1. 13 Aug, 2015 6 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · ebcbf166
      Linus Torvalds authored
      Pull xen block driver fixes from Jens Axboe:
       "A few small bug fixes for xen-blk{front,back} that have been sitting
        over my vacation"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        xen-blkback: replace work_pending with work_busy in purge_persistent_gnt()
        xen-blkfront: don't add indirect pages to list when !feature_persistent
        xen-blkfront: introduce blkfront_gather_backend_features()
      ebcbf166
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.2-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 6b476e11
      Linus Torvalds authored
      Pull xen bug fixes from David Vrabel:
      
       - revert a fix from 4.2-rc5 that was causing lots of WARNING spam.
      
       - fix a memory leak affecting backends in HVM guests.
      
       - fix PV domU hang with certain configurations.
      
      * tag 'for-linus-4.2-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen/xenbus: Don't leak memory when unmapping the ring on HVM backend
        Revert "xen/events/fifo: Handle linked events when closing a port"
        x86/xen: build "Xen PV" APIC driver for domU as well
      6b476e11
    • Linus Torvalds's avatar
      Revert x86 sigcontext cleanups · ed596cde
      Linus Torvalds authored
      This reverts commits 9a036b93 ("x86/signal/64: Remove 'fs' and 'gs'
      from sigcontext") and c6f20629 ("x86/signal/64: Fix SS handling for
      signals delivered to 64-bit programs").
      
      They were cleanups, but they break dosemu by changing the signal return
      behavior (and removing 'fs' and 'gs' from the sigcontext struct - while
      not actually changing any behavior - causes build problems).
      Reported-and-tested-by: default avatarStas Sergeev <stsp@list.ru>
      Acked-by: default avatarAndy Lutomirski <luto@amacapital.net>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ed596cde
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 26b552e0
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Workaround hw bug when acquiring PCI bos ownership of iwlwifi
          devices, from Emmanuel Grumbach.
      
       2) Falling back to vmalloc in conntrack should not emit a warning, from
          Pablo Neira Ayuso.
      
       3) Fix NULL deref when rtlwifi driver is used as an AP, from Luis
          Felipe Dominguez Vega.
      
       4) Rocker doesn't free netdev on device removal, from Ido Schimmel.
      
       5) UDP multicast early sock demux has route handling races, from Eric
          Dumazet.
      
       6) Fix L4 checksum handling in openvswitch, from Glenn Griffin.
      
       7) Fix use-after-free in skb_set_peeked, from Herbert Xu.
      
       8) Don't advertize NETIF_F_FRAGLIST in virtio_net driver, this can lead
          to fraglists longer than the driver can support.  From Jason Wang.
      
       9) Fix mlx5 on non-4k-pagesize systems, from Carol L Soto.
      
      10) Fix interrupt storm in bna driver, from Ivan Vecera.
      
      11) Don't propagate -EBUSY from netlink_insert(), from Daniel Borkmann.
      
      12) Fix inet request sock leak, from Eric Dumazet.
      
      13) Fix TX interrupt masking and marking in TX descriptors of fs_enet
          driver, from LEROY Christophe.
      
      14) Get rid of rule optimizer in gianfar driver, it's buggy and unlikely
          to get fixed any time soon.  From Jakub Kicinski
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (61 commits)
        cosa: missing error code on failure in probe()
        gianfar: remove faulty filer optimizer
        gianfar: correct list membership accounting
        gianfar: correct filer table writing
        bonding: Gratuitous ARP gets dropped when first slave added
        net: dsa: Do not override PHY interface if already configured
        net: fs_enet: mask interrupts for TX partial frames.
        net: fs_enet: explicitly remove I flag on TX partial frames
        inet: fix possible request socket leak
        inet: fix races with reqsk timers
        mkiss: Fix error handling in mkiss_open()
        bnx2x: Free NVRAM lock at end of each page
        bnx2x: Prevent null pointer dereference on SKB release
        cxgb4: missing curly braces in t4_setup_debugfs()
        net-timestamp: Update skb_complete_tx_timestamp comment
        ipv6: don't reject link-local nexthop on other interface
        netlink: make sure -EBUSY won't escape from netlink_insert
        bna: fix interrupts storm caused by erroneous packets
        net: mvpp2: replace TX coalescing interrupts with hrtimer
        net: mvpp2: enable proper per-CPU TX buffers unmapping
        ...
      26b552e0
    • Linus Torvalds's avatar
      Merge tag 'edac_fix_for_4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp · 2331d30d
      Linus Torvalds authored
      Pull EDAC fix from Borislav Petkov:
       "A ppc4xx_edac fix for accessing ->csrows properly.  This driver was
        missed during the conversion a couple of years ago"
      
      * tag 'edac_fix_for_4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
        EDAC, ppc4xx: Access mci->csrows array elements properly
      2331d30d
    • Michael Walle's avatar
      EDAC, ppc4xx: Access mci->csrows array elements properly · 5c16179b
      Michael Walle authored
      The commit
      
        de3910eb ("edac: change the mem allocation scheme to
      		 make Documentation/kobject.txt happy")
      
      changed the memory allocation for the csrows member. But ppc4xx_edac was
      forgotten in the patch. Fix it.
      Signed-off-by: default avatarMichael Walle <michael@walle.cc>
      Cc: <stable@vger.kernel.org>
      Cc: linux-edac <linux-edac@vger.kernel.org>
      Cc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
      Link: http://lkml.kernel.org/r/1437469253-8611-1-git-send-email-michael@walle.ccSigned-off-by: default avatarBorislav Petkov <bp@suse.de>
      5c16179b
  2. 12 Aug, 2015 13 commits
  3. 11 Aug, 2015 12 commits
  4. 10 Aug, 2015 9 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid · 7a834ba5
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
      
       - fix for bounds limit calculation in uclogic driver, by Dan Carpenter
      
       - fix for use-after-free during device removal, by Krzysztof Kozlowski
      
       - fix for userspace regression (that became apparent only with shiny
         new libinput, so it's not that bad, but I still consider it 4.2
         material), in wacom driver, by Jason Gerecke
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
        HID: wacom: Report correct device resolution when using the wireless adapater
        HID: hid-input: Fix accessing freed memory during device disconnect
        HID: uclogic: fix limit in uclogic_tablet_enable()
      7a834ba5
    • Jason Gerecke's avatar
      HID: wacom: Report correct device resolution when using the wireless adapater · 0be01712
      Jason Gerecke authored
      The 'wacom_wireless_work' function does not recalculate the tablet's
      resolution, causing the value contained in the 'features' struct to
      always be reported to userspace. This value is valid only for the pen
      interface, meaning that the value will be incorrect for the touchpad (if
      present). This in particular causes problems for libinput which relies
      on the reported resolution being correct.
      
      This patch adds the necessary calls to recalculate the resolution for
      each interface. This requires a little bit of code shuffling since both
      the 'wacom_set_default_phy' and 'wacom_calculate_res' are declared below
      their new first point of use in 'wacom_wireless_work'.
      Signed-off-by: default avatarJason Gerecke <jason.gerecke@wacom.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      0be01712
    • David S. Miller's avatar
      Merge branch 'bnx2x-fixes' · 875a74b6
      David S. Miller authored
      Yuval Mintz says:
      
      ====================
      bnx2x: small fixes
      
      This adds 2 small fixes, one to error flows during memory release
      and the other to flash writes via ethtool API.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      875a74b6
    • Yuval Mintz's avatar
      bnx2x: Free NVRAM lock at end of each page · 0ea853df
      Yuval Mintz authored
      Writing each 4Kb page into flash might take up-to ~100 miliseconds,
      during which time management firmware cannot acces the nvram for its
      own uses.
      
      Firmware upgrade utility use the ethtool API to burn new flash images
      for the device via the ethtool API, doing so by writing several page-worth
      of data on each command. Such action might create problems for the
      management firmware, as the nvram might not be accessible for a long time.
      
      This patch changes the write implementation, releasing the nvram lock on
      the completion of each page, allowing the management firmware time to
      claim it and perform its own required actions.
      Signed-off-by: default avatarYuval Mintz <Yuval.Mintz@qlogic.com>
      Signed-off-by: default avatarAriel Elior <Ariel.Elior@qlogic.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0ea853df
    • Yuval Mintz's avatar
      bnx2x: Prevent null pointer dereference on SKB release · e1615903
      Yuval Mintz authored
      On error flows its possible to free an SKB even if it was not allocated.
      Signed-off-by: default avatarYuval Mintz <Yuval.Mintz@qlogic.com>
      Signed-off-by: default avatarAriel Elior <Ariel.Elior@qlogic.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e1615903
    • Dan Carpenter's avatar
      cxgb4: missing curly braces in t4_setup_debugfs() · 21a44763
      Dan Carpenter authored
      There were missing curly braces so it means we call add_debugfs_mem()
      unintentionally.
      
      Fixes: 3ccc6cf7 ('cxgb4: Adds support for T6 adapter')
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      21a44763
    • Benjamin Poirier's avatar
      net-timestamp: Update skb_complete_tx_timestamp comment · 7a76a021
      Benjamin Poirier authored
      After "62bccb8c net-timestamp: Make the clone operation stand-alone from phy
      timestamping" the hwtstamps parameter of skb_complete_tx_timestamp() may no
      longer be NULL.
      Signed-off-by: default avatarBenjamin Poirier <bpoirier@suse.com>
      Cc: Alexander Duyck <alexander.h.duyck@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7a76a021
    • Florian Westphal's avatar
      ipv6: don't reject link-local nexthop on other interface · 330567b7
      Florian Westphal authored
      48ed7b26 ("ipv6: reject locally assigned nexthop addresses") is too
      strict; it rejects following corner-case:
      
      ip -6 route add default via fe80::1:2:3 dev eth1
      
      [ where fe80::1:2:3 is assigned to a local interface, but not eth1 ]
      
      Fix this by restricting search to given device if nh is linklocal.
      
      Joint work with Hannes Frederic Sowa.
      
      Fixes: 48ed7b26 ("ipv6: reject locally assigned nexthop addresses")
      Signed-off-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      330567b7
    • Daniel Borkmann's avatar
      netlink: make sure -EBUSY won't escape from netlink_insert · 4e7c1330
      Daniel Borkmann authored
      Linus reports the following deadlock on rtnl_mutex; triggered only
      once so far (extract):
      
      [12236.694209] NetworkManager  D 0000000000013b80     0  1047      1 0x00000000
      [12236.694218]  ffff88003f902640 0000000000000000 ffffffff815d15a9 0000000000000018
      [12236.694224]  ffff880119538000 ffff88003f902640 ffffffff81a8ff84 00000000ffffffff
      [12236.694230]  ffffffff81a8ff88 ffff880119c47f00 ffffffff815d133a ffffffff81a8ff80
      [12236.694235] Call Trace:
      [12236.694250]  [<ffffffff815d15a9>] ? schedule_preempt_disabled+0x9/0x10
      [12236.694257]  [<ffffffff815d133a>] ? schedule+0x2a/0x70
      [12236.694263]  [<ffffffff815d15a9>] ? schedule_preempt_disabled+0x9/0x10
      [12236.694271]  [<ffffffff815d2c3f>] ? __mutex_lock_slowpath+0x7f/0xf0
      [12236.694280]  [<ffffffff815d2cc6>] ? mutex_lock+0x16/0x30
      [12236.694291]  [<ffffffff814f1f90>] ? rtnetlink_rcv+0x10/0x30
      [12236.694299]  [<ffffffff8150ce3b>] ? netlink_unicast+0xfb/0x180
      [12236.694309]  [<ffffffff814f5ad3>] ? rtnl_getlink+0x113/0x190
      [12236.694319]  [<ffffffff814f202a>] ? rtnetlink_rcv_msg+0x7a/0x210
      [12236.694331]  [<ffffffff8124565c>] ? sock_has_perm+0x5c/0x70
      [12236.694339]  [<ffffffff814f1fb0>] ? rtnetlink_rcv+0x30/0x30
      [12236.694346]  [<ffffffff8150d62c>] ? netlink_rcv_skb+0x9c/0xc0
      [12236.694354]  [<ffffffff814f1f9f>] ? rtnetlink_rcv+0x1f/0x30
      [12236.694360]  [<ffffffff8150ce3b>] ? netlink_unicast+0xfb/0x180
      [12236.694367]  [<ffffffff8150d344>] ? netlink_sendmsg+0x484/0x5d0
      [12236.694376]  [<ffffffff810a236f>] ? __wake_up+0x2f/0x50
      [12236.694387]  [<ffffffff814cad23>] ? sock_sendmsg+0x33/0x40
      [12236.694396]  [<ffffffff814cb05e>] ? ___sys_sendmsg+0x22e/0x240
      [12236.694405]  [<ffffffff814cab75>] ? ___sys_recvmsg+0x135/0x1a0
      [12236.694415]  [<ffffffff811a9d12>] ? eventfd_write+0x82/0x210
      [12236.694423]  [<ffffffff811a0f9e>] ? fsnotify+0x32e/0x4c0
      [12236.694429]  [<ffffffff8108cb70>] ? wake_up_q+0x60/0x60
      [12236.694434]  [<ffffffff814cba09>] ? __sys_sendmsg+0x39/0x70
      [12236.694440]  [<ffffffff815d4797>] ? entry_SYSCALL_64_fastpath+0x12/0x6a
      
      It seems so far plausible that the recursive call into rtnetlink_rcv()
      looks suspicious. One way, where this could trigger is that the senders
      NETLINK_CB(skb).portid was wrongly 0 (which is rtnetlink socket), so
      the rtnl_getlink() request's answer would be sent to the kernel instead
      to the actual user process, thus grabbing rtnl_mutex() twice.
      
      One theory would be that netlink_autobind() triggered via netlink_sendmsg()
      internally overwrites the -EBUSY error to 0, but where it is wrongly
      originating from __netlink_insert() instead. That would reset the
      socket's portid to 0, which is then filled into NETLINK_CB(skb).portid
      later on. As commit d470e3b4 ("[NETLINK]: Fix two socket hashing bugs.")
      also puts it, -EBUSY should not be propagated from netlink_insert().
      
      It looks like it's very unlikely to reproduce. We need to trigger the
      rhashtable_insert_rehash() handler under a situation where rehashing
      currently occurs (one /rare/ way would be to hit ht->elasticity limits
      while not filled enough to expand the hashtable, but that would rather
      require a specifically crafted bind() sequence with knowledge about
      destination slots, seems unlikely). It probably makes sense to guard
      __netlink_insert() in any case and remap that error. It was suggested
      that EOVERFLOW might be better than an already overloaded ENOMEM.
      
      Reference: http://thread.gmane.org/gmane.linux.network/372676Reported-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Acked-by: default avatarThomas Graf <tgraf@suug.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4e7c1330