1. 18 Dec, 2013 2 commits
    • Dan Williams's avatar
      net_dma: mark broken · 77873803
      Dan Williams authored
      net_dma can cause data to be copied to a stale mapping if a
      copy-on-write fault occurs during dma.  The application sees missing
      data.
      
      The following trace is triggered by modifying the kernel to WARN if it
      ever triggers copy-on-write on a page that is undergoing dma:
      
       WARNING: CPU: 24 PID: 2529 at lib/dma-debug.c:485 debug_dma_assert_idle+0xd2/0x120()
       ioatdma 0000:00:04.0: DMA-API: cpu touching an active dma mapped page [pfn=0x16bcd9]
       Modules linked in: iTCO_wdt iTCO_vendor_support ioatdma lpc_ich pcspkr dca
       CPU: 24 PID: 2529 Comm: linbug Tainted: G        W    3.13.0-rc1+ #353
        00000000000001e5 ffff88016f45f688 ffffffff81751041 ffff88017ab0ef70
        ffff88016f45f6d8 ffff88016f45f6c8 ffffffff8104ed9c ffffffff810f3646
        ffff8801768f4840 0000000000000282 ffff88016f6cca10 00007fa2bb699349
       Call Trace:
        [<ffffffff81751041>] dump_stack+0x46/0x58
        [<ffffffff8104ed9c>] warn_slowpath_common+0x8c/0xc0
        [<ffffffff810f3646>] ? ftrace_pid_func+0x26/0x30
        [<ffffffff8104ee86>] warn_slowpath_fmt+0x46/0x50
        [<ffffffff8139c062>] debug_dma_assert_idle+0xd2/0x120
        [<ffffffff81154a40>] do_wp_page+0xd0/0x790
        [<ffffffff811582ac>] handle_mm_fault+0x51c/0xde0
        [<ffffffff813830b9>] ? copy_user_enhanced_fast_string+0x9/0x20
        [<ffffffff8175fc2c>] __do_page_fault+0x19c/0x530
        [<ffffffff8175c196>] ? _raw_spin_lock_bh+0x16/0x40
        [<ffffffff810f3539>] ? trace_clock_local+0x9/0x10
        [<ffffffff810fa1f4>] ? rb_reserve_next_event+0x64/0x310
        [<ffffffffa0014c00>] ? ioat2_dma_prep_memcpy_lock+0x60/0x130 [ioatdma]
        [<ffffffff8175ffce>] do_page_fault+0xe/0x10
        [<ffffffff8175c862>] page_fault+0x22/0x30
        [<ffffffff81643991>] ? __kfree_skb+0x51/0xd0
        [<ffffffff813830b9>] ? copy_user_enhanced_fast_string+0x9/0x20
        [<ffffffff81388ea2>] ? memcpy_toiovec+0x52/0xa0
        [<ffffffff8164770f>] skb_copy_datagram_iovec+0x5f/0x2a0
        [<ffffffff8169d0f4>] tcp_rcv_established+0x674/0x7f0
        [<ffffffff816a68c5>] tcp_v4_do_rcv+0x2e5/0x4a0
        [..]
       ---[ end trace e30e3b01191b7617 ]---
       Mapped at:
        [<ffffffff8139c169>] debug_dma_map_page+0xb9/0x160
        [<ffffffff8142bf47>] dma_async_memcpy_pg_to_pg+0x127/0x210
        [<ffffffff8142cce9>] dma_memcpy_pg_to_iovec+0x119/0x1f0
        [<ffffffff81669d3c>] dma_skb_copy_datagram_iovec+0x11c/0x2b0
        [<ffffffff8169d1ca>] tcp_rcv_established+0x74a/0x7f0:
      
      ...the problem is that the receive path falls back to cpu-copy in
      several locations and this trace is just one of the areas.  A few
      options were considered to fix this:
      
      1/ sync all dma whenever a cpu copy branch is taken
      
      2/ modify the page fault handler to hold off while dma is in-flight
      
      Option 1 adds yet more cpu overhead to an "offload" that struggles to compete
      with cpu-copy.  Option 2 adds checks for behavior that is already documented as
      broken when using get_user_pages().  At a minimum a debug mode is warranted to
      catch and flag these violations of the dma-api vs get_user_pages().
      
      Thanks to David for his reproducer.
      
      Cc: <stable@vger.kernel.org>
      Cc: Dave Jiang <dave.jiang@intel.com>
      Cc: Vinod Koul <vinod.koul@intel.com>
      Cc: Alexander Duyck <alexander.h.duyck@intel.com>
      Reported-by: default avatarDavid Whipple <whipple@securedatainnovations.ch>
      Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      77873803
    • Will Deacon's avatar
      dma: pl330: ensure DMA descriptors are zero-initialised · 0baf8f6a
      Will Deacon authored
      I see the following splat with 3.13-rc1 when attempting to perform DMA:
      
      [  253.004516] Alignment trap: not handling instruction e1902f9f at [<c0204b40>]
      [  253.004583] Unhandled fault: alignment exception (0x221) at 0xdfdfdfd7
      [  253.004646] Internal error: : 221 [#1] PREEMPT SMP ARM
      [  253.004691] Modules linked in: dmatest(+) [last unloaded: dmatest]
      [  253.004798] CPU: 0 PID: 671 Comm: kthreadd Not tainted 3.13.0-rc1+ #2
      [  253.004864] task: df9b0900 ti: df03e000 task.ti: df03e000
      [  253.004937] PC is at dmaengine_unmap_put+0x14/0x34
      [  253.005010] LR is at pl330_tasklet+0x3c8/0x550
      [  253.005087] pc : [<c0204b44>]    lr : [<c0207478>]    psr: a00e0193
      [  253.005087] sp : df03fe48  ip : 00000000  fp : df03bf18
      [  253.005178] r10: bf00e108  r9 : 00000001  r8 : 00000000
      [  253.005245] r7 : df837040  r6 : dfb41800  r5 : df837048  r4 : df837000
      [  253.005316] r3 : dfdfdfcf  r2 : dfb41f80  r1 : df837048  r0 : dfdfdfd7
      [  253.005384] Flags: NzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
      [  253.005459] Control: 30c5387d  Table: 9fb9ba80  DAC: fffffffd
      [  253.005520] Process kthreadd (pid: 671, stack limit = 0xdf03e248)
      
      This is due to desc->txd.unmap containing garbage (uninitialised memory).
      
      Rather than add another dummy initialisation to _init_desc, instead
      ensure that the descriptors are zero-initialised during allocation and
      remove the dummy, per-field initialisation.
      
      Cc: Andriy Shevchenko <andriy.shevchenko@intel.com>
      Acked-by: default avatarJassi Brar <jassisinghbrar@gmail.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Acked-by: default avatarVinod Koul <vinod.koul@intel.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      0baf8f6a
  2. 13 Dec, 2013 10 commits
    • Dan Williams's avatar
      dmaengine: fix sleep in atomic · 8194ee27
      Dan Williams authored
       BUG: sleeping function called from invalid context at mm/mempool.c:203
       in_atomic(): 1, irqs_disabled(): 0, pid: 43502, name: linbug
       no locks held by linbug/43502.
       CPU: 7 PID: 43502 Comm: linbug Not tainted 3.13.0-rc1+ #15
       Hardware name:
        0000000000000010 ffff88005ebd1878 ffffffff8172d512 ffff8801752bc1c0
        ffff8801752bc1c0 ffff88005ebd1898 ffffffff8109d1f6 ffff88005f9a3c58
        ffff880177f0f080 ffff88005ebd1918 ffffffff81161f43 ffff88005ebd18f8
       Call Trace:
        [<ffffffff8172d512>] dump_stack+0x4e/0x68
        [<ffffffff8109d1f6>] __might_sleep+0xe6/0x120
        [<ffffffff81161f43>] mempool_alloc+0x93/0x170
        [<ffffffff810c0c34>] ? mark_held_locks+0x74/0x140
        [<ffffffff8118a826>] ? follow_page_mask+0x556/0x600
        [<ffffffff814107ae>] dmaengine_get_unmap_data+0x2e/0x60
        [<ffffffff81410f11>] dma_async_memcpy_pg_to_pg+0x41/0x1c0
        [<ffffffff814110e0>] dma_async_memcpy_buf_to_pg+0x50/0x60
        [<ffffffff81411bdc>] dma_memcpy_to_iovec+0xfc/0x190
        [<ffffffff816163af>] dma_skb_copy_datagram_iovec+0x6f/0x2b0
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      8194ee27
    • Russell King's avatar
      dmaengine: mv_xor: fix oops when channels fail to initialise · 0be8253f
      Russell King authored
      When a channel fails to initialise, we error out and clean up any
      previously unregistered channels by walking the entire xordev->channels
      array.  Unfortunately, there are paths which end up storing an error
      pointer in this array, which we then try and dereference in the cleanup
      code, which causes an oops.
      
      Fix this by avoiding writing invalid pointers to this array in the first
      place.
      Tested-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      0be8253f
    • Ezequiel Garcia's avatar
      dma: mv_xor: Use dmaengine_unmap_data for the self-tests · d16695a7
      Ezequiel Garcia authored
      The driver-specific unmap code was removed in:
      
        commit 54f8d501
        Author: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
        Date:   Fri Oct 18 19:35:32 2013 +0200
      
            dmaengine: remove DMA unmap from drivers
      
      which had the side-effect of not unmapping the self-test mappings.
      Fix this by using dmaengine_unmap_data in the self-test routines.
      
      In addition, since dmaengine_unmap() assumes that all mappings were created
      with dma_map_page, this commit changes the single mapping to a page mapping
      to avoid an incorrect unmapping of the memcpy self-test.
      
      The allocation could be changed to be alloc_page(), but sticking to kmalloc
      results in a less intrusive patch. The size of the test buffer is increased,
      since dma_map_page() seem to fail when the source and destination pages are
      the same page.
      Signed-off-by: default avatarEzequiel Garcia <ezequiel.garcia@free-electrons.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      d16695a7
    • Dan Williams's avatar
      dmaengine: fix enable for high order unmap pools · 3cc377b9
      Dan Williams authored
      The higher order mempools support raid operations, and we want to
      disable them when raid support is not enabled.  Making them conditional
      on ASYNC_TX_DMA is not sufficient as other users (specifically dmatest)
      will also issue raid operations.  Make raid drivers explicitly request
      that the core carry the higher order pools.
      Reported-by: default avatarEzequiel Garcia <ezequiel.garcia@free-electrons.com>
      Tested-by: default avatarEzequiel Garcia <ezequiel.garcia@free-electrons.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      3cc377b9
    • Dan Williams's avatar
      dma: fix build warnings in txx9 · 8e5ee258
      Dan Williams authored
      The unmap rework missed this:
      drivers/dma/txx9dmac.c:409:25: warning: unused variable 'ds' [-Wunused-variable]
      
      Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      8e5ee258
    • Dan Williams's avatar
      dmatest: fix build warning on mips · 745c00da
      Dan Williams authored
      drivers/dma/dmatest.c:543:11: warning: passing argument 1 of 'virt_to_phys' makes pointer from integer without a cast [enabled by default]
      
      mips expects virt_to_phys() to take a pointer.  Fix up the types accordingly.
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      745c00da
    • Dan Williams's avatar
      dma: fix fsldma build warnings · bbc76560
      Dan Williams authored
      
      drivers/dma/fsldma.c: In function 'fsldma_cleanup_descriptor':
      drivers/dma/fsldma.c:860:6: warning: unused variable 'len' [-Wunused-variable]
      drivers/dma/fsldma.c:859:13: warning: unused variable 'dst' [-Wunused-variable]
      drivers/dma/fsldma.c:858:13: warning: unused variable 'src' [-Wunused-variable]
      drivers/dma/fsldma.c:857:17: warning: unused variable 'dev' [-Wunused-variable]
      - due to unmap changes
      
      drivers/dma/fsldma.c: In function 'fsl_dma_tx_submit':
      drivers/dma/fsldma.c:428:2: warning: 'cookie' may be used uninitialized in this function [-Wuninitialized]
      - long standing warning
      
      Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
      Cc: Li Yang <leoli@freescale.com>
      Cc: Zhang Wei <zw@zh-kernel.org>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      bbc76560
    • Dan Williams's avatar
      dma: fix build warnings in ppc4xx · 6aa2731c
      Dan Williams authored
      drivers/dma/ppc4xx/adma.c:1507:6: warning: unused variable 'i' [-Wunused-variable]
      - due to unmap reworks
      
      drivers/dma/ppc4xx/adma.c:3900:2: warning: format '%s' expects a matching 'char *' argument [-Wformat]
      - due to memset removal
      
      drivers/dma/ppc4xx/adma.c:538:13: warning: 'ppc440spe_desc_init_memset' defined but not used [-Wunused-function]
      - due to memset removal
      
      Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      6aa2731c
    • Olof Johansson's avatar
      dmaengine: at_hdmac: remove unused function · d7fb0300
      Olof Johansson authored
      commit 54f8d501 ('dmaengine: remove DMA unmap from drivers')
      refactored some code which resulted in an unused function in the at_hdmac
      driver:
      
      drivers/dma/at_hdmac_regs.h:350:23: warning: 'chan2parent' defined but
          not used [-Wunused-function]
      
      Fixes: 54f8d501 ('dmaengine: remove DMA unmap from drivers')
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
      Acked-by: default avatarNicolas Ferre <nicolas.ferre@atmel.com>
      Acked-by: default avatarBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
      Acked-by: default avatarVinod Koul <vinod.koul@Intel.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      d7fb0300
    • Jason Cooper's avatar
      dma: mv_xor: remove mv_desc_get_dest_addr() · f984841b
      Jason Cooper authored
      The following commit:
      
        54f8d501 dmaengine: remove DMA unmap from drivers
      
      removed the last caller to mv_desc_get_dest_addr(), creating the
      warning:
      
        drivers/dma/mv_xor.c:57:12: warning: mv_desc_get_dest_addr defined
        but not used [-Wunused-function]
      
      Remove it.
      Signed-off-by: default avatarJason Cooper <jason@lakedaemon.net>
      Acked-by: default avatarVinod Koul <vinod.koul@intel.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      f984841b
  3. 04 Dec, 2013 2 commits
  4. 28 Nov, 2013 5 commits
  5. 22 Nov, 2013 21 commits
    • Linus Torvalds's avatar
      Linux 3.13-rc1 · 6ce4eac1
      Linus Torvalds authored
      6ce4eac1
    • Linus Torvalds's avatar
      Merge tag 'ecryptfs-3.13-rc1-quiet-checkers' of... · 57498f9c
      Linus Torvalds authored
      Merge tag 'ecryptfs-3.13-rc1-quiet-checkers' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs
      
      Pull minor eCryptfs fix from Tyler Hicks:
       "Quiet static checkers by removing unneeded conditionals"
      
      * tag 'ecryptfs-3.13-rc1-quiet-checkers' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
        eCryptfs: file->private_data is always valid
      57498f9c
    • Linus Torvalds's avatar
      Merge tag 'sound-fix2-3.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · e48f88a3
      Linus Torvalds authored
      Pull second set of sound fixes from Takashi Iwai:
       "A collection of small fixes in HD-audio quirks and runtime PM, ASoC
        rcar, abs8500 and other codecs.  Most of commits are for stable
        kernels, too"
      
      * tag 'sound-fix2-3.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - Set current_headset_type to ALC_HEADSET_TYPE_ENUM (janitorial)
        ALSA: hda - Provide missing pin configs for VAIO with ALC260
        ALSA: hda - Add headset quirk for Dell Inspiron 3135
        ALSA: hda - Fix the headphone jack detection on Sony VAIO TX
        ALSA: hda - Fix missing bass speaker on ASUS N550
        ALSA: hda - Fix unbalanced runtime PM notification at resume
        ASoC: arizona: Set FLL to free-run before disabling
        ALSA: hda - A casual Dell Headset quirk
        ASoC: rcar: fixup dma_async_issue_pending() timing
        ASoC: rcar: off by one in rsnd_scu_set_route()
        ASoC: wm5110: Add post SYSCLK register patch for rev D chip
        ASoC: ab8500: Revert to using custom I/O functions
        ALSA: hda - Also enable mute/micmute LED control for "Lenovo dock" fixup
        ALSA: firewire-lib: include sound/asound.h to refer to snd_pcm_format_t
        ALSA: hda - Select FW_LOADER from CONFIG_SND_HDA_CODEC_CA0132_DSP
        ALSA: hda - Enable mute/mic-mute LEDs for more Thinkpads with Realtek codec
        ASoC: rcar: fixup mod access before checking
      e48f88a3
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · aecde27c
      Linus Torvalds authored
      Pull DRM fixes from Dave Airlie:
       "I was going to leave this until post -rc1 but sysfs fixes broke
        hotplug in userspace, so I had to fix it harder, otherwise a set of
        pulls from intel, radeon and vmware,
      
        The vmware/ttm changes are bit larger but since its early and they are
        unlikely to break anything else I put them in, it lets vmware work
        with dri3"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (36 commits)
        drm/sysfs: fix hotplug regression since lifetime changes
        drm/exynos: g2d: fix memory leak to userptr
        drm/i915: Fix gen3 self-refresh watermarks
        drm/ttm: Remove set_need_resched from the ttm fault handler
        drm/ttm: Don't move non-existing data
        drm/radeon: hook up backlight functions for CI and KV family.
        drm/i915: Replicate BIOS eDP bpp clamping hack for hsw
        drm/i915: Do not enable package C8 on unsupported hardware
        drm/i915: Hold pc8 lock around toggling pc8.gpu_idle
        drm/i915: encoder->get_config is no longer optional
        drm/i915/tv: add ->get_config callback
        drm/radeon/cik: Add macrotile mode array query
        drm/radeon/cik: Return backend map information to userspace
        drm/vmwgfx: Make vmwgfx dma buffers prime aware
        drm/vmwgfx: Make surfaces prime-aware
        drm/vmwgfx: Hook up the prime ioctls
        drm/ttm: Add a minimal prime implementation for ttm base objects
        drm/vmwgfx: Fix false lockdep warning
        drm/ttm: Allow execbuf util reserves without ticket
        drm/i915: restore the early forcewake cleanup
        ...
      aecde27c
    • Linus Torvalds's avatar
      Merge tag 'pci-v3.13-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · e3414786
      Linus Torvalds authored
      Pull PCI updates from Bjorn Helgaas:
       "Miscellaneous
         - Remove duplicate disable from pcie_portdrv_remove() (Yinghai Lu)
         - Fix whitespace, capitalization, and spelling errors (Bjorn Helgaas)"
      
      * tag 'pci-v3.13-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        PCI: Remove duplicate pci_disable_device() from pcie_portdrv_remove()
        PCI: Fix whitespace, capitalization, and spelling errors
      e3414786
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · b0e3636f
      Linus Torvalds authored
      Pull SCSI target updates from Nicholas Bellinger:
       "Things have been quiet this round with mostly bugfixes, percpu
        conversions, and other minor iscsi-target conformance testing changes.
      
        The highlights include:
      
         - Add demo_mode_discovery attribute for iscsi-target (Thomas)
         - Convert tcm_fc(FCoE) to use percpu-ida pre-allocation
         - Add send completion interrupt coalescing for ib_isert
         - Convert target-core to use percpu-refcounting for se_lun
         - Fix mutex_trylock usage bug in iscsit_increment_maxcmdsn
         - tcm_loop updates (Hannes)
         - target-core ALUA cleanups + prep for v3.14 SCSI Referrals support (Hannes)
      
        v3.14 is currently shaping to be a busy development cycle in target
        land, with initial support for T10 Referrals and T10 DIF currently on
        the roadmap"
      
      * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (40 commits)
        iscsi-target: chap auth shouldn't match username with trailing garbage
        iscsi-target: fix extract_param to handle buffer length corner case
        iscsi-target: Expose default_erl as TPG attribute
        target_core_configfs: split up ALUA supported states
        target_core_alua: Make supported states configurable
        target_core_alua: Store supported ALUA states
        target_core_alua: Rename ALUA_ACCESS_STATE_OPTIMIZED
        target_core_alua: spellcheck
        target core: rename (ex,im)plict -> (ex,im)plicit
        percpu-refcount: Add percpu-refcount.o to obj-y
        iscsi-target: Do not reject non-immediate CmdSNs exceeding MaxCmdSN
        iscsi-target: Convert iscsi_session statistics to atomic_long_t
        target: Convert se_device statistics to atomic_long_t
        target: Fix delayed Task Aborted Status (TAS) handling bug
        iscsi-target: Reject unsupported multi PDU text command sequence
        ib_isert: Avoid duplicate iscsit_increment_maxcmdsn call
        iscsi-target: Fix mutex_trylock usage in iscsit_increment_maxcmdsn
        target: Core does not need blkdev.h
        target: Pass through I/O topology for block backstores
        iser-target: Avoid using FRMR for single dma entry requests
        ...
      b0e3636f
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging · 0032cdef
      Linus Torvalds authored
      Pull hwmon fixes from Guenter Roeck:
       - acpi_power_meter: Fix return value check from call to
         acpi_bus_get_device
       - nct6775: Fix/improve NCT6791 support
       - lm75: Add support for GMT G751
      
      * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (acpi_power_meter) Fix acpi_bus_get_device() return value check
        hwmon: (nct6775) NCT6791 supports weight control only for CPUFAN
        hwmon: (nct6775) Monitor additional temperature registers
        hwmon: (lm75) Add support for GMT G751 chip
      0032cdef
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · d2c2ad54
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix memory leaks and other issues in mwifiex driver, from Amitkumar
          Karwar.
      
       2) skb_segment() can choke on packets using frag lists, fix from
          Herbert Xu with help from Eric Dumazet and others.
      
       3) IPv4 output cached route instantiation properly handles races
          involving two threads trying to install the same route, but we
          forgot to propagate this logic to input routes as well.  Fix from
          Alexei Starovoitov.
      
       4) Put protections in place to make sure that recvmsg() paths never
          accidently copy uninitialized memory back into userspace and also
          make sure that we never try to use more that sockaddr_storage for
          building the on-kernel-stack copy of a sockaddr.  Fixes from Hannes
          Frederic Sowa.
      
       5) R8152 driver transmit flow bug fixes from Hayes Wang.
      
       6) Fix some minor fallouts from genetlink changes, from Johannes Berg
          and Michael Opdenacker.
      
       7) AF_PACKET sendmsg path can race with netdevice unregister notifier,
          fix by using RCU to make sure the network device doesn't go away
          from under us.  Fix from Daniel Borkmann.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (43 commits)
        gso: handle new frag_list of frags GRO packets
        genetlink: fix genl_set_err() group ID
        genetlink: fix genlmsg_multicast() bug
        packet: fix use after free race in send path when dev is released
        xen-netback: stop the VIF thread before unbinding IRQs
        wimax: remove dead code
        net/phy: Add the autocross feature for forced links on VSC82x4
        net/phy: Add VSC8662 support
        net/phy: Add VSC8574 support
        net/phy: Add VSC8234 support
        net: add BUG_ON if kernel advertises msg_namelen > sizeof(struct sockaddr_storage)
        net: rework recvmsg handler msg_name and msg_namelen logic
        bridge: flush br's address entry in fdb when remove the
        net: core: Always propagate flag changes to interfaces
        ipv4: fix race in concurrent ip_route_input_slow()
        r8152: fix incorrect type in assignment
        r8152: support stopping/waking tx queue
        r8152: modify the tx flow
        r8152: fix tx/rx memory overflow
        netfilter: ebt_ip6: fix source and destination matching
        ...
      d2c2ad54
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm · 7fa850ab
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "Some small fixes for this merge window, most of them quite self
        explanatory - the biggest thing here is a fix for the ARMv7 LPAE
        suspend/resume support"
      
      * 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
        ARM: 7894/1: kconfig: select GENERIC_CLOCKEVENTS if HAVE_ARM_ARCH_TIMER
        ARM: 7893/1: bitops: only emit .arch_extension mp if CONFIG_SMP
        ARM: 7892/1: Fix warning for V7M builds
        ARM: 7888/1: seccomp: not compatible with ARM OABI
        ARM: 7886/1: make OABI default to off
        ARM: 7885/1: Save/Restore 64-bit TTBR registers on LPAE suspend/resume
        ARM: 7884/1: mm: Fix ECC mem policy printk
        ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE
        ARM: 7882/1: mm: fix __phys_to_virt to work with 64 bit phys_addr_t in BE case
        ARM: 7881/1: __fixup_smp read of SCU config should do byteswap in BE case
        ARM: Fix nommu.c build warning
      7fa850ab
    • Linus Torvalds's avatar
      Merge branch 'next' of git://git.kernel.org/pub/scm/virt/kvm/kvm · c874e6fc
      Linus Torvalds authored
      Pull KVM fixes from Gleb Natapov.
      
      * 'next' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: kvm_clear_guest_page(): fix empty_zero_page usage
        kvm: mmu: delay mmu audit activation
        arm/arm64: KVM: Fix hyp mappings of vmalloc regions
      c874e6fc
    • Linus Torvalds's avatar
      Merge git://git.kvack.org/~bcrl/aio-next · d0f278c1
      Linus Torvalds authored
      Pull aio fixes from Benjamin LaHaise.
      
      * git://git.kvack.org/~bcrl/aio-next:
        aio: nullify aio->ring_pages after freeing it
        aio: prevent double free in ioctx_alloc
        aio: Fix a trinity splat
      d0f278c1
    • Linus Torvalds's avatar
      Merge branch 'for-3.13' of git://linux-nfs.org/~bfields/linux · 533db9b3
      Linus Torvalds authored
      Pull nfsd bugfixes from Bruce Fields:
       "A couple nfsd bugfixes"
      
      * 'for-3.13' of git://linux-nfs.org/~bfields/linux:
        nfsd4: fix xdr decoding of large non-write compounds
        nfsd: make sure to balance get/put_write_access
        nfsd: split up nfsd_setattr
      533db9b3
    • Linus Torvalds's avatar
      Merge tag 'gfs2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-fixes · c85e0727
      Linus Torvalds authored
      Pull GFS2 fixes from Steven Whitehouse:
       "A couple of small, but important bug fixes for GFS2.  The first one
        fixes a possible NULL pointer dereference, and the second one resolves
        a reference counting issue in one of the lesser used paths through
        atomic_open"
      
      * tag 'gfs2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-fixes:
        GFS2: Fix ref count bug relating to atomic_open
        GFS2: fix potential NULL pointer dereference
      c85e0727
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · fb0d1eb8
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "Almost all of these are bug fixes.  Dave Sterba's documentation update
        is the big exception because he removed our promises to set any
        machine running Btrfs on fire"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Documentation: filesystems: update btrfs tools section
        Documentation: filesystems: add new btrfs mount options
        btrfs: update kconfig help text
        btrfs: fix bio_size_ok() for max_sectors > 0xffff
        btrfs: Use trace condition for get_extent tracepoint
        btrfs: fix typo in the log message
        Btrfs: fix list delete warning when removing ordered root from the list
        Btrfs: print bytenr instead of page pointer in check-int
        Btrfs: remove dead codes from ctree.h
        Btrfs: don't wait for ordered data outside desired range
        Btrfs: fix lockdep error in async commit
        Btrfs: avoid heavy operations in btrfs_commit_super
        Btrfs: fix __btrfs_start_workers retval
        Btrfs: disable online raid-repair on ro mounts
        Btrfs: do not inc uncorrectable_errors counter on ro scrubs
        Btrfs: only drop modified extents if we logged the whole inode
        Btrfs: make sure to copy everything if we rename
        Btrfs: don't BUG_ON() if we get an error walking backrefs
      fb0d1eb8
    • Linus Torvalds's avatar
      Merge tag 'xfs-for-linus-v3.13-rc1-2' of git://oss.sgi.com/xfs/xfs · 6ea9786e
      Linus Torvalds authored
      Pull second xfs update from Ben Myers:
       "There are a couple of patches that I wasn't quite sure about in time
        for our initial 3.13 pull request, a bugfix, and an update to add Dave
        to MAINTAINERS:
      
        Here we have a performance fix for inode iversion, increased inode
        cluster size for v5 superblock filesystems, a fix for error handling
        in xfs_bmap_add_attrfork, and a MAINTAINERS update to add Dave"
      
      * tag 'xfs-for-linus-v3.13-rc1-2' of git://oss.sgi.com/xfs/xfs:
        xfs: open code inc_inode_iversion when logging an inode
        xfs: increase inode cluster size for v5 filesystems
        xfs: fix unlock in xfs_bmap_add_attrfork
        xfs: update maintainers
      6ea9786e
    • Linus Torvalds's avatar
      Merge branch 'slab/next' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux · 24f971ab
      Linus Torvalds authored
      Pull SLAB changes from Pekka Enberg:
       "The patches from Joonsoo Kim switch mm/slab.c to use 'struct page' for
        slab internals similar to mm/slub.c.  This reduces memory usage and
        improves performance:
      
          https://lkml.org/lkml/2013/10/16/155
      
        Rest of the changes are bug fixes from various people"
      
      * 'slab/next' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux: (21 commits)
        mm, slub: fix the typo in mm/slub.c
        mm, slub: fix the typo in include/linux/slub_def.h
        slub: Handle NULL parameter in kmem_cache_flags
        slab: replace non-existing 'struct freelist *' with 'void *'
        slab: fix to calm down kmemleak warning
        slub: proper kmemleak tracking if CONFIG_SLUB_DEBUG disabled
        slab: rename slab_bufctl to slab_freelist
        slab: remove useless statement for checking pfmemalloc
        slab: use struct page for slab management
        slab: replace free and inuse in struct slab with newly introduced active
        slab: remove SLAB_LIMIT
        slab: remove kmem_bufctl_t
        slab: change the management method of free objects of the slab
        slab: use __GFP_COMP flag for allocating slab pages
        slab: use well-defined macro, virt_to_slab()
        slab: overloading the RCU head over the LRU for RCU free
        slab: remove cachep in struct slab_rcu
        slab: remove nodeid in struct slab
        slab: remove colouroff in struct slab
        slab: change return type of kmem_getpages() to struct page
        ...
      24f971ab
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · 3bab0bf0
      Linus Torvalds authored
      Pull third set of powerpc updates from Benjamin Herrenschmidt:
       "This is a small collection of random bug fixes and a few improvements
        of Oops output which I deemed valuable enough to include as well.
      
        The fixes are essentially recent build breakage and regressions, and a
        couple of older bugs such as the DTL log duplication, the EEH issue
        with PCI_COMMAND_MASTER and the problem with small contexts passed to
        get/set_context with VSX enabled"
      
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
        powerpc/signals: Mark VSX not saved with small contexts
        powerpc/pseries: Fix SMP=n build of rng.c
        powerpc: Make cpu_to_chip_id() available when SMP=n
        powerpc/vio: Fix a dma_mask issue of vio
        powerpc: booke: Fix build failures
        powerpc: ppc64 address space capped at 32TB, mmap randomisation disabled
        powerpc: Only print PACATMSCRATCH in oops when TM is active
        powerpc/pseries: Duplicate dtl entries sometimes sent to userspace
        powerpc: Remove a few lines of oops output
        powerpc: Print DAR and DSISR on machine check oopses
        powerpc: Fix __get_user_pages_fast() irq handling
        powerpc/eeh: More accurate log
        powerpc/eeh: Enable PCI_COMMAND_MASTER for PCI bridges
      3bab0bf0
    • David Henningsson's avatar
      ALSA: hda - Set current_headset_type to ALC_HEADSET_TYPE_ENUM (janitorial) · 5db4d34b
      David Henningsson authored
      current_headset_type should be of the HEADSET_TYPE enum, not the
      HEADSET_MODE enum. Since ALC_HEADSET_TYPE_UNKNOWN and ALC_HEADSET_MODE_UNKNOWN
      are both 0, this patch is just janitorial.
      Signed-off-by: default avatarDavid Henningsson <david.henningsson@canonical.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      5db4d34b
    • Takashi Iwai's avatar
      ALSA: hda - Provide missing pin configs for VAIO with ALC260 · d08c5ef2
      Takashi Iwai authored
      Some models (or maybe depending on BIOS version) of Sony VAIO with
      ALC260 give no proper pin configurations as default, resulting in the
      non-working speaker, etc.  Just provide the whole pin configurations
      via a fixup.
      Reported-by: default avatarMatthew Markus <mmarkus@hearit.co>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      d08c5ef2
    • Linus Torvalds's avatar
      Merge branch 'akpm' (fixes from Andrew) · a5d6e633
      Linus Torvalds authored
      Merge patches from Andrew Morton:
       "13 fixes"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        mm: place page->pmd_huge_pte to right union
        MAINTAINERS: add keyboard driver to Hyper-V file list
        x86, mm: do not leak page->ptl for pmd page tables
        ipc,shm: correct error return value in shmctl (SHM_UNLOCK)
        mm, mempolicy: silence gcc warning
        block/partitions/efi.c: fix bound check
        ARM: drivers/rtc/rtc-at91rm9200.c: disable interrupts at shutdown
        mm: hugetlbfs: fix hugetlbfs optimization
        kernel: remove CONFIG_USE_GENERIC_SMP_HELPERS cleanly
        ipc,shm: fix shm_file deletion races
        mm: thp: give transparent hugepage code a separate copy_page
        checkpatch: fix "Use of uninitialized value" warnings
        configfs: fix race between dentry put and lookup
      a5d6e633
    • Linus Torvalds's avatar
      Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security · 78dc53c4
      Linus Torvalds authored
      Pull security subsystem updates from James Morris:
       "In this patchset, we finally get an SELinux update, with Paul Moore
        taking over as maintainer of that code.
      
        Also a significant update for the Keys subsystem, as well as
        maintenance updates to Smack, IMA, TPM, and Apparmor"
      
      and since I wanted to know more about the updates to key handling,
      here's the explanation from David Howells on that:
      
       "Okay.  There are a number of separate bits.  I'll go over the big bits
        and the odd important other bit, most of the smaller bits are just
        fixes and cleanups.  If you want the small bits accounting for, I can
        do that too.
      
         (1) Keyring capacity expansion.
      
              KEYS: Consolidate the concept of an 'index key' for key access
              KEYS: Introduce a search context structure
              KEYS: Search for auth-key by name rather than target key ID
              Add a generic associative array implementation.
              KEYS: Expand the capacity of a keyring
      
           Several of the patches are providing an expansion of the capacity of a
           keyring.  Currently, the maximum size of a keyring payload is one page.
           Subtract a small header and then divide up into pointers, that only gives
           you ~500 pointers on an x86_64 box.  However, since the NFS idmapper uses
           a keyring to store ID mapping data, that has proven to be insufficient to
           the cause.
      
           Whatever data structure I use to handle the keyring payload, it can only
           store pointers to keys, not the keys themselves because several keyrings
           may point to a single key.  This precludes inserting, say, and rb_node
           struct into the key struct for this purpose.
      
           I could make an rbtree of records such that each record has an rb_node
           and a key pointer, but that would use four words of space per key stored
           in the keyring.  It would, however, be able to use much existing code.
      
           I selected instead a non-rebalancing radix-tree type approach as that
           could have a better space-used/key-pointer ratio.  I could have used the
           radix tree implementation that we already have and insert keys into it by
           their serial numbers, but that means any sort of search must iterate over
           the whole radix tree.  Further, its nodes are a bit on the capacious side
           for what I want - especially given that key serial numbers are randomly
           allocated, thus leaving a lot of empty space in the tree.
      
           So what I have is an associative array that internally is a radix-tree
           with 16 pointers per node where the index key is constructed from the key
           type pointer and the key description.  This means that an exact lookup by
           type+description is very fast as this tells us how to navigate directly to
           the target key.
      
           I made the data structure general in lib/assoc_array.c as far as it is
           concerned, its index key is just a sequence of bits that leads to a
           pointer.  It's possible that someone else will be able to make use of it
           also.  FS-Cache might, for example.
      
         (2) Mark keys as 'trusted' and keyrings as 'trusted only'.
      
              KEYS: verify a certificate is signed by a 'trusted' key
              KEYS: Make the system 'trusted' keyring viewable by userspace
              KEYS: Add a 'trusted' flag and a 'trusted only' flag
              KEYS: Separate the kernel signature checking keyring from module signing
      
           These patches allow keys carrying asymmetric public keys to be marked as
           being 'trusted' and allow keyrings to be marked as only permitting the
           addition or linkage of trusted keys.
      
           Keys loaded from hardware during kernel boot or compiled into the kernel
           during build are marked as being trusted automatically.  New keys can be
           loaded at runtime with add_key().  They are checked against the system
           keyring contents and if their signatures can be validated with keys that
           are already marked trusted, then they are marked trusted also and can
           thus be added into the master keyring.
      
           Patches from Mimi Zohar make this usable with the IMA keyrings also.
      
         (3) Remove the date checks on the key used to validate a module signature.
      
              X.509: Remove certificate date checks
      
           It's not reasonable to reject a signature just because the key that it was
           generated with is no longer valid datewise - especially if the kernel
           hasn't yet managed to set the system clock when the first module is
           loaded - so just remove those checks.
      
         (4) Make it simpler to deal with additional X.509 being loaded into the kernel.
      
              KEYS: Load *.x509 files into kernel keyring
              KEYS: Have make canonicalise the paths of the X.509 certs better to deduplicate
      
           The builder of the kernel now just places files with the extension ".x509"
           into the kernel source or build trees and they're concatenated by the
           kernel build and stuffed into the appropriate section.
      
         (5) Add support for userspace kerberos to use keyrings.
      
              KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches
              KEYS: Implement a big key type that can save to tmpfs
      
           Fedora went to, by default, storing kerberos tickets and tokens in tmpfs.
           We looked at storing it in keyrings instead as that confers certain
           advantages such as tickets being automatically deleted after a certain
           amount of time and the ability for the kernel to get at these tokens more
           easily.
      
           To make this work, two things were needed:
      
           (a) A way for the tickets to persist beyond the lifetime of all a user's
               sessions so that cron-driven processes can still use them.
      
               The problem is that a user's session keyrings are deleted when the
               session that spawned them logs out and the user's user keyring is
               deleted when the UID is deleted (typically when the last log out
               happens), so neither of these places is suitable.
      
               I've added a system keyring into which a 'persistent' keyring is
               created for each UID on request.  Each time a user requests their
               persistent keyring, the expiry time on it is set anew.  If the user
               doesn't ask for it for, say, three days, the keyring is automatically
               expired and garbage collected using the existing gc.  All the kerberos
               tokens it held are then also gc'd.
      
           (b) A key type that can hold really big tickets (up to 1MB in size).
      
               The problem is that Active Directory can return huge tickets with lots
               of auxiliary data attached.  We don't, however, want to eat up huge
               tracts of unswappable kernel space for this, so if the ticket is
               greater than a certain size, we create a swappable shmem file and dump
               the contents in there and just live with the fact we then have an
               inode and a dentry overhead.  If the ticket is smaller than that, we
               slap it in a kmalloc()'d buffer"
      
      * 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (121 commits)
        KEYS: Fix keyring content gc scanner
        KEYS: Fix error handling in big_key instantiation
        KEYS: Fix UID check in keyctl_get_persistent()
        KEYS: The RSA public key algorithm needs to select MPILIB
        ima: define '_ima' as a builtin 'trusted' keyring
        ima: extend the measurement list to include the file signature
        kernel/system_certificate.S: use real contents instead of macro GLOBAL()
        KEYS: fix error return code in big_key_instantiate()
        KEYS: Fix keyring quota misaccounting on key replacement and unlink
        KEYS: Fix a race between negating a key and reading the error set
        KEYS: Make BIG_KEYS boolean
        apparmor: remove the "task" arg from may_change_ptraced_domain()
        apparmor: remove parent task info from audit logging
        apparmor: remove tsk field from the apparmor_audit_struct
        apparmor: fix capability to not use the current task, during reporting
        Smack: Ptrace access check mode
        ima: provide hash algo info in the xattr
        ima: enable support for larger default filedata hash algorithms
        ima: define kernel parameter 'ima_template=' to change configured default
        ima: add Kconfig default measurement list template
        ...
      78dc53c4