17 Dec, 2014

1 commit


05 Dec, 2014

1 commit


29 Nov, 2014

2 commits

  • Pull staging/IIO driver fixes from Greg KH:
    "Here are some staging and IIO driver fixes for 3.18-rc7 that resolve a
    number of reported issues, and a new device id for a staging wireless
    driver.

    All of these have been in linux-next"

    * tag 'staging-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
    staging: r8188eu: Add new device ID for DLink GO-USB-N150
    staging: r8188eu: Fix scheduling while atomic error introduced in commit fadbe0cd
    iio: accel: bmc150: set low default thresholds
    iio: accel: bmc150: Fix iio_event_spec direction
    iio: accel: bmc150: Send x, y and z motion separately
    iio: accel: bmc150: Error handling when mode set fails
    iio: gyro: bmg160: Fix iio_event_spec direction
    iio: gyro: bmg160: Send x, y and z motion separately
    iio: gyro: bmg160: Don't let interrupt mode to be open drain
    iio: gyro: bmg160: Error handling when mode set fails
    iio: adc: men_z188_adc: Add terminating entry for men_z188_ids
    iio: accel: kxcjk-1013: Fix kxcjk10013_set_range
    iio: Fix IIO_EVENT_CODE_EXTRACT_DIR bit mask

    Linus Torvalds
     
  • Pull sound fixes from Takashi Iwai:
    "No excitement, here are only minor fixes: an endian fix for the new
    DSD format we added in 3.18, a fix for HP mute LED, and a fix for
    Native Instrument quirk"

    * tag 'sound-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
    ALSA: pcm: Add big-endian DSD sample formats and fix XMOS DSD sample format
    ALSA: hda - One more HP machine needs to change mute led quirk
    ALSA: usb-audio: Use snd_usb_ctl_msg() for Native Instruments quirk

    Linus Torvalds
     

28 Nov, 2014

1 commit

  • Pull networking fixes from David Miller:
    "Several small fixes here:

    1) Don't crash in tg3 driver when the number of tx queues has been
    configured to be different from the number of rx queues. From
    Thadeu Lima de Souza Cascardo.

    2) VLAN filter not disabled properly in promisc mode in ixgbe driver,
    from Vlad Yasevich.

    3) Fix OOPS on dellink op in VTI tunnel driver, from Xin Long.

    4) IPV6 GRE driver WCCP code checks skb->protocol for ETH_P_IP
    instead of ETH_P_IPV6, whoops. From Yuri Chislov.

    5) Socket matching in ping driver is buggy when packet AF does not
    match socket's AF. Fix from Jane Zhou.

    6) Fix checksum calculation errors in VXLAN due to where the
    udp_tunnel6_xmit_skb() helper gets it's saddr/daddr from. From
    Alexander Duyck.

    7) Fix 5G detection problem in rtlwifi driver, from Larry Finger.

    8) Fix NULL deref in tcp_v{4,6}_send_reset, from Eric Dumazet.

    9) Various missing netlink attribute verifications in bridging code,
    from Thomas Graf.

    10) tcp_recvmsg() unconditionally calls ipv4 ip_recv_error even for
    ipv6 sockets, whoops. Fix from Willem de Bruijn"

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (29 commits)
    net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks
    bridge: Sanitize IFLA_EXT_MASK for AF_BRIDGE:RTM_GETLINK
    bridge: Add missing policy entry for IFLA_BRPORT_FAST_LEAVE
    net: Check for presence of IFLA_AF_SPEC
    net: Validate IFLA_BRIDGE_MODE attribute length
    bridge: Validate IFLA_BRIDGE_FLAGS attribute length
    stmmac: platform: fix default values of the filter bins setting
    net/mlx4_core: Limit count field to 24 bits in qp_alloc_res
    net: dsa: bcm_sf2: reset switch prior to initialization
    net: dsa: bcm_sf2: fix unmapping registers in case of errors
    tg3: fix ring init when there are more TX than RX channels
    tcp: fix possible NULL dereference in tcp_vX_send_reset()
    rtlwifi: Change order in device startup
    rtlwifi: rtl8821ae: Fix 5G detection problem
    Revert "netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse"
    vxlan: Fix boolean flip in VXLAN_F_UDP_ZERO_CSUM6_[TX|RX]
    ip6_udp_tunnel: Fix checksum calculation
    net-timestamp: Fix a documentation typo
    net/ping: handle protocol mismatching scenario
    af_packet: fix sparse warning
    ...

    Linus Torvalds
     

27 Nov, 2014

2 commits

  • TCP timestamping introduced MSG_ERRQUEUE handling for TCP sockets.
    If the socket is of family AF_INET6, call ipv6_recv_error instead
    of ip_recv_error.

    This change is more complex than a single branch due to the loadable
    ipv6 module. It reuses a pre-existing indirect function call from
    ping. The ping code is safe to call, because it is part of the core
    ipv6 module and always present when AF_INET6 sockets are active.

    Fixes: 4ed2d765 (net-timestamp: TCP timestamping)
    Signed-off-by: Willem de Bruijn

    ----

    It may also be worthwhile to add WARN_ON_ONCE(sk->family == AF_INET6)
    to ip_recv_error.
    Signed-off-by: David S. Miller

    Willem de Bruijn
     
  • …/jic23/iio into staging-linus

    Jonathan writes:

    Third set of IIO fixes for the 3.18 cycle.

    Most of these are fairly standard little fixes, a bmc150 and bmg160 patch
    is to make an ABI change to indicated a specific axis in an event rather
    than the generic option in the original drivers. As both of these drivers
    are new in this cycle it would be ideal to push this minor change through
    even though it isn't strictly a fix. A couple of other 'fixes' change
    defaults for some settings on these new drivers to more intuitive calues.
    Looks like some useful feedback has been coming in for this driver
    since it was applied.

    * IIO_EVENT_CODE_EXTRACT_DIR bit mask was wrong and has been for a while
    0xCF clearly doesn't give a contiguous bitmask.
    * kxcjk-1013 range setting was failing to mask out the previous value
    in the register and hence was 'enable only'.
    * men_z188 device id table wasn't null terminated.
    * bmg160 and bmc150 both failed to correctly handling an error in mode
    setting.
    * bmg160 and bmc150 both had a bug in setting the event direction in the
    event spec (leads to an attribute name being incorrect)
    * bmg160 defaulted to an open drain output for the interrupt - as a default
    this obviously only works with some interrupt chips - hence change the
    default to push-pull (note this is a new driver so we aren't going to
    cause any regressions with this change).
    * bmc150 had an unintuitive default for the rate of change (motion detector)
    so change it to 0 (new driver so change of default won't cause any
    regressions).

    Greg Kroah-Hartman
     

26 Nov, 2014

3 commits

  • This reverts commit 85c8555ff0 ("KVM: check for !is_zero_pfn() in
    kvm_is_mmio_pfn()") and renames the function to kvm_is_reserved_pfn.

    The problem being addressed by the patch above was that some ARM code
    based the memory mapping attributes of a pfn on the return value of
    kvm_is_mmio_pfn(), whose name indeed suggests that such pfns should
    be mapped as device memory.

    However, kvm_is_mmio_pfn() doesn't do quite what it says on the tin,
    and the existing non-ARM users were already using it in a way which
    suggests that its name should probably have been 'kvm_is_reserved_pfn'
    from the beginning, e.g., whether or not to call get_page/put_page on
    it etc. This means that returning false for the zero page is a mistake
    and the patch above should be reverted.

    Signed-off-by: Ard Biesheuvel
    Signed-off-by: Paolo Bonzini

    Ard Biesheuvel
     
  • Pull powerpc fixes from Ben Herrenschmidt:
    "This series fix a nasty issue with radeon adapters on powerpc servers,
    it's all CC'ed stable and has the relevant maintainers ack's/reviews.

    Basically, some (radeon) adapters have issues with MSI addresses above
    1T (only support 40-bits). We had powerpc specific quirk but it only
    listed a specific revision of an adapter that we shipped with our
    machines and didn't properly handle the audio function which some
    distros enable nowadays.

    So we made the quirk generic and fixed both the graphic and audio
    drivers properly to use it.

    Without that, ppc64 server machines will crash at boot with a radeon
    adapter.

    Note: This has been brewing for a while, it just needed a last respin
    which got delayed due to us moving ozlabs to a new location in town
    and other such things taking priority"

    * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
    powerpc/pci: Remove unused force_32bit_msi quirk
    powerpc/pseries: Honor the generic "no_64bit_msi" flag
    powerpc/powernv: Honor the generic "no_64bit_msi" flag
    sound/radeon: Move 64-bit MSI quirk from arch to driver
    gpu/radeon: Set flag to indicate broken 64-bit MSI
    PCI/MSI: Add device flag indicating that 64-bit MSIs don't work
    ALSA: hda - Limit 40bit DMA for AMD HDMI controllers

    Linus Torvalds
     
  • Pull clock fixes from Mike Turquette:
    "The fixes for the clock framework are all regressions in drivers, plus
    a single fix in one of the basic clock templates. No fixes to the
    core this time around.

    As with most clock driver fixes these run the gamut from fixing a
    build warning to fixing wrecked memory timings, with a little USB
    tossed in for fun"

    * tag 'clk-fixes-for-linus' of https://git.linaro.org/people/mike.turquette/linux:
    clk: pxa: fix pxa27x CCCR bit usage
    clk-divider: Fix READ_ONLY when divider > 1
    clk: qcom: Fix duplicate rbcpr clock name
    clk: at91: usb: fix at91sam9x5 recalc, round and set rate
    clk: at91: usb: fix at91rm9200 round and set rate

    Linus Torvalds
     

24 Nov, 2014

3 commits

  • This can be set by quirks/drivers to be used by the architecture code
    that assigns the MSI addresses.

    We additionally add verification in the core MSI code that the values
    assigned by the architecture do satisfy the limitation in order to fail
    gracefully if they don't (ie. the arch hasn't been updated to deal with
    that quirk yet).

    Signed-off-by: Benjamin Herrenschmidt
    CC:
    Acked-by: Bjorn Helgaas

    Benjamin Herrenschmidt
     
  • Pull percpu fix from Tejun Heo:
    "This contains one patch to fix a race condition which can lead to
    percpu_ref using a percpu pointer which is corrupted with a set DEAD
    bit. The bug was introduced while separating out the ATOMIC mode flag
    from the DEAD flag. The fix is pretty straight forward.

    I just committed the patch to the percpu tree but am sending out the
    pull request early as I'll be on vacation for a week. The patch
    should be fairly safe and while the latency will be higher I'll be
    checking emails"

    * 'for-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
    percpu-ref: fix DEAD flag contamination of percpu pointer

    Linus Torvalds
     
  • While decoupling ATOMIC and DEAD flags, f47ad4578461 ("percpu_ref:
    decouple switching to percpu mode and reinit") updated
    __ref_is_percpu() so that it only tests ATOMIC flag to determine
    whether the ref is in percpu mode or not; however, while DEAD implies
    ATOMIC, the two flags are set separately during percpu_ref_kill() and
    if __ref_is_percpu() races percpu_ref_kill(), it may see DEAD w/o
    ATOMIC. Because __ref_is_percpu() returns @ref->percpu_count_ptr
    value verbatim as the percpu pointer after testing ATOMIC, the pointer
    may now be contaminated with the DEAD flag.

    This can be fixed by clearing the flag bits before returning the
    pointer which was the fix proposed by Shaohua; however, as DEAD
    implies ATOMIC, we can just test for both flags at once and avoid the
    explicit masking.

    Update __ref_is_percpu() so that it tests that both ATOMIC and DEAD
    are clear before returning @ref->percpu_count_ptr as the percpu
    pointer.

    Signed-off-by: Tejun Heo
    Reported-and-Reviewed-by: Shaohua Li
    Link: http://lkml.kernel.org/r/995deb699f5b873c45d667df4add3b06f73c2c25.1416638887.git.shli@kernel.org
    Fixes: f47ad4578461 ("percpu_ref: decouple switching to percpu mode and reinit")

    Tejun Heo
     

22 Nov, 2014

4 commits

  • Pull networking fixes from David Miller:

    1) Fix BUG when decrypting empty packets in mac80211, from Ronald Wahl.

    2) nf_nat_range is not fully initialized and this is copied back to
    userspace, from Daniel Borkmann.

    3) Fix read past end of b uffer in netfilter ipset, also from Dan
    Carpenter.

    4) Signed integer overflow in ipv4 address mask creation helper
    inet_make_mask(), from Vincent BENAYOUN.

    5) VXLAN, be2net, mlx4_en, and qlcnic need ->ndo_gso_check() methods to
    properly describe the device's capabilities, from Joe Stringer.

    6) Fix memory leaks and checksum miscalculations in openvswitch, from
    Pravin B SHelar and Jesse Gross.

    7) FIB rules passes back ambiguous error code for unreachable routes,
    making behavior confusing for userspace. Fix from Panu Matilainen.

    8) ieee802154fake_probe() doesn't release resources properly on error,
    from Alexey Khoroshilov.

    9) Fix skb_over_panic in add_grhead(), from Daniel Borkmann.

    10) Fix access of stale slave pointers in bonding code, from Nikolay
    Aleksandrov.

    11) Fix stack info leak in PPP pptp code, from Mathias Krause.

    12) Cure locking bug in IPX stack, from Jiri Bohac.

    13) Revert SKB fclone memory freeing optimization that is racey and can
    allow accesses to freed up memory, from Eric Dumazet.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (71 commits)
    tcp: Restore RFC5961-compliant behavior for SYN packets
    net: Revert "net: avoid one atomic operation in skb_clone()"
    virtio-net: validate features during probe
    cxgb4 : Fix DCB priority groups being returned in wrong order
    ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg
    openvswitch: Don't validate IPv6 label masks.
    pptp: fix stack info leak in pptp_getname()
    brcmfmac: don't include linux/unaligned/access_ok.h
    cxgb4i : Don't block unload/cxgb4 unload when remote closes TCP connection
    ipv6: delete protocol and unregister rtnetlink when cleanup
    net/mlx4_en: Add VXLAN ndo calls to the PF net device ops too
    bonding: fix curr_active_slave/carrier with loadbalance arp monitoring
    mac80211: minstrel_ht: fix a crash in rate sorting
    vxlan: Inline vxlan_gso_check().
    can: m_can: update to support CAN FD features
    can: m_can: fix incorrect error messages
    can: m_can: add missing delay after setting CCCR_INIT bit
    can: m_can: fix not set can_dlc for remote frame
    can: m_can: fix possible sleep in napi poll
    can: m_can: add missing message RAM initialization
    ...

    Linus Torvalds
     
  • Pull sound fixes from Takashi Iwai:
    "This batch ended up as a relatively high volume due to pending ASoC
    fixes. But most of fixes there are trivial and/or device- specific
    fixes and quirks, so safe to apply. The only (ASoC) core fixes are
    the DPCM race fix and the machine-driver matching fix for
    componentization"

    * tag 'sound-3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
    ALSA: hda - fix the mic mute led problem for Latitude E5550
    ALSA: hda - move DELL_WMI_MIC_MUTE_LED to the tail in the quirk chain
    ASoC: wm_adsp: Avoid attempt to free buffers that might still be in use
    ALSA: usb-audio: Set the Control Selector to SU_SELECTOR_CONTROL for UAC2
    ALSA: usb-audio: Add ctrl message delay quirk for Marantz/Denon devices
    ASoC: sgtl5000: Fix SMALL_POP bit definition
    ASoC: cs42l51: re-hook of_match_table pointer
    ASoC: rt5670: change dapm routes of PLL connection
    ASoC: rt5670: correct the incorrect default values
    ASoC: samsung: Add MODULE_DEVICE_TABLE for Snow
    ASoC: max98090: Correct pclk divisor settings
    ASoC: dpcm: Fix race between FE/BE updates and trigger
    ASoC: Fix snd_soc_find_dai() matching component by name
    ASoC: rsnd: remove unsupported PAUSE flag
    ASoC: fsi: remove unsupported PAUSE flag
    ASoC: rt5645: Mark RT5645_TDM_CTRL_3 as readable
    ASoC: rockchip-i2s: fix infinite loop in rockchip_snd_rxctrl
    ASoC: es8328-i2c: Fix i2c_device_id name field in es8328_id
    ASoC: fsl_asrc: Add reg_defaults for regmap to fix kernel dump

    Linus Torvalds
     
  • Pull scheduler fixes from Ingo Molnar:
    "Misc fixes: two NUMA fixes, two cputime fixes and an RCU/lockdep fix"

    * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    sched/cputime: Fix clock_nanosleep()/clock_gettime() inconsistency
    sched/cputime: Fix cpu_timer_sample_group() double accounting
    sched/numa: Avoid selecting oneself as swap target
    sched/numa: Fix out of bounds read in sched_init_numa()
    sched: Remove lockdep check in sched_move_task()

    Linus Torvalds
     
  • Pull core fix from Ingo Molnar:
    "Fix GENMASK macro shift overflow"

    Nobody seems to currently use GENMASK() to fill every single last bit
    (which is what overflows) in-tree, and gcc would warn about it, so we
    have that going for us. But apparently there are pending changes that
    want this.

    * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    bitops: Fix shift overflow in GENMASK macros

    Linus Torvalds
     

21 Nov, 2014

1 commit


20 Nov, 2014

1 commit

  • Marc Kleine-Budde says:

    ====================
    pull-request: can 2014-11-18

    this is a pull request of 17 patches for net/master for the v3.18 release
    cycle.

    The last patch of this pull request ("can: m_can: update to support CAN FD
    features") adds, as the description says, a new feature to the m_can driver. As
    the m_can driver has been added in v3.18 there is no risk of causing a
    regression. Give me a note if this is not okay and I'll create a new pull
    request without it.

    There is a patch for the CAN infrastructure by Thomas Körper which fixes
    calling kfree_skb() from interrupt context. Roman Fietze fixes a typo also in
    the infrastructure. A patch by Dong Aisheng adds a generic helper function to
    tell if a skb is normal CAN or CAN-FD frame. Alexey Khoroshilov of the Linux
    Driver Verification project fixes a memory leak in the esd_usb2 driver. Two
    patches by Sudip Mukherjee remove unused variables and fixe the signess of a
    variable. Three patches by me add the missing .ndo_change_mtu callback to the
    xilinx_can, rcar_can and gs_usb driver.

    The remaining patches improve the m_can driver: David Cohen adds the missing
    CONFIG_HAS_IOMEM dependency. Dong Aisheng provides 6 bugfix patches (most
    important: missing RAM init, sleep in NAPI poll, dlc in RTR). While the last of
    his patches adds CAN FD support to the driver.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

19 Nov, 2014

1 commit


18 Nov, 2014

4 commits

  • The CAN device drivers can use can_is_canfd_skb() to check if the frame to send
    is on CAN FD mode or normal CAN mode.

    Acked-by: Oliver Hartkopp
    Signed-off-by: Dong Aisheng
    Signed-off-by: Marc Kleine-Budde

    Dong Aisheng
     
  • Commit 79c6ab509558 (clk: divider: add CLK_DIVIDER_READ_ONLY flag) in
    v3.16 introduced the CLK_DIVIDER_READ_ONLY flag which caused the
    recalc_rate() and round_rate() clock callbacks to be omitted.

    However using this flag has the unfortunate side effect of causing the
    clock recalculation code when a clock rate change is attempted to always
    treat it as a pass-through clock, i.e. with a fixed divide of 1, which
    may not be the case. Child clock rates are then recalculated using the
    wrong parent rate.

    Therefore instead of dropping the recalc_rate() and round_rate()
    callbacks, alter clk_divider_bestdiv() to always report the current
    divider as the best divider so that it is never altered.

    For me the read only clock was the system clock, which divided the PLL
    rate by 2, from which both the UART and the SPI clocks were divided.
    Initial setting of the UART rate set it correctly, but when the SPI
    clock was set, the other child clocks were miscalculated. The UART clock
    was recalculated using the PLL rate as the parent rate, resulting in a
    UART new_rate of double what it should be, and a UART which spewed forth
    garbage when the rate changes were propagated.

    Signed-off-by: James Hogan
    Cc: Thomas Abraham
    Cc: Tomasz Figa
    Cc: Max Schwarz
    Cc: # v3.16+
    Acked-by: Haojian Zhuang
    Signed-off-by: Michael Turquette

    James Hogan
     
  • There is a duplication in a clock name for apq8084 platform that causes
    the following warning: "RBCPR_CLK_SRC" redefined

    Resolve this by adding a MMSS_ prefix to this clock and making its name
    coherent with msm8974 platform.

    Fixes: 2b46cd23a5a2 ("clk: qcom: Add APQ8084 Multimedia Clock Controller (MMCC) support")
    Signed-off-by: Georgi Djakov
    Reviewed-by: Stephen Boyd
    Signed-off-by: Michael Turquette

    Georgi Djakov
     
  • …cm', 'asoc/fix/es8328', 'asoc/fix/fsl-asrc', 'asoc/fix/max98090', 'asoc/fix/rcar', 'asoc/fix/rockchip' and 'asoc/fix/rt5645' into asoc-linus

    Mark Brown
     

17 Nov, 2014

3 commits

  • Pull ARM SoC fixes from Olof Johansson:
    "Another small set of fixes:

    - some DT compatible typo fixes
    - irq setup fix dealing with irq storms on orion
    - i2c quirk generalization for mvebu
    - a handful of smaller fixes for OMAP
    - a couple of added file patterns for OMAP entries in MAINTAINERS"

    * tag 'armsoc-for-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
    ARM: at91/dt: Fix sama5d3x typos
    pinctrl: dra: dt-bindings: Fix output pull up/down
    MAINTAINERS: Update entry for omap related .dts files to cover new SoCs
    MAINTAINERS: add more files under OMAP SUPPORT
    ARM: dts: AM437x-SK-EVM: Fix DCDC3 voltage
    ARM: dts: AM437x-GP-EVM: Fix DCDC3 voltage
    ARM: dts: AM43x-EPOS-EVM: Fix DCDC3 voltage
    ARM: dts: am335x-evm: Fix 5th NAND partition's name
    ARM: orion: Fix for certain sequence of request_irq can cause irq storm
    ARM: mvebu: armada xp: Generalize use of i2c quirk

    Linus Torvalds
     
  • …ernel/git/tmlind/linux-omap into fixes

    Merge "omap fixes against v3.18-rc4" from Tony Lindgren:

    Few omap fixes for hangs and wrong pinctrl defines, and update
    MAINTAINERS file to avoid missing PMIC and SoC related patches:

    - Fix random hangs on am437x because of incorrect default
    value for the DDR regulator

    - Fix wrong partition name for NAND on am335x-evm

    - Fix wrong pinctrl defines for dra7xx

    - Update maintainers entries for PMICs and SoCs

    * tag 'omap-fixes-against-v3.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
    pinctrl: dra: dt-bindings: Fix output pull up/down
    MAINTAINERS: Update entry for omap related .dts files to cover new SoCs
    MAINTAINERS: add more files under OMAP SUPPORT
    ARM: dts: AM437x-SK-EVM: Fix DCDC3 voltage
    ARM: dts: AM437x-GP-EVM: Fix DCDC3 voltage
    ARM: dts: AM43x-EPOS-EVM: Fix DCDC3 voltage
    ARM: dts: am335x-evm: Fix 5th NAND partition's name

    Signed-off-by: Olof Johansson <olof@lixom.net>

    Olof Johansson
     
  • Pablo Neira Ayuso says:

    ====================
    Netfilter/IPVS fixes for net

    The following patchset contains Netfilter updates for your net tree,
    they are:

    1) Fix missing initialization of the range structure (allocated in the
    stack) in nft_masq_{ipv4, ipv6}_eval, from Daniel Borkmann.

    2) Make sure the data we receive from userspace contains the req_version
    structure, otherwise return an error incomplete on truncated input.
    From Dan Carpenter.

    3) Fix handling og skb->sk which may cause incorrect handling
    of connections from a local process. Via Simon Horman, patch from
    Calvin Owens.

    4) Fix wrong netns in nft_compat when setting target and match params
    structure.

    5) Relax chain type validation in nft_compat that was recently included,
    this broke the matches that need to be run from the route chain type.
    Now iptables-test.py automated regression tests report success again
    and we avoid the only possible problematic case, which is the use of
    nat targets out of nat chain type.

    6) Use match->table to validate the tablename, instead of the match->name.
    Again patch for nft_compat.

    7) Restore the synchronous release of objects from the commit and abort
    path in nf_tables. This is causing two major problems: splats when using
    nft_compat, given that matches and targets may sleep and call_rcu is
    invoked from softirq context. Moreover Patrick reported possible event
    notification reordering when rules refer to anonymous sets.

    8) Fix race condition in between packets that are being confirmed by
    conntrack and the ctnetlink flush operation. This happens since the
    removal of the central spinlock. Thanks to Jesper D. Brouer to looking
    into this.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

16 Nov, 2014

5 commits

  • While looking over the cpu-timer code I found that we appear to add
    the delta for the calling task twice, through:

    cpu_timer_sample_group()
    thread_group_cputimer()
    thread_group_cputime()
    times->sum_exec_runtime += task_sched_runtime();

    *sample = cputime.sum_exec_runtime + task_delta_exec();

    Which would make the sample run ahead, making the sleep short.

    Signed-off-by: Peter Zijlstra (Intel)
    Cc: KOSAKI Motohiro
    Cc: Oleg Nesterov
    Cc: Stanislaw Gruszka
    Cc: Christoph Lameter
    Cc: Frederic Weisbecker
    Cc: Linus Torvalds
    Cc: Rik van Riel
    Cc: Tejun Heo
    Link: http://lkml.kernel.org/r/20141112113737.GI10476@twins.programming.kicks-ass.net
    Signed-off-by: Ingo Molnar

    Peter Zijlstra
     
  • On some 32 bits architectures, including x86, GENMASK(31, 0) returns 0
    instead of the expected ~0UL.

    This is the same on some 64 bits architectures with GENMASK_ULL(63, 0).

    This is due to an overflow in the shift operand, 1 << 32 for GENMASK,
    1 << 64 for GENMASK_ULL.

    Reported-by: Eric Paire
    Suggested-by: Rasmus Villemoes
    Signed-off-by: Maxime Coquelin
    Signed-off-by: Peter Zijlstra (Intel)
    Cc: # v3.13+
    Cc: linux@rasmusvillemoes.dk
    Cc: gong.chen@linux.intel.com
    Cc: John Sullivan
    Cc: Linus Torvalds
    Cc: Paul E. McKenney
    Cc: Theodore Ts'o
    Fixes: 10ef6b0dffe4 ("bitops: Introduce a more generic BITMASK macro")
    Link: http://lkml.kernel.org/r/1415267659-10563-1-git-send-email-maxime.coquelin@st.com
    Signed-off-by: Ingo Molnar

    Maxime COQUELIN
     
  • Pull power supply updates from Sebastian Reichel:
    "Power supply and reset changes for the v3.18-rc:

    - misc. charger-manager fixes
    - year 2038 fix in ab8500_fg
    - fix error handling of bq2415x_charger"

    * tag 'for-v3.18-rc' of git://git.infradead.org/battery-2.6:
    power: charger-manager: Fix accessing invalidated power supply after charger unbind
    power: charger-manager: Fix accessing invalidated power supply after fuel gauge unbind
    power: charger-manager: Avoid recursive thermal get_temp call
    power_supply: Add no_thermal property to prevent recursive get_temp calls
    power: bq2415x_charger: Fix memory leak on DTS parsing error
    power: bq2415x_charger: Properly handle ENODEV from power_supply_get_by_phandle
    power: ab8500_fg.c: use 64-bit time types

    Linus Torvalds
     
  • Pull NFS client bugfixes from Trond Myklebust:
    "Highlights include:

    - stable patches to fix NFSv4.x delegation reclaim error paths
    - fix a bug whereby we were advertising NFSv4.1 but using NFSv4.2
    features
    - fix a use-after-free problem with pNFS block layouts
    - fix a memory leak in the pNFS files O_DIRECT code
    - replace an intrusive and Oops-prone performance fix in the NFSv4
    atomic open code with a safer one-line version and revert the two
    original patches"

    * tag 'nfs-for-3.18-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
    sunrpc: fix sleeping under rcu_read_lock in gss_stringify_acceptor
    NFS: Don't try to reclaim delegation open state if recovery failed
    NFSv4: Ensure that we call FREE_STATEID when NFSv4.x stateids are revoked
    NFSv4: Fix races between nfs_remove_bad_delegation() and delegation return
    NFSv4.1: nfs41_clear_delegation_stateid shouldn't trust NFS_DELEGATED_STATE
    NFSv4: Ensure that we remove NFSv4.0 delegations when state has expired
    NFS: SEEK is an NFS v4.2 feature
    nfs: Fix use of uninitialized variable in nfs_getattr()
    nfs: Remove bogus assignment
    nfs: remove spurious WARN_ON_ONCE in write path
    pnfs/blocklayout: serialize GETDEVICEINFO calls
    nfs: fix pnfs direct write memory leak
    Revert "NFS: nfs4_do_open should add negative results to the dcache."
    Revert "NFS: remove BUG possibility in nfs4_open_and_get_state"
    NFSv4: Ensure nfs_atomic_open set the dentry verifier on ENOENT

    Linus Torvalds
     
  • The direction field is set on 7 bits, thus we need to AND it with 0111 111 mask
    in order to retrieve it, that is 0x7F, not 0xCF as it is now.

    Fixes: ade7ef7ba (staging:iio: Differential channel handling)
    Signed-off-by: Cristina Ciocan
    Cc:
    Signed-off-by: Jonathan Cameron

    Cristina Ciocan
     

15 Nov, 2014

3 commits

  • Most NICs that report NETIF_F_GSO_UDP_TUNNEL support VXLAN, and not
    other UDP-based encapsulation protocols where the format and size of the
    header differs. This patch implements a generic ndo_gso_check() for
    VXLAN which will only advertise GSO support when the skb looks like it
    contains VXLAN (or no UDP tunnelling at all).

    Implementation shamelessly stolen from Tom Herbert:
    http://thread.gmane.org/gmane.linux.network/332428/focus=333111

    Signed-off-by: Joe Stringer
    Signed-off-by: David S. Miller

    Joe Stringer
     
  • There could be a signed overflow in the following code.

    The expression, (32-logmask) is comprised between 0 and 31 included.
    It may be equal to 31.
    In such a case the left shift will produce a signed integer overflow.
    According to the C99 Standard, this is an undefined behavior.
    A simple fix is to replace the signed int 1 with the unsigned int 1U.

    Signed-off-by: Vincent BENAYOUN
    Signed-off-by: David S. Miller

    Vincent BENAYOUN
     
  • Pull ACPI and power management fixes from Rafael Wysocki:
    "These are three regression fixes, two recent (generic power domains,
    suspend-to-idle) and one older (cpufreq), an ACPI blacklist entry for
    one more machine having problems with Windows 8 compatibility, a minor
    cpufreq driver fix (cpufreq-dt) and a fixup for new callback
    definitions (generic power domains).

    Specifics:

    - Fix a crash in the suspend-to-idle code path introduced by a recent
    commit that forgot to check a pointer against NULL before
    dereferencing it (Dmitry Eremin-Solenikov).

    - Fix a boot crash on Exynos5 introduced by a recent commit making
    that platform use generic Device Tree bindings for power domains
    which exposed a weakness in the generic power domains framework
    leading to that crash (Ulf Hansson).

    - Fix a crash during system resume on systems where cpufreq depends
    on Operation Performance Points (OPP) for functionality, but
    CONFIG_OPP is not set. This leads the cpufreq driver registration
    to fail, but the resume code attempts to restore the pre-suspend
    cpufreq configuration (which does not exist) nevertheless and
    crashes. From Geert Uytterhoeven.

    - Add a new ACPI blacklist entry for Dell Vostro 3546 that has
    problems if it is reported as Windows 8 compatible to the BIOS
    (Adam Lee).

    - Fix swapped arguments in an error message in the cpufreq-dt driver
    (Abhilash Kesavan).

    - Fix up the prototypes of new callbacks in struct generic_pm_domain
    to make them more useful. Users of those callbacks will be added
    in 3.19 and it's better for them to be based on the correct struct
    definition in mainline from the start. From Ulf Hansson and Kevin
    Hilman"

    * tag 'pm+acpi-3.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
    PM / Domains: Fix initial default state of the need_restore flag
    PM / sleep: Fix entering suspend-to-IDLE if no freeze_oops is set
    PM / Domains: Change prototype for the attach and detach callbacks
    cpufreq: Avoid crash in resume on SMP without OPP
    cpufreq: cpufreq-dt: Fix arguments in clock failure error message
    ACPI / blacklist: blacklist Win8 OSI for Dell Vostro 3546

    Linus Torvalds
     

14 Nov, 2014

4 commits

  • * pm-domains:
    PM / Domains: Fix initial default state of the need_restore flag
    PM / Domains: Change prototype for the attach and detach callbacks

    * pm-sleep:
    PM / sleep: Fix entering suspend-to-IDLE if no freeze_oops is set

    * pm-cpufreq:
    cpufreq: Avoid crash in resume on SMP without OPP
    cpufreq: cpufreq-dt: Fix arguments in clock failure error message

    Rafael J. Wysocki
     
  • Pull networking fixes from David Miller:

    1) sunhme driver lacks DMA mapping error checks, based upon a report by
    Meelis Roos.

    2) Fix memory leak in mvpp2 driver, from Sudip Mukherjee.

    3) DMA memory allocation sizes are wrong in systemport ethernet driver,
    fix from Florian Fainelli.

    4) Fix use after free in mac80211 defragmentation code, from Johannes
    Berg.

    5) Some networking uapi headers missing from Kbuild file, from Stephen
    Hemminger.

    6) TUN driver gets csum_start offset wrong when VLAN accel is enabled,
    and macvtap has a similar bug, from Herbert Xu.

    7) Adjust several tunneling drivers to set dev->iflink after registry,
    because registry sets that to -1 overwriting whatever we did. From
    Steffen Klassert.

    8) Geneve forgets to set inner tunneling type, causing GSO segmentation
    to fail on some NICs. From Jesse Gross.

    9) Fix several locking bugs in stmmac driver, from Fabrice Gasnier and
    Giuseppe CAVALLARO.

    10) Fix spurious timeouts with NewReno on low traffic connections, from
    Marcelo Leitner.

    11) Fix descriptor updates in enic driver, from Govindarajulu
    Varadarajan.

    12) PPP calls bpf_prog_create() with locks held, which isn't kosher.
    Fix from Takashi Iwai.

    13) Fix NULL deref in SCTP with malformed INIT packets, from Daniel
    Borkmann.

    14) psock_fanout selftest accesses past the end of the mmap ring, fix
    from Shuah Khan.

    15) Fix PTP timestamping for VLAN packets, from Richard Cochran.

    16) netlink_unbind() calls in netlink pass wrong initial argument, from
    Hiroaki SHIMODA.

    17) vxlan socket reuse accidently reuses a socket when the address
    family is different, so we have to explicitly check this, from
    Marcelo Lietner.

    18) Fix missing include in nft_reject_bridge.c breaking the build on ppc
    and other architectures, from Guenter Roeck.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (75 commits)
    vxlan: Do not reuse sockets for a different address family
    smsc911x: power-up phydev before doing a software reset.
    lib: rhashtable - Remove weird non-ASCII characters from comments
    net/smsc911x: Fix delays in the PHY enable/disable routines
    net/smsc911x: Fix rare soft reset timeout issue due to PHY power-down mode
    netlink: Properly unbind in error conditions.
    net: ptp: fix time stamp matching logic for VLAN packets.
    cxgb4 : dcb open-lldp interop fixes
    selftests/net: psock_fanout seg faults in sock_fanout_read_ring()
    net: bcmgenet: apply MII configuration in bcmgenet_open()
    net: bcmgenet: connect and disconnect from the PHY state machine
    net: qualcomm: Fix dependency
    ixgbe: phy: fix uninitialized status in ixgbe_setup_phy_link_tnx
    net: phy: Correctly handle MII ioctl which changes autonegotiation.
    ipv6: fix IPV6_PKTINFO with v4 mapped
    net: sctp: fix memory leak in auth key management
    net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet
    net: ppp: Don't call bpf_prog_create() in ppp_lock
    net/mlx4_en: Advertize encapsulation offloads features only when VXLAN tunnel is set
    cxgb4 : Fix bug in DCB app deletion
    ...

    Linus Torvalds
     
  • In free_area_init_core(), zone->managed_pages is set to an approximate
    value for lowmem, and will be adjusted when the bootmem allocator frees
    pages into the buddy system.

    But free_area_init_core() is also called by hotadd_new_pgdat() when
    hot-adding memory. As a result, zone->managed_pages of the newly added
    node's pgdat is set to an approximate value in the very beginning.

    Even if the memory on that node has node been onlined,
    /sys/device/system/node/nodeXXX/meminfo has wrong value:

    hot-add node2 (memory not onlined)
    cat /sys/device/system/node/node2/meminfo
    Node 2 MemTotal: 33554432 kB
    Node 2 MemFree: 0 kB
    Node 2 MemUsed: 33554432 kB
    Node 2 Active: 0 kB

    This patch fixes this problem by reset node managed pages to 0 after
    hot-adding a new node.

    1. Move reset_managed_pages_done from reset_node_managed_pages() to
    reset_all_zones_managed_pages()
    2. Make reset_node_managed_pages() non-static
    3. Call reset_node_managed_pages() in hotadd_new_pgdat() after pgdat
    is initialized

    Signed-off-by: Tang Chen
    Signed-off-by: Yasuaki Ishimatsu
    Cc: [3.16+]
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Tang Chen
     
  • Before describing bugs itself, I first explain definition of freepage.

    1. pages on buddy list are counted as freepage.
    2. pages on isolate migratetype buddy list are *not* counted as freepage.
    3. pages on cma buddy list are counted as CMA freepage, too.

    Now, I describe problems and related patch.

    Patch 1: There is race conditions on getting pageblock migratetype that
    it results in misplacement of freepages on buddy list, incorrect
    freepage count and un-availability of freepage.

    Patch 2: Freepages on pcp list could have stale cached information to
    determine migratetype of buddy list to go. This causes misplacement of
    freepages on buddy list and incorrect freepage count.

    Patch 4: Merging between freepages on different migratetype of
    pageblocks will cause freepages accouting problem. This patch fixes it.

    Without patchset [3], above problem doesn't happens on my CMA allocation
    test, because CMA reserved pages aren't used at all. So there is no
    chance for above race.

    With patchset [3], I did simple CMA allocation test and get below
    result:

    - Virtual machine, 4 cpus, 1024 MB memory, 256 MB CMA reservation
    - run kernel build (make -j16) on background
    - 30 times CMA allocation(8MB * 30 = 240MB) attempts in 5 sec interval
    - Result: more than 5000 freepage count are missed

    With patchset [3] and this patchset, I found that no freepage count are
    missed so that I conclude that problems are solved.

    On my simple memory offlining test, these problems also occur on that
    environment, too.

    This patch (of 4):

    There are two paths to reach core free function of buddy allocator,
    __free_one_page(), one is free_one_page()->__free_one_page() and the
    other is free_hot_cold_page()->free_pcppages_bulk()->__free_one_page().
    Each paths has race condition causing serious problems. At first, this
    patch is focused on first type of freepath. And then, following patch
    will solve the problem in second type of freepath.

    In the first type of freepath, we got migratetype of freeing page
    without holding the zone lock, so it could be racy. There are two cases
    of this race.

    1. pages are added to isolate buddy list after restoring orignal
    migratetype

    CPU1 CPU2

    get migratetype => return MIGRATE_ISOLATE
    call free_one_page() with MIGRATE_ISOLATE

    grab the zone lock
    unisolate pageblock
    release the zone lock

    grab the zone lock
    call __free_one_page() with MIGRATE_ISOLATE
    freepage go into isolate buddy list,
    although pageblock is already unisolated

    This may cause two problems. One is that we can't use this page anymore
    until next isolation attempt of this pageblock, because freepage is on
    isolate buddy list. The other is that freepage accouting could be wrong
    due to merging between different buddy list. Freepages on isolate buddy
    list aren't counted as freepage, but ones on normal buddy list are
    counted as freepage. If merge happens, buddy freepage on normal buddy
    list is inevitably moved to isolate buddy list without any consideration
    of freepage accouting so it could be incorrect.

    2. pages are added to normal buddy list while pageblock is isolated.
    It is similar with above case.

    This also may cause two problems. One is that we can't keep these
    freepages from being allocated. Although this pageblock is isolated,
    freepage would be added to normal buddy list so that it could be
    allocated without any restriction. And the other problem is same as
    case 1, that it, incorrect freepage accouting.

    This race condition would be prevented by checking migratetype again
    with holding the zone lock. Because it is somewhat heavy operation and
    it isn't needed in common case, we want to avoid rechecking as much as
    possible. So this patch introduce new variable, nr_isolate_pageblock in
    struct zone to check if there is isolated pageblock. With this, we can
    avoid to re-check migratetype in common case and do it only if there is
    isolated pageblock or migratetype is MIGRATE_ISOLATE. This solve above
    mentioned problems.

    Changes from v3:
    Add one more check in free_one_page() that checks whether migratetype is
    MIGRATE_ISOLATE or not. Without this, abovementioned case 1 could happens.

    Signed-off-by: Joonsoo Kim
    Acked-by: Minchan Kim
    Acked-by: Michal Nazarewicz
    Acked-by: Vlastimil Babka
    Cc: "Kirill A. Shutemov"
    Cc: Mel Gorman
    Cc: Johannes Weiner
    Cc: Yasuaki Ishimatsu
    Cc: Zhang Yanfei
    Cc: Tang Chen
    Cc: Naoya Horiguchi
    Cc: Bartlomiej Zolnierkiewicz
    Cc: Wen Congyang
    Cc: Marek Szyprowski
    Cc: Laura Abbott
    Cc: Heesub Shin
    Cc: "Aneesh Kumar K.V"
    Cc: Ritesh Harjani
    Cc: Gioh Kim
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Joonsoo Kim
     

13 Nov, 2014

1 commit

  • …it/rostedt/linux-trace

    Pull tracing fix from Steven Rostedt:
    "Rabin Vincent found a way that tracing could cause an infinite loop in
    the kernel. The splice logic wants a full page from the ring buffer
    but the ring_buffer_wait() returns when there's any data in the ring
    buffer. The splice code would then continue the loop waiting for a
    full page. But if a full page never happens, the splice code will
    never sleep and just continue to loop.

    There's another case that Rabin fixed that could loop if there's no
    memory and kmalloc() constantly returns NULL"

    * tag 'trace-fixes-v3.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
    tracing: Do not risk busy looping in buffer splice
    tracing: Do not busy wait in buffer splice

    Linus Torvalds