvm_vgic_create() If we detect another vCPU is running we just exit and return 0 as if we succesfully created the VGIC, but the VGIC wouldn't actual be created. This shouldn't break in-kernel behavior because the kernel will not observe the failed the attempt to create the VGIC, but userspace could be rightfully confused. Cc: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | 26 November 2014, 13:40:44 UTC |
| db7dedd | Christoffer Dall | 19 November 2014, 11:23:54 UTC | arm64: KVM: Handle traps of ICC_SRE_EL1 as RAZ/WI When running on a system with a GICv3, we currenly don't allow the guest to access the system register interface of the GICv3. We do this by clearing the ICC_SRE_EL2.Enable, which causes all guest accesses to ICC_SRE_EL1 to trap to EL2 and causes all guest accesses to other ICC_ registers to cause an undefined exception in the guest. However, we currently don't handle the trap of guest accesses to ICC_SRE_EL1 and will spill out a warning. The trap just needs to handle the access as RAZ/WI, and a guest that tries to prod this register and set ICC_SRE_EL1.SRE=1, must read back the value (which Linux already does) to see if it succeeded, and will thus observe that ICC_SRE_EL1.SRE was not set. Add the simple trap handler in the sorted table of the system registers. Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org> [ardb: added cp15 handling] Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | 26 November 2014, 13:40:43 UTC |
| 7cbb87d | Mark Rutland | 28 October 2014, 19:36:45 UTC | arm64: KVM: fix unmapping with 48-bit VAs Currently if using a 48-bit VA, tearing down the hyp page tables (which can happen in the absence of a GICH or GICV resource) results in the rather nasty splat below, evidently becasue we access a table that doesn't actually exist. Commit 38f791a4e499792e (arm64: KVM: Implement 48 VA support for KVM EL2 and Stage-2) added a pgd_none check to __create_hyp_mappings to account for the additional level of tables, but didn't add a corresponding check to unmap_range, and this seems to be the source of the problem. This patch adds the missing pgd_none check, ensuring we don't try to access tables that don't exist. Original splat below: kvm [1]: Using HYP init bounce page @83fe94a000 kvm [1]: Cannot obtain GICH resource Unable to handle kernel paging request at virtual address ffff7f7fff000000 pgd = ffff800000770000 [ffff7f7fff000000] *pgd=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.18.0-rc2+ #89 task: ffff8003eb500000 ti: ffff8003eb45c000 task.ti: ffff8003eb45c000 PC is at unmap_range+0x120/0x580 LR is at free_hyp_pgds+0xac/0xe4 pc : [<ffff80000009b768>] lr : [<ffff80000009cad8>] pstate: 80000045 sp : ffff8003eb45fbf0 x29: ffff8003eb45fbf0 x28: ffff800000736000 x27: ffff800000735000 x26: ffff7f7fff000000 x25: 0000000040000000 x24: ffff8000006f5000 x23: 0000000000000000 x22: 0000007fffffffff x21: 0000800000000000 x20: 0000008000000000 x19: 0000000000000000 x18: ffff800000648000 x17: ffff800000537228 x16: 0000000000000000 x15: 000000000000001f x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000020 x11: 0000000000000062 x10: 0000000000000006 x9 : 0000000000000000 x8 : 0000000000000063 x7 : 0000000000000018 x6 : 00000003ff000000 x5 : ffff800000744188 x4 : 0000000000000001 x3 : 0000000040000000 x2 : ffff800000000000 x1 : 0000007fffffffff x0 : 000000003fffffff Process swapper/0 (pid: 1, stack limit = 0xffff8003eb45c058) Stack: (0xffff8003eb45fbf0 to 0xffff8003eb460000) fbe0: eb45fcb0 ffff8003 0009cad8 ffff8000 fc00: 00000000 00000080 00736140 ffff8000 00736000 ffff8000 00000000 00007c80 fc20: 00000000 00000080 006f5000 ffff8000 00000000 00000080 00743000 ffff8000 fc40: 00735000 ffff8000 006d3030 ffff8000 006fe7b8 ffff8000 00000000 00000080 fc60: ffffffff 0000007f fdac1000 ffff8003 fd94b000 ffff8003 fda47000 ffff8003 fc80: 00502b40 ffff8000 ff000000 ffff7f7f fdec6000 00008003 fdac1630 ffff8003 fca0: eb45fcb0 ffff8003 ffffffff 0000007f eb45fd00 ffff8003 0009b378 ffff8000 fcc0: ffffffea 00000000 006fe000 ffff8000 00736728 ffff8000 00736120 ffff8000 fce0: 00000040 00000000 00743000 ffff8000 006fe7b8 ffff8000 0050cd48 00000000 fd00: eb45fd60 ffff8003 00096070 ffff8000 006f06e0 ffff8000 006f06e0 ffff8000 fd20: fd948b40 ffff8003 0009a320 ffff8000 00000000 00000000 00000000 00000000 fd40: 00000ae0 00000000 006aa25c ffff8000 eb45fd60 ffff8003 0017ca44 00000002 fd60: eb45fdc0 ffff8003 0009a33c ffff8000 006f06e0 ffff8000 006f06e0 ffff8000 fd80: fd948b40 ffff8003 0009a320 ffff8000 00000000 00000000 00735000 ffff8000 fda0: 006d3090 ffff8000 006aa25c ffff8000 00735000 ffff8000 006d3030 ffff8000 fdc0: eb45fdd0 ffff8003 000814c0 ffff8000 eb45fe50 ffff8003 006aaac4 ffff8000 fde0: 006ddd90 ffff8000 00000006 00000000 006d3000 ffff8000 00000095 00000000 fe00: 006a1e90 ffff8000 00735000 ffff8000 006d3000 ffff8000 006aa25c ffff8000 fe20: 00735000 ffff8000 006d3030 ffff8000 eb45fe50 ffff8003 006fac68 ffff8000 fe40: 00000006 00000006 fe293ee6 ffff8003 eb45feb0 ffff8003 004f8ee8 ffff8000 fe60: 004f8ed4 ffff8000 00735000 ffff8000 00000000 00000000 00000000 00000000 fe80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 fea0: 00000000 00000000 00000000 00000000 00000000 00000000 000843d0 ffff8000 fec0: 004f8ed4 ffff8000 00000000 00000000 00000000 00000000 00000000 00000000 fee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ff00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ff20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ff40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ff60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ff80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ffa0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000005 00000000 ffe0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 Call trace: [<ffff80000009b768>] unmap_range+0x120/0x580 [<ffff80000009cad4>] free_hyp_pgds+0xa8/0xe4 [<ffff80000009b374>] kvm_arch_init+0x268/0x44c [<ffff80000009606c>] kvm_init+0x24/0x260 [<ffff80000009a338>] arm_init+0x18/0x24 [<ffff8000000814bc>] do_one_initcall+0x88/0x1a0 [<ffff8000006aaac0>] kernel_init_freeable+0x148/0x1e8 [<ffff8000004f8ee4>] kernel_init+0x10/0xd4 Code: 8b000263 92628479 d1000720 eb01001f (f9400340) ---[ end trace 3bc230562e926fa4 ]--- Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Jungseok Lee <jungseoklee85@gmail.com> Acked-by: Marc Zyngier <marc.zyngier@arm.com> Acked-by: Christoffer Dall <christoffer.dall@linaro.org> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | 26 November 2014, 13:40:42 UTC |
| b914c5b | Linus Torvalds | 26 November 2014, 03:05:41 UTC | Merge branch 'for-3.18' of git://linux-nfs.org/~bfields/linux Pull nfsd bugfixes from Bruce Fields: "These fix one mishandling of the case when security labels are configured out, and two races in the 4.1 backchannel code" * 'for-3.18' of git://linux-nfs.org/~bfields/linux: nfsd: Fix slot wake up race in the nfsv4.1 callback code SUNRPC: Fix locking around callback channel reply receive nfsd: correctly define v4.2 support attributes | 26 November 2014, 03:05:41 UTC |
| 277f850 | Linus Torvalds | 26 November 2014, 02:55:44 UTC | Merge git://git.kvack.org/~bcrl/aio-fixes Pull aio fix from Ben LaHaise: "Dirty page accounting fix for aio" * git://git.kvack.org/~bcrl/aio-fixes: aio: fix uncorrent dirty pages accouting when truncating AIO ring buffer | 26 November 2014, 02:55:44 UTC |
| d1ca000 | Linus Torvalds | 26 November 2014, 02:43:21 UTC | Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc Pull powerpc fixes from Ben Herrenschmidt: "This series fix a nasty issue with radeon adapters on powerpc servers, it's all CC'ed stable and has the relevant maintainers ack's/reviews. Basically, some (radeon) adapters have issues with MSI addresses above 1T (only support 40-bits). We had powerpc specific quirk but it only listed a specific revision of an adapter that we shipped with our machines and didn't properly handle the audio function which some distros enable nowadays. So we made the quirk generic and fixed both the graphic and audio drivers properly to use it. Without that, ppc64 server machines will crash at boot with a radeon adapter. Note: This has been brewing for a while, it just needed a last respin which got delayed due to us moving ozlabs to a new location in town and other such things taking priority" * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/pci: Remove unused force_32bit_msi quirk powerpc/pseries: Honor the generic "no_64bit_msi" flag powerpc/powernv: Honor the generic "no_64bit_msi" flag sound/radeon: Move 64-bit MSI quirk from arch to driver gpu/radeon: Set flag to indicate broken 64-bit MSI PCI/MSI: Add device flag indicating that 64-bit MSIs don't work ALSA: hda - Limit 40bit DMA for AMD HDMI controllers | 26 November 2014, 02:43:21 UTC |
| a6e4a05 | Linus Torvalds | 26 November 2014, 02:11:15 UTC | Merge tag 'hwmon-for-linus-v3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull a hwmon fix from Guenter Roeck: "Fix hwmon registration problem in g762 driver" * tag 'hwmon-for-linus-v3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (g762) fix call to devm_hwmon_device_register_with_groups() | 26 November 2014, 02:11:15 UTC |
| a7e9092 | Linus Torvalds | 26 November 2014, 01:52:56 UTC | Merge tag 'clk-fixes-for-linus' of https://git.linaro.org/people/mike.turquette/linux Pull clock fixes from Mike Turquette: "The fixes for the clock framework are all regressions in drivers, plus a single fix in one of the basic clock templates. No fixes to the core this time around. As with most clock driver fixes these run the gamut from fixing a build warning to fixing wrecked memory timings, with a little USB tossed in for fun" * tag 'clk-fixes-for-linus' of https://git.linaro.org/people/mike.turquette/linux: clk: pxa: fix pxa27x CCCR bit usage clk-divider: Fix READ_ONLY when divider > 1 clk: qcom: Fix duplicate rbcpr clock name clk: at91: usb: fix at91sam9x5 recalc, round and set rate clk: at91: usb: fix at91rm9200 round and set rate | 26 November 2014, 01:52:56 UTC |
| a620a6b | Thadeu Lima de Souza Cascardo | 25 November 2014, 16:21:11 UTC | tg3: fix ring init when there are more TX than RX channels If TX channels are set to 4 and RX channels are set to less than 4, using ethtool -L, the driver will try to initialize more RX channels than it has allocated, causing an oops. This fix only initializes the RX ring if it has been allocated. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 25 November 2014, 20:18:45 UTC |
| c3658e8 | Eric Dumazet | 25 November 2014, 15:40:04 UTC | tcp: fix possible NULL dereference in tcp_vX_send_reset() After commit ca777eff51f7 ("tcp: remove dst refcount false sharing for prequeue mode") we have to relax check against skb dst in tcp_v[46]_send_reset() if prequeue dropped the dst. If a socket is provided, a full lookup was done to find this socket, so the dst test can be skipped. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88191 Reported-by: Jaša Bartelj <jasa.bartelj@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Daniel Borkmann <dborkman@redhat.com> Fixes: ca777eff51f7 ("tcp: remove dst refcount false sharing for prequeue mode") Signed-off-by: David S. Miller <davem@davemloft.net> | 25 November 2014, 19:29:18 UTC |
| 7d63a5f | Larry Finger | 25 November 2014, 16:32:07 UTC | rtlwifi: Change order in device startup The existing order of steps when starting the PCI devices works for 2.4G devices, but fails to initialize the 5G section of the RTL8821AE hardware. This patch is needed to fix the regression reported in Bug #88811 (https://bugzilla.kernel.org/show_bug.cgi?id=88811). Reported-by: Valerio Passini <valerio.passini@unicam.it> Tested-by: Valerio Passini <valerio.passini@unicam.it> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Valerio Passini <valerio.passini@unicam.it> Signed-off-by: John W. Linville <linville@tuxdriver.com> | 25 November 2014, 19:22:22 UTC |
| a91ed19 | Larry Finger | 25 November 2014, 16:32:06 UTC | rtlwifi: rtl8821ae: Fix 5G detection problem The changes associated with moving this driver from staging to the regular tree missed one section setting the allowable rates for the 5GHz band. This patch is needed to fix the regression reported in Bug #88811 (https://bugzilla.kernel.org/show_bug.cgi?id=88811). Reported-by: Valerio Passini <valerio.passini@unicam.it> Tested-by: Valerio Passini <valerio.passini@unicam.it> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Valerio Passini <valerio.passini@unicam.it> Signed-off-by: John W. Linville <linville@tuxdriver.com> | 25 November 2014, 19:22:21 UTC |
| 43612d7 | Pablo Neira | 25 November 2014, 18:54:47 UTC | Revert "netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse" This reverts commit 5195c14c8b27cc0b18220ddbf0e5ad3328a04187. If the conntrack clashes with an existing one, it is left out of the unconfirmed list, thus, crashing when dropping the packet and releasing the conntrack since golden rule is that conntracks are always placed in any of the existing lists for traceability reasons. Reported-by: Daniel Borkmann <dborkman@redhat.com> Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=88841 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net> | 25 November 2014, 19:14:51 UTC |
| 814f7d1 | David S. Miller | 25 November 2014, 19:12:36 UTC | Merge branch 'ipv6_vxlan_outer_udp_csum' Alexander Duyck says: ==================== Fix outer UDP checksums for IPv6 VXLAN tunnels In testing against an older kernel I found a couple issues in the IPv6 VXLAN tunnel checksum logic for the outer UDP checksum. First the default transitioned from using an outer checksum to not using one. Second, sometime after that the checksum inputs were changed resulting the checksum not being correct if it were computed. These two issues prevented a ping from the newer kernel to the older one. With these two changes applied I verified I was able to send traffic over the VXLAN tunnel to a link partner on an older kernel. The boolean flip fix can be submitted for 3.17 stable as well since the patch that introduced the issue was included in that kernel. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 25 November 2014, 19:12:36 UTC |
| 3dc2b6a | Alexander Duyck | 25 November 2014, 04:08:38 UTC | vxlan: Fix boolean flip in VXLAN_F_UDP_ZERO_CSUM6_[TX|RX] In "vxlan: Call udp_sock_create" there was a logic error that resulted in the default for IPv6 VXLAN tunnels going from using checksums to not using checksums. Since there is currently no support in iproute2 for setting these values it means that a kernel after the change cannot talk over a IPv6 VXLAN tunnel to a kernel prior the change. Fixes: 3ee64f3 ("vxlan: Call udp_sock_create") Cc: Tom Herbert <therbert@google.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@redhat.com> Acked-by: Tom Herbert <therbert@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 25 November 2014, 19:12:12 UTC |
| f375081 | Alexander Duyck | 25 November 2014, 04:08:32 UTC | ip6_udp_tunnel: Fix checksum calculation The UDP checksum calculation for VXLAN tunnels is currently using the socket addresses instead of the actual packet source and destination addresses. As a result the checksum calculated is incorrect in some cases. Also uh->check was being set twice, first it was set to 0, and then it is set again in udp6_set_csum. This change removes the redundant assignment to 0. Fixes: acbf74a7 ("vxlan: Refactor vxlan driver to make use of the common UDP tunnel functions.") Cc: Andy Zhou <azhou@nicira.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 25 November 2014, 19:12:12 UTC |
| 138a7f4 | Andrew Lutomirski | 24 November 2014, 20:02:29 UTC | net-timestamp: Fix a documentation typo SOF_TIMESTAMPING_OPT_ID puts the id in ee_data, not ee_info. Cc: Willem de Bruijn <willemb@google.com> Signed-off-by: Andy Lutomirski <luto@amacapital.net> Acked-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 25 November 2014, 18:35:26 UTC |
| a1f9a40 | Greg Kroah-Hartman | 25 November 2014, 08:38:17 UTC | Input: xpad - use proper endpoint type The xpad wireless endpoint is not a bulk endpoint on my devices, but rather an interrupt one, so the USB core complains when it is submitted. I'm guessing that the author really did mean that this should be an interrupt urb, but as there are a zillion different xpad devices out there, let's cover out bases and handle both bulk and interrupt endpoints just as easily. Signed-off-by: "Pierre-Loup A. Griffais" <pgriffais@valvesoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> | 25 November 2014, 08:42:19 UTC |
| d0ab547 | Dmitry Torokhov | 20 November 2014, 07:33:07 UTC | Input: elantech - trust firmware about trackpoint presence Only try to parse data as coming from trackpoint if firmware told us that trackpoint is present. Fixes commit caeb0d37fa3e387eb0dd22e5d497523c002033d1 Reported-and-tested-by: Marcus Overhagen <marcus.overhagen@gmail.com> Reported-and-tested-by: Anders Kaseorg <andersk@mit.edu> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> | 25 November 2014, 08:42:13 UTC |
| 91a0b60 | Jane Zhou | 24 November 2014, 19:44:08 UTC | net/ping: handle protocol mismatching scenario ping_lookup() may return a wrong sock if sk_buff's and sock's protocols dont' match. For example, sk_buff's protocol is ETH_P_IPV6, but sock's sk_family is AF_INET, in that case, if sk->sk_bound_dev_if is zero, a wrong sock will be returned. the fix is to "continue" the searching, if no matching, return NULL. Cc: "David S. Miller" <davem@davemloft.net> Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Cc: James Morris <jmorris@namei.org> Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org> Cc: Patrick McHardy <kaber@trash.net> Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Jane Zhou <a17711@motorola.com> Signed-off-by: Yiwei Zhao <gbjc64@motorola.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 November 2014, 21:48:20 UTC |
| 6e58040 | Michael S. Tsirkin | 24 November 2014, 11:32:16 UTC | af_packet: fix sparse warning af_packet produces lots of these: net/packet/af_packet.c:384:39: warning: incorrect type in return expression (different modifiers) net/packet/af_packet.c:384:39: expected struct page [pure] * net/packet/af_packet.c:384:39: got struct page * this seems to be because sparse does not realize that _pure refers to function, not the returned pointer. Tweak code slightly to avoid the warning. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 November 2014, 21:15:36 UTC |
| 2dd3433 | Alexey Khoroshilov | 24 November 2014, 10:58:00 UTC | xen-netback: do not report success if backend_create_xenvif() fails If xenvif_alloc() or xenbus_scanf() fail in backend_create_xenvif(), xenbus is left in offline mode but netback_probe() reports success. The patch implements propagation of error code for backend_create_xenvif(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Acked-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 November 2014, 21:14:45 UTC |
| be6572f | Yuri Chislov | 24 November 2014, 10:25:15 UTC | ipv6: gre: fix wrong skb->protocol in WCCP When using GRE redirection in WCCP, it sets the wrong skb->protocol, that is, ETH_P_IP instead of ETH_P_IPV6 for the encapuslated traffic. Fixes: c12b395a4664 ("gre: Support GRE over IPv6") Cc: Dmitry Kozlov <xeb@mail.ru> Signed-off-by: Yuri Chislov <yuri.chislov@gmail.com> Tested-by: Yuri Chislov <yuri.chislov@gmail.com> Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 November 2014, 21:11:05 UTC |
| 90d8879 | John W. Linville | 24 November 2014, 18:53:41 UTC | Merge tag 'iwlwifi-for-john-2014-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes Emmanuel Grumbach <egrumbach@gmail.com> says: "Not all the firmware know how to handle the HOT_SPOT_CMD. Make sure that the firmware will know this command before sending it. This avoids a firmware crash." Signed-off-by: John W. Linville <linville@tuxdriver.com> | 24 November 2014, 18:53:41 UTC |
| b4da18b | Steven J. Hill | 13 November 2014, 15:52:00 UTC | MIPS: Fix address type used for early memory detection. In 'early_parse_mem' the data type used for the start and size of a memory region specified on the command line is incorrect. If 64-bit addressing is used, the value gets truncated. Signed-off-by: Steven J. Hill <Steven.Hill@imgtec.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8456/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:07 UTC |
| 9e2b537 | Markos Chandras | 21 July 2014, 07:46:14 UTC | MIPS: Kconfig: Don't allow both microMIPS and SmartMIPS to be selected. microMIPS and SmartMIPS can't be used together. This fixes the following build problem: Warning: the 32-bit microMIPS architecture does not support the `smartmips' extension arch/mips/kernel/entry.S:90: Error: unrecognized opcode `mtlhx $24' [...] arch/mips/kernel/entry.S:109: Error: unrecognized opcode `mtlhx $24' Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/7421/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:07 UTC |
| 76cff82 | Markos Chandras | 16 July 2014, 07:53:39 UTC | MIPS: kernel: cps-vec: Set ISA level to mips32r2 for the MIPS MT ASE Fixes the following build warnings: arch/mips/kernel/cps-vec.S: Assembler messages: arch/mips/kernel/cps-vec.S:228: Warning: the `mt' extension requires MIPS32 revision 2 or greater [...] arch/mips/kernel/cps-vec.S: Assembler messages: arch/mips/kernel/cps-vec.S:345: Warning: the `mt' extension requires MIPS32 revision 2 or greater Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> Cc: Paul Burton <Paul.Burton@imgtec.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/7355/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:06 UTC |
| 3964917 | Florian Fainelli | 24 September 2014, 17:55:11 UTC | MIPS: Netlogic: handle modular AHCI builds Commits a951440971d0 ("MIPS: Netlogic: Support for XLP3XX on-chip SATA") and fedfcb1137d2 ("MIPS: Netlogic: XLP9XX on-chip SATA support") added ahci-init and ahci-init-xlp2 as objects to build when CONFIG_SATA_AHCI is enabled. If CONFIG_SATA_AHCI is made modular, these two files will also get built as modules (obj-m), which will result in the following linking failure: ERROR: "nlm_set_pic_extra_ack" [arch/mips/netlogic/xlp/ahci-init.ko] undefined! ERROR: "nlm_io_base" [arch/mips/netlogic/xlp/ahci-init.ko] undefined! ERROR: "nlm_nodes" [arch/mips/netlogic/xlp/ahci-init-xlp2.ko] undefined! ERROR: "nlm_set_pic_extra_ack" [arch/mips/netlogic/xlp/ahci-init-xlp2.ko] undefined! ERROR: "xlp_socdev_to_node" [arch/mips/netlogic/xlp/ahci-init-xlp2.ko] undefined! ERROR: "nlm_io_base" [arch/mips/netlogic/xlp/ahci-init-xlp2.ko] undefined! Just check whether CONFIG_SATA_AHCI is defined for this build, and if that is the case, add these objects to the list of built-in object files. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Cc: linux-mips@linux-mips.org Cc: ganesanr@broadcom.com Cc: jchandra@broadcom.com Patchwork: https://patchwork.linux-mips.org/patch/7855/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:06 UTC |
| 717ce64 | Florian Fainelli | 24 September 2014, 17:55:10 UTC | MIPS: Netlogic: handle modular USB case Commit 1004165f346a ("MIPS: Netlogic: USB support for XLP") and then commit 9eac3591e78b ("MIPS: Netlogic: Add support for USB on XLP2xx") added usb-init and usb-init-xlp2 as objects to build when CONFIG_USB is enabled. If CONFIG_USB is made modular, these two files will also get built as modules (obj-m), which will result in the following linking failure: ERROR: "nlm_io_base" [arch/mips/netlogic/xlp/usb-init.ko] undefined! ERROR: "nlm_nodes" [arch/mips/netlogic/xlp/usb-init-xlp2.ko] undefined! ERROR: "nlm_set_pic_extra_ack" [arch/mips/netlogic/xlp/usb-init-xlp2.ko] undefined! ERROR: "xlp_socdev_to_node" [arch/mips/netlogic/xlp/usb-init-xlp2.ko] undefined! ERROR: "nlm_io_base" [arch/mips/netlogic/xlp/usb-init-xlp2.ko] undefined! Just check whether CONFIG_USB is defined for this build, and if that is the case, add these objects to the list of built-in object files. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Cc: linux-mips@linux-mips.org Cc: ganesanr@broadcom.com Cc: jchandra@broadcom.com Patchwork: https://patchwork.linux-mips.org/patch/7854/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:06 UTC |
| 26927f7 | Aaro Koskinen | 19 November 2014, 23:05:38 UTC | MIPS: Loongson: Make platform serial setup always built-in. If SERIAL_8250 is compiled as a module, the platform specific setup for Loongson will be a module too, and it will not work very well. At least on Loongson 3 it will trigger a build failure, since loongson_sysconf is not exported to modules. Fix by making the platform specific serial code always built-in. Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi> Reported-by: Ralf Baechle <ralf@linux-mips.org> Cc: stable@vger.kernel.org Cc: linux-mips@linux-mips.org Cc: Huacai Chen <chenhc@lemote.com> Cc: Markos Chandras <Markos.Chandras@imgtec.com> Patchwork: https://patchwork.linux-mips.org/patch/8533/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:06 UTC |
| 14fa12d | Paul Burton | 28 October 2014, 11:25:51 UTC | MIPS: fix EVA & non-SMP non-FPU FP context signal handling The save_fp_context & restore_fp_context pointers were being assigned to the wrong variables if either: - The kernel is configured for UP & runs on a system without an FPU, since b2ead5282885 "MIPS: Move & rename fpu_emulator_{save,restore}_context". - The kernel is configured for EVA, since ca750649e08c "MIPS: kernel: signal: Prevent save/restore FPU context in user memory". This would lead to FP context being clobbered incorrectly when setting up a sigcontext, then the garbage values being saved uselessly when returning from the signal. Fix by swapping the pointer assignments appropriately. Signed-off-by: Paul Burton <paul.burton@imgtec.com> Cc: stable@vger.kernel.org # v3.15+ Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8230/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:06 UTC |
| cf0a8aa | Markos Chandras | 10 November 2014, 12:25:34 UTC | MIPS: cpu-probe: Set the FTLB probability bit on supported cores Make use of the Config6/FLTBP bit to set the probability of a TLBWR instruction to hit the FTLB or the VTLB. A value of 0 (which may be the default value on certain cores, such as proAptiv or P5600) means that a TLBWR instruction will never hit the VTLB which leads to performance limitations since it effectively decreases the number of available TLB slots. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> Reviewed-by: James Hogan <james.hogan@imgtec.com> Cc: <stable@vger.kernel.org> # v3.15+ Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8368/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:05 UTC |
| 4ec8f9e | Kevin Cernekee | 21 October 2014, 04:27:51 UTC | MIPS: BMIPS: Fix ".previous without corresponding .section" warnings Commit 078a55fc824c1 ("Delete __cpuinit/__CPUINIT usage from MIPS code") removed our __CPUINIT directives, so now the ".previous" directives are superfluous. Remove them. Signed-off-by: Kevin Cernekee <cernekee@gmail.com> Cc: f.fainelli@gmail.com Cc: mbizon@freebox.fr Cc: jogo@openwrt.org Cc: jfraser@broadcom.com Cc: linux-mips@linux-mips.org Cc: devicetree@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/8156/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:05 UTC |
| 14aa136 | Ralf Baechle | 04 November 2014, 01:23:45 UTC | MIPS: uaccess.h: Fix strnlen_user comment. Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:05 UTC |
| 83fd434 | Markos Chandras | 05 November 2014, 08:25:37 UTC | MIPS: r4kcache: Add EVA case for protected_writeback_dcache_line Commit de8974e3f76c0 ("MIPS: asm: r4kcache: Add EVA cache flushing functions") added cache function for EVA using the cachee instruction. However, it didn't add a case for the protected_writeback_dcache_line. mips_dsemul() calls r4k_flush_cache_sigtramp() which in turn uses the protected_writeback_dcache_line() to flush the trampoline code back to memory. This used the wrong "cache" instruction leading to random userland crashes on non-FPU cores. Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> Cc: <stable@vger.kernel.org> # v3.15+ Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8331/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:04 UTC |
| 7f0dd76 | Rafał Miłecki | 03 September 2014, 05:36:51 UTC | MIPS: Fix info about plat_setup in arch_mem_init comment Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/7607/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:04 UTC |
| 3dc4bf3 | Masanari Iida | 07 October 2014, 03:57:45 UTC | MIPS: rtlx: Remove KERN_DEBUG from pr_debug() arguments in rtlx.c Signed-off-by: Masanari Iida <standby24x7@gmail.com> Cc: linux-kernel@vger.kernel.org Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/7938/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:04 UTC |
| a54b8b0 | Ralf Baechle | 23 October 2014, 22:41:45 UTC | MIPS: SEAD3: Fix LED device registration. This isn't a module and shouldn't be one. Signed-off-by: Ralf Baechle <ralf@linux-mips.org> Cc: Markos Chandras <markos.chandras@imgtec.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8202/ | 24 November 2014, 06:44:03 UTC |
| b61a393 | Huacai Chen | 12 November 2014, 05:47:14 UTC | MIPS: Fix a copy & paste error in unistd.h Commit 5df4c8dbbc (MIPS: Wire up bpf syscall.) break the N32 build because of a copy & paste error. Signed-off-by: Huacai Chen <chenhc@lemote.com> Cc: John Crispin <john@phrozen.org> Cc: Steven J. Hill <Steven.Hill@imgtec.com> Cc: linux-mips@linux-mips.org Cc: Fuxin Zhang <zhangfx@lemote.com> Cc: Zhangjin Wu <wuzhangjin@gmail.com> Patchwork: https://patchwork.linux-mips.org/patch/8390/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> | 24 November 2014, 06:44:03 UTC |
| 31345e1 | Benjamin Herrenschmidt | 07 October 2014, 05:13:34 UTC | powerpc/pci: Remove unused force_32bit_msi quirk This is now fully replaced with the generic "no_64bit_msi" one that is set by the respective drivers directly. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | 24 November 2014, 03:36:02 UTC |
| 415072a | Benjamin Herrenschmidt | 07 October 2014, 05:12:55 UTC | powerpc/pseries: Honor the generic "no_64bit_msi" flag Instead of the arch specific quirk which we are deprecating Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> CC: <stable@vger.kernel.org> | 24 November 2014, 03:36:02 UTC |
| 3607438 | Benjamin Herrenschmidt | 07 October 2014, 05:12:36 UTC | powerpc/powernv: Honor the generic "no_64bit_msi" flag Instead of the arch specific quirk which we are deprecating and that drivers don't understand. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> CC: <stable@vger.kernel.org> | 24 November 2014, 03:36:01 UTC |
| db79afa | Benjamin Herrenschmidt | 24 November 2014, 03:17:08 UTC | sound/radeon: Move 64-bit MSI quirk from arch to driver A number of radeon cards have a HW limitation causing them to be unable to generate the full 64-bit of address bits for MSIs. This breaks MSIs on some platforms such as POWER machines. We used to have a powerpc specific quirk to address that on a single card, but this doesn't scale very well, this is better put under control of the drivers who know precisely what a given HW revision can do. We now have a generic quirk in the PCI code. We should set it appropriately for all radeon's from the audio driver. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Reviewed-by: Takashi Iwai <tiwai@suse.de> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> CC: <stable@vger.kernel.org> | 24 November 2014, 03:17:34 UTC |
| 91ed6fd | Benjamin Herrenschmidt | 03 October 2014, 05:18:59 UTC | gpu/radeon: Set flag to indicate broken 64-bit MSI Some radeon ASICs don't support all 64 address bits of MSIs despite advertising support for 64-bit MSIs in their configuration space. This breaks on systems such as IBM POWER7/8, where 64-bit MSIs can be assigned with some of the high address bits set. This makes use of the newly introduced "no_64bit_msi" flag in structure pci_dev to allow the MSI allocation code to fallback to 32-bit MSIs on those adapters. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> CC: <stable@vger.kernel.org> --- Adding Alex's review tag. Patch to the driver is identical to the reviewed one, I dropped the arch/powerpc hunk rewrote the subject and cset comment. | 24 November 2014, 03:12:56 UTC |
| f144d14 | Benjamin Herrenschmidt | 03 October 2014, 05:13:24 UTC | PCI/MSI: Add device flag indicating that 64-bit MSIs don't work This can be set by quirks/drivers to be used by the architecture code that assigns the MSI addresses. We additionally add verification in the core MSI code that the values assigned by the architecture do satisfy the limitation in order to fail gracefully if they don't (ie. the arch hasn't been updated to deal with that quirk yet). Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> CC: <stable@vger.kernel.org> Acked-by: Bjorn Helgaas <bhelgaas@google.com> | 24 November 2014, 03:11:34 UTC |
| 413cbf4 | Takashi Iwai | 01 October 2014, 08:30:53 UTC | ALSA: hda - Limit 40bit DMA for AMD HDMI controllers AMD/ATI HDMI controller chip models, we already have a filter to lower to 32bit DMA, but the rest are supposed to be working with 64bit although the hardware doesn't really work with 63bit but only with 40 or 48bit DMA. In this patch, we take 40bit DMA for safety for the AMD/ATI controllers as the graphics drivers does. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> CC: <stable@vger.kernel.org> | 24 November 2014, 03:02:53 UTC |
| 20ea60c | lucien | 23 November 2014, 07:04:11 UTC | ip_tunnel: the lack of vti_link_ops' dellink() cause kernel panic Now the vti_link_ops do not point the .dellink, for fb tunnel device (ip_vti0), the net_device will be removed as the default .dellink is unregister_netdevice_queue,but the tunnel still in the tunnel list, then if we add a new vti tunnel, in ip_tunnel_find(): hlist_for_each_entry_rcu(t, head, hash_node) { if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr && link == t->parms.link && ==> type == t->dev->type && ip_tunnel_key_match(&t->parms, flags, key)) break; } the panic will happen, cause dev of ip_tunnel *t is null: [ 3835.072977] IP: [<ffffffffa04103fd>] ip_tunnel_find+0x9d/0xc0 [ip_tunnel] [ 3835.073008] PGD b2c21067 PUD b7277067 PMD 0 [ 3835.073008] Oops: 0000 [#1] SMP ..... [ 3835.073008] Stack: [ 3835.073008] ffff8800b72d77f0 ffffffffa0411924 ffff8800bb956000 ffff8800b72d78e0 [ 3835.073008] ffff8800b72d78a0 0000000000000000 ffffffffa040d100 ffff8800b72d7858 [ 3835.073008] ffffffffa040b2e3 0000000000000000 0000000000000000 0000000000000000 [ 3835.073008] Call Trace: [ 3835.073008] [<ffffffffa0411924>] ip_tunnel_newlink+0x64/0x160 [ip_tunnel] [ 3835.073008] [<ffffffffa040b2e3>] vti_newlink+0x43/0x70 [ip_vti] [ 3835.073008] [<ffffffff8150d4da>] rtnl_newlink+0x4fa/0x5f0 [ 3835.073008] [<ffffffff812f68bb>] ? nla_strlcpy+0x5b/0x70 [ 3835.073008] [<ffffffff81508fb0>] ? rtnl_link_ops_get+0x40/0x60 [ 3835.073008] [<ffffffff8150d11f>] ? rtnl_newlink+0x13f/0x5f0 [ 3835.073008] [<ffffffff81509cf4>] rtnetlink_rcv_msg+0xa4/0x270 [ 3835.073008] [<ffffffff8126adf5>] ? sock_has_perm+0x75/0x90 [ 3835.073008] [<ffffffff81509c50>] ? rtnetlink_rcv+0x30/0x30 [ 3835.073008] [<ffffffff81529e39>] netlink_rcv_skb+0xa9/0xc0 [ 3835.073008] [<ffffffff81509c48>] rtnetlink_rcv+0x28/0x30 .... modprobe ip_vti ip link del ip_vti0 type vti ip link add ip_vti0 type vti rmmod ip_vti do that one or more times, kernel will panic. fix it by assigning ip_tunnel_dellink to vti_link_ops' dellink, in which we skip the unregister of fb tunnel device. do the same on ip6_vti. Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Cong Wang <cwang@twopensource.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 November 2014, 02:11:17 UTC |
| 5d01410 | Linus Torvalds | 23 November 2014, 23:25:20 UTC | Linux 3.18-rc6 | 23 November 2014, 23:25:20 UTC |
| 82975bc | Andy Lutomirski | 21 November 2014, 21:26:07 UTC | uprobes, x86: Fix _TIF_UPROBE vs _TIF_NOTIFY_RESUME x86 call do_notify_resume on paranoid returns if TIF_UPROBE is set but not on non-paranoid returns. I suspect that this is a mistake and that the code only works because int3 is paranoid. Setting _TIF_NOTIFY_RESUME in the uprobe code was probably a workaround for the x86 bug. With that bug fixed, we can remove _TIF_NOTIFY_RESUME from the uprobes code. Reported-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com> Acked-by: Borislav Petkov <bp@suse.de> Signed-off-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 23 November 2014, 22:25:28 UTC |
| 90e362f | Thomas Gleixner | 23 November 2014, 22:04:52 UTC | sched: Provide update_curr callbacks for stop/idle scheduling classes Chris bisected a NULL pointer deference in task_sched_runtime() to commit 6e998916dfe3 'sched/cputime: Fix clock_nanosleep()/clock_gettime() inconsistency'. Chris observed crashes in atop or other /proc walking programs when he started fork bombs on his machine. He assumed that this is a new exit race, but that does not make any sense when looking at that commit. What's interesting is that, the commit provides update_curr callbacks for all scheduling classes except stop_task and idle_task. While nothing can ever hit that via the clock_nanosleep() and clock_gettime() interfaces, which have been the target of the commit in question, the author obviously forgot that there are other code paths which invoke task_sched_runtime() do_task_stat(() thread_group_cputime_adjusted() thread_group_cputime() task_cputime() task_sched_runtime() if (task_current(rq, p) && task_on_rq_queued(p)) { update_rq_clock(rq); up->sched_class->update_curr(rq); } If the stats are read for a stomp machine task, aka 'migration/N' and that task is current on its cpu, this will happily call the NULL pointer of stop_task->update_curr. Ooops. Chris observation that this happens faster when he runs the fork bomb makes sense as the fork bomb will kick migration threads more often so the probability to hit the issue will increase. Add the missing update_curr callbacks to the scheduler classes stop_task and idle_task. While idle tasks cannot be monitored via /proc we have other means to hit the idle case. Fixes: 6e998916dfe3 'sched/cputime: Fix clock_nanosleep()/clock_gettime() inconsistency' Reported-by: Chris Mason <clm@fb.com> Reported-and-tested-by: Borislav Petkov <bp@alien8.de> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@kernel.org> Cc: Stanislaw Gruszka <sgruszka@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 23 November 2014, 22:14:40 UTC |
| 00c89b2 | Linus Torvalds | 23 November 2014, 21:56:55 UTC | Merge branch 'x86-traps' (trap handling from Andy Lutomirski) Merge x86-64 iret fixes from Andy Lutomirski: "This addresses the following issues: - an unrecoverable double-fault triggerable with modify_ldt. - invalid stack usage in espfix64 failed IRET recovery from IST context. - invalid stack usage in non-espfix64 failed IRET recovery from IST context. It also makes a good but IMO scary change: non-espfix64 failed IRET will now report the correct error. Hopefully nothing depended on the old incorrect behavior, but maybe Wine will get confused in some obscure corner case" * emailed patches from Andy Lutomirski <luto@amacapital.net>: x86_64, traps: Rework bad_iret x86_64, traps: Stop using IST for #SS x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C | 23 November 2014, 21:56:55 UTC |
| b645af2 | Andy Lutomirski | 23 November 2014, 02:00:33 UTC | x86_64, traps: Rework bad_iret It's possible for iretq to userspace to fail. This can happen because of a bad CS, SS, or RIP. Historically, we've handled it by fixing up an exception from iretq to land at bad_iret, which pretends that the failed iret frame was really the hardware part of #GP(0) from userspace. To make this work, there's an extra fixup to fudge the gs base into a usable state. This is suboptimal because it loses the original exception. It's also buggy because there's no guarantee that we were on the kernel stack to begin with. For example, if the failing iret happened on return from an NMI, then we'll end up executing general_protection on the NMI stack. This is bad for several reasons, the most immediate of which is that general_protection, as a non-paranoid idtentry, will try to deliver signals and/or schedule from the wrong stack. This patch throws out bad_iret entirely. As a replacement, it augments the existing swapgs fudge into a full-blown iret fixup, mostly written in C. It's should be clearer and more correct. Signed-off-by: Andy Lutomirski <luto@amacapital.net> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 23 November 2014, 21:56:19 UTC |
| 6f442be | Andy Lutomirski | 23 November 2014, 02:00:32 UTC | x86_64, traps: Stop using IST for #SS On a 32-bit kernel, this has no effect, since there are no IST stacks. On a 64-bit kernel, #SS can only happen in user code, on a failed iret to user space, a canonical violation on access via RSP or RBP, or a genuine stack segment violation in 32-bit kernel code. The first two cases don't need IST, and the latter two cases are unlikely fatal bugs, and promoting them to double faults would be fine. This fixes a bug in which the espfix64 code mishandles a stack segment violation. This saves 4k of memory per CPU and a tiny bit of code. Signed-off-by: Andy Lutomirski <luto@amacapital.net> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 23 November 2014, 21:56:19 UTC |
| af726f2 | Andy Lutomirski | 23 November 2014, 02:00:31 UTC | x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C There's nothing special enough about the espfix64 double fault fixup to justify writing it in assembly. Move it to C. This also fixes a bug: if the double fault came from an IST stack, the old asm code would return to a partially uninitialized stack frame. Fixes: 3891a04aafd668686239349ea58f3314ea2af86b Signed-off-by: Andy Lutomirski <luto@amacapital.net> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 23 November 2014, 21:56:18 UTC |
| 5ac6c72 | Luciano Coelho | 21 October 2014, 13:12:18 UTC | iwlwifi: mvm: check TLV flag before trying to use hotspot firmware commands Older firmwares do not provide support for the HOT_SPOT_CMD command. Check for the appropriate TLV flag that declares hotspot support in the firmware to prevent a firmware assertion failure that can be triggered from the userspace, Cc: stable@vger.kernel.org [3.17+] Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> | 23 November 2014, 19:50:57 UTC |
| 2794631 | Linus Torvalds | 23 November 2014, 19:46:01 UTC | Merge tag 'armsoc-for-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "A collection of fixes this week: - A set of clock fixes for shmobile platforms - A fix for tegra that moves serial port labels to be per board. We're choosing to merge this for 3.18 because the labels will start being parsed in 3.19, and without this change serial port numbers that used to be stable since the dawn of time will change numbers. - A few other DT tweaks for Tegra. - A fix for multi_v7_defconfig that makes it stop spewing cpufreq errors on Arndale (Exynos)" * tag 'armsoc-for-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: multi_v7_defconfig: fix failure setting CPU voltage by enabling dependent I2C controller ARM: tegra: roth: Fix SD card VDD_IO regulator ARM: tegra: Remove eMMC vmmc property for roth/tn7 ARM: dts: tegra: move serial aliases to per-board ARM: tegra: Add serial port labels to Tegra124 DT ARM: shmobile: kzm9g legacy: Set i2c clks_per_count to 2 ARM: shmobile: r8a7740 dtsi: Correct IIC0 parent clock ARM: shmobile: r8a7790: Fix SD3CKCR address to device tree ARM: shmobile: r8a7740 legacy: Correct IIC0 parent clock ARM: shmobile: r8a7740 legacy: Add missing INTCA clock for irqpin module ARM: shmobile: r8a7790: Fix SD3CKCR address ARM: dts: sun6i: Re-parent ahb1_mux to pll6 as required by dma controller | 23 November 2014, 19:46:01 UTC |
| 9f2e0f6 | Linus Torvalds | 23 November 2014, 19:33:49 UTC | Merge branch 'for-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu Pull percpu fix from Tejun Heo: "This contains one patch to fix a race condition which can lead to percpu_ref using a percpu pointer which is corrupted with a set DEAD bit. The bug was introduced while separating out the ATOMIC mode flag from the DEAD flag. The fix is pretty straight forward. I just committed the patch to the percpu tree but am sending out the pull request early as I'll be on vacation for a week. The patch should be fairly safe and while the latency will be higher I'll be checking emails" * 'for-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu: percpu-ref: fix DEAD flag contamination of percpu pointer | 23 November 2014, 19:33:49 UTC |
| 73112f9 | Julia Lawall | 22 November 2014, 14:39:17 UTC | solos-pci: fix error return code Return a negative error code on failure. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ identifier ret; expression e1,e2; @@ ( if (\(ret < 0\|ret != 0\)) { ... return ret; } | ret = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: David S. Miller <davem@davemloft.net> | 23 November 2014, 19:29:44 UTC |
| 17a402a | Carolyn Wyborny | 22 November 2014, 07:52:54 UTC | igb: Fixes needed for surprise removal support This patch adds some checks in order to prevent panic's on surprise removal of devices during S0, S3, S4. Without this patch, Thunderbolt type device removal will panic the system. Signed-off-by: Yanir Lubetkin <yanirx.lubetkin@intel.com> Signed-off-by: Carolyn Wyborny <carolyn.wyborny@intel.com> Tested-by: Aaron Brown <aaron.f.brown@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 23 November 2014, 19:26:12 UTC |
| b5b2ffc | Daniel Borkmann | 22 November 2014, 07:52:53 UTC | ixgbe: fix use after free adapter->state test in ixgbe_remove/ixgbe_probe While working on a different issue, I noticed an annoying use after free bug on my machine when unloading the ixgbe driver: [ 8642.318797] ixgbe 0000:02:00.1: removed PHC on p2p2 [ 8642.742716] ixgbe 0000:02:00.1: complete [ 8642.743784] BUG: unable to handle kernel paging request at ffff8807d3740a90 [ 8642.744828] IP: [<ffffffffa01c77dc>] ixgbe_remove+0xfc/0x1b0 [ixgbe] [ 8642.745886] PGD 20c6067 PUD 81c1f6067 PMD 81c15a067 PTE 80000007d3740060 [ 8642.746956] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC [ 8642.748039] Modules linked in: [...] [ 8642.752929] CPU: 1 PID: 1225 Comm: rmmod Not tainted 3.18.0-rc2+ #49 [ 8642.754203] Hardware name: Supermicro X10SLM-F/X10SLM-F, BIOS 1.1b 11/01/2013 [ 8642.755505] task: ffff8807e34d3fe0 ti: ffff8807b7204000 task.ti: ffff8807b7204000 [ 8642.756831] RIP: 0010:[<ffffffffa01c77dc>] [<ffffffffa01c77dc>] ixgbe_remove+0xfc/0x1b0 [ixgbe] [...] [ 8642.774335] Stack: [ 8642.775805] ffff8807ee824098 ffff8807ee824098 ffffffffa01f3000 ffff8807ee824000 [ 8642.777326] ffff8807b7207e18 ffffffff8137720f ffff8807ee824098 ffff8807ee824098 [ 8642.778848] ffffffffa01f3068 ffff8807ee8240f8 ffff8807b7207e38 ffffffff8144180f [ 8642.780365] Call Trace: [ 8642.781869] [<ffffffff8137720f>] pci_device_remove+0x3f/0xc0 [ 8642.783395] [<ffffffff8144180f>] __device_release_driver+0x7f/0xf0 [ 8642.784876] [<ffffffff814421f8>] driver_detach+0xb8/0xc0 [ 8642.786352] [<ffffffff814414a9>] bus_remove_driver+0x59/0xe0 [ 8642.787783] [<ffffffff814429d0>] driver_unregister+0x30/0x70 [ 8642.789202] [<ffffffff81375c65>] pci_unregister_driver+0x25/0xa0 [ 8642.790657] [<ffffffffa01eb38e>] ixgbe_exit_module+0x1c/0xc8e [ixgbe] [ 8642.792064] [<ffffffff810f93a2>] SyS_delete_module+0x132/0x1c0 [ 8642.793450] [<ffffffff81012c61>] ? do_notify_resume+0x61/0xa0 [ 8642.794837] [<ffffffff816d2029>] system_call_fastpath+0x12/0x17 The issue is that test_and_set_bit() done on adapter->state is being performed *after* the netdevice has been freed via free_netdev(). When netdev is being allocated on initialization time, it allocates a private area, here struct ixgbe_adapter, that resides after the net_device structure. In ixgbe_probe(), the device init routine, we set up the adapter after alloc_etherdev_mq() on the private area and add a reference for the pci_dev as well via pci_set_drvdata(). Both in the error path of ixgbe_probe(), but also on module unload when ixgbe_remove() is being called, commit 41c62843eb6a ("ixgbe: Fix rcu warnings induced by LER") accesses adapter after free_netdev(). The patch stores the result in a bool and thus fixes above oops on my side. Fixes: 41c62843eb6a ("ixgbe: Fix rcu warnings induced by LER") Cc: stable <stable@vger.kernel.org> Cc: Mark Rustad <mark.d.rustad@intel.com> Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 23 November 2014, 19:26:12 UTC |
