This is a set of three fixes. One represents a nasty shared tag map
regression (another inverted condition) caused by recent SCSI MQ patches, one
is a longstanding potential buffer overrun in the iscsi data buffer and the
final one is a use after free for the rare bidirectional commands.
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQEcBAABAgAGBQJUHDQjAAoJEDeqqVYsXL0MAksIAMW7JMBW2BRSixKhqtZOsItd
DrYN1wfvOuoKgyKnXBfhLbgKih9UgMEnc4zWnB96gBnNJCwFpW9vIICdf6kCWwXh
c7Bh24SjcHMvYU9Of08TcAdUxyql6md/d28jzjoIi9zFj4C3XvLgevR8n4x2Lk2b
3SQnX/PYUVMd4sKZaTQDLLAy5+CYGf2tbLPHlMZQHlIN+Cgjorm8zW7tIWJ+rhrv
Sc3f9O9LxROsJ5wJNJpD0/9adlpsFxSD6cJWELaXBFsgw7jh0ZUjAXSYpyHASZqF
Mln4kNCEcoa3IIiLVxBbBoQCVF01+kYpGuZM4o4nU6b+wluXupcuhTh5o37G7Q8=
=FPm9
-----END PGP SIGNATURE-----
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"This is a set of three fixes.
One represents a nasty shared tag map regression (another inverted
condition) caused by recent SCSI MQ patches, one is a longstanding
potential buffer overrun in the iscsi data buffer and the final one is
a use after free for the rare bidirectional commands"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
[SCSI] fix for bidi use after free
[SCSI] fix regression that accidentally disabled block-based tcq
[SCSI] libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu
Pull perf fixes from Ingo Molnar:
"Two kernel side fixes: a kprobes fix and a perf_remove_from_context()
fix (which does not yet fix the migration bug which is WIP)"
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Fix a race condition in perf_remove_from_context()
kprobes/x86: Free 'optinsn' cache when range check fails
This particular reference count is not needed with the rcu protection,
and the current code leaks a reference count, causing a hang in
qib_qp_destroy().
Cc: <stable@vger.kernel.org>
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
There are two queries for port attributes one after another. A second
call is not needed since port_attr structure already holds the data.
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Alex Estrin <alex.estrin@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
This reverts commit 1820ffdccb ("PCI: Make sure bus number resources stay
within their parents bounds") because it breaks some systems with LSI Logic
FC949ES Fibre Channel Adapters, apparently by exposing a defect in those
adapters.
Dirk tested a Tyan VX50 (B4985) with this device that worked like this
prior to 1820ffdccb:
bus: [bus 00-7f] on node 0 link 1
ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-07])
pci 0000:00:0e.0: PCI bridge to [bus 0a]
pci_bus 0000:0a: busn_res: can not insert [bus 0a] under [bus 00-07] (conflicts with (null) [bus 00-07])
pci 0000:0a:00.0: [1000:0646] type 00 class 0x0c0400 (FC adapter)
Note that the root bridge [bus 00-07] aperture is wrong; this is a BIOS
defect in the PCI0 _CRS method. But prior to 1820ffdccb, we didn't
enforce that aperture, and the FC adapter worked fine at 0a:00.0.
After 1820ffdccb, we notice that 00:0e.0's aperture is not contained in
the root bridge's aperture, so we reconfigure it so it *is* contained:
pci 0000:00:0e.0: bridge configuration invalid ([bus 0a-0a]), reconfiguring
pci 0000:00:0e.0: PCI bridge to [bus 06-07]
This effectively moves the FC device from 0a:00.0 to 07:00.0, which should
be legal. But when we enumerate bus 06, the FC device doesn't respond, so
we don't find anything. This is probably a defect in the FC device.
Possible fixes (due to Yinghai):
1) Add a quirk to fix the _CRS information based on what amd_bus.c read
from the hardware
2) Reset the FC device after we change its bus number
3) Revert 1820ffdccb
Fix 1 would be relatively easy, but it does sweep the LSI FC issue under
the rug. We might want to reconfigure bus numbers in the future for some
other reason, e.g., hotplug, and then we could trip over this again.
For that reason, I like fix 2, but we don't know whether it actually works,
and we don't have a patch for it yet.
This revert is fix 3, which also sweeps the LSI FC issue under the rug.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=84281
Reported-by: Dirk Gouders <dirk@gouders.net>
Tested-by: Dirk Gouders <dirk@gouders.net>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
CC: stable@vger.kernel.org # v3.15+
CC: Yinghai Lu <yinghai@kernel.org>
According to <http://marc.info/?t=138347640900004&r=1&w=2>, revision
A0 of Connect-X does not correctly assemble TSO packets. Disable that
feature on that hardware revision.
Signed-off-by: Roland Dreier <roland@purestorage.com>
The static helper routine, __qib_get_user_pages(), accepts a vma arg,
but current use always passes NULL.
This has caused some confusion associated with the correct use of this
argument, but since the current use case doesn't require the
flexiblity, the best thing to do is to simplfy the code to always pass
NULL to get_user_pages().
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
The static helper routine, __ipath_get_user_pages(), accepts a vma
arg, but current use always passes NULL.
This has caused some confusion associated with the correct use of this
argument, but since the current use case doesn't require the
flexiblity, the best thing to do is to simplfy the code to always pass
NULL to get_user_pages().
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
This reverts commit fc1b253141 ("PCI: Don't scan random busses in
pci_scan_bridge()") because it breaks CardBus on some machines.
David tested a Dell Latitude D505 that worked like this prior to
fc1b253141:
pci 0000:00:1e.0: PCI bridge to [bus 01]
pci 0000:01:01.0: CardBus bridge to [bus 02-05]
Note that the 01:01.0 CardBus bridge has a bus number aperture of
[bus 02-05], but those buses are all outside the 00:1e.0 PCI bridge bus
number aperture, so accesses to buses 02-05 never reach CardBus. This is
later patched up by yenta_fixup_parent_bridge(), which changes the
subordinate bus number of the 00:1e.0 PCI bridge:
pci_bus 0000:01: Raising subordinate bus# of parent bus (#01) from #01 to #05
With fc1b253141, pci_scan_bridge() fails immediately when it notices that
we can't allocate a valid secondary bus number for the CardBus bridge, and
CardBus doesn't work at all:
pci 0000:01:01.0: can't allocate child bus 01 from [bus 01]
I'd prefer to fix this by integrating the yenta_fixup_parent_bridge() logic
into pci_scan_bridge() so we fix the bus number apertures up front. But
I don't think we can do that before v3.17, so I'm going to revert this to
avoid the problem while we're working on the long-term fix.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=83441
Link: http://lkml.kernel.org/r/1409303414-5196-1-git-send-email-david.henningsson@canonical.com
Reported-by: David Henningsson <david.henningsson@canonical.com>
Tested-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
CC: stable@vger.kernel.org # v3.15+
In debugging an application that receives -ENOMEM from ib_reg_mr(), I
found that ib_umem_get() can fail because the pinned_vm count has
wrapped causing it to always be larger than the lock limit even with
RLIMIT_MEMLOCK set to RLIM_INFINITY.
The wrapping of pinned_vm occurs because the process that calls
ib_reg_mr() will have its mm->pinned_vm count incremented. Later a
different process with a different mm_struct than the one that
allocated the ib_umem struct ends up releasing it which results in
decrementing the new processes mm->pinned_vm count past zero and
wrapping.
I'm not entirely sure what circumstances cause a different process to
release the ib_umem than the one that allocated it but the kernel
stack trace of the freeing process from my situation looks like the
following:
Call Trace:
[<ffffffff814d64b1>] dump_stack+0x19/0x1b
[<ffffffffa0b522a5>] ib_umem_release+0x1f5/0x200 [ib_core]
[<ffffffffa0b90681>] mlx4_ib_destroy_qp+0x241/0x440 [mlx4_ib]
[<ffffffffa0b4d93c>] ib_destroy_qp+0x12c/0x170 [ib_core]
[<ffffffffa0cc7129>] ib_uverbs_close+0x259/0x4e0 [ib_uverbs]
[<ffffffff81141cba>] __fput+0xba/0x240
[<ffffffff81141e4e>] ____fput+0xe/0x10
[<ffffffff81060894>] task_work_run+0xc4/0xe0
[<ffffffff810029e5>] do_notify_resume+0x95/0xa0
[<ffffffff814e3dd0>] int_signal+0x12/0x17
The following patch fixes the issue by storing the pid struct of the
process that calls ib_umem_get() so that ib_umem_release and/or
ib_umem_account() can properly decrement the pinned_vm count of the
correct mm_struct.
Signed-off-by: Shawn Bohrer <sbohrer@rgmadvisors.com>
Reviewed-by: Shachar Raindel <raindel@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
When ib_request_notify_cq() is called for the first time, ocrdma tries
to skip setting deffered_arm flag. This may lead CQ to an un-armed
state thus never generating a CQ event and leaving consumer hung.
This patch removes the part of code that skips setting deferred_arm.
Signed-off-by: Devesh Sharma <devesh.sharma@emulex.com>
Signed-off-by: Selvin Xavier <selvin.xavier@emulex.com>
Signed-off-by: Mitesh Ahuja <mitesh.ahuja@emulex.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Pull x86 fixes from Ingo Molnar:
"Misc fixes:
EFI fixes, a build fix, a page table dumping (debug) fix and a clang
build fix"
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
efi/arm64: Fix fdt-related memory reservation
x86/mm: Apply the section attribute to the variable, not its type
x86/efi: Fixup GOT in all boot code paths
x86/efi: Only load initrd above 4g on second try
x86-64, ptdump: Mark espfix area only if existent
x86, irq: Fix build error caused by 9eabc99a63
Pull MIPS fixes from Ralf Baechle:
"A fair number of build fixes for various configurations.
Fixes to BPF, and the BCM47xx platform code, a preemption fix for the
Loongson core, a syscall auditing fix, wire up the new getrandom and
memfd_create. Several patches for EVA"
* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (30 commits)
MIPS: SmartMIPS: Disable assembler warnings
MIPS: Move CPU topology macros to topology.h
MIPS: Wire up new syscalls getrandom and memfd_create.
MIPS: Fix a warning for virt_to_page
arch/mips/net/bpf_jit.c: fix failure check
MIPS: COP2: CPP macro safety fixes.
MIPS: Kconfig: Select SMP symbols for CMP
MIPS: ZBOOT: add missing <linux/string.h> include
MIPS: IP28: Fix/clean spaces.h
MIPS: IP28: Select correct L1_CACHE_SHIFT
MIPS: BCM63xx: delete double assignment
MIPS: Spelling s/confugrations/configurations/
MIPS: OCTEON: make get_system_type() thread-safe
MIPS: CPS: Initialize EVA before bringing up VPEs from secondary cores
MIPS: Malta: EVA: Rename 'eva_entry' to 'platform_eva_init'
MIPS: EVA: Add new EVA header
MIPS: scall64-o32: Fix indirect syscall detection
MIPS: syscall: Fix AUDIT value for O32 processes on MIPS64
MIPS: Loongson: Fix COP2 usage for preemptible kernel
MIPS: NL: Fix nlm_xlp_defconfig build error
...
When ending a bi-directionional SCSI request, blk_finish_request()
cleans up and frees the request, but scsi_release_bidi_buffers() tries
to indirect through the request to find it's data buffers. This causes
a panic due to a null pointer dereference.
Move the call to scsi_release_bidi_buffers() before the call to
blk_finish_request().
Signed-off-by: Daniel Gryniewicz <dang@linuxbox.com>
Reviewed-by: Webb Scales <webbnh@hp.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
The scsi blk-mq support accidentally flipped a conditional, which lead to
never enabling block based tcq when using the legacy request path.
Fixes: d285203cf6 scsi: add support for a blk-mq based I/O path.
Reported-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
This patches fixes a potential buffer overrun in __iscsi_conn_send_pdu.
This function is used by iscsi drivers and userspace to send iscsi PDUs/
commands. For login commands, we have a set buffer size. For all other
commands we do not support data buffers.
This was reported by Dan Carpenter here:
http://www.spinics.net/lists/linux-scsi/msg66838.html
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
The KASLR location-choosing logic needs to avoid the setup_data
list memory areas as well. Without this, it would be possible to
have the ASLR position stomp on the memory, ultimately causing
the boot to fail.
Signed-off-by: Kees Cook <keescook@chromium.org>
Tested-by: Baoquan He <bhe@redhat.com>
Cc: stable@vger.kernel.org
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: http://lkml.kernel.org/r/20140911161931.GA12001@www.outflux.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
earlyprintk=efi after recent changes to the ACPI code - Dave Young
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJUG/pjAAoJEC84WcCNIz1VQToP+wfz21mZLPyurzCXycbrXi3I
h2Jg99HhCe2TL1+9slSEJZvCFGsnspbkZtfA8OB0Ms7eomt3mY9yTwsfMVfyUZRM
2DAWjK0eg9ZEAXcmU0tGbI4Iy9Kf/U0OPEsZ8ZKJkG1QGA+pHrKqhfdrKzP/pVV6
iQ94OgBa1BZqljYureERvIourghN6hcwlJHqTLF66kzbFtL//2NQJIidHBcJRO0k
CA/2U65WNEFXAtUenHHUnSM8hhN5H2NiSxPKg6p4iK6nsNcBL80rhEmMHYW80VHp
PP7lXoCAbGARIfXbjPPNvn7aHL0qzpsF3fvNrtQRSkEwGjEod8gxHAqqzguLrK58
G0HovhfUvEADXzjDiWCWUAIT/ryHutJLxXo6Fn2UijtAso+W/wUorqJlKNDG1dHX
PRJKO0kk7TCKPBYxNRkds9Gt8g8uEoInr+V13qvURjwb6H9hFd8fyuL25bRUftdV
TE4/pzm5F9YjLU2548RfXKcz5snSuOT9EYf3s4C8wTtm4tJv7GxQ+/vz000Hres3
YlWaY2CywsrZfdBZaaF9gEtsjsdBVH+PspOGtodY0jjnz/I71H7oZNdgb8vslRLS
6iH9+swCEm6cdytzqFXO1qp7DKLpxZJmwTHKhAvdSYzXZBvf1JMCQ6zdoXNfdNRR
R8vYh1pvBd1tRJQ9tpJe
=t4a9
-----END PGP SIGNATURE-----
Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/urgent
Pull EFI fix from Matt Fleming:
* Increase the number of early_ioremap() slots to fix a regression with
earlyprintk=efi after recent changes to the ACPI code (Dave Young)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
* pci/vga:
vgaarb: Drop obsolete #ifndef
vgaarb: Don't default exclusively to first video device with mem+io
* commit '6a73336bde29':
PCI: Remove "no hotplug settings from platform" warning
couple of display fixes.
* tag 'drm-intel-fixes-2014-09-18' of git://anongit.freedesktop.org/drm-intel:
drm/i915: Add limited color range readout for HDMI/DP ports on g4x/vlv/chv
drm/i915: Fix SRC_COPY width on 830/845g
- fix a resume hang on mullins
- fix an oops on module unload with vgaswitcheroo (radeon and nouveau)
- fix possible hangs DMA engine hangs due to hw bugs
* 'drm-fixes-3.17' of git://people.freedesktop.org/~agd5f/linux:
drm/nouveau/runpm: fix module unload
drm/radeon/px: fix module unload
vgaswitcheroo: add vga_switcheroo_fini_domain_pm_ops
drm/radeon: don't reset dma on r6xx-evergreen init
drm/radeon: don't reset sdma on CIK init
drm/radeon: don't reset dma on NI/SI init
drm/radeon/dpm: fix resume on mullins
drm/radeon: Disable HDP flush before every CS again for < r600
drm/radeon: delete unused PTE_* defines
Use the new vga_switcheroo_fini_domain_pm_ops function
to unregister the pm ops.
Based on a patch from:
Pali Rohár <pali.rohar@gmail.com>
bug:
https://bugzilla.kernel.org/show_bug.cgi?id=84431
Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Cc: Ben Skeggs <bskeggs@redhat.com>
Use the new vga_switcheroo_fini_domain_pm_ops function
to unregister the pm ops.
Based on a patch from:
Pali Rohár <pali.rohar@gmail.com>
bug:
https://bugzilla.kernel.org/show_bug.cgi?id=84431
Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Drivers should call this on unload to unregister pmops.
Bug:
https://bugzilla.kernel.org/show_bug.cgi?id=84431
Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Otherwise we may lose the DMA golden settings which can
lead to hangs, etc.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Otherwise we may lose the DMA golden settings which can
lead to hangs, etc.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
It was causing display corruption with R300 generation GPUs at least.
Reported-and-Tested-by: Mikael Pettersson <mikpelinux@gmail.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
They don't appear to be used anywhere... elsewhere uses R*_PTE_*.
master@linux:U:.% git grep PTE_ -- drivers/gpu/drm/radeon | grep -v _PTE_
master@linux:U:.% (kyle@redacted:~/linux)
./arch/arm64/include/asm/pgtable.h:27:0: note: this is the location of the previous definition
#define PTE_VALID (_AT(pteval_t, 1) << 0)
^
In file included from drivers/gpu/drm/radeon/r600_cs.c:31:0:
drivers/gpu/drm/radeon/r600d.h:48:0: warning: "PTE_VALID" redefined [enabled by default]
#define PTE_VALID (1 << 0)
^
In file included from ./arch/arm64/include/asm/io.h:29:0,
from include/linux/clocksource.h:19,
from include/clocksource/arm_arch_timer.h:19,
from ./arch/arm64/include/asm/arch_timer.h:27,
from ./arch/arm64/include/asm/timex.h:19,
from include/linux/timex.h:65,
<snip>
from include/drm/drmP.h:51,
from drivers/gpu/drm/radeon/r600_cs.c:29:
./arch/arm64/include/asm/pgtable.h:27:0: note: this is the location of the previous definition
#define PTE_VALID (_AT(pteval_t, 1) << 0)
^
Signed-off-by: Kyle McMartin <kyle@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Pull cifs/smb3 fixes from Steve French:
"Fixes for problems found during testing and debugging at the SMB3
storage test event (plugfest) this week"
* 'for-linus' of git://git.samba.org/sfrench/cifs-2.6:
Fix mfsymlinks file size check
Update version number displayed by modinfo for cifs.ko
cifs: remove dead code
Revert "cifs: No need to send SIGKILL to demux_thread during umount"
[SMB3] Fix oops when creating symlinks on smb3
[CIFS] Fix setting time before epoch (negative time values)
All small fixes in random various drivers, mostly for ASoC at this
time, which look reasonable for a high rc number.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABAgAGBQJUGo2LAAoJEGwxgFQ9KSmkf74P/RYd9/0zzMyf8xIc1MnX9Ggl
Mw/se46bf0jcJ66mfvFEyJLH+a0CHOujXHFUgRvE4EySLRjaiRm+qU8MKB0tP96X
Y7fepeNeYtnUmI+wDe6VYgLqgEbTMguW+a9npK+4nTzJAQUIDL7YVvXS/QgpRbnD
AIIvcBPNuFdJLGmtdhrrprJAd4TyjuVa3TIvVqYh8bRCs7VQZzDx7CtlAL2HVJFG
iJb4/Tqyv9OM/zSFdD5ZTllK3Cy//vSOBoffnh6K9jk8siodMPjrFlRXX5Dc2uSL
O8HzwtXBqNZldbcydwb5BjSvIUXVVKcZQMkfmPxA4HAi/eh7pORGIOcgeO9K6B1H
uwEcp5gassEztsB1eb2jmrpZ6hcQy3ec4QiQH7yF4A9djiX0LQdJJ6uOfJ5YZFJN
bx0u72sT4VkfJstel9NgR5L/XQlcWpvbMy5uVWX7X2NbTDF26lb30VBPZEnUfb1b
6By8onsWZBDrAkRRxyV34Q3F0J3T6EfNuu2/xju1jnjP1lPvSh3AEylhdzjWMJoI
cFOhhTyIeW3s0qzNqzSIdBNdL6I8Wcgn3RmP3f//CFTFNPztc6VjAr3lUcdiiXDu
MGPjGThJB0t1dib0tWQ/HO6U/XOEiyr4dxe4CeTqrybPLcQDZNVQ63UEzX30032O
f22/BsqXInYpAoPQnU9E
=dEGa
-----END PGP SIGNATURE-----
Merge tag 'sound-3.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"All small fixes in random various drivers, mostly for ASoC at this
time, which look reasonable for a high rc number"
* tag 'sound-3.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: rockchip-i2s: dt: swap tx and rx channed request number in example
ASoC: rockchip-i2s: fix registers' property of rockchip i2s controller
ASoC: rockchip-i2s: fix master mode set bit error
ASoC: cs4265: Fix register address to set the proper data type.
ALSA: hda - Fix invalid pin powermap without jack detection
ASoC: soc-pcm: fix dpcm_path_get error handling
ASoC: samsung-i2s: Check secondary DAI exists before referencing
ASoC: Update email id of the author
ASoC: dwc: Update email id of the author
ASoC: davinci-mcasp: Correct rx format unit configuration
ASoC: tlv320aic31xx: Fix 24bit samples with I2S format and 12MHz mclk
dma_pool_create() needs to unlock the mutex in error case. The bug was
introduced in the 3.16 by commit cc6b664aa2 ("mm/dmapool.c: remove
redundant NULL check for dev in dma_pool_create()")/
Signed-off-by: Krzysztof Hałasa <khc@piap.pl>
Cc: stable@vger.kernel.org # v3.16
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Fix some leaked OF node references in regulator drivers that have been
left over following a fix on a fix to the reference counting.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJUGMj6AAoJECTWi3JdVIfQvqYH/1bj+ndSH7P8jS9C0NiTQcGP
aEgwtGXManfRaTzyr/rBGRatpqcQ5yUHPu5lXysLC9JwACj3aFywCHdBSF4EaDzi
j737MCXm4Aq/JABwxRUBC7c3BXX5cxqqaOFxxYwtmXys581sqSjXGs9sB74qfKZw
Rg/1Vx+40gP3gzSCRXn+5xQ/cJdrAM7Chf/v/69xJjfdEJJbHw952/s3TR7Bjige
2C0rQ+ia+kk1TeuE0zQqxFqK/Z/YNaOCpAxTt+CUayhz7SHuEdlL1t9kUw/wHP5Q
0w/2CK1eRFWVWCwLy/5A5Hrxt7aG+/nTCLoEcGVtymFvCDdnkmGYn43rGgQGGlM=
=/mIC
-----END PGP SIGNATURE-----
Merge tag 'regulator-v3.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fix from Mark Brown:
"Fix some leaked OF node references in regulator drivers that have been
left over following a fix on a fix to the reference counting"
* tag 'regulator-v3.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: remove unnecessary of_node_get() to parent
A few driver specific fixes for v3.17:
- Fix davinci so that GPIO chip selects work with deferred probe of
GPIOs (which could happen in production depending on kernel config)
plus one incremental stylistic fix to that.
- Several fixes for the newly introduced rockchip driver that came up
in wider testing of the device.
- A couple of small things in the sirf driver, one bug that would stop
DMA transfers working and another update to follow the documented
procedure in the datasheet.
- Fix some memory leaks with devm_kzalloc() being used outside of the
device bind path.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJUGMflAAoJECTWi3JdVIfQaJoH/1Zvl0/WrxIaNLIhI0SeyiTc
Wtma9R5/N5Dx9tWp1X6XSZJbWLP/H9VN2YUd2eeZTAn48rlYLf6wgz6pqa8xmVUd
y1+pYukRxlOFSIfKWaCpTvgqDQx09VnWPNlm+E/vKVj/ba1jvkxdhRoc9ROwcfuj
DBtJ/kRcmJrEbMEQD60ZbJEHrqTmhNLWwpnoTLQ+2DRsBKyzo6YCgYlcAlcA0siK
tu1zGsQr28jl0DjYJTl+TwjSWhzcFichFr2NuxC1k8b8xhLonRYxiR9Uxyb8gJQ4
mtBvOrcZ0GPdCYFG9Fkr62dphxL5thh5ZrSTpUCh5y/ep8l7iZgiv0/CmyYFOHg=
=hxe+
-----END PGP SIGNATURE-----
Merge tag 'spi-v3.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A few driver specific fixes for v3.17:
- Fix davinci so that GPIO chip selects work with deferred probe of
GPIOs (which could happen in production depending on kernel config)
plus one incremental stylistic fix to that.
- Several fixes for the newly introduced rockchip driver that came up
in wider testing of the device.
- A couple of small things in the sirf driver, one bug that would
stop DMA transfers working and another update to follow the
documented procedure in the datasheet.
- Fix some memory leaks with devm_kzalloc() being used outside of the
device bind path"
* tag 'spi-v3.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: davinci: remove empty function davinci_spi_cleanup
spi: davinci: request cs_gpio's from probe
spi/pl022: Fix error message
spi/rockchip: Mark DMA as optional
spi/rockchip: Don't warn if SPI is busy but disabled
spi/rockchip: Fix the wait_for_idle() timeout
spi: sirf: add fifo reset/start for cmd transfer
spi: sirf: enable RX_IO_DMA_INT interrupt
spi: dw: Don't use devm_kzalloc in master->setup callback
spi: fsl: Don't use devm_kzalloc in master->setup callback
James Drew reports another bug whereby the NFS client is now sending
an OPEN_DOWNGRADE in a situation where it should really have sent a
CLOSE: the client is opening the file for O_RDWR, but then trying to
do a downgrade to O_RDONLY, which is not allowed by the NFSv4 spec.
Reported-by: James Drews <drews@engr.wisc.edu>
Link: http://lkml.kernel.org/r/541AD7E5.8020409@engr.wisc.edu
Fixes: aee7af356e (NFSv4: Fix problems with close in the presence...)
Cc: stable@vger.kernel.org # 2.6.33+
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
There is a race between nfs4_state_manager() and
nfs_server_remove_lists() that happens during a nfsv3 mount.
The v3 mount notices there is already a supper block so
nfs_server_remove_lists() called which uses the nfs_client_lock
spin lock to synchronize access to the client list.
At the same time nfs4_state_manager() is running through
the client list looking for work to do, using the same
lock. When nfs4_state_manager() wins the race to the
list, a v3 client pointer is found and not ignored
properly which causes the panic.
Moving some protocol checks before the state checking
avoids the panic.
CC: Stable Tree <stable@vger.kernel.org>
Signed-off-by: Steve Dickson <steved@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
cgroup_pidlist_start() holds cgrp->pidlist_mutex and then calls
pidlist_array_load(), and cgroup_pidlist_stop() releases the mutex.
It is wrong that we release the mutex in the failure path in
pidlist_array_load(), because cgroup_pidlist_stop() will be called
no matter if cgroup_pidlist_start() returns errno or not.
Fixes: 4bac00d16a
Cc: <stable@vger.kernel.org> # 3.14+
Signed-off-by: Zefan Li <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
This reverts commit b96de000bc.
This commit is triggering failures to mount by subvolume id in some
configurations. The main problem is how many different ways this
scanning function is used, both for scanning while mounted and
unmounted. A proper cleanup is too big for late rcs.
For now, just revert the commit and we'll put a better fix into a later
merge window.
Signed-off-by: Chris Mason <clm@fb.com>
Enable interrupts from all 32 bundles.
Signed-off-by: Conor McLoughlin <conor.mcloughlin@intel.com>
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
The limited color range knob is in the port registers on
g4x and vlv/chv for HDMI, and on g4x for DP. Add the relevant code
to read out the hardware state into pipe config. On vlv/chv the
DP port limited color range knob is in PIPECONF for which we
already have readout code.
Cc: Chris Clayton <chris2553@googlemail.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Tested-by: Chris Clayton <chris2553@googlemail.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
In order to make the driver work with the common clock framework, this patch
converts the clk_enable()/clk_disable() to
clk_prepare_enable()/clk_disable_unprepare(). While there, add the missing
error handling.
Signed-off-by: David Dueck <davidcdueck@googlemail.com>
Signed-off-by: Anthony Harivel <anthony.harivel@emtrion.de>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
This patch increases the mask in the FLEXCAN_MCR_MAXMB() to 7 bits as in the
newer flexcan cores the MAXMB field is 7 bits wide.
Reported-by: David Jander <david@protonic.nl>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
After sending a RTR frame the TX mailbox becomes a RX_EMPTY mailbox. To avoid
side effects when the RX-FIFO is full, this patch puts the TX mailbox into
TX_INACTIVE mode in the transmission complete interrupt handler. This, of
course, leaves a race window between the actual completion of the transmission
and the handling of tx-complete interrupt. However this is the best we can do
without busy polling the tx complete interrupt.
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
This patch implements the workaround mentioned in ERR005829:
ERR005829: FlexCAN: FlexCAN does not transmit a message that is enabled to
be transmitted in a specific moment during the arbitration process.
Workaround: The workaround consists of two extra steps after setting up a
message for transmission:
Step 8: Reserve the first valid mailbox as an inactive mailbox (CODE=0b1000).
If RX FIFO is disabled, this mailbox must be message buffer 0. Otherwise, the
first valid mailbox can be found using the "RX FIFO filters" table in the
FlexCAN chapter of the chip reference manual.
Step 9: Write twice INACTIVE code (0b1000) into the first valid mailbox.
Signed-off-by: David Jander <david@protonic.nl>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Apparently mailboxes may contain random data at startup, causing some of them
being prepared for message reception. This causes overruns being missed or even
confusing the IRQ check for trasmitted messages, increasing the transmit
counter instead of the error counter.
This patch initializes all mailboxes after the FIFO as RX_INACTIVE.
Signed-off-by: David Jander <david@protonic.nl>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
This patch fixes the initialization of the TX mailbox. It is now correctly
initialized as TX_INACTIVE not RX_EMPTY.
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
