aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-09-08Merge branch 'v3.18/topic/thermal' into linux-linaro-lsk-v3.18lsk-v3.18-15.09Kevin Hilman
* v3.18/topic/thermal: thermal: power_allocator: allocate with kcalloc what you free with kfree thermal: power_allocator: do not use devm* interfaces thermal: cpu_cooling: Check memory allocation of power_table
2015-09-08thermal: power_allocator: allocate with kcalloc what you free with kfreev3.18/topic/thermalJavi Merino
Commit cf736ea6f902 ("thermal: power_allocator: do not use devm* interfaces") forgot to change a devm_kcalloc() to just kcalloc(), but it's corresponding devm_kfree() was changed to kfree(). Allocate with kcalloc() to match the kfree(). Fixes: cf736ea6f902 ("thermal: power_allocator: do not use devm* interfaces") Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com> Cc: Eduardo Valentin <edubezval@gmail.com> Cc: Zhang Rui <rui.zhang@intel.com> Signed-off-by: Javi Merino <javi.merino@arm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 9751a9e449da2a7749d89968039d532c615beeaa) Signed-off-by: Kevin Hilman <khilman@linaro.org>
2015-09-08thermal: power_allocator: do not use devm* interfacesDmitry Torokhov
The code in question is called outside of standard driver probe()/remove() callbacks and thus will not benefit from use of devm* infrastructure. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Eduardo Valentin <edubezval@gmail.com> (cherry picked from commit cf736ea6f902c26e03895dc7f5ccbc55cdc68e6e) Signed-off-by: Kevin Hilman <khilman@linaro.org>
2015-09-08thermal: cpu_cooling: Check memory allocation of power_tableJavi Merino
We allocate the power_table in memory but we don't test whether the allocation succeeded. Return -ENOMEM if kcalloc() fails. Fixes: e0128d8ab423 ("thermal: cpu_cooling: implement the power cooling device API") Cc: Eduardo Valentin <edubezval@gmail.com> Cc: Zhang Rui <rui.zhang@intel.com> Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Javi Merino <javi.merino@arm.com> Signed-off-by: Eduardo Valentin <edubezval@gmail.com> (cherry picked from commit 0cdf97e1ad8d796313de051528f06c1b16f3a679) Signed-off-by: Kevin Hilman <khilman@linaro.org>
2015-08-25Merge branch 'v3.18/topic/fixes' into linux-linaro-lsk-v3.18lsk-v3.18-15.08Kevin Hilman
2015-08-25Merge branch 'v3.18/topic/for-stable' into linux-linaro-lsk-v3.18Kevin Hilman
2015-08-25Revert "media: remove unused variable that causes a warning"v3.18/topic/for-stableKevin Hilman
This reverts commit 12b27ff59a1ecad4b4441bb1a56c0c7a62f71c73. This fix was rejected by LTS
2015-08-25media: remove unused variable that causes a warningLinus Torvalds
My 'allmodconfig' build is _almost_ free of warnings, and most of the remaining ones are for legacy drivers that just do bad things that I can't find it in my black heart to care too much about. But this one was just annoying me: drivers/media/v4l2-core/videobuf2-core.c:3256:26: warning: unused variable ‘fileio’ [-Wunused-variable] because commit 0e661006370b ("[media] vb2: fix 'UNBALANCED' warnings when calling vb2_thread_stop()") removed all users of 'fileio' and instead calls "__vb2_cleanup_fileio(q)" to clean up q->fileio. But the now unused 'fileio' variable was left around. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 1d11437f4fd02f9b5d3749675a1232216787dcc6) Signed-off-by: Kevin Hilman <khilman@linaro.org>
2015-08-24Merge branch 'v3.18/topic/for-stable' into linux-linaro-lsk-v3.18Kevin Hilman
2015-08-24media: remove unused variable that causes a warningLinus Torvalds
My 'allmodconfig' build is _almost_ free of warnings, and most of the remaining ones are for legacy drivers that just do bad things that I can't find it in my black heart to care too much about. But this one was just annoying me: drivers/media/v4l2-core/videobuf2-core.c:3256:26: warning: unused variable ‘fileio’ [-Wunused-variable] because commit 0e661006370b ("[media] vb2: fix 'UNBALANCED' warnings when calling vb2_thread_stop()") removed all users of 'fileio' and instead calls "__vb2_cleanup_fileio(q)" to clean up q->fileio. But the now unused 'fileio' variable was left around. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 1d11437f4fd02f9b5d3749675a1232216787dcc6) Signed-off-by: Kevin Hilman <khilman@linaro.org>
2015-08-24Merge branch 'v3.18/topic/fixes' into linux-linaro-lsk-v3.18Kevin Hilman
* v3.18/topic/fixes: net: sysctl_net_core: Fix warning: 'one' defined but not used
2015-08-24net: sysctl_net_core: Fix warning: 'one' defined but not usedJon Medhurst
Commit c48cf4f27d45 ("net: sysctl_net_core: check SNDBUF and RCVBUF for min length") removed the last user of the variable 'one' leading to: net/core/sysctl_net_core.c:26:12: warning: 'one' defined but not used [-Wunused-variable] Fix this by deleting the variable. Signed-off-by: Jon Medhurst <tixy@linaro.org> Signed-off-by: Kevin Hilman <khilman@linaro.org>
2015-08-10Merge tag 'v3.18.20' into linux-linaro-lsk-v3.18Kevin Hilman
Linux 3.18.20 * tag 'v3.18.20': (52 commits) Linux 3.18.20 blk-mq: fix CPU hotplug handling SCSI: add 1024 max sectors black list flag Fix firmware loader uevent buffer NULL pointer dereference arm64: Don't report clear pmds and puds as huge 9p: don't leave a half-initialized inode sitting around 9p: forgetting to cancel request on interrupted zero-copy RPC NFS: Fix size of NFSACL SETACL operations watchdog: omap: assert the counter being stopped before reprogramming of: return NUMA_NO_NODE from fallback of_node_to_nid() USB: usbfs: allow URBs to be reaped after disconnection dell-laptop: Fix allocating & freeing SMI buffer page mac80211: prevent possible crypto tx tailroom corruption security_syslog() should be called once only __bitmap_parselist: fix bug in empty string handling mmc: card: Fixup request missing in mmc_blk_issue_rw_rq iser-target: Fix possible deadlock in RDMA_CM connection error iscsi-target: Convert iscsi_thread_set usage to kthread.h ACPICA: Tables: Fix an issue that FACS initialization is performed twice Btrfs: fix memory leak in the extent_same ioctl ...
2015-08-10Merge branch 'v3.18/topic/thermal' into linux-linaro-lsk-v3.18Kevin Hilman
* v3.18/topic/thermal: thermal: power_allocator: trace the real requested power
2015-08-10thermal: power_allocator: trace the real requested powerJavi Merino
The power allocator governor uses ftrace to output a bunch of internal data for debugging and tuning. Currently, the requested power it outputs is the "weighted" requested power, that is, what each cooling device has requested multiplied by the cooling device weight. It is more useful to trace the real request, without any weight being applied. This commit only affects the data traced, there is no functional change. Cc: Zhang Rui <rui.zhang@intel.com> Cc: Eduardo Valentin <edubezval@gmail.com> Signed-off-by: Javi Merino <javi.merino@arm.com> Signed-off-by: Eduardo Valentin <edubezval@gmail.com> (cherry picked from commit d5f831090191fa26a539e12456af64547ab11dde) Signed-off-by: Kevin Hilman <khilman@linaro.org>
2015-08-07Linux 3.18.20v3.18.20Sasha Levin
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-06blk-mq: fix CPU hotplug handlingMing Lei
[ Upstream commit 2a34c0872adf252f23a6fef2d051a169ac796cef ] hctx->tags has to be set as NULL in case that it is to be unmapped no matter if set->tags[hctx->queue_num] is NULL or not in blk_mq_map_swqueue() because shared tags can be freed already from another request queue. The same situation has to be considered during handling CPU online too. Unmapped hw queue can be remapped after CPU topo is changed, so we need to allocate tags for the hw queue in blk_mq_map_swqueue(). Then tags allocation for hw queue can be removed in hctx cpu online notifier, and it is reasonable to do that after mapping is updated. Cc: <stable@vger.kernel.org> Reported-by: Dongsu Park <dongsu.park@profitbricks.com> Tested-by: Dongsu Park <dongsu.park@profitbricks.com> Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Jens Axboe <axboe@fb.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-06SCSI: add 1024 max sectors black list flagMike Christie
[ Upstream commit 35e9a9f93994d7f7d12afa41169c7ba05513721b ] This works around a issue with qnap iscsi targets not handling large IOs very well. The target returns: VPD INQUIRY: Block limits page (SBC) Maximum compare and write length: 1 blocks Optimal transfer length granularity: 1 blocks Maximum transfer length: 4294967295 blocks Optimal transfer length: 4294967295 blocks Maximum prefetch, xdread, xdwrite transfer length: 0 blocks Maximum unmap LBA count: 8388607 Maximum unmap block descriptor count: 1 Optimal unmap granularity: 16383 Unmap granularity alignment valid: 0 Unmap granularity alignment: 0 Maximum write same length: 0xffffffff blocks Maximum atomic transfer length: 0 Atomic alignment: 0 Atomic transfer length granularity: 0 and it is *sometimes* able to handle at least one IO of size up to 8 MB. We have seen in traces where it will sometimes work, but other times it looks like it fails and it looks like it returns failures if we send multiple large IOs sometimes. Also it looks like it can return 2 different errors. It will sometimes send iscsi reject errors indicating out of resources or it will send invalid cdb illegal requests check conditions. And then when it sends iscsi rejects it does not seem to handle retries when there are command sequence holes, so I could not just add code to try and gracefully handle that error code. The problem is that we do not have a good contact for the company, so we are not able to determine under what conditions it returns which error and why it sometimes works. So, this patch just adds a new black list flag to set targets like this to the old max safe sectors of 1024. The max_hw_sectors changes added in 3.19 caused this regression, so I also ccing stable. Reported-by: Christian Hesse <list@eworm.de> Signed-off-by: Mike Christie <michaelc@cs.wisc.edu> Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: James Bottomley <JBottomley@Odin.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04Merge tag 'v3.18.19' of ↵Kevin Hilman
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into linux-linaro-lsk-v3.18 Linux 3.18.19 * tag 'v3.18.19' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (237 commits) Linux 3.18.19 x86/xen: allow privcmd hypercalls to be preempted rtnl: restore notifications for deleted interfaces Input: synaptics - add min/max quirk for Lenovo S540 Revert "Input: synaptics - add min/max quirk for Lenovo S540" Revert "nfs: take extra reference to fl->fl_file when running a LOCKU operation" fs/ufs: restore s_lock mutex_init() ufs: Fix possible deadlock when looking up directories ufs: Fix warning from unlock_new_inode() vfs: Ignore unlocked mounts in fs_fully_visible KVM: x86: properly restore LVT0 KVM: s390: virtio-ccw: don't overwrite config space values selinux: fix setting of security labels on NFS usb: gadget: f_fs: add extra check before unregister_gadget_item perf/x86: Honor the architectural performance monitoring version perf: Fix ring_buffer_attach() RCU sync, again x86/boot: Fix overflow warning with 32-bit binutils vfs: Remove incorrect debugging WARN in prepend_path KVM: x86: make vapics_in_nmi_mode atomic arm: KVM: force execution of HCPTR access on VM exit ...
2015-08-04Fix firmware loader uevent buffer NULL pointer dereferenceLinus Torvalds
[ Upstream commit 6f957724b94cb19f5c1c97efd01dd4df8ced323c ] The firmware class uevent function accessed the "fw_priv->buf" buffer without the proper locking and testing for NULL. This is an old bug (looks like it goes back to 2012 and commit 1244691c73b2: "firmware loader: introduce firmware_buf"), but for some reason it's triggering only now in 4.2-rc1. Shuah Khan is trying to bisect what it is that causes this to trigger more easily, but in the meantime let's just fix the bug since others are hitting it too (at least Ingo reports having seen it as well). Reported-and-tested-by: Shuah Khan <shuahkh@osg.samsung.com> Acked-by: Ming Lei <ming.lei@canonical.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04arm64: Don't report clear pmds and puds as hugeChristoffer Dall
[ Upstream commit fd28f5d439fca77348c129d5b73043a56f8a0296 ] The current pmd_huge() and pud_huge() functions simply check if the table bit is not set and reports the entries as huge in that case. This is counter-intuitive as a clear pmd/pud cannot also be a huge pmd/pud, and it is inconsistent with at least arm and x86. To prevent others from making the same mistake as me in looking at code that calls these functions and to fix an issue with KVM on arm64 that causes memory corruption due to incorrect page reference counting resulting from this mistake, let's change the behavior. Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org> Reviewed-by: Steve Capper <steve.capper@linaro.org> Acked-by: Marc Zyngier <marc.zyngier@arm.com> Fixes: 084bd29810a5 ("ARM64: mm: HugeTLB support.") Cc: <stable@vger.kernel.org> # 3.11+ Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-049p: don't leave a half-initialized inode sitting aroundAl Viro
[ Upstream commit 0a73d0a204a4a04a1e110539c5a524ae51f91d6d ] Cc: stable@vger.kernel.org # all branches Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-049p: forgetting to cancel request on interrupted zero-copy RPCAl Viro
[ Upstream commit a84b69cb6e0a41e86bc593904faa6def3b957343 ] If we'd already sent a request and decide to abort it, we *must* issue TFLUSH properly and not just blindly reuse the tag, or we'll get seriously screwed when response eventually arrives and we confuse it for response to later request that had reused the same tag. Cc: stable@vger.kernel.org # v3.2 and later Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04NFS: Fix size of NFSACL SETACL operationsChuck Lever
[ Upstream commit d683cc49daf7c5afca8cd9654aaa1bf63cdf2ad9 ] When encoding the NFSACL SETACL operation, reserve just the estimated size of the ACL rather than a fixed maximum. This eliminates needless zero padding on the wire that the server ignores. Fixes: ee5dc7732bd5 ('NFS: Fix "kernel BUG at fs/nfs/nfs3xdr.c:1338!"') Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04watchdog: omap: assert the counter being stopped before reprogrammingUwe Kleine-König
[ Upstream commit 530c11d432727c697629ad5f9d00ee8e2864d453 ] The omap watchdog has the annoying behaviour that writes to most registers don't have any effect when the watchdog is already running. Quoting the AM335x reference manual: To modify the timer counter value (the WDT_WCRR register), prescaler ratio (the WDT_WCLR[4:2] PTV bit field), delay configuration value (the WDT_WDLY[31:0] DLY_VALUE bit field), or the load value (the WDT_WLDR[31:0] TIMER_LOAD bit field), the watchdog timer must be disabled by using the start/stop sequence (the WDT_WSPR register). Currently the timer is stopped in the .probe callback but still there are possibilities that yield to a situation where omap_wdt_start is entered with the timer running (e.g. when /dev/watchdog is closed without stopping and then reopened). In such a case programming the timeout silently fails! To circumvent this stop the timer before reprogramming. Assuming one of the first things the watchdog user does is setting the timeout explicitly nothing too bad should happen because this explicit setting works fine. Fixes: 7768a13c252a ("[PATCH] OMAP: Add Watchdog driver support") Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@iguana.be> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04of: return NUMA_NO_NODE from fallback of_node_to_nid()Konstantin Khlebnikov
[ Upstream commit c8fff7bc5bba6bd59cad40441c189c4efe7190f6 ] Node 0 might be offline as well as any other numa node, in this case kernel cannot handle memory allocation and crashes. Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Fixes: 0c3f061c195c ("of: implement of_node_to_nid as a weak function") Signed-off-by: Grant Likely <grant.likely@linaro.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04USB: usbfs: allow URBs to be reaped after disconnectionAlan Stern
[ Upstream commit 3f2cee73b650921b2e214bf487b2061a1c266504 ] The usbfs API has a peculiar hole: Users are not allowed to reap their URBs after the device has been disconnected. There doesn't seem to be any good reason for this; it is an ad-hoc inconsistency. The patch allows users to issue the USBDEVFS_REAPURB and USBDEVFS_REAPURBNDELAY ioctls (together with their 32-bit counterparts on 64-bit systems) even after the device is gone. If no URBs are pending for a disconnected device then the ioctls will return -ENODEV rather than -EAGAIN, because obviously no new URBs will ever be able to complete. The patch also adds a new capability flag for USBDEVFS_GET_CAPABILITIES to indicate that the reap-after-disconnect feature is supported. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Tested-by: Chris Dickens <christopher.a.dickens@gmail.com> Acked-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Greg Kroah-Hartman <greg@kroah.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04dell-laptop: Fix allocating & freeing SMI buffer pagePali Rohár
[ Upstream commit b8830a4e71b15d0364ac8e6c55301eea73f211da ] This commit fix kernel crash when probing for rfkill devices in dell-laptop driver failed. Function free_page() was incorrectly used on struct page * instead of virtual address of SMI buffer. This commit also simplify allocating page for SMI buffer by using __get_free_page() function instead of sequential call of functions alloc_page() and page_address(). Signed-off-by: Pali Rohár <pali.rohar@gmail.com> Acked-by: Michal Hocko <mhocko@suse.cz> Cc: stable@vger.kernel.org Signed-off-by: Darren Hart <dvhart@linux.intel.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04mac80211: prevent possible crypto tx tailroom corruptionMichal Kazior
[ Upstream commit ab499db80fcf07c18e4053f91a619500f663e90e ] There was a possible race between ieee80211_reconfig() and ieee80211_delayed_tailroom_dec(). This could result in inability to transmit data if driver crashed during roaming or rekeying and subsequent skbs with insufficient tailroom appeared. This race was probably never seen in the wild because a device driver would have to crash AND recover within 0.5s which is very unlikely. I was able to prove this race exists after changing the delay to 10s locally and crashing ath10k via debugfs immediately after GTK rekeying. In case of ath10k the counter went below 0. This was harmless but other drivers which actually require tailroom (e.g. for WEP ICV or MMIC) could end up with the counter at 0 instead of >0 and introduce insufficient skb tailroom failures because mac80211 would not resize skbs appropriately anymore. Fixes: 8d1f7ecd2af5 ("mac80211: defer tailroom counter manipulation when roaming") Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04security_syslog() should be called once onlyVasily Averin
[ Upstream commit d194e5d666225b04c7754471df0948f645b6ab3a ] The final version of commit 637241a900cb ("kmsg: honor dmesg_restrict sysctl on /dev/kmsg") lost few hooks, as result security_syslog() are processed incorrectly: - open of /dev/kmsg checks syslog access permissions by using check_syslog_permissions() where security_syslog() is not called if dmesg_restrict is set. - syslog syscall and /proc/kmsg calls do_syslog() where security_syslog can be executed twice (inside check_syslog_permissions() and then directly in do_syslog()) With this patch security_syslog() is called once only in all syslog-related operations regardless of dmesg_restrict value. Fixes: 637241a900cb ("kmsg: honor dmesg_restrict sysctl on /dev/kmsg") Signed-off-by: Vasily Averin <vvs@virtuozzo.com> Cc: Kees Cook <keescook@chromium.org> Cc: Josh Boyer <jwboyer@redhat.com> Cc: Eric Paris <eparis@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04__bitmap_parselist: fix bug in empty string handlingChris Metcalf
[ Upstream commit 2528a8b8f457d7432552d0e2b6f0f4046bb702f4 ] bitmap_parselist("", &mask, nmaskbits) will erroneously set bit zero in the mask. The same bug is visible in cpumask_parselist() since it is layered on top of the bitmask code, e.g. if you boot with "isolcpus=", you will actually end up with cpu zero isolated. The bug was introduced in commit 4b060420a596 ("bitmap, irq: add smp_affinity_list interface to /proc/irq") when bitmap_parselist() was generalized to support userspace as well as kernelspace. Fixes: 4b060420a596 ("bitmap, irq: add smp_affinity_list interface to /proc/irq") Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com> Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04mmc: card: Fixup request missing in mmc_blk_issue_rw_rqDing Wang
[ Upstream commit 29535f7b797df35cc9b6b3bca635591cdd3dd2a8 ] The current handler of MMC_BLK_CMD_ERR in mmc_blk_issue_rw_rq function may cause new coming request permanent missing when the ongoing request (previoulsy started) complete end. The problem scenario is as follows: (1) Request A is ongoing; (2) Request B arrived, and finally mmc_blk_issue_rw_rq() is called; (3) Request A encounters the MMC_BLK_CMD_ERR error; (4) In the error handling of MMC_BLK_CMD_ERR, suppose mmc_blk_cmd_err() end request A completed and return zero. Continue the error handling, suppose mmc_blk_reset() reset device success; (5) Continue the execution, while loop completed because variable ret is zero now; (6) Finally, mmc_blk_issue_rw_rq() return without processing request B. The process related to the missing request may wait that IO request complete forever, possibly crashing the application or hanging the system. Fix this issue by starting new request when reset success. Signed-off-by: Ding Wang <justin.wang@spreadtrum.com> Fixes: 67716327eec7 ("mmc: block: add eMMC hardware reset support") Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04iser-target: Fix possible deadlock in RDMA_CM connection errorSagi Grimberg
[ Upstream commit 4a579da2586bd3b79b025947ea24ede2bbfede62 ] Before we reach to connection established we may get an error event. In this case the core won't teardown this connection (never established it), so we take care of freeing it ourselves. Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Cc: <stable@vger.kernel.org> # v3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04iscsi-target: Convert iscsi_thread_set usage to kthread.hNicholas Bellinger
[ Upstream commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca ] This patch converts iscsi-target code to use modern kthread.h API callers for creating RX/TX threads for each new iscsi_conn descriptor, and releasing associated RX/TX threads during connection shutdown. This is done using iscsit_start_kthreads() -> kthread_run() to start new kthreads from within iscsi_post_login_handler(), and invoking kthread_stop() from existing iscsit_close_connection() code. Also, convert iscsit_logout_post_handler_closesession() code to use cmpxchg when determing when iscsit_cause_connection_reinstatement() needs to sleep waiting for completion. Reported-by: Sagi Grimberg <sagig@mellanox.com> Tested-by: Sagi Grimberg <sagig@mellanox.com> Cc: Slava Shwartsman <valyushash@gmail.com> Cc: <stable@vger.kernel.org> # v3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04ACPICA: Tables: Fix an issue that FACS initialization is performed twiceLv Zheng
[ Upstream commit c04be18448355441a0c424362df65b6422e27bda ] ACPICA commit 90f5332a15e9d9ba83831ca700b2b9f708274658 This patch adds a new FACS initialization flag for acpi_tb_initialize(). acpi_enable_subsystem() might be invoked several times in OS bootup process, and we don't want FACS initialization to be invoked twice. Lv Zheng. Link: https://github.com/acpica/acpica/commit/90f5332a Cc: All applicable <stable@vger.kernel.org> # All applicable Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04Btrfs: fix memory leak in the extent_same ioctlFilipe Manana
[ Upstream commit 497b4050e0eacd4c746dd396d14916b1e669849d ] We were allocating memory with memdup_user() but we were never releasing that memory. This affected pretty much every call to the ioctl, whether it deduplicated extents or not. This issue was reported on IRC by Julian Taylor and on the mailing list by Marcel Ritter, credit goes to them for finding the issue. Reported-by: Julian Taylor <jtaylor.debian@googlemail.com> Reported-by: Marcel Ritter <ritter.marcel@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: Mark Fasheh <mfasheh@suse.de> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04Btrfs: use kmem_cache_free when freeing entry in inode cacheFilipe Manana
[ Upstream commit c3f4a1685bb87e59c886ee68f7967eae07d4dffa ] The free space entries are allocated using kmem_cache_zalloc(), through __btrfs_add_free_space(), therefore we should use kmem_cache_free() and not kfree() to avoid any confusion and any potential problem. Looking at the kfree() definition at mm/slab.c it has the following comment: /* * (...) * * Don't free memory not originally allocated by kmalloc() * or you will run into trouble. */ So better be safe and use kmem_cache_free(). Cc: stable@vger.kernel.org Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: David Sterba <dsterba@suse.cz> Signed-off-by: Chris Mason <clm@fb.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04md: fix a build warningFiro Yang
[ Upstream commit 4e023612325a9034a542bfab79f78b1fe5ebb841 ] Warning like this: drivers/md/md.c: In function "update_array_info": drivers/md/md.c:6394:26: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses] !mddev->persistent != info->not_persistent|| Fix it as Neil Brown said: mddev->persistent != !info->not_persistent || Signed-off-by: Firo Yang <firogm@gmail.com> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04tracing: Have branch tracer use recursive field of task structSteven Rostedt (Red Hat)
[ Upstream commit 6224beb12e190ff11f3c7d4bf50cb2922878f600 ] Fengguang Wu's tests triggered a bug in the branch tracer's start up test when CONFIG_DEBUG_PREEMPT set. This was because that config adds some debug logic in the per cpu field, which calls back into the branch tracer. The branch tracer has its own recursive checks, but uses a per cpu variable to implement it. If retrieving the per cpu variable calls back into the branch tracer, you can see how things will break. Instead of using a per cpu variable, use the trace_recursion field of the current task struct. Simply set a bit when entering the branch tracing and clear it when leaving. If the bit is set on entry, just don't do the tracing. There's also the case with lockdep, as the local_irq_save() called before the recursion can also trigger code that can call back into the function. Changing that to a raw_local_irq_save() will protect that as well. This prevents the recursion and the inevitable crash that follows. Link: http://lkml.kernel.org/r/20150630141803.GA28071@wfg-t540p.sh.intel.com Cc: stable@vger.kernel.org # 3.10+ Reported-by: Fengguang Wu <fengguang.wu@intel.com> Tested-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04tracing/filter: Do not WARN on operand count going below zeroSteven Rostedt (Red Hat)
[ Upstream commit b4875bbe7e68f139bd3383828ae8e994a0df6d28 ] When testing the fix for the trace filter, I could not come up with a scenario where the operand count goes below zero, so I added a WARN_ON_ONCE(cnt < 0) to the logic. But there is legitimate case that it can happen (although the filter would be wrong). # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter That is, a single operation without any operands will hit the path where the WARN_ON_ONCE() can trigger. Although this is harmless, and the filter is reported as a error. But instead of spitting out a warning to the kernel dmesg, just fail nicely and report it via the proper channels. Link: http://lkml.kernel.org/r/558C6082.90608@oracle.com Reported-by: Vince Weaver <vincent.weaver@maine.edu> Reported-by: Sasha Levin <sasha.levin@oracle.com> Cc: stable@vger.kernel.org # 2.6.33+ Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04libata: force disable trim for SuperSSpeed S238Arne Fitzenreiter
[ Upstream commit cda57b1b05cf7b8b99ab4b732bea0b05b6c015cc ] This device loses blocks, often the partition table area, on trim. Disable TRIM. http://pcengines.ch/msata16a.htm Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org> Signed-off-by: Tejun Heo <tj@kernel.org> Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04libata: add ATA_HORKAGE_NOTRIMArne Fitzenreiter
[ Upstream commit 71d126fd28de2d4d9b7b2088dbccd7ca62fad6e0 ] Some devices lose data on TRIM whether queued or not. This patch adds a horkage to disable TRIM. tj: Collapsed unnecessary if() nesting. Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org> Signed-off-by: Tejun Heo <tj@kernel.org> Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04evm: labeling pseudo filesystems exceptionMimi Zohar
[ Upstream commit 5101a1850bb7ccbf107929dee9af0cd2f400940f ] To prevent offline stripping of existing file xattrs and relabeling of them at runtime, EVM allows only newly created files to be labeled. As pseudo filesystems are not persistent, stripping of xattrs is not a concern. Some LSMs defer file labeling on pseudo filesystems. This patch permits the labeling of existing files on pseudo files systems. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04KEYS: ensure we free the assoc array edit if edit is validColin Ian King
[ Upstream commit HEAD ] commit ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0 upstream. __key_link_end is not freeing the associated array edit structure and this leads to a 512 byte memory leak each time an identical existing key is added with add_key(). The reason the add_key() system call returns okay is that key_create_or_update() calls __key_link_begin() before checking to see whether it can update a key directly rather than adding/replacing - which it turns out it can. Thus __key_link() is not called through __key_instantiate_and_link() and __key_link_end() must cancel the edit. CVE-2015-1333 Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit c9cd9b18dac801040ada16562dc579d5ac366d75) Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04drm: add a check for x/y in drm_mode_setcrtcZhao Junwang
[ Upstream commit 01447e9f04ba1c49a9534ae6a5a6f26c2bb05226 ] legacy setcrtc ioctl does take a 32 bit value which might indeed overflow the checks of crtc_req->x > INT_MAX and crtc_req->y > INT_MAX aren't needed any more with this v2: -polish the annotation according to Daniel's comment Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Zhao Junwang <zhjwpku@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5Alex Deucher
[ Upstream commit 5dfc71bc44d91d1620505c064fa22b0b3db58a9d ] bug: https://bugs.freedesktop.org/show_bug.cgi?id=76490 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04mmc: block: Add missing mmc_blk_put() in power_ro_lock_show()Tomas Winkler
[ Upstream commit 9098f84cced870f54d8c410dd2444cfa61467fa0 ] Enclosing mmc_blk_put() is missing in power_ro_lock_show() sysfs handler, let's add it. Fixes: add710eaa886 ("mmc: boot partition ro lock support") Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04dm btree: silence lockdep lock inversion in dm_btree_del()Joe Thornber
[ Upstream commit 1c7518794a3647eb345d59ee52844e8a40405198 ] Allocate memory using GFP_NOIO when deleting a btree. dm_btree_del() can be called via an ioctl and we don't want to recurse into the FS or block layer. Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04dm btree remove: fix bug in redistribute3Dennis Yang
[ Upstream commit 4c7e309340ff85072e96f529582d159002c36734 ] redistribute3() shares entries out across 3 nodes. Some entries were being moved the wrong way, breaking the ordering. This manifested as a BUG() in dm-btree-remove.c:shift() when entries were removed from the btree. For additional context see: https://www.redhat.com/archives/dm-devel/2015-May/msg00113.html Signed-off-by: Dennis Yang <shinrairis@gmail.com> Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2015-08-04usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() functionAMAN DEEP
[ Upstream commit 3496810663922617d4b706ef2780c279252ddd6a ] virt_dev->num_cached_rings counts on freed ring and is not updated correctly. In xhci_free_or_cache_endpoint_ring() function, the free ring is added into cache and then num_rings_cache is incremented as below: virt_dev->ring_cache[rings_cached] = virt_dev->eps[ep_index].ring; virt_dev->num_rings_cached++; here, free ring pointer is added to a current index and then index is incremented. So current index always points to empty location in the ring cache. For getting available free ring, current index should be decremented first and then corresponding ring buffer value should be taken from ring cache. But In function xhci_endpoint_init(), the num_rings_cached index is accessed before decrement. virt_dev->eps[ep_index].new_ring = virt_dev->ring_cache[virt_dev->num_rings_cached]; virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; virt_dev->num_rings_cached--; This is bug in manipulating the index of ring cache. And it should be as below: virt_dev->num_rings_cached--; virt_dev->eps[ep_index].new_ring = virt_dev->ring_cache[virt_dev->num_rings_cached]; virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; Cc: <stable@vger.kernel.org> Signed-off-by: Aman Deep <aman.deep@samsung.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-26 17:26:32 +0000