a remote processor is shut down and, on certain circumstances,
can indirectly prevent it from being reloaded.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAABAgAGBQJPs2y2AAoJELLolMlTRIoMcl0P/0fPAjNlIeMbiWy5FqTgwkM6
QnujXPq0+fGRbO8ScjAVCVUmKewEbBtzA7h6b3XD4VUCMVIiWx2+hEhuYMNHduxj
CnqwNsukl/PmPLBQucghuITjGqgAAasuO7UvE4b12vn/ZD8y28f21sL4S0G5DIAv
GKLInkwMWwCjdNBa1CquVSl7t75TtEPByPuLa+3Cr+uhKP0zI+1TEyTzA6oSi+ub
aR56yZCS2HF4jiTNKb/+x/mSeaCOhUb7/d8173c9fKFFU8jF6LNc0uRByLSUg2Ze
2cU5UEhtxBhJ3fG2HuAMAvXJyFvriW+kYcUZeubgaHIWR/g+vNXYO4Q1Aoicve6V
Ulp4y5Nwv4xbU3BLOm1r3CFioTTSBOpqHY6x1NjyJUCRGel0XWWsNuLvm6nMTVql
GmzwKPH5nnyFI1piJRagLzPs1KbW6yBqwghiUkGagEfuHsjHPZ6RHMolVVSFhD5Z
wmvwO8nJ59bgjMndz1VAPkcvihYDG8kZ2GrsOE7i8wLUK7V1MuI0SH5364nti58F
dxetaqcOkARN4Alt+6mNgymOqybcueOUa9BhlosXyGRhHYfUnlQV1m+i5uT9P4pJ
558rJ4PHJDqC3KsRLgY8oK9QIGOAthR+naUSSSipIfuiXnDNCydXEApY+Q5PkgEm
+HBh+0lwlEWY2i+Ege3F
=wUSA
-----END PGP SIGNATURE-----
Merge tag 'rproc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc
Pull remoteproc fix from Ohad Ben-Cohen:
"Fix a nasty off-by-one remoteproc bug which leaks memory when a remote
processor is shut down and, on certain circumstances, can indirectly
prevent it from being reloaded."
* tag 'rproc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc:
remoteproc: fix off-by-one bug in __rproc_free_vrings
Pull networking tree from David Miller:
1) ptp_pch driver build broke during this merge window due to missing
slab.h header, fix from Geery Uytterhoeven.
2) If ipset passes in a bogus hash table size we crash because the size
is not validated properly. Compounding this, gcc-4.7 can miscompile
ipset such that even when the user specifies legitimate parameters
the tool passes in an out-of-range size to the kernel.
Fix from Jozsef Kadlecsik.
3) Users have reported that the netdev watchdog can trigger with pch_gbe
devices, and it turns out this is happening because of races in the
TX path of the driver leading to the transmitter hanging. Fix from
Eric Dumazet, reported and tested by Andy Cress.
4) Novatel USB551L devices match the generic class entries for the cdc
ethernet USB driver, but they don't work because they have generic
descriptors and thus need FLAG_WWAN to function properly.
Add the necessary ID table entry to fix this, from Dan Williams.
5) A recursive locking fix in the USBNET driver added a new problem, in
that packet list traversal is now racy and we can thus access
unlinked SKBs and crash.
Avoid this situation by adding some extra state tracking, from Ming
Lei.
6) The rtlwifi conversion to asynchronous firmware loading is racy, fix
by reordering the probe procedure. From Larry Finger.
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=43187
7) Fix regressions with bluetooth keyboards by notifying userland
properly when the security level changes, from Gustavo Padovan.
8) Bluetooth needs to make sure device connected events are emitted
before other kinds of events, otherwise userspace will think there is
no baseband link yet and therefore abort the sockets associated with
that connection.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
netfilter: ipset: fix hash size checking in kernel
ptp_pch: Add missing #include <linux/slab.h>
pch_gbe: fix transmit races
cdc_ether: add Novatel USB551L device IDs for FLAG_WWAN
usbnet: fix skb traversing races during unlink(v2)
Bluetooth: mgmt: Fix device_connected sending order
Bluetooth: notify userspace of security level change
rtlwifi: fix for race condition when firmware is cached
drivers/ptp/ptp_pch.c: In function 'pch_remove':
drivers/ptp/ptp_pch.c:576:2: error: implicit declaration of function 'kfree' [-Werror=implicit-function-declaration]
drivers/ptp/ptp_pch.c: In function 'pch_probe':
drivers/ptp/ptp_pch.c:587:2: error: implicit declaration of function 'kzalloc' [-Werror=implicit-function-declaration]
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
John Linville says:
Here are three more fixes that some of my developers are desperate to
see included in 3.4...
Johan Hedberg went to some length justifyng the inclusion of these two
Bluetooth fixes:
"The device_connected fix should be quite self-explanatory, but it's
actually a wider issue than just for keyboards. All profiles that do
incoming connection authorization (e.g. headsets) will break without it
with specific hardware. The reason it wasn't caught earlier is that it
only occurs with specific Bluetooth adapters.
As for the security level patch, this fixes L2CAP socket based security
level elevation during a connection. The HID profile needs this (for
keyboards) and it is the only way to achieve the security level
elevation when using the management interface to talk to the kernel
(hence the management enabling patch being the one that exposes this"
The rtlwifi fix addresses a regression related to firmware loading,
as described in kernel.org bug 43187. It basically just moves a hunk
of code to a more appropriate place.
Signed-off-by: David S. Miller <davem@davemloft.net>
Andy reported pch_gbe triggered "NETDEV WATCHDOG" errors.
May 11 11:06:09 kontron kernel: WARNING: at net/sched/sch_generic.c:261
dev_watchdog+0x1ec/0x200() (Not tainted)
May 11 11:06:09 kontron kernel: Hardware name: N/A
May 11 11:06:09 kontron kernel: NETDEV WATCHDOG: eth0 (pch_gbe):
transmit queue 0 timed out
It seems pch_gbe has a racy tx path (races with TX completion path)
Remove tx_queue_lock lock since it has no purpose, we must use tx_lock
instead.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andy Cress <andy.cress@us.kontron.com>
Tested-by: Andy Cress <andy.cress@us.kontron.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Needs to be tagged with FLAG_WWAN, which since it has generic
descriptors, won't happen if we don't override the generic
driver info.
Cc: Oliver Neukum <oliver@neukum.org>
Cc: stable@vger.kernel.org
Signed-off-by: Dan Williams <dcbw@redhat.com>
Acked-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit 4231d47e6fe69f061f96c98c30eaf9fb4c14b96d(net/usbnet: avoid
recursive locking in usbnet_stop()) fixes the recursive locking
problem by releasing the skb queue lock before unlink, but may
cause skb traversing races:
- after URB is unlinked and the queue lock is released,
the refered skb and skb->next may be moved to done queue,
even be released
- in skb_queue_walk_safe, the next skb is still obtained
by next pointer of the last skb
- so maybe trigger oops or other problems
This patch extends the usage of entry->state to describe 'start_unlink'
state, so always holding the queue(rx/tx) lock to change the state if
the referd skb is in rx or tx queue because we need to know if the
refered urb has been started unlinking in unlink_urbs.
The other part of this patch is based on Huajun's patch:
always traverse from head of the tx/rx queue to get skb which is
to be unlinked but not been started unlinking.
Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Cc: Oliver Neukum <oneukum@suse.de>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Pull media fixes from Mauro Carvalho Chehab:
"For a some fix patches for v3.4, including a regression fix at DVB core"
Fix up trivial conflicts in Documentation/feature-removal-schedule.txt
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
[media] gspca - sonixj: Fix a zero divide in isoc interrupt
[media] media: videobuf2-dma-contig: include header for exported symbols
[media] media: videobuf2-dma-contig: quiet sparse noise about plain integer as NULL pointer
[media] media: vb2-memops: Export vb2_get_vma symbol
[media] s5p-fimc: Correct memory allocation for VIDIOC_CREATE_BUFS
[media] s5p-fimc: Fix locking in subdev set_crop op
[media] dvb_frontend: fix a regression with DVB-S zig-zag
[media] fintek-cir: change || to &&
[media] V4L: Schedule V4L2_CID_HCENTER, V4L2_CID_VCENTER controls for removal
[media] rc: Postpone ISR registration
[media] marvell-cam: fix an ARM build error
[media] V4L: soc-camera: protect hosts during probing from overzealous user-space
Pull networking fixes from David Miller:
"The main purpose of this pull request is to fix up the erroneous
bonding patch I applied last round. I meant to apply v4 of the patch
from Jiri but I applied v3 by accident. Mea culpa.
Also, eagle eyed Dan Carpenter noticed that openvswitch has one of
those "X = alloc(); if (!Y)" mistakes, test the proper pointer
instead."
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
openvswitch: checking wrong variable in queue_userspace_packet()
bonding: Fix LACPDU rx_dropped commit.
In commit b0302ab, the rtlwifi family of drivers was converted to use
asynchronous firmware loading. Unfortumately, the implementation was
racy, and the ieee80211 routines could be started before rtl_init_core()
was called to setup the data.
This patch fixes the bug noted in https://bugzilla.kernel.org/show_bug.cgi?id=43187.
Reported-by: Joshua Roys <Joshua.Roys@gtri.gatech.edu>
Tested-by: Neptune Ning <frostyplanet@gmail.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org> [3.3]
Signed-off-by: John W. Linville <linville@tuxdriver.com>
3.4-rc introduced a regression when setting the LEDS. We do the right thing
but then return an error code.
Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=43144
Reported-by: Christian Casteyde
Signed-off-by: Alan Cox <alan@linux/intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Fix a nasty off-by-one bug in __rproc_free_vrings which
resulted in a memory leak and (for some platforms) failures
to reload the remote processor.
Signed-off-by: Subramaniam Chanderashekarapuram <subramaniam.ca@ti.com>
[ohad@wizery.com: reword commit log, stick with the for loop]
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
I applied the wrong version of Jiri's bonding fix in commit
13a8e0c8cd ("bonding: don't increase
rx_dropped after processing LACPDUs")
I applied v3, which introduces warnings I asked him to fix,
instead of v4 which properly takes care of those issues.
This inter-diffs such that the warnings are now gone.
Signed-off-by: David S. Miller <davem@davemloft.net>
- Fix a lock ordering deadlock in JFFS2
- Fix an oops in the dataflash driver, triggered by a dummy call to test
whether it has OTP functionality.
- Fix request_mem_region() failure on amsdelta NAND driver.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEABECAAYFAk+vekgACgkQdwG7hYl686N8bQCfdizsFrliKbDW20R/pO66NoAV
aloAn0ln+mwe3rIdNt8qKynW8e8dbudF
=R7XS
-----END PGP SIGNATURE-----
Merge tag 'for-linus-3.4-20120513' of git://git.infradead.org/linux-mtd
Pull three MTD fixes from David Woodhouse:
- Fix a lock ordering deadlock in JFFS2
- Fix an oops in the dataflash driver, triggered by a dummy call to test
whether it has OTP functionality.
- Fix request_mem_region() failure on amsdelta NAND driver.
* tag 'for-linus-3.4-20120513' of git://git.infradead.org/linux-mtd:
mtd: ams-delta: fix request_mem_region() failure
jffs2: Fix lock acquisition order bug in gc path
mtd: fix oops in dataflash driver
An OMAP bug fix, a set of PCH bug fixes, and one patch to fix up compile
warnings
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAABAgAGBQJPra+FAAoJEEFnBt12D9kBW3oQALDLW0bneFl+sysynzu9qOAu
Qy4BmQjNalPHoZ3PZ6Q5CevrTXJsDwFxkKAS+29melBrPaKpubTPMoqD9yaTjizU
yH2MClTLIfOXOQTDwYyILeCq5jcw7uRAyx73cHzAD/JBCTkUgv8HoLKCbhZN4wo5
s/KqZRCEpee8rLHhQa7DFUuJVH7L9zskO2ZwpxgMGOAkDH4aB7OHzlcndB6jST4f
dFkMva50pQ8iggCu9tX/zmGbPXWKroSswnrdZVBOEKIj3QJq6h2B9s0u64B4ergZ
W57xnCF6AmPWp8YvenMruQRLUUy3KQIMZV5d8fIjvYXpH9TQJE4PR9IWjt+PADqy
TVoVR4tjcdYWFJuYhskpvT5dq/x2AX9eyNsTgu9ob8HyUQgzbcTu9zczUF52SiyN
ohqjrbKmPINnUrLD1gUkUmUayWt5SOt+hu19rMijqKY/HWQn2rzK5mUIreZeG/Cb
aPY1acunbdaNTsIgmIBqLkfSl/ErCYcXwmkulBIZOyUitaMYnZyhbZmgTIeEebTY
2ffX658MTT9cWlHsZ4wfWDynJIpsvTHCVau/oQfurLSO2p6Jb/xA7k34v9mxfAaK
gESiK+8T8n0u9RetLSSk7uKNyTqRvDaWsbaB7As0mAd1r8ETAL98N2ZzBv5o+bmF
JH4g4IgKNdowY4EqA0Ms
=P8v+
-----END PGP SIGNATURE-----
Merge tag 'gpio-for-linus' of git://git.secretlab.ca/git/linux-2.6
Pull a few more GPIO bug fixes from Grant Likely:
"Oops, missed a couple. Here's an updated pull req for GPIO"
A set of PCH bug fixes, and one patch to fix up compile warnings
* tag 'gpio-for-linus' of git://git.secretlab.ca/git/linux-2.6:
gpio/exynos: Fix compiler warnings when non-exynos machines are selected
gpio: pch9: Use proper flow type handlers
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)
iQEcBAABAgAGBQJPri7CAAoJEDeqqVYsXL0MOMYH/2vxI1NTdIvjApKiI6oumOS2
FjGqiUTsLXIR3pKoeZp12FdltC4zTVjDI/JBAvXfXWGy8ooaBceFiIiHesIucFBY
tBtgogKoq1vHk/spNNU3vGtpLDaDm9vqK9LACkwyUtF7IKUJYvmXmTq5Av0P27lE
ay+rpzLBLzJPATZjS94PKeXMOG7iDt+Idyh8Dp15kPUh5/kcUR40dzBhPmAeLEfQ
abshdAuMzBb7Dzb4tMfi/1AgISVgem9+fbzX/BjSGa0ByXr9/6VMgIhSdum7xxTp
3X1G6DR3km0SM1Lc5RJbujiG2lwP/l1lua5OreimMz78M5AUyPYnwYzq9CqGKQ4=
=GDPf
-----END PGP SIGNATURE-----
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"This is a set of minor qla and virto fixes plus one major regression
fix (oops in all legacy host drivers)."
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
[SCSI] virtio_scsi: fix TMF use-after-free
[SCSI] fix oops in all legacy host adapters caused by 6f381fa
[SCSI] qla2xxx: Update version number to 8.04.00.03-k.
[SCSI] qla2xxx: Properly check for current state after the fabric-login request.
[SCSI] qla2xxx: Proper completion to scsi-ml for scsi status task_set_full and busy.
[SCSI] qla2xxx: Block flash access from application when device is initialized for ISP82xx.
[SCSI] qla2xxx: Fix reset time out as qla2xxx not ack to reset request.
Pull networking fixes from David S. Miller:
1) Since we do RCU lookups on ipv4 FIB entries, we have to test if the
entry is dead before returning it to our caller.
2) openvswitch locking and packet validation fixes from Ansis Atteka,
Jesse Gross, and Pravin B Shelar.
3) Fix PM resume locking in IGB driver, from Benjamin Poirier.
4) Fix VLAN header handling in vhost-net and macvtap, from Basil Gor.
5) Revert a bogus network namespace isolation change that was causing
regressions on S390 networking devices.
6) If bonding decides to process and handle a LACPDU frame, we
shouldn't bump the rx_dropped counter. From Jiri Bohac.
7) Fix mis-calculation of available TX space in r8169 driver when doing
TSO, which can lead to crashes and/or hung device. From Julien
Ducourthial.
8) SCTP does not validate cached routes properly in all cases, from
Nicolas Dichtel.
9) Link status interrupt needs to be handled in ks8851 driver, from
Stephen Boyd.
10) Use capable(), not cap_raised(), in connector/userns netlink code.
From Eric W. Biederman via Andrew Morton.
11) Fix pktgen OOPS on module unload, from Eric Dumazet.
12) iwlwifi under-estimates SKB truesizes, also from Eric Dumazet.
13) Cure division by zero in SFC driver, from Ben Hutchings.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits)
ks8851: Update link status during link change interrupt
macvtap: restore vlan header on user read
vhost-net: fix handle_rx buffer size
bonding: don't increase rx_dropped after processing LACPDUs
connector/userns: replace netlink uses of cap_raised() with capable()
sctp: check cached dst before using it
pktgen: fix crash at module unload
Revert "net: maintain namespace isolation between vlan and real device"
ehea: fix losing of NEQ events when one event occurred early
igb: fix rtnl race in PM resume path
ipv4: Do not use dead fib_info entries.
r8169: fix unsigned int wraparound with TSO
sfc: Fix division by zero when using one RX channel and no SR-IOV
openvswitch: Validation of IPv6 set port action uses IPv4 header
net: compare_ether_addr[_64bits]() has no ordering
cdc_ether: Ignore bogus union descriptor for RNDIS devices
bnx2x: bug fix when loading after SAN boot
e1000: Silence sparse warnings by correcting type
igb, ixgbe: netdev_tx_reset_queue incorrectly called from tx init path
openvswitch: Release rtnl_lock if ovs_vport_cmd_build_info() failed.
...
Fix a couple of serious memory leaks in device-mapper thin provisioning
and tidy its MODULE_DESCRIPTION.
Mitigate occasional reported hangs associated with multipath scsi_dh
module loading.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAABAgAGBQJPrbVzAAoJEK2W1qbAHj1ndO4QAKYKAtAhAOEQ7+26RTz/7vEn
1Rp7D+1f8PBK3/CkbFhOjknGyRO6MGuWOrP6y2WkHcYR/wq1FKxqtOmut5bIwVuf
s3jyZ+sg07ev8tgj1s4PKc7HPkWGNET+xHTAlpsjzIMSjSbUaOijgF/yOqMhgVuH
SucXgfZytDtCACl3GR0PVOe+1xtXRiCi7drzR66zA5/2bIACr/NITfvtfHyQUT6v
Js8Rm6uTmSjvX4l4rBICz5szgXUFAF7Eqb3msWEovdQkgrt5bQVvLsQAybbmHTCn
v1hH8xE6FNYJil5e5wr2sG53FqiYLXcMFrRRSm6QUgV2FIGqCpkrF1SdPJHkXPGH
ndYtfblCEHbBGIFYpmpETlZ94k8Xi8RV6ah/+1am8MqP2nLZb02OSHAkhPziQnTS
qkthM/Mmo70dZESvBEsbWMpnannoiKOMHfAx5BUwah6BbRIdikNXj2j5Kziy6sl0
zQ0aOHdlVrYDH1oqc+pV7MUHmd9ftvkCQfswQUxaQz786IXeB5x/TxtVt+AOdmxa
cTsS/jC88b3sU7QZlx48Zkmwb8ryn4BqHF2rtwok8wYHyViS3OmhyrKL5X9mESro
hGSNM6qurko7q9VT+UthgeyVb42cHmxjbuouCoLadxYP7SSmeB7tkOk/vCB3Wx86
1egUWKacy75JTNEemywy
=jmbP
-----END PGP SIGNATURE-----
Merge tag 'dm-3.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm
Pull device-mapper fixes from Alasdair G Kergon:
"Fix a couple of serious memory leaks in device-mapper thin
provisioning and tidy its MODULE_DESCRIPTION.
Mitigate occasional reported hangs associated with multipath scsi_dh
module loading."
* tag 'dm-3.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm:
dm mpath: check if scsi_dh module already loaded before trying to load
dm thin: correct module description
dm thin: fix unprotected use of prepared_discards list
dm thin: reinstate missing mempool_free in cell_release_singleton
If the requested scsi_dh module is already loaded then skip
request_module().
Multipath table loads can hang in an unnecessary __request_module.
Reported-by: Ben Marzinski <bmarzins@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Fix two places in commit 104655fd4d ("dm thin: support discards") that
didn't use pool->lock to protect against concurrent changes to the
prepared_discards list.
Without this fix, thin_endio() can race with process_discard(), leading
to concurrent list_add()s that result in the processes locking up with
an error like the following:
WARNING: at lib/list_debug.c:32 __list_add+0x8f/0xa0()
...
list_add corruption. next->prev should be prev (ffff880323b96140), but was ffff8801d2c48440. (next=ffff8801d2c485c0).
...
Pid: 17205, comm: kworker/u:1 Tainted: G W O 3.4.0-rc3.snitm+ #1
Call Trace:
[<ffffffff8103ca1f>] warn_slowpath_common+0x7f/0xc0
[<ffffffff8103cb16>] warn_slowpath_fmt+0x46/0x50
[<ffffffffa04f6ce6>] ? bio_detain+0xc6/0x210 [dm_thin_pool]
[<ffffffff8124ff3f>] __list_add+0x8f/0xa0
[<ffffffffa04f70d2>] process_discard+0x2a2/0x2d0 [dm_thin_pool]
[<ffffffffa04f6a78>] ? remap_and_issue+0x38/0x50 [dm_thin_pool]
[<ffffffffa04f7c3b>] process_deferred_bios+0x7b/0x230 [dm_thin_pool]
[<ffffffffa04f7df0>] ? process_deferred_bios+0x230/0x230 [dm_thin_pool]
[<ffffffffa04f7e42>] do_worker+0x52/0x60 [dm_thin_pool]
[<ffffffff81056fa9>] process_one_work+0x129/0x450
[<ffffffff81059b9c>] worker_thread+0x17c/0x3c0
[<ffffffff81059a20>] ? manage_workers+0x120/0x120
[<ffffffff8105eabe>] kthread+0x9e/0xb0
[<ffffffff814ceda4>] kernel_thread_helper+0x4/0x10
[<ffffffff8105ea20>] ? kthread_freezable_should_stop+0x70/0x70
[<ffffffff814ceda0>] ? gs_change+0x13/0x13
---[ end trace 7e0a523bc5e52692 ]---
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Fix a significant memory leak inadvertently introduced during
simplification of cell_release_singleton() in commit
6f94a4c45a ("dm thin: fix stacked bi_next
usage").
A cell's hlist_del() must be accompanied by a mempool_free().
Use __cell_release() to do this, like before.
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Fixes the following compiler warnings:
drivers/gpio/gpio-samsung.c: In function ‘samsung_gpiolib_init’:
drivers/gpio/gpio-samsung.c:2980:1: warning: label ‘err_ioremap1’ defined but not used [-Wunused-label]
drivers/gpio/gpio-samsung.c:2978:1: warning: label ‘err_ioremap2’ defined but not used [-Wunused-label]
drivers/gpio/gpio-samsung.c:2976:1: warning: label ‘err_ioremap3’ defined but not used [-Wunused-label]
drivers/gpio/gpio-samsung.c:2974:1: warning: label ‘err_ioremap4’ defined but not used [-Wunused-label]
drivers/gpio/gpio-samsung.c:2722:55: warning: unused variable ‘gpio_base4’ [-Wunused-variable]
drivers/gpio/gpio-samsung.c:455:32: warning: ‘exynos_gpio_cfg’ defined but not used [-Wunused-variable]
drivers/gpio/gpio-samsung.c:2126:33: warning: ‘exynos4_gpios_1’ defined but not used [-Wunused-variable]
drivers/gpio/gpio-samsung.c:2228:33: warning: ‘exynos4_gpios_2’ defined but not used [-Wunused-variable]
drivers/gpio/gpio-samsung.c:2373:33: warning: ‘exynos4_gpios_3’ defined but not used [-Wunused-variable]
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Jean-Francois Dagenais reported:
Configuring a gpio pin with the gpio-pch driver with
"IRQF_TRIGGER_LOW | IRQF_ONESHOT" generates an interrupt storm for
threaded ISR until the ISR thread actually gets to physically clear
the interrupt on the triggering chip!! The immediate observable
symptom is the high CPU usage for my ISR thread task and the
interrupt count in /proc/interrupts incrementing radically.
The driver is wrong in several ways:
1) Using handle_simple_irq() does not provide proper flow control
handling. In the case of oneshot threaded handlers for the
demultiplexed interrupts this results in an interrupt storm because
the simple handler does not deal with masking/unmasking. Even
without threaded oneshot handlers an interrupt storm for level type
interrupts can easily be triggered when the interrupt is disabled
and the interrupt line is activated from the device.
2) Acknowlegding the demultiplexed interrupt before calling the
handler is wrong for level type interrupts.
3) The set_type function unconditionally enables the interrupt. It's
supposed to set the type and nothing else. The unmasking is done by
the core code.
Move the acknowledge code into a separate function and add it to the
demux irqchip callbacks.
Remove the unconditional enabling from the set_type() callback and set
the proper flow handlers depending on the selected type (level/edge).
Reported-and-tested-by: Jean-Francois Dagenais <jeff.dagenais@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Pull target fix from Nicholas Bellinger:
"This patch removes some incorrect legacy code to free se_lun_acl
memory in the NodeACL release path that could potentially trigger an
OOPS during shutdown once dynamic -> explicit initiator NodeACL
conversion has occurred.
That said, we've been able to trigger an OOPS in v4.0 code for this
special case when the associated MappedLUNs had not also been made
explicit based on active TPG LUN layout during the conversion, so it
really makes senses to go ahead and drop this extra cruft to avoid any
possible issues here.
This ends up only effecting iscsi-target module code (it's the only
user) and is CC'ed to stable."
* '3.4-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
target: Drop incorrect se_lun_acl release for dynamic -> explict ACL conversion
If a link change interrupt comes in we just clear the interrupt
and continue along without notifying the upper networking layers
that the link has changed. Use the mii_check_link() function to
update the link status whenever a link change interrupt occurs.
Cc: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ethernet vlan header is not on the packet and kept in the skb->vlan_tci
when it comes from lower dev. This patch inserts vlan header in user
buffer during skb copy on user read.
Signed-off-by: Basil Gor <basil.gor@gmail.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Take vlan header length into account, when vlan id is stored as
vlan_tci. Otherwise tagged packets coming from macvtap will be
truncated.
Signed-off-by: Basil Gor <basil.gor@gmail.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This patch removes some potentially problematic legacy code within
core_clear_initiator_node_from_tpg() that was originally intended to
release left over se_lun_acl setup during dynamic NodeACL+MappedLUN
generate when running with TPG demo-mode operation.
Since we now only ever expect to allocate and release se_lun_acl from
within target_core_fabric_configfs.c:target_fabric_make_mappedlun() and
target_fabric_drop_mappedlun() context respectively, this code for
demo-mode release is incorrect and needs to be removed.
Cc: Christoph Hellwig <hch@lst.de>
Cc: Andy Grover <agrover@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Since commit 3aba891d, bonding processes LACP frames (802.3ad
mode) with bond_handle_frame(). Currently a copy of the skb is
made and the original is left to be processed by other
rx_handlers and the rest of the network stack by returning
RX_HANDLER_ANOTHER. As there is no protocol handler for
PKT_TYPE_LACPDU, the frame is dropped and dev->rx_dropped
increased.
Fix this by making bond_handle_frame() return RX_HANDLER_CONSUMED
if bonding has processed the LACP frame.
Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
In 2009 Philip Reiser notied that a few users of netlink connector
interface needed a capability check and added the idiom
cap_raised(nsp->eff_cap, CAP_SYS_ADMIN) to a few of them, on the premise
that netlink was asynchronous.
In 2011 Patrick McHardy noticed we were being silly because netlink is
synchronous and removed eff_cap from the netlink_skb_params and changed
the idiom to cap_raised(current_cap(), CAP_SYS_ADMIN).
Looking at those spots with a fresh eye we should be calling
capable(CAP_SYS_ADMIN). The only reason I can see for not calling capable
is that it once appeared we were not in the same task as the caller which
would have made calling capable() impossible.
In the initial user_namespace the only difference between between
cap_raised(current_cap(), CAP_SYS_ADMIN) and capable(CAP_SYS_ADMIN) are a
few sanity checks and the fact that capable(CAP_SYS_ADMIN) sets
PF_SUPERPRIV if we use the capability.
Since we are going to be using root privilege setting PF_SUPERPRIV seems
the right thing to do.
The motivation for this that patch is that in a child user namespace
cap_raised(current_cap(),...) tests your capabilities with respect to that
child user namespace not capabilities in the initial user namespace and
thus will allow processes that should be unprivielged to use the kernel
services that are only protected with cap_raised(current_cap(),..).
To fix possible user_namespace issues and to just clean up the code
replace cap_raised(current_cap(), CAP_SYS_ADMIN) with
capable(CAP_SYS_ADMIN).
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Philipp Reisner <philipp.reisner@linbit.com>
Acked-by: Serge E. Hallyn <serge.hallyn@canonical.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Cc: Vasiliy Kulikov <segoon@openwall.com>
Cc: David Howells <dhowells@redhat.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This reverts commit 8a83a00b07.
It causes regressions for S390 devices, because it does an
unconditional DST drop on SKBs for vlans and the QETH device
needs the neighbour entry hung off the DST for certain things
on transmit.
Arnd can't remember exactly why he even needed this change.
Conflicts:
drivers/net/macvlan.c
net/8021q/vlan_dev.c
net/core/dev.c
Signed-off-by: David S. Miller <davem@davemloft.net>
The NEQ interrupt is only triggered when there was no previous pending
interrupt. If we request irq handling after an interrupt has occurred,
we will never get an interrupt until we call H_RESET_EVENTS.
Events seem to be cleared when we first register the NEQ. So, when we
requested irq handling right after registering it, a possible race with
an interrupt was much less likely. Now, there is a chance we may lose
this race and never get any events.
The fix here is to poll and acknowledge any events that might have
happened right after registering the irq handler.
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Since the caller (PM resume code) is not the one holding rtnl, when taking the
'else' branch rtnl may be released at any moment, thereby defeating the whole
purpose of this code block.
Signed-off-by: Benjamin Poirier <bpoirier@suse.de>
Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Merge PA-RISC compile fixes from Rolf Eike Beer:
"Since commit d66acc39c7 ("bitops: Optimise get_order()") getorder.h
includes log2.h which leads to an include loop on PA-RISC, bringing a
bunch of other breakage to light. This patchset fixes the compilation
of the current state of 3.4 on HPPA.
Unchanged against the first version, just added an Ack by Grant."
* emailed from Rolf Eike Beer <eike-kernel@sf-tec.de>: (5 patches)
parisc: move definition of PAGE0 to asm/page.h
parisc: add missing include of asm/page.h to asm/pgtable.h
parisc: drop include of asm/pdc.h from asm/hardware.h
parisc: add missing forward declarations in asm/hardware.h
parisc: add missing includes in asm/spinlock.h
This was defined in asm/pdc.h which needs to include asm/page.h for
__PAGE_OFFSET. This leads to an include loop so that page.h eventually will
include pdc.h again. While this is no problem because of header guards, it is
a problem because some symbols may be undefined. Such an error is this:
In file included from include/linux/bitops.h:35:0,
from include/asm-generic/getorder.h:7,
from arch/parisc/include/asm/page.h:162,
from arch/parisc/include/asm/pdc.h:346,
from arch/parisc/include/asm/processor.h:16,
from arch/parisc/include/asm/spinlock.h:6,
from arch/parisc/include/asm/atomic.h:20,
from include/linux/atomic.h:4,
from include/linux/sysfs.h:20,
from include/linux/kobject.h:21,
from include/linux/device.h:17,
from include/linux/eisa.h:5,
from arch/parisc/kernel/pci.c:11:
arch/parisc/include/asm/bitops.h: In function ‘set_bit’:
arch/parisc/include/asm/bitops.h:82:2: error: implicit declaration of function ‘_atomic_spin_lock_irqsave’ [-Werror=implicit-function-declaration]
arch/parisc/include/asm/bitops.h:84:2: error: implicit declaration of function ‘_atomic_spin_unlock_irqrestore’ [-Werror=implicit-function-declaration]
Signed-off-by: Rolf Eike Beer <eike-kernel@sf-tec.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
__devexit functions are discarded without CONFIG_HOTPLUG, so they need
to be referenced carefully. A __devexit function may also not be called
from a __devinit function.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Bryan Wu <bryan.wu@canonical.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Initialization of irqenable, irqstatus registers is the common
operation done in this function for all OMAP platforms, viz. OMAP1,
OMAP2+. The latter _gpio_rmw()'s which supposedly got introduced
wrongly to take care of OMAP2+ platforms were overwriting initially
programmed OMAP1 value breaking functionality on OMAP1.
Somehow incorrect assumption was made that each _gpio_rmw()'s were
mutually exclusive. On close observation it is found that the first
_gpio_rmw() which is supposedly done to take care of OMAP1 platform
is generic enough and takes care of OMAP2+ platform as well.
Therefore remove the latter _gpio_rmw() to irqenable as they are
redundant now.
Writing to ctrl and debounce_en registers for OMAP2+ platforms are
modified to match the original(pre-cleanup) code where the registers
are initialized with 0. In the cleanup series since we are using
_gpio_rmw(reg, 0, 1), instead of __raw_writel(), we are just reading
and writing the same values to ctrl and debounce_en. This is not an
issue for debounce_en register because it has 0x0 as the default value.
But in the case of ctrl register the default value is 0x2 (GATINGRATIO
= 0x1) so that we end up writing 0x2 instead of intended 0 value.
Therefore changing back to __raw_writel() as this is sufficient for
this case besides simpler to understand.
Also, change irqstatus initalization logic that avoids comparison
with bool, besides making it fit in a single line.
Cc: stable@vger.kernel.org
Cc: Tony Lindgren <tony@atomide.com>
Cc: Kevin Hilman <khilman@ti.com>
Cc: Santosh Shilimkar <santosh.shilimkar@ti.com>
Cc: Grant Likely <grant.likely@secretlab.ca>
Reported-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl>
Tested-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl>
Signed-off-by: Tarun Kanti DebBarma <tarun.kanti@ti.com>
Signed-off-by: Kevin Hilman <khilman@ti.com>
Fix a use-after-free in the TMF path, where cmd may have been already
freed by virtscsi_complete_free when wait_for_completion restarts
executing virtscsi_tmf. Technically a race, but in practice the command
will always be freed long before the completion waiter is awoken.
The fix is to make callers specifying a completion responsible for
freeing the command in all cases.
Signed-off-by: Hu Tao <hutao@cn.fujitsu.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Commit 6f381fa344
Author: Lin Ming <ming.m.lin@intel.com>
[SCSI] scsi_lib: use correct DMA device in __scsi_alloc_queue
Caused a regression where we oops in every legacy mode SCSI host driver
because they supply a NULL pointer to scsi_add_host(). Fix this by checking
for the NULL in scsi_add_host_with_dma() and changing the DMA device to being
the platform_bus in that case (which replicates the original behaviour).
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
In case of firmmware detected under-run condition and scsi status of
task_set_full or busy_condition, return that to the mid layer for proper error
handling instead of DID_ERROR (which causes error handler activation and a
full retry).
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
This is a last minute bug fix that was only just noticed since the code
path that's being exercised here is one that is fairly rarely used. The
changelog for the change itself is extremely clear and the code itself
is obvious to inspection so should be pretty safe.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAABAgAGBQJPqoQhAAoJEBus8iNuMP3dj1kP/0Z1yIk1ME0KzSy42/qbGKsp
+2mrAASkh7DbbWU2hSmwTpEgAAiY2ws0A/Uyj/Al4f/gJW6bZvlxK4mbf1i+P1LG
ab3ohhUOqexHVaIKMTnYKhnHWuzU25mnf2vW8IOr6jccu6h7X4orDmw1uEPVgsbs
P7fThQa0BPRkiLIUWGmg0oMY6IXJlzsStDK2Npw47EypY4FZCZucJgXkmYZLt0Nk
mhLPsznD5GqHNSmCqrUI3j/s3R0sd/Xc63pvznBU9D8RAbSRgi2vGL8UenEtIQgt
bVXOKe5H8ZzXYNYpzpGeJm3dTE2pZWmT1hfRSf0kBOkLhEpt/Oy9WBj1kfoTg9n9
fNH6OJYn12uG0qQomiAT96Qm3qrslF5y9S64ZyHT6BAkJT87wnEqTmaQkoAevDEr
hldzT+dTPAk2Pspge8m910+kQA72YyE1z6/PikvkEepYDFrqffZcBFWqjW8aQjGj
/5r7F5fLC7zJku0FjYUMRYDgYc9z0lk6tDt8QL7E7j+55ntrhYR8IuTQA7g2asal
yeQSTqa/NkJcch+aULgyOU0W9U1z2i04mdGI74iJnf3DSGGmvJ95IYLJA4tfnIOw
63xo2BhmHVGyRqTN5l7o5Zlgf5FdcUt+5EBLudSqqZynB/tMZNgb0PEzfIRFBuRq
GSIm5dwIqKgtymCEOUmp
=xcal
-----END PGP SIGNATURE-----
Merge tag 'regmap-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull last minute regman bug fix from Mark Brown:
"This is a last minute bug fix that was only just noticed since the
code path that's being exercised here is one that is fairly rarely
used. The changelog for the change itself is extremely clear and the
code itself is obvious to inspection so should be pretty safe."
* tag 'regmap-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: fix possible memory corruption in regmap_bulk_read()
The function regmap_bulk_read() calls the regmap_read() for
each register if set of register has volatile and cache is
enabled. In this case, last few register read makes the memory
corruption if the register size is not the size of unsigned int.
The regam_read() takes argument as unsigned int for returning
value and it update the value as
*val = map->format.parse_val(map->work_buf);
This causes complete 4 bytes (size of unsigned int) to get written.
Now if client pass the memory pointer for value which is equal to the
required size of register count in regmap_bulk_read() then last few
register read actually update the memory beyond passed pointer size.
Avoid this by using local variable for read and then do memcpy()
for actual byte copy to passed pointer based on register size.
I allocated one pointer ptr and take first 16 bytes dump of that
pointer then call regmap_bulk_read() with pointer which is just
on top of this allocated pointer and register count of 128. Here
register size is 1 byte.
The memory trace of last 5 register read are as follows:
[ 5.438589] regmap_bulk_read after regamp_read() for register 122
[ 5.447421] 0xef993c20 0xef993c00 0x00000000 0x00000001
[ 5.467535] regmap_bulk_read after regamp_read() for register 123
[ 5.476374] 0xef993c20 0xef993c00 0x00000000 0x00000001
[ 5.496425] regmap_bulk_read after regamp_read() for register 124
[ 5.505260] 0xef993c20 0xef993c00 0x00000000 0x00000001
[ 5.525372] regmap_bulk_read after regamp_read() for register 125
[ 5.534205] 0xef993c00 0xef993c00 0x00000000 0x00000001
[ 5.554258] regmap_bulk_read after regamp_read() for register 126
[ 5.563100] 0xef990000 0xef993c00 0x00000000 0x00000001
[ 5.554258] regmap_bulk_read after regamp_read() for register 127
[ 5.587108] 0xef000000 0xef993c00 0x00000000 0x00000001
Here it is observed that the memory content at first word started changing
on last 3 regmap_read() and so corruption happened.
Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Linus Torvalds