1. 10 Feb, 2016 7 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 74c7b2af
      Linus Torvalds authored
      Pull input updates from Dmitry Torokhov:
       "Just small driver fixups"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: colibri-vf50-ts - add missing #include <linux/of.h>
        Input: adp5589 - fix row 5 handling for adp5589
        Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree
        Input: vmmouse - fix absolute device registration
        Input: serio - drop warnings in case of EPROBE_DEFER from serio_find_driver()
        Input: cap11xx - add missing of_node_put
        Input: sirfsoc-onkey - allow modular build
        Input: xpad - remove unused function
      74c7b2af
    • Linus Torvalds's avatar
      Merge branch 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata · 4e541699
      Linus Torvalds authored
      Pull libata fixes from Tejun Heo:
      
       - PORTS_IMPL workaround for very early ahci controllers is misbehaving
         on new systems.  Disabled on recent ahci versions.
      
       - Old-style PIO state machine had a horrible locking problem.  Don't
         know how we've been getting away this far.  Fixed.
      
       - Other device specific updates.
      
      * 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
        ahci: Intel DNV device IDs SATA
        libata: fix sff host state machine locking while polling
        libata-sff: use WARN instead of BUG on illegal host state machine state
        libata: disable forced PORTS_IMPL for >= AHCI 1.3
        libata: blacklist a Viking flash model for MWDMA corruption
        drivers: ata: wake port before DMA stop for ALPM
      4e541699
    • Linus Torvalds's avatar
      Merge branch 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup · fb0dc5f1
      Linus Torvalds authored
      Pull cgroup fixes from Tejun Heo:
      
       - The destruction path of cgroup objects are asynchronous and
         multi-staged and some of them ended up destroying parents before
         children leading to failures in cpu and memory controllers.  Ensure
         that parents are always destroyed after children.
      
       - cpuset mm node migration was performed synchronously while holding
         threadgroup and cgroup mutexes and the recent threadgroup locking
         update resulted in a possible deadlock.  The migration is best effort
         and shouldn't have been performed under those locks to begin with.
         Made asynchronous.
      
       - Minor documentation fix.
      
      * 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
        Documentation: cgroup: Fix 'cgroup-legacy' -> 'cgroup-v1'
        cgroup: make sure a parent css isn't freed before its children
        cgroup: make sure a parent css isn't offlined before its children
        cpuset: make mm migration asynchronous
      fb0dc5f1
    • Linus Torvalds's avatar
      Merge branch 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq · 9aece75c
      Linus Torvalds authored
      Pull workqueue fixes from Tejun Heo:
       "Workqueue fixes for v4.5-rc3.
      
         - Remove a spurious triggering of flush dependency warning.
      
         - Officially break local execution guarantee of unbound work items
           and add a debug feature to flush out usages which depend on it.
      
         - Work around CPU -> NODE mapping becoming invalid on CPU offline.
      
        The branch is young but pushing out early as stable kernels are being
        affected"
      
      * 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
        workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup
        workqueue: implement "workqueue.debug_force_rr_cpu" debug feature
        workqueue: schedule WORK_CPU_UNBOUND work on wq_unbound_cpumask CPUs
        Revert "workqueue: make sure delayed work run in local cpu"
        workqueue: skip flush dependency checks for legacy workqueues
      9aece75c
    • Tejun Heo's avatar
      workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup · d6e022f1
      Tejun Heo authored
      When looking up the pool_workqueue to use for an unbound workqueue,
      workqueue assumes that the target CPU is always bound to a valid NUMA
      node.  However, currently, when a CPU goes offline, the mapping is
      destroyed and cpu_to_node() returns NUMA_NO_NODE.
      
      This has always been broken but hasn't triggered often enough before
      874bbfe6 ("workqueue: make sure delayed work run in local cpu").
      After the commit, workqueue forcifully assigns the local CPU for
      delayed work items without explicit target CPU to fix a different
      issue.  This widens the window where CPU can go offline while a
      delayed work item is pending causing delayed work items dispatched
      with target CPU set to an already offlined CPU.  The resulting
      NUMA_NO_NODE mapping makes workqueue try to queue the work item on a
      NULL pool_workqueue and thus crash.
      
      While 874bbfe6 has been reverted for a different reason making the
      bug less visible again, it can still happen.  Fix it by mapping
      NUMA_NO_NODE to the default pool_workqueue from unbound_pwq_by_node().
      This is a temporary workaround.  The long term solution is keeping CPU
      -> NODE mapping stable across CPU off/online cycles which is being
      worked on.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Reported-by: default avatarMike Galbraith <umgwanakikbuti@gmail.com>
      Cc: Tang Chen <tangchen@cn.fujitsu.com>
      Cc: Rafael J. Wysocki <rafael@kernel.org>
      Cc: Len Brown <len.brown@intel.com>
      Cc: stable@vger.kernel.org
      Link: http://lkml.kernel.org/g/1454424264.11183.46.camel@gmail.com
      Link: http://lkml.kernel.org/g/1453702100-2597-1-git-send-email-tangchen@cn.fujitsu.com
      d6e022f1
    • Alexandra Yates's avatar
      ahci: Intel DNV device IDs SATA · 342decff
      Alexandra Yates authored
      Adding Intel codename DNV platform device IDs for SATA.
      Signed-off-by: default avatarAlexandra Yates <alexandra.yates@linux.intel.com>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Cc: stable@vger.kernel.org
      342decff
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux · 2178cbc6
      Linus Torvalds authored
      Pull module fixes from Rusty Russell:
       "Fix for async_probe module param added in 4.3 (clearly not widely used
        yet), and a much more interesting kallsyms race which has been around
        approximately forever.  This fix is more invasive, and will require
        some care in backporting, but I hated all the bandaids I could think
        of, so...
      
        There are some more coming, which are only for breakages introduced
        this cycle (livepatch), but wanted these in now"
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
        modules: fix longstanding /proc/kallsyms vs module insertion race.
        module: wrapper for symbol name.
        modules: fix modparam async_probe request
      2178cbc6
  2. 09 Feb, 2016 8 commits
    • Geert Uytterhoeven's avatar
      Input: colibri-vf50-ts - add missing #include <linux/of.h> · ff84dabe
      Geert Uytterhoeven authored
      drivers/input/touchscreen/colibri-vf50-ts.c: In function ‘vf50_ts_probe’:
      drivers/input/touchscreen/colibri-vf50-ts.c:302: error: implicit declaration of function ‘of_property_read_u32’
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      ff84dabe
    • Lars-Peter Clausen's avatar
      Input: adp5589 - fix row 5 handling for adp5589 · 7008dafb
      Lars-Peter Clausen authored
      The adp5589 has row 5, don't skip it when creating the GPIO mapping.
      Otherwise the pin gets reserved as used and it is not possible to use it as
      a GPIO.
      Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Acked-by: default avatarMichael Hennerich <michael.hennerich@analog.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      7008dafb
    • Philipp Zabel's avatar
      Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree · dc262dfa
      Philipp Zabel authored
      A recent patch broke parsing the gain, offset, and threshold parameters
      from device tree. Instead of setting the cached values and writing them
      to the correct registers during probe, it would write the values from DT
      into the register address variables and never write them to the chip
      during normal operation.
      
      Fixes: 2e23b7a9 ("Input: edt-ft5x06 - use generic properties API")
      Signed-off-by: default avatarPhilipp Zabel <p.zabel@pengutronix.de>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      dc262dfa
    • Tejun Heo's avatar
      workqueue: implement "workqueue.debug_force_rr_cpu" debug feature · f303fccb
      Tejun Heo authored
      Workqueue used to guarantee local execution for work items queued
      without explicit target CPU.  The guarantee is gone now which can
      break some usages in subtle ways.  To flush out those cases, this
      patch implements a debug feature which forces round-robin CPU
      selection for all such work items.
      
      The debug feature defaults to off and can be enabled with a kernel
      parameter.  The default can be flipped with a debug config option.
      
      If you hit this commit during bisection, please refer to 041bd12e
      ("Revert "workqueue: make sure delayed work run in local cpu"") for
      more information and ping me.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      f303fccb
    • Mike Galbraith's avatar
      workqueue: schedule WORK_CPU_UNBOUND work on wq_unbound_cpumask CPUs · ef557180
      Mike Galbraith authored
      WORK_CPU_UNBOUND work items queued to a bound workqueue always run
      locally.  This is a good thing normally, but not when the user has
      asked us to keep unbound work away from certain CPUs.  Round robin
      these to wq_unbound_cpumask CPUs instead, as perturbation avoidance
      trumps performance.
      
      tj: Cosmetic and comment changes.  WARN_ON_ONCE() dropped from empty
          (wq_unbound_cpumask AND cpu_online_mask).  If we want that, it
          should be done when config changes.
      Signed-off-by: default avatarMike Galbraith <umgwanakikbuti@gmail.com>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      ef557180
    • Tejun Heo's avatar
      Revert "workqueue: make sure delayed work run in local cpu" · 041bd12e
      Tejun Heo authored
      This reverts commit 874bbfe6.
      
      Workqueue used to implicity guarantee that work items queued without
      explicit CPU specified are put on the local CPU.  Recent changes in
      timer broke the guarantee and led to vmstat breakage which was fixed
      by 176bed1d ("vmstat: explicitly schedule per-cpu work on the CPU
      we need it to run on").
      
      vmstat is the most likely to expose the issue and it's quite possible
      that there are other similar problems which are a lot more difficult
      to trigger.  As a preventive measure, 874bbfe6 ("workqueue: make
      sure delayed work run in local cpu") was applied to restore the local
      CPU guarnatee.  Unfortunately, the change exposed a bug in timer code
      which got fixed by 22b886dd ("timers: Use proper base migration in
      add_timer_on()").  Due to code restructuring, the commit couldn't be
      backported beyond certain point and stable kernels which only had
      874bbfe6 started crashing.
      
      The local CPU guarantee was accidental more than anything else and we
      want to get rid of it anyway.  As, with the vmstat case fixed,
      874bbfe6 is causing more problems than it's fixing, it has been
      decided to take the chance and officially break the guarantee by
      reverting the commit.  A debug feature will be added to force foreign
      CPU assignment to expose cases relying on the guarantee and fixes for
      the individual cases will be backported to stable as necessary.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Fixes: 874bbfe6 ("workqueue: make sure delayed work run in local cpu")
      Link: http://lkml.kernel.org/g/20160120211926.GJ10810@quack.suse.cz
      Cc: stable@vger.kernel.org
      Cc: Mike Galbraith <umgwanakikbuti@gmail.com>
      Cc: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
      Cc: Daniel Bilik <daniel.bilik@neosystem.cz>
      Cc: Jan Kara <jack@suse.cz>
      Cc: Shaohua Li <shli@fb.com>
      Cc: Sasha Levin <sasha.levin@oracle.com>
      Cc: Ben Hutchings <ben@decadent.org.uk>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Daniel Bilik <daniel.bilik@neosystem.cz>
      Cc: Jiri Slaby <jslaby@suse.cz>
      Cc: Michal Hocko <mhocko@kernel.org>
      041bd12e
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · 7cf91adc
      Linus Torvalds authored
      Pull crypto fixes from Herbert Xu:
       "This fixes the following issues:
      
        API:
         - Fix async algif_skcipher, it was broken by recent fixes.
         - Fix potential race condition in algif_skcipher with ctx.
         - Fix potential memory corruption in algif_skcipher.
         - Add missing lock to crypto_user when doing an alg dump.
      
        Drivers:
         - marvell/cesa was testing the wrong variable for NULL after
           allocation.
         - Fix potential double-free in atmel-sha.
         - Fix illegal call to sleepin function from atomic context in
           atmel-sha"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: marvell/cesa - fix test in mv_cesa_dev_dma_init()
        crypto: atmel-sha - remove calls of clk_prepare() from atomic contexts
        crypto: atmel-sha - fix atmel_sha_remove()
        crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path
        crypto: algif_skcipher - Do not dereference ctx without socket lock
        crypto: algif_skcipher - Do not assume that req is unchanged
        crypto: user - lock crypto_alg_list on alg dump
      7cf91adc
    • J. Bruce Fields's avatar
      scripts: add "prune-kernel" script to clean up old kernel images · b64e86cd
      J. Bruce Fields authored
      Long ago, Dave Jones complained about CONFIG_LOCALVERSION_AUTO:
       "I don't use the auto config, because I end up filling up /boot unless
        I go through and clean them out by hand every time I install a new one
        (which I do probably a dozen or so times a day).  Is there some easy
        way to prune old builds I'm missing?"
      
      To which Bruce replied:
       "I run this by hand every now and then.  I'm probably doing it all wrong"
      
      And if he is running it wrong, then so am I - because I've been using
      this script ever since.  It is true that CONFIG_LOCALVERSION_AUTO easily
      ends up filling your /boot partition if you don't clean up old versions
      regularly, and this script helps make that easier.
      
      Checked with Bruce to see that it's fine to add this to the kernel
      scripts.  Maybe people will come up with enhancements, but more
      importantly, this way I won't misplace this script whenever I install a
      new machine and start doing custom kernels for it.
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b64e86cd
  3. 08 Feb, 2016 4 commits
  4. 07 Feb, 2016 5 commits
    • Linus Torvalds's avatar
      Linux 4.5-rc3 · 388f7b1d
      Linus Torvalds authored
      388f7b1d
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · c17dfb01
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "The first real batch of fixes for this release cycle, so there are a
        few more than usual.
      
        Most of these are fixes and tweaks to board support (DT bugfixes,
        etc).  I've also picked up a couple of small cleanups that seemed
        innocent enough that there was little reason to wait (const/
        __initconst and Kconfig deps).
      
        Quite a bit of the changes on OMAP were due to fixes to no longer
        write to rodata from assembly when ARM_KERNMEM_PERMS was enabled, but
        there were also other fixes.
      
        Kirkwood had a bunch of gpio fixes for some boards.  OMAP had RTC
        fixes on OMAP5, and Nomadik had changes to MMC parameters in DT.
      
        All in all, mostly the usual mix of various fixes"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (46 commits)
        ARM: multi_v7_defconfig: enable DW_WATCHDOG
        ARM: nomadik: fix up SD/MMC DT settings
        ARM64: tegra: Add chosen node for tegra132 norrin
        ARM: realview: use "depends on" instead of "if" after prompt
        ARM: tango: use "depends on" instead of "if" after prompt
        ARM: tango: use const and __initconst for smp_operations
        ARM: realview: use const and __initconst for smp_operations
        bus: uniphier-system-bus: revive tristate prompt
        arm64: dts: Add missing DMA Abort interrupt to Juno
        bus: vexpress-config: Add missing of_node_put
        ARM: dts: am57xx: sbc-am57x: correct Eth PHY settings
        ARM: dts: am57xx: cl-som-am57x: fix CPSW EMAC pinmux
        ARM: dts: am57xx: sbc-am57x: fix UART3 pinmux
        ARM: dts: am57xx: cl-som-am57x: update SPI Flash frequency
        ARM: dts: am57xx: cl-som-am57x: set HOST mode for USB2
        ARM: dts: am57xx: sbc-am57x: fix SB-SOM EEPROM I2C address
        ARM: dts: LogicPD Torpedo: Revert Duplicative Entries
        ARM: dts: am437x: pixcir_tangoc: use correct flags for irq types
        ARM: dts: am4372: fix irq type for arm twd and global timer
        ARM: dts: at91: sama5d4 xplained: fix phy0 IRQ type
        ...
      c17dfb01
    • Linus Torvalds's avatar
      Merge branch 'mailbox-devel' of git://git.linaro.org/landing-teams/working/fujitsu/integration · 63fee123
      Linus Torvalds authored
      Pull mailbox fixes from Jassi Brar:
      
       - fix getting element from the pcc-channels array by simply indexing
         into it
      
       - prevent building mailbox-test driver for archs that don't have IOMEM
      
      * 'mailbox-devel' of git://git.linaro.org/landing-teams/working/fujitsu/integration:
        mailbox: Fix dependencies for !HAS_IOMEM archs
        mailbox: pcc: fix channel calculation in get_pcc_channel()
      63fee123
    • Linus Torvalds's avatar
      Merge tag 'usb-4.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 46df55ce
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are some USB fixes for 4.5-rc3.
      
        The usual, xhci fixes for reported issues, combined with some small
        gadget driver fixes, and a MAINTAINERS file update.  All have been in
        linux-next with no reported issues"
      
      * tag 'usb-4.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        xhci: harden xhci_find_next_ext_cap against device removal
        xhci: Fix list corruption in urb dequeue at host removal
        usb: host: xhci-plat: fix NULL pointer in probe for device tree case
        usb: xhci-mtk: fix AHB bus hang up caused by roothubs polling
        usb: xhci-mtk: fix bpkts value of LS/HS periodic eps not behind TT
        usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms
        usb: xhci: set SSIC port unused only if xhci_suspend succeeds
        usb: xhci: add a quirk bit for ssic port unused
        usb: xhci: handle both SSIC ports in PME stuck quirk
        usb: dwc3: gadget: set the OTG flag in dwc3 gadget driver.
        Revert "xhci: don't finish a TD if we get a short-transfer event mid TD"
        MAINTAINERS: fix my email address
        usb: dwc2: Fix probe problem on bcm2835
        Revert "usb: dwc2: Move reset into dwc2_get_hwparams()"
        usb: musb: ux500: Fix NULL pointer dereference at system PM
        usb: phy: mxs: declare variable with initialized value
        usb: phy: msm: fix error handling in probe.
      46df55ce
    • Linus Torvalds's avatar
      Merge tag 'staging-4.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · dacd53c8
      Linus Torvalds authored
      Pull staging and IIO driver fixes from Greg KH:
       "Here are some IIO and staging driver fixes for 4.5-rc3.
      
        All of them, except one, are for IIO drivers, and one is for a speakup
        driver fix caused by some earlier patches, to resolve a reported build
        failure"
      
      * tag 'staging-4.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        Staging: speakup: Fix allyesconfig build on mn10300
        iio: dht11: Use boottime
        iio: ade7753: avoid uninitialized data
        iio: pressure: mpl115: fix temperature offset sign
        iio: imu: Fix dependencies for !HAS_IOMEM archs
        staging: iio: Fix dependencies for !HAS_IOMEM archs
        iio: adc: Fix dependencies for !HAS_IOMEM archs
        iio: inkern: fix a NULL dereference on error
        iio:adc:ti_am335x_adc Fix buffered mode by identifying as software buffer.
        iio: light: acpi-als: Report data as processed
        iio: dac: mcp4725: set iio name property in sysfs
        iio: add HAS_IOMEM dependency to VF610_ADC
        iio: add IIO_TRIGGER dependency to STK8BA50
        iio: proximity: lidar: correct return value
        iio-light: Use a signed return type for ltr501_match_samp_freq()
      dacd53c8
  5. 06 Feb, 2016 16 commits
    • Boris BREZILLON's avatar
      crypto: marvell/cesa - fix test in mv_cesa_dev_dma_init() · 8a3978ad
      Boris BREZILLON authored
      We are checking twice if dma->cache_pool is not NULL but are never testing
      dma->padding_pool value.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarBoris Brezillon <boris.brezillon@free-electrons.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      8a3978ad
    • Cyrille Pitchen's avatar
      crypto: atmel-sha - remove calls of clk_prepare() from atomic contexts · c033042a
      Cyrille Pitchen authored
      clk_prepare()/clk_unprepare() must not be called within atomic context.
      
      This patch calls clk_prepare() once for all from atmel_sha_probe() and
      clk_unprepare() from atmel_sha_remove().
      
      Then calls of clk_prepare_enable()/clk_disable_unprepare() were replaced
      by calls of clk_enable()/clk_disable().
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarCyrille Pitchen <cyrille.pitchen@atmel.com>
      Reported-by: default avatarMatthias Mayr <matthias.mayr@student.kit.edu>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      c033042a
    • Cyrille Pitchen's avatar
      crypto: atmel-sha - fix atmel_sha_remove() · d961436c
      Cyrille Pitchen authored
      Since atmel_sha_probe() uses devm_xxx functions to allocate resources,
      atmel_sha_remove() should no longer explicitly release them.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarCyrille Pitchen <cyrille.pitchen@atmel.com>
      Fixes: b0e8b341 ("crypto: atmel - use devm_xxx() managed function")
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      d961436c
    • Herbert Xu's avatar
      crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path · dad41997
      Herbert Xu authored
      The async path cannot use MAY_BACKLOG because it is not meant to
      block, which is what MAY_BACKLOG does.  On the other hand, both
      the sync and async paths can make use of MAY_SLEEP.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      dad41997
    • Herbert Xu's avatar
      crypto: algif_skcipher - Do not dereference ctx without socket lock · 6454c2b8
      Herbert Xu authored
      Any access to non-constant bits of the private context must be
      done under the socket lock, in particular, this includes ctx->req.
      
      This patch moves such accesses under the lock, and fetches the
      tfm from the parent socket which is guaranteed to be constant,
      rather than from ctx->req.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      6454c2b8
    • Herbert Xu's avatar
      crypto: algif_skcipher - Do not assume that req is unchanged · ec69bbfb
      Herbert Xu authored
      The async path in algif_skcipher assumes that the crypto completion
      function will be called with the original request.  This is not
      necessarily the case.  In fact there is no need for this anyway
      since we already embed information into the request with struct
      skcipher_async_req.
      
      This patch adds a pointer to that struct and then passes it as
      the data to the callback function.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Tested-by: default avatarTadeusz Struk <tadeusz.struk@intel.com>
      ec69bbfb
    • Mathias Krause's avatar
      crypto: user - lock crypto_alg_list on alg dump · 63e41ebc
      Mathias Krause authored
      We miss to take the crypto_alg_sem semaphore when traversing the
      crypto_alg_list for CRYPTO_MSG_GETALG dumps. This allows a race with
      crypto_unregister_alg() removing algorithms from the list while we're
      still traversing it, thereby leading to a use-after-free as show below:
      
      [ 3482.071639] general protection fault: 0000 [#1] SMP
      [ 3482.075639] Modules linked in: aes_x86_64 glue_helper lrw ablk_helper cryptd gf128mul ipv6 pcspkr serio_raw virtio_net microcode virtio_pci virtio_ring virtio sr_mod cdrom [last unloaded: aesni_intel]
      [ 3482.075639] CPU: 1 PID: 11065 Comm: crconf Not tainted 4.3.4-grsec+ #126
      [ 3482.075639] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
      [ 3482.075639] task: ffff88001cd41a40 ti: ffff88001cd422c8 task.ti: ffff88001cd422c8
      [ 3482.075639] RIP: 0010:[<ffffffff93722bd3>]  [<ffffffff93722bd3>] strncpy+0x13/0x30
      [ 3482.075639] RSP: 0018:ffff88001f713b60  EFLAGS: 00010202
      [ 3482.075639] RAX: ffff88001f6c4430 RBX: ffff88001f6c43a0 RCX: ffff88001f6c4430
      [ 3482.075639] RDX: 0000000000000040 RSI: fefefefefefeff16 RDI: ffff88001f6c4430
      [ 3482.075639] RBP: ffff88001f713b60 R08: ffff88001f6c4470 R09: ffff88001f6c4480
      [ 3482.075639] R10: 0000000000000002 R11: 0000000000000246 R12: ffff88001ce2aa28
      [ 3482.075639] R13: ffff880000093700 R14: ffff88001f5e4bf8 R15: 0000000000003b20
      [ 3482.075639] FS:  0000033826fa2700(0000) GS:ffff88001e900000(0000) knlGS:0000000000000000
      [ 3482.075639] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 3482.075639] CR2: ffffffffff600400 CR3: 00000000139ec000 CR4: 00000000001606f0
      [ 3482.075639] Stack:
      [ 3482.075639]  ffff88001f713bd8 ffffffff936ccd00 ffff88001e5c4200 ffff880000093700
      [ 3482.075639]  ffff88001f713bd0 ffffffff938ef4bf 0000000000000000 0000000000003b20
      [ 3482.075639]  ffff88001f5e4bf8 ffff88001f5e4848 0000000000000000 0000000000003b20
      [ 3482.075639] Call Trace:
      [ 3482.075639]  [<ffffffff936ccd00>] crypto_report_alg+0xc0/0x3e0
      [ 3482.075639]  [<ffffffff938ef4bf>] ? __alloc_skb+0x16f/0x300
      [ 3482.075639]  [<ffffffff936cd08a>] crypto_dump_report+0x6a/0x90
      [ 3482.075639]  [<ffffffff93935707>] netlink_dump+0x147/0x2e0
      [ 3482.075639]  [<ffffffff93935f99>] __netlink_dump_start+0x159/0x190
      [ 3482.075639]  [<ffffffff936ccb13>] crypto_user_rcv_msg+0xc3/0x130
      [ 3482.075639]  [<ffffffff936cd020>] ? crypto_report_alg+0x3e0/0x3e0
      [ 3482.075639]  [<ffffffff936cc4b0>] ? alg_test_crc32c+0x120/0x120
      [ 3482.075639]  [<ffffffff93933145>] ? __netlink_lookup+0xd5/0x120
      [ 3482.075639]  [<ffffffff936cca50>] ? crypto_add_alg+0x1d0/0x1d0
      [ 3482.075639]  [<ffffffff93938141>] netlink_rcv_skb+0xe1/0x130
      [ 3482.075639]  [<ffffffff936cc4f8>] crypto_netlink_rcv+0x28/0x40
      [ 3482.075639]  [<ffffffff939375a8>] netlink_unicast+0x108/0x180
      [ 3482.075639]  [<ffffffff93937c21>] netlink_sendmsg+0x541/0x770
      [ 3482.075639]  [<ffffffff938e31e1>] sock_sendmsg+0x21/0x40
      [ 3482.075639]  [<ffffffff938e4763>] SyS_sendto+0xf3/0x130
      [ 3482.075639]  [<ffffffff93444203>] ? bad_area_nosemaphore+0x13/0x20
      [ 3482.075639]  [<ffffffff93444470>] ? __do_page_fault+0x80/0x3a0
      [ 3482.075639]  [<ffffffff939d80cb>] entry_SYSCALL_64_fastpath+0x12/0x6e
      [ 3482.075639] Code: 88 4a ff 75 ed 5d 48 0f ba 2c 24 3f c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 85 d2 48 89 f8 48 89 f9 4c 8d 04 17 48 89 e5 74 15 <0f> b6 16 80 fa 01 88 11 48 83 de ff 48 83 c1 01 4c 39 c1 75 eb
      [ 3482.075639] RIP  [<ffffffff93722bd3>] strncpy+0x13/0x30
      
      To trigger the race run the following loops simultaneously for a while:
        $ while : ; do modprobe aesni-intel; rmmod aesni-intel; done
        $ while : ; do crconf show all > /dev/null; done
      
      Fix the race by taking the crypto_alg_sem read lock, thereby preventing
      crypto_unregister_alg() from modifying the algorithm list during the
      dump.
      
      This bug has been detected by the PaX memory sanitize feature.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMathias Krause <minipli@googlemail.com>
      Cc: Steffen Klassert <steffen.klassert@secunet.com>
      Cc: PaX Team <pageexec@freemail.hu>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      63e41ebc
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · 5af9c2e1
      Linus Torvalds authored
      Merge fixes from Andrew Morton:
       "22 fixes"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (22 commits)
        epoll: restrict EPOLLEXCLUSIVE to POLLIN and POLLOUT
        radix-tree: fix oops after radix_tree_iter_retry
        MAINTAINERS: trim the file triggers for ABI/API
        dax: dirty inode only if required
        thp: make deferred_split_scan() work again
        mm: replace vma_lock_anon_vma with anon_vma_lock_read/write
        ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup
        um: asm/page.h: remove the pte_high member from struct pte_t
        mm, hugetlb: don't require CMA for runtime gigantic pages
        mm/hugetlb: fix gigantic page initialization/allocation
        mm: downgrade VM_BUG in isolate_lru_page() to warning
        mempolicy: do not try to queue pages from !vma_migratable()
        mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress
        vmstat: make vmstat_update deferrable
        mm, vmstat: make quiet_vmstat lighter
        mm/Kconfig: correct description of DEFERRED_STRUCT_PAGE_INIT
        memblock: don't mark memblock_phys_mem_size() as __init
        dump_stack: avoid potential deadlocks
        mm: validate_mm browse_rb SMP race condition
        m32r: fix build failure due to SMP and MMU
        ...
      5af9c2e1
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client · 5d6a6a75
      Linus Torvalds authored
      Pull Ceph fixes from Sage Weil:
       "We have a few wire protocol compatibility fixes, ports of a few recent
        CRUSH mapping changes, and a couple error path fixes"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
        libceph: MOSDOpReply v7 encoding
        libceph: advertise support for TUNABLES5
        crush: decode and initialize chooseleaf_stable
        crush: add chooseleaf_stable tunable
        crush: ensure take bucket value is valid
        crush: ensure bucket id is valid before indexing buckets array
        ceph: fix snap context leak in error path
        ceph: checking for IS_ERR instead of NULL
      5d6a6a75
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 9b108828
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Fixes all over the place:
      
         - amdkfd: two static checker fixes
         - mst: a bunch of static checker and spec/hw interaction fixes
         - amdgpu: fix Iceland hw properly, and some fiji bugs, along with
           some write-combining fixes.
         - exynos: some regression fixes
         - adv7511: fix some EDID reading issues"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (38 commits)
        drm/dp/mst: deallocate payload on port destruction
        drm/dp/mst: Reverse order of MST enable and clearing VC payload table.
        drm/dp/mst: move GUID storage from mgr, port to only mst branch
        drm/dp/mst: change MST detection scheme
        drm/dp/mst: Calculate MST PBN with 31.32 fixed point
        drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil
        drm/mst: Add range check for max_payloads during init
        drm/mst: Don't ignore the MST PBN self-test result
        drm: fix missing reference counting decrease
        drm/amdgpu: disable uvd and vce clockgating on Fiji
        drm/amdgpu: remove exp hardware support from iceland
        drm/amdgpu: load MEC ucode manually on iceland
        drm/amdgpu: don't load MEC2 on topaz
        drm/amdgpu: drop topaz support from gmc8 module
        drm/amdgpu: pull topaz gmc bits into gmc_v7
        drm/amdgpu: The VI specific EXE bit should only apply to GMC v8.0 above
        drm/amdgpu: iceland use CI based MC IP
        drm/amdgpu: move gmc7 support out of CIK dependency
        drm/amdgpu/gfx7: enable cp inst/reg error interrupts
        drm/amdgpu/gfx8: enable cp inst/reg error interrupts
        ...
      9b108828
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-4.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 22f60701
      Linus Torvalds authored
      Pull power management and ACPI fixes from Rafael Wysocki:
       "These are: a fix for a recently introduced false-positive warnings
        about PM domain pointers being changed inappropriately (harmless but
        annoying), an MCH size workaround quirk for one more platform, a
        compiler warning fix (generic power domains framework), an ACPI LPSS
        (Intel SoCs) driver fixup and a cleanup of the ACPI CPPC core code.
      
        Specifics:
      
         - PM core fix to avoid false-positive warnings generated when the
           pm_domain field is cleared for a device that appears to be bound to
           a driver (Rafael Wysocki).
      
         - New MCH size workaround quirk for Intel Haswell-ULT (Josh Boyer).
      
         - Fix for an "unused function" compiler warning in the generic power
           domains framework (Ulf Hansson).
      
         - Fixup for the ACPI driver for Intel SoCs (acpi-lpss) to set the PM
           domain pointer of a device properly in one place that was
           overlooked by a recent PM core update (Andy Shevchenko).
      
         - Removal of a redundant function declaration in the ACPI CPPC core
           code (Timur Tabi)"
      
      * tag 'pm+acpi-4.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        PM: Avoid false-positive warnings in dev_pm_domain_set()
        PM / Domains: Silence compiler warning for an unused function
        ACPI / CPPC: remove redundant mbox_send_message() declaration
        ACPI / LPSS: set PM domain via helper setter
        PNP: Add Haswell-ULT to Intel MCH size workaround
      22f60701
    • Jason Baron's avatar
      epoll: restrict EPOLLEXCLUSIVE to POLLIN and POLLOUT · b6a515c8
      Jason Baron authored
      In the current implementation of the EPOLLEXCLUSIVE flag (added for
      4.5-rc1), if epoll waiters create different POLL* sets and register them
      as exclusive against the same target fd, the current implementation will
      stop waking any further waiters once it finds the first idle waiter.
      This means that waiters could miss wakeups in certain cases.
      
      For example, when we wake up a pipe for reading we do:
      wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLRDNORM); So if
      one epoll set or epfd is added to pipe p with POLLIN and a second set
      epfd2 is added to pipe p with POLLRDNORM, only epfd may receive the
      wakeup since the current implementation will stop after it finds any
      intersection of events with a waiter that is blocked in epoll_wait().
      
      We could potentially address this by requiring all epoll waiters that
      are added to p be required to pass the same set of POLL* events.  IE the
      first EPOLL_CTL_ADD that passes EPOLLEXCLUSIVE establishes the set POLL*
      flags to be used by any other epfds that are added as EPOLLEXCLUSIVE.
      However, I think it might be somewhat confusing interface as we would
      have to reference count the number of users for that set, and so
      userspace would have to keep track of that count, or we would need a
      more involved interface.  It also adds some shared state that we'd have
      store somewhere.  I don't think anybody will want to bloat
      __wait_queue_head for this.
      
      I think what we could do instead, is to simply restrict EPOLLEXCLUSIVE
      such that it can only be specified with EPOLLIN and/or EPOLLOUT.  So
      that way if the wakeup includes 'POLLIN' and not 'POLLOUT', we can stop
      once we hit the first idle waiter that specifies the EPOLLIN bit, since
      any remaining waiters that only have 'POLLOUT' set wouldn't need to be
      woken.  Likewise, we can do the same thing if 'POLLOUT' is in the wakeup
      bit set and not 'POLLIN'.  If both 'POLLOUT' and 'POLLIN' are set in the
      wake bit set (there is at least one example of this I saw in fs/pipe.c),
      then we just wake the entire exclusive list.  Having both 'POLLOUT' and
      'POLLIN' both set should not be on any performance critical path, so I
      think that's ok (in fs/pipe.c its in pipe_release()).  We also continue
      to include EPOLLERR and EPOLLHUP by default in any exclusive set.  Thus,
      the user can specify EPOLLERR and/or EPOLLHUP but is not required to do
      so.
      
      Since epoll waiters may be interested in other events as well besides
      EPOLLIN, EPOLLOUT, EPOLLERR and EPOLLHUP, these can still be added by
      doing a 'dup' call on the target fd and adding that as one normally
      would with EPOLL_CTL_ADD.  Since I think that the POLLIN and POLLOUT
      events are what we are interest in balancing, I think that the 'dup'
      thing could perhaps be added to only one of the waiter threads.
      However, I think that EPOLLIN, EPOLLOUT, EPOLLERR and EPOLLHUP should be
      sufficient for the majority of use-cases.
      
      Since EPOLLEXCLUSIVE is intended to be used with a target fd shared
      among multiple epfds, where between 1 and n of the epfds may receive an
      event, it does not satisfy the semantics of EPOLLONESHOT where only 1
      epfd would get an event.  Thus, it is not allowed to be specified in
      conjunction with EPOLLEXCLUSIVE.
      
      EPOLL_CTL_MOD is also not allowed if the fd was previously added as
      EPOLLEXCLUSIVE.  It seems with the limited number of flags to not be as
      interesting, but this could be relaxed at some further point.
      Signed-off-by: default avatarJason Baron <jbaron@akamai.com>
      Tested-by: default avatarMadars Vitolins <m@silodev.com>
      Cc: Michael Kerrisk <mtk.manpages@gmail.com>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Al Viro <viro@ftp.linux.org.uk>
      Cc: Eric Wong <normalperson@yhbt.net>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Hagen Paul Pfeifer <hagen@jauu.net>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b6a515c8
    • Konstantin Khlebnikov's avatar
      radix-tree: fix oops after radix_tree_iter_retry · 73204282
      Konstantin Khlebnikov authored
      Helper radix_tree_iter_retry() resets next_index to the current index.
      In following radix_tree_next_slot current chunk size becomes zero.  This
      isn't checked and it tries to dereference null pointer in slot.
      
      Tagged iterator is fine because retry happens only at slot 0 where tag
      bitmask in iter->tags is filled with single bit.
      
      Fixes: 46437f9a ("radix-tree: fix race in gang lookup")
      Signed-off-by: default avatarKonstantin Khlebnikov <koct9i@gmail.com>
      Cc: Matthew Wilcox <willy@linux.intel.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: Ohad Ben-Cohen <ohad@wizery.com>
      Cc: Jeremiah Mahler <jmmahler@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      73204282
    • Michael Kerrisk (man-pages)'s avatar
      MAINTAINERS: trim the file triggers for ABI/API · b14fd334
      Michael Kerrisk (man-pages) authored
      Commit ea8f8fc8 ("MAINTAINERS: add linux-api for review of API/ABI
      changes") added file triggers for various paths that likely indicated
      API/ABI changes.  However, catching all changes in Documentation/ABI/
      and include/uapi/ produces a large volume of mail to linux-api, rather
      than only API/ABI changes.  Drop those two entries, but leave
      include/linux/syscalls.h and kernel/sys_ni.c to catch syscall-related
      changes.
      
      [josh@joshtriplett.org: redid changelog]
      Signed-off-by: default avatarMichael Kerrisk <mtk.man-pages@gmail.com>
      Acked-by: default avatarShuah khan <shuahkh@osg.samsung.com>
      Cc: Josh Triplett <josh@joshtriplett.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b14fd334
    • Dmitry Monakhov's avatar
      dax: dirty inode only if required · d2b2a28e
      Dmitry Monakhov authored
      Signed-off-by: default avatarDmitry Monakhov <dmonakhov@openvz.org>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Reviewed-by: default avatarRoss Zwisler <ross.zwisler@linux.intel.com>
      Cc: Matthew Wilcox <matthew.r.wilcox@intel.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d2b2a28e
    • Kirill A. Shutemov's avatar
      thp: make deferred_split_scan() work again · ae026204
      Kirill A. Shutemov authored
      We need to iterate over split_queue, not local empty list to get
      anything split from the shrinker.
      
      Fixes: e3ae1953 ("thp: limit number of object to scan on deferred_split_scan()")
      Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Andrea Arcangeli <aarcange@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ae026204