Commit graph

534133 commits

Author SHA1 Message Date
Nicolas Iooss
3958b79266 configfs: fix kernel infoleak through user-controlled format string
Some modules call config_item_init_type_name() and config_group_init_type_name()
with parameter "name" directly controlled by userspace.  These two
functions call config_item_set_name() with this name used as a format
string, which can be used to leak information such as content of the
stack to userspace.

For example, make_netconsole_target() in netconsole module calls
config_item_init_type_name() with the name of a newly-created directory.
This means that the following commands give some unexpected output, with
configfs mounted in /sys/kernel/config/ and on a system with a
configured eth0 ethernet interface:

    # modprobe netconsole
    # mkdir /sys/kernel/config/netconsole/target_%lx
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # echo 1 > /sys/kernel/config/netconsole/target_%lx/enabled
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # dmesg |tail -n1
    [  142.697668] netconsole: target (target_ffffffffc0ae8080) is
    enabled, disable to update parameters

The directory name is correct but %lx has been interpreted in the
internal item name, displayed here in the error message used by
store_dev_name() in drivers/net/netconsole.c.

To fix this, update every caller of config_item_set_name to use "%s"
when operating on untrusted input.

This issue was found using -Wformat-security gcc flag, once a __printf
attribute has been added to config_item_set_name().

Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Felipe Balbi <balbi@ti.com>
Acked-by: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-17 16:39:53 -07:00
Nicolas Iooss
8db1486065 include, lib: add __printf attributes to several function prototypes
Using __printf attributes helps to detect several format string issues
at compile time (even though -Wformat-security is currently disabled in
Makefile).  For example it can detect when formatting a pointer as a
number, like the issue fixed in commit a3fa71c40f ("wl18xx: show
rx_frames_per_rates as an array as it really is"), or when the arguments
do not match the format string, c.f.  for example commit 5ce1aca814
("reiserfs: fix __RASSERT format string").

To prevent similar bugs in the future, add a __printf attribute to every
function prototype which needs one in include/linux/ and lib/.  These
functions were mostly found by using gcc's -Wsuggest-attribute=format
flag.

Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-17 16:39:53 -07:00
Dominik Dingel
7f9be77555 s390/hugetlb: add hugepages_supported define
On s390 we only can enable hugepages if the underlying hardware/hypervisor
also does support this.  Common code now would assume this to be
signaled by setting HPAGE_SHIFT to 0.  But on s390, where we only
support one hugepage size, there is a link between HPAGE_SHIFT and
pageblock_order.

So instead of setting HPAGE_SHIFT to 0, we will implement the check for
the hardware capability.

Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-17 16:39:52 -07:00
Dominik Dingel
2531c8cf56 mm: hugetlb: allow hugepages_supported to be architecture specific
s390 has a constant hugepage size, by setting HPAGE_SHIFT we also change
e.g. the pageblock_order, which should be independent in respect to
hugepage support.

With this patch every architecture is free to define how to check
for hugepage support.

Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-17 16:39:52 -07:00
Dominik Dingel
41318bfe2a revert "s390/mm: make hugepages_supported a boot time decision"
Heiko noticed that the current check for hugepage support on s390 is a
little bit too harsh as systems which do not support will crash.

The reason is that pageblock_order can now get negative when we set
HPAGE_SHIFT to 0.  To avoid all this and to avoid opening another can of
worms with enabling HUGETLB_PAGE_SIZE_VARIABLE I think it would be best
to simply allow architectures to define their own hugepages_supported().

Revert bea41197ea ("s390/mm: make hugepages_supported a boot time
decision") in preparation.

Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-17 16:39:52 -07:00
Dominik Dingel
ad4f99e888 revert "s390/mm: change HPAGE_SHIFT type to int"
Heiko noticed that the current check for hugepage support on s390 is a
little bit too harsh as systems which do not support will crash.

The reason is that pageblock_order can now get negative when we set
HPAGE_SHIFT to 0.  To avoid all this and to avoid opening another can of
worms with enabling HUGETLB_PAGE_SIZE_VARIABLE I think it would be best
to simply allow architectures to define their own hugepages_supported().

This patch (of 4): revert commit cf54e2fce5 ("s390/mm: change
HPAGE_SHIFT type to int") in preparation.

Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-17 16:39:52 -07:00
Andrew Morton
04ea1e91f8 openrisc: fix CONFIG_UID16 setting
openrisc-allnoconfig:

  kernel/uid16.c: In function 'SYSC_setgroups16':
  kernel/uid16.c:184:2: error: implicit declaration of function 'groups_alloc'
  kernel/uid16.c:184:13: warning: assignment makes pointer from integer without a cast

openrisc shouldn't be setting CONFIG_UID16 when CONFIG_MULTIUSER=n.

Fixes: 2813893f8b ("kernel: conditionally support non-root users, groups and capabilities")
Reported-by: Fengguang Wu <fengguang.wu@gmail.com>
Cc: Iulia Manda <iulia.manda21@gmail.com>
Cc: Josh Triplett <josh@joshtriplett.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-17 16:39:52 -07:00
Michal Hocko
fbd7dc744a MAINTAINERS: change mhocko's email address to kernel.org
I am moving from mhocko@suse.cz to mhocko@kernel.org for kernel related
stuff.

Signed-off-by: Michal Hocko <mhocko@suse.cz>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-17 16:39:52 -07:00
Iago López Galeiras
db5d5b3665 fs, proc: add help for CONFIG_PROC_CHILDREN
The purpose of the option was documented in
Documentation/filesystems/proc.txt but the help text was missing.

Add small help text that also points to the documentation.

Signed-off-by: Iago López Galeiras <iago@endocode.com>
Reviewed-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-17 16:39:52 -07:00
Jiri Slaby
d8130624b0 MAINTAINERS: switch to suse.com many-in-one (fwd)
Since suse.{de,cz} is deprecated to use (but will still work for some
time), switch to suse.com which is now to be used instead.

Signed-off-by: Jiri Slaby <jslaby@suse.com>
Acked-by: Alexander Graf <agraf@suse.de>
Acked-by: David Sterba <dsterba@suse.com>
Acked-by: Hannes Reinecke <hare@suse.com>
Acked-by: Jan Kara <jack@suse.com>
Acked-by: Jean Delvare <jdelvare@suse.com>
Acked-by: Jiri Kosina <jkosina@suse.com>
Acked-by: Michal Marek <mmarek@suse.com>
Acked-by: NeilBrown <neilb@suse.com>
Acked-by: Oliver Neukum <oneukum@suse.de>
Acked-by: Takashi Iwai <tiwai@suse.com>
Acked-by: Thomas Renninger <trenn@suse.de>
Acked-by: Tomas Cech <sleep_walker@suse.com>
Acked-by: Vojtech Pavlik <vojtech@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-17 16:39:52 -07:00
Fabio Estevam
d80238bbca rtc: armada38x: Remove unused variable from armada38x_rtc_set_time()
Remove the 'flags' variable in order to fix the following warning:

drivers/rtc/rtc-armada38x.c:91:22: warning: unused variable 'flags' [-Wunused-variable]

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
2015-07-18 00:42:31 +02:00
Wei-Ning Huang
baeca4495f rtc: mt6397: enable wakeup before registering rtc device
rtc_sysfs_add_device checks if device can wakeup before creating the
wakealarm file in sysfs. Thus the driver must set wakeup capability
before registering the rtc device.

Signed-off-by: Wei-Ning Huang <wnhuang@google.com>
Acked-by: Eddie Huang <eddie.huang@mediatek.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
2015-07-18 00:42:15 +02:00
Linus Torvalds
eb254374a3 Staging/IIO driver fixes for 4.2-rc3
Here's some staging and IIO driver fixes for 4.2-rc3.
 
 Nothing major, the majority are IIO issues that were reported, with a
 few other minor staging driver fixes.  All have been in linux-next for a
 while with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlWpRFUACgkQMUfUDdst+yke/wCeJPDuYuOp/SFhyviMx9ojKIGF
 kVIAoI1xDY4SwVExztXcqyKo6m0H2yZ4
 =pxAa
 -----END PGP SIGNATURE-----

Merge tag 'staging-4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging and IIO driver fixes from Greg KH:
 "Here's some staging and IIO driver fixes for 4.2-rc3.

  Nothing major, the majority are IIO issues that were reported, with a
  few other minor staging driver fixes.  All have been in linux-next for
  a while with no reported issues"

* tag 'staging-4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (25 commits)
  staging: vt6656: check ieee80211_bss_conf bssid not NULL
  staging: vt6655: check ieee80211_bss_conf bssid not NULL
  staging:lustre: remove irq.h from socklnd.h
  staging: make board support depend on OF_IRQ and CLKDEV_LOOKUP
  iio: tmp006: Check channel info on write
  iio: sx9500: Add missing init in sx9500_buffer_pre{en,dis}able()
  iio:light:ltr501: fix regmap dependency
  iio:light:ltr501: fix variable in ltr501_init
  iio: sx9500: fix bug in compensation code
  iio: sx9500: rework error handling of raw readings
  iio: magnetometer: mmc35240: fix available sampling frequencies
  iio:light:stk3310: Fix REGMAP_I2C dependency
  iio: light: STK3310: un-invert proximity values
  iio:adc:cc10001_adc: fix Kconfig dependency
  iio: light: tcs3414: Fix bug preventing to set integration time
  iio:accel:bmc150-accel: fix counting direction
  iio:light:cm3323: clear bitmask before set
  iio: adc: at91_adc: allow to use full range of startup time
  iio: DAC: ad5624r_spi: fix bit shift of output data value
  iio: proximity: sx9500: Fix proximity value
  ...
2015-07-17 11:30:59 -07:00
Linus Torvalds
2b3eb6e337 USB driver fixes for 4.2-rc3
Here's some USB driver fixes for 4.2-rc3.
 
 The ususal number of gadget driver fixes are in here, along with some
 new device ids and a build fix for the mn10300 arch which required some
 symbols to be renamed in the mos7720 driver.
 
 All have been in linux-next for a while with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlWpRQEACgkQMUfUDdst+ykQTACfbXmLNn/1ycArRysqHGg5llIZ
 pdIAn2Yi8TCbXr9HvtugUcxQrDIANNcF
 =WUtC
 -----END PGP SIGNATURE-----

Merge tag 'usb-4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB driver fixes from Greg KH:
 "Here's some USB driver fixes for 4.2-rc3.

  The ususal number of gadget driver fixes are in here, along with some
  new device ids and a build fix for the mn10300 arch which required
  some symbols to be renamed in the mos7720 driver.

  All have been in linux-next for a while with no reported issues"

* tag 'usb-4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: serial: Destroy serial_minors IDR on module exit
  usb: gadget: f_midi: fix error recovery path
  usb: phy: mxs: suspend to RAM causes NULL pointer dereference
  usb: gadget: udc: fix free_irq() after request_irq() failed
  usb: gadget: composite: Fix NULL pointer dereference
  usb: gadget: f_fs: do not set cancel function on synchronous {read,write}
  usb: f_mass_storage: limit number of reported LUNs
  usb: dwc3: core: avoid NULL pointer dereference
  usb: dwc2: embed storage for reg backup in struct dwc2_hsotg
  usb: dwc2: host: allocate qtd before atomic enqueue
  usb: dwc2: host: allocate qh before atomic enqueue
  usb: musb: host: rely on port_mode to call musb_start()
  USB: cp210x: add ID for Aruba Networks controllers
  USB: mos7720: rename registers
  USB: option: add 2020:4000 ID
2015-07-17 11:24:31 -07:00
Steven Rostedt (Red Hat)
d6726c8145 tracing: Fix sample output of dynamic arrays
He Kuang noticed that the trace event samples for arrays was broken:

"The output result of trace_foo_bar event in traceevent samples is
 wrong. This problem can be reproduced as following:

  (Build kernel with SAMPLE_TRACE_EVENTS=m)

  $ insmod trace-events-sample.ko

  $ echo 1 > /sys/kernel/debug/tracing/events/sample-trace/foo_bar/enable

  $ cat /sys/kernel/debug/tracing/trace

  event-sample-980 [000] ....  43.649559: foo_bar: foo hello 21 0x15
  BIT1|BIT3|0x10 {0x1,0x6f6f6e53,0xff007970,0xffffffff} Snoopy
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                 The array length is not right, should be {0x1}.
  (ffffffff,ffffffff)

  event-sample-980 [000] ....  44.653827: foo_bar: foo hello 22 0x16
  BIT2|BIT3|0x10
  {0x1,0x2,0x646e6147,0x666c61,0xffffffff,0xffffffff,0x750aeffe,0x7}
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                 The array length is not right, should be {0x1,0x2}.
  Gandalf (ffffffff,ffffffff)"

This was caused by an update to have __print_array()'s second parameter
be the count of items in the array and not the size of the array.

As there is already users of __print_array(), it can not change. But
the sample code can and we can also improve on the documentation about
__print_array() and __get_dynamic_array_len().

Link: http://lkml.kernel.org/r/1436839171-31527-2-git-send-email-hekuang@huawei.com

Fixes: ac01ce1410 ("tracing: Make ftrace_print_array_seq compute buf_len")
Reported-by: He Kuang <hekuang@huawei.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2015-07-17 14:15:13 -04:00
Linus Torvalds
1ea2a01c1d sound fixes for 4.2-rc3
There are two small fixes for HD-audio and USB LINE6, and the rest are
 a few new quirks and device ID addition that are good enough to get
 into 4.2.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJVqNr6AAoJEGwxgFQ9KSmktDUP/0af0005hx/MZ8iWZX3v7Qqj
 zAR5Ils2bbRz+R50WE4X2v6UERoU+DUU5qAh8XOGMAASo4xAUt9Uc/iqDWpPzcv6
 4FJI7lj/8qfsqXT/moO675M1KiPJzPj9CrWQVNZldSCVOC6liGMAcvuLOIxKv8PU
 VBkwsVdZEa5WRwx21DOXeTnqsPWGF/sjz4i1SOFYrHjLPZspNE0lL9rX2xj0jS1Y
 SQgY96zIT58AqVnJNiAmyNVSTQZ915JqgBPrMWJst6xZTKMRSmmFcnLv0ep+SSsn
 DptdMlER8j4bC9YGxj7v1FIEeU6gkyUQ3MZ2c8AVqsrap1zTot2HWBqKQGK+3Rnr
 VkYxTVJ2grEZ53JPw6vI5LydqsW50Iq8lR0dFrLrVTzVzYA02pahp2uovBQ/FJ1P
 Lp03vt3krvSSuOW2a9pK9Y0j5KAJFvxb3YWMONJ922JJPvnur0z6w8kxJ3Y4DwwR
 TD0FeetGptYSh1ZvViBGUv6AfdreQV5J2eqL/bsFMxk2NoXJaiF8tb8cCoQFFl7N
 QZtE1yJKnv8xDjgoxYXhqwDG2+j8okRa3h7ov3MVExjh7KV7wmM+G6H7LiV1SpQ5
 9SIjkgIwoMOSQGt+AubnCZdsMQZWRX8YDQS8048J6X4+SDdNKNwXASNhC5HCtfSS
 kGVXxyJRgEvcoBAnx96n
 =EgRm
 -----END PGP SIGNATURE-----

Merge tag 'sound-4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "There are two small fixes for HD-audio and USB LINE6, and the rest are
  a few new quirks and device ID addition that are good enough to get
  into 4.2"

* tag 'sound-4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda/realtek: Enable HP amp and mute LED on HP Folio 9480m [v3]
  ALSA: line6: Fix -EBUSY error during active monitoring
  ALSA: hda - Fix a wrong busy check in alt PCM open
  ALSA: hda - add codec ID for Broxton display audio codec
  ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4
2015-07-17 10:54:30 -07:00
Linus Torvalds
9bca4df258 This is a first set of GPIO fixes for the v4.2 series, all
hitting individual drivers and nothing else.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJVqPoCAAoJEEEQszewGV1zccEP/2bGViiPxrlBV2plLlteE4sT
 7zujWF3v1rkRZ1jr6tDafAthxtaL8WBY6O3rDWAVCZiVYATsYBGoh/Rg9EFwaKZ/
 6i5aqVFqAo9aNOFVmKabjUs8YESRTB4Wo1Ccuju/n4PkL7sGM+fBuZw5R6J7R+GU
 TpXMulHI4mDVjHuZWeUJ+GRnp6xmaTv5/PR1p1NC7D7zFulk6h4ZPYXJUhX8fhwC
 6Pp0bgH8JEvlzphDLHziX41jSEz8Pr3vWk0WJTYCisdsNl6oklfCMBcCOgluZmgO
 7v32RmxqXqBevhDgzd7sUUGjntmATb9kS4ZIcW6awX9Ia7TK55iG/pEd5pHfXAVV
 j79ViWfWxWLH2kVPiBTKSe+nCtMSg8hEj5RtPxTkBdUOL4BBgAigyY1DW4OgKPv5
 YOHiG0FN9UT/tNH8EmUNtnUW8k4a6LpLN+r+3Tgjbz1xgVcd/5wGlEzDm+TVnyMf
 RBojHUDYI0taE/KpGl7RkhcKZoDNsrYK/M+pKw5DTD8Ca/hfjMoLvqAs0uKzWjc7
 HDTtTTjAqFICNnf+yAaAKcjjpEp7r8xaj0c/cBIItIqG79vjLd+VnUvonjVzuTGP
 icysBdY5J2+NWBgWeVotopGhGs4NOYNIDQjzUwBLUBFcAVzvhsvTRc9LoncZq5Bn
 SWHIW/sZZ8hnWETNoz6q
 =mTd/
 -----END PGP SIGNATURE-----

Merge tag 'gpio-v4.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio

Pull GPIO fixes from Linus Walleij:
 "This is a first set of GPIO fixes for the v4.2 series, all hitting
  individual drivers and nothing else (except for a documentation
  oneliner.  I intended to send a request earlier but life intervened)"

* tag 'gpio-v4.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpio: pca953x: fix nested irqs rescheduling
  gpio: omap: prevent module from being unloaded while in use
  gpio: max732x: Add missing dev reference to gpiochip
  gpio/xilinx: Use correct address when setting initial values.
  gpio: zynq: Fix problem with unbalanced pm_runtime_enable
  gpio: omap: add missed spin_unlock_irqrestore in omap_gpio_irq_type
  gpio: brcmstb: fix null ptr dereference in driver remove
  gpio: Remove double "base" in comment
2015-07-17 10:40:45 -07:00
Olof Johansson
47295aa438 Couple of DTS fixes 4.2-rcx for Keystone EVMs:
K2E EVM boot hangs because of missing serdes driver which is needed to bring up
 PCIe on K2E. These couple of fixes makes the PCIE disabled on common default and
 let the specific board DTS to enable it.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJVqC4cAAoJEHJsHOdBp5c/EPoP/0tG+A0/m/h5NLU+7knX/vZK
 puZKuVwB2maEzTowcImgZi7LN9RGUpUIIHYJepcRvf6R0IEcTkWMjMxFmwz26Xn4
 u4eTOX27b7kRbtsqXFxogTqsFSmXkZNrm0Juf7oEi+RcD8Bx0ku/TZ5qbIFiaAS7
 aF/3Q/2vBHiCH6QzAa6eILaMnoVd3zGUCPHJL59hIygVevcLG71IOV/U4vrfDFG9
 ebHAjXPlZ0LhJAOaJVXEFPyir1HrblygwQR9ECPsylv0xAonyuxw79/0fpdIXIBw
 ozJ8v91p1+LQwkF9GRsbDnUVFSOQoV+fB5KJGEE9qQAPktZp5mOVh+2QAO+hHzX6
 TOvGXsEGxE59wf303/6dqSotN5QjUUY3UWGOZisgddgg4kKOSAodB9w/YOyuKwpf
 7l0CRsEeCmlYrQOLAlyTcok3BbG6d8PTzDJ92fI6s2lFHb/CX2x57/deZWt+AU2L
 KSHDXRrhCajWaJeiuACv6yme9DPHBE9RBdunLzUH5+Wsql1swB0ikE/sug9XXcIY
 1i+NhlRW4QhFvs6lN3uNW3T7raT3Q+BY0mASEz3eeuOSV9AQotaXUfPbzpqsoL2m
 clhghqkQeRvJFNjvu3UUG8AOHLpH3k24YFBm/NRhi3OXbLt8Yyw1fSdX/T7dqsYW
 mUOIBQAa1EcCcnOFb07h
 =BEOi
 -----END PGP SIGNATURE-----

Merge tag 'keystone-dts-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ssantosh/linux-keystone into fixes

Merge "ARM: Couple of dts fixes for v4.2-rcx" from Santosh Shilimkar:

Couple of DTS fixes 4.2-rcx for Keystone EVMs:

K2E EVM boot hangs because of missing serdes driver which is needed to bring up
PCIe on K2E. These couple of fixes makes the PCIE disabled on common default and
let the specific board DTS to enable it.

* tag 'keystone-dts-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ssantosh/linux-keystone:
  ARM: keystone: dts: rename pcie nodes to help override status
  ARM: keystone: dts: fix dt bindings for PCIe

Signed-off-by: Olof Johansson <olof@lixom.net>
2015-07-17 10:10:22 -07:00
Linus Torvalds
e05bf4f366 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
 "Fixes all over the place.

  The rockchip and imx fixes I missed while on holidays, so I've queued
  them now which makes this a bit bigger.

  The rest is misc amdgpu, radeon, i915 and armada.

  I think the most important thing is the ioctl fix, we dropped the
  avoid compat ball, so we get to add a compat wrapper.

  There is also an i915 revert to avoid a regression with existing
  userspace"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (43 commits)
  drm/ttm: improve uncached page deallocation.
  drm/ttm: fix uncached page deallocation to properly fill page pool v3.
  drm/amdgpu/dce8: Re-set VBLANK interrupt state when enabling a CRTC
  drm/radeon/ci: silence a harmless PCC warning
  drm/amdgpu/cz: silence some dpm debug output
  drm/amdgpu/cz: store the forced dpm level
  drm/amdgpu/cz: unforce dpm levels before forcing to low/high
  drm/amdgpu: remove bogus check in gfx8 rb setup
  drm/amdgpu: set proper index/data pair for smc regs on CZ (v2)
  drm/amdgpu: disable the IP module if early_init returns -ENOENT (v2)
  drm/amdgpu: stop context leak in the error path
  drm/amdgpu: validate the context id in the dependencies
  drm/radeon: fix user ptr race condition
  drm/radeon: Don't flush the GART TLB if rdev->gart.ptr == NULL
  drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5
  drm/armada: avoid saving the adjusted mode to crtc->mode
  drm/armada: fix overlay when partially off-screen
  drm/armada: convert overlay to use drm_plane_helper_check_update()
  drm/armada: fix gem object free after failed prime import
  drm/armada: fix incorrect overlay plane cleanup
  ...
2015-07-17 10:05:00 -07:00
Russell King
0871b72481 ARM: fix __virt_to_idmap build error on !MMU
Fengguang Wu reports that building ARM with !MMU results in the
following build error:

   arch/arm/kernel/built-in.o: In function `__soft_restart':
>> :(.text+0x1624): undefined reference to `arch_virt_to_idmap'

Fix this by adding an appropriate IS_ENABLED(CONFIG_MMU) into the
__virt_to_idmap() inline function.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2015-07-17 15:08:40 +01:00
Russell King
bac51ad9d1 ARM: invalidate L1 before enabling coherency
We must invalidate the L1 cache before enabling coherency, otherwise
secondary CPUs can inject invalid cache lines into the coherent CPU
cluster, which could then be migrated to other CPUs.  This fixes a
recent regression with SoCFPGA randomly failing to boot.

Fixes: 02b4e2756e ("ARM: v7 setup function should invalidate L1 cache")
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2015-07-17 15:08:40 +01:00
Marek Szyprowski
462859aa7b ARM: 8404/1: dma-mapping: fix off-by-one error in bitmap size check
nr_bitmaps member of mapping structure stores the number of already
allocated bitmaps and it is interpreted as loop iterator (it starts from
0 not from 1), so a comparison against number of possible bitmap
extensions should include this fact. This patch fixes this by changing
the extension failure condition. This issue has been introduced by
commit 4d852ef8c2 ("arm: dma-mapping: Add
support to extend DMA IOMMU mappings").

Reported-by: Hyungwon Hwang <human.hwang@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Hyungwon Hwang <human.hwang@samsung.com>
Cc: stable@vger.kernel.org  # v3.15+
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2015-07-17 15:08:40 +01:00
Stephen Boyd
8e0c34b0d2 ARM: 8402/1: perf: Don't use of_node after putting it
It's possible, albeit unlikely, that using the of_node here will
reference freed memory. Call of_node_put() after printing the
name to be safe.

Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2015-07-17 15:08:38 +01:00
Vitaly Andrianov
df9de3c429 ARM: 8400/1: use virt_to_idmap to get phys_reset address
This patch is to get correct physical address of the reset function for
PAE systems, which use aliased physical memory for booting.

See the "ARM: mm: Introduce virt_to_idmap() with an arch hook" for details.

Signed-off-by: Vitaly Andrianov <vitalya@ti.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2015-07-17 15:08:17 +01:00
Arik Nemtsov
923b352f19 cfg80211: use RTNL locked reg_can_beacon for IR-relaxation
The RTNL is required to check for IR-relaxation conditions that allow
more channels to beacon. Export an RTNL locked version of reg_can_beacon
and use it where possible in AP/STA interface type flows, where
IR-relaxation may be applicable.

Fixes: 06f207fc54 ("cfg80211: change GO_CONCURRENT to IR_CONCURRENT for STA")
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-07-17 15:02:02 +02:00
Bob Copeland
b3e7de873d mac80211: add missing length check for confirm frames
Although mesh_rx_plink_frame() already checks that frames have enough
bytes for the action code plus another two bytes for capability/reason
code, it doesn't take into account that confirm frames also have an
additional two-byte aid.  As a result, a corrupt frame could cause a
subsequent subtraction to wrap around to ill effect.  Add another
check for this case.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-07-17 14:39:42 +02:00
Bob Copeland
2ea752cd2c mac80211: correct aid location in peering frames
According to 802.11-2012 8.5.16.3.2 AID comes directly after the
capability bytes in mesh peering confirm frames.  The existing
code, however, was adding a 2 byte offset to this location,
resulting in garbage data going out over the air.  Remove the
offset to fix it.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-07-17 14:38:10 +02:00
Thomas Petazzoni
042ab5fc7a wireless: regulatory: reduce log level of CRDA related messages
With a basic Linux userspace, the messages "Calling CRDA to update
world regulatory domain" appears 10 times after boot every second or
so, followed by a final "Exceeded CRDA call max attempts. Not calling
CRDA". For those of us not having the corresponding userspace parts,
having those messages repeatedly displayed at boot time is a bit
annoying, so this commit reduces their log level to pr_debug().

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-07-17 14:37:23 +02:00
Ingo Molnar
a6acd6a411 perf/urgent fixes:
User visible:
 
 - Fix misplaced check for HAVE_SYNC_COMPARE_AND_SWAP_SUPPORT in
   the auxtrace code, which made 'perf record' fail straight away
   in some architectures, even when auxtrace wasn't involved. (Adrian Hunter)
 
 Developer stuff:
 
 - Really allow to specify custom CC, AR or LD (Alexey Brodkin)
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJVpnm5AAoJENZQFvNTUqpAwFYP/RkuHUpessvcueUR+xXAr6WR
 ANvg8rl7Wgn3hsZbH+1Hwg+BoBobR3IkmPqXBbgCvoquRm8+ozC+1GV03ng2lIRE
 e/IHDbp6Pq5xlTHgQlEUVWwrb7qutTUiO3+dxuVBGjyQfHwTm69R/3NCMpmAf4bl
 9f6VYT9SG6YAdUe5+upQX4vrS8RRAAv5G7T1hOY3b3lNXUb2ex0ZtwP2feZ5m98y
 fQqRNJ8JB7os2iOt22mpAykCtVWrix1HMkEe2/alFvElnlVUjZj+ZCCO8m6/1NT4
 gQboneLobAdhEqBiUXmQ1VflKnDOp7k65uktsJZqIR91qcshT7qVO7IX3TccmI9L
 MTXOcLrKNA7hMu55FVRLhsw0hQOmED1hEgIokhU0vHIiTUqtmoYAajsccrDGwUXr
 0HnMsoPISgGMBKktBwTl3Yn6Jb09BnuFB9G4awig3oHucKwZ/WVySjfyPTemMcTP
 2a0zVO3aAy6+orbfSG7e1sUSuvRs+Qer8p9MmyFlcITMTJpEOvHD4jca2DOvdRX1
 8mCS2Jf+Vn8OiOo6O80DlAIpVpGVYPsvCu6UQ6nS8gx8XUYvDQ1zQBcs/LJCBh5A
 Le2hMIi07FLAhA8cmaNN/ZHhcjWx/iXRI4HhTQc46+gfsQhc7pywzppKQ7big3e5
 ANJwXKq6m+yb9oflWSXR
 =fP9H
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent

Pull perf/urgent fixes from Arnaldo Carvalho de Melo:

  - Fix misplaced check for HAVE_SYNC_COMPARE_AND_SWAP_SUPPORT in
    the auxtrace code, which made 'perf record' fail straight away
    in some architectures, even when auxtrace wasn't involved. (Adrian Hunter)

  - Really allow to specify custom CC, AR or LD (Alexey Brodkin)

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-07-17 14:17:19 +02:00
Andy Lutomirski
a97439aa1a x86/entry/64, x86/nmi/64: Add CONFIG_DEBUG_ENTRY NMI testing code
It turns out to be rather tedious to test the NMI nesting code.
Make it easier: add a new CONFIG_DEBUG_ENTRY option that causes
the NMI handler to pre-emptively unmask NMIs.

With this option set, errors in the repeat_nmi logic or failures
to detect that we're in a nested NMI will result in quick panics
under perf (especially if multiple counters are running at high
frequency) instead of requiring an unusual workload that
generates page faults or breakpoints inside NMIs.

I called it CONFIG_DEBUG_ENTRY instead of CONFIG_DEBUG_NMI_ENTRY
because I want to add new non-NMI checks elsewhere in the entry
code in the future, and I'd rather not add too many new config
options or add this option and then immediately rename it.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-07-17 12:50:14 +02:00
Andy Lutomirski
36f1a77b3a x86/nmi/64: Make the "NMI executing" variable more consistent
Currently, "NMI executing" is one the first time an outermost
NMI hits repeat_nmi and zero thereafter.  Change it to be zero
each time for consistency.

This is intended to help NMI handling fail harder if it's buggy.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-07-17 12:50:13 +02:00
Andy Lutomirski
23a781e987 x86/nmi/64: Minor asm simplification
Replace LEA; MOV with an equivalent SUB.  This saves one
instruction.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-07-17 12:50:13 +02:00
Andy Lutomirski
810bc075f7 x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection
We have a tricky bug in the nested NMI code: if we see RSP
pointing to the NMI stack on NMI entry from kernel mode, we
assume that we are executing a nested NMI.

This isn't quite true.  A malicious userspace program can point
RSP at the NMI stack, issue SYSCALL, and arrange for an NMI to
happen while RSP is still pointing at the NMI stack.

Fix it with a sneaky trick.  Set DF in the region of code that
the RSP check is intended to detect.  IRET will clear DF
atomically.

( Note: other than paravirt, there's little need for all this
  complexity. We could check RIP instead of RSP. )

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-07-17 12:50:12 +02:00
Andy Lutomirski
a27507ca2d x86/nmi/64: Reorder nested NMI checks
Check the repeat_nmi .. end_repeat_nmi special case first.  The
next patch will rework the RSP check and, as a side effect, the
RSP check will no longer detect repeat_nmi .. end_repeat_nmi, so
we'll need this ordering of the checks.

Note: this is more subtle than it appears.  The check for
repeat_nmi .. end_repeat_nmi jumps straight out of the NMI code
instead of adjusting the "iret" frame to force a repeat.  This
is necessary, because the code between repeat_nmi and
end_repeat_nmi sets "NMI executing" and then writes to the
"iret" frame itself.  If a nested NMI comes in and modifies the
"iret" frame while repeat_nmi is also modifying it, we'll end up
with garbage.  The old code got this right, as does the new
code, but the new code is a bit more explicit.

If we were to move the check right after the "NMI executing"
check, then we'd get it wrong and have random crashes.

( Because the "NMI executing" check would jump to the code that would
  modify the "iret" frame without checking if the interrupted NMI was
  currently modifying it. )

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-07-17 12:50:12 +02:00
Andy Lutomirski
0b22930eba x86/nmi/64: Improve nested NMI comments
I found the nested NMI documentation to be difficult to follow.
Improve the comments.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-07-17 12:50:11 +02:00
Andy Lutomirski
9b6e6a8334 x86/nmi/64: Switch stacks on userspace NMI entry
Returning to userspace is tricky: IRET can fail, and ESPFIX can
rearrange the stack prior to IRET.

The NMI nesting fixup relies on a precise stack layout and
atomic IRET.  Rather than trying to teach the NMI nesting fixup
to handle ESPFIX and failed IRET, punt: run NMIs that came from
user mode on the normal kernel stack.

This will make some nested NMIs visible to C code, but the C
code is okay with that.

As a side effect, this should speed up perf: it eliminates an
RDMSR when NMIs come from user mode.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-07-17 12:50:11 +02:00
Andy Lutomirski
0e181bb581 x86/nmi/64: Remove asm code that saves CR2
Now that do_nmi saves CR2, we don't need to save it in asm.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Acked-by: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-07-17 12:50:11 +02:00
Andy Lutomirski
9d05041679 x86/nmi: Enable nested do_nmi() handling for 64-bit kernels
32-bit kernels handle nested NMIs in C.  Enable the exact same
handling on 64-bit kernels as well.  This isn't currently
necessary, but it will become necessary once the asm code starts
allowing limited nesting.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-07-17 12:50:10 +02:00
Marc Zyngier
591e5bec13 irqchip/gicv3-its: Fix mapping of LPIs to collections
The GICv3 ITS architecture allows a given [DevID, EventID] pair to be
translated to a [LPI, Collection] pair, where DevID is the device writing
the MSI, EventID is the payload being written, LPI is the actual
interrupt number, and Collection is roughly equivalent to a target CPU.

Each LPI can be mapped to a separate collection, but the ITS driver
insists on maintaining the collection on a device basis, instead of doing
it on a per interrupt basis.

This is obviously flawed, and this patch fixes it by adding a per interrupt
index that indicates which collection number is in use.

Reported-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Cc: <linux-arm-kernel@lists.infradead.org>
Cc: Jason Cooper <jason@lakedaemon.net>
Cc: stable@vger.kernel.org	# 4.1, 4.0
Link: http://lkml.kernel.org/r/1437126402-11677-1-git-send-email-marc.zyngier@arm.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-07-17 12:14:29 +02:00
Thomas Gleixner
75a06189fc genirq: Prevent resend to interrupts marked IRQ_NESTED_THREAD
The resend mechanism happily calls the interrupt handler of interrupts
which are marked IRQ_NESTED_THREAD from softirq context. This can
result in crashes because the interrupt handler is not the proper way
to invoke the device handlers. They must be invoked via
handle_nested_irq.

Prevent the resend even if the interrupt has no valid parent irq
set. Its better to have a lost interrupt than a crashing machine.

Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
2015-07-17 11:29:34 +02:00
Johannes Berg
d8d9008cfb mac80211: shut down interfaces before destroying interface list
If the hardware is unregistered while interfaces are up, mac80211 will
unregister all interfaces, which in turns causes mac80211 to be called
again to remove them all from the driver and eventually shut down the
hardware.

During this shutdown, however, it's currently already unsafe to iterate
the list of interfaces atomically, as the list is manipulated in an
unsafe manner. This puts an undue burden on the driver - it must stop
all its activities before calling ieee80211_unregister_hw(), while in
the normal stop path it can do all cleanup in the stop method. If, for
example, it's using the iteration during RX for some reason, it would
have to stop RX before unregistering to avoid crashes.

Fix this problem by closing all interfaces before unregistering them.
This will cause the driver stop to have completed before we manipulate
the interface list, and after the driver is stopped *and* has called
ieee80211_unregister_hw() it really musn't be iterating any more as
the memory will be freed as well.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-07-17 11:16:26 +02:00
Chaitanya T K
541b6ed7ce mac80211: wowlan: enable powersave if suspend while ps-polling
If for any reason we're in the middle of PS-polling or awake after
TX due to dynamic powersave while going to suspend, go back to save
power. This might cause a response frame to get lost, but since we
can't really wait for it while going to suspend that's still better
than not enabling powersave which would cause higher power usage
during (and possibly even after) suspend.

Note that this really only affects the very few drivers that use
the powersave implementation in mac80211.

Signed-off-by: Chaitanya T K <chaitanya.mgit@gmail.com>
[rewrite misleading commit log]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-07-17 11:13:21 +02:00
Michal Kazior
e9de01907e mac80211: don't clear all tx flags when requeing
When acting as AP and a PS-Poll frame is received
associated station is marked as one in a Service
Period. This state is kept until Tx status for
released frame is reported. While a station is in
Service Period PS-Poll frames are ignored.

However if PS-Poll was received during A-MPDU
teardown it was possible to have the to-be
released frame re-queued back to pending queue.
In such case the frame was stripped of 2 important
flags:

 (a) IEEE80211_TX_CTL_NO_PS_BUFFER
 (b) IEEE80211_TX_STATUS_EOSP

Stripping of (a) led to the frame that was to be
released to be queued back to ps_tx_buf queue. If
station remained to use only PS-Poll frames the
re-queued frame (and new ones) was never actually
transmitted because mac80211 would ignore
subsequent PS-Poll frames due to station being in
Service Period. There was nothing left to clear
the Service Period bit (no xmit -> no tx status ->
no SP end), i.e. the AP would have the station
stuck in Service Period. Beacon TIM would
repeatedly prompt station to poll for frames but
it would get none.

Once (a) is not stripped (b) becomes important
because it's the main condition to clear the
Service Period bit of the station when Tx status
for the released frame is reported back.

This problem was observed with ath9k acting as P2P
GO in some testing scenarios but isn't limited to
it. AP operation with mac80211 based Tx A-MPDU
control combined with clients using PS-Poll frames
is subject to this race.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-07-17 11:06:21 +02:00
Tom Hughes
4479004e64 mac80211: clear subdir_stations when removing debugfs
If we don't do this, and we then fail to recreate the debugfs
directory during a mode change, then we will fail later trying
to add stations to this now bogus directory:

BUG: unable to handle kernel NULL pointer dereference at 0000006c
IP: [<c0a92202>] mutex_lock+0x12/0x30
Call Trace:
[<c0678ab4>] start_creating+0x44/0xc0
[<c0679203>] debugfs_create_dir+0x13/0xf0
[<f8a938ae>] ieee80211_sta_debugfs_add+0x6e/0x490 [mac80211]

Cc: stable@kernel.org
Signed-off-by: Tom Hughes <tom@compton.nu>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-07-17 10:53:19 +02:00
Kalle Valo
df2cd4586f * bug fixes specific for 8000 series
* fix a crash in time events
 * fix a crash in PCIe transport
 * fix BT Coex code that prevented association on certain
         devices (3160).
 * revert the new RBD allocation model because it introduced
 	a bug when running on weak VM setups.
 * a new device IDs
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJVop0oAAoJEC0Llv5uNjIBgCkP/ic9hgwZzh3nWzfYyqvxTEY0
 NrLxW8jJGIYxS/M3tVoG8xQcoeA4D4itRt5npLGU+NiqxZMZWOsMRQTKLp04dAQE
 WuSDvBsiR0LFCv+XIccp63LYjDA/Y4Ib8zJTLIdMbQONBJ9lvy2CM5Qe98nzxkxr
 tkawZZrfUigPWCWoqjx1+uENCf6N/pJEnovZuWdRVSxj+olVjNs4CRcZeMAF1C44
 SBvImKa2JyGqPa1Zpr2nCRmyN/I9yvh6kCjyC5ywClm3vkd4ACXtaiNjtrlKwli8
 LhFSFBUFeDd+OJujS4/YoUzSojaNZYiOoN9NLmeFojD8kIkO47ClvjSdGrzOekm/
 fCNiIY9IYvtTOkJg5vQtu5/eXP/da7ZknQPjfswKvfWfuaUk8GhLNXghnZ+OnQYQ
 OT5oqOT5WTQObLwiANcpOPqFuUQMuTu/JGUBI5Ex3XIGWgCQFiIZJJUBshAas70l
 j340Jw9l5FKlhff+e3b57h928Ub4hnxgycy6E66/kXCYPOje4bSnE7LX1MUPa58V
 oc4Bd2kiL1BEFuuzkaYLBqlwwYv2qqfeh6oWz+4slCkorzm0UTMNvlQjGQgZkZIP
 9V7j/SAGL2Cwo7Wd4xSrQ6s+kF1pI9hbK/ABo6qw/ZgIWmt6YJnQF05ez4ZJdzFx
 X/AOFvHACngGZ2tavxJU
 =TLrS
 -----END PGP SIGNATURE-----

Merge tag 'iwlwifi-for-kalle-2015-06-12' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes

* bug fixes specific for 8000 series
* fix a crash in time events
* fix a crash in PCIe transport
* fix BT Coex code that prevented association on certain
        devices (3160).
* revert the new RBD allocation model because it introduced
	a bug when running on weak VM setups.
* a new device IDs
2015-07-17 11:19:08 +03:00
Jérôme Glisse
e930888487 drm/ttm: improve uncached page deallocation.
Calls to set_memory_wb() incure heavy TLB flush and IPI cost. To
minimize those wait until pool grow beyond batch size before
draining the pool.

Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Reviewed-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Reviewed-and-Tested-by: Michel Dänzer <michel@daenzer.net>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2015-07-17 18:18:04 +10:00
Jérôme Glisse
ef2b731759 drm/ttm: fix uncached page deallocation to properly fill page pool v3.
Current code never allowed the page pool to actualy fill in anyway.
This fix it, so that we only start freeing page from the pool when
we go over the pool size.

Changed since v1:
  - Move the page batching optimization to its separate patch.

Changed since v2:
  - Do not remove code part of the batching optimization with
    this patch.
  - Better commit message.

Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Reviewed-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Reviewed-and-Tested-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2015-07-17 18:17:33 +10:00
Krzysztof Kozlowski
5cde07abcb pinctrl: samsung: Remove old unused defines
Since 9a2c1c3b91 ("pinctrl: samsung: Allow grouping multiple
pinmux/pinconf nodes") the defines for GPIO group and function names are
not used anywhere in the driver.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Inspired-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-07-17 09:55:55 +02:00
Sergei Shtylyov
e2370f07cf ravb: do not invalidate cache for RX buffer twice
First, dma_sync_single_for_cpu() shouldn't have been called in the first place
(it's a streaming DMA API), dma_unmap_single() should have been called instead.
Second, dma_unmap_single() call after handing the buffer to napi_gro_receive()
makes little sense.  Moreover desc->dptr might not be valid at this point.

Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-17 00:10:47 -07:00
Linus Torvalds
21bdb584af Power management and ACPI fixes for v4.2-rc3
- Fix a recently introduced issue in the cpufreq policy object
    reinitialization that leads to CPU offline/online breakage
    (Viresh Kumar).
 
  - Make it possible to access frequency tables of offline CPUs
    which is needed by thermal management code among other things
    (Viresh Kumar).
 
  - Fix an ACPI resource management regression introduced during
    the 4.0 cycle that may cause incorrect resource validation
    results to appear in 32-bit x86 kernels due to silent truncation
    of 64-bit values to 32-bit (Jiang Liu).
 
  - Fix up an RCU-related lockdep complaint about suspicious RCU
    usage in idle caused by using a suspend tracepoint in the
    core suspend-to-idle code (Rafael J Wysocki).
 
 /
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABCAAGBQJVqC6GAAoJEILEb/54YlRxgREP/RXsHHL58VVMmSFEMkNX7lX2
 q2YibvVdNrZ9bk9+uNEk/NRc25mHrTHv8HyyIwn88EiUfbdvvKgyZez7KGzaFPYT
 0vAJLfKwqBHKpPMc0CaYHSIqAaL3RofqTCrw6pQHUj7S0q07fTV+rZ/A7eUnMbzG
 fQYf0zDIYAVrmd/GqB2fUxvMXbjWNmntDrHDahXG+C+96ih/wb1Hwz9Afb6l13Le
 Q6t/FXrVAi4g61dpnKIKFl3efE4u0s1CnfUCoz8VYT+g+ZSb/IYdaKlQ8kNGFGuA
 xxNpJgwdCWb7rD0WBuonX9lCaeM/Irg9SpfEw/DViSrKUm4GMOVm4EJ2S50oneVh
 lY6vy4Z95YqPxRccrsPchqg6KKUTnlv3PyNMdVM4UQCyoeKmIXLYIS0MT2juHh4R
 w1+GWE94AFcNC6kny0M6jWhG1pUfWEbajxNz3diIB4wJPG+qyBYcdzTrg1vyLD32
 4EeT5hUeQFPRILA9IiLk/L8uabJnqnvBarlJ/fl3qN0Pust3q/WbqgarqwN7tDcw
 ML3TlDLc9kU2e6q7VnvKqav0jCil7HHns5RIk3noOo1LZI7gM0o11sUXT4N84rla
 Aao+1v0Al6zMqSinCzp4uzwgaPThQpLWEGxuRvkNCceNXlJ1p5abx2DBZsSLI1Uk
 gAEcsa1eAg1TT3MQ2+RZ
 =BDs+
 -----END PGP SIGNATURE-----

Merge tag 'pm+acpi-4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management and ACPI fixes from Rafael Wysocki:
 "These fix two bugs in the cpufreq core (including one recent
  regression), fix a 4.0 PCI regression related to the ACPI resources
  management and quieten an RCU-related lockdep complaint about a
  tracepoint in the suspend-to-idle code.

  Specifics:

   - Fix a recently introduced issue in the cpufreq policy object
     reinitialization that leads to CPU offline/online breakage (Viresh
     Kumar)

   - Make it possible to access frequency tables of offline CPUs which
     is needed by thermal management code among other things (Viresh
     Kumar)

   - Fix an ACPI resource management regression introduced during the
     4.0 cycle that may cause incorrect resource validation results to
     appear in 32-bit x86 kernels due to silent truncation of 64-bit
     values to 32-bit (Jiang Liu)

   - Fix up an RCU-related lockdep complaint about suspicious RCU usage
     in idle caused by using a suspend tracepoint in the core suspend-
     to-idle code (Rafael J Wysocki)"

* tag 'pm+acpi-4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI / PCI: Fix regressions caused by resource_size_t overflow with 32-bit kernel
  cpufreq: Allow freq_table to be obtained for offline CPUs
  cpufreq: Initialize the governor again while restoring policy
  suspend-to-idle: Prevent RCU from complaining about tick_freeze()
2015-07-16 21:10:53 -07:00