Commit graph

388,156 commits

Author SHA1 Message Date
Al Viro
e86d35c38e do_coredump(): don't wait for thaw if coredump has already been interrupted
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-05-04 14:45:54 -04:00
Al Viro
0d5cadb87e do_mount(): fix a leak introduced in 3.9 ("mount: consolidate permission checks")
Cc: stable@vger.kernel.org
Bisected-by: Michael Leun <lkml20130126@newton.leun.net>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-05-04 14:40:51 -04:00
Linus Torvalds
73b29505c3 ipc: sem_putref() does not need the semaphore lock any more
ipc_rcu_putref() uses atomics for the refcount, and the games to lock
and unlock the semaphore just to try to keep the reference counting
working are no longer useful.

Acked-by: Davidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-05-04 11:24:21 -07:00
Linus Torvalds
6d49dab8ae ipc: move rcu_read_unlock() out of sem_unlock() and into callers
The IPC locking is a mess, and sem_unlock() unlocks not only the
semaphore spinlock, it also drops the rcu read lock.  Unlike sem_lock(),
which just gets the spin-lock, and expects the caller to get the rcu
read lock.

This all makes things very hard to follow, and it's very confusing when
you take the rcu read lock in one function, and then release it in
another.  And it has caused actual bugs: the sem_obtain_lock() function
ended up dropping the RCU read lock twice in one error path, because it
first did the sem_unlock(), and then did a rcu_read_unlock() to match
the rcu_read_lock() it had done.

This is just a totally mindless "remove rcu_read_unlock() from
sem_unlock() and add it immediately after each caller" (except for the
aforementioned bug where we did too many rcu_read_unlock(), and in
find_alloc_undo() where we just got the rcu_read_lock() to correct for
the fact that sem_unlock would immediately drop it again).

We can (and should) clean things up further, but this fixes the bug with
the minimal amount of subtlety.

Reviewed-by: Davidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-05-04 11:24:00 -07:00
Russell King
87c46b6c3d ARM: finally enable IRQ time accounting config
We've had IRQ time accounting for the last six months, except for the
Kconfig symbol.  This somehow got missed out of the original patch.
Add this now.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2013-05-04 14:38:59 +01:00
Jean Delvare
3fbc81e3c0 hwmon: (lm75) Add support for the Dallas/Maxim DS7505
Basically it's the same as the original DS75 but much faster.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Guenter Roeck <linux@roeck-us.net>
2013-05-04 14:49:36 +02:00
Jean Delvare
0cd2c72d76 hwmon: (lm75) Tune resolution and sample time per chip
Most LM75-compatible chips can either sample much faster or with a
much better resolution than the original LM75 chip. So far the lm75
driver did not let the user take benefit of these improvements. Do it
now.

I decided to almost always configure the chip to use the best
resolution possible, which also means the longest sample time. The
only chips for which I didn't are the DS75, DS1775 and STDS75, because
they are really too slow in 12-bit mode (1.2 to 1.5 second worst case)
so I went for 11-bit mode as a more reasonable tradeoff. This choice is
dictated by the fact that the hwmon subsystem is meant for system
monitoring, it has never been supposed to be ultra-fast, and as a
matter of fact we do cache the sampled values in almost all drivers.

If anyone isn't pleased with these default settings, they can always
introduce a platform data structure or DT support for the lm75. That
being said, it seems nobody ever complained that the driver wouldn't
refresh the value faster than every 1.5 second, and the change made
it faster for all chips even in 12-bit mode, so I don't expect any
complaint.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Guenter Roeck <linux@roeck-us.net>
2013-05-04 14:49:36 +02:00
Jean Delvare
87d0621ae2 hwmon: (lm75) Prepare to support per-chip resolution and sample time
Prepare the lm75 driver to support per-chip resolution and sample
time. For now we only make the code generic enough to support it, but
we still use the same, unchanged resolution (9-bit) and sample time
(1.5 s) for all chips.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Guenter Roeck <linux@roeck-us.net>
2013-05-04 14:49:36 +02:00
Jean Delvare
8a5c5cc617 hwmon: (lm75) Per-chip configuration register initialization
There is no standard for the configuration register bits of LM75-like
chips. We shouldn't blindly clear bits setting the resolution as they
are either unused or used for something else on some of the supported
chips.

So, switch to per-chip configuration initialization. This will allow
for better tuning later, for example using more resolution bits when
available.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Guenter Roeck <linux@roeck-us.net>
2013-05-04 14:49:36 +02:00
Takashi Iwai
ff359b1491 ALSA: hda - Fix 3.9 regression of EAPD init on Conexant codecs
The older Conexant codecs have up to two EAPDs and these are supposed
to be rather statically turned on.  The new generic parser code
assumes the dynamic on/off per path usage, thus it resulted in the
silent output on some machines.

This patch fixes the problem by simply assuming the static EAPD on for
such old Conexant codecs as we did until 3.8 kernel.

Reported-and-tested-by: Christopher K. <c.krooss@gmail.com>
Cc: <stable@vger.kernel.org> [v3.9]
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-05-04 10:57:16 +02:00
Imre Deak
3ab9c63705 drm/i915: hsw: fix link training for eDP on port-A
According to BSpec the link training sequence for eDP on HSW port-A
should be as follows:

1. link training: clock recovery
2. link training: equalization
3. link training: set idle transmission mode
4. display pipe enable
5. link training: disable (set normal mode)

Contrary to this at the moment we don't do step 3. and we do step 5.
before step 4. Fix this by setting idle transmission mode for eDP at
the end of intel_dp_complete_link_train and adding a new
intel_dp_stop_link_training function to disable link training. With
these changes we'll end up with the following functions corresponding
to the above steps:

intel_dp_start_link_train    -> step 1.
intel_dp_complete_link_train -> step 2., step 3.
intel_dp_stop_link_train     -> step 5.

For port-A we'll call intel_dp_stop_link_train only after enabling the
pipe, for everything else we'll call it right after
intel_dp_complete_link_train to preserve the current behavior.

Tested on HSW/HSW-ULT.

In v2:
- Due to a HW issue we must set idle transmission mode for port-A too
  before enabling the pipe. Thanks for Arthur Runyan for explaining
  this.
- Update the patch subject to make it clear that it's an eDP fix, DP is
  not affected.

v3:
- rename intel_dp_link_train() to intel_dp_set_link_train(), use 'val'
  instead 'l' as var name. (Paulo)

Signed-off-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Tested-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-05-04 10:24:56 +02:00
Daniel Vetter
657445fe86 Revert "drm/i915: revert eDP bpp clamping code changes"
This reverts commit 57c2196332.

It's an ugly hack for a Haswell SDV platform where the vbt doesn't
seem to fully agree with the panel. Since it seems to cause issues on
real eDP platform let's just kill this hack again.

Reported-and-tested-by: Josh Boyer <jwboyer@gmail.com>
References: https://lkml.org/lkml/2013/5/3/467
Cc: Paulo Zanoni <przanoni@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-05-04 10:09:18 +02:00
Peter Zijlstra
6e15eb3ba6 perf/x86/intel/lbr: Fix LBR filter
The LBR 'from' adddress is under full userspace control; ensure
we validate it before reading from it.

Note: is_module_text_address() can potentially be quite
expensive; for those running into that with high overhead
in modules optimize it using an RCU backed rb-tree.

Reported-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: <stable@kernel.org>
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/20130503121256.158211806@chello.nl
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: http://lkml.kernel.org/n/tip-mk8i82ffzax01cnqo829iy1q@git.kernel.org
2013-05-04 08:37:47 +02:00
Peter Zijlstra
741a698f42 perf/x86: Blacklist all MEM_*_RETIRED events for Ivy Bridge
Errata BV98 states that all MEM_*_RETIRED events corrupt the
counter value of the SMT sibling's counters. Blacklist these
events

Reported-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: <stable@kernel.org>
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/20130503121256.083340271@chello.nl
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: http://lkml.kernel.org/n/tip-jwra43mujrv1oq9xk6mfe57v@git.kernel.org
2013-05-04 08:37:46 +02:00
Frederic Weisbecker
265f22a975 sched: Keep at least 1 tick per second for active dynticks tasks
The scheduler doesn't yet fully support environments
with a single task running without a periodic tick.

In order to ensure we still maintain the duties of scheduler_tick(),
keep at least 1 tick per second.

This makes sure that we keep the progression of various scheduler
accounting and background maintainance even with a very low granularity.
Examples include cpu load, sched average, CFS entity vruntime,
avenrun and events such as load balancing, amongst other details
handled in sched_class::task_tick().

This limitation will be removed in the future once we get
these individual items to work in full dynticks CPUs.

Suggested-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Hakan Akkan <hakanakkan@gmail.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Kevin Hilman <khilman@linaro.org>
Cc: Li Zhong <zhong@linux.vnet.ibm.com>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
2013-05-04 08:32:02 +02:00
Frederic Weisbecker
73c3082877 rcu: Fix full dynticks' dependency on wide RCU nocb mode
Commit 0637e02939
("nohz: Select wide RCU nocb for full dynticks") intended
to force CONFIG_RCU_NOCB_CPU_ALL=y when full dynticks is
enabled.

However this option is part of a choice menu and Kconfig's
"select" instruction has no effect on such targets.

Fix this by using reverse dependencies on the targets we
don't want instead.

Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Hakan Akkan <hakanakkan@gmail.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Kevin Hilman <khilman@linaro.org>
Cc: Li Zhong <zhong@linux.vnet.ibm.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
2013-05-04 08:30:34 +02:00
Geert Uytterhoeven
80690fdb95 iscsi-target: Make buf param of iscsit_do_crypto_hash_buf() const void *
Make the "buf" input param of iscsit_do_crypto_hash_buf() "const void *".
This allows to remove lots of casts in its callers.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-05-03 16:49:48 -07:00
Nicholas Bellinger
bfbdb31d41 iscsi-target: Fix NULL pointer dereference in iscsit_send_reject
Fix up a NULL pointer dereference regression in iscsit_send_reject()
introduced by from commit 2ec5a8c11.

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-05-03 16:46:41 -07:00
Andy Grover
64146db71e target: Have dev/enable show if TCM device is configured
User tools need to know if the device is properly configured, since if
not, some other attributes are invalid.

Signed-off-by: Andy Grover <agrover@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-05-03 16:46:02 -07:00
Andy Grover
e3e84cda32 target: Use FD_MAX_SECTORS/FD_BLOCKSIZE for blockdevs using fileio
We can still see the error reported in

https://patchwork.kernel.org/patch/2338981/

when using fileio backed by a block device.

I'm assuming this will get us past that error (from sbc_parse_cdb),
and also assuming it's OK to have our max_sectors be larger than
the block's queue max hw sectors?

Reported-by: Eric Harney <eharney@redhat.com>
Signed-off-by: Andy Grover <agrover@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-05-03 16:44:24 -07:00
Andy Grover
2acd09f323 target: Remove unused struct members in se_dev_entry
Some were incremented, but never used anywhere from what I could tell.

Signed-off-by: Andy Grover <agrover@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-05-03 16:42:18 -07:00
Steven Rostedt (Red Hat)
2228768885 ring-buffer: Select IRQ_WORK
As the wake up logic for waiters on the buffer has been moved
from the tracing code to the ring buffer, it requires also adding
IRQ_WORK as the wake up code is performed via irq_work.

This fixes compile breakage when a user of the ring buffer is selected
but tracing and irq_work are not.

Link http://lkml.kernel.org/r/20130503115332.GT8356@rric.localhost

Cc: Arnd Bergmann <arnd@arndb.de>
Reported-by: Robert Richter <rric@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-05-03 19:24:17 -04:00
Tony Lindgren
eb16d33273 ARM: OMAP2+: Fix unmet direct dependencies for SERIAL_OMAP
Commit 8a6201b9 (ARM: OMAP2+: Fix unmet direct dependencies for zoom
for 8250 serial) fixed unmet direct dependencies for 8250, but failed
to do the same for omap serial. This can cause the following warning:

warning: (ARCH_OMAP2PLUS_TYPICAL) selects SERIAL_OMAP which has
unmet direct dependencies (TTY && HAS_IOMEM && GENERIC_HARDIRQS &&
ARCH_OMAP2PLUS).

We should not select drivers, they should be selected by the
user. Fix the issue by removing the select and adding them to
omap2plus_defconfig instead.

Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-05-03 22:38:53 +02:00
Arnd Bergmann
ccefeea91c ARM: ux500: always select ABX500_CORE
We are probably selecting more drivers than we should in ux500,
but cleaning up that logic for good can be left for another
time. Most of these could be converted into silent options in
the future, since they are always enabled on ux500 and never
needed elsewhere.

As a fixup for 3.10, let's at least select the dependencies for
the other drivers we already select, to make it consistent.

warning: (UX500_SOC_COMMON) selects AB8500_CORE which has unmet direct dependencies (HAS_IOMEM && GENERIC_HARDIRQS && ABX500_CORE && MFD_DB8500_PRCMU)

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
2013-05-03 22:36:58 +02:00
Arnd Bergmann
cb0c480a46 ARM: SIRF: select SMP_ON_UP only on SMP builds
Like all other platforms, we can only select SMP_ON_UP if SMP
is also enabled.

warning: (SOC_IMX31 && SOC_IMX35 && ARCH_MARCO) selects
 SMP_ON_UP which has unmet direct dependencies (SMP && !XIP_KERNEL)

Cc: Barry Song <baohua.song@csr.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-05-03 22:36:32 +02:00
Arnd Bergmann
6343b05f0a ARM: SPEAr: conditionalize l2x0 support
If the cache controller implementation is disabled at build time,
we must not call any functions related to it.

arch/arm/mach-spear/built-in.o: In function `spear13xx_l2x0_init':
arch/arm/mach-spear/spear13xx.c:47: undefined reference to `l2x0_init'

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Viresh Kumar <viresh.linux@gmail.com>
2013-05-03 22:36:32 +02:00
Arnd Bergmann
cb48389bd6 ARM: imx: build CPU suspend code only when needed
The ARM CPU suspend function has its own configuration symbol,
which we need to use for conditionalizing any code calling into
it as well.

arch/arm/mach-imx/built-in.o: In function `v7_cpu_resume':
/git/arm-soc/arch/arm/mach-imx/headsmp.S:57: undefined
 reference to `cpu_resume'

Cc: Sascha Hauer <kernel@pengutronix.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-05-03 22:36:31 +02:00
Arnd Bergmann
572b16db70 ARM: OMAP: build SMP code only for OMAP4/5
The OMAP platform code assumes that SMP is only ever enabled when
CONFIG_ARCH_OMAP4 or CONFIG_SOC_OMAP5 is enabled, which is not
necessarirly true in a multiplatform configuration.

arch/arm/mach-omap2/built-in.o: In function `omap4_smp_prepare_cpus':
 :(.init.text+0x413c): undefined reference to `omap_get_wakeupgen_base'
 :(.init.text+0x415c): undefined reference to `omap_secure_apis_support'
arch/arm/mach-omap2/built-in.o: In function `omap4_boot_secondary':
 :(.cpuinit.text+0x28): undefined reference to `omap_get_wakeupgen_base'
 :(.cpuinit.text+0x3c): undefined reference to `omap_secure_apis_support'
arch/arm/mach-omap2/built-in.o: In function `omap4_cpu_die':
 :(.ref.text+0x8): undefined reference to `omap_get_wakeupgen_base'
 :(.ref.text+0x10): undefined reference to `omap_secure_apis_support'
 :(.ref.text+0x4c): undefined reference to `omap4_hotplug_cpu'
 :(.ref.text+0x50): undefined reference to `omap_secure_apis_support'

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Tony Lindgren <tony@atomide.com>
2013-05-03 22:36:30 +02:00
J. Bruce Fields
9f415eb255 nfsd4: don't allow owner override on 4.1 CLAIM_FH opens
The Linux client is using CLAIM_FH to implement regular opens, not just
recovery cases, so it depends on the server to check permissions
correctly.

Therefore the owner override, which may make sense in the delegation
recovery case, isn't right in the CLAIM_FH case.

Symptoms: on a client with 49f9a0fafd
"NFSv4.1: Enable open-by-filehandle", Bryan noticed this:

	touch test.txt
	chmod 000 test.txt
	echo test > test.txt

succeeding.

Cc: stable@kernel.org
Reported-by: Bryan Schumaker <bjschuma@netapp.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2013-05-03 16:36:14 -04:00
Arnd Bergmann
63cc846761 ARM: tegra: Tegra114 needs CPU_FREQ_TABLE
Like the other Tegra SoCs using the same cpufreq driver, we
have to enable CPU_FREQ_TABLE for this one.

drivers/built-in.o: In function `tegra_cpu_exit':
 drivers/cpufreq/tegra-cpufreq.c:237: undefined reference to
 `cpufreq_frequency_table_cpuinfo'

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Cc: Stephen Warren <swarren@nvidia.com>
Cc: Hiroshi Doyu <hdoyu@nvidia.com>
2013-05-03 22:36:08 +02:00
Thadeu Lima de Souza Cascardo
777c230086 cxgb4: fix error recovery when t4_fw_hello returns a positive value
Since commit 636f9d371f ("cxgb4: Add
support for T4 configuration file"), t4_fw_hello may return a positive
value instead of 0 for success. The recovery code tests only for zero
and fails recovery for any other value.

This fix tests for negative error values and fails only on those cases.
Error recovery after an error injection works after this change.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:10:34 -04:00
Kirill Smelkov
88dccf5b34 sky2: Fix crash on receiving VLAN frames
After recent 86a9bad3 (net: vlan: add protocol argument to packet
tagging functions) my sky2 started to crash on receive of tagged
frames, with backtrace similar to

    #CRASH!!!
    vlan_do_receive
    __netif_receive_skb_core
    __netif_receive_skb
    netif_receive_skb
    sky2_poll
    ...
    __net_rx_action
    __do_softirq

The problem turned out to be:

    1) sky2 copies small packets from ring on RX, and in its
       receive_copy() skb header is copied manually field, by field, and
       only for some fields;

    2) 86a9bad3  added skb->vlan_proto, which vlan_untag() or
       __vlan_hwaccel_put_tag() set, and which is later used in
       vlan_do_receive().

       That patch updated copy_skb_header() for newly introduced
       skb->vlan_proto, but overlooked the need to also copy it in sky2's
       receive_copy().

Because of 2, we have the following scenario:

    - frame is received and tagged in a ring, by sky2_rx_tag(). Both
      skb->vlan_proto and skb->vlan_tci are set;

    - later skb is decided to be copied, but skb->vlan_proto is
      forgotten and becomes 0.

    - in the beginning of vlan_do_receive() we call

        __be16 vlan_proto = skb->vlan_proto;
        vlan_dev = vlan_find_dev(skb->dev, vlan_proto, vlan_id);

      which eventually invokes

        vlan_proto_idx(vlan_proto)

      and that routine BUGs for everything except ETH_P_8021Q and
      ETH_P_8021AD.

      Oops.

Fix it.

P.S.

Stephen, I wonder, why copy_skb_header() is not used in
sky2.c::receive_copy() ? Problems, where receive_copy was updated field
by field showed several times already, e.g.

    3f42941b    (sky2: propogate rx hash when packet is copied)
    e072b3fa    (sky2: fix receive length error in mixed non-VLAN/VLAN traffic)

Cc: Patrick McHardy <kaber@trash.net>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Cc: Mirko Lindner <mlindner@marvell.com>
Signed-off-by: Kirill Smelkov <kirr@mns.spb.ru>
Acked-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:10:34 -04:00
Daniel Borkmann
8da3056c04 packet: tpacket_v3: do not trigger bug() on wrong header status
Jakub reported that it is fairly easy to trigger the BUG() macro
from user space with TPACKET_V3's RX_RING by just giving a wrong
header status flag. We already had a similar situation in commit
7f5c3e3a80 (``af_packet: remove BUG statement in
tpacket_destruct_skb'') where this was the case in the TX_RING
side that could be triggered from user space. So really, don't use
BUG() or BUG_ON() unless there's really no way out, and i.e.
don't use it for consistency checking when there's user space
involved, no excuses, especially not if you're slapping the user
with WARN + dump_stack + BUG all at once. The two functions are
of concern:

  prb_retire_current_block() [when block status != TP_STATUS_KERNEL]
  prb_open_block() [when block_status != TP_STATUS_KERNEL]

Calls to prb_open_block() are guarded by ealier checks if block_status
is really TP_STATUS_KERNEL (racy!), but the first one BUG() is easily
triggable from user space. System behaves still stable after they are
removed. Also remove that yoda condition entirely, since it's already
guarded.

Reported-by: Jakub Zawadzki <darkjames-ws@darkjames.pl>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:10:33 -04:00
holger@eitzenberger.org
c5060cec6b asix: fix BUG in receive path when lowering MTU
There is bug in the receive path of the asix driver at the time a
packet is received larger than MTU size and DF bit set:

 BUG: unable to handle kernel paging request at 0000004000000001
 IP: [<ffffffff8126f65b>] skb_release_head_state+0x2d/0xd2
 ...
 Call Trace:
  <IRQ>
  [<ffffffff8126f86d>] ? skb_release_all+0x9/0x1e
  [<ffffffff8126f8ad>] ? __kfree_skb+0x9/0x6f
  [<ffffffffa00b4200>] ? asix_rx_fixup_internal+0xff/0x1ae [asix]
  [<ffffffffa00fb3dc>] ? usbnet_bh+0x4f/0x226 [usbnet]
  ...

It is easily reproducable by setting an MTU of 512 e. g. and sending
something like

  ping -s 1472 -c 1 -M do $SELF

from another box.

And this is because the rx->ax_skb is freed on error, but rx->ax_skb
is not reset, and the size is not reset to zero in this case.

And since the skb is added again to the usbnet->done skb queue it is
accessing already freed memory, resulting in the BUG when freeing a
2nd time.  I therefore think the value 0x0000004000000001 show in the
trace is more or less random data.

Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:10:33 -04:00
Teppo Kotilainen
0decc64b18 net: qmi_wwan: Add Telewell TW-LTE 4G
Information from driver description files:

  diag:  VID_19D2&PID_0412&MI_00
  nmea:  VID_19D2&PID_0412&MI_01
  at:    VID_19D2&PID_0412&MI_02
  modem: VID_19D2&PID_0412&MI_03
  net:   VID_19D2&PID_0412&MI_04

Signed-off-by: Teppo Kotilainen <qubit303@gmail.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:10:33 -04:00
Dan Carpenter
3d64fc7053 usbnet: pegasus: endian bug in write_mii_word()
We're only passing the two high bytes of an integer.  It works for
little endian but not for big endian.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:10:23 -04:00
Pravin B Shelar
0d05535d41 vxlan: Fix TCPv6 segmentation.
This patch set correct skb->protocol so that inner packet can
lookup correct gso handler.

Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:08:59 -04:00
Pravin B Shelar
9b3eb5edf3 gre: Fix GREv4 TCPv6 segmentation.
For ipv6 traffic, GRE can generate packet with strange GSO
bits, e.g. ipv4 packet with SKB_GSO_TCPV6 flag set.  Therefore
following patch relaxes check in inet gso handler to allow
such packet for segmentation.
This patch also fixes wrong skb->protocol set that was done in
gre_gso_segment() handler.

Reported-by: Steinar H. Gunderson <sesse@google.com>
CC: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:08:58 -04:00
stephen hemminger
83401eb499 bridge: fix race with topology change timer
A bridge should only send topology change notice if it is not
the root bridge. It is possible for message age timer to elect itself
as a new root bridge, and still have a topology change timer running
but waiting for bridge lock on other CPU.

Solve the race by checking if we are root bridge before continuing.
This was the root cause of the cases where br_send_tcn_bpdu would OOPS.

Reported-by: JerryKang <jerry.kang@samsung.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:08:58 -04:00
Gerlando Falauto
488fc9af82 tipc: pskb_copy() buffers when sending on more than one bearer
When sending packets, TIPC bearers use skb_clone() before writing their
hardware header. This will however NOT copy the data buffer.
So when the same packet is sent over multiple bearers (to reach multiple
nodes), the same socket buffer data will be treated by multiple
tipc_media drivers which will write their own hardware header through
dev_hard_header().
Most of the time this is not a problem, because by the time the
packet is processed by the second media, it has already been sent over
the first one. However, when the first transmission is delayed (e.g.
because of insufficient bandwidth or through a shaper), the next bearer
will overwrite the hardware header, resulting in the packet being sent:
a) with the wrong source address, when bearers of the same type,
e.g. ethernet, are involved
b) with a completely corrupt header, or even dropped, when bearers of
different types are involved.

So when the same socket buffer is to be sent multiple times, send a
pskb_copy() instead (from the second instance on), and release it
afterwards (the bearer will skb_clone() it anyway).

Signed-off-by: Gerlando Falauto <gerlando.falauto@keymile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:08:58 -04:00
Gerlando Falauto
77861d9c00 tipc: tipc_bcbearer_send(): simplify bearer selection
Signed-off-by: Gerlando Falauto <gerlando.falauto@keymile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:08:58 -04:00
Gerlando Falauto
e616071094 tipc: cosmetic: clean up comments and break a long line
Signed-off-by: Gerlando Falauto <gerlando.falauto@keymile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03 16:08:58 -04:00
Linus Torvalds
1db772216f Merge branch 'for-3.10' of git://linux-nfs.org/~bfields/linux
Pull nfsd changes from J Bruce Fields:
 "Highlights include:

   - Some more DRC cleanup and performance work from Jeff Layton

   - A gss-proxy upcall from Simo Sorce: currently krb5 mounts to the
     server using credentials from Active Directory often fail due to
     limitations of the svcgssd upcall interface.  This replacement
     lifts those limitations.  The existing upcall is still supported
     for backwards compatibility.

   - More NFSv4.1 support: at this point, if a user with a current
     client who upgrades from 4.0 to 4.1 should see no regressions.  In
     theory we do everything a 4.1 server is required to do.  Patches
     for a couple minor exceptions are ready for 3.11, and with those
     and some more testing I'd like to turn 4.1 on by default in 3.11."

Fix up semantic conflict as per Stephen Rothwell and linux-next:

Commit 030d794bf4 ("SUNRPC: Use gssproxy upcall for server RPCGSS
authentication") adds two new users of "PDE(inode)->data", but we're
supposed to use "PDE_DATA(inode)" instead since commit d9dda78bad
("procfs: new helper - PDE_DATA(inode)").

The old PDE() macro is no longer available since commit c30480b92c
("proc: Make the PROC_I() and PDE() macros internal to procfs")

* 'for-3.10' of git://linux-nfs.org/~bfields/linux: (60 commits)
  NFSD: SECINFO doesn't handle unsupported pseudoflavors correctly
  NFSD: Simplify GSS flavor encoding in nfsd4_do_encode_secinfo()
  nfsd: make symbol nfsd_reply_cache_shrinker static
  svcauth_gss: fix error return code in rsc_parse()
  nfsd4: don't remap EISDIR errors in rename
  svcrpc: fix gss-proxy to respect user namespaces
  SUNRPC: gssp_procedures[] can be static
  SUNRPC: define {create,destroy}_use_gss_proxy_proc_entry in !PROC case
  nfsd4: better error return to indicate SSV non-support
  nfsd: fix EXDEV checking in rename
  SUNRPC: Use gssproxy upcall for server RPCGSS authentication.
  SUNRPC: Add RPC based upcall mechanism for RPCGSS auth
  SUNRPC: conditionally return endtime from import_sec_context
  SUNRPC: allow disabling idle timeout
  SUNRPC: attempt AF_LOCAL connect on setup
  nfsd: Decode and send 64bit time values
  nfsd4: put_client_renew_locked can be static
  nfsd4: remove unused macro
  nfsd4: remove some useless code
  nfsd4: implement SEQ4_STATUS_RECALLABLE_STATE_REVOKED
  ...
2013-05-03 10:59:39 -07:00
Stanislaw Gruszka
db17834043 ath5k: do not reschedule tx_complete_work on stop
This patch claim to fix "WARNING: at net/mac80211/util.c:599
ieee80211_can_queue_work.isra.7+0x30/0x40", which was reported at:

https://bugzilla.redhat.com/show_bug.cgi?id=922295

We use ATH_STAT_STARTED flag to disallow to perform
ath5k_tx_complete_poll_work() code, hence reschedule
ah->tx_complete_work, when we stop device. This flag was defined in
ath5k code, but it was not used.

I didn't get feedback if the fix works, so patch is compile only tested.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-05-03 13:55:08 -04:00
Felix Fietkau
4ef69d0394 ath9k: fix key allocation error handling for powersave keys
If no keycache slots are available, ath_key_config can return -ENOSPC.
If the key index is not checked for errors, it can lead to logspam that
looks like this: "ath: wiphy0: keyreset: keycache entry 228 out of range"
This can cause follow-up errors if the invalid keycache index gets
used for tx.

Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-05-03 13:44:56 -04:00
Linus Torvalds
86652188f3 a couple fixes for jfs
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.19 (GNU/Linux)
 
 iQIcBAABAgAGBQJRg9htAAoJEDaohF61QIxkD4AP/A4SRjnIyNOuN/pJ4PGfv6Ck
 2c9102PvTrinLfgiMRU7TU6TfxP3IIcAYvf4l2gXVlmCbaMSSnd/POimW6caPRML
 DNrsdwdhH8kSOM3F5x3YQS6ZZo7ySUxj2Cnt74eg8Jiear6gC8Xhy7/kRvVA1a1w
 adDgqRuhgpbhPuzn1Al+ohy51hLzV+4CaeCphPLfzV1rSPrOlzeZIrhIPoE/PUr2
 /8hMRzwiuRMTVYL2lur4OA5KtTfE2zZ7uRp4wzUoGmkG+FXVPe1xvCcOxhAC1H82
 PwpflqFn9P9p9qPyBcRz7OtO2ME8CLQz9zKwvXuWBu3rr3Un/1v1f+0lZwl82ukv
 lNNYLdBMUFDUatz9OeYE8uWSkJ4g2JXVt5ZdsiVQiKb8/IDekD2h+krX1ZWiQsoo
 CGwdOgIfIAzCIglh3ge51NAymJwMo84oi2JtzLgPgZy3PteHiCRMChqYiocIqHjM
 pHOSU6k0RYmRrNlzrWdl76F/SvYYLbY9UDFFYMkq7SzZ73zt0vKv598ig1vDXsJN
 mCnfqkuBpHc8cZaPshyirU/BOJfUzXT5qK1ctqyHWmVhSf/5H8XLnyUu9gzhktJM
 u3H/DhXr6C6mCiOO9NHNWXgRNiQP8RV0aB29UF/s697yS3p05duPuSZcXsISFIzD
 DkzkwEJNc7uFbGDHLHl5
 =hKDY
 -----END PGP SIGNATURE-----

Merge tag 'jfs-3.10' of git://github.com/kleikamp/linux-shaggy

Pull jfs fixes from David Kleikamp:
 "A couple fixes for jfs"

(What's with the unhelpful pull request "explanations" from fs people
today?)

* tag 'jfs-3.10' of git://github.com/kleikamp/linux-shaggy:
  jfs: fix a couple races
  jfs: avoid undefined behavior from left-shifting by 32 bits
2013-05-03 09:57:16 -07:00
Linus Torvalds
14a9e5c09d Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull ext3/jbd fixes from Jan Kara:
 "A couple of ext3/jbd fixes"

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  jbd: use kmem_cache_zalloc for allocating journal head
  jbd: use kmem_cache_zalloc instead of kmem_cache_alloc/memset
  jbd: don't wait (forever) for stale tid caused by wraparound
  ext3: fix data=journal fast mount/umount hang
2013-05-03 09:56:25 -07:00
Jesse Barnes
2b87f3b1ba drm/i915: fix Haswell pfit power well check v2
We can't read the pfit regs if the power well is off, so use the cached
value.

v2: re-add lost comment (Jesse)
    make sure the crtc using the fitter is actually enabled (Jesse)

Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
[danvet: Drop now unused dev_priv, as spotted by Mika.]
Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Tested-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-05-03 18:23:26 +02:00
Mika Kuoppala
168f836602 drm/i915: unreference default context on module unload
Before module unload is called, gpu_idle() will switch
to default context. This will increment ref count of base
object as the default context is 'running' on module unload
time. Unreference the drm object so that when context
is freed, base object is freed as well.

v2: added comment to explain the refcounts (Ben Widawsky)

Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com>
Reviewed-by: Ben Widawsky <ben@bwidawsk.net>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-05-03 18:19:56 +02:00
Trond Myklebust
9b1d75b755 SUNRPC: Don't spam syslog with "Pseudoflavor not found" messages
Just convert those messages to dprintk()s so that they can be used
when debugging.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
2013-05-03 12:19:33 -04:00