Commit graph

562309 commits

Author SHA1 Message Date
Tejun Heo
599c963a0f cgroup_freezer: simplify propagation of CGROUP_FROZEN clearing in freezer_attach()
If one or more tasks get moved into a frozen css, the frozen state is
cleared up from the destination css so that it can be reasserted once
the migrated tasks are frozen.  freezer_attach() implements this in
two separate steps - clearing CGROUP_FROZEN on the target css while
processing each task and propagating the clearing upwards after the
task loop is done if necessary.

This patch merges the two steps.  Propagation now takes place inside
the task loop.  This simplifies the code and prepares it for the fix
of multi-destination migration.

Signed-off-by: Tejun Heo <tj@kernel.org>
2015-12-03 10:18:21 -05:00
Maxime Ripard
59f0ec231f clk: sunxi: pll2: Fix clock running too fast
Contrary to what the datasheet says, the pre divider doesn't seem to be
incremented by one in the PLL2, but just uses the value from the register,
with 0 being a bypass.

This fixes the audio playing too fast.

Since we now have the same pre-divider flags, and the only difference with
the A10 is the post-divider offset, also remove the structure to just pass
the offset as an argument.

Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Fixes: eb662f8547 ("clk: sunxi: pll2: Add A13 support")
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-12-02 23:27:47 -08:00
Julia Lawall
a8c24724dd phy: cygnus: pcie: add missing of_node_put
for_each_available_child_of_node performs an of_node_get on each iteration,
so a return from the middle of the loop requires an of_node_put.

A simplified version of the semantic patch that finds this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_available_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
*  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
2015-12-03 12:28:23 +05:30
Julia Lawall
39c2b96422 phy: miphy365x: add missing of_node_put
for_each_child_of_node performs an of_node_get on each iteration,
so a return from the middle of the loop requires an of_node_put.

A simplified version of the semantic patch that finds this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
*  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
2015-12-03 12:28:23 +05:30
Julia Lawall
7fd7fa43f4 phy: miphy28lp: add missing of_node_put
for_each_child_of_node performs an of_node_get on each iteration,
so a return from the middle of the loop requires an of_node_put.

A simplified version of the semantic patch that finds this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
*  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
2015-12-03 12:28:23 +05:30
Julia Lawall
f6f31af81c phy: rockchip-usb: add missing of_node_put
for_each_available_child_of_node performs an of_node_get on each iteration,
so a return from the middle of the loop requires an of_node_put.

A simplified version of the semantic patch that finds this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_available_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
*  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
2015-12-03 12:28:23 +05:30
Julia Lawall
d0ca576af2 phy: berlin-sata: add missing of_node_put
for_each_available_child_of_node performs an of_node_get on each iteration,
so a return from the middle of the loop requires an of_node_put.

A simplified version of the semantic patch that finds this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_available_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
*  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Acked-by: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
2015-12-03 12:28:23 +05:30
Julia Lawall
2bb80ccda1 phy: mt65xx-usb3: add missing of_node_put
for_each_child_of_node performs an of_node_get on each iteration,
so a return from the middle of the loop requires an of_node_put.

A simplified version of the semantic patch that finds this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
*  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
2015-12-03 12:28:23 +05:30
Julia Lawall
0b25ff8697 phy: brcmstb-sata: add missing of_node_put
for_each_available_child_of_node performs an of_node_get on each iteration,
so a return from the middle of the loop requires an of_node_put.

A simplified version of the semantic patch that finds this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_available_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
*  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Acked-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
2015-12-03 12:28:23 +05:30
Arnd Bergmann
97dc5bf8d6 phy: sun9i-usb: add USB dependency
The sun9i usb phy driver calls of_usb_get_phy_mode(), which is not
available if USB is disabled:

drivers/built-in.o: In function `sun9i_usb_phy_probe':
:(.text+0x7fb0): undefined reference to `of_usb_get_phy_mode'

This adds a dependency to avoid the randconfig build errors.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 9c3b443026 ("phy: Add driver to support individual USB PHYs on sun9i")
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
2015-12-03 11:55:41 +05:30
Konstantin Khlebnikov
6adc5fd6a1 net/neighbour: fix crash at dumping device-agnostic proxy entries
Proxy entries could have null pointer to net-device.

Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
Fixes: 84920c1420 ("net: Allow ipv6 proxies and arp proxies be shown with iproute2")
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-03 00:07:51 -05:00
Marcelo Ricardo Leitner
cacc062152 sctp: use GFP_USER for user-controlled kmalloc
Dmitry Vyukov reported that the user could trigger a kernel warning by
using a large len value for getsockopt SCTP_GET_LOCAL_ADDRS, as that
value directly affects the value used as a kmalloc() parameter.

This patch thus switches the allocation flags from all user-controllable
kmalloc size to GFP_USER to put some more restrictions on it and also
disables the warn, as they are not necessary.

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 23:39:46 -05:00
Marcelo Ricardo Leitner
38ee8fb67c sctp: convert sack_needed and sack_generation to bits
They don't need to be any bigger than that and with this we start a new
bitfield for tracking association runtime stuff, like zero window
situation.

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 23:39:46 -05:00
Eric Dumazet
45f6fad84c ipv6: add complete rcu protection around np->opt
This patch addresses multiple problems :

UDP/RAW sendmsg() need to get a stable struct ipv6_txoptions
while socket is not locked : Other threads can change np->opt
concurrently. Dmitry posted a syzkaller
(http://github.com/google/syzkaller) program desmonstrating
use-after-free.

Starting with TCP/DCCP lockless listeners, tcp_v6_syn_recv_sock()
and dccp_v6_request_recv_sock() also need to use RCU protection
to dereference np->opt once (before calling ipv6_dup_options())

This patch adds full RCU protection to np->opt

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 23:37:16 -05:00
Alexei Starovoitov
01b3f52157 bpf: fix allocation warnings in bpf maps and integer overflow
For large map->value_size the user space can trigger memory allocation warnings like:
WARNING: CPU: 2 PID: 11122 at mm/page_alloc.c:2989
__alloc_pages_nodemask+0x695/0x14e0()
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82743b56>] dump_stack+0x68/0x92 lib/dump_stack.c:50
 [<ffffffff81244ec9>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:460
 [<ffffffff812450f9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:493
 [<     inline     >] __alloc_pages_slowpath mm/page_alloc.c:2989
 [<ffffffff81554e95>] __alloc_pages_nodemask+0x695/0x14e0 mm/page_alloc.c:3235
 [<ffffffff816188fe>] alloc_pages_current+0xee/0x340 mm/mempolicy.c:2055
 [<     inline     >] alloc_pages include/linux/gfp.h:451
 [<ffffffff81550706>] alloc_kmem_pages+0x16/0xf0 mm/page_alloc.c:3414
 [<ffffffff815a1c89>] kmalloc_order+0x19/0x60 mm/slab_common.c:1007
 [<ffffffff815a1cef>] kmalloc_order_trace+0x1f/0xa0 mm/slab_common.c:1018
 [<     inline     >] kmalloc_large include/linux/slab.h:390
 [<ffffffff81627784>] __kmalloc+0x234/0x250 mm/slub.c:3525
 [<     inline     >] kmalloc include/linux/slab.h:463
 [<     inline     >] map_update_elem kernel/bpf/syscall.c:288
 [<     inline     >] SYSC_bpf kernel/bpf/syscall.c:744

To avoid never succeeding kmalloc with order >= MAX_ORDER check that
elem->value_size and computed elem_size are within limits for both hash and
array type maps.
Also add __GFP_NOWARN to kmalloc(value_size | elem_size) to avoid OOM warnings.
Note kmalloc(key_size) is highly unlikely to trigger OOM, since key_size <= 512,
so keep those kmalloc-s as-is.

Large value_size can cause integer overflows in elem_size and map.pages
formulas, so check for that as well.

Fixes: aaac3ba95e ("bpf: charge user for creation of BPF maps and programs")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 23:36:00 -05:00
David S. Miller
a64f3f8350 Merge branch 'mvneta-fixes'
Marcin Wojtas says:

====================
Marvell Armada XP/370/38X Neta fixes

I'm sending v4 with corrected commit log of the last patch, in order to
avoid possible conflicts between the branches as suggested by Gregory
Clement.

Best regards,
Marcin Wojtas

Changes from v4:
* Correct commit log of patch 6/6

Changes from v2:
* Style fixes in patch updating mbus protection
* Remove redundant stable notifications except for patch 4/6

Changes from v1:
* update MBUS windows access protection register once, after whole loop
* add fixing value of MVNETA_RXQ_INTR_ENABLE_ALL_MASK
* add fixing error path for skb_build()
* add possibility of setting custom TX IP checksum limit in DT property
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 23:35:22 -05:00
Marcin Wojtas
c4a25007cf mvebu: dts: enable IP checksum with jumbo frames for Armada 38x on Port0
The Ethernet controller found in the Armada 38x SoC's family support
TCP/IP checksumming with frame sizes larger than 1600 bytes, however
only on port 0.

This commit enables it by setting 'tx-csum-limit' to 9800B in
'ethernet@70000' node.

Signed-off-by: Marcin Wojtas <mw@semihalf.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 23:35:05 -05:00
Marcin Wojtas
9110ee0776 net: mvneta: enable setting custom TX IP checksum limit
Since Armada 38x SoC can support IP checksum for jumbo frames only on
a single port, it means that this feature should be enabled per-port,
rather than for the whole SoC.

This patch enables setting custom TX IP checksum limit by adding new
optional property to the mvneta device tree node. If not used, by
default 1600B is set for "marvell,armada-370-neta" and 9800B for other
strings, which ensures backward compatibility. Binding documentation
is updated accordingly.

Signed-off-by: Marcin Wojtas <mw@semihalf.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 23:35:05 -05:00
Marcin Wojtas
26c17a179f net: mvneta: fix error path for building skb
In the actual RX processing, there is same error path for both descriptor
ring refilling and building skb fails. This is not correct, because after
successful refill, the ring is already updated with newly allocated
buffer. Then, in case of build_skb() fail, hitherto code left the original
buffer unmapped.

This patch fixes above situation by swapping error check of skb build with
DMA-unmap of original buffer.

Signed-off-by: Marcin Wojtas <mw@semihalf.com>
Acked-by: Simon Guinot <simon.guinot@sequanux.org>
Cc: <stable@vger.kernel.org> # v4.2+
Fixes a84e328941 ("net: mvneta: fix refilling for Rx DMA buffers")
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 23:35:05 -05:00
Marcin Wojtas
dc1aadf6f1 net: mvneta: fix bit assignment for RX packet irq enable
A value originally defined in the driver was inappropriate. Even though
the ingress was somehow working, writing MVNETA_RXQ_INTR_ENABLE_ALL_MASK
to MVNETA_INTR_ENABLE didn't make any effect, because the bits [31:16]
are reserved and read-only.

This commit updates MVNETA_RXQ_INTR_ENABLE_ALL_MASK to be compliant with
the controller's documentation.

Signed-off-by: Marcin Wojtas <mw@semihalf.com>

Fixes: c5aff18204 ("net: mvneta: driver for Marvell Armada 370/XP network
unit")
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 23:35:05 -05:00
Marcin Wojtas
e5bdf689d3 net: mvneta: fix bit assignment in MVNETA_RXQ_CONFIG_REG
MVNETA_RXQ_HW_BUF_ALLOC bit which controls enabling hardware buffer
allocation was mistakenly set as BIT(1). This commit fixes the assignment.

Signed-off-by: Marcin Wojtas <mw@semihalf.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@free-electrons.com>

Fixes: c5aff18204 ("net: mvneta: driver for Marvell Armada 370/XP network
unit")
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 23:35:04 -05:00
Marcin Wojtas
db6ba9a537 net: mvneta: add configuration for MBUS windows access protection
This commit adds missing configuration of MBUS windows access protection
in mvneta_conf_mbus_windows function - a dedicated variable for that
purpose remained there unused since v3.8 initial mvneta support. Because
of that the register contents were inherited from the bootloader.

Signed-off-by: Marcin Wojtas <mw@semihalf.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@free-electrons.com>

Fixes: c5aff18204 ("net: mvneta: driver for Marvell Armada 370/XP network
unit")
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 23:35:04 -05:00
Linus Torvalds
e69be8c2de spi: Fixes for v4.4
There's one fix for the core here, we weren't reinitialising the actual
 transferred length in messages when they get reused which meant that
 we'd just keep adding to the length if a message is reused.  This has
 limited impact since it's only used in error handling cases but will
 really mess anything that tries to use it up when it triggers.
 
 As ever there's a small collection of driver specific fixes too.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJWXaUPAAoJECTWi3JdVIfQLPAH/1A6xgPcS2HnBu43ezzQu9JY
 gd22gYN1+klyKhOzWv86zG0vbT/sVo2YCTb8nbnGfMCc5ghwlxF1fl2mCVXRTr2F
 7dP2n43TmTNsuXQjO4tv2iJTkCXXuhoEr3DTrOu3+ywm+HNn1gUPgOl0i7zZpuIJ
 AcQ0uuh33k5nQW3elj/gFcdjlVdHIq5oNpP4JBJeOn+ijsd/6DzVyW+TBiGnImWX
 50XCuM+gUvj762y77T3rgORkWwkmJSQIjV+TNKXD/hIDvVWQK9OvtyMpGBOTe7nH
 emEiy7BJnVIdpknUUVf0ZqjNpprxpLwU+ryQhVC9orP0dL64GlsbPkFOtIgxkDs=
 =NlLa
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v4.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "There's one fix for the core here, we weren't reinitialising the
  actual transferred length in messages when they get reused which meant
  that we'd just keep adding to the length if a message is reused.  This
  has limited impact since it's only used in error handling cases but
  will really mess anything that tries to use it up when it triggers.

  As ever there's a small collection of driver specific fixes too"

* tag 'spi-fix-v4.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: bugfix: spi_message.transfer_length does not get reset
  spi: pl022: handle EPROBE_DEFER for dma
  spi: bcm63xx: use correct format string for printing a resource
  spi: mediatek: single device does not require cs_gpios
  spi: Add missing kerneldoc description for parameter
2015-12-02 16:45:56 -08:00
Charles Keepax
1cf44efa1e Input: arizona-haptic - fix disabling of haptics device
A small copy and paste error was preventing the haptics device being
disabled. This patch corrects the value written on disable.

Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2015-12-02 16:22:11 -08:00
Will Deacon
40ee068ec0 ARM: 8465/1: mm: keep reserved ASIDs in sync with mm after multiple rollovers
Under some unusual context-switching patterns, it is possible to end up
with multiple threads from the same mm running concurrently with
different ASIDs:

1. CPU x schedules task t with mm p containing ASID a and generation g
   This task doesn't block and the CPU doesn't context switch.
   So:
     * per_cpu(active_asid, x) = {g,a}
     * p->context.id = {g,a}

2. Some other CPU generates an ASID rollover. The global generation is
   now (g + 1). CPU x is still running t, with no context switch and
   so per_cpu(reserved_asid, x) = {g,a}

3. CPU y schedules task t', which shares mm p with t. The generation
   mismatches, so we take the slowpath and hit the reserved ASID from
   CPU x. p is then updated so that p->context.id = {g + 1,a}

4. CPU y schedules some other task u, which has an mm != p.

5. Some other CPU generates *another* CPU rollover. The global
   generation is now (g + 2). CPU x is still running t, with no context
   switch and so per_cpu(reserved_asid, x) = {g,a}.

6. CPU y once again schedules task t', but now *fails* to hit the
   reserved ASID from CPU x because of the generation mismatch. This
   results in a new ASID being allocated, despite the fact that t is
   still running on CPU x with the same mm.

Consequently, TLBIs (e.g. as a result of CoW) will not be synchronised
between the two threads.

This patch fixes the problem by updating all of the matching reserved
ASIDs when we hit on the slowpath (i.e. in step 3 above). This keeps
the reserved ASIDs in-sync with the mm and avoids the problem.

Cc: <stable@vger.kernel.org>
Reported-by: Tony Thompson <anthony.thompson@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2015-12-02 23:57:54 +00:00
Srinivas Pandruvada
69030dd1c3 cpufreq: use last policy after online for drivers with ->setpolicy
For cpufreq drivers which use setpolicy interface, after offline->online
the policy is set to default. This can be reproduced by setting the
default policy of intel_pstate or longrun to ondemand and then change to
"performance". After offline and online, the setpolicy will be called with
the policy=ondemand.

For drivers using governors this condition is handled by storing
last_governor, during offline and restoring during online. The same should
be done for drivers using setpolicy interface. Storing last_policy during
offline and restoring during online.

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2015-12-02 23:50:33 +01:00
Johannes Berg
c1df932c05 mac80211: fix off-channel mgmt-tx uninitialized variable usage
In the last change here, I neglected to update the cookie in one code
path: when a mgmt-tx has no real cookie sent to userspace as it doesn't
wait for a response, but is off-channel. The original code used the SKB
pointer as the cookie and always assigned the cookie to the TX SKB in
ieee80211_start_roc_work(), but my change turned this around and made
the code rely on a valid cookie being passed in.

Unfortunately, the off-channel no-wait TX path wasn't assigning one at
all, resulting in an uninitialized stack value being used. This wasn't
handed back to userspace as a cookie (since in the no-wait case there
isn't a cookie), but it was tested for non-zero to distinguish between
mgmt-tx and off-channel.

Fix this by assigning a dummy non-zero cookie unconditionally, and get
rid of a misleading comment and some dead code while at it. I'll clean
up the ACK SKB handling separately later.

Fixes: 3b79af973c ("mac80211: stop using pointers as userspace cookies")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-12-02 22:27:53 +01:00
Antonio Quartulli
4e39ccac0d mac80211: do not actively scan DFS channels
DFS channels should not be actively scanned as we can't be sure
if we are allowed or not.

If the current channel is in the DFS band, active scan might be
performed after CSA, but we have no guarantee about other channels,
therefore it is safer to prevent active scanning at all.

Cc: stable@vger.kernel.org
Signed-off-by: Antonio Quartulli <antonio@open-mesh.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-12-02 22:27:53 +01:00
Eliad Peller
835112b289 mac80211: don't teardown sdata on sdata stop
Interfaces are being initialized (setup) on addition,
and torn down on removal.

However, p2p device is being torn down when stopped,
resulting in the next p2p start operation being done
on uninitialized interface.

Solve it by calling ieee80211_teardown_sdata() only
on interface removal (for the non-netdev case).

Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
[squashed in fix to call teardown after unregister]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-12-02 22:27:27 +01:00
David S. Miller
9f7aec5f56 Merge branch 'thunderx-fixes'
Sunil Goutham says:

====================
thunderx: miscellaneous fixes

This patch series contains fixes for various issues observed
with BGX and NIC drivers.

Changes from v1:
- Fixed comment syle in the first patch of the series
- Removed 'Increase transmit queue length' patch from the series,
  will recheck if it's a driver or system issue and resubmit.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 15:58:51 -05:00
Sunil Goutham
bc69fdfc6c net: thunderx: Enable BGX LMAC's RX/TX only after VF is up
Enable or disable BGX LMAC's RX/TX based on corresponding VF's
status. If otherwise, when multiple LMAC's physical link is up
then packets from all LMAC's whose corresponding VF is not yet
initialized will get forwarded to VF0. This is due to VNIC's default
configuration where CPI, RSSI e.t.c point to VF0/QSET0/RQ0.

This patch will prevent multiple copies of packets on VF0.

Signed-off-by: Sunil Goutham <sgoutham@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 15:58:50 -05:00
Sunil Goutham
0b72a9a106 net: thunderx: Switchon carrier only upon interface link up
Call netif_carrier_on() only if interface's link is up. Switching this on
upon IFF_UP by default, is causing issues with ethernet channel bonding
in LACP mode. Initial NETDEV_CHANGE notification was being skipped.

Also fixed some issues with link/speed/duplex reporting via ethtool.

Signed-off-by: Sunil Goutham <sgoutham@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 15:58:50 -05:00
Sunil Goutham
006394a7cb net: thunderx: Set CQ timer threshold properly
Properly set CQ timer threshold and also set it to 2us.
With previous incorrect settings it was set to 0.5us which is too less.

Signed-off-by: Sunil Goutham <sgoutham@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 15:58:50 -05:00
Thanneeru Srinivasulu
a7b1f535a8 net: thunderx: Wait for delayed work to finish before destroying it
While VNIC or BGX driver teardown, wait for already scheduled delayed work to
finish before destroying it.

Signed-off-by: Thanneeru Srinivasulu <tsrinivasulu@caviumnetworks.com>
Signed-off-by: Sunil Goutham <sgoutham@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 15:58:50 -05:00
Thanneeru Srinivasulu
723cda5b05 net: thunderx: Force to load octeon-mdio before bgx driver.
Signed-off-by: Thanneeru Srinivasulu <tsrinivasulu@caviumnetworks.com>
Signed-off-by: Sunil Goutham <sgoutham@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 15:58:49 -05:00
Nicolai Hähnle
07df04dfcf drm/amdgpu: fix race condition in amd_sched_entity_push_job
As soon as we leave the spinlock after the job has been added to the job
queue, we can no longer rely on the job's data to be available.

I have seen a null-pointer dereference due to sched == NULL in
amd_sched_wakeup via amd_sched_entity_push_job and
amd_sched_ib_submit_kernel_helper. Since the latter initializes
sched_job->sched with the address of the ring scheduler, which is
guaranteed to be non-NULL, this race appears to be a likely culprit.

Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
Bugzilla: https://bugs.freedesktop.org/attachment.cgi?bugid=93079
Reviewed-by: Christian König <christian.koenig@amd.com>
2015-12-02 15:04:04 -05:00
Chunming Zhou
e2f784fa8a drm/amdgpu: add err check for pin userptr
Missing error check if the operation failed.

Signed-off-by: Chunming Zhou <David1.Zhou@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
2015-12-02 15:03:54 -05:00
Bart Van Assche
e619e6cbec Revert "scsi: Fix a bdi reregistration race"
The SCSI sd driver probes SCSI devices asynchronously. The sd_remove()
function, called indirectly by device_del(), waits until asynchronous
probing has finished. Since the block layer queue must only be cleaned
up after probing has finished, device_del() has to be called before
blk_cleanup_queue(). Hence revert commit bf2cf3baa2.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
2015-12-02 11:53:44 -08:00
Linus Torvalds
25364a9e54 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
Pull HID fixes from Jiri Kosina:
 - regression fix for hid-lg driver from Benjamin Tissoires
 - quirk for Logitech G710+ from Jimmy Berry

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: lg: restrict filtering out of first interface to G29 only
  HID: usbhid: add Logitech G710+ keyboard quirk NOGET
2015-12-02 11:05:34 -08:00
Linus Torvalds
357436af49 These are some v4.4 pin control fixes:
- Drop a redundant if-clause from Kconfig
 
 - Fix a missing of_node_put() memory leak in the
   Freescale i.MX driver
 
 - Fix 64bit compilation of the Qualcomm SSBI driver.
 
 - Fix a logic inversion in the Mediatek driver.
 
 - Fix a compilation error for the odd one off in the
   Super-H instance of the SH PFC driver.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJWXv4gAAoJEEEQszewGV1zl0AQAMljInkraH4CGdP7i3ynPYjn
 BIDzbm6Hbgn89KTodYvwmufTvDsIcmMY8eIsm+LfaavHRhc3/ddznsIB1ow6MzAr
 uwDtUSGvVw/lBnbsXAQw41at1fOihTZfeIgrXL1uhBL1TX7gKFthRbKp73hiCUnk
 RkrwLu/vt1YbTFRbLW6PymV/9zNyV5Cm9iimfwlTRft3wmzs1gYD5w5s9b7grtNm
 lCL1h+HBawuv+RSSqgHohc3zXqAkI+PfU1WZWpseIEZt5QfZ/31ogFvG/9bA0Ifq
 WAc0cHDF7sPnv8jHNeJ4O0g2Kg8vyqeyfkDP2qREv2QmmNv0FF0o/HEGV9Efc6lL
 hPQeOxcew7OKhJ+vTy/SA/wIlrZmbqk3Mw3j8yxoezuQAuQ5qGJqeLkWhMWrOsXr
 UixxMBFhMW2BuNs9JScTm5+mUAf8t+nRY8dqEKdRlLReOy1FJ0Yd7ZJh+vBpMqmf
 R7uh2DUsNrzwUfcF4XjGcb3wuEOECwW76CcOznCSPrG7XB3+nQG78Ia63IC4CfPs
 9+CzGQWBVDZziSgKDsaNzBSyE4Ipfn2dxdBLRDuUU/lwg368Xp8Ac2vzyiMdOXi1
 FIB/00U8dEBC7Nn2q/cumO+pVbYVjdzu51NsBR5QQHez7e3d+DlTumcOftEe7iTp
 t6BXUesJY0rUmDLZtjf4
 =f61M
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v4.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pincontrol fixes from Linus Walleij:
 "These are some v4.4 pin control fixes:

   - Drop a redundant if-clause from Kconfig
   - Fix a missing of_node_put() memory leak in the Freescale i.MX
     driver
   - Fix 64bit compilation of the Qualcomm SSBI driver.
   - Fix a logic inversion in the Mediatek driver.
   - Fix a compilation error for the odd one off in the Super-H instance
     of the SH PFC driver"

* tag 'pinctrl-v4.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: sh-pfc: sh7734: Add missing cfg macro parameter to fix build
  pinctrl: mediatek: Add get_direction support.
  pinctrl: fix qcom ssbi drivers for 64-bit compilation
  pinctrl: imx1-core: add missing of_node_put
  pinctrl: remove redundant if conditional from Kconfig
2015-12-02 11:00:05 -08:00
Linus Torvalds
79e63f50c2 Some GPIO fixes for the v4.4 series:
- Fix a bunch of possible NULL references found by Coccinelle
   jockeys.
 - Stop creating Tegra's debugfs on everything and it's dog.
   This is an ARM multiplatform kernel issue.
 - Fix an oops in gpiolib for NULL names on named GPIOs.
 - Fix a complex OMAP1 bug in the OMAP driver.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJWXvnbAAoJEEEQszewGV1z4yAQAMu8FON3frlLkXdgAs3CSl1v
 sBbtcI9T0Mda9cp78rUAo2diP5EnI13wRiQDCsf/9LI85//cE4fVXDIES6AEgrvf
 CV6VAI5XONKhN2o0DDRqCiIYNLG22GDH1B4Z0w77q0pr/aUavGJex9Jb9Cp36yUR
 qERPgEdtbTqdI3RnzatBTwNB4j23NMb5sa7A8X3H6Fe+e3ieEuQiYmBdQqhoF8zV
 f3l/EaU8TDS7Zm2CGGlB79jHmHqTpJ4/3qmMbaR0pQfO1MftRRS4xuS8ca73Qjt8
 tc2uL20Z724H+2nGc2UZfmDkAL50KyWKRHPGYMVkJAlxEqeWqy4+9OQZC17YnedA
 JemVFfdpLBhObCXHhrwwL9uif0ViPW+IB/RfCJ0h8ta0w5VsxHAeOD4l1v28vALX
 kp4bAQExXU2pLDPlerCvXHDurJpESJDihFloII75brww+3xsaLiodhNLGiDlfctS
 OD1Eskm+3Lk8w7pDrEdsMK209F8T4Vfvu6/8qoyQmFf4fHgWm4y7+vPn5fNWRB9H
 qZPmveCqi8EF75lIQF5/+OliqMlFMKFGe+HrBNP9kmn3LBuI0u2+vjIHuOU8pr6m
 quwKgjzaWWwltyXwptl2CZFPz45cvAKiykVWKjIWuvC3leeoGdgV/OPJ8uZca42b
 F+8dRp/ppHkhN84pZl3d
 =aggl
 -----END PGP SIGNATURE-----

Merge tag 'gpio-v4.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio

Pull GPIO fixes from Linus Walleij:
 "Some GPIO fixes for the v4.4 series:

   - Fix a bunch of possible NULL references found by Coccinelle
     jockeys.
   - Stop creating Tegra's debugfs on everything and its dog.  This is
     an ARM multiplatform kernel issue.
   - Fix an oops in gpiolib for NULL names on named GPIOs.
   - Fix a complex OMAP1 bug in the OMAP driver"

* tag 'gpio-v4.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpio: omap: drop omap1 mpuio specific irq_mask/unmask callbacks
  gpiolib: fix oops, if gpio name is NULL
  gpio-tegra: Do not create the debugfs entry by default
  gpio: palmas: fix a possible NULL dereference
  gpio: syscon: fix a possible NULL dereference
  gpio: 74xx: fix a possible NULL dereference
2015-12-02 10:54:03 -08:00
Joe Thornber
993ceab919 dm thin metadata: fix bug in dm_thin_remove_range()
dm_btree_remove_leaves() only unmaps a contiguous region so we need a
loop, in __remove_range(), to handle ranges that contain multiple
regions.

A new btree function, dm_btree_lookup_next(), is introduced which is
more efficiently able to skip over regions of the thin device which
aren't mapped.  __remove_range() uses dm_btree_lookup_next() for each
iteration of __remove_range()'s loop.

Also, improve description of dm_btree_remove_leaves().

Fixes: 6550f075 ("dm thin metadata: add dm_thin_remove_range()")
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org # 4.1+
2015-12-02 13:26:49 -05:00
Mike Snitzer
30ce6e1cc5 dm btree: fix leak of bufio-backed block in btree_split_sibling error path
The block allocated at the start of btree_split_sibling() is never
released if later insert_at() fails.

Fix this by releasing the previously allocated bufio block using
unlock_block().

Reported-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org
2015-12-02 13:20:34 -05:00
Vladis Dronov
8e20cf2bce Input: aiptek - fix crash on detecting device without endpoints
The aiptek driver crashes in aiptek_probe() when a specially crafted USB
device without endpoints is detected. This fix adds a check that the device
has proper configuration expected by the driver. Also an error return value
is changed to more matching one in one of the error paths.

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2015-12-02 09:35:41 -08:00
Dmitry Torokhov
c67566c6a1 Input: atmel_mxt_ts - add generic platform data for Chromebooks
Apparently people are installing generic Linux distributions not only on
Pixels but also on other Chromebooks. Unfortunately on all of them Atmel
parts assigned names ATML0000 and ATML0001, and do not carry any other
configuration data. So let's create generic instance of platform data that
should cover most of them (we assume that they will not be using T100
objects, since with those Google mapped BTN_LEFT onto a different GPIO, so
slightly different keymap would be needed, but I think we used parts with
T100 on ARM devices where we thankfully have DTS and can describe the
devices better).

Tested-by: Rich K <rgkirch@gmail.com>
Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2015-12-02 09:35:40 -08:00
Boris Ostrovsky
de0afc9bde xen: Resume PMU from non-atomic context
Resuming PMU currently triggers a warning from ___might_sleep() (assuming
CONFIG_DEBUG_ATOMIC_SLEEP is set) when xen_pmu_init() allocates GFP_KERNEL
page because we are in state resembling atomic context.

Move resuming PMU to xen_arch_resume() which is called in regular context.
For symmetry move suspending PMU to xen_arch_suspend() as well.

Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Reported-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: <stable@vger.kernel.org> # 4.3
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
2015-12-02 17:17:17 +00:00
Paolo Abeni
83e4bf7a74 openvswitch: properly refcount vport-vxlan module
After 614732eaa1, no refcount is maintained for the vport-vxlan module.
This allows the userspace to remove such module while vport-vxlan
devices still exist, which leads to later oops.

v1 -> v2:
 - move vport 'owner' initialization in ovs_vport_ops_register()
   and make such function a macro

Fixes: 614732eaa1 ("openvswitch: Use regular VXLAN net_device device")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-02 11:50:59 -05:00
Imre Deak
0f5a9be157 drm/i915: take a power domain reference while checking the HDMI live status
There are platforms that don't need the full GMBUS power domain (BXT)
while others do (PCH, VLV/CHV). For optimizing this we would need to add
a new power domain, but it's not clear how much we would benefit given
the short time we hold the reference. So for now let's keep things
simple.

This fixes a regression introduced in
commit 237ed86c69
Author: Sonika Jindal <sonika.jindal@intel.com>
Date:   Tue Sep 15 09:44:20 2015 +0530

   drm/i915: Check live status before reading edid

v2:
- fix commit message, PCH won't take any redundant power resource after
this change (Ville)

Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
[fix commit message in v2 (Imre)]
[Cherry-picked from drm-intel-next-queued 29bb94bb (Imre)]
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1448643329-18675-6-git-send-email-imre.deak@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2015-12-02 16:43:15 +02:00
Imre Deak
8e695444cb drm/i915: add MISSING_CASE to a few port/aux power domain helpers
MISSING_CASE() would have been useful to track down a recent problem in
intel_display_port_aux_power_domain(), so add it there and a few related
helpers. This was also suggested by Ville in his review of the latest
DMC/DC changes, we forgot to address that.

Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Patrik Jakobsson <patrik.jakobsson@linux.intel.com>
[Cherry-picked from drm-intel-next-queued b9fec167 (Imre)]
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1448643329-18675-5-git-send-email-imre.deak@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2015-12-02 16:43:08 +02:00
Imre Deak
88747f133b drm/i915/ddi: fix intel_display_port_aux_power_domain() after HDMI detect
Due to the current sharing of the DDI encoder between DP and HDMI
connectors we can run the DP detection after the HDMI detection has
already set the shared encoder's type. For now solve this keeping the
current behavior and running the detection in this case too. For a proper
solution Ville suggested to split the encoder into an HDMI and DP one, that
can be done as a follow-up.

This issue triggers the WARN in intel_display_port_aux_power_domain() and
was introduced in:
commit 25f78f58e5
Author: Ville Syrjälä <ville.syrjala@linux.intel.com>
Date:   Mon Nov 16 15:01:04 2015 +0100

    drm/i915: Clean up AUX power domain handling

CC: Patrik Jakobsson <patrik.jakobsson@linux.intel.com>
CC: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Patrik Jakobsson <patrik.jakobsson@linux.intel.com>
[Cherry-picked from drm-intel-next-queued 651174a4 (Imre)]
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1448643329-18675-4-git-send-email-imre.deak@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2015-12-02 16:42:56 +02:00