1. 19 Oct, 2014 7 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 5e2ee7cd
      Linus Torvalds authored
      Pull sparc fixes from David Miller:
       "Here we have two bug fixes:
      
        1) The current thread's fault_code is not setup properly upon entry to
           do_sparc64_fault() in some paths, leading to spurious SIGBUS.
      
        2) Don't use a zero length array at the end of thread_info on sparc64,
           otherwise end_of_stack() isn't right"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc64: Do not define thread fpregs save area as zero-length array.
        sparc64: Fix corrupted thread fault code.
      5e2ee7cd
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · e25b4927
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "A quick batch of bug fixes:
      
        1) Fix build with IPV6 disabled, from Eric Dumazet.
      
        2) Several more cases of caching SKB data pointers across calls to
           pskb_may_pull(), thus referencing potentially free'd memory.  From
           Li RongQing.
      
        3) DSA phy code tests operation presence improperly, instead of going:
      
              if (x->ops->foo)
                      r = x->ops->foo(args);
      
           it was going:
      
              if (x->ops->foo(args))
                      r = x->ops->foo(args);
      
         Fix from Andew Lunn"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        Net: DSA: Fix checking for get_phy_flags function
        ipv6: fix a potential use after free in sit.c
        ipv6: fix a potential use after free in ip6_offload.c
        ipv4: fix a potential use after free in gre_offload.c
        tcp: fix build error if IPv6 is not enabled
      e25b4927
    • Andrew Lunn's avatar
      Net: DSA: Fix checking for get_phy_flags function · 228b16cb
      Andrew Lunn authored
      The check for the presence or not of the optional switch function
      get_phy_flags() called the function, rather than checked to see if it
      is a NULL pointer. This causes a derefernce of a NULL pointer on all
      switch chips except the sf2, the only switch to implement this call.
      Signed-off-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Fixes: 6819563e ("net: dsa: allow switch drivers to specify phy_device::dev_flags")
      Cc: Florian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      228b16cb
    • David S. Miller's avatar
      sparc64: Do not define thread fpregs save area as zero-length array. · e2653143
      David S. Miller authored
      This breaks the stack end corruption detection facility.
      
      What that facility does it write a magic value to "end_of_stack()"
      and checking to see if it gets overwritten.
      
      "end_of_stack()" is "task_thread_info(p) + 1", which for sparc64 is
      the beginning of the FPU register save area.
      
      So once the user uses the FPU, the magic value is overwritten and the
      debug checks trigger.
      
      Fix this by making the size explicit.
      
      Due to the size we use for the fpsaved[], gsr[], and xfsr[] arrays we
      are limited to 7 levels of FPU state saves.  So each FPU register set
      is 256 bytes, allocate 256 * 7 for the fpregs area.
      Reported-by: default avatarMeelis Roos <mroos@linux.ee>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e2653143
    • David S. Miller's avatar
      sparc64: Fix corrupted thread fault code. · 84bd6d8b
      David S. Miller authored
      Every path that ends up at do_sparc64_fault() must install a valid
      FAULT_CODE_* bitmask in the per-thread fault code byte.
      
      Two paths leading to the label winfix_trampoline (which expects the
      FAULT_CODE_* mask in register %g4) were not doing so:
      
      1) For pre-hypervisor TLB protection violation traps, if we took
         the 'winfix_trampoline' path we wouldn't have %g4 initialized
         with the FAULT_CODE_* value yet.  Resulting in using the
         TLB_TAG_ACCESS register address value instead.
      
      2) In the TSB miss path, when we notice that we are going to use a
         hugepage mapping, but we haven't allocated the hugepage TSB yet, we
         still have to take the window fixup case into consideration and
         in that particular path we leave %g4 not setup properly.
      
      Errors on this sort were largely invisible previously, but after
      commit 4ccb9272 ("sparc64: sun4v TLB
      error power off events") we now have a fault_code mask bit
      (FAULT_CODE_BAD_RA) that triggers due to this bug.
      
      FAULT_CODE_BAD_RA triggers because this bit is set in TLB_TAG_ACCESS
      (see #1 above) and thus we get seemingly random bus errors triggered
      for user processes.
      
      Fixes: 4ccb9272 ("sparc64: sun4v TLB error power off events")
      Reported-by: default avatarMeelis Roos <mroos@linux.ee>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      84bd6d8b
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma · 52d589a0
      Linus Torvalds authored
      Pull slave-dmaengine updates from Vinod Koul:
       "For dmaengine contributions we have:
         - designware cleanup by Andy
         - my series moving device_control users to dmanegine_xxx APIs for
           later removal of device_control API
         - minor fixes spread over drivers mainly mv_xor, pl330, mmp, imx-sdma
           etc"
      
      * 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma: (60 commits)
        serial: atmel: add missing dmaengine header
        dmaengine: remove FSLDMA_EXTERNAL_START
        dmaengine: freescale: remove FSLDMA_EXTERNAL_START control method
        carma-fpga: move to fsl_dma_external_start()
        carma-fpga: use dmaengine_xxx() API
        dmaengine: freescale: add and export fsl_dma_external_start()
        dmaengine: add dmaengine_prep_dma_sg() helper
        video: mx3fb: use dmaengine_terminate_all() API
        serial: sh-sci: use dmaengine_terminate_all() API
        net: ks8842: use dmaengine_terminate_all() API
        mtd: sh_flctl: use dmaengine_terminate_all() API
        mtd: fsmc_nand: use dmaengine_terminate_all() API
        V4L2: mx3_camer: use dmaengine_pause() API
        dmaengine: coh901318: use dmaengine_terminate_all() API
        pata_arasan_cf: use dmaengine_terminate_all() API
        dmaengine: edma: check for echan->edesc => NULL in edma_dma_pause()
        dmaengine: dw: export probe()/remove() and Co to users
        dmaengine: dw: enable and disable controller when needed
        dmaengine: dw: always export dw_dma_{en,dis}able
        dmaengine: dw: introduce dw_dma_on() helper
        ...
      52d589a0
    • Linus Torvalds's avatar
      Merge tag 'fbdev-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux · 0a582821
      Linus Torvalds authored
      Pull fbdev updates from Tomi Valkeinen:
       - new 6x10 font
       - various small fixes and cleanups
      
      * tag 'fbdev-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: (30 commits)
        fonts: Add 6x10 font
        videomode: provide dummy inline functions for !CONFIG_OF
        video/atmel_lcdfb: Introduce regulator support
        fbdev: sh_mobile_hdmi: Re-init regs before irq re-enable on resume
        framebuffer: fix screen corruption when copying
        framebuffer: fix border color
        arm, fbdev, omap2, LLVMLinux: Remove nested function from omapfb
        arm, fbdev, omap2, LLVMLinux: Remove nested function from omap2 dss
        video: fbdev: valkyriefb.c: use container_of to resolve fb_info_valkyrie from fb_info
        video: fbdev: pxafb.c: use container_of to resolve pxafb_info/layer from fb_info
        video: fbdev: cyber2000fb.c: use container_of to resolve cfb_info from fb_info
        video: fbdev: controlfb.c: use container_of to resolve fb_info_control from fb_info
        video: fbdev: sa1100fb.c: use container_of to resolve sa1100fb_info from fb_info
        video: fbdev: stifb.c: use container_of to resolve stifb_info from fb_info
        video: fbdev: sis: sis_main.c: Cleaning up missing null-terminate in conjunction with strncpy
        video: valkyriefb: Fix unused variable warning in set_valkyrie_clock()
        video: fbdev: use %*ph specifier to dump small buffers
        video: mx3fb: always enable BACKLIGHT_LCD_SUPPORT
        video: fbdev: au1200fb: delete double assignment
        video: fbdev: sis: delete double assignment
        ...
      0a582821
  2. 18 Oct, 2014 33 commits
    • Linus Torvalds's avatar
      Merge tag 'kvm-arm-for-3.18-take-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm · 8a5de182
      Linus Torvalds authored
      Pull second batch of changes for KVM/{arm,arm64} from Marc Zyngier:
       "The most obvious thing is the sizeable MMU changes to support 48bit
        VAs on arm64.
      
        Summary:
      
         - support for 48bit IPA and VA (EL2)
         - a number of fixes for devices mapped into guests
         - yet another VGIC fix for BE
         - a fix for CPU hotplug
         - a few compile fixes (disabled VGIC, strict mm checks)"
      
      [ I'm pulling directly from Marc at the request of Paolo Bonzini, whose
        backpack was stolen at Düsseldorf airport and will do new keys and
        rebuild his web of trust.    - Linus ]
      
      * tag 'kvm-arm-for-3.18-take-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm:
        arm/arm64: KVM: Fix BE accesses to GICv2 EISR and ELRSR regs
        arm: kvm: STRICT_MM_TYPECHECKS fix for user_mem_abort
        arm/arm64: KVM: Ensure memslots are within KVM_PHYS_SIZE
        arm64: KVM: Implement 48 VA support for KVM EL2 and Stage-2
        arm/arm64: KVM: map MMIO regions at creation time
        arm64: kvm: define PAGE_S2_DEVICE as read-only by default
        ARM: kvm: define PAGE_S2_DEVICE as read-only by default
        arm/arm64: KVM: add 'writable' parameter to kvm_phys_addr_ioremap
        arm/arm64: KVM: fix potential NULL dereference in user_mem_abort()
        arm/arm64: KVM: use __GFP_ZERO not memset() to get zeroed pages
        ARM: KVM: fix vgic-disabled build
        arm: kvm: fix CPU hotplug
      8a5de182
    • Linus Torvalds's avatar
      Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus · 857b50f5
      Linus Torvalds authored
      Pull MIPS updates from Ralf Baechle:
       "This is the MIPS pull request for the next kernel:
      
         - Zubair's patch series adds CMA support for MIPS.  Doing so it also
           touches ARM64 and x86.
         - remove the last instance of IRQF_DISABLED from arch/mips
         - updates to two of the MIPS defconfig files.
         - cleanup of how cache coherency bits are handled on MIPS and
           implement support for write-combining.
         - platform upgrades for Alchemy
         - move MIPS DTS files to arch/mips/boot/dts/"
      
      * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (24 commits)
        MIPS: ralink: remove deprecated IRQF_DISABLED
        MIPS: pgtable.h: Implement the pgprot_writecombine function for MIPS
        MIPS: cpu-probe: Set the write-combine CCA value on per core basis
        MIPS: pgtable-bits: Define the CCA bit for WC writes on Ingenic cores
        MIPS: pgtable-bits: Move the CCA bits out of the core's ifdef blocks
        MIPS: DMA: Add cma support
        x86: use generic dma-contiguous.h
        arm64: use generic dma-contiguous.h
        asm-generic: Add dma-contiguous.h
        MIPS: BPF: Add new emit_long_instr macro
        MIPS: ralink: Move device-trees to arch/mips/boot/dts/
        MIPS: Netlogic: Move device-trees to arch/mips/boot/dts/
        MIPS: sead3: Move device-trees to arch/mips/boot/dts/
        MIPS: Lantiq: Move device-trees to arch/mips/boot/dts/
        MIPS: Octeon: Move device-trees to arch/mips/boot/dts/
        MIPS: Add support for building device-tree binaries
        MIPS: Create common infrastructure for building built-in device-trees
        MIPS: SEAD3: Enable DEVTMPFS
        MIPS: SEAD3: Regenerate defconfigs
        MIPS: Alchemy: DB1300: Add touch penirq support
        ...
      857b50f5
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux · 168f07a1
      Linus Torvalds authored
      Pull powerpc fix from Michael Ellerman:
       "There was a bit of a misunderstanding between us and the ARM guys in
        the device tree PCI code, which is breaking virtio on powerpc.
      
        This is the minimal fix until we can sort it out properly"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux:
        powerpc/pci: Fix IO space breakage after of_pci_range_to_resource() change
      168f07a1
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6 · 9272f2dc
      Linus Torvalds authored
      Pull cifs/smb3 updates from Steve French:
       "Improved SMB3 support (symlink and device emulation, and remapping by
        default the 7 reserved posix characters) and a workaround for cifs
        mounts to Mac (working around a commonly encountered Mac server bug)"
      
      * 'for-linus' of git://git.samba.org/sfrench/cifs-2.6:
        [CIFS] Remove obsolete comment
        Check minimum response length on query_network_interface
        Workaround Mac server problem
        Remap reserved posix characters by default (part 3/3)
        Allow conversion of characters in Mac remap range (part 2)
        Allow conversion of characters in Mac remap range. Part 1
        mfsymlinks support for SMB2.1/SMB3. Part 2 query symlink
        Add mfsymlinks support for SMB2.1/SMB3. Part 1 create symlink
        Allow mknod and mkfifo on SMB2/SMB3 mounts
        add defines for two new file attributes
      9272f2dc
    • Linus Torvalds's avatar
      Merge tag 'dlm-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm · e83e4323
      Linus Torvalds authored
      Pull dlm fix from David Teigland:
       "This includes a single commit fixing a missing endian conversion"
      
      * tag 'dlm-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm:
        dlm: fix missing endian conversion of rcom_status flags
      e83e4323
    • Linus Torvalds's avatar
      Merge branch 'for-linus-update' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · ef161ea1
      Linus Torvalds authored
      Pull btrfs data corruption fix from Chris Mason:
       "I'm testing a pull with more fixes, but wanted to get this one out so
        Greg can pick it up.
      
        The corruption isn't easy to hit, you have to do a readonly snapshot
        and have orphans in the snapshot.  But my review and testing missed
        the bug.  Filipe has added a better xfstest to cover it"
      
      * 'for-linus-update' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Revert "Btrfs: race free update of commit root for ro snapshots"
      ef161ea1
    • Linus Torvalds's avatar
      Merge tag 'please-pull-pstore' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux · 8ccf863f
      Linus Torvalds authored
      Pull pstore fix from Tony Luck:
       "Ensure unique filenames in pstore"
      
      * tag 'please-pull-pstore' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux:
        pstore: Fix duplicate {console,ftrace}-efi entries
      8ccf863f
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/aia21/ntfs · 4869447d
      Linus Torvalds authored
      Pull NTFS update from Anton Altaparmakov:
       "Here is a small NTFS update notably implementing FIBMAP ioctl for NTFS
        by adding the bmap address space operation.  People seem to still want
        FIBMAP"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/aia21/ntfs:
        NTFS: Bump version to 2.1.31.
        NTFS: Add bmap address space operation needed for FIBMAP ioctl.
        NTFS: Remove changelog from Documentation/filesystems/ntfs.txt.
        NTFS: Split ntfs_aops into ntfs_normal_aops and ntfs_compressed_aops in preparation for them diverging.
      4869447d
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-3.18-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · ead13aee
      Linus Torvalds authored
      Pull NFS client updates from Trond Myklebust:
       "Highlights include:
      
        Stable fixes:
         - fix an uninitialised pointer Oops in the writeback error path
         - fix a bogus warning (and early exit from the loop) in nfs_generic_pgio()
      
        Features:
         - Add NFSv4.2 SEEK feature and client support for lseek(SEEK_HOLE/SEEK_DATA)
      
        Other fixes:
         - pnfs: replace broken pnfs_put_lseg_async
         - Remove dead prototype for nfs4_insert_deviceid_node"
      
      * tag 'nfs-for-3.18-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        NFS: Fix a bogus warning in nfs_generic_pgio
        NFS: Fix an uninitialised pointer Oops in the writeback error path
        NFSv4.1/pnfs: replace broken pnfs_put_lseg_async
        NFSv4: Remove dead prototype for nfs4_insert_deviceid_node()
        NFS: Implement SEEK
      ead13aee
    • Linus Torvalds's avatar
      Merge tag 'dm-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm · 929254d8
      Linus Torvalds authored
      Pull device-mapper updates from Mike Snitzer:
       "I rebased the DM tree ontop of linux-block.git's 'for-3.18/core' at
        the beginning of October because DM core now depends on the newly
        introduced bioset_create_nobvec() interface.
      
        Summary:
      
         - fix DM's long-standing excessive use of memory by leveraging the
           new bioset_create_nobvec() interface when creating the DM's bioset
      
         - fix a few bugs in dm-bufio and dm-log-userspace
      
         - add DM core support for a DM multipath use-case that requires
           loading DM tables that contain devices that have failed (by
           allowing active and inactive DM tables to share dm_devs)
      
         - add discard support to the DM raid target; like MD raid456 the user
           must opt-in to raid456 discard support be specifying the
           devices_handle_discard_safely=Y module param"
      
      * tag 'dm-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm log userspace: fix memory leak in dm_ulog_tfr_init failure path
        dm bufio: when done scanning return from __scan immediately
        dm bufio: update last_accessed when relinking a buffer
        dm raid: add discard support for RAID levels 4, 5 and 6
        dm raid: add discard support for RAID levels 1 and 10
        dm: allow active and inactive tables to share dm_devs
        dm mpath: stop queueing IO when no valid paths exist
        dm: use bioset_create_nobvec()
        dm: remove nr_iovecs parameter from alloc_tio()
      929254d8
    • Linus Torvalds's avatar
      Merge branch 'for-3.18/drivers' of git://git.kernel.dk/linux-block · e75437fb
      Linus Torvalds authored
      Pull block layer driver update from Jens Axboe:
       "This is the block driver pull request for 3.18.  Not a lot in there
        this round, and nothing earth shattering.
      
         - A round of drbd fixes from the linbit team, and an improvement in
           asender performance.
      
         - Removal of deprecated (and unused) IRQF_DISABLED flag in rsxx and
           hd from Michael Opdenacker.
      
         - Disable entropy collection from flash devices by default, from Mike
           Snitzer.
      
         - A small collection of xen blkfront/back fixes from Roger Pau Monné
           and Vitaly Kuznetsov"
      
      * 'for-3.18/drivers' of git://git.kernel.dk/linux-block:
        block: disable entropy contributions for nonrot devices
        xen, blkfront: factor out flush-related checks from do_blkif_request()
        xen-blkback: fix leak on grant map error path
        xen/blkback: unmap all persistent grants when frontend gets disconnected
        rsxx: Remove deprecated IRQF_DISABLED
        block: hd: remove deprecated IRQF_DISABLED
        drbd: use RB_DECLARE_CALLBACKS() to define augment callbacks
        drbd: compute the end before rb_insert_augmented()
        drbd: Add missing newline in resync progress display in /proc/drbd
        drbd: reduce lock contention in drbd_worker
        drbd: Improve asender performance
        drbd: Get rid of the WORK_PENDING macro
        drbd: Get rid of the __no_warn and __cond_lock macros
        drbd: Avoid inconsistent locking warning
        drbd: Remove superfluous newline from "resync_extents" debugfs entry.
        drbd: Use consistent names for all the bi_end_io callbacks
        drbd: Use better variable names
      e75437fb
    • Linus Torvalds's avatar
      Merge branch 'for-3.18/core' of git://git.kernel.dk/linux-block · d3dc366b
      Linus Torvalds authored
      Pull core block layer changes from Jens Axboe:
       "This is the core block IO pull request for 3.18.  Apart from the new
        and improved flush machinery for blk-mq, this is all mostly bug fixes
        and cleanups.
      
         - blk-mq timeout updates and fixes from Christoph.
      
         - Removal of REQ_END, also from Christoph.  We pass it through the
           ->queue_rq() hook for blk-mq instead, freeing up one of the request
           bits.  The space was overly tight on 32-bit, so Martin also killed
           REQ_KERNEL since it's no longer used.
      
         - blk integrity updates and fixes from Martin and Gu Zheng.
      
         - Update to the flush machinery for blk-mq from Ming Lei.  Now we
           have a per hardware context flush request, which both cleans up the
           code should scale better for flush intensive workloads on blk-mq.
      
         - Improve the error printing, from Rob Elliott.
      
         - Backing device improvements and cleanups from Tejun.
      
         - Fixup of a misplaced rq_complete() tracepoint from Hannes.
      
         - Make blk_get_request() return error pointers, fixing up issues
           where we NULL deref when a device goes bad or missing.  From Joe
           Lawrence.
      
         - Prep work for drastically reducing the memory consumption of dm
           devices from Junichi Nomura.  This allows creating clone bio sets
           without preallocating a lot of memory.
      
         - Fix a blk-mq hang on certain combinations of queue depths and
           hardware queues from me.
      
         - Limit memory consumption for blk-mq devices for crash dump
           scenarios and drivers that use crazy high depths (certain SCSI
           shared tag setups).  We now just use a single queue and limited
           depth for that"
      
      * 'for-3.18/core' of git://git.kernel.dk/linux-block: (58 commits)
        block: Remove REQ_KERNEL
        blk-mq: allocate cpumask on the home node
        bio-integrity: remove the needless fail handle of bip_slab creating
        block: include func name in __get_request prints
        block: make blk_update_request print prefix match ratelimited prefix
        blk-merge: don't compute bi_phys_segments from bi_vcnt for cloned bio
        block: fix alignment_offset math that assumes io_min is a power-of-2
        blk-mq: Make bt_clear_tag() easier to read
        blk-mq: fix potential hang if rolling wakeup depth is too high
        block: add bioset_create_nobvec()
        block: use bio_clone_fast() in blk_rq_prep_clone()
        block: misplaced rq_complete tracepoint
        sd: Honor block layer integrity handling flags
        block: Replace strnicmp with strncasecmp
        block: Add T10 Protection Information functions
        block: Don't merge requests if integrity flags differ
        block: Integrity checksum flag
        block: Relocate bio integrity flags
        block: Add a disk flag to block integrity profile
        block: Add prefix to block integrity profile flags
        ...
      d3dc366b
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20141015' of git://git.infradead.org/linux-mtd · 511c41d9
      Linus Torvalds authored
      Pull MTD update from Brian Norris:
       "Sorry for delaying this a bit later than usual.  There's one mild
        regression from 3.16 that was noticed during the 3.17 cycle, and I
        meant to send a fix for it along with this pull request.  I'll
        probably try to queue it up for a later pull request once I've had a
        better look at it, hopefully by -rc2 at the latest.
      
        Summary for this pull:
      
        NAND
         - Cleanup for Denali driver
         - Atmel: add support for new page sizes
         - Atmel: fix up 'raw' mode support
         - Atmel: miscellaneous cleanups
         - New timing mode helpers for non-ONFI NAND
         - OMAP: allow driver to be (properly) built as a module
         - bcm47xx: RESET support and other cleanups
      
        SPI NOR
         - Miscellaneous cleanups, to prepare framework for wider use (some
           further work still pending)
         - Compile-time configuration to select 4K vs.  64K support for flash
           that support both (necessary for using UBIFS on some SPI NOR)
      
        A few scattered code quality fixes, detected by Coverity
      
        See the changesets for more"
      
      * tag 'for-linus-20141015' of git://git.infradead.org/linux-mtd: (59 commits)
        mtd: nand: omap: Correct CONFIG_MTD_NAND_OMAP_BCH help message
        mtd: nand: Force omap_elm to be built as a module if omap2_nand is a module
        mtd: move support for struct flash_platform_data into m25p80
        mtd: spi-nor: add Kconfig option to disable 4K sectors
        mtd: nand: Move ELM driver and rename as omap_elm
        nand: omap2: Replace pr_err with dev_err
        nand: omap2: Remove horrible ifdefs to fix module probe
        mtd: nand: add Hynix's H27UCG8T2ATR-BC to nand_ids table
        mtd: nand: support ONFI timing mode retrieval for non-ONFI NANDs
        mtd: physmap_of: Add non-obsolete map_rom probe
        mtd: physmap_of: Fix ROM support via OF
        MAINTAINERS: add l2-mtd.git, 'next' tree for MTD
        mtd: denali: fix indents and other trivial things
        mtd: denali: remove unnecessary parentheses
        mtd: denali: remove another set-but-unused variable
        mtd: denali: fix include guard and license block of denali.h
        mtd: nand: don't break long print messages
        mtd: bcm47xxnflash: replace some magic numbers
        mtd: bcm47xxnflash: NAND_CMD_RESET support
        mtd: bcm47xxnflash: add cmd_ctrl handler
        ...
      511c41d9
    • Linus Torvalds's avatar
      Merge tag 'md/3.18' of git://neil.brown.name/md · 88ed806a
      Linus Torvalds authored
      Pull md updates from Neil Brown:
       - a few minor bug fixes
       - quite a lot of code tidy-up and simplification
       - remove PRINT_RAID_DEBUG ioctl.  I'm fairly sure it is unused, and it
         isn't particularly useful.
      
      * tag 'md/3.18' of git://neil.brown.name/md: (21 commits)
        lib/raid6: Add log level to printks
        md: move EXPORT_SYMBOL to after function in md.c
        md: discard PRINT_RAID_DEBUG ioctl
        md: remove MD_BUG()
        md: clean up 'exit' labels in md_ioctl().
        md: remove unnecessary test for MD_MAJOR in md_ioctl()
        md: don't allow "-sync" to be set for device in an active array.
        md: remove unwanted white space from md.c
        md: don't start resync thread directly from md thread.
        md: Just use RCU when checking for overlap between arrays.
        md: avoid potential long delay under pers_lock
        md: simplify export_array()
        md: discard find_rdev_nr in favour of find_rdev_nr_rcu
        md: use wait_event() to simplify md_super_wait()
        md: be more relaxed about stopping an array which isn't started.
        md/raid1: process_checks doesn't use its return value.
        md/raid5: fix init_stripe() inconsistencies
        md/raid10: another memory leak due to reshape.
        md: use set_bit/clear_bit instead of shift/mask for bi_flags changes.
        md/raid1: minor typos and reformatting.
        ...
      88ed806a
    • Linus Torvalds's avatar
      Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security · e56d9fcc
      Linus Torvalds authored
      Pull selinux fix from James Morris:
       "Fix for a list corruption bug in the SELinux code"
      
      * 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
        selinux: fix inode security list corruption
      e56d9fcc
    • Linus Torvalds's avatar
      Merge tag 'virtio-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux · 0e6e58f9
      Linus Torvalds authored
      Pull virtio updates from Rusty Russell:
       "One cc: stable commit, the rest are a series of minor cleanups which
        have been sitting in MST's tree during my vacation.  I changed a
        function name and made one trivial change, then they spent two days in
        linux-next"
      
      * tag 'virtio-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: (25 commits)
        virtio-rng: refactor probe error handling
        virtio_scsi: drop scan callback
        virtio_balloon: enable VQs early on restore
        virtio_scsi: fix race on device removal
        virito_scsi: use freezable WQ for events
        virtio_net: enable VQs early on restore
        virtio_console: enable VQs early on restore
        virtio_scsi: enable VQs early on restore
        virtio_blk: enable VQs early on restore
        virtio_scsi: move kick event out from virtscsi_init
        virtio_net: fix use after free on allocation failure
        9p/trans_virtio: enable VQs early
        virtio_console: enable VQs early
        virtio_blk: enable VQs early
        virtio_net: enable VQs early
        virtio: add API to enable VQs early
        virtio_net: minor cleanup
        virtio-net: drop config_mutex
        virtio_net: drop config_enable
        virtio-blk: drop config_mutex
        ...
      0e6e58f9
    • Linus Torvalds's avatar
      Merge tag 'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux · 50edb5cc
      Linus Torvalds authored
      Pull module fix from Rusty Russell:
       "A single panic fix for a rare race, stable CC'd"
      
      * tag 'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
        modules, lock around setting of MODULE_STATE_UNFORMED
      50edb5cc
    • Jonathan Corbet's avatar
      MAINTAINERS: Become the docs maintainer · ad3118b9
      Jonathan Corbet authored
      It seems it's my turn to be the documentation maintainer for a bit.  My
      plan is to work to ensure that docs patches don't fall through the cracks;
      I assume most changes will continue to flow through subsystem-specific
      trees.
      Acked-by: default avatarJiri Kosina <jkosina@suse.cz>
      Signed-off-by: default avatarJonathan Corbet <corbet@lwn.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ad3118b9
    • Andy Lutomirski's avatar
      x86,kvm,vmx: Preserve CR4 across VM entry · d974baa3
      Andy Lutomirski authored
      CR4 isn't constant; at least the TSD and PCE bits can vary.
      
      TBH, treating CR0 and CR3 as constant scares me a bit, too, but it looks
      like it's correct.
      
      This adds a branch and a read from cr4 to each vm entry.  Because it is
      extremely likely that consecutive entries into the same vcpu will have
      the same host cr4 value, this fixes up the vmcs instead of restoring cr4
      after the fact.  A subsequent patch will add a kernel-wide cr4 shadow,
      reducing the overhead in the common case to just two memory reads and a
      branch.
      Signed-off-by: default avatarAndy Lutomirski <luto@amacapital.net>
      Acked-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      Cc: stable@vger.kernel.org
      Cc: Petr Matousek <pmatouse@redhat.com>
      Cc: Gleb Natapov <gleb@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d974baa3
    • Li RongQing's avatar
      ipv6: fix a potential use after free in sit.c · a6d4518d
      Li RongQing authored
      pskb_may_pull() maybe change skb->data and make iph pointer oboslete,
      fix it by geting ip header length directly.
      
      Fixes: ca15a078 (sit: generate icmpv6 error when receiving icmpv4 error)
      Cc: Oussama Ghorbel <ghorbel@pivasoftware.com>
      Signed-off-by: default avatarLi RongQing <roy.qing.li@gmail.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a6d4518d
    • Li RongQing's avatar
      ipv6: fix a potential use after free in ip6_offload.c · fc6fb41c
      Li RongQing authored
      pskb_may_pull() maybe change skb->data and make opth pointer oboslete,
      so set the opth again
      Signed-off-by: default avatarLi RongQing <roy.qing.li@gmail.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fc6fb41c
    • Li RongQing's avatar
      ipv4: fix a potential use after free in gre_offload.c · b4e3cef7
      Li RongQing authored
      pskb_may_pull() may change skb->data and make greh pointer oboslete;
      so need to reassign greh;
      but since first calling pskb_may_pull already ensured that skb->data
      has enough space for greh, so move the reference of greh before second
      calling pskb_may_pull(), to avoid reassign greh.
      
      Fixes: 7a7ffbab("ipv4: fix tunneled VM traffic over hw VXLAN/GRE GSO NIC")
      Cc: Wei-Chun Chao <weichunc@plumgrid.com>
      Signed-off-by: default avatarLi RongQing <roy.qing.li@gmail.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b4e3cef7
    • Eric Dumazet's avatar
      tcp: fix build error if IPv6 is not enabled · 815afe17
      Eric Dumazet authored
      $ make M=net/ipv4
        CC      net/ipv4/route.o
      In file included from net/ipv4/route.c:102:0:
      include/net/tcp.h: In function ‘tcp_v6_iif’:
      include/net/tcp.h:738:32: error: ‘union <anonymous>’ has no member named ‘h6’
        return TCP_SKB_CB(skb)->header.h6.iif;
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Fixes: 870c3151 ("ipv6: introduce tcp_v6_iif()")
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      815afe17
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 2e923b02
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Include fixes for netrom and dsa (Fabian Frederick and Florian
          Fainelli)
      
       2) Fix FIXED_PHY support in stmmac, from Giuseppe CAVALLARO.
      
       3) Several SKB use after free fixes (vxlan, openvswitch, vxlan,
          ip_tunnel, fou), from Li ROngQing.
      
       4) fec driver PTP support fixes from Luwei Zhou and Nimrod Andy.
      
       5) Use after free in virtio_net, from Michael S Tsirkin.
      
       6) Fix flow mask handling for megaflows in openvswitch, from Pravin B
          Shelar.
      
       7) ISDN gigaset and capi bug fixes from Tilman Schmidt.
      
       8) Fix route leak in ip_send_unicast_reply(), from Vasily Averin.
      
       9) Fix two eBPF JIT bugs on x86, from Alexei Starovoitov.
      
      10) TCP_SKB_CB() reorganization caused a few regressions, fixed by Cong
          Wang and Eric Dumazet.
      
      11) Don't overwrite end of SKB when parsing malformed sctp ASCONF
          chunks, from Daniel Borkmann.
      
      12) Don't call sock_kfree_s() with NULL pointers, this function also has
          the side effect of adjusting the socket memory usage.  From Cong Wang.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (90 commits)
        bna: fix skb->truesize underestimation
        net: dsa: add includes for ethtool and phy_fixed definitions
        openvswitch: Set flow-key members.
        netrom: use linux/uaccess.h
        dsa: Fix conversion from host device to mii bus
        tipc: fix bug in bundled buffer reception
        ipv6: introduce tcp_v6_iif()
        sfc: add support for skb->xmit_more
        r8152: return -EBUSY for runtime suspend
        ipv4: fix a potential use after free in fou.c
        ipv4: fix a potential use after free in ip_tunnel_core.c
        hyperv: Add handling of IP header with option field in netvsc_set_hash()
        openvswitch: Create right mask with disabled megaflows
        vxlan: fix a free after use
        openvswitch: fix a use after free
        ipv4: dst_entry leak in ip_send_unicast_reply()
        ipv4: clean up cookie_v4_check()
        ipv4: share tcp_v4_save_options() with cookie_v4_check()
        ipv4: call __ip_options_echo() in cookie_v4_check()
        atm: simplify lanai.c by using module_pci_driver
        ...
      2e923b02
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · ffd8221b
      Linus Torvalds authored
      Pull Sparc bugfix from David Miller:
       "Sparc64 AES ctr mode bug fix"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc64: Fix FPU register corruption with AES crypto offload.
      ffd8221b
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide · e0a9272c
      Linus Torvalds authored
      Pull IDE cleanup from David Miller:
       "One IDE driver cleanup"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide:
        Drivers: ide: Remove typedef atiixp_ide_timing
      e0a9272c
    • Catalin Marinas's avatar
      futex: Ensure get_futex_key_refs() always implies a barrier · 76835b0e
      Catalin Marinas authored
      Commit b0c29f79 (futexes: Avoid taking the hb->lock if there's
      nothing to wake up) changes the futex code to avoid taking a lock when
      there are no waiters. This code has been subsequently fixed in commit
      11d4616b (futex: revert back to the explicit waiter counting code).
      Both the original commit and the fix-up rely on get_futex_key_refs() to
      always imply a barrier.
      
      However, for private futexes, none of the cases in the switch statement
      of get_futex_key_refs() would be hit and the function completes without
      a memory barrier as required before checking the "waiters" in
      futex_wake() -> hb_waiters_pending(). The consequence is a race with a
      thread waiting on a futex on another CPU, allowing the waker thread to
      read "waiters == 0" while the waiter thread to have read "futex_val ==
      locked" (in kernel).
      
      Without this fix, the problem (user space deadlocks) can be seen with
      Android bionic's mutex implementation on an arm64 multi-cluster system.
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      Reported-by: default avatarMatteo Franchin <Matteo.Franchin@arm.com>
      Fixes: b0c29f79 (futexes: Avoid taking the hb->lock if there's nothing to wake up)
      Acked-by: default avatarDavidlohr Bueso <dave@stgolabs.net>
      Tested-by: default avatarMike Galbraith <umgwanakikbuti@gmail.com>
      Cc: <stable@vger.kernel.org>
      Cc: Darren Hart <dvhart@linux.intel.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      76835b0e
    • Eric Dumazet's avatar
      bna: fix skb->truesize underestimation · f2d9da1a
      Eric Dumazet authored
      skb->truesize is not meant to be tracking amount of used bytes
      in an skb, but amount of reserved/consumed bytes in memory.
      
      For instance, if we use a single byte in last page fragment,
      we have to account the full size of the fragment.
      
      skb->truesize can be very different from skb->len, that has
      a very specific safety purpose.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Rasesh Mody <rasesh.mody@qlogic.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f2d9da1a
    • Florian Fainelli's avatar
      net: dsa: add includes for ethtool and phy_fixed definitions · a2820543
      Florian Fainelli authored
      net/dsa/slave.c uses functions and structures declared in phy_fixed.h
      but does not explicitely include it, while dsa.h needs structure
      declarations for 'struct ethtool_wolinfo' and 'struct ethtool_eee', fix
      those by including the correct header files.
      
      Fixes: ec9436ba ("net: dsa: allow drivers to do link adjustment")
      Fixes: ce31b31c ("net: dsa: allow updating fixed PHY link information")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a2820543
    • Pravin B Shelar's avatar
      openvswitch: Set flow-key members. · 25ef1328
      Pravin B Shelar authored
      This patch adds missing memset which are required to initialize
      flow key member. For example for IP flow we need to initialize
      ip.frag for all cases.
      
      Found by inspection.
      
      This bug is introduced by commit 07148121
      ("openvswitch: Eliminate memset() from flow_extract").
      Signed-off-by: default avatarPravin B Shelar <pshelar@nicira.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      25ef1328
    • Fabian Frederick's avatar
      netrom: use linux/uaccess.h · dc8e5416
      Fabian Frederick authored
      replace asm/uaccess.h by linux/uaccess.h
      Signed-off-by: default avatarFabian Frederick <fabf@skynet.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dc8e5416
    • Guenter Roeck's avatar
      dsa: Fix conversion from host device to mii bus · b184e497
      Guenter Roeck authored
      Commit b4d2394d ("dsa: Replace mii_bus with a generic host device")
      replaces mii_bus with a generic host_dev, and introduces
      dsa_host_dev_to_mii_bus() to support conversion from host_dev to mii_bus.
      However, in some cases it uses to_mii_bus to perform that conversion.
      Since host_dev is not the phy bus device but typically a platform device,
      this fails and results in a crash with the affected drivers.
      
      BUG: unable to handle kernel NULL pointer dereference at           (null)
      IP: [<ffffffff81781d35>] __mutex_lock_slowpath+0x75/0x100
      PGD 406783067 PUD 406784067 PMD 0
      Oops: 0002 [#1] SMP
      ...
      Call Trace:
      [<ffffffff810a538b>] ? pick_next_task_fair+0x61b/0x880
      [<ffffffff81781de3>] mutex_lock+0x23/0x37
      [<ffffffff81533244>] mdiobus_read+0x34/0x60
      [<ffffffff8153b95a>] __mv88e6xxx_reg_read+0x8a/0xa0
      [<ffffffff8153b9bc>] mv88e6xxx_reg_read+0x4c/0xa0
      
      Fixes: b4d2394d ("dsa: Replace mii_bus with a generic host device")
      Cc: Alexander Duyck <alexander.h.duyck@intel.com>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Acked-by: default avatarAlexander Duyck <alexander.h.duyck@redhat.com>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b184e497
    • Jon Paul Maloy's avatar
      tipc: fix bug in bundled buffer reception · 643566d4
      Jon Paul Maloy authored
      In commit ec8a2e56 ("tipc: same receive
      code path for connection protocol and data messages") we omitted the
      the possiblilty that an arriving message extracted from a bundle buffer
      may be a multicast message. Such messages need to be to be delivered to
      the socket via a separate function, tipc_sk_mcast_rcv(). As a result,
      small multicast messages arriving as members of a bundle buffer will be
      silently dropped.
      
      This commit corrects the error by considering this case in the function
      tipc_link_bundle_rcv().
      Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      643566d4