Mimi Zohar [Mon, 13 Feb 2012 15:15:05 +0000 (10:15 -0500)]
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Mimi Zohar [Thu, 17 Mar 2011 02:48:43 +0000 (22:48 -0400)]
vfs: move ima_file_free before releasing the file
ima_file_free(), called on __fput(), currently flags files that have
changed, so that the file is re-measured. For appraising a files's
integrity, the file's hash must be re-calculated and stored in the
'security.ima' xattr to reflect any changes.
This patch moves the ima_file_free() call to before releasing the file
in preparation of ima-appraisal measuring the file and updating the
'security.ima' xattr.
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Mimi Zohar [Wed, 23 Mar 2011 21:23:06 +0000 (17:23 -0400)]
vfs: extend vfs_removexattr locking
This patch takes the i_mutex lock before security_inode_removexattr(),
instead of after, in preparation of calling ima_inode_removexattr().
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@nokia.com>
Kees Cook [Mon, 27 Aug 2012 18:38:13 +0000 (11:38 -0700)]
Yama: handle 32-bit userspace prctl
When running a 64-bit kernel and receiving prctls from a 32-bit
userspace, the "-1" used as an unsigned long will end up being
misdetected. The kernel is looking for 0xffffffffffffffff instead of
0xffffffff. Since prctl lacks a distinct compat interface, Yama needs
to handle this translation itself. As such, support either value as
meaning PR_SET_PTRACER_ANY, to avoid breaking the ABI for 64-bit.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: John Johansen <john.johansen@canonical.com>
Cc: stable@vger.kernel.org
Signed-off-by: James Morris <james.l.morris@oracle.com>
Kees Cook [Tue, 4 Sep 2012 20:32:13 +0000 (13:32 -0700)]
security: allow Yama to be unconditionally stacked
Unconditionally call Yama when CONFIG_SECURITY_YAMA_STACKED is selected,
no matter what LSM module is primary.
Ubuntu and Chrome OS already carry patches to do this, and Fedora
has voiced interest in doing this as well. Instead of having multiple
distributions (or LSM authors) carrying these patches, just allow Yama
to be called unconditionally when selected by the new CONFIG.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge E. Hallyn <serge.hallyn@canonical.com>
Acked-by: Eric Paris <eparis@redhat.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Xiaoyan Zhang [Thu, 29 Aug 2013 12:39:11 +0000 (20:39 +0800)]
driver/char/tpm: declare internal symbols as static
This patch declares the internal struct and functions as static to provide
more security.
Signed-off-by: Xiaoyan Zhang <xiaoyan.zhang@intel.com>
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Reviewed-by: Kent Yoder <key@linux.vnet.ibm.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Xiaoyan Zhang [Wed, 22 Aug 2012 10:47:22 +0000 (18:47 +0800)]
driver: add PPI support in tpm driver
The Physical Presence Interface enables the OS and the BIOS to cooperate and
provides a simple and straightforward platform user experience for
administering the TPM without sacrificing security.
V2: separate the patch out in a separate source file,
add #ifdef CONFIG_ACPI so it compiles out on ppc,
use standard error instead of ACPI error as return code of show/store fns.
V3: move #ifdef CONFIG_ACPI from .c file to .h file.
V4: move tpm_ppi code from tpm module to tpm_bios module.
V5: modify sys_add_ppi() so that ppi_attr_grp doesn't need to be exported
Signed-off-by: Xiaoyan Zhang <xiaoyan.zhang@intel.com>
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Xiaoyan Zhang [Wed, 22 Aug 2012 10:47:21 +0000 (18:47 +0800)]
Documentation: sysfs for Physical Presence Interface
Signed-off-by: Xiaoyan Zhang <xiaoyan.zhang@intel.com>
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Jesper Juhl [Wed, 15 Aug 2012 22:16:33 +0000 (00:16 +0200)]
tpm: Do not dereference NULL pointer if acpi_os_map_memory() fails.
In drivers/char/tpm/tpm_acpi.c::read_log() we call
acpi_os_map_memory(). That call may fail for a number of reasons
(invalid address, out of memory etc). If the call fails it returns
NULL and we just pass that to memcpy() unconditionally, which will go
bad when it tries to dereference the pointer.
Unfortunately we just get NULL back, so we can't really tell the user
exactely what went wrong, but we can at least avoid crashing and
return an error (-EIO seemed more generic and more suitable here than
-ENOMEM or something else, so I picked that).
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Kent Yoder [Wed, 22 Aug 2012 20:01:47 +0000 (15:01 -0500)]
ima: enable the IBM vTPM as the default TPM in the PPC64 case
Enable tpm_ibmvtpm driver by default when IMA is enabled on PPC64
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Ashley Lai [Tue, 14 Aug 2012 23:35:32 +0000 (18:35 -0500)]
drivers/char/tpm: Add securityfs support for event log
This patch retrieves the event log data from the device tree
during file open. The event log data will then displayed through
securityfs.
Signed-off-by: Ashley Lai <adlai@us.ibm.com>
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Ashley Lai [Tue, 14 Aug 2012 23:34:57 +0000 (18:34 -0500)]
PPC64: Add support for instantiating SML from Open Firmware
This patch instantiate Stored Measurement Log (SML) and put the
log address and size in the device tree.
Signed-off-by: Ashley Lai <adlai@us.ibm.com>
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Ashley Lai [Wed, 22 Aug 2012 21:17:43 +0000 (16:17 -0500)]
drivers/char/tpm: Add new device driver to support IBM vTPM
This patch adds a new device driver to support IBM virtual TPM
(vTPM) for PPC64. IBM vTPM is supported through the adjunct
partition with firmware release 740 or higher. With vTPM
support, each lpar is able to have its own vTPM without the
physical TPM hardware.
This driver provides TPM functionalities by communicating with
the vTPM adjunct partition through Hypervisor calls (Hcalls)
and Command/Response Queue (CRQ) commands.
Signed-off-by: Ashley Lai <adlai@us.ibm.com>
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Kent Yoder [Thu, 9 Aug 2012 14:20:15 +0000 (09:20 -0500)]
tpm: compile out unused code in the PNP and PM cases
The tpm_tis driver doesn't use tpm_tis_resume except when PM is
configured and doesn't make use of tpm_tis_reenable_interrupts except
when PM or PNP is configured.
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Kent Yoder [Wed, 25 Jul 2012 19:14:02 +0000 (14:14 -0500)]
tpm: fix double write race and tpm_release free issue
Moved the atomic_set of the data_pending variable until after the
tpm_read has completed processing. The existing code had a window of
time where a second write to the driver could clobber the tpm command
buffer.
Also fixed an issue where if close was called on the tpm device before a
read completed, the tpm command buffer would be returned to the OS,
which could contain sensitive information.
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Kent Yoder [Wed, 8 Aug 2012 19:18:57 +0000 (14:18 -0500)]
hw_random: add support for the TPM chip as a hardware RNG source
This driver will make use of any available TPM chip on the system as a
hwrng source.
Acked-by: David Safford <safford@linux.vnet.ibm.com>
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Kent Yoder [Thu, 7 Jun 2012 18:47:14 +0000 (13:47 -0500)]
tpm: Move tpm_get_random api into the TPM device driver
Move the tpm_get_random api from the trusted keys code into the TPM
device driver itself so that other callers can make use of it. Also,
change the api slightly so that the number of bytes read is returned in
the call, since the TPM command can potentially return fewer bytes than
requested.
Acked-by: David Safford <safford@linux.vnet.ibm.com>
Reviewed-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Kent Yoder [Wed, 11 Jul 2012 15:08:12 +0000 (10:08 -0500)]
tpm: modularize event log collection
Break ACPI-specific pieces of the event log handling into their own file
and create tpm_eventlog.[ch] to store common event log handling code.
This will be required to integrate future event log sources on platforms
without ACPI tables.
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Peter Huewe [Tue, 7 Aug 2012 09:42:32 +0000 (11:42 +0200)]
char/tpm: Add new driver for Infineon I2C TIS TPM
This patch adds a driver to support Infineon's SLB 9635 TT 1.2 Soft I2C TPMs
which follow the TGC TIS 1.2 TPM specification[1] and Infineon's I2C Protocol
Stack Specification 0.20.
The I2C Protocol Stack Specification is a simple adaption of the LPC TIS
Protocol to the I2C Bus.
The I2C TPMs can be used when LPC Bus is not available (i.e. non x86
architectures like ARM).
The driver is based on the tpm_tis.c driver by Leendert van Dorn and Kyleen
Hall and has quite similar functionality.
Tested on Nvidia ARM Tegra2 Development Platform and Beagleboard (ARM OMAP)
Tested with the Trousers[2] TSS API Testsuite v 0.3 [3]
Compile-tested on x86 (32/64-bit)
Updates since version 2.1.4:
- included "Lock the I2C adapter for a sequence of requests", by Bryan Freed
- use __i2c_transfer instead of own implementation of unlocked i2c_transfer
- use struct dev_pm_ops for power management via SIMPLE_DEV_PM_OPS
Updates since version 2.1.3:
- use proper probing mechanism
* either add the tpm using I2C_BOARD_INFO to your board file or probe it
* during runtime e.g on BeagleBoard using :
* "echo tpm_i2c_infineon 0x20 > /sys/bus/i2c/devices/i2c-2/new_device"
- fix possible endless loop if hardware misbehaves
- improved return codes
- consistent spelling i2c/tpm -> I2C/TPM
- remove hardcoded sleep values and msleep usage
- removed debug statements
- added check for I2C functionality
- renaming to tpm_i2c_infineon
Updates since version 2.1.2:
- added sysfs entries for duration and timeouts
- updated to new tpm_do_selftest
Updates since version 2.1.0:
- improved error handling
- implemented workarounds needed by the tpm
- fixed typos
References:
[1]
http://www.trustedcomputinggroup.org/resources/pc_client_work_group_pc_client_
specific_tpm_interface_specification_tis_version_12/
[2] http://trousers.sourceforge.net/
[3]
http://sourceforge.net/projects/trousers/files/TSS%20API%20test%20suite/0.3/
Reviewed-by: Andi Shyti <andi.shyti@gmail.com>
Acked-by: Marcel Selhorst <tpmdd@selhorst.net>
Signed-off-by: Peter Huewe <peter.huewe@infineon.com>
Signed-off-by: Bryan Freed <bfreed@chromium.org>
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
James Morris [Fri, 17 Aug 2012 10:42:30 +0000 (20:42 +1000)]
Merge tag 'v3.6-rc2' into next
Linux 3.6-rc2
Resync with Linus.
Linus Torvalds [Thu, 16 Aug 2012 21:51:24 +0000 (14:51 -0700)]
Linux 3.6-rc2
Ian Kent [Mon, 6 Aug 2012 01:37:47 +0000 (09:37 +0800)]
autofs4 - fix get_next_positive_subdir()
Following a report of a crash during an automount expire I found that
the locking in fs/autofs4/expire.c:get_next_positive_subdir() was wrong.
Not only is the locking wrong but the function is more complex than it
needs to be.
The function is meant to calculate (and dget) the next entry in the list
of directories contained in the root of an autofs mount point (an autofs
indirect mount to be precise). The main problem was that the d_lock of
the owner of the list was not being taken when walking the list, which
lead to list corruption under load. The only other lock that needs to
be taken is against the next dentry candidate so it can be checked for
usability.
Signed-off-by: Ian Kent <raven@themaw.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Thu, 16 Aug 2012 18:47:42 +0000 (11:47 -0700)]
Merge tag 'vfio-for-v3.6-rc1' of git://github.com/awilliam/linux-vfio
Pull VFIO fix from Alex Williamson:
"Just a trivial patch to include vfio.h in the installed headers so we
can complete userspace integration into QEMU."
* tag 'vfio-for-v3.6-rc1' of git://github.com/awilliam/linux-vfio:
vfio: Include vfio.h in installed headers
Linus Torvalds [Thu, 16 Aug 2012 18:46:31 +0000 (11:46 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/mszeredi/fuse
Pull fuse updates from Miklos Szeredi.
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
fuse: verify all ioctl retry iov elements
fuse: add missing INIT flag descriptions
fuse: add missing INIT flags
fuse: update attributes on aio_read
fuse: invalidate inode mapping if mtime changes
fuse: add FUSE_AUTO_INVAL_DATA init flag
Linus Torvalds [Thu, 16 Aug 2012 18:31:59 +0000 (11:31 -0700)]
Merge tag 'stable/for-linus-3.6-rc1-tag' of git://git./linux/kernel/git/konrad/xen
Pull Xen fix from Konrad Rzeszutek Wilk:
"Way back in v3.5 we added a mechanism to populate back pages that were
released (they overlapped with MMIO regions), but neglected to reserve
the proper amount of virtual space for extend_brk to work properly.
Coincidentally some other commit aligned the _brk space to larger area
so I didn't trigger this until it was run on a machine with more than
2GB of MMIO space."
* On machines with large MMIO/PCI E820 spaces we fail to boot b/c
we failed to pre-allocate large enough virtual space for extend_brk.
* tag 'stable/for-linus-3.6-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
xen/p2m: Reserve 8MB of _brk space for P2M leafs when populating back.
Linus Torvalds [Thu, 16 Aug 2012 18:31:29 +0000 (11:31 -0700)]
Merge tag 'sh-for-linus' of git://github.com/pmundt/linux-sh
Pull SuperH fixes from Paul Mundt.
* tag 'sh-for-linus' of git://github.com/pmundt/linux-sh:
sh: intc: Handle domain association for sparseirq pre-allocated vectors.
sh: sh7269: Fix LCD pinmux
sh: dma: fix request_irq usage
Dan Williams [Thu, 16 Aug 2012 02:20:02 +0000 (19:20 -0700)]
MAINTAINERS: update address for Dan Williams
Moved to djbw@fb.com
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Dan Williams <djbw@fb.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Borislav Petkov [Wed, 15 Aug 2012 11:00:51 +0000 (13:00 +0200)]
scripts/decodecode: Fixup trapping instruction marker
When dumping "Code: " sections from an oops, the trapping instruction
%rip points to can be a string copy
2b:* f3 a5 rep movsl %ds:(%rsi),%es:(%rdi)
and the line contain a bunch of ":". Current "cut" selects only the and
the second field output looks funnily overlaid this:
2b:* f3 a5 rep movsl %ds <-- trapping instruction:(%rsi),%es:(%rdi
Fix this by selecting the remaining fields too.
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: linux-kbuild@vger.kernel.org
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Thu, 16 Aug 2012 18:13:16 +0000 (11:13 -0700)]
Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma
Pull two slave-dmaengine fixes from Vinod Koul:
"One fixes the correct use of clock API in imx driver and the other
enables clock for tegra driver, which is used for other tegra driver
conversion to dmanegine in -next."
* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
dma: tegra: enable/disable dma clock
dma: imx-dma: Fix kernel crash due to missing clock conversion
Linus Torvalds [Thu, 16 Aug 2012 18:08:32 +0000 (11:08 -0700)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull more drm fixes from Dave Airlie:
"Just some intel and nouveau ones this time, intel has more edp panel
fixes for macbooks and nouveau has a suspend/resume regression fix in
there."
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/i915: Apply post-sync write for pipe control invalidates
drm/i915: reorder edp disabling to fix ivb MacBook Air
drm/nv86/fifo: suspend fix
drm/nouveau: disable copy engine on NVAF
nouveau: fixup scanout enable in nvc0_pm
drm/nouveau/aux: mask off higher bits of auxch index in i2c table entry
drm/nvd0/disp: mask off high 16 bit of negative cursor x-coordinate
drm/i915: ensure i2c adapter is all set before adding it
drm/i915: ignore eDP bpc settings from vbt
drm/i915: Fix blank panel at reopening lid
drm/nve0/fifo: add support for the flip completion swmthd
Linus Torvalds [Thu, 16 Aug 2012 00:07:01 +0000 (17:07 -0700)]
Merge git://git./linux/kernel/git/davem/sparc
Pull two sparc fixes from David S. Miller.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
sparc64: Be less verbose during vmemmap population.
sparc64: do not clobber personality flags in sys_sparc64_personality()
Dave Airlie [Wed, 15 Aug 2012 10:31:22 +0000 (20:31 +1000)]
Merge branch 'drm-nouveau-fixes' of git://git.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes
* 'drm-nouveau-fixes' of git://git.freedesktop.org/git/nouveau/linux-2.6:
drm/nv86/fifo: suspend fix
drm/nouveau: disable copy engine on NVAF
nouveau: fixup scanout enable in nvc0_pm
drm/nouveau/aux: mask off higher bits of auxch index in i2c table entry
drm/nvd0/disp: mask off high 16 bit of negative cursor x-coordinate
drm/nve0/fifo: add support for the flip completion swmthd
Dave Airlie [Wed, 15 Aug 2012 10:27:51 +0000 (20:27 +1000)]
Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel into drm-fixes
Daniel Vetter writes:
"A few important fixers:
- fix various lvds backlight issues, regressed in 3.6 (Takashi Iwai)
- make the retina mbp work (ignore bogus edp bpc value in vbt)
- fix a gmbus regression introduced in (iirc) 3.4 (Jani Nikula)
- fix an edp panel power sequence regression, fixes the new macbook air
- apply the tlb invalidate w/a
Otherwise we still have another gmbus regression (patches are awaiting
tested-bys) and there's something odd going with some rare systems not
entering rc6 often enough (and hence blowing through too much power). It
seems to be a timing-related issue and can be mitigated by frobbing the
magic tuning parameters. We're still working on that one. Also, we still
have some fallout from the hw context support, but you can only hit that
with mesa master."
* 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel:
drm/i915: Apply post-sync write for pipe control invalidates
drm/i915: reorder edp disabling to fix ivb MacBook Air
drm/i915: ensure i2c adapter is all set before adding it
drm/i915: ignore eDP bpc settings from vbt
drm/i915: Fix blank panel at reopening lid
David S. Miller [Wed, 15 Aug 2012 07:37:29 +0000 (00:37 -0700)]
sparc64: Be less verbose during vmemmap population.
On a 2-node machine with 256GB of ram we get 512 lines of
console output, which is just too much.
This mimicks Yinghai Lu's x86 commit
c2b91e2eec9678dbda274e906cc32ea8f711da3b
(x86_64/mm: check and print vmemmap allocation continuous) except that
we aren't ever going to get contiguous block pointers in between calls
so just print when the virtual address or node changes.
This decreases the output by an order of 16.
Also demote this to KERN_DEBUG.
Signed-off-by: David S. Miller <davem@davemloft.net>
Chris Wilson [Fri, 10 Aug 2012 09:18:10 +0000 (10:18 +0100)]
drm/i915: Apply post-sync write for pipe control invalidates
When invalidating the TLBs it is documentated as requiring a post-sync
write. Failure to do so seems to result in a GPU hang.
Exposure to this hang on IVB seems to be a result of removing the extra
stalls required for SNB pipecontrol workarounds:
commit
6c6cf5aa9c583478b19e23149feaa92d01fb8c2d
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date: Fri Jul 20 18:02:28 2012 +0100
drm/i915: Only apply the SNB pipe control w/a to gen6
Note: Manually switch the pipe_control cmd to 4 dwords to avoid a
(silent) functional conflict with -next. This way will get a loud (but
conflict with next (since the scratch_addr has been deleted there).
Reported-and-tested-by: yex.tian@intel.com
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=53322
Acked-by: Ben Widawsky <ben@bwidawsk.net>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
[danvet: added note about merge conflict with -next.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Daniel Vetter [Sun, 12 Aug 2012 20:17:14 +0000 (22:17 +0200)]
drm/i915: reorder edp disabling to fix ivb MacBook Air
eDP is tons of fun. It turns out that at least the new MacBook Air 5,1
model absolutely doesn't like the new force vdd dance we've introduced
in
commit
6cb49835da0426f69a2931bc2a0a8156344b0e41
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date: Sun May 20 17:14:50 2012 +0200
drm/i915: enable vdd when switching off the eDP panel
But that patch also tried to fix some neat edp sequence issue with the
force_vdd timings. Closer inspection reveals that we've raised
force_vdd only to do the aux channel communication dp_sink_dpms. If we
move the edp_panel_off below that, we don't need any force_vdd for the
disable sequence, which makes the Air happy.
Unfortunately the reporter of the original bug that the above commit
fixed is travelling, so we can't test whether this regresses things.
But my theory is that since we don't check for any power-off ->
force_vdd-on delays in edp_panel_vdd_on, this was the actual
root-cause of this failure. With that force_vdd dance completely
eliminated, I'm hopeful the original bug stays fixed, too.
For reference the old bug, which hopefully doesn't get broken by this:
https://bugzilla.kernel.org/show_bug.cgi?id=43163
In any case, regression fixers win over plain bugfixes, so this needs
to go in asap.
v2: The crucial pieces seems to be to clear the force_vdd flag
uncoditionally, too, in edp_panel_off. Looks like this is left behind
by the firmware somehow.
v3: The Apple firmware seems to switch off the panel on it's own, hence
we still need to keep force_vdd on, but properly clear it when switching
the panel off.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=45671
Tested-by: Roberto Romer <sildurin@gmail.com>
Tested-by: Daniel Wagner <wagi@monom.org>
Tested-by: Keith Packard <keithp@keithp.com>
Cc: stable@vger.kernel.org
Cc: Keith Packard <keithp@keithp.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Linus Torvalds [Tue, 14 Aug 2012 04:58:59 +0000 (07:58 +0300)]
Merge branch 'for-linus' of git://git./linux/kernel/git/s390/linux
Pull s390 patches from Martin Schwidefsky:
"Included are bug fixes and a patch to enable system call filtering
with BPF."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/compat: fix mmap compat system calls
s390/compat: fix compat wrappers for process_vm system calls
s390: do not clobber personality flags in sys_32_personality()
s390/seccomp: add support for system call filtering using BPF
s390/sclp_sdias: Add missing break and "fall through"
s390/mm: remove MAX_PHYSADDR_BITS define
Linus Torvalds [Tue, 14 Aug 2012 04:52:41 +0000 (07:52 +0300)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
"Radeon and intel fixes mostly, one fix to the mgag200 driver to not
hang on certain server variants."
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (32 commits)
drm/radeon: fix typo in function header comment
drm/radeon/kms: implement timestamp userspace query (v2)
drm/radeon/kms: add MSAA texture support for r600-evergreen
drm/radeon/kms: reorder code in r600_check_texture_resource
drm/radeon: fence virtual address and free it once idle v4
drm/radeon: fix some missing parens in asic macros
drm/radeon: add some new SI pci ids
drm/radeon: fix ordering in pll picking on dce4+
drm/radeon: do not reenable crtc after moving vram start address
drm/radeon: fix bank tiling parameters on cayman
drm/radeon: fix bank tiling parameters on evergreen
drm/radeon: fix bank tiling parameters on SI
drm/radeon: properly handle crtc powergating
drm/radeon: properly handle SS overrides on TN (v2)
drm/radeon/dce4+: set a more reasonable cursor watermark
drm/radeon: fix handling for ddc type 5 on combios
drm/mgag200: fix G200ER pll picking algorithm
drm/edid: Fix potential memory leak in edid_load()
drm/udl: Use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(.. [1]
drm/radeon/kms: allow "invalid" DB formats as a means to disable DB
...
Arnd Bergmann [Mon, 13 Aug 2012 14:36:10 +0000 (14:36 +0000)]
GPIO: gpio-pxa: fix building without CONFIG_OF
Commit
7212157267 ("GPIO: gpio-pxa: fix devicetree functions") added an
"xlate" function pointer to the irq_domain_ops, but this function is nor
declared or defined anywhere when CONFIG_OF is disabled, causing the
build error:
drivers/gpio/gpio-pxa.c:532:11: error: 'irq_domain_xlate_twocell' undeclared here (not in a function)
Extending the DT-only code section to cover the irq_domain_ops and the
pxa_gpio_dt_ids solves this problem and makes it clearer which code is
actually used without DT.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Maxim Levitsky [Mon, 13 Aug 2012 23:22:07 +0000 (02:22 +0300)]
drm/nv86/fifo: suspend fix
This fix is a backport from the reworked nouveau driver. It masks off the
engines we're not expecting to use before attempting a channel kickoff.
Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Henrik Rydberg [Sat, 4 Aug 2012 06:00:45 +0000 (08:00 +0200)]
drm/nouveau: disable copy engine on NVAF
The copy engine exhibits random memory corruption in at least one case, the
GeForce 320M (nv50, 0xaf) in the MacBookAir3,1.
This patch omits creating the engine for the specific chipset, falling back
to M2MF, which kills the symptoms.
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Maarten Lankhorst [Mon, 30 Jul 2012 10:03:30 +0000 (12:03 +0200)]
nouveau: fixup scanout enable in nvc0_pm
Fixes screen being black after changing performance level.
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Cc: stable@vger.kernel.org [3.5+]
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Ben Skeggs [Fri, 27 Jul 2012 04:18:03 +0000 (14:18 +1000)]
drm/nouveau/aux: mask off higher bits of auxch index in i2c table entry
At least partially fixes DP output detection on W530. Not sure if more
issues remain, or if my adaptor is just behaving weirdly (it does that
sometimes).
In any case, this patch is necessary.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Christoph Bumiller [Thu, 26 Jul 2012 18:53:19 +0000 (20:53 +0200)]
drm/nvd0/disp: mask off high 16 bit of negative cursor x-coordinate
Signed-off-by: Christoph Bumiller <e0425955@student.tuwien.ac.at>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Cc: stable@vger.kernel.org
Dave Airlie [Mon, 13 Aug 2012 23:25:01 +0000 (09:25 +1000)]
Merge branch 'drm-fixes-3.6' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
Alex Deucher writes:
This is the current set of radeon fixes for 3.6. Nothing too major.
Highlights:
- various display fixes
- some SI fixes
- new SI pci ids
- major VM fix
- CS checker support for MSAA
I've tested on a number of cards across generations and noticed no problems.
* 'drm-fixes-3.6' of git://people.freedesktop.org/~agd5f/linux:
drm/radeon: fix typo in function header comment
drm/radeon/kms: implement timestamp userspace query (v2)
drm/radeon/kms: add MSAA texture support for r600-evergreen
drm/radeon/kms: reorder code in r600_check_texture_resource
drm/radeon: fence virtual address and free it once idle v4
drm/radeon: fix some missing parens in asic macros
drm/radeon: add some new SI pci ids
drm/radeon: fix ordering in pll picking on dce4+
drm/radeon: do not reenable crtc after moving vram start address
drm/radeon: fix bank tiling parameters on cayman
drm/radeon: fix bank tiling parameters on evergreen
drm/radeon: fix bank tiling parameters on SI
drm/radeon: properly handle crtc powergating
drm/radeon: properly handle SS overrides on TN (v2)
drm/radeon/dce4+: set a more reasonable cursor watermark
drm/radeon: fix handling for ddc type 5 on combios
Jani Nikula [Mon, 13 Aug 2012 14:33:02 +0000 (17:33 +0300)]
drm/i915: ensure i2c adapter is all set before adding it
i2c_add_adapter() may do i2c transfers on the bus to detect supported
devices. Therefore the adapter needs to be all set before adding it. This
was not the case for the bit-banging fallback, resulting in an oops if the
device detection GMBUS transfers timed out. Fix the issue by calling
i2c_add_adapter() only after intel_gpio_setup().
LKML-Reference: <
5021F00B.7000503@ionic.de>
Tested-by: Mihai Moldovan <ionic@ionic.de>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Dmitrii Cherkasov [Mon, 13 Aug 2012 14:53:29 +0000 (10:53 -0400)]
drm/radeon: fix typo in function header comment
Signed-off-by: Dmitrii Cherkasov <DCherkasov@luxsoft.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Marek Olšák [Thu, 9 Aug 2012 14:34:17 +0000 (16:34 +0200)]
drm/radeon/kms: implement timestamp userspace query (v2)
Returns a snapshot of the GPU clock counter. Needed
for certain OpenGL extensions.
v2: agd5f
- address Jerome's comments
- add function documentation
Signed-off-by: Marek Olšák <maraeo@gmail.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Marek Olšák [Thu, 9 Aug 2012 14:34:16 +0000 (16:34 +0200)]
drm/radeon/kms: add MSAA texture support for r600-evergreen
Most of the checking seems to be in place already. As you can see,
log2(number of samples) resides in LAST_LEVEL.
This is required for MSAA support (namely for depth-stencil resolve and
blitting between MSAA resources).
Signed-off-by: Marek Olšák <maraeo@gmail.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Marek Olšák [Thu, 9 Aug 2012 14:34:15 +0000 (16:34 +0200)]
drm/radeon/kms: reorder code in r600_check_texture_resource
Signed-off-by: Marek Olšák <maraeo@gmail.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Jerome Glisse [Mon, 6 Aug 2012 16:32:21 +0000 (12:32 -0400)]
drm/radeon: fence virtual address and free it once idle v4
Virtual address need to be fenced to know when we can safely remove it.
This patch also properly clear the pagetable. Previously it was
serouisly broken.
Kernel 3.5/3.4 need a similar patch but adapted for difference in mutex locking.
v2: For to update pagetable when unbinding bo (don't bailout if
bo_va->valid is true).
v3: Add kernel 3.5/3.4 comment.
v4: Fix compilation warnings.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Alex Deucher [Fri, 3 Aug 2012 15:50:54 +0000 (11:50 -0400)]
drm/radeon: fix some missing parens in asic macros
Better safe than sorry.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Alex Deucher [Mon, 6 Aug 2012 14:03:59 +0000 (10:03 -0400)]
drm/radeon: add some new SI pci ids
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Alex Deucher [Mon, 6 Aug 2012 21:06:03 +0000 (17:06 -0400)]
drm/radeon: fix ordering in pll picking on dce4+
No functional change, but re-order the cases so they
evaluate properly due to the way the DCE macros work.
Noticed by kallisti5 on IRC.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Jerome Glisse [Fri, 27 Jul 2012 20:32:24 +0000 (16:32 -0400)]
drm/radeon: do not reenable crtc after moving vram start address
It seems we can not update the crtc scanout address. After disabling
crtc, update to base address do not take effect after crtc being
reenable leading to at least frame being scanout from the old crtc
base address. Disabling crtc display request lead to same behavior.
So after changing the vram address if we don't keep crtc disabled
we will have the GPU trying to read some random system memory address
with some iommu this will broke the crtc engine and will lead to
broken display and iommu error message.
So to avoid this, disable crtc. For flicker less boot we will need
to avoid moving the vram start address.
This patch should also fix :
https://bugs.freedesktop.org/show_bug.cgi?id=42373
Cc: <stable@vger.kernel.org>
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Alex Deucher [Tue, 31 Jul 2012 15:05:11 +0000 (11:05 -0400)]
drm/radeon: fix bank tiling parameters on cayman
Handle the 16 bank case.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Alex Deucher [Tue, 31 Jul 2012 15:01:10 +0000 (11:01 -0400)]
drm/radeon: fix bank tiling parameters on evergreen
Handle the 16 bank case.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Christian König [Tue, 31 Jul 2012 11:48:51 +0000 (13:48 +0200)]
drm/radeon: fix bank tiling parameters on SI
The sixteen bank case wasn't handled here, leading to GPU
crashes because of userspace miscalculation.
Signed-off-by: Christian König <deathsimple@vodafone.de>
Cc: stable@vger.kernel.org
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Alex Deucher [Thu, 26 Jul 2012 17:38:52 +0000 (13:38 -0400)]
drm/radeon: properly handle crtc powergating
Need to make sure the crtc is gated on before modesetting.
Explicitly gate the crtc on in prepare() and set a flag
so that the dpms functions don't gate it off during
mode set.
Noticed by sylware on IRC.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Alex Deucher [Wed, 25 Jul 2012 16:32:59 +0000 (12:32 -0400)]
drm/radeon: properly handle SS overrides on TN (v2)
The IntegratedSystemInfo table changed versions
on TN. Update the SS override lookup to handle it.
v2: fix copy-paste typo.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Alex Deucher [Tue, 10 Jul 2012 19:20:24 +0000 (15:20 -0400)]
drm/radeon/dce4+: set a more reasonable cursor watermark
Set a more reasonable default cursor watermark. The
recommended default value is 4. This should reduce
urgency requests to the MC form the display hw.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Alex Deucher [Fri, 20 Jul 2012 00:11:44 +0000 (20:11 -0400)]
drm/radeon: fix handling for ddc type 5 on combios
When ddc type is 5, need to look up the i2c channel
in the i2c table.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Linus Torvalds [Mon, 13 Aug 2012 06:59:04 +0000 (09:59 +0300)]
Merge branch 'fixes-for-3.6' of git://git./linux/kernel/git/cooloney/linux-leds
Pull leds fixes/revert from Bryan Wu.
* 'fixes-for-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds:
leds: renesas: fix error handling
Revert "leds: use led_set_brightness in led_trigger_event"
leds: lp8788: Fix updating scale configuration bits
Arnd Bergmann [Wed, 8 Aug 2012 21:27:58 +0000 (05:27 +0800)]
leds: renesas: fix error handling
bfe4c041 "leds: convert Renesas TPU LED driver to devm_kzalloc() and
cleanup error exit path" introduced a possible case in which r_tpu_probe
calls iounmap on a wild pointer. This changes the one case that was
missed in the same way as the other error paths.
Without this patch, building kota2_defconfig results in:
drivers/leds/leds-renesas-tpu.c: In function 'r_tpu_probe':
drivers/leds/leds-renesas-tpu.c:246:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized]
drivers/leds/leds-renesas-tpu.c:308:17: warning: 'p' may be used uninitialized in this function [-Wuninitialized]
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Magnus Damm <damm@opensource.se>
Signed-off-by: Bryan Wu <bryan.wu@canonical.com>
Fabio Baltieri [Mon, 13 Aug 2012 06:27:24 +0000 (14:27 +0800)]
Revert "leds: use led_set_brightness in led_trigger_event"
This reverts commit
a0193cbee0809d65362a0767b2d50306b145b2f5.
The problem with the original commit was that it caused a warning with
the MMC trigger calling del_timer_sync from hard-irq context.
Signed-off-by: Fabio Baltieri <fabio.baltieri@gmail.com>
Reported-by: Pawel Moll <pawel.moll@arm.com>
Signed-off-by: Bryan Wu <bryan.wu@canonical.com>
Linus Torvalds [Mon, 13 Aug 2012 06:18:19 +0000 (09:18 +0300)]
Merge git://git./linux/kernel/git/davem/net
Pull networking changes from David Miller:
"Most importantly this should cure the ipv4-mapped ipv6 socket TCP
crashes some people were seeing, otherwise:
1) Fix e1000e autonegotiation handling regression, from Tushar Dave.
2) Fix TX data corruption race on e1000e down, also from Tushar Dave.
3) Fix bfin_sir IRDA driver build, from Sonic Zhang.
4) AF_PACKET mmap() tests a flag in the TX ring shared between
userspace and the kernel for an internal consistency check. It
really shouldn't do this to validate the kernel's own behavior
because the user can corrupt it to be any value at all. From
Daniel Borkmann.
5) Fix TCP metrics leak on netns dismantle, from Eric Dumazet.
6) Orphan the anonymous TCP socket from the SKB in
ip_send_unicast_reply() so that the rest of the stack needn't see
it. Otherwise we get selinux problems of all sorts, from Eric
Dumazet.
This is the best way to fix this since the socket is just a place
holder for sending packets in a context where we have no real
socket at all.
7) Fix TUN detach crashes, from Stanislav Kinsbursky.
8) dev_set_alias() leaks memory on krealloc() failure, from Alexey
Khoroshilov.
9) FIB trie must use call_rcu() not call_rcu_bh(), because this code
is not universally invoked from software interrupts. From Eric
Dumazet.
10) PPTP looks up ipv4 routes with the wrong network namespace, fix
from Gao Feng."
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (33 commits)
bnx2x: Fix compiler warnings
af_packet: remove BUG statement in tpacket_destruct_skb
macvtap: rcu_dereference outside read-lock section
codel: refine one condition to avoid a nul rec_inv_sqrt
ixgbe: add missing braces
ipv4: fix ip_send_skb()
net: tcp: ipv6_mapped needs sk_rx_dst_set method
ipv4: tcp: unicast_sock should not land outside of TCP stack
bnx2x: Fix recovery flow cleanup during probe
bnx2x: fix unload previous driver flow when flr-capable
tun: don't zeroize sock->file on detach
igb: Fix register defines for all non-82575 hardware
e1000e: fix panic while dumping packets on Tx hang with IOMMU
igb: fix panic while dumping packets on Tx hang with IOMMU
tcp: must free metrics at net dismantle
net/stmmac: mark probe function as __devinit
lpc_eth: remove obsolete ifdefs
net/core: Fix potential memory leak in dev_set_alias()
cdc-phonet: Don't leak in usbpn_open
batman-adv: Fix mem leak in the batadv_tt_local_event() function
...
Linus Torvalds [Mon, 13 Aug 2012 05:40:51 +0000 (08:40 +0300)]
Merge branch 'for-linus' of git://git./linux/kernel/git/nab/target-pending
Pull tcm_vhost level target fabric driver from Nicholas Bellinger:
"Here is the PULL request for the initial merge of tcm_vhost based on
RFC-v5 code with MST's ACK appended to the initial merge commit."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
tcm_vhost: Initial merge for vhost level target fabric driver
Laxman Dewangan [Fri, 20 Jul 2012 08:01:08 +0000 (13:31 +0530)]
dma: tegra: enable/disable dma clock
Enable the DMA clock when allocating channel and
disable clock when freeing channels.
Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Joren Van Onder [Sat, 11 Aug 2012 17:10:35 +0000 (17:10 +0000)]
bnx2x: Fix compiler warnings
Fix the following compiler warnings:
- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c:2908:3: warning: comparison
of distinct pointer types lacks a cast [enabled by default]
- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c:1709:7: warning: comparison
of distinct pointer types lacks a cast [enabled by default]
Signed-off-by: Joren Van Onder <joren.vanonder@gmail.com>
Acked-By: Yuval Mintz <yuvalmin@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
danborkmann@iogearbox.net [Fri, 10 Aug 2012 22:48:54 +0000 (22:48 +0000)]
af_packet: remove BUG statement in tpacket_destruct_skb
Here's a quote of the comment about the BUG macro from asm-generic/bug.h:
Don't use BUG() or BUG_ON() unless there's really no way out; one
example might be detecting data structure corruption in the middle
of an operation that can't be backed out of. If the (sub)system
can somehow continue operating, perhaps with reduced functionality,
it's probably not BUG-worthy.
If you're tempted to BUG(), think again: is completely giving up
really the *only* solution? There are usually better options, where
users don't need to reboot ASAP and can mostly shut down cleanly.
In our case, the status flag of a ring buffer slot is managed from both sides,
the kernel space and the user space. This means that even though the kernel
side might work as expected, the user space screws up and changes this flag
right between the send(2) is triggered when the flag is changed to
TP_STATUS_SENDING and a given skb is destructed after some time. Then, this
will hit the BUG macro. As David suggested, the best solution is to simply
remove this statement since it cannot be used for kernel side internal
consistency checks. I've tested it and the system still behaves /stable/ in
this case, so in accordance with the above comment, we should rather remove it.
Signed-off-by: Daniel Borkmann <daniel.borkmann@tik.ee.ethz.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Denis Efremov [Sat, 11 Aug 2012 20:26:31 +0000 (20:26 +0000)]
macvtap: rcu_dereference outside read-lock section
rcu_dereference occurs in update section. Replacement by
rcu_dereference_protected in order to prevent lockdep
complaint.
Found by Linux Driver Verification project (linuxtesting.org)
Signed-off-by: Denis Efremov <yefremov.denis@gmail.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Sun, 12 Aug 2012 18:45:33 +0000 (21:45 +0300)]
Merge tag 'gpio-fixes-v3.6-rc1' of git://git./linux/kernel/git/linusw/linux-gpio
Pull gpio fixes from Linus Walleij:
- Fix a resource leak in the SCH driver
- Fix the register address calculation in the MSIC driver
- Fix the PXA driver's devicetree functions
- Delete redundant shadow variable leftovers in the MXC driver
- Specify the GPIO base for the device tree probe in the MXC driver
- Add a modalias for the i.MX driver
- Fix off-by-one bug in the Samsung driver
- Fix erroneous errorpath in the Langwell driver
* tag 'gpio-fixes-v3.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
drivers/gpio/gpio-langwell.c: fix error return code
gpio: samsung: Fix off-by-one bug in gpio addresses
ARM: dts: imx: add alias for gpio
gpio/mxc: specify gpio base for device tree probe
gpio/mxc: remove redundant shadow variables initialization
GPIO: gpio-pxa: fix devicetree functions
gpio: msic: Fix calculating register address in msic_gpio_to_oreg()
gpio-sch: Fix leak of resource
Linus Torvalds [Sun, 12 Aug 2012 18:36:13 +0000 (21:36 +0300)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/linux-security
Pull a security subsystem fix from James Morris
"This fixes an issue in the Yama LSM"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
Yama: higher restrictions should block PTRACE_TRACEME
Linus Torvalds [Sun, 12 Aug 2012 18:34:09 +0000 (21:34 +0300)]
Merge tag 'pm-for-3.6-rc2' of git://git./linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael J. Wysocki:
- Fix for two recent regressions in the generic PM domains framework.
- Revert of a commit that introduced a resume regression and is
conceptually incorrect in my opinion.
- Fix for a return value in pcc-cpufreq.c from Julia Lawall.
- RTC wakeup signaling fix from Neil Brown.
- Suppression of compiler warnings for CONFIG_PM_SLEEP unset in ACPI,
platform/x86 and TPM drivers.
* tag 'pm-for-3.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
tpm_tis / PM: Fix unused function warning for CONFIG_PM_SLEEP
platform / x86 / PM: Fix unused function warnings for CONFIG_PM_SLEEP
ACPI / PM: Fix unused function warnings for CONFIG_PM_SLEEP
Revert "NMI watchdog: fix for lockup detector breakage on resume"
PM: Make dev_pm_get_subsys_data() always return 0 on success
drivers/cpufreq/pcc-cpufreq.c: fix error return code
RTC: Avoid races between RTC alarm wakeup and suspend.
Linus Torvalds [Sun, 12 Aug 2012 18:31:44 +0000 (21:31 +0300)]
Merge tag 'fixes-for-linus' of git://git./linux/kernel/git/arm/arm-soc
Pull arm-soc bug fixes from Arnd Bergmann:
"These are a bunch of bug fixes that came in after the merge window and
one update for the MAINTAINERS file.
The largest part of the fixes are patches that address bugs found by
building all the ARM defconfig files. There are a lot more warnings
that we have patches for, but the others are either still under
discussion or are harmless and do not cause actual problems besides
making the build slightly noisy."
* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (30 commits)
ARM: davinci: remove broken ntosd2_init_i2c
ARM: s3c24xx: enable CONFIG_BUG for tct_hammer
omap-rng: fix use of SIMPLE_DEV_PM_OPS
spi/s3c64xx: improve error handling
mtd/omap2: fix dmaengine_slave_config error handling
gpio: em: do not discard em_gio_irq_domain_cleanup
ARM: exynos: exynos_pm_add_dev_to_genpd may be unused
ARM: imx: gpmi-nand depends on mxs-dma
ARM: integrator: include <linux/export.h>
ARM: s3c24xx: use new PWM driver
ARM: sa1100: include linux/io.h in hackkit leds code
Input: eeti_ts: pass gpio value instead of IRQ
ARM: pxa: remove irq_to_gpio from ezx-pcap driver
ARM: tegra: more regulator fixes for Harmony
usb/ohci-omap: remove unused variable
mfd/asic3: fix asic3_mfd_probe return value
ARM: kirkwood: fix typo in Makefile.boot
i.MX27: Fix emma-prp and csi clocks.
ARM: integrator: use clk_prepare_enable() for timer
MAINTAINERS: update entry for Linus Walleij
...
Linus Torvalds [Sun, 12 Aug 2012 18:30:30 +0000 (21:30 +0300)]
Merge branch 'fixes-for-linus-for-3.6-rc2' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping
Pull three dma-mapping fixes from Marek Szyprowski.
* 'fixes-for-linus-for-3.6-rc2' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping:
ARM: dma-mapping: fix incorrect freeing of atomic allocations
ARM: dma-mapping: fix atomic allocation alignment
ARM: mm: fix MMU mapping of CMA regions
Linus Torvalds [Sun, 12 Aug 2012 18:28:41 +0000 (21:28 +0300)]
Merge branch 'for-linus-3.6' of git://git./linux/kernel/git/mason/linux-btrfs
Pull btrfs merge fix from Chris Mason:
"This fixes a merge error in rc1. The calls to mnt_want_write should
have been removed."
* 'for-linus-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
Btrfs: remove mnt_want_write call in btrfs_mksubvol
Jeff Mahoney [Fri, 10 Aug 2012 19:07:09 +0000 (15:07 -0400)]
printk: Fix calculation of length used to discard records
While tracking down a weird buffer overflow issue in a program that
looked to be sane, I started double checking the length returned by
syslog(SYSLOG_ACTION_READ_ALL, ...) to make sure it wasn't overflowing
the buffer.
Sure enough, it was. I saw this in strace:
11339 syslog(SYSLOG_ACTION_READ_ALL, "<5>[244017.708129] REISERFS (dev"..., 8192) = 8279
It turns out that the loops that calculate how much space the entries
will take when they're copied don't include the newlines and prefixes
that will be included in the final output since prev flags is passed as
zero.
This patch properly accounts for it and fixes the overflow.
CC: stable@kernel.org
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Daniel Vetter [Fri, 10 Aug 2012 09:10:20 +0000 (11:10 +0200)]
drm/i915: ignore eDP bpc settings from vbt
This has originally been introduced to not oversubscribe the dp links
in
commit
885a5fb5b120a5c7e0b3baad7b0feb5a89f76c18
Author: Zhenyu Wang <zhenyuw@linux.intel.com>
Date: Tue Jan 12 05:38:31 2010 +0800
drm/i915: fix pixel color depth setting on eDP
Since then we've fixed up the dp link bandwidth calculation code and
should now automatically fall back to 6bpc dithering. So this is
unnecessary.
Furthermore it seems to break the new MacbookPro with retina display,
hence let's just rip this out.
Reported-by: Benoit Gschwind <gschwind@gnu-log.net>
Cc: Benoit Gschwind <gschwind@gnu-log.net>
Cc: Francois Rigaut <frigaut@gmail.com>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: stable@vger.kernel.org
Tested-by: Benoit Gschwind <gschwind@gnu-log.net>
Tested-by: Bernhard Froemel <froemel at vmars tuwien.ac.at>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
--
Testing feedback highgly welcome, and thanks for Benoit for finding
out that the bpc computations are busted.
-Daniel
Takashi Iwai [Sat, 11 Aug 2012 06:56:42 +0000 (08:56 +0200)]
drm/i915: Fix blank panel at reopening lid
When you reopen the lid on a laptop with PCH, the panel suddenly goes
blank sometimes. It seems because BLC_PWM_CPU_CTL register is cleared
to zero when BLC_PWM_CPU_CTL2 and BLC_PWM_PCH_CTL1 registers are
enabled.
This patch fixes the problem by moving the call of the function setting
BLC_PWM_CPU_CTL after enabling other two registers.
Reported-and-tested-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Eric Dumazet [Sun, 29 Jul 2012 20:52:21 +0000 (20:52 +0000)]
codel: refine one condition to avoid a nul rec_inv_sqrt
One condition before codel_Newton_step() was not good if
we never left the dropping state for a flow. As a result
rec_inv_sqrt was 0, instead of the ~0 initial value.
codel control law was then set to a very aggressive mode, dropping
many packets before reaching 'target' and recovering from this problem.
To keep codel_vars_init() as efficient as possible, refine
the condition to make sure rec_inv_sqrt initial value is correct
Many thanks to Anton Mich for discovering the issue and suggesting
a fix.
Reported-by: Anton Mich <lp2s1h@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Emil Tantilov [Fri, 10 Aug 2012 07:35:14 +0000 (07:35 +0000)]
ixgbe: add missing braces
This patch adds missing braces around the 10gig link check to include the check for KR support.
Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Reported-by: Sascha Wildner <saw@online.de>
Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Fri, 10 Aug 2012 23:26:41 +0000 (16:26 -0700)]
Merge branch 'for-davem' of git://git./linux/kernel/git/linville/wireless
John W. Linville says:
====================
Here is a handful of fixes intended for 3.6.
Daniel Drake offers a cfg80211 fix to consume pending events before
taking a wireless device down. This prevents a resource leak.
Stanislaw Gruszka gives us a fix for a NULL pointer dereference in
rt61pci.
Johannes Berg provides an iwlwifi patch to disable "greenfield" mode.
Use of that mode was causing a rate scaling problem in for iwlwifi.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Fri, 10 Aug 2012 02:22:47 +0000 (02:22 +0000)]
ipv4: fix ip_send_skb()
ip_send_skb() can send orphaned skb, so we must pass the net pointer to
avoid possible NULL dereference in error path.
Bug added by commit
3a7c384ffd57 (ipv4: tcp: unicast_sock should not
land outside of TCP stack)
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
John W. Linville [Fri, 10 Aug 2012 18:05:38 +0000 (14:05 -0400)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless into for-davem
Rafael J. Wysocki [Thu, 9 Aug 2012 21:00:35 +0000 (23:00 +0200)]
tpm_tis / PM: Fix unused function warning for CONFIG_PM_SLEEP
According to a compiler warning, the tpm_tis_resume() function is not
used for CONFIG_PM_SLEEP unset, so add a #ifdef to prevent it from
being built in that case.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Rafael J. Wysocki [Thu, 9 Aug 2012 21:00:13 +0000 (23:00 +0200)]
platform / x86 / PM: Fix unused function warnings for CONFIG_PM_SLEEP
According to compiler warnings, quite some suspend/resume functions
in platform x86 drivers are not used for CONFIG_PM_SLEEP unset, so
add #ifdefs to prevent them from being built in that case.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Rafael J. Wysocki [Thu, 9 Aug 2012 21:00:02 +0000 (23:00 +0200)]
ACPI / PM: Fix unused function warnings for CONFIG_PM_SLEEP
According to compiler warnings, several suspend/resume functions
in ACPI drivers are not used for CONFIG_PM_SLEEP unset, so add
#ifdefs to prevent them from being built in that case.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Arnd Bergmann [Mon, 30 Apr 2012 14:03:33 +0000 (14:03 +0000)]
ARM: davinci: remove broken ntosd2_init_i2c
ntosd2_init_i2c walks the ntosd2_i2c_info array, which it expects to
be populated with at least one member. gcc correctly warns about
the out-of-bounds access here.
Since this can not possibly work, it's better to disable i2c
support entirely on this board.
Without this patch, building davinci_all_defconfig results in:
arch/arm/mach-davinci/board-neuros-osd2.c: In function 'davinci_ntosd2_init':
arch/arm/mach-davinci/board-neuros-osd2.c:187:20: warning: array subscript is above array bounds [-Warray-bounds]
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Sekhar Nori <nsekhar@ti.com>
Cc: Kevin Hilman <khilman@ti.com>
Cc: Andrey Porodko <panda@chelcom.ru>
Arnd Bergmann [Thu, 3 May 2012 12:47:54 +0000 (12:47 +0000)]
ARM: s3c24xx: enable CONFIG_BUG for tct_hammer
Disabling CONFIG_BUG creates an insane amount of build warnings, which
makes it useless to check for building defconfigs to see if new
warnings show up.
Without this patch, building tct_hammer_defconfig results in:
net/packet/af_packet.c: In function 'tpacket_rcv':
net/packet/af_packet.c:1889:30: warning: 'hdrlen' may be used uninitialized in this function [-Wuninitialized]
net/core/ethtool.c: In function 'ethtool_get_feature_mask':
net/core/ethtool.c:213:1: warning: control reaches end of non-void function [-Wreturn-type]
block/cfq-iosched.c: In function 'cfq_async_queue_prio':
block/cfq-iosched.c:2914:1: warning: control reaches end of non-void function [-Wreturn-type]
mm/bootmem.c: In function 'mark_bootmem':
mm/bootmem.c:352:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/dev.c: In function 'skb_warn_bad_offload':
net/core/dev.c:1904:33: warning: unused variable 'null_features' [-Wunused-variable]
drivers/mtd/chips/cfi_probe.c: In function 'cfi_chip_setup':
include/linux/mtd/cfi.h:489:3: warning: 'r.x[0]' may be used uninitialized in this function [-Wuninitialized]
include/linux/mtd/map.h:394:11: note: 'r.x[0]' was declared here
include/linux/mtd/cfi.h:489:3: warning: 'r.x[0]' may be used uninitialized in this function [-Wuninitialized]
(and many more)
The size of vmlinux increases by 1.78% because of this:
size obj-arm/vmlinux.nobug
text data bss dec hex filename
2108474 116916 55352 2280742 22cd26 obj-arm/vmlinux
size obj-arm/vmlinux.bug
text data bss dec hex filename
2150804 116916 53696 2321416 236c08 obj-arm/vmlinux
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Kukjin Kim <kgene.kim@samsung.com>
Cc: Ben Dooks <ben-linux@fluff.org>
Dave Airlie [Thu, 9 Aug 2012 05:00:15 +0000 (15:00 +1000)]
drm/mgag200: fix G200ER pll picking algorithm
The original code was misported from the X driver,
a) an int went to unsigned int, breaking the downward counting testm code
b) the port did the vco/computed clock bits completely wrong.
This fixes an infinite loop on modprobe on some Dell servers with the G200ER
chipset variant.
Found in internal testing.
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alexey Khoroshilov [Tue, 7 Aug 2012 12:23:06 +0000 (12:23 +0000)]
drm/edid: Fix potential memory leak in edid_load()
Do not leak memory by updating pointer with potentially
NULL realloc return value.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: Carsten Emde <C.Emde@osadl.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Arnd Bergmann [Fri, 10 Aug 2012 10:28:57 +0000 (12:28 +0200)]
Merge branch 'testing/new-warnings' into fixes
These patches all fix bugs that were newly introduced in v3.6-rc1
and found because they cause a gcc warning with one of the ARM
defconfigs. Most of them are harmless, but since we're trying
to get rid of all warnings eventually, we can start with the ones
that were not there before.
* testing/new-warnings:
omap-rng: fix use of SIMPLE_DEV_PM_OPS
spi/s3c64xx: improve error handling
mtd/omap2: fix dmaengine_slave_config error handling
gpio: em: do not discard em_gio_irq_domain_cleanup
ARM: exynos: exynos_pm_add_dev_to_genpd may be unused
usb/ohci-omap: remove unused variable
mfd/asic3: fix asic3_mfd_probe return value
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Arnd Bergmann [Sat, 4 Aug 2012 07:11:34 +0000 (07:11 +0000)]
omap-rng: fix use of SIMPLE_DEV_PM_OPS
omap_rng_suspend and omap_rng_resume are unused if CONFIG_PM is enabled
but CONFIG_PM_SLEEP is disabled. I found this while building all defconfig
files on ARM. It's not clear to me if this is the right solution, but
at least it makes the code consistent again.
Without this patch, building omap1_defconfig results in:
drivers/char/hw_random/omap-rng.c:165:12: warning: 'omap_rng_suspend' defined but not used [-Wunused-function]
drivers/char/hw_random/omap-rng.c:171:12: warning: 'omap_rng_resume' defined but not used [-Wunused-function]
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Kevin Hilman <khilman@ti.com>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Arnd Bergmann [Sat, 4 Aug 2012 11:18:20 +0000 (11:18 +0000)]
spi/s3c64xx: improve error handling
When a device tree definition os an s3c64xx SPI master is missing
a "controller-data" subnode, the newly added s3c64xx_get_slave_ctrldata
function might use uninitialized memory in place of that node,
which was correctly reported by gcc.
Without this patch, building s3c6400_defconfig results in:
drivers/spi/spi-s3c64xx.c: In function 's3c64xx_get_slave_ctrldata.isra.25':
drivers/spi/spi-s3c64xx.c:841:5: warning: 'data_np' may be used uninitialized in this function [-Wuninitialized]
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Thomas Abraham <thomas.abraham@linaro.org>
Acked-by: Kukjin Kim <kgene.kim@samsung.com>
Cc: Jaswinder Singh <jaswinder.singh@linaro.org>
Cc: Grant Likely <grant.likely@secretlab.ca>
Arnd Bergmann [Sat, 4 Aug 2012 11:05:25 +0000 (11:05 +0000)]
mtd/omap2: fix dmaengine_slave_config error handling
The newly added dmaengine support in the omap2 nand driver
potentially causes an undefined return value from the
omap_nand_probe function when dmaengine_slave_config
reports an error. Let's handle this by returning the
same error back to the caller.
Without this patch, building omap2plus_defconfig results in:
drivers/mtd/nand/omap2.c: In function 'omap_nand_probe':
drivers/mtd/nand/omap2.c:1154:6: warning: 'err' may be used uninitialized in this function [-Wuninitialized]
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Russell King <rmk+kernel@arm.linux.org.uk>
Cc: Grazvydas Ignotas <notasas@gmail.com>
Arnd Bergmann [Sat, 4 Aug 2012 10:33:24 +0000 (10:33 +0000)]
gpio: em: do not discard em_gio_irq_domain_cleanup
The newly added gpio-em driver marks its em_gio_irq_domain_cleanup
function as __devexit, which would lead to that function being
discarded in case CONFIG_HOTPLUG is disabled. However, the function
is also called by the error handling logic em_gio_probe, which
would cause a jump into a NULL pointer if it was removed from the
kernel or module.
Without this patch, building kzm9d_defconfig results in:
WARNING: drivers/gpio/built-in.o(.devinit.text+0x330): Section mismatch in reference from the function em_gio_probe() to the function .devexit.text:em_gio_irq_domain_cleanup()
The function __devinit em_gio_probe() references
a function __devexit em_gio_irq_domain_cleanup().
This is often seen when error handling in the init function
uses functionality in the exit path.
The fix is often to remove the __devexit annotation of
em_gio_irq_domain_cleanup() so it may be used outside an exit section.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Magnus Damm <damm@opensource.se>
Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Arnd Bergmann [Sat, 4 Aug 2012 10:28:33 +0000 (10:28 +0000)]
ARM: exynos: exynos_pm_add_dev_to_genpd may be unused
exynos_pm_add_dev_to_genpd is used if one or more out of a large
number of Kconfig symbols are enabled. However the new
exynos_defconfig selects none of those, so the function becomes
unused. Marking it so lets the compiler automatically discard
it.
Without this patch, building exynos_defconfig results in:
arch/arm/mach-exynos/pm_domains.c:118:123: warning: 'exynos_pm_add_dev_to_genpd' defined but not used [-Wunused-function]
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Thomas Abraham <thomas.abraham@linaro.org>
Acked-by: Kukjin Kim <kgene.kim@samsung.com>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Kees Cook [Fri, 10 Aug 2012 02:01:26 +0000 (19:01 -0700)]
Yama: higher restrictions should block PTRACE_TRACEME
The higher ptrace restriction levels should be blocking even
PTRACE_TRACEME requests. The comments in the LSM documentation are
misleading about when the checks happen (the parent does not go through
security_ptrace_access_check() on a PTRACE_TRACEME call).
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org # 3.5.x and later
Signed-off-by: James Morris <james.l.morris@oracle.com>
Eric Dumazet [Thu, 9 Aug 2012 14:11:00 +0000 (14:11 +0000)]
net: tcp: ipv6_mapped needs sk_rx_dst_set method
commit
5d299f3d3c8a2fb (net: ipv6: fix TCP early demux) added a
regression for ipv6_mapped case.
[ 67.422369] SELinux: initialized (dev autofs, type autofs), uses
genfs_contexts
[ 67.449678] SELinux: initialized (dev autofs, type autofs), uses
genfs_contexts
[ 92.631060] BUG: unable to handle kernel NULL pointer dereference at
(null)
[ 92.631435] IP: [< (null)>] (null)
[ 92.631645] PGD 0
[ 92.631846] Oops: 0010 [#1] SMP
[ 92.632095] Modules linked in: autofs4 sunrpc ipv6 dm_mirror
dm_region_hash dm_log dm_multipath dm_mod video sbs sbshc battery ac lp
parport sg snd_hda_intel snd_hda_codec snd_seq_oss snd_seq_midi_event
snd_seq snd_seq_device pcspkr snd_pcm_oss snd_mixer_oss snd_pcm
snd_timer serio_raw button floppy snd i2c_i801 i2c_core soundcore
snd_page_alloc shpchp ide_cd_mod cdrom microcode ehci_hcd ohci_hcd
uhci_hcd
[ 92.634294] CPU 0
[ 92.634294] Pid: 4469, comm: sendmail Not tainted 3.6.0-rc1 #3
[ 92.634294] RIP: 0010:[<
0000000000000000>] [< (null)>]
(null)
[ 92.634294] RSP: 0018:
ffff880245fc7cb0 EFLAGS:
00010282
[ 92.634294] RAX:
ffffffffa01985f0 RBX:
ffff88024827ad00 RCX:
0000000000000000
[ 92.634294] RDX:
0000000000000218 RSI:
ffff880254735380 RDI:
ffff88024827ad00
[ 92.634294] RBP:
ffff880245fc7cc8 R08:
0000000000000001 R09:
0000000000000000
[ 92.634294] R10:
0000000000000000 R11:
ffff880245fc7bf8 R12:
ffff880254735380
[ 92.634294] R13:
ffff880254735380 R14:
0000000000000000 R15:
7fffffffffff0218
[ 92.634294] FS:
00007f4516ccd6f0(0000) GS:
ffff880256600000(0000)
knlGS:
0000000000000000
[ 92.634294] CS: 0010 DS: 0000 ES: 0000 CR0:
000000008005003b
[ 92.634294] CR2:
0000000000000000 CR3:
0000000245ed1000 CR4:
00000000000007f0
[ 92.634294] DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
[ 92.634294] DR3:
0000000000000000 DR6:
00000000ffff0ff0 DR7:
0000000000000400
[ 92.634294] Process sendmail (pid: 4469, threadinfo
ffff880245fc6000,
task
ffff880254b8cac0)
[ 92.634294] Stack:
[ 92.634294]
ffffffff813837a7 ffff88024827ad00 ffff880254b6b0e8
ffff880245fc7d68
[ 92.634294]
ffffffff81385083 00000000001d2680 ffff8802547353a8
ffff880245fc7d18
[ 92.634294]
ffffffff8105903a ffff88024827ad60 0000000000000002
00000000000000ff
[ 92.634294] Call Trace:
[ 92.634294] [<
ffffffff813837a7>] ? tcp_finish_connect+0x2c/0xfa
[ 92.634294] [<
ffffffff81385083>] tcp_rcv_state_process+0x2b6/0x9c6
[ 92.634294] [<
ffffffff8105903a>] ? sched_clock_cpu+0xc3/0xd1
[ 92.634294] [<
ffffffff81059073>] ? local_clock+0x2b/0x3c
[ 92.634294] [<
ffffffff8138caf3>] tcp_v4_do_rcv+0x63a/0x670
[ 92.634294] [<
ffffffff8133278e>] release_sock+0x128/0x1bd
[ 92.634294] [<
ffffffff8139f060>] __inet_stream_connect+0x1b1/0x352
[ 92.634294] [<
ffffffff813325f5>] ? lock_sock_nested+0x74/0x7f
[ 92.634294] [<
ffffffff8104b333>] ? wake_up_bit+0x25/0x25
[ 92.634294] [<
ffffffff813325f5>] ? lock_sock_nested+0x74/0x7f
[ 92.634294] [<
ffffffff8139f223>] ? inet_stream_connect+0x22/0x4b
[ 92.634294] [<
ffffffff8139f234>] inet_stream_connect+0x33/0x4b
[ 92.634294] [<
ffffffff8132e8cf>] sys_connect+0x78/0x9e
[ 92.634294] [<
ffffffff813fd407>] ? sysret_check+0x1b/0x56
[ 92.634294] [<
ffffffff81088503>] ? __audit_syscall_entry+0x195/0x1c8
[ 92.634294] [<
ffffffff811cc26e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[ 92.634294] [<
ffffffff813fd3e2>] system_call_fastpath+0x16/0x1b
[ 92.634294] Code: Bad RIP value.
[ 92.634294] RIP [< (null)>] (null)
[ 92.634294] RSP <
ffff880245fc7cb0>
[ 92.634294] CR2:
0000000000000000
[ 92.648982] ---[ end trace
24e2bed94314c8d9 ]---
[ 92.649146] Kernel panic - not syncing: Fatal exception in interrupt
Fix this using inet_sk_rx_dst_set(), and export this function in case
IPv6 is modular.
Reported-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>