summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-07-16gpio/xilinx: Use correct address when setting initial values.Raphaël Teysseyre1-2/+2
xgpio_save_regs() is used in this driver to setup the initial values of the registers in the hardware. The relevant registers at that time are: 0x0 -> channel 0 data (32 bits, one for each GPIO on this channel). 0x4 -> channel 0 tri, controls in/out status for each GPIO of this channel. 0x8 -> channel 1 data 0xC -> channel 1 tri gpio-xilinx.c defines these: XGPIO_DATA_OFFSET (0x0) XGPIO_TRI_OFFSET (0x4) XGPIO_CHANNEL_OFFSET 0x8 Before this patch, the "data" register value of channel 1 was written at 0x4 intead of 0x8 (overwriting the channel 0 "tri" register), and the "tri" register value for channel 1 was written at 0x8 instead of 0xC. Signed-off-by: Raphaël Teysseyre <rteysseyre@gmail.com> Reviewed-by: Michal Simek <michal.simek@xilinx.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpiolib: assign chip owner to dev->driver->owner if not setGrygorii Strashko1-0/+3
Assign GPIO chip owner field to chip->dev->driver->owner if it was not configured by GPIO driver. Cc: Johan Hovold <johan@kernel.org> Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com> Acked-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpiolib: irqchip: prevent driver unloading if gpio is used as irq onlyGrygorii Strashko1-0/+5
Now nothing prevents GPIO driver from being unloaded if its gpios were requested as GPIO IRQs only (without calling gpio_request()). Hence, add calls of try_module_get()/module_put() into gpiochip_irq_reqres/relres() to track such scenario properly. Cc: Johan Hovold <johan@kernel.org> Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: zynq: Fix problem with unbalanced pm_runtime_enableMichal Simek1-0/+1
Add missing pm_runtime_disabled to remove(). Error log: root@zynqmp:~# modprobe gpio_zynq root@zynqmp:~# lsmod Not tainted gpio_zynq 7086 0 - Live 0xffffffbffc00a000 root@zynqmp:~# rmmod gpio_zynq root@zynqmp:~# lsmod Not tainted root@zynqmp:~# modprobe gpio_zynq [ 246.924438] zynq-gpio ff0a0000.gpio: Unbalanced pm_runtime_enable! root@zynqmp:~# rmmod gpio_zynq root@zynqmp:~# lsmod Not tainted Signed-off-by: Michal Simek <michal.simek@xilinx.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16ALSA: hda/realtek: Enable HP amp and mute LED on HP Folio 9480m [v3]Keith Packard1-0/+55
This laptop needs GPIO4 pulled high to enable the headphone amplifier, and has a mute LED on GPIO3. I modelled the patch on the existing GPIO4 code which pulls the line low for the same purpose; this time, the HP amp line is pulled high. v2: Disable the headphone amplifier when no headphone is connected. Don't disable power savings to preserve the LED state. v3: Remove headset-specific hooks and code; this is just a headphone. Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-07-16gpio: pcf857x: get rid of slock spinlockGrygorii Strashko1-9/+5
The spinlock 'slock' is used now to protect pcf857x_irq() from itself which is unnecessary (especially after switching to use threaded IRQs). Hence, remove it and use mutex to protect device data in IRQ handler. Cc: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: rcar: Fine-grained Runtime PM supportGeert Uytterhoeven1-4/+16
Currently gpio modules are runtime-resumed at probe time. This means the gpio module will be active all the time (except during system suspend, if not configured as a wake-up source). While an R-Car Gen2 gpio module retains pins configured for output at the requested level while put in standby mode, gpio registercannot be accessed while suspended. Unfortunately pm_runtime_get_sync() cannot be called from all contexts where gpio register access is needed. Hence move the Runtime PM handling from probe/remove time to gpio request/free time, which is probably the best we can do. On r8a7791/koelsch, gpio modules 0, 1, 3, and 4 are now suspended during normal use (gpio2 is used for LEDs and regulators, gpio5 for keys, gpio6 for SD-Card CD & WP, gpio7 for keys and regulators). Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: omap: add missed spin_unlock_irqrestore in omap_gpio_irq_typeGrygorii Strashko1-1/+3
Add missed spin_unlock_irqrestore in omap_gpio_irq_type when omap_set_gpio_triggering() is failed. It fixes static checker warning: drivers/gpio/gpio-omap.c:523 omap_gpio_irq_type() warn: inconsistent returns 'spin_lock:&bank->lock'. This fixes commit: 1562e4618ded ('gpio: omap: fix error handling in omap_gpio_irq_type') Reported-by: Javier Martinez Canillas <javier@dowhile0.org> Signed-off-by: Grygorii Strashko <grygorii.strashko@linaro.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: em: Remove obsolete platform data supportGeert Uytterhoeven2-37/+8
Since commit 59032702ead90562 ("ARM: shmobile: Remove legacy platform devices from EMEV2 SoC code"), EMMA Mobile SoCs are only supported in generic DT-only ARM multi-platform builds. The driver doesn't need to use platform data anymore, hence remove platform data configuration. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Simon Horman <horms+renesas@verge.net.au> Tested-by: Niklas Söderlund <niso@kth.se> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: zx: Add ZTE zx296702 GPIO supportJun Nie3-0/+331
Add ZTE zx296702 GPIO controller support Signed-off-by: Jun Nie <jun.nie@linaro.org> Acked-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: Document ZTE zx296702 GPIO DT bindingJun Nie1-0/+24
Add document of ZTE zx296702 GPIO binding Signed-off-by: Jun Nie <jun.nie@linaro.org> Acked-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16can: mcp251x: get regulators optionallyStefan Agner1-2/+2
The regulators power and transceiver are optional. If those are not present, the pointer (or error pointer) is correctly handled by the driver, hence we can use devm_regulator_get_optional safely, which avoids regulators getting created. Signed-off-by: Stefan Agner <stefan@agner.ch> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2015-07-16can: mcp251x: fix resume when device is downStefan Agner1-7/+6
If a valid power regulator or a dummy regulator is used (which happens to be the case when no regulator is specified), restart_work is queued no matter whether the device was running or not at suspend time. Since work queues get initialized in the ndo_open callback, resuming leads to a NULL pointer exception. Reverse exactly the steps executed at suspend time: - Enable the power regulator in any case - Enable the transceiver regulator if the device was running, even in case we have a power regulator - Queue restart_work only in case the device was running Fixes: bf66f3736a94 ("can: mcp251x: Move to threaded interrupts instead of workqueues.") Signed-off-by: Stefan Agner <stefan@agner.ch> Cc: linux-stable <stable@vger.kernel.org> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2015-07-16Merge branch 'for-upstream' of ↵David S. Miller1-6/+5
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Johan Hedberg says: ==================== pull request: bluetooth 2015-07-15 Here's a regression fix for Broadcom Bluetooth adapters found at least in certain Apple laptops. The issue was introduced in 4.1 so there's the appropriate "Cc: stable" entry for it. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16tc: act_bpf: fix memory leakAlexei Starovoitov1-0/+3
prog->bpf_ops is populated when act_bpf is used with classic BPF and prog->bpf_name is optionally used with extended BPF. Fix memory leak when act_bpf is released. Fixes: d23b8ad8ab23 ("tc: add BPF based action") Fixes: a8cb5f556b56 ("act_bpf: add initial eBPF support for actions") Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16fq_codel: fix return value of fq_codel_drop()WANG Cong1-1/+10
The ->drop() is supposed to return the number of bytes it dropped, however fq_codel_drop() returns the index of the flow where it drops a packet from. Fix this by introducing a helper to wrap fq_codel_drop(). Cc: Eric Dumazet <edumazet@google.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Cong Wang <cwang@twopensource.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16net_sched: fix a use-after-free in sfqWANG Cong1-1/+1
Fixes: 25331d6ce42b ("net: sched: implement qstat helper routines") Cc: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Cong Wang <cwang@twopensource.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16Merge branch 'ipvlan'David S. Miller3-30/+27
Konstantin Khlebnikov says: ==================== ipvlan: cleanups and fixes v1: http://comments.gmane.org/gmane.linux.network/363346 v2: http://comments.gmane.org/gmane.linux.network/369086 v3 has reduced set of patches from "ipvlan: fix ipv6 autoconfiguration". Here just cleanups and patch which ignores ipv6 notifications from RA. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16ipvlan: ignore addresses from ipv6 autoconfigurationKonstantin Khlebnikov1-0/+4
Inet6addr notifier is atomic and runs in bh context without RTNL when ipv6 receives router advertisement packet and performs autoconfiguration. Proper fix still in discussion. Let's at least plug the bug. v1: http://lkml.kernel.org/r/20150514135618.14062.1969.stgit@buzz v2: http://lkml.kernel.org/r/20150703125840.24121.91556.stgit@buzz Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16ipvlan: use rcu_deference_bh() in ipvlan_queue_xmit()WANG Cong2-1/+6
In tx path rcu_read_lock_bh() is held, so we need rcu_deference_bh(). This fixes the following warning: =============================== [ INFO: suspicious RCU usage. ] 4.1.0-rc1+ #1007 Not tainted ------------------------------- drivers/net/ipvlan/ipvlan.h:106 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 1 lock held by dhclient/1076: #0: (rcu_read_lock_bh){......}, at: [<ffffffff817e8d84>] rcu_lock_acquire+0x0/0x26 stack backtrace: CPU: 2 PID: 1076 Comm: dhclient Not tainted 4.1.0-rc1+ #1007 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 0000000000000001 ffff8800d381bac8 ffffffff81a4154f 000000003c1a3c19 ffff8800d4d0a690 ffff8800d381baf8 ffffffff810b849f ffff880117d41148 ffff880117d40000 ffff880117d40068 0000000000000156 ffff8800d381bb18 Call Trace: [<ffffffff81a4154f>] dump_stack+0x4c/0x65 [<ffffffff810b849f>] lockdep_rcu_suspicious+0x107/0x110 [<ffffffff8165a522>] ipvlan_port_get_rcu+0x47/0x4e [<ffffffff8165ad14>] ipvlan_queue_xmit+0x35/0x450 [<ffffffff817ea45d>] ? rcu_read_unlock+0x3e/0x5f [<ffffffff810a20bf>] ? local_clock+0x19/0x22 [<ffffffff810b4781>] ? __lock_is_held+0x39/0x52 [<ffffffff8165b64c>] ipvlan_start_xmit+0x1b/0x44 [<ffffffff817edf7f>] dev_hard_start_xmit+0x2ae/0x467 [<ffffffff817ee642>] __dev_queue_xmit+0x50a/0x60c [<ffffffff817ee7a7>] dev_queue_xmit_sk+0x13/0x15 [<ffffffff81997596>] dev_queue_xmit+0x10/0x12 [<ffffffff8199b41c>] packet_sendmsg+0xb6b/0xbdf [<ffffffff810b5ea7>] ? mark_lock+0x2e/0x226 [<ffffffff810a1fcc>] ? sched_clock_cpu+0x9e/0xb7 [<ffffffff817d56f9>] sock_sendmsg_nosec+0x12/0x1d [<ffffffff817d7257>] sock_sendmsg+0x29/0x2e [<ffffffff817d72cc>] sock_write_iter+0x70/0x91 [<ffffffff81199563>] __vfs_write+0x7e/0xa7 [<ffffffff811996bc>] vfs_write+0x92/0xe8 [<ffffffff811997d7>] SyS_write+0x47/0x7e [<ffffffff81a4d517>] system_call_fastpath+0x12/0x6f Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Cc: Mahesh Bandewar <maheshb@google.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Acked-by: Mahesh Bandewar <maheshb@google.com> Acked-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16ipvlan: unhash addresses without synchronize_rcuKonstantin Khlebnikov3-8/+6
All structures used in traffic forwarding are rcu-protected: ipvl_addr, ipvl_dev and ipvl_port. Thus we can unhash addresses without synchronization. We'll anyway hash it back into the same bucket: in worst case lockless lookup will scan hash once again. Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16ipvlan: plug memory leak in ipvlan_link_deleteKonstantin Khlebnikov1-0/+1
Add missing kfree_rcu(addr, rcu); Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16ipvlan: remove counters of ipv4 and ipv6 addressesKonstantin Khlebnikov2-23/+12
They are unused after commit f631c44bbe15 ("ipvlan: Always set broadcast bit in multicast filter"). Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16Merge branch 'for-linus' of ↵Linus Torvalds2-1/+10
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull TPM bugfixes from James Morris. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: tpm, tpm_crb: fail when TPM2 ACPI table contents look corrupted tpm: Fix initialization of the cdev
2015-07-16Merge tag 'linux-can-fixes-for-4.2-20150715' of ↵David S. Miller13-39/+28
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2015-07-15 this is a pull request of 12 patches by me. This series fixes the use of the skb after netif_receive_skb() / netif_rx() which exists in several drivers. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16ipv6: lock socket in ip6_datagram_connect()Eric Dumazet3-9/+28
ip6_datagram_connect() is doing a lot of socket changes without socket being locked. This looks wrong, at least for udp_lib_rehash() which could corrupt lists because of concurrent udp_sk(sk)->udp_portaddr_hash accesses. Signed-off-by: Eric Dumazet <edumazet@google.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16Merge branch 'isdn-gigaset-fixes'David S. Miller1-25/+10
Tilman Schmidt says: ==================== Fix long-standing regression in ser_gigaset ISDN driver This series fixes a serious regression in the Gigaset M101 driver introduced in kernel release 3.10 and removes some unneeded code. Please also queue up patch 1 of the series for inclusion in the stable/longterm releases 3.10 and later. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16isdn/gigaset: drop unused ldisc methodsTilman Schmidt1-24/+0
The line discipline read and write methods are optional so the dummy methods in ser_gigaset are unnecessary and can be removed. Signed-off-by: Tilman Schmidt <tilman@imap.cc> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16isdn/gigaset: reset tty->receive_room when attaching ser_gigasetTilman Schmidt1-1/+10
Commit 79901317ce80 ("n_tty: Don't flush buffer when closing ldisc"), first merged in kernel release 3.10, caused the following regression in the Gigaset M101 driver: Before that commit, when closing the N_TTY line discipline in preparation to switching to N_GIGASET_M101, receive_room would be reset to a non-zero value by the call to n_tty_flush_buffer() in n_tty's close method. With the removal of that call, receive_room might be left at zero, blocking data reception on the serial line. The present patch fixes that regression by setting receive_room to an appropriate value in the ldisc open method. Fixes: 79901317ce80 ("n_tty: Don't flush buffer when closing ldisc") Signed-off-by: Tilman Schmidt <tilman@imap.cc> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16fq_codel: fix a use-after-freeWANG Cong1-1/+1
Fixes: 25331d6ce42b ("net: sched: implement qstat helper routines") Cc: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Cong Wang <cwang@twopensource.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16tcp: don't use F-RTO on non-recurring timeoutsYuchung Cheng1-2/+1
Currently F-RTO may repeatedly send new data packets on non-recurring timeouts in CA_Loss mode. This is a bug because F-RTO (RFC5682) should only be used on either new recovery or recurring timeouts. This exacerbates the recovery progress during frequent timeout & repair, because we prioritize sending new data packets instead of repairing the holes when the bandwidth is already scarce. Fix it by correcting the test of a new recovery episode. Signed-off-by: Yuchung Cheng <ycheng@google.com> Signed-off-by: Neal Cardwell <ncardwell@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16bridge: mdb: fix double add notificationNikolay Aleksandrov1-1/+0
Since the mdb add/del code was introduced there have been 2 br_mdb_notify calls when doing br_mdb_add() resulting in 2 notifications on each add. Example: Command: bridge mdb add dev br0 port eth1 grp 239.0.0.1 permanent Before patch: root@debian:~# bridge monitor all [MDB]dev br0 port eth1 grp 239.0.0.1 permanent [MDB]dev br0 port eth1 grp 239.0.0.1 permanent After patch: root@debian:~# bridge monitor all [MDB]dev br0 port eth1 grp 239.0.0.1 permanent Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Fixes: cfd567543590 ("bridge: add support of adding and deleting mdb entries") Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16bridge: multicast: treat igmpv3 report with INCLUDE and no sources as a leaveSatish Ashok1-7/+30
A report with INCLUDE/Change_to_include and empty source list should be treated as a leave, specified by RFC 3376, section 3.1: "If the requested filter mode is INCLUDE *and* the requested source list is empty, then the entry corresponding to the requested interface and multicast address is deleted if present. If no such entry is present, the request is ignored." Signed-off-by: Satish Ashok <sashok@cumulusnetworks.com> Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16Merge tag 'for-linus' of ↵Linus Torvalds36-269/+351
git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull rdma fixes from Doug Ledford: "Mainly fix-ups for the various 4.2 items" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: (24 commits) IB/core: Destroy ocrdma_dev_id IDR on module exit IB/core: Destroy multcast_idr on module exit IB/mlx4: Optimize do_slave_init IB/mlx4: Fix memory leak in do_slave_init IB/mlx4: Optimize freeing of items on error unwind IB/mlx4: Fix use of flow-counters for process_mad IB/ipath: Convert use of __constant_<foo> to <foo> IB/ipoib: Set MTU to max allowed by mode when mode changes IB/ipoib: Scatter-Gather support in connected mode IB/ucm: Fix bitmap wrap when devnum > IB_UCM_MAX_DEVICES IB/ipoib: Prevent lockdep warning in __ipoib_ib_dev_flush IB/ucma: Fix lockdep warning in ucma_lock_files rds: rds_ib_device.refcount overflow RDMA/nes: Fix for incorrect recording of the MAC address RDMA/nes: Fix for resolving the neigh RDMA/core: Fixes for port mapper client registration IB/IPoIB: Fix bad error flow in ipoib_add_port() IB/mlx4: Do not attemp to report HCA clock offset on VFs IB/cm: Do not queue work to a device that's going away IB/srp: Avoid using uninitialized variable ...
2015-07-16net: Fix skb csum races when peekingHerbert Xu1-6/+9
When we calculate the checksum on the recv path, we store the result in the skb as an optimisation in case we need the checksum again down the line. This is in fact bogus for the MSG_PEEK case as this is done without any locking. So multiple threads can peek and then store the result to the same skb, potentially resulting in bogus skb states. This patch fixes this by only storing the result if the skb is not shared. This preserves the optimisations for the few cases where it can be done safely due to locking or other reasons, e.g., SIOCINQ. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16Revert "net: fec: Ensure clocks are enabled while using mdio bus"Fabio Estevam1-75/+13
This reverts commit 6c3e921b18edca290099adfddde8a50236bf2d80. commit 6c3e921b18ed ("net: fec: Ensure clocks are enabled while using mdio bus") prevents the kernel to boot on mx6 boards, so let's revert it. Reported-by: Tyler Baker <tyler.baker@linaro.org> Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16NET: AX.25: Stop heartbeat timer on disconnect.Richard Stearn1-0/+1
This may result in a kernel panic. The bug has always existed but somehow we've run out of luck now and it bites. Signed-off-by: Richard Stearn <richard@rns-stearn.demon.co.uk> Cc: stable@vger.kernel.org # all branches Signed-off-by: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16net: Clone skb before setting peeked flagHerbert Xu1-3/+38
Shared skbs must not be modified and this is crucial for broadcast and/or multicast paths where we use it as an optimisation to avoid unnecessary cloning. The function skb_recv_datagram breaks this rule by setting peeked without cloning the skb first. This causes funky races which leads to double-free. This patch fixes this by cloning the skb and replacing the skb in the list when setting skb->peeked. Fixes: a59322be07c9 ("[UDP]: Only increment counter on first peek/recv") Reported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16rtnetlink: reject non-IFLA_VF_PORT attributes inside IFLA_VF_PORTSDaniel Borkmann1-4/+7
Similarly as in commit 4f7d2cdfdde7 ("rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver"), we have a double nesting of netlink attributes, i.e. IFLA_VF_PORTS only contains IFLA_VF_PORT that is nested itself. While IFLA_VF_PORTS is a verified attribute from ifla_policy[], we only check if the IFLA_VF_PORTS container has IFLA_VF_PORT attributes and then pass the attribute's content itself via nla_parse_nested(). It would be more correct to reject inner types other than IFLA_VF_PORT instead of continuing parsing and also similarly as in commit 4f7d2cdfdde7, to check for a minimum of NLA_HDRLEN. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Cc: Roopa Prabhu <roopa@cumulusnetworks.com> Cc: Scott Feldman <sfeldma@gmail.com> Cc: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-16gpio: brcmstb: fix null ptr dereference in driver removeGregory Fong1-3/+11
If a failure occurs during probe, brcmstb_gpio_remove() is called. In remove, we call platform_get_drvdata(), but at the time of failure in the probe the driver data hadn't yet been set which leads to a NULL ptr dereference in the remove's list_for_each. Call platform_set_drvdata() and set up list head right after allocating the priv struct to both avoid the null pointer dereference that could occur today. To guard against potential future changes, check for null pointer in remove. Reported-by: Tim Ross <tross@broadcom.com> Signed-off-by: Gregory Fong <gregory.0xf0@gmail.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: Remove double "base" in commentGeert Uytterhoeven1-1/+1
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: of: remove unnecessary variable in of_get_gpio_hog()Masahiro Yamada1-4/+1
The variable "desc" is only used for storing the return value at the end of the function. It is unneeded. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com> Acked-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: mvebu: kill bogus dependency on GPIO_GENERICMasahiro Yamada1-1/+0
The driver gpio-mvebu.c does not depend on gpio-generic.c at all. Drop unneeded "select GPIO_GENERIC". Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com> Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: altera: use of_mm_gpiochip_remove() to fix memory leakMasahiro Yamada1-1/+1
This driver calls of_mm_gpiochip_add() to add a memory mapped gpio chip. So, of_mm_gpiochip_remove() should be used when removing it. The direct call of gpiochip_remove() misses unmapping the register and freeing the label. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Acked-by: Tien Hock Loh <thloh@altera.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: altera: fix return value of altera_gpio_remove()Masahiro Yamada1-1/+1
The remove callback never succeeds, which seems odd. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Acked-by: Tien Hock Loh <thloh@altera.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: altera: kill bogus dependency on GPIO_GENERICMasahiro Yamada1-1/+0
The driver gpio-altera.c does not depend on gpio-generic.c at all. Drop unneeded "select GPIO_GENERIC". Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com> Acked-by: Tien Hock Loh <thloh@altera.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: zynq: add missing module_exit functionMasahiro Yamada1-0/+6
This driver is tristate, so it should be cleanable. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com> Tested-by: Michal Simek <michal.simek@xilinx.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16dt-bindings: brcmstb-gpio: document properties for wakeupGregory Fong1-7/+28
Some brcmstb GPIO controllers can be used to wake from suspend, so use the de facto standard property 'wakeup-source' to mark the nodes of controllers with that capability. Also document interrupts-extended, which will be used for wakeup handling because the interrupt parent for the wake IRQ is different from the regular IRQ. While we're at it, a few more fixes: We don't actually use the "interrupt-names" property, so remove it from the listed optional properties and from the examples. And since we're modifying the examples, also follow Brian's suggestions to: - change #gpio-cells, #interrupt-cells, and brcm,gpio-bank-widths from hex to dec - use phandles Reviewed-by: Brian Norris <computersforpeace@gmail.com> Signed-off-by: Gregory Fong <gregory.0xf0@gmail.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpiolib: Fix docs for gpiochip_add_pingroup_rangeTomeu Vizoso1-1/+1
gpiochip_add_pingroup_range() has a pctldev argument, not pinctrl. Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-16gpio: generic: add get_direction supportPhilipp Zabel1-0/+18
Allow to determine the current direction configuration by reading back from the direction register. Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Acked-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
generated by cgit v1.2.3 (git 2.39.0) at 2025-09-30 21:06:30 +0300