Ditang Chen [Fri, 7 Mar 2014 05:27:57 +0000 (13:27 +0800)]
SUNRPC: Fix oops when trace sunrpc_task events in nfs client
When tracking sunrpc_task events in nfs client, the clnt pointer may be NULL.
[ 139.269266] BUG: unable to handle kernel NULL pointer dereference at
0000000000000004
[ 139.269915] IP: [<
ffffffffa026f216>] ftrace_raw_event_rpc_task_running+0x86/0xf0 [sunrpc]
[ 139.269915] PGD
1d293067 PUD
1d294067 PMD 0
[ 139.269915] Oops: 0000 [#1] SMP
[ 139.269915] Modules linked in: nfsv4 dns_resolver nfs lockd sunrpc fscache sg ppdev e1000
serio_raw pcspkr parport_pc parport i2c_piix4 i2c_core microcode xfs libcrc32c sd_mod sr_mod
cdrom ata_generic crc_t10dif crct10dif_common pata_acpi ahci libahci ata_piix libata dm_mirror
dm_region_hash dm_log dm_mod
[ 139.269915] CPU: 0 PID: 59 Comm: kworker/0:2 Not tainted 3.10.0-84.el7.x86_64 #1
[ 139.269915] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[ 139.269915] Workqueue: rpciod rpc_async_schedule [sunrpc]
[ 139.269915] task:
ffff88001b598000 ti:
ffff88001b632000 task.ti:
ffff88001b632000
[ 139.269915] RIP: 0010:[<
ffffffffa026f216>] [<
ffffffffa026f216>] ftrace_raw_event_rpc_task_running+0x86/0xf0 [sunrpc]
[ 139.269915] RSP: 0018:
ffff88001b633d70 EFLAGS:
00010206
[ 139.269915] RAX:
ffff88001dfc5338 RBX:
ffff88001cc37a00 RCX:
ffff88001dfc5334
[ 139.269915] RDX:
ffff88001dfc5338 RSI:
0000000000000000 RDI:
ffff88001dfc533c
[ 139.269915] RBP:
ffff88001b633db0 R08:
000000000000002c R09:
000000000000000a
[ 139.269915] R10:
0000000000062180 R11:
00000020759fb9dc R12:
ffffffffa0292c20
[ 139.269915] R13:
ffff88001dfc5334 R14:
0000000000000000 R15:
0000000000000000
[ 139.269915] FS:
0000000000000000(0000) GS:
ffff88001fc00000(0000) knlGS:
0000000000000000
[ 139.269915] CS: 0010 DS: 0000 ES: 0000 CR0:
000000008005003b
[ 139.269915] CR2:
0000000000000004 CR3:
000000001d290000 CR4:
00000000000006f0
[ 139.269915] DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
[ 139.269915] DR3:
0000000000000000 DR6:
00000000ffff0ff0 DR7:
0000000000000400
[ 139.269915] Stack:
[ 139.269915]
000000001b633d98 0000000000000246 ffff88001df1dc00 ffff88001cc37a00
[ 139.269915]
ffff88001bc35e60 0000000000000000 ffff88001ffa0a48 ffff88001bc35ee0
[ 139.269915]
ffff88001b633e08 ffffffffa02704b5 0000000000010000 ffff88001cc37a70
[ 139.269915] Call Trace:
[ 139.269915] [<
ffffffffa02704b5>] __rpc_execute+0x1d5/0x400 [sunrpc]
[ 139.269915] [<
ffffffffa0270706>] rpc_async_schedule+0x26/0x30 [sunrpc]
[ 139.269915] [<
ffffffff8107867b>] process_one_work+0x17b/0x460
[ 139.269915] [<
ffffffff8107942b>] worker_thread+0x11b/0x400
[ 139.269915] [<
ffffffff81079310>] ? rescuer_thread+0x3e0/0x3e0
[ 139.269915] [<
ffffffff8107fc80>] kthread+0xc0/0xd0
[ 139.269915] [<
ffffffff8107fbc0>] ? kthread_create_on_node+0x110/0x110
[ 139.269915] [<
ffffffff815d122c>] ret_from_fork+0x7c/0xb0
[ 139.269915] [<
ffffffff8107fbc0>] ? kthread_create_on_node+0x110/0x110
[ 139.269915] Code: 4c 8b 45 c8 48 8d 7d d0 89 4d c4 41 89 c9 b9 28 00 00 00 e8 9d b4 e9
e0 48 85 c0 49 89 c5 74 a2 48 89 c7 e8 9d 3f e9 e0 48 89 c2 <41> 8b 46 04 48 8b 7d d0 4c
89 e9 4c 89 e6 89 42 0c 0f b7 83 d4
[ 139.269915] RIP [<
ffffffffa026f216>] ftrace_raw_event_rpc_task_running+0x86/0xf0 [sunrpc]
[ 139.269915] RSP <
ffff88001b633d70>
[ 139.269915] CR2:
0000000000000004
[ 140.946406] ---[ end trace
ba486328b98d7622 ]---
Signed-off-by: Ditang Chen <chendt.fnst@cn.fujitsu.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Rafael J. Wysocki [Sat, 8 Mar 2014 00:07:31 +0000 (01:07 +0100)]
Merge branch 'pm-cpufreq'
* pm-cpufreq:
cpufreq: Initialize governor for a new policy under policy->rwsem
cpufreq: Initialize policy before making it available for others to use
cpufreq: use cpufreq_cpu_get() to avoid cpufreq_get() race conditions
Rafael J. Wysocki [Sat, 8 Mar 2014 00:07:06 +0000 (01:07 +0100)]
Merge branches 'acpi-resources', 'acpi-ec' and 'acpi-sleep'
* acpi-resources:
ACPI / resources: ignore invalid ACPI device resources
* acpi-ec:
ACPI / EC: Clear stale EC events on Samsung systems
* acpi-sleep:
ACPI / sleep: pm_power_off needs more sanity checks to be installed
Linus Torvalds [Fri, 7 Mar 2014 23:17:36 +0000 (15:17 -0800)]
Merge tag 'dm-3.14-fixes-3' of git://git./linux/kernel/git/device-mapper/linux-dm
Pull device mapper fixes from Mike Snitzer:
- dm-cache memory allocation failure fix
- fix DM's Kconfig identation
- dm-snapshot metadata corruption fix for bug introduced in 3.14-rc1
- important refcount < 0 fix for the DM persistent data library's space
map metadata interface which fixes corruption reported by a few
dm-thinp users
and last but not least:
- more extensive fixes than ideal for dm-thinp's data resize capability
(which has had growing pain much like we've seen from -ENOSPC
handling of filesystems that mature).
The end result is dm-thinp now handles metadata operation failure and
no data space error conditions much better than before.
* tag 'dm-3.14-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
dm space map metadata: fix refcount decrement below 0 which caused corruption
dm thin: fix Documentation for held metadata root feature
dm thin: fix noflush suspend IO queueing
dm thin: fix deadlock in __requeue_bio_list
dm thin: fix out of data space handling
dm thin: ensure user takes action to validate data and metadata consistency
dm thin: synchronize the pool mode during suspend
dm snapshot: fix metadata corruption
dm: fix Kconfig indentation
dm cache mq: fix memory allocation failure for large cache devices
H. Peter Anvin [Fri, 7 Mar 2014 23:05:20 +0000 (15:05 -0800)]
x86: Ignore NMIs that come in during early boot
Don Zickus reports:
A customer generated an external NMI using their iLO to test kdump
worked. Unfortunately, the machine hung. Disabling the nmi_watchdog
made things work.
I speculated the external NMI fired, caused the machine to panic (as
expected) and the perf NMI from the watchdog came in and was latched.
My guess was this somehow caused the hang.
----
It appears that the latched NMI stays latched until the early page
table generation on 64 bits, which causes exceptions to happen which
end in IRET, which re-enable NMI. Therefore, ignore NMIs that come in
during early execution, until we have proper exception handling.
Reported-and-tested-by: Don Zickus <dzickus@redhat.com>
Link: http://lkml.kernel.org/r/1394221143-29713-1-git-send-email-dzickus@redhat.com
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: <stable@vger.kernel.org> # v3.5+, older with some backport effort
Mark Rutland [Wed, 26 Feb 2014 16:21:26 +0000 (17:21 +0100)]
ARM: 7992/1: boot: compressed: ignore bswapsdi2.S
Commit
017f161a55b4 (ARM: 7877/1: use built-in byte swap function) added
bswapsdi2.{o,S} to arch/arm/boot/compressed/Makefile, but didn't update
the .gitignore. Thus after a a build git status shows bswapsdi2.S as a
new file, which is a little annoying.
This patch updates arch/arm/boot/compressed/.gitignore to ignore
bswapsdi2.S, as we already do for ashldi3.S and others.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Nicolas Pitre <nico@linaro.org>
Acked-by: Kim Phillips <kim.phillips@freescale.com>
Cc: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Linus Walleij [Tue, 25 Feb 2014 21:41:41 +0000 (22:41 +0100)]
ARM: 7991/1: sa1100: fix compile problem on Collie
Due to a problem in the MFD Kconfig it was not possible to
compile the UCB battery driver for the Collie SA1100 system,
in turn making it impossible to compile in the battery driver.
(See patch "mfd: include all drivers in subsystem menu".)
After fixing the MFD Kconfig (separate patch) a compile error
appears in the Collie battery driver due to the <mach/collie.h>
implicitly requiring <mach/hardware.h> through <linux/gpio.h>
via <mach/gpio.h> prior to commit
40ca061b "ARM: 7841/1: sa1100: remove complex GPIO interface".
Fix this up by including the required header into
<mach/collie.h>.
Cc: stable@vger.kernel.org
Cc: Andrea Adami <andrea.adami@gmail.com>
Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Russell King [Wed, 26 Feb 2014 19:40:46 +0000 (19:40 +0000)]
ARM: fix noMMU kallsyms symbol filtering
With noMMU, CONFIG_PAGE_OFFSET was not being set correctly. As there's
no MMU, PAGE_OFFSET should be equal to PHYS_OFFSET in all cases. This
commit makes that explicit.
Since we do this, we don't need to mess around in asm/memory.h with
ifdefs to sort this out, so let's get rid of that, and there's no point
offering the "Memory split" option for noMMU as that's meaningless
there.
Fixes:
b9b32bf70f2f ("ARM: use linker magic for vectors and vector stubs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
John W. Linville [Fri, 7 Mar 2014 20:09:32 +0000 (15:09 -0500)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless into for-davem
Mathias Nyman [Fri, 7 Mar 2014 15:06:58 +0000 (17:06 +0200)]
Revert "USBNET: ax88179_178a: enable tso if usb host supports sg dma"
This reverts commit
3804fad45411b48233b48003e33a78f290d227c8.
This commit, together with commit
247bf557273dd775505fb9240d2d152f4f20d304
"xhci 1.0: Limit arbitrarily-aligned scatter gather." were
origially added to get xHCI 1.0 hosts and usb ethernet ax88179_178a devices
working together with scatter gather. xHCI 1.0 hosts pose some requirement on how transfer
buffers are aligned, setting this requirement for 1.0 hosts caused USB 3.0 mass
storage devices to fail more frequently.
USB 3.0 mass storage devices used to work before 3.14-rc1. Theoretically,
the TD fragment rules could have caused an occasional disk glitch.
Now the devices *will* fail, instead of theoretically failing.
>From a user perspective, this looks like a regression; the USB device obviously
fails on 3.14-rc1, and may sometimes silently fail on prior kernels.
The proper soluition is to implement the TD fragment rules for xHCI 1.0 hosts,
but for now, revert this patch until scatter gather can be properly supported.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Mathias Nyman [Fri, 7 Mar 2014 15:06:57 +0000 (17:06 +0200)]
Revert "xhci 1.0: Limit arbitrarily-aligned scatter gather."
This reverts commit
247bf557273dd775505fb9240d2d152f4f20d304.
This commit, together with commit
3804fad45411b48233b48003e33a78f290d227c8
"USBNET: ax88179_178a: enable tso if usb host supports sg dma" were
origially added to get xHCI 1.0 hosts and usb ethernet ax88179_178a devices
working together with scatter gather. xHCI 1.0 hosts pose some requirement on how transfer
buffers are aligned, setting this requirement for 1.0 hosts caused USB 3.0 mass
storage devices to fail more frequently.
USB 3.0 mass storage devices used to work before 3.14-rc1. Theoretically,
the TD fragment rules could have caused an occasional disk glitch.
Now the devices *will* fail, instead of theoretically failing.
>From a user perspective, this looks like a regression; the USB device obviously
fails on 3.14-rc1, and may sometimes silently fail on prior kernels.
The proper soluition is to implement the TD fragment rules required, but for now
this patch needs to be reverted to get USB 3.0 mass storage devices working at the
level they used to.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Julius Werner [Tue, 4 Mar 2014 19:27:38 +0000 (11:27 -0800)]
usb: Make DELAY_INIT quirk wait 100ms between Get Configuration requests
The DELAY_INIT quirk only reduces the frequency of enumeration failures
with the Logitech HD Pro C920 and C930e webcams, but does not quite
eliminate them. We have found that adding a delay of 100ms between the
first and second Get Configuration request makes the device enumerate
perfectly reliable even after several weeks of extensive testing. The
reasons for that are anyone's guess, but since the DELAY_INIT quirk
already delays enumeration by a whole second, wating for another 10th of
that isn't really a big deal for the one other device that uses it, and
it will resolve the problems with these webcams.
Signed-off-by: Julius Werner <jwerner@chromium.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Julius Werner [Tue, 4 Mar 2014 18:52:39 +0000 (10:52 -0800)]
usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e
We've encountered a rare issue when enumerating two Logitech webcams
after a reboot that doesn't power cycle the USB ports. They are spewing
random data (possibly some leftover UVC buffers) on the second
(full-sized) Get Configuration request of the enumeration phase. Since
the data is random this can potentially cause all kinds of odd behavior,
and since it occasionally happens multiple times (after the kernel
issues another reset due to the garbled configuration descriptor), it is
not always recoverable. Set the USB_DELAY_INIT quirk that seems to work
around the issue.
Signed-off-by: Julius Werner <jwerner@chromium.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Michele Baldessari [Fri, 7 Mar 2014 16:34:29 +0000 (16:34 +0000)]
libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus SpinPoint M8 (
2BA30001)
Via commit
87809942d3fa "libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk
for Seagate Momentus SpinPoint M8" we added a quirk for disks named
"ST1000LM024 HN-M101MBB" with firmware revision "2AR10001".
As reported on https://bugzilla.redhat.com/show_bug.cgi?id=1073901,
we need to also add firmware revision
2BA30001 as it is broken as well.
Reported-by: Nicholas <arealityfarbetween@googlemail.com>
Signed-off-by: Michele Baldessari <michele@acksyn.org>
Tested-by: Guilherme Amadio <guilherme.amadio@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
Vineet Gupta [Fri, 7 Mar 2014 07:52:22 +0000 (13:22 +0530)]
ARC: Use correct PTAG register for icache flush
This fixes a subtle issue with cache flush which could potentially cause
random userspace crashes because of stale icache lines.
This error crept in when consolidating the cache flush code
Fixes:
bd12976c3664 (ARC: cacheflush refactor #3: Unify the {d,i}cache)
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org # 3.13
Cc: arc-linux-dev@synopsys.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Fri, 7 Mar 2014 18:02:39 +0000 (10:02 -0800)]
Merge tag 'sound-3.14-rc6' of git://git./linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"Just a few device-specific quirks for HD-audio and USB-audio, most of
which are one-liners"
* tag 'sound-3.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: usb-audio: Add quirk for Logitech Webcam C500
ALSA: hda - Use analog beep for Thinkpads with AD1984 codecs
ALSA: hda - Add missing loopback merge path for AD1884/1984 codecs
ALSA: hda - add automute fix for another dell AIO model
ALSA: hda - Added inverted digital-mic handling for Acer TravelMate 8371
Linus Torvalds [Fri, 7 Mar 2014 18:01:47 +0000 (10:01 -0800)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
"Mostly intel and radeon fixes, one tda998x, one kconfig dep fix and
two more MAINTAINERS updates,
All pretty run of the mill for this stage"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/radeon/atom: select the proper number of lanes in transmitter setup
MAINTAINERS: add maintainer entry for TDA998x driver
drm: fix bochs kconfig dependencies
drm/radeon/dpm: fix typo in EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters
drm/radeon/cik: fix typo in documentation
drm/radeon: silence GCC warning on 32 bit
drm/radeon: resume old pm late
drm/radeon: TTM must be init with cpu-visible VRAM, v2
DRM: armada: fix use of kfifo_put()
drm/i915: Reject >165MHz modes w/ DVI monitors
drm/i915: fix assert_cursor on BDW
drm/i915: vlv: reserve GT power context early
drm/i915: fix pch pci device enumeration
drm/i915: Resolving the memory region conflict for Stolen area
drm/i915: use backlight legacy combination mode also for i915gm/i945gm
MAINTAINERS: update AGP tree to point at drm tree
Linus Torvalds [Fri, 7 Mar 2014 17:59:44 +0000 (09:59 -0800)]
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
Pull block fixes from Jens Axboe:
"Small collection of fixes for 3.14-rc. It contains:
- Three minor update to blk-mq from Christoph.
- Reduce number of unaligned (< 4kb) in-flight writes on mtip32xx to
two. From Micron.
- Make the blk-mq CPU notify spinlock raw, since it can't be a
sleeper spinlock on RT. From Mike Galbraith.
- Drop now bogus BUG_ON() for bio iteration with blk integrity. From
Nic Bellinger.
- Properly propagate the SYNC flag on requests. From Shaohua"
* 'for-linus' of git://git.kernel.dk/linux-block:
blk-mq: add REQ_SYNC early
rt,blk,mq: Make blk_mq_cpu_notify_lock a raw spinlock
bio-integrity: Drop bio_integrity_verify BUG_ON in post bip->bip_iter world
blk-mq: support partial I/O completions
blk-mq: merge blk_mq_insert_request and blk_mq_run_request
blk-mq: remove blk_mq_alloc_rq
mtip32xx: Reduce the number of unaligned writes to 2
Linus Torvalds [Fri, 7 Mar 2014 17:54:40 +0000 (09:54 -0800)]
Merge tag 'pinctrl-v3.14-3' of git://git./linux/kernel/git/linusw/linux-pinctrl
Pull pin control fixes from Linus Walleij:
"This is a set of pin control fixes I have collected over the last few
days. Some have rotated more than others in linux-next, but they were
rebased on v3.14-rc5 due to sloppy commit messages. I am quite
convinced that they are all good fixes that only hit this or that
individual driver and not the entire subsystem.
- Fix chained interrupts, interrupt masking and register offset
calculation for the sunxi driver
- Make MSM a bool rather than a tristate to stop build problems to
happen - chained interrupt controllers cannot currently be defined
in modules
- Fix a clock in the PFC driver
- Fix a kernel panic in the sirf driver"
* tag 'pinctrl-v3.14-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
pinctrl: sirf: fix kernel panic in gpio_lock_as_irq
pinctrl: sh-pfc: r8a7791: SD1_CLK fix
pinctrl: msm: make PINCTRL_MSM bool instead of tristate
pinctrl: sunxi: Fix interrupt register offset calculation
pinctrl: sunxi: Fix masking when setting irq type
pinctrl: sunxi: use chained_irq_{enter, exit} for GIC compatibility
Linus Torvalds [Fri, 7 Mar 2014 17:53:24 +0000 (09:53 -0800)]
Merge tag 'stable/for-linus-3.14-rc5-tag' of git://git./linux/kernel/git/xen/tip
Pull Xen fix from Konrad Rzeszutek Wilk:
"This has exactly one patch for Xen ARM. It sets the dependency to
compile the kernel with MMU enabled - otherwise - the guest won't work
very well"
* tag 'stable/for-linus-3.14-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
ARM: XEN depends on having a MMU
Linus Torvalds [Fri, 7 Mar 2014 17:52:46 +0000 (09:52 -0800)]
Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming
Pull c6x build fix from Mark Salter:
"Build fix for c6x"
* tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
c6x: fix build failure caused by cache.h
Joe Thornber [Fri, 7 Mar 2014 14:57:19 +0000 (14:57 +0000)]
dm space map metadata: fix refcount decrement below 0 which caused corruption
This has been a relatively long-standing issue that wasn't nailed down
until Teng-Feng Yang's meticulous bug report to dm-devel on 3/7/2014,
see: http://www.redhat.com/archives/dm-devel/2014-March/msg00021.html
From that report:
"When decreasing the reference count of a metadata block with its
reference count equals 3, we will call dm_btree_remove() to remove
this enrty from the B+tree which keeps the reference count info in
metadata device.
The B+tree will try to rebalance the entry of the child nodes in each
node it traversed, and the rebalance process contains the following
steps.
(1) Finding the corresponding children in current node (shadow_current(s))
(2) Shadow the children block (issue BOP_INC)
(3) redistribute keys among children, and free children if necessary (issue BOP_DEC)
Since the update of a metadata block's reference count could be
recursive, we will stash these reference count update operations in
smm->uncommitted and then process them in a FILO fashion.
The problem is that step(3) could free the children which is created
in step(2), so the BOP_DEC issued in step(3) will be carried out
before the BOP_INC issued in step(2) since these BOPs will be
processed in FILO fashion. Once the BOP_DEC from step(3) tries to
decrease the reference count of newly shadow block, it will report
failure for its reference equals 0 before decreasing. It looks like we
can solve this issue by processing these BOPs in a FIFO fashion
instead of FILO."
Commit
5b564d80 ("dm space map: disallow decrementing a reference count
below zero") changed the code to report an error for this temporary
refcount decrement below zero. So what was previously a harmless
invalid refcount became a hard failure due to the new error path:
device-mapper: space map common: unable to decrement a reference count below 0
device-mapper: thin: 253:6: dm_thin_insert_block() failed: error = -22
device-mapper: thin: 253:6: switching pool to read-only mode
This bug is in dm persistent-data code that is common to the DM thin and
cache targets. So any users of those targets should apply this fix.
Fix this by applying recursive space map operations in FIFO order rather
than FILO.
Resolves: https://bugzilla.kernel.org/show_bug.cgi?id=68801
Reported-by: Apollon Oikonomopoulos <apoikos@debian.org>
Reported-by: edwillam1007@gmail.com
Reported-by: Teng-Feng Yang <shinrairis@gmail.com>
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org # 3.13+
Tejun Heo [Fri, 7 Mar 2014 15:19:57 +0000 (10:19 -0500)]
firewire: don't use PREPARE_DELAYED_WORK
PREPARE_[DELAYED_]WORK() are being phased out. They have few users
and a nasty surprise in terms of reentrancy guarantee as workqueue
considers work items to be different if they don't have the same work
function.
firewire core-device and sbp2 have been been multiplexing work items
with multiple work functions. Introduce fw_device_workfn() and
sbp2_lu_workfn() which invoke fw_device->workfn and
sbp2_logical_unit->workfn respectively and always use the two
functions as the work functions and update the users to set the
->workfn fields instead of overriding work functions using
PREPARE_DELAYED_WORK().
This fixes a variety of possible regressions since
a2c1c57be8d9
"workqueue: consider work function when searching for busy work items"
due to which fw_workqueue lost its required non-reentrancy property.
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Cc: linux1394-devel@lists.sourceforge.net
Cc: stable@vger.kernel.org # v3.9+
Cc: stable@vger.kernel.org # v3.8.2+
Cc: stable@vger.kernel.org # v3.4.60+
Cc: stable@vger.kernel.org # v3.2.40+
Shaohua Li [Wed, 19 Feb 2014 12:20:21 +0000 (20:20 +0800)]
blk-mq: add REQ_SYNC early
Add REQ_SYNC early, so rq_dispatched[] in blk_mq_rq_ctx_init
is set correctly.
Signed-off-by: Shaohua Li<shli@fusionio.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Takashi Iwai [Fri, 7 Mar 2014 07:37:19 +0000 (08:37 +0100)]
ALSA: hda - Fix loud click noise with IdeaPad 410Y
Lenovo IdeaPad 410Y with ALC282 codec makes loud click noises at boot
and shutdown. Also, it wrongly misdetects the acpi_thinkpad hook.
This patch adds a device-specific fixup for disabling the shutup
callback that is the cause of the click noise and also avoiding the
thinpad_helper calls.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=71511
Reported-and-tested-by: Guilherme Amadio <guilherme.amadio@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Sagi Grimberg [Wed, 5 Mar 2014 12:05:09 +0000 (14:05 +0200)]
Target/sbc: Fix sbc_copy_prot for offset scatters
When copying between device and command protection scatters
we must take into account that device scatters might be offset
and we might copy outside scatter range. Thus for each cmd prot
scatter we must take the min between cmd prot scatter, dev prot
scatter, and whats left (and loop in case we havn't copied enough
from/to cmd prot scatter).
Example (single t_prot_sg of len 2048):
kernel: sbc_dif_copy_prot: se_cmd=
ffff880380aaf970, left=2048, len=2048, dev_prot_sg_offset=3072, dev_prot_sg_len=4096
kernel: isert: se_cmd=
ffff880380aaf970 PI error found type 0 at sector 0x2600 expected 0x0 vs actual 0x725f, lba=2580
Instead of copying 2048 from offset 3072 (copying junk outside sg
limit 4096), we must to copy 1024 and continue to next sg until
we complete cmd prot scatter.
This issue was found using iSER T10-PI offload over rd_mcp (wasn't
discovered with fileio since file_dev prot sglists are never offset).
Changes from v1:
- Fix sbc_copy_prot copy length miss-calculation
Changes from v0:
- Removed psg->offset consideration for psg_len computation
- Removed sg->offset consideration for offset condition
- Added copied consideraiton for len computation
- Added copied offset to paddr when doing memcpy
Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Mark Brown [Fri, 7 Mar 2014 03:08:13 +0000 (11:08 +0800)]
Merge remote-tracking branches 'spi/fix/ath79', 'spi/fix/atmel', 'spi/fix/coldfire', 'spi/fix/fsl-dspi', 'spi/fix/imx' and 'spi/fix/topcliff-pch' into spi-linus
Anton Blanchard [Mon, 3 Mar 2014 21:31:24 +0000 (08:31 +1100)]
powerpc: Align p_dyn, p_rela and p_st symbols
The 64bit relocation code places a few symbols in the text segment.
These symbols are only 4 byte aligned where they need to be 8 byte
aligned. Add an explicit alignment.
Signed-off-by: Anton Blanchard <anton@samba.org>
Cc: stable@vger.kernel.org
Tested-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Michael Neuling [Mon, 3 Mar 2014 03:21:40 +0000 (14:21 +1100)]
powerpc/tm: Fix crash when forking inside a transaction
When we fork/clone we currently don't copy any of the TM state to the new
thread. This results in a TM bad thing (program check) when the new process is
switched in as the kernel does a tmrechkpt with TEXASR FS not set. Also, since
R1 is from userspace, we trigger the bad kernel stack pointer detection. So we
end up with something like this:
Bad kernel stack pointer 0 at
c0000000000404fc
cpu 0x2: Vector: 700 (Program Check) at [
c00000003ffefd40]
pc:
c0000000000404fc: restore_gprs+0xc0/0x148
lr:
0000000000000000
sp: 0
msr:
9000000100201030
current = 0xc000001dd1417c30
paca = 0xc00000000fe00800 softe: 0 irq_happened: 0x01
pid = 0, comm = swapper/2
WARNING: exception is not recoverable, can't continue
The below fixes this by flushing the TM state before we copy the task_struct to
the clone. To do this we go through the tmreclaim patch, which removes the
checkpointed registers from the CPU and transitions the CPU out of TM suspend
mode. Hence we need to call tmrechkpt after to restore the checkpointed state
and the TM mode for the current task.
To make this fail from userspace is simply:
tbegin
li r0, 2
sc
<boom>
Kudos to Adhemerval Zanella Neto for finding this.
Signed-off-by: Michael Neuling <mikey@neuling.org>
cc: Adhemerval Zanella Neto <azanella@br.ibm.com>
cc: stable@vger.kernel.org
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Dave Airlie [Thu, 6 Mar 2014 23:27:22 +0000 (09:27 +1000)]
Merge branch 'drm-fixes-3.14' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
one more radeon fix.
* 'drm-fixes-3.14' of git://people.freedesktop.org/~agd5f/linux:
drm/radeon/atom: select the proper number of lanes in transmitter setup
Alex Deucher [Thu, 6 Mar 2014 23:09:52 +0000 (18:09 -0500)]
drm/radeon/atom: select the proper number of lanes in transmitter setup
We need to check for DVI vs. HDMI when setting up duallink since
HDMI is single link only. Fixes 4k modes on newer asics.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=75223
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Russell King [Mon, 3 Mar 2014 12:18:14 +0000 (12:18 +0000)]
MAINTAINERS: add maintainer entry for TDA998x driver
Add a maintainers entry for the TDA998x driver. Rob Clark has handed
this driver over to me to look after.
Acked-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Gerd Hoffmann [Thu, 6 Mar 2014 12:26:36 +0000 (13:26 +0100)]
drm: fix bochs kconfig dependencies
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Thu, 6 Mar 2014 23:04:32 +0000 (09:04 +1000)]
Merge branch 'drm-armada-fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-cubox into drm-fixes
fix for kfifo api change.
* 'drm-armada-fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-cubox:
DRM: armada: fix use of kfifo_put()
Dave Airlie [Thu, 6 Mar 2014 22:41:12 +0000 (08:41 +1000)]
Merge branch 'drm-fixes-3.14' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
a few more radeon fixes.
* 'drm-fixes-3.14' of git://people.freedesktop.org/~agd5f/linux:
drm/radeon/dpm: fix typo in EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters
drm/radeon/cik: fix typo in documentation
drm/radeon: silence GCC warning on 32 bit
drm/radeon: resume old pm late
drm/radeon: TTM must be init with cpu-visible VRAM, v2
Sabrina Dubroca [Thu, 6 Mar 2014 16:51:57 +0000 (17:51 +0100)]
ipv6: don't set DST_NOCOUNT for remotely added routes
DST_NOCOUNT should only be used if an authorized user adds routes
locally. In case of routes which are added on behalf of router
advertisments this flag must not get used as it allows an unlimited
number of routes getting added remotely.
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Amir Vadai [Thu, 6 Mar 2014 16:28:17 +0000 (18:28 +0200)]
net/mlx4_core: mlx4_init_slave() shouldn't access comm channel before PF is ready
Currently, the PF call to pci_enable_sriov from the PF probe function
stalls for 10 seconds times the number of VFs probed on the host. This
happens because the way for such VFs to determine of the PF
initialization finished, is by attempting to issue reset on the
comm-channel and get timeout (after 10s).
The PF probe function is called from a kenernel workqueue, and therefore
during that time, rcu lock is being held and kernel's workqueue is
stalled. This blocks other processes that try to use the workqueue
or rcu lock. For example, interface renaming which is calling
rcu_synchronize is blocked, and timedout by systemd.
Changed mlx4_init_slave() to allow VF probed on the host to immediatly
detect that the PF is not ready, and return EPROBE_DEFER instantly.
Only when the PF finishes the initialization, allow such VFs to
access the comm channel.
This issue and fix are relevant only for probed VFs on the hypervisor,
there is no way to pass this information to a VM until comm channel is
ready, so in a VM, if PF is not ready, the first command will be timedout
after 10 seconds and return EPROBE_DEFER.
Signed-off-by: Amir Vadai <amirv@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Amir Vadai [Thu, 6 Mar 2014 16:28:16 +0000 (18:28 +0200)]
net/mlx4_core: Fix memory access error in mlx4_QUERY_DEV_CAP_wrapper()
Fix a regression introduced by [1]. outbox was accessed instead of
outbox->buf. Typo was copy-pasted to [2] and [3].
[1] - cc1ade9 mlx4_core: Disable memory windows for virtual functions
[2] - 4de6580 mlx4_core: Add support for steerable IB UD QPs
[3] - 7ffdf72 net/mlx4_core: Add basic support for TCP/IP offloads under
tunneling
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Amir Vadai <amirv@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Sasha Levin [Thu, 6 Mar 2014 21:53:11 +0000 (16:53 -0500)]
bonding: correctly handle out of range parameters for lp_interval
We didn't correctly check cases where the value for lp_interval is not
within the legal range due to a missing table terminator.
This would let userspace trigger a kernel panic by specifying a value out
of range:
echo -1 > /sys/devices/virtual/net/bond0/bonding/lp_interval
Introduced by commit
4325b374f84 ("bonding: convert lp_interval to use
the new option API").
Acked-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alex Deucher [Thu, 6 Mar 2014 18:16:55 +0000 (13:16 -0500)]
drm/radeon/dpm: fix typo in EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters
Should be at 0x8 rather than 0.
fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=60523
Noticed by ArtForz on #radeon
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Alex Deucher [Tue, 4 Mar 2014 20:50:29 +0000 (15:50 -0500)]
drm/radeon/cik: fix typo in documentation
Copy-paste typo.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Paul Bolle [Tue, 4 Mar 2014 09:34:48 +0000 (10:34 +0100)]
drm/radeon: silence GCC warning on 32 bit
Building radeon_ttm.o on 32 bit x86 triggers a warning:
In file included from include/asm-generic/bug.h:13:0,
from [...]/arch/x86/include/asm/bug.h:38,
from include/linux/bug.h:4,
from include/drm/drm_mm.h:39,
from include/drm/drm_vma_manager.h:26,
from include/drm/ttm/ttm_bo_api.h:35,
from drivers/gpu/drm/radeon/radeon_ttm.c:32:
drivers/gpu/drm/radeon/radeon_ttm.c: In function 'radeon_ttm_gtt_read':
include/linux/kernel.h:712:17: warning: comparison of distinct pointer types lacks a cast [enabled by default]
(void) (&_min1 == &_min2); \
^
drivers/gpu/drm/radeon/radeon_ttm.c:938:22: note: in expansion of macro 'min'
ssize_t cur_size = min(size, PAGE_SIZE - off);
^
Silence this warning by using min_t(). Since cur_size will never be
negative and its upper bound is PAGE_SIZE, we can change its type to
size_t and use min_t(size_t, [...]) here.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Alex Deucher [Tue, 25 Feb 2014 17:01:28 +0000 (12:01 -0500)]
drm/radeon: resume old pm late
Moving the pm resume up in the init order to fix
dpm seems to have regressed somes cases with the old
pm code. Move it back to late resume.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Lauri Kasanen [Fri, 28 Feb 2014 18:50:23 +0000 (20:50 +0200)]
drm/radeon: TTM must be init with cpu-visible VRAM, v2
Without this, a bo may get created in the cpu-inaccessible vram.
Before the CP engines get setup, all copies are done via cpu memcpy.
This means that the cpu tries to read from inaccessible memory, fails,
and the radeon module proceeds to disable acceleration.
Doing this has no downsides, as the real VRAM size gets set as soon as the
CP engines get init.
This is a candidate for 3.14 fixes.
v2: Add comment on why the function is used
Signed-off-by: Lauri Kasanen <cand@gmx.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Cc: stable@vger.kernel.org
Anton Nayshtut [Wed, 5 Mar 2014 06:30:08 +0000 (08:30 +0200)]
ipv6: Fix exthdrs offload registration.
Without this fix, ipv6_exthdrs_offload_init doesn't register IPPROTO_DSTOPTS
offload, but returns 0 (as the IPPROTO_ROUTING registration actually succeeds).
This then causes the ipv6_gso_segment to drop IPv6 packets with IPPROTO_DSTOPTS
header.
The issue detected and the fix verified by running MS HCK Offload LSO test on
top of QEMU Windows guests, as this test sends IPv6 packets with
IPPROTO_DSTOPTS.
Signed-off-by: Anton Nayshtut <anton@swortex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Anton Blanchard [Wed, 5 Mar 2014 03:51:37 +0000 (14:51 +1100)]
ibmveth: Fix endian issues with MAC addresses
The code to load a MAC address into a u64 for passing to the
hypervisor via a register is broken on little endian.
Create a helper function called ibmveth_encode_mac_addr
which does the right thing in both big and little endian.
We were storing the MAC address in a long in struct ibmveth_adapter.
It's never used so remove it - we don't need another place in the
driver where we create endian issues with MAC addresses.
Signed-off-by: Anton Blanchard <anton@samba.org>
Cc: stable@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Anton Blanchard [Wed, 5 Mar 2014 03:29:58 +0000 (14:29 +1100)]
net: unix socket code abuses csum_partial
The unix socket code is using the result of csum_partial to
hash into a lookup table:
unix_hash_fold(csum_partial(sunaddr, len, 0));
csum_partial is only guaranteed to produce something that can be
folded into a checksum, as its prototype explains:
* returns a 32-bit number suitable for feeding into itself
* or csum_tcpudp_magic
The 32bit value should not be used directly.
Depending on the alignment, the ppc64 csum_partial will return
different 32bit partial checksums that will fold into the same
16bit checksum.
This difference causes the following testcase (courtesy of
Gustavo) to sometimes fail:
#include <sys/socket.h>
#include <stdio.h>
int main()
{
int fd = socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC, 0);
int i = 1;
setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &i, 4);
struct sockaddr addr;
addr.sa_family = AF_LOCAL;
bind(fd, &addr, 2);
listen(fd, 128);
struct sockaddr_storage ss;
socklen_t sslen = (socklen_t)sizeof(ss);
getsockname(fd, (struct sockaddr*)&ss, &sslen);
fd = socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC, 0);
if (connect(fd, (struct sockaddr*)&ss, sslen) == -1){
perror(NULL);
return 1;
}
printf("OK\n");
return 0;
}
As suggested by davem, fix this by using csum_fold to fold the
partial 32bit checksum into a 16bit checksum before using it.
Signed-off-by: Anton Blanchard <anton@samba.org>
Cc: stable@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Andrew Lutomirski [Wed, 5 Mar 2014 01:24:10 +0000 (17:24 -0800)]
net: Improve SO_TIMESTAMPING documentation and fix a minor code bug
The original documentation was very unclear.
The code fix is presumably related to the formerly unclear
documentation: SOCK_TIMESTAMPING_RX_SOFTWARE has no effect on
__sock_recv_timestamp's behavior, so calling __sock_recv_ts_and_drops
from sock_recv_ts_and_drops if only SOCK_TIMESTAMPING_RX_SOFTWARE is
set is pointless. This should have no user-observable effect.
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Bjorn Helgaas [Wed, 5 Mar 2014 00:35:44 +0000 (17:35 -0700)]
phy: fix compiler array bounds warning on settings[]
With -Werror=array-bounds, gcc v4.7.x warns that in phy_find_valid(), the
settings[] "array subscript is above array bounds", I think because idx is
a signed integer and if the caller supplied idx < 0, we pass the guard but
still reference out of bounds.
Fix this by making idx unsigned here and elsewhere.
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stefan Richter [Thu, 6 Mar 2014 19:39:04 +0000 (20:39 +0100)]
firewire: ohci: fix probe failure with Agere/LSI controllers
Since commit
bd972688eb24
"firewire: ohci: Fix 'failed to read phy reg' on FW643 rev8",
there is a high chance that firewire-ohci fails to initialize LSI née
Agere controllers.
https://bugzilla.kernel.org/show_bug.cgi?id=65151
Peter Hurley points out the reason: IEEE 1394a:2000 clause 5A.1 (or
IEEE 1394:2008 clause 17.2.1) say: "The PHY shall insure that no more
than 10 ms elapse from the reassertion of LPS until the interface is
reset. The link shall not assert LReq until the reset is complete."
In other words, the link needs to give the PHY at least 10 ms to get
the interface operational.
With just the msleep(1) in
bd972688eb24, the first read_phy_reg()
during ohci_enable() may happen before the phy-link interface reset was
finished, and fail. Due to the high variability of msleep(n) with small
n, this failure was not fully reproducible, and not apparent at all with
low CONFIG_HZ setting.
On the other hand, Peter can no longer reproduce the issue with FW643
rev8. The read phy reg failures that happened back then may have had an
unrelated cause. So, just revert
bd972688eb24, except for the valid
comment on TSB82AA2 cards.
Reported-by: Mikhail Gavrilov
Reported-by: Jay Fenlason <fenlason@redhat.com>
Reported-by: Clemens Ladisch <clemens@ladisch.de>
Reported-by: Peter Hurley <peter@hurleysoftware.com>
Cc: stable@vger.kernel.org # v3.10+
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Florian Westphal [Thu, 6 Mar 2014 17:06:41 +0000 (18:06 +0100)]
inet: frag: make sure forced eviction removes all frags
Quoting Alexander Aring:
While fragmentation and unloading of 6lowpan module I got this kernel Oops
after few seconds:
BUG: unable to handle kernel paging request at
f88bbc30
[..]
Modules linked in: ipv6 [last unloaded: 6lowpan]
Call Trace:
[<
c012af4c>] ? call_timer_fn+0x54/0xb3
[<
c012aef8>] ? process_timeout+0xa/0xa
[<
c012b66b>] run_timer_softirq+0x140/0x15f
Problem is that incomplete frags are still around after unload; when
their frag expire timer fires, we get crash.
When a netns is removed (also done when unloading module), inet_frag
calls the evictor with 'force' argument to purge remaining frags.
The evictor loop terminates when accounted memory ('work') drops to 0
or the lru-list becomes empty. However, the mem accounting is done
via percpu counters and may not be accurate, i.e. loop may terminate
prematurely.
Alter evictor to only stop once the lru list is empty when force is
requested.
Reported-by: Phoebe Buckheister <phoebe.buckheister@itwm.fraunhofer.de>
Reported-by: Alexander Aring <alex.aring@gmail.com>
Tested-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Thu, 6 Mar 2014 19:46:38 +0000 (14:46 -0500)]
Merge branch 'tipc'
Eric Hugne says:
====================
tipc: refcount and memory leak fixes
v3: Remove error logging from data path completely. Rebased on top of
latest net merge.
v2: Drop specific -ENOMEM logging in patch #1 (tipc: allow connection
shutdown callback to be invoked in advance) And add a general error
message if an internal server tries to send a message on a
closed/nonexisting connection.
In addition to the fix for refcount leak and memory leak during
module removal, we also fix a problem where the topology server
listening socket where unexpectedly closed. We also eliminate an
unnecessary context switch during accept()/recvmsg() for nonblocking
sockets.
It might be good to include this patchset in stable aswell. After the
v3 rebase on latest merge from net all patches apply cleanly on that
tree.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Erik Hugne [Thu, 6 Mar 2014 13:40:21 +0000 (14:40 +0100)]
tipc: don't log disabled tasklet handler errors
Failure to schedule a TIPC tasklet with tipc_k_signal because the
tasklet handler is disabled is not an error. It means TIPC is
currently in the process of shutting down. We remove the error
logging in this case.
Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Reviewed-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Erik Hugne [Thu, 6 Mar 2014 13:40:20 +0000 (14:40 +0100)]
tipc: fix memory leak during module removal
When the TIPC module is removed, the tasklet handler is disabled
before all other subsystems. This will cause lingering publications
in the name table because the node_down tasklets responsible to
clean up publications from an unreachable node will never run.
When the name table is shut down, these publications are detected
and an error message is logged:
tipc: nametbl_stop(): orphaned hash chain detected
This is actually a memory leak, introduced with commit
993b858e37b3120ee76d9957a901cca22312ffaa ("tipc: correct the order
of stopping services at rmmod")
Instead of just logging an error and leaking memory, we free
the orphaned entries during nametable shutdown.
Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Reviewed-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Erik Hugne [Thu, 6 Mar 2014 13:40:19 +0000 (14:40 +0100)]
tipc: drop subscriber connection id invalidation
When a topology server subscriber is disconnected, the associated
connection id is set to zero. A check vs zero is then done in the
subscription timeout function to see if the subscriber have been
shut down. This is unnecessary, because all subscription timers
will be cancelled when a subscriber terminates. Setting the
connection id to zero is actually harmful because id zero is the
identity of the topology server listening socket, and can cause a
race that leads to this socket being closed instead.
Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Reviewed-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 6 Mar 2014 13:40:18 +0000 (14:40 +0100)]
tipc: avoid to unnecessary process switch under non-block mode
When messages are received via tipc socket under non-block mode,
schedule_timeout() is called in tipc_wait_for_rcvmsg(), that is,
the process of receiving messages will be scheduled once although
timeout value passed to schedule_timeout() is 0. The same issue
exists in accept()/wait_for_accept(). To avoid this unnecessary
process switch, we only call schedule_timeout() if the timeout
value is non-zero.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Reviewed-by: Erik Hugne <erik.hugne@ericsson.com>
Reviewed-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 6 Mar 2014 13:40:17 +0000 (14:40 +0100)]
tipc: fix connection refcount leak
When tipc_conn_sendmsg() calls tipc_conn_lookup() to query a
connection instance, its reference count value is increased if
it's found. But subsequently if it's found that the connection is
closed, the work of sending message is not queued into its server
send workqueue, and the connection reference count is not decreased.
This will cause a reference count leak. To reproduce this problem,
an application would need to open and closes topology server
connections with high intensity.
We fix this by immediately decrementing the connection reference
count if a send fails due to the connection being closed.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Acked-by: Erik Hugne <erik.hugne@ericsson.com>
Reviewed-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 6 Mar 2014 13:40:16 +0000 (14:40 +0100)]
tipc: allow connection shutdown callback to be invoked in advance
Currently connection shutdown callback function is called when
connection instance is released in tipc_conn_kref_release(), and
receiving packets and sending packets are running in different
threads. Even if connection is closed by the thread of receiving
packets, its shutdown callback may not be called immediately as
the connection reference count is non-zero at that moment. So,
although the connection is shut down by the thread of receiving
packets, the thread of sending packets doesn't know it. Before
its shutdown callback is invoked to tell the sending thread its
connection has been closed, the sending thread may deliver
messages by tipc_conn_sendmsg(), this is why the following error
information appears:
"Sending subscription event failed, no memory"
To eliminate it, allow connection shutdown callback function to
be called before connection id is removed in tipc_close_conn(),
which makes the sending thread know the truth in time that its
socket is closed so that it doesn't send message to it. We also
remove the "Sending XXX failed..." error reporting for topology
and config services.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Reviewed-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Guillaume Nault [Thu, 6 Mar 2014 10:15:10 +0000 (11:15 +0100)]
l2tp: fix userspace reception on plain L2TP sockets
As pppol2tp_recv() never queues up packets to plain L2TP sockets,
pppol2tp_recvmsg() never returns data to userspace, thus making
the recv*() system calls unusable.
Instead of dropping packets when the L2TP socket isn't bound to a PPP
channel, this patch adds them to its reception queue.
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Guillaume Nault [Thu, 6 Mar 2014 10:14:30 +0000 (11:14 +0100)]
l2tp: fix manual sequencing (de)activation in L2TPv2
Commit
e0d4435f "l2tp: Update PPP-over-L2TP driver to work over L2TPv3"
broke the PPPOL2TP_SO_SENDSEQ setsockopt. The L2TP header length was
previously computed by pppol2tp_l2t_header_len() before each call to
l2tp_xmit_skb(). Now that header length is retrieved from the hdr_len
session field, this field must be updated every time the L2TP header
format is modified, or l2tp_xmit_skb() won't push the right amount of
data for the L2TP header.
This patch uses l2tp_session_set_header_len() to adjust hdr_len every
time sequencing is (de)activated from userspace (either by the
PPPOL2TP_SO_SENDSEQ setsockopt or the L2TP_ATTR_SEND_SEQ netlink
attribute).
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Mike Snitzer [Thu, 6 Mar 2014 19:04:51 +0000 (14:04 -0500)]
dm thin: fix Documentation for held metadata root feature
The Documentation for the thin provisioning target's held metadata root
feature was incorrect. It is now available and the value for the held
metadata root is in block units (not 512b sectors).
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Peter Zijlstra [Wed, 5 Mar 2014 13:07:49 +0000 (14:07 +0100)]
x86, trace: Further robustify CR2 handling vs tracing
Building on commit
0ac09f9f8cd1 ("x86, trace: Fix CR2 corruption when
tracing page faults") this patch addresses another few issues:
- Now that read_cr2() is lifted into trace_do_page_fault(), we should
pass the address to trace_page_fault_entries() to avoid it
re-reading a potentially changed cr2.
- Put both trace_do_page_fault() and trace_page_fault_entries() under
CONFIG_TRACING.
- Mark both fault entry functions {,trace_}do_page_fault() as notrace
to avoid getting __mcount or other function entry trace callbacks
before we've observed CR2.
- Mark __do_page_fault() as noinline to guarantee the function tracer
does get to see the fault.
Cc: <jolsa@redhat.com>
Cc: <vincent.weaver@maine.edu>
Acked-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/20140306145300.GO9987@twins.programming.kicks-ass.net
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Amitkumar Karwar [Wed, 5 Mar 2014 02:43:14 +0000 (18:43 -0800)]
mwifiex: save and copy AP's VHT capability info correctly
While preparing association request, intersection of device's
VHT capability information and corresponding field advertised
by AP is used.
This patch fixes a couple errors while saving and copying vht_cap
and vht_oper fields from AP's beacon.
Cc: <stable@vger.kernel.org> # 3.9+
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Amitkumar Karwar [Wed, 5 Mar 2014 02:43:13 +0000 (18:43 -0800)]
mwifiex: copy AP's HT capability info correctly
While preparing association request, intersection of device's HT
capability information and corresponding fields advertised by AP
is used.
This patch fixes an error while copying this field from AP's
beacon.
Cc: <stable@vger.kernel.org>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
John W. Linville [Thu, 6 Mar 2014 18:47:16 +0000 (13:47 -0500)]
Merge branch 'for-john' of git://git./linux/kernel/git/jberg/mac80211
Kieran Clancy [Fri, 28 Feb 2014 14:12:28 +0000 (00:42 +1030)]
ACPI / EC: Clear stale EC events on Samsung systems
A number of Samsung notebooks (530Uxx/535Uxx/540Uxx/550Pxx/900Xxx/etc)
continue to log events during sleep (lid open/close, AC plug/unplug,
battery level change), which accumulate in the EC until a buffer fills.
After the buffer is full (tests suggest it holds 8 events), GPEs stop
being triggered for new events. This state persists on wake or even on
power cycle, and prevents new events from being registered until the EC
is manually polled.
This is the root cause of a number of bugs, including AC not being
detected properly, lid close not triggering suspend, and low ambient
light not triggering the keyboard backlight. The bug also seemed to be
responsible for performance issues on at least one user's machine.
Juan Manuel Cabo found the cause of bug and the workaround of polling
the EC manually on wake.
The loop which clears the stale events is based on an earlier patch by
Lan Tianyu (see referenced attachment).
This patch:
- Adds a function acpi_ec_clear() which polls the EC for stale _Q
events at most ACPI_EC_CLEAR_MAX (currently 100) times. A warning is
logged if this limit is reached.
- Adds a flag EC_FLAGS_CLEAR_ON_RESUME which is set to 1 if the DMI
system vendor is Samsung. This check could be replaced by several
more specific DMI vendor/product pairs, but it's likely that the bug
affects more Samsung products than just the five series mentioned
above. Further, it should not be harmful to run acpi_ec_clear() on
systems without the bug; it will return immediately after finding no
data waiting.
- Runs acpi_ec_clear() on initialisation (boot), from acpi_ec_add()
- Runs acpi_ec_clear() on wake, from acpi_ec_unblock_transactions()
References: https://bugzilla.kernel.org/show_bug.cgi?id=44161
References: https://bugzilla.kernel.org/show_bug.cgi?id=45461
References: https://bugzilla.kernel.org/show_bug.cgi?id=57271
References: https://bugzilla.kernel.org/attachment.cgi?id=126801
Suggested-by: Juan Manuel Cabo <juanmanuel.cabo@gmail.com>
Signed-off-by: Kieran Clancy <clancy.kieran@gmail.com>
Reviewed-by: Lan Tianyu <tianyu.lan@intel.com>
Reviewed-by: Dennis Jansen <dennis.jansen@web.de>
Tested-by: Kieran Clancy <clancy.kieran@gmail.com>
Tested-by: Juan Manuel Cabo <juanmanuel.cabo@gmail.com>
Tested-by: Dennis Jansen <dennis.jansen@web.de>
Tested-by: Maurizio D'Addona <mauritiusdadd@gmail.com>
Tested-by: San Zamoyski <san@plusnet.pl>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Viresh Kumar [Tue, 4 Mar 2014 03:44:01 +0000 (11:44 +0800)]
cpufreq: Initialize governor for a new policy under policy->rwsem
policy->rwsem is used to lock access to all parts of code modifying
struct cpufreq_policy, but it's not used on a new policy created by
__cpufreq_add_dev().
Because of that, if cpufreq_update_policy() is called in a tight loop
on one CPU in parallel with offline/online of another CPU, then the
following crash can be triggered:
Unable to handle kernel NULL pointer dereference at virtual address
00000020
pgd =
c0003000
[
00000020] *pgd=
80000000004003, *pmd=
00000000
Internal error: Oops: 206 [#1] PREEMPT SMP ARM
PC is at __cpufreq_governor+0x10/0x1ac
LR is at cpufreq_update_policy+0x114/0x150
---[ end trace
f23a8defea6cd706 ]---
Kernel panic - not syncing: Fatal exception
CPU0: stopping
CPU: 0 PID: 7136 Comm: mpdecision Tainted: G D W 3.10.0-gd727407-00074-g979ede8 #396
[<
c0afe180>] (notifier_call_chain+0x40/0x68) from [<
c02a23ac>] (__blocking_notifier_call_chain+0x40/0x58)
[<
c02a23ac>] (__blocking_notifier_call_chain+0x40/0x58) from [<
c02a23d8>] (blocking_notifier_call_chain+0x14/0x1c)
[<
c02a23d8>] (blocking_notifier_call_chain+0x14/0x1c) from [<
c0803c68>] (cpufreq_set_policy+0xd4/0x2b8)
[<
c0803c68>] (cpufreq_set_policy+0xd4/0x2b8) from [<
c0803e7c>] (cpufreq_init_policy+0x30/0x98)
[<
c0803e7c>] (cpufreq_init_policy+0x30/0x98) from [<
c0805a18>] (__cpufreq_add_dev.isra.17+0x4dc/0x7a4)
[<
c0805a18>] (__cpufreq_add_dev.isra.17+0x4dc/0x7a4) from [<
c0805d38>] (cpufreq_cpu_callback+0x58/0x84)
[<
c0805d38>] (cpufreq_cpu_callback+0x58/0x84) from [<
c0afe180>] (notifier_call_chain+0x40/0x68)
[<
c0afe180>] (notifier_call_chain+0x40/0x68) from [<
c02812dc>] (__cpu_notify+0x28/0x44)
[<
c02812dc>] (__cpu_notify+0x28/0x44) from [<
c0aeed90>] (_cpu_up+0xf4/0x1dc)
[<
c0aeed90>] (_cpu_up+0xf4/0x1dc) from [<
c0aeeed4>] (cpu_up+0x5c/0x78)
[<
c0aeeed4>] (cpu_up+0x5c/0x78) from [<
c0aec808>] (store_online+0x44/0x74)
[<
c0aec808>] (store_online+0x44/0x74) from [<
c03a40f4>] (sysfs_write_file+0x108/0x14c)
[<
c03a40f4>] (sysfs_write_file+0x108/0x14c) from [<
c03517d4>] (vfs_write+0xd0/0x180)
[<
c03517d4>] (vfs_write+0xd0/0x180) from [<
c0351ca8>] (SyS_write+0x38/0x68)
[<
c0351ca8>] (SyS_write+0x38/0x68) from [<
c0205de0>] (ret_fast_syscall+0x0/0x30)
Fix that by taking locks at appropriate places in __cpufreq_add_dev()
as well.
Reported-by: Saravana Kannan <skannan@codeaurora.org>
Suggested-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
[rjw: Changelog]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Viresh Kumar [Tue, 4 Mar 2014 03:44:00 +0000 (11:44 +0800)]
cpufreq: Initialize policy before making it available for others to use
Policy must be fully initialized before it is being made available
for use by others. Otherwise cpufreq_cpu_get() would be able to grab
a half initialized policy structure that might not have affected_cpus
(for example) populated. Then, anybody accessing those fields will get
a wrong value and that will lead to unpredictable results.
In order to fix this, do all the necessary initialization before we
make the policy structure available via cpufreq_cpu_get(). That will
guarantee that any code accessing fields of the policy will get
correct data from them.
Reported-by: Saravana Kannan <skannan@codeaurora.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
[rjw: Changelog]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Aaron Plattner [Tue, 4 Mar 2014 20:42:15 +0000 (12:42 -0800)]
cpufreq: use cpufreq_cpu_get() to avoid cpufreq_get() race conditions
If a module calls cpufreq_get while cpufreq is initializing, it's
possible for it to be called after cpufreq_driver is set but before
cpufreq_cpu_data is written during subsys_interface_register. This
happens because cpufreq_get doesn't take the cpufreq_driver_lock
around its use of cpufreq_cpu_data.
Fix this by using cpufreq_cpu_get(cpu) to look up the policy rather
than reading it out of cpufreq_cpu_data directly. cpufreq_cpu_get()
takes the appropriate locks to prevent this race from happening.
Since it's possible for policy to be NULL if the caller passes in an
invalid CPU number or calls the function before cpufreq is initialized,
delete the BUG_ON(!policy) and simply return 0. Don't try to return
-ENOENT because that's negative and the function returns an unsigned
integer.
References: https://bbs.archlinux.org/viewtopic.php?id=177934
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Cc: 3.13+ <stable@vger.kernel.org> # 3.13+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Marc Zyngier [Thu, 6 Mar 2014 03:30:46 +0000 (03:30 +0000)]
ARM: KVM: fix non-VGIC compilation
Add a stub for kvm_vgic_addr when compiling without
CONFIG_KVM_ARM_VGIC. The usefulness of this configurarion is extremely
doubtful, but let's fix it anyway (until we decide that we'll always
support a VGIC).
Reported-by: Michele Paolino <m.paolino@virtualopensystems.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Benoit Cousson [Fri, 28 Feb 2014 13:12:05 +0000 (14:12 +0100)]
clk: shmobile: rcar-gen2: Use kick bit to allow Z clock frequency change
The Z clock frequency change is effective only after setting the kick
bit located in the FRQCRB register.
Without that, the CA15 CPUs clock rate will never change.
Fix that by checking if the kick bit is cleared and enable it to make
the clock rate change effective. The bit is cleared automatically upon
completion.
Signed-off-by: Benoit Cousson <bcousson+renesas@baylibre.com>
Acked-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
Haiyang Zhang [Tue, 4 Mar 2014 22:11:06 +0000 (14:11 -0800)]
hyperv: Move state setting for link query
It moves the state setting for query into rndis_filter_receive_response().
All callbacks including query-complete and status-callback are synchronized
by channel->inbound_lock. This prevents pentential race between them.
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Soren Brinkmann [Tue, 4 Mar 2014 16:46:40 +0000 (08:46 -0800)]
net: macb: DMA-unmap full rx-buffer
When allocating RX buffers a fixed size is used, while freeing is based
on actually received bytes, resulting in the following kernel warning
when CONFIG_DMA_API_DEBUG is enabled:
WARNING: CPU: 0 PID: 0 at lib/dma-debug.c:1051 check_unmap+0x258/0x894()
macb
e000b000.ethernet: DMA-API: device driver frees DMA memory with different size [device address=0x000000002d170040] [map size=1536 bytes] [unmap size=60 bytes]
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.14.0-rc3-xilinx-00220-g49f84081ce4f #65
[<
c001516c>] (unwind_backtrace) from [<
c0011df8>] (show_stack+0x10/0x14)
[<
c0011df8>] (show_stack) from [<
c03c775c>] (dump_stack+0x7c/0xc8)
[<
c03c775c>] (dump_stack) from [<
c00245cc>] (warn_slowpath_common+0x60/0x84)
[<
c00245cc>] (warn_slowpath_common) from [<
c0024670>] (warn_slowpath_fmt+0x2c/0x3c)
[<
c0024670>] (warn_slowpath_fmt) from [<
c0227d44>] (check_unmap+0x258/0x894)
[<
c0227d44>] (check_unmap) from [<
c0228588>] (debug_dma_unmap_page+0x64/0x70)
[<
c0228588>] (debug_dma_unmap_page) from [<
c02ab78c>] (gem_rx+0x118/0x170)
[<
c02ab78c>] (gem_rx) from [<
c02ac4d4>] (macb_poll+0x24/0x94)
[<
c02ac4d4>] (macb_poll) from [<
c031222c>] (net_rx_action+0x6c/0x188)
[<
c031222c>] (net_rx_action) from [<
c0028a28>] (__do_softirq+0x108/0x280)
[<
c0028a28>] (__do_softirq) from [<
c0028e8c>] (irq_exit+0x84/0xf8)
[<
c0028e8c>] (irq_exit) from [<
c000f360>] (handle_IRQ+0x68/0x8c)
[<
c000f360>] (handle_IRQ) from [<
c0008528>] (gic_handle_irq+0x3c/0x60)
[<
c0008528>] (gic_handle_irq) from [<
c0012904>] (__irq_svc+0x44/0x78)
Exception stack(0xc056df20 to 0xc056df68)
df20:
00000001 c0577430 00000000 c0577430 04ce8e0d 00000002 edfce238 00000000
df40:
04e20f78 00000002 c05981f4 00000000 00000008 c056df68 c0064008 c02d7658
df60:
20000013 ffffffff
[<
c0012904>] (__irq_svc) from [<
c02d7658>] (cpuidle_enter_state+0x54/0xf8)
[<
c02d7658>] (cpuidle_enter_state) from [<
c02d77dc>] (cpuidle_idle_call+0xe0/0x138)
[<
c02d77dc>] (cpuidle_idle_call) from [<
c000f660>] (arch_cpu_idle+0x8/0x3c)
[<
c000f660>] (arch_cpu_idle) from [<
c006bec4>] (cpu_startup_entry+0xbc/0x124)
[<
c006bec4>] (cpu_startup_entry) from [<
c053daec>] (start_kernel+0x350/0x3b0)
---[ end trace
d5fdc38641bd3a11 ]---
Mapped at:
[<
c0227184>] debug_dma_map_page+0x48/0x11c
[<
c02ab32c>] gem_rx_refill+0x154/0x1f8
[<
c02ac7b4>] macb_open+0x270/0x3e0
[<
c03152e0>] __dev_open+0x7c/0xfc
[<
c031554c>] __dev_change_flags+0x8c/0x140
Fixing this by passing the same size which is passed during mapping the
memory to the unmap function as well.
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
Reviewed-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Soren Brinkmann [Tue, 4 Mar 2014 16:46:39 +0000 (08:46 -0800)]
net: macb: Check DMA mappings for error
With CONFIG_DMA_API_DEBUG enabled the following warning is printed:
WARNING: CPU: 0 PID: 619 at lib/dma-debug.c:1101 check_unmap+0x758/0x894()
macb
e000b000.ethernet: DMA-API: device driver failed to check map error[device address=0x000000002d171c02] [size=322 bytes] [mapped as single]
Modules linked in:
CPU: 0 PID: 619 Comm: udhcpc Not tainted 3.14.0-rc3-xilinx-00219-gd158fc7f36a2 #63
[<
c001516c>] (unwind_backtrace) from [<
c0011df8>] (show_stack+0x10/0x14)
[<
c0011df8>] (show_stack) from [<
c03c7714>] (dump_stack+0x7c/0xc8)
[<
c03c7714>] (dump_stack) from [<
c00245cc>] (warn_slowpath_common+0x60/0x84)
[<
c00245cc>] (warn_slowpath_common) from [<
c0024670>] (warn_slowpath_fmt+0x2c/0x3c)
[<
c0024670>] (warn_slowpath_fmt) from [<
c0228244>] (check_unmap+0x758/0x894)
[<
c0228244>] (check_unmap) from [<
c0228588>] (debug_dma_unmap_page+0x64/0x70)
[<
c0228588>] (debug_dma_unmap_page) from [<
c02aba64>] (macb_interrupt+0x1f8/0x2dc)
[<
c02aba64>] (macb_interrupt) from [<
c006c6e4>] (handle_irq_event_percpu+0x2c/0x178)
[<
c006c6e4>] (handle_irq_event_percpu) from [<
c006c86c>] (handle_irq_event+0x3c/0x5c)
[<
c006c86c>] (handle_irq_event) from [<
c006f548>] (handle_fasteoi_irq+0xb8/0x100)
[<
c006f548>] (handle_fasteoi_irq) from [<
c006c148>] (generic_handle_irq+0x20/0x30)
[<
c006c148>] (generic_handle_irq) from [<
c000f35c>] (handle_IRQ+0x64/0x8c)
[<
c000f35c>] (handle_IRQ) from [<
c0008528>] (gic_handle_irq+0x3c/0x60)
[<
c0008528>] (gic_handle_irq) from [<
c0012904>] (__irq_svc+0x44/0x78)
Exception stack(0xed197f60 to 0xed197fa8)
7f60:
00000134 60000013 bd94362e bd94362e be96b37c 00000014 fffffd72 00000122
7f80:
c000ebe4 ed196000 00000000 00000011 c032c0d8 ed197fa8 c0064008 c000ea20
7fa0:
60000013 ffffffff
[<
c0012904>] (__irq_svc) from [<
c000ea20>] (ret_fast_syscall+0x0/0x48)
---[ end trace
478f921d0d542d1e ]---
Mapped at:
[<
c0227184>] debug_dma_map_page+0x48/0x11c
[<
c02aaca0>] macb_start_xmit+0x184/0x2a8
[<
c03143c0>] dev_hard_start_xmit+0x334/0x470
[<
c032c09c>] sch_direct_xmit+0x78/0x2f8
[<
c0314814>] __dev_queue_xmit+0x318/0x708
due to missing checks of the dma mapping. Add the appropriate checks to fix
this.
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
Reviewed-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Borkmann [Tue, 4 Mar 2014 15:35:51 +0000 (16:35 +0100)]
net: sctp: fix skb leakage in COOKIE ECHO path of chunk->auth_chunk
While working on
ec0223ec48a9 ("net: sctp: fix sctp_sf_do_5_1D_ce to
verify if we/peer is AUTH capable"), we noticed that there's a skb
memory leakage in the error path.
Running the same reproducer as in
ec0223ec48a9 and by unconditionally
jumping to the error label (to simulate an error condition) in
sctp_sf_do_5_1D_ce() receive path lets kmemleak detector bark about
the unfreed chunk->auth_chunk skb clone:
Unreferenced object 0xffff8800b8f3a000 (size 256):
comm "softirq", pid 0, jiffies
4294769856 (age 110.757s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
89 ab 75 5e d4 01 58 13 00 00 00 00 00 00 00 00 ..u^..X.........
backtrace:
[<
ffffffff816660be>] kmemleak_alloc+0x4e/0xb0
[<
ffffffff8119f328>] kmem_cache_alloc+0xc8/0x210
[<
ffffffff81566929>] skb_clone+0x49/0xb0
[<
ffffffffa0467459>] sctp_endpoint_bh_rcv+0x1d9/0x230 [sctp]
[<
ffffffffa046fdbc>] sctp_inq_push+0x4c/0x70 [sctp]
[<
ffffffffa047e8de>] sctp_rcv+0x82e/0x9a0 [sctp]
[<
ffffffff815abd38>] ip_local_deliver_finish+0xa8/0x210
[<
ffffffff815a64af>] nf_reinject+0xbf/0x180
[<
ffffffffa04b4762>] nfqnl_recv_verdict+0x1d2/0x2b0 [nfnetlink_queue]
[<
ffffffffa04aa40b>] nfnetlink_rcv_msg+0x14b/0x250 [nfnetlink]
[<
ffffffff815a3269>] netlink_rcv_skb+0xa9/0xc0
[<
ffffffffa04aa7cf>] nfnetlink_rcv+0x23f/0x408 [nfnetlink]
[<
ffffffff815a2bd8>] netlink_unicast+0x168/0x250
[<
ffffffff815a2fa1>] netlink_sendmsg+0x2e1/0x3f0
[<
ffffffff8155cc6b>] sock_sendmsg+0x8b/0xc0
[<
ffffffff8155d449>] ___sys_sendmsg+0x369/0x380
What happens is that commit
bbd0d59809f9 clones the skb containing
the AUTH chunk in sctp_endpoint_bh_rcv() when having the edge case
that an endpoint requires COOKIE-ECHO chunks to be authenticated:
---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ---------->
<------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------
------------------ AUTH; COOKIE-ECHO ---------------->
<-------------------- COOKIE-ACK ---------------------
When we enter sctp_sf_do_5_1D_ce() and before we actually get to
the point where we process (and subsequently free) a non-NULL
chunk->auth_chunk, we could hit the "goto nomem_init" path from
an error condition and thus leave the cloned skb around w/o
freeing it.
The fix is to centrally free such clones in sctp_chunk_destroy()
handler that is invoked from sctp_chunk_free() after all refs have
dropped; and also move both kfree_skb(chunk->auth_chunk) there,
so that chunk->auth_chunk is either NULL (since sctp_chunkify()
allocs new chunks through kmem_cache_zalloc()) or non-NULL with
a valid skb pointer. chunk->skb and chunk->auth_chunk are the
only skbs in the sctp_chunk structure that need to be handeled.
While at it, we should use consume_skb() for both. It is the same
as dev_kfree_skb() but more appropriately named as we are not
a device but a protocol. Also, this effectively replaces the
kfree_skb() from both invocations into consume_skb(). Functions
are the same only that kfree_skb() assumes that the frame was
being dropped after a failure (e.g. for tools like drop monitor),
usage of consume_skb() seems more appropriate in function
sctp_chunk_destroy() though.
Fixes:
bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Vlad Yasevich <yasevich@gmail.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
hayeswang [Tue, 4 Mar 2014 12:47:48 +0000 (20:47 +0800)]
r8152: disable the ECM mode
There are known issues for switching the drivers between ECM mode and
vendor mode. The interrup transfer may become abnormal. The hardware
may have the opportunity to die if you change the configuration without
unloading the current driver first, because all the control transfers
of the current driver would fail after the command of switching the
configuration.
Although to use the ecm driver and vendor driver independently is fine,
it may have problems to change the driver from one to the other by
switching the configuration. Additionally, now the vendor mode driver
is more powerful than the ECM driver. Thus, disable the ECM mode driver,
and let r8152 to set the configuration to vendor mode and reset the
device automatically.
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Gavin Shan [Tue, 4 Mar 2014 07:35:20 +0000 (15:35 +0800)]
net/mlx4: Support shutdown() interface
In kexec scenario, we failed to load the mlx4 driver in the
second kernel because the ownership bit was hold by the first
kernel without release correctly.
The patch adds shutdown() interface so that the ownership can
be released correctly in the first kernel. It also helps avoiding
EEH error happened during boot stage of the second kernel because
of undesired traffic, which can't be handled by hardware during
that stage on Power platform.
Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>
Tested-by: Wei Yang <weiyang@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Lüssing [Tue, 4 Mar 2014 02:57:35 +0000 (03:57 +0100)]
bridge: multicast: add sanity check for query source addresses
MLD queries are supposed to have an IPv6 link-local source address
according to RFC2710, section 4 and RFC3810, section 5.1.14. This patch
adds a sanity check to ignore such broken MLD queries.
Without this check, such malformed MLD queries can result in a
denial of service: The queries are ignored by any MLD listener
therefore they will not respond with an MLD report. However,
without this patch these malformed MLD queries would enable the
snooping part in the bridge code, potentially shutting down the
according ports towards these hosts for multicast traffic as the
bridge did not learn about these listeners.
Reported-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Reviewed-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Nikolay Aleksandrov [Mon, 3 Mar 2014 22:19:18 +0000 (23:19 +0100)]
net: fix for a race condition in the inet frag code
I stumbled upon this very serious bug while hunting for another one,
it's a very subtle race condition between inet_frag_evictor,
inet_frag_intern and the IPv4/6 frag_queue and expire functions
(basically the users of inet_frag_kill/inet_frag_put).
What happens is that after a fragment has been added to the hash chain
but before it's been added to the lru_list (inet_frag_lru_add) in
inet_frag_intern, it may get deleted (either by an expired timer if
the system load is high or the timer sufficiently low, or by the
fraq_queue function for different reasons) before it's added to the
lru_list, then after it gets added it's a matter of time for the
evictor to get to a piece of memory which has been freed leading to a
number of different bugs depending on what's left there.
I've been able to trigger this on both IPv4 and IPv6 (which is normal
as the frag code is the same), but it's been much more difficult to
trigger on IPv4 due to the protocol differences about how fragments
are treated.
The setup I used to reproduce this is: 2 machines with 4 x 10G bonded
in a RR bond, so the same flow can be seen on multiple cards at the
same time. Then I used multiple instances of ping/ping6 to generate
fragmented packets and flood the machines with them while running
other processes to load the attacked machine.
*It is very important to have the _same flow_ coming in on multiple CPUs
concurrently. Usually the attacked machine would die in less than 30
minutes, if configured properly to have many evictor calls and timeouts
it could happen in 10 minutes or so.
An important point to make is that any caller (frag_queue or timer) of
inet_frag_kill will remove both the timer refcount and the
original/guarding refcount thus removing everything that's keeping the
frag from being freed at the next inet_frag_put. All of this could
happen before the frag was ever added to the LRU list, then it gets
added and the evictor uses a freed fragment.
An example for IPv6 would be if a fragment is being added and is at
the stage of being inserted in the hash after the hash lock is
released, but before inet_frag_lru_add executes (or is able to obtain
the lru lock) another overlapping fragment for the same flow arrives
at a different CPU which finds it in the hash, but since it's
overlapping it drops it invoking inet_frag_kill and thus removing all
guarding refcounts, and afterwards freeing it by invoking
inet_frag_put which removes the last refcount added previously by
inet_frag_find, then inet_frag_lru_add gets executed by
inet_frag_intern and we have a freed fragment in the lru_list.
The fix is simple, just move the lru_add under the hash chain locked
region so when a removing function is called it'll have to wait for
the fragment to be added to the lru_list, and then it'll remove it (it
works because the hash chain removal is done before the lru_list one
and there's no window between the two list adds when the frag can get
dropped). With this fix applied I couldn't kill the same machine in 24
hours with the same setup.
Fixes:
3ef0eb0db4bf ("net: frag, move LRU list maintenance outside of
rwlock")
CC: Florian Westphal <fw@strlen.de>
CC: Jesper Dangaard Brouer <brouer@redhat.com>
CC: David S. Miller <davem@davemloft.net>
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Joe Thornber [Mon, 3 Mar 2014 15:52:28 +0000 (15:52 +0000)]
dm thin: fix noflush suspend IO queueing
i) by the time DM core calls the postsuspend hook the dm_noflush flag
has been cleared. So the old thin_postsuspend did nothing. We need to
use the presuspend hook instead.
ii) There was a race between bios leaving DM core and arriving in the
deferred queue.
thin_presuspend now sets a 'requeue' flag causing all bios destined for
that thin to be requeued back to DM core. Then it requeues all held IO,
and all IO on the deferred queue (destined for that thin). Finally
postsuspend clears the 'requeue' flag.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Joe Thornber [Mon, 3 Mar 2014 15:46:42 +0000 (15:46 +0000)]
dm thin: fix deadlock in __requeue_bio_list
The spin lock in requeue_io() was held for too long, allowing deadlock.
Don't worry, due to other issues addressed in the following "dm thin:
fix noflush suspend IO queueing" commit, this code was never called.
Fix this by taking the spin lock for a much shorter period of time.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Joe Thornber [Mon, 3 Mar 2014 16:03:26 +0000 (16:03 +0000)]
dm thin: fix out of data space handling
Ideally a thin pool would never run out of data space; the low water
mark would trigger userland to extend the pool before we completely run
out of space. However, many small random IOs to unprovisioned space can
consume data space at an alarming rate. Adjust your low water mark if
you're frequently seeing "out-of-data-space" mode.
Before this fix, if data space ran out the pool would be put in
PM_READ_ONLY mode which also aborted the pool's current metadata
transaction (data loss for any changes in the transaction). This had a
side-effect of needlessly compromising data consistency. And retry of
queued unserviceable bios, once the data pool was resized, could
initiate changes to potentially inconsistent pool metadata.
Now when the pool's data space is exhausted transition to a new pool
mode (PM_OUT_OF_DATA_SPACE) that allows metadata to be changed but data
may not be allocated. This allows users to remove thin volumes or
discard data to recover data space.
The pool is no longer put in PM_READ_ONLY mode in response to the pool
running out of data space. And PM_READ_ONLY mode no longer aborts the
pool's current metadata transaction. Also, set_pool_mode() will now
notify userspace when the pool mode is changed.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Mike Snitzer [Fri, 14 Feb 2014 16:58:41 +0000 (11:58 -0500)]
dm thin: ensure user takes action to validate data and metadata consistency
If a thin metadata operation fails the current transaction will abort,
whereby causing potential for IO layers up the stack (e.g. filesystems)
to have data loss. As such, set THIN_METADATA_NEEDS_CHECK_FLAG in the
thin metadata's superblock which:
1) requires the user verify the thin metadata is consistent (e.g. use
thin_check, etc)
2) suggests the user verify the thin data is consistent (e.g. use fsck)
The only way to clear the superblock's THIN_METADATA_NEEDS_CHECK_FLAG is
to run thin_repair.
On metadata operation failure: abort current metadata transaction, set
pool in read-only mode, and now set the needs_check flag.
As part of this change, constraints are introduced or relaxed:
* don't allow a pool to transition to write mode if needs_check is set
* don't allow data or metadata space to be resized if needs_check is set
* if a thin pool's metadata space is exhausted: the kernel will now
force the user to take the pool offline for repair before the kernel
will allow the metadata space to be extended.
Also, update Documentation to include information about when the thin
provisioning target commits metadata, how it handles metadata failures
and running out of space.
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Joe Thornber <ejt@redhat.com>
Trond Myklebust [Tue, 4 Mar 2014 18:48:16 +0000 (13:48 -0500)]
NFSv4: Fail the truncate() if the lock/open stateid is invalid
If the open stateid could not be recovered, or the file locks were lost,
then we should fail the truncate() operation altogether.
Reported-by: Andy Adamson <andros@netapp.com>
Link: http://lkml.kernel.org/r/1393954269-3974-1-git-send-email-andros@netapp.com
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Andy Adamson [Tue, 4 Mar 2014 17:31:09 +0000 (12:31 -0500)]
NFSv4.1 Fail data server I/O if stateid represents a lost lock
Signed-off-by: Andy Adamson <andros@netapp.com>
Link: http://lkml.kernel.org/r/1393954269-3974-1-git-send-email-andros@netapp.com
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Trond Myklebust [Tue, 4 Mar 2014 18:12:03 +0000 (13:12 -0500)]
NFSv4: Fix the return value of nfs4_select_rw_stateid
In commit
5521abfdcf4d6 (NFSv4: Resend the READ/WRITE RPC call
if a stateid change causes an error), we overloaded the return value of
nfs4_select_rw_stateid() to cause it to return -EWOULDBLOCK if an RPC
call is outstanding that would cause the NFSv4 lock or open stateid
to change.
That is all redundant when we actually copy the stateid used in the
read/write RPC call that failed, and check that against the current
stateid. It is doubly so, when we consider that in the NFSv4.1 case,
we also set the stateid's seqid to the special value '0', which means
'match the current valid stateid'.
Reported-by: Andy Adamson <andros@netapp.com>
Link: http://lkml.kernel.org/r/1393954269-3974-1-git-send-email-andros@netapp.com
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Trond Myklebust [Wed, 5 Mar 2014 13:44:23 +0000 (08:44 -0500)]
NFSv4: nfs4_stateid_is_current should return 'true' for an invalid stateid
When nfs4_set_rw_stateid() can fails by returning EIO to indicate that
the stateid is completely invalid, then it makes no sense to have it
trigger a retry of the READ or WRITE operation. Instead, we should just
have it fall through and attempt a recovery.
This fixes an infinite loop in which the client keeps replaying the same
bad stateid back to the server.
Reported-by: Andy Adamson <andros@netapp.com>
Link: http://lkml.kernel.org/r/1393954269-3974-1-git-send-email-andros@netapp.com
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Johannes Berg [Tue, 4 Mar 2014 12:46:53 +0000 (13:46 +0100)]
mac80211: clear sequence/fragment number in QoS-null frames
Avoid leaking data by sending uninitialized memory and setting an
invalid (non-zero) fragment number (the sequence number is ignored
anyway) by setting the seq_ctrl field to zero.
Cc: stable@vger.kernel.org
Fixes:
3f52b7e328c5 ("mac80211: mesh power save basics")
Fixes:
ce662b44ce22 ("mac80211: send (QoS) Null if no buffered frames")
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Takashi Iwai [Wed, 5 Mar 2014 11:34:39 +0000 (12:34 +0100)]
ALSA: usb-audio: Add quirk for Logitech Webcam C500
Logitech C500 (046d:0807) needs the same workaround like other
Logitech Webcams.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Takashi Iwai [Wed, 5 Mar 2014 11:00:29 +0000 (12:00 +0100)]
ALSA: hda - Use analog beep for Thinkpads with AD1984 codecs
For making the driver behavior compatible with the earlier kernels,
use the analog beep in the loopback path instead of the digital beep.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Takashi Iwai [Wed, 5 Mar 2014 10:52:24 +0000 (11:52 +0100)]
ALSA: hda - Add missing loopback merge path for AD1884/1984 codecs
The mixer widget (NID 0x20) of AD1884 and AD1984 codecs isn't
connected directly to the actual I/O paths but only via another mixer
widget (NID 0x21). We need a similar fix as we did for AD1882.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Barry Song [Wed, 5 Mar 2014 06:55:02 +0000 (14:55 +0800)]
pinctrl: sirf: fix kernel panic in gpio_lock_as_irq
commit
655dada6277991 causes kernel panic, this patch fixes it.
[ 1.197816] [
ffffffee] *pgd=
0d7fd821, *pte=
00000000, *ppte=
00000000
[ 1.204070] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[ 1.209447] Modules linked in:
[ 1.212490] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.14.0-rc1 #3
[ 1.218737] task:
cd03c000 ti:
cd040000 task.ti:
cd040000
[ 1.224127] PC is at gpiod_lock_as_irq+0xc/0x64
[ 1.228634] LR is at sirfsoc_gpio_irq_startup+0x18/0x44
[ 1.233842] pc : [<
c01d3990>] lr : [<
c01d1c38>] psr:
a0000193
[ 1.233842] sp :
cd041d30 ip :
00000000 fp :
00000000
[ 1.245296] r10:
00000000 r9 :
cd023db4 r8 :
60000113
[ 1.250505] r7 :
0000003e r6 :
cd023dd4 r5 :
c06bfa54 r4 :
cd023d80
[ 1.257014] r3 :
00000020 r2 :
00000000 r1 :
ffffffea r0 :
ffffffea
[ 1.263526] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
[ 1.270903] Control:
10c53c7d Table:
00004059 DAC:
00000015
[ 1.276631] Process swapper/0 (pid: 1, stack limit = 0xcd040240)
[ 1.282620] Stack: (0xcd041d30 to 0xcd042000)
[ 1.286963] 1d20:
cd023d80 c01d1c38 c01d1c20 cd023d80
[ 1.295124] 1d40:
00000001 c0068438 cd023d80 ccb6d880 cd023dd4 c0067044 0000718e c006719c
[ 1.286963] 1d20:
cd023d80 c01d1c38 c01d1c20 cd023d80
[ 1.295124] 1d40:
00000001 c0068438 cd023d80 ccb6d880 cd023dd4 c0067044 0000718e c006719c
[ 1.295124] 1d40:
00000001 c0068438 cd023d80 ccb6d880 cd023dd4 c0067044 0000718e c006719c
[ 1.303283] 1d60:
00000800 00000083 ccb6d880 cd023d80 c02b41d8 00000083 0000003e ccb7c410
[ 1.311442] 1d80:
00000000 c00671dc 00000083 0000003e c02b41d8 cd3dd5c0 0000003e ccb7c634
[ 1.319601] 1da0:
cd040030 c00672a8 cd3dd5c0 ccb7c410 ccb6d340 ccb7c410 ccb6d340 cd3dd400
[ 1.327760] 1dc0:
cd3dd410 c02b4434 ccb7c410 c01265a8 00000001 cd3dd410 c0687108 00000000
[ 1.335919] 1de0:
c0687108 00000000 00000000 c0240170 c0240158 cd3dd410 c06c30d0 c023e8bc
[ 1.344079] 1e00:
c023e9d4 00000000 cd3dd410 c023e9d4 c0682150 c023cf88 cd003e98 cd2d50c4
[ 1.352238] 1e20:
cd3dd410 cd3dd444 c06822f0 c023e768 cd3dd418 cd3dd410 c06822f0 c023de14
[ 1.360397] 1e40:
cd3dd418 00000000 cd3dd410 c023c398 cd041e78 cd041ea8 cd3dd400 cd3dd410
[ 1.368556] 1e60:
00000083 00000000 cd3dd400 cd3dd410 00000083 000000c8 c04e00c8 c023fee8
[ 1.376715] 1e80:
00000000 cd041ea8 cd3dd400 00000001 00000083 c024048c c0435ef8 c0434dec
[ 1.384874] 1ea0:
c068da58 c04c6d04 c0682150 c0435ef8 ffffffff 00000000 00000000 c068da58
[ 1.393033] 1ec0:
00000020 00000000 00000000 00000000 c05dabb8 00000007 c068d640 c068d640
[ 1.401193] 1ee0:
c04c247c c04c249c 00000000 c00088e8 cd004c00 c043bbb8 cd029180 c03812a0
[ 1.409352] 1f00:
00000000 00000000 60000113 c0673728 60000113 c0673728 00000000 00000000
[ 1.417511] 1f20:
cd7fce01 c0390a54 00000065 c003a81c c049e8bc 00000007 cd7fce0e 00000007
[ 1.425670] 1f40:
00000000 c05dabb8 00000007 c068d640 c068d640 c04c050c c04e00c8 00000065
[ 1.433829] 1f60:
c04e00c0 c04c0c54 00000007 00000007 c04c050c c037d8fc cd03c000 c004322c
[ 1.441988] 1f80:
c0662b40 0000d640 c03737c0 00000000 00000000 00000000 00000000 00000000
[ 1.450147] 1fa0:
00000000 c03737cc 00000000 c000e478 00000000 00000000 00000000 00000000
[ 1.458307] 1fc0:
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1.466467] 1fe0:
00000000 00000000 00000000 00000000 00000013 00000000 0002d481 05014092
[ 1.474640] [<
c01d3990>] (gpiod_lock_as_irq) from [<
c01d1c38>] (sirfsoc_gpio_irq_startup+0x18/0x44)
[ 1.483661] [<
c01d1c38>] (sirfsoc_gpio_irq_startup) from [<
c0068438>] (irq_startup+0x34/0x6c)
[ 1.492163] [<
c0068438>] (irq_startup) from [<
c0067044>] (__setup_irq+0x450/0x4b8)
[ 1.499714] [<
c0067044>] (__setup_irq) from [<
c00671dc>] (request_threaded_irq+0xa8/0x128)
[ 1.507960] [<
c00671dc>] (request_threaded_irq) from [<
c00672a8>] (request_any_context_irq+0x4c/0x7c)
[ 1.517164] [<
c00672a8>] (request_any_context_irq) from [<
c02b4434>] (gpio_extcon_probe+0x144/0x1d4)
[ 1.526279] [<
c02b4434>] (gpio_extcon_probe) from [<
c0240170>] (platform_drv_probe+0x18/0x48)
[ 1.534783] [<
c0240170>] (platform_drv_probe) from [<
c023e8bc>] (driver_probe_device+0x120/0x238)
[ 1.543641] [<
c023e8bc>] (driver_probe_device) from [<
c023cf88>] (bus_for_each_drv+0x58/0x8c)
[ 1.552143] [<
c023cf88>] (bus_for_each_drv) from [<
c023e768>] (device_attach+0x74/0x88)
[ 1.560126] [<
c023e768>] (device_attach) from [<
c023de14>] (bus_probe_device+0x84/0xa8)
[ 1.568113] [<
c023de14>] (bus_probe_device) from [<
c023c398>] (device_add+0x440/0x520)
[ 1.576012] [<
c023c398>] (device_add) from [<
c023fee8>] (platform_device_add+0xb4/0x214)
[ 1.584084] [<
c023fee8>] (platform_device_add) from [<
c024048c>] (platform_device_register_full+0xb8/0xdc)
[ 1.593719] [<
c024048c>] (platform_device_register_full) from [<
c04c6d04>] (sirfsoc_init_late+0xec/0xf4)
[ 1.603185] [<
c04c6d04>] (sirfsoc_init_late) from [<
c04c249c>] (init_machine_late+0x20/0x28)
[ 1.611603] [<
c04c249c>] (init_machine_late) from [<
c00088e8>] (do_one_initcall+0xf8/0x144)
[ 1.619934] [<
c00088e8>] (do_one_initcall) from [<
c04c0c54>] (kernel_init_freeable+0x13c/0x1dc)
[ 1.628620] [<
c04c0c54>] (kernel_init_freeable) from [<
c03737cc>] (kernel_init+0xc/0x118)
Signed-off-by: Barry Song <Baohua.Song@csr.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Dave Airlie [Wed, 5 Mar 2014 04:50:38 +0000 (14:50 +1000)]
Merge tag 'drm-intel-fixes-2014-03-04' of ssh://git.freedesktop.org/git/drm-intel into drm-fixes
Small fixes all around, mostly stable material. Please pull.
* tag 'drm-intel-fixes-2014-03-04' of ssh://git.freedesktop.org/git/drm-intel:
drm/i915: Reject >165MHz modes w/ DVI monitors
drm/i915: fix assert_cursor on BDW
drm/i915: vlv: reserve GT power context early
drm/i915: fix pch pci device enumeration
drm/i915: Resolving the memory region conflict for Stolen area
drm/i915: use backlight legacy combination mode also for i915gm/i945gm
Wenyou Yang [Wed, 5 Mar 2014 03:29:01 +0000 (11:29 +0800)]
spi: atmel: add missing spi_master_{resume,suspend} calls to PM callbacks
The PM callbacks implemented by the spi-atmel driver don't call
spi_master_{resume,suspend}, fix that.
Signed-off-by: Wenyou Yang <wenyou.yang@atmel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Axel Lin [Fri, 14 Feb 2014 01:53:00 +0000 (09:53 +0800)]
spi: coldfire-qspi: Fix getting correct address for *mcfqspi
dev_get_drvdata() returns the address of master rather than mcfqspi.
Fixes:
af361079 (spi/coldfire-qspi: Drop extra calls to spi_master_get in suspend/resume functions)
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org
Axel Lin [Fri, 14 Feb 2014 04:49:12 +0000 (12:49 +0800)]
spi: fsl-dspi: Fix getting correct address for master
Current code set platform drvdata to dspi. However, the code in dspi_suspend()
and dspi_resume() assumes the drvdata is the address of master.
Fix it by setting platform drvdata to master.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org
Patrick Lai [Sun, 2 Mar 2014 19:52:57 +0000 (11:52 -0800)]
ASoC: pcm: free path list before exiting from error conditions
dpcm_path_get() allocates dynamic memory to hold path list.
Corresponding dpcm_path_put() must be called to free the memory.
dpcm_path_put() is not called under several error conditions.
This leads to memory leak.
Signed-off-by: Patrick Lai <plai@codeaurora.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org
Magnus Damm [Wed, 26 Feb 2014 10:10:26 +0000 (19:10 +0900)]
pinctrl: sh-pfc: r8a7791: SD1_CLK fix
Fix the SD1_CLK handling for r8a7791. Without this patch
it is impossible to request all pins needed for SDHI1 on
the Koelsch board.
Signed-off-by: Magnus Damm <damm@opensource.se>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Josh Cartwright [Mon, 24 Feb 2014 18:41:20 +0000 (12:41 -0600)]
pinctrl: msm: make PINCTRL_MSM bool instead of tristate
Modular builds of pinctrl-msm break due to handle_bad_irq being
unexported for module use. For now, make PINCTRL_MSM 'bool'.
Signed-off-by: Josh Cartwright <joshc@codeaurora.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Hans de Goede [Mon, 17 Feb 2014 21:19:44 +0000 (22:19 +0100)]
pinctrl: sunxi: Fix interrupt register offset calculation
This fixing setting the interrupt type for eints >= 8.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>