summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-07-29HID: hid-lg: Add USBID for Logitech G29 WheelSimon Wood2-0/+3
Since this wheel is now available, and the USBID is listed on their website, this patch adds it to allow the hid-lg4ff force feedback driver to find it. I do not have this wheel to test with, but this should at least get it working in emulation mode. Note: There is probably more work required for adjust HID descriptor and handle switching between emulation and native modes. Signed-off-by: Simon Wood <simon@mungewell.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2015-07-24Merge branch 'for-linus' of ↵Linus Torvalds5-2/+19
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: - kernel crash fixes for multitouch and wacom drivers, by Brent Adam and Dan Carpenter - cp2112 data packet race condition corruption fix, by Antonio Borneo - a few new device IDs for wacom and microsoft drivers * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: cp2112: fix to force single data-report reply HID: wacom: Enable pad device for older Bamboo Touch tablets HID: multitouch: Fix fields from pen report ID being interpreted for multitouch HID: microsoft: Add quirk for MS Surface Type/Touch cover HID: wacom: NULL dereferences on error in probe()
2015-07-24Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds13-34/+154
Pull drm fixes from Dave Airlie: "Aome amdgpu, one i915, one ttm and one hlcdc, nothing too scary. All seems fine for about this time" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/ttm: recognize ARM64 arch in ioprot handler drm/amdgpu/cz/dpm: properly report UVD and VCE clock levels drm/amdgpu/cz: implement voltage validation properly drm/amdgpu: add VCE harvesting instance query drm/amdgpu: implement VCE 3.0 harvesting support (v4) drm/amdgpu/dce10: Re-set VBLANK interrupt state when enabling a CRTC drm/amdgpu/dce11: Re-set VBLANK interrupt state when enabling a CRTC drm: Stop resetting connector state to unknown drm/i915: Use two 32bit reads for select 64bit REG_READ ioctls drm: atmel-hlcdc: fix vblank initial state
2015-07-24Merge branch 'stable' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile Pull arch/tile bugfix from Chris Metcalf: "This fixes a bug in freeing the initramfs memory" * 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: tile: use free_bootmem_late() for initrd
2015-07-24Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds6-15/+43
Pull KVM fixes from Paolo Bonzini: "Everything related to the new quirks and memory type features: - small improvements to the quirks API - extending one of the quirks from just AMD to Intel as well, because 4.2 can show the same problem with problematic firmware on Intel too" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: rename quirk constants to KVM_X86_QUIRK_* KVM: vmx: obey KVM_QUIRK_CD_NW_CLEARED KVM: x86: introduce kvm_check_has_quirk KVM: MTRR: simplify kvm_mtrr_get_guest_memory_type KVM: MTRR: fix memory type handling if MTRR is completely disabled
2015-07-24Merge tag 'drm-atmel-hlcdc/fixes-for-4.2' of ↵Dave Airlie2-6/+7
https://github.com/bbrezillon/linux-at91 into drm-fixes single hlcdc fix. * tag 'drm-atmel-hlcdc/fixes-for-4.2' of https://github.com/bbrezillon/linux-at91: drm: atmel-hlcdc: fix vblank initial state
2015-07-24Merge tag 'topic/drm-fixes-2015-07-23' of ↵Dave Airlie1-4/+1
git://anongit.freedesktop.org/drm-intel into drm-fixes Regression fix for systemd getting confused about unknown connector state after resume. Just stop setting the state to unknown, turned out to be a silly idea anyway. What drivers imo really should do (and i915 still does that) is forcing a full reprobe on resume to make sure connector changes while suspended are caught. Most drivers seem to get this wrong. Otoh it took us years to get fixes merged where some probe races resulted in eating uevents, I guess userspace expectations for reliable hpd are just really low :( * tag 'topic/drm-fixes-2015-07-23' of git://anongit.freedesktop.org/drm-intel: drm: Stop resetting connector state to unknown
2015-07-24Merge tag 'drm-intel-fixes-2015-07-23' of ↵Dave Airlie2-7/+27
git://anongit.freedesktop.org/drm-intel into drm-fixes arb_timer kernel side fix from Chris. * tag 'drm-intel-fixes-2015-07-23' of git://anongit.freedesktop.org/drm-intel: drm/i915: Use two 32bit reads for select 64bit REG_READ ioctls
2015-07-24Merge branch 'drm-fixes-4.2' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie7-16/+117
into drm-fixes Some amdgpu fixes. * 'drm-fixes-4.2' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu/cz/dpm: properly report UVD and VCE clock levels drm/amdgpu/cz: implement voltage validation properly drm/amdgpu: add VCE harvesting instance query drm/amdgpu: implement VCE 3.0 harvesting support (v4) drm/amdgpu/dce10: Re-set VBLANK interrupt state when enabling a CRTC drm/amdgpu/dce11: Re-set VBLANK interrupt state when enabling a CRTC
2015-07-24drm/ttm: recognize ARM64 arch in ioprot handlerAlexandre Courbot1-1/+2
Return proper pgprot for ARM64. This is required for objects like Nouveau fences to be mapped with expected coherency. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2015-07-23Merge branch 'for-linus' of ↵Linus Torvalds2-11/+33
git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull namespace fixes from Eric Biederman: "While reading through the code of detach_mounts I realized the code was slightly off. Testing it revealed two buggy corner cases that can send the code of detach_mounts into an infinite loop. Fixing the code to do the right thing removes the possibility of these user triggered infinite loops in the code" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: mnt: In detach_mounts detach the appropriate unmounted mount mnt: Clarify and correct the disconnect logic in umount_tree
2015-07-23Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhostLinus Torvalds11-20/+91
Pull virtio/vhost fixes from Michael Tsirkin: "Bugfixes and documentation fixes. Igor's patch that allows users to tweak memory table size is borderline, but it does fix known crashes, so I merged it" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost: add max_mem_regions module parameter vhost: extend memory regions allocation to vmalloc 9p/trans_virtio: reset virtio device on remove virtio/s390: rename drivers/s390/kvm -> drivers/s390/virtio MAINTAINERS: separate section for s390 virtio drivers virtio: define virtio_pci_cfg_cap in header. virtio: Fix typecast of pointer in vring_init() virtio scsi: fix unused variable warning vhost: use binary search instead of linear in find_region() virtio_net: document VIRTIO_NET_CTRL_GUEST_OFFLOADS
2015-07-23Merge tag 'iommu-fixes-v4.2-rc3' of ↵Linus Torvalds3-17/+55
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: "The fixes include: - a couple of fixes for the new ARM-SMMUv3 driver to fix issues found on the first real implementation of that hardware. - a patch for the Intel VT-d driver to fix a domain-id leak" * tag 'iommu-fixes-v4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Fix VM domain ID leak iommu/arm-smmu: Skip the execution of CMD_PREFETCH_CONFIG iommu/arm-smmu: Enlarge STRTAB_L1_SZ_SHIFT to support larger sidsize iommu/arm-smmu: Fix the values of ARM64_TCR_{I,O}RGN0_SHIFT iommu/arm-smmu: Fix LOG2SIZE setting for 2-level stream tables iommu/arm-smmu: Fix the index calculation of strtab
2015-07-23drm/amdgpu/cz/dpm: properly report UVD and VCE clock levelsAlex Deucher1-16/+45
VCE, UVD DPM work similarly to SCLK DPM. Report the current clock levels for UVD and VCE via debugfs. Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-07-23drm/amdgpu/cz: implement voltage validation properlyAlex Deucher1-7/+16
CZ uses a different set of registers compared to previous asics and supports separate NB and GFX planes. Reviewed-by: Jammy Zhou <Jammy.Zhou@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-07-23tile: use free_bootmem_late() for initrdChris Metcalf1-1/+1
We were previously using free_bootmem() and just getting lucky that nothing too bad happened. Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com> Cc: stable@vger.kernel.org
2015-07-23mnt: In detach_mounts detach the appropriate unmounted mountEric W. Biederman1-5/+2
The handling of in detach_mounts of unmounted but connected mounts is buggy and can lead to an infinite loop. Correct the handling of unmounted mounts in detach_mount. When the mountpoint of an unmounted but connected mount is connected to a dentry, and that dentry is deleted we need to disconnect that mount from the parent mount and the deleted dentry. Nothing changes for the unmounted and connected children. They can be safely ignored. Cc: stable@vger.kernel.org Fixes: ce07d891a0891d3c0d0c2d73d577490486b809e1 mnt: Honor MNT_LOCKED when detaching mounts Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2015-07-23drm/amdgpu: add VCE harvesting instance queryLeo Liu2-0/+3
Signed-off-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com>
2015-07-23drm/amdgpu: implement VCE 3.0 harvesting support (v4)Alex Deucher2-0/+52
For boards with bad VCE blocks, only configure the working block. v2: use the harvest info for pipe setup v3: fix mask check as noted by Leo v4: add dGPU support Reviewed-by: Christian König <christian.koenig@amd.com> (v2) Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-07-23drm/amdgpu/dce10: Re-set VBLANK interrupt state when enabling a CRTCMichel Dänzer1-0/+4
This doesn't seem strictly necessary with Tonga right now, but that might change with future power management enhancements. Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
2015-07-23drm/amdgpu/dce11: Re-set VBLANK interrupt state when enabling a CRTCMichel Dänzer1-0/+4
Something (ATOM BIOS?) seems to be clobbering the LB_INTERRUPT_MASK register while the CRTC is off, which caused e.g. glxgears or gnome-shell to hang after a modeset. Reviewed-and-Tested-by: Alex Deucher <alexander.deucher@amd.com> Tested-by: Sonny Jiang <sonny.jiang@amd.com> Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
2015-07-23iommu/vt-d: Fix VM domain ID leakAlex Williamson1-3/+6
This continues the attempt to fix commit fb170fb4c548 ("iommu/vt-d: Introduce helper functions to make code symmetric for readability"). The previous attempt in commit 71684406905f ("iommu/vt-d: Detach domain *only* from attached iommus") overlooked the fact that dmar_domain.iommu_bmp gets cleared for VM domains when devices are detached: intel_iommu_detach_device domain_remove_one_dev_info domain_detach_iommu The domain is detached from the iommu, but the iommu is still attached to the domain, for whatever reason. Thus when we get to domain_exit(), we can't rely on iommu_bmp for VM domains to find the active iommus, we must check them all. Without that, the corresponding bit in intel_iommu.domain_ids doesn't get cleared and repeated VM domain creation and destruction will run out of domain IDs. Meanwhile we still can't call iommu_detach_domain() on arbitrary non-VM domains or we risk clearing in-use domain IDs, as 71684406905f attempted to address. It's tempting to modify iommu_detach_domain() to test the domain iommu_bmp, but the call ordering from domain_remove_one_dev_info() prevents it being able to work as fb170fb4c548 seems to have intended. Caching of unused VM domains on the iommu object seems to be the root of the problem, but this code is far too fragile for that kind of rework to be proposed for stable, so we simply revert this chunk to its state prior to fb170fb4c548. Fixes: fb170fb4c548 ("iommu/vt-d: Introduce helper functions to make code symmetric for readability") Fixes: 71684406905f ("iommu/vt-d: Detach domain *only* from attached iommus") Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: Jiang Liu <jiang.liu@linux.intel.com> Cc: stable@vger.kernel.org # v3.17+ Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-07-23KVM: x86: rename quirk constants to KVM_X86_QUIRK_*Paolo Bonzini4-5/+5
Make them clearly architecture-dependent; the capability is valid for all architectures, but the argument is not. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-23KVM: vmx: obey KVM_QUIRK_CD_NW_CLEAREDXiao Guangrong1-1/+4
OVMF depends on WB to boot fast, because it only clears caches after it has set up MTRRs---which is too late. Let's do writeback if CR0.CD is set to make it happy, similar to what SVM is already doing. Signed-off-by: Xiao Guangrong <guangrong.xiao@intel.com> Tested-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-23KVM: x86: introduce kvm_check_has_quirkPaolo Bonzini3-2/+7
The logic of the disabled_quirks field usually results in a double negation. Wrap it in a simple function that checks the bit and negates it. Based on a patch from Xiao Guangrong. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-23KVM: MTRR: simplify kvm_mtrr_get_guest_memory_typeXiao Guangrong1-9/+10
kvm_mtrr_get_guest_memory_type never returns -1 which is implied in the current code since if @type = -1 (means no MTRR contains the range), iter.partial_map must be true Simplify the code to indicate this fact Signed-off-by: Xiao Guangrong <guangrong.xiao@intel.com> Tested-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-23KVM: MTRR: fix memory type handling if MTRR is completely disabledXiao Guangrong1-1/+20
Currently code uses default memory type if MTRR is fully disabled, fix it by using UC instead. Signed-off-by: Xiao Guangrong <guangrong.xiao@intel.com> Tested-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-23mnt: Clarify and correct the disconnect logic in umount_treeEric W. Biederman2-6/+31
rmdir mntpoint will result in an infinite loop when there is a mount locked on the mountpoint in another mount namespace. This is because the logic to test to see if a mount should be disconnected in umount_tree is buggy. Move the logic to decide if a mount should remain connected to it's mountpoint into it's own function disconnect_mount so that clarity of expression instead of terseness of expression becomes a virtue. When the conditions where it is invalid to leave a mount connected are first ruled out, the logic for deciding if a mount should be disconnected becomes much clearer and simpler. Fixes: e0c9c0afd2fc958ffa34b697972721d81df8a56f mnt: Update detach_mounts to leave mounts connected Fixes: ce07d891a0891d3c0d0c2d73d577490486b809e1 mnt: Honor MNT_LOCKED when detaching mounts Cc: stable@vger.kernel.org Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2015-07-23Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds79-811/+714
Pull networking fixes from David Miller: 1) Don't use shared bluetooth antenna in iwlwifi driver for management frames, from Emmanuel Grumbach. 2) Fix device ID check in ath9k driver, from Felix Fietkau. 3) Off by one in xen-netback BUG checks, from Dan Carpenter. 4) Fix IFLA_VF_PORT netlink attribute validation, from Daniel Borkmann. 5) Fix races in setting peeked bit flag in SKBs during datagram receive. If it's shared we have to clone it otherwise the value can easily be corrupted. Fix from Herbert Xu. 6) Revert fec clock handling change, causes regressions. From Fabio Estevam. 7) Fix use after free in fq_codel and sfq packet schedulers, from WANG Cong. 8) ipvlan bug fixes (memory leaks, missing rcu_dereference_bh, etc.) from WANG Cong and Konstantin Khlebnikov. 9) Memory leak in act_bpf packet action, from Alexei Starovoitov. 10) ARM bpf JIT bug fixes from Nicolas Schichan. 11) Fix backwards compat of ANY_LAYOUT in virtio_net driver, from Michael S Tsirkin. 12) Destruction of bond with different ARP header types not handled correctly, fix from Nikolay Aleksandrov. 13) Revert GRO receive support in ipv6 SIT tunnel driver, causes regressions because the GRO packets created cannot be processed properly on the GSO side if we forward the frame. From Herbert Xu. 14) TCCR update race and other fixes to ravb driver from Sergei Shtylyov. 15) Fix SKB leaks in caif_queue_rcv_skb(), from Eric Dumazet. 16) Fix panics on packet scheduler filter replace, from Daniel Borkmann. 17) Make sure AF_PACKET sees properly IP headers in defragmented frames (via PACKET_FANOUT_FLAG_DEFRAG option), from Edward Hyunkoo Jee. 18) AF_NETLINK cannot hold mutex in RCU callback, fix from Florian Westphal. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (84 commits) ravb: fix ring memory allocation net: phy: dp83867: Fix warning check for setting the internal delay openvswitch: allocate nr_node_ids flow_stats instead of num_possible_nodes netlink: don't hold mutex in rcu callback when releasing mmapd ring ARM: net: fix vlan access instructions in ARM JIT. ARM: net: handle negative offsets in BPF JIT. ARM: net: fix condition for load_order > 0 when translating load instructions. tcp: suppress a division by zero warning drivers: net: cpsw: remove tx event processing in rx napi poll inet: frags: fix defragmented packet's IP header for af_packet net: mvneta: fix refilling for Rx DMA buffers stmmac: fix setting of driver data in stmmac_dvr_probe sched: cls_flow: fix panic on filter replace sched: cls_flower: fix panic on filter replace sched: cls_bpf: fix panic on filter replace net/mdio: fix mdio_bus_match for c45 PHY net: ratelimit warnings about dst entry refcount underflow or overflow caif: fix leaks and race in caif_queue_rcv_skb() qmi_wwan: add the second QMI/network interface for Sierra Wireless MC7305/MC7355 ravb: fix race updating TCCR ...
2015-07-22Merge tag 'arm64-fixes' of ↵Linus Torvalds2-4/+5
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull ARM64 fixes from Catalin Marinas: - arm64 build fix following the move of the thread_struct to the end of task_struct and the asm offsets becoming too large for the AArch64 ISA - preparatory patch for moving irq_data struct members (applied now to reduce dependency for the next merging window) * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: ARM64/irq: Use access helper irq_data_get_affinity_mask() arm64: switch_to: calculate cpu context pointer using separate register
2015-07-22drm: Stop resetting connector state to unknownDaniel Vetter1-4/+1
It's causing piles of issues since we've stopped forcing full detect cycles in the sysfs interfaces with commit c484f02d0f02fbbfc6decc945a69aae011041a27 Author: Chris Wilson <chris@chris-wilson.co.uk> Date: Fri Mar 6 12:36:42 2015 +0000 drm: Lighten sysfs connector 'status' The original justification for this was that the hpd handlers could use the unknown state as a hint to force a full detection. But current i915 code isn't doing that any more, and no one else really uses reset on resume. So instead just keep the old state around. References: http://article.gmane.org/gmane.comp.freedesktop.xorg.drivers.intel/62584 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=100641 Cc: Rui Matos <tiagomatos@gmail.com> Cc: Julien Wajsberg <felash@gmail.com> Cc: kuddel.mail@gmx.de Cc: Lennart Poettering <mzxreary@0pointer.de> Cc: stable@vger.kernel.org Acked-by: Rob Clark <robdclark@gmail.com> Tested-by: Rui Tiago Cação Matos <tiagomatos@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
2015-07-22ARM64/irq: Use access helper irq_data_get_affinity_mask()Jiang Liu1-2/+2
This is a preparatory patch for moving irq_data struct members. Signed-off-by: Jiang Liu <jiang.liu@linux.intel.com> Reviewed-by: Hanjun Guo <hanjun.guo@linaro.org> Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2015-07-22arm64: switch_to: calculate cpu context pointer using separate registerWill Deacon1-2/+3
Commit 0c8c0f03e3a2 ("x86/fpu, sched: Dynamically allocate 'struct fpu'") moved the thread_struct to the bottom of task_struct. As a result, the offset is now too large to be used in an immediate add on arm64 with some kernel configs: arch/arm64/kernel/entry.S: Assembler messages: arch/arm64/kernel/entry.S:588: Error: immediate out of range arch/arm64/kernel/entry.S:597: Error: immediate out of range This patch calculates the offset using an additional register instead of an immediate offset. Fixes: 0c8c0f03e3a2 ("x86/fpu, sched: Dynamically allocate 'struct fpu'") Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: Olof Johansson <olof@lixom.net> Cc: Ingo Molnar <mingo@kernel.org> Signed-off-by: Will Deacon <will.deacon@arm.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2015-07-22ravb: fix ring memory allocationSergei Shtylyov1-25/+34
The driver is written as if it can adapt to a low memory situation allocating less RX skbs and TX aligned buffers than the respective RX/TX ring sizes. In reality though the driver would malfunction in this case. Stop being overly smart and just fail in such situation -- this is achieved by moving the memory allocation from ravb_ring_format() to ravb_ring_init(). We leave dma_map_single() calls in place but make their failure non-fatal by marking the corresponding RX descriptors with zero data size which should prevent DMA to an invalid addresses. Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-22net: phy: dp83867: Fix warning check for setting the internal delayDan Murphy1-1/+1
Fix warning: logical ‘or’ of collectively exhaustive tests is always true Change the internal delay check from an 'or' condition to an 'and' condition. Reported-by: David Binderman <dcb314@hotmail.com> Signed-off-by: Dan Murphy <dmurphy@ti.com> Acked-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-22openvswitch: allocate nr_node_ids flow_stats instead of num_possible_nodesChris J Arges1-1/+1
Some architectures like POWER can have a NUMA node_possible_map that contains sparse entries. This causes memory corruption with openvswitch since it allocates flow_cache with a multiple of num_possible_nodes() and assumes the node variable returned by for_each_node will index into flow->stats[node]. Use nr_node_ids to allocate a maximal sparse array instead of num_possible_nodes(). The crash was noticed after 3af229f2 was applied as it changed the node_possible_map to match node_online_map on boot. Fixes: 3af229f2071f5b5cb31664be6109561fbe19c861 Signed-off-by: Chris J Arges <chris.j.arges@canonical.com> Acked-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Nishanth Aravamudan <nacc@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-22netlink: don't hold mutex in rcu callback when releasing mmapd ringFlorian Westphal1-32/+47
Kirill A. Shutemov says: This simple test-case trigers few locking asserts in kernel: int main(int argc, char **argv) { unsigned int block_size = 16 * 4096; struct nl_mmap_req req = { .nm_block_size = block_size, .nm_block_nr = 64, .nm_frame_size = 16384, .nm_frame_nr = 64 * block_size / 16384, }; unsigned int ring_size; int fd; fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, &req, sizeof(req)) < 0) exit(1); if (setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, &req, sizeof(req)) < 0) exit(1); ring_size = req.nm_block_nr * req.nm_block_size; mmap(NULL, 2 * ring_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0); return 0; } +++ exited with 0 +++ BUG: sleeping function called from invalid context at /home/kas/git/public/linux-mm/kernel/locking/mutex.c:616 in_atomic(): 1, irqs_disabled(): 0, pid: 1, name: init 3 locks held by init/1: #0: (reboot_mutex){+.+...}, at: [<ffffffff81080959>] SyS_reboot+0xa9/0x220 #1: ((reboot_notifier_list).rwsem){.+.+..}, at: [<ffffffff8107f379>] __blocking_notifier_call_chain+0x39/0x70 #2: (rcu_callback){......}, at: [<ffffffff810d32e0>] rcu_do_batch.isra.49+0x160/0x10c0 Preemption disabled at:[<ffffffff8145365f>] __delay+0xf/0x20 CPU: 1 PID: 1 Comm: init Not tainted 4.1.0-00009-gbddf4c4818e0 #253 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Debian-1.8.2-1 04/01/2014 ffff88017b3d8000 ffff88027bc03c38 ffffffff81929ceb 0000000000000102 0000000000000000 ffff88027bc03c68 ffffffff81085a9d 0000000000000002 ffffffff81ca2a20 0000000000000268 0000000000000000 ffff88027bc03c98 Call Trace: <IRQ> [<ffffffff81929ceb>] dump_stack+0x4f/0x7b [<ffffffff81085a9d>] ___might_sleep+0x16d/0x270 [<ffffffff81085bed>] __might_sleep+0x4d/0x90 [<ffffffff8192e96f>] mutex_lock_nested+0x2f/0x430 [<ffffffff81932fed>] ? _raw_spin_unlock_irqrestore+0x5d/0x80 [<ffffffff81464143>] ? __this_cpu_preempt_check+0x13/0x20 [<ffffffff8182fc3d>] netlink_set_ring+0x1ed/0x350 [<ffffffff8182e000>] ? netlink_undo_bind+0x70/0x70 [<ffffffff8182fe20>] netlink_sock_destruct+0x80/0x150 [<ffffffff817e484d>] __sk_free+0x1d/0x160 [<ffffffff817e49a9>] sk_free+0x19/0x20 [..] Cong Wang says: We can't hold mutex lock in a rcu callback, [..] Thomas Graf says: The socket should be dead at this point. It might be simpler to add a netlink_release_ring() function which doesn't require locking at all. Reported-by: "Kirill A. Shutemov" <kirill@shutemov.name> Diagnosed-by: Cong Wang <cwang@twopensource.com> Suggested-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-22Merge branch 'arm-bpf-fixes'David S. Miller1-13/+44
Nicolas Schichan says: ==================== BPF JIT fixes for ARM These patches are fixing bugs in the ARM JIT and should probably find their way to a stable kernel. All 60 test_bpf tests in Linux 4.1 release are now passing OK (was 54 out of 60 before). ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-22ARM: net: fix vlan access instructions in ARM JIT.Nicolas Schichan1-3/+5
This makes BPF_ANC | SKF_AD_VLAN_TAG and BPF_ANC | SKF_AD_VLAN_TAG_PRESENT have the same behaviour as the in kernel VM and makes the test_bpf LD_VLAN_TAG and LD_VLAN_TAG_PRESENT tests pass. Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-22ARM: net: handle negative offsets in BPF JIT.Nicolas Schichan1-9/+38
Previously, the JIT would reject negative offsets known during code generation and mishandle negative offsets provided at runtime. Fix that by calling bpf_internal_load_pointer_neg_helper() appropriately in the jit_get_skb_{b,h,w} slow path helpers and by forcing the execution flow to the slow path helpers when the offset is negative. Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-22ARM: net: fix condition for load_order > 0 when translating load instructions.Nicolas Schichan1-1/+1
To check whether the load should take the fast path or not, the code would check that (r_skb_hlen - load_order) is greater than the offset of the access using an "Unsigned higher or same" condition. For halfword accesses and an skb length of 1 at offset 0, that test is valid, as we end up comparing 0xffffffff(-1) and 0, so the fast path is taken and the filter allows the load to wrongly succeed. A similar issue exists for word loads at offset 0 and an skb length of less than 4. Fix that by using the condition "Signed greater than or equal" condition for the fast path code for load orders greater than 0. Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-22tcp: suppress a division by zero warningEric Dumazet1-6/+5
Andrew Morton reported following warning on one ARM build with gcc-4.4 : net/ipv4/inet_hashtables.c: In function 'inet_ehash_locks_alloc': net/ipv4/inet_hashtables.c:617: warning: division by zero Even guarded with a test on sizeof(spinlock_t), compiler does not like current construct on a !CONFIG_SMP build. Remove the warning by using a temporary variable. Fixes: 095dc8e0c368 ("tcp: fix/cleanup inet_ehash_locks_alloc()") Reported-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-22Revert "fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()"Linus Torvalds1-14/+20
This reverts commit a2673b6e040663bf16a552f8619e6bde9f4b9acf. Kinglong Mee reports a memory leak with that patch, and Jan Kara confirms: "Thanks for report! You are right that my patch introduces a race between fsnotify kthread and fsnotify_destroy_group() which can result in leaking inotify event on group destruction. I haven't yet decided whether the right fix is not to queue events for dying notification group (as that is pointless anyway) or whether we should just fix the original problem differently... Whenever I look at fsnotify code mark handling I get lost in the maze of locks, lists, and subtle differences between how different notification systems handle notification marks :( I'll think about it over night" and after thinking about it, Jan says: "OK, I have looked into the code some more and I found another relatively simple way of fixing the original oops. It will be IMHO better than trying to fixup this issue which has more potential for breakage. I'll ask Linus to revert the fsnotify fix he already merged and send a new fix" Reported-by: Kinglong Mee <kinglongmee@gmail.com> Requested-by: Jan Kara <jack@suse.cz> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-22Merge tag 'wireless-drivers-for-davem-2015-07-20' of ↵David S. Miller12-410/+144
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== ath9k: * fix device ID check for AR956x iwlwifi: * bug fixes specific for 8000 series * fix a crash in time events * fix a crash in PCIe transport * fix BT Coex code that prevented association on certain devices (3160). * revert the new RBD allocation model because it introduced a bug when running on weak VM setups. * new device IDs ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-22Merge tag 'pinctrl-v4.2-2' of ↵Linus Torvalds7-12/+8
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Here are some overly ripe pin control fixes for the v4.2 series. They got delayed because of various crap commits and having to clean and rinse the patch stack a few times. Now they are however looking good. - some dead defines dropped from the Samsung driver, was targeted for -rc2 but got delayed - drop the strict mode from abx500, this was too strict - fix the R-Car sparse IRQs code to work as intended - fix the IRQ code for the pinctrl-single GPIO backend to not enforce threaded IRQs - clear the latched events/IRQs for the Broadcom BCM2835 driver - fix up debugfs for the Freescale imx1 driver - fix a typo bug in the Schmitt Trigger setup in the LPC18xx driver" * tag 'pinctrl-v4.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: lpc18xx: fix schmitt trigger setup Subject: pinctrl: imx1-core: Fix debug output in .pin_config_set callback pinctrl: bcm2835: Clear the event latch register when disabling interrupts pinctrl: single: ensure pcs irq will not be forced threaded sh-pfc: fix sparse GPIOs for R-Car SoCs pinctrl: abx500: remove strict mode pinctrl: samsung: Remove old unused defines
2015-07-22Merge branch 'for_linus' of ↵Linus Torvalds1-12/+7
git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull UDF fix from Jan Kara: "A fix for UDF corruption when certain disk-format feature is enabled" * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Don't corrupt unalloc spacetable when writing it
2015-07-22Merge tag 'trace-v4.2-rc2-fix2' of ↵Linus Torvalds1-2/+5
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing sample code fix from Steven Rostedt: "He Kuang noticed that the sample code using the trace_event helper function __get_dynamic_array_len() is broken. This only changes the sample code, and I'm pushing this now instead of later because I don't want others using the broken code as an example when using it for real" * tag 'trace-v4.2-rc2-fix2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Fix sample output of dynamic arrays
2015-07-21drivers: net: cpsw: remove tx event processing in rx napi pollMugunthan V N1-6/+3
With commit c03abd84634d ("net: ethernet: cpsw: don't requests IRQs we don't use") common isr and napi are separated into separate tx isr and rx isr/napi, but still in rx napi tx events are handled. So removing the tx event handling in rx napi. Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-21inet: frags: fix defragmented packet's IP header for af_packetEdward Hyunkoo Jee1-2/+4
When ip_frag_queue() computes positions, it assumes that the passed sk_buff does not contain L2 headers. However, when PACKET_FANOUT_FLAG_DEFRAG is used, IP reassembly functions can be called on outgoing packets that contain L2 headers. Also, IPv4 checksum is not corrected after reassembly. Fixes: 7736d33f4262 ("packet: Add pre-defragmentation support for ipv4 fanouts.") Signed-off-by: Edward Hyunkoo Jee <edjee@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Willem de Bruijn <willemb@google.com> Cc: Jerry Chu <hkchu@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-21drm/i915: Use two 32bit reads for select 64bit REG_READ ioctlsChris Wilson2-7/+27
Since the hardware sometimes mysteriously totally flummoxes the 64bit read of a 64bit register when read using a single instruction, split the read into two instructions. Since the read here is of automatically incrementing timestamp counters, we also have to be very careful in order to make sure that it does not increment between the two instructions. However, since userspace tried to workaround this issue and so enshrined this ABI for a broken hardware read and in the process neglected that the read only fails in some environments, we have to introduce a new uABI flag for userspace to request the 2x32 bit accurate read of the timestamp. v2: Fix alignment check and include details of the workaround for userspace. Reported-by: Karol Herbst <freedesktop@karolherbst.de> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91317 Testcase: igt/gem_reg_read Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Michał Winiarski <michal.winiarski@intel.com> Cc: stable@vger.kernel.org Tested-by: Michał Winiarski <michal.winiarski@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>