This patch addresses a >= v3.11 free-after-use regression
in core_scsi3_emulate_pro_register() that was introduced
in the following commit:
commit bc118fe4c4
Author: Andy Grover <agrover@redhat.com>
Date: Thu May 16 10:41:04 2013 -0700
target: Further refactoring of core_scsi3_emulate_pro_register()
To avoid the free-after-use, save an type value before hand, and
only call core_scsi3_put_pr_reg() with a valid *pr_reg.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Andy Grover <agrover@redhat.com>
Cc: <stable@vger.kernel.org> #3.11+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
- Fix ARM and Xen FIFO not working.
- Remove more Xen ia64 vestigates.
- Fix UAPI missing Xen files.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJS+j6MAAoJEFjIrFwIi8fJnwsH/2KAR3OU6Xye10bXzHVf/SLD
C7q7OR0tYPSWAesJ+W2B0pzrWbs4sZF+rr0ctLPH0neE6dqxiv2fypT5WHCQDS4E
WLmFtzwxVOXr4wy7vCH5VWP9Xc8ACLnyFHrQXycT7kV4+jlcHC2DkeiJ02bKtUR9
1MgUXem8OrdLvtvKMG7Zlw8c5xgJ5QQskCMMja1DjkRtUYnpgxQk/gqNhf+c20zj
NeRBSvwi2zxYwyH7l26zGusk08cvNEBKDnZaxXsraHXIFMDaLdkmWBEp8Y5Bjn+D
xWHofrRpARPKSODL9wN0ozUdKEVFmlMwfiHB0OqY/rHip3+3ceYJDTZ7brjV3gE=
=i0aW
-----END PGP SIGNATURE-----
Merge tag 'stable/for-linus-3.14-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull Xen bugfixes from Konrad Rzeszutek Wilk:
"This has an healthy amount of code being removed - which we do not use
anymore (the only user of it was ia64 Xen which had been removed
already). The other bug-fixes are to make Xen ARM be able to use the
new event channel mechanism and proper export of header files to
user-space.
Summary:
- Fix ARM and Xen FIFO not working.
- Remove more Xen ia64 vestigates.
- Fix UAPI missing Xen files"
* tag 'stable/for-linus-3.14-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
ia64/xen: Remove Xen support for ia64 even more
xen: install xen/gntdev.h and xen/gntalloc.h
xen/events: bind all new interdomain events to VCPU0
Set the return variable to an error code as done elsewhere in the function.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
{ ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
when != &ret
*if(...)
{
... when != ret = e2
when forall
return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Set the return variable to an error code as done elsewhere in the function.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
{ ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
when != &ret
*if(...)
{
... when != ret = e2
when forall
return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Two driver fixes, one fixing the mapping of interrupts on da9055 (which
previously wouldn't have worked at all) and a fix for reference counting
OF nodes in the max14577 driver.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJS+2B5AAoJELSic+t+oim9+pcP/1DexaQDDkebFHiIkoLiNlt1
EEXqAnB3ATS1BdCWzjlPVMRKU62fGpUwXBni1vQnb7d5SzhWAwRaL1socQtx0VoI
8G7xkIRIHthxa+SMCV91Juh9vif+Kg1HQYBAdOXreXQJNWMhhANP4hdQxFV1rt6K
/jRMnmxR9LvskIvJGxGBem5MG8mayK4gS+OUDMPQ2+eXCuhcRKl6FmQVx+3qtlRL
qw+ep9dLTnNaxwhRkimkV27pmB/X6/jRnUCCB+/qd325WVwT7dkCpSqSMfaN+AOF
P1rJMatn9YZpOXFIToM1f3DCoS6KD4cnPO8GkojJf8DREf62/OkTFGUY0OQCI+RQ
VRU0/rM8KvaxJydxqcCbxV7OQ0oVq4UcptBZx4JwQWazgn8Ge91TskCpPepA/LpM
x/U+RJFOXQZKgPcELYOMdcXOIWLBpMv6ZVYsWFmLH9pTowhxEhWlschx3Q+iN7m1
v8jTjvAlTzND3GyoZYzBSNFmsaR0i+VQoFCybrwYnuRLWRfWE3L6HOBdC7tS+aQ5
2IIomLMJ5I4qXXoSKmo8xzVxgBD9tlEuEMlVaZQ6f1tfxDuK/O1m2U1/0s0DKdPW
kUm6JGp7U41NubO0Q/e2BsM/Mp6UX68QtVs/c/n9aCRZml6Qg4sy5cW6JStYhN3E
tdZaNfzjPHH+1pPvXZsE
=bibl
-----END PGP SIGNATURE-----
Merge tag 'regulator-v3.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"Two driver fixes, one fixing the mapping of interrupts on da9055
(which previously wouldn't have worked at all) and a fix for reference
counting OF nodes in the max14577 driver"
* tag 'regulator-v3.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: da9055: Remove use of regmap_irq_get_virq()
regulator: max14577: Add missing of_node_put
- Get #ifdef's right in the <linux/gpio/consumer.h> header.
- Minor fixes to tb10x, clps711x, bcm281xx, intel-mid and
xtensa GPIO drivers.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJS+4lBAAoJEEEQszewGV1zFzIQAKNEGIZrm+GdEKULoJ2E0SIN
MzXRgZV3xiz7giroSdbiF+MBb6rE/0Ixa8EnrZ1JBz+OXCEYKYOS/TXbDNPAnjU2
OI+4aiGUe7cb+Y787z/tggw01twaCYISbdoST+RHwtRi+fizSI0nLLDx3iXMb24t
1EUjQm/Gv+X3zSwt9zYpv3qO/tiQxf6SVTnYOuGS2DDJX6tXwxpFmlGZGf78cBTs
2SdfxZmrDU8M+Mqul4i4BmIVfUsgROZaD7YeYVu7tJp2aPyPgPz6PC1YrxYhxOZH
w4mOhao+anDM8IWBu2jLn6CBl4QN0tgKZJ65dm58wce55q8q/8McOqrSWR9THzAy
W9niY430MXuY1M2ZB1vsJP0ICR5wSKWf6NkIJOsWVTVLDP4JT3kQoOV+zCTHi+Y8
UarlFgf54OazF8y2sUcXgSKHIntjmyU/sT04d+27k6RkJl9Nvu7kzRXu+hZBNiEj
M00E89NxSnUoKQhp5WFcLBBt1MzFxhxRu/Z7EbdkrKIsiIs0iYpZ2met93RjCp/O
zhoKHmyOLuIGqozRUeQvGS4E8J1Gw2c9opIVnqkF7cuQx5l/Au/OGHMB4A5AVwEa
ywV+ipxbI+fVlCbRNFAiKhjHAHsK3jDWEsT7vANSy5lRaegL9RCTvMfj/GP34QAG
gxG2UXLwp37wevGHsV1s
=pj2O
-----END PGP SIGNATURE-----
Merge tag 'gpio-v3.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio
Pull GPIO fixes from Linus Walleij:
"Here are some accumulated patches with small fixes for this and that
in a few GPIO drivers, and a more important fix to an #ifdef in the
GPIO consumer header.
Summary:
- Get #ifdef's right in the <linux/gpio/consumer.h> header.
- Minor fixes to tb10x, clps711x, bcm281xx, intel-mid and xtensa GPIO
drivers"
* tag 'gpio-v3.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
gpio: consumer.h: Move forward declarations outside #ifdef
gpio: tb10x: GPIO_TB10X needs to select GENERIC_IRQ_CHIP
gpio: clps711x: Add module alias to support module auto loading
gpio: bcm281xx: Update MODULE_AUTHOR
gpio: intel-mid: fix the incorrect return of idle callback
gpio: xtensa: fix build when XCHAL_HAVE_CP is 0
A few driver and documentation fixes, plus a fix for double error
handling which had crept in due to the confusing documentation - it
wasn't clear if the core or the driver was responsible for cleanup
in error cases so both tried to do it with unfortunate results.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJS+haUAAoJELSic+t+oim9wLMP/idNnHkp7sNPrc6dlC+ZpFEY
Dat8RJCO0NAEZIO/CBWaCx47WMVj51VVFxWXf/fp6djwPFcG0BY6OU2xixEOZn//
4u2nmCWA5bQCYBaItxKggZe407/vaBU+9R6XIK5mMHGQyrEZX/88z4N61S4CzrK4
F0GJO1KW3ypi4jI6193Cwuw1T6Gr3GYzu/gD5Yo1kZq5hTRoIt/gFSrolH9Z2yXS
YOJWTWTXzrtGJ/UVD09ukjV9pdxk6qNHp0jtGe+H3RGditPyWuPyttWZIPKR6zdl
GCd11oIGOjzSFbFwDHXocKP+o2oL8Xc6HoD6GK2LHGnHjXO2OZasVsEuQXAlRUSR
X7jr6i+NXiFwuKfbLMdbRahfUWDkFp2rhyJvWpgLZg26dyHiHvpT5CIfT/ep948K
PEoUeXYZXR8u3LgG+WVCcZaVL1VUyDCrvSzVL3C3vx0yGuna1nj7ybKzPPtb96Ub
XB4qNow4FfvubM4ierjZwjZqTSlMjPeXGH1hMUtZYQpUGCS1TuDMElAtWKAxd3ip
7aESg+b+kkfqUulZ9ObGf1K3h7MhH52/sqKbBWUi3DS2BnCGIEqkl+qfBnqBSHwS
cNxCgIg4ohxkEt3DUH1T2+8vAwQSawhjlS/4h+Al+tdzG4HAP7D/cDaCBWFiNf+7
vqvISqHUdpKLPYYF4sON
=rORX
-----END PGP SIGNATURE-----
Merge tag 'spi-v3.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A few driver and documentation fixes, plus a fix for double error
handling which had crept in due to the confusing documentation - it
wasn't clear if the core or the driver was responsible for cleanup in
error cases so both tried to do it with unfortunate results"
* tag 'spi-v3.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: nuc900: Set SPI_LSB_FIRST for master->mode_bits if hw->pdata->lsb is true
spi: rspi: Document support for Renesas QSPI in Kconfig
spi: Fix crash with double message finalisation on error handling
spi: correct the transfer_one_message documentation wording
spi: document the transfer_one spi_master callback
spi: spi.h: clarify the documentation of transfer_one
Pull drm fixes from Dave Airlie:
"Nothing too crazy.
Radeon irq fixes, i915 regression fixes, exynos fixes, tda998x chip
fixes, and a bunch of msm fixes"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (31 commits)
drm/i915: Pair va_copy with va_end in i915_error_vprintf
drm/i915: Fix intel_pipe_to_cpu_transcoder for UMS
drm/i915: Disable dp aux irq on g4x
drm/msm: bigger synchronization hammer
drm/exynos: Convert to use the standard hdmi.h header
drm/exynos: Fix trivial typo
drm/exynos: Remove unnecessary semicolon
drm/exynos: Fix multiplatform breakage for ipp/gsc
drm/exynos: Fix freeing issues in exynos_drm_drv.c
drm/radeon: add missing include in btc_dpm.c
drm/radeon/dpm: fix uninitialized read from stack in kv_dpm_late_enable
drm/radeon: remove useless return
drm/radeon/dpm: use stored max_vddc rather than looking it up
drm/radeon/dpm: use the driver state for dpm debugfs
drm/radeon: fix UVD IRQ support on 7xx
drm/radeon: fix UVD IRQ support on SI
drm/msm: fix deadlock in bo create fail path
drm/msm/mdp4: cursor fixes
drm/msm/mdp4: pageflip fixes
drm/msm/mdp5: fix ref leaks in error paths
...
This reverts commit d3c56568f4.
The reverted commit breaks audio through headphone line out on
the Acer TravelMate B113 (Type1Sku0) Notebook, my main work
machine. I don't know much about it but this fixes my problem.
Bisected and tested.
Fixes: d3c56568f4 ('ALSA: hda/realtek - Avoid invalid COEFs for ALC271X')
Cc: <stable@vger.kernel.org>
Tested-by: Martin Kepplinger <martink@posteo.de>
Signed-off-by: Martin Kepplinger <martink@posteo.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When mkfs issues a full device discard and the device only
supports discards of a smallish size, we can loop in
blkdev_issue_discard() for a long time. If preempt isn't enabled,
this can turn into a softlock situation and the kernel will
start complaining.
Add an explicit cond_resched() at the end of the loop to avoid
that.
Cc: stable@kernel.org
Signed-off-by: Jens Axboe <axboe@fb.com>
* acpi-dock:
ACPI / dock: Use acpi_device_enumerated() to check if dock is present
* acpi-scan:
ACPI / container: Fix error code path in container_device_attach()
* acpi-pci-hotplug:
ACPI / hotplug / PCI: Relax the checking of _STA return values
To avoid leaking memory on errors from device_register(), do a
put_device() on the device object in question in the error code
path of container_device_attach().
Fixes: caa73ea158 (ACPI / hotplug / driver core: Handle containers in a special way)
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
The ACPI specification (ACPI 5.0A, Section 6.3.7) says:
_STA may return bit 0 clear (not present) with bit 3 set (device is
functional). This case is used to indicate a valid device for which
no device driver should be loaded (for example, a bridge device.)
Children of this device may be present and valid. OSPM should
continue enumeration below a device whose _STA returns this bit
combination.
Evidently, some BIOSes follow that and return 0x0A from _STA, which
causes problems to happen when they trigger bus check or device check
notifications for those devices too. Namely, ACPIPHP thinks that they
are gone and may drop them, for example, if such a notification is
triggered during a resume from system suspend.
To fix that, modify ACPICA to regard devies as present and
functioning if _STA returns both the ACPI_STA_DEVICE_ENABLED
and ACPI_STA_DEVICE_FUNCTIONING bits set for them.
Reported-and-tested-by: Peter Wu <lekensteyn@gmail.com>
Cc: 3.12+ <stable@vger.kernel.org> # 3.12+
[rjw: Subject and changelog, minor code modifications]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Pull powerpc updates from Ben Herrenschmidt:
"Here is some powerpc goodness for -rc2. Arguably -rc1 material more
than -rc2 but I was travelling (again !)
It's mostly bug fixes including regressions, but there are a couple of
new things that I decided to drop-in.
One is a straightforward patch from Michael to add a bunch of P8 cache
events to perf.
The other one is a patch by myself to add the direct DMA (iommu
bypass) for PCIe on Power8 for 64-bit capable devices. This has been
around for a while, I had lost track of it. However it's been in our
internal kernels we use for testing P8 already and it affects only P8
related code. Since P8 is still unreleased the risk is pretty much
nil at this point"
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc/powernv: Add iommu DMA bypass support for IODA2
powerpc: Fix endian issues in kexec and crash dump code
powerpc/ppc32: Fix the bug in the init of non-base exception stack for UP
powerpc/xmon: Don't signal we've entered until we're finished printing
powerpc/xmon: Fix timeout loop in get_output_lock()
powerpc/xmon: Don't loop forever in get_output_lock()
powerpc/perf: Configure BHRB filter before enabling PMU interrupts
crypto/nx/nx-842: Fix handling of vmalloc addresses
powerpc/pseries: Select ARCH_RANDOM on pseries
powerpc/perf: Add Power8 cache & TLB events
powerpc/relocate fix relocate processing in LE mode
powerpc: Fix kdump hang issue on p8 with relocation on exception enabled.
powerpc/pseries: Disable relocation on exception while going down during crash.
powerpc/eeh: Drop taken reference to driver on eeh_rmv_device
powerpc: Fix build failure in sysdev/mpic.c for MPIC_WEIRD=y
Initialize persistent_purge_work work_struct on xen_blkif_alloc (and
remove the previous initialization done in purge_persistent_gnt). This
prevents flush_work from complaining even if purge_persistent_gnt has
not been used.
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Tested-by: Sander Eikelenboom <linux@eikelenboom.it>
Signed-off-by: Jens Axboe <axboe@fb.com>
When the conversion was made to remove stop machine and use the breakpoint
logic instead, the modification of the function graph caller is still
done directly as though it was being done under stop machine.
As it is not converted via stop machine anymore, there is a possibility
that the code could be layed across cache lines and if another CPU is
accessing that function graph call when it is being updated, it could
cause a General Protection Fault.
Convert the update of the function graph caller to use the breakpoint
method as well.
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: stable@vger.kernel.org # 3.5+
Fixes: 08d636b6d4 "ftrace/x86: Have arch x86_64 use breakpoints instead of stop machine"
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
These are a number of fixes from the patch set which Jean-Francois has
been working on which I think are important to be merged during -rc, and
have been tested independently here. I've been in discussion with Rob,
who is happy that I send these directly to you.
* 'tda998x-fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-cubox:
drm/i2c: tda998x: fix the ENABLE_SPACE register
drm/i2c: tda998x: set the PLL division factor in range 0..3
drm/i2c: tda998x: force the page register at startup time
drm/i2c: tda998x: free the CEC device on encoder_destroy
drm/i2c: tda998x: check the CEC device creation
drm/i2c: tda998x: fix bad value in the AIF
3 regression fixes in i915
* tag 'drm-intel-fixes-2014-02-11' of ssh://git.freedesktop.org/git/drm-intel:
drm/i915: Pair va_copy with va_end in i915_error_vprintf
drm/i915: Fix intel_pipe_to_cpu_transcoder for UMS
drm/i915: Disable dp aux irq on g4x
Interface #5 of 19d2:1270 is a net interface which has been submitted to the
qmi_wwan driver so consequently remove it from the option driver.
Signed-off-by: Raymond Wanyoike <raymond.wanyoike@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Hi Greg,
Recently, we found that commit "35773dac5f86 "usb: xhci: Link TRB must not
occur within a USB payload burst" causes a userspace regression. It will
cause larger transfers submitted through usbfs that would have succeeded
on older kernels to be rejected.
Commit 35773dac5f was designed to address an issue where an ASIX USB
ethernet device would get wedged when it was connected to a 1.0 xHCI
host. Only this particular ethernet device was impacted, because only the
ax88179_178a driver implemented scatter-gather in 3.12. The xHCI driver
doesn't currently support TD fragment rules, and commit 35773dac5f was a
quick hack that partially implemented one of the rules.
This is the third regression this patch has caused. There's yet another
quick hack to work around the issue, but I really want to support TD
fragments properly, rather than hacking around it. It will take us a
kernel release or two to get it implemented, since it is a big
architectural change.
This patchset backs out commit 35773dac5f, and the two bug fix patches
for it. The first patch limits arbitrarily aligned scatter-gather under
xHCI 1.0 hosts.
As a result of this patchset:
1. usb-storage and uas will still be able to use scatter-gather, since
they submit max packet sized aligned transfers.
2. usbfs will behave exactly as before, no more userspace regressions.
3. The ax88179_178a driver works fine without scatter-gather (Mark Lord
confirms this).
Users of the ASIX chipset may still see occasional packet loss on 1.0 xHCI
hosts, if the xHCI driver needs to split a TRB across 64-KB boundaries,
and a link TRB happens to fall between those two TRBs. I expect this
corner case to be infrequent.
Sarah Sharp
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
iQIcBAABAgAGBQJS+lcgAAoJEBMGWMLi1Gc5dt4P/1M4HtDKavU4ReJROonILiM3
eYcSVJPkYm6KeZx3YtNhzuHE4CEbMwCSmu4qrvffM87Ya8hckrS5iafciCJlwQpB
AEZCEeuD/ACHF/F/BKnwMkZJCIIdjhdklqxUqUCR0tKC2BwUB6+JWrig6tHcGglV
y9C1FLI910hq1UGxvF0fzK6/DpEEAIs4UzysdZ4B0u++cOI0u4cQmFLMwrY/CoqY
gokzHQOALwcnbmbT8+LcjFwumGPAFsTKkbPyw+PWroiPoGlqcFQZErfSaSwojo4B
ZQj3zWvYeO6plHv8rdBk1Q5sr6F+h2Mf9j6YXMLOw/i1sHn+Zryonf6/350cKi2p
TjmJfOkmtQpZ+leAC2LUaTEVTNUE8FUc4tLY3KPWhR3nDLcx73UL3Lmh3monhiIz
nB52e4EjAS+XN5v/Ef1FbtEUBccHiaNWUK9v44oUAur/bRl5MkN7JkDc1eqih92d
7gHtM3K9IXIzbLCOndnu8hDj/vlgw9kf7wSMC0W4+1vdRqK8PoB9GaBf4VrgWGnm
toY26pG8DpRhZJdN0gVPA3YgoEcgucLB5XUHDxr3SRV3dM5zVHAz/1ZOC1phwO/Y
0CiS/5hpXd0hVp8d93RWKGtp5O1RvEKtUnFN6dW5XYJtXxgLTldxR7N340Z5DOWy
/c219n1V4XIIU2DsL1Qe
=0yTh
-----END PGP SIGNATURE-----
Merge tag 'for-usb-linus-2014-02-11' of git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-linus
Sarah writes:
xhci: Revert TD fragment hacks.
Hi Greg,
Recently, we found that commit "35773dac5f86 "usb: xhci: Link TRB must not
occur within a USB payload burst" causes a userspace regression. It will
cause larger transfers submitted through usbfs that would have succeeded
on older kernels to be rejected.
Commit 35773dac5f was designed to address an issue where an ASIX USB
ethernet device would get wedged when it was connected to a 1.0 xHCI
host. Only this particular ethernet device was impacted, because only the
ax88179_178a driver implemented scatter-gather in 3.12. The xHCI driver
doesn't currently support TD fragment rules, and commit 35773dac5f was a
quick hack that partially implemented one of the rules.
This is the third regression this patch has caused. There's yet another
quick hack to work around the issue, but I really want to support TD
fragments properly, rather than hacking around it. It will take us a
kernel release or two to get it implemented, since it is a big
architectural change.
This patchset backs out commit 35773dac5f, and the two bug fix patches
for it. The first patch limits arbitrarily aligned scatter-gather under
xHCI 1.0 hosts.
As a result of this patchset:
1. usb-storage and uas will still be able to use scatter-gather, since
they submit max packet sized aligned transfers.
2. usbfs will behave exactly as before, no more userspace regressions.
3. The ax88179_178a driver works fine without scatter-gather (Mark Lord
confirms this).
Users of the ASIX chipset may still see occasional packet loss on 1.0 xHCI
hosts, if the xHCI driver needs to split a TRB across 64-KB boundaries,
and a link TRB happens to fall between those two TRBs. I expect this
corner case to be infrequent.
Sarah Sharp
- Fix compile error drivers/spi/spi-rspi.c with !CONFIG_OF
- Fix warnings for unused/uninitialized variables with !CONFIG_OF
- Fix PCIe bus matching for powerpc
- Add documentation for various vendor strings
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
iQEcBAABAgAGBQJS+kY1AAoJEMhvYp4jgsXiEo8IAIHD4+QSyVpHEYnhlyDPPGxt
zQHj/jadofP7nsC0QgFhTnmG1qEUjl8BZ5UsA+swaixtqFkKdsGtCtQ+c/PCU8LK
OHTZ2XbT+TTkyKncx+Beghb/v2e8AVGutlSoFGpsGK/nuvda950VoKsH2eVE1X0c
9YBy209/g+nNcaC+qNwuBL4acy9bQmyj/Pm//5lMzv0VU7uGVE8hl6Eh6kpd847g
Ww26c/fK0JL3yQBYxbhAupuwXieY6wbZ1u1c/37EloMv6ahsT1v+iFaWJun35KeT
xyKYgw7tDDcrVEiNfg6jhEYyG2PmDVEvouEafy60ha+iHuQxHp1psrc4zVS9Xn8=
=bkhj
-----END PGP SIGNATURE-----
Merge tag 'dt-fixes-for-3.14' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
Pull DeviceTree fixes from Rob Herring:
- Fix compile error drivers/spi/spi-rspi.c with !CONFIG_OF
- Fix warnings for unused/uninitialized variables with !CONFIG_OF
- Fix PCIe bus matching for powerpc
- Add documentation for various vendor strings
* tag 'dt-fixes-for-3.14' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
DT: Add vendor prefix for Spansion Inc.
of/device: Nullify match table in of_match_device() for CONFIG_OF=n
dt-bindings: add vendor-prefix for neonode
of: fix PCI bus match for PCIe slots
of: restructure for_each macros to fix compile warnings
of: add vendor prefix for Honeywell
of: Update qcom vendor prefix description
of: add vendor prefix for Allwinner Technology
Pull s390 bugfixes from Martin Schwidefsky:
"A collection a bug fixes. Most of them are minor but two of them are
more severe. The linkage stack bug can be used by user space to force
an oops, with panic_on_oops this is a denial-of-service. And the dump
memory detection issue can cause incomplete memory dumps"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/cio: improve cio_commit_config
s390: fix kernel crash due to linkage stack instructions
s390/dump: Fix dump memory detection
s390/appldata: restore missing init_virt_timer()
s390/qdio: correct program-controlled interruption checking
s390/qdio: for_each macro correctness
Pull networking updates from David Miller:
1) Fix flexcan build on big endian, from Arnd Bergmann
2) Correctly attach cpsw to GPIO bitbang MDIO drive, from Stefan Roese
3) udp_add_offload has to use GFP_ATOMIC since it can be invoked from
non-sleepable contexts. From Or Gerlitz
4) vxlan_gro_receive() does not iterate over all possible flows
properly, fix also from Or Gerlitz
5) CAN core doesn't use a proper SKB destructor when it hooks up
sockets to SKBs. Fix from Oliver Hartkopp
6) ip_tunnel_xmit() can use an uninitialized route pointer, fix from
Eric Dumazet
7) Fix address family assignment in IPVS, from Michal Kubecek
8) Fix ath9k build on ARM, from Sujith Manoharan
9) Make sure fail_over_mac only applies for the correct bonding modes,
from Ding Tianhong
10) The udp offload code doesn't use RCU correctly, from Shlomo Pongratz
11) Handle gigabit features properly in generic PHY code, from Florian
Fainelli
12) Don't blindly invoke link operations in
rtnl_link_get_slave_info_data_size, they are optional. Fix from
Fernando Luis Vazquez Cao
13) Add USB IDs for Netgear Aircard 340U, from Bjørn Mork
14) Handle netlink packet padding properly in openvswitch, from Thomas
Graf
15) Fix oops when deleting chains in nf_tables, from Patrick McHardy
16) Fix RX stalls in xen-netback driver, from Zoltan Kiss
17) Fix deadlock in mac80211 stack, from Emmanuel Grumbach
18) inet_nlmsg_size() forgets to consider ifa_cacheinfo, fix from Geert
Uytterhoeven
19) tg3_change_mtu() can deadlock, fix from Nithin Sujir
20) Fix regression in setting SCTP local source addresses on accepted
sockets, caused by some generic ipv6 socket changes. Fix from
Matija Glavinic Pecotic
21) IPPROTO_* must be pure defines, otherwise module aliases don't get
constructed properly. Fix from Jan Moskyto
22) IPV6 netconsole setup doesn't work properly unless an explicit
source address is specified, fix from Sabrina Dubroca
23) Use __GFP_NORETRY for high order skb page allocations in
sock_alloc_send_pskb and skb_page_frag_refill. From Eric Dumazet
24) Fix a regression added in netconsole over bridging, from Cong Wang
25) TCP uses an artificial offset of 1ms for SRTT, but this doesn't jive
well with TCP pacing which needs the SRTT to be accurate. Fix from
Eric Dumazet
26) Several cases of missing header file includes from Rashika Kheria
27) Add ZTE MF667 device ID to qmi_wwan driver, from Raymond Wanyoike
28) TCP Small Queues doesn't handle nonagle properly in some corner
cases, fix from Eric Dumazet
29) Remove extraneous read_unlock in bond_enslave, whoops. From Ding
Tianhong
30) Fix 9p trans_virtio handling of vmalloc buffers, from Richard Yao
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (136 commits)
6lowpan: fix lockdep splats
alx: add missing stats_lock spinlock init
9p/trans_virtio.c: Fix broken zero-copy on vmalloc() buffers
bonding: remove unwanted bond lock for enslave processing
USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support
tcp: tsq: fix nonagle handling
bridge: Prevent possible race condition in br_fdb_change_mac_address
bridge: Properly check if local fdb entry can be deleted when deleting vlan
bridge: Properly check if local fdb entry can be deleted in br_fdb_delete_by_port
bridge: Properly check if local fdb entry can be deleted in br_fdb_change_mac_address
bridge: Fix the way to check if a local fdb entry can be deleted
bridge: Change local fdb entries whenever mac address of bridge device changes
bridge: Fix the way to find old local fdb entries in br_fdb_change_mac_address
bridge: Fix the way to insert new local fdb entries in br_fdb_changeaddr
bridge: Fix the way to find old local fdb entries in br_fdb_changeaddr
tcp: correct code comment stating 3 min timeout for FIN_WAIT2, we only do 1 min
net: vxge: Remove unused device pointer
net: qmi_wwan: add ZTE MF667
3c59x: Remove unused pointer in vortex_eisa_cleanup()
net: fix 'ip rule' iif/oif device rename
...
4ac7249ea5 "nfsd: use get_acl and
->set_acl" forgets to set the size in the case get_acl() succeeds, so
_posix_to_nfsv4_one() can then write past the end of its allocation.
Symptoms were slab corruption warnings.
Also, some minor cleanup while we're here. (Among other things, note
that the first few lines guarantee that pacl is non-NULL.)
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Each sub-buffer (buffer page) has a full 64 bit timestamp. The events on
that page use a 27 bit delta against that timestamp in order to save on
bits written to the ring buffer. If the time between events is larger than
what the 27 bits can hold, a "time extend" event is added to hold the
entire 64 bit timestamp again and the events after that hold a delta from
that timestamp.
As a "time extend" is always paired with an event, it is logical to just
allocate the event with the time extend, to make things a bit more efficient.
Unfortunately, when the pairing code was written, it removed the "delta = 0"
from the first commit on a page, causing the events on the page to be
slightly skewed.
Fixes: 69d1b839f7 "ring-buffer: Bind time extend and data events together"
Cc: stable@vger.kernel.org # 2.6.37+
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Commit 70b41abc15
"ARM: ux500: move MSP pin control to the device tree"
accidentally activated MSP2, giving rise to a boot scroll
scream as the kernel attempts to probe a driver for it and
fails to obtain DMA channel 14.
Fix this up by marking the node disabled again.
Acked-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kevin Hilman <khilman@linaro.org>
Make sure we have a proper pairing between starting and requeueing
requests. Move the dma drain and REQ_END setup into blk_mq_start_request,
and make sure blk_mq_requeue_request properly undoes them, giving us
a pair of function to prepare and unprepare a request without leaving
side effects.
Together this ensures we always clean up properly after
BLK_MQ_RQ_QUEUE_BUSY returns from ->queue_rq.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
rq->errors never has been part of the communication protocol between drivers
and the block stack and most drivers will not have initialized it.
Return -EIO to upper layers when the driver returns BLK_MQ_RQ_QUEUE_ERROR
unconditionally. If a driver want to return a different error it can easily
do so by returning success after calling blk_mq_end_io itself.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
Immutable biovecs changed the way bio segments are treated in such a way that
bio_for_each_segment() cannot now do what we want for discard/write same bios,
since bi_size means something completely different for them.
Fortunately discard and write same bios never have more than a single biovec, so
bio_for_each_segment() is unnecessary and not terribly meaningful for them, but
we still have to special case them in a few places.
Signed-off-by: Kent Overstreet <kmo@daterainc.com>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Commit d52eefb47d ("ia64/xen: Remove Xen support for ia64") removed
the Kconfig symbol XEN_XENCOMM. But it didn't remove the code depending
on that symbol. Remove that code now.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Acked-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
xen/gntdev.h and xen/gntalloc.h both provide userspace ABIs so they
should be installed.
CC: stable@vger.kernel.org
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Commit fc087e1073 (xen/events: remove
unnecessary init_evtchn_cpu_bindings()) causes a regression.
The kernel-side VCPU binding was not being correctly set for newly
allocated or bound interdomain events. In ARM guests where 2-level
events were used, this would result in no interdomain events being
handled because the kernel-side VCPU masks would all be clear.
x86 guests would work because the irq affinity was set during irq
setup and this would set the correct kernel-side VCPU binding.
Fix this by properly initializing the kernel-side VCPU binding in
bind_evtchn_to_irq().
Reported-and-tested-by: Julien Grall <julien.grall@linaro.org>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
'fck' field in dpi and sdi clock calculation struct is 'unsigned long
long', even though it should be 'unsigned long'. This hasn't caused any
issues so far.
Fix the field's type.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
The driver uses DIV_ROUND_UP when calculating decimated width & height.
For example, when decimating with 3, the width is calculated as:
width = DIV_ROUND_UP(width, decim_x);
This yields bad results for some values. For example, 800/3=266.666...,
which is rounded to 267. When the input width is set to 267, and pixel
increment is set to 3, this causes the dispc to read a line of 801
pixels, i.e. it reads a wrong pixel at the end of the line.
Even more pressing, the above rounding causes a BUG() in pixinc(), as
the value of 801 is used to calculate row increment, leading to a bad
value being passed to pixinc().
This patch fixes the decimation by removing the DIV_ROUND_UP()s when
calculating width and height for decimation.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Each invocation of va_copy() must be matched by a corresponding
invocation of va_end() in the same function.
This regression has been introduced in
commit e29bb4ebbf
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date: Fri Sep 20 10:20:59 2013 +0100
drm/i915: Use a temporary va_list for two-pass string handling
Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
We don't have all the drm_crtc&co hanging around in that case.
This regression has been introduced in
commit 391f75e2bf
Author: Ville Syrjälä <ville.syrjala@linux.intel.com>
Date: Wed Sep 25 19:55:26 2013 +0300
drm/i915: Fix pre-CTG vblank counter
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=69521
Cc: stable@vger.kernel.org (for 3.13 only)
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
In allmodconfig builds for sparc and any other arch which does
not set CONFIG_SPARSE_IRQ, the following will be seen at modpost:
CC [M] lib/cpu-notifier-error-inject.o
CC [M] lib/pm-notifier-error-inject.o
ERROR: "irq_to_desc" [drivers/gpio/gpio-mcp23s08.ko] undefined!
make[2]: *** [__modpost] Error 1
This happens because commit 3911ff30f5 ("genirq: export
handle_edge_irq() and irq_to_desc()") added one export for it, but
there were actually two instances of it, in an if/else clause for
CONFIG_SPARSE_IRQ. Add the second one.
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: stable@vger.kernel.org # 3.4+
Link: http://lkml.kernel.org/r/1392057610-11514-1-git-send-email-paul.gortmaker@windriver.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
This patch adds the support for to create a direct iommu "bypass"
window on IODA2 bridges (such as Power8) allowing to bypass iommu
page translation completely for 64-bit DMA capable devices, thus
significantly improving DMA performances.
Additionally, this adds a hook to the struct iommu_table so that
the IOMMU API / VFIO can disable the bypass when external ownership
is requested, since in that case, the device will be used by an
environment such as userspace or a KVM guest which must not be
allowed to bypass translations.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Just minor stuff really, on vlv dp fix and two patches to tune down some
opregion sanity check. Plus MAINTAINERS update for the new git repo, which
is the only reason I've really bothered with this pull request.
* tag 'drm-intel-fixes-2014-02-06' of ssh://git.freedesktop.org/git/drm-intel:
drm/i915: demote opregion excessive timeout WARN_ONCE to DRM_INFO_ONCE
drm: add DRM_INFO_ONCE() to print a one-time DRM_INFO() message
MAINTAINERS: Update drm/i915 git repo
drm/i915: vlv: fix DP PHY lockup due to invalid PP sequencer setup
This pull request fixes memory leak issue in exynos_drm_open() and
multiplatform breakage for ipp/gsc. And also including some cleanups.
* 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
drm/exynos: Convert to use the standard hdmi.h header
drm/exynos: Fix trivial typo
drm/exynos: Remove unnecessary semicolon
drm/exynos: Fix multiplatform breakage for ipp/gsc
drm/exynos: Fix freeing issues in exynos_drm_drv.c
Compared to original fixes pull req that I sent yesterday, this adds
one more fix that I found for a synchronization issue which starts to
crop up when we use XA in DDX for 2d accel on 3d core. In particular,
accelerating presentation blit triggers this problem.
* 'msm-next' of git://people.freedesktop.org/~robclark/linux:
drm/msm: bigger synchronization hammer
drm/msm: fix deadlock in bo create fail path
drm/msm/mdp4: cursor fixes
drm/msm/mdp4: pageflip fixes
drm/msm/mdp5: fix ref leaks in error paths
drm/msm: fix inconsequential typo
When a device ndo_start_xmit() calls again dev_queue_xmit(),
lockdep can complain because dev_queue_xmit() is re-entered and the
spinlocks protecting tx queues share a common lockdep class.
Same issue was fixed for bonding/l2tp/ppp in commits
0daa230302 ("[PATCH] bonding: lockdep annotation")
49ee49202b ("bonding: set qdisc_tx_busylock to avoid LOCKDEP splat")
23d3b8bfb8 ("net: qdisc busylock needs lockdep annotations ")
303c07db48 ("ppp: set qdisc_tx_busylock to avoid LOCKDEP splat ")
Reported-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Trivial fix for init time stack trace occuring in
alx_get_stats64 upon start up. Should have been part of
commit adding the spinlock:
f1b6b106 alx: add alx_get_stats64 operation
Signed-off-by: John Greene <jogreene@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
The 9p-virtio transport does zero copy on things larger than 1024 bytes
in size. It accomplishes this by returning the physical addresses of
pages to the virtio-pci device. At present, the translation is usually a
bit shift.
That approach produces an invalid page address when we read/write to
vmalloc buffers, such as those used for Linux kernel modules. Any
attempt to load a Linux kernel module from 9p-virtio produces the
following stack.
[<ffffffff814878ce>] p9_virtio_zc_request+0x45e/0x510
[<ffffffff814814ed>] p9_client_zc_rpc.constprop.16+0xfd/0x4f0
[<ffffffff814839dd>] p9_client_read+0x15d/0x240
[<ffffffff811c8440>] v9fs_fid_readn+0x50/0xa0
[<ffffffff811c84a0>] v9fs_file_readn+0x10/0x20
[<ffffffff811c84e7>] v9fs_file_read+0x37/0x70
[<ffffffff8114e3fb>] vfs_read+0x9b/0x160
[<ffffffff81153571>] kernel_read+0x41/0x60
[<ffffffff810c83ab>] copy_module_from_fd.isra.34+0xfb/0x180
Subsequently, QEMU will die printing:
qemu-system-x86_64: virtio: trying to map MMIO memory
This patch enables 9p-virtio to correctly handle this case. This not
only enables us to load Linux kernel modules off virtfs, but also
enables ZFS file-based vdevs on virtfs to be used without killing QEMU.
Special thanks to both Avi Kivity and Alexander Graf for their
interpretation of QEMU backtraces. Without their guidence, tracking down
this bug would have taken much longer. Also, special thanks to Linus
Torvalds for his insightful explanation of why this should use
is_vmalloc_addr() instead of is_vmalloc_or_module_addr():
https://lkml.org/lkml/2014/2/8/272
Signed-off-by: Richard Yao <ryao@gentoo.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
The bond enslave processing don't hold bond->lock anymore,
so release an unlocked rw lock will cause warning message,
remove the unwanted read_unlock(&bond->lock).
Cc: Jay Vosburgh <fubar@us.ibm.com>
Cc: Veaceslav Falico <vfalico@redhat.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Ding Tianhong <dingtianhong@huawei.com>
Acked-by: Veaceslav Falico <vfalico@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
