28 Nov, 2014

5 commits

  • Pull powerpc fixes from Michael Ellerman:
    "Here are five fixes for you to pull please.

    They're all CC'ed to stable except the "Fix PE state format" one which
    went in this release"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux:
    powerpc: 32 bit getcpu VDSO function uses 64 bit instructions
    powerpc/powernv: Replace OPAL_DEASSERT_RESET with EEH_RESET_DEACTIVATE
    powerpc/eeh: Fix PE state format
    powerpc/pseries: Fix endiannes issue in RTAS call from xmon
    powerpc/powernv: Fix the hmi event version check.

    Linus Torvalds
     
  • Pull sparc fixlet from David Miller:
    "Aparc fix to add dma_cache_sync(), even if a nop it should be provided
    if dma_{alloc,free}_noncoherent() is provided too"

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
    sparc: Add NOP dma_cache_sync() implementation.

    Linus Torvalds
     
  • Pull networking fixes from David Miller:
    "Several small fixes here:

    1) Don't crash in tg3 driver when the number of tx queues has been
    configured to be different from the number of rx queues. From
    Thadeu Lima de Souza Cascardo.

    2) VLAN filter not disabled properly in promisc mode in ixgbe driver,
    from Vlad Yasevich.

    3) Fix OOPS on dellink op in VTI tunnel driver, from Xin Long.

    4) IPV6 GRE driver WCCP code checks skb->protocol for ETH_P_IP
    instead of ETH_P_IPV6, whoops. From Yuri Chislov.

    5) Socket matching in ping driver is buggy when packet AF does not
    match socket's AF. Fix from Jane Zhou.

    6) Fix checksum calculation errors in VXLAN due to where the
    udp_tunnel6_xmit_skb() helper gets it's saddr/daddr from. From
    Alexander Duyck.

    7) Fix 5G detection problem in rtlwifi driver, from Larry Finger.

    8) Fix NULL deref in tcp_v{4,6}_send_reset, from Eric Dumazet.

    9) Various missing netlink attribute verifications in bridging code,
    from Thomas Graf.

    10) tcp_recvmsg() unconditionally calls ipv4 ip_recv_error even for
    ipv6 sockets, whoops. Fix from Willem de Bruijn"

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (29 commits)
    net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks
    bridge: Sanitize IFLA_EXT_MASK for AF_BRIDGE:RTM_GETLINK
    bridge: Add missing policy entry for IFLA_BRPORT_FAST_LEAVE
    net: Check for presence of IFLA_AF_SPEC
    net: Validate IFLA_BRIDGE_MODE attribute length
    bridge: Validate IFLA_BRIDGE_FLAGS attribute length
    stmmac: platform: fix default values of the filter bins setting
    net/mlx4_core: Limit count field to 24 bits in qp_alloc_res
    net: dsa: bcm_sf2: reset switch prior to initialization
    net: dsa: bcm_sf2: fix unmapping registers in case of errors
    tg3: fix ring init when there are more TX than RX channels
    tcp: fix possible NULL dereference in tcp_vX_send_reset()
    rtlwifi: Change order in device startup
    rtlwifi: rtl8821ae: Fix 5G detection problem
    Revert "netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse"
    vxlan: Fix boolean flip in VXLAN_F_UDP_ZERO_CSUM6_[TX|RX]
    ip6_udp_tunnel: Fix checksum calculation
    net-timestamp: Fix a documentation typo
    net/ping: handle protocol mismatching scenario
    af_packet: fix sparse warning
    ...

    Linus Torvalds
     
  • Pull spi fixes from Mark Brown:
    "There's a couple of driver fixes here, plus one core fix for the DMA
    mapping which wasn't doing the right thing for vmalloc()ed addresses
    that hadn't been through kmap(). It's fairly rare to use vmalloc()
    with SPI and it's a subset of those users who might fail so it's
    unsurprising that this wasn't noticed sooner"

    * tag 'spi-v3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
    spi: sirf: fix word width configuration
    spi: Fix mapping from vmalloc-ed buffer to scatter list
    spi: dw: Fix dynamic speed change.

    Linus Torvalds
     
  • Pull input layer fixes from Dmitry Torokhov:
    "The main change is to fix breakage in Elantech driver introduced by
    the recent commit adding trackpoint reporting to protocol v4. Now we
    are trusting the hardware to advertise the trackpoint properly and do
    not try to decode the data as trackpoint if firmware told us it is not
    present"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
    Input: xpad - use proper endpoint type
    Input: elantech - trust firmware about trackpoint presence
    Input: synaptics - adjust min/max on Thinkpad E540

    Linus Torvalds
     

27 Nov, 2014

22 commits

  • I used some 64 bit instructions when adding the 32 bit getcpu VDSO
    function. Fix it.

    Fixes: 18ad51dd342a ("powerpc: Add VDSO version of getcpu")
    Cc: stable@vger.kernel.org
    Signed-off-by: Anton Blanchard
    Signed-off-by: Michael Ellerman

    Anton Blanchard
     
  • The flag passed to ioda_eeh_phb_reset() should be EEH_RESET_DEACTIVATE,
    which is translated to OPAL_DEASSERT_RESET or something else by the
    EEH backend accordingly.

    The patch replaces OPAL_DEASSERT_RESET with EEH_RESET_DEACTIVATE for
    ioda_eeh_phb_reset().

    Cc: stable@vger.kernel.org
    Signed-off-by: Gavin Shan
    Signed-off-by: Michael Ellerman

    Gavin Shan
     
  • Obviously I had wrong format given to the PE state output from
    /sys/bus/pci/devices/xxxx/eeh_pe_state with some typoes, which
    was introduced by commit 2013add4ce73. The patch fixes it up.

    Fixes: 2013add4ce73 ("powerpc/eeh: Show hex prefix for PE state sysfs")
    Signed-off-by: Gavin Shan
    Signed-off-by: Michael Ellerman

    Gavin Shan
     
  • On pseries system (LPAR) xmon failed to enter when running in LE mode,
    system is hunging. Inititating xmon will lead to such an output on the
    console:

    SysRq : Entering xmon
    cpu 0x15: Vector: 0 at [c0000003f39ffb10]
    pc: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70
    lr: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70
    sp: c0000003f39ffc70
    msr: 8000000000009033
    current = 0xc0000003fafa7180
    paca = 0xc000000007d75e80 softe: 0 irq_happened: 0x01
    pid = 14617, comm = bash
    Bad kernel stack pointer fafb4b0 at eca7cc4
    cpu 0x15: Vector: 300 (Data Access) at [c000000007f07d40]
    pc: 000000000eca7cc4
    lr: 000000000eca7c44
    sp: fafb4b0
    msr: 8000000000001000
    dar: 10000000
    dsisr: 42000000
    current = 0xc0000003fafa7180
    paca = 0xc000000007d75e80 softe: 0 irq_happened: 0x01
    pid = 14617, comm = bash
    cpu 0x15: Exception 300 (Data Access) in xmon, returning to main loop
    xmon: WARNING: bad recursive fault on cpu 0x15

    The root cause is that xmon is calling RTAS to turn off the surveillance
    when entering xmon, and RTAS is requiring big endian parameters.

    This patch is byte swapping the RTAS arguments when running in LE mode.

    Cc: stable@vger.kernel.org
    Signed-off-by: Laurent Dufour
    Signed-off-by: Michael Ellerman

    Laurent Dufour
     
  • The current HMI event structure is an ABI and carries a version field to
    accommodate future changes without affecting/rearranging current structure
    members that are valid for previous versions.

    The current version check "if (hmi_evt->version != OpalHMIEvt_V1)"
    doesn't accomodate the fact that the version number may change in
    future.

    If firmware starts returning an HMI event with version > 1, this check
    will fail and no HMI information will be printed on older kernels.

    This patch fixes this issue.

    Cc: stable@vger.kernel.org # 3.17+
    Signed-off-by: Mahesh Salgaonkar
    [mpe: Reword changelog]
    Signed-off-by: Michael Ellerman

    Mahesh Salgaonkar
     
  • John W. Linville says:

    ====================
    pull request: wireless 2014-11-26

    Please pull this little batch of fixes intended for the 3.18 stream...

    For the iwlwifi one, Emmanuel says:

    "Not all the firmware know how to handle the HOT_SPOT_CMD.
    Make sure that the firmware will know this command before
    sending it. This avoids a firmware crash."

    Along with that, Larry sends a pair of rtlwifi fixes to address some
    discrepancies from moving drivers out of staging. Larry says:

    "These two patches are needed to fix a regression introduced when
    driver rtl8821ae was moved from staging to the regular wireless tree."

    Please let me know if there are problems!
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • This can be a NOP because we forward dma_{alloc,free}_noncoherent to
    dma_{alloc,free}_coherent.

    Signed-off-by: David S. Miller

    David S. Miller
     
  • TCP timestamping introduced MSG_ERRQUEUE handling for TCP sockets.
    If the socket is of family AF_INET6, call ipv6_recv_error instead
    of ip_recv_error.

    This change is more complex than a single branch due to the loadable
    ipv6 module. It reuses a pre-existing indirect function call from
    ping. The ping code is safe to call, because it is part of the core
    ipv6 module and always present when AF_INET6 sockets are active.

    Fixes: 4ed2d765 (net-timestamp: TCP timestamping)
    Signed-off-by: Willem de Bruijn

    ----

    It may also be worthwhile to add WARN_ON_ONCE(sk->family == AF_INET6)
    to ip_recv_error.
    Signed-off-by: David S. Miller

    Willem de Bruijn
     
  • Thomas Graf says:

    ====================
    bridge: Fix missing Netlink message validations

    Adds various missing length checks in the bridging code for Netlink
    messages and corresponding attributes provided by user space.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • Only search for IFLA_EXT_MASK if the message actually carries a
    ifinfomsg header and validate minimal length requirements for
    IFLA_EXT_MASK.

    Fixes: 6cbdceeb ("bridge: Dump vlan information from a bridge port")
    Cc: Vlad Yasevich
    Signed-off-by: Thomas Graf
    Signed-off-by: David S. Miller

    Thomas Graf
     
  • Fixes: c2d3babf ("bridge: implement multicast fast leave")
    Cc: David S. Miller
    Signed-off-by: Thomas Graf
    Signed-off-by: David S. Miller

    Thomas Graf
     
  • ndo_bridge_setlink() is currently only called on the slave if
    IFLA_AF_SPEC is set but this is a very fragile assumption and may
    change in the future.

    Cc: Ajit Khaparde
    Cc: John Fastabend
    Signed-off-by: Thomas Graf
    Acked-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Thomas Graf
     
  • Payload is currently accessed blindly and may exceed valid message
    boundaries.

    Fixes: a77dcb8c8 ("be2net: set and query VEB/VEPA mode of the PF interface")
    Fixes: 815cccbf1 ("ixgbe: add setlink, getlink support to ixgbe and ixgbevf")
    Cc: Ajit Khaparde
    Cc: John Fastabend
    Signed-off-by: Thomas Graf
    Acked-by: Jeff Kirsher
    Acked-by: John Fastabend
    Signed-off-by: David S. Miller

    Thomas Graf
     
  • Payload is currently accessed blindly and may exceed valid message
    boundaries.

    Fixes: 407af3299 ("bridge: Add netlink interface to configure vlans on bridge ports")
    Cc: Vlad Yasevich
    Signed-off-by: Thomas Graf
    Signed-off-by: David S. Miller

    Thomas Graf
     
  • Pull kvm fixes from Paolo Bonzini:
    "Last minute KVM/ARM fixes; even the generic change actually affects
    nothing but ARM"

    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
    kvm: fix kvm_is_mmio_pfn() and rename to kvm_is_reserved_pfn()
    arm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn()
    arm/arm64: KVM: vgic: Fix error code in kvm_vgic_create()
    arm64: KVM: Handle traps of ICC_SRE_EL1 as RAZ/WI
    arm64: KVM: fix unmapping with 48-bit VAs

    Linus Torvalds
     
  • Mark Brown
     
  • Mark Brown
     
  • The commit 3b57de958e2a brought the support for a different amount of
    the filter bins, but didn't update the platform driver that without
    CONFIG_OF.

    Fixes: 3b57de958e2a (net: stmmac: Support devicetree configs for mcast
    and ucast filter entries)

    Signed-off-by: Huacai Chen
    Acked-by: Giuseppe Cavallaro
    Signed-off-by: David S. Miller

    Huacai Chen
     
  • Some VF drivers use the upper byte of "param1" (the qp count field)
    in mlx4_qp_reserve_range() to pass flags which are used to optimize
    the range allocation.

    Under the current code, if any of these flags are set, the 32-bit
    count field yields a count greater than 2^24, which is out of range,
    and this VF fails.

    As these flags represent a "best-effort" allocation hint anyway, they may
    safely be ignored. Therefore, the PF driver may simply mask out the bits.

    Fixes: c82e9aa0a8 "mlx4_core: resource tracking for HCA resources used by guests"
    Signed-off-by: Jack Morgenstein
    Signed-off-by: Or Gerlitz
    Signed-off-by: David S. Miller

    Jack Morgenstein
     
  • Florian Fainelli says:

    ====================
    net: dsa: bcm_sf2: misc bugfixes

    This patch series contains two bug fixes:

    - first patch fixes an issue on the error path of the driver where we could
    have left some of our registers mapped

    - second patch enforces the use of a software reset of the switch to guarantee
    the HW is in a consistent state prior to software initialization
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • Our boot agent may have left the switch in an certain configuration
    state, make sure we issue a software reset prior to configuring the
    switch in order to ensure the HW is in a consistent state, in particular
    transmit queues and internal buffers.

    Fixes: 246d7f773c13 ("net: dsa: add Broadcom SF2 switch driver")
    Signed-off-by: Florian Fainelli
    Signed-off-by: David S. Miller

    Florian Fainelli
     
  • In case we fail to ioremap() one of our registers, we would be leaking
    existing mappings, unwind those accordingly on errors.

    Fixes: 246d7f773c13 ("net: dsa: add Broadcom SF2 switch driver")
    Signed-off-by: Florian Fainelli
    Signed-off-by: David S. Miller

    Florian Fainelli
     

26 Nov, 2014

13 commits

  • This reverts commit 85c8555ff0 ("KVM: check for !is_zero_pfn() in
    kvm_is_mmio_pfn()") and renames the function to kvm_is_reserved_pfn.

    The problem being addressed by the patch above was that some ARM code
    based the memory mapping attributes of a pfn on the return value of
    kvm_is_mmio_pfn(), whose name indeed suggests that such pfns should
    be mapped as device memory.

    However, kvm_is_mmio_pfn() doesn't do quite what it says on the tin,
    and the existing non-ARM users were already using it in a way which
    suggests that its name should probably have been 'kvm_is_reserved_pfn'
    from the beginning, e.g., whether or not to call get_page/put_page on
    it etc. This means that returning false for the zero page is a mistake
    and the patch above should be reverted.

    Signed-off-by: Ard Biesheuvel
    Signed-off-by: Paolo Bonzini

    Ard Biesheuvel
     
  • Instead of using kvm_is_mmio_pfn() to decide whether a host region
    should be stage 2 mapped with device attributes, add a new static
    function kvm_is_device_pfn() that disregards RAM pages with the
    reserved bit set, as those should usually not be mapped as device
    memory.

    Signed-off-by: Ard Biesheuvel
    Signed-off-by: Paolo Bonzini

    Ard Biesheuvel
     
  • If we detect another vCPU is running we just exit and return 0 as if we
    succesfully created the VGIC, but the VGIC wouldn't actual be created.

    This shouldn't break in-kernel behavior because the kernel will not
    observe the failed the attempt to create the VGIC, but userspace could
    be rightfully confused.

    Cc: Andre Przywara
    Signed-off-by: Christoffer Dall
    Signed-off-by: Marc Zyngier
    Signed-off-by: Paolo Bonzini

    Christoffer Dall
     
  • When running on a system with a GICv3, we currenly don't allow the guest
    to access the system register interface of the GICv3. We do this by
    clearing the ICC_SRE_EL2.Enable, which causes all guest accesses to
    ICC_SRE_EL1 to trap to EL2 and causes all guest accesses to other ICC_
    registers to cause an undefined exception in the guest.

    However, we currently don't handle the trap of guest accesses to
    ICC_SRE_EL1 and will spill out a warning. The trap just needs to handle
    the access as RAZ/WI, and a guest that tries to prod this register and
    set ICC_SRE_EL1.SRE=1, must read back the value (which Linux already
    does) to see if it succeeded, and will thus observe that ICC_SRE_EL1.SRE
    was not set.

    Add the simple trap handler in the sorted table of the system registers.

    Signed-off-by: Christoffer Dall
    [ardb: added cp15 handling]
    Signed-off-by: Ard Biesheuvel
    Signed-off-by: Marc Zyngier

    Signed-off-by: Paolo Bonzini

    Christoffer Dall
     
  • Currently if using a 48-bit VA, tearing down the hyp page tables (which
    can happen in the absence of a GICH or GICV resource) results in the
    rather nasty splat below, evidently becasue we access a table that
    doesn't actually exist.

    Commit 38f791a4e499792e (arm64: KVM: Implement 48 VA support for KVM EL2
    and Stage-2) added a pgd_none check to __create_hyp_mappings to account
    for the additional level of tables, but didn't add a corresponding check
    to unmap_range, and this seems to be the source of the problem.

    This patch adds the missing pgd_none check, ensuring we don't try to
    access tables that don't exist.

    Original splat below:

    kvm [1]: Using HYP init bounce page @83fe94a000
    kvm [1]: Cannot obtain GICH resource
    Unable to handle kernel paging request at virtual address ffff7f7fff000000
    pgd = ffff800000770000
    [ffff7f7fff000000] *pgd=0000000000000000
    Internal error: Oops: 96000004 [#1] PREEMPT SMP
    Modules linked in:
    CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.18.0-rc2+ #89
    task: ffff8003eb500000 ti: ffff8003eb45c000 task.ti: ffff8003eb45c000
    PC is at unmap_range+0x120/0x580
    LR is at free_hyp_pgds+0xac/0xe4
    pc : [] lr : [] pstate: 80000045
    sp : ffff8003eb45fbf0
    x29: ffff8003eb45fbf0 x28: ffff800000736000
    x27: ffff800000735000 x26: ffff7f7fff000000
    x25: 0000000040000000 x24: ffff8000006f5000
    x23: 0000000000000000 x22: 0000007fffffffff
    x21: 0000800000000000 x20: 0000008000000000
    x19: 0000000000000000 x18: ffff800000648000
    x17: ffff800000537228 x16: 0000000000000000
    x15: 000000000000001f x14: 0000000000000000
    x13: 0000000000000001 x12: 0000000000000020
    x11: 0000000000000062 x10: 0000000000000006
    x9 : 0000000000000000 x8 : 0000000000000063
    x7 : 0000000000000018 x6 : 00000003ff000000
    x5 : ffff800000744188 x4 : 0000000000000001
    x3 : 0000000040000000 x2 : ffff800000000000
    x1 : 0000007fffffffff x0 : 000000003fffffff

    Process swapper/0 (pid: 1, stack limit = 0xffff8003eb45c058)
    Stack: (0xffff8003eb45fbf0 to 0xffff8003eb460000)
    fbe0: eb45fcb0 ffff8003 0009cad8 ffff8000
    fc00: 00000000 00000080 00736140 ffff8000 00736000 ffff8000 00000000 00007c80
    fc20: 00000000 00000080 006f5000 ffff8000 00000000 00000080 00743000 ffff8000
    fc40: 00735000 ffff8000 006d3030 ffff8000 006fe7b8 ffff8000 00000000 00000080
    fc60: ffffffff 0000007f fdac1000 ffff8003 fd94b000 ffff8003 fda47000 ffff8003
    fc80: 00502b40 ffff8000 ff000000 ffff7f7f fdec6000 00008003 fdac1630 ffff8003
    fca0: eb45fcb0 ffff8003 ffffffff 0000007f eb45fd00 ffff8003 0009b378 ffff8000
    fcc0: ffffffea 00000000 006fe000 ffff8000 00736728 ffff8000 00736120 ffff8000
    fce0: 00000040 00000000 00743000 ffff8000 006fe7b8 ffff8000 0050cd48 00000000
    fd00: eb45fd60 ffff8003 00096070 ffff8000 006f06e0 ffff8000 006f06e0 ffff8000
    fd20: fd948b40 ffff8003 0009a320 ffff8000 00000000 00000000 00000000 00000000
    fd40: 00000ae0 00000000 006aa25c ffff8000 eb45fd60 ffff8003 0017ca44 00000002
    fd60: eb45fdc0 ffff8003 0009a33c ffff8000 006f06e0 ffff8000 006f06e0 ffff8000
    fd80: fd948b40 ffff8003 0009a320 ffff8000 00000000 00000000 00735000 ffff8000
    fda0: 006d3090 ffff8000 006aa25c ffff8000 00735000 ffff8000 006d3030 ffff8000
    fdc0: eb45fdd0 ffff8003 000814c0 ffff8000 eb45fe50 ffff8003 006aaac4 ffff8000
    fde0: 006ddd90 ffff8000 00000006 00000000 006d3000 ffff8000 00000095 00000000
    fe00: 006a1e90 ffff8000 00735000 ffff8000 006d3000 ffff8000 006aa25c ffff8000
    fe20: 00735000 ffff8000 006d3030 ffff8000 eb45fe50 ffff8003 006fac68 ffff8000
    fe40: 00000006 00000006 fe293ee6 ffff8003 eb45feb0 ffff8003 004f8ee8 ffff8000
    fe60: 004f8ed4 ffff8000 00735000 ffff8000 00000000 00000000 00000000 00000000
    fe80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    fea0: 00000000 00000000 00000000 00000000 00000000 00000000 000843d0 ffff8000
    fec0: 004f8ed4 ffff8000 00000000 00000000 00000000 00000000 00000000 00000000
    fee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    ff00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    ff20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    ff40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    ff60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    ff80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    ffa0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000005 00000000
    ffe0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    Call trace:
    [] unmap_range+0x120/0x580
    [] free_hyp_pgds+0xa8/0xe4
    [] kvm_arch_init+0x268/0x44c
    [] kvm_init+0x24/0x260
    [] arm_init+0x18/0x24
    [] do_one_initcall+0x88/0x1a0
    [] kernel_init_freeable+0x148/0x1e8
    [] kernel_init+0x10/0xd4
    Code: 8b000263 92628479 d1000720 eb01001f (f9400340)
    ---[ end trace 3bc230562e926fa4 ]---
    Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

    Signed-off-by: Mark Rutland
    Cc: Catalin Marinas
    Cc: Jungseok Lee
    Acked-by: Marc Zyngier
    Acked-by: Christoffer Dall
    Signed-off-by: Marc Zyngier
    Signed-off-by: Paolo Bonzini

    Mark Rutland
     
  • Pull nfsd bugfixes from Bruce Fields:
    "These fix one mishandling of the case when security labels are
    configured out, and two races in the 4.1 backchannel code"

    * 'for-3.18' of git://linux-nfs.org/~bfields/linux:
    nfsd: Fix slot wake up race in the nfsv4.1 callback code
    SUNRPC: Fix locking around callback channel reply receive
    nfsd: correctly define v4.2 support attributes

    Linus Torvalds
     
  • Pull aio fix from Ben LaHaise:
    "Dirty page accounting fix for aio"

    * git://git.kvack.org/~bcrl/aio-fixes:
    aio: fix uncorrent dirty pages accouting when truncating AIO ring buffer

    Linus Torvalds
     
  • Pull powerpc fixes from Ben Herrenschmidt:
    "This series fix a nasty issue with radeon adapters on powerpc servers,
    it's all CC'ed stable and has the relevant maintainers ack's/reviews.

    Basically, some (radeon) adapters have issues with MSI addresses above
    1T (only support 40-bits). We had powerpc specific quirk but it only
    listed a specific revision of an adapter that we shipped with our
    machines and didn't properly handle the audio function which some
    distros enable nowadays.

    So we made the quirk generic and fixed both the graphic and audio
    drivers properly to use it.

    Without that, ppc64 server machines will crash at boot with a radeon
    adapter.

    Note: This has been brewing for a while, it just needed a last respin
    which got delayed due to us moving ozlabs to a new location in town
    and other such things taking priority"

    * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
    powerpc/pci: Remove unused force_32bit_msi quirk
    powerpc/pseries: Honor the generic "no_64bit_msi" flag
    powerpc/powernv: Honor the generic "no_64bit_msi" flag
    sound/radeon: Move 64-bit MSI quirk from arch to driver
    gpu/radeon: Set flag to indicate broken 64-bit MSI
    PCI/MSI: Add device flag indicating that 64-bit MSIs don't work
    ALSA: hda - Limit 40bit DMA for AMD HDMI controllers

    Linus Torvalds
     
  • …el/git/groeck/linux-staging

    Pull a hwmon fix from Guenter Roeck:
    "Fix hwmon registration problem in g762 driver"

    * tag 'hwmon-for-linus-v3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
    hwmon: (g762) fix call to devm_hwmon_device_register_with_groups()

    Linus Torvalds
     
  • Pull clock fixes from Mike Turquette:
    "The fixes for the clock framework are all regressions in drivers, plus
    a single fix in one of the basic clock templates. No fixes to the
    core this time around.

    As with most clock driver fixes these run the gamut from fixing a
    build warning to fixing wrecked memory timings, with a little USB
    tossed in for fun"

    * tag 'clk-fixes-for-linus' of https://git.linaro.org/people/mike.turquette/linux:
    clk: pxa: fix pxa27x CCCR bit usage
    clk-divider: Fix READ_ONLY when divider > 1
    clk: qcom: Fix duplicate rbcpr clock name
    clk: at91: usb: fix at91sam9x5 recalc, round and set rate
    clk: at91: usb: fix at91rm9200 round and set rate

    Linus Torvalds
     
  • If TX channels are set to 4 and RX channels are set to less than 4,
    using ethtool -L, the driver will try to initialize more RX channels
    than it has allocated, causing an oops.

    This fix only initializes the RX ring if it has been allocated.

    Signed-off-by: Thadeu Lima de Souza Cascardo
    Signed-off-by: David S. Miller

    Thadeu Lima de Souza Cascardo
     
  • After commit ca777eff51f7 ("tcp: remove dst refcount false sharing for
    prequeue mode") we have to relax check against skb dst in
    tcp_v[46]_send_reset() if prequeue dropped the dst.

    If a socket is provided, a full lookup was done to find this socket,
    so the dst test can be skipped.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88191
    Reported-by: Jaša Bartelj
    Signed-off-by: Eric Dumazet
    Reported-by: Daniel Borkmann
    Fixes: ca777eff51f7 ("tcp: remove dst refcount false sharing for prequeue mode")
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • The existing order of steps when starting the PCI devices works for
    2.4G devices, but fails to initialize the 5G section of the RTL8821AE
    hardware.

    This patch is needed to fix the regression reported in Bug #88811
    (https://bugzilla.kernel.org/show_bug.cgi?id=88811).

    Reported-by: Valerio Passini
    Tested-by: Valerio Passini
    Signed-off-by: Larry Finger
    Cc: Valerio Passini
    Signed-off-by: John W. Linville

    Larry Finger