Commit Graph

665443 Commits

Author SHA1 Message Date
Lucas Stach
8ed81ec82a PCI: mvebu: Change delay after reset to the PCIe spec mandated 100ms
The current default of 20ms cause some devices, which are slow to
initialize, to not show up during the bus scanning.  Change this to the
PCIe spec mandated 100ms and document this in the DT binding.

From PCIe base spec rev 3.0, chapter "6.6.1. Conventional Reset":

  To allow components to perform internal initialization, system software
  must wait a specified minimum period following the end of a Conventional
  Reset of one or more devices before it is permitted to issue
  Configuration Requests to those devices.

  With a Downstream Port that does not support Link speeds greater than 5.0
  GT/s, software must wait a minimum of 100 ms before sending a
  Configuration Request to the device immediately below that Port.

Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Jason Cooper <jason@lakedaemon.net>
2017-02-08 13:33:57 -06:00
Mark Rutland
76624175dc arm64: uaccess: consistently check object sizes
Currently in arm64's copy_{to,from}_user, we only check the
source/destination object size if access_ok() tells us the user access
is permissible.

However, in copy_from_user() we'll subsequently zero any remainder on
the destination object. If we failed the access_ok() check, that applies
to the whole object size, which we didn't check.

To ensure that we catch that case, this patch hoists check_object_size()
to the start of copy_from_user(), matching __copy_from_user() and
__copy_to_user(). To make all of our uaccess copy primitives consistent,
the same is done to copy_to_user().

Cc: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2017-02-08 19:32:54 +00:00
Neil Leeder
21bdbb7102 perf: add qcom l2 cache perf events driver
Adds perf events support for L2 cache PMU.

The L2 cache PMU driver is named 'l2cache_0' and can be used
with perf events to profile L2 events such as cache hits
and misses on Qualcomm Technologies processors.

Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Neil Leeder <nleeder@codeaurora.org>
[will: minimise nesting in l2_cache_associate_cpu_with_cluster]
[will: use kstrtoul for unsigned long, remove redunant .owner setting]
Signed-off-by: Will Deacon <will.deacon@arm.com>
2017-02-08 19:32:24 +00:00
Kalle Valo
cbda794cf1 Some patches focusing on bugfixes for v4.11:
* Fix 802.11w, which was failing to due an IGTK bug;
   * A few more bugzilla bug fixes;
   * A channel-switch race condition fix;
   * Some fixes related to suspend/resume with new HW;
   * The RF-kill saga continues;
   * And some other fixes here and there...
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEF3LNfgb2BPWm68smoUecoho8xfoFAlibZVQACgkQoUecoho8
 xfp+EQ/+K1/pgC4XfjifbLVZFHVhTnTVl9Nym2LkLIH7kEQPiTQXUMXlHkQZv546
 ir1neeqKdidqQZlaM0gFpc/DWgiMxWui/e6Va1oegr0ZqcxUNN3+CXo1bTL88kmu
 CTYjPVnjOFRZLxaXt/9wBkJ2ktWNSb8BYeK6Ftj21iX9xyf2xBSCV2En+aB6dhv1
 1UbOLPn8raqubAFn1ZcwEZw2Ems4xyrOlriHNHOzhCsXG+PE0d+OxtxcVcQXF7nu
 lyqVCYgREIz0114MrLTlo5atur2LKLZqfRrkP+fgjsOekgHWMF5yyB9zpoO/TTcQ
 jVpAs2P4q5uDqMRI5BM3qVB7XPt3HDYLpTb1pyf+EL4yR/3NgN4QdB8vzZm32QgN
 0Of97AIlJOkO8FRVhHyI2z6QO6vHBVK+tzyrV1FCTc+ZQYfnj+r3hRYPCCFr/UW8
 2fB3esPiKRD6cXng8fJkFIw79e9erEgOl8hi5IbUG0zVbetDhZrtevjFrDoFzI7E
 X9LSoIcCA6J616T/k6Vi2e40xVq3u5GbYTSg8GvX+TDI0UPfKJrx6AoSImxaPGzh
 ByQ5Ib+xOQo6oZsNy27cw8cDGojWlHp2s0xj7ilgpMOlpmOP5eHlKLE0hkzOhNmg
 Zxv5GD0ar0zEW1jIiR/O0PleUGoLCdID9M2zkeUgcQ6ftB65WVQ=
 =dHzs
 -----END PGP SIGNATURE-----

Merge tag 'iwlwifi-next-for-kalle-2017-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next

Some patches focusing on bugfixes for v4.11:

  * Fix 802.11w, which was failing to due an IGTK bug;
  * A few more bugzilla bug fixes;
  * A channel-switch race condition fix;
  * Some fixes related to suspend/resume with new HW;
  * The RF-kill saga continues;
  * And some other fixes here and there...
2017-02-08 21:28:36 +02:00
Rafał Miłecki
be5e509918 mtd: bcm47xxsflash: use platform_(set|get)_drvdata
We have generic place & helpers for storing platform driver data so
there is no reason for using custom priv pointer.

This allows cleaning up struct bcma_sflash from unneeded fields.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Kalle Valo <kvalo@codeaurora.org>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
2017-02-08 11:19:43 -08:00
Arnaldo Carvalho de Melo
2f7db55579 perf tools: Fix include of linux/mman.h
It was using uapi/linux/mmap.h which caused for at least one reporter,
that hasn't specified in what environment the problem manifests itself:

 ----
The original error is:

In file included from util/event.c:2:0:
...tools/include/uapi/linux/mman.h:4:27: fatal error: uapi/asm/mman.h:
No such file or directory
 #include <uapi/asm/mman.h>
                           ^
compilation terminated.
 ----

Test built it on these containers:

  # dm
   1 alpine:3.4: Ok
   2 android-ndk:r12b-arm: Ok
   3 archlinux:latest: Ok
   4 centos:5: Ok
   5 centos:6: Ok
   6 centos:7: Ok
   7 debian:7: Ok
   8 debian:8: Ok
   9 debian:experimental: Ok
  10 debian:experimental-x-arm64: Ok
  11 debian:experimental-x-mips: Ok
  12 debian:experimental-x-mips64: Ok
  13 debian:experimental-x-mipsel: Ok
  14 fedora:20: Ok
  15 fedora:21: Ok
  16 fedora:22: Ok
  17 fedora:23: Ok
  18 fedora:24: Ok
  19 fedora:24-x-ARC-uClibc: Ok
  20 fedora:25: Ok
  21 fedora:rawhide: Ok
  22 mageia:5: Ok
  23 opensuse:13.2: Ok
  24 opensuse:42.1: Ok
  25 opensuse:tumbleweed: Ok
  26 ubuntu:12.04.5: Ok
  27 ubuntu:14.04.4-x-linaro-arm64: Ok
  28 ubuntu:15.10: Ok
  29 ubuntu:16.04: Ok
  30 ubuntu:16.04-x-arm: Ok
  31 ubuntu:16.04-x-arm64: Ok
  32 ubuntu:16.04-x-powerpc: Ok
  33 ubuntu:16.04-x-powerpc64: Ok
  34 ubuntu:16.04-x-powerpc64el: Ok
  35 ubuntu:16.04-x-s390: Ok
  36 ubuntu:16.10: Ok

Reported-by: David Carrillo-Cisneros <davidcc@google.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: He Kuang <hekuang@huawei.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Michal Marek <mmarek@suse.com>
Cc: Paul Turner <pjt@google.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Cc: Wang Nan <wangnan0@huawei.com>
Fixes: fbef103fad ("perf tools: Do hugetlb handling in more systems")
Link: http://lkml.kernel.org/n/tip-4wm5xmjz5wgbq7ucyz4dyd72@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2017-02-08 16:06:21 -03:00
WANG Cong
73d2c6678e ping: fix a null pointer dereference
Andrey reported a kernel crash:

  general protection fault: 0000 [#1] SMP KASAN
  Dumping ftrace buffer:
     (ftrace buffer empty)
  Modules linked in:
  CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ #124
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  task: ffff880060048040 task.stack: ffff880069be8000
  RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline]
  RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837
  RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206
  RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000
  RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2
  RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000
  R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0
  R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000
  FS:  00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0
  Call Trace:
   inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
   sock_sendmsg_nosec net/socket.c:635 [inline]
   sock_sendmsg+0xca/0x110 net/socket.c:645
   SYSC_sendto+0x660/0x810 net/socket.c:1687
   SyS_sendto+0x40/0x50 net/socket.c:1655
   entry_SYSCALL_64_fastpath+0x1f/0xc2

This is because we miss a check for NULL pointer for skb_peek() when
the queue is empty. Other places already have the same check.

Fixes: c319b4d76b ("net: ipv4: add IPPROTO_ICMP socket kind")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08 13:58:21 -05:00
David S. Miller
9538132a9f Merge branch 'net-header-length-truncation'
Willem de Bruijn says:

====================
net: Fixes for header length truncation

Packets should not enter the stack with truncated link layer headers
and link layer headers should always be stored in the skb linear
segment.

Patch 1 ensures the first for PF_PACKET sockets
Patch 2 ensures the second for PF_PACKET GSO sockets without tx_ring
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08 13:56:38 -05:00
Willem de Bruijn
57031eb794 packet: round up linear to header len
Link layer protocols may unconditionally pull headers, as Ethernet
does in eth_type_trans. Ensure that the entire link layer header
always lies in the skb linear segment. tpacket_snd has such a check.
Extend this to packet_snd.

Variable length link layer headers complicate the computation
somewhat. Here skb->len may be smaller than dev->hard_header_len.

Round up the linear length to be at least as long as the smallest of
the two.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08 13:56:37 -05:00
Willem de Bruijn
217e6fa24c net: introduce device min_header_len
The stack must not pass packets to device drivers that are shorter
than the minimum link layer header length.

Previously, packet sockets would drop packets smaller than or equal
to dev->hard_header_len, but this has false positives. Zero length
payload is used over Ethernet. Other link layer protocols support
variable length headers. Support for validation of these protocols
removed the min length check for all protocols.

Introduce an explicit dev->min_header_len parameter and drop all
packets below this value. Initially, set it to non-zero only for
Ethernet and loopback. Other protocols can follow in a patch to
net-next.

Fixes: 9ed988cd59 ("packet: validate variable length ll headers")
Reported-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08 13:56:37 -05:00
Bryant G. Ly
b22bc27868 ibmvscsis: Add SGL limit
This patch adds internal LIO sgl limit since the driver already
sets a max transfer limit on transport layer of 1MB to the client.

Cc: stable@vger.kernel.org
Tested-by: Steven Royer <seroyer@linux.vnet.ibm.com>
Signed-off-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2017-02-08 10:51:24 -08:00
Wu Fengguang
3c19bd6c52 net: qcom/emac: fix semicolon.cocci warnings
drivers/net/ethernet/qualcomm/emac/emac-ethtool.c:155:49-50: Unneeded semicolon

 Remove unneeded semicolon.

Generated by: scripts/coccinelle/misc/semicolon.cocci

CC: Timur Tabi <timur@codeaurora.org>
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08 13:38:44 -05:00
Vincent Abriou
8480ac5679 ASoC: hdmi-codec: remove HDMI device unregister
While unregistering the hdmi-codec, the hdmi device list must be
cleaned up. It avoid kernel page fault when registering again the
hdmi-codec.

Signed-off-by: Vincent Abriou <vincent.abriou@st.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
2017-02-08 18:33:16 +00:00
Icenowy Zheng
e5028a2597 ASoC: sunxi: allow the analog codec driver to be built on ARM64
As the 64-bit Allwinner H5 SoC has the same analog codec part (also the
same digital part) as H3, enable the driver to be built on ARM64
Allwinner platform, so that it can be used on H5.

Signed-off-by: Icenowy Zheng <icenowy@aosc.xyz>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
2017-02-08 18:29:37 +00:00
Dmitry Torokhov
a4d7641fa7 regulator: core: simplify _regulator_get()
The code in _regulator_get() got a bit confusing over time, with control
flow jumping to a label from couple of places. Let's untangle it a bit by
doing the following:

1. Make handling of missing supplies and substituting them with dummy
regulators more explicit:

- check if we not have full constraints and refuse considering dummy
  regulators with appropriate message;

- use "switch (get_type)" to handle different types of request explicitly
  as well. "Normal" requests will get dummies, exclusive will not and
  will notify user about that; optional will fail silently.

2. Stop jumping to a label in the middle of the function but instead have
proper conditional flow. I believe jumps should be reserved for error
handling, breaking from inner loop, or restarting a loop, but not for
implementing normal conditional flow.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2017-02-08 18:29:05 +00:00
Raju Lakkaraju
04d8a0a5f3 net: phy: Add LED mode driver for Microsemi PHYs.
LED Mode:
Microsemi PHY support 2 LEDs (LED[0] and LED[1]) to display different
status information that can be selected by setting LED mode.

LED Mode parameter (vsc8531, led-0-mode) and (vsc8531, led-1-mode) get
from Device Tree.

Signed-off-by: Raju Lakkaraju <Raju.Lakkaraju@microsemi.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08 13:29:04 -05:00
Johan Hovold
acfe27633b USB: serial: metro-usb: drop redundant URB reinitialisation
No need to reinitialise the interrupt-in URB with values that have not
changed before (some) resubmissions.

This also allows the interrupt-in callback to have a single path for URB
resubmission.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
2017-02-08 19:28:02 +01:00
Johan Hovold
168fc6c3c3 USB: serial: metro-usb: drop function-tracing debugging
Drop some unnecessary debug printks.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
2017-02-08 19:27:57 +01:00
Johan Hovold
d395c9ab00 USB: serial: metro-usb: drop redundant URB unlink
Drop redundant URB unlink as there's no need to unlink an URB which is
about to be killed synchronously.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
2017-02-08 19:27:52 +01:00
Johan Hovold
965bbef552 USB: serial: metro-usb: drop unused interrupt-out callback
Drop the unused interrupt-out callback.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
2017-02-08 19:27:40 +01:00
Dan Carpenter
ff4cf0e5ce net: dsa: bcm_sf2: cleanup bcm_sf2_cfp_rule_get() a little
This patch doesn't affect how the code works.

My static checker complains that the mask and shift doesn't make sense
because 0xffffff << 16 goes beyond the end of 32 bits.  It should be
0xffff instead but the existing code won't cause runtime bugs.

Also the casting here is not needed and not consistent with the rest of
the code.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08 13:27:06 -05:00
Jeeja KP
2acd8309a3 ASoC: hdac_hdmi: Add support to handle MST capable pin
To handle jack event and configuration of the pin widget for MST
capable pin, this patch adds:
o Flag to identify the pin is MST capable.
o In notify callback(), based on the pipe and port information marks if
the port is mst_capable. In case of non MST, port is defaulted to zero.

Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2017-02-08 18:24:01 +00:00
Jeeja KP
8d13640f6b ASoC: Intel: Skylake: Add route change to nau88l25_ssm4567 machine
To support MST moved pin to port, this changes the routes based on
port. So change the route in nau88l25_ssm4567 machine.

Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2017-02-08 18:23:57 +00:00
Jeeja KP
b0aad231bd ASoC: Intel: Skylake: Add route change to nau88l25_max98357a machine
To support MST moved pin to port, this changes the routes based on
port. So change the route in nau88l25_max98357a machine.

Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2017-02-08 18:23:35 +00:00
Jeeja KP
eaba31035a ASoC: Intel: bxt: Add route change to rt298 machine
To support MST moved pin to port, this changes the routes based on
port. So change the route in bxt_rt298 machine.

Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2017-02-08 18:23:35 +00:00
Jeeja KP
754695f996 ASoC: hdac_hdmi: Begin to add support for DP Multi-stream audio
With MST each pin contains several ports to which device can be
connected.

As a preparatory work to support DP MST this patch adds below changes:
1. Defines the port structure and moves all stream related information
   like ELD, converter list, chmap to port.
2. Creates ports for each pin based on the max_ports support.
3. Based on Pin-Port combination creates DAPM Mux widget instead of Pin
   to allow user to select a converter.
4. Port zero is the default port when pin does not support MST.

Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2017-02-08 18:23:35 +00:00
Tomi Valkeinen
0396162ab9 drm/omap: use vblank hooks in struct drm_crtc_funcs
The vblank hooks in struct drm_driver are deprecated and only meant for
legacy drivers.  For modern drivers with DRIVER_MODESET flag, the hooks
in struct drm_crtc_funcs should be used instead.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2017-02-08 19:23:34 +01:00
Dave Hansen
2195bff041 selftests, x86, protection_keys: fix wrong offset in siginfo
The siginfo contains a bunch of information about the fault.
For protection keys, it tells us which protection key's
permissions were violated.

The wrong offset in here leads to reading garbage and thus
failures in the tests.

We should probably eventually move this over to using the
kernel's headers defining the siginfo instead of a hard-coded
offset.  But, for now, just do the simplest fix.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-02-08 11:15:43 -07:00
Dave Hansen
16846c2d96 selftests, x86, protection_keys: fix uninitialized variable warning
'orig_pkru' might have been uninitialized here.  Fix it.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-02-08 11:15:35 -07:00
Viresh Kumar
0a7d2cd740 selftest: cpufreq: Update MAINTAINERS file
Update MAINTAINERS file with cpufreq's selftest directory.

Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-02-08 11:14:22 -07:00
WANG Cong
d7426c69a1 sit: fix a double free on error path
Dmitry reported a double free in sit_init_net():

  kernel BUG at mm/percpu.c:689!
  invalid opcode: 0000 [#1] SMP KASAN
  Dumping ftrace buffer:
     (ftrace buffer empty)
  Modules linked in:
  CPU: 0 PID: 15692 Comm: syz-executor1 Not tainted 4.10.0-rc6-next-20170206 #1
  Hardware name: Google Google Compute Engine/Google Compute Engine,
  BIOS Google 01/01/2011
  task: ffff8801c9cc27c0 task.stack: ffff88017d1d8000
  RIP: 0010:pcpu_free_area+0x68b/0x810 mm/percpu.c:689
  RSP: 0018:ffff88017d1df488 EFLAGS: 00010046
  RAX: 0000000000010000 RBX: 00000000000007c0 RCX: ffffc90002829000
  RDX: 0000000000010000 RSI: ffffffff81940efb RDI: ffff8801db841d94
  RBP: ffff88017d1df590 R08: dffffc0000000000 R09: 1ffffffff0bb3bdd
  R10: dffffc0000000000 R11: 00000000000135dd R12: ffff8801db841d80
  R13: 0000000000038e40 R14: 00000000000007c0 R15: 00000000000007c0
  FS:  00007f6ea608f700(0000) GS:ffff8801dbe00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000000002000aff8 CR3: 00000001c8d44000 CR4: 00000000001426f0
  DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
  Call Trace:
   free_percpu+0x212/0x520 mm/percpu.c:1264
   ipip6_dev_free+0x43/0x60 net/ipv6/sit.c:1335
   sit_init_net+0x3cb/0xa10 net/ipv6/sit.c:1831
   ops_init+0x10a/0x530 net/core/net_namespace.c:115
   setup_net+0x2ed/0x690 net/core/net_namespace.c:291
   copy_net_ns+0x26c/0x530 net/core/net_namespace.c:396
   create_new_namespaces+0x409/0x860 kernel/nsproxy.c:106
   unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:205
   SYSC_unshare kernel/fork.c:2281 [inline]
   SyS_unshare+0x64e/0xfc0 kernel/fork.c:2231
   entry_SYSCALL_64_fastpath+0x1f/0xc2

This is because when tunnel->dst_cache init fails, we free dev->tstats
once in ipip6_tunnel_init() and twice in sit_init_net(). This looks
redundant but its ndo_uinit() does not seem enough to clean up everything
here. So avoid this by setting dev->tstats to NULL after the first free,
at least for -net.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08 13:12:22 -05:00
Linus Torvalds
472ff5be61 ARM: SoC fixes for v4.10
- A relatively large patch restores booting on i.MX platforms that
   failed to boot after a cleanup was merged for v4.10.
 
 - A quirk for USB needs to be enabled on the STi platform
 
 - On the Meson platform, we saw memory corruption with part of
   the memory used by the secure monitor, so we have to stay out
   of that area.
 
 - The same platform also has a problem with ethernet under load,
   which is fixed by disabling EEE negotiation.
 
 - imx6dl has an incorrect pin configuration, which prevents SPI
   from working.
 
 - Two maintainers have lost their access to their email addresses, so
   we should update the MAINTAINERS file before the release
 
 - Renaming one of the orion5x linkstation models to help simplify
   the debian install.
 
 - A couple of fixes for build warnings that were introduced during
   v4.10-rc.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIVAwUAWJtPYGCrR//JCVInAQIrqxAA4XlWN83jn0+zDt1A7OmrXUhtycD8eJFM
 cP0Lc965pa1OVVkcIRRrgvYE9dnILuK6qPit7HbQtQcCSRxb5P2OQ0AyNBjAt6C0
 exBD/R13aImPLWWuGl65/WqBaCWaZ9KnVqzNHDXGt9d51NBsqreM9TdwLMvFMQBl
 tyvoRNK4TbIMGpOtrnLMTwHLkh4yZXik7srkuwSV0jeIVh7HrQUd2eawqWssuX7A
 idkZWBheDhQt2s1tI5wkRf4TFEI6muWpaNaU3NGi9qmQdHpJWc0ivYZtHlE29Fli
 T/nXDWmPptRIhOSIney6TwLdgN1Lg4ztRdaowHEpYXnfieUx+P86QJTXhxxo/3eT
 be30IhWX4WKAWiQkQHAsVCt6zIYRfXE5N8An6S5MfsC3n1dYAvCCf/qpToGUnoc/
 nyZQcbasHaSB3r5YMUmgH1oDowT9FsE/iaOzCr5xymiXgxR/p3gTVxcLn9jgp3Zq
 m1hSNfCACGmGLNcQBR/fz63/1b6sanXV6JOSEEB2TfpcQ0Mi0AaeZjAR9JAfQbNR
 hG/r8LC2Q0cG10zwOe1Iv60Ery7UsfCtdzEU6D3/gwtlDssSOs351cBoIKWtQxnX
 SPcUag9ZHZS1iuaZaSISmOWMyhK7CeCjk12TDFJPBrLolJOhIuHUOW/5cFwydWgp
 DLbhSBwqQKU=
 =zlTb
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC fixes from Arnd Bergmann:

 - A relatively large patch restores booting on i.MX platforms that
   failed to boot after a cleanup was merged for v4.10.

 - A quirk for USB needs to be enabled on the STi platform

 - On the Meson platform, we saw memory corruption with part of the
   memory used by the secure monitor, so we have to stay out of that
   area.

 - The same platform also has a problem with ethernet under load, which
   is fixed by disabling EEE negotiation.

 - imx6dl has an incorrect pin configuration, which prevents SPI from
   working.

 - Two maintainers have lost their access to their email addresses, so
   we should update the MAINTAINERS file before the release

 - Renaming one of the orion5x linkstation models to help simplify the
   debian install.

 - A couple of fixes for build warnings that were introduced during
   v4.10-rc.

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: defconfigs: make NF_CT_PROTO_SCTP and NF_CT_PROTO_UDPLITE built-in
  MAINTAINERS: socfpga: update email for Dinh Nguyen
  ARM: orion5x: fix Makefile for linkstation-lschl.dtb
  ARM: dts: orion5x-lschl: More consistent naming on linkstation series
  ARM: dts: orion5x-lschl: Fix model name
  MAINTAINERS: change email address from atmel to microchip
  MAINTAINERS: at91: change email address
  ARM64: dts: meson-gx: Add firmware reserved memory zones
  ARM64: dts: meson-gxbb-odroidc2: fix GbE tx link breakage
  ARM: dts: STiH407-family: set snps,dis_u3_susphy_quirk
  ARM: dts: imx: Pass 'chosen' and 'memory' nodes
  ARM: dts: imx6dl: fix GPIO4 range
  ARM: imx: hide unused variable in #ifdef
2017-02-08 10:01:39 -08:00
Linus Torvalds
d3498fbaf3 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull selinux fix from James Morris:
 "Fix off-by-one in setprocattr"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  selinux: fix off-by-one in setprocattr
2017-02-08 09:59:45 -08:00
Linus Torvalds
23fbe2cdc1 Merge branch 'for-linus' of git://git.kernel.dk/linux-block
Pull block fix from Jens Axboe:
 "A single fix that should go into 4.10, fixing a regression on some
  devices with the WRITE_SAME command"

* 'for-linus' of git://git.kernel.dk/linux-block:
  block: don't try Write Same from __blkdev_issue_zeroout
2017-02-08 09:56:15 -08:00
David Ahern
2bd137de53 lwtunnel: valid encap attr check should return 0 when lwtunnel is disabled
An error was reported upgrading to 4.9.8:
    root@Typhoon:~# ip route add default table 210 nexthop dev eth0 via 10.68.64.1
    weight 1 nexthop dev eth0 via 10.68.64.2 weight 1
    RTNETLINK answers: Operation not supported

The problem occurs when CONFIG_LWTUNNEL is not enabled and a multipath
route is submitted.

The point of lwtunnel_valid_encap_type_attr is catch modules that
need to be loaded before any references are taken with rntl held. With
CONFIG_LWTUNNEL disabled, there will be no modules to load so the
lwtunnel_valid_encap_type_attr stub should just return 0.

Fixes: 9ed59592e3 ("lwtunnel: fix autoload of lwt modules")
Reported-by: pupilla@libero.it
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08 12:52:11 -05:00
Leon Romanovsky
646ebd4166 RDMA: Don't reference kernel private header from UAPI header
Remove references to private kernel header and defines from exported
ib_user_verb.h file.

The code snippet below is used to reproduce the issue:

 #include <stdio.h>
 #include <rdma/ib_user_verb.h>

 int main(void)
 {
	printf("IB_USER_VERBS_ABI_VERSION = %d\n", IB_USER_VERBS_ABI_VERSION);
	return 0;
 }

It fails during compilation phase with an error:
➜  /tmp gcc main.c
main.c:2:31: fatal error: rdma/ib_user_verb.h: No such file or directory
 #include <rdma/ib_user_verb.h>
                               ^
compilation terminated.

Fixes: 189aba99e7 ("IB/uverbs: Extend modify_qp and support packet pacing")
CC: Bodong Wang <bodong@mellanox.com>
CC: Matan Barak <matanb@mellanox.com>
CC: Christoph Hellwig <hch@infradead.org>
Tested-by: Slava Shwartsman <slavash@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-02-08 12:28:49 -05:00
Eyal Itkin
647bf3d8a8 IB/rxe: Fix mem_check_range integer overflow
Update the range check to avoid integer-overflow in edge case.
Resolves CVE 2016-8636.

Signed-off-by: Eyal Itkin <eyal.itkin@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-02-08 12:28:30 -05:00
Eyal Itkin
628f07d33c IB/rxe: Fix resid update
Update the response's resid field when larger than MTU, instead of only
updating the local resid variable.

Fixes: 8700e3e7c4 ("Soft RoCE driver")
Signed-off-by: Eyal Itkin <eyal.itkin@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-02-08 12:28:30 -05:00
Marc Zyngier
34d677a90f irqchip/gic-v3-its: Zero command on allocation
When reusing commands from the ring buffer, it would be better
to zero them out, even if the ITS should ignore the unused
fields.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
2017-02-08 17:09:56 +00:00
Marcus Huewe
a11a7f71ca ipv6: addrconf: fix generation of new temporary addresses
Under some circumstances it is possible that no new temporary addresses
will be generated.

For instance, addrconf_prefix_rcv_add_addr() indirectly calls
ipv6_create_tempaddr(), which creates a tentative temporary address and
starts dad. Next, addrconf_prefix_rcv_add_addr() indirectly calls
addrconf_verify_rtnl(). Now, assume that the previously created temporary
address has the least preferred lifetime among all existing addresses and
is still tentative (that is, dad is still running). Hence, the next run of
addrconf_verify_rtnl() is performed when the preferred lifetime of the
temporary address ends. If dad succeeds before the next run, the temporary
address becomes deprecated during the next run, but no new temporary
address is generated.

In order to fix this, schedule the next addrconf_verify_rtnl() run slightly
before the temporary address becomes deprecated, if dad succeeded.

Signed-off-by: Marcus Huewe <suse-tux@gmx.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08 11:54:40 -05:00
Jeff Mahoney
2a36224918 btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls
Commit 4c63c2454e incorrectly assumed that returning -ENOIOCTLCMD would
cause the native ioctl to be called.  The ->compat_ioctl callback is
expected to handle all ioctls, not just compat variants.  As a result,
when using 32-bit userspace on 64-bit kernels, everything except those
three ioctls would return -ENOTTY.

Fixes: 4c63c2454e ("btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl")
Cc: stable@vger.kernel.org
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
2017-02-08 17:47:30 +01:00
Nicholas Bellinger
9b2792c3da target: Fix COMPARE_AND_WRITE ref leak for non GOOD status
This patch addresses a long standing bug where the commit phase
of COMPARE_AND_WRITE would result in a se_cmd->cmd_kref reference
leak if se_cmd->scsi_status returned non SAM_STAT_GOOD.

This would manifest first as a lost SCSI response, and eventual
hung task during fabric driver logout or re-login, as existing
shutdown logic waited for the COMPARE_AND_WRITE se_cmd->cmd_kref
to reach zero.

To address this bug, compare_and_write_post() has been changed
to drop the incorrect !cmd->scsi_status conditional that was
preventing *post_ret = 1 for being set during non SAM_STAT_GOOD
status.

This patch has been tested with SAM_STAT_CHECK_CONDITION status
from normal target_complete_cmd() callback path, as well as the
incoming __target_execute_cmd() submission failure path when
se_cmd->execute_cmd() returns non zero status.

Reported-by: Donald White <dew@datera.io>
Cc: Donald White <dew@datera.io>
Tested-by: Gary Guo <ghg@datera.io>
Cc: Gary Guo <ghg@datera.io>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: <stable@vger.kernel.org> # v3.12+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2017-02-08 08:25:39 -08:00
Nicholas Bellinger
01d4d67355 target: Fix multi-session dynamic se_node_acl double free OOPs
This patch addresses a long-standing bug with multi-session
(eg: iscsi-target + iser-target) se_node_acl dynamic free
withini transport_deregister_session().

This bug is caused when a storage endpoint is configured with
demo-mode (generate_node_acls = 1 + cache_dynamic_acls = 1)
initiators, and initiator login creates a new dynamic node acl
and attaches two sessions to it.

After that, demo-mode for the storage instance is disabled via
configfs (generate_node_acls = 0 + cache_dynamic_acls = 0) and
the existing dynamic acl is never converted to an explicit ACL.

The end result is dynamic acl resources are released twice when
the sessions are shutdown in transport_deregister_session().

If the storage instance is not changed to disable demo-mode,
or the dynamic acl is converted to an explict ACL, or there
is only a single session associated with the dynamic ACL,
the bug is not triggered.

To address this big, move the release of dynamic se_node_acl
memory into target_complete_nacl() so it's only freed once
when se_node_acl->acl_kref reaches zero.

(Drop unnecessary list_del_init usage - HCH)

Reported-by: Rob Millner <rlm@daterainc.com>
Tested-by: Rob Millner <rlm@daterainc.com>
Cc: Rob Millner <rlm@daterainc.com>
Cc: stable@vger.kernel.org # 4.1+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2017-02-08 08:25:23 -08:00
Chris Wilson
1f7b847d72 drm/i915: Disable engine->irq_tasklet around resets
When we restart the engines, and we have active requests, a request on
the first engine may complete and queue a request to the second engine
before we try to restart the second engine. That queueing of the
request may race with the engine to restart, and so may corrupt the
current state. Disabling the engine->irq_tasklet prevents the two paths
from writing into ELSP simultaneously (and modifyin the execlists_port[]
at the same time).

Fixes: 821ed7df6e ("drm/i915: Update reset path to fix incomplete requests")
Testcase: igt/gem_exec_fence/await-hang
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Mika Kuoppala <mika.kuoppala@intel.com>
Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170208143033.11651-3-chris@chris-wilson.co.uk
2017-02-08 16:24:42 +00:00
Chris Wilson
d802709313 drm/i915: Split GEM resetting into 3 phases
Currently we do a reset prepare/finish around the call to reset the GPU,
but it looks like we need a later stage after the hw has been
reinitialised to allow GEM to restart itself. Start by splitting the 2
GEM phases into 3:

  prepare - before the reset, check if GEM recovered, then stop GEM

  reset - after the reset, update GEM bookkeeping

  finish - after the re-initialisation following the reset, restart GEM

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@intel.com>
Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170208143033.11651-2-chris@chris-wilson.co.uk
2017-02-08 16:24:42 +00:00
Chris Wilson
20a8a74ad9 drm/i915: Move calling engine->init_hw() to its own function
Just a simple refactor to move a loop and some support code out of
i915_gem_init_hw(). This is in preparation for avoiding a race between
the tasklet writing to ELSP whilst simultaneously being written by
engine->init_hw() following a GPU reset.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@intel.com>
Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170208143033.11651-1-chris@chris-wilson.co.uk
2017-02-08 16:24:42 +00:00
Chris Wilson
519d524981 drm/i915: i915_gem_shrink_all() needs an awake device
Since to unbind an object, we may need a powered up device to access the
GTT entries, we only shrink bound objects if awake. Callers to
i915_gem_shrink_all() had to take this into account and take the rpm
wakeref, but we can move this wakeref into the shrink_all itself for
convenience and making the function live up to its name.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: http://patchwork.freedesktop.org/patch/msgid/20170208104710.18089-1-chris@chris-wilson.co.uk
Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
2017-02-08 16:24:42 +00:00
Marcelo Tosatti
a0e136d436 PTP: add kvm PTP driver
Add a driver with gettime method returning hosts realtime clock.
This allows Chrony to synchronize host and guest clocks with
high precision (see results below).

chronyc> sources
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================

To configure Chronyd to use PHC refclock, add the
following line to its configuration file:

refclock PHC /dev/ptpX poll 3 dpoll -2 offset 0

Where /dev/ptpX is the kvmclock PTP clock.

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-08 17:16:20 +01:00
Marcelo Tosatti
f4066c2bc4 kvmclock: export kvmclock clocksource and data pointers
To be used by KVM PTP driver.

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-08 17:16:19 +01:00
Ville Syrjälä
ceb993201c drm/i915: Move ilk_pipe_pixel_rate() to intel_display.c
Move ilk_pipe_pixel_rate() next to its only caller
(intel_crtc_compute_pixel_rate()).

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Ander Conselvan de Oliveira <conselvan2@gmail.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170120182205.8141-15-ville.syrjala@linux.intel.com
2017-02-08 18:07:11 +02:00