22 Jun, 2015

1 commit


19 Jun, 2015

1 commit

  • This tells userspace that it's safe to use the RADEON_VA_UNMAP operation
    of the DRM_RADEON_GEM_VA ioctl.

    Cc: stable@vger.kernel.org
    (NOTE: Backporting this commit requires at least backports of commits
    26d4d129b6042197b4cbc8341c0618f99231af2f,
    48afbd70ac7b6aa62e8d452091023941d8085f8a and
    c29c0876ec05d51a93508a39b90b92c29ba6423d as well, otherwise using
    RADEON_VA_UNMAP runs into trouble)

    Signed-off-by: Michel Dänzer
    Signed-off-by: Christian König

    Michel Dänzer
     

15 Jun, 2015

1 commit

  • Pull sound fixes from Takashi Iwai:
    "Most of commits are regression fixes for HD-audio: a few corner case
    fixes for regmap transition, and i915 binding issues.

    In addition, a quirk for another USB-audio device supporting DSD"

    * tag 'sound-4.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
    ALSA: hda - Abort the probe without i915 binding for HSW/BDW
    ALSA: hda - Re-add the lost fake mute support
    ALSA: hda - Continue probing even if i915 binding fails
    ALSA: hda - Don't actually write registers for caps overwrites
    ALSA: hda - fix number of devices query on hotplug
    ALSA: usb-audio: add native DSD support for JLsounds I2SoverUSB

    Linus Torvalds
     

13 Jun, 2015

1 commit

  • Pull VT-d hardware workarounds from David Woodhouse:
    "This contains a workaround for hardware issues which I *thought* were
    never going to be seen on production hardware. I'm glad I checked
    that before the 4.1 release...

    Firstly, PASID support is so broken on existing chips that we're just
    going to declare the old capability bit 28 as 'reserved' and change
    the VT-d spec to move PASID support to another bit. So any existing
    hardware doesn't support SVM; it only sets that (now) meaningless bit
    28.

    That patch *wasn't* imperative for 4.1 because we don't have PASID
    support yet. But *even* the extended context tables are broken — if
    you just enable the wider tables and use none of the new bits in them,
    which is precisely what 4.1 does, you find that translations don't
    work. It's this problem which I thought was caught in time to be
    fixed before production, but wasn't.

    To avoid triggering this issue, we now *only* enable the extended
    context tables on hardware which also advertises "we have PASID
    support and we actually tested it this time" with the new PASID
    feature bit.

    In addition, I've added an 'intel_iommu=ecs_off' command line
    parameter to allow us to disable it manually if we need to"

    * git://git.infradead.org/intel-iommu:
    iommu/vt-d: Only enable extended context tables if PASID is supported
    iommu/vt-d: Change PASID support to bit 40 of Extended Capability Register

    Linus Torvalds
     

11 Jun, 2015

1 commit

  • Yet another regression by the transition to regmap cache; for better
    usability, we had the fake mute control using the zero amp value for
    Conexant codecs, and this was forgotten in the new hda core code.

    Since the bits 4-7 are unused for the amp registers (as we follow the
    syntax of AMP_GET verb), the bit 4 is now used to indicate the fake
    mute. For setting this flag, snd_hda_codec_amp_update() becomes a
    function from a simple macro. The bonus is that it gained a proper
    function description.

    Signed-off-by: Takashi Iwai

    Takashi Iwai
     

09 Jun, 2015

1 commit


07 Jun, 2015

1 commit


06 Jun, 2015

1 commit

  • Pull perf fixes from Ingo Molnar:
    "The biggest chunk of the changes are two regression fixes: a HT
    workaround fix and an event-group scheduling fix. It's been verified
    with 5 days of fuzzer testing.

    Other fixes:

    - eBPF fix
    - a BIOS breakage detection fix
    - PMU driver fixes"

    * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    perf/x86/intel/pt: Fix a refactoring bug
    perf/x86: Tweak broken BIOS rules during check_hw_exists()
    perf/x86/intel/pt: Untangle pt_buffer_reset_markers()
    perf: Disallow sparse AUX allocations for non-SG PMUs in overwrite mode
    perf/x86: Improve HT workaround GP counter constraint
    perf/x86: Fix event/group validation
    perf: Fix race in BPF program unregister

    Linus Torvalds
     

04 Jun, 2015

1 commit

  • Pull block layer fixes from Jens Axboe:
    "Sending this off now, as I'm not aware of other current bugs, nor do I
    expect further fixes before 4.1 final. This contains two fixes:

    - a fix for a bdi unregister warning that gets spewed on md, due to a
    regression introduced earlier in this cycle. From Neil Brown.

    - a fix for a compile warning for NVMe on 32-bit platforms, also a
    regression introduced in this cycle. From Arnd Bergmann"

    * 'for-linus' of git://git.kernel.dk/linux-block:
    NVMe: fix type warning on 32-bit
    block: discard bdi_unregister() in favour of bdi_destroy()

    Linus Torvalds
     

02 Jun, 2015

1 commit

  • Pull networking fixes from David Miller:

    1) Various VTI tunnel (mark handling, PMTU) bug fixes from Alexander
    Duyck and Steffen Klassert.

    2) Revert ethtool PHY query change, it wasn't correct. The PHY address
    selected by the driver running the PHY to MAC connection decides
    what PHY address GET ethtool operations return information from.

    3) Fix handling of sequence number bits for encryption IV generation in
    ESP driver, from Herbert Xu.

    4) UDP can return -EAGAIN when we hit a bad checksum on receive, even
    when there are other packets in the receive queue which is wrong.
    Just respect the error returned from the generic socket recv
    datagram helper. From Eric Dumazet.

    5) Fix BNA driver firmware loading on big-endian systems, from Ivan
    Vecera.

    6) Fix regression in that we were inheriting the congestion control of
    the listening socket for new connections, the intended behavior
    always was to use the default in this case. From Neal Cardwell.

    7) Fix NULL deref in brcmfmac driver, from Arend van Spriel.

    8) OTP parsing fix in iwlwifi from Liad Kaufman.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits)
    vti6: Add pmtu handling to vti6_xmit.
    Revert "net: core: 'ethtool' issue with querying phy settings"
    bnx2x: Move statistics implementation into semaphores
    xen: netback: read hotplug script once at start of day.
    xen: netback: fix printf format string warning
    Revert "netfilter: ensure number of counters is >0 in do_replace()"
    net: dsa: Properly propagate errors from dsa_switch_setup_one
    tcp: fix child sockets to use system default congestion control if not set
    udp: fix behavior of wrong checksums
    sfc: free multiple Rx buffers when required
    bna: fix soft lock-up during firmware initialization failure
    bna: remove unreasonable iocpf timer start
    bna: fix firmware loading on big-endian machines
    bridge: fix br_multicast_query_expired() bug
    via-rhine: Resigning as maintainer
    brcmfmac: avoid null pointer access when brcmf_msgbuf_get_pktid() fails
    mac80211: Fix mac80211.h docbook comments
    iwlwifi: nvm: fix otp parsing in 8000 hw family
    iwlwifi: pcie: fix tracking of cmd_in_flight
    ip_vti/ip6_vti: Preserve skb->mark after rcv_cb call
    ...

    Linus Torvalds
     

01 Jun, 2015

3 commits

  • Fixes userspace compilation error:

    error: unknown type name ‘__virtio16’
    __virtio16 tag;

    Signed-off-by: Mikko Rapeli

    Signed-off-by: Michael S. Tsirkin

    Mikko Rapeli
     
  • Linux 3.17 and earlier are explicitly engineered so that if the app
    doesn't specifically request a CC module on a listener before the SYN
    arrives, then the child gets the system default CC when the connection
    is established. See tcp_init_congestion_control() in 3.17 or earlier,
    which says "if no choice made yet assign the current value set as
    default". The change ("net: tcp: assign tcp cong_ops when tcp sk is
    created") altered these semantics, so that children got their parent
    listener's congestion control even if the system default had changed
    after the listener was created.

    This commit returns to those original semantics from 3.17 and earlier,
    since they are the original semantics from 2007 in 4d4d3d1e8 ("[TCP]:
    Congestion control initialization."), and some Linux congestion
    control workflows depend on that.

    In summary, if a listener socket specifically sets TCP_CONGESTION to
    "x", or the route locks the CC module to "x", then the child gets
    "x". Otherwise the child gets current system default from
    net.ipv4.tcp_congestion_control. That's the behavior in 3.17 and
    earlier, and this commit restores that.

    Fixes: 55d8694fa82c ("net: tcp: assign tcp cong_ops when tcp sk is created")
    Cc: Florian Westphal
    Cc: Daniel Borkmann
    Cc: Glenn Judd
    Cc: Stephen Hemminger
    Signed-off-by: Neal Cardwell
    Signed-off-by: Eric Dumazet
    Signed-off-by: Yuchung Cheng
    Acked-by: Daniel Borkmann
    Signed-off-by: David S. Miller

    Neal Cardwell
     
  • Pull SCSI target fixes from Nicholas Bellinger:
    "These are mostly minor fixes, with the exception of the following that
    address fall-out from recent v4.1-rc1 changes:

    - regression fix related to the big fabric API registration changes
    and configfs_depend_item() usage, that required cherry-picking one
    of HCH's patches from for-next to address the issue for v4.1 code.

    - remaining TCM-USER -v2 related changes to enforce full CDB
    passthrough from Andy + Ilias.

    Also included is a target_core_pscsi driver fix from Andy that
    addresses a long standing issue with a Scsi_Host reference being
    leaked on PSCSI device shutdown"

    * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
    iser-target: Fix error path in isert_create_pi_ctx()
    target: Use a PASSTHROUGH flag instead of transport_types
    target: Move passthrough CDB parsing into a common function
    target/user: Only support full command pass-through
    target/user: Update example code for new ABI requirements
    target/pscsi: Don't leak scsi_host if hba is VIRTUAL_HOST
    target: Fix se_tpg_tfo->tf_subsys regression + remove tf_subsystem
    target: Drop signal_pending checks after interruptible lock acquire
    target: Add missing parentheses
    target: Fix bidi command handling
    target/user: Disallow full passthrough (pass_level=0)
    ISCSI: fix minor memory leak

    Linus Torvalds
     

31 May, 2015

4 commits

  • …kernel/git/jberg/mac80211

    Johannes Berg says:

    ====================
    This just has a single docbook build fix. In my confusion
    I'd already sent the same fix for -next, but Ben Hutchings
    noted it's necessary in 4.1.
    ====================

    Signed-off-by: David S. Miller <davem@davemloft.net>

    David S. Miller
     
  • It seems like we only care if a transport is passthrough or not. Convert
    transport_type to a flags field and replace TRANSPORT_PLUGIN_* with a
    flag, TRANSPORT_FLAG_PASSTHROUGH.

    Signed-off-by: Andy Grover
    Reviewed-by: Ilias Tsitsimpis
    Signed-off-by: Nicholas Bellinger

    Andy Grover
     
  • Aside from whether they handle BIDI ops or not, parsing of the CDB by
    kernel and user SCSI passthrough modules should be identical. Move this
    into a new passthrough_parse_cdb() and call it from tcm-pscsi and tcm-user.

    Reported-by: Christoph Hellwig
    Reviewed-by: Ilias Tsitsimpis
    Signed-off-by: Andy Grover
    Signed-off-by: Nicholas Bellinger

    Andy Grover
     
  • There is just one configfs subsystem in the target code, so we might as
    well add two helpers to reference / unreference it from the core code
    instead of passing pointers to it around.

    This fixes a regression introduced for v4.1-rc1 with commit 9ac8928e6,
    where configfs_depend_item() callers using se_tpg_tfo->tf_subsys would
    fail, because the assignment from the original target_core_subsystem[]
    is no longer happening at target_register_template() time.

    (Fix target_core_exit_configfs pointer dereference - Sagi)

    Signed-off-by: Christoph Hellwig
    Reported-by: Himanshu Madhani
    Signed-off-by: Nicholas Bellinger

    Christoph Hellwig
     

30 May, 2015

3 commits

  • Pull xfs fixes from Dave Chinner:
    "This is a little larger than I'd like late in the release cycle, but
    all the fixes are for regressions introduced in the 4.1-rc1 merge, or
    are needed back in -stable kernels fairly quickly as they are
    filesystem corruption or userspace visible correctness issues.

    Changes in this update:

    - regression fix for new rename whiteout code

    - regression fixes for new superblock generic per-cpu counter code

    - fix for incorrect error return sign introduced in 3.17

    - metadata corruption fixes that need to go back to -stable kernels"

    * tag 'xfs-for-linus-4.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs:
    xfs: fix broken i_nlink accounting for whiteout tmpfile inode
    xfs: xfs_iozero can return positive errno
    xfs: xfs_attr_inactive leaves inconsistent attr fork state behind
    xfs: extent size hints can round up extents past MAXEXTLEN
    xfs: inode and free block counters need to use __percpu_counter_compare
    percpu_counter: batch size aware __percpu_counter_compare()
    xfs: use percpu_counter_read_positive for mp->m_icount

    Linus Torvalds
     
  • Merge misc fixes from Andrew Morton:
    "10 fixes"

    * emailed patches from Andrew Morton :
    scripts/gdb: fix lx-lsmod refcnt
    omfs: fix potential integer overflow in allocator
    omfs: fix sign confusion for bitmap loop counter
    omfs: set error return when d_make_root() fails
    fs, omfs: add NULL terminator in the end up the token list
    MAINTAINERS: update CAPABILITIES pattern
    fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings
    tracing/mm: don't trace mm_page_pcpu_drain on offline cpus
    tracing/mm: don't trace mm_page_free on offline cpus
    tracing/mm: don't trace kmem_cache_free on offline cpus

    Linus Torvalds
     
  • Pull fixes for cpumask and modules from Rusty Russell:
    "** NOW WITH TESTING! **

    Two fixes which got lost in my recent distraction. One is a weird
    cpumask function which needed to be rewritten, the other is a module
    bug which is cc:stable"

    * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
    cpumask_set_cpu_local_first => cpumask_local_spread, lament
    module: Call module notifier on failure after complete_formation()

    Linus Torvalds
     

29 May, 2015

5 commits

  • Since tracepoints use RCU for protection, they must not be called on
    offline cpus. trace_mm_page_pcpu_drain can be called on an offline cpu
    in this scenario caught by LOCKDEP:

    ===============================
    [ INFO: suspicious RCU usage. ]
    4.1.0-rc1+ #9 Not tainted
    -------------------------------
    include/trace/events/kmem.h:265 suspicious rcu_dereference_check() usage!

    other info that might help us debug this:

    RCU used illegally from offline CPU!
    rcu_scheduler_active = 1, debug_locks = 1
    1 lock held by swapper/5/0:
    #0: (&(&zone->lock)->rlock){..-...}, at: [] .free_pcppages_bulk+0x70/0x920

    stack backtrace:
    CPU: 5 PID: 0 Comm: swapper/5 Not tainted 4.1.0-rc1+ #9
    Call Trace:
    .dump_stack+0x98/0xd4 (unreliable)
    .lockdep_rcu_suspicious+0x108/0x170
    .free_pcppages_bulk+0x60c/0x920
    .free_hot_cold_page+0x208/0x280
    .destroy_context+0x90/0xd0
    .__mmdrop+0x58/0x160
    .idle_task_exit+0xf0/0x100
    .pnv_smp_cpu_kill_self+0x58/0x2c0
    .cpu_die+0x34/0x50
    .arch_cpu_idle_dead+0x20/0x40
    .cpu_startup_entry+0x708/0x7a0
    .start_secondary+0x36c/0x3a0
    start_secondary_prolog+0x10/0x14

    Fix this by converting mm_page_pcpu_drain trace point into
    TRACE_EVENT_CONDITION where condition is cpu_online(smp_processor_id())

    Signed-off-by: Shreyas B. Prabhu
    Reviewed-by: Preeti U Murthy
    Acked-by: Steven Rostedt
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Shreyas B. Prabhu
     
  • Since tracepoints use RCU for protection, they must not be called on
    offline cpus. trace_mm_page_free can be called on an offline cpu in this
    scenario caught by LOCKDEP:

    ===============================
    [ INFO: suspicious RCU usage. ]
    4.1.0-rc1+ #9 Not tainted
    -------------------------------
    include/trace/events/kmem.h:170 suspicious rcu_dereference_check() usage!

    other info that might help us debug this:

    RCU used illegally from offline CPU!
    rcu_scheduler_active = 1, debug_locks = 1
    no locks held by swapper/1/0.

    stack backtrace:
    CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.1.0-rc1+ #9
    Call Trace:
    .dump_stack+0x98/0xd4 (unreliable)
    .lockdep_rcu_suspicious+0x108/0x170
    .free_pages_prepare+0x494/0x680
    .free_hot_cold_page+0x50/0x280
    .destroy_context+0x90/0xd0
    .__mmdrop+0x58/0x160
    .idle_task_exit+0xf0/0x100
    .pnv_smp_cpu_kill_self+0x58/0x2c0
    .cpu_die+0x34/0x50
    .arch_cpu_idle_dead+0x20/0x40
    .cpu_startup_entry+0x708/0x7a0
    .start_secondary+0x36c/0x3a0
    start_secondary_prolog+0x10/0x14

    Fix this by converting mm_page_free trace point into TRACE_EVENT_CONDITION
    where condition is cpu_online(smp_processor_id())

    Signed-off-by: Shreyas B. Prabhu
    Reviewed-by: Preeti U Murthy
    Acked-by: Steven Rostedt
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Shreyas B. Prabhu
     
  • Since tracepoints use RCU for protection, they must not be called on
    offline cpus. trace_kmem_cache_free can be called on an offline cpu in
    this scenario caught by LOCKDEP:

    ===============================
    [ INFO: suspicious RCU usage. ]
    4.1.0-rc1+ #9 Not tainted
    -------------------------------
    include/trace/events/kmem.h:148 suspicious rcu_dereference_check() usage!

    other info that might help us debug this:

    RCU used illegally from offline CPU!
    rcu_scheduler_active = 1, debug_locks = 1
    no locks held by swapper/1/0.

    stack backtrace:
    CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.1.0-rc1+ #9
    Call Trace:
    .dump_stack+0x98/0xd4 (unreliable)
    .lockdep_rcu_suspicious+0x108/0x170
    .kmem_cache_free+0x344/0x4b0
    .__mmdrop+0x4c/0x160
    .idle_task_exit+0xf0/0x100
    .pnv_smp_cpu_kill_self+0x58/0x2c0
    .cpu_die+0x34/0x50
    .arch_cpu_idle_dead+0x20/0x40
    .cpu_startup_entry+0x708/0x7a0
    .start_secondary+0x36c/0x3a0
    start_secondary_prolog+0x10/0x14

    Fix this by converting kmem_cache_free trace point into
    TRACE_EVENT_CONDITION where condition is cpu_online(smp_processor_id())

    Signed-off-by: Shreyas B. Prabhu
    Reported-by: Aneesh Kumar K.V
    Reviewed-by: Preeti U Murthy
    Acked-by: Steven Rostedt
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Shreyas B. Prabhu
     
  • XFS uses non-stanard batch sizes for avoiding frequent global
    counter updates on it's allocated inode counters, as they increment
    or decrement in batches of 64 inodes. Hence the standard percpu
    counter batch of 32 means that the counter is effectively a global
    counter. Currently Xfs uses a batch size of 128 so that it doesn't
    take the global lock on every single modification.

    However, Xfs also needs to compare accurately against zero, which
    means we need to use percpu_counter_compare(), and that has a
    hard-coded batch size of 32, and hence will spuriously fail to
    detect when it is supposed to use precise comparisons and hence
    the accounting goes wrong.

    Add __percpu_counter_compare() to take a custom batch size so we can
    use it sanely in XFS and factor percpu_counter_compare() to use it.

    Signed-off-by: Dave Chinner
    Acked-by: Tejun Heo
    Signed-off-by: Dave Chinner

    Dave Chinner
     
  • bdi_unregister() now contains very little functionality.

    It contains a "WARN_ON" if bdi->dev is NULL. This warning is of no
    real consequence as bdi->dev isn't needed by anything else in the function,
    and it triggers if
    blk_cleanup_queue() -> bdi_destroy()
    is called before bdi_unregister, which happens since
    Commit: 6cd18e711dd8 ("block: destroy bdi before blockdev is unregistered.")

    So this isn't wanted.

    It also calls bdi_set_min_ratio(). This needs to be called after
    writes through the bdi have all been flushed, and before the bdi is destroyed.
    Calling it early is better than calling it late as it frees up a global
    resource.

    Calling it immediately after bdi_wb_shutdown() in bdi_destroy()
    perfectly fits these requirements.

    So bdi_unregister() can be discarded with the important content moved to
    bdi_destroy(), as can the
    writeback_bdi_unregister
    event which is already not used.

    Reported-by: Mike Snitzer
    Cc: stable@vger.kernel.org (v4.0)
    Fixes: c4db59d31e39 ("fs: don't reassign dirty inodes to default_backing_dev_info")
    Fixes: 6cd18e711dd8 ("block: destroy bdi before blockdev is unregistered.")
    Acked-by: Peter Zijlstra (Intel)
    Acked-by: Dan Williams
    Tested-by: Nicholas Moulin
    Signed-off-by: NeilBrown
    Reviewed-by: Christoph Hellwig
    Signed-off-by: Jens Axboe

    NeilBrown
     

28 May, 2015

4 commits

  • A couple of enums in mac80211.h became structures recently, but the
    comments didn't follow suit, leading to errors like:

    Error(.//include/net/mac80211.h:367): Cannot parse enum!
    Documentation/DocBook/Makefile:93: recipe for target 'Documentation/DocBook/80211.xml' failed
    make[1]: *** [Documentation/DocBook/80211.xml] Error 1
    Makefile:1361: recipe for target 'mandocs' failed
    make: *** [mandocs] Error 2

    Fix the comments comments accordingly. Added a couple of other small
    comment fixes while I was there to silence other recently-added docbook
    warnings.

    Reported-by: Jim Davis
    Signed-off-by: Jonathan Corbet
    Signed-off-by: Johannes Berg

    Jonathan Corbet
     
  • da91309e0a7e (cpumask: Utility function to set n'th cpu...) created a
    genuinely weird function. I never saw it before, it went through DaveM.
    (He only does this to make us other maintainers feel better about our own
    mistakes.)

    cpumask_set_cpu_local_first's purpose is say "I need to spread things
    across N online cpus, choose the ones on this numa node first"; you call
    it in a loop.

    It can fail. One of the two callers ignores this, the other aborts and
    fails the device open.

    It can fail in two ways: allocating the off-stack cpumask, or through a
    convoluted codepath which AFAICT can only occur if cpu_online_mask
    changes. Which shouldn't happen, because if cpu_online_mask can change
    while you call this, it could return a now-offline cpu anyway.

    It contains a nonsensical test "!cpumask_of_node(numa_node)". This was
    drawn to my attention by Geert, who said this causes a warning on Sparc.
    It sets a single bit in a cpumask instead of returning a cpu number,
    because that's what the callers want.

    It could be made more efficient by passing the previous cpu rather than
    an index, but that would be more invasive to the callers.

    Fixes: da91309e0a7e8966d916a74cce42ed170fde06bf
    Signed-off-by: Rusty Russell (then rebased)
    Tested-by: Amir Vadai
    Acked-by: Amir Vadai
    Acked-by: David S. Miller

    Rusty Russell
     
  • Pull networking fixes from David Miller:

    1) Don't use MMIO on certain iwlwifi devices otherwise we get a
    firmware crash.

    2) Don't corrupt the GRO lists of mac80211 contexts by doing sends via
    timer interrupt, from Johannes Berg.

    3) SKB tailroom is miscalculated in AP_VLAN crypto code, from Michal
    Kazior.

    4) Fix fw_status memory leak in iwlwifi, from Haim Dreyfuss.

    5) Fix use after free in iwl_mvm_d0i3_enable_tx(), from Eliad Peller.

    6) JIT'ing of large BPF programs is broken on x86, from Alexei
    Starovoitov.

    7) EMAC driver ethtool register dump size is miscalculated, from Ivan
    Mikhaylov.

    8) Fix PHY initial link mode when autonegotiation is disabled in
    amd-xgbe, from Tom Lendacky.

    9) Fix NULL deref on SOCK_DEAD socket in AF_UNIX and CAIF protocols,
    from Mark Salyzyn.

    10) credit_bytes not initialized properly in xen-netback, from Ross
    Lagerwall.

    11) Fallback from MSI-X to INTx interrupts not handled properly in mlx4
    driver, fix from Benjamin Poirier.

    12) Perform ->attach() after binding dev->qdisc in packet scheduler,
    otherwise we can crash. From Cong WANG.

    13) Don't clobber data in sctp_v4_map_v6(). From Jason Gunthorpe.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (30 commits)
    sctp: Fix mangled IPv4 addresses on a IPv6 listening socket
    net_sched: invoke ->attach() after setting dev->qdisc
    xen-netfront: properly destroy queues when removing device
    mlx4_core: Fix fallback from MSI-X to INTx
    xen/netback: Properly initialize credit_bytes
    net: netxen: correct sysfs bin attribute return code
    tools: bpf_jit_disasm: fix segfault on disabled debugging log output
    unix/caif: sk_socket can disappear when state is unlocked
    amd-xgbe-phy: Fix initial mode when autoneg is disabled
    net: dp83640: fix improper double spin locking.
    net: dp83640: reinforce locking rules.
    net: dp83640: fix broken calibration routine.
    net: stmmac: create one debugfs dir per net-device
    net/ibm/emac: fix size of emac dump memory areas
    x86: bpf_jit: fix compilation of large bpf programs
    net: phy: bcm7xxx: Fix 7425 PHY ID and flags
    iwlwifi: mvm: avoid use-after-free on iwl_mvm_d0i3_enable_tx()
    iwlwifi: mvm: clean net-detect info if device was reset during suspend
    iwlwifi: mvm: take the UCODE_DOWN reference when resuming
    iwlwifi: mvm: BT Coex - duplicate the command if sent ASYNC
    ...

    Linus Torvalds
     
  • sctp_v4_map_v6 was subtly writing and reading from members
    of a union in a way the clobbered data it needed to read before
    it read it.

    Zeroing the v6 flowinfo overwrites the v4 sin_addr with 0, meaning
    that every place that calls sctp_v4_map_v6 gets ::ffff:0.0.0.0 as the
    result.

    Reorder things to guarantee correct behaviour no matter what the
    union layout is.

    This impacts user space clients that open an IPv6 SCTP socket and
    receive IPv4 connections. Prior to 299ee user space would see a
    sockaddr with AF_INET and a correct address, after 299ee the sockaddr
    is AF_INET6, but the address is wrong.

    Fixes: 299ee123e198 (sctp: Fixup v4mapped behaviour to comply with Sock API)
    Signed-off-by: Jason Gunthorpe
    Acked-by: Daniel Borkmann
    Acked-by: Neil Horman
    Signed-off-by: David S. Miller

    Jason Gunthorpe
     

27 May, 2015

2 commits

  • Commit 43b4578071c0 ("perf/x86: Reduce stack usage of
    x86_schedule_events()") violated the rule that 'fake' scheduling; as
    used for event/group validation; should not change the event state.

    This went mostly un-noticed because repeated calls of
    x86_pmu::get_event_constraints() would give the same result. And
    x86_pmu::put_event_constraints() would mostly not do anything.

    Commit e979121b1b15 ("perf/x86/intel: Implement cross-HT corruption
    bug workaround") made the situation much worse by actually setting the
    event->hw.constraint value to NULL, so when validation and actual
    scheduling interact we get NULL ptr derefs.

    Fix it by removing the constraint pointer from the event and move it
    back to an array, this time in cpuc instead of on the stack.

    validate_group()
    x86_schedule_events()
    event->hw.constraint = c; # store


    perf_task_event_sched_in()
    ...
    x86_schedule_events();
    event->hw.constraint = c2; # store

    ...

    put_event_constraints(event); # assume failure to schedule
    intel_put_event_constraints()
    event->hw.constraint = NULL;

    c = event->hw.constraint; # read -> NULL

    if (!test_bit(hwc->idx, c->idxmsk)) #
    Signed-off-by: Peter Zijlstra (Intel)
    Cc: Andrew Hunter
    Cc: Linus Torvalds
    Cc: Maria Dimakopoulou
    Cc: Peter Zijlstra
    Cc: Thomas Gleixner
    Fixes: 43b4578071c0 ("perf/x86: Reduce stack usage of x86_schedule_events()")
    Fixes: e979121b1b15 ("perf/x86/intel: Implement cross-HT corruption bug workaround")
    Signed-off-by: Ingo Molnar

    Peter Zijlstra
     
  • Commit 5590f3196b29 ("drivers/core/of: Add symlink to device-tree from
    devices with an OF node") adds the symlink `of_node` for each device
    pointing to it's device tree node while creating/initialising it.

    However the devicetree sysfs is created and setup in of_init which is
    executed at core_initcall level. For all the devices created before
    of_init, the following error is thrown:
    "Error -2(-ENOENT) creating of_node link"

    Like many other components in driver model, initialize the sysfs support
    for OF/devicetree from driver_init so that it's ready before any devices
    are created.

    Fixes: 5590f3196b29 ("drivers/core/of: Add symlink to device-tree from
    devices with an OF node")
    Suggested-by: Rob Herring
    Cc: Grant Likely
    Cc: Pawel Moll
    Cc: Benjamin Herrenschmidt
    Signed-off-by: Sudeep Holla
    Tested-by: Robert Schwebel
    Acked-by: Rob Herring
    Signed-off-by: Greg Kroah-Hartman

    Sudeep Holla
     

25 May, 2015

1 commit

  • While adding support for 7425 PHY in the 7xxx PHY driver, the ID that
    was used was actually coming from an external PHY: a BCM5461x. Fix this
    by using the proper ID for the internal 7425 PHY and set the
    PHY_IS_INTERNAL flag, otherwise consumers of this PHY driver would not
    be able to properly identify it as such.

    Fixes: d068b02cfdfc2 ("net: phy: add BCM7425 and BCM7429 PHYs")
    Signed-off-by: Florian Fainelli
    Reviewed-by: Petri Gynther
    Signed-off-by: David S. Miller

    Florian Fainelli
     

24 May, 2015

1 commit


23 May, 2015

4 commits

  • Pull networking fixes from David Miller:

    1) Don't leak ipvs->sysctl_tbl, from Tommi Rentala.

    2) Fix neighbour table entry leak in rocker driver, from Ying Xue.

    3) Do not emit bonding notifications for unregistered interfaces, from
    Nicolas Dichtel.

    4) Set ipv6 flow label properly when in TIME_WAIT state, from Florent
    Fourcot.

    5) Fix regression in ipv6 multicast filter test, from Henning Rogge.

    6) do_replace() in various footables netfilter modules is missing a
    check for 0 counters in the datastructure provided by the user. Fix
    from Dave Jones, and found with trinity.

    7) Fix RCU bug in packet scheduler classifier module unloads, from
    Daniel Borkmann.

    8) Avoid deadlock in tcp_get_info() by using u64_sync. From Eric
    Dumzaet.

    9) Input packet processing can race with inetdev_destroy() teardown,
    fix potential OOPS in ip_error() by explicitly testing whether the
    inetdev is still attached. From Eric W Biederman.

    10) MLDv2 parser in bridge multicast code breaks too early while
    parsing. Fix from Thadeu Lima de Souza Cascardo.

    11) Asking for settings on non-zero PHYID doesn't work because we do not
    import the command structure from the user and use the PHYID
    provided there. Fix from Arun Parameswaran.

    12) Fix UDP checksums with IPV6 RAW sockets, from Vlad Yasevich.

    13) Missing NF_TABLES depends for TPROXY etc can cause build failures,
    fix from Florian Westphal.

    14) Fix netfilter conntrack to handle RFC5961 challenge ACKs properly,
    from Jesper Dangaard Brouer.

    15) If netlink autobind retry fails, we have to reset the sockets portid
    back to zero. From Herbert Xu.

    16) VXLAN netns exit code unregisters using wrong device, from John W
    Linville.

    17) Add some USB device IDs to ath3k and btusb bluetooth drivers, from
    Dmitry Tunin and Wen-chien Jesse Sung.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits)
    bridge: fix lockdep splat
    net: core: 'ethtool' issue with querying phy settings
    bridge: fix parsing of MLDv2 reports
    ARM: zynq: DT: Use the zynq binding with macb
    net: macb: Disable half duplex gigabit on Zynq
    net: macb: Document zynq gem dt binding
    ipv4: fill in table id when replacing a route
    cdc_ncm: Fix tx_bytes statistics
    ipv4: Avoid crashing in ip_error
    tcp: fix a potential deadlock in tcp_get_info()
    net: sched: fix call_rcu() race on classifier module unloads
    net: phy: Make sure phy_start() always re-enables the phy interrupts
    ipv6: fix ECMP route replacement
    ipv6: do not delete previously existing ECMP routes if add fails
    Revert "netfilter: bridge: query conntrack about skb dnat"
    netfilter: ensure number of counters is >0 in do_replace()
    netfilter: nfnetlink_{log,queue}: Register pernet in first place
    tcp: don't over-send F-RTO probes
    tcp: only undo on partial ACKs in CA_Loss
    net/ipv6/udp: Fix ipv6 multicast socket filter regression
    ...

    Linus Torvalds
     
  • Pull block fixes from Jens Axboe:
    "Three small fixes that have been picked up the last few weeks.
    Specifically:

    - Fix a memory corruption issue in NVMe with malignant user
    constructed request. From Christoph.

    - Kill (now) unused blk_queue_bio(), dm was changed to not need this
    anymore. From Mike Snitzer.

    - Always use blk_schedule_flush_plug() from the io_schedule() path
    when flushing a plug, fixing a !TASK_RUNNING warning with md. From
    Shaohua"

    * 'for-linus' of git://git.kernel.dk/linux-block:
    sched: always use blk_schedule_flush_plug in io_schedule_out
    nvme: fix kernel memory corruption with short INQUIRY buffers
    block: remove export for blk_queue_bio

    Linus Torvalds
     
  • Pablo Neira Ayuso says:

    ====================
    Netfilter fixes for net

    The following patchset contain Netfilter fixes for your net tree, they are:

    1) Fix a race in nfnetlink_log and nfnetlink_queue that can lead to a crash.
    This problem is due to wrong order in the per-net registration and netlink
    socket events. Patch from Francesco Ruggeri.

    2) Make sure that counters that userspace pass us are higher than 0 in all the
    x_tables frontends. Discovered via Trinity, patch from Dave Jones.

    3) Revert a patch for br_netfilter to rely on the conntrack status bits. This
    breaks stateless IPv6 NAT transformations. Patch from Florian Westphal.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • Taking socket spinlock in tcp_get_info() can deadlock, as
    inet_diag_dump_icsk() holds the &hashinfo->ehash_locks[i],
    while packet processing can use the reverse locking order.

    We could avoid this locking for TCP_LISTEN states, but lockdep would
    certainly get confused as all TCP sockets share same lockdep classes.

    [ 523.722504] ======================================================
    [ 523.728706] [ INFO: possible circular locking dependency detected ]
    [ 523.734990] 4.1.0-dbg-DEV #1676 Not tainted
    [ 523.739202] -------------------------------------------------------
    [ 523.745474] ss/18032 is trying to acquire lock:
    [ 523.750002] (slock-AF_INET){+.-...}, at: [] tcp_get_info+0x2c4/0x360
    [ 523.758129]
    [ 523.758129] but task is already holding lock:
    [ 523.763968] (&(&hashinfo->ehash_locks[i])->rlock){+.-...}, at: [] inet_diag_dump_icsk+0x1d5/0x6c0
    [ 523.774661]
    [ 523.774661] which lock already depends on the new lock.
    [ 523.774661]
    [ 523.782850]
    [ 523.782850] the existing dependency chain (in reverse order) is:
    [ 523.790326]
    -> #1 (&(&hashinfo->ehash_locks[i])->rlock){+.-...}:
    [ 523.796599] [] lock_acquire+0xbb/0x270
    [ 523.802565] [] _raw_spin_lock+0x38/0x50
    [ 523.808628] [] __inet_hash_nolisten+0x78/0x110
    [ 523.815273] [] tcp_v4_syn_recv_sock+0x24b/0x350
    [ 523.822067] [] tcp_check_req+0x3c1/0x500
    [ 523.828199] [] tcp_v4_do_rcv+0x239/0x3d0
    [ 523.834331] [] tcp_v4_rcv+0xa8e/0xc10
    [ 523.840202] [] ip_local_deliver_finish+0x133/0x3e0
    [ 523.847214] [] ip_local_deliver+0xaa/0xc0
    [ 523.853440] [] ip_rcv_finish+0x168/0x5c0
    [ 523.859624] [] ip_rcv+0x307/0x420

    Lets use u64_sync infrastructure instead. As a bonus, 64bit
    arches get optimized, as these are nop for them.

    Fixes: 0df48c26d841 ("tcp: add tcpi_bytes_acked to tcp_info")
    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

22 May, 2015

3 commits

  • Pull two xen bugfixes from David Vrabel:

    - fix ARM build regression.

    - fix VIRQ_CONSOLE related oops.

    * tag 'for-linus-4.1b-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
    xen/events: don't bind non-percpu VIRQs with percpu chip
    xen/arm: Define xen_arch_suspend()

    Linus Torvalds
     
  • Pull HID fixes from Jiri Kosina:
    "Bugfixes for HID subsystem that should go in 4.1. Important
    highlights:

    - the patch that extended support for HID++ protocol for TK820
    touchpad turns out to be causing regressions due to firmware
    issues; patch reverting back to basic support from Benjamin
    Tissoires

    - Wacom driver can oops for devices that report non-touch data on
    touch interfaces. Fix from Ping Cheng

    - gpiolib is not mandatory for i2c-hid, so the driver shouldn't fail
    if gpiolib is not enabled. Fix from Mika Westerberg"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
    HID: wacom: fix an Oops caused by wacom_wac_finger_count_touches
    HID: usbhid: Add HID_QUIRK_NOGET for Aten DVI KVM switch
    HID: hid-sensor-hub: Fix debug lock warning
    Revert "HID: logitech-hidpp: support combo keyboard touchpad TK820"
    HID: i2c-hid: Do not fail probing if gpiolib is not enabled

    Linus Torvalds
     
  • Pull clk fixes from Michael Turquette:
    "The first set of clk fixes for 4.1 are all driver bugs, with the
    exception of a single locking fix in the core code.

    All driver fixes are for code that was merged recently. The Samsung
    stuff is mostly fixes around suspend/resume, the Qualcomm fixes are
    for invalid hardware configuration data and the Silicon Labs patches
    are fixes following their move away from platform_data to Device Tree"

    * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
    clk: si5351: Do not pass struct clk in platform_data
    clk: si5351: Mention clock-names in the binding documentation
    clk: add missing lock when call clk_core_enable in clk_set_parent
    clk: exynos5420: Restore GATE_BUS_TOP on suspend
    clk: qcom: Fix MSM8916 gfx3d_clk_src configuration
    clk: qcom: Fix MSM8916 venus divider value
    clk: exynos5433: Fix wrong PMS value of exynos5433_pll_rates
    clk: exynos5433: Fix wrong parent clock of sclk_apollo clock
    clk: exynos5433: Fix CLK_PCLK_MONOTONIC_CNT clk register assignment
    clk: exynos5433: Fix wrong offset of PCLK_MSCL_SECURE_SMMU_JPEG
    clk: Use CONFIG_ARCH_EXYNOS instead of CONFIG_ARCH_EXYNOS5433

    Linus Torvalds