1. 09 Jan, 2017 6 commits
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.10-rc4' of git://people.freedesktop.org/~airlied/linux · bd5d7428
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "amdgpu, radeon, msm, meson, tilcdc, drm fixes.
      
        Just back online for a couple of days, gathered up the remaining fixes
        pull requests.
      
        This contains fixes for a few ARM platforms (msm, tilcdc, meson), and
        one core atomic fix. The AMD pull has some new hardware support
        (Polaris12) in it, but this is pretty limited to just hw enablement
        and shouldn't cause any problems"
      
      * tag 'drm-fixes-for-v4.10-rc4' of git://people.freedesktop.org/~airlied/linux:
        drm/amdgpu: drop verde dpm quirks
        drm/radeon: drop verde dpm quirks
        drm/radeon: update smc firmware selection for SI
        drm/amdgpu: update si kicker smc firmware
        drm/amd/powerplay: extend smu's response timeout time.
        drm/amdgpu: remove static integer for uvd pp state
        drm/amd/amdgpu: add Polaris12 PCI ID
        drm/amdgpu/powerplay: add Polaris12 support
        drm/amd/amdgpu: add Polaris12 support (v3)
        MAINTAINERS: Update mailing list for radeon and amdgpu
        drm/meson: Fix CVBS VDAC disable
        drm/meson: Fix CVBS initialization when HDMI is configured by bootloader
        drm: Clean up planes in atomic commit helper failure path
        drm: tilcdc: simplify the recovery from sync lost error on rev1
        drm/meson: Fix plane atomic check when no crtc for the plane
        drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set
        drm/msm: Put back the vaddr in submit_reloc()
        drm/msm: Ensure that the hardware write pointer is valid
      bd5d7428
    • Linus Torvalds's avatar
      Merge tag 'gpio-v4.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 756a7334
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
      
       - move freeing of GPIO hogs to after freeing the device to get rid of a
         warning state.
      
       - a small compile warning fix
      
      * tag 'gpio-v4.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: Move freeing of GPIO hogs before numbing of the device
        gpio: mxs: remove __init annotation
      756a7334
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c92f5bdc
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix dumping of nft_quota entries, from Pablo Neira Ayuso.
      
       2) Fix out of bounds access in nf_tables discovered by KASAN, from
          Florian Westphal.
      
       3) Fix IRQ enabling in dp83867 driver, from Grygorii Strashko.
      
       4) Fix unicast filtering in be2net driver, from Ivan Vecera.
      
       5) tg3_get_stats64() can race with driver close and ethtool
          reconfigurations, fix from Michael Chan.
      
       6) Fix error handling when pass limit is reached in bpf code gen on
          x86. From Daniel Borkmann.
      
       7) Don't clobber switch ops and use proper MDIO nested reads and writes
          in bcm_sf2 driver, from Florian Fainelli.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (21 commits)
        net: dsa: bcm_sf2: Utilize nested MDIO read/write
        net: dsa: bcm_sf2: Do not clobber b53_switch_ops
        net: stmmac: fix maxmtu assignment to be within valid range
        bpf: change back to orig prog on too many passes
        tg3: Fix race condition in tg3_get_stats64().
        be2net: fix unicast list filling
        be2net: fix accesses to unicast list
        netlabel: add CALIPSO to the list of built-in protocols
        vti6: fix device register to report IFLA_INFO_KIND
        net: phy: dp83867: fix irq generation
        amd-xgbe: Fix IRQ processing when running in single IRQ mode
        sh_eth: R8A7740 supports packet shecksumming
        sh_eth: fix EESIPR values for SH77{34|63}
        r8169: fix the typo in the comment
        nl80211: fix sched scan netlink socket owner destruction
        bridge: netfilter: Fix dropping packets that moving through bridge interface
        netfilter: ipt_CLUSTERIP: check duplicate config when initializing
        netfilter: nft_payload: mangle ckecksum if NFT_PAYLOAD_L4CSUM_PSEUDOHDR is set
        netfilter: nf_tables: fix oob access
        netfilter: nft_queue: use raw_smp_processor_id()
        ...
      c92f5bdc
    • David S. Miller's avatar
      Merge branch 'bcm_sf2-fixes' · 03430fa1
      David S. Miller authored
      Florian Fainelli says:
      
      ====================
      net: dsa: bcm_sf2: Couple fixes
      
      Here are a couple of fixes for bcm_sf2, please queue these up for -stable
      as well, thank you very much!
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      03430fa1
    • Florian Fainelli's avatar
      net: dsa: bcm_sf2: Utilize nested MDIO read/write · 2cfe8f82
      Florian Fainelli authored
      We are implementing a MDIO bus which is behind another one, so use the
      nested version of the accessors to get lockdep annotations correct.
      
      Fixes: 461cd1b0 ("net: dsa: bcm_sf2: Register our slave MDIO bus")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2cfe8f82
    • Florian Fainelli's avatar
      net: dsa: bcm_sf2: Do not clobber b53_switch_ops · a4c61b92
      Florian Fainelli authored
      We make the bcm_sf2 driver override ds->ops which points to
      b53_switch_ops since b53_switch_alloc() did the assignent. This is all
      well and good until a second b53 switch comes in, and ends up using the
      bcm_sf2 operations. Make a proper local copy, substitute the ds->ops
      pointer and then override the operations.
      
      Fixes: f458995b ("net: dsa: bcm_sf2: Utilize core B53 driver when possible")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a4c61b92
  2. 08 Jan, 2017 15 commits
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.10' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 6edd870b
      Dave Airlie authored
      Fixes for 4.10:
      - Polaris 12 support
      - Add new amd-gfx mailing list to MAINTAINERS file
      - UVD clockgating fix
      - SI dpm fixes
      
      * 'drm-fixes-4.10' of git://people.freedesktop.org/~agd5f/linux:
        drm/amdgpu: drop verde dpm quirks
        drm/radeon: drop verde dpm quirks
        drm/radeon: update smc firmware selection for SI
        drm/amdgpu: update si kicker smc firmware
        drm/amd/powerplay: extend smu's response timeout time.
        drm/amdgpu: remove static integer for uvd pp state
        drm/amd/amdgpu: add Polaris12 PCI ID
        drm/amdgpu/powerplay: add Polaris12 support
        drm/amd/amdgpu: add Polaris12 support (v3)
        MAINTAINERS: Update mailing list for radeon and amdgpu
      6edd870b
    • Kweh, Hock Leong's avatar
      net: stmmac: fix maxmtu assignment to be within valid range · a2cd64f3
      Kweh, Hock Leong authored
      There is no checking valid value of maxmtu when getting it from
      device tree. This resolution added the checking condition to
      ensure the assignment is made within a valid range.
      Signed-off-by: default avatarKweh, Hock Leong <hock.leong.kweh@intel.com>
      Reviewed-by: default avatarAndy Shevchenko <andy.shevchenko@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a2cd64f3
    • Dave Airlie's avatar
      Merge branch 'msm-fixes-4.10' of git://people.freedesktop.org/~robclark/linux into drm-fixes · 6906407e
      Dave Airlie authored
      A few fixes for 4.10.. the first fixes a long-standing logic bug, that
      by luck (ie. size of packets written into RB for a submit) wasn't hit
      on a3xx/a4xx but was causing intermittent GPU lockups on a5xx.  And a
      couple other robustness issues that Jordan noticed.
      
      * 'msm-fixes-4.10' of git://people.freedesktop.org/~robclark/linux:
        drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set
        drm/msm: Put back the vaddr in submit_reloc()
        drm/msm: Ensure that the hardware write pointer is valid
      6906407e
    • Dave Airlie's avatar
      Merge tag 'meson-drm-fixes-for-4.10' of... · 90e5d2d4
      Dave Airlie authored
      Merge tag 'meson-drm-fixes-for-4.10' of git://people.freedesktop.org/~narmstrong/linux into drm-fixes
      
      - plan atomic check oops fix
      - fix CVBS init when HDMI is configured by bootloader
      - fix CVBS VDAC disable
      
      * tag 'meson-drm-fixes-for-4.10' of git://people.freedesktop.org/~narmstrong/linux:
        drm/meson: Fix CVBS VDAC disable
        drm/meson: Fix CVBS initialization when HDMI is configured by bootloader
        drm/meson: Fix plane atomic check when no crtc for the plane
      90e5d2d4
    • Dave Airlie's avatar
      Merge tag 'tilcdc-4.10-fixes' of https://github.com/jsarha/linux into drm-fixes · 13fe46b5
      Dave Airlie authored
      tilcdc fixes for v4.10.
      
      * tag 'tilcdc-4.10-fixes' of https://github.com/jsarha/linux:
        drm: tilcdc: simplify the recovery from sync lost error on rev1
      13fe46b5
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2017-01-04' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes · e1ef6f71
      Dave Airlie authored
      single drm fix.
      
      * tag 'drm-misc-fixes-2017-01-04' of git://anongit.freedesktop.org/git/drm-misc:
        drm: Clean up planes in atomic commit helper failure path
      e1ef6f71
    • Linus Torvalds's avatar
      Linux 4.10-rc3 · a121103c
      Linus Torvalds authored
      a121103c
    • Daniel Borkmann's avatar
      bpf: change back to orig prog on too many passes · 9d5ecb09
      Daniel Borkmann authored
      If after too many passes still no image could be emitted, then
      swap back to the original program as we do in all other cases
      and don't use the one with blinding.
      
      Fixes: 959a7579 ("bpf, x86: add support for constant blinding")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9d5ecb09
    • Linus Torvalds's avatar
      Merge tag 'usb-4.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 83280e90
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are a bunch of USB fixes for 4.10-rc3. Yeah, it's a lot, an
        artifact of the holiday break I think.
      
        Lots of gadget and the usual XHCI fixups for reported issues (one day
        that driver will calm down...) Also included are a bunch of usb-serial
        driver fixes, and for good measure, a number of much-reported MUSB
        driver issues have finally been resolved.
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'usb-4.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (72 commits)
        USB: fix problems with duplicate endpoint addresses
        usb: ohci-at91: use descriptor-based gpio APIs correctly
        usb: storage: unusual_uas: Add JMicron JMS56x to unusual device
        usb: hub: Move hub_port_disable() to fix warning if PM is disabled
        usb: musb: blackfin: add bfin_fifo_offset in bfin_ops
        usb: musb: fix compilation warning on unused function
        usb: musb: Fix trying to free already-free IRQ 4
        usb: musb: dsps: implement clear_ep_rxintr() callback
        usb: musb: core: add clear_ep_rxintr() to musb_platform_ops
        USB: serial: ti_usb_3410_5052: fix NULL-deref at open
        USB: serial: spcp8x5: fix NULL-deref at open
        USB: serial: quatech2: fix sleep-while-atomic in close
        USB: serial: pl2303: fix NULL-deref at open
        USB: serial: oti6858: fix NULL-deref at open
        USB: serial: omninet: fix NULL-derefs at open and disconnect
        USB: serial: mos7840: fix misleading interrupt-URB comment
        USB: serial: mos7840: remove unused write URB
        USB: serial: mos7840: fix NULL-deref at open
        USB: serial: mos7720: remove obsolete port initialisation
        USB: serial: mos7720: fix parallel probe
        ...
      83280e90
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · cc250e26
      Linus Torvalds authored
      Pull char/misc fixes from Greg KH:
       "Here are a few small char/misc driver fixes for 4.10-rc3.
      
        Two MEI driver fixes, and three NVMEM patches for reported issues, and
        a new Hyper-V driver MAINTAINER update. Nothing major at all, all have
        been in linux-next with no reported issues"
      
      * tag 'char-misc-4.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        hyper-v: Add myself as additional MAINTAINER
        nvmem: fix nvmem_cell_read() return type doc
        nvmem: imx-ocotp: Fix wrong register size
        nvmem: qfprom: Allow single byte accesses for read/write
        mei: move write cb to completion on credentials failures
        mei: bus: fix mei_cldev_enable KDoc
      cc250e26
    • Linus Torvalds's avatar
      Merge tag 'staging-4.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 6ea17ed1
      Linus Torvalds authored
      Pull staging/IIO fixes from Greg KH:
       "Here are some staging and IIO driver fixes for 4.10-rc3.
      
        Most of these are minor IIO fixes of reported issues, along with one
        network driver fix to resolve an issue. And a MAINTAINERS update with
        a new mailing list. All of these, except the MAINTAINERS file update,
        have been in linux-next with no reported issues (the MAINTAINERS patch
        happened on Friday...)"
      
      * tag 'staging-4.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        MAINTAINERS: add greybus subsystem mailing list
        staging: octeon: Call SET_NETDEV_DEV()
        iio: accel: st_accel: fix LIS3LV02 reading and scaling
        iio: common: st_sensors: fix channel data parsing
        iio: max44000: correct value in illuminance_integration_time_available
        iio: adc: TI_AM335X_ADC should depend on HAS_DMA
        iio: bmi160: Fix time needed to sleep after command execution
        iio: 104-quad-8: Fix active level mismatch for the preset enable option
        iio: 104-quad-8: Fix off-by-one errors when addressing IOR
        iio: 104-quad-8: Fix index control configuration
      6ea17ed1
    • Michael Chan's avatar
      tg3: Fix race condition in tg3_get_stats64(). · f5992b72
      Michael Chan authored
      The driver's ndo_get_stats64() method is not always called under RTNL.
      So it can race with driver close or ethtool reconfigurations.  Fix the
      race condition by taking tp->lock spinlock in tg3_free_consistent()
      when freeing the tp->hw_stats memory block.  tg3_get_stats64() is
      already taking tp->lock.
      Reported-by: default avatarWang Yufen <wangyufen@huawei.com>
      Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f5992b72
    • Ivan Vecera's avatar
      be2net: fix unicast list filling · 6052cd1a
      Ivan Vecera authored
      The adapter->pmac_id[0] item is used for primary MAC address but
      this is not true for adapter->uc_list[0] as is assumed in
      be_set_uc_list(). There are N UC addresses copied first from net_device
      to adapter->uc_list[1..N] and then N UC addresses from
      adapter->uc_list[0..N-1] are sent to HW. So the last UC address is never
      stored into HW and address 00:00:00:00;00:00 (from uc_list[0]) is used
      instead.
      
      Cc: Sathya Perla <sathya.perla@broadcom.com>
      Cc: Ajit Khaparde <ajit.khaparde@broadcom.com>
      Cc: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
      Cc: Somnath Kotur <somnath.kotur@broadcom.com>
      Fixes: b7172414 be2net: replace polling with sleeping in the FW completion path
      Signed-off-by: default avatarIvan Vecera <cera@cera.cz>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6052cd1a
    • Johannes Weiner's avatar
      mm: workingset: fix use-after-free in shadow node shrinker · ea07b862
      Johannes Weiner authored
      Several people report seeing warnings about inconsistent radix tree
      nodes followed by crashes in the workingset code, which all looked like
      use-after-free access from the shadow node shrinker.
      
      Dave Jones managed to reproduce the issue with a debug patch applied,
      which confirmed that the radix tree shrinking indeed frees shadow nodes
      while they are still linked to the shadow LRU:
      
        WARNING: CPU: 2 PID: 53 at lib/radix-tree.c:643 delete_node+0x1e4/0x200
        CPU: 2 PID: 53 Comm: kswapd0 Not tainted 4.10.0-rc2-think+ #3
        Call Trace:
           delete_node+0x1e4/0x200
           __radix_tree_delete_node+0xd/0x10
           shadow_lru_isolate+0xe6/0x220
           __list_lru_walk_one.isra.4+0x9b/0x190
           list_lru_walk_one+0x23/0x30
           scan_shadow_nodes+0x2e/0x40
           shrink_slab.part.44+0x23d/0x5d0
           shrink_node+0x22c/0x330
           kswapd+0x392/0x8f0
      
      This is the WARN_ON_ONCE(!list_empty(&node->private_list)) placed in the
      inlined radix_tree_shrink().
      
      The problem is with 14b46879 ("mm: workingset: move shadow entry
      tracking to radix tree exceptional tracking"), which passes an update
      callback into the radix tree to link and unlink shadow leaf nodes when
      tree entries change, but forgot to pass the callback when reclaiming a
      shadow node.
      
      While the reclaimed shadow node itself is unlinked by the shrinker, its
      deletion from the tree can cause the left-most leaf node in the tree to
      be shrunk.  If that happens to be a shadow node as well, we don't unlink
      it from the LRU as we should.
      
      Consider this tree, where the s are shadow entries:
      
             root->rnode
                  |
             [0       n]
              |       |
           [s    ] [sssss]
      
      Now the shadow node shrinker reclaims the rightmost leaf node through
      the shadow node LRU:
      
             root->rnode
                  |
             [0        ]
              |
          [s     ]
      
      Because the parent of the deleted node is the first level below the
      root and has only one child in the left-most slot, the intermediate
      level is shrunk and the node containing the single shadow is put in
      its place:
      
             root->rnode
                  |
             [s        ]
      
      The shrinker again sees a single left-most slot in a first level node
      and thus decides to store the shadow in root->rnode directly and free
      the node - which is a leaf node on the shadow node LRU.
      
        root->rnode
             |
             s
      
      Without the update callback, the freed node remains on the shadow LRU,
      where it causes later shrinker runs to crash.
      
      Pass the node updater callback into __radix_tree_delete_node() in case
      the deletion causes the left-most branch in the tree to collapse too.
      
      Also add warnings when linked nodes are freed right away, rather than
      wait for the use-after-free when the list is scanned much later.
      
      Fixes: 14b46879 ("mm: workingset: move shadow entry tracking to radix tree exceptional tracking")
      Reported-by: default avatarDave Chinner <david@fromorbit.com>
      Reported-by: default avatarHugh Dickins <hughd@google.com>
      Reported-by: default avatarAndrea Arcangeli <aarcange@redhat.com>
      Reported-and-tested-by: default avatarDave Jones <davej@codemonkey.org.uk>
      Signed-off-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Chris Leech <cleech@redhat.com>
      Cc: Lee Duncan <lduncan@suse.com>
      Cc: Jan Kara <jack@suse.cz>
      Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Matthew Wilcox <mawilcox@linuxonhyperv.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ea07b862
    • Hugh Dickins's avatar
      mm: stop leaking PageTables · b0b9b3df
      Hugh Dickins authored
      4.10-rc loadtest (even on x86, and even without THPCache) fails with
      "fork: Cannot allocate memory" or some such; and /proc/meminfo shows
      PageTables growing.
      
      Commit 953c66c2 ("mm: THP page cache support for ppc64") that got
      merged in rc1 removed the freeing of an unused preallocated pagetable
      after do_fault_around() has called map_pages().
      
      This is usually a good optimization, so that the followup doesn't have
      to reallocate one; but it's not sufficient to shift the freeing into
      alloc_set_pte(), since there are failure cases (most commonly
      VM_FAULT_RETRY) which never reach finish_fault().
      
      Check and free it at the outer level in do_fault(), then we don't need
      to worry in alloc_set_pte(), and can restore that to how it was (I
      cannot find any reason to pte_free() under lock as it was doing).
      
      And fix a separate pagetable leak, or crash, introduced by the same
      change, that could only show up on some ppc64: why does do_set_pmd()'s
      failure case attempt to withdraw a pagetable when it never deposited
      one, at the same time overwriting (so leaking) the vmf->prealloc_pte?
      Residue of an earlier implementation, perhaps? Delete it.
      
      Fixes: 953c66c2 ("mm: THP page cache support for ppc64")
      Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
      Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Michael Neuling <mikey@neuling.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: Balbir Singh <bsingharora@gmail.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarHugh Dickins <hughd@google.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b0b9b3df
  3. 07 Jan, 2017 4 commits
  4. 06 Jan, 2017 15 commits