summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-11-30Merge tag 'drm-qemu-20161121' of git://git.kraxel.org/linux into drm-nextDave Airlie258-1303/+1998
drm/virtio: fix busid in a different way, allocate more vbufs. drm/qxl: various bugfixes and cleanups, * tag 'drm-qemu-20161121' of git://git.kraxel.org/linux: (224 commits) drm/virtio: allocate some extra bufs qxl: Allow resolution which are not multiple of 8 qxl: Don't notify userspace when monitors config is unchanged qxl: Remove qxl_bo_init() return value qxl: Call qxl_gem_{init, fini} qxl: Add missing '\n' to qxl_io_log() call qxl: Remove unused prototype qxl: Mark some internal functions as static Revert "drm: virtio: reinstate drm_virtio_set_busid()" drm/virtio: fix busid regression drm: re-export drm_dev_set_unique Linux 4.9-rc5 gp8psk: Fix DVB frontend attach gp8psk: fix gp8psk_usb_in_op() logic dvb-usb: move data_mutex to struct dvb_usb_device iio: maxim_thermocouple: detect invalid storage size in read() aoe: fix crash in page count manipulation lightnvm: invalid offset calculation for lba_shift Kbuild: enable -Wmaybe-uninitialized warnings by default pcmcia: fix return value of soc_pcmcia_regulator_set ...
2016-11-30Merge branch 'for-upstream/hdlcd' of git://linux-arm.org/linux-ld into drm-fixesDave Airlie1-1/+1
Thanks for pulling the previous patch for HDLCD. Unfortunately, yesterday Robin Murphy discovered another issue while playing with CMA allocation sizes, which he has submitted a fix for. * 'for-upstream/hdlcd' of git://linux-arm.org/linux-ld: drm: hdlcd: Fix cleanup order
2016-11-30Merge branch 'fixed-phy-phydev-leaks'David S. Miller18-54/+152
Johan Hovold says: ==================== net: fix fixed-link phydev leaks This series fixes failures to deregister and free fixed-link phydevs that have been registered using the of_phy_register_fixed_link() interface. All but two drivers currently fail to do this and this series fixes most of them with the exception of a staging driver and the stmmac drivers which will be fixed by follow-on patches. Included are also a couple of fixes for related of-node leaks. Note that all patches except the of_mdio one have been compile-tested only. Also note that the series is against net due to dependencies not yet in net-next. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: dsa: slave: fix fixed-link phydev leaksJohan Hovold1-1/+11
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on slave-setup errors and on slave destroy. Fixes: 0d8bcdd383b8 ("net: dsa: allow for more complex PHY setups") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: ti: davinci_emac: fix fixed-link phydev and of-node leaksJohan Hovold1-1/+9
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Also remember to put the of-node reference on probe errors. Fixes: 1bb6aa56bb38 ("net: davinci_emac: Add support for fixed-link PHY") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: dwc_eth_qos: fix fixed-link phydev leaksJohan Hovold1-7/+13
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: 077742dac2c7 ("dwc_eth_qos: Add support for Synopsys DWC Ethernet QoS") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: renesas: ravb: fix fixed-link phydev leaksJohan Hovold1-3/+14
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on initialisation errors and on device close after having disconnected the PHY. Fixes: b4bc88a868ed ("ravb: Add fixed-link support") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: mediatek: fix fixed-link phydev leaksJohan Hovold1-0/+4
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on initialisation errors and on uninit. Fixes: 0c72c50f6f93 ("net-next: mediatek: add fixed-phy support") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: marvell: mvneta: fix fixed-link phydev leaksJohan Hovold1-0/+5
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: 83895bedeee6 ("net: mvneta: add support for fixed links") Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: ucc_geth: fix fixed-link phydev leaksJohan Hovold1-7/+16
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: 87009814cdbb ("ucc_geth: use the new fixed PHY helpers") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: gianfar: fix fixed-link phydev leaksJohan Hovold1-0/+8
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: be40364544bd ("gianfar: use the new fixed PHY helpers") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: fs_enet: fix fixed-link phydev leaksJohan Hovold1-1/+6
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: bb74d9a4a87b ("fs_enet: use the new fixed PHY helpers") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: fec: fix fixed-link phydev leaksJohan Hovold1-0/+5
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: 407066f8f371 ("net: fec: Support phys probed from devicetree and fixed-link") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: bcmgenet: fix fixed-link phydev leaksJohan Hovold1-0/+6
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Note that we're still leaking any fixed-link PHY registered in the non-OF probe path. Fixes: 9abf0c2b717a ("net: bcmgenet: use the new fixed PHY helpers") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: bcmsysport: fix fixed-link phydev leaksJohan Hovold1-5/+12
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: 186534a3f832 ("net: systemport: use the new fixed PHY helpers") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: aurora: nb8800: fix fixed-link phydev leaksJohan Hovold1-2/+7
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: c7dfe3abf40e ("net: ethernet: nb8800: support fixed-link DT node") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: ethernet: altera: fix fixed-link phydev leaksJohan Hovold1-1/+8
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: 7cdbc6f74f8e ("altera tse: add support for fixed-links.") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30of_mdio: add helper to deregister fixed-link PHYsJohan Hovold4-24/+23
Add helper to deregister fixed-link PHYs registered using of_phy_register_fixed_link(). Convert the two drivers that care to deregister their fixed-link PHYs to use the new helper, but note that most drivers currently fail to do so. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: dsa: slave: fix of-node leak and phy priorityJohan Hovold1-2/+5
Make sure to drop the reference taken by of_parse_phandle() before returning from dsa_slave_phy_setup(). Note that this also modifies the PHY priority so that any fixed-link node is only parsed when no phy-handle is given, which is in accordance with the common scheme for this. Fixes: 0d8bcdd383b8 ("net: dsa: allow for more complex PHY setups") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30Merge branch 'drm-fixes-4.9' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie3-5/+22
into drm-fixes Regression fixes for PX and a powerplay fix. * 'drm-fixes-4.9' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: fix check for port PM availability drm/amdgpu: fix check for port PM availability drm/amd/powerplay: initialize the soft_regs offset in struct smu7_hwmgr
2016-11-30Merge tag 'arc-4.9-final' of ↵Linus Torvalds3-6/+7
git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - fix PAE40 crash [Yuriy] - disable IO-Coherency by default - use a different inline asm constraint for Zero Overhead loops * tag 'arc-4.9-final' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: mm: PAE40: Fix crash at munmap ARC: mm: IOC: Don't enable IOC by default ARC: Don't use "+l" inline asm constraint
2016-11-30GSO: Reload iph after pskb_may_pullArnaldo Carvalho de Melo1-1/+1
As it may get stale and lead to use after free. Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Alexander Duyck <aduyck@mirantis.com> Cc: Andrey Konovalov <andreyknvl@google.com> Fixes: cbc53e08a793 ("GSO: Add GSO type for fixed IPv4 ID") Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Acked-by: Alexander Duyck <alexander.h.duyck@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30sched: cls_flower: remove from hashtable only in case skip sw flag is not setJiri Pirko1-4/+6
Be symmetric to hashtable insert and remove filter from hashtable only in case skip sw flag is not set. Fixes: e69985c67c33 ("net/sched: cls_flower: Introduce support in SKIP SW flag") Signed-off-by: Jiri Pirko <jiri@mellanox.com> Reviewed-by: Amir Vadai <amir@vadai.me> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net/dccp: fix use-after-free in dccp_invalid_packetEric Dumazet1-5/+7
pskb_may_pull() can reallocate skb->head, we need to reload dh pointer in dccp_invalid_packet() or risk use after free. Bug found by Andrey Konovalov using syzkaller. Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: macb: ensure ordering write to re-enable RX smoothlyZumeng Chen1-0/+2
When a hardware issue happened as described by inline comments, the register write pattern looks like the following: <write ~MACB_BIT(RE)> + wmb(); <write MACB_BIT(RE)> There might be a memory barrier between these two write operations, so add wmb to ensure an flip from 0 to 1 for NCR. Signed-off-by: Zumeng Chen <zumeng.chen@windriver.com> Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net: macb: fix the RX queue reset in macb_rx()Cyrille Pitchen1-2/+1
On macb only (not gem), when a RX queue corruption was detected from macb_rx(), the RX queue was reset: during this process the RX ring buffer descriptor was initialized by macb_init_rx_ring() but we forgot to also set bp->rx_tail to 0. Indeed, when processing the received frames, bp->rx_tail provides the macb driver with the index in the RX ring buffer of the next buffer to process. So when the whole ring buffer is reset we must also reset bp->rx_tail so the driver is synchronized again with the hardware. Since macb_init_rx_ring() is called from many locations, currently from macb_rx() and macb_init_rings(), we'd rather add the "bp->rx_tail = 0;" line inside macb_init_rx_ring() than add the very same line after each call of this function. Without this fix, the rx queue is not reset properly to recover from queue corruption and connection drop may occur. Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com> Fixes: 9ba723b081a2 ("net: macb: remove BUG_ON() and reset the queue to handle RX errors") Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30netlink: Call cb->done from a worker threadHerbert Xu2-4/+25
The cb->done interface expects to be called in process context. This was broken by the netlink RCU conversion. This patch fixes it by adding a worker struct to make the cb->done call where necessary. Fixes: 21e4902aea80 ("netlink: Lockless lookup with RCU grace...") Reported-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30net/sched: pedit: make sure that offset is validAmir Vadai1-4/+20
Add a validation function to make sure offset is valid: 1. Not below skb head (could happen when offset is negative). 2. Validate both 'offset' and 'at'. Signed-off-by: Amir Vadai <amir@vadai.me> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30Re-enable CONFIG_MODVERSIONS in a slightly weaker formLinus Torvalds2-3/+3
This enables CONFIG_MODVERSIONS again, but allows for missing symbol CRC information in order to work around the issue that newer binutils versions seem to occasionally drop the CRC on the floor. binutils 2.26 seems to work fine, while binutils 2.27 seems to break MODVERSIONS of symbols that have been defined in assembler files. [ We've had random missing CRC's before - it may be an old problem that just is now reliably triggered with the weak asm symbols and a new version of binutils ] Some day I really do want to remove MODVERSIONS entirely. Sadly, today does not appear to be that day: Debian people apparently do want the option to enable MODVERSIONS to make it easier to have external modules across kernel versions, and this seems to be a fairly minimal fix for the annoying problem. Cc: Ben Hutchings <ben@decadent.org.uk> Acked-by: Michal Marek <mmarek@suse.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-11-30drm/vc4: Fix race between page flip completion event and clean-upDerek Foreman3-8/+34
There was a small window where a userspace program could submit a pageflip after receiving a pageflip completion event yet still receive EBUSY. Signed-off-by: Derek Foreman <derekf@osg.samsung.com> Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Eric Anholt <eric@anholt.net> Reviewed-by: Daniel Stone <daniels@collabora.com>
2016-11-30drm: Fix locking cargo-cult in encoder/plane init/cleanupDaniel Vetter2-10/+3
Encoders&planes can't be hotplugged, we dont need locking for this since it's all single-threaded driver setup/teardown code. CRTCs already don't grab locks. While at it I noticed that plane's are missing the drm_modeset_lock_fini() call, so add it. Reviewed-by: Frank Binns <frank.binns@imgtec.com> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Link: http://patchwork.freedesktop.org/patch/msgid/20161129094538.9650-1-daniel.vetter@ffwll.ch
2016-11-30drm/doc: Fix indenting in drm_modeset_lock.c commentDaniel Vetter1-5/+5
This isn't part of the code snippet anymore ... Acked-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20161129092440.6940-1-daniel.vetter@ffwll.ch
2016-11-29drm: Protect fb_helper list manipulation with a mutexChris Wilson1-0/+5
Though we only walk the kernel_fb_helper_list inside a panic (or single thread debugging), we still need to protect the list manipulation on creating/removing a framebuffer device in order to prevent list corruption. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Sean Paul <seanpaul@chromium.org> Link: http://patchwork.freedesktop.org/patch/msgid/20161129120217.7344-3-chris@chris-wilson.co.uk
2016-11-29drm: Pull together probe + setup for drm_fb_helperChris Wilson1-26/+11
drm_fb_helper_probe_connector_modes() is always called before drm_setup_crtcs(), so just move the call into drm_setup_crtcs for a small bit of code compaction. Note that register_framebuffer will do a modeset (when fbcon is enabled) and hence must be moved out of the critical section. A follow-up patch will add new locking for the fb list, hence move all the related registration code together. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Daniel Vetter <daniel.vetter@intel.com> Signed-off-by: Sean Paul <seanpaul@chromium.org> Link: http://patchwork.freedesktop.org/patch/msgid/20161129120217.7344-2-chris@chris-wilson.co.uk
2016-11-29drm: Hold mode_config.lock to prevent hotplug whilst setting up crtcsChris Wilson1-33/+40
The fb_helper->connector_count is modified when a new connector is constructed following a hotplug event (e.g. DP-MST). This causes trouble for drm_setup_crtcs() and friends that assume that fb_helper is constant: [ 1250.872997] BUG: KASAN: slab-out-of-bounds in drm_setup_crtcs+0x320/0xf80 at addr ffff88074cdd2608 [ 1250.873020] Write of size 40 by task kworker/u8:3/480 [ 1250.873039] CPU: 2 PID: 480 Comm: kworker/u8:3 Tainted: G U 4.9.0-rc6+ #285 [ 1250.873043] Hardware name: /NUC6i3SYB, BIOS SYSKLi35.86A.0024.2015.1027.2142 10/27/2015 [ 1250.873050] Workqueue: events_unbound async_run_entry_fn [ 1250.873056] ffff88070f9d78f0 ffffffff814b72aa ffff88074e40c5c0 ffff88074cdd2608 [ 1250.873067] ffff88070f9d7918 ffffffff8124ff3c ffff88070f9d79b0 ffff88074cdd2600 [ 1250.873079] ffff88074e40c5c0 ffff88070f9d79a0 ffffffff812501e4 0000000000000005 [ 1250.873090] Call Trace: [ 1250.873099] [<ffffffff814b72aa>] dump_stack+0x67/0x9d [ 1250.873106] [<ffffffff8124ff3c>] kasan_object_err+0x1c/0x70 [ 1250.873113] [<ffffffff812501e4>] kasan_report_error+0x204/0x4f0 [ 1250.873120] [<ffffffff81698df0>] ? drm_dev_printk+0x140/0x140 [ 1250.873127] [<ffffffff81250ac3>] kasan_report+0x53/0x60 [ 1250.873134] [<ffffffff81688b40>] ? drm_setup_crtcs+0x320/0xf80 [ 1250.873142] [<ffffffff8124f18e>] check_memory_region+0x13e/0x1a0 [ 1250.873147] [<ffffffff8124f5f3>] memset+0x23/0x40 [ 1250.873154] [<ffffffff81688b40>] drm_setup_crtcs+0x320/0xf80 [ 1250.873161] [<ffffffff810be7c5>] ? wake_up_q+0x45/0x80 [ 1250.873169] [<ffffffff81b0c180>] ? mutex_lock_nested+0x5a0/0x5a0 [ 1250.873176] [<ffffffff8168a0e6>] drm_fb_helper_initial_config+0x206/0x7a0 [ 1250.873183] [<ffffffff81689ee0>] ? drm_fb_helper_set_par+0x90/0x90 [ 1250.873303] [<ffffffffa0b68690>] ? intel_fbdev_fini+0x140/0x140 [i915] [ 1250.873387] [<ffffffffa0b686b2>] intel_fbdev_initial_config+0x22/0x40 [i915] [ 1250.873391] [<ffffffff810b50ff>] async_run_entry_fn+0x7f/0x270 [ 1250.873394] [<ffffffff810a64b0>] process_one_work+0x3d0/0x960 [ 1250.873398] [<ffffffff810a641d>] ? process_one_work+0x33d/0x960 [ 1250.873401] [<ffffffff810a60e0>] ? max_active_store+0xf0/0xf0 [ 1250.873406] [<ffffffff810f6f9d>] ? do_raw_spin_lock+0x10d/0x1a0 [ 1250.873413] [<ffffffff810a767d>] worker_thread+0x8d/0x840 [ 1250.873419] [<ffffffff810a75f0>] ? create_worker+0x2e0/0x2e0 [ 1250.873426] [<ffffffff810b0454>] kthread+0x194/0x1c0 [ 1250.873432] [<ffffffff810b02c0>] ? kthread_park+0x60/0x60 [ 1250.873438] [<ffffffff810f095d>] ? trace_hardirqs_on+0xd/0x10 [ 1250.873446] [<ffffffff810b02c0>] ? kthread_park+0x60/0x60 [ 1250.873453] [<ffffffff810b02c0>] ? kthread_park+0x60/0x60 [ 1250.873457] [<ffffffff81b12277>] ret_from_fork+0x27/0x40 [ 1250.873460] Object at ffff88074cdd2608, in cache kmalloc-32 size: 32 However, when holding the mode_config.lock around the fb_helper, we have to be careful of any callbacks that may reenter the fb_helper and so try to reacquire the mode_config.lock (e.g. register_framebuffer). To avoid the mutex recursion, we have to rearrange the sequence to move the registration into the caller outside of the mode_config.lock. v2: drop the 1; following the lockdep assertion inside the for(;;), I anticipated an error that doesn't happen! Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98826 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Daniel Vetter <daniel@ffwll.ch> Signed-off-by: Sean Paul <seanpaul@chromium.org> Link: http://patchwork.freedesktop.org/patch/msgid/20161129120217.7344-1-chris@chris-wilson.co.uk
2016-11-29Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds3-12/+28
Pull CIFS fixes from Steve French: "A few misc important cifs fixes, including a fix for a 4.9 regression in posix_acl xattr handling" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: CIFS: iterate over posix acl xattr entry correctly in ACL_to_cifs_posix() Call echo service immediately after socket reconnect CIFS: Fix BUG() in calc_seckey()
2016-11-29netfilter: ipv6: nf_defrag: drop mangled skb on ream errorFlorian Westphal2-3/+3
Dmitry Vyukov reported GPF in network stack that Andrey traced down to negative nh offset in nf_ct_frag6_queue(). Problem is that all network headers before fragment header are pulled. Normal ipv6 reassembly will drop the skb when errors occur further down the line. netfilter doesn't do this, and instead passed the original fragment along. That was also fine back when netfilter ipv6 defrag worked with cloned fragments, as the original, pristine fragment was passed on. So we either have to undo the pull op, or discard such fragments. Since they're malformed after all (e.g. overlapping fragment) it seems preferrable to just drop them. Same for temporary errors -- it doesn't make sense to accept (and perhaps forward!) only some fragments of same datagram. Fixes: 029f7f3b8701cc7ac ("netfilter: ipv6: nf_defrag: avoid/free clone operations") Reported-by: Dmitry Vyukov <dvyukov@google.com> Debugged-by: Andrey Konovalov <andreyknvl@google.com> Diagnosed-by: Eric Dumazet <Eric Dumazet <edumazet@google.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2016-11-29Merge tag 'scsi-fixes' of ↵Linus Torvalds5-12/+23
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four small fixes. The be2iscsi is a potential device overrun in consistent memory, which could have nasty consequences if the consistent allocations are packed. The hpsa one fixes a regression where older controllers can now get a numbering clash between the first internal disk and the controller. The libfc one is a regression in timespec conversions which causes a user visible issue in a command line tool and the mpt3sas one fixes a regression where the controller could remain permanently blocked after an ATA pass through command followed by a reset" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: be2iscsi: allocate enough memory in beiscsi_boot_get_sinfo() scsi: mpt3sas: Unblock device after controller reset scsi: hpsa: use bus '3' for legacy HBA devices scsi: libfc: fix seconds_since_last_reset miscalculation
2016-11-29Revert "i2c: octeon: thunderx: Limit register access retries"Jan Glauber2-19/+12
This reverts commit 70121f7f3725 ("i2c: octeon: thunderx: Limit register access retries"). Using readq_poll_timeout instead of __raw_readq triggers the following debug warning: [ 78.871568] ipmi_ssif: Trying hotmod-specified SSIF interface at i2c address 0x12, adapter Cavium ThunderX i2c adapter at 0000:01:09.4, slave address 0x0 [ 78.886107] do not call blocking ops when !TASK_RUNNING; state=2 set at [<fffffc00080e0088>] prepare_to_wait_event+0x58/0x10c [ 78.897436] ------------[ cut here ]------------ [ 78.902050] WARNING: CPU: 6 PID: 2235 at kernel/sched/core.c:7718 __might_sleep+0x80/0x88 [...] [ 79.133553] [<fffffc00080c3aac>] __might_sleep+0x80/0x88 [ 79.138862] [<fffffc0000e30138>] octeon_i2c_test_iflg+0x4c/0xbc [i2c_thunderx] [ 79.146077] [<fffffc0000e30958>] octeon_i2c_test_ready+0x18/0x70 [i2c_thunderx] [ 79.153379] [<fffffc0000e30b04>] octeon_i2c_wait+0x154/0x1a4 [i2c_thunderx] [ 79.160334] [<fffffc0000e310bc>] octeon_i2c_xfer+0xf4/0xf60 [i2c_thunderx] Signed-off-by: Jan Glauber <jglauber@cavium.com> Acked-by: Steven J. Hill <steven.hill@cavium.com> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
2016-11-29drm/tilcdc: Fix race from forced shutdown of crtc in unloadJyri Sarha3-8/+26
Fix race from forced shutdown of crtc in unload by adding internal locking and a boolean telling if device is going to be shutdown. Signed-off-by: Jyri Sarha <jsarha@ti.com>
2016-11-29drm/tilcdc: Use unload to handle initialization failuresJyri Sarha3-71/+43
Use unload to handle initialization failures instead of complex goto label mess. To do this the initialization sequence needed slight reordering and some unload functions needed to become conditional. Signed-off-by: Jyri Sarha <jsarha@ti.com>
2016-11-29drm/tilcdc: Stop using struct drm_driver load() callbackJyri Sarha1-54/+70
Stop using struct drm_driver load() and unload() callbacks. The callbacks should not be used anymore. Instead of using load the drm_device is allocated with drm_dev_alloc() and registered with drm_dev_register() only after the driver is completely initialized. The deinitialization is done directly either in component unbind callback or in platform driver demove callback. Signed-off-by: Jyri Sarha <jsarha@ti.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
2016-11-29drm/tilcdc: Remove obsolete drm_connector_register() callsJyri Sarha2-4/+0
Remove obsolete drm_connector_register() calls from tilcdc_panel.c and tilcdc_tfp410.c. All connectors are registered when drm_dev_register() is called. Signed-off-by: Jyri Sarha <jsarha@ti.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
2016-11-29drm/tilcdc: Correct misspelling in error messageDaniel Schultz1-1/+1
This error message will be printed when a FIFO underflow irq has triggered. Since this happens sometimes and the error message will be displayed on the console, it should have a correct spelling. Signed-off-by: Daniel Schultz <d.schultz@phytec.de> Signed-off-by: Jyri Sarha <jsarha@ti.com>
2016-11-29drm/tilcdc: Add revision handling for FB_CEILINGDaniel Schultz1-1/+5
The commit d8ff0c63fbcb ("drm/tilcdc: Adjust the FB_CEILING address") added an adjustment of the FB_CEILING address. This is done by decrementing the address by one. On the AM335x (rev 0x4F201000) the framebuffer is rotated left over the display border, because the ceiling address is 8f276fff instead of 8f277000. Since this adjustment isn't necessary for the LCDC v2, the origin ceiling address should be used. Signed-off-by: Daniel Schultz <d.schultz@phytec.de> Signed-off-by: Jyri Sarha <jsarha@ti.com>
2016-11-29drm/tilcdc: add a da850-specific compatible stringBartosz Golaszewski2-2/+5
Due to some potential tweaks for the da850 LCDC (for example: the required memory bandwith settings) we need a separate compatible for the IP present on the da850 boards. Suggested-by: Sekhar Nori <nsekhar@ti.com> Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Jyri Sarha <jsarha@ti.com>
2016-11-29drm/tilcdc: add a workaround for failed clk_set_rate()Bartosz Golaszewski1-6/+51
Some architectures don't use the common clock framework and don't implement all the clk interfaces for every clock. This is the case for da850-lcdk where clk_set_rate() only works for PLL0 and PLL1. Trying to set the clock rate for the LCDC clock results in -EINVAL being returned. As a workaround for that: if the call to clk_set_rate() fails, fall back to adjusting the clock divider instead. Proper divider value is calculated by dividing the current clock rate by the required pixel clock rate in HZ. This code is based on a hack initially developed internally for baylibre by Karl Beldan <kbeldan@baylibre.com>. Tested with a da850-lcdk with an LCD display connected over VGA. Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> Signed-off-by: Jyri Sarha <jsarha@ti.com>
2016-11-29ARC: mm: PAE40: Fix crash at munmapYuriy Kolerov1-1/+1
commit 1c3c90930392 broke PAE40. Macro pfn_pte(pfn, prot) creates paddr from pfn, but the page shift was getting truncated to 32 bits since we lost the proper cast to 64 bits (for PAE400 Instead of reverting that commit, use a better helper which is 32/64 bits safe just like ARM implementation. Fixes: 1c3c90930392 ("ARC: mm: fix build breakage with STRICT_MM_TYPECHECKS") Cc: <stable@vger.kernel.org> #4.4+ Signed-off-by: Yuriy Kolerov <yuriy.kolerov@synopsys.com> [vgupta: massaged changelog] Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
2016-11-29mremap: move_ptes: check pte dirty after its removalAaron Lu2-6/+10
Linus found there still is a race in mremap after commit 5d1904204c99 ("mremap: fix race between mremap() and page cleanning"). As described by Linus: "the issue is that another thread might make the pte be dirty (in the hardware walker, so no locking of ours will make any difference) *after* we checked whether it was dirty, but *before* we removed it from the page tables" Fix it by moving the check after we removed it from the page table. Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Aaron Lu <aaron.lu@intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-11-29pwm: Fix device reference leakJohan Hovold1-0/+2
Make sure to drop the reference to the parent device taken by class_find_device() after "unexporting" any children when deregistering a PWM chip. Fixes: 0733424c9ba9 ("pwm: Unexport children before chip removal") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Thierry Reding <thierry.reding@gmail.com>