Commit Graph

386480 Commits

Author SHA1 Message Date
Raphael S. Carvalho 6beb8a23b5 kernel/auditfilter.c: fixing build warning
kernel/auditfilter.c:426: warning: this decimal constant is unsigned only in ISO C90

Signed-off-by: Raphael S. Carvalho <raphael.scarv@gmail.com>
Cc: Eric Paris <eparis@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-07-09 10:33:19 -07:00
Jeff Layton 79f6530cb5 audit: fix mq_open and mq_unlink to add the MQ root as a hidden parent audit_names record
The old audit PATH records for mq_open looked like this:

  type=PATH msg=audit(1366282323.982:869): item=1 name=(null) inode=6777
  dev=00:0c mode=041777 ouid=0 ogid=0 rdev=00:00
  obj=system_u:object_r:tmpfs_t:s15:c0.c1023
  type=PATH msg=audit(1366282323.982:869): item=0 name="test_mq" inode=26732
  dev=00:0c mode=0100700 ouid=0 ogid=0 rdev=00:00
  obj=staff_u:object_r:user_tmpfs_t:s15:c0.c1023

...with the audit related changes that went into 3.7, they now look like this:

  type=PATH msg=audit(1366282236.776:3606): item=2 name=(null) inode=66655
  dev=00:0c mode=0100700 ouid=0 ogid=0 rdev=00:00
  obj=staff_u:object_r:user_tmpfs_t:s15:c0.c1023
  type=PATH msg=audit(1366282236.776:3606): item=1 name=(null) inode=6926
  dev=00:0c mode=041777 ouid=0 ogid=0 rdev=00:00
  obj=system_u:object_r:tmpfs_t:s15:c0.c1023
  type=PATH msg=audit(1366282236.776:3606): item=0 name="test_mq"

Both of these look wrong to me.  As Steve Grubb pointed out:

 "What we need is 1 PATH record that identifies the MQ.  The other PATH
  records probably should not be there."

Fix it to record the mq root as a parent, and flag it such that it
should be hidden from view when the names are logged, since the root of
the mq filesystem isn't terribly interesting.  With this change, we get
a single PATH record that looks more like this:

  type=PATH msg=audit(1368021604.836:484): item=0 name="test_mq" inode=16914
  dev=00:0c mode=0100644 ouid=0 ogid=0 rdev=00:00
  obj=unconfined_u:object_r:user_tmpfs_t:s0

In order to do this, a new audit_inode_parent_hidden() function is
added.  If we do it this way, then we avoid having the existing callers
of audit_inode needing to do any sort of flag conversion if auditing is
inactive.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reported-by: Jiri Jaburek <jjaburek@redhat.com>
Cc: Steve Grubb <sgrubb@redhat.com>
Cc: Eric Paris <eparis@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-07-09 10:33:19 -07:00
Olof Johansson f9f0a7d0dc drivers/dma/iop-adma.c: fix new warnings
The recent "drivers/dma: remove unused support for MEMSET operations"
change has fallout from lack of build testing by the author.  This
fixes:

  drivers/dma/iop-adma.c:1020:13: warning: unused variable 'dma_addr' [-Wunused-variable]
  drivers/dma/iop-adma.c:1519:2: warning: format '%s' expects a matching 'char *' argument [-Wformat=]

Signed-off-by: Olof Johansson <olof@lixom.net>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-07-09 10:33:19 -07:00
James Hogan d903bca9bc metag: checksum.h: fix carry in csum_tcpudp_nofold
In csum_tcpudp_nofold, add 1 if the carry bit is set after adding the
destination IP address (32 bits) to the checksum (16 bits).

The lack of carry handling for this particular addition meant that a
destination address of *.*.255.255 (e.g. certain broadcasts) sometimes
resulted in an incorrect checksum. This bug has been present in the Meta
port since the code was written in the 2.4 days.

Reported-by: Marcin Nowakowski <Marcin.Nowakowski@pure.com>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
2013-07-09 11:09:17 +01:00
Steven Miao 150382a53d smp: refine bf561 smpboot code
release boot lock earlier to let coreb do setup and calibrate
set coreb online later after initialization ready
add BFIN_IPI_NONE IPI type
drop unnecesarry smp_mb() and using atomic type

Signed-off-by: Steven Miao <realmz6@gmail.com>
2013-07-09 15:50:38 +08:00
Steven Miao b700a3f304 bf609: stmmac: fix build after stmmac_mdio_bus_data changed
Signed-off-by: Steven Miao <realmz6@gmail.com>
2013-07-09 15:50:28 +08:00
Sonic Zhang 67c0b1b558 bf609: add cpu revision 0.1
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
2013-07-09 15:50:05 +08:00
Scott Jiang 5e50175bdc bf609: rename bfin6xx_spi to bfin_spi3
Signed-off-by: Scott Jiang <scott.jiang.linux@gmail.com>
Signed-off-by: Steven Miao <realmz6@gmail.com>
2013-07-09 15:47:54 +08:00
Sonic Zhang 259c9b1712 kgdb: blackfin: include irq_regs.h in kgdb.c
The function definition of get_irq_regs() is moved to asm header irq_regs.h.

Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
2013-07-09 15:47:22 +08:00
Eliezer Tamir cbf55001b2 net: rename low latency sockets functions to busy poll
Rename functions in include/net/ll_poll.h to busy wait.
Clarify documentation about expected power use increase.
Rename POLL_LL to POLL_BUSY_LOOP.
Add need_resched() testing to poll/select busy loops.

Note, that in select and poll can_busy_poll is dynamic and is
updated continuously to reflect the existence of supported
sockets with valid queue information.

Signed-off-by: Eliezer Tamir <eliezer.tamir@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-08 19:25:45 -07:00
Michael S. Tsirkin c893c8d763 MAINTAINERS: add tools/virtio/ under virtio
This should help make sure patches go to the correct list.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2013-07-09 10:47:54 +09:30
Michael S. Tsirkin 80390df8b2 tools/virtio: move module license stub to module.h
This fixes build for the vringh test:
[linux]$ make -C tools/virtio/
make: Entering directory `/home/mst/scm/linux/tools/virtio'
cc -g -O2 -Wall -I. -I ../../usr/include/ -Wno-pointer-sign
-fno-strict-overflow -fno-strict-aliasing -fno-common -MMD
-U_FORTIFY_SOURCE   -c -o vringh.o ../../drivers/vhost/vringh.c
../../drivers/vhost/vringh.c:1010:16: error: expected declaration
specifiers or ‘...’ before string constant

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2013-07-09 10:47:53 +09:30
Michael S. Tsirkin c5610a5d71 virtio: include asm/barrier explicitly
virtio_ring.h uses mb() and friends, make
it pull in asm/barrier.h itself, not rely
on other headers to do it.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2013-07-09 10:47:53 +09:30
Rusty Russell 62525a00b8 virtio: VIRTIO_F_ANY_LAYOUT feature
Also known as the "no really, I read the spec" bit.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2013-07-09 10:47:45 +09:30
Dave Airlie 774d8e34e4 Merge branch 'drm-next-3.11' of git://people.freedesktop.org/~agd5f/linux into drm-next
A few more DPM fixes based on user testing.

* 'drm-next-3.11' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon/dpm: implement vblank_too_short callback for si
  drm/radeon/dpm: implement vblank_too_short callback for cayman
  drm/radeon/dpm: implement vblank_too_short callback for btc
  drm/radeon/dpm: implement vblank_too_short callback for evergreen
  drm/radeon/dpm: implement vblank_too_short callback for 7xx
  drm/radeon/dpm: add checks against vblank time
  drm/radeon/dpm: add helper to calculate vblank time
  drm/radeon: remove stray line in old pm code
  drm/radeon/dpm: fix display_gap programming on rv7xx
  drm/radeon/dpm: implement force performance level for TN
  drm/radeon/dpm: implement force performance level for ON/LN
  drm/radeon/dpm: implement force performance level for SI
  drm/radeon/dpm: implement force performance level for cayman
  drm/radeon/dpm: implement force performance levels for 7xx/eg/btc
  drm/radeon/dpm: add infrastructure to force performance levels
  drm/radeon: fix surface setup on r1xx
  drm/radeon: add support for 3d perf states on older asics
  drm/radeon: set default clocks for SI when DPM is disabled
2013-07-09 10:49:39 +10:00
Dave Airlie fd0932d7f8 Merge branch 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-next
Two minor fixes for regressions.

* 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
  drm/nvc0/gr: fix gpc firmware regression
  drm/nouveau: fix minor thinko causing bo moves to not be async on kepler
2013-07-09 10:48:41 +10:00
Alex Deucher f4dec31861 drm/radeon/dpm: implement vblank_too_short callback for si
Check if we can switch the mclk during the vblank time otherwise
we may get artifacts on the screen when the mclk changes.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-08 17:41:11 -04:00
Alex Deucher 76ad73e549 drm/radeon/dpm: implement vblank_too_short callback for cayman
Check if we can switch the mclk during the vblank time otherwise
we may get artifacts on the screen when the mclk changes.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-08 17:41:01 -04:00
Alex Deucher a84301c65d drm/radeon/dpm: implement vblank_too_short callback for btc
Check if we can switch the mclk during the vblank time otherwise
we may get artifacts on the screen when the mclk changes.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-08 17:40:52 -04:00
Alex Deucher d0b54bdc93 drm/radeon/dpm: implement vblank_too_short callback for evergreen
Check if we can switch the mclk during the vblank time otherwise
we may get artifacts on the screen when the mclk changes.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-08 17:40:42 -04:00
Alex Deucher b06195d994 drm/radeon/dpm: implement vblank_too_short callback for 7xx
Check if we can switch the mclk during the vblank time otherwise
we may get artifacts on the screen when the mclk changes.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-08 17:40:31 -04:00
Alex Deucher 4878306935 drm/radeon/dpm: add checks against vblank time
If the vblank time is too short to adjust mclk,
assume multiple displays (no mclk adjustments).

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-08 17:40:20 -04:00
Alex Deucher 66edc1c95d drm/radeon/dpm: add helper to calculate vblank time
Required for checking vblank time for mclk changes.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-08 17:40:09 -04:00
Alex Deucher 7e1f3c0419 drm/radeon: remove stray line in old pm code
Looks like a remnant from an old rebase.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-08 17:40:00 -04:00
Alex Deucher 222dc9a072 drm/radeon/dpm: fix display_gap programming on rv7xx
Check the driver state rather than the register as the
crtc registers may not be enabled yet.

Should fix:
https://bugzilla.kernel.org/show_bug.cgi?id=60510
https://bugs.freedesktop.org/show_bug.cgi?id=66651

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-08 17:39:51 -04:00
Luck, Tony 4484009847 [IA64] sim: Add casts to avoid assignment warnings
Pointers in the efi_runtime_services_t structure now have type
"void *" (formerly they were "unsigned long"). So we now see a
bunch of warnings like this:

arch/ia64/hp/sim/boot/fw-emu.c:293: warning: assignment makes pointer from integer without a cast

Add (void *) casts to the 10 affected lines to make the build quiet again.

Signed-off-by: Tony Luck <tony.luck@intel.com>
2013-07-08 10:46:50 -07:00
Jean Delvare 5b0620df9c hwmon: (lm63) Drop redundant safety on cache lifetime
time_after (as opposed to time_after_equal) already ensures that the
cache lifetime is at least as much as requested. There is no point in
manually adding another jiffy to that value, and this can confuse the
reader into wrong interpretation.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Imre Deak <imre.deak@intel.com>
2013-07-08 14:18:24 +02:00
Jean Delvare 78c2c2fe59 hwmon: (lm90) Drop redundant safety on cache lifetime
time_after (as opposed to time_after_equal) already ensures that the
cache lifetime is at least as much as requested. There is no point in
manually adding another jiffy to that value, and this can confuse the
reader into wrong interpretation.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Imre Deak <imre.deak@intel.com>
2013-07-08 14:18:24 +02:00
Wei Yongjun 4fbeb19d53 ncpfs: fix error return code in ncp_parse_options()
Fix to return -EINVAL from the option parse error handling
case instead of 0, as done elsewhere in this function.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-07-08 13:36:43 +04:00
Jeff Layton 7012b02a2b locks: move file_lock_list to a set of percpu hlist_heads and convert file_lock_lock to an lglock
The file_lock_list is only used for /proc/locks. The vastly common case
is for locks to be put onto the list and come off again, without ever
being traversed.

Help optimize for this use-case by moving to percpu hlist_head-s. At the
same time, we can make the locking less contentious by moving to an
lglock. When iterating over the lists for /proc/locks, we must take the
global lock and then iterate over each CPU's list in turn.

This change necessitates a new fl_link_cpu field to keep track of which
CPU the entry is on. On x86_64 at least, this field is placed within an
existing hole in the struct to avoid growing the size.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Acked-by: J. Bruce Fields <bfields@fieldses.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-07-08 13:36:42 +04:00
Jeff Layton 0bc77381c1 seq_file: add seq_list_*_percpu helpers
When we convert the file_lock_list to a set of percpu lists, we'll need
a way to iterate over them in order to output /proc/locks info. Add
some seq_list_*_percpu helpers to handle that.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Acked-by: J. Bruce Fields <bfields@fieldses.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-07-08 13:36:41 +04:00
Jaegeuk Kim 99b072bb38 f2fs: fix readdir incorrectness
In the previous Al Viro's readdir patch set, there occurs a bug when
running
xfstest: 006 as follows.

[Error output]
alpha size = 4, name length = 6, total files = 4096, nproc=1
1023 files created
rm: cannot remove `/mnt/f2fs/permname.15150/a': Directory not empty

[Correct output]
alpha size = 4, name length = 6, total files = 4096, nproc=1
4097 files created

This bug is due to the misupdate of directory position in ctx.
So, this patch fixes this.

[AV: fixed a braino]

CC: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-07-08 13:35:48 +04:00
Markus Pargmann 1b6c79361b video: imxfb: Add DT support
Add devicetree support for imx framebuffer driver. It uses the generic
display bindings and helper functions.

Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Acked-by: Sascha Hauer <s.hauer@pengutronix.de>
2013-07-08 16:36:49 +08:00
Maarten Lankhorst d2989b534e drm/nvc0/gr: fix gpc firmware regression
"drm/nve0-/gr: some new gpc registers can have multiple copies"
5ee86c4190 caused a regression for nvc0, because the bit indicating last
transfer has occured was no longer set, resulting in random system lockups.

Reported-by: Ronald Uitermark <ronald645@gmail.com>
Tested-by: Ronald Uitermark <ronald645@gmail.com>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-08 10:52:07 +10:00
Ben Skeggs 1bb3f6a252 drm/nouveau: fix minor thinko causing bo moves to not be async on kepler
Reported-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-08 10:52:02 +10:00
Linus Torvalds d2b4a64671 Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma
Pull slave-dmaengine updates from Vinod Koul:
 "Once you have some time from extended weekend celebrations please
  consider pulling the following to get:
   - Various fixes and PCI driver for dw_dmac by Andy
   - DT binding for imx-dma by Markus & imx-sdma by Shawn
   - DT fixes for dmaengine by Lars
   - jz4740 dmac driver by Lars
   - and various fixes across the drivers"

What "extended weekend celebrations"?  I'm in the merge window, who has
time for extended celebrations..

* 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma: (40 commits)
  DMA: shdma: add DT support
  DMA: shdma: shdma_chan_filter() has to be in shdma-base.h
  DMA: shdma: (cosmetic) don't re-calculate a pointer
  dmaengine: at_hdmac: prepare clk before calling enable
  dmaengine/trivial: at_hdmac: add curly brackets to if/else expressions
  dmaengine: at_hdmac: remove unsuded atc_cleanup_descriptors()
  dmaengine: at_hdmac: add FIFO configuration parameter to DMA DT binding
  ARM: at91: dt: add header to define at_hdmac configuration
  MIPS: jz4740: Correct clock gate bit for DMA controller
  MIPS: jz4740: Remove custom DMA API
  MIPS: jz4740: Register jz4740 DMA device
  dma: Add a jz4740 dmaengine driver
  MIPS: jz4740: Acquire and enable DMA controller clock
  dma: mmp_tdma: disable irq when disabling dma channel
  dmaengine: PL08x: Avoid collisions with get_signal() macro
  dmaengine: dw: select DW_DMAC_BIG_ENDIAN_IO automagically
  dma: dw: add PCI part of the driver
  dma: dw: split driver to library part and platform code
  dma: move dw_dmac driver to an own directory
  dw_dmac: don't check resource with devm_ioremap_resource
  ...
2013-07-07 11:11:43 -07:00
Linus Torvalds 8dce5f3dee Merge branch 'cpuinit-delete' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
Pull first stage of __cpuinit removal from Paul Gortmaker:
 "The two commits here 1) dummy out all the __cpuinit macros so that we
  no longer generate such sections, and then 2) remove all the section
  processing that we used to do for those sections.

  This makes all the __cpuinit and friends no-ops, so that we can remove
  the use cases of it at our leisure.  Expect stage 2, which does the
  tree wide removal sweep at the end of the merge window."

* 'cpuinit-delete' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux:
  modpost: remove all traces of cpuinit/cpuexit sections
  init.h: remove __cpuinit sections from the kernel
2013-07-07 11:01:19 -07:00
Michael S. Tsirkin 09a34c8404 vhost/test: update test after vhost cleanups
We changed the type of dev.vqs field, update test
module accordingly.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2013-07-07 18:02:25 +03:00
Asias He 0a1febf7ba vhost: Make local function static
$ make C=1 M=drivers/vhost

drivers/vhost/net.c:168:5: warning: symbol 'vhost_net_set_ubuf_info' was not declared. Should it be static?
drivers/vhost/net.c:194:6: warning: symbol 'vhost_net_vq_reset' was not declared. Should it be static?
drivers/vhost/scsi.c:219:6: warning: symbol 'tcm_vhost_done_inflight' was not declared. Should it be static?

Signed-off-by: Asias He <asias@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2013-07-07 17:34:07 +03:00
Asias He 6ac1afbf61 vhost: Make vhost a separate module
Currently, vhost-net and vhost-scsi are sharing the vhost core code.
However, vhost-scsi shares the code by including the vhost.c file
directly.

Making vhost a separate module makes it is easier to share code with
other vhost devices.

Signed-off-by: Asias He <asias@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2013-07-07 17:33:44 +03:00
Asias He 3c63f66a0d vhost-scsi: Rename struct tcm_vhost_cmd *tv_cmd to *cmd
This way, we use cmd for struct tcm_vhost_cmd and evt for struct
tcm_vhost_cmd.

Signed-off-by: Asias He <asias@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2013-07-07 14:38:58 +03:00
Asias He 9871831283 vhost-scsi: Rename struct tcm_vhost_tpg *tv_tpg to *tpg
Signed-off-by: Asias He <asias@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2013-07-07 14:38:57 +03:00
Asias He 683bd967dd vhost-scsi: Make func indention more consistent
Signed-off-by: Asias He <asias@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2013-07-07 14:38:55 +03:00
Asias He c7289312fe vhost-scsi: Rename struct vhost_scsi *s to *vs
vs is used everywhere, make the naming more consistent.

Signed-off-by: Asias He <asias@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2013-07-07 14:38:53 +03:00
Asias He deeacef086 vhost-scsi: Remove unnecessary forward struct vhost_scsi declaration
It was needed when struct tcm_vhost_tpg is in tcm_vhost.h

Signed-off-by: Asias He <asias@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2013-07-07 14:38:50 +03:00
Asias He 6d5e6aa860 vhost: Simplify dev->vqs[i] access
Signed-off-by: Asias He <asias@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2013-07-07 14:38:26 +03:00
Michael S. Tsirkin c38e39c378 vhost-net: fix use-after-free in vhost_net_flush
vhost_net_ubuf_put_and_wait has a confusing name:
it will actually also free it's argument.
Thus since commit 1280c27f8e
    "vhost-net: flush outstanding DMAs on memory change"
vhost_net_flush tries to use the argument after passing it
to vhost_net_ubuf_put_and_wait, this results
in use after free.
To fix, don't free the argument in vhost_net_ubuf_put_and_wait,
add an new API for callers that want to free ubufs.

Acked-by: Asias He <asias@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2013-07-07 14:06:22 +03:00
Cong Wang c7e8e8a8f7 bridge: fix some kernel warning in multicast timer
Several people reported the warning: "kernel BUG at kernel/timer.c:729!"
and the stack trace is:

	#7 [ffff880214d25c10] mod_timer+501 at ffffffff8106d905
	#8 [ffff880214d25c50] br_multicast_del_pg.isra.20+261 at ffffffffa0731d25 [bridge]
	#9 [ffff880214d25c80] br_multicast_disable_port+88 at ffffffffa0732948 [bridge]
	#10 [ffff880214d25cb0] br_stp_disable_port+154 at ffffffffa072bcca [bridge]
	#11 [ffff880214d25ce8] br_device_event+520 at ffffffffa072a4e8 [bridge]
	#12 [ffff880214d25d18] notifier_call_chain+76 at ffffffff8164aafc
	#13 [ffff880214d25d50] raw_notifier_call_chain+22 at ffffffff810858f6
	#14 [ffff880214d25d60] call_netdevice_notifiers+45 at ffffffff81536aad
	#15 [ffff880214d25d80] dev_close_many+183 at ffffffff81536d17
	#16 [ffff880214d25dc0] rollback_registered_many+168 at ffffffff81537f68
	#17 [ffff880214d25de8] rollback_registered+49 at ffffffff81538101
	#18 [ffff880214d25e10] unregister_netdevice_queue+72 at ffffffff815390d8
	#19 [ffff880214d25e30] __tun_detach+272 at ffffffffa074c2f0 [tun]
	#20 [ffff880214d25e88] tun_chr_close+45 at ffffffffa074c4bd [tun]
	#21 [ffff880214d25ea8] __fput+225 at ffffffff8119b1f1
	#22 [ffff880214d25ef0] ____fput+14 at ffffffff8119b3fe
	#23 [ffff880214d25f00] task_work_run+159 at ffffffff8107cf7f
	#24 [ffff880214d25f30] do_notify_resume+97 at ffffffff810139e1
	#25 [ffff880214d25f50] int_signal+18 at ffffffff8164f292

this is due to I forgot to check if mp->timer is armed in
br_multicast_del_pg(). This bug is introduced by
commit 9f00b2e7cf (bridge: only expire the mdb entry
when query is received).

Same for __br_mdb_del().

Tested-by: poma <pomidorabelisima@gmail.com>
Reported-by: LiYonghua <809674045@qq.com>
Reported-by: Robert Hancock <hancockrwd@gmail.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Cong Wang <amwang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-06 18:12:47 -07:00
Linus Torvalds 21884a83b2 Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer core updates from Thomas Gleixner:
 "The timer changes contain:

   - posix timer code consolidation and fixes for odd corner cases

   - sched_clock implementation moved from ARM to core code to avoid
     duplication by other architectures

   - alarm timer updates

   - clocksource and clockevents unregistration facilities

   - clocksource/events support for new hardware

   - precise nanoseconds RTC readout (Xen feature)

   - generic support for Xen suspend/resume oddities

   - the usual lot of fixes and cleanups all over the place

  The parts which touch other areas (ARM/XEN) have been coordinated with
  the relevant maintainers.  Though this results in an handful of
  trivial to solve merge conflicts, which we preferred over nasty cross
  tree merge dependencies.

  The patches which have been committed in the last few days are bug
  fixes plus the posix timer lot.  The latter was in akpms queue and
  next for quite some time; they just got forgotten and Frederic
  collected them last minute."

* 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (59 commits)
  hrtimer: Remove unused variable
  hrtimers: Move SMP function call to thread context
  clocksource: Reselect clocksource when watchdog validated high-res capability
  posix-cpu-timers: don't account cpu timer after stopped thread runtime accounting
  posix_timers: fix racy timer delta caching on task exit
  posix-timers: correctly get dying task time sample in posix_cpu_timer_schedule()
  selftests: add basic posix timers selftests
  posix_cpu_timers: consolidate expired timers check
  posix_cpu_timers: consolidate timer list cleanups
  posix_cpu_timer: consolidate expiry time type
  tick: Sanitize broadcast control logic
  tick: Prevent uncontrolled switch to oneshot mode
  tick: Make oneshot broadcast robust vs. CPU offlining
  x86: xen: Sync the CMOS RTC as well as the Xen wallclock
  x86: xen: Sync the wallclock when the system time is set
  timekeeping: Indicate that clock was set in the pvclock gtod notifier
  timekeeping: Pass flags instead of multiple bools to timekeeping_update()
  xen: Remove clock_was_set() call in the resume path
  hrtimers: Support resuming with two or more CPUs online (but stopped)
  timer: Fix jiffies wrap behavior of round_jiffies_common()
  ...
2013-07-06 14:09:38 -07:00
Linus Torvalds 8b70a90cab Merge branch 'for-v3.11' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping
Pull ARM DMA mapping updates from Marek Szyprowski:
 "This contains important bugfixes and an update for IOMMU integration
  support for ARM architecture"

* 'for-v3.11' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping:
  ARM: dma: Drop __GFP_COMP for iommu dma memory allocations
  ARM: DMA-mapping: mark all !DMA_TO_DEVICE pages in unmapping as clean
  ARM: dma-mapping: NULLify dev->archdata.mapping pointer on detach
  ARM: dma-mapping: convert DMA direction into IOMMU protection attributes
  ARM: dma-mapping: Get pages if the cpu_addr is out of atomic_pool
2013-07-06 12:41:54 -07:00