1. 03 Aug, 2015 4 commits
    • Benjamin Randazzo's avatar
      md: use kzalloc() when bitmap is disabled · b6878d9e
      Benjamin Randazzo authored
      In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a
      mdu_bitmap_file_t called "file".
      
      5769         file = kmalloc(sizeof(*file), GFP_NOIO);
      5770         if (!file)
      5771                 return -ENOMEM;
      
      This structure is copied to user space at the end of the function.
      
      5786         if (err == 0 &&
      5787             copy_to_user(arg, file, sizeof(*file)))
      5788                 err = -EFAULT
      
      But if bitmap is disabled only the first byte of "file" is initialized
      with zero, so it's possible to read some bytes (up to 4095) of kernel
      space memory from user space. This is an information leak.
      
      5775         /* bitmap disabled, zero the first byte and copy out */
      5776         if (!mddev->bitmap_info.file)
      5777                 file->pathname[0] = '\0';
      Signed-off-by: default avatarBenjamin Randazzo <benjamin@randazzo.fr>
      Signed-off-by: default avatarNeilBrown <neilb@suse.com>
      b6878d9e
    • NeilBrown's avatar
      md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies · 423f04d6
      NeilBrown authored
      raid1_end_read_request() assumes that the In_sync bits are consistent
      with the ->degaded count.
      raid1_spare_active updates the In_sync bit before the ->degraded count
      and so exposes an inconsistency, as does error()
      So extend the spinlock in raid1_spare_active() and error() to hide those
      inconsistencies.
      
      This should probably be part of
        Commit: 34cab6f4 ("md/raid1: fix test for 'was read error from
        last working device'.")
      as it addresses the same issue.  It fixes the same bug and should go
      to -stable for same reasons.
      
      Fixes: 76073054 ("md/raid1: clean up read_balance.")
      Cc: stable@vger.kernel.org (v3.0+)
      Signed-off-by: default avatarNeilBrown <neilb@suse.com>
      423f04d6
    • Linus Torvalds's avatar
      Linux 4.2-rc5 · 74d33293
      Linus Torvalds authored
      74d33293
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · d08c3181
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       - TCE table memory calculation fix from Alexey
       - Build fix for ans-lcd from Luis
       - Unbalanced IRQ warning fix from Alistair
      
      * tag 'powerpc-4.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/eeh-powernv: Fix unbalanced IRQ warning
        macintosh/ans-lcd: fix build failure after module_init/exit relocation
        powerpc/powernv/ioda2: Fix calculation for memory allocated for TCE table
      d08c3181
  2. 02 Aug, 2015 5 commits
    • Linus Torvalds's avatar
      i915: temporary fix for DP MST docking station NULL pointer dereference · 27667f47
      Linus Torvalds authored
      Ted Ts'o reports that his Lenovo T540p ThinkPad crashes at boot if
      attached to the docking station.  This is a regression that he was able
      to bisect to commit 8c7b5ccb: "drm/i915: Use atomic helpers for
      computing changed flags:"
      
      The reason seems to be the new call to drm_atomic_helper_check_modeset()
      added to intel_modeset_compute_config(), which in turn calls
      update_connector_routing(), and somehow ends up picking a NULL crtc for
      the connector state, causing the subsequent drm_crtc_index() to OOPS.
      
      Daniel Vetter says that the fundamental issue seems to be confusion in
      the encoder selection, and this isn't the right fix, but while he chases
      down the proper fix, this at least avoids the NULL pointer dereference
      and makes Ted's docking station work again.
      Reported-bisected-and-tested-by: default avatarTheodore Ts'o <tytso@mit.edu>
      Cc: Daniel Vetter <daniel.vetter@intel.com>
      Cc: Mani Nikula <jani.nikula@linux.intel.com>
      Cc: Dave Airlie <airlied@gmail.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      27667f47
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · d4edea40
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "A set of three fixes for the ipr driver and one fairly major one for
        memory leaks in the mq path of SCSI"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: fix memory leak with scsi-mq
        ipr: Fix invalid array indexing for HRRQ
        ipr: Fix incorrect trace indexing
        ipr: Fix locking for unit attention handling
      d4edea40
    • Linus Torvalds's avatar
      Merge tag 'armsoc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 30c7b56d
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "Things are calming down nicely here w.r.t. fixes.  This batch
        includes two week's worth since I missed to send before -rc4.
      
        Nothing particularly scary to point out, smaller fixes here and there.
        Shortlog describes it pretty well"
      
      * tag 'armsoc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: dts: keystone: fix dt bindings to use post div register for mainpll
        ARM: nomadik: disable UART0 on Nomadik boards
        ARM: dts: i.MX35: Fix can support.
        ARM: OMAP2+: hwmod: Fix _wait_target_ready() for hwmods without sysc
        ARM: dts: add CPU OPP and regulator supply property for exynos4210
        ARM: dts: Update video-phy node with syscon phandle for exynos3250
        ARM: DRA7: hwmod: fix gpmc hwmod
      30c7b56d
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 01183609
      Linus Torvalds authored
      Pull VFS fix from Al Viro:
       "Spurious ENOTDIR fix"
      
      This should fix the problems reported by Dominique Martinet and Hugh
      Dickins.
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        link_path_walk(): be careful when failing with ENOTDIR
      01183609
    • Al Viro's avatar
      link_path_walk(): be careful when failing with ENOTDIR · 97242f99
      Al Viro authored
      In RCU mode we might end up with dentry evicted just we check
      that it's a directory.  In such case we should return ECHILD
      rather than ENOTDIR, so that pathwalk would be retries in non-RCU
      mode.
      
      Breakage had been introduced in commit b18825a7 - prior to that
      we were looking at nd->inode, which had been fetched before
      verifying that ->d_seq was still valid.  That form of check
      would only be satisfied if at some point the pathname prefix
      would indeed have resolved to a non-directory.  The fix consists
      of checking ->d_seq after we'd run into a non-directory dentry,
      and failing with ECHILD in case of mismatch.
      
      Note that all branches since 3.12 have that problem...
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      97242f99
  3. 01 Aug, 2015 6 commits
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-4.2-rc5' of git://git.infradead.org/users/vkoul/slave-dma · 3f6d9e08
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "We had a regression due to reuse of descriptor so we have reverted
        that.
      
        The rest are driver fixes:
      
         - at_hdmac and at_xdmac for residue, trannfer width, and channel config
         - pl330 final fix for dma fails and overflow issue
         - xgene resouce map fix
         - mv_xor big endian op fix"
      
      * tag 'dmaengine-fix-4.2-rc5' of git://git.infradead.org/users/vkoul/slave-dma:
        Revert "dmaengine: virt-dma: don't always free descriptor upon completion"
        dmaengine: mv_xor: fix big endian operation in register mode
        dmaengine: xgene-dma: Fix the resource map to handle overlapping
        dmaengine: at_xdmac: fix transfer data width in at_xdmac_prep_slave_sg()
        dmaengine: at_hdmac: fix residue computation
        dmaengine: at_xdmac: fix bug about channel configuration
        dmaengine: pl330: Really fix choppy sound because of wrong residue calculation
        dmaengine: pl330: Fix overflow when reporting residue in memcpy
      3f6d9e08
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 3270c8ea
      Linus Torvalds authored
      Pull irq fixlets from Thomas Gleixner:
       "Just two updates to the maintainers file"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        MAINTAINERS: Appoint Jiang and Marc as irqdomain maintainers
        MAINTAINERS: Appoint Marc Zyngier as irqchips co-maintainer
      3270c8ea
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 51d2e09b
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Fallout from the recent NMI fixes: make x86 LDT handling more robust.
      
        Also some EFI fixes"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/ldt: Make modify_ldt synchronous
        x86/xen: Probe target addresses in set_aliased_prot() before the hypercall
        x86/irq: Use the caller provided polarity setting in mp_check_pin_attr()
        efi: Check for NULL efi kernel parameters
        x86/efi: Use all 64 bit of efi_memmap in setup_e820()
      51d2e09b
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 7c764cec
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Must teardown SR-IOV before unregistering netdev in igb driver, from
          Alex Williamson.
      
       2) Fix ipv6 route unreachable crash in IPVS, from Alex Gartrell.
      
       3) Default route selection in ipv4 should take the prefix length, table
          ID, and TOS into account, from Julian Anastasov.
      
       4) sch_plug must have a reset method in order to purge all buffered
          packets when the qdisc is reset, likewise for sch_choke, from WANG
          Cong.
      
       5) Fix deadlock and races in slave_changelink/br_setport in bridging.
          From Nikolay Aleksandrov.
      
       6) mlx4 bug fixes (wrong index in port even propagation to VFs,
          overzealous BUG_ON assertion, etc.) from Ido Shamay, Jack
          Morgenstein, and Or Gerlitz.
      
       7) Turn off klog message about SCTP userspace interface compat that
          makes no sense at all, from Daniel Borkmann.
      
       8) Fix unbounded restarts of inet frag eviction process, causing NMI
          watchdog soft lockup messages, from Florian Westphal.
      
       9) Suspend/resume fixes for r8152 from Hayes Wang.
      
      10) Fix busy loop when MSG_WAITALL|MSG_PEEK is used in TCP recv, from
          Sabrina Dubroca.
      
      11) Fix performance regression when removing a lot of routes from the
          ipv4 routing tables, from Alexander Duyck.
      
      12) Fix device leak in AF_PACKET, from Lars Westerhoff.
      
      13) AF_PACKET also has a header length comparison bug due to signedness,
          from Alexander Drozdov.
      
      14) Fix bug in EBPF tail call generation on x86, from Daniel Borkmann.
      
      15) Memory leaks, TSO stats, watchdog timeout and other fixes to
          thunderx driver from Sunil Goutham and Thanneeru Srinivasulu.
      
      16) act_bpf can leak memory when replacing programs, from Daniel
          Borkmann.
      
      17) WOL packet fixes in gianfar driver, from Claudiu Manoil.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (79 commits)
        stmmac: fix missing MODULE_LICENSE in stmmac_platform
        gianfar: Enable device wakeup when appropriate
        gianfar: Fix suspend/resume for wol magic packet
        gianfar: Fix warning when CONFIG_PM off
        act_pedit: check binding before calling tcf_hash_release()
        net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket
        net: sched: fix refcount imbalance in actions
        r8152: reset device when tx timeout
        r8152: add pre_reset and post_reset
        qlcnic: Fix corruption while copying
        act_bpf: fix memory leaks when replacing bpf programs
        net: thunderx: Fix for crash while BGX teardown
        net: thunderx: Add PCI driver shutdown routine
        net: thunderx: Fix crash when changing rss with mutliple traffic flows
        net: thunderx: Set watchdog timeout value
        net: thunderx: Wakeup TXQ only if CQE_TX are processed
        net: thunderx: Suppress alloc_pages() failure warnings
        net: thunderx: Fix TSO packet statistic
        net: thunderx: Fix memory leak when changing queue count
        net: thunderx: Fix RQ_DROP miscalculation
        ...
      7c764cec
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · acea568f
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "Filipe fixed up a hard to trigger ENOSPC regression from our merge
        window pull, and we have a few other smaller fixes"
      
      * 'for-linus-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: fix quick exhaustion of the system array in the superblock
        btrfs: its btrfs_err() instead of btrfs_error()
        btrfs: Avoid NULL pointer dereference of free_extent_buffer when read_tree_block() fail
        btrfs: Fix lockdep warning of btrfs_run_delayed_iputs()
      acea568f
    • Linus Torvalds's avatar
      Merge tag 'sound-4.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · c6fd4fc7
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This became a relative big update as it includes the collected ASoC
        fixes.  There are a few fixes in ASoC core side, mostly for DAPM and
        the new topology API.  The rest are various ASoC driver-specific
        fixes, as well as the usual HD-audio and USB-audio quirks"
      
      * tag 'sound-4.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (29 commits)
        ALSA: hda - Fix MacBook Pro 5,2 quirk
        ALSA: hda - Fix race between PM ops and HDA init/probe
        ALSA: usb-audio: add dB range mapping for some devices
        ALSA: hda - Apply a fixup to Dell Vostro 5480
        ALSA: hda - Add pin quirk for the headset mic jack detection on Dell laptop
        ALSA: hda - Apply fixup for another Toshiba Satellite S50D
        ALSA: fireworks: add support for AudioFire2 quirk
        ALSA: hda - Fix the headset mic that will not work on Dell desktop machine
        ALSA: hda - fix cs4210_spdif_automute()
        ASoC: pcm1681: Fix setting de-emphasis sampling rate selection
        ASoC: ssm4567: Keep TDM_BCLKS in ssm4567_set_dai_fmt
        ASoC: sgtl5000: Fix up define for SGTL5000_SMALL_POP
        ASoC: dapm: Don't add prefix to widget stream name
        ASoC: rt5645: Check if codec is initialized in workqueue handler
        ASoC: Intel: Get correct usage_count value to load firmware
        ASoC: topology: Fix to add dapm mixer info
        ASoC: zx: spdif: Fix devm_ioremap_resource return value check
        ASoC: zx: i2s: Fix devm_ioremap_resource return value check
        ASoC: mediatek: Use platform_of_node for machine drivers
        ASoC: Free card DAPM context on snd_soc_instantiate_card() error path
        ...
      c6fd4fc7
  4. 31 Jul, 2015 21 commits
    • Joachim Eastwood's avatar
      stmmac: fix missing MODULE_LICENSE in stmmac_platform · ea111545
      Joachim Eastwood authored
      Commit 50649ab1 ("stmmac: drop driver from stmmac platform code")
      was a bit overzealous in removing code and dropped the MODULE_*
      macro's that are still needed since stmmac_platform can be a module.
      Fix this by putting the macro's remvoed in 50649ab1 back.
      
      This fixes the following errors when used as a module:
        stmmac_platform: module license 'unspecified' taints kernel.
        Disabling lock debugging due to kernel taint
        stmmac_platform: Unknown symbol devm_kmalloc (err 0)
        stmmac_platform: Unknown symbol stmmac_suspend (err 0)
        stmmac_platform: Unknown symbol platform_get_irq_byname (err 0)
        stmmac_platform: Unknown symbol stmmac_dvr_remove (err 0)
        stmmac_platform: Unknown symbol platform_get_resource (err 0)
        stmmac_platform: Unknown symbol of_get_phy_mode (err 0)
        stmmac_platform: Unknown symbol of_property_read_u32_array (err 0)
        stmmac_platform: Unknown symbol of_alias_get_id (err 0)
        stmmac_platform: Unknown symbol stmmac_resume (err 0)
        stmmac_platform: Unknown symbol stmmac_dvr_probe (err 0)
      
      Fixes: 50649ab1 ("stmmac: drop driver from stmmac platform code")
      Reported-by: default avatarIgor Gnatenko <i.gnatenko.brain@gmail.com>
      Signed-off-by: default avatarJoachim Eastwood <manabian@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ea111545
    • David S. Miller's avatar
      Merge branch 'gianfar-wol-fixes' · ef1f4364
      David S. Miller authored
      Claudiu Manoil says:
      
      ====================
      gianfar: wol magic packet fixes
      
      These changes were already validated as part of FSL SDK.
      Patch 2 fixes occasional wake-on magic packet failures during
      traffic, probably due to incorrect traffic stop/ device halt
      sequence and incorrect usage of txlock.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ef1f4364
    • Claudiu Manoil's avatar
      gianfar: Enable device wakeup when appropriate · b0734b6d
      Claudiu Manoil authored
      The wol_en flag is 0 by default anyway, and we have the
      following inconsistency: a MAGIC packet wol capable eth
      interface is registered as a wake-up source but unable
      to wake-up the system as wol_en is 0 (wake-on flag set to 'd').
      Calling set_wakeup_enable() at netdev open is just redundant
      because wol_en is 0 by default.
      Let only ethtool call set_wakeup_enable() for now.
      
      The bflock is obviously obsoleted, its utility has been corroded
      over time.  The bitfield flags used today in gianfar are accessed
      only on the init/ config path, with no real possibility of
      concurrency - nothing that would justify smth. like bflock.
      Signed-off-by: default avatarClaudiu Manoil <claudiu.manoil@freescale.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b0734b6d
    • Claudiu Manoil's avatar
      gianfar: Fix suspend/resume for wol magic packet · 614b4242
      Claudiu Manoil authored
      If we disable NAPI in the first place we can mask the device's
      interrupts (and halt it) without fearing that imask may be
      concurrently accessed from interrupt context, so there's
      no need to do local_irq_save() around gfar_halt_nodisable().
      lock_rx_qs()/unlock_tx_qs() are just obsoleted and potentially
      buggy routines.  The txlock is currently used in the driver only
      to manage TX congestion, it has nothing to do with halting the
      device.  With these changes, the TX processing is stopped before
      gfar_halt().
      
      Compact gfar_halt() is used instead of gfar_halt_nodisable(),
      as it disables Rx/TX DMA h/w blocks and the Rx/TX h/w queues.
      gfar_start() re-enables all these blocks on resume.  Enabling
      the magic-packet mode remains the same, note that the RX block
      is re-enabled just before entering sleep mode.
      
      Add IRQF_NO_SUSPEND flag for the error interrupt line, to signal
      that the interrupt line must remain active during sleep in order
      to wake the system by magic packet (MAG) reception interrupt.
      (On some systems the MAG interrupt did trigger w/o this flag
      as well, but on others it didn't.)
      
      Without these fixes, when suspended during fair Tx traffic the
      interface occasionally failed to be woken up by magic packet.
      Signed-off-by: default avatarClaudiu Manoil <claudiu.manoil@freescale.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      614b4242
    • Claudiu Manoil's avatar
      gianfar: Fix warning when CONFIG_PM off · 84868305
      Claudiu Manoil authored
      CC      drivers/net/ethernet/freescale/gianfar.o
      drivers/net/ethernet/freescale/gianfar.c:568:13: warning: 'lock_tx_qs'
      defined but not used [-Wunused-function]
       static void lock_tx_qs(struct gfar_private *priv)
                   ^
      drivers/net/ethernet/freescale/gianfar.c:576:13: warning: 'unlock_tx_qs'
      defined but not used [-Wunused-function]
       static void unlock_tx_qs(struct gfar_private *priv)
                   ^
      Reported-by: default avatarScott Wood <scottwood@freescale.com>
      Signed-off-by: default avatarClaudiu Manoil <claudiu.manoil@freescale.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      84868305
    • WANG Cong's avatar
      act_pedit: check binding before calling tcf_hash_release() · 5175f710
      WANG Cong authored
      When we share an action within a filter, the bind refcnt
      should increase, therefore we should not call tcf_hash_release().
      
      Fixes: 1a29321e ("net_sched: act: Dont increment refcnt on replace")
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Daniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarCong Wang <cwang@twopensource.com>
      Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5175f710
    • Murali Karicheri's avatar
      ARM: dts: keystone: fix dt bindings to use post div register for mainpll · c1bfa985
      Murali Karicheri authored
      All of the keystone devices have a separate register to hold post
      divider value for main pll clock. Currently the fixed-postdiv
      value used for k2hk/l/e SoCs works by sheer luck as u-boot happens to
      use a value of 2 for this. Now that we have fixed this in the pll
      clock driver change the dt bindings for the same.
      Signed-off-by: default avatarMurali Karicheri <m-karicheri2@ti.com>
      Acked-by: default avatarSantosh Shilimkar <ssantosh@kernel.org>
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      c1bfa985
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 5e49e0be
      Linus Torvalds authored
      Pull IOMMU fixes from Joerg Roedel:
       "These fixes are all for the AMD IOMMU driver:
      
         - A regression with HSA caused by the conversion of the driver to
           default domains.  The fixes make sure that an HSA device can still
           be attached to an IOMMUv2 domain and that these domains also allow
           non-IOMMUv2 capable devices.
      
         - Fix iommu=pt mode which did not work because the dma_ops where set
           to nommu_ops, which breaks devices that can only do 32bit DMA.
      
         - Fix an issue with non-PCI devices not working, because there are no
           dma_ops for them.  This issue was discovered recently as new AMD
           x86 platforms have non-PCI devices too"
      
      * tag 'iommu-fixes-v4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        iommu/amd: Allow non-ATS devices in IOMMUv2 domains
        iommu/amd: Set global dma_ops if swiotlb is disabled
        iommu/amd: Use swiotlb in passthrough mode
        iommu/amd: Allow non-IOMMUv2 devices in IOMMUv2 domains
        iommu/amd: Use iommu core for passthrough mode
        iommu/amd: Use iommu_attach_group()
      5e49e0be
    • Linus Torvalds's avatar
      Merge tag 'drm-intel-fixes-2015-07-31' of git://anongit.freedesktop.org/drm-intel · 23ff9e19
      Linus Torvalds authored
      Pull drm intel fixes from Daniel Vetter:
       "I delayed my -fixes pull a bit hoping that I could include a fix for
        the dp mst stuff but looks a bit more nasty than that.  So just 3
        other regression fixes, one 4.2 other two cc: stable"
      
      * tag 'drm-intel-fixes-2015-07-31' of git://anongit.freedesktop.org/drm-intel:
        drm/i915: Declare the swizzling unknown for L-shaped configurations
        drm/i915: Mark PIN_USER binding as GLOBAL_BIND without the aliasing ppgtt
        drm/i915: Replace WARN inside I915_READ64_2x32 with retry loop
      23ff9e19
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · fd56d1d6
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This has a bunch of nouveau fixes, as Ben has been hibernating and has
        lots of small fixes for lots of bugs across nouveau.
      
        Radeon has one major fix for hdmi/dp audio regression that is larger
        than Alex would like, but seems to fix up a fair few bugs, along with
        some misc fixes.
      
        And a few msm fixes, one of which is also a bit large.
      
        But nothing in here seems insane or crazy for this stage, just more
        than I'd like"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (33 commits)
        drm/msm/mdp5: release SMB (shared memory blocks) in various cases
        drm/msm: change to uninterruptible wait in atomic commit
        drm/msm: mdp4: Fix drm_framebuffer dereference crash
        drm/msm: fix msm_gem_prime_get_sg_table()
        drm/amdgpu: add new parameter to seperate map and unmap
        drm/amdgpu: hdp_flush is not needed for inside IB
        drm/amdgpu: different emit_ib for gfx and compute
        drm/amdgpu: information leak in amdgpu_info_ioctl()
        drm/amdgpu: clean up init sequence for failures
        drm/radeon/combios: add some validation of lvds values
        drm/radeon: rework audio modeset to handle non-audio hdmi features
        drm/radeon: rework audio detect (v4)
        drm/amdgpu: Drop drm/ prefix for including drm.h in amdgpu_drm.h
        drm/radeon: Drop drm/ prefix for including drm.h in radeon_drm.h
        drm/nouveau/nouveau/ttm: fix tiled system memory with Maxwell
        drm/nouveau/kms/nv50-: guard against enabling cursor on disabled heads
        drm/nouveau/fbcon/g80: reduce PUSH_SPACE alloc, fire ring on accel init
        drm/nouveau/fbcon/gf100-: reduce RING_SPACE allocation
        drm/nouveau/fbcon/nv11-: correctly account for ring space usage
        drm/nouveau/bios: add proper support for opcode 0x59
        ...
      fd56d1d6
    • Jun Nie's avatar
      Revert "dmaengine: virt-dma: don't always free descriptor upon completion" · 8c8fe97b
      Jun Nie authored
      This reverts commit b9855f03.
      The patch break existing DMA usage case. For example, audio SOC
      dmaengine never release channel and cause virt-dma to cache too
      much memory in descriptor to exhaust system memory.
      Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
      8c8fe97b
    • Thomas Petazzoni's avatar
      dmaengine: mv_xor: fix big endian operation in register mode · 0ec9ebc7
      Thomas Petazzoni authored
      Commit 6f166312 ("dmaengine: mv_xor: add support for a38x command
      in descriptor mode") introduced the support for a feature that
      appeared in Armada 38x: specifying the operation to be performed in a
      per-descriptor basis rather than globally per channel.
      
      However, when doing so, it changed the function mv_chan_set_mode() to
      use:
      
        if (IS_ENABLED(__BIG_ENDIAN))
      
      instead of:
      
        #if defined(__BIG_ENDIAN)
      
      While IS_ENABLED() is perfectly fine for CONFIG_* symbols, it is not
      for other symbols such as __BIG_ENDIAN that is provided directly by
      the compiler. Consequently, the commit broke support for big-endian,
      as the XOR_DESCRIPTOR_SWAP flag was not set in the XOR channel
      configuration register.
      
      The primarily visible effect was some nasty warnings and failures
      appearing during the self-test of the XOR unit:
      
      [    1.197368] mv_xor d0060900.xor: error on chan 0. intr cause 0x00000082
      [    1.197393] mv_xor d0060900.xor: config       0x00008440
      [    1.197410] mv_xor d0060900.xor: activation   0x00000000
      [    1.197427] mv_xor d0060900.xor: intr cause   0x00000082
      [    1.197443] mv_xor d0060900.xor: intr mask    0x000003f7
      [    1.197460] mv_xor d0060900.xor: error cause  0x00000000
      [    1.197477] mv_xor d0060900.xor: error addr   0x00000000
      [    1.197491] ------------[ cut here ]------------
      [    1.197513] WARNING: CPU: 0 PID: 1 at ../drivers/dma/mv_xor.c:664 mv_xor_interrupt_handler+0x14c/0x170()
      
      See also:
      
        http://storage.kernelci.org/next/next-20150617/arm-mvebu_v7_defconfig+CONFIG_CPU_BIG_ENDIAN=y/lab-khilman/boot-armada-xp-openblocks-ax3-4.txtSigned-off-by: default avatarThomas Petazzoni <thomas.petazzoni@free-electrons.com>
      Fixes: 6f166312 ("dmaengine: mv_xor: add support for a38x command in descriptor mode")
      Reviewed-by: default avatarMaxime Ripard <maxime.ripard@free-electrons.com>
      Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
      0ec9ebc7
    • Rameshwar Prasad Sahu's avatar
      dmaengine: xgene-dma: Fix the resource map to handle overlapping · cda8e937
      Rameshwar Prasad Sahu authored
      There is an overlap in dma ring cmd csr region due to sharing of ethernet
      ring cmd csr region. This patch fix the resource overlapping by mapping
      the entire dma ring cmd csr region.
      Signed-off-by: default avatarRameshwar Prasad Sahu <rsahu@apm.com>
      Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
      cda8e937
    • Cyrille Pitchen's avatar
      dmaengine: at_xdmac: fix transfer data width in at_xdmac_prep_slave_sg() · 1c8a38b1
      Cyrille Pitchen authored
      This patch adds the missing update of the transfer data width in
      at_xdmac_prep_slave_sg().
      
      Indeed, for each item in the scatter-gather list, we check whether the
      transfer length is aligned with the data width provided by
      dmaengine_slave_config(). If so, we directly use this data width for the
      current part of the transfer we are preparing. Otherwise, the data width
      is reduced to 8 bits (1 byte). Of course, the actual number of register
      accesses must also be updated to match the new data width.
      
      So one chunk was missing in the original patch (see Fixes tag below): the
      number of register accesses was correctly set to (len >> fixed_dwidth) in
      mbr_ubc but the real data width was not updated in mbr_cfg. Since mbr_cfg
      may change for each part of the scatter-gather transfer this also explains
      why the original patch used the Descriptor View 2 instead of the
      Descriptor View 1.
      
      Let's take the example of a DMA transfer to write 8bit data into an Atmel
      USART with FIFOs. When FIFOs are enabled in the USART, its Transmit
      Holding Register (THR) works in multidata mode, that is to say that up to
      4 8bit data can be written into the THR in a single 32bit access and it is
      still possible to write only one data with a 8bit access. To take
      advantage of this new feature, the DMA driver was modified to allow
      multiple dwidths when doing slave transfers.
      For instance, when the total length is 22 bytes, the USART driver splits
      the transfer into 2 parts:
      
      First part: 20 bytes transferred through 5 32bit writes into THR
      Second part: 2 bytes transferred though 2 8bit writes into THR
      
      For the second part, the data width was first set to 4_BYTES by the USART
      driver thanks to dmaengine_slave_config() then at_xdmac_prep_slave_sg()
      reduces this data width to 1_BYTE because the 2 byte length is not aligned
      with the original 4_BYTES data width. Since the data width is modified,
      the actual number of writes into THR must be set accordingly.
      Signed-off-by: default avatarCyrille Pitchen <cyrille.pitchen@atmel.com>
      Fixes: 6d3a7d9e ("dmaengine: at_xdmac: allow muliple dwidths when doing slave transfers")
      Cc: stable@vger.kernel.org #4.0 and later
      Acked-by: default avatarNicolas Ferre <nicolas.ferre@atmel.com>
      Acked-by: default avatarLudovic Desroches <ludovic.desroches@atmel.com>
      Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
      1c8a38b1
    • Cyrille Pitchen's avatar
      dmaengine: at_hdmac: fix residue computation · 93dce3a6
      Cyrille Pitchen authored
      As claimed by the programmer datasheet and confirmed by the IP designer,
      the Block Transfer Size (BTSIZE) bitfield of the Channel x Control A
      Register (CTRLAx) always refers to a number of Source Width (SRC_WIDTH)
      transfers.
      
      Both the SRC_WIDTH and BTSIZE bitfields can be extacted from the CTRLAx
      register to compute the DMA residue. So the 'tx_width' field is useless
      and can be removed from the struct at_desc.
      
      Before this patch, atc_prep_slave_sg() was not consistent: BTSIZE was
      correctly initialized according to the SRC_WIDTH but 'tx_width' was always
      set to reg_width, which was incorrect for MEM_TO_DEV transfers. It led to
      bad DMA residue when 'tx_width' != SRC_WIDTH.
      
      Also the 'tx_width' field was mostly set only in the first and last
      descriptors. Depending on the kind of DMA transfer, this field remained
      uninitialized for intermediate descriptors. The accurate DMA residue was
      computed only when the currently processed descriptor was the first or the
      last of the chain. This algorithm was a little bit odd. An accurate DMA
      residue can always be computed using the SRC_WIDTH and BTSIZE bitfields
      in the CTRLAx register.
      
      Finally, the test to check whether the currently processed descriptor is
      the last of the chain was wrong: for cyclic transfer, last_desc->lli.dscr
      is NOT equal to zero, since set_desc_eol() is never called, but logically
      equal to first_desc->txd.phys. This bug has a side effect on the
      drivers/tty/serial/atmel_serial.c driver, which uses cyclic DMA transfer
      to receive data. Since the DMA residue was wrong each time the DMA
      transfer reaches the second (and last) period of the transfer, no more
      data were received by the USART driver till the cyclic DMA transfer loops
      back to the first period.
      Signed-off-by: default avatarCyrille Pitchen <cyrille.pitchen@atmel.com>
      Acked-by: default avatarTorsten Fleischer <torfl6749@gmail.com>
      Tested-by: default avatarJirí Prchal <jiri.prchal@aksignal.cz>
      Acked-by: default avatarNicolas Ferre <nicolas.ferre@atmel.com>
      Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
      93dce3a6
    • Ludovic Desroches's avatar
      dmaengine: at_xdmac: fix bug about channel configuration · 20cadcb4
      Ludovic Desroches authored
      When using descriptor view 2 or higher, we don't write the configuration
      into AT_XDMAC_CC register because this configuration will be fetch from
      the descriptor. Unfortunately, the PROT bit is not updated with this
      method, we have to do it manually before enabling the channel.
      Signed-off-by: default avatarLudovic Desroches <ludovic.desroches@atmel.com>
      Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
      20cadcb4
    • Joerg Roedel's avatar
      iommu/amd: Allow non-ATS devices in IOMMUv2 domains · 1c1cc454
      Joerg Roedel authored
      With the grouping of multi-function devices a non-ATS
      capable device might also end up in the same domain as an
      IOMMUv2 capable device.
      So handle this situation gracefully and don't consider it a
      bug anymore.
      Tested-by: default avatarOded Gabbay <oded.gabbay@gmail.com>
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      1c1cc454
    • Andy Lutomirski's avatar
      x86/ldt: Make modify_ldt synchronous · 37868fe1
      Andy Lutomirski authored
      modify_ldt() has questionable locking and does not synchronize
      threads.  Improve it: redesign the locking and synchronize all
      threads' LDTs using an IPI on all modifications.
      
      This will dramatically slow down modify_ldt in multithreaded
      programs, but there shouldn't be any multithreaded programs that
      care about modify_ldt's performance in the first place.
      
      This fixes some fallout from the CVE-2015-5157 fixes.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Jan Beulich <jbeulich@suse.com>
      Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Sasha Levin <sasha.levin@oracle.com>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: security@kernel.org <security@kernel.org>
      Cc: <stable@vger.kernel.org>
      Cc: xen-devel <xen-devel@lists.xen.org>
      Link: http://lkml.kernel.org/r/4c6978476782160600471bd865b318db34c7b628.1438291540.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      37868fe1
    • Andy Lutomirski's avatar
      x86/xen: Probe target addresses in set_aliased_prot() before the hypercall · aa1acff3
      Andy Lutomirski authored
      The update_va_mapping hypercall can fail if the VA isn't present
      in the guest's page tables.  Under certain loads, this can
      result in an OOPS when the target address is in unpopulated vmap
      space.
      
      While we're at it, add comments to help explain what's going on.
      
      This isn't a great long-term fix.  This code should probably be
      changed to use something like set_memory_ro.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: David Vrabel <dvrabel@cantab.net>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Jan Beulich <jbeulich@suse.com>
      Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Sasha Levin <sasha.levin@oracle.com>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: security@kernel.org <security@kernel.org>
      Cc: <stable@vger.kernel.org>
      Cc: xen-devel <xen-devel@lists.xen.org>
      Link: http://lkml.kernel.org/r/0b0e55b995cda11e7829f140b833ef932fcabe3a.1438291540.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      aa1acff3
    • Ingo Molnar's avatar
      Merge tag 'efi-urgent' of... · 1adb9123
      Ingo Molnar authored
      Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/urgent
      
      Pull EFI fixes from Matt Fleming:
      
       * Fix an EFI boot issue preventing a Parallels virtual machine from
         booting because the upper 32-bits of the EFI memmap pointer were
         being discarded in setup_e820(). (Dmitry Skorodumov)
      
       * Validate that the "efi" kernel parameter gets used with an argument,
         otherwise we will oops. (Ricardo Neri)
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      1adb9123
    • Linus Torvalds's avatar
      Merge tag 'xfs-for-linus-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs · 84009357
      Linus Torvalds authored
      Pull xfs fixes from Dave Chinner:
       "There are a couple of recently found, long standing remote attribute
        corruption fixes caused by log recovery getting confused after a
        crash, and the new DAX code in XFS (merged in 4.2-rc1) needs to
        actually use the DAX fault path on read faults.
      
        Summary:
      
         - remote attribute log recovery corruption fixes
      
         - DAX page faults need to use direct mappings, not a page cache
           mapping"
      
      * tag 'xfs-for-linus-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs:
        xfs: remote attributes need to be considered data
        xfs: remote attribute headers contain an invalid LSN
        xfs: call dax_fault on read page faults for DAX
      84009357
  5. 30 Jul, 2015 4 commits
    • Sowmini Varadhan's avatar
      net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket · 8a681736
      Sowmini Varadhan authored
      The newsk returned by sk_clone_lock should hold a get_net()
      reference if, and only if, the parent is not a kernel socket
      (making this similar to sk_alloc()).
      
      E.g,. for the SYN_RECV path, tcp_v4_syn_recv_sock->..inet_csk_clone_lock
      sets up the syn_recv newsk from sk_clone_lock. When the parent (listen)
      socket is a kernel socket (defined in sk_alloc() as having
      sk_net_refcnt == 0), then the newsk should also have a 0 sk_net_refcnt
      and should not hold a get_net() reference.
      
      Fixes: 26abe143 ("net: Modify sk_alloc to not reference count the
            netns of kernel sockets.")
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Eric W. Biederman <ebiederm@xmission.com>
      Signed-off-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8a681736
    • Daniel Borkmann's avatar
      net: sched: fix refcount imbalance in actions · 28e6b67f
      Daniel Borkmann authored
      Since commit 55334a5d ("net_sched: act: refuse to remove bound action
      outside"), we end up with a wrong reference count for a tc action.
      
      Test case 1:
      
        FOO="1,6 0 0 4294967295,"
        BAR="1,6 0 0 4294967294,"
        tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 \
           action bpf bytecode "$FOO"
        tc actions show action bpf
          action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
          index 1 ref 1 bind 1
        tc actions replace action bpf bytecode "$BAR" index 1
        tc actions show action bpf
          action order 0: bpf bytecode '1,6 0 0 4294967294' default-action pipe
          index 1 ref 2 bind 1
        tc actions replace action bpf bytecode "$FOO" index 1
        tc actions show action bpf
          action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
          index 1 ref 3 bind 1
      
      Test case 2:
      
        FOO="1,6 0 0 4294967295,"
        tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok
        tc actions show action gact
          action order 0: gact action pass
          random type none pass val 0
           index 1 ref 1 bind 1
        tc actions add action drop index 1
          RTNETLINK answers: File exists [...]
        tc actions show action gact
          action order 0: gact action pass
           random type none pass val 0
           index 1 ref 2 bind 1
        tc actions add action drop index 1
          RTNETLINK answers: File exists [...]
        tc actions show action gact
          action order 0: gact action pass
           random type none pass val 0
           index 1 ref 3 bind 1
      
      What happens is that in tcf_hash_check(), we check tcf_common for a given
      index and increase tcfc_refcnt and conditionally tcfc_bindcnt when we've
      found an existing action. Now there are the following cases:
      
        1) We do a late binding of an action. In that case, we leave the
           tcfc_refcnt/tcfc_bindcnt increased and are done with the ->init()
           handler. This is correctly handeled.
      
        2) We replace the given action, or we try to add one without replacing
           and find out that the action at a specific index already exists
           (thus, we go out with error in that case).
      
      In case of 2), we have to undo the reference count increase from
      tcf_hash_check() in the tcf_hash_check() function. Currently, we fail to
      do so because of the 'tcfc_bindcnt > 0' check which bails out early with
      an -EPERM error.
      
      Now, while commit 55334a5d prevents 'tc actions del action ...' on an
      already classifier-bound action to drop the reference count (which could
      then become negative, wrap around etc), this restriction only accounts for
      invocations outside a specific action's ->init() handler.
      
      One possible solution would be to add a flag thus we possibly trigger
      the -EPERM ony in situations where it is indeed relevant.
      
      After the patch, above test cases have correct reference count again.
      
      Fixes: 55334a5d ("net_sched: act: refuse to remove bound action outside")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Reviewed-by: default avatarCong Wang <cwang@twopensource.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      28e6b67f
    • David S. Miller's avatar
      Merge branch 'r8152-fixes' · 990c9b34
      David S. Miller authored
      Hayes Wang says:
      
      ====================
      r8152: device reset
      
      v3:
      For patch #2, remove cancel_delayed_work().
      
      v2:
      For patch #1, remove usb_autopm_get_interface(), usb_autopm_put_interface(), and
      the checking of intf->condition.
      
      For patch #2, replace the original method with usb_queue_reset_device() to reset
      the device.
      
      v1:
      Although the driver works normally, we find the device may get all 0xff data when
      transmitting packets on certain platforms. It would break the device and no packet
      could be transmitted. The reset is necessary to recover the hw for this situation.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      990c9b34
    • hayeswang's avatar
      r8152: reset device when tx timeout · 37608f3e
      hayeswang authored
      The device reset is necessary if the hw becomes abnormal and stops
      transmitting packets.
      Signed-off-by: default avatarHayes Wang <hayeswang@realtek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      37608f3e