09 Jan, 2015
22 commits
-
commit dc6057ecb39edb34b0461ca55382094410bd257a upstream.
When creating a dumb buffer object using the DRM_IOCTL_MODE_CREATE_DUMB
IOCTL, only the width, height, bpp and flags parameters are inputs. The
caller is not guaranteed to zero out or set handle, pitch and size, so
the driver must not treat these values as possible inputs.Fixes a bug where running the Weston compositor on Tegra DRM would cause
an attempt to allocate a 3 GiB framebuffer to be allocated.Fixes: de2ba664c30f ("gpu: host1x: drm: Add memory manager and fb")
Signed-off-by: Thierry Reding
Signed-off-by: Greg Kroah-Hartman -
commit 17181fb7a0c3a279196c0eeb2caba65a1519614b upstream.
As long as struct thin_c is in the list, anyone can grab a reference of
it. Consequently, we must wait for the reference count to drop to zero
*after* we remove the structure from the list, not before.Signed-off-by: Mikulas Patocka
Signed-off-by: Mike Snitzer
Signed-off-by: Greg Kroah-Hartman -
commit 2c43fd26e46734430122b8d2ad3024bb532df3ef upstream.
Discard bios and thin device deletion have the potential to release data
blocks. If the thin-pool is in out-of-data-space mode, and blocks were
released, transition the thin-pool back to full write mode.The correct time to do this is just after the thin-pool metadata commit.
It cannot be done before the commit because the space maps will not
allow immediate reuse of the data blocks in case there's a rollback
following power failure.Signed-off-by: Joe Thornber
Signed-off-by: Mike Snitzer
Signed-off-by: Greg Kroah-Hartman -
commit 45ec9bd0fd7abf8705e7cf12205ff69fe9d51181 upstream.
When the pool was in PM_OUT_OF_SPACE mode its process_prepared_discard
function pointer was incorrectly being set to
process_prepared_discard_passdown rather than process_prepared_discard.This incorrect function pointer meant the discard was being passed down,
but not effecting the mapping. As such any discard that was issued, in
an attempt to reclaim blocks, would not successfully free data space.Reported-by: Eric Sandeen
Signed-off-by: Joe Thornber
Signed-off-by: Mike Snitzer
Signed-off-by: Greg Kroah-Hartman -
commit c1c6156fe4d4577444b769d7edd5dd503e57bbc9 upstream.
This function isn't right and it causes a static checker warning:
drivers/md/dm-thin.c:3016 maybe_resize_data_dev()
error: potentially using uninitialized 'sb_data_size'.It should set "*count" and return zero on success the same as the
sm_metadata_get_nr_blocks() function does earlier.Fixes: 3241b1d3e0aa ('dm: add persistent data library')
Signed-off-by: Dan Carpenter
Acked-by: Joe Thornber
Signed-off-by: Mike Snitzer
Signed-off-by: Greg Kroah-Hartman -
commit f824a2af3dfbbb766c02e19df21f985bceadf0ee upstream.
We never bother caching a partial block that is at the back end of the
origin device. No cell ever gets locked, but the calling code was
assuming it was and trying to release it.Now the code only releases if the cell has been set to a non NULL
value.Signed-off-by: Joe Thornber
Signed-off-by: Mike Snitzer
Signed-off-by: Greg Kroah-Hartman -
commit 1e32134a5a404e80bfb47fad8a94e9bbfcbdacc5 upstream.
If the incoming bio is a WRITE and completely covers a block then we
don't bother to do any copying for a promotion operation. Once this is
done the cache block and origin block will be different, so we need to
set it to 'dirty'.Signed-off-by: Joe Thornber
Signed-off-by: Mike Snitzer
Signed-off-by: Greg Kroah-Hartman -
commit f29a3147e251d7ae20d3194ff67f109d71e501b4 upstream.
Overwrite causes the cache block and origin blocks to diverge, which
is only allowed in writeback mode.Signed-off-by: Joe Thornber
Signed-off-by: Mike Snitzer
Signed-off-by: Greg Kroah-Hartman -
commit 1a71d6ffe18c0d0f03fc8531949cc8ed41d702ee upstream.
Use memzero_explicit to cleanup sensitive data allocated on stack
to prevent the compiler from optimizing and removing memset() calls.Signed-off-by: Milan Broz
Signed-off-by: Mike Snitzer
Signed-off-by: Greg Kroah-Hartman -
commit 445559cdcb98a141f5de415b94fd6eaccab87e6d upstream.
When dm-bufio sets out to use the bio built into a struct dm_buffer to
issue an IO, it needs to call bio_reset after it's done with the bio
so that we can free things attached to the bio such as the integrity
payload. Therefore, inject our own endio callback to take care of
the bio_reset after calling submit_io's end_io callback.Test case:
1. modprobe scsi_debug delay=0 dif=1 dix=199 ato=1 dev_size_mb=300
2. Set up a dm-bufio client, e.g. dm-verity, on the scsi_debug device
3. Repeatedly read metadata and watch kmalloc-192 leak!Signed-off-by: Darrick J. Wong
Signed-off-by: Mikulas Patocka
Signed-off-by: Mike Snitzer
Signed-off-by: Greg Kroah-Hartman -
commit b6c92b7e0af575e2b8b05bdf33633cf9e1661cbf upstream.
The .eh_abort_handler needs to return SUCCESS, FAILED, or
FAST_IO_FAIL. So fixup all callers to adhere to this requirement.Reviewed-by: Robert Elliott
Signed-off-by: Hannes Reinecke
Signed-off-by: Christoph Hellwig
Signed-off-by: Greg Kroah-Hartman -
commit fe08be3ec8672ed92b3ed1b85810df9fa0f98931 upstream.
The code reads the default voltage selector from its register. If the
bootloader disables the regulator, the default voltage selector will be
0 which results in faulty behaviour of this regulator driver.This patch sets a default voltage selector for vddpu if it is not set in
the register.Signed-off-by: Markus Pargmann
Signed-off-by: Mark Brown
Signed-off-by: Greg Kroah-Hartman -
commit 6e755ddc2935d970574263db3eca547eb70e67d7 upstream.
This patch addresses few endianness related bug fixes.
Signed-off-by: Sumit Saxena
Signed-off-by: Kashyap Desai
Reviewed-by: Tomas Henzl
Signed-off-by: Christoph Hellwig
Signed-off-by: Greg Kroah-Hartman -
commit 170c238701ec38b1829321b17c70671c101bac55 upstream.
Corrected wait_event() call which was waiting for wrong completion
status (0xFF).Signed-off-by: Sumit Saxena
Signed-off-by: Kashyap Desai
Reviewed-by: Tomas Henzl
Signed-off-by: Christoph Hellwig
Signed-off-by: Greg Kroah-Hartman -
commit 6380ea099cdd46d7377b6fbec0291cf2aa387bad upstream.
Fix Dell E5440 when reboot Linux, can't find o2micro sd host chip issue.
Fixes: 01acf6917aed (mmc: sdhci-pci: add support of O2Micro/BayHubTech SD hosts)
Signed-off-by: Peter Guo
Signed-off-by: Ulf Hansson
Signed-off-by: Greg Kroah-Hartman -
commit 0031a98a85e9fca282624bfc887f9531b2768396 upstream.
Make force_ro consistent with other sysfs entries.
Fixes: 371a689f64b0d ('mmc: MMC boot partitions support')
Cc: Andrei Warkentin
Signed-off-by: Baruch Siach
Signed-off-by: Ulf Hansson
Signed-off-by: Greg Kroah-Hartman -
commit 903101a83949d6fc77c092cef07e9c1e10c07e46 upstream.
The commit, mmc: omap: clarify DDR timing mode between SD-UHS and eMMC,
switched omap_hsmmc to support MMC DDR mode instead of UHS DDR50 mode.Add UHS DDR50 mode again and this time let's also keep the MMC DDR mode.
Fixes: 5438ad95a57c (mmc: omap: clarify DDR timing mode between SD-UHS and eMMC)
Reported-by: Kishon Vijay Abraham I
Signed-off-by: Ulf Hansson
Signed-off-by: Greg Kroah-Hartman -
commit 66dfd10173159cafa9cb0d39936b8daeaab8e3e0 upstream.
Commit f1d2736c8156 (mmc: dw_mmc: control card read threshold) added
dw_mci_ctrl_rd_thld() with an unconditional write to the CDTHRCTL
register at offset 0x100. However before version 240a, the FIFO region
started at 0x100, so the write messes with the FIFO and completely
breaks the driver.If the version id < 240A, return early from dw_mci_ctl_rd_thld() so as
not to hit this problem.Fixes: f1d2736c8156 (mmc: dw_mmc: control card read threshold)
Signed-off-by: James Hogan
Acked-by: Jaehoon Chung
Signed-off-by: Ulf Hansson
Signed-off-by: Greg Kroah-Hartman -
commit 1a5fb99de4850cba710d91becfa2c65653048589 upstream.
Some boards with TC6393XB chip require full state restore during system
resume thanks to chip's VCC being cut off during suspend (Sharp SL-6000
tosa is one of them). Failing to do so would result in ohci Oops on
resume due to internal memory contentes being changed. Fail ohci suspend
on tc6393xb is full state restore is required.Recommended workaround is to unbind tmio-ohci driver before suspend and
rebind it after resume.Signed-off-by: Dmitry Eremin-Solenikov
Signed-off-by: Lee Jones
Signed-off-by: Greg Kroah-Hartman -
commit 1b9b46d05f887aec418b3a5f4f55abf79316fcda upstream.
Commit e7cd1d1eb16f ("mfd: twl4030-power: Add generic reset
configuration") accidentally removed the compatible flag for
"ti,twl4030-power" that should be there as documented in the
binding.If "ti,twl4030-power" only the poweroff configuration is done
by the driver.Fixes: e7cd1d1eb16f ("mfd: twl4030-power: Add generic reset configuration")
Reported-by: "Dr. H. Nikolaus Schaller"
Signed-off-by: Tony Lindgren
Signed-off-by: Lee Jones
Signed-off-by: Greg Kroah-Hartman -
commit 0b46b8a718c6e90910a1b1b0fe797be3c167e186 upstream.
This is a bug fix for using physical arch timers when
the arch_timer_use_virtual boolean is false. It restores the
arch_counter_get_cntpct() function after removal in0d651e4e "clocksource: arch_timer: use virtual counters"
We need this on certain ARMv7 systems which are architected like this:
* The firmware doesn't know and doesn't care about hypervisor mode and
we don't want to add the complexity of hypervisor there.* The firmware isn't involved in SMP bringup or resume.
* The ARCH timer come up with an uninitialized offset between the
virtual and physical counters. Each core gets a different random
offset.* The device boots in "Secure SVC" mode.
* Nothing has touched the reset value of CNTHCTL.PL1PCEN or
CNTHCTL.PL1PCTEN (both default to 1 at reset)One example of such as system is RK3288 where it is much simpler to
use the physical counter since there's nobody managing the offset and
each time a core goes down and comes back up it will get reinitialized
to some other random value.Fixes: 0d651e4e65e9 ("clocksource: arch_timer: use virtual counters")
Signed-off-by: Sonny Rao
Acked-by: Catalin Marinas
Acked-by: Daniel Lezcano
Signed-off-by: Olof Johansson
Signed-off-by: Greg Kroah-Hartman -
commit 333c2aa029b847051a2db76a6ca59f699a520030 upstream.
Reviewed-by: Arend Van Spriel
Reviewed-by: Pieter-Paul Giesberts
Signed-off-by: Hante Meuleman
Signed-off-by: Arend van Spriel
Signed-off-by: John W. Linville
Signed-off-by: Greg Kroah-Hartman
17 Dec, 2014
8 commits
-
commit 946e51f2bf37f1656916eb75bd0742ba33983c28 upstream.
Signed-off-by: Al Viro
Signed-off-by: Greg Kroah-Hartman -
commit 87141db0848aa20c43d453f5545efc8f390d4372 upstream.
Proper operation with the rewritten PCI mini driver requires that a flag be set
when interrupts are enabled. This flag was missed. This patch is one of three needed to
fix the kernel regression reported at https://bugzilla.kernel.org/show_bug.cgi?id=88951.Signed-off-by: Larry Finger
Reported-by: Catalin Iacob
Tested-by: Catalin Iacob
Cc: Catalin Iacob
Signed-off-by: John W. Linville
Signed-off-by: Greg Kroah-Hartman -
commit f892914c03131a445b926b82815b03162c19288e upstream.
In the major update of the rtlwifi-family of drivers, one of the callback entries
was missed, which leads to memory corruption. Unfortunately, this corruption
never caused a kernel oops, but showed up in other parts of the system.
This patch is one of three needed to fix the kernel regression reported at
https://bugzilla.kernel.org/show_bug.cgi?id=88951.Signed-off-by: Larry Finger
Reported-by: Catalin Iacob
Tested-by: Catalin Iacob
Cc: Catalin Iacob
Signed-off-by: John W. Linville
Signed-off-by: Greg Kroah-Hartman -
commit 99a82f734aa6c6d397e029e6dfa933f04e0fa8c8 upstream.
In the major update of the rtlwifi-family of drivers, there was an editing
mistake. Unfortunately, this particular error leads to memory corruption that
silently leads to failure of the system. This patch is one of three needed to
fix the kernel regression reported at https://bugzilla.kernel.org/show_bug.cgi?id=88951.Signed-off-by: Larry Finger
Reported-by: Catalin Iacob
Tested-by: Catalin Iacob
Cc: Catalin Iacob
Signed-off-by: John W. Linville
Signed-off-by: Greg Kroah-Hartman -
[ Upstream commit 11d3d2a16cc1f05c6ece69a4392e99efb85666a6 ]
Commit 97a6d1bb2b658ac85ed88205ccd1ab809899884d (xen-netfront: Fix
handling packets on compound pages with skb_linearize) attempted to
fix a problem where an skb that would have required too many slots
would be dropped causing TCP connections to stall.However, it filled in the first slot using the original buffer and not
the new one and would use the wrong offset and grant access to the
wrong page.Netback would notice the malformed request and stop all traffic on the
VIF, reporting:vif vif-3-0 vif3.0: txreq.offset: 85e, size: 4002, end: 6144
vif vif-3-0 vif3.0: fatal error; disabling deviceReported-by: Anthony Wright
Tested-by: Anthony Wright
Signed-off-by: David Vrabel
Signed-off-by: David S. Miller
Signed-off-by: Greg Kroah-Hartman -
[ Upstream commit 5f478b41033606d325e420df693162e2524c2b94 ]
mvneta_tx() dereferences skb to get skb->len too late,
as hardware might have completed the transmit and TX completion
could have freed the skb from another cpu.Fixes: 71f6d1b31fb1 ("net: mvneta: replace Tx timer with a real interrupt")
Signed-off-by: Eric Dumazet
Signed-off-by: David S. Miller
Signed-off-by: Greg Kroah-Hartman -
[ Upstream commit aebea2ba0f7495e1a1c9ea5e753d146cb2f6b845 ]
The mvneta driver sets the amount of Tx coalesce packets to 16 by
default. Normally that does not cause any trouble since the driver
uses a much larger Tx ring size (532 packets). But some sockets
might run with very small buffers, much smaller than the equivalent
of 16 packets. This is what ping is doing for example, by setting
SNDBUF to 324 bytes rounded up to 2kB by the kernel.The problem is that there is no documented method to force a specific
packet to emit an interrupt (eg: the last of the ring) nor is it
possible to make the NIC emit an interrupt after a given delay.In this case, it causes trouble, because when ping sends packets over
its raw socket, the few first packets leave the system, and the first
15 packets will be emitted without an IRQ being generated, so without
the skbs being freed. And since the socket's buffer is small, there's
no way to reach that amount of packets, and the ping ends up with
"send: no buffer available" after sending 6 packets. Running with 3
instances of ping in parallel is enough to hide the problem, because
with 6 packets per instance, that's 18 packets total, which is enough
to grant a Tx interrupt before all are sent.The original driver in the LSP kernel worked around this design flaw
by using a software timer to clean up the Tx descriptors. This timer
was slow and caused terrible network performance on some Tx-bound
workloads (such as routing) but was enough to make tools like ping
work correctly.Instead here, we simply set the packet counts before interrupt to 1.
This ensures that each packet sent will produce an interrupt. NAPI
takes care of coalescing interrupts since the interrupt is disabled
once generated.No measurable performance impact nor CPU usage were observed on small
nor large packets, including when saturating the link on Tx, and this
fixes tools like ping which rely on too small a send buffer. If one
wants to increase this value for certain workloads where it is safe
to do so, "ethtool -C $dev tx-frames" will override this default
setting.This fix needs to be applied to stable kernels starting with 3.10.
Tested-By: Maggie Mae Roxas
Signed-off-by: Willy Tarreau
Signed-off-by: David S. Miller
Signed-off-by: Greg Kroah-Hartman -
[ Upstream commit 00c83b01d58068dfeb2e1351cca6fccf2a83fa8f ]
Currently, when trying to reuse a socket, vxlan_sock_add will grab
vn->sock_lock, locate a reusable socket, inc refcount and release
vn->sock_lock.But vxlan_sock_release() will first decrement refcount, and then grab
that lock. refcnt operations are atomic but as currently we have
deferred works which hold vs->refcnt each, this might happen, leading to
a use after free (specially after vxlan_igmp_leave):CPU 1 CPU 2
deferred work vxlan_sock_add
... ...
spin_lock(&vn->sock_lock)
vs = vxlan_find_sock();
vxlan_sock_release
dec vs->refcnt, reaches 0
spin_lock(&vn->sock_lock)
vxlan_sock_hold(vs), refcnt=1
spin_unlock(&vn->sock_lock)
hlist_del_rcu(&vs->hlist);
vxlan_notify_del_rx_port(vs)
spin_unlock(&vn->sock_lock)So when we look for a reusable socket, we check if it wasn't freed
already before reusing it.Signed-off-by: Marcelo Ricardo Leitner
Fixes: 7c47cedf43a8b3 ("vxlan: move IGMP join/leave to work queue")
Signed-off-by: David S. Miller
Signed-off-by: Greg Kroah-Hartman
08 Dec, 2014
1 commit
-
Pull libata fixes from Tejun Heo:
"Three libata fixes for v3.18. Nothing too interesting. PCI ID ID and
quirk additions to ahci and an error handling path fix in sata_fsl"* 'for-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
ahci: disable MSI on SAMSUNG 0xa800 SSD
sata_fsl: fix error handling of irq_of_parse_and_map
AHCI: Add DeviceIDs for Sunrise Point-LP SATA controller
07 Dec, 2014
2 commits
-
Pull watchdog fix from Wim Van Sebroeck:
"Fix the watchdog mask bit offset for Exynos7"* git://www.linux-watchdog.org/linux-watchdog:
watchdog: s3c2410_wdt: Fix the mask bit offset for Exynos7 -
Pull i2c fixes from Wolfram Sang:
"Here are two more driver bugfixes for I2C which would be good to have"* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
i2c: cadence: Set the hardware time-out register to maximum value
i2c: davinci: generate STP always when NACK is received
06 Dec, 2014
1 commit
-
The watchdog mask bit offset listed for Exynos7 is incorrect.
Fix this.Signed-off-by: Abhilash Kesavan
Acked-by: Naveen Krishna Chatradhi
Signed-off-by: Wim Van Sebroeck
05 Dec, 2014
6 commits
-
Pull drm intel fixes from Dave Airlie:
"Two intel stable fixes, that should be it from me for this round"* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/i915: Unlock panel even when LVDS is disabled
drm/i915: More cautious with pch fifo underruns -
Pull ACPI backlight fix from Rafael Wysocki:
"This is a simple fix for an ACPI backlight regression introduced by a
recent commit that overlooked a corner case which should have been
taken into account"* tag 'pm+acpi-3.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPI / video: update condition to check if device is in _DOD list -
Silence some pch fifo underrun reports and panel locking backtraces,
both cc: stable.* tag 'drm-intel-fixes-2014-12-04' of git://anongit.freedesktop.org/drm-intel:
drm/i915: Unlock panel even when LVDS is disabled
drm/i915: More cautious with pch fifo underruns -
Pull media fixes from Mauro Carvalho Chehab:
"A core fix and some driver fixes:
- regression fix in Remote Controller core affecting RC6 protocol
handling
- fix video buffer handling in cx23885
- race fix in solo6x10
- fix image selection in smiapp
- fix reported payload size on s2255drv
- two updates for MAINTAINERS file"* tag 'media/v3.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
[media] rc-core: fix toggle handling in the rc6 decoder
MAINTAINERS: Update mchehab's addresses
[media] cx23885: use sg = sg_next(sg) instead of sg++
[media] s2255drv: fix payload size for JPG, MJPEG
[media] Update MAINTAINERS for solo6x10
[media] solo6x10: fix a race in IRQ handler
[media] smiapp: Only some selection targets are settable -
Cadence I2C controller has bug wherein it generates invalid read transactions
after timeout in master receiver mode. This driver does not use the HW
timeout and this interrupt is disabled but the feature itself cannot be
disabled. Hence, this patch writes the maximum value (0xFF) to this register.
This is one of the workarounds to this bug and it will not avoid the issue
completely but reduces the chances of error.Signed-off-by: Vishnu Motghare
Signed-off-by: Harini Katakam
Signed-off-by: Wolfram Sang
Cc: stable@kernel.org -
According to I2C specification the NACK should be handled as follows:
"When SDA remains HIGH during this ninth clock pulse, this is defined as the Not
Acknowledge signal. The master can then generate either a STOP condition to
abort the transfer, or a repeated START condition to start a new transfer."
[I2C spec Rev. 6, 3.1.6: http://www.nxp.com/documents/user_manual/UM10204.pdf]Currently the Davinci i2c driver interrupts the transfer on receipt of a
NACK but fails to send a STOP in some situations and so makes the bus
stuck until next I2C IP reset (idle/enable).For example, the issue will happen during SMBus read transfer which
consists from two i2c messages write command/address and read data:S Slave Address Wr A Command Code A Sr Slave Address Rd A D1..Dn A P
The I2C client device will send NACK if it can't recognize "Command Code"
and it's expected from I2C master to generate STP in this case.
But now, Davinci i2C driver will just exit with -EREMOTEIO and STP will
not be generated.Hence, fix it by generating Stop condition (STP) always when NACK is received.
This patch fixes Davinci I2C in the same way it was done for OMAP I2C
commit cda2109a26eb ("i2c: omap: query STP always when NACK is received").Reviewed-by: Uwe Kleine-König
Reported-by: Hein Tibosch
Signed-off-by: Grygorii Strashko
Signed-off-by: Wolfram Sang
Cc: stable@kernel.org
