Commit Graph

617785 Commits

Author SHA1 Message Date
Linus Torvalds
46738ab31f Merge branch 'mailbox-devel' of git://git.linaro.org/landing-teams/working/fujitsu/integration
Pull mailbox fixes from Jassi Brar:
 "Misc fixes for BCM mailbox driver

   - Fix build warnings by making static functions used within the file.
   - Check for potential NULL before dereferencing
   - Fix link error by defining HAS_DMA dependency"

* 'mailbox-devel' of git://git.linaro.org/landing-teams/working/fujitsu/integration:
  fix📫bcm-pdc-mailbox:mark symbols static where possible
  mailbox: bcm-pdc: potential NULL dereference in pdc_shutdown()
  mailbox: Add HAS_DMA Kconfig dependency to BCM_PDC_MBOX
2016-09-06 11:15:07 -07:00
Linus Torvalds
6296c41259 SCSI fixes on 20160906
This is really three fixes, but the SES one comes in a bundle of three
 (making the replacement API available properly, using it and removing
 the non-working one).  The SES problem causes an oops on hpsa devices
 because they attach virtual disks to the host which aren't SAS
 attached (the replacement API ignores them).  The other two fixes are
 fairly minor: the sense key one means we actually resolve a newly
 added sense key and the RDAC device blacklisting is needed to prevent
 us annoying the universal XPORT lun of various RDAC arrays.
 
 Signed-off-by: James Bottomley <jejb@linux.vnet.ibm.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJXztXJAAoJEAVr7HOZEZN4Ix4QAKEfme48bS9+5qsDodwzK1tR
 FZqC7/itkmQ295yzppw0Gp4Tbod+LflBd3o321JCQiAZ5YF3PeDINYDj3X0JkgLW
 2dMd9dcDogigGCkosmr4V8WtCdWj6UXXvbzqLu8PSX9Ji0Fhi4S4mSuQkBWwq2nb
 232i/fV+RP/5l/XjJtEjV/bCbbsfLA76SmcKx6Q8j+OmF+Nap/KhtP4JYtbErS0C
 gE4WRidoCRjCurLTHn5srqYHmqG5kewxgtAyJEYUi5YxP0LHD0h5NhDd/n8ZB1oY
 6f+MfIkIbMmMs/ILnjpVFtLD8iRma1X8APcF4x2m+w+BH839fqefzXjpcMoE3laf
 h6BHys7mDgVTcHStML61OzC4vPbwRsJX+YTLcC0fO1pftl3q/qCqTBy0hlohfX9Q
 iHCjY4qaQz/ufYtQjAG+z6JWKswlKiHUzRt69TWc5tYQM3vvhUZ9+bd0oU+q0UUv
 OJlht505QA41lMssMo49QgjZIXO9HIFKsg99J9zBtYUwbanwkIhLNc+6xZIb09BG
 0JYNXbSoUHlW8nniXHIPQzK/5qs11IV7vued+SoqNU9z9koSBuf5Im1L2tZDzbgz
 he0w+paGfskAIXIQD2LzP8YmIWOb28Nq/DgeQ4/iJRXrhvw20XxbbGZQgzQdPyN7
 oFjaMEDIbve0XbNEQXwr
 =HBmE
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "This is really three fixes, but the SES one comes in a bundle of three
  (making the replacement API available properly, using it and removing
  the non-working one).  The SES problem causes an oops on hpsa devices
  because they attach virtual disks to the host which aren't SAS
  attached (the replacement API ignores them).

  The other two fixes are fairly minor: the sense key one means we
  actually resolve a newly added sense key and the RDAC device
  blacklisting is needed to prevent us annoying the universal XPORT lun
  of various RDAC arrays"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: sas: remove is_sas_attached()
  scsi: ses: use scsi_is_sas_rphy instead of is_sas_attached
  scsi: sas: provide stub implementation for scsi_is_sas_rphy
  scsi: blacklist all RDAC devices for BLIST_NO_ULD_ATTACH
  scsi: fix upper bounds check of sense key in scsi_sense_key_string()
2016-09-06 11:06:52 -07:00
Linus Torvalds
ec9a03d47e regmap: Fixes for v4.8
Several fixes here, the main one being the change from Lars-Peter which
 I'd been letting soak in -next since the merge window in case it
 uncovered further issues as it's a minimal fix rather than a change
 addressing the root cause of the problems (which would've been too
 invasive for -rc):
 
  - The biggest change is a fix from Lars-Peter to ensure that we don't
    create overlapping rbtree nodes which in turn avoids returning
    corrupt cache values to users, fixing some issues that were exposed
    by some recent optimisations with certain access patterns but had
    been present for a long time.
  - A fix from Elaine Zhang to stop us updating the cache if we get an
    I/O error when writing to the hardware.
  - A fix fromm Maarten ter Huurne to avoid uninitialized defaults in
    cases where we have non-readable registers but are initializing the
    cache by reading from the device.
 -----BEGIN PGP SIGNATURE-----
 
 iQEwBAABCAAaBQJXzrAXExxicm9vbmllQGtlcm5lbC5vcmcACgkQJNaLcl1Uh9DK
 6Af/eRh/gD5Bp6DheOkrCNNj/jx0QlkAlgtkFzZBVp4AetirO3UZ3hwUyFCGyLWw
 n2Ohmt54s3BHsvqy+YTrVD57AueI+chAOvKWJ6sYHxiPByy8KuVH+KmffhDHXjyd
 gpIHPAMYnlYknTwitagbyWPA1vuAd4JWCqmJ7Nd/Fxl+Q9fY3PhsXSBXdcejWTtm
 Su8XIhCtykTCTGijg4I/ZNeOLk1xPEWMiX+P/0knOpgE+9ATWq33UIWInoXe02bs
 xITHse40BQUKCfoJKZjJGX3uSnluKpOvojIbcJhcHFYjJpeoU+4kj1Gd4UHMQ8vB
 n8OpZYDKU3KdEHjIZBqbk0wFDw==
 =cYjC
 -----END PGP SIGNATURE-----

Merge tag 'regmap-fix-v4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap

Pull regmap fixes from Mark Brown:
 "Several fixes here, the main one being the change from Lars-Peter
  which I'd been letting soak in -next since the merge window in case it
  uncovered further issues as it's a minimal fix rather than a change
  addressing the root cause of the problems (which would've been too
  invasive for -rc):

   - The biggest change is a fix from Lars-Peter to ensure that we don't
     create overlapping rbtree nodes which in turn avoids returning
     corrupt cache values to users, fixing some issues that were exposed
     by some recent optimisations with certain access patterns but had
     been present for a long time.

   - A fix from Elaine Zhang to stop us updating the cache if we get an
     I/O error when writing to the hardware.

   - A fix fromm Maarten ter Huurne to avoid uninitialized defaults in
     cases where we have non-readable registers but are initializing the
     cache by reading from the device"

* tag 'regmap-fix-v4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: drop cache if the bus transfer error
  regmap: rbtree: Avoid overlapping nodes
  regmap: cache: Fix num_reg_defaults computation from reg_defaults_raw
2016-09-06 11:02:36 -07:00
Linus Torvalds
8ded8f0030 spi: Fixes for v4.8
As well as the usual driver fixes there's a couple of non-trivial core
 fixes in here:
 
  - Fixes for issues reported by Julia Lawall in the changes that were
    sent last time to fix interaction between the bus lock and the
    locking done for the SPI thread.  I'd let this one cook for a while
    to make sure nothing else came up in testing.
  - A fix from Sien Wu arithmetic overflows when calculating the timeout
    for larger transfers (espcially common with slow buses with flashes
    on them).
 -----BEGIN PGP SIGNATURE-----
 
 iQEwBAABCAAaBQJXzq2lExxicm9vbmllQGtlcm5lbC5vcmcACgkQJNaLcl1Uh9A1
 wQf/Vpu3Yjc54vHrjhCKj0Obps0uNontCjmWlBPLb4WskJ9OMtsmDtKaO5xVJPKE
 d3786Bb3xnKxJXfb8FJlWI4zH19JYxycZUqc7C77TwDtY/tFFtjRdwe30nv1JqOE
 87ieyTSvJX4qYSjidf4aB+zQCz0V3lakP2CB9vte/hHbThFGBZ9PY7M7EdINubi6
 DhT+g8ra3X6IOl8HnojfHDQIfTJB77vrblDyUcL6gI5O7Ol6k5R5m7pTlOp8zkPN
 qMkHkqafX0x0ntcDanRhfhxJTXh8CkNfpWl/nj1fZ2wYIQQVHsOuAeKmZ9+pDrYB
 oJX+BVmK3hzNGuRyH6/1UqGs6Q==
 =idNX
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "As well as the usual driver fixes there's a couple of non-trivial core
  fixes in here:

   - Fixes for issues reported by Julia Lawall in the changes that were
     sent last time to fix interaction between the bus lock and the
     locking done for the SPI thread.  I'd let this one cook for a while
     to make sure nothing else came up in testing.

   - A fix from Sien Wu for arithmetic overflows when calculating the
     timeout for larger transfers (espcially common with slow buses with
     flashes on them)"

* tag 'spi-fix-v4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: Prevent unexpected SPI time out due to arithmetic overflow
  spi: pxa2xx-pci: fix ACPI-based enumeration of SPI devices
  MAINTAINERS: add myself as Samsung SPI maintainer
  spi: Drop io_mutex in error paths
  spi: sh-msiof: Avoid invalid clock generator parameters
  spi: img-spfi: Remove spi_master_put in img_spfi_remove()
  spi: mediatek: remove spi_master_put in mtk_spi_remove()
  spi: qup: Remove spi_master_put in spi_qup_remove()
2016-09-06 10:59:44 -07:00
Linus Torvalds
8fa5729dc2 regulator: Fixes for v4.8
Two things here, one an e-mail update for Krzysztof Kozlowski and the
 other a couple of fixes for issues with incorrectly described voltages
 in a couple of the Qualcomm regulator drivers that were breaking MMC on
 some platforms.
 -----BEGIN PGP SIGNATURE-----
 
 iQEwBAABCAAaBQJXzqufExxicm9vbmllQGtlcm5lbC5vcmcACgkQJNaLcl1Uh9CP
 DQf/RNBJQVXb3Zr0ehM+/sNJBBhYQhoK8sbsKjL1y47mXttcP5LfiOEazM8VfoET
 33tkGvGVbtIvdI/iHu9QAQmqSYTLzFEmlvKOqWtVG+AjDFzT1MfQzUHTpTJfAXO0
 IDRxXULK9SLl5lUGF3CnhE2yzqACBcDDrVrso+y86jTAguP+MMYobk2GMUflMW5l
 UQbT5UJ3LcBCrw+vVNSKPZWup0CMnvpXVgFJcM4LOWv5fkzXkPQt0ky6AwPjoGB0
 IVRExi9UtcQxAzeQRDBfj2os+fhYxcf+2zBmLdlRXGIvcZ9Hg9ZdroCq4/hBqLs/
 yopZOW9OO8oun2i67eWsHo0YJw==
 =S9iL
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fixes from Mark Brown:
 "Two things here, one an e-mail update for Krzysztof Kozlowski and the
  other a couple of fixes for issues with incorrectly described voltages
  in a couple of the Qualcomm regulator drivers that were breaking MMC
  on some platforms"

* tag 'regulator-fix-v4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: Change Krzysztof Kozlowski's email to kernel.org
  regulator: qcom_smd: Fix voltage ranges for pma8084 ftsmps and pldo
  regulator: qcom_smd: Fix voltage ranges for pm8x41
2016-09-06 10:43:54 -07:00
Linus Torvalds
4c601e0df7 Pin control fixes for the v4.8 development cycle, all
SoC-specific driver fixes:
 - Fix routing problems in pistachio (Imagination) and
   sunxi (AllWinner)
 - Fix an interrupt problem in the Cherryview (Intel)
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJXzngKAAoJEEEQszewGV1zDX0P+wUhZ0tYyr6yG3e3eAC50tU2
 QuBCcFfoI4j11pxFEwyfcYgzKPR31igL/W1r8t4AmoXVqvkd/9Rbmndfm4+uTMnx
 Y95TkD5krSOUceQMTO9FAimeTRQtLdDYS7oN3SWDLwCSRl2bchdTDHpMgP5ngt1m
 Grju6x20s6DoKtkmaWIJPUoz0hQQ1t4mhPH7gH6Ik6McG9tdia7BdOkRNcb6+6nW
 R7o02vvVXVdYcjyvohu97eUDovUGGrWn3Z7YmfJV6gEjotLI/IoLFhDqI/BxV6Dg
 E3KTaDLFvSefPMzCnQq1mK13pffk9YSwM5K2IReyLTqtD4e5nR5QxBjasKMy4VYV
 0safWOgVH4BAejqSUYkRDMmWgOEIBG/nugL0kmKhbJ8aFtWZCqxLkBVFIMZC6sFB
 evQqen969xt/ByFsfeJFCgcl9lKUstZz4jK/c5ZH45+HjRPD3IhZAYiqbD/ZQD/0
 Qy92xwAIPyqwNOCA7OOTmuO8/P2wShU2hYTahMgKiLJxAmxijo8N11lwrrWnH2Zm
 7P2cKeW9z0UcIO8Mm97720QueRYoOK0QAbxZIGryaeEdhPn4ZolejxThNdJuBabB
 aOtnQPkQOYhx6cfzWL4awqm4PzcXjCaueBvKQdUhCx+YCOPJDCKJLURUQbwD+qZK
 Izqb2OchSakRkowIe9Rn
 =uncw
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v4.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:
 "Nothing special at all, just three SoC-specific driver fixes:

   - Fix routing problems in pistachio (Imagination) and sunxi
     (AllWinner)

   - Fix an interrupt problem in the Cherryview (Intel)"

* tag 'pinctrl-v4.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: sunxi: fix uart1 CTS/RTS pins at PG on A23/A33
  pinctrl: cherryview: Do not mask all interrupts in probe
  pinctrl: pistachio: fix mfio pll_lock pinmux
2016-09-06 10:36:12 -07:00
Wang Xiaoguang
ce129655c9 btrfs: introduce tickets_id to determine whether asynchronous metadata reclaim work makes progress
In btrfs_async_reclaim_metadata_space(), we use ticket's address to
determine whether asynchronous metadata reclaim work is making progress.

	ticket = list_first_entry(&space_info->tickets,
				  struct reserve_ticket, list);
	if (last_ticket == ticket) {
		flush_state++;
	} else {
		last_ticket = ticket;
		flush_state = FLUSH_DELAYED_ITEMS_NR;
		if (commit_cycles)
			commit_cycles--;
	}

But indeed it's wrong, we should not rely on local variable's address to
do this check, because addresses may be same. In my test environment, I
dd one 168MB file in a 256MB fs, found that for this file, every time
wait_reserve_ticket() called, local variable ticket's address is same,

For above codes, assume a previous ticket's address is addrA, last_ticket
is addrA. Btrfs_async_reclaim_metadata_space() finished this ticket and
wake up it, then another ticket is added, but with the same address addrA,
now last_ticket will be same to current ticket, then current ticket's flush
work will start from current flush_state, not initial FLUSH_DELAYED_ITEMS_NR,
which may result in some enospc issues(I have seen this in my test machine).

Signed-off-by: Wang Xiaoguang <wangxg.fnst@cn.fujitsu.com>
Reviewed-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: David Sterba <dsterba@suse.com>
2016-09-06 16:31:43 +02:00
Chris Mason
cbd60aa7cd Btrfs: remove root_log_ctx from ctx list before btrfs_sync_log returns
We use a btrfs_log_ctx structure to pass information into the
tree log commit, and get error values out.  It gets added to a per
log-transaction list which we walk when things go bad.

Commit d1433debe added an optimization to skip waiting for the log
commit, but didn't take root_log_ctx out of the list.  This
patch makes sure we remove things before exiting.

Signed-off-by: Chris Mason <clm@fb.com>
Fixes: d1433debe7
cc: stable@vger.kernel.org # 3.15+
2016-09-06 05:57:25 -07:00
Dirk Behme
87260d3f7a thermal: rcar_thermal: Fix priv->zone error handling
In case thermal_zone_xxx_register() returns an error, priv->zone
isn't NULL any more, but contains the error code.

This is passed to thermal_zone_device_unregister(), then. This checks
for priv->zone being NULL, but the error code is != NULL. So it works
with the error code as a pointer. Crashing immediately.

To fix this, reset priv->zone to NULL before entering
rcar_gen3_thermal_remove().

Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
2016-09-06 20:46:06 +08:00
Mark Brown
ae4860b533 Merge remote-tracking branches 'spi/fix/lock', 'spi/fix/maintainers', 'spi/fix/put', 'spi/fix/pxa2xx', 'spi/fix/sh-msiof' and 'spi/fix/timeout' into spi-linus 2016-09-06 12:32:09 +01:00
Mark Brown
78cefcbe60 Merge remote-tracking branches 'regulator/fix/email' and 'regulator/fix/qcom-smd' into regulator-linus 2016-09-06 12:31:34 +01:00
Marc Zyngier
d2896d4b55 arm: KVM: Fix idmap overlap detection when the kernel is idmap'ed
We're trying hard to detect when the HYP idmap overlaps with the
HYP va, as it makes the teardown of a cpu dangerous. But there is
one case where an overlap is completely safe, which is when the
whole of the kernel is idmap'ed, which is likely to happen on 32bit
when RAM is at 0x8000000 and we're using a 2G/2G VA split.

In that case, we can proceed safely.

Reported-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
2016-09-06 13:09:31 +02:00
Jiri Olsa
79d102cbfd perf/x86/intel/cqm: Check cqm/mbm enabled state in event init
Yanqiu Zhang reported kernel panic when using mbm event
on system where CQM is detected but without mbm event
support, like with perf:

  # perf stat -e 'intel_cqm/event=3/' -a

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
  IP: [<ffffffff8100d64c>] update_sample+0xbc/0xe0
  ...
   <IRQ>
   [<ffffffff8100d688>] __intel_mbm_event_init+0x18/0x20
   [<ffffffff81113d6b>] flush_smp_call_function_queue+0x7b/0x160
   [<ffffffff81114853>] generic_smp_call_function_single_interrupt+0x13/0x60
   [<ffffffff81052017>] smp_call_function_interrupt+0x27/0x40
   [<ffffffff816fb06c>] call_function_interrupt+0x8c/0xa0
  ...

The reason is that we currently allow to init mbm event
even if mbm support is not detected.  Adding checks for
both cqm and mbm events and support into cqm's event_init.

Fixes: 33c3cc7acf ("perf/x86/mbm: Add Intel Memory B/W Monitoring enumeration and init")
Reported-by: Yanqiu Zhang <yanqzhan@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@redhat.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Vikas Shivappa <vikas.shivappa@linux.intel.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/1473089407-21857-1-git-send-email-jolsa@kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2016-09-06 10:42:12 +02:00
Colin Ian King
3ff488ab60 usb: gadget: prevent potenial null pointer dereference on skb->len
An earlier fix partially fixed the null pointer dereference on skb->len
by moving the assignment of len after the check on skb being non-null,
however it failed to remove the erroneous dereference when assigning len.
Correctly fix this by removing the initialisation of len as was
originally intended.

Fixes: 70237dc8ef ("usb: gadget: function: f_eem: socket buffer may be NULL")
Acked-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-09-06 10:44:03 +03:00
Gavin Shan
b314427a52 powerpc/powernv: Fix crash on releasing compound PE
The compound PE is created to accommodate the devices attached to
one specific PCI bus that consume multiple M64 segments. The compound
PE is made up of one master PE and possibly multiple slave PEs. The
slave PEs should be destroyed when releasing the master PE. A kernel
crash happens when derferencing @pe->pdev on releasing the slave PE
in pnv_ioda_deconfigure_pe().

  # echo 0 > /sys/bus/pci/slots/C7/power
  iommu: Removing device 0000:01:00.1 from group 0
  iommu: Removing device 0000:01:00.0 from group 0
  Unable to handle kernel paging request for data at address 0x00000010
  Faulting instruction address: 0xc00000000005d898
  cpu 0x1: Vector: 300 (Data Access) at [c000000fe8217620]
      pc: c00000000005d898: pnv_ioda_release_pe+0x288/0x610
      lr: c00000000005dbdc: pnv_ioda_release_pe+0x5cc/0x610
      sp: c000000fe82178a0
     msr: 9000000000009033
     dar: 10
   dsisr: 40000000
    current = 0xc000000fe815ab80
    paca    = 0xc00000000ff00400	 softe: 0	 irq_happened: 0x01
      pid   = 2709, comm = sh
  Linux version 4.8.0-rc5-gavin-00006-g745efdb (gwshan@gwshan) \
  (gcc version 4.9.3 (Buildroot 2016.02-rc2-00093-g5ea3bce) ) #586 SMP \
  Tue Sep 6 13:37:29 AEST 2016
  enter ? for help
  [c000000fe8217940] c00000000005d684 pnv_ioda_release_pe+0x74/0x610
  [c000000fe82179e0] c000000000034460 pcibios_release_device+0x50/0x70
  [c000000fe8217a10] c0000000004aba80 pci_release_dev+0x50/0xa0
  [c000000fe8217a40] c000000000704898 device_release+0x58/0xf0
  [c000000fe8217ac0] c000000000470510 kobject_release+0x80/0xf0
  [c000000fe8217b00] c000000000704dd4 put_device+0x24/0x40
  [c000000fe8217b20] c0000000004af94c pci_remove_bus_device+0x12c/0x150
  [c000000fe8217b60] c000000000034244 pci_hp_remove_devices+0x94/0xd0
  [c000000fe8217ba0] c0000000004ca444 pnv_php_disable_slot+0x64/0xb0
  [c000000fe8217bd0] c0000000004c88c0 power_write_file+0xa0/0x190
  [c000000fe8217c50] c0000000004c248c pci_slot_attr_store+0x3c/0x60
  [c000000fe8217c70] c0000000002d6494 sysfs_kf_write+0x94/0xc0
  [c000000fe8217cb0] c0000000002d50f0 kernfs_fop_write+0x180/0x260
  [c000000fe8217d00] c0000000002334a0 __vfs_write+0x40/0x190
  [c000000fe8217d90] c000000000234738 vfs_write+0xc8/0x240
  [c000000fe8217de0] c000000000236250 SyS_write+0x60/0x110
  [c000000fe8217e30] c000000000009524 system_call+0x38/0x108

It fixes the kernel crash by bypassing releasing resources (DMA,
IO and memory segments, PELTM) because there are no resources assigned
to the slave PE.

Fixes: c5f7700bbd ("powerpc/powernv: Dynamically release PE")
Reported-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-09-06 14:54:46 +10:00
Benjamin Herrenschmidt
f8e33475b0 powerpc/xics/opal: Fix processor numbers in OPAL ICP
When using the OPAL ICP backend we incorrectly pass Linux CPU numbers
rather than HW CPU numbers to OPAL.

Fixes: d74361881f ("powerpc/xics: Add ICP OPAL backend")
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-09-06 14:54:45 +10:00
Thiago Jung Bauermann
d81d825821 powerpc/pseries: Fix little endian build with CONFIG_KEXEC=n
On ppc64le, builds with CONFIG_KEXEC=n fail with:

arch/powerpc/platforms/pseries/setup.c: In function ‘pseries_big_endian_exceptions’:
arch/powerpc/platforms/pseries/setup.c:403:13: error: implicit declaration of function ‘kdump_in_progress’
  if (rc && !kdump_in_progress())

This is because pseries/setup.c includes <linux/kexec.h>, but
kdump_in_progress() is defined in <asm/kexec.h>. This is a problem
because the former only includes the latter if CONFIG_KEXEC_CORE=y.

Fix it by including <asm/kexec.h> directly, as is done in powernv/setup.c.

Fixes: d3cbff1b5a ("powerpc: Put exception configuration in a common place")
Signed-off-by: Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2016-09-06 14:54:08 +10:00
Gregor Boirie
171c009183 iio:core: fix IIO_VAL_FRACTIONAL sign handling
7985e7c100 ("iio: Introduce a new fractional value type") introduced a
new IIO_VAL_FRACTIONAL value type meant to represent rational type numbers
expressed by a numerator and denominator combination.

Formating of IIO_VAL_FRACTIONAL values relies upon do_div() usage. This
fails handling negative values properly since parameters are reevaluated
as unsigned values.
Fix this by using div_s64_rem() instead. Computed integer part will carry
properly signed value. Formatted fractional part will always be positive.

Fixes: 7985e7c100 ("iio: Introduce a new fractional value type")
Signed-off-by: Gregor Boirie <gregor.boirie@parrot.com>
Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2016-09-05 21:21:32 +01:00
Colin Ian King
5dba4b14ba iio: ensure ret is initialized to zero before entering do loop
A recent fix to iio_buffer_read_first_n_outer removed ret from being set by
a return from wait_event_interruptible and also added a continue in a loop
which causes the variable ret to not be set when it reaches the end of the
loop.  Fix this by initializing ret to zero.

Also remove extraneous white space at the end of the loop.

Fixes: fcf68f3c0b ("fix sched WARNING "do not call blocking ops when !TASK_RUNNING")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2016-09-05 21:00:14 +01:00
Linus Torvalds
bc4dee5aa7 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
 "This fixes a regression in the cryptd code that breaks certain
  accelerated AED algorithms as well as an older regression in the
  caam driver that breaks IPsec"

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: caam - fix IV loading for authenc (giv)decryption
  crypto: cryptd - Use correct tfm object for AEAD tracking
2016-09-05 11:10:00 -07:00
Linus Torvalds
56291b271b Merge branch 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild
Pull kbuild fix from Michal Marek:
 "Fix for 'make deb-pkg'.  The bug got introduced in v4.8-rc1"

* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  builddeb: Skip gcc-plugins when not configured
2016-09-05 10:55:55 -07:00
Wang Xiaoguang
ed7a694839 btrfs: do not decrease bytes_may_use when replaying extents
When replaying extents, there is no need to update bytes_may_use
in btrfs_alloc_logged_file_extent(), otherwise it'll trigger a
WARN_ON about bytes_may_use.

Fixes: ("btrfs: update btrfs_space_info's bytes_may_use timely")
Signed-off-by: Wang Xiaoguang <wangxg.fnst@cn.fujitsu.com>
Reviewed-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: David Sterba <dsterba@suse.com>
2016-09-05 17:40:41 +02:00
Thomas Gleixner
cbf2f8a99a * Make for_each_efi_memory_desc_in_map() safe on Xen and prevent an
infinte loop - Jan Beulich
 
  * Fix boot error on arm64 Qualcomm platforms by refactoring and
    improving the ExitBootServices() hack we already for x86 and moving
    it to the libstub - Jeffrey Hugo
 
  * Use correct return data type for of_get_flat_dt_subnode_by_name()
    so that we correctly handle errors - Andrzej Hajda
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQI2BAABCAAgBQJXzV7+GRxtYXR0QGNvZGVibHVlcHJpbnQuY28udWsACgkQLzhZ
 wI0jPVX3gw//QCwvGUJeDwQ7OGbZ5NiwBSo1gUZorkrO3GbRWAcMCAZpp2GkGjvO
 VMreLCGrvRQD8UDeMswD/I122ro7B32NHqolgnRaXieJK3lVkbBRa21PR1Fz3ySw
 kDFxuZLogaWawIf2m8EhW4IFO5Te9d1xtFteEtnk3MivNY2SpbvoGk2xZCRIbDju
 DadkS445bhx1nUlB4KnEywlS/a/+4AGoNgoJ9mf7hyuKH1Hgpk+6CMxRT8YjoOvY
 rdZ4cdXuEz//aRBZGRAj70fRVxjuZlH+04JUepeWteQrCLCMXwhnaW3ngPXfdsIY
 7LAf+P8G8nZhaTawOa+xu2wj9kwgjkHtligGtBw0Rr5HcADOD7NDPMynSe9L5zcT
 QyhCB4JKzCyuJU/Fg/WmdfuP82SJu3OYp2jzas/sl7iXV2eX6VctLM/sBHKIvLiA
 +RQ8jSf3i9NiIqzQE3rZpa0sswq2Oe2Nl270vU8AYUUx0zMDnZZNeE9Ev/Ym91JT
 0hTs1FNO1jX66/4tykLH8OVW/r+LcipAEj0djnW2al3GQSJZ9XPFR5rJF8cm2SZR
 x6LWDPHIL0FtM8g7XprDBz7Mzt1nfcFcUdn13RafY+TSVJG0ljB7Etu01KQk7McI
 X3c1TqoOJQOxIm27Z8/66v16mPYAvwK+rmabHmmADqh4M9OqAjr8MXI=
 =ozfd
 -----END PGP SIGNATURE-----

Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into efi/urgent

 * Make for_each_efi_memory_desc_in_map() safe on Xen and prevent an
   infinte loop - Jan Beulich

 * Fix boot error on arm64 Qualcomm platforms by refactoring and
   improving the ExitBootServices() hack we already for x86 and moving
   it to the libstub - Jeffrey Hugo

 * Use correct return data type for of_get_flat_dt_subnode_by_name()
   so that we correctly handle errors - Andrzej Hajda
2016-09-05 17:14:17 +02:00
Paolo Bonzini
20218b86ad A bugfix for the vsie code (setting the wrong field).
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJXzVwyAAoJEN7Pa5PG8C+vvI0P/1ftzc6GxS6Pw/CUzjJP3fml
 ts7TdLqobEKiT9ndGT1Fi5CE9w+ST41Hp0Fq1F9O7tTm9CQQ/CGORrokKGvCdUq5
 fSwSXa42utSazoeyHsgmUZQRXJGIVTVLhFazATputvc3+xqO3cZbFLLuDsbyIfjS
 stMuVt/LNYNcudHb+zt38NhwmPU7BdhLwl0jj6TdTquc1yObGVNRXUVlTI2oKJnj
 uX2ggj7UeA66Sagih/DK3yZy8rWircv8REKMmS3jA0NQ1WXoa55PAq4S8nDKDbfx
 7tkYAjwghk+soxJAgenDyILOZJojI1oM4NNKU4uU6xOtoX/BMfA2UbVtXaJA8949
 VQsy/Lqebn/O9moOzoJPkwirWcujRl88C72Z3wnDGqglfJ7FSBoyPMWisAWnlqTU
 L9SdkhmnQ3z4eEzLfzA5JSIINuPIZIitu4iQAiG8feUN4I2s/zkX+vtuewxtxtmR
 pum1kPDp2KEoh5U5mXw5xa9tC0H31YquaUR1Cb148VkvDxXl9rQcjxWawN0fJ+8n
 LFMfAyvS9mfvIkIQS+B4M21irGzHzOjlh14U3gmEbLvDZZj7YHRFH/JPbwsKf1W2
 nQhcYp50BvVu03tAotulj67UhYEtkLzZWrCvTdBrsOVmD2a/sQ6KlA3IlQ19cISA
 CR4lI+Rr3vS5jaNtkrM3
 =6BkY
 -----END PGP SIGNATURE-----

Merge tag 'kvm-s390-master-4.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-master

A bugfix for the vsie code (setting the wrong field).
2016-09-05 16:15:22 +02:00
Wanpeng Li
e12c8f36f3 KVM: lapic: adjust preemption timer correctly when goes TSC backward
TSC_OFFSET will be adjusted if discovers TSC backward during vCPU load.
The preemption timer, which relies on the guest tsc to reprogram its
preemption timer value, is also reprogrammed if vCPU is scheded in to
a different pCPU. However, the current implementation reprogram preemption
timer before TSC_OFFSET is adjusted to the right value, resulting in the
preemption timer firing prematurely.

This patch fix it by adjusting TSC_OFFSET before reprogramming preemption
timer if TSC backward.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krċmář <rkrcmar@redhat.com>
Cc: Yunhong Jiang <yunhong.jiang@intel.com>
Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-05 16:14:39 +02:00
Tejun Heo
c86d06ba28 PM / QoS: avoid calling cancel_delayed_work_sync() during early boot
of_clk_init() ends up calling into pm_qos_update_request() very early
during boot where irq is expected to stay disabled.
pm_qos_update_request() uses cancel_delayed_work_sync() which
correctly assumes that irq is enabled on invocation and
unconditionally disables and re-enables it.

Gate cancel_delayed_work_sync() invocation with kevented_up() to avoid
enabling irq unexpectedly during early boot.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-tested-by: Qiao Zhou <qiaozhou@asrmicro.com>
Link: http://lkml.kernel.org/r/d2501c4c-8e7b-bea3-1b01-000b36b5dfe9@asrmicro.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-09-05 15:07:53 +02:00
Nicolas Iooss
0f5aa88a7b ceph: do not modify fi->frag in need_reset_readdir()
Commit f3c4ebe65e ("ceph: using hash value to compose dentry offset")
modified "if (fpos_frag(new_pos) != fi->frag)" to "if (fi->frag |=
fpos_frag(new_pos))" in need_reset_readdir(), thus replacing a
comparison operator with an assignment one.

This looks like a typo which is reported by clang when building the
kernel with some warning flags:

    fs/ceph/dir.c:600:22: error: using the result of an assignment as a
    condition without parentheses [-Werror,-Wparentheses]
            } else if (fi->frag |= fpos_frag(new_pos)) {
                       ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~
    fs/ceph/dir.c:600:22: note: place parentheses around the assignment
    to silence this warning
            } else if (fi->frag |= fpos_frag(new_pos)) {
                                ^
                       (                             )
    fs/ceph/dir.c:600:22: note: use '!=' to turn this compound
    assignment into an inequality comparison
            } else if (fi->frag |= fpos_frag(new_pos)) {
                                ^~
                                !=

Fixes: f3c4ebe65e ("ceph: using hash value to compose dentry offset")
Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2016-09-05 14:30:35 +02:00
Miklos Szeredi
e1ff3dd1ae ovl: fix workdir creation
Workdir creation fails in latest kernel.

Fix by allowing EOPNOTSUPP as a valid return value from
vfs_removexattr(XATTR_NAME_POSIX_ACL_*).  Upper filesystem may not support
ACL and still be perfectly able to support overlayfs.

Reported-by: Martin Ziegler <ziegler@uni-freiburg.de>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: c11b9fdd6a ("ovl: remove posix_acl_default from workdir")
Cc: <stable@vger.kernel.org>
2016-09-05 13:55:20 +02:00
David Hildenbrand
4d21cef3ea KVM: s390: vsie: fix riccbd
We store the address of riccbd at the wrong location, overwriting
gvrd. This means that our nested guest will not be able to use runtime
instrumentation. Also, a memory leak, if our KVM guest actually sets gvrd.

Not noticed until now, as KVM guests never make use of gvrd and runtime
instrumentation wasn't completely tested yet.

Reported-by: Fan Zhang <zhangfan@linux.vnet.ibm.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2016-09-05 13:48:50 +02:00
Jeffrey Hugo
d64934019f x86/efi: Use efi_exit_boot_services()
The eboot code directly calls ExitBootServices.  This is inadvisable as the
UEFI spec details a complex set of errors, race conditions, and API
interactions that the caller of ExitBootServices must get correct.  The
eboot code attempts allocations after calling ExitBootSerives which is
not permitted per the spec.  Call the efi_exit_boot_services() helper
intead, which handles the allocation scenario properly.

Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
2016-09-05 12:40:16 +01:00
Jeffrey Hugo
ed9cc156c4 efi/libstub: Use efi_exit_boot_services() in FDT
The FDT code directly calls ExitBootServices.  This is inadvisable as the
UEFI spec details a complex set of errors, race conditions, and API
interactions that the caller of ExitBootServices must get correct.  The
FDT code does not handle EFI_INVALID_PARAMETER as required by the spec,
which causes intermittent boot failures on the Qualcomm Technologies
QDF2432.  Call the efi_exit_boot_services() helper intead, which handles
the EFI_INVALID_PARAMETER scenario properly.

Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
2016-09-05 12:32:36 +01:00
Jeffrey Hugo
fc07716ba8 efi/libstub: Introduce ExitBootServices helper
The spec allows ExitBootServices to fail with EFI_INVALID_PARAMETER if a
race condition has occurred where the EFI has updated the memory map after
the stub grabbed a reference to the map.  The spec defines a retry
proceedure with specific requirements to handle this scenario.

This scenario was previously observed on x86 - commit d3768d885c ("x86,
efi: retry ExitBootServices() on failure") but the current fix is not spec
compliant and the scenario is now observed on the Qualcomm Technologies
QDF2432 via the FDT stub which does not handle the error and thus causes
boot failures.  The user will notice the boot failure as the kernel is not
executed and the system may drop back to a UEFI shell, but will be
unresponsive to input and the system will require a power cycle to recover.

Add a helper to the stub library that correctly adheres to the spec in the
case of EFI_INVALID_PARAMETER from ExitBootServices and can be universally
used across all stub implementations.

Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
2016-09-05 12:32:28 +01:00
Jeffrey Hugo
dadb57abc3 efi/libstub: Allocate headspace in efi_get_memory_map()
efi_get_memory_map() allocates a buffer to store the memory map that it
retrieves.  This buffer may need to be reused by the client after
ExitBootServices() is called, at which point allocations are not longer
permitted.  To support this usecase, provide the allocated buffer size back
to the client, and allocate some additional headroom to account for any
reasonable growth in the map that is likely to happen between the call to
efi_get_memory_map() and the client reusing the buffer.

Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
2016-09-05 12:18:17 +01:00
Yoshihiro Shimoda
519d8bd4b5 usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition
The previous driver is possible to stop the transfer wrongly.
For example:
 1) An interrupt happens, but not BRDY interruption.
 2) Read INTSTS0. And than state->intsts0 is not set to BRDY.
 3) BRDY is set to 1 here.
 4) Read BRDYSTS.
 5) Clear the BRDYSTS. And then. the BRDY is cleared wrongly.

Remarks:
 - The INTSTS0.BRDY is read only.
  - If any bits of BRDYSTS are set to 1, the BRDY is set to 1.
  - If BRDYSTS is 0, the BRDY is set to 0.

So, this patch adds condition to avoid such situation. (And about
NRDYSTS, this is not used for now. But, avoiding any side effects,
this patch doesn't touch it.)

Fixes: d5c6a1e024 ("usb: renesas_usbhs: fixup interrupt status clear method")
Cc: <stable@vger.kernel.org> # v3.8+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-09-05 13:39:23 +03:00
Fabio Estevam
7c113f7df7 usb: phy: phy-generic: Check clk_prepare_enable() error
clk_prepare_enable() may fail, so we should better check its return
value and propagate it in the case of failure.

Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-09-05 13:39:23 +03:00
Yoshihiro Shimoda
b2f1eaaee5 usb: gadget: udc: renesas-usb3: clear VBOUT bit in DRD_CON
This driver should clear the bit. Otherwise, the VBUS will output
wrongly if the usb port on a board has VBUS output capability.

Fixes: 746bfe63bb ("usb: gadget: renesas_usb3: add support for
		      Renesas USB3.0 peripheral controller")
Cc: <stable@vger.kernel.org> # v4.5+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-09-05 13:39:23 +03:00
John Youn
9d7aba7786 Revert "usb: dwc3: gadget: always decrement by 1"
This reverts commit 6f8245b4e3 ("usb: dwc3: gadget: always decrement
by 1").

We can't always decrement this value.

We should decrement only if the calculation of free slots results in a
LINK TRB being among one of the free slots (dequeue < enqueue).

Otherwise, if the LINK TRB is not among the free slots then it should
not be decremented.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-09-05 13:39:23 +03:00
Andrzej Hajda
4af9ed578a efi: Fix handling error value in fdt_find_uefi_params
of_get_flat_dt_subnode_by_name can return negative value in case of error.
Assigning the result to unsigned variable and checking if the variable
is lesser than zero is incorrect and always false.
The patch fixes it by using signed variable to check the result.

The problem has been detected using semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci

Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Shawn Lin <shawn.lin@rock-chips.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
2016-09-05 11:26:42 +01:00
Jan Beulich
d4c4fed08f efi: Make for_each_efi_memory_desc_in_map() cope with running on Xen
While commit 55f1ea1521 ("efi: Fix for_each_efi_memory_desc_in_map()
for empty memmaps") made an attempt to deal with empty memory maps, it
didn't address the case where the map field never gets set, as is
apparently the case when running under Xen.

Reported-by: <lists@ssl-mail.com>
Tested-by: <lists@ssl-mail.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org> # v4.7+
Signed-off-by: Jan Beulich <jbeulich@suse.com>
[ Guard the loop with a NULL check instead of pointer underflow ]
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
2016-09-05 11:16:56 +01:00
Balbir Singh
135e8c9250 sched/core: Fix a race between try_to_wake_up() and a woken up task
The origin of the issue I've seen is related to
a missing memory barrier between check for task->state and
the check for task->on_rq.

The task being woken up is already awake from a schedule()
and is doing the following:

	do {
		schedule()
		set_current_state(TASK_(UN)INTERRUPTIBLE);
	} while (!cond);

The waker, actually gets stuck doing the following in
try_to_wake_up():

	while (p->on_cpu)
		cpu_relax();

Analysis:

The instance I've seen involves the following race:

 CPU1					CPU2

 while () {
   if (cond)
     break;
   do {
     schedule();
     set_current_state(TASK_UN..)
   } while (!cond);
					wakeup_routine()
					  spin_lock_irqsave(wait_lock)
   raw_spin_lock_irqsave(wait_lock)	  wake_up_process()
 }					  try_to_wake_up()
 set_current_state(TASK_RUNNING);	  ..
 list_del(&waiter.list);

CPU2 wakes up CPU1, but before it can get the wait_lock and set
current state to TASK_RUNNING the following occurs:

 CPU3
 wakeup_routine()
 raw_spin_lock_irqsave(wait_lock)
 if (!list_empty)
   wake_up_process()
   try_to_wake_up()
   raw_spin_lock_irqsave(p->pi_lock)
   ..
   if (p->on_rq && ttwu_wakeup())
   ..
   while (p->on_cpu)
     cpu_relax()
   ..

CPU3 tries to wake up the task on CPU1 again since it finds
it on the wait_queue, CPU1 is spinning on wait_lock, but immediately
after CPU2, CPU3 got it.

CPU3 checks the state of p on CPU1, it is TASK_UNINTERRUPTIBLE and
the task is spinning on the wait_lock. Interestingly since p->on_rq
is checked under pi_lock, I've noticed that try_to_wake_up() finds
p->on_rq to be 0. This was the most confusing bit of the analysis,
but p->on_rq is changed under runqueue lock, rq_lock, the p->on_rq
check is not reliable without this fix IMHO. The race is visible
(based on the analysis) only when ttwu_queue() does a remote wakeup
via ttwu_queue_remote. In which case the p->on_rq change is not
done uder the pi_lock.

The result is that after a while the entire system locks up on
the raw_spin_irqlock_save(wait_lock) and the holder spins infintely

Reproduction of the issue:

The issue can be reproduced after a long run on my system with 80
threads and having to tweak available memory to very low and running
memory stress-ng mmapfork test. It usually takes a long time to
reproduce. I am trying to work on a test case that can reproduce
the issue faster, but thats work in progress. I am still testing the
changes on my still in a loop and the tests seem OK thus far.

Big thanks to Benjamin and Nick for helping debug this as well.
Ben helped catch the missing barrier, Nick caught every missing
bit in my theory.

Signed-off-by: Balbir Singh <bsingharora@gmail.com>
[ Updated comment to clarify matching barriers. Many
  architectures do not have a full barrier in switch_to()
  so that cannot be relied upon. ]
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Alexey Kardashevskiy <aik@ozlabs.ru>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Nicholas Piggin <nicholas.piggin@gmail.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/e02cce7b-d9ca-1ad0-7a61-ea97c7582b37@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-09-05 11:57:53 +02:00
Peter Zijlstra
5876314875 perf/core: Remove WARN from perf_event_read()
This effectively reverts commit:

  71e7bc2bab ("perf/core: Check return value of the perf_event_read() IPI")

... and puts in a comment explaining why we ignore the return value.

Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: David Carrillo-Cisneros <davidcc@google.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 71e7bc2bab ("perf/core: Check return value of the perf_event_read() IPI")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-09-05 11:55:00 +02:00
Johannes Berg
d7127b5e5f locking/barriers: Don't use sizeof(void) in lockless_dereference()
My previous commit:

  112dc0c806 ("locking/barriers: Suppress sparse warnings in lockless_dereference()")

caused sparse to complain that (in radix-tree.h) we use sizeof(void)
since that rcu_dereference()s a void *.

Really, all we need is to have the expression *p in here somewhere
to make sure p is a pointer type, and sizeof(*p) was the thing that
came to my mind first to make sure that's done without really doing
anything at runtime.

Another thing I had considered was using typeof(*p), but obviously
we can't just declare a typeof(*p) variable either, since that may
end up being void. Declaring a variable as typeof(*p)* gets around
that, and still checks that typeof(*p) is valid, so do that. This
type construction can't be done for _________p1 because that will
actually be used and causes sparse address space warnings, so keep
a separate unused variable for it.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E . McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: kbuild-all@01.org
Fixes: 112dc0c806 ("locking/barriers: Suppress sparse warnings in lockless_dereference()")
Link: http://lkml.kernel.org/r/1472192160-4049-1-git-send-email-johannes@sipsolutions.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-09-05 11:50:42 +02:00
Borislav Petkov
cc2187a6e0 x86/microcode/AMD: Fix load of builtin microcode with randomized memory
We do not need to add the randomization offset when the microcode is
built in.

Reported-and-tested-by: Emanuel Czirai <icanrealizeum@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: http://lkml.kernel.org/r/20160904093736.GA11939@pd.tnic
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2016-09-05 10:38:56 +02:00
Fabio Estevam
f065e9e4ad ARM: dts: imx6qdl: Fix SPDIF regression
Commit 833f2cbf70 ("ARM: dts: imx6: change the core clock of spdif")
changed many more clocks than only the SPDIF core clock as stated in
the commit message.

The MLB clock has been added and this causes SPDIF regression as
reported by Xavi Drudis Ferran and also in this forum post:
https://forum.digikey.com/thread/34240

The MX6Q Reference Manual does not mention that MLB is a clock related
to SPDIF, so change it back to a dummy clock to restore SPDIF
functionality.

Thanks to Ambika for providing the fix at:
https://community.nxp.com/thread/387131

Fixes: 833f2cbf70 ("ARM: dts: imx6: change the core clock of spdif")
Cc: <stable@vger.kernel.org> # 4.4.x
Reported-by: Xavi Drudis Ferran <xdrudis@tinet.cat>
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Tested-by:  Xavi Drudis Ferran <xdrudis@tinet.cat>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2016-09-05 10:30:58 +08:00
Linus Torvalds
c6935931c1 Linux 4.8-rc5 2016-09-04 14:31:46 -07:00
Linus Torvalds
6e1ce3c345 af_unix: split 'u->readlock' into two: 'iolock' and 'bindlock'
Right now we use the 'readlock' both for protecting some of the af_unix
IO path and for making the bind be single-threaded.

The two are independent, but using the same lock makes for a nasty
deadlock due to ordering with regards to filesystem locking.  The bind
locking would want to nest outside the VSF pathname locking, but the IO
locking wants to nest inside some of those same locks.

We tried to fix this earlier with commit c845acb324 ("af_unix: Fix
splice-bind deadlock") which moved the readlock inside the vfs locks,
but that caused problems with overlayfs that will then call back into
filesystem routines that take the lock in the wrong order anyway.

Splitting the locks means that we can go back to having the bind lock be
the outermost lock, and we don't have any deadlocks with lock ordering.

Acked-by: Rainer Weikusat <rweikusat@cyberadapt.com>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-04 13:29:29 -07:00
Linus Torvalds
38f7bd94a9 Revert "af_unix: Fix splice-bind deadlock"
This reverts commit c845acb324.

It turns out that it just replaces one deadlock with another one: we can
still get the wrong lock ordering with the readlock due to overlayfs
calling back into the filesystem layer and still taking the vfs locks
after the readlock.

The proper solution ends up being to just split the readlock into two
pieces: the bind lock (taken *outside* the vfs locks) and the IO lock
(taken *inside* the filesystem locks).  The two locks are independent
anyway.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-04 13:29:29 -07:00
David S. Miller
2f83a53a81 Merge branch 'vxlan-fixes'
Jiri Benc says:

====================
vxlan: fix error reporting

This patchset improves checking for invalid configuration in VXLAN and
fixes problems with duplicated and inappropriate error messages.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-04 11:42:57 -07:00
Jiri Benc
3555621de7 vxlan: fix duplicated and wrong error messages
vxlan_dev_configure outputs error messages before returning, no need to
print again the same mesages in vxlan_newlink. Also, vxlan_dev_configure may
return a particular error code for a different reason than vxlan_newlink
thinks.

Move the remaining error messages into vxlan_dev_configure and let
vxlan_newlink just pass on the error code.

Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-04 11:42:56 -07:00
Jiri Benc
9b4cdd516d vxlan: reject multicast destination without an interface
Currently, kernel accepts configurations such as:

  ip l a type vxlan dstport 4789 id 1 group 239.192.0.1
  ip l a type vxlan dstport 4789 id 1 group ff0e::110

However, neither of those really works. In the IPv4 case, the interface
cannot be brought up ("RTNETLINK answers: No such device"). This is because
multicast join will be rejected without the interface being specified.

In the IPv6 case, multicast wil be joined on the first interface found. This
is not what the user wants as it depends on random factors (order of
interfaces).

Note that it's possible to add a local address but it doesn't solve
anything. For IPv4, it's not considered in the multicast join (thus the same
error as above is returned on ifup). This could be added but it wouldn't
help for IPv6 anyway. For IPv6, we do need the interface.

Just reject a configuration that sets multicast address and does not provide
an interface. Nobody can depend on the previous behavior as it never worked.

Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-04 11:42:56 -07:00