14 Feb, 2013

17 commits

  • Under LPAR the zfcpdump HSA is a shared resource. Up to now the HSA memory
    is released when the zcore file is closed. Dump programs that know that
    they do not need the HSA memory any more (e.g. because they already dumped it)
    could release it earlier. This would allow other LPARs to use it again.

    To achieve this a new debugfs file "hsa" is added that can be used to read
    the HSA size and to release the HSA by writing "0" into the file.

    Signed-off-by: Michael Holzheu
    Signed-off-by: Martin Schwidefsky

    Michael Holzheu
     
  • When a zfcpdump is triggered and a second dump on the same CEC is
    already in progress for another LPAR, diagnose 308 returns with
    an error code until the first dump is finished. Currently the
    second Linux stops with a disabled wait PSW in that case.

    This is improved now by by triggering diag 308 in a loop until
    it works.

    Signed-off-by: Michael Holzheu
    Signed-off-by: Martin Schwidefsky

    Michael Holzheu
     
  • Cleanup the functions used to call SEI.
    Also provide !CONFIG_PCI dummys for pci error handling.

    Reviewed-by: Peter Oberparleiter
    Signed-off-by: Sebastian Ott
    Signed-off-by: Martin Schwidefsky

    Sebastian Ott
     
  • Signed-off-by: Ingo Tuchscherer
    Signed-off-by: Martin Schwidefsky

    Ingo Tuchscherer
     
  • Given enough debug options some modules can grow large enough
    that the GOT table gets bigger than 4K. On s390 the modules
    are compiled with -fpic which limits the GOT to 4K. The end
    result is a module that is loaded but won't work.

    Add a sanity check to apply_rela and return with an error if
    a relocation error is detected for a module.

    Signed-off-by: Martin Schwidefsky

    Martin Schwidefsky
     
  • Convert the synchronous size sense code to an interrupt driven
    approach. This allows to set the device online even if the
    terminal is not connected. With the new code views can be
    registered without a connected terminal, the tty can be opened
    as soon as the device is online. After the terminal has been
    connected and the size has been determined the tty is resized
    to match the device characteristics..

    Signed-off-by: Martin Schwidefsky

    Martin Schwidefsky
     
  • Add a notifier to create / destroy the device nodes for the tty view
    and the fullscreen view. Only device nodes for online devices are
    created and the device names will follow the convention as outlined
    in Documentation/devices.txt: 3270/tty for the tty nodes,
    3270/tub for hte fullscreen nodes and 3270/tub for the fullscreen
    control node.

    Signed-off-by: Martin Schwidefsky

    Martin Schwidefsky
     
  • Corrects the order of tasklet_init vs. the allocation of the
    read request which has been broken by git commit 9d2ae233
    "TTY: tty3270, move initialization to allocation".

    Signed-off-by: Martin Schwidefsky

    Martin Schwidefsky
     
  • Reintroduce the tty3270_open function which has been removed by
    git commit 20cda6f2 "TTY: tty3270, add tty install". Without
    the open function in the tty_operations tty_open will return
    -ENODEV and the 3270 tty will not work.

    Signed-off-by: Martin Schwidefsky

    Martin Schwidefsky
     
  • E.g. readl is defined like this

    #define readl(addr) __le32_to_cpu(__raw_readl(addr))

    If a there is a readl() call that doesn't check the return value
    this will cause a compile warning on big endian machines due to
    the __le32_to_cpu macro magic.

    E.g. code like this:

    readl(addr);

    will generate the following compile warning:

    warning: value computed is not used [-Wunused-value]

    With this patch we get rid of dozens of compile warnings on s390.

    Signed-off-by: Heiko Carstens
    Acked-by: Arnd Bergmann
    Signed-off-by: Martin Schwidefsky

    Heiko Carstens
     
  • Pull networking fixes from David Miller:
    "This is primarily to get those r8169 reverts sorted, but other fixes
    have accumulated meanwhile.

    1) Revert two r8169 changes to fix suspend/resume for some users,
    from Francois Romieu.

    2) PCI dma mapping errors in atl1c are not checked for and this cause
    hard crashes for some users, from Xiong Huang.

    3) In 3.8.x we merged the removal of the EXPERIMENTAL dependency for
    'dlm' but the same patch for 'sctp' got lost somewhere, resulting
    in the potential for build errors since there are cross
    dependencies. From Kees Cook.

    4) SCTP's ipv6 socket route validation makes boolean tests
    incorrectly, fix from Daniel Borkmann.

    5) mac80211 does sizeof(ptr) instead of (sizeof(ptr) * nelem), from
    Cong Ding.

    6) arp_rcv() can crash on shared non-linear packets, from Eric
    Dumazet.

    7) Avoid crashes in macvtap by setting ->gso_type consistently in
    ixgbe, qlcnic, and bnx2x drivers. From Michael S Tsirkin and
    Alexander Duyck.

    8) Trinity fuzzer spots infinite loop in __skb_recv_datagram(), fix
    from Eric Dumazet.

    9) STP protocol frames should use high packet priority, otherwise an
    overloaded bridge can get stuck. From Stephen Hemminger.

    10) The HTB packet scheduler was converted some time ago to store
    internal timestamps in nanoseconds, but we don't convert back into
    psched ticks for the user during dumps. Fix from Jiri Pirko.

    11) mwl8k channel table doesn't set the .band field properly,
    resulting in NULL pointer derefs. Fix from Jonas Gorski.

    12) mac80211 doesn't accumulate channels properly during a scan so we
    can downgrade heavily to a much less desirable connection speed.
    Fix from Johannes Berg.

    13) PHY probe failure in stmmac can result in resource leaks and
    double MDIO registery later, from Giuseppe CAVALLARO.

    14) Correct ipv6 checksumming in ip6t_NPT netfilter module, also fix
    address prefix mangling, from YOSHIFUJI Hideaki."

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (27 commits)
    net, sctp: remove CONFIG_EXPERIMENTAL
    net: sctp: sctp_v6_get_dst: fix boolean test in dst cache
    batman-adv: Fix NULL pointer dereference in DAT hash collision avoidance
    net/macb: fix race with RX interrupt while doing NAPI
    atl1c: add error checking for pci_map_single functions
    htb: fix values in opt dump
    ixgbe: Only set gso_type to SKB_GSO_TCPV4 as RSC does not support IPv6
    net: fix infinite loop in __skb_recv_datagram()
    net: qmi_wwan: add Yota / Megafon M100-1 4g modem
    mwl8k: fix band for supported channels
    bridge: set priority of STP packets
    mac80211: fix channel selection bug
    arp: fix possible crash in arp_rcv()
    bnx2x: set gso_type
    qlcnic: set gso_type
    ixgbe: fix gso type
    stmmac: mdio register has to fail if the phy is not found
    stmmac: fix macro used for debugging the xmit
    Revert "r8169: enable internal ASPM and clock request settings".
    Revert "r8169: enable ALDPS for power saving".
    ...

    Linus Torvalds
     
  • Pull x86 fixes from Peter Anvin:
    "One (hopefully) last batch of x86 fixes. You asked for the patch by
    patch justifications, so here they are:

    x86, MCE: Retract most UAPI exports

    This one unexports from userspace a bunch of definitions which should
    never have been exported. We really don't want to create an
    accidental legacy here.

    x86, doc: Add a bootloader ID for OVMF

    This is a documentation-only patch, just recording the official
    assignment of a boot loader ID.

    x86: Do not leak kernel page mapping locations

    Security: avoid making it needlessly easy for user space to probe the
    kernel memory layout.

    x86/mm: Check if PUD is large when validating a kernel address

    Prevent failures using /proc/kcore when using 1G pages.

    x86/apic: Work around boot failure on HP ProLiant DL980 G7 Server systems

    Works around a BIOS problem causing boot failures on affected hardware."

    * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/mm: Check if PUD is large when validating a kernel address
    x86/apic: Work around boot failure on HP ProLiant DL980 G7 Server systems
    x86, doc: Add a bootloader ID for OVMF
    x86: Do not leak kernel page mapping locations
    x86, MCE: Retract most UAPI exports

    Linus Torvalds
     
  • This config item has not carried much meaning for a while now and is
    almost always enabled by default. As agreed during the Linux kernel
    summit, remove it.

    Acked-by: Vlad Yasevich
    Acked-by: Steven Whitehouse
    Signed-off-by: Kees Cook
    Signed-off-by: David Rientjes
    Signed-off-by: David S. Miller

    Kees Cook
     
  • We walk through the bind address list and try to get the best source
    address for a given destination. However, currently, we take the
    'continue' path of the loop when an entry is invalid (!laddr->valid)
    *and* the entry state does not equal SCTP_ADDR_SRC (laddr->state !=
    SCTP_ADDR_SRC).

    Thus, still, invalid entries with SCTP_ADDR_SRC might not 'continue'
    as well as valid entries with SCTP_ADDR_{NEW, SRC, DEL}, with a possible
    false baddr and matchlen as a result, causing in worst case dst route
    to be false or possibly NULL.

    This test should actually be a '||' instead of '&&'. But lets fix it
    and make this a bit easier to read by having the condition the same way
    as similarly done in sctp_v4_get_dst.

    Signed-off-by: Daniel Borkmann
    Acked-by: Vlad Yasevich
    Acked-by: Neil Horman
    Signed-off-by: David S. Miller

    Daniel Borkmann
     
  • An entry in DAT with the hashed position of 0 can cause a NULL pointer
    dereference when the first entry is checked by batadv_choose_next_candidate.
    This first candidate automatically has the max value of 0 and the max_orig_node
    of NULL. Not checking max_orig_node for NULL in batadv_is_orig_node_eligible
    will lead to a NULL pointer dereference when checking for the lowest address.

    This problem was added in 785ea1144182c341b8b85b0f8180291839d176a8
    ("batman-adv: Distributed ARP Table - create DHT helper functions").

    Signed-off-by: Pau Koning
    Signed-off-by: David S. Miller

    Pau Koning
     
  • When interrupts are disabled, an RX condition can occur but
    it is not reported when enabling interrupts again. We need to check
    RSR and use napi_reschedule() if condition is met.

    Signed-off-by: Nicolas Ferre
    Signed-off-by: David S. Miller

    Nicolas Ferre
     
  • it is reported that code hit DMA-API errors on 3.8-rc6+,
    (see https://bugzilla.redhat.com/show_bug.cgi?id=908436, and
    https://bugzilla.redhat.com/show_bug.cgi?id=908550)

    this patch just adds error handler for
    pci_map_single and skb_frag_dma_map.

    Signed-off-by: xiong
    Signed-off-by: David S. Miller

    Huang, Xiong
     

13 Feb, 2013

17 commits

  • A user reported the following oops when a backup process reads
    /proc/kcore:

    BUG: unable to handle kernel paging request at ffffbb00ff33b000
    IP: [] kern_addr_valid+0xbe/0x110
    [...]

    Call Trace:
    [] read_kcore+0x17a/0x370
    [] proc_reg_read+0x77/0xc0
    [] vfs_read+0xc7/0x130
    [] sys_read+0x53/0xa0
    [] system_call_fastpath+0x16/0x1b

    Investigation determined that the bug triggered when reading
    system RAM at the 4G mark. On this system, that was the first
    address using 1G pages for the virt->phys direct mapping so the
    PUD is pointing to a physical address, not a PMD page.

    The problem is that the page table walker in kern_addr_valid() is
    not checking pud_large() and treats the physical address as if
    it was a PMD. If it happens to look like pmd_none then it'll
    silently fail, probably returning zeros instead of real data. If
    the data happens to look like a present PMD though, it will be
    walked resulting in the oops above.

    This patch adds the necessary pud_large() check.

    Unfortunately the problem was not readily reproducible and now
    they are running the backup program without accessing
    /proc/kcore so the patch has not been validated but I think it
    makes sense.

    Signed-off-by: Mel Gorman
    Reviewed-by: Rik van Riel
    Reviewed-by: Michal Hocko
    Acked-by: Johannes Weiner
    Cc: stable@vger.kernel.org
    Cc: linux-mm@kvack.org
    Link: http://lkml.kernel.org/r/20130211145236.GX21389@suse.de
    Signed-off-by: Ingo Molnar

    Mel Gorman
     
  • …r/parisc-linux into akpm

    Pull hp parisc automounter fix from Helge Deller:
    "This unbreaks automounter support for the parisc architecture (and
    probably aarch64 as well).""

    * 'autofs-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
    unbreak automounter support on 64-bit kernel with 32-bit userspace (v2)

    Linus Torvalds
     
  • Pull s390 regression fix from Martin Schwidefsky:
    "The recent fix for the s390 sched_clock() function uncovered yet
    another bug in s390_next_ktime which causes an endless loop in KVM.
    This regression should be fixed before v3.8.

    I keep the fingers crossed that this is the last one for v3.8."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
    s390/timer: avoid overflow when programming clock comparator

    Linus Torvalds
     
  • Pull m68knommu fix from Greg Ungerer:
    "This contains a single critical fix for the non-MMU m68k platforms.

    The change of the kernel exec code path has revealed a problem in the
    start thread code that causes crashing on boot. This is the fix for
    it."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
    m68knommu: fix trap on execing /bin/init

    Linus Torvalds
     
  • in htb_change_class() cl->buffer and cl->buffer are stored in ns.
    So in dump, convert them back to psched ticks.

    Note this was introduced by:
    commit 56b765b79e9a78dc7d3f8850ba5e5567205a3ecd
    htb: improved accuracy at high rates

    Please consider this for -net/-stable.

    Signed-off-by: Jiri Pirko
    Acked-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Jiri Pirko
     
  • Pull tile bugfixes from Chris Metcalf:
    "This includes a variety of minor bug fixes, mostly to do with testing
    "make allyesconfig", "make allmodconfig", "make allnoconfig", inspired
    to Tejun Heo's observation about Kconfig.freezer not being included.

    The largest changes are just syntax changes removing the tile-specific
    use of a macro named INT_MASK, which is way too commonly redefined
    throughout driver code"

    * 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
    tile: tag some code with #ifdef CONFIG_COMPAT
    tile: fix memcpy_*io functions for allnoconfig
    tile: export a handful of symbols appropriately
    drm: fix compile failure by including
    tile: avoid defining INT_MASK macro in
    tile: provide "screen_info" when enabling VT
    drivers/input/joystick/analog.c: enable precise timer
    tile: include kernel/Kconfig.freezer in tile Kconfig
    tile: remove an unused variable in copy_thread()

    Linus Torvalds
     
  • Pull ARM SoC fixes from Olof Johansson:
    "We had a number of fixes queued up, but taking a strict pass-through
    and weeding out any that either have been broken for a while, or are
    for platforms that need out-of-tree code to be useful anyway, or other
    fixes for problems that few users are likely to see in real life, only
    this short branch of patches remains.

    The three patches here are to make SMP boot work on the Calxeda
    platforms again. Some of the rework for cpuids on 3.8 broke it (and
    it was discovered late, unfortunately)."

    * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
    ARM: highbank: mask cluster id from cpu_logical_map
    ARM: scu: mask cluster id from cpu_logical_map
    ARM: scu: add empty scu_enable for !CONFIG_SMP

    Linus Torvalds
     
  • The total number of low memory pages is determined as totalram_pages -
    totalhigh_pages, so without this patch all CMA pageblocks placed in
    highmem were accounted to low memory.

    Signed-off-by: Marek Szyprowski
    Acked-by: Kyungmin Park
    Cc: Minchan Kim
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Marek Szyprowski
     
  • We're forgetting to reenable local interrupts on an error path.

    Signed-off-by: "Eric W. Biederman"
    Reported-by: Josh Boyer
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Eric W. Biederman
     
  • The designed workflow for the caches in kmemcg is: register it with
    memcg_register_cache() if kmemcg is already available or later on when a
    new kmemcg appears at memcg_update_cache_sizes() which will handle all
    caches in the system. The caches created at boot time will be handled
    by the later, and the memcg-caches as well as any system caches that are
    registered later on by the former.

    There is a bug, however, in memcg_register_cache: we correctly set up
    the array size, but do not mark the cache as a root cache.

    This means that allocations for any cache appearing late in the game
    will see memcg->memcg_params->is_root_cache == false, and in particular,
    trigger VM_BUG_ON(!cachep->memcg_params->is_root_cache) in
    __memcg_kmem_cache_get.

    The obvious fix is to include the missing assignment.

    Signed-off-by: Glauber Costa
    Cc: Michal Hocko
    Cc: Johannes Weiner
    Cc: KAMEZAWA Hiroyuki
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Glauber Costa
     
  • With commit 8e72033f2a48 ("thp: make MADV_HUGEPAGE check for
    mm->def_flags") the VM_NOHUGEPAGE flag may be set on s390 in
    mm->def_flags for certain processes, to prevent future thp mappings.
    This would be overwritten by do_mlockall(), which sets it back to 0 with
    an optional VM_LOCKED flag set.

    To fix this, instead of overwriting mm->def_flags in do_mlockall(), only
    the VM_LOCKED flag should be set or cleared.

    Signed-off-by: Gerald Schaefer
    Reported-by: Vivek Goyal
    Cc: Andrea Arcangeli
    Cc: Hugh Dickins
    Cc: Martin Schwidefsky
    Cc: Heiko Carstens
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Gerald Schaefer
     
  • Commit e7e034e18a0a ("drivers/rtc/rtc-pl031.c: fix the missing operation
    on enable") accidentally broke the ST variants of PL031.

    The bit that is being poked as "clockwatch" enable bit for the ST
    variants does the work of bit 0 on this variant. Bit 0 is used for a
    clock divider on the ST variants, and setting it to 1 will affect
    timekeeping in a very bad way.

    Signed-off-by: Linus Walleij
    Acked-by: Haojian Zhuang
    Cc: Mian Yousaf KAUKAB
    Cc: Srinidhi Kasagar
    Cc: Alessandro Zummo
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Linus Walleij
     
  • John W. Linville says:

    ====================
    Here is another handful of late-breaking fixes intended for the 3.8
    stream... Hopefully the will still make it! :-)

    There are three mac80211 fixes pulled from Johannes:

    "Here are three fixes still for the 3.8 stream, the fix from Cong Ding
    for the bad sizeof (Stephen Hemminger had pointed it out before but I'd
    promptly forgotten), a mac80211 managed-mode channel context usage fix
    where a downgrade would never stop until reaching non-HT and a bug in
    the channel determination that could cause invalid channels like HT40+
    on channel 11 to be used."

    Also included is a mwl8k fix that avoids an oops when using mwl8k
    devices that only support the 5 GHz band.

    Please let me know if there are problems!
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • The original fix that was applied for setting gso_type required more change
    than necessary because it was assumed ixgbe does RSC on IPv6 frames and this
    is not correct. RSC is only supported with IPv4/TCP frames only. As such we
    can simplify the fix and avoid the unnecessary move of eth_type_trans.

    The previous patch "ixgbe: fix gso type" and this patch reduce the entire fix
    to one line that sets gso_type to TCPV4 if the frame is RSC.

    Signed-off-by: Alexander Duyck
    Signed-off-by: David S. Miller

    Alexander Duyck
     
  • Tommi was fuzzing with trinity and reported the following problem :

    commit 3f518bf745 (datagram: Add offset argument to __skb_recv_datagram)
    missed that a raw socket receive queue can contain skbs with no payload.

    We can loop in __skb_recv_datagram() with MSG_PEEK mode, because
    wait_for_packet() is not prepared to skip these skbs.

    [ 83.541011] INFO: rcu_sched detected stalls on CPUs/tasks: {}
    (detected by 0, t=26002 jiffies, g=27673, c=27672, q=75)
    [ 83.541011] INFO: Stall ended before state dump start
    [ 108.067010] BUG: soft lockup - CPU#0 stuck for 22s! [trinity-child31:2847]
    ...
    [ 108.067010] Call Trace:
    [ 108.067010] [] __skb_recv_datagram+0x1a3/0x3b0
    [ 108.067010] [] skb_recv_datagram+0x2d/0x30
    [ 108.067010] [] rawv6_recvmsg+0xad/0x240
    [ 108.067010] [] sock_common_recvmsg+0x34/0x50
    [ 108.067010] [] sock_recvmsg+0xbc/0xf0
    [ 108.067010] [] sys_recvfrom+0xde/0x150
    [ 108.067010] [] system_call_fastpath+0x16/0x1b

    Reported-by: Tommi Rantala
    Tested-by: Tommi Rantala
    Signed-off-by: Eric Dumazet
    Cc: Pavel Emelyanov
    Acked-by: Pavel Emelyanov
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • Interface layout:

    00 CD-ROM
    01 debug COM port
    02 AP control port
    03 modem
    04 usb-ethernet

    Bus=01 Lev=02 Prnt=02 Port=01 Cnt=02 Dev#= 4 Spd=480 MxCh= 0
    D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
    P: Vendor=0408 ProdID=ea42 Rev= 0.00
    S: Manufacturer=Qualcomm, Incorporated
    S: Product=Qualcomm CDMA Technologies MSM
    S: SerialNumber=353568051xxxxxx
    C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
    I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
    E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
    E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
    E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms

    Signed-off-by: Bjørn Mork
    Signed-off-by: David S. Miller

    Bjørn Mork
     
  • Pull drm fixes from Dave Airlie:
    "Three nouveau fixes, all user visible issues, and one radeon
    regression fix"

    * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
    drm/radeon: enforce use of radeon_get_ib_value when reading user cmd
    drm/nouveau: add lockdep annotations
    drm/nv50/fb: Fix nullptr-deref on IGPs
    drm/nouveau: use different register to wait for secret scrubber

    Linus Torvalds
     

12 Feb, 2013

5 commits

  • …wireless into for-davem

    John W. Linville
     
  • When ever parsing cmd buffer supplied by userspace we need to use
    radeon_get_ib_value rather than directly accessing the ib as the user
    cmd might not yet be copied into the ib thus the parser might read
    value that does not correspond to what user is sending and possibly
    allowing user to send malicious command undected.

    Signed-off-by: Jerome Glisse
    Reviewed-by: Alex Deucher
    Signed-off-by: Dave Airlie

    Jerome Glisse
     
  • The band field for the supported channels were left unpopulated, making
    them default to 0 == IEEE80211_BAND_2GHZ, even for the 5GHz channels.

    This resulted in null pointer accesses if anything tries to access
    wiphy->bands[channel->band] of a 5GHz channel on 5GHz only cards, since
    wiphy->bands[2GHZ] is NULL for them (e.g. cfg80211_chandef_usable does).

    Example kernel OOPS:

    [ 665.669993] Unable to handle kernel NULL pointer dereference at virtual address 00000016
    [ 665.678194] pgd = c6d58000
    [ 665.680941] [00000016] *pgd=06f8a831, *pte=00000000, *ppte=00000000
    [ 665.687303] Internal error: Oops: 17 [#1]
    (...)
    [ 666.116373] Backtrace:
    [ 666.118866] [] (cfg80211_chandef_usable+0x0/0x1bc [cfg80211]) from [] (nl80211_leave_mesh+0x244/0x264 [cfg80211])
    [ 666.130919] r7:c6d12100 r6:0000143c r5:c0611c48 r4:c0611b98
    [ 666.136668] [] (nl80211_leave_mesh+0x164/0x264 [cfg80211]) from [] (nl80211_remain_on_channel+0x2a0/0x358 [cfg80211])
    [ 666.149074] r7:c6d12000 r6:c6d12000 r5:c6f4f368 r4:00000003
    [ 666.154814] [] (nl80211_remain_on_channel+0x240/0x358 [cfg80211]) from [] (nl80211_set_wiphy+0x264/0x560 [cfg80211])
    [ 666.167150] [] (nl80211_set_wiphy+0x0/0x560 [cfg80211]) from [] (genl_rcv_msg+0x1b8/0x1f8)
    [ 666.177205] [] (genl_rcv_msg+0x0/0x1f8) from [] (netlink_rcv_skb+0x58/0xb4)
    [ 666.185949] [] (netlink_rcv_skb+0x0/0xb4) from [] (genl_rcv+0x20/0x2c)
    [ 666.194251] r6:c6f70780 r5:0000002c r4:c6f70780 r3:00000001
    [ 666.199973] [] (genl_rcv+0x0/0x2c) from [] (netlink_unicast+0x154/0x1f4)
    [ 666.208449] r4:c785ea00 r3:c01f92fc
    [ 666.212057] [] (netlink_unicast+0x0/0x1f4) from [] (netlink_sendmsg+0x230/0x2b0)
    [ 666.221240] [] (netlink_sendmsg+0x0/0x2b0) from [] (sock_sendmsg+0x90/0xa4)
    [ 666.229986] [] (sock_sendmsg+0x0/0xa4) from [] (__sys_sendmsg+0x290/0x298)
    [ 666.238637] r9:00000000 r8:c0611ec8 r6:0000002c r5:c0610000 r4:c0611f64
    [ 666.245411] [] (__sys_sendmsg+0x0/0x298) from [] (sys_sendmsg+0x44/0x6c)
    [ 666.253897] [] (sys_sendmsg+0x0/0x6c) from [] (ret_fast_syscall+0x0/0x2c)
    [ 666.262460] r6:00000000 r5:beeff96c r4:00000005

    Signed-off-by: Jonas Gorski
    Signed-off-by: John W. Linville

    Jonas Gorski
     
  • John W. Linville
     
  • Spanning Tree Protocol packets should have always been marked as
    control packets, this causes them to get queued in the high prirority
    FIFO. As Radia Perlman mentioned in her LCA talk, STP dies if bridge
    gets overloaded and can't communicate. This is a long-standing bug back
    to the first versions of Linux bridge.

    Signed-off-by: Stephen Hemminger
    Signed-off-by: David S. Miller

    Stephen Hemminger
     

11 Feb, 2013

1 commit

  • When a HP ProLiant DL980 G7 Server boots a regular kernel,
    there will be intermittent lost interrupts which could
    result in a hang or (in extreme cases) data loss.

    The reason is that this system only supports x2apic physical
    mode, while the kernel boots with a logical-cluster default
    setting.

    This bug can be worked around by specifying the "x2apic_phys" or
    "nox2apic" boot option, but we want to handle this system
    without requiring manual workarounds.

    The BIOS sets ACPI_FADT_APIC_PHYSICAL in FADT table.
    As all apicids are smaller than 255, BIOS need to pass the
    control to the OS with xapic mode, according to x2apic-spec,
    chapter 2.9.

    Current code handle x2apic when BIOS pass with xapic mode
    enabled:

    When user specifies x2apic_phys, or FADT indicates PHYSICAL:

    1. During madt oem check, apic driver is set with xapic logical
    or xapic phys driver at first.

    2. enable_IR_x2apic() will enable x2apic_mode.

    3. if user specifies x2apic_phys on the boot line, x2apic_phys_probe()
    will install the correct x2apic phys driver and use x2apic phys mode.
    Otherwise it will skip the driver will let x2apic_cluster_probe to
    take over to install x2apic cluster driver (wrong one) even though FADT
    indicates PHYSICAL, because x2apic_phys_probe does not check
    FADT PHYSICAL.

    Add checking x2apic_fadt_phys in x2apic_phys_probe() to fix the
    problem.

    Signed-off-by: Stoney Wang
    [ updated the changelog and simplified the code ]
    Signed-off-by: Yinghai Lu
    Cc: stable@kernel.org
    Link: http://lkml.kernel.org/r/1360263182-16226-1-git-send-email-yinghai@kernel.org
    Signed-off-by: Ingo Molnar

    Stoney Wang