28 Jan, 2015
4 commits
-
Pull drm fixes from Dave Airlie:
"This feels larger than I'd like but its for three reasons.a) amdkfd finalising the API more, this is a new feature introduced
last merge window, and I'd prefer to make the tweaks to the API
before it first gets into a stable release.b) radeon regression required splitting an internal API to fix
properly, so it just changed a few more linesc) vmwgfx fix changes a lock from a mutex->spin lock, this is fallout
from the new sleep checking.Otherwise there is just some tda998x fixes"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/radeon: Remove rdev->gart.pages_addr array
drm/radeon: Restore GART table contents after pinning it in VRAM v3
drm/radeon: Split off gart_get_page_entry ASIC hook from set_page_entry
drm/amdkfd: Fix bug in call to init_pipelines()
drm/amdkfd: Fix bug in pipelines initialization
drm/radeon: Don't increment pipe_id in kgd_init_pipeline
drm/i2c: tda998x: set the CEC I2C address based on the slave I2C address
drm/vmwgfx: Replace the hw mutex with a hw spinlock
drm/amdkfd: Allow user to limit only queues per device
drm/amdkfd: PQM handle queue creation fault
drm: tda998x: Fix EDID read timeout on HDMI connect
drm: tda998x: Protect the page register -
Pull networking fixes from David Miller:
1) Don't OOPS on socket AIO, from Christoph Hellwig.
2) Scheduled scans should be aborted upon RFKILL, from Emmanuel
Grumbach.3) Fix sleep in atomic context in kvaser_usb, from Ahmed S Darwish.
4) Fix RCU locking across copy_to_user() in bpf code, from Alexei
Starovoitov.5) Lots of crash, memory leak, short TX packet et al bug fixes in
sh_eth from Ben Hutchings.6) Fix memory corruption in SCTP wrt. INIT collitions, from Daniel
Borkmann.7) Fix return value logic for poll handlers in netxen, enic, and bnx2x.
From Eric Dumazet and Govindarajulu Varadarajan.8) Header length calculation fix in mac80211 from Fred Chou.
9) mv643xx_eth doesn't handle highmem correctly in non-TSO code paths.
From Ezequiel Garcia.10) udp_diag has bogus logic in it's hash chain skipping, copy same fix
tcp diag used. From Herbert Xu.11) amd-xgbe programs wrong rx flow control register, from Thomas
Lendacky.12) Fix race leading to use after free in ping receive path, from Subash
Abhinov Kasiviswanathan.13) Cache redirect routes otherwise we can get a heavy backlog of rcu
jobs liberating DST_NOCACHE entries. From Hannes Frederic Sowa.* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (48 commits)
net: don't OOPS on socket aio
stmmac: prevent probe drivers to crash kernel
bnx2x: fix napi poll return value for repoll
ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too
sh_eth: Fix DMA-API usage for RX buffers
sh_eth: Check for DMA mapping errors on transmit
sh_eth: Ensure DMA engines are stopped before freeing buffers
sh_eth: Remove RX overflow log messages
ping: Fix race in free in receive path
udp_diag: Fix socket skipping within chain
can: kvaser_usb: Fix state handling upon BUS_ERROR events
can: kvaser_usb: Retry the first bulk transfer on -ETIMEDOUT
can: kvaser_usb: Send correct context to URB completion
can: kvaser_usb: Do not sleep in atomic context
ipv4: try to cache dst_entries which would cause a redirect
samples: bpf: relax test_maps check
bpf: rcu lock must not be held when calling copy_to_user()
net: sctp: fix slab corruption from use after free on INIT collisions
net: mv643xx_eth: Fix highmem support in non-TSO egress path
sh_eth: Fix serialisation of interrupt disable with interrupt & NAPI handlers
... -
In the case when alloc_netdev fails we return NULL to a caller. But there is no
check for NULL in the probe drivers. This patch changes NULL to an error
pointer. The function description is amended to reflect what we may get
returned.Signed-off-by: Andy Shevchenko
Signed-off-by: David S. Miller -
Pull one more module fix from Rusty Russell:
"SCSI was using module_refcount() to figure out when the module was
unloading: this broke with new atomic refcounting. The code is still
suspicious, but this solves the WARN_ON()"* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
scsi: always increment reference count
27 Jan, 2015
24 commits
-
With the commit d75b1ade567ffab ("net: less interrupt masking in NAPI") napi
repoll is done only when work_done == budget. When in busy_poll is we return 0
in napi_poll. We should return budget.Signed-off-by: Govindarajulu Varadarajan
Acked-by: Eric Dumazet
Signed-off-by: David S. Miller -
- Use the return value of dma_map_single(), rather than calling
virt_to_page() separately
- Check for mapping failue
- Call dma_unmap_single() rather than dma_sync_single_for_cpu()Signed-off-by: Ben Hutchings
Signed-off-by: David S. Miller -
dma_map_single() may fail if an IOMMU or swiotlb is in use, so
we need to check for this.Signed-off-by: Ben Hutchings
Signed-off-by: David S. Miller -
Currently we try to clear EDRRR and EDTRR and immediately continue to
free buffers. This is unsafe because:- In general, register writes are not serialised with DMA, so we still
have to wait for DMA to complete somehow
- The R8A7790 (R-Car H2) manual states that the TX running flag cannot
be cleared by writing to EDTRR
- The same manual states that clearing the RX running flag only stops
RX DMA at the next packet boundaryI applied this patch to the driver to detect DMA writes to freed
buffers:> --- a/drivers/net/ethernet/renesas/sh_eth.c
> +++ b/drivers/net/ethernet/renesas/sh_eth.c
> @@ -1098,7 +1098,14 @@ static void sh_eth_ring_free(struct net_device *ndev)
> /* Free Rx skb ringbuffer */
> if (mdp->rx_skbuff) {
> for (i = 0; i < mdp->num_rx_ring; i++)
> + memcpy(mdp->rx_skbuff[i]->data,
> + "Hello, world", 12);
> + msleep(100);
> + for (i = 0; i < mdp->num_rx_ring; i++) {
> + WARN_ON(memcmp(mdp->rx_skbuff[i]->data,
> + "Hello, world", 12));
> dev_kfree_skb(mdp->rx_skbuff[i]);
> + }
> }
> kfree(mdp->rx_skbuff);
> mdp->rx_skbuff = NULL;then ran the loop:
while ethtool -G eth0 rx 128 ; ethtool -G eth0 rx 64; do echo -n .; done
and 'ping -f' toward the sh_eth port from another machine. The
warning fired several times a minute.To fix these issues:
- Deactivate all TX descriptors rather than writing to EDTRR
- As there seems to be no way of telling when RX DMA is stopped,
perform a soft reset to ensure that both DMA enginess are stopped
- To reduce the possibility of the reset truncating a transmitted
frame, disable egress and wait a reasonable time to reach a
packet boundary before resetting
- Update statistics before resetting(The 'reasonable time' does not allow for CS/CD in half-duplex
mode, but half-duplex no longer seems reasonable!)Signed-off-by: Ben Hutchings
Signed-off-by: David S. Miller -
If RX traffic is overflowing the FIFO or DMA ring, logging every time
this happens just makes things worse. These errors are visible in the
statistics anyway.Signed-off-by: Ben Hutchings
Signed-off-by: David S. Miller -
While being in an ERROR_WARNING state, and receiving further
bus error events with error counters still in the ERROR_WARNING
range of 97-127 inclusive, the state handling code erroneously
reverts back to ERROR_ACTIVE.Per the CAN standard, only revert to ERROR_ACTIVE when the
error counters are less than 96.Moreover, in certain Kvaser models, the BUS_ERROR flag is
always set along with undefined bits in the M16C status
register. Thus use bitwise operators instead of full equality
for checking that register against bus errors.Signed-off-by: Ahmed S. Darwish
Cc: linux-stable
Signed-off-by: Marc Kleine-Budde -
On some x86 laptops, plugging a Kvaser device again after an
unplug makes the firmware always ignore the very first command.
For such a case, provide some room for retries instead of
completely exiting the driver init code.Signed-off-by: Ahmed S. Darwish
Cc: linux-stable
Signed-off-by: Marc Kleine-Budde -
Send expected argument to the URB completion hander: a CAN
netdevice instead of the network interface private context
`kvaser_usb_net_priv'.This was discovered by having some garbage in the kernel
log in place of the netdevice names: can0 and can1.Signed-off-by: Ahmed S. Darwish
Cc: linux-stable
Signed-off-by: Marc Kleine-Budde -
Upon receiving a hardware event with the BUS_RESET flag set,
the driver kills all of its anchored URBs and resets all of
its transmit URB contexts.Unfortunately it does so under the context of URB completion
handler `kvaser_usb_read_bulk_callback()', which is often
called in an atomic context.While the device is flooded with many received error packets,
usb_kill_urb() typically sleeps/reschedules till the transfer
request of each killed URB in question completes, leading to
the sleep in atomic bug. [3]In v2 submission of the original driver patch [1], it was
stated that the URBs kill and tx contexts reset was needed
since we don't receive any tx acknowledgments later and thus
such resources will be locked down forever. Fortunately this
is no longer needed since an earlier bugfix in this patch
series is now applied: all tx URB contexts are reset upon CAN
channel close. [2]Moreover, a BUS_RESET is now treated _exactly_ like a BUS_OFF
event, which is the recommended handling method advised by
the device manufacturer.[1] http://article.gmane.org/gmane.linux.network/239442
http://www.webcitation.org/6Vr2yagAQ[2] can: kvaser_usb: Reset all URB tx contexts upon channel close
889b77f7fd2bcc922493d73a4c51d8a851505815[3] Stacktrace:
[] dump_stack+0x45/0x57
[] __schedule_bug+0x41/0x4f
[] __schedule+0x5f1/0x700
[] ? _raw_spin_unlock_irqrestore+0xa/0x10
[] schedule+0x24/0x70
[] usb_kill_urb+0x65/0xa0
[] ? prepare_to_wait_event+0x110/0x110
[] usb_kill_anchored_urbs+0x48/0x80
[] kvaser_usb_unlink_tx_urbs+0x18/0x50 [kvaser_usb]
[] kvaser_usb_rx_error+0xc0/0x400 [kvaser_usb]
[] ? vprintk_default+0x1a/0x20
[] kvaser_usb_read_bulk_callback+0x4c1/0x5f0 [kvaser_usb]
[] __usb_hcd_giveback_urb+0x5e/0xc0
[] usb_hcd_giveback_urb+0x41/0x110
[] finish_urb+0x98/0x180 [ohci_hcd]
[] ? acct_account_cputime+0x17/0x20
[] ? local_clock+0x15/0x30
[] ohci_work+0x1fb/0x5a0 [ohci_hcd]
[] ? process_backlog+0xb1/0x130
[] ohci_irq+0xeb/0x270 [ohci_hcd]
[] usb_hcd_irq+0x21/0x30
[] handle_irq_event_percpu+0x43/0x120
[] handle_irq_event+0x3d/0x60
[] handle_fasteoi_irq+0x74/0x110
[] handle_irq+0x1d/0x30
[] do_IRQ+0x57/0x100
[] common_interrupt+0x6a/0x6aSigned-off-by: Ahmed S. Darwish
Cc: linux-stable
Signed-off-by: Marc Kleine-Budde -
Merge misc fixes from Andrew Morton:
"Six fixes"* emailed patches from Andrew Morton :
drivers/rtc/rtc-s5m.c: terminate s5m_rtc_id array with empty element
printk: add dummy routine for when CONFIG_PRINTK=n
mm/vmscan: fix highidx argument type
memcg: remove extra newlines from memcg oom kill log
x86, build: replace Perl script with Shell script
mm: page_alloc: embed OOM killing naturally into allocation slowpath -
Commit 69ad0dd7af22b61d9e0e68e56b6290121618b0fb
Author: Ezequiel Garcia
Date: Mon May 19 13:59:59 2014 -0300net: mv643xx_eth: Use dma_map_single() to map the skb fragments
caused a nasty regression by removing the support for highmem skb
fragments. By using page_address() to get the address of a fragment's
page, we are assuming a lowmem page. However, such assumption is incorrect,
as fragments can be in highmem pages, resulting in very nasty issues.This commit fixes this by using the skb_frag_dma_map() helper,
which takes care of mapping the skb fragment properly. Additionally,
the type of mapping is now tracked, so it can be unmapped using
dma_unmap_page or dma_unmap_single when appropriate.This commit also fixes the error path in txq_init() to release the
resources properly.Fixes: 69ad0dd7af22 ("net: mv643xx_eth: Use dma_map_single() to map the skb fragments")
Reported-by: Russell King
Signed-off-by: Ezequiel Garcia
Signed-off-by: David S. Miller -
In order to stop the RX path accessing the RX ring while it's being
stopped or resized, we clear the interrupt mask (EESIPR) and then call
free_irq() or synchronise_irq(). This is insufficient because the
interrupt handler or NAPI poller may set EESIPR again after we clear
it. Also, in sh_eth_set_ringparam() we currently don't disable NAPI
polling at all.I could easily trigger a crash by running the loop:
while ethtool -G eth0 rx 128 && ethtool -G eth0 rx 64; do echo -n .; done
and 'ping -f' toward the sh_eth port from another machine.
To fix this:
- Add a software flag (irq_enabled) to signal whether interrupts
should be enabled
- In the interrupt handler, if the flag is clear then clear EESIPR
and return
- In the NAPI poller, if the flag is clear then don't set EESIPR
- Set the flag before enabling interrupts in sh_eth_dev_init() and
sh_eth_set_ringparam()
- Clear the flag and serialise with the interrupt and NAPI
handlers before clearing EESIPR in sh_eth_close() and
sh_eth_set_ringparam()After this, I could run the loop for 100,000 iterations successfully.
Signed-off-by: Ben Hutchings
Signed-off-by: David S. Miller -
If the device is down then no packet buffers should be allocated.
We also must not touch its registers as it may be powered off.Signed-off-by: Ben Hutchings
Signed-off-by: David S. Miller -
We must only ever stop TX queues when they are full or the net device
is not 'ready' so far as the net core, and specifically the watchdog,
is concerned. Otherwise, the watchdog may fire *immediately* if no
packets have been added to the queue in the last 5 seconds.What's more, sh_eth_tx_timeout() will likely crash if called while
we're resizing the TX ring.I could easily trigger this by running the loop:
while ethtool -G eth0 rx 128 && ethtool -G eth0 rx 64; do echo -n .; done
Signed-off-by: Ben Hutchings
Signed-off-by: David S. Miller -
If an skb to be transmitted is shorter than the minimum Ethernet frame
length, we currently set the DMA descriptor length to the minimum but
do not add zero-padding. This could result in leaking sensitive
data. We also pass different lengths to dma_map_single() and
dma_unmap_single().Use skb_padto() to pad properly, before calling dma_map_single().
Signed-off-by: Ben Hutchings
Signed-off-by: David S. Miller -
In Dual EMAC, the default VLANs are used to segregate Rx packets between
the ports, so adding the same default VLAN to the switch will affect the
normal packet transfers. So returning error on addition of dual EMAC
default VLANs.Even if EMAC 0 default port VLAN is added to EMAC 1, it will lead to
break dual EMAC port separations.Fixes: d9ba8f9e6298 (driver: net: ethernet: cpsw: dual emac interface implementation)
Cc: # v3.9+
Reported-by: Felipe Balbi
Signed-off-by: Mugunthan V N
Signed-off-by: David S. Miller -
Suspend/resume regression fix for 3.19.
* 'drm-fixes-3.19' of git://people.freedesktop.org/~agd5f/linux:
drm/radeon: Remove rdev->gart.pages_addr array
drm/radeon: Restore GART table contents after pinning it in VRAM v3
drm/radeon: Split off gart_get_page_entry ASIC hook from set_page_entry -
…/linux into drm-fixes
A couple of fixes for -rc7 in amdkfd:
- Forgot to free resources when creation of queue has failed
- Initialization of pipelines was incorrect (3 patches)In addition, The patch "drm/amdkfd: Allow user to limit only queues per device"
is not a fix, but I would like to push it for 3.19 as it changes the ABI
between amdkfd and userspace (by changing the module parameters). I would
prefer *not* to support the two deprecated module parameters if I don't have
too, as amdkfd hasn't been released yet.* tag 'drm-amdkfd-fixes-2015-01-26' of git://people.freedesktop.org/~gabbayo/linux:
drm/amdkfd: Fix bug in call to init_pipelines()
drm/amdkfd: Fix bug in pipelines initialization
drm/radeon: Don't increment pipe_id in kgd_init_pipeline
drm/amdkfd: Allow user to limit only queues per device
drm/amdkfd: PQM handle queue creation fault -
Linux 3.19-rc6
pull in rc6 as the amdkfd fixes are based on it, and I'd rather
be doing the merges separately -
…nux/kernel/git/mkl/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2015-01-21this is a pull request for v3.19, net/master, which consists of a single patch.
Viktor Babrian fixes the issue in the c_can dirver, that the CAN interface
might continue to send frames after the interface has been shut down.
====================Signed-off-by: David S. Miller <davem@davemloft.net>
-
3 fixes for the tda998x.
* 'drm-tda998x-fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
drm/i2c: tda998x: set the CEC I2C address based on the slave I2C address
drm: tda998x: Fix EDID read timeout on HDMI connect
drm: tda998x: Protect the page register -
Pull regulator fixes from Mark Brown:
"One correctness fix here for the s2mps11 driver which would have
resulted in some of the regulators being completely broken together
with a fix for locking in regualtor_put() (which is fortunately rarely
called at all in practical systems)"* tag 'regulator-v3.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: s2mps11: Fix wrong calculation of register offset
regulator: core: fix race condition in regulator_put() -
Pull spi fixes from Mark Brown:
"A few driver specific fixes here, some fixes for issues introduced and
discovered during recent work on the DesignWare driver (which has been
getting a lot of attention recently) and a couple of other drivers.
All serious things for people who run into them"* tag 'spi-v3.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: dw: amend warning message
spi: sh-msiof: fix MDR1_FLD_MASK value
spi: dw-mid: fix FIFO size
spi: dw: Fix detecting FIFO depth
spi/pxa2xx: Clear cur_chip pointer before starting next message -
Array of platform_device_id elements should be terminated with empty
element.Fixes: 5bccae6ec458 ("rtc: s5m-rtc: add real-time clock driver for s5m8767")
Signed-off-by: Andrey Ryabinin
Reviewed-by: Krzysztof Kozlowski
Cc:
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
26 Jan, 2015
9 commits
-
Do not wait for channel command buffers in IPA commands.
The potential wait could be done while holding a spin lock and causes
in recent kernels such a bug if kernel lock debugging is enabled:kernel: BUG: sleeping function called from invalid context at drivers/s390/net/qeth_core_main.c:
794
kernel: in_atomic(): 1, irqs_disabled(): 0, pid: 2031, name: NetworkManager
kernel: 2 locks held by NetworkManager/2031:
kernel: #0: (rtnl_mutex){+.+.+.}, at: [] rtnetlink_rcv+0x32/0x50
kernel: #1: (_xmit_ETHER){+.....}, at: [] dev_set_rx_mode+0x30/0x50
kernel: CPU: 0 PID: 2031 Comm: NetworkManager Not tainted 3.18.0-rc5-next-20141124 #1
kernel: 00000000275fb1f0 00000000275fb280 0000000000000002 0000000000000000
00000000275fb320 00000000275fb298 00000000275fb298 00000000007e326a
0000000000000000 000000000099ce2c 00000000009b4988 000000000000000b
00000000275fb2e0 00000000275fb280 0000000000000000 0000000000000000
0000000000000000 00000000001129c8 00000000275fb280 00000000275fb2e0
kernel: Call Trace:
kernel: ([] show_trace+0xf8/0x158)
kernel: [] show_stack+0x6a/0xe8
kernel: [] dump_stack+0x82/0xb0
kernel: [] ___might_sleep+0x170/0x228
kernel: [] qeth_wait_for_buffer+0x36/0xd0 [qeth]
kernel: [] qeth_get_ipacmd_buffer+0x3a/0xc0 [qeth]
kernel: [] qeth_l3_send_setdelmc+0x58/0xf8 [qeth_l3]
kernel: [] qeth_l3_set_ip_addr_list+0x2c6/0x848 [qeth_l3]
kernel: [] qeth_l3_set_multicast_list+0x434/0xc48 [qeth_l3]
kernel: [] dev_set_rx_mode+0x3a/0x50
kernel: [] __dev_open+0xe0/0x140
kernel: [] __dev_change_flags+0xa0/0x178
kernel: [] dev_change_flags+0x30/0x70
kernel: [] do_setlink+0x346/0x9a0
...The device driver has plenty of command buffers available
per channel for channel command communication.
In the extremely rare case when there is no command buffer
available, return a NULL pointer and issue a warning
in the kernel log. The caller handles the case when
a NULL pointer is encountered and returns an error.In the case the wait for command buffer is possible
(because no lock is held as in the OSN case), still wait
until a channel command buffer is available.Signed-off-by: Thomas Richter
Signed-off-by: Ursula Braun
Reviewed-by: Eugene Crosser
Signed-off-by: David S. Miller -
In the functions that are registering and unregistering MAC
addresses in the qeth-handled hardware, remove callback functions
that are unnesessary, as only the return code is analyzed.
Translate hardware response codes to semi-standard 'errno'-like
codes for readability.Add kernel-doc description to the internal API function
qeth_send_control_data().Signed-off-by: Eugene Crosser
Signed-off-by: Ursula Braun
Reviewed-by: Thomas-Mich Richter
Signed-off-by: David S. Miller -
Pull x86 fixes from Thomas Gleixner:
"Hopefully the last round of fixes for 3.19- regression fix for the LDT changes
- regression fix for XEN interrupt handling caused by the APIC
changes
- regression fixes for the PAT changes
- last minute fixes for new the MPX support
- regression fix for 32bit UP
- fix for a long standing relocation issue on 64bit tagged for stable
- functional fix for the Hyper-V clocksource tagged for stable
- downgrade of a pr_err which tends to confuse usersLooks a bit on the large side, but almost half of it are valuable
comments"* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/tsc: Change Fast TSC calibration failed from error to info
x86/apic: Re-enable PCI_MSI support for non-SMP X86_32
x86, mm: Change cachemode exports to non-gpl
x86, tls: Interpret an all-zero struct user_desc as "no segment"
x86, tls, ldt: Stop checking lm in LDT_empty
x86, mpx: Strictly enforce empty prctl() args
x86, mpx: Fix potential performance issue on unmaps
x86, mpx: Explicitly disable 32-bit MPX support on 64-bit kernels
x86, hyperv: Mark the Hyper-V clocksource as being continuous
x86: Don't rely on VMWare emulating PAT MSR correctly
x86, irq: Properly tag virtualization entry in /proc/interrupts
x86, boot: Skip relocs when load address unchanged
x86/xen: Override ACPI IRQ management callback __acpi_unregister_gsi
ACPI: pci: Do not clear pci_dev->irq in acpi_pci_irq_disable()
x86/xen: Treat SCI interrupt as normal GSI interrupt -
Pull irq fixes from Thomas Gleixner:
"From the irqchip departement you get:- regression fix for omap-intc
- regression fix for atmel-aic-common
- functional correctness fix for hip04
- type mismatch fix for gic-v3-its
- proper error pointer check for mtd-sysirq
Mostly one and two liners except for the omap regression fix which is
slightly larger than desired"* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irqchip: atmel-aic-common: Prevent clobbering of priority when changing IRQ type
irqchip: omap-intc: Fix legacy DMA regression
irqchip: gic-v3-its: Fix use of max with decimal constant
irqchip: hip04: Initialize hip04_cpu_map to 0xffff
irqchip: mtk-sysirq: Use IS_ERR() instead of NULL pointer check -
Pull timer fixes from Thomas Gleixner:
"A set of small fixes:- regression fix for exynos_mct clocksource
- trivial build fix for kona clocksource
- functional one liner fix for the sh_tmu clocksource
- two validation fixes to prevent (root only) data corruption in the
kernel via settimeofday and adjtimex. Tagged for stable"* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
time: adjtimex: Validate the ADJ_FREQUENCY values
time: settimeofday: Validate the values of tv from user
clocksource: sh_tmu: Set cpu_possible_mask to fix SMP broadcast
clocksource: kona: fix __iomem annotation
clocksource: exynos_mct: Fix bitmask regression for exynos4_mct_write -
Pull ARM SoC fixes from Olof Johansson:
"A week's worth of fixes for various ARM platforms. Diff wise, the
largest fix is for OMAP to deal with how GIC now registers interrupts
(irq_domain_add_legacy() -> irq_domain_add_linear() changes).Besides this, a few more renesas platforms needed the GIC instatiation
done for legacy boards. There's also a fix that disables coherency of
mvebu due to issues, and a few other smaller fixes"* tag 'armsoc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
arm64: dts: add baud rate to Juno stdout-path
ARM: dts: imx25: Fix PWM "per" clocks
bus: mvebu-mbus: fix support of MBus window 13
Merge tag 'mvebu-fixes-3.19-3' of git://git.infradead.org/linux-mvebu into fixes
ARM: mvebu: completely disable hardware I/O coherency
ARM: OMAP: Work around hardcoded interrupts
ARM: shmobile: r8a7779: Instantiate GIC from C board code in legacy builds
ARM: shmobile: r8a7778: Instantiate GIC from C board code in legacy builds
arm: boot: dts: dra7: enable dwc3 suspend PHY quirk -
Pull device mapper fixes from Mike Snitzer:
"Two stable fixes for dm-cache and one 3.19 DM core fix:- fix potential for dm-cache metadata corruption via stale metadata
buffers being used when switching an inactive cache table to
active; this could occur due to each table having it's own bufio
client rather than sharing the client between tables.- fix dm-cache target to properly account for discard IO while
suspending otherwise IO quiescing could complete prematurely.- fix DM core's handling of multiple internal suspends by maintaining
an 'internal_suspend_count' and only resuming the device when this
count drops to zero"* tag 'dm-3.19-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
dm: fix handling of multiple internal suspends
dm cache: fix problematic dual use of a single migration count variable
dm cache: share cache-metadata object across inactive and active DM tables -
Pull two block layer fixes from Jens Axboe:
"Two small patches that should make it into 3.19:- a fixup from me for NVMe, making the cq_vector a signed variable.
Otherwise our -1 comparison fails, and commit 2b25d981790b doesn't
do what it was supposed to.- a fixup for the hotplug handling for blk-mq from Ming Lei, using
the proper kobject referencing to ensure we release resources at
the right time"* 'for-linus' of git://git.kernel.dk/linux-block:
blk-mq: fix hctx/ctx kobject use-after-free
NVMe: cq_vector should be signed
25 Jan, 2015
3 commits
-
The ip6_route_output() always returns a valid dst pointer unlike in IPv4
case. So the validation has to be different from the IPv4 path. Correcting
that error in this patch.This was picked up by a static checker with a following warning -
drivers/net/ipvlan/ipvlan_core.c:380 ipvlan_process_v6_outbound()
warn: 'dst' isn't an ERR_PTRSigned-off-by: Mahesh Bandewar
Reported-by: Dan Carpenter
Signed-off-by: David S. Miller -
NAPI poll logic now enforces that a poller returns exactly the budget
when it wants to be called again.If a driver limits TX completion, it has to return budget as well when
the limit is hit, not the number of received packets.Reported-and-tested-by: Mike Galbraith
Signed-off-by: Eric Dumazet
Fixes: d75b1ade567f ("net: less interrupt masking in NAPI")
Cc: Manish Chopra
Acked-by: Manish Chopra
Signed-off-by: David S. Miller -
With the commit d75b1ade567ffab ("net: less interrupt masking in NAPI") napi repoll
is done only when work_done == budget. When we are in busy_poll we return 0 in
napi_poll. We should return budget.Signed-off-by: Govindarajulu Varadarajan
Signed-off-by: David S. Miller
