OSDN Git Service
John W. Linville [Wed, 12 Jun 2013 14:57:04 +0000 (10:57 -0400)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless into for-davem
Kees Cook [Fri, 10 May 2013 21:48:21 +0000 (14:48 -0700)]
b43: stop format string leaking into error msgs
The module parameter "fwpostfix" is userspace controllable, unfiltered,
and is used to define the firmware filename. b43_do_request_fw() populates
ctx->errors[] on error, containing the firmware filename. b43err()
parses its arguments as a format string. For systems with b43 hardware,
this could lead to a uid-0 to ring-0 escalation.
CVE-2013-2852
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Sujith Manoharan [Thu, 6 Jun 2013 04:36:29 +0000 (10:06 +0530)]
ath9k: Use minstrel rate control by default
The ath9k rate control algorithm has various architectural
issues that make it a poor fit in scenarios like congested
environments etc.
An example: https://bugzilla.redhat.com/show_bug.cgi?id=927191
Change the default to minstrel which is more robust in such cases.
The ath9k RC code is left in the driver for now, maybe it can
be removed altogether later on.
Cc: stable@vger.kernel.org
Cc: Jouni Malinen <jouni@qca.qualcomm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Felix Fietkau [Mon, 3 Jun 2013 09:18:57 +0000 (11:18 +0200)]
Revert "ath9k_hw: Update rx gain initval to improve rx sensitivity"
This reverts commit
68d9e1fa24d9c7c2e527f49df8d18fb8cf0ec943
This change reduces rx sensitivity with no apparent extra benefit.
It looks like it was meant for testing in a specific scenario,
but it was never properly validated.
Cc: rmanohar@qca.qualcomm.com
Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Sujith Manoharan [Sat, 1 Jun 2013 01:38:09 +0000 (07:08 +0530)]
ath9k: Disable PowerSave by default
Almost all the DMA issues which have plagued ath9k (in station mode)
for years are related to PS. Disabling PS usually "fixes" the user's
connection stablility. Reports of DMA problems are still trickling in
and are sitting in the kernel bugzilla. Until the PS code in ath9k is
given a thorough review, disbale it by default. The slight increase
in chip power consumption is a small price to pay for improved link
stability.
Cc: stable@vger.kernel.org
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Yijing Wang [Fri, 31 May 2013 06:05:32 +0000 (14:05 +0800)]
net: wireless: iwlegacy: fix build error for il_pm_ops
Fix build error for il_pm_ops if CONFIG_PM is set
but CONFIG_PM_SLEEP is not set.
ERROR: "il_pm_ops" [drivers/net/wireless/iwlegacy/iwl4965.ko] undefined!
ERROR: "il_pm_ops" [drivers/net/wireless/iwlegacy/iwl3945.ko] undefined!
make[1]: *** [__modpost] Error 1
make: *** [modules] Error 2
Signed-off-by: Yijing Wang <wangyijing@huawei.com>
Cc: Stanislaw Gruszka <sgruszka@redhat.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Cc: netdev@vger.kernel.org
Cc: linux-wireless@vger.kernel.org
Cc: Jingoo Han <jg1.han@samsung.com>
Acked-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Larry Finger [Thu, 30 May 2013 21:21:47 +0000 (16:21 -0500)]
rtlwifi: Fix a false leak indication for PCI devices
This false leak indication is avoided with a no-leak annotation to kmemleak.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Eliad Peller [Tue, 7 May 2013 12:41:09 +0000 (15:41 +0300)]
wl12xx/wl18xx: scan all 5ghz channels
Due to a typo, the current code copies only sizeof(cmd->channels_2)
bytes, which is smaller than the correct sizeof(cmd->channels_5)
size, resulting in a partial scan (some channels are skipped).
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Luciano Coelho [Fri, 10 May 2013 07:44:25 +0000 (10:44 +0300)]
wl12xx: increase minimum singlerole firmware version required
The minimum firmware version required for singlerole after recent
driver changes is 6/7.3.10.0.133.
Reported-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Luciano Coelho [Fri, 10 May 2013 07:19:38 +0000 (10:19 +0300)]
wl12xx: fix minimum required firmware version for wl127x multirole
There was a typo in commit 8675f9 (wlcore/wl12xx/wl18xx: verify
multi-role and single-role fw versions), which was causing the
multirole firmware for wl127x (WiLink6) to be rejected. The actual
minimum version needed for wl127x multirole is 6.5.7.0.42.
Reported-by: Levi Pearson <levipearson@gmail.com>
Reported-by: Michael Scott <hashcode0f@gmail.com>
Cc: stable@kernel.org # 3.9+
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Larry Finger [Thu, 30 May 2013 23:05:55 +0000 (18:05 -0500)]
rtlwifi: rtl8192cu: Fix problem in connecting to WEP or WPA(1) networks
Driver rtl8192cu can connect to WPA2 networks, but fails for any other
encryption method. The cause is a failure to set the rate control data
blocks. These changes fix https://bugzilla.redhat.com/show_bug.cgi?id=952793
and https://bugzilla.redhat.com/show_bug.cgi?id=761525.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Mark A. Greer [Wed, 29 May 2013 19:25:34 +0000 (12:25 -0700)]
mwifiex: debugfs: Fix out of bounds array access
When reading the contents of '/sys/kernel/debug/mwifiex/p2p0/info',
the following panic occurs:
$ cat /sys/kernel/debug/mwifiex/p2p0/info
Unable to handle kernel paging request at virtual address
74706164
pgd =
de530000
[
74706164] *pgd=
00000000
Internal error: Oops: 5 [#1] SMP ARM
Modules linked in: phy_twl4030_usb omap2430 musb_hdrc mwifiex_sdio mwifiex
CPU: 0 PID: 1635 Comm: cat Not tainted
3.10.0-rc1-00010-g1268390 #1
task:
de16b6c0 ti:
de048000 task.ti:
de048000
PC is at strnlen+0xc/0x4c
LR is at string+0x3c/0xf8
pc : [<
c02c123c>] lr : [<
c02c2d1c>] psr:
a0000013
sp :
de049e10 ip :
c06efba0 fp :
de6d2092
r10:
bf01a260 r9 :
ffffffff r8 :
74706164
r7 :
0000ffff r6 :
ffffffff r5 :
de6d209c r4 :
00000000
r3 :
ff0a0004 r2 :
74706164 r1 :
ffffffff r0 :
74706164
Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control:
10c5387d Table:
9e530019 DAC:
00000015
Process cat (pid: 1635, stack limit = 0xde048240)
Stack: (0xde049e10 to 0xde04a000)
9e00:
de6d2092 00000002 bf01a25e de6d209c
9e20:
de049e80 c02c438c 0000000a ff0a0004 ffffffff 00000000 00000000 de049e48
9e40:
00000000 2192df6d ff0a0004 ffffffff 00000000 de6d2092 de049ef8 bef3cc00
9e60:
de6b0000 dc358000 de6d2000 00000000 00000003 c02c45a4 bf01790c bf01a254
9e80:
74706164 bf018698 00000000 de59c3c0 de048000 de049f80 00001000 bef3cc00
9ea0:
00000008 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9ec0:
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9ee0:
00000000 00000000 00000000 00000001 00000000 00000000 6669776d 20786569
9f00:
20302e31 2e343128 392e3636 3231702e 00202933 00000000 00000003 c0294898
9f20:
00000000 00000000 00000000 00000000 de59c3c0 c0107c04 de554000 de59c3c0
9f40:
00001000 bef3cc00 de049f80 bef3cc00 de049f80 00000000 00000003 c0108a00
9f60:
de048000 de59c3c0 00000000 00000000 de59c3c0 00001000 bef3cc00 c0108b60
9f80:
00000000 00000000 00001000 bef3cc00 00000003 00000003 c0014128 de048000
9fa0:
00000000 c0013f80 00001000 bef3cc00 00000003 bef3cc00 00001000 00000000
9fc0:
00001000 bef3cc00 00000003 00000003 00000001 00000001 00000001 00000003
9fe0:
00000000 bef3cbdc 00011984 b6f1127c 60000010 00000003 18dbdd2c 7f7bfffd
[<
c02c123c>] (strnlen+0xc/0x4c) from [<
c02c2d1c>] (string+0x3c/0xf8)
[<
c02c2d1c>] (string+0x3c/0xf8) from [<
c02c438c>] (vsnprintf+0x1e8/0x3e8)
[<
c02c438c>] (vsnprintf+0x1e8/0x3e8) from [<
c02c45a4>] (sprintf+0x18/0x24)
[<
c02c45a4>] (sprintf+0x18/0x24) from [<
bf01790c>] (mwifiex_info_read+0xfc/0x3e8 [mwifiex])
[<
bf01790c>] (mwifiex_info_read+0xfc/0x3e8 [mwifiex]) from [<
c0108a00>] (vfs_read+0xb0/0x144)
[<
c0108a00>] (vfs_read+0xb0/0x144) from [<
c0108b60>] (SyS_read+0x44/0x70)
[<
c0108b60>] (SyS_read+0x44/0x70) from [<
c0013f80>] (ret_fast_syscall+0x0/0x30)
Code:
e12fff1e e3510000 e1a02000 0a00000d (
e5d03000)
---[ end trace
ca98273dc605a04f ]---
The panic is caused by the mwifiex_info_read() routine assuming that
there can only be four modes (0-3) which is an invalid assumption.
For example, when testing P2P, the mode is '8' (P2P_CLIENT) so the
code accesses data beyond the bounds of the bss_modes[] array which
causes the panic. Fix this by updating bss_modes[] to support the
current list of modes and adding a check to prevent the out-of-bounds
access from occuring in the future when more modes are added.
Signed-off-by: Mark A. Greer <mgreer@animalcreek.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Johan Hedberg [Wed, 29 May 2013 06:51:29 +0000 (09:51 +0300)]
Bluetooth: Fix mgmt handling of power on failures
If hci_dev_open fails we need to ensure that the corresponding
mgmt_set_powered command gets an appropriate response. This patch fixes
the missing response by adding a new mgmt_set_powered_failed function
that's used to indicate a power on failure to mgmt. Since a situation
with the device being rfkilled may require special handling in user
space the patch uses a new dedicated mgmt status code for this.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Johan Hedberg [Tue, 28 May 2013 10:46:30 +0000 (13:46 +0300)]
Bluetooth: Fix missing length checks for L2CAP signalling PDUs
There has been code in place to check that the L2CAP length header
matches the amount of data received, but many PDU handlers have not been
checking that the data received actually matches that expected by the
specific PDU. This patch adds passing the length header to the specific
handler functions and ensures that those functions fail cleanly in the
case of an incorrect amount of data.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Bing Zhao [Tue, 14 May 2013 01:15:32 +0000 (18:15 -0700)]
Bluetooth: btmrvl: support Marvell Bluetooth device SD8897
The register offsets have been changed in SD8897 and newer chips.
Define a new btmrvl_sdio_card_reg map for SD88xx.
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: Frank Huang <frankh@marvell.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Johan Hedberg [Wed, 24 Apr 2013 10:05:32 +0000 (13:05 +0300)]
Bluetooth: Fix checks for LE support on LE-only controllers
LE-only controllers do not support extended features so any kind of host
feature bit checks do not make sense for them. This patch fixes code
used for both single-mode (LE-only) and dual-mode (BR/EDR/LE) to use the
HCI_LE_ENABLED flag instead of the "Host LE supported" feature bit for
LE support tests.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Jiri Pirko [Sat, 8 Jun 2013 13:00:55 +0000 (15:00 +0200)]
team: fix checks in team_get_first_port_txable_rcu()
should be checked if "cur" is txable, not "port".
Introduced by commit
6e88e1357c "team: use function team_port_txable()
for determing enabled and up port"
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jiri Pirko [Sat, 8 Jun 2013 13:00:54 +0000 (15:00 +0200)]
team: move add to port list before port enablement
team_port_enable() adds port to port_hashlist. Reader sees port
in team_get_port_by_index_rcu() and returns it, but
team_get_first_port_txable_rcu() tries to go through port_list, where the
port is not inserted yet -> NULL pointer dereference.
Fix this by reordering port_list and port_hashlist insertion.
Panic is easily triggeable when txing packets and adding/removing port
in a loop.
Introduced by commit
3d249d4c "net: introduce ethernet teaming device"
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jiri Pirko [Sat, 8 Jun 2013 13:00:53 +0000 (15:00 +0200)]
team: check return value of team_get_port_by_index_rcu() for NULL
team_get_port_by_index_rcu() might return NULL due to race between port
removal and skb tx path. Panic is easily triggeable when txing packets
and adding/removing port in a loop.
introduced by commit
3d249d4ca "net: introduce ethernet teaming device"
and commit
753f993911b "team: introduce random mode" (for random mode)
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jason Wang [Sat, 8 Jun 2013 06:17:41 +0000 (14:17 +0800)]
tuntap: set SOCK_ZEROCOPY flag during open
Commit
54f968d6efdbf7dec36faa44fc11f01b0e4d1990
(tuntap: move socket to tun_file) forgets to set SOCK_ZEROCOPY flag, which will
prevent vhost_net from doing zercopy w/ tap. This patch fixes this by setting
it during file open.
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Tue, 11 Jun 2013 09:52:47 +0000 (02:52 -0700)]
netlink: fix error propagation in netlink_mmap()
Return the error if something went wrong instead of unconditionally
returning 0.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Borkmann [Thu, 6 Jun 2013 13:53:47 +0000 (15:53 +0200)]
net: sctp: fix NULL pointer dereference in socket destruction
While stress testing sctp sockets, I hit the following panic:
BUG: unable to handle kernel NULL pointer dereference at
0000000000000020
IP: [<
ffffffffa0490c4e>] sctp_endpoint_free+0xe/0x40 [sctp]
PGD
7cead067 PUD
7ce76067 PMD 0
Oops: 0000 [#1] SMP
Modules linked in: sctp(F) libcrc32c(F) [...]
CPU: 7 PID: 2950 Comm: acc Tainted: GF 3.10.0-rc2+ #1
Hardware name: Dell Inc. PowerEdge T410/0H19HD, BIOS 1.6.3 02/01/2011
task:
ffff88007ce0e0c0 ti:
ffff88007b568000 task.ti:
ffff88007b568000
RIP: 0010:[<
ffffffffa0490c4e>] [<
ffffffffa0490c4e>] sctp_endpoint_free+0xe/0x40 [sctp]
RSP: 0018:
ffff88007b569e08 EFLAGS:
00010292
RAX:
0000000000000000 RBX:
ffff88007db78a00 RCX:
dead000000200200
RDX:
ffffffffa049fdb0 RSI:
ffff8800379baf38 RDI:
0000000000000000
RBP:
ffff88007b569e18 R08:
ffff88007c230da0 R09:
0000000000000001
R10:
0000000000000000 R11:
0000000000000000 R12:
0000000000000000
R13:
ffff880077990d00 R14:
0000000000000084 R15:
ffff88007db78a00
FS:
00007fc18ab61700(0000) GS:
ffff88007fc60000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
000000008005003b
CR2:
0000000000000020 CR3:
000000007cf9d000 CR4:
00000000000007e0
DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
DR3:
0000000000000000 DR6:
00000000ffff0ff0 DR7:
0000000000000400
Stack:
ffff88007b569e38 ffff88007db78a00 ffff88007b569e38 ffffffffa049fded
ffffffff81abf0c0 ffff88007db78a00 ffff88007b569e58 ffffffff8145b60e
0000000000000000 0000000000000000 ffff88007b569eb8 ffffffff814df36e
Call Trace:
[<
ffffffffa049fded>] sctp_destroy_sock+0x3d/0x80 [sctp]
[<
ffffffff8145b60e>] sk_common_release+0x1e/0xf0
[<
ffffffff814df36e>] inet_create+0x2ae/0x350
[<
ffffffff81455a6f>] __sock_create+0x11f/0x240
[<
ffffffff81455bf0>] sock_create+0x30/0x40
[<
ffffffff8145696c>] SyS_socket+0x4c/0xc0
[<
ffffffff815403be>] ? do_page_fault+0xe/0x10
[<
ffffffff8153cb32>] ? page_fault+0x22/0x30
[<
ffffffff81544e02>] system_call_fastpath+0x16/0x1b
Code: 0c c9 c3 66 2e 0f 1f 84 00 00 00 00 00 e8 fb fe ff ff c9 c3 66 0f
1f 84 00 00 00 00 00 55 48 89 e5 53 48 83 ec 08 66 66 66 66 90 <48>
8b 47 20 48 89 fb c6 47 1c 01 c6 40 12 07 e8 9e 68 01 00 48
RIP [<
ffffffffa0490c4e>] sctp_endpoint_free+0xe/0x40 [sctp]
RSP <
ffff88007b569e08>
CR2:
0000000000000020
---[ end trace
e0d71ec1108c1dd9 ]---
I did not hit this with the lksctp-tools functional tests, but with a
small, multi-threaded test program, that heavily allocates, binds,
listens and waits in accept on sctp sockets, and then randomly kills
some of them (no need for an actual client in this case to hit this).
Then, again, allocating, binding, etc, and then killing child processes.
This panic then only occurs when ``echo 1 > /proc/sys/net/sctp/auth_enable''
is set. The cause for that is actually very simple: in sctp_endpoint_init()
we enter the path of sctp_auth_init_hmacs(). There, we try to allocate
our crypto transforms through crypto_alloc_hash(). In our scenario,
it then can happen that crypto_alloc_hash() fails with -EINTR from
crypto_larval_wait(), thus we bail out and release the socket via
sk_common_release(), sctp_destroy_sock() and hit the NULL pointer
dereference as soon as we try to access members in the endpoint during
sctp_endpoint_free(), since endpoint at that time is still NULL. Now,
if we have that case, we do not need to do any cleanup work and just
leave the destruction handler.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Michael S. Tsirkin [Thu, 6 Jun 2013 12:20:46 +0000 (15:20 +0300)]
vhost: fix ubuf_info cleanup
vhost_net_clear_ubuf_info didn't clear ubuf_info
after kfree, this could trigger double free.
Fix this and simplify this code to make it more robust: make sure
ubuf info is always freed through vhost_net_clear_ubuf_info.
Reported-by: Tommi Rantala <tt.rantala@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Michael S. Tsirkin [Thu, 6 Jun 2013 12:20:39 +0000 (15:20 +0300)]
vhost: check owner before we overwrite ubuf_info
If device has an owner, we shouldn't touch ubuf_info
since it might be in use.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Bjørn Mork [Thu, 6 Jun 2013 10:57:02 +0000 (12:57 +0200)]
qmi_wwan/cdc_ether: let qmi_wwan handle the Huawei E1820
Another QMI speaking Qualcomm based device, which should be
driven by qmi_wwan, while cdc_ether should ignore it.
Like on other Huawei devices, the wwan function can appear
either as a single vendor specific interface or as a CDC ECM
class function using separate control and data interfaces.
The ECM control interface protocol is 0xff, likely in an
attempt to indicate that vendor specific management is
required.
In addition to the near standard CDC class, Huawei also add
vendor specific AT management commands to their firmwares.
This is probably an attempt to support non-Windows systems
using standard class drivers. Unfortunately, this part of
the firmware is often buggy. Linux is much better off using
whatever native vendor specific management protocol the
device offers, and Windows uses, whenever possible. This
means QMI in the case of Qualcomm based devices.
The E1820 has been verified to work fine with QMI.
Matching on interface number is necessary to distiguish the
wwan function from serial functions in the single interface
mode, as both function types will have class/subclass/function
set to ff/ff/ff.
The control interface number does not change in CDC ECM mode,
so the interface number matching rule is sufficient to handle
both modes. The cdc_ether blacklist entry is only relevant in
CDC ECM mode, but using a similar interface number based rule
helps document this as a transfer from one driver to another.
Other Huawei 02/06/ff devices are left with the cdc_ether driver
because we do not know whether they are based on Qualcomm chips.
The Huawei specific AT command management is known to be somewhat
hardware independent, and their usage of these class codes may
also be independent of the modem hardware.
Reported-by: Graham Inggs <graham.inggs@uct.ac.za>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Sergei Shtylyov [Wed, 5 Jun 2013 19:54:01 +0000 (23:54 +0400)]
sh_eth: fix result of sh_eth_check_reset() on timeout
When the first loop in sh_eth_check_reset() runs to its end, 'cnt' is 0, so the
following check for 'cnt < 0' fails to catch the timeout. Fix the condition in
this check, so that the timeout is actually reported.
While at it, fix the grammar in the failure message...
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Sebastian Siewior [Wed, 5 Jun 2013 16:54:00 +0000 (18:54 +0200)]
net/ti davinci_mdio: don't hold a spin lock while calling pm_runtime
was playing with suspend and run into this:
|BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:891
|in_atomic(): 1, irqs_disabled(): 0, pid: 1963, name: bash
|6 locks held by bash/1963:
|CPU: 0 PID: 1963 Comm: bash Not tainted 3.10.0-rc4+ #50
|[<
c0014fdc>] (unwind_backtrace+0x0/0xf8) from [<
c0011da4>] (show_stack+0x10/0x14)
|[<
c0011da4>] (show_stack+0x10/0x14) from [<
c02e8680>] (__pm_runtime_idle+0xa4/0xac)
|[<
c02e8680>] (__pm_runtime_idle+0xa4/0xac) from [<
c0341158>] (davinci_mdio_suspend+0x6c/0x9c)
|[<
c0341158>] (davinci_mdio_suspend+0x6c/0x9c) from [<
c02e0628>] (platform_pm_suspend+0x2c/0x54)
|[<
c02e0628>] (platform_pm_suspend+0x2c/0x54) from [<
c02e52bc>] (dpm_run_callback.isra.3+0x2c/0x64)
|[<
c02e52bc>] (dpm_run_callback.isra.3+0x2c/0x64) from [<
c02e57e4>] (__device_suspend+0x100/0x22c)
|[<
c02e57e4>] (__device_suspend+0x100/0x22c) from [<
c02e67e8>] (dpm_suspend+0x68/0x230)
|[<
c02e67e8>] (dpm_suspend+0x68/0x230) from [<
c0072a20>] (suspend_devices_and_enter+0x68/0x350)
|[<
c0072a20>] (suspend_devices_and_enter+0x68/0x350) from [<
c0072f18>] (pm_suspend+0x210/0x24c)
|[<
c0072f18>] (pm_suspend+0x210/0x24c) from [<
c0071c74>] (state_store+0x6c/0xbc)
|[<
c0071c74>] (state_store+0x6c/0xbc) from [<
c02714dc>] (kobj_attr_store+0x14/0x20)
|[<
c02714dc>] (kobj_attr_store+0x14/0x20) from [<
c01341a0>] (sysfs_write_file+0x16c/0x19c)
|[<
c01341a0>] (sysfs_write_file+0x16c/0x19c) from [<
c00ddfe4>] (vfs_write+0xb4/0x190)
|[<
c00ddfe4>] (vfs_write+0xb4/0x190) from [<
c00de3a4>] (SyS_write+0x3c/0x70)
|[<
c00de3a4>] (SyS_write+0x3c/0x70) from [<
c000e2c0>] (ret_fast_syscall+0x0/0x48)
I don't see a reason why the pm_runtime call must be under the lock.
Further I don't understand why this is a spinlock and not mutex.
Cc: Mugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Mugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Nicolas Dichtel [Wed, 5 Jun 2013 13:30:55 +0000 (15:30 +0200)]
sock_diag: fix filter code sent to userspace
Filters need to be translated to real BPF code for userland, like SO_GETFILTER.
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jason Wang [Wed, 5 Jun 2013 08:44:57 +0000 (16:44 +0800)]
tuntap: fix a possible race between queue selection and changing queues
Complier may generate codes that re-read the tun->numqueues during
tun_select_queue(). This may be a race if vlan->numqueues were changed in the
same time and can lead unexpected result (e.g. very huge value).
We need prevent the compiler from generating such codes by adding an
ACCESS_ONCE() to make sure tun->numqueues were only read once.
Bug were introduced by commit
c8d68e6be1c3b242f1c598595830890b65cea64a
(tuntap: multiqueue support).
Reported-by: Michael S. Tsirkin <mst@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jason Wang [Wed, 5 Jun 2013 07:40:46 +0000 (15:40 +0800)]
vhost_net: clear msg.control for non-zerocopy case during tx
When we decide not use zero-copy, msg.control should be set to NULL otherwise
macvtap/tap may set zerocopy callbacks which may decrease the kref of ubufs
wrongly.
Bug were introduced by commit
cedb9bdce099206290a2bdd02ce47a7b253b6a84
(vhost-net: skip head management if no outstanding).
This solves the following warnings:
WARNING: at include/linux/kref.h:47 handle_tx+0x477/0x4b0 [vhost_net]()
Modules linked in: vhost_net macvtap macvlan tun nfsd exportfs bridge stp llc openvswitch kvm_amd kvm bnx2 megaraid_sas [last unloaded: tun]
CPU: 5 PID: 8670 Comm: vhost-8668 Not tainted 3.10.0-rc2+ #1566
Hardware name: Dell Inc. PowerEdge R715/00XHKG, BIOS 1.5.2 04/19/2011
ffffffffa0198323 ffff88007c9ebd08 ffffffff81796b73 ffff88007c9ebd48
ffffffff8103d66b 000000007b773e20 ffff8800779f0000 ffff8800779f43f0
ffff8800779f8418 000000000000015c 0000000000000062 ffff88007c9ebd58
Call Trace:
[<
ffffffff81796b73>] dump_stack+0x19/0x1e
[<
ffffffff8103d66b>] warn_slowpath_common+0x6b/0xa0
[<
ffffffff8103d6b5>] warn_slowpath_null+0x15/0x20
[<
ffffffffa0197627>] handle_tx+0x477/0x4b0 [vhost_net]
[<
ffffffffa0197690>] handle_tx_kick+0x10/0x20 [vhost_net]
[<
ffffffffa019541e>] vhost_worker+0xfe/0x1a0 [vhost_net]
[<
ffffffffa0195320>] ? vhost_attach_cgroups_work+0x30/0x30 [vhost_net]
[<
ffffffffa0195320>] ? vhost_attach_cgroups_work+0x30/0x30 [vhost_net]
[<
ffffffff81061f46>] kthread+0xc6/0xd0
[<
ffffffff81061e80>] ? kthread_freezable_should_stop+0x70/0x70
[<
ffffffff817a1aec>] ret_from_fork+0x7c/0xb0
[<
ffffffff81061e80>] ? kthread_freezable_should_stop+0x70/0x70
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Mon, 10 Jun 2013 20:30:33 +0000 (13:30 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/pablo/nf
Pablo Neira Ayuso says:
====================
The following patchset contains four fixes for Netfilter and one fix
for IPVS, they are:
* Fix data leak to user-space via getsockopt IP_VS_SO_GET_DESTS, from
Dan Carpenter.
* Fix xt_TCPMSS if no TCP MSS is specified in syn packets, to avoid the
violation of RFC879, from Phil Oester.
* Fix incomplete dump of objects via nfnetlink_acct and nfnetlink_cttimeout,
from myself.
* Fix missing HW protocol in packets passed to user-space via NFQUEUE,
from myself.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Dan Carpenter [Mon, 3 Jun 2013 09:00:49 +0000 (12:00 +0300)]
ipvs: info leak in __ip_vs_get_dest_entries()
The entry struct has a 2 byte hole after ->port and another 4 byte
hole after ->stats.outpkts. You must have CAP_NET_ADMIN in your
namespace to hit this information leak.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Eric Dumazet [Sun, 2 Jun 2013 11:15:55 +0000 (11:15 +0000)]
net_sched: qdisc_get_rtab() must check data[] array
qdisc_get_rtab() should check not only the keys in struct tc_ratespec,
but also the full data[] array.
"tc ... linklayer atm " only perturbs values in the 256 slots array.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pablo Neira Ayuso [Fri, 7 Jun 2013 16:42:00 +0000 (18:42 +0200)]
netfilter: nfnetlink_queue: fix missing HW protocol
Locally generated IPv4 and IPv6 traffic gets skb->protocol unset,
thus passing zero.
ip6tables -I OUTPUT -j NFQUEUE
libmnl/examples/netfilter# ./nf-queue 0 &
ping6 ::1
packet received (id=1 hw=0x0000 hook=3)
^^^^^^
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Linus Torvalds [Fri, 7 Jun 2013 01:09:05 +0000 (18:09 -0700)]
Merge git://git./linux/kernel/git/davem/net
Pull networking fix from David Miller:
"This is a quick one commit pull request to cure the regression
introduced by the MSG_CMSG_COMPAT change."
(Background: commit
1be374a0518a completely broke 32-bit COMPAT handling
by not only disallowing MSG_CMSG_COMPAT from user APIs, but clearing it
in our own internal use too!)
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
net: Unbreak compat_sys_{send,recv}msg
Linus Torvalds [Thu, 6 Jun 2013 23:34:11 +0000 (16:34 -0700)]
Merge tag 'staging-3.10-rc4' of git://git./linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg Kroah-Hartman:
"Here are some staging and IIO driver fixes for the 3.10-rc5 release.
All of them are tiny, and fix a number of reported issues (build and
runtime)"
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* tag 'staging-3.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
iio:inkern: Fix typo/bug in convert raw to processed.
iio: frequency: ad4350: Fix bug / typo in mask
inkern: iio_device_put after incorrect return/goto
staging: alarm-dev: information leak in alarm_compat_ioctl()
iio:callback buffer: free the scan_mask
staging: alarm-dev: information leak in alarm_ioctl()
drivers: staging: zcache: fix compile error
staging: dwc2: fix value of dma_mask
Linus Torvalds [Thu, 6 Jun 2013 23:33:35 +0000 (16:33 -0700)]
Merge tag 'tty-3.10-rc4' of git://git./linux/kernel/git/gregkh/tty
Pull tty/serial driver fixes from Greg Kroah-Hartman:
"Here are some small bugfixes, and one revert, of serial driver issues
that have been reported"
* tag 'tty-3.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
Revert "serial: 8250: Make SERIAL_8250_RUNTIME_UARTS work correctly"
serial: samsung: enable clock before clearing pending interrupts during init
serial/imx: disable hardware flow control at startup
Linus Torvalds [Thu, 6 Jun 2013 23:29:17 +0000 (16:29 -0700)]
Merge tag 'usb-3.10-rc4' of git://git./linux/kernel/git/gregkh/usb
Pull USB fixes from Greg Kroah-Hartman:
"Here are a number of USB bugfixes and new device ids for the 3.10-rc5
tree.
Nothing major here, a number of new device ids (and movement from the
option to the zte_ev driver of a number of ids that we had previously
gotten wrong, some xhci bugfixes, some usb-serial driver fixes that
were recently found, some host controller fixes / reverts, and a
variety of smaller other things"
* tag 'usb-3.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (29 commits)
USB: option,zte_ev: move most ZTE CDMA devices to zte_ev
USB: option: blacklist network interface on Huawei E1820
USB: whiteheat: fix broken port configuration
USB: serial: fix TIOCMIWAIT return value
USB: mos7720: fix hardware flow control
USB: keyspan: remove unused endpoint-array access
USB: keyspan: fix bogus array index
USB: zte_ev: fix broken open
USB: serial: Add Option GTM681W to qcserial device table.
USB: Serial: cypress_M8: Enable FRWD Dongle hidcom device
USB: EHCI: fix regression related to qh_refresh()
usbfs: Increase arbitrary limit for USB 3 isopkt length
USB: zte_ev: fix control-message timeouts
USB: mos7720: fix message timeouts
USB: iuu_phoenix: fix bulk-message timeout
USB: ark3116: fix control-message timeout
USB: mos7840: fix DMA to stack
USB: mos7720: fix DMA to stack
USB: visor: fix initialisation of Treo/Kyocera devices
USB: serial: fix Treo/Kyocera interrrupt-in urb context
...
Linus Torvalds [Thu, 6 Jun 2013 23:28:15 +0000 (16:28 -0700)]
Merge tag 'pci-v3.10-fixes-3' of git://git./linux/kernel/git/helgaas/pci
Pull PCI fixes from Bjorn Helgaas:
"This fixes a crash when booting a 32-bit kernel via the EFI boot stub.
PCI ROM from EFI
x86/PCI: Map PCI setup data with ioremap() so it can be in highmem"
* tag 'pci-v3.10-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
x86/PCI: Map PCI setup data with ioremap() so it can be in highmem
Linus Torvalds [Thu, 6 Jun 2013 23:15:25 +0000 (16:15 -0700)]
Merge tag 'for-linus-v3.10-rc5' of git://oss.sgi.com/xfs/xfs
Pull more xfs updates from Ben Myers:
"Here are several fixes for filesystems with CRC support turned on:
fixes for quota, remote attributes, and recovery. There is also some
feature work related to CRCs: the implementation of CRCs for the inode
unlinked lists, disabling noattr2/attr2 options when appropriate, and
bumping the maximum number of ACLs.
I would have preferred to defer this last category of items to 3.11.
This would require setting a feature bit for the on-disk changes, so
there is some pressure to get these in 3.10. I believe this
represents the end of the CRC related queue.
- Rework of dquot CRCs
- Fix for remote attribute invalidation of a leaf
- Fix ordering of transaction replay in recovery
- Implement CRCs for inode unlinked list
- Disable noattr2/attr2 mount options when CRCs are enabled
- Bump the limitation of ACL entries for v5 superblocks"
* tag 'for-linus-v3.10-rc5' of git://oss.sgi.com/xfs/xfs:
xfs: increase number of ACL entries for V5 superblocks
xfs: disable noattr2/attr2 mount options for CRC enabled filesystems
xfs: inode unlinked list needs to recalculate the inode CRC
xfs: fix log recovery transaction item reordering
xfs: fix remote attribute invalidation for a leaf
xfs: rework dquot CRCs
Andy Lutomirski [Wed, 5 Jun 2013 19:38:26 +0000 (19:38 +0000)]
net: Unbreak compat_sys_{send,recv}msg
I broke them in this commit:
commit
1be374a0518a288147c6a7398792583200a67261
Author: Andy Lutomirski <luto@amacapital.net>
Date: Wed May 22 14:07:44 2013 -0700
net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg
This patch adds __sys_sendmsg and __sys_sendmsg as common helpers that accept
MSG_CMSG_COMPAT and blocks MSG_CMSG_COMPAT at the syscall entrypoints. It
also reverts some unnecessary checks in sys_socketcall.
Apparently I was suffering from underscore blindness the first time around.
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Tested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dan Williams [Wed, 5 Jun 2013 20:26:27 +0000 (15:26 -0500)]
USB: option,zte_ev: move most ZTE CDMA devices to zte_ev
Per some ZTE Linux drivers I found for the AC2716, the following patch
moves most ZTE CDMA devices from option to zte_ev. The blacklist stuff
that option does is not required with zte_ev, because it doesn't
implement any of the send_setup hooks which the blacklist suppressed.
I did not move the 2718 over because I could not find any ZTE Linux
drivers for that device, nor even any Windows drivers.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bjørn Mork [Thu, 6 Jun 2013 10:57:24 +0000 (12:57 +0200)]
USB: option: blacklist network interface on Huawei E1820
The mode used by Windows for the Huawei E1820 will use the
same ff/ff/ff class codes for both serial and network
functions.
Reported-by: Graham Inggs <graham.inggs@uct.ac.za>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan Hovold [Thu, 6 Jun 2013 11:32:47 +0000 (13:32 +0200)]
USB: whiteheat: fix broken port configuration
When configuring the port (e.g. set_termios) the port minor number
rather than the port number was used in the request (and they only
coincide for minor number 0).
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Dave Chinner [Wed, 5 Jun 2013 02:09:10 +0000 (12:09 +1000)]
xfs: increase number of ACL entries for V5 superblocks
The limit of 25 ACL entries is arbitrary, but baked into the on-disk
format. For version 5 superblocks, increase it to the maximum nuber
of ACLs that can fit into a single xattr.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Mark Tinguely <tinuguely@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
(cherry picked from commit
5c87d4bc1a86bd6e6754ac3d6e111d776ddcfe57)
Dave Chinner [Wed, 5 Jun 2013 02:09:09 +0000 (12:09 +1000)]
xfs: disable noattr2/attr2 mount options for CRC enabled filesystems
attr2 format is always enabled for v5 superblock filesystems, so the
mount options to enable or disable it need to be cause mount errors.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
(cherry picked from commit
d3eaace84e40bf946129e516dcbd617173c1cf14)
Dave Chinner [Wed, 5 Jun 2013 02:09:08 +0000 (12:09 +1000)]
xfs: inode unlinked list needs to recalculate the inode CRC
The inode unlinked list manipulations operate directly on the inode
buffer, and so bypass the inode CRC calculation mechanisms. Hence an
inode on the unlinked list has an invalid CRC. Fix this by
recalculating the CRC whenever we modify an unlinked list pointer in
an inode, ncluding during log recovery. This is trivial to do and
results in unlinked list operations always leaving a consistent
inode in the buffer.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
(cherry picked from commit
0a32c26e720a8b38971d0685976f4a7d63f9e2ef)
Dave Chinner [Wed, 5 Jun 2013 02:09:07 +0000 (12:09 +1000)]
xfs: fix log recovery transaction item reordering
There are several constraints that inode allocation and unlink
logging impose on log recovery. These all stem from the fact that
inode alloc/unlink are logged in buffers, but all other inode
changes are logged in inode items. Hence there are ordering
constraints that recovery must follow to ensure the correct result
occurs.
As it turns out, this ordering has been working mostly by chance
than good management. The existing code moves all buffers except
cancelled buffers to the head of the list, and everything else to
the tail of the list. The problem with this is that is interleaves
inode items with the buffer cancellation items, and hence whether
the inode item in an cancelled buffer gets replayed is essentially
left to chance.
Further, this ordering causes problems for log recovery when inode
CRCs are enabled. It typically replays the inode unlink buffer long before
it replays the inode core changes, and so the CRC recorded in an
unlink buffer is going to be invalid and hence any attempt to
validate the inode in the buffer is going to fail. Hence we really
need to enforce the ordering that the inode alloc/unlink code has
expected log recovery to have since inode chunk de-allocation was
introduced back in 2003...
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
(cherry picked from commit
a775ad778073d55744ed6709ccede36310638911)
Dave Chinner [Mon, 3 Jun 2013 05:28:49 +0000 (15:28 +1000)]
xfs: fix remote attribute invalidation for a leaf
When invalidating an attribute leaf block block, there might be
remote attributes that it points to. With the recent rework of the
remote attribute format, we have to make sure we calculate the
length of the attribute correctly. We aren't doing that in
xfs_attr3_leaf_inactive(), so fix it.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Mark Tinguely <tinuguely@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
(cherry picked from commit
59913f14dfe8eb772ff93eb442947451b4416329)
Dave Chinner [Mon, 3 Jun 2013 05:28:46 +0000 (15:28 +1000)]
xfs: rework dquot CRCs
Calculating dquot CRCs when the backing buffer is written back just
doesn't work reliably. There are several places which manipulate
dquots directly in the buffers, and they don't calculate CRCs
appropriately, nor do they always set the buffer up to calculate
CRCs appropriately.
Firstly, if we log a dquot buffer (e.g. during allocation) it gets
logged without valid CRC, and so on recovery we end up with a dquot
that is not valid.
Secondly, if we recover/repair a dquot, we don't have a verifier
attached to the buffer and hence CRCs are not calculated on the way
down to disk.
Thirdly, calculating the CRC after we've changed the contents means
that if we re-read the dquot from the buffer, we cannot verify the
contents of the dquot are valid, as the CRC is invalid.
So, to avoid all the dquot CRC errors that are being detected by the
read verifier, change to using the same model as for inodes. That
is, dquot CRCs are calculated and written to the backing buffer at
the time the dquot is flushed to the backing buffer. If we modify
the dquot directly in the backing buffer, calculate the CRC
immediately after the modification is complete. Hence the dquot in
the on-disk buffer should always have a valid CRC.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Ben Myers <bpm@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
(cherry picked from commit
6fcdc59de28817d1fbf1bd58cc01f4f3fac858fb)
Peter Zijlstra [Wed, 5 Jun 2013 10:26:50 +0000 (12:26 +0200)]
arch, mm: Remove tlb_fast_mode()
Since the introduction of preemptible mmu_gather TLB fast mode has been
broken. TLB fast mode relies on there being absolutely no concurrency;
it frees pages first and invalidates TLBs later.
However now we can get concurrency and stuff goes *bang*.
This patch removes all tlb_fast_mode() code; it was found the better
option vs trying to patch the hole by entangling tlb invalidation with
the scheduler.
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Tony Luck <tony.luck@intel.com>
Reported-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Thu, 6 Jun 2013 01:05:45 +0000 (10:05 +0900)]
Merge branch 'rc-fixes' of git://git./linux/kernel/git/mmarek/kbuild
Pull kbuild fixes from Michal Marek:
"There is one fix for a kbuild regression, plus three kconfig fixes for
bugs that have alway been there, but are simple enough to be fixed in
an -rc"
* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
kconfig/menu.c: fix multiple references to expressions in menu_add_prop()
mconf: handle keys in empty dialogs
kbuild: Don't assume dts files live in arch/*/boot/dts
scripts/config: fix assignment of parameters for short version of --*-after options
Matt Fleming [Wed, 5 Jun 2013 14:15:41 +0000 (15:15 +0100)]
x86/PCI: Map PCI setup data with ioremap() so it can be in highmem
f9a37be0f0 ("x86: Use PCI setup data") added support for using PCI ROM
images from setup_data. This used phys_to_virt(), which is not valid for
highmem addresses, and can cause a crash when booting a 32-bit kernel via
the EFI boot stub.
pcibios_add_device() assumes that the physical addresses stored in
setup_data are accessible via the direct kernel mapping, and that calling
phys_to_virt() is valid. This isn't guaranteed to be true on x86 where the
direct mapping range is much smaller than on x86-64.
Calling phys_to_virt() on a highmem address results in the following:
BUG: unable to handle kernel paging request at
39a3c198
IP: [<
c262be0f>] pcibios_add_device+0x2f/0x90
...
Call Trace:
[<
c2370c73>] pci_device_add+0xe3/0x130
[<
c274640b>] pci_scan_single_device+0x8b/0xb0
[<
c2370d08>] pci_scan_slot+0x48/0x100
[<
c2371904>] pci_scan_child_bus+0x24/0xc0
[<
c262a7b0>] pci_acpi_scan_root+0x2c0/0x490
[<
c23b7203>] acpi_pci_root_add+0x312/0x42f
...
The solution is to use ioremap() instead of phys_to_virt() to map the
setup data into the kernel address space.
[bhelgaas: changelog]
Tested-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Seth Forshee <seth.forshee@canonical.com>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: stable@vger.kernel.org # v3.8+
Johan Hovold [Wed, 5 Jun 2013 10:21:11 +0000 (12:21 +0200)]
USB: serial: fix TIOCMIWAIT return value
Fix regression introduced by commit
143d9d9616 ("USB: serial: add
tiocmiwait subdriver operation") which made the ioctl operation return
ENODEV rather than ENOIOCTLCMD when a subdriver TIOCMIWAIT
implementation is missing.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Phil Oester [Tue, 4 Jun 2013 05:09:27 +0000 (05:09 +0000)]
netfilter: xt_TCPMSS: Fix violation of RFC879 in absence of MSS option
The clamp-mss-to-pmtu option of the xt_TCPMSS target can cause issues
connecting to websites if there was no MSS option present in the
original SYN packet from the client. In these cases, it may add a
MSS higher than the default specified in RFC879. Fix this by never
setting a value > 536 if no MSS option was specified by the client.
This closes netfilter's bugzilla #662.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Pablo Neira Ayuso [Sat, 1 Jun 2013 13:36:02 +0000 (15:36 +0200)]
netfilter: nfnetlink_cttimeout: fix incomplete dumping of objects
Fix broken incomplete object dumping if the list of objects does not
fit into one single netlink message.
Reported-by: Gabriel Lazar <Gabriel.Lazar@com.utcluj.ro>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Pablo Neira Ayuso [Sat, 1 Jun 2013 13:31:40 +0000 (15:31 +0200)]
netfilter: nfnetlink_acct: fix incomplete dumping of objects
Fix broken incomplete object dumping if the list of objects does not
fit into one single netlink message.
Reported-by: Gabriel Lazar <Gabriel.Lazar@com.utcluj.ro>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Linus Torvalds [Wed, 5 Jun 2013 10:19:04 +0000 (19:19 +0900)]
Merge git://git./linux/kernel/git/davem/net
Pull networking fixes from David Miller:
1) Fix timeouts with direct mode authentication in mac80211, from
Stanislaw Gruszka.
2) Aggregation sessions can deadlock in ath9k, from Felix Fietkau.
3) Netfilter's xt_addrtype doesn't work with ipv6 due to route lookups
creating undesirable cache entries, from Florian Westphal.
4) Fix netfilter's ipt_ULOG from generating non-NULL terminated
strings.
5) Fix netdev transmit queue crashes in mac80211, from Johannes Berg.
6) Fix copy and paste error in 802.11 stack that broke reporting of
64-bit station tx statistics, from Felix Fietkau.
7) When qlge_probe fails, it leaks the netdev. Fix from Wei Yongjun.
8) SKB control block (where we store the IP options information,
amongst other things) must be cleared properly otherwise ICMP
sending can crash for IP tunnels. Fix from Eric Dumazet.
9) Verification of Energy Efficient Ether support was coded wrongly,
the test was inversed. Fix from Giuseppe CAVALLARO.
10) TCP handles redirects improperly because the wrong flow key is used
for the route lookup. From Michal Kubecek.
11) Don't interpret MSG_CMSG_COMPAT from userspace, fix from Andy
Lutomirski.
12) The new AF_VSOCK was missing from the lockdep string table, fix from
Federico Vaga.
13) be2net doesn't handle checksumming of IP fragments properly, from
Somnath Kotur.
14) Fix several bugs in the device address list code that lead to
crashes and other misbehaviors. From Jay Vosburgh.
15) Fix ipv6 segmentation handling of fragmented GRE tunnel traffic,
from Pravin B Shalr.
16) Fix usage of stale policies in IPSEC layer, from Paul Moore.
17) Fix team driver dump of ports when there are a large number of them,
from Jiri Pirko.
18) Fix softlockups in UDP ipv4 socket lookup causes by and error in the
hlist_nulls_for_each_entry_rcu() macro. From Eric Dumazet.
19) Fix several regressions added by the high rate accuracy changes to
the htb packet scheduler. From Eric Dumazet.
20) Fix DMA'ing onto the stack in esd_usb2 and peak_usb CAN drivers,
from Olivier Sobrie and Marc Kleine-Budde.
21) Fix unremovable network devices due to missing route pointer
installation in the per-device ipv6 address list entries. From Gao
feng.
22) Apply the tg3 5719 DMA workaround on 5720 chips as well, otherwise
we get stalls. From Nithin Sujir.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (68 commits)
net_sched: htb: do not mix 1ns and 64ns time units
net: fix sk_buff head without data area
tg3: Add read dma workaround for 5720
net: ethernet: xilinx_emaclite: set protocol selector bits when writing ANAR
bnx2x: Fix bridged GSO for 57710/57711 chips
net: fec: add fallback to random MAC address
bnx2x: fix TCP offload for tunneling ipv4 over ipv6
ipv6: assign rt6_info to inet6_ifaddr in init_loopback
net/mlx4_core: Keep VF assigned MAC in the PF admin table
net/mlx4_en: Handle unassigned VF MAC address correctly
net/mlx4_core: Return -EPROBE_DEFER when a VF is probed before PF is sufficiently initialized
net/mlx4_en: Fix adaptive moderation cq update
net: can: peak_usb: Do not do dma on the stack
net: can: esd_usb2: Do not do dma on the stack
net: can: kvaser_usb: fix reception on "USBcan Pro" and "USBcan R" type hardware.
net_sched: restore "overhead xxx" handling
net: force a reload of first item in hlist_nulls_for_each_entry_rcu
hyperv: Fix vlan_proto setting in netvsc_recv_callback()
team: fix port list dump for big number of ports
list: introduce list_first_entry_or_null
...
Eric Dumazet [Tue, 4 Jun 2013 07:11:48 +0000 (07:11 +0000)]
net_sched: htb: do not mix 1ns and 64ns time units
commit
56b765b79 ("htb: improved accuracy at high rates") added another
regression for low rates, because it mixes 1ns and 64ns time units.
So the maximum delay (mbuffer) was not 60 second, but 937 ms.
Lets convert all time fields to 1ns as 64bit arches are becoming the
norm.
Reported-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pablo Neira [Mon, 3 Jun 2013 09:28:43 +0000 (09:28 +0000)]
net: fix sk_buff head without data area
Eric Dumazet spotted that we have to check skb->head instead
of skb->data as skb->head points to the beginning of the
data area of the skbuff. Similarly, we have to initialize the
skb->head pointer, not skb->data in __alloc_skb_head.
After this fix, netlink crashes in the release path of the
sk_buff, so let's fix that as well.
This bug was introduced in (
0ebd0ac net: add function to
allocate sk_buff head without data area).
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Nithin Sujir [Mon, 3 Jun 2013 09:19:34 +0000 (09:19 +0000)]
tg3: Add read dma workaround for 5720
Commit
091f0ea30074bc43f9250961b3247af713024bc6 "tg3: Add New 5719 Read
DMA workaround" added a workaround for TX DMA stall on the 5719. This
workaround needs to be applied to the 5720 as well.
Cc: stable@vger.kernel.org
Reported-by: Roland Dreier <roland@purestorage.com>
Tested-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jens Renner \(EFE\) [Mon, 3 Jun 2013 04:32:52 +0000 (04:32 +0000)]
net: ethernet: xilinx_emaclite: set protocol selector bits when writing ANAR
This patch sets the protocol selector bits (4:0) of the PHY's MII_ADVERTISE
register (ANAR) when writing ADVERTISE_ALL. The protocol selector bits are
indicating IEEE 803.3u support and are fixed / read-only on some PHYs. Not
setting them correctly on others (like TI DP83630) makes the PHY fall back
to 10M HDX mode which should be avoided.
Tested for TI DP83630 PHY on Microblaze platform.
Signed-off-by: Jens Renner <renner@efe-gmbh.de>
Tested-by: Michal Simek <monstr@monstr.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Yuval Mintz [Mon, 3 Jun 2013 02:59:57 +0000 (02:59 +0000)]
bnx2x: Fix bridged GSO for 57710/57711 chips
It was recently found out that GSO on 57710/57711 was broken, due to packets
being sent without a valid IP checksum.
Commit
057cf65 "bnx2x: Fix GSO for 57710/57711 chips" partially fixed this
issue, but failed to set the correct IP checksum when receiving GSO packets
via bridges, as such packets enter bnx2x_tx_split() and the FW flags needed
to calculate IP checksum were erroneously set in the incorrect
buffer descriptor.
This patch re-enables GSO in said scenario for 57710/57711 chips.
Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com>
Signed-off-by: Ariel Elior <ariele@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Wed, 5 Jun 2013 00:13:06 +0000 (09:13 +0900)]
Merge tag 'mmc-fixes-for-3.10-rc5' of git://git./linux/kernel/git/cjb/mmc
Pull MMC fixes from Chris Ball:
- sdhci-acpi: Fix initial runtime PM status, add more ACPI IDs
- atmel-mci, omap_hsmmc: DT handling fixes
- esdhc-imx: Fix SDIO IRQs, fix multiblock reads (both h/w errata)
* tag 'mmc-fixes-for-3.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc:
mmc: omap_hsmmc: Skip platform_get_resource_byname() for dt case
mmc: omap_hsmmc: convert to dma_request_slave_channel_compat
mmc: omap_hsmmc: Fix the DT pbias workaround for MMC controllers 2 to 5
mmc: sdhci-pci: add more device ids
mmc: sdhci-acpi: add more device ids
mmc: sdhci-acpi: fix initial runtime pm status
mmc: atmel-mci: convert to dma_request_slave_channel_compat()
mmc: sdhci-esdhc-imx: fix multiblock reads on i.MX53
mmc: sdhci-esdhc-imx: Fix SDIO interrupts
Linus Torvalds [Wed, 5 Jun 2013 00:11:06 +0000 (09:11 +0900)]
Merge branch 'for-linus' of git://git./linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
"Just a 2 small driver fixups here"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: wacom - fix a typo for Cintiq 22HDT
Input: synaptics - fix sync lost after resume on some laptops
Linus Torvalds [Wed, 5 Jun 2013 00:09:35 +0000 (09:09 +0900)]
Merge branch 'fixes' of git://git./virt/kvm/kvm
Pull kvm bugfixes from Gleb Natapov:
"The bulk of the fixes is in MIPS KVM kernel<->userspace ABI. MIPS KVM
is new for 3.10 and some problems were found with current ABI. It is
better to fix them now and do not have a kernel with broken one"
* 'fixes' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: Fix race in apic->pending_events processing
KVM: fix sil/dil/bpl/spl in the mod/rm fields
KVM: Emulate multibyte NOP
ARM: KVM: be more thorough when invalidating TLBs
ARM: KVM: prevent NULL pointer dereferences with KVM VCPU ioctl
mips/kvm: Use ENOIOCTLCMD to indicate unimplemented ioctls.
mips/kvm: Fix ABI by moving manipulation of CP0 registers to KVM_{G,S}ET_ONE_REG
mips/kvm: Use ARRAY_SIZE() instead of hardcoded constants in kvm_arch_vcpu_ioctl_{s,g}et_regs
mips/kvm: Fix name of gpr field in struct kvm_regs.
mips/kvm: Fix ABI for use of 64-bit registers.
mips/kvm: Fix ABI for use of FPU.
Linus Torvalds [Wed, 5 Jun 2013 00:06:28 +0000 (09:06 +0900)]
Merge git://git./linux/kernel/git/steve/gfs2-3.0-fixes
Pull gfs2 fixes from Steven Whitehouse:
"There are four patches this time.
The first fixes a problem where the wrong descriptor type was being
written into the log for journaled data blocks.
The second fixes a race relating to the deallocation of allocator
data.
The third provides a fallback if kmalloc is unable to satisfy a
request to allocate a directory hash table.
The fourth fixes the iopen glock caching so that inodes are deleted in
a more timely manner after rmdir/unlink"
* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-fixes:
GFS2: Don't cache iopen glocks
GFS2: Fall back to vmalloc if kmalloc fails for dir hash tables
GFS2: Increase i_writecount during gfs2_setattr_size
GFS2: Set log descriptor type for jdata blocks
Linus Torvalds [Wed, 5 Jun 2013 00:03:31 +0000 (09:03 +0900)]
Merge branch 'for-linus' of git://git./linux/kernel/git/mszeredi/fuse
Pull fuse fixes from Miklos Szeredi:
"One patch fixes an Oops introduced in 3.9 with the readdirplus
feature. The rest are fixes for async-dio in 3.10"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
fuse: fix alignment in short read optimization for async_dio
fuse: return -EIOCBQUEUED from fuse_direct_IO() for all async requests
fuse: fix readdirplus Oops in fuse_dentry_revalidate
fuse: update inode size and invalidate attributes on fallocate
fuse: truncate pagecache range on hole punch
fuse: allocate for_background dio requests based on io->async state
Linus Torvalds [Wed, 5 Jun 2013 00:02:09 +0000 (09:02 +0900)]
Merge branch 'next' of git://git.monstr.eu/linux-2.6-microblaze
Pull microblaze fixes from Michal Simek:
"One is fixing warning reported by sparse and the second warning was
reported by Geert in his build regressions/improvements status update
for -rc4."
* 'next' of git://git.monstr.eu/linux-2.6-microblaze:
microblaze: Use static inline functions in cacheflush.h
microblaze: Fix sparse warnings
Lucas Stach [Mon, 3 Jun 2013 00:38:39 +0000 (00:38 +0000)]
net: fec: add fallback to random MAC address
If no valid MAC address could be obtained from the hardware,
fall back to a randomly generated one.
Signed-off-by: Pavel Machek <pavel@denx.de>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dmitry Kravkov [Sun, 2 Jun 2013 23:28:41 +0000 (23:28 +0000)]
bnx2x: fix TCP offload for tunneling ipv4 over ipv6
FW was initialized with data from wrong header, this caused TSO packets
have wrong IP csum.
Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: Ariel Elior <ariele@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Gao feng [Sun, 2 Jun 2013 22:16:21 +0000 (22:16 +0000)]
ipv6: assign rt6_info to inet6_ifaddr in init_loopback
Commit
25fb6ca4ed9cad72f14f61629b68dc03c0d9713f
"net IPv6 : Fix broken IPv6 routing table after loopback down-up"
forgot to assign rt6_info to the inet6_ifaddr.
When disable the net device, the rt6_info which allocated
in init_loopback will not be destroied in __ipv6_ifa_notify.
This will trigger the waring message below
[23527.916091] unregister_netdevice: waiting for tap0 to become free. Usage count = 1
Reported-by: Arkadiusz Miskiewicz <a.miskiewicz@gmail.com>
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 4 Jun 2013 21:30:12 +0000 (14:30 -0700)]
Merge branch 'fixes-for-3.10' of git://gitorious.org/linux-can/linux-can
Marc Kleine-Budde says:
====================
here are there fixes for the v3.10 release cycle:
The first patch by Jonas Peterson and Olivier Sobrie fixes the reception of CAN
frames on Kvaser's "USBcan Pro" and "USBcan R" type hardware.
The last two patches by Olivier Sobrie (for esd_usb2) and me (for peak_usb)
change the memory handling for the USB messages from stack to kmalloc(), as
memory used for DMA should not be allocated on stack.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Or Gerlitz [Tue, 4 Jun 2013 05:13:29 +0000 (05:13 +0000)]
net/mlx4_core: Keep VF assigned MAC in the PF admin table
MAC addresses assigned by the PF to VFs were not kept in the PF driver
admin table. As a result, displaying the VF MACs from the PF interface
to user space showed zero address where in fact the VF got non-zero
address from the PF, fix that.
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Or Gerlitz [Tue, 4 Jun 2013 05:13:28 +0000 (05:13 +0000)]
net/mlx4_en: Handle unassigned VF MAC address correctly
When a VF sense they didn't get MAC address, use random one. This will
address the case of administrator not assigning MAC to the VF through
the PF OS APIs and keep udev happy.
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jack Morgenstein [Tue, 4 Jun 2013 05:13:27 +0000 (05:13 +0000)]
net/mlx4_core: Return -EPROBE_DEFER when a VF is probed before PF is sufficiently initialized
In the PF initialization, SRIOV is enabled before the PF is fully initialized.
This allows the kernel to probe the newly-exposed VFs before the PF is ready
to handle them (nested probes).
Have the probe method return the -EPROBE_DEFER value in this situation (instead
of the VF probe method retrying its initialization in a loop, and returning -EIO
on failure). When -EPROBE_DEFER is returned by the VF probe method, the kernel
itself will retry the probe after a suitable delay.
Based upon a suggestion by Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Sagi Grimberg [Tue, 4 Jun 2013 05:13:26 +0000 (05:13 +0000)]
net/mlx4_en: Fix adaptive moderation cq update
When turning on adaptive_rx under adaptive moderation, the CQ's moderation
count wasn't updated according to rx_frames which resulted in too many
interrupts and bandwidth drop.
Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Amir Vadai <amirv@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Greg Kroah-Hartman [Tue, 4 Jun 2013 19:30:11 +0000 (12:30 -0700)]
Merge tag 'iio-fixes-for-3.10b' of git://git./linux/kernel/git/jic23/iio into staging-linus
Jonathan writes:
Second round of IIO fixes for the 3.10 cycle.
A couple of little bits and pieces, some delayed due to traveling.
1) A memory leak fix in the callback buffer.
2) Wrong exit path due to a return when it should have been a goto.
3) Bug in a mask value in ad4350
4) Reading the wrong value in raw to processed utility function.
Michael Hennerich [Mon, 3 Jun 2013 08:04:00 +0000 (09:04 +0100)]
iio:inkern: Fix typo/bug in convert raw to processed.
Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Michael Hennerich [Mon, 3 Jun 2013 13:30:00 +0000 (14:30 +0100)]
iio: frequency: ad4350: Fix bug / typo in mask
Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Joe Perches [Tue, 4 Jun 2013 14:44:00 +0000 (15:44 +0100)]
inkern: iio_device_put after incorrect return/goto
The code uses
return foo;
goto err_type;
when instead the form should have been
ret = foo;
goto err_type;
Here this causes a useful iio_device_put to be skipped.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Dan Carpenter [Tue, 4 Jun 2013 13:13:25 +0000 (16:13 +0300)]
staging: alarm-dev: information leak in alarm_compat_ioctl()
If we pass an invalid clock type then "ts" is never set. We need to
check for errors earlier, otherwise we end up passing uninitialized
stack data to userspace.
Reported-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jonathan Cameron [Wed, 22 May 2013 21:41:00 +0000 (22:41 +0100)]
iio:callback buffer: free the scan_mask
Reported-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Johan Hovold [Tue, 4 Jun 2013 16:50:31 +0000 (18:50 +0200)]
USB: mos7720: fix hardware flow control
The register access to enable hardware flow control depends on the
device port number and not the port minor number.
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan Hovold [Tue, 4 Jun 2013 16:50:30 +0000 (18:50 +0200)]
USB: keyspan: remove unused endpoint-array access
Remove the no longer used endpoint-array access completely.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan Hovold [Tue, 4 Jun 2013 16:50:29 +0000 (18:50 +0200)]
USB: keyspan: fix bogus array index
The outcont_endpoints array was indexed using the port minor number
(which can be greater than the array size) rather than the device port
number.
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan Hovold [Tue, 4 Jun 2013 16:50:28 +0000 (18:50 +0200)]
USB: zte_ev: fix broken open
Remove bogus port-number check in open and close, which prevented this
driver from being used with a minor number different from zero.
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ping Cheng [Thu, 23 May 2013 17:22:33 +0000 (10:22 -0700)]
Input: wacom - fix a typo for Cintiq 22HDT
And make the lines easier to read.
Signed-off-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Eric Miao [Tue, 4 Jun 2013 16:30:55 +0000 (09:30 -0700)]
Input: synaptics - fix sync lost after resume on some laptops
In summary, the symptom is intermittent key events lost after resume
on some machines with synaptics touchpad (seems this is synaptics _only_),
and key events loss is due to serio port reconnect after psmouse sync lost.
Removing psmouse and inserting it back during the suspend/resume process
is able to work around the issue, so the difference between psmouse_connect()
and psmouse_reconnect() is the key to the root cause of this problem.
After comparing the two different paths, synaptics driver has its own
implementation of synaptics_reconnect(), and the missing psmouse_probe()
seems significant, the patch below added psmouse_probe() to the reconnect
process, and has been verified many times that the issue could not be reliably
reproduced.
There are two PS/2 commands in psmouse_probe():
1. PSMOUSE_CMD_GETID
2. PSMOUSE_CMD_RESET_DIS
Only the PSMOUSE_CMD_GETID seems to be significant. The
PSMOUSE_CMD_RESET_DIS is irrelevant to this issue after trying
several times. So we have only implemented this patch to issue
the PSMOUSE_CMD_GETID so far.
Tested-by: Daniel Manrique <daniel.manrique@canonical.com>
Signed-off-by: James M Leddy <james.leddy@canonical.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Linus Torvalds [Mon, 3 Jun 2013 21:34:51 +0000 (06:34 +0900)]
Merge tag 'regulator-v3.10-rc4' of git://git./linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"A few small fixes for v3.10, documentation things in the core and a
few driver bugs."
* tag 'regulator-v3.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: palmas: Fix "enable_reg" to point to the correct reg for SMPS10
regulator: palmas: Fix incorrect condition
regulator: core: Correct spelling mistake in comment
regulator: dbx500: Make local symbol static
regulator: Fix kernel-doc generation warnings.
Linus Torvalds [Mon, 3 Jun 2013 21:33:44 +0000 (06:33 +0900)]
Merge tag 'jfs-3.10-rc5' of git://github.com/kleikamp/linux-shaggy
Pull jfs bugfixes from David Kleikamp:
"A couple jfs bug fixes for 3.10-rc5"
* tag 'jfs-3.10-rc5' of git://github.com/kleikamp/linux-shaggy:
fs/jfs: Add check if journaling to disk has been disabled in lbmRead()
jfs: Several bugs in jfs_freeze() and jfs_unfreeze()
Dan Carpenter [Mon, 3 Jun 2013 09:02:31 +0000 (02:02 -0700)]
staging: alarm-dev: information leak in alarm_ioctl()
Smatch complains that if we pass an invalid clock type then "ts" is
never set. We need to check for errors earlier, otherwise we end up
passing uninitialized stack data to userspace.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Richard Weinberger [Fri, 24 May 2013 10:01:51 +0000 (12:01 +0200)]
USB: serial: Add Option GTM681W to qcserial device table.
The Option GTM681W uses a qualcomm chip and can be
served by the qcserial device driver.
Signed-off-by: Richard Weinberger <richard@nod.at>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Robert Butora [Fri, 31 May 2013 15:09:51 +0000 (18:09 +0300)]
USB: Serial: cypress_M8: Enable FRWD Dongle hidcom device
The patch adds a new HIDCOM device and does not affect other devices
driven by the cypress_M8 module. Changes are:
- add VendorID ProductID to device tables
- skip unstable speed check because FRWD uses 115200bps
- skip reset at probe which is an issue workaround for this
particular device.
Signed-off-by: Robert Butora <robert.butora.fi@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Kyle McMartin [Mon, 3 Jun 2013 13:38:26 +0000 (09:38 -0400)]
Revert "serial: 8250: Make SERIAL_8250_RUNTIME_UARTS work correctly"
This reverts commit
cfcec52e9781f08948c6eb98198d65c45be75a70.
This regresses a longstanding behaviour on X86 systems, which end up with
PCI serial ports moving between ttyS4 and ttyS0 when you bisect to opposite
sides of this commit, resulting in the need to constantly modify the console
setting in order to bisect across it.
Please revert, we can work on solving this for ARM platforms in a less
disruptive way.
Signed-off-by: Kyle McMartin <kyle@mcmartin.ca>
Cc: Karthik Manamcheri <karthik.manamcheri@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Chander Kashyap [Tue, 28 May 2013 13:02:07 +0000 (18:32 +0530)]
serial: samsung: enable clock before clearing pending interrupts during init
Ensure that the uart controller clock is enabled prior to writing to the
interrupt mask and pending registers in the s3c24xx_serial_init_port
function.
Signed-off-by: Chander Kashyap <chander.kashyap@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Lucas Stach [Thu, 30 May 2013 13:47:04 +0000 (15:47 +0200)]
serial/imx: disable hardware flow control at startup
We only want to enable hardware flow control if RTS/CTS pins
are connected.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bob Peterson [Wed, 29 May 2013 15:51:52 +0000 (11:51 -0400)]
GFS2: Don't cache iopen glocks
This patch makes GFS2 immediately reclaim/delete all iopen glocks
as soon as they're dequeued. This allows deleters to get an
EXclusive lock on iopen so files are deleted properly instead of
being set as unlinked.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
Bob Peterson [Thu, 30 May 2013 13:48:56 +0000 (09:48 -0400)]
GFS2: Fall back to vmalloc if kmalloc fails for dir hash tables
This version has one more correction: the vmalloc calls are replaced
by __vmalloc calls to preserve the GFP_NOFS flag.
When GFS2's directory management code allocates buffers for a
directory hash table, if it can't get the memory it needs, it
currently gives a bad return code. Rather than giving an error,
this patch allows it to use virtual memory rather than kernel
memory for the hash table. This should make it possible for
directories to function properly, even when kernel memory becomes
very fragmented.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
Bob Peterson [Tue, 28 May 2013 14:04:44 +0000 (10:04 -0400)]
GFS2: Increase i_writecount during gfs2_setattr_size
This patch calls get_write_access in a few functions. This
merely increases inode->i_writecount for the duration of the function.
That will ensure that any file closes won't delete the inode's
multi-block reservation while the function is running.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>