The warning in question was unnecessary but with Jeff's series the rules
are also clearer. This patch removes the warning and updates the comment
to explain why sk_mem_reclaim() may still be called.
[jlayton: remove if (sk->sk_forward_alloc) conditional. As Leon
points out that it's not needed.]
Cc: Leon Romanovsky <leon@leon.nu> Signed-off-by: Mel Gorman <mgorman@suse.de> Signed-off-by: Jeff Layton <jeff.layton@primarydata.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Since the addition of sysfs multicast router support if one set
multicast_router to "2" more than once, then the port would be added to
the hlist every time and could end up linking to itself and thus causing an
endless loop for rlist walkers.
So to reproduce just do:
echo 2 > multicast_router; echo 2 > multicast_router;
in a bridge port and let some igmp traffic flow, for me it hangs up
in br_multicast_flood().
Fix this by adding a check in br_multicast_add_router() if the port is
already linked.
The reason this didn't happen before the addition of multicast_router
sysfs entries is because there's a !hlist_unhashed check that prevents
it.
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Fixes: 0909e11758bd ("bridge: Add multicast_router sysfs entries") Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Erik Hugne [Tue, 9 Jun 2015 15:27:12 +0000 (17:27 +0200)]
tipc: disconnect socket directly after probe failure
If the TIPC connection timer expires in a probing state, a
self abort message is supposed to be generated and delivered
to the local socket. This is currently broken, and the abort
message is actually sent out to the peer node with invalid
addressing information. This will cause the link to enter
a constant retransmission state and eventually reset.
We fix this by removing the self-abort message creation and
tear down connection immediately instead.
Signed-off-by: Erik Hugne <erik.hugne@ericsson.com> Reviewed-by: Ying Xue <ying.xue@windriver.com> Reviewed-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Takashi Iwai [Wed, 10 Jun 2015 10:03:49 +0000 (12:03 +0200)]
ALSA: hda - Continue probing even if i915 binding fails
Currently snd-hda-intel driver aborts the probing of Intel HD-audio
controller with i915 power well management when binding with i915
driver via hda_i915_init() fails. This is no big problem for Haswell
and Broadwell where the HD-audio controllers are dedicated to
HDMI/DP, thus i915 link is mandatory. However, Skylake, Baytrail and
Braswell have only one controller and both HDMI/DP and analog codecs
share the same bus. Thus, even if HDMI/DP isn't usable, we should
keep the controller working for other codecs.
For fixing this, this patch simply allows continuing the probing even
if hda_i915_init() call fails. This may leave stale sound components
for HDMI/DP devices that are unbound with graphics. We could abort
the probing selectively, but from the code simplicity POV, it's better
to continue in all cases.
Reported-by: Libin Yang <libin.yang@intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Linus Torvalds [Thu, 11 Jun 2015 00:16:32 +0000 (17:16 -0700)]
Merge tag 'misc-for-linus-4.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull misc fixes from Guenter Roeck:
"There are two patches here. One fixes a build error affecting the
blackfin architecture, the other fixes a build error affecting the
score architecture.
The score maintainer (Lennox Wu) has a hard time sending you the score
patch, and the blackfin maintainer (Steven Miao) has been silent since
-rc1. Since 4.1 is about to be released, I figured it would be useful
to get the patches upstream to avoid the related build failures in the
final release"
* tag 'misc-for-linus-4.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
score: Fix exception handler label
blackfin: Fix build error
Kevin Hilman [Thu, 11 Jun 2015 00:05:33 +0000 (17:05 -0700)]
Merge tag 'hi6620-dt-for-4.2' of git://github.com/hisilicon/linux-hisi into next/dt
ARM64: DT: Hisilicon hi6220 soc and hikey board updates for 4.2
- Added the devicetree bindings document for hi6220 SoC
- Added the devicetree bindings document for hi6220 clock
- Added dts files for hi6220 SoC and hikey board
* tag 'hi6620-dt-for-4.2' of git://github.com/hisilicon/linux-hisi:
arm64: dts: Add dts files for Hisilicon Hi6220 SoC
clk: hi6220: Document devicetree bindings for hi6220 clock
arm64: hi6220: Document devicetree bindings for Hisilicon hi6220 SoC
Kevin Hilman [Thu, 11 Jun 2015 00:03:07 +0000 (17:03 -0700)]
Merge tag 'at91-dt4' of git://git.kernel.org/pub/scm/linux/kernel/git/nferre/linux-at91 into next/dt
Fourth batch of DT changes for 4.2:
- rtc node for at91sam9rl/at91sam9rlek
- move to stdout-path for console on kizbox and all Atmel's boards
- Addition of the Acme Systems' Arietta G25
- two little fixes for Kizbox and sama5d4ek
* tag 'at91-dt4' of git://git.kernel.org/pub/scm/linux/kernel/git/nferre/linux-at91:
ARM: at91/dt: sama5d4ek: mci0 uses slot 0
ARM: at91/dt: kizbox: fix mismatch LED PWM device
ARM: at91/dt: Add Acme Arietta G25
ARM: at91/dt: sama5d4 xplained: use stdout-path
ARM: at91/dt: sama5d4ek: use stdout-path
ARM: at91/dt: sama5d3 xplained: use stdout-path
ARM: at91/dt: sama5d3xek: use stdout-path
ARM: at91/dt: at91sam9x5ek: use stdout-path
ARM: at91/dt: at91sam9rlek: use stdout-path
ARM: at91/dt: at91sam9n12ek: use stdout-path
ARM: at91/dt: at91sam9m10g45ek use stdout-path
ARM: at91/dt: at91sam9g20ek: use stdout-path
ARM: at91/dt: at91sam9263ek: use stdout-path
ARM: at91/dt: at91sam9261ek: use stdout-path
ARM: at91/dt: at91rm9200ek: use stdout-path
ARM: at91/dt: kizbox: use stdout-path
ARM: at91/dt: at91sam9rlek: add RTC
ARM: at91/dt: at91sam9rl: fix rtc node
Kevin Hilman [Thu, 11 Jun 2015 00:01:25 +0000 (17:01 -0700)]
Merge tag 'imx-dt-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into next/dt
The i.MX device tree changes for 4.2:
- Add device tree for i.MX7D SoC and imx7d-sdb board
- New i.MX6 board support: Armadeus Systems APF6, Gateworks GW5510,
and aristainetos2 boards
- Change LVDS to use simple-panel for nitrogen6x and sabrelite boards
- Add Wifi/Bluetooth devices support for cubox-i board
- Remove unused regulators and correct OTG roles setting for
imx6sl-warp board
- Add I2C support for imx23-olinuxino board
- Move imx6qdl HDMI device to a better place
- Add power-domain for imx6qdl CODA device
* tag 'imx-dt-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (24 commits)
ARM: dts: imx6dl: add imx6dl gpt specific compatible string
ARM: dts: imx6: add DT for aristainetos2 board
ARM: dts: cubox-i/hummingboard: Fix the license text
ARM: dts: sabrelite: use simple-panel instead of display-timings for LVDS0
ARM: dts: nitrogen6x: use simple-panel instead of display-timings for LVDS0
ARM: dts: add imx7d-sdb support
ARM: dts: add imx7d soc dtsi file
ARM: dts: Armadeus Systems APF6 family support (i.MX6)
ARM: dts: vf610: Nomenclature fixup for PTC12 pin used in RMII mode.
ARM: dts: cubox-i: add support for Broadcom Wifi/Bluetooth devices
Document: dt: binding: imx: update document for imx7d support
ARM: dts: imx6qdl: Add power-domain phandle to CODA device node
ARM: dts: Gateworks GW5510 support (i.MX6)
ARM: dts: imx6sl-warp: Fix OTG roles
ARM: dts: imx6sl-warp: Remove USB regulators
ARM: dts: imx6sl-warp: Remove unused regulator
ARM: dts: add pinfunc include file to support imx7d
ARM: mxs: fix in tree users of ssd1306
ARM: dts: imx6qdl-hummingboard: Add PCIe support
ARM: dts: imx23-olinuxino: Add i2c support
...
Kevin Hilman [Wed, 10 Jun 2015 23:58:05 +0000 (16:58 -0700)]
Merge tag 'imx-soc-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into next/soc
The i.MX SoC updates for 4.2:
- Add new SoC i.MX7D support, which integrates two Cortex-A7 and one
Cortex-M4 cores.
- Support suspend from IRAM on i.MX53, so that DDR pins can be set to
high impedance for more power saving during suspend.
- Move i.MX clock drivers from arch/arm/mach-imx to drivers/clk/imx.
- Move i.MX GPT timer driver from arch/arm/mach-imx into
drivers/clocksource.
- A couple of clock driver update for VF610 and i.MX6Q.
- A few random code correction and improvement.
* tag 'imx-soc-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (44 commits)
ARM: imx: imx7d requires anatop
clocksource: timer-imx-gpt: remove include of <asm/mach/time.h>
ARM: imx: move timer driver into drivers/clocksource
ARM: imx: remove platform headers from timer driver
ARM: imx: provide gpt device specific irq functions
ARM: imx: get rid of variable timer_base
ARM: imx: define gpt register offset per device type
ARM: imx: move clock event variables into imx_timer
ARM: imx: set up .set_next_event hook via imx_gpt_data
ARM: imx: setup tctl register in device specific function
ARM: imx: initialize gpt device type for DT boot
ARM: imx: define an enum for gpt timer device type
ARM: imx: move timer resources into a structure
ARM: imx: use relaxed IO accessor in timer driver
ARM: imx: make imx51/3 suspend optional
ARM: clk-imx6q: refine sata's parent
ARM: imx: clk-v610: Add clock for I2C2 and I2C3
ARM: mach-imx: iomux-imx31: Use DECLARE_BITMAP
ARM: imx: add imx7d clk tree support
ARM: clk: imx: update pllv3 to support imx7
...
Linus Torvalds [Wed, 10 Jun 2015 23:43:53 +0000 (16:43 -0700)]
Merge branch 'akpm' (patches from Andrew)
Merge misc fixes from Andrew Morton:
"The gcc-4.4.4 workaround has actually been merged into a KVM tree by
Paolo but it is stuck in linux-next and mainline needs it"
* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
arch/x86/kvm/mmu.c: work around gcc-4.4.4 bug
sched, numa: do not hint for NUMA balancing on VM_MIXEDMAP mappings
zsmalloc: fix a null pointer dereference in destroy_handle_cache()
mm: memcontrol: fix false-positive VM_BUG_ON() on -rt
checkpatch: fix "GLOBAL_INITIALISERS" test
zram: clear disk io accounting when reset zram device
memcg: do not call reclaim if !__GFP_WAIT
mm/memory_hotplug.c: set zone->wait_table to null after freeing it
Andrew Morton [Wed, 10 Jun 2015 18:15:02 +0000 (11:15 -0700)]
arch/x86/kvm/mmu.c: work around gcc-4.4.4 bug
Fix this compile issue with gcc-4.4.4:
arch/x86/kvm/mmu.c: In function 'kvm_mmu_pte_write':
arch/x86/kvm/mmu.c:4256: error: unknown field 'cr0_wp' specified in initializer
arch/x86/kvm/mmu.c:4257: error: unknown field 'cr4_pae' specified in initializer
arch/x86/kvm/mmu.c:4257: warning: excess elements in union initializer
...
gcc-4.4.4 (at least) has issues when using anonymous unions in
initializers.
Compound pages cannot be migrated and it was not expected that such pages
be marked for NUMA balancing. This did not take into account that drivers
such as net/packet/af_packet.c may insert compound pages into userspace
with vm_insert_page. This patch tells the NUMA balancing protection
scanner to skip all VM_MIXEDMAP mappings which avoids the possibility that
compound pages are marked for migration.
zsmalloc: fix a null pointer dereference in destroy_handle_cache()
If zs_create_pool()->create_handle_cache()->kmem_cache_create() or
pool->name allocation fails, zs_create_pool()->destroy_handle_cache()
will dereference the NULL pool->handle_cachep.
Modify destroy_handle_cache() to avoid this.
Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> Cc: Minchan Kim <minchan@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Johannes Weiner [Wed, 10 Jun 2015 18:14:54 +0000 (11:14 -0700)]
mm: memcontrol: fix false-positive VM_BUG_ON() on -rt
On -rt, the VM_BUG_ON(!irqs_disabled()) triggers inside the memcg
swapout path because the spin_lock_irq(&mapping->tree_lock) in the
caller doesn't actually disable the hardware interrupts - which is fine,
because on -rt the tophalves run in process context and so we are still
safe from preemption while updating the statistics.
Remove the VM_BUG_ON() but keep the comment of what we rely on.
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Reported-by: Clark Williams <williams@redhat.com> Cc: Fernando Lopez-Lezcano <nando@ccrma.Stanford.EDU> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Joe Perches [Wed, 10 Jun 2015 18:14:52 +0000 (11:14 -0700)]
checkpatch: fix "GLOBAL_INITIALISERS" test
Commit d5e616fc1c1d ("checkpatch: add a few more --fix corrections")
broke the GLOBAL_INITIALISERS test with bad parentheses and optional
leading spaces.
Fix it.
Signed-off-by: Joe Perches <joe@perches.com> Reported-by: Bandan Das <bsd@makefile.in> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Weijie Yang [Wed, 10 Jun 2015 18:14:49 +0000 (11:14 -0700)]
zram: clear disk io accounting when reset zram device
Clear zram disk io accounting when resetting the zram device. Otherwise
the residual io accounting stat will affect the diskstat in the next
zram active cycle.
Signed-off-by: Weijie Yang <weijie.yang@samsung.com> Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> Acked-by: Minchan Kim <minchan@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Vladimir Davydov [Wed, 10 Jun 2015 18:14:46 +0000 (11:14 -0700)]
memcg: do not call reclaim if !__GFP_WAIT
When trimming memcg consumption excess (see memory.high), we call
try_to_free_mem_cgroup_pages without checking if we are allowed to sleep
in the current context, which can result in a deadlock. Fix this.
Fixes: 241994ed8649 ("mm: memcontrol: default hierarchy interface for memory") Signed-off-by: Vladimir Davydov <vdavydov@parallels.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Acked-by: Michal Hocko <mhocko@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This seems an use-after-free problem, and the root cause is
zone->wait_table was not set to *NULL* after free it in
try_offline_node.
When hot re-add a node, we will reuse the pgdat of it, so does the zone
struct, and when add pages to the target zone, it will init the zone
first (including the wait_table) if the zone is not initialized. The
judgement of zone initialized is based on zone->wait_table:
static inline bool zone_is_initialized(struct zone *zone)
{
return !!zone->wait_table;
}
so if we do not set the zone->wait_table to *NULL* after free it, the
memory hotplug routine will skip the init of new zone when hot re-add
the node, and the wait_table still points to the freed memory, then we
will access the invalid address when trying to wake up the waiting
people after the i/o operation with the page is done, such as mentioned
above.
Kevin Hilman [Wed, 10 Jun 2015 23:04:48 +0000 (16:04 -0700)]
Merge branch 'socfpga/soc' into next/soc
* socfpga/soc:
ARM: socfpga: support suspend to ram
ARM: socfpga: add CPU_METHOD_OF_DECLARE for Arria 10
ARM: socfpga: use CPU_METHOD_OF_DECLARE for socfpga_cyclone5
Maxime Coquelin [Wed, 3 Jun 2015 14:54:02 +0000 (16:54 +0200)]
ARM: dts: Introduce STM32F429 MCU
The STMicrolectornics's STM32F429 MCU has the following main features:
- Cortex-M4 core running up to @180MHz
- 2MB internal flash, 256KBytes internal RAM
- FMC controller to connect SDRAM, NOR and NAND memories
- SD/MMC/SDIO support
- Ethernet controller
- USB OTFG FS & HS controllers
- I2C, SPI, CAN busses support
- Several 16 & 32 bits general purpose timers
- Serial Audio interface
- LCD controller
Tested-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Maxime Coquelin <mcoquelin.stm32@gmail.com> Signed-off-by: Kevin Hilman <khilman@linaro.org>
Kevin Hilman [Wed, 10 Jun 2015 22:47:21 +0000 (15:47 -0700)]
Merge tag 'sunxi-dt-for-4.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mripard/linux into next/dt
Allwinner DT changes for 4.2, take 2
A bunch of new DT changes for the 4.2 merge window, among which:
- Enable the SRAM controller on the A10/A10s/A13/A20
- A33 support
- New boards: A23 EVB, SinA33, GA10H-A33, Mele A1000G
* tag 'sunxi-dt-for-4.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mripard/linux:
ARM: dts: sun6i: Add a dts file for the Mele A1000G quad top set box
ARM: dts: sun8i: Add dts file for the GA10H-A33 tablet
ARM: dts: sun8i-a33: Add dts for Sinlinx SinA33 development board.
ARM: dts: sun8i-a33: Add pinmux setting for uart0 on PB pins
ARM: dts: sun8i: Add pinmux setting for 8bit mmc2
ARM: dts: sun8i: Add usb_clk node for a23/a33
ARM: dts: sun8i: Add ET-Q8 A33 support
ARM: dts: sun8i: Add sun8i-a33 dtsi
ARM: dts: sun8i: Add sun8i-a23-a33 dtsi
ARM: dts: sun7i: Add A20 SRAM and SRAM controller
ARM: dts: sun5i: Add A10s and A13 SRAM and SRAM controller
ARM: dts: sun4i: Add A10 SRAM and SRAM controller
ARM: dts: sunxi: Revert SRAM controller drivers patches
ARM: dts: sun9i: Add device node for watchdog
ARM: dts: sun7i: Add uart4 support for BananaPro, disable uart2
ARM: dts: sun7i: Add uart4_pins_b definition
ARM: sun8i: Introduce A23 Evaluation Board Support
Dinh Nguyen [Wed, 3 Jun 2015 02:14:02 +0000 (21:14 -0500)]
ARM: socfpga: add CPU_METHOD_OF_DECLARE for Arria 10
Add boot_secondary implementation for the Arria10 platform. Bringing up
the secondary core on the Arria 10 platform is pretty similar to the
Cyclone/Arria 5 platform, with the exception of the following differences:
- Register offset to bringup CPU1 out of reset is different.
- The cpu1-start-addr for Arria10 contains an additional nibble.
Signed-off-by: Dinh Nguyen <dinguyen@opensource.altera.com> Signed-off-by: Kevin Hilman <khilman@linaro.org>
The latest version of modinfo fails to compile score architecture
targets with the following error.
FATAL: The relocation at __ex_table+0x634 references
section "__ex_table" which is not executable, IOW
the kernel will fault if it ever tries to
jump to it. Something is seriously wrong
and should be fixed.
The probem is caused by a bad label in an __ex_table entry.
Guenter Roeck [Fri, 1 May 2015 12:59:35 +0000 (05:59 -0700)]
blackfin: Fix build error
Fix
include/asm-generic/io.h: In function 'readb':
include/asm-generic/io.h:113:2: error:
implicit declaration of function 'bfin_read8'
include/asm-generic/io.h: In function 'readw':
include/asm-generic/io.h:121:2: error:
implicit declaration of function 'bfin_read16'
include/asm-generic/io.h: In function 'readl':
include/asm-generic/io.h:129:2: error:
implicit declaration of function 'bfin_read32'
include/asm-generic/io.h: In function 'writeb':
include/asm-generic/io.h:147:2: error:
implicit declaration of function 'bfin_write8'
include/asm-generic/io.h: In function 'writew':
include/asm-generic/io.h:155:2: error:
implicit declaration of function 'bfin_write16'
include/asm-generic/io.h: In function 'writel':
include/asm-generic/io.h:163:2: error:
implicit declaration of function 'bfin_write32'
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Fixes: 1a3372bc522ef ("blackfin: io: define __raw_readx/writex with
bfin_readx/writex") Cc: Steven Miao <realmz6@gmail.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Ralf Baechle [Fri, 22 May 2015 23:20:19 +0000 (01:20 +0200)]
MIPS: MSA: bugfix - disable MSA correctly for new threads/processes.
Due to the slightly odd way that new threads and processes start execution
when scheduled for the very first time they were bypassing the required
disable_msa call.
Ralf Baechle [Tue, 9 Jun 2015 07:35:34 +0000 (09:35 +0200)]
MIPS: Loongson: Do not register 8250 platform device from module.
If CONFIG_SERIAL_8250 is set to m, the Loongson seria.ko module might get
unloaded while the serial driver modules are still loaded resulting in
stale references to the destroyed platform_device instance.
Anyway, platform devices should always be registered indicated what
devices are present, _not_ what drivers have been configured.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org> Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Patchwork: https://patchwork.linux-mips.org/patch/10538/
Ralf Baechle [Wed, 10 Jun 2015 08:23:29 +0000 (10:23 +0200)]
MIPS: Cobalt: Do not build MTD platform device registration code as module.
If CONFIG_MTD_PHYSMAP is set to m, the Cobalt mtd.ko module might get
unloaded while the drivers/mtd modules are still loaded resulting in
stale references to the destroyed platform_device instance.
Anyway, platform devices should always be registered indicated what
devices are present, _not_ what drivers have been configured.
Takashi Iwai [Wed, 10 Jun 2015 08:27:00 +0000 (10:27 +0200)]
ALSA: hda - Don't actually write registers for caps overwrites
Along with the transition to regmap for managing the cached parameter
reads, the caps overwrite was also moved to regmap cache. The cache
change itself works, but it still tries to write the non-existing verb
(the HDA parameter is read-only) wrongly. It's harmless in most
cases, but some chips are picky and may result in the codec
communication stall.
This patch avoids it just by adding the missing flag check in
reg_write ops.
Ming Lei [Thu, 4 Jun 2015 14:25:04 +0000 (22:25 +0800)]
blk-mq: free hctx->ctxs in queue's release handler
Now blk_cleanup_queue() can be called before calling
del_gendisk()[1], inside which hctx->ctxs is touched
from blk_mq_unregister_hctx(), but the variable has
been freed by blk_cleanup_queue() at that time.
So this patch moves freeing of hctx->ctxs into queue's
release handler for fixing the oops reported by Stefan.
[1], 6cd18e711dd8075 (block: destroy bdi before blockdev is
unregistered)
Reported-by: Stefan Seyfried <stefan.seyfried@googlemail.com> Cc: NeilBrown <neilb@suse.de> Cc: Christoph Hellwig <hch@lst.de> Cc: stable@vger.kernel.org (v4.0) Signed-off-by: Ming Lei <tom.leiming@gmail.com> Signed-off-by: Jens Axboe <axboe@fb.com>
Johannes Berg [Tue, 9 Jun 2015 19:35:44 +0000 (21:35 +0200)]
cfg80211: wext: clear sinfo struct before calling driver
Until recently, mac80211 overwrote all the statistics it could
provide when getting called, but it now relies on the struct
having been zeroed by the caller. This was always the case in
nl80211, but wext used a static struct which could even cause
values from one device leak to another.
Using a static struct is OK (as even documented in a comment)
since the whole usage of this function and its return value is
always locked under RTNL. Not clearing the struct for calling
the driver has always been wrong though, since drivers were
free to only fill values they could report, so calling this
for one device and then for another would always have leaked
values from one to the other.
Fix this by initializing the structure in question before the
driver method call.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=99691
Cc: stable@vger.kernel.org Reported-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Reported-by: Alexander Kaltsas <alexkaltsas@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Hauke Mehrtens [Sat, 6 Jun 2015 23:52:51 +0000 (01:52 +0200)]
SSB: Fix handling of ssb_pmu_get_alp_clock()
Dan Carpenter reported missing brackets which resulted in reading a
wrong crystalfreq value. I also noticed that the result of this
function is ignored.
David Woodhouse [Tue, 9 Jun 2015 14:06:55 +0000 (15:06 +0100)]
iommu/vt-d: Change PASID support to bit 40 of Extended Capability Register
The existing hardware implementations with PASID support advertised in
bit 28? Forget them. They do not exist. Bit 28 means nothing. When we
have something that works, it'll use bit 40. Do not attempt to infer
anything meaningful from bit 28.
This will be reflected in an updated VT-d spec in the extremely near
future.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Markos Chandras [Fri, 29 May 2015 13:43:52 +0000 (14:43 +0100)]
MIPS: pgtable-bits: Fix XPA damage to R6 definitions.
Commit be0c37c985ed ("MIPS: Rearrange PTE bits into fixed positions.")
rearranged the PTE bits into fixed positions in preparation for the XPA
support. However, this patch broke R6 since it only took R2 cores
into consideration for the RI/XI bits leading to boot failures. We fix
this by adding the missing CONFIG_CPU_MIPSR6 definitions
Fixes: be0c37c985ed ("MIPS: Rearrange PTE bits into fixed positions.") Cc: Steven J. Hill <Steven.Hill@imgtec.com> Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/10208/ Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Jani Nikula [Tue, 2 Jun 2015 16:21:15 +0000 (19:21 +0300)]
drm/i915: Fix DDC probe for passive adapters
Passive DP->DVI/HDMI dongles on DP++ ports show up to the system as HDMI
devices, as they do not have a sink device in them to respond to any AUX
traffic. When probing these dongles over the DDC, sometimes they will
NAK the first attempt even though the transaction is valid and they
support the DDC protocol. The retry loop inside of
drm_do_probe_ddc_edid() would normally catch this case and try the
transaction again, resulting in success.
drm: give up on edid retries when i2c bus is not responding
This added code to exit immediately if the return code from the
i2c_transfer function was -ENXIO in order to reduce the amount of time
spent in waiting for unresponsive or disconnected devices. That was
possible because the underlying i2c bit banging algorithm had retries of
its own (which, of course, were part of the reason for the bug the
commit fixes).
we've been flipping back and forth enabling the GMBUS transfers, but
we've settled since then. The GMBUS implementation does not do any
retries, however, bailing out of the drm_do_probe_ddc_edid() retry loop
on first encounter of -ENXIO. This, combined with Eugeni's commit, broke
the retry on -ENXIO.
Retry GMBUS once on -ENXIO on first message to mitigate the issues with
passive adapters.
This patch is based on the work, and commit message, by Todd Previte
<tprevite@gmail.com>.
Sagi Grimberg [Thu, 4 Jun 2015 16:49:21 +0000 (19:49 +0300)]
iser-target: Fix possible use-after-free
iser connection termination process happens in 2 stages:
- isert_wait_conn:
- resumes rdma disconnect
- wait for session commands
- wait for flush completions (post a marked wr to signal we are done)
- wait for logout completion
- queue work for connection cleanup (depends on disconnected/timewait
events)
- isert_free_conn
- last reference put on the connection
In case we are terminating during IOs, we might be posting send/recv
requests after we posted the last work request which might lead
to a use-after-free condition in isert_handle_wc.
After we posted the last wr in isert_wait_conn we are guaranteed that
no successful completions will follow (meaning no new work request posts
may happen) but other flush errors might still come. So before we
put the last reference on the connection, we repeat the process of
posting a marked work request (isert_wait4flush) in order to make sure all
pending completions were flushed.
Sagi Grimberg [Thu, 4 Jun 2015 16:49:20 +0000 (19:49 +0300)]
iser-target: release stale iser connections
When receiving a new iser connect request we serialize
the pending requests by adding the newly created iser connection
to the np accept list and let the login thread process the connect
request one by one (np_accept_wait).
In case we received a disconnect request before the iser_conn
has begun processing (still linked in np_accept_list) we should
detach it from the list and clean it up and not have the login
thread process a stale connection. We do it only when the connection
state is not already terminating (initiator driven disconnect) as
this might lead us to access np_accept_mutex after the np was released
in live shutdown scenarios.
Since commit "2426bd456a6 target: Report correct response ..."
we might get a command with data_size that does not fit to
the number of allocated data sg elements. Given that we rely on
cmd t_data_nents which might be different than the data_size,
we sometimes receive local length error completion. The correct
approach would be to take the command data_size into account when
constructing the ib sg_list.
Jon Mason [Sun, 5 Apr 2015 18:57:22 +0000 (14:57 -0400)]
ntb: iounmap MW reg and vbase in error path
The MW regbase and vbase(s) were not being freed if an error occurred
in the vbase allocation loop. This is corrected by updating the error
path for the allocation loop to err4.
Reported-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Jon Mason <jdmason@kudzu.us>
1) Fix stack allocation in s390 BPF JIT, from Michael Holzheu.
2) Disable LRO on openvswitch paths, from Jiri Benc.
3) UDP early demux doesn't handle multicast group membership properly,
fix from Shawn Bohrer.
4) Fix TX queue hang due to incorrect handling of mixed sized fragments
and linearlization in i40e driver, from Anjali Singhai Jain.
5) Cannot use disable_irq() in timer handler of AMD xgbe driver, from
Thomas Lendacky.
6) b2net driver improperly assumes pci_alloc_consistent() gives zero'd
out memory, use dma_zalloc_coherent(). From Sriharsha Basavapatna.
7) Fix use-after-free in MPLS and ipv6, from Robert Shearman.
8) Missing neif_napi_del() calls in cleanup paths of b44 driver, from
Hauke Mehrtens.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
net: replace last open coded skb_orphan_frags with function call
net: bcmgenet: power on MII block for all MII modes
ipv6: Fix protocol resubmission
ipv6: fix possible use after free of dev stats
b44: call netif_napi_del()
bridge: disable softirqs around br_fdb_update to avoid lockup
Revert "bridge: use _bh spinlock variant for br_fdb_update to avoid lockup"
mpls: fix possible use after free of device
be2net: Replace dma/pci_alloc_coherent() calls with dma_zalloc_coherent()
bridge: use _bh spinlock variant for br_fdb_update to avoid lockup
amd-xgbe: Use disable_irq_nosync from within timer function
rhashtable: add missing import <linux/export.h>
i40e: Make sure to be in VEB mode if SRIOV is enabled at probe
i40e: start up in VEPA mode by default
i40e/i40evf: Fix mixed size frags and linearization
ipv4/udp: Verify multicast group is ours in upd_v4_early_demux()
openvswitch: disable LRO
s390/bpf: fix bpf frame pointer setup
s390/bpf: fix stack allocation
Linus Torvalds [Mon, 8 Jun 2015 23:26:53 +0000 (16:26 -0700)]
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
Pull last-minute virtio fix from Michael Tsirkin:
"This fixes a minor issue affecting multiqueue virtio net when user
keeps changing the number of active queues and CPUs are added and
removed by hotplug"
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
virtio_pci: Clear stale cpumask when setting irq affinity
Linus Torvalds [Mon, 8 Jun 2015 20:21:58 +0000 (13:21 -0700)]
Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc
Pull ARM SoC fixes from Kevin Hilman:
"About 10 days worth of small bug fixes, and the (hopefully) final
round fixes for from arm-soc land for the -rc cycle. Nothing special
to note, but here's a brief summary of fixes by SoC type:
- OMAP:
small set of misc DT fixes; boot fix for THUMB2 kernel
- mediatek:
PMIC fixes; DT fix for model name
- exynos:
wakeup interupt fixes for 3250
- mvebu:
revert mbus patch which broke DMA masters
* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
ARM: dts: am335x-boneblack: disable RTC-only sleep to avoid hardware damage
ARM: dts: AM35xx: fix system control module clocks
arm64: dts: mt8173-evb: fix model name
ARM: exynos: Fix wake-up interrupts for Exynos3250
ARM: dts: Fix n900 dts file to work around 4.1 touchscreen regression on n900
ARM: dts: Fix dm816x to use right compatible flag for MUSB
ARM: OMAP3: Fix booting with thumb2 kernel
Revert "bus: mvebu-mbus: make sure SDRAM CS for DMA don't overlap the MBus bridge window"
bus: mvebu-mbus: do not set WIN_CTRL_SYNCBARRIER on non io-coherent platforms.
ARM: mvebu: armada-xp-linksys-mamba: Disable internal RTC
soc: mediatek: Add compile dependency to pmic-wrapper
soc: mediatek: PMIC wrap: Fix register state machine handling
soc: mediatek: PMIC wrap: Fix clock rate handling
net: replace last open coded skb_orphan_frags with function call
Commit 70008aa50e92 ("skbuff: convert to skb_orphan_frags") replaced
open coded tests of SKBTX_DEV_ZEROCOPY and skb_copy_ubufs with calls
to helper function skb_orphan_frags. Apply that to the last remaining
open coded site.
Signed-off-by: Willem de Bruijn <willemb@google.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
net: bcmgenet: power on MII block for all MII modes
The RGMII block is currently only powered on when using RGMII or
RGMII_NO_ID, which is not correct when using the GENET interface in MII
or Reverse MII modes. We always need to power on the RGMII interface for
this block to properly work, regardless of the MII mode in which we
operate.
Fixes: aa09677cba423 ("net: bcmgenet: add MDIO routines") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Josh Hunt [Mon, 8 Jun 2015 16:00:59 +0000 (12:00 -0400)]
ipv6: Fix protocol resubmission
UDP encapsulation is broken on IPv6. This is because the logic to resubmit
the nexthdr is inverted, checking for a ret value > 0 instead of < 0. Also,
the resubmit label is in the wrong position since we already get the
nexthdr value when performing decapsulation. In addition the skb pull is no
longer necessary either.
This changes the return value check to look for < 0, using it for the
nexthdr on the next iteration, and moves the resubmit label to the proper
location.
With these changes the v6 code now matches what we do in the v4 ip input
code wrt resubmitting when decapsulating.
Signed-off-by: Josh Hunt <johunt@akamai.com> Acked-by: "Tom Herbert" <tom@herbertland.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Robert Shearman [Fri, 5 Jun 2015 17:51:54 +0000 (18:51 +0100)]
ipv6: fix possible use after free of dev stats
The memory pointed to by idev->stats.icmpv6msgdev,
idev->stats.icmpv6dev and idev->stats.ipv6 can each be used in an RCU
read context without taking a reference on idev. For example, through
IP6_*_STATS_* calls in ip6_rcv. These memory blocks are freed without
waiting for an RCU grace period to elapse. This could lead to the
memory being written to after it has been freed.
Fix this by using call_rcu to free the memory used for stats, as well
as idev after an RCU grace period has elapsed.
Signed-off-by: Robert Shearman <rshearma@brocade.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Kevin Hilman [Mon, 8 Jun 2015 17:31:34 +0000 (10:31 -0700)]
Merge tag 'omap-for-v4.1/fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes
Merge omap fixes for v4.1, urgent fix to avoid potential hardware damage From Tony Lindgren:
Omap fixes for the -rc cycle, including a fix for potential hardware
breakage on BeagleBones:
- BeagleBones don't support RTC-only mode, it can cause hardware
damage if system-power-controller is specified without
ti,pmic-shutdown-controller
- Fix a recent regression to am3517 SoCs caused by the recent clock
move that was not noticed until now despite automated boot
testing
- Fix a regression for n900 touchscreen triggered by recent
recent input changes
- Fix compatible property for dm816x USB to avoid errors with
USB Ethernet
- Fix oops for omap3 when built with CONFIG_THUMB2_KERNEL
* tag 'omap-for-v4.1/fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
ARM: dts: am335x-boneblack: disable RTC-only sleep to avoid hardware damage
ARM: dts: AM35xx: fix system control module clocks
ARM: dts: Fix n900 dts file to work around 4.1 touchscreen regression on n900
ARM: dts: Fix dm816x to use right compatible flag for MUSB
ARM: OMAP3: Fix booting with thumb2 kernel
Linus Torvalds [Mon, 8 Jun 2015 16:37:23 +0000 (09:37 -0700)]
Merge git://git.infradead.org/intel-iommu
Pull Intel IOMMU fix from David Woodhouse:
"This fixes an oops when attempting to enable 1:1 passthrough mode for
devices on which VT-d translation was disabled anyway.
It's actually a long-standing bug but recent changes (commit 18436afdc11a: "iommu/vt-d: Allow RMRR on graphics devices too") have
made it much easier to trigger with 'iommu=pt intel_iommu=igfx_off' on
the command line"
* git://git.infradead.org/intel-iommu:
iommu/vt-d: Fix passthrough mode with translation-disabled devices
Linus Torvalds [Mon, 8 Jun 2015 15:47:08 +0000 (08:47 -0700)]
Merge branch 'for-4.1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata
Pull libata fixes from Tejun Heo:
"Two driver fixes. One is for an ahci_mvebu controller config bug and
the other fixes pata_octeon_cf build issue"
* 'for-4.1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
pata_octeon_cf: fix broken build
ata: ahci_mvebu: Fix wrongly set base address for the MBus window setting
dmaengine: at_xdmac: rework slave configuration part
Rework slave configuration part in order to more report wrong errors
about the configuration.
Only maxburst and addr width values are checked when doing the slave
configuration. The validity of the channel configuration is done at
prepare time.
Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com> Cc: stable@vger.kernel.org # 4.0 and later Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Using _bh variant for spin locks causes this kind of warning:
Starting logging: ------------[ cut here ]------------
WARNING: CPU: 0 PID: 3 at /ssd_drive/linux/kernel/softirq.c:151
__local_bh_enable_ip+0xe8/0xf4()
Modules linked in:
CPU: 0 PID: 3 Comm: ksoftirqd/0 Not tainted 4.1.0-rc2+ #94
Hardware name: Atmel SAMA5
[<c0013c04>] (unwind_backtrace) from [<c00118a4>] (show_stack+0x10/0x14)
[<c00118a4>] (show_stack) from [<c001bbcc>]
(warn_slowpath_common+0x80/0xac)
[<c001bbcc>] (warn_slowpath_common) from [<c001bc14>]
(warn_slowpath_null+0x1c/0x24)
[<c001bc14>] (warn_slowpath_null) from [<c001e28c>]
(__local_bh_enable_ip+0xe8/0xf4)
[<c001e28c>] (__local_bh_enable_ip) from [<c01fdbd0>]
(at_xdmac_device_terminate_all+0xf4/0x100)
[<c01fdbd0>] (at_xdmac_device_terminate_all) from [<c02221a4>]
(atmel_complete_tx_dma+0x34/0xf4)
[<c02221a4>] (atmel_complete_tx_dma) from [<c01fe4ac>]
(at_xdmac_tasklet+0x14c/0x1ac)
[<c01fe4ac>] (at_xdmac_tasklet) from [<c001de58>]
(tasklet_action+0x68/0xb4)
[<c001de58>] (tasklet_action) from [<c001dfdc>]
(__do_softirq+0xfc/0x238)
[<c001dfdc>] (__do_softirq) from [<c001e140>] (run_ksoftirqd+0x28/0x34)
[<c001e140>] (run_ksoftirqd) from [<c0033a3c>]
(smpboot_thread_fn+0x138/0x18c)
[<c0033a3c>] (smpboot_thread_fn) from [<c0030e7c>] (kthread+0xdc/0xf0)
[<c0030e7c>] (kthread) from [<c000f480>] (ret_from_fork+0x14/0x34)
---[ end trace b57b14a99c1d8812 ]---
It comes from the fact that devices can called some code from the DMA
controller with irq disabled. _bh variant is not intended to be used in
this case since it can enable irqs. Switch to irqsave/irqrestore variant to
avoid this situation.
Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com> Cc: stable@vger.kernel.org # 4.0 and later Signed-off-by: Vinod Koul <vinod.koul@intel.com>
drm/i915: Properly initialize SDVO analog connectors
In the commit below, I missed the connector allocation in the function
intel_sdvo_analog_init(), leading to those connectors to have a NULL
state pointer.
commit 08d9bc920d465bbbbd762cac9383249c19bf69a2
Author: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
Date: Fri Apr 10 10:59:10 2015 +0300
drm/i915: Allocate connector state together with the connectors
Reported-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> Tested-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com> Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Axel Lin [Sun, 7 Jun 2015 13:33:29 +0000 (21:33 +0800)]
irqchip: sunxi-nmi: Fix off-by-one error in irq iterator
Fixes: 6058bb362818 'ARM: sun7i/sun6i: irqchip: Add irqchip driver for NMI controller' Signed-off-by: Axel Lin <axel.lin@ingics.com> Cc: Maxime Ripard <maxime.ripard@free-electrons.com> Cc: Carlo Caione <carlo@caione.org> Cc: Jason Cooper <jason@lakedaemon.net> Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1433684009.9134.1.camel@ingics.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
bridge: disable softirqs around br_fdb_update to avoid lockup
br_fdb_update() can be called in process context in the following way:
br_fdb_add() -> __br_fdb_add() -> br_fdb_update() (if NTF_USE flag is set)
so we need to disable softirqs because there are softirq users of the
hash_lock. One easy way to reproduce this is to modify the bridge utility
to set NTF_USE, enable stp and then set maxageing to a low value so
br_fdb_cleanup() is called frequently and then just add new entries in
a loop. This happens because br_fdb_cleanup() is called from timer/softirq
context. The spin locks in br_fdb_update were _bh before commit f8ae737deea1
("[BRIDGE]: forwarding remove unneeded preempt and bh diasables")
and at the time that commit was correct because br_fdb_update() couldn't be
called from process context, but that changed after commit: 292d1398983f ("bridge: add NTF_USE support")
Using local_bh_disable/enable around br_fdb_update() allows us to keep
using the spin_lock/unlock in br_fdb_update for the fast-path.
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Fixes: 292d1398983f ("bridge: add NTF_USE support") Signed-off-by: David S. Miller <davem@davemloft.net>
Robert Shearman [Fri, 5 Jun 2015 17:54:45 +0000 (18:54 +0100)]
mpls: fix possible use after free of device
The mpls device is used in an RCU read context without a lock being
held. As the memory is freed without waiting for the RCU grace period
to elapse, the freed memory could still be in use.
Address this by using kfree_rcu to free the memory for the mpls device
after the RCU grace period has elapsed.
Fixes: 03c57747a702 ("mpls: Per-device MPLS state") Signed-off-by: Robert Shearman <rshearma@brocade.com> Acked-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Sun, 7 Jun 2015 23:56:10 +0000 (16:56 -0700)]
Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus
Pull MIPS updates from Ralf Baechle:
"Eight fixes across arch/mips. Nothing stands particuarly out nor is
complicated but fixes keep coming in at a higher than comfortable
rate"
* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
MIPS: KVM: Do not sign extend on unsigned MMIO load
MIPS: BPF: Fix stack pointer allocation
MIPS: Loongson-3: Fix a cpu-hotplug issue in loongson3_ipi_interrupt()
MIPS: Fix enabling of DEBUG_STACKOVERFLOW
MIPS: c-r4k: Fix typo in probe_scache()
MIPS: Avoid an FPE exception in FCSR mask probing
MIPS: ath79: Add a missing new line in log message
MIPS: ralink: Fix clearing the illegal access interrupt
be2net: Replace dma/pci_alloc_coherent() calls with dma_zalloc_coherent()
There are several places in the driver (all in control paths) where
coherent dma memory is being allocated using either dma_alloc_coherent()
or the deprecated pci_alloc_consistent(). All these calls should be
changed to use dma_zalloc_coherent() to avoid uninitialized fields in
data structures backed by this memory.
Reported-by: Joerg Roedel <jroedel@suse.de> Tested-by: Joerg Roedel <jroedel@suse.de> Signed-off-by: Sriharsha Basavapatna <sriharsha.basavapatna@avagotech.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Wilson Kok [Fri, 5 Jun 2015 07:52:57 +0000 (00:52 -0700)]
bridge: use _bh spinlock variant for br_fdb_update to avoid lockup
br_fdb_update() can be called in process context in the following way:
br_fdb_add() -> __br_fdb_add() -> br_fdb_update() (if NTF_USE flag is set)
so we need to use spin_lock_bh because there are softirq users of the
hash_lock. One easy way to reproduce this is to modify the bridge utility
to set NTF_USE, enable stp and then set maxageing to a low value so
br_fdb_cleanup() is called frequently and then just add new entries in
a loop. This happens because br_fdb_cleanup() is called from timer/softirq
context. These locks were _bh before commit f8ae737deea1
("[BRIDGE]: forwarding remove unneeded preempt and bh diasables")
and at the time that commit was correct because br_fdb_update() couldn't be
called from process context, but that changed after commit: 292d1398983f ("bridge: add NTF_USE support")
Signed-off-by: Wilson Kok <wkok@cumulusnetworks.com> Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Fixes: 292d1398983f ("bridge: add NTF_USE support") Signed-off-by: David S. Miller <davem@davemloft.net>
Peter Zijlstra [Tue, 2 Jun 2015 10:50:13 +0000 (12:50 +0200)]
lockdep: Fix a race between /proc/lock_stat and module unload
The lock_class iteration of /proc/lock_stat is not serialized against
the lockdep_free_key_range() call from module unload.
Therefore it can happen that we find a class of which ->name/->key are
no longer valid.
There is a further bug in zap_class() that left ->name dangling. Cure
this. Use RCU_INIT_POINTER() because NULL.
Since lockdep_free_key_range() is rcu_sched serialized, we can read
both ->name and ->key under rcu_read_lock_sched() (preempt-disable)
and be assured that if we observe a !NULL value it stays safe to use
for as long as we hold that lock.
If we observe both NULL, skip the entry.
Reported-by: Jerome Marchand <jmarchan@redhat.com> Tested-by: Jerome Marchand <jmarchan@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/20150602105013.GS3644@twins.programming.kicks-ass.net Signed-off-by: Ingo Molnar <mingo@kernel.org>
amd-xgbe: Use disable_irq_nosync from within timer function
Since the Tx timer function runs in softirq context the driver needs
to call disable_irq_nosync instead of a disable_irq.
Reported-by: Josh Stone <jistone@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Sun, 7 Jun 2015 05:37:45 +0000 (22:37 -0700)]
Merge tag 'driver-core-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Pull driver core fixes from Greg KH:
"Here are two fixes for the driver core that resolve some reported
issues.
One is a regression from 4.0, the other a fixes a reported oops that
has been there since 3.19.
Both have been in linux-next for a while with no problems"
* tag 'driver-core-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
drivers/base: cacheinfo: handle absence of caches
drivers: of/base: move of_init to driver_init
Linus Torvalds [Sun, 7 Jun 2015 05:33:08 +0000 (22:33 -0700)]
Merge tag 'staging-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging / IIO fixes from Greg KH:
"Here are some IIO driver fixes to resolve reported issues, some ozwpan
fixes for some reported CVE problems, and a rtl8712 driver fix for a
reported regression.
All have been in linux-next successfully"
* tag 'staging-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: rtl8712: fix stack dump
ozwpan: unchecked signed subtraction leads to DoS
ozwpan: divide-by-zero leading to panic
ozwpan: Use unsigned ints to prevent heap overflow
ozwpan: Use proper check to prevent heap overflow
iio: adc: twl6030-gpadc: Fix modalias
iio: adis16400: Fix burst transfer for adis16448
iio: adis16400: Fix burst mode
iio: adis16400: Compute the scan mask from channel indices
iio: adis16400: Use != channel indices for the two voltage channels
iio: adis16400: Report pressure channel scale
Linus Torvalds [Sun, 7 Jun 2015 05:14:23 +0000 (22:14 -0700)]
Merge tag 'tty-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty/serial driver fixes from Greg KH:
"Here are a few TTY and Serial driver fixes for reported regressions
and crashes.
All of these have been in linux-next with no reported problems"
* tag 'tty-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
n_tty: Fix auditing support for cannonical mode
serial: 8250_omap: provide complete custom startup & shutdown callbacks
n_tty: Fix calculation of size in canon_copy_from_read_buf
serial: imx: Fix DMA handling for IDLE condition aborts
serial/amba-pl011: Unconditionally poll for FIFO space before each TX char
Linus Torvalds [Sun, 7 Jun 2015 05:06:53 +0000 (22:06 -0700)]
Merge tag 'usb-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB and PHY driver fixes from Greg KH:
"Here are some USB and PHY driver fixes that resolve some reported
regressions. Also in here are some new device ids.
All of the details are in the shortlog and these patches have been in
linux-next with no problems"
* tag 'usb-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (22 commits)
USB: cp210x: add ID for HubZ dual ZigBee and Z-Wave dongle
usb: renesas_usbhs: Don't disable the pipe if Control write status stage
usb: renesas_usbhs: Fix fifo unclear in usbhsf_prepare_pop
usb: gadget: f_fs: fix check in read operation
usb: musb: fix order of conditions for assigning end point operations
usb: gadget: f_uac1: check return code from config_ep_by_speed
usb: gadget: ffs: fix: Always call ffs_closed() in ffs_data_clear()
usb: gadget: g_ffs: Fix counting of missing_functions
usb: s3c2410_udc: correct reversed pullup logic
usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros
usb: phy: tahvo: Pass the IRQF_ONESHOT flag
usb: phy: ab8500-usb: Pass the IRQF_ONESHOT flag
usb: renesas_usbhs: Revise the binding document about the dma-names
usb: host: xhci: add mutex for non-thread-safe data
usb: make module xhci_hcd removable
USB: serial: ftdi_sio: Add support for a Motion Tracker Development Board
usb: gadget: f_midi: fix segfault when reading empty id
phy: phy-rcar-gen2: Fix USBHS_UGSTS_LOCK value
phy: omap-usb2: invoke pm_runtime_disable on error path
phy: fix Kconfig dependencies
...
Linus Torvalds [Sun, 7 Jun 2015 04:43:29 +0000 (21:43 -0700)]
Merge tag 'devicetree-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux
Pull devicetree fix from Grant Likely:
"Stupid typo fix for v4.1. One of the IS_ENABLED() macro calls forgot
the CONFIG_ prefix. Only affects a tiny number of platforms, but
still..."
* tag 'devicetree-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux:
of/dynamic: Fix test for PPC_PSERIES
Hauke Mehrtens [Sun, 24 May 2015 19:08:14 +0000 (21:08 +0200)]
ARM: BCM5301X: add IRQ numbers for PCIe controller
The driver for the PCIe controller was just added, this adds the
missing definition of the IRQ numbers to device tree. The driver itself
will be automatically detected by bcma.
Hauke Mehrtens [Fri, 29 May 2015 21:39:47 +0000 (23:39 +0200)]
ARM: BCM5301X: add NAND flash chip description
This adds the NAND flash chip description for a standard chip found
connected to this SoC. This makes use of generic Broadcom NAND driver
with the iProc interface.
Linus Torvalds [Sat, 6 Jun 2015 16:15:14 +0000 (09:15 -0700)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
"i915 has a bunch of fixes, and Russell found a bug in sysfs writing
handling that results in userspace getting stuck"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm: fix writing to /sys/class/drm/*/status
drm/i915: Move WaBarrierPerformanceFixDisable:skl to skl code from chv code
drm/i915: Include G4X/VLV/CHV in self refresh status
drm/i915: Initialize HWS page address after GPU reset
drm/i915: Don't skip request retirement if the active list is empty
drm/i915/hsw: Fix workaround for server AUX channel clock divisor
Linus Torvalds [Sat, 6 Jun 2015 16:08:23 +0000 (09:08 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input subsystem fixes from Dmitry Torokhov:
"Just a couple touchpad drivers fixups"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: alps - do not reduce trackpoint speed by half
Input: elantech - add new icbody type
Input: elantech - fix detection of touchpads where the revision matches a known rate
Markos Chandras [Thu, 4 Jun 2015 10:56:13 +0000 (11:56 +0100)]
MIPS: BPF: Fix stack pointer allocation
Fix stack pointer offset which could potentially corrupt
argument registers in the previous frame. The calculated offset
reflects the size of all the registers we need to preserve so there
is no need for this erroneous subtraction.
[ralf@linux-mips.org: Fixed conflict due to only applying this fix part
of the entire series as part of 4.1 fixes.]