| b18042a | Antti Palosaari | 14 March 2015, 16:03:55 UTC | [media] rtl28xxu: return success for unimplemented FE callback Return success for FE callback on case we don't have any special implementation. fc0013 tuner driver calls that callback in order to switch antenna input, even we don't provide antenna switch. Returning error caused fc0013 driver given up tuning. Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 02 April 2015, 21:27:14 UTC |
| b3b2bf8 | Antti Palosaari | 14 March 2015, 14:13:07 UTC | [media] rtl2832: disable regmap register cache Caching register reads causes some random I/O errors on channel change. Disable caching now in order to avoid those errors. Reverts partly commit dcadb82 Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 02 April 2015, 21:26:45 UTC |
| b0838b1 | Linus Torvalds | 02 April 2015, 20:53:53 UTC | Merge tag 'stable/for-linus-4.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen regression fixes from David Vrabel: "Fix two regressions in the balloon driver's use of memory hotplug when used in a PV guest" * tag 'stable/for-linus-4.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/balloon: before adding hotplugged memory, set frames to invalid x86/xen: prepare p2m list for memory hotplug | 02 April 2015, 20:53:53 UTC |
| 1d51433 | Linus Torvalds | 02 April 2015, 20:48:43 UTC | Merge tag 'powerpc-4.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux Pull powerpc fix from Michael Ellerman: "Fix memory corruption by pnv_alloc_idle_core_states" * tag 'powerpc-4.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux: powerpc: fix memory corruption by pnv_alloc_idle_core_states | 02 April 2015, 20:48:43 UTC |
| 06459fc | Linus Torvalds | 02 April 2015, 20:35:58 UTC | Merge tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband Pull infiniband/rdma fix from Roland Dreier: "Fix for exploitable integer overflow in uverbs interface" * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic | 02 April 2015, 20:35:58 UTC |
| 666b805 | Neal Cardwell | 02 April 2015, 00:26:46 UTC | tcp: fix FRTO undo on cumulative ACK of SACKed range On processing cumulative ACKs, the FRTO code was not checking the SACKed bit, meaning that there could be a spurious FRTO undo on a cumulative ACK of a previously SACKed skb. The FRTO code should only consider a cumulative ACK to indicate that an original/unretransmitted skb is newly ACKed if the skb was not yet SACKed. The effect of the spurious FRTO undo would typically be to make the connection think that all previously-sent packets were in flight when they really weren't, leading to a stall and an RTO. Signed-off-by: Neal Cardwell <ncardwell@google.com> Signed-off-by: Yuchung Cheng <ycheng@google.com> Fixes: e33099f96d99c ("tcp: implement RFC5682 F-RTO") Signed-off-by: David S. Miller <davem@davemloft.net> | 02 April 2015, 20:35:58 UTC |
| 0c36820 | Jonathan Davies | 31 March 2015, 10:05:15 UTC | xen-netfront: transmit fully GSO-sized packets xen-netfront limits transmitted skbs to be at most 44 segments in size. However, GSO permits up to 65536 bytes, which means a maximum of 45 segments of 1448 bytes each. This slight reduction in the size of packets means a slight loss in efficiency. Since c/s 9ecd1a75d, xen-netfront sets gso_max_size to XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER, where XEN_NETIF_MAX_TX_SIZE is 65535 bytes. The calculation used by tcp_tso_autosize (and also tcp_xmit_size_goal since c/s 6c09fa09d) in determining when to split an skb into two is sk->sk_gso_max_size - 1 - MAX_TCP_HEADER. So the maximum permitted size of an skb is calculated to be (XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER) - 1 - MAX_TCP_HEADER. Intuitively, this looks like the wrong formula -- we don't need two TCP headers. Instead, there is no need to deviate from the default gso_max_size of 65536 as this already accommodates the size of the header. Currently, the largest skb transmitted by netfront is 63712 bytes (44 segments of 1448 bytes each), as observed via tcpdump. This patch makes netfront send skbs of up to 65160 bytes (45 segments of 1448 bytes each). Similarly, the maximum allowable mtu does not need to subtract MAX_TCP_HEADER as it relates to the size of the whole packet, including the header. Fixes: 9ecd1a75d977 ("xen-netfront: reduce gso_max_size to account for max TCP header") Signed-off-by: Jonathan Davies <jonathan.davies@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 02 April 2015, 20:18:58 UTC |
| 0a48127 | Linus Torvalds | 02 April 2015, 18:30:36 UTC | Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "This time we have addition of caps for jz4740 which fixes intentional warning at boot. Then we have memory leak issues in drivers using virt-dma by Peter on few drive" * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: moxart-dma: Fix memory leak when stopping a running transfer dmaengine: bcm2835-dma: Fix memory leak when stopping a running transfer dmaengine: omap-dma: Fix memory leak when terminating running transfer dmaengine: edma: fix memory leak when terminating running transfers dmaengine: jz4740: Define capabilities | 02 April 2015, 18:30:36 UTC |
| 8172ba5 | Linus Torvalds | 02 April 2015, 18:09:41 UTC | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix use-after-free with mac80211 RX A-MPDU reorder timer, from Johannes Berg. 2) iwlwifi leaks memory every module load/unload cycles, fix from Larry Finger. 3) Need to use for_each_netdev_safe() in rtnl_group_changelink() otherwise we can crash, from WANG Cong. 4) mlx4 driver does register_netdev() too early in the probe sequence, from Ido Shamay. 5) Don't allow router discovery hop limit to decrease the interface's hop limit, from D.S. Ljungmark. 6) tx_packets and tx_bytes improperly accounted for certain classes of USB network devices, fix from Ben Hutchings. 7) ip{6}mr_rules_init() mistakenly use plain kfree to release the ipmr tables in the error path, they must instead use ip{6}mr_free_table(). Fix from WANG Cong. 8) cxgb4 doesn't properly quiesce all RX activity before unregistering the netdevice. Fix from Hariprasad Shenai. 9) Fix hash corruptions in ipvlan driver, from Jiri Benc. 10) nla_memcpy(), like a real memcpy, should fully initialize the destination buffer, even if the source attribute is smaller. Fix from Jiri Benc. 11) Fix wrong error code returned from iucv_sock_sendmsg(). We should use whatever sock_alloc_send_skb() put into 'err'. From Eugene Crosser. 12) Fix slab object leak on module unload in TIPC, from Ying Xue. 13) Need a READ_ONCE() when reading the cached RX socket route in tcp_v{4,6}_early_demux(). From Michal Kubecek. 14) Still too many problems with TPC support in the ath9k driver, so disable it for now. From Felix Fietkau. 15) When in AP mode the rtlwifi driver can leak DMA mappings, fix from Larry Finger. 16) Missing kzalloc() failure check in gs_usb CAN driver, from Colin Ian King. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits) cxgb4: Fix to dump devlog, even if FW is crashed cxgb4: Firmware macro changes for fw verison 1.13.32.0 bnx2x: Fix kdump when iommu=on bnx2x: Fix kdump on 4-port device mac80211: fix RX A-MPDU session reorder timer deletion MAINTAINERS: Update Intel Wired Ethernet Driver info tipc: fix a slab object leak net/usb/r8152: add device id for Lenovo TP USB 3.0 Ethernet af_iucv: fix AF_IUCV sendmsg() errno openvswitch: Return vport module ref before destruction netlink: pad nla_memcpy dest buffer with zeroes bonding: Bonding Overriding Configuration logic restored. ipvlan: fix check for IP addresses in control path ipvlan: do not use rcu operations for address list ipvlan: protect against concurrent link removal ipvlan: fix addr hash list corruption net: fec: setup right value for mdio hold time net: tcp6: fix double call of tcp_v6_fill_cb() cxgb4vf: Fix sparse warnings netns: don't clear nsid too early on removal ... | 02 April 2015, 18:09:41 UTC |
| 8494057 | Shachar Raindel | 18 March 2015, 17:39:08 UTC | IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic Properly verify that the resulting page aligned end address is larger than both the start address and the length of the memory area requested. Both the start and length arguments for ib_umem_get are controlled by the user. A misbehaving user can provide values which will cause an integer overflow when calculating the page aligned end address. This overflow can cause also miscalculation of the number of pages mapped, and additional logic issues. Addresses: CVE-2014-8159 Cc: <stable@vger.kernel.org> Signed-off-by: Shachar Raindel <raindel@mellanox.com> Signed-off-by: Jack Morgenstein <jackm@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: Roland Dreier <roland@purestorage.com> | 02 April 2015, 16:53:59 UTC |
| c420f19 | Andi Kleen | 09 March 2015, 18:20:22 UTC | perf/x86/intel: Fix Haswell CYCLE_ACTIVITY.* counter constraints Some of the CYCLE_ACTIVITY.* events can only be scheduled on counter 2. Due to a typo Haswell matched those with INTEL_EVENT_CONSTRAINT, which lead to the events never matching as the comparison does not expect anything in the umask too. Fix the typo. Signed-off-by: Andi Kleen <ak@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: http://lkml.kernel.org/r/1425925222-32361-1-git-send-email-andi@firstfloor.org Signed-off-by: Ingo Molnar <mingo@kernel.org> | 02 April 2015, 15:07:43 UTC |
| 687805e | Kan Liang | 27 March 2015, 14:38:25 UTC | perf/x86/intel: Filter branches for PEBS event For supporting Intel LBR branches filtering, Intel LBR sharing logic mechanism is introduced from commit b36817e88630 ("perf/x86: Add Intel LBR sharing logic"). It modifies __intel_shared_reg_get_constraints() to config lbr_sel, which is finally used to set LBR_SELECT. However, the intel_shared_regs_constraints() function is called after intel_pebs_constraints(). The PEBS event will return immediately after intel_pebs_constraints(). So it's impossible to filter branches for PEBS events. This patch moves intel_shared_regs_constraints() ahead of intel_pebs_constraints(). We can safely do that because the intel_shared_regs_constraints() function only returns empty constraint if its rejecting the event, otherwise it returns NULL such that we continue calling intel_pebs_constraints() and x86_get_event_constraint(). Signed-off-by: Kan Liang <kan.liang@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: eranian@google.com Link: http://lkml.kernel.org/r/1427467105-9260-1-git-send-email-kan.liang@intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org> | 02 April 2015, 15:07:42 UTC |
| 22e2e86 | Christian König | 31 March 2015, 15:36:58 UTC | drm/radeon: fix wait in radeon_mn_invalidate_range_start We need to wait for all fences, not just the exclusive one. Signed-off-by: Christian König <christian.koenig@amd.com> Cc: <stable@vger.kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> | 02 April 2015, 14:03:29 UTC |
| 863653f | Christian König | 31 March 2015, 15:36:57 UTC | drm/radeon: add extra check in radeon_ttm_tt_unpin_userptr We somehow try to free the SG table twice. Bugs: https://bugs.freedesktop.org/show_bug.cgi?id=89734 Signed-off-by: Christian König <christian.koenig@amd.com> Cc: <stable@vger.kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> | 02 April 2015, 14:03:29 UTC |
| adacb22 | Daniel Stone | 17 March 2015, 13:24:58 UTC | drm: Exynos: Respect framebuffer pitch for FIMD/Mixer When performing a modeset, use the framebuffer pitch value to set FIMD IMG_SIZE and Mixer SPAN registers. These are both defined as pitch - the distance between contiguous lines (bytes for FIMD, pixels for mixer). Fixes display on Snow (1366x768). Signed-off-by: Daniel Stone <daniels@collabora.com> Tested-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk> Signed-off-by: Inki Dae <inki.dae@samsung.com> | 02 April 2015, 13:37:13 UTC |
| 4879785 | Sakari Ailus | 13 February 2015, 07:42:37 UTC | [media] vb2: Fix dma_dir setting for dma-contig mem type The last argument of vb2_dc_get_user_pages() is of type enum dma_data_direction, but the caller, vb2_dc_get_userptr() passes a value which is the result of comparison dma_dir == DMA_FROM_DEVICE. This results in the write parameter to get_user_pages() being zero in all cases, i.e. that the caller has no intent to write there. This was broken by patch "vb2: replace 'write' by 'dma_dir'". Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: stable@vger.kernel.org # for v3.19 Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 02 April 2015, 11:56:26 UTC |
| f59df35 | Steffen Liebergeld | 02 April 2015, 09:01:59 UTC | kgdb/x86: Fix reporting of 'si' in kgdb on x86_64 This patch fixes an error in kgdb for x86_64 which would report the value of dx when asked to give the value of si. Signed-off-by: Steffen Liebergeld <steffen.liebergeld@kernkonzept.com> Cc: Jason Wessel <jason.wessel@windriver.com> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org> | 02 April 2015, 09:32:16 UTC |
| 7ea2416 | Andy Lutomirski | 01 April 2015, 21:26:34 UTC | x86/asm/entry/64: Disable opportunistic SYSRET if regs->flags has TF set When I wrote the opportunistic SYSRET code, I missed an important difference between SYSRET and IRET. Both instructions are capable of setting EFLAGS.TF, but they behave differently when doing so: - IRET will not issue a #DB trap after execution when it sets TF. This is critical -- otherwise you'd never be able to make forward progress when returning to userspace. - SYSRET, on the other hand, will trap with #DB immediately after returning to CPL3, and the next instruction will never execute. This breaks anything that opportunistically SYSRETs to a user context with TF set. For example, running this code with TF set and a SIGTRAP handler loaded never gets past 'post_nop': extern unsigned char post_nop[]; asm volatile ("pushfq\n\t" "popq %%r11\n\t" "nop\n\t" "post_nop:" : : "c" (post_nop) : "r11"); In my defense, I can't find this documented in the AMD or Intel manual. Fix it by using IRET to restore TF. Signed-off-by: Andy Lutomirski <luto@kernel.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Borislav Petkov <bp@suse.de> Cc: Brian Gerst <brgerst@gmail.com> Cc: Denys Vlasenko <dvlasenk@redhat.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Thomas Gleixner <tglx@linutronix.de> Fixes: 2a23c6b8a9c4 ("x86_64, entry: Use sysret to return to userspace when possible") Link: http://lkml.kernel.org/r/9472f1ca4c19a38ecda45bba9c91b7168135fcfa.1427923514.git.luto@kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org> | 02 April 2015, 09:09:54 UTC |
| 840a1cf | Ville Syrjälä | 27 March 2015, 17:59:40 UTC | drm/i915: Reject the colorkey ioctls for primary and cursor planes The legcy colorkey ioctls are only implemented for sprite planes, so reject the ioctl for primary/cursor planes. If we want to support colorkeying with these planes (assuming we have hw support of course) we should just move ahead with the colorkey property conversion. Testcase: kms_legacy_colorkey Cc: Tommi Rantala <tt.rantala@gmail.com> Cc: stable@vger.kernel.org Reference: http://mid.gmane.org/CA+ydwtr+bCo7LJ44JFmUkVRx144UDFgOS+aJTfK6KHtvBDVuAw@mail.gmail.com Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Jani Nikula <jani.nikula@intel.com> | 02 April 2015, 08:25:50 UTC |
| 86d65dc | Andy Grover | 31 March 2015, 22:04:37 UTC | target: Allow userspace to write 1 to attrib/emulate_fua_write Before 4.0, reading attrib/emulate_fua_write has returned 1. Saved configs created on a pre-4.0 kernel will try to write that back when restoring LIO configuration. This should succeed with no effect, and issue a warning. See https://bugzilla.redhat.com/show_bug.cgi?id=1206184 Reported-by: Yanko Kaneti <yaneti@declera.com> Reported-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> | 02 April 2015, 04:42:51 UTC |
| f5f321c | David S. Miller | 01 April 2015, 18:48:50 UTC | Merge tag 'wireless-drivers-for-davem-2015-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== iwlwifi: * fix a memory leak, we leaked memory each time the module was loaded. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 01 April 2015, 18:48:50 UTC |
| 877e45d | David S. Miller | 01 April 2015, 18:47:21 UTC | Merge branch 'cxgb4-net' Hariprasad Shenai says: ==================== cxgb4 FW macro changes for new FW Fix to dump device log even in the case of firmware crash. Also incorporates changes for new FW. This patch series has been created against net tree and includes patches on cxgb4 driver. We have included all the maintainers of respective drivers. Kindly review the change and let us know in case of any review comments. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 01 April 2015, 18:47:21 UTC |
| ae469b6 | Hariprasad Shenai | 01 April 2015, 16:11:16 UTC | cxgb4: Fix to dump devlog, even if FW is crashed Add new Common Code routines to retrieve Firmware Device Log parameters from PCIE_FW_PF[7]. The firmware initializes its Device Log very early on and stores the parameters for its location/size in that register. Using the parameters from the register allows us to access the Firmware Device Log even when the firmware crashes very early on or we're not attached to the firmware Based on original work by Casey Leedom <leedom@chelsio.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 01 April 2015, 18:47:20 UTC |
| 7ef65a4 | Hariprasad Shenai | 01 April 2015, 16:11:15 UTC | cxgb4: Firmware macro changes for fw verison 1.13.32.0 Adds new macro and few macro changes for fw version 1.13.32.0 also changes version string in driver to match 1.13.32.0 Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 01 April 2015, 18:47:20 UTC |
| af3e09e | David S. Miller | 01 April 2015, 18:19:22 UTC | Merge tag 'mac80211-for-davem-2015-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== This contains just a single fix for a crash I happened to randomly run into today during testing. It's clearly been around for a while, but is pretty hard to trigger, even when I tried explicitly (and modified the code to make it more likely) it rarely did. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 01 April 2015, 18:19:22 UTC |
| d403931 | Linus Torvalds | 01 April 2015, 17:29:55 UTC | Merge tag 'iommu-fixes-v4.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: "This contains fixes for: - a VT-d issue where hardware domain-ids might be freed while still in use. - an ipmmu-vmsa issue where where the device-table was not zero terminated - unchecked register access issue in the arm-smmu driver" * tag 'iommu-fixes-v4.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Remove unused variable iommu: ipmmu-vmsa: Add terminating entry for ipmmu_of_ids iommu/vt-d: Detach domain *only* from attached iommus iommu/arm-smmu: fix ARM_SMMU_FEAT_TRANS_OPS condition | 01 April 2015, 17:29:55 UTC |
| e1b7c02 | Rusty Russell | 01 April 2015, 06:33:30 UTC | lguest: now needs PCI_DIRECT. Since commit 8e7094694396 ("lguest: add a dummy PCI host bridge.") lguest uses PCI, but it needs you to frob the ports directly. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Acked-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 01 April 2015, 17:29:05 UTC |
| b6c3a59 | Linus Torvalds | 01 April 2015, 17:05:42 UTC | Merge tag 'lazytime_fix' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull lazytime fixes from Ted Ts'o: "This fixes a problem in the lazy time patches, which can cause frequently updated inods to never have their timestamps updated. These changes guarantee that no timestamp on disk will be stale by more than 24 hours" * tag 'lazytime_fix' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: fs: add dirtytime_expire_seconds sysctl fs: make sure the timestamps for lazytime inodes eventually get written | 01 April 2015, 17:05:42 UTC |
| 1e84891 | Linus Torvalds | 01 April 2015, 16:45:47 UTC | Merge branch 'for-4.0' of git://linux-nfs.org/~bfields/linux Pull nfsd fixes from Bruce Fields: "Two main issues: - We found that turning on pNFS by default (when it's configured at build time) was too aggressive, so we want to switch the default before the 4.0 release. - Recent client changes to increase open parallelism uncovered a serious bug lurking in the server's open code. Also fix a krb5/selinux regression. The rest is mainly smaller pNFS fixes" * 'for-4.0' of git://linux-nfs.org/~bfields/linux: sunrpc: make debugfs file creation failure non-fatal nfsd: require an explicit option to enable pNFS NFSD: Fix bad update of layout in nfsd4_return_file_layout NFSD: Take care the return value from nfsd4_encode_stateid NFSD: Printk blocklayout length and offset as format 0x%llx nfsd: return correct lockowner when there is a race on hash insert nfsd: return correct openowner when there is a race to put one in the hash NFSD: Put exports after nfsd4_layout_verify fail NFSD: Error out when register_shrinker() fail NFSD: Take care the return value from nfsd4_decode_stateid NFSD: Check layout type when returning client layouts NFSD: restore trace event lost in mismerge | 01 April 2015, 16:45:47 UTC |
| 9c02642 | David S. Miller | 01 April 2015, 16:30:39 UTC | Merge branch 'bnx2' Yuval Mintz says: ==================== bnx2x: kdump related fixes This patch series aims to fix bnx2x driver issues when loading in kdump kernel. Both issues fixed here would be fatal to the device, requiring full reset of the system in order to recover, preventing the device from serving its purpose in the kdump environment. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 01 April 2015, 16:30:39 UTC |
| da254fb | Yuval Mintz | 01 April 2015, 07:02:20 UTC | bnx2x: Fix kdump when iommu=on When IOMM-vtd is active, once main kernel crashes unfinished DMAE transactions will be blocked, putting the HW in an error state which will cause further transactions to timeout. Current employed logic uses wrong macros, causing the first function to be the only function that cleanups that error state during its probe/load. This patch allows all the functions to successfully re-load in kdump kernel. Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com> Signed-off-by: Ariel Elior <Ariel.Elior@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 01 April 2015, 16:30:39 UTC |
| 3d6b725 | Yuval Mintz | 01 April 2015, 07:02:19 UTC | bnx2x: Fix kdump on 4-port device When running in a kdump kernel, it's very likely that due to sync. loss with management firmware the first PCI function to probe and reach the previous unload flow would decide it can reset the chip and continue onward. While doing so, it will only close its own Rx port. On a 4-port device where 2nd port on engine is a 1g-port, the 2nd port would allow ingress traffic after the chip is reset [assuming it was active on the first kernel]. This would later cause a HW attention. This changes driver flow to close both ports' 1g capabilities during the previous driver unload flow prior to the chip reset. Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com> Signed-off-by: Ariel Elior <Ariel.Elior@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 01 April 2015, 16:30:38 UTC |
| 788211d | Johannes Berg | 01 April 2015, 12:20:42 UTC | mac80211: fix RX A-MPDU session reorder timer deletion There's an issue with the way the RX A-MPDU reorder timer is deleted that can cause a kernel crash like this: * tid_rx is removed - call_rcu(ieee80211_free_tid_rx) * station is destroyed * reorder timer fires before ieee80211_free_tid_rx() runs, accessing the station, thus potentially crashing due to the use-after-free The station deletion is protected by synchronize_net(), but that isn't enough -- ieee80211_free_tid_rx() need not have run when that returns (it deletes the timer.) We could use rcu_barrier() instead of synchronize_net(), but that's much more expensive. Instead, to fix this, add a field tracking that the session is being deleted. In this case, the only re-arming of the timer happens with the reorder spinlock held, so make that code not rearm it if the session is being deleted and also delete the timer after setting that field. This ensures the timer cannot fire after ___ieee80211_stop_rx_ba_session() returns, which fixes the problem. Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> | 01 April 2015, 12:35:01 UTC |
| 80313b3 | Stefan Lippers-Hollmann | 30 March 2015, 20:44:27 UTC | x86/reboot: Add ASRock Q1900DC-ITX mainboard reboot quirk The ASRock Q1900DC-ITX mainboard (Baytrail-D) hangs randomly in both BIOS and UEFI mode while rebooting unless reboot=pci is used. Add a quirk to reboot via the pci method. The problem is very intermittent and hard to debug, it might succeed rebooting just fine 40 times in a row - but fails half a dozen times the next day. It seems to be slightly less common in BIOS CSM mode than native UEFI (with the CSM disabled), but it does happen in either mode. Since I've started testing this patch in late january, rebooting has been 100% reliable. Most of the time it already hangs during POST, but occasionally it might even make it through the bootloader and the kernel might even start booting, but then hangs before the mode switch. The same symptoms occur with grub-efi, gummiboot and grub-pc, just as well as (at least) kernel 3.16-3.19 and 4.0-rc6 (I haven't tried older kernels than 3.16). Upgrading to the most current mainboard firmware of the ASRock Q1900DC-ITX, version 1.20, does not improve the situation. ( Searching the web seems to suggest that other Bay Trail-D mainboards might be affected as well. ) -- Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> Cc: <stable@vger.kernel.org> Cc: Matt Fleming <matt.fleming@intel.com> Link: http://lkml.kernel.org/r/20150330224427.0fb58e42@mir Signed-off-by: Ingo Molnar <mingo@kernel.org> | 01 April 2015, 12:08:09 UTC |
| dce5bdf | Greg Kroah-Hartman | 01 April 2015, 11:51:02 UTC | Merge tag 'iio-fixes-for-4.0d' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: IIO fixes for 4.0 set 4 A couple more IIO fixes. * Fix check for HAS_IOMEM in the cc100001_adc driver to avoid build errors. Rather curiously it was ORed with Regulator and clock support. * vf610 driver was trying to use an ADC clock outside the possible spec on some boards. The driver assumed a fixed clock speed previously across all boards, but that is not true. This fix ensures that the reported frequency is correct on all boards. * The adis imu common code directly set the current trigger to the driver supplied one. Unfortunately this didn't increase the use count leading to a double free via a particular path of changing the trigger then removing the driver. | 01 April 2015, 11:51:02 UTC |
| d3a3d28 | Greg Kroah-Hartman | 01 April 2015, 11:42:58 UTC | Merge tag 'usb-serial-4.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for v4.0-rc6 Here are a few new device IDs. Signed-off-by: Johan Hovold <johan@kernel.org> | 01 April 2015, 11:42:58 UTC |
| a0f10c1 | Marek Szyprowski | 04 March 2015, 13:55:22 UTC | [media] media: s5p-mfc: fix broken pointer cast on 64bit arch Unsigned int cannot be used to store casted pointer on 64bit architecture, so correct such casts to properly use unsigned long variables. Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Kamil Debski <k.debski@samsung.com> [k.debski@samsung.com: removed volatile and __iomem from cast] Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 01 April 2015, 09:56:56 UTC |
| 05b676a | Marek Szyprowski | 04 March 2015, 13:55:21 UTC | [media] media: s5p-mfc: fix mmap support for 64bit arch TASK_SIZE is depends on the systems architecture (32 or 64 bits) and it should not be used for defining offset boundary for mmaping buffers for CAPTURE and OUTPUT queues. This patch fixes support for MMAP calls on the CAPTURE queue on 64bit architectures (like ARM64). Cc: stable@vger.kernel.org Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Kamil Debski <k.debski@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 01 April 2015, 09:56:56 UTC |
| 6b46211 | Hans Verkuil | 09 March 2015, 07:20:03 UTC | [media] cx23885: fix querycap cap->device_caps wasn't set in cx23885-417.c causing a warning from the v4l2-core. Reported-by: Joseph Jasi <joe.yasi@gmail.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Cc: <stable@vger.kernel.org> # for v3.19 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 01 April 2015, 09:56:56 UTC |
| ab31203 | Hans Verkuil | 10 December 2014, 15:35:34 UTC | [media] sh_veu: v4l2_dev wasn't set The v4l2_dev field of struct video_device must be set correctly. This was never done for this driver, so no video nodes were created anymore. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Cc: <stable@vger.kernel.org> # for v3.11 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 01 April 2015, 09:56:55 UTC |
| 4c5930e | Steve French | 31 March 2015, 03:03:06 UTC | Fix warning Coverity reports a warning due to unitialized attr structure in one code path. Reported by Coverity (CID 728535) Signed-off-by: Steve French <smfrench@gmail.com> Reviewed-by: Jeff Layton <jlayton@samba.org> | 01 April 2015, 05:01:47 UTC |
| dfebe40 | Steve French | 27 March 2015, 06:00:06 UTC | Fix another dereference before null check warning null tcon is not possible in these paths so remove confusing null check Reported by Coverity (CID 728519) Signed-off-by: Steve French <smfrench@gmail.com> Reviewed-by: Jeff Layton <jlayton@samba.org> | 01 April 2015, 05:01:47 UTC |
| 8b7a454 | Steve French | 30 March 2015, 21:58:17 UTC | CIFS: session servername can't be null remove impossible check Pointed out by Coverity (CID 115422) Signed-off-by: Steve French <smfrench@gmail.com> Reviewed-by: Jeff Layton <jlayton@samba.org> | 01 April 2015, 05:01:47 UTC |
| c85c35f | Steve French | 27 March 2015, 06:15:02 UTC | Fix warning on impossible comparison workstation_RFC1001_name is part of the struct and can't be null, remove impossible comparison (array vs. null) Pointed out by Coverity (CID 140095) Signed-off-by: Steve French <smfrench@gmail.com> Reviewed-by: Jeff Layton <jlayton@samba.org> | 01 April 2015, 05:01:47 UTC |
| 064bcc0 | Steve French | 27 March 2015, 03:41:59 UTC | Fix coverity warning Coverity reports a warning for referencing the beginning of the SMB2/SMB3 frame using the ProtocolId field as an array. Although it works the same either way, this patch should quiet the warning and might be a little clearer. Reported by Coverity (CID 741269) Signed-off-by: Steve French <smfrench@gmail.com> Acked-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com> Acked-by: Sachin Prabhu <sprabhu@redhat.com> Reviewed-by: Jeff Layton <jlayton@poochiereds.net> | 01 April 2015, 05:01:47 UTC |
| 8e35310 | Steve French | 27 March 2015, 00:47:02 UTC | Fix dereference before null check warning null tcon is not likely in these paths in current code, but obviously it does clarify the code to check for null (if at all) before derefrencing rather than after. Reported by Coverity (CID 1042666) Signed-off-by: Steve French <smfrench@gmail.com> Acked-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com> Acked-by: Sachin Prabhu <sprabhu@redhat.com> | 01 April 2015, 05:01:47 UTC |
| f3a31a2 | Steve French | 27 March 2015, 00:23:20 UTC | Don't ignore errors on encrypting password in SMBTcon Although unlikely to fail (and tree connect does not commonly send a password since SECMODE_USER is the default for most servers) do not ignore errors on SMBNTEncrypt in SMB Tree Connect. Reported by Coverity (CID 1226853) Signed-off-by: Steve French <smfrench@gmail.com> Acked-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com> Acked-by: Sachin Prabhu <sprabhu@redhat.com> Reviewed-by: Jeff Layton <jlayton@poochiereds.net> | 01 April 2015, 05:01:46 UTC |
| 75fdfc8 | Steve French | 25 March 2015, 23:51:57 UTC | Fix warning on uninitialized buftype Pointed out by coverity analyzer. resp_buftype is not initialized in one path which can rarely log a spurious warning (buf is null so there will not be a problem with freeing data, but if buf_type were randomly set to wrong value could log a warning) Reported by Coverity (CID 1269144) Signed-off-by: Steve French <smfrench@gmail.com> Acked-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com> Acked-by: Sachin Prabhu <sprabhu@redhat.com> Reviewed-by: Jeff Layton <jlayton@poochiereds.net> | 01 April 2015, 05:01:46 UTC |
| 2f30232 | Jeff Kirsher | 26 March 2015, 00:01:03 UTC | MAINTAINERS: Update Intel Wired Ethernet Driver info Update the git tree info with a recent change in tree names. Also add our new mailing list created solely for Linux kernel patches and kernel development, as well as the new patchwork project for tracking patches. Lastly update the list of "reviewers" since a couple of developers have moved on to different projects. Made an update to the section header so that it is more manageable going forward as we add new drivers. Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> | 01 April 2015, 04:26:36 UTC |
| 7e43690 | Ying Xue | 01 April 2015, 01:42:50 UTC | tipc: fix a slab object leak When remove TIPC module, there is a warning to remind us that a slab object is leaked like: root@localhost:~# rmmod tipc [ 19.056226] ============================================================================= [ 19.057549] BUG TIPC (Not tainted): Objects remaining in TIPC on kmem_cache_close() [ 19.058736] ----------------------------------------------------------------------------- [ 19.058736] [ 19.060287] INFO: Slab 0xffffea0000519a00 objects=23 used=1 fp=0xffff880014668b00 flags=0x100000000004080 [ 19.061915] INFO: Object 0xffff880014668000 @offset=0 [ 19.062717] kmem_cache_destroy TIPC: Slab cache still has objects This is because the listening socket of TIPC topology server is not closed before TIPC proto handler is unregistered with proto_unregister(). However, as the socket is closed in tipc_exit_net() which is called by unregister_pernet_subsys() during unregistering TIPC namespace operation, the warning can be eliminated if calling unregister_pernet_subsys() is moved before calling proto_unregister(). Fixes: e05b31f4bf89 ("tipc: make tipc socket support net namespace") Reviewed-by: Erik Hugne <erik.hugne@ericsson.com> Signed-off-by: Ying Xue <ying.xue@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 01 April 2015, 03:10:08 UTC |
| d52356e | Jan Stancek | 31 March 2015, 16:11:46 UTC | powerpc: fix memory corruption by pnv_alloc_idle_core_states Space allocated for paca is based off nr_cpu_ids, but pnv_alloc_idle_core_states() iterates paca with cpu_nr_cores()*threads_per_core, which is using NR_CPUS. This causes pnv_alloc_idle_core_states() to write over memory, which is outside of paca array and may later lead to various panics. Fixes: 7cba160ad789 (powernv/cpuidle: Redesign idle states management) Signed-off-by: Jan Stancek <jstancek@redhat.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> | 01 April 2015, 01:05:44 UTC |
| 3309677 | Peter Hutterer | 27 March 2015, 16:59:55 UTC | Input: define INPUT_PROP_ACCELEROMETER behavior Spell out what this property means to userspace. If the property is set, all directional axes must be accelerometer axes, any other axes are left as-is. This allows an accelerometer device to e.g. have an ABS_WHEEL. It is not permitted to mix normal directional axes and accelerometer axes on the same device node. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Acked-by: Jiri Kosina <jkosina@suse.cz> Reviewed-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> | 31 March 2015, 21:46:40 UTC |
| 85734b1 | Filip Ayazi | 25 March 2015, 22:53:04 UTC | Input: synaptics - fix min-max quirk value for E440 Commit 98dc070373 ("Input: synaptics - add quirk for Thinkpad E440") had a typo in ymax, this changes the value to the one reported by touchpad-edge-detector and mentioned in the commit. Signed-off-by: Filip Ayazi <filipayazi@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> | 31 March 2015, 21:46:39 UTC |
| 347eec3 | Christian Hesse | 31 March 2015, 12:10:07 UTC | net/usb/r8152: add device id for Lenovo TP USB 3.0 Ethernet This device is sold as 'Lenovo Tinkpad USB 3.0 Ethernet 4X90E51405'. Chipset is RTL8153 and works with r8152. Signed-off-by: Christian Hesse <mail@eworm.de> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 March 2015, 21:15:37 UTC |
| ed4ac42 | Eugene Crosser | 30 March 2015, 13:40:42 UTC | af_iucv: fix AF_IUCV sendmsg() errno When sending over AF_IUCV socket, errno was incorrectly set to ENOMEM even when other values where appropriate, notably EAGAIN. With this patch, error indicator returned by sock_alloc_send_skb() is passed to the caller, rather than being overwritten with ENOMEM. Signed-off-by: Eugene Crosser <Eugene.Crosser@ru.ibm.com> Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 March 2015, 20:06:50 UTC |
| fa2d8ff | Thomas Graf | 30 March 2015, 11:57:41 UTC | openvswitch: Return vport module ref before destruction Return module reference before invoking the respective vport ->destroy() function. This is needed as ovs_vport_del() is not invoked inside an RCU read side critical section so the kfree can occur immediately before returning to ovs_vport_del(). Returning the module reference before ->destroy() is safe because the module unregistration is blocked on ovs_lock which we hold while destroying the datapath. Fixes: 62b9c8d0372d ("ovs: Turn vports with dependencies into separate modules") Reported-by: Pravin Shelar <pshelar@nicira.com> Signed-off-by: Thomas Graf <tgraf@suug.ch> Acked-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 March 2015, 19:59:50 UTC |
| f9c72d1 | Jeff Layton | 31 March 2015, 16:03:28 UTC | sunrpc: make debugfs file creation failure non-fatal We currently have a problem that SELinux policy is being enforced when creating debugfs files. If a debugfs file is created as a side effect of doing some syscall, then that creation can fail if the SELinux policy for that process prevents it. This seems wrong. We don't do that for files under /proc, for instance, so Bruce has proposed a patch to fix that. While discussing that patch however, Greg K.H. stated: "No kernel code should care / fail if a debugfs function fails, so please fix up the sunrpc code first." This patch converts all of the sunrpc debugfs setup code to be void return functins, and the callers to not look for errors from those functions. This should allow rpc_clnt and rpc_xprt creation to work, even if the kernel fails to create debugfs files for some reason. Symptoms were failing krb5 mounts on systems using gss-proxy and selinux. Fixes: 388f0c776781 "sunrpc: add a debugfs rpc_xprt directory..." Cc: stable@vger.kernel.org Signed-off-by: Jeff Layton <jeff.layton@primarydata.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: J. Bruce Fields <bfields@redhat.com> | 31 March 2015, 18:15:08 UTC |
| 5899f04 | Jiri Benc | 29 March 2015, 14:05:28 UTC | netlink: pad nla_memcpy dest buffer with zeroes This is especially important in cases where the kernel allocs a new structure and expects a field to be set from a netlink attribute. If such attribute is shorter than expected, the rest of the field is left containing previous data. When such field is read back by the user space, kernel memory content is leaked. Signed-off-by: Jiri Benc <jbenc@redhat.com> Acked-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 March 2015, 18:07:24 UTC |
| f5e2dc5 | Anton Nayshtut | 29 March 2015, 11:20:25 UTC | bonding: Bonding Overriding Configuration logic restored. Before commit 3900f29021f0bc7fe9815aa32f1a993b7dfdd402 ("bonding: slight optimizztion for bond_slave_override()") the override logic was to send packets with non-zero queue_id through the slave with corresponding queue_id, under two conditions only - if the slave can transmit and it's up. The above mentioned commit changed this logic by introducing an additional condition - whether the bond is active (indirectly, using the slave_can_tx and later - bond_is_active_slave), that prevents the user from implementing more complex policies according to the Documentation/networking/bonding.txt. Signed-off-by: Anton Nayshtut <anton@swortex.com> Signed-off-by: Alexey Bogoslavsky <alexey@swortex.com> Signed-off-by: Andy Gospodarek <gospo@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 March 2015, 17:49:45 UTC |
| d91e901 | David S. Miller | 31 March 2015, 17:28:38 UTC | Merge branch 'ipvlan-corruptions' Jiri Benc says: ==================== ipvlan: list corruption and rcu fixes This patch set fixes different issues leading to corrupted lists and incorrect rcu usage. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 31 March 2015, 17:28:38 UTC |
| e9997c2 | Jiri Benc | 28 March 2015, 18:13:25 UTC | ipvlan: fix check for IP addresses in control path When an ipvlan interface is down, its addresses are not on the hash list. Fix checks for existence of addresses not to depend on the hash list, walk through all interface addresses instead. Signed-off-by: Jiri Benc <jbenc@redhat.com> Acked-by: Mahesh Bandewar <maheshb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 March 2015, 17:28:33 UTC |
| 40891e8 | Jiri Benc | 28 March 2015, 18:13:24 UTC | ipvlan: do not use rcu operations for address list All accesses to ipvlan->addrs are under rtnl. Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 March 2015, 17:28:33 UTC |
| 2afa650 | Jiri Benc | 28 March 2015, 18:13:23 UTC | ipvlan: protect against concurrent link removal Adding and removing to the 'ipvlans' list is already done using _rcu list operations. Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 March 2015, 17:28:33 UTC |
| 27705f7 | Jiri Benc | 28 March 2015, 18:13:22 UTC | ipvlan: fix addr hash list corruption When ipvlan interface with IP addresses attached is brought down and then deleted, the assigned addresses are deleted twice from the address hash list, first on the interface down and second on the link deletion. Similarly, when an address is added while the interface is down, it is added second time once the interface is brought up. When the interface is down, the addresses should be kept off the hash list for performance reasons. Ensure this is true, which also fixes the double add problem. To fix the double free, check whether the address is hashed before removing it. Reported-by: Dan Williams <dcbw@redhat.com> Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Mahesh Bandewar <maheshb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 March 2015, 17:28:33 UTC |
| e963741 | Mike Snitzer | 30 March 2015, 17:39:09 UTC | block: fix blk_stack_limits() regression due to lcm() change Linux 3.19 commit 69c953c ("lib/lcm.c: lcm(n,0)=lcm(0,n) is 0, not n") caused blk_stack_limits() to not properly stack queue_limits for stacked devices (e.g. DM). Fix this regression by establishing lcm_not_zero() and switching blk_stack_limits() over to using it. DM uses blk_set_stacking_limits() to establish the initial top-level queue_limits that are then built up based on underlying devices' limits using blk_stack_limits(). In the case of optimal_io_size (io_opt) blk_set_stacking_limits() establishes a default value of 0. With commit 69c953c, lcm(0, n) is no longer n, which compromises proper stacking of the underlying devices' io_opt. Test: $ modprobe scsi_debug dev_size_mb=10 num_tgts=1 opt_blks=1536 $ cat /sys/block/sde/queue/optimal_io_size 786432 $ dmsetup create node --table "0 100 linear /dev/sde 0" Before this fix: $ cat /sys/block/dm-5/queue/optimal_io_size 0 After this fix: $ cat /sys/block/dm-5/queue/optimal_io_size 786432 Signed-off-by: Mike Snitzer <snitzer@redhat.com> Cc: stable@vger.kernel.org # 3.19+ Acked-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Jens Axboe <axboe@fb.com> | 31 March 2015, 15:45:50 UTC |
| 36cbf25 | Ingo Molnar | 31 March 2015, 08:45:47 UTC | Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/urgent Pull EFI fix from Matt Fleming: - Fix integer overflow issue in the DMI SMBIOS 3.0 code when calculating the number of DMI table entries. (Jean Delvare) Signed-off-by: Ingo Molnar <mingo@kernel.org> | 31 March 2015, 08:45:47 UTC |
| ca68a52 | Borislav Petkov | 29 March 2015, 13:54:13 UTC | MAINTAINERS: Change the x86 microcode loader maintainer Let's make it official - I've been doing this for a while now anyway. Signed-off-by: Borislav Petkov <bp@suse.de> Cc: Andreas Herrmann <herrmann.der.user@googlemail.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Greg KH <gregkh@linuxfoundation.org> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Tigran Aivazian <tigran@aivazian.fsnet.co.uk> Signed-off-by: Ingo Molnar <mingo@kernel.org> | 31 March 2015, 08:04:52 UTC |
| 11e52a6 | James Bottomley | 18 March 2015, 22:56:16 UTC | enclosure: fix WARN_ON removing an adapter in multi-path devices We have peculiar problems with multi-path and enclosures: physically, we know each bay can only be occupied by a single disk device. However in multi-path, it appears we have many (because each path to the device appears in Linux as a different kernel device). We try to fix this by only having the last seen device show up in the bay. Sysfs gets very annoyed if we try to manipulate links when the kobject sysfs directory (kobj.sd) doesn't exist and drops a huge WARN_ON which most users panic and report an oops for. This happens on a few path removal situations and IBM reports seeing it when one of their multi-path adapters is removed. Add a check to enclosure device removal for the existence the sysfs directory containing both the forward and back links so that the remnants (if any) get removed in either direction but no scary warnings are dumped. Reported-by: Wen Xiong <wenxiong@linux.vnet.ibm.com> Tested-by: Wen Xiong <wenxiong@linux.vnet.ibm.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> | 31 March 2015, 05:53:36 UTC |
| 6c310bc | Linus Torvalds | 30 March 2015, 22:13:04 UTC | Merge tag 'locks-v4.0-5' of git://git.samba.org/jlayton/linux Pull file locking fix from Jeff Layton: "Another small fix for the lease overhaul" * tag 'locks-v4.0-5' of git://git.samba.org/jlayton/linux: locks: fix file_lock deletion inside loop | 30 March 2015, 22:13:04 UTC |
| f3f0333 | Christoph Hellwig | 30 March 2015, 16:46:29 UTC | nfsd: require an explicit option to enable pNFS Turns out sending out layouts to any client is a bad idea if they can't get at the storage device, so require explicit admin action to enable pNFS. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: J. Bruce Fields <bfields@redhat.com> | 30 March 2015, 20:05:26 UTC |
| 32374ea | Linus Torvalds | 30 March 2015, 18:08:37 UTC | Merge branch 'for-4.0-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata Pull libata fixes from Tejun Heo: "Nothing exciting. Two patches to update queued trim blacklist" * 'for-4.0-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: libata: Blacklist queued TRIM on Samsung SSD 850 Pro libata: Update Crucial/Micron blacklist | 30 March 2015, 18:08:37 UTC |
| fbef403 | Peter Ujfalusi | 27 March 2015, 11:35:55 UTC | dmaengine: moxart-dma: Fix memory leak when stopping a running transfer The vd->node is removed from the lists when the transfer started so the vchan_get_all_descriptors() will not find it. This results memory leak. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Vinod Koul <vinod.koul@intel.com> | 30 March 2015, 17:47:08 UTC |
| f931782 | Peter Ujfalusi | 27 March 2015, 11:35:53 UTC | dmaengine: bcm2835-dma: Fix memory leak when stopping a running transfer The vd->node is removed from the lists when the transfer started so the vchan_get_all_descriptors() will not find it. This results memory leak. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Acked-by: Stephen Warren <swarren@wwwdotorg.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com> | 30 March 2015, 17:47:08 UTC |
| 02d88b7 | Peter Ujfalusi | 27 March 2015, 11:35:52 UTC | dmaengine: omap-dma: Fix memory leak when terminating running transfer In omap_dma_start_desc the vdesc->node is removed from the virt-dma framework managed lists (to be precise from the desc_issued list). If a terminate_all comes before the transfer finishes the omap_desc will not be freed up because it is not in any of the lists and we stopped the DMA channel so the transfer will not going to complete. There is no special sequence for leaking memory when using cyclic (audio) transfer: with every start and stop of a cyclic transfer the driver leaks struct omap_desc worth of memory. Free up the allocated memory directly in omap_dma_terminate_all() since the framework will not going to do that for us. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> CC: <stable@vger.kernel.org> CC: <linux-omap@vger.kernel.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com> | 30 March 2015, 17:47:08 UTC |
| 5ca9e7c | Petr Kulhavy | 27 March 2015, 11:35:51 UTC | dmaengine: edma: fix memory leak when terminating running transfers If edma_terminate_all() was called while a transfer was running (i.e. after edma_execute() but before edma_callback()) the echan->edesc was not freed. This was due to the fact that a running transfer is on none of the vchan lists: desc_submitted, desc_issued, desc_completed (edma_execute() removes it from the desc_issued list), so the vchan_dma_desc_free_list() called at the end of edma_terminate_all() didn't find it and didn't free it. This bug was found on an AM1808 based hardware (very similar to da850evm, however using the second MMC/SD controller), where intense operations on the SD card wasted the device 128MB RAM within a couple of days. Peter Ujfalusi: The issue is even more severe since it affects cyclic (audio) transfers as well. In this case starting/stopping audio will results memory leak. Signed-off-by: Petr Kulhavy <petr@barix.com> Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> CC: <stable@vger.kernel.org> CC: <linux-omap@vger.kernel.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com> | 30 March 2015, 17:47:08 UTC |
| ca76683 | Lars-Peter Clausen | 28 March 2015, 17:05:44 UTC | dmaengine: jz4740: Define capabilities Setup the capabilities of the device/driver, so that users of the DMAengine API can query them. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Vinod Koul <vinod.koul@intel.com> | 30 March 2015, 17:30:23 UTC |
| 29059af | Linus Torvalds | 30 March 2015, 16:14:41 UTC | Merge tag 'gpio-v4.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull late GPIO fixes from Linus Walleij: "Here are the (hopefully) last GPIO fixes for v4.0. Nothing controversial whatsoever, just fixes: - syscon GPIO fix for Keystone DSP GPIOs - pin number translation fix for ACPI GPIO - a smallish compiler warning fix on the mpc8xxx driver" * tag 'gpio-v4.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: syscon: reduce message level when direction reg offset not in dt gpiolib: translate pin number in GPIO ACPI callbacks gpio: mpc8xxx: remove __initdata annotation for mpc8xxx_gpio_ids[] | 30 March 2015, 16:14:41 UTC |
| ee73c61 | Chris Wilson | 27 March 2015, 11:02:10 UTC | drm/i915: Skip allocating shadow batch for 0-length batches Since commit 17cabf571e50677d980e9ab2a43c5f11213003ae Author: Chris Wilson <chris@chris-wilson.co.uk> Date: Wed Jan 14 11:20:57 2015 +0000 drm/i915: Trim the command parser allocations we may then try to allocate a zero-sized object and attempt to extract its pages. Understandably this fails. Note that the real offender seems to be commit b9ffd80ed659c559152c042e74741f4f60cac691 Author: Brad Volkin <bradley.d.volkin@intel.com> Date: Thu Dec 11 12:13:10 2014 -0800 drm/i915: Use batch length instead of object size in command parser Testcase: igt/gem_exec_nop #ivb,byt,hsw Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> [cherry picked from commit 743e78c1d726d875b98ff9689cc77c4d3d5d9ae2 from drm-intel-next because 4.0 seems to be affected by this too, despite that the obvious culprit is definitely not in 4.0. Whatever, if fixes a bug. Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> | 30 March 2015, 14:59:47 UTC |
| 69628cd | Kalle Valo | 30 March 2015, 06:39:12 UTC | Merge tag 'iwlwifi-for-kalle-2015-03-30' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes * fix a memory leak: we leaked memory each time the module was loaded. | 30 March 2015, 06:39:12 UTC |
| 91fd896 | Dave Airlie | 30 March 2015, 02:17:27 UTC | Merge branch 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes A few more fixes for 4.0 for radeon. Sorry for the delay, I was a little under the weather this week and time got away from me. * 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: programm the VCE fw BAR as well drm/radeon: always dump the ring content if it's available radeon: Do not directly dereference pointers to BIOS area. drm/radeon/dpm: fix 120hz handling harder | 30 March 2015, 02:17:27 UTC |
| e42391c | Linus Torvalds | 29 March 2015, 22:26:31 UTC | Linux 4.0-rc6 | 29 March 2015, 22:26:31 UTC |
| 08f41f7 | Linus Torvalds | 29 March 2015, 22:09:31 UTC | Merge tag 'armsoc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "The latest and greatest fixes for ARM platform code. Worth pointing out are: - Lines-wise, largest is a PXA fix for dealing with interrupts on DT that was quite broken. It's still newish code so while we could have held this off, it seemed appropriate to include now - Some GPIO fixes for OMAP platforms added a few lines. This was also fixes for code recently added (this release). - Small OMAP timer fix to behave better with partially upstreamed platforms, which is quite welcome. - Allwinner fixes about operating point control, reducing overclocking in some cases for better stability. plus a handful of other smaller fixes across the map" * tag 'armsoc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: arm64: juno: Fix misleading name of UART reference clock ARM: dts: sunxi: Remove overclocked/overvoltaged OPP ARM: dts: sun4i: a10-lime: Override and remove 1008MHz OPP setting ARM: socfpga: dts: fix spi1 interrupt ARM: dts: Fix gpio interrupts for dm816x ARM: dts: dra7: remove ti,hwmod property from pcie phy ARM: OMAP: dmtimer: disable pm runtime on remove ARM: OMAP: dmtimer: check for pm_runtime_get_sync() failure ARM: OMAP2+: Fix socbus family info for AM33xx devices ARM: dts: omap3: Add missing dmas for crypto ARM: dts: rockchip: disable gmac by default in rk3288.dtsi MAINTAINERS: add rockchip regexp to the ARM/Rockchip entry ARM: pxa: fix pxa interrupts handling in DT ARM: pxa: Fix typo in zeus.c ARM: sunxi: Have ARCH_SUNXI select RESET_CONTROLLER for clock driver usage | 29 March 2015, 22:09:31 UTC |
| 4550bdb | Olof Johansson | 29 March 2015, 21:00:53 UTC | Merge tag 'sunxi-fixes-for-4.0' of https://git.kernel.org/pub/scm/linux/kernel/git/mripard/linux into fixes Allwinner fixes for 4.0 There's a few fixes to merge for 4.0, one to add a select in the machine Kconfig option to fix a potential build failure, and two fixing cpufreq related issues. * tag 'sunxi-fixes-for-4.0' of https://git.kernel.org/pub/scm/linux/kernel/git/mripard/linux: ARM: dts: sunxi: Remove overclocked/overvoltaged OPP ARM: dts: sun4i: a10-lime: Override and remove 1008MHz OPP setting ARM: sunxi: Have ARCH_SUNXI select RESET_CONTROLLER for clock driver usage Signed-off-by: Olof Johansson <olof@lixom.net> | 29 March 2015, 21:01:02 UTC |
| b1dae3d | Olof Johansson | 29 March 2015, 20:58:54 UTC | Merge tag 'fixes-v4.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Fixes for omaps for the -rc cycle: - Fix a device tree based booting vs legacy booting regression for omap3 crypto hardware by adding the missing DMA channels. - Fix /sys/bus/soc/devices/soc0/family for am33xx devices. - Fix two timer issues that can cause hangs if the timer related hwmod data is missing like it often initially is for new SoCs. - Remove pcie hwmods entry from dts as that causes runtime PM to fail for the PHYs. - A paper bag type dts configuration fix for dm816x GPIO interrupts that I just noticed. This is most of the changes diffstat wise, but as it's a basic feature for connecting devices and things work otherwise, it should be fixed. * tag 'fixes-v4.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: Fix gpio interrupts for dm816x ARM: dts: dra7: remove ti,hwmod property from pcie phy ARM: OMAP: dmtimer: disable pm runtime on remove ARM: OMAP: dmtimer: check for pm_runtime_get_sync() failure ARM: OMAP2+: Fix socbus family info for AM33xx devices ARM: dts: omap3: Add missing dmas for crypto Signed-off-by: Olof Johansson <olof@lixom.net> | 29 March 2015, 20:59:16 UTC |
| ebc0aa8 | Olof Johansson | 29 March 2015, 20:58:04 UTC | Merge tag 'socfpga_fix_for_v4.0_2' of git://git.rocketboards.org/linux-socfpga-next into fixes Late fix for v4.0 on the SoCFPGA platform: - Fix interrupt number for SPI1 interface * tag 'socfpga_fix_for_v4.0_2' of git://git.rocketboards.org/linux-socfpga-next: ARM: socfpga: dts: fix spi1 interrupt Signed-off-by: Olof Johansson <olof@lixom.net> | 29 March 2015, 20:58:14 UTC |
| 78d84bc | Dave Martin | 17 March 2015, 12:35:41 UTC | arm64: juno: Fix misleading name of UART reference clock The UART reference clock speed is 7273.8 kHz, not 72738 kHz. Dots aren't usually used in node names even though ePAPR permits them. However, this can easily be avoided by expressing the frequency in Hz, not kHz. This patch changes the name to refclk7273800hz, reflecting the actual clock speed. Signed-off-by: Dave Martin <Dave.Martin@arm.com> Acked-by: Liviu Dudau <Liviu.Dudau@arm.com> Signed-off-by: Olof Johansson <olof@lixom.net> | 29 March 2015, 20:56:08 UTC |
| 53b1a66 | Olof Johansson | 29 March 2015, 20:47:21 UTC | Merge tag 'fixes-for-v4.0-rc5' of https://github.com/rjarzmik/linux into fixes arm: pxa: fixes for v4.0-rc5 There are only 2 fixes, one for the zeus board about the regulator changes, where a typo prevented the zeus board from having a working can regulator, and one regression triggered by the interrupts IRQ shift of 16 affecting all boards. * tag 'fixes-for-v4.0-rc5' of https://github.com/rjarzmik/linux: ARM: pxa: fix pxa interrupts handling in DT ARM: pxa: Fix typo in zeus.c Signed-off-by: Olof Johansson <olof@lixom.net> | 29 March 2015, 20:47:37 UTC |
| 63c6073 | Uwe Kleine-König | 27 March 2015, 10:08:32 UTC | net: fec: setup right value for mdio hold time The FEC modules used on i.MX28 and newer have a register to tune the MDIO output hold time that should be at least 10 ns. Up to now this value was not explicitly set and so resulted in less hold time if the fec clock was faster than 100 MHz. This was noticed on an i.MX28 machine that uses an input clock of ~150 Mhz which resulted in unreliable communication with a Marvell switch. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 March 2015, 20:40:36 UTC |
| 4ad19de | Alexey Kodanev | 27 March 2015, 09:24:22 UTC | net: tcp6: fix double call of tcp_v6_fill_cb() tcp_v6_fill_cb() will be called twice if socket's state changes from TCP_TIME_WAIT to TCP_LISTEN. That can result in control buffer data corruption because in the second tcp_v6_fill_cb() call it's not copying IP6CB(skb) anymore, but 'seq', 'end_seq', etc., so we can get weird and unpredictable results. Performance loss of up to 1200% has been observed in LTP/vxlan03 test. This can be fixed by copying inet6_skb_parm to the beginning of 'cb' only if xfrm6_policy_check() and tcp_v6_fill_cb() are going to be called again. Fixes: 2dc49d1680b53 ("tcp6: don't move IP6CB before xfrm6_policy_check()") Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 March 2015, 20:36:05 UTC |
| 2ff2acf | Hariprasad Shenai | 27 March 2015, 05:31:18 UTC | cxgb4vf: Fix sparse warnings Fixes sparse warnings introduced in commit e85c9a7abfa407ed ("cxgb4/cxgb4vf: Add code to calculate T5 BAR2 Offsets for SGE Queue Registers") and df64e4d38c904dd3 ("cxgb4/cxgb4vf: Use new interfaces to calculate BAR2 SGE Queue Register addresses") and few old ones sparse warnings: >> drivers/net/ethernet/chelsio/cxgb4vf/sge.c:1006:48: sparse: cast removes >> address space of expression >> drivers/net/ethernet/chelsio/cxgb4vf/sge.c:1006:48: sparse: incorrect type in >> initializer (different address space) >> drivers/net/ethernet/chelsio/cxgb4vf/sge.c:1020:40: sparse: incorrect type in >> argument 1 (different base types) Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 March 2015, 20:28:22 UTC |
| 4217291 | Nicolas Dichtel | 26 March 2015, 16:56:38 UTC | netns: don't clear nsid too early on removal With the current code, ids are removed too early. Suppose you have an ipip interface that stands in the netns foo and its link part in the netns bar (so the netns bar has an nsid into the netns foo). Now, you remove the netns bar: - the bar nsid into the netns foo is removed - the netns exit method of ipip is called, thus our ipip iface is removed: => a netlink message is sent in the netns foo to advertise this deletion => this netlink message requests an nsid for bar, thus a new nsid is allocated for bar and never removed. We must remove nsids when we are sure that nobody will refer to netns currently cleaned. Fixes: 0c7aecd4bde4 ("netns: add rtnl cmd to add and get peer netns ids") Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 March 2015, 19:58:21 UTC |
| dbcf988 | Jason Cooper | 29 March 2015, 19:34:05 UTC | Merge branch 'irqchip/urgent-gic' into irqchip/urgent | 29 March 2015, 19:34:05 UTC |
| 241a386 | Marc Zyngier | 27 March 2015, 14:15:05 UTC | irqchip: gicv3-its: Use non-cacheable accesses when no shareability If the ITS or the redistributors report their shareability as zero, then it is important to make sure they will no generate any cacheable traffic, as this is unlikely to produce the expected result. Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Link: https://lkml.kernel.org/r/1427465705-17126-5-git-send-email-marc.zyngier@arm.com Signed-off-by: Jason Cooper <jason@lakedaemon.net> | 29 March 2015, 19:25:57 UTC |
| 4ad3e36 | Marc Zyngier | 27 March 2015, 14:15:04 UTC | irqchip: gicv3-its: Fix PROP/PEND and BASE/CBASE confusion The ITS driver sometime mixes up the use of GICR_PROPBASE bitfields for the GICR_PENDBASE register, and GITS_BASER for GICR_CBASE. This does not lead to any observable bug because similar bits are at the same location, but this just make the code even harder to understand... This patch provides the required #defines and fixes the mixup. Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Link: https://lkml.kernel.org/r/1427465705-17126-4-git-send-email-marc.zyngier@arm.com Signed-off-by: Jason Cooper <jason@lakedaemon.net> | 29 March 2015, 19:25:51 UTC |
| 7e195ba | Andre Przywara | 27 March 2015, 14:15:03 UTC | irqchip: gicv3-its: Fix device ID encoding When building ITS commands which have the device ID in it, we should mask off the whole upper 32 bits of the first command word before inserting the new value in there. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Link: https://lkml.kernel.org/r/1427465705-17126-3-git-send-email-marc.zyngier@arm.com Signed-off-by: Jason Cooper <jason@lakedaemon.net> | 29 March 2015, 19:25:49 UTC |
| 263fcd3 | Marc Zyngier | 27 March 2015, 14:15:02 UTC | irqchip: gicv3-its: Fix encoding of collection's target redistributor With a monolithic GICv3, redistributors are addressed using a linear number, while a distributed implementation uses physical addresses. When encoding a target address into a command, we strip the lower 16 bits, as redistributors are always 64kB aligned. This works perfectly well with a distributed implementation, but has the silly effect of always encoding target 0 in the monolithic case (unless you have more than 64k CPUs, of course). The obvious fix is to shift the linear target number by 16 when computing the target address, so that we don't loose any precious bit. Reported-by: Andre Przywara <andre.przywara@arm.com> Tested-by: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Link: https://lkml.kernel.org/r/1427465705-17126-2-git-send-email-marc.zyngier@arm.com Signed-off-by: Jason Cooper <jason@lakedaemon.net> | 29 March 2015, 19:25:45 UTC |
| 17f5ddd | David S. Miller | 29 March 2015, 19:24:46 UTC | Merge branch 'cxgb4' Hariprasad Shenai says: ==================== cxgb4: Fixes ingress queue mapping and other fixes The below series fixes ingress queue mapping by allocating them dynamically to prevent stack overflow. Disable napi and interrupts before unregistering netdev to avoid crash while unloading driver when traffic is flowing. The patches series is created against 'net' tree. And includes patches on cxgb4 driver. We have included all the maintainers of respective drivers. Kindly review the change and let us know in case of any review comments. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 29 March 2015, 19:24:46 UTC |
| b37987e | Hariprasad Shenai | 26 March 2015, 04:34:26 UTC | cxgb4: Disable interrupts and napi before unregistering netdev Disable interrupts and quiesce rx before unregistering net device to avoid crash while unloading driver when traffic is flowing through. Based on original work by Shameem Khalid <shameem@chelsio.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 March 2015, 19:24:43 UTC |
| 4b8e27a | Hariprasad Shenai | 26 March 2015, 04:34:25 UTC | cxgb4: Allocate dynamic mem. for egress and ingress queue maps QIDs (egress/ingress) from firmware in FW_*_CMD.alloc command can be anywhere in the range from EQ(IQFLINT)_START to EQ(IQFLINT)_END. For eg, in the first load eqid can be from 100 to 300. In the next load it can be from 301 to 500 (assume eq_start is 100 and eq_end is 1000). The driver was assuming them to always start from EQ(IQFLINT)_START till MAX_EGRQ(INGQ). This was causing stack overflow and subsequent crash. Fixed it by dynamically allocating memory (of qsize (x_END - x_START + 1)) for these structures. Based on original work by Santosh Rastapur <santosh@chelsio.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 March 2015, 19:24:42 UTC |
| f243e5a | WANG Cong | 25 March 2015, 21:45:03 UTC | ipmr,ip6mr: call ip6mr_free_table() on failure path Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 March 2015, 19:13:54 UTC |
