summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-02-05ip6_gre: fix endianness errors in ip6gre_errSabrina Dubroca
info is in network byte order, change it back to host byte order before use. In particular, the current code sets the MTU of the tunnel to a wrong (too big) value. Fixes: c12b395a4664 ("gre: Support GRE over IPv6") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-05qlcnic: Fix NAPI poll routine for Tx completionShahed Shaikh
After d75b1ade567f ("net: less interrupt masking in NAPI") driver's NAPI poll routine is expected to return exact budget value if it wants to be re-called. Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com> Fixes: d75b1ade567f ("net: less interrupt masking in NAPI") Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-05hrtimer: Fix incorrect tai offset calculation for non high-res timer systemsJohn Stultz
I noticed some CLOCK_TAI timer test failures on one of my less-frequently used configurations. And after digging in I found in 76f4108892d9 (Cleanup hrtimer accessors to the timekepeing state), the hrtimer_get_softirq_time tai offset calucation was incorrectly rewritten, as the tai offset we return shold be from CLOCK_MONOTONIC, and not CLOCK_REALTIME. This results in CLOCK_TAI timers expiring early on non-highres capable machines. This patch fixes the issue, calculating the tai time properly from the monotonic base. Signed-off-by: John Stultz <john.stultz@linaro.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: stable <stable@vger.kernel.org> # 3.17+ Link: http://lkml.kernel.org/r/1423097126-10236-1-git-send-email-john.stultz@linaro.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-02-04amd-xgbe: Set RSS enablement based on hardware featuresLendacky, Thomas
The RSS support requires enablement based on the features reported by the hardware. The setting of this flag is missing. Add support to set the RSS enablement flag based on the reported hardware features. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-04amd-xgbe: Adjust for zero-based traffic class countLendacky, Thomas
The number of traffic classes reported by the hardware is zero-based so increment the value returned to get an actual count. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-04cls_api.c: Fix dumping of non-existing actions' stats.Ignacy Gawędzki
In tcf_exts_dump_stats(), ensure that exts->actions is not empty before accessing the first element of that list and calling tcf_action_copy_stats() on it. This fixes some random segvs when adding filters of type "basic" with no particular action. This also fixes the dumping of those "no-action" filters, which more often than not made calls to tcf_action_copy_stats() fail and consequently netlink attributes added by the caller to be removed by a call to nla_nest_cancel(). Fixes: 33be62715991 ("net_sched: act: use standard struct list_head") Signed-off-by: Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr> Acked-by: Cong Wang <cwang@twopensource.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-04pkt_sched: fq: avoid hang when quantum 0Kenneth Klette Jonassen
Configuring fq with quantum 0 hangs the system, presumably because of a non-interruptible infinite loop. Either way quantum 0 does not make sense. Reproduce with: sudo tc qdisc add dev lo root fq quantum 0 initial_quantum 0 ping 127.0.0.1 Signed-off-by: Kenneth Klette Jonassen <kennetkl@ifi.uio.no> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-04Btrfs: add missing blk_finish_plug in btrfs_sync_log()Forrest Liu
Add missing blk_finish_plug in btrfs_sync_log() Signed-off-by: Forrest Liu <forrestl@synology.com> Reviewed-by: David Sterba <dsterba@suse.cz> Signed-off-by: Chris Mason <clm@fb.com>
2015-02-05drm/cirrus: Limit modes depending on bpp optionTakashi Iwai
The commit [8975626ea35a: drm/cirrus: allow 32bpp framebuffers for cirrus drm] broke X modesetting driver because cirrus driver still provides the full list of modes up to 1280x1024 while the 32bpp can support only up to 800x600. We might be able to filter out the invalid modes in mode_valid callback, but unfortunately the bpp in question can't be referred there for now (let me know if there is a better way to retrieve the bpp for the probed fb). So, instead, this patch adds the bpp module option to specify the maximal bpp explicitly and limits the resolutions in get_modes depending on its value. The default value is set to 24 so that the existing stuff keeps working. If you need a new 32bpp feature, specify cirrus.bpp=32 option explicitly. Fixes: 8975626ea35a ('drm/cirrus: allow 32bpp framebuffers for cirrus drm') Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Dave Airlie <airlied@redhat.com>
2015-02-04net: rds: use correct size for max unacked packets and bytesSasha Levin
Max unacked packets/bytes is an int while sizeof(long) was used in the sysctl table. This means that when they were getting read we'd also leak kernel memory to userspace along with the timeout values. Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-04vhost/net: fix up num_buffers endian-nessMichael S. Tsirkin
In virtio 1.0 mode, when mergeable buffers are enabled on a big-endian host, num_buffers wasn't byte-swapped correctly, so large incoming packets got corrupted. To fix, fill it in within hdr - this also makes sure it gets the correct type. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-04gianfar: correct the bad expression while writing bit-patternSanjeev Sharma
This patch correct the bad expression while writing the bit-pattern from software's buffer to hardware registers. Signed-off-by: Sanjeev Sharma <Sanjeev_Sharma@mentor.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-04net: usb: sr9700: Use 'SR_' prefix for the common register macrosChen Gang
The commone register macors (e.g. RSR) is too commont to drivers, it may be conflict with the architectures (e.g. xtensa, sh). The related warnings (with allmodconfig under xtensa): CC [M] drivers/net/usb/sr9700.o In file included from drivers/net/usb/sr9700.c:24:0: drivers/net/usb/sr9700.h:65:0: warning: "RSR" redefined #define RSR 0x06 ^ In file included from ./arch/xtensa/include/asm/bitops.h:22:0, from include/linux/bitops.h:36, from include/linux/kernel.h:10, from include/linux/list.h:8, from include/linux/module.h:9, from drivers/net/usb/sr9700.c:13: ./arch/xtensa/include/asm/processor.h:190:0: note: this is the location of the previous definition #define RSR(v,sr) __asm__ __volatile__ ("rsr %0,"__stringify(sr) : "=a"(v)); ^ Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-04Merge remote-tracking branches 'spi/fix/fsl-dspi' and 'spi/fix/imx' into ↵Mark Brown
spi-linus
2015-02-04Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds
Pull cifs fixes from Steve French: "Three small cifs fixes. One fixes a hang under stress, and the other two are security related" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix MUST SecurityFlags filtering Complete oplock break jobs before closing file handle cifs: use memzero_explicit to clear stack buffer
2015-02-04Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-armLinus Torvalds
Pull ARM fixes from Russell King: "A number of ARM fixes, the biggest is fixing a regression caused by appended DT blobs exceeding 64K, causing the decompressor fixup code to fail to patch the DT blob. Another important fix is for the ASID allocator from Will Deacon which prevents some rare crashes seen on some systems. Lastly, there's a build fix for v7M systems when printk support is disabled. The last two remaining fixes are more cosmetic - the IOMMU one prevents an annoying harmless warning message, and we disable the kernel strict memory permissions on non-MMU which can't support it anyway" * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: ARM: 8299/1: mm: ensure local active ASID is marked as allocated on rollover ARM: 8298/1: ARM_KERNMEM_PERMS only works with MMU enabled ARM: 8295/1: fix v7M build for !CONFIG_PRINTK ARM: 8294/1: ATAG_DTB_COMPAT: remove the DT workspace's hardcoded 64KB size ARM: 8288/1: dma-mapping: don't detach devices without an IOMMU during teardown
2015-02-04MIPS: Fix syscall_get_nr for the syscall exit tracing.Lars Persson
Register 2 is alredy overwritten by the return value when syscall_trace_leave() is called. Signed-off-by: Lars Persson <larper@axis.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/9187/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-02-04MIPS: elf2ecoff: Ignore PT_MIPS_ABIFLAGS program headers.Ralf Baechle
These are generated by very recent toolchains and result in an error message when attenpting to convert a kernel from ELF to ECOFF. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-02-04MIPS: elf2ecoff: Rewrite main processing loop to switch.Ralf Baechle
The if construct was getting hard to read and would be getting even more complex with the next bug fix. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2015-02-03Merge branch 'virtio_net_ufo'David S. Miller
Vladislav Yasevich says: ==================== Restore UFO support to virtio_net devices commit 3d0ad09412ffe00c9afa201d01effdb6023d09b4 Author: Ben Hutchings <ben@decadent.org.uk> Date: Thu Oct 30 18:27:12 2014 +0000 drivers/net: Disable UFO through virtio Turned off UFO support to virtio-net based devices due to issues with IPv6 fragment id generation for UFO packets. The issue was that IPv6 UFO/GSO implementation expects the fragment id to be supplied in skb_shinfo(). However, for packets generated by the VMs, the fragment id is not supplied which causes all IPv6 fragments to have the id of 0. The problem is that turning off UFO support on tap/macvtap as well as virtio devices caused issues with migrations. Migrations would fail when moving a vm from a kernel supporting expecting UFO to work to the newer kernels that disabled UFO. This series provides a partial solution to address the migration issue. The series allows us to track whether skb_shinfo()->ip6_frag_id has been set by treating value of 0 as unset. This lets GSO code to generate fragment ids if they are necessary (ex: packet was generated by VM or packet socket). Since v3: - Resolved build issue when IPv6 is a module. - Removed trailing white space. Since v2: - Rebase and rebuild to make sure everything works. No changes to the patches were done. Since v1: - Removed the skb bit and use value of 0 as tracker. - Used Eric's suggestion to set fragment id as 0x80000000 if id generation procedure yeilded a 0 result. - Consolidated ipv6 id genration code. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-03Revert "drivers/net: Disable UFO through virtio"Vlad Yasevich
This reverts commit 3d0ad09412ffe00c9afa201d01effdb6023d09b4. Now that GSO functionality can correctly track if the fragment id has been selected and select a fragment id if necessary, we can re-enable UFO on tap/macvap and virtio devices. Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-03Revert "drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets"Vlad Yasevich
This reverts commit 5188cd44c55db3e92cd9e77a40b5baa7ed4340f7. Now that GSO layer can track if fragment id has been selected and can allocate one if necessary, we don't need to do this in tap and macvtap. This reverts most of the code and only keeps the new ipv6 fragment id generation function that is still needed. Fixes: 3d0ad09412ff (drivers/net: Disable UFO through virtio) Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-03ipv6: Select fragment id during UFO segmentation if not set.Vlad Yasevich
If the IPv6 fragment id has not been set and we perform fragmentation due to UFO, select a new fragment id. We now consider a fragment id of 0 as unset and if id selection process returns 0 (after all the pertrubations), we set it to 0x80000000, thus giving us ample space not to create collisions with the next packet we may have to fragment. When doing UFO integrity checking, we also select the fragment id if it has not be set yet. This is stored into the skb_shinfo() thus allowing UFO to function correclty. This patch also removes duplicate fragment id generation code and moves ipv6_select_ident() into the header as it may be used during GSO. Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-04sched/deadline: Fix deadline parameter modification handlingPeter Zijlstra
Commit 67dfa1b756f2 ("sched/deadline: Implement cancel_dl_timer() to use in switched_from_dl()") removed the hrtimer_try_cancel() function call out from init_dl_task_timer(), which gets called from __setparam_dl(). The result is that we can now re-init the timer while its active -- this is bad and corrupts timer state. Furthermore; changing the parameters of an active deadline task is tricky in that you want to maintain guarantees, while immediately effective change would allow one to circumvent the CBS guarantees -- this too is bad, as one (bad) task should not be able to affect the others. Rework things to avoid both problems. We only need to initialize the timer once, so move that to __sched_fork() for new tasks. Then make sure __setparam_dl() doesn't affect the current running state but only updates the parameters used to calculate the next scheduling period -- this guarantees the CBS functions as expected (albeit slightly pessimistic). This however means we need to make sure __dl_clear_params() needs to reset the active state otherwise new (and tasks flipping between classes) will not properly (re)compute their first instance. Todo: close class flipping CBS hole. Todo: implement delayed BW release. Reported-by: Luca Abeni <luca.abeni@unitn.it> Acked-by: Juri Lelli <juri.lelli@arm.com> Tested-by: Luca Abeni <luca.abeni@unitn.it> Fixes: 67dfa1b756f2 ("sched/deadline: Implement cancel_dl_timer() to use in switched_from_dl()") Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: <stable@vger.kernel.org> Cc: Kirill Tkhai <tkhai@yandex.ru> Cc: Linus Torvalds <torvalds@linux-foundation.org> Link: http://lkml.kernel.org/r/20150128140803.GF23038@twins.programming.kicks-ass.net Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-02-04Merge branch 'liblockdep-fixes-3.19' of ↵Ingo Molnar
git://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux into core/urgent Pull liblockdep fixes from Sasha Levin. Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-02-03Merge tag 'rdma-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband Pull infiniband reverts from Roland Dreier: "Last minute InfiniBand/RDMA changes for 3.19: - Revert IPoIB driver back to 3.18 state. We had a number of fixes go into 3.19, but they introduced regressions. We tried to get everything fixed up but ran out of time, so we'll try again for 3.20. - Similarly, turn off the new "extended query port" verb. Late in the cycle we realized the ABI is not quite right, and rather than freeze something in a rush and make a mistake, we'll take a bit more time and get it right in 3.20" * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IB/core: Temporarily disable ex_query_device uverb Revert "IPoIB: Consolidate rtnl_lock tasks in workqueue" Revert "IPoIB: Make the carrier_on_task race aware" Revert "IPoIB: fix MCAST_FLAG_BUSY usage" Revert "IPoIB: fix mcast_dev_flush/mcast_restart_task race" Revert "IPoIB: change init sequence ordering" Revert "IPoIB: Use dedicated workqueues per interface" Revert "IPoIB: Make ipoib_mcast_stop_thread flush the workqueue" Revert "IPoIB: No longer use flush as a parameter"
2015-02-03Merge tag 'md/3.19-fixes' of git://neil.brown.name/mdLinus Torvalds
Pull two fixes for md from Neil Brown: - Another live lock, needs backporting - work-around false positive with new warnings. * tag 'md/3.19-fixes' of git://neil.brown.name/md: md/bitmap: fix a might_sleep() warning. md/raid5: fix another livelock caused by non-aligned writes.
2015-02-03PCI: Handle read-only BARs on AMD CS553x devicesMyron Stowe
Some AMD CS553x devices have read-only BARs because of a firmware or hardware defect. There's a workaround in quirk_cs5536_vsa(), but it no longer works after 36e8164882ca ("PCI: Restore detection of read-only BARs"). Prior to 36e8164882ca, we filled in res->start; afterwards we leave it zeroed out. The quirk only updated the size, so the driver tried to use a region starting at zero, which didn't work. Expand quirk_cs5536_vsa() to read the base addresses from the BARs and hard-code the sizes. On Nix's system BAR 2's read-only value is 0x6200. Prior to 36e8164882ca, we interpret that as a 512-byte BAR based on the lowest-order bit set. Per datasheet sec 5.6.1, that BAR (MFGPT) requires only 64 bytes; use that to avoid clearing any address bits if a platform uses only 64-byte alignment. [bhelgaas: changelog, reduce BAR 2 size to 64] Fixes: 36e8164882ca ("PCI: Restore detection of read-only BARs") Link: https://bugzilla.kernel.org/show_bug.cgi?id=85991#c4 Link: http://support.amd.com/TechDocs/31506_cs5535_databook.pdf Link: http://support.amd.com/TechDocs/33238G_cs5536_db.pdf Reported-and-tested-by: Nix <nix@esperi.org.uk> Signed-off-by: Myron Stowe <myron.stowe@redhat.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> CC: stable@vger.kernel.org # v.2.6.27+
2015-02-03aio: annotate aio_read_event_ring for sleep patternsDave Chinner
Under CONFIG_DEBUG_ATOMIC_SLEEP=y, aio_read_event_ring() will throw warnings like the following due to being called from wait_event context: WARNING: CPU: 0 PID: 16006 at kernel/sched/core.c:7300 __might_sleep+0x7f/0x90() do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff810d85a3>] prepare_to_wait_event+0x63/0x110 Modules linked in: CPU: 0 PID: 16006 Comm: aio-dio-fcntl-r Not tainted 3.19.0-rc6-dgc+ #705 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 ffffffff821c0372 ffff88003c117cd8 ffffffff81daf2bd 000000000000d8d8 ffff88003c117d28 ffff88003c117d18 ffffffff8109beda ffff88003c117cf8 ffffffff821c115e 0000000000000061 0000000000000000 00007ffffe4aa300 Call Trace: [<ffffffff81daf2bd>] dump_stack+0x4c/0x65 [<ffffffff8109beda>] warn_slowpath_common+0x8a/0xc0 [<ffffffff8109bf56>] warn_slowpath_fmt+0x46/0x50 [<ffffffff810d85a3>] ? prepare_to_wait_event+0x63/0x110 [<ffffffff810d85a3>] ? prepare_to_wait_event+0x63/0x110 [<ffffffff810bdfcf>] __might_sleep+0x7f/0x90 [<ffffffff81db8344>] mutex_lock+0x24/0x45 [<ffffffff81216b7c>] aio_read_events+0x4c/0x290 [<ffffffff81216fac>] read_events+0x1ec/0x220 [<ffffffff810d8650>] ? prepare_to_wait_event+0x110/0x110 [<ffffffff810fdb10>] ? hrtimer_get_res+0x50/0x50 [<ffffffff8121899d>] SyS_io_getevents+0x4d/0xb0 [<ffffffff81dba5a9>] system_call_fastpath+0x12/0x17 ---[ end trace bde69eaf655a4fea ]--- There is not actually a bug here, so annotate the code to tell the debug logic that everything is just fine and not to fire a false positive. Signed-off-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
2015-02-03Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds
Pull final block layer fixes from Jens Axboe: "Unfortunately the hctx/ctx lifetime fix from last pull had some issues. This pull request contains a revert of the problematic commit, and a proper rewrite of it. The rewrite has been tested by the users complaining about the regression, and it works fine now. Additionally, I've run testing on all the blk-mq use cases for it and it passes. So we should definitely get this into 3.19, to avoid regression for some cases" * 'for-linus' of git://git.kernel.dk/linux-block: blk-mq: release mq's kobjects in blk_release_queue() Revert "blk-mq: fix hctx/ctx kobject use-after-free"
2015-02-03Merge tag 'gpio-v3.19-5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull gpio fixes from Linus Walleij: "Yet more GPIO fixes for the v3.19 series. There is a high bug-spot activity in GPIO this merge window, much due to Johan Hovolds spearheading into actually exercising the removal path for GPIO chips, something that was never really exercised before. The other two fixes are augmenting erroneous behaviours in two specific drivers for minor systems. Summary from signed tag: - Two fixes stabilizing that which was never stable before: removal of GPIO chips, now let's stop leaking memory. - Make sure OMAP IRQs are usable when the irqchip API is used orthogonally to the gpiochip API. - Provide a default GPIO base for the mcp23s08 driver" * tag 'gpio-v3.19-5' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: sysfs: fix memory leak in gpiod_sysfs_set_active_low gpio: sysfs: fix memory leak in gpiod_export_link gpio: mcp23s08: handle default gpio base gpio: omap: Fix bad device access with setup_irq()
2015-02-03Merge branches 'ipoib' and 'odp' into for-nextRoland Dreier
2015-02-03IB/core: Temporarily disable ex_query_device uverbHaggai Eran
Commit 5a77abf9a97a ("IB/core: Add support for extended query device caps") added a new extended verb to query the capabilities of RDMA devices, but the semantics of this verb are still under debate [1]. Don't expose this verb to userspace until the ABI is nailed down. [1] [PATCH v1 0/5] IB/core: extended query device caps cleanup for v3.19 http://www.spinics.net/lists/linux-rdma/msg22904.html Signed-off-by: Haggai Eran <haggaie@mellanox.com> Reviewed-by: Yann Droneaud <ydroneaud@opteya.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
2015-02-03Revert "ACPI / LPSS: introduce a 'proxy' device to power on LPSS for DMA"Rafael J. Wysocki
Revert commit 6c17ee44d524 (ACPI / LPSS: introduce a 'proxy' device to power on LPSS for DMA), as it introduced registration and probe ordering problems between devices on the LPSS that may lead to full hard system hang on boot in some cases.
2015-02-03ASoC: sgtl5000: add delay before first I2C accessEric Nelson
To quote from section 1.3.1 of the data sheet: The SGTL5000 has an internal reset that is deasserted 8 SYS_MCLK cycles after all power rails have been brought up. After this time, communication can start ... 1.0us represents 8 SYS_MCLK cycles at the minimum 8.0 MHz SYS_MCLK. Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com> Reviewed-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2015-02-03ARM: 8299/1: mm: ensure local active ASID is marked as allocated on rolloverWill Deacon
Commit e1a5848e3398 ("ARM: 7924/1: mm: don't bother with reserved ttbr0 when running with LPAE") removed the use of the reserved TTBR0 value for LPAE systems, since the ASID is held in the TTBR and can be updated atomicly with the pgd of the next mm. Unfortunately, this patch forgot to update flush_context, which deliberately avoids marking the local active ASID as allocated, since we used to switch via ASID zero and didn't need to allocate the ASID of the previous mm. The side-effect of this is that we can allocate the same ASID to the next mm and, between flushing the local TLB and updating TTBR0, we can perform speculative TLB fills for userspace nG mappings using the page table of the previous mm. The consequence of this is that the next mm can erroneously hit some mappings of the previous mm. Note that this was made significantly harder to hit by a391263cd84e ("ARM: 8203/1: mm: try to re-use old ASID assignments following a rollover") but is still theoretically possible. This patch fixes the problem by removing the code from flush_context that forces the allocated ASID to zero for the local CPU. Many thanks to the Broadcom guys for tracking this one down. Fixes: e1a5848e3398 ("ARM: 7924/1: mm: don't bother with reserved ttbr0 when running with LPAE") Cc: <stable@vger.kernel.org> # v3.14+ Reported-by: Raymond Ngun <rngun@broadcom.com> Tested-by: Raymond Ngun <rngun@broadcom.com> Reviewed-by: Gregory Fong <gregory.0xf0@gmail.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2015-02-03spi: imx: use pio mode for i.mx6dlRobin Gong
For TKT238285 hardware issue which may cause txfifo store data twice can only be caught on i.mx6dl, we use pio mode instead of DMA mode on i.mx6dl. Fixes: f62caccd12c17e4 (spi: spi-imx: add DMA support) Signed-off-by: Robin Gong <b38343@freescale.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2015-02-03sched/wait: Remove might_sleep() from wait_event_cmd()Mikulas Patocka
The patch e22b886a8a43 ("sched/wait: Add might_sleep() checks") introduced a bug in the raid5 subsystem. The function raid5_quiesce() (and resize_stripes()) uses the 'cmd' part to release and acquire a spinlock (so we call the sleep primitives in atomic context), and therefore we cannot do the might_sleep() check. Remove it. Fixes: e22b886a8a43 ("sched/wait: Add might_sleep() checks") Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Link: http://lkml.kernel.org/r/alpine.LRH.2.02.1502020935580.13510@file01.intranet.prod.int.rdu2.redhat.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-02-02xen-netback: stop the guest rx thread after a fatal errorDavid Vrabel
After commit e9d8b2c2968499c1f96563e6522c56958d5a1d0d (xen-netback: disable rogue vif in kthread context), a fatal (protocol) error would leave the guest Rx thread spinning, wasting CPU time. Commit ecf08d2dbb96d5a4b4bcc53a39e8d29cc8fef02e (xen-netback: reintroduce guest Rx stall detection) made this even worse by removing a cond_resched() from this path. Since a fatal error is non-recoverable, just allow the guest Rx thread to exit. This requires taking additional refs to the task so the thread exiting early is handled safely. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reported-by: Julien Grall <julien.grall@linaro.org> Tested-by: Julien Grall <julien.grall@linaro.org> Acked-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-02net/mlx4_core: Fix kernel Oops (mem corruption) when working with more than ↵Jack Morgenstein
80 VFs Commit de966c592802 (net/mlx4_core: Support more than 64 VFs) was meant to allow up to 126 VFs. However, due to leaving MLX4_MFUNC_MAX too low, using more than 80 VFs resulted in memory corruptions (and Oopses) when more than 80 VFs were requested. In addition, the number of slaves was left too high. This commit fixes these issues. Fixes: de966c592802 ("net/mlx4_core: Support more than 64 VFs") Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-02isdn: off by one in connect_res()Dan Carpenter
The bug here is that we use "Reject" as the index into the cau_t[] array in the else path. Since the cau_t[] has 9 elements if Reject == 9 then we are reading beyond the end of the array. My understanding of the code is that it's saying that if Reject is 1 or too high then that's invalid and we should hang up. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-02Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nfDavid S. Miller
Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter/IPVS fixes for your net tree, they are: 1) Validate hooks for nf_tables NAT expressions, otherwise users can crash the kernel when using them from the wrong hook. We already got one user trapped on this when configuring masquerading. 2) Fix a BUG splat in nf_tables with CONFIG_DEBUG_PREEMPT=y. Reported by Andreas Schultz. 3) Avoid unnecessary reroute of traffic in the local input path in IPVS that triggers a crash in in xfrm. Reported by Florian Wiessner and fixes by Julian Anastasov. 4) Fix memory and module refcount leak from the error path of nf_tables_newchain(). ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-02Documentation: Update netlink_mmap.txtRichard Weinberger
Update netlink_mmap.txt wrt. commit 4682a0358639b29cf ("netlink: Always copy on mmap TX."). Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-02sunvnet: set queue mapping when doing packet copiesDavid L Stevens
This patch fixes a bug where vnet_skb_shape() didn't set the already-selected queue mapping when a packet copy was required. This results in using the wrong queue index for stops/starts, hung tx queues and watchdog timeouts under heavy load. Signed-off-by: David L Stevens <david.stevens@oracle.com> Acked-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-02qlge: Fix qlge_update_hw_vlan_features to handle if interface is downMarcelo Leitner
Currently qlge_update_hw_vlan_features() will always first put the interface down, then update features and then bring it up again. But it is possible to hit this code while the adapter is down and this causes a non-paired call to napi_disable(), which will get stuck. This patch fixes it by skipping these down/up actions if the interface is already down. Fixes: a45adbe8d352 ("qlge: Enhance nested VLAN (Q-in-Q) handling.") Cc: Harish Patil <harish.patil@qlogic.com> Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-03Merge tag 'drm-amdkfd-fixes-2015-02-02' of ↵Dave Airlie
git://people.freedesktop.org/~gabbayo/linux into drm-fixes Three small fixes that came up during last week, nothing scary: - Accidently incremented a counter instead of decrementing it (copy-paste error) - Module parameter of max num of queues must be at least 1 and not 0 - Don't do BUG() as a result from wrong user input * tag 'drm-amdkfd-fixes-2015-02-02' of git://people.freedesktop.org/~gabbayo/linux: drm/amdkfd: Don't create BUG due to incorrect user parameter drm/amdkfd: max num of queues can't be 0 drm/amdkfd: Fix bug in accounting of queues
2015-02-03Merge branch 'drm-fixes-3.19' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie
into drm-fixes One last round of fixes for radeon for 3.19: - fix some fallout from the reservation object integration on the test/benchmark options - fix a crash in the gpu vm code if gfx init fails - fix a pll issue that leads to a blank screen on older IGP parts * 'drm-fixes-3.19' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: fix the crash in test functions drm/radeon: fix the crash in benchmark functions drm/radeon: properly set vm fragment size for TN/RL drm/radeon: don't init gpuvm if accel is disabled (v3) drm/radeon: fix PLLs on RS880 and older v2
2015-02-02drm/radeon: fix the crash in test functionsIlija Hadzic
radeon_copy_dma and radeon_copy_blit must be called with a valid reservation object. Otherwise a crash will be provoked. We borrow the object from vram BO. bug: https://bugs.freedesktop.org/show_bug.cgi?id=88464 Cc: stable@vger.kernel.org Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Ilija Hadzic <ihadzic@research.bell-labs.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-02-02drm/radeon: fix the crash in benchmark functionsIlija Hadzic
radeon_copy_dma and radeon_copy_blit must be called with a valid reservation object. Otherwise a crash will be provoked. We borrow the object from destination BO. bug: https://bugs.freedesktop.org/show_bug.cgi?id=88464 Cc: stable@vger.kernel.org Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Ilija Hadzic <ihadzic@research.bell-labs.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-02-02drm/radeon: properly set vm fragment size for TN/RLAlex Deucher
Should be the same as cayman. We don't use VM by default on NI parts so this isn't critical. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org