Commit graph

617987 commits

Author SHA1 Message Date
Nicolas Iooss
ae6c33ba6e printk: fix parsing of "brl=" option
Commit bbeddf52ad ("printk: move braille console support into separate
braille.[ch] files") moved the parsing of braille-related options into
_braille_console_setup(), changing the type of variable str from char*
to char**.  In this commit, memcmp(str, "brl,", 4) was correctly updated
to memcmp(*str, "brl,", 4) but not memcmp(str, "brl=", 4).

Update the code to make "brl=" option work again and replace memcmp()
with strncmp() to make the compiler able to detect such an issue.

Fixes: bbeddf52ad ("printk: move braille console support into separate braille.[ch] files")
Link: http://lkml.kernel.org/r/20160823165700.28952-1-nicolas.iooss_linux@m4x.org
Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Cc: Joe Perches <joe@perches.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-08-26 17:39:35 -07:00
Andrea Arcangeli
804dd15046 soft_dirty: fix soft_dirty during THP split
While adding proper userfaultfd_wp support with bits in pagetable and
swap entry to avoid false positives WP userfaults through swap/fork/
KSM/etc, I've been adding a framework that mostly mirrors soft dirty.

So I noticed in one place I had to add uffd_wp support to the pagetables
that wasn't covered by soft_dirty and I think it should have.

Example: in the THP migration code migrate_misplaced_transhuge_page()
pmd_mkdirty is called unconditionally after mk_huge_pmd.

	entry = mk_huge_pmd(new_page, vma->vm_page_prot);
	entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);

That sets soft dirty too (it's a false positive for soft dirty, the soft
dirty bit could be more finegrained and transfer the bit like uffd_wp
will do..  pmd/pte_uffd_wp() enforces the invariant that when it's set
pmd/pte_write is not set).

However in the THP split there's no unconditional pmd_mkdirty after
mk_huge_pmd and pte_swp_mksoft_dirty isn't called after the migration
entry is created.  The code sets the dirty bit in the struct page
instead of setting it in the pagetable (which is fully equivalent as far
as the real dirty bit is concerned, as the whole point of pagetable bits
is to be eventually flushed out of to the page, but that is not
equivalent for the soft-dirty bit that gets lost in translation).

This was found by code review only and totally untested as I'm working
to actually replace soft dirty and I don't have time to test potential
soft dirty bugfixes as well :).

Transfer the soft_dirty from pmd to pte during THP splits.

This fix avoids losing the soft_dirty bit and avoids userland memory
corruption in the checkpoint.

Fixes: eef1b3ba05 ("thp: implement split_huge_pmd()")
Link: http://lkml.kernel.org/r/1471610515-30229-2-git-send-email-aarcange@redhat.com
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Acked-by: Pavel Emelyanov <xemul@virtuozzo.com>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-08-26 17:39:35 -07:00
Subash Abhinov Kasiviswanathan
e7d316a02f sysctl: handle error writing UINT_MAX to u32 fields
We have scripts which write to certain fields on 3.18 kernels but this
seems to be failing on 4.4 kernels.  An entry which we write to here is
xfrm_aevent_rseqth which is u32.

  echo 4294967295  > /proc/sys/net/core/xfrm_aevent_rseqth

Commit 230633d109 ("kernel/sysctl.c: detect overflows when converting
to int") prevented writing to sysctl entries when integer overflow
occurs.  However, this does not apply to unsigned integers.

Heinrich suggested that we introduce a new option to handle 64 bit
limits and set min as 0 and max as UINT_MAX.  This might not work as it
leads to issues similar to __do_proc_doulongvec_minmax.  Alternatively,
we would need to change the datatype of the entry to 64 bit.

  static int __do_proc_doulongvec_minmax(void *data, struct ctl_table
  {
      i = (unsigned long *) data;   //This cast is causing to read beyond the size of data (u32)
      vleft = table->maxlen / sizeof(unsigned long); //vleft is 0 because maxlen is sizeof(u32) which is lesser than sizeof(unsigned long) on x86_64.

Introduce a new proc handler proc_douintvec.  Individual proc entries
will need to be updated to use the new handler.

[akpm@linux-foundation.org: coding-style fixes]
Fixes: 230633d109 ("kernel/sysctl.c:detect overflows when converting to int")
Link: http://lkml.kernel.org/r/1471479806-5252-1-git-send-email-subashab@codeaurora.org
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Ingo Molnar <mingo@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-08-26 17:39:35 -07:00
Joe Perches
8582fb59f7 get_maintainer: quiet noisy implicit -f vcs_file_exists checking
Checking command line filenames that are outside the git tree can emit a
noisy and confusing message.

Quiet that message by redirecting stderr.
Verify that the command was executed successfully.

Fixes: 4cad35a7ca ("get_maintainer.pl: reduce need for command-line option -f")
Link: http://lkml.kernel.org/r/1970a1d2fecb258e384e2e4fdaacdc9ccf3e30a4.1470955439.git.joe@perches.com
Signed-off-by: Joe Perches <joe@perches.com>
Reported-by: Wolfram Sang <wsa@the-dreams.de>
Tested-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-08-26 17:39:34 -07:00
Johannes Berg
101b29a204 byteswap: don't use __builtin_bswap*() with sparse
Although sparse declares __builtin_bswap*(), it can't actually do
constant folding inside them (yet).  As such, things like

  switch (protocol) {
  case htons(ETH_P_IP):
          break;
  }

which we do all over the place cause sparse to warn that it expects a
constant instead of a function call.

Disable __HAVE_BUILTIN_BSWAP*__ if __CHECKER__ is defined to avoid this.

Fixes: 7322dd755e ("byteswap: try to avoid __builtin_constant_p gcc bug")
Link: http://lkml.kernel.org/r/1470914102-26389-1-git-send-email-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-08-26 17:39:34 -07:00
Jiri Pirko
c15e07b02b team: loadbalance: push lacpdus to exact delivery
When team is in bridge and LACP is utilized, LACPDU packets are pushed
to userspace using raw socket and there they are processed. However,
since 8626c56c82, LACPDU skbs are dropped by bridge rx_handler so
they never reach packet handlers in rx path. Fix this by explicity treat
LACPDUs to be pushed to exact delivery in team rx_handler.

Reported-by: Ido Schimmel <idosch@mellanox.com>
Fixes: 8626c56c82 ("bridge: fix potential use-after-free when hook returns QUEUE or STOLEN verdict")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-08-26 13:08:59 -07:00
Colin Ian King
c234af5875 net: hns: dereference ppe_cb->ppe_common_cb if it is non-null
ppe_cb->ppe_common_cb is being dereferenced before a null check is
being made on it.  If ppe_cb->ppe_common_cb is null then we end up
with a null pointer dereference when assigning dsaf_dev.  Fix this
by moving the initialisation of dsaf_dev once we know
ppe_cb->ppe_common_cb is OK to dereference.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Yisen Zhuang <yisen.zhuang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-08-26 11:44:56 -07:00
Eric Ren
079d37df33 dlm: fix malfunction of dlm_tool caused by debugfs changes
With the current kernel, `dlm_tool lockdebug` fails as below:

"dlm_tool lockdebug ED0BD86DCE724393918A1AE8FDBF1EE3
can't open /sys/kernel/debug/dlm/ED0BD86DCE724393918A1AE8FDBF1EE3:
Operation not permitted"

This is because table_open() depends on file->f_op to tell which
seq_file ops should be passed down. But, the original file ops in
file->f_op is replaced by "debugfs_full_proxy_file_operations" with
commit 49d200deaa ("debugfs: prevent access to removed files'
private data").

Currently, I can think up 2 solutions: 1st, replace
debugfs_create_file() with debugfs_create_file_unsafe();
2nd, make different table_open#() accordingly. The 1st one
is neat, but I don't thoroughly understand its risk. Maybe
someone has a better one.

Signed-off-by: Eric Ren <zren@suse.com>
Signed-off-by: David Teigland <teigland@redhat.com>
2016-08-26 13:22:14 -05:00
Javier Martinez Canillas
29617e1cfc MAINTAINERS: Add myself as reviewer for Samsung Exynos support
I've been helping reviewing and testing Exynos SoC support patches
for the last couple of years. But it would be easier for me if I'm
cc'ed for patches, so I'm adding myself as reviewer for this entry.

Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Kukjin Kim <kgene@kernel.org>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2016-08-26 18:38:02 +02:00
Russell King
da60626e7d ARM: sa1100: clear reset status prior to reboot
Clear the current reset status prior to rebooting the platform.  This
adds the bit missing from 04fef228fb ("[ARM] pxa: introduce
reset_status and clear_reset_status for driver's usage").

Fixes: 04fef228fb ("[ARM] pxa: introduce reset_status and clear_reset_status for driver's usage")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
2016-08-26 15:09:24 +01:00
Christophe Jaillet
61a28d2b69 IB/hfi1: Clean up type used and casting
In all other places in this file where 'find_first_bit' is called,
port_num is defined as a 'u8' and no casting is done.

Do the same here in order to be more consistent.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-08-26 10:01:49 -04:00
Shiraz Saleem
b71121b4b7 i40iw: Receive notification events correctly
Device notifications are not received after the first interface is
closed; since there is an unregister for notifications on every
interface close. Correct this by unregistering for device
notifications only when the last interface is closed. Also, make
all operations on the i40iw_notifiers_registered atomic as it
can be read/modified concurrently.

Fixes: 8e06af711b ("i40iw: add main, hdr, status")

Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-08-26 09:59:13 -04:00
Mustafa Ismail
866e0f4d73 i40iw: Update hw_iwarp_state
Update iwqp->hw_iwarp_state to reflect the new state of the CQP
modify QP operation. This avoids reissuing a CQP operation to
modify a QP to a state that it is already in.

Fixes: 4e9042e647 ("i40iw: add hw and utils files")

Reported-by: Stefan Assmann <sassmann@redhat.com>
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-08-26 09:59:13 -04:00
Chen-Yu Tsai
b53e7d000d clocksource/drivers/sun4i: Clear interrupts after stopping timer in probe function
The bootloader (U-boot) sometimes uses this timer for various delays.
It uses it as a ongoing counter, and does comparisons on the current
counter value. The timer counter is never stopped.

In some cases when the user interacts with the bootloader, or lets
it idle for some time before loading Linux, the timer may expire,
and an interrupt will be pending. This results in an unexpected
interrupt when the timer interrupt is enabled by the kernel, at
which point the event_handler isn't set yet. This results in a NULL
pointer dereference exception, panic, and no way to reboot.

Clear any pending interrupts after we stop the timer in the probe
function to avoid this.

Cc: stable@vger.kernel.org
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
2016-08-26 15:56:01 +02:00
Marcin Nowakowski
4d0e701659 drivers/clocksource/pistachio: Fix memory corruption in init
Driver init code incorrectly uses the block base address and as a result
clears clocksource structure's fields instead of the hardware registers.

Commit 09a9982016 ("timekeeping: Lift clocksource cacheline
restriction") has changed the offsets within pistachio_clocksource
structure and what has previously gone unnoticed now leads to a kernel
panic during boot.

Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
2016-08-26 15:55:59 +02:00
Alexandre Belloni
699e36e5b8 clocksource/drivers/timer-atmel-pit: Enable mck clock
mck is needed to get the PIT working. Explicitly prepare_enable it instead
of assuming it is enabled.

This solves an issue where the system is freezing when the ETM/ETB drivers
are enabled.

Reported-by: Olivier Schonken <olivier.schonken@gmail.com>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
2016-08-26 15:55:58 +02:00
Linus Lüssing
1e5d343b8f batman-adv: fix elp packet data reservation
The skb_reserve() call only reserved headroom for the mac header, but
not the elp packet header itself.

Fixing this by using skb_put()'ing towards the skb tail instead of
skb_push()'ing towards the skb head.

Fixes: d6f94d91f7 ("batman-adv: ELP - adding basic infrastructure")
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
2016-08-26 15:22:31 +02:00
Sven Eckelmann
936523441b batman-adv: Add missing refcnt for last_candidate
batadv_find_router dereferences last_bonding_candidate from
orig_node without making sure that it has a valid reference. This reference
has to be retrieved by increasing the reference counter while holding
neigh_list_lock. The lock is required to avoid that
batadv_last_bonding_replace removes the current last_bonding_candidate,
reduces the reference counter and maybe destroys the object in this
process.

Fixes: f3b3d90189 ("batman-adv: add bonding again")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
2016-08-26 15:22:30 +02:00
Gregory CLEMENT
c721da1d05 ARM: dts: kirkwood: Fix PCIe label on OpenRD
While converting PCIe node on kirkwood by using label, the following
commit eb13cf8345 ("ARM: dts: kirkwood: Fixup pcie DT warnings")
introduced a regression on the OpenRD boards: the PCIe didn't work
anymore. As reported by Aaro Koskinen, the display/framebuffer was
lost. This commit adds the forgotten label.

Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Fixes: eb13cf8345 ("ARM: dts: kirkwood: Fixup pcie DT warnings")
Cc: stable@vger.kernel.org
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
2016-08-26 11:33:16 +02:00
Simon Baatz
a778937888 ARM: kirkwood: ib62x0: fix size of u-boot environment partition
Commit 148c274ea6 ("ARM: kirkwood: ib62x0: add u-boot environment
partition") split the "u-boot" partition into "u-boot" and "u-boot
environment".  However, instead of the size of the environment, an offset
was given, resulting in overlapping partitions.

Signed-off-by: Simon Baatz <gmbnomis@gmail.com>
Fixes: 148c274ea6 ("ARM: kirkwood: ib62x0: add u-boot environment partition")
Cc: Jason Cooper <jason@lakedaemon.net>
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Gregory Clement <gregory.clement@free-electrons.com>
Cc: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
Cc: Luka Perkov <luka@openwrt.org>
Cc: stable@vger.kernel.org # 3.13+
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
2016-08-26 11:30:51 +02:00
Mark Rutland
d662ed2e50 bus: arm-ccn: make event groups reliable
The CCN PMU driver leaves the counting logic always enabled, and thus
events are enabled while groups are manipulated. As each event is
stopped and read individually, this leads to arbitrary skew across event
groups, which can be seen if counting several identical events.

To avoid this, implement pmu_{enable,disable} callbacks to stop and
start all counters atomically around event manipulation. As the counters
are now stopped, we cannot poll the cycle counter to wait for events to
drain from the bus. However, as the counters are stopped and the events
will not be read regardless, we can simply allow the bus to drain
naturally.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Pawel Moll <pawel.moll@arm.com>
2016-08-26 09:16:18 +01:00
Mark Rutland
5b1e01f3ce bus: arm-ccn: fix hrtimer registration
The CCN PMU driver has a single hrtimer, used to simulate a periodic
interrupt on systems where the overflow interrupt is not possible to
use. The hrtimer is started when any event is started, and cancelled when
any event is stopped. Thus, stopping a single event is sufficient to
disable to hrtimer, and overflows (of other events) may be lost.

To avoid this, this patch reworks the hrtimer start/cancel to only occur
when the first event is added to a PMU, and the last event removed,
making use of the existing bitmap counting active events.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Pawel Moll <pawel.moll@arm.com>
2016-08-26 09:16:13 +01:00
Mark Rutland
0811ef7e2f bus: arm-ccn: fix PMU interrupt flags
Currently the IRQ core is permitted to make the CCN PMU IRQ handler
threaded, and will allow userspace to change the CPU affinity of the
interrupt behind our back. Both of these could violate our
synchronisation requirements with the core perf code, which relies upon
strict CPU affinity and disabling of interrupts to guarantee mutual
exclusion in some cases.

As with the CPU PMU drivers, we should request the interrupt with
IRQF_NOBALANCING and IRQF_NO_THREAD, to avoid these issues.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Pawel Moll <pawel.moll@arm.com>
Reviewed-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Pawel Moll <pawel.moll@arm.com>
2016-08-26 09:16:07 +01:00
Brian Foster
800b2694f8 xfs: prevent dropping ioend completions during buftarg wait
xfs_wait_buftarg() waits for all pending I/O, drains the ioend
completion workqueue and walks the LRU until all buffers in the cache
have been released. This is traditionally an unmount operation` but the
mechanism is also reused during filesystem freeze.

xfs_wait_buftarg() invokes drain_workqueue() as part of the quiesce,
which is intended more for a shutdown sequence in that it indicates to
the queue that new operations are not expected once the drain has begun.
New work jobs after this point result in a WARN_ON_ONCE() and are
otherwise dropped.

With filesystem freeze, however, read operations are allowed and can
proceed during or after the workqueue drain. If such a read occurs
during the drain sequence, the workqueue infrastructure complains about
the queued ioend completion work item and drops it on the floor. As a
result, the buffer remains on the LRU and the freeze never completes.

Despite the fact that the overall buffer cache cleanup is not necessary
during freeze, fix up this operation such that it is safe to invoke
during non-unmount quiesce operations. Replace the drain_workqueue()
call with flush_workqueue(), which runs a similar serialization on
pending workqueue jobs without causing new jobs to be dropped. This is
safe for unmount as unmount independently locks out new operations by
the time xfs_wait_buftarg() is invoked.

cc: <stable@vger.kernel.org>
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
2016-08-26 16:01:59 +10:00
Dave Chinner
f3d7ebdeb2 xfs: fix superblock inprogress check
From inspection, the superblock sb_inprogress check is done in the
verifier and triggered only for the primary superblock via a
"bp->b_bn == XFS_SB_DADDR" check.

Unfortunately, the primary superblock is an uncached buffer, and
hence it is configured by xfs_buf_read_uncached() with:

	bp->b_bn = XFS_BUF_DADDR_NULL;  /* always null for uncached buffers */

And so this check never triggers. Fix it.

cc: <stable@vger.kernel.org>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
2016-08-26 16:01:30 +10:00
Darrick J. Wong
5b5c2dbd3c xfs: simple btree query range should look right if LE lookup fails
If the initial LOOKUP_LE in the simple query range fails to find
anything, we should attempt to increment the btree cursor to see
if there actually /are/ records for what we're trying to find.
Without this patch, a bnobt range query of (0, $agsize) returns
no results because the leftmost record never has a startblock
of zero.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
2016-08-26 16:00:10 +10:00
Darrick J. Wong
722278997b xfs: fix some key handling problems in _btree_simple_query_range
We only need the record's high key for the first record that we look
at; for all records, we /definitely/ need the regular record key.
Therefore, fix how the simple range query function gets its keys.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
2016-08-26 15:59:50 +10:00
Darrick J. Wong
da1f039d69 xfs: don't log the entire end of the AGF
When we're logging the last non-spare field in the AGF, we don't
need to log the spare fields, so plumb in a new AGF logging flag
to help us avoid that.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
2016-08-26 15:59:31 +10:00
Darrick J. Wong
738f57c16a xfs: disallow mounting of realtime + rmap filesystems
Since the kernel doesn't currently support the realtime rmapbt,
don't allow such filesystems to be mounted.  Support will appear
in a future release.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
2016-08-26 15:59:19 +10:00
Darrick J. Wong
ed150e1a5c xfs: don't perform lookups on zero-height btrees
If the caller passes in a cursor to a zero-height btree (which is
impossible), we never set block to anything but NULL, which causes the
later dereference of it to crash.  Instead, just return -EFSCORRUPTED.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
2016-08-26 15:58:40 +10:00
Jon Hunter
0a10e85b6c ARM: tegra: Correct polarity for Tegra114 PMIC interrupt
The ARM GIC only supports interrupts with either level-high or
rising-edge types for SPIs. The interrupt type for the Palmas PMIC used
for Tegra114 boards is specified as level-low which is invalid for the
GIC. This has gone undetected because until recently, failures to set
the interrupt type when the interrupts are mapped via firmware (such as
device-tree) have not been reported. Since commits 4b357daed6
("genirq: Look-up trigger type if not specified by caller") and
1e2a7d7849 ("irqdomain: Don't set type when mapping an IRQ"), failure
to set the interrupt type will cause the requesting of the interrupt to
fail and exposing incorrectly configured interrupts.

Please note that although the interrupt type was never being set for the
Palmas PMIC, it was still working fine, because the default type setting
for the interrupt, 'level-high', happen to match the correct type for
the interrupt.

Finally, it should be noted that the Palmas interrupt from the PMIC is
actually 'level-low', however, this interrupt signal is inverted by the
Tegra PMC and so the GIC actually sees a 'level-high' interrupt which is
what should be specified in the device-tree interrupt specifier.

Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
2016-08-25 17:31:30 -07:00
Olof Johansson
633af91ddb Fix for v4.8-rc1:
1. Select proper eMMC HighSpeed mode on Odroid XU.  DTS was mixing
    "samsung,exynos5250-dw-mshc" compatible (with HS200 as fastest mode)
    with a property "mmc-hs400-1_8v" thus leading to failures during
    probe.
 
 2. Update Krzysztof Kozlowski's email address in maintainers.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJXtVXwAAoJEME3ZuaGi4PXIa4P/3XxkjOP8WEP+yKml5LWKKAo
 PXyskyQjaq44YnXjOIVJTMafnWZ4ElyP66PJAfA3ebqjmnC0zrtdCoh0EvTZ/PVT
 yl4WHkBhJjidoX3jixWRPsKdbzMVgBNYQGVhWYq3kg/dveuem4jqLeqSHiD0ek5l
 nbPa2p6Itg6kNNFc1FFbMXA4zufngN+gCXCtlcxTu4KjudIKmo8m5eIgQbboCyW4
 +tJl9TiymMGDzxmpGNrET3rO/IELAoMor+8b8VbftcZ+H/g1u1srCLp501GEHIO6
 gz5VJpA4RDcuilZ3LNIsIcm8lUVwJ85X+tExCiMlQ8LN2yVZHY0bhL8WJ+k8Z3Z0
 ELFgGQUNTjpqHshPIGOPRximdEuOljFFyxINXzSH4nx0n9F8Vf456Jd4hjAkSY0b
 emwT+PkCOeYORMrWPnTngNOX41Rpf8e7M7Nx9GPgT43ZkBc4d3vrAki1F47yzXJ9
 3uLIBg+n8Vn9XYo2GAYXe590giQzNDy7o8sBUH7rf1b/8urVGn+/21lPKBsJrtPt
 wkkh5/gDWUxbsvZDhpuq0JmVcamQFiouKe6emuuIKfJDhqy2GQ2Swufq4RIkzBIC
 ivSNFiPflU3dPY4tTZOFceo5ckN0/kvpVaKe/1N0mgt5tNcgS/WCbpH7jlOdYDWt
 n5qECo6BvmW7UMtZezqf
 =YvD5
 -----END PGP SIGNATURE-----

Merge tag 'samsung-fixes-4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into fixes

Fix for v4.8-rc1:
1. Select proper eMMC HighSpeed mode on Odroid XU.  DTS was mixing
   "samsung,exynos5250-dw-mshc" compatible (with HS200 as fastest mode)
   with a property "mmc-hs400-1_8v" thus leading to failures during
   probe.

2. Update Krzysztof Kozlowski's email address in maintainers.

* tag 'samsung-fixes-4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
  MAINTAINERS: Switch to kernel.org account for Krzysztof Kozlowski
  ARM: dts: exynos: Properly select eMMC HighSpeed mode on Odroid XU

Signed-off-by: Olof Johansson <olof@lixom.net>
2016-08-25 17:29:32 -07:00
Olof Johansson
1ce3b12f43 The i.MX fixes for 4.8:
- Fix typo in imx6sx-sabreauto board wakeup property
  - Fix i.MX6UL suspend-to-standby support by adding the
    BM_CLPCR_BYP_MMDC_CH0_LPM_HS handling
  - Fix a i.MX6UL regression on suspend support, which is caused by
    commit 850bea2335 ("arm: Remove unnecessary of_platform_populate
    with default match table")
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJXtQNxAAoJEFBXWFqHsHzOO/gH/2o5IuMylmAxWur8jAudSMc2
 qMD42NJwy6z4z4koMd4O7zQIafR2Sm8jOto8Z07ACAZOaUXU0biat2j9iGm6lv7z
 VTgzlWut+pDTfYXwo4MSZjcW3/Xkc2RgZDQCOlwGlLfjhaFjuk8ZEQxetFPtFveN
 5FYoLzmWRRza6PI4I5uu1TrdJXQlq2qihZd+OD7Qa78yuzrvNzHRfGBH7h+4Hkyn
 uCzaTxh6kyIF9ggK5McMjgAwQv8r/wgJ9mLel9scVULv/qxzefHxKbDX+ewHtZ1q
 t3q7q2UpF00Fxd/Wii2BT7p8LNicbHsqorUMGTk81CMVcOeT652z/LO8rx+13+E=
 =Dgm6
 -----END PGP SIGNATURE-----

Merge tag 'imx-fixes-4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes

The i.MX fixes for 4.8:
 - Fix typo in imx6sx-sabreauto board wakeup property
 - Fix i.MX6UL suspend-to-standby support by adding the
   BM_CLPCR_BYP_MMDC_CH0_LPM_HS handling
 - Fix a i.MX6UL regression on suspend support, which is caused by
   commit 850bea2335 ("arm: Remove unnecessary of_platform_populate
   with default match table")

* tag 'imx-fixes-4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  ARM: imx6ul: populates platform device at .init_machine
  ARM: imx6: add missing BM_CLPCR_BYP_MMDC_CH0_LPM_HS setting for imx6ul
  ARM: dts: imx6sx-sabreauto: Fix misspelled property

Signed-off-by: Olof Johansson <olof@lixom.net>
2016-08-25 17:21:37 -07:00
Masahiro Yamada
becc8d3ccd MAINTAINERS: add tree entry for ARM/UniPhier architecture
Add T: entry for a new git tree, which I expect UniPhier SoC
updates will be pulled from.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
2016-08-25 17:18:34 -07:00
Olof Johansson
fd03819797 Fixes for omaps for v4.8-rc cycle, mostly a series of four fixes for
am335x RTC zero offset for clkctrl register. Also few other fixes:
 
 - Add missing sysc information for DSI as at least n950 needs it for
   the working display
 
 - Fix old elm-id properties that cause nand boot to not work
 
 - Fix overo gpmc nand cs0 range
 
 - FIx overo gpmc nand on boards with ethernet
 
 - Fix logicpd torpedo nand ready pin nand interrupt configuration
 -----BEGIN PGP SIGNATURE-----
 
 iQIuBAABCAAYBQJXszT8ERx0b255QGF0b21pZGUuY29tAAoJEBvUPslcq6Vzyg4Q
 AI2ZbM7Ot6c7jlGfp00rrheCNg83FdDqOP4tLb2MUjzJng564tJgcvLOV6eVo/uR
 1DXGZeK+faWJUxnHNiSviLMzUZfMgiYQtlZAAo8AC9B2PBFC8/2KRWCjN4IvnQhT
 hFeBW6xmwEMeQIYszLFHBwQFvR9pNQs+pXQeehRkQRZjFCVWmZCJpa2vjt8NH/1M
 Vcz7sl9/a741hD/VUIQYndTv9rbVSsxrTbIj3qNYEFVKp85Zl3dMHaCY/16pFbQ1
 SyZhJUw7NSP6wzokmmftXzpWpvIsC19DmlpEiBE+FncDMzXID5WaoPSkiQpAylW9
 x6nVAP51cNndNQR/ZTTQOkCjJPH+ApCnPGbkGwHDuJKgEQ4BCMV97So1Bibz33HK
 T8nQ5nLBul1IDQgys92PH0UHJGV71Y2pebboPdV60qn9zoQF1y8wTaShMPTh7MJs
 8fpCklyt7XwX0T7BLhxNaH1lDkqXQjz2GamQHC1+4njog9Z/GZ1r43GEdQAH7Z6w
 ahjasGiRJa0pQDhR3E04tOmPW34qUdJw7/o3mRTSY7v1yH1mBD7lw9jvC/K2zxFG
 6ZlsOmCJ9os6B+fjyZgfnPcmvb554LBGLN9ac7ammtG3V8K2dEf63LUNCnpJy3kK
 MUJHiU3HFhr6v1hUd8QVGNhhOQJmURCXbONWGAHiualI
 =P5mg
 -----END PGP SIGNATURE-----

Merge tag 'omap-for-v4.8/fixes-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

Fixes for omaps for v4.8-rc cycle, mostly a series of four fixes for
am335x RTC zero offset for clkctrl register. Also few other fixes:

- Add missing sysc information for DSI as at least n950 needs it for
  the working display

- Fix old elm-id properties that cause nand boot to not work

- Fix overo gpmc nand cs0 range

- FIx overo gpmc nand on boards with ethernet

- Fix logicpd torpedo nand ready pin nand interrupt configuration

* tag 'omap-for-v4.8/fixes-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: dts: logicpd-somlv: Fix NAND device nodes
  ARM: dts: logicpd-torpedo-som: Provide NAND ready pin
  ARM: dts: overo: fix gpmc nand on boards with ethernet
  ARM: dts: overo: fix gpmc nand cs0 range
  ARM: dts: am335x: Update elm phandle binding
  ARM: OMAP4+: CM: Remove redundant checks for clkctrl_offs of zero
  ARM: OMAP4+: Have _omap4_wait_target_* check for valid clkctrl_offs
  ARM: OMAP2+: AM33XX: Add HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET flag to rtc hwmod
  ARM: OMAP4+: hwmod: Add hwmod flag for HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET
  ARM: OMAP3: hwmod data: Add sysc information for DSI

Signed-off-by: Olof Johansson <olof@lixom.net>
2016-08-25 17:12:23 -07:00
Gao Feng
b628d611a2 8139cp: Fix one possible deadloop in cp_rx_poll
When cp_rx_poll does not get enough packet, it will check the rx
interrupt status again. If so, it will jumpt to rx_status_loop again.
But the goto jump resets the rx variable as zero too.

As a result, it causes one possible deadloop. Assume this case,
rx_status_loop only gets the packet count which is less than budget,
and (cpr16(IntrStatus) & cp_rx_intr_mask) condition is always true.
It causes the deadloop happens and system is blocked.

Signed-off-by: Gao Feng <fgao@ikuai8.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-08-25 17:02:48 -07:00
Olof Johansson
8184a34f11 SCPI/Vexpress fixes for v4.8-rc
Couple of minor fixes to add missing of_node_put after calling
 of_parse_phandle in SCPI and vexpress-config bus drivers(Peter Chen)
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJXqIqeAAoJEABBurwxfuKYBhcP/2eEbbxpdAFwRGa9qLciVzAB
 LErQWjzKlYmCdryCWGr2pu2bDbnzMd/1P/UrV4URApjpbElYTC1jNb/p1btmXoxn
 orQIEFN62auTbhmXKCXGiI8pKpsj0GYKI3PVglwRMf6eP2nWSPDgQzzZ5KMOVqpp
 IiPChMCWWR9Or30DnIOMNYyR3hdMnNfF7VINeWrr8Pq55QKnWftBwST0PUO9u+o7
 I8dN2S/fz39MSui+8cjhbQ15FeHlv8isIe0mlVflAl8BN4yUP7gEDsRxNc2LZK1H
 Vo14yza6yMJyociPsrNhVtBgvvM/G+Ic1n1XluSWOLUwqmLOlLozbhVdnWjNTuGY
 yf9tJGyTwXYPZV6grrD0XaKwZCwIdEGw22C36epxrMzsMR6jFodlpMbj6sKLvE7w
 tME7n9k/wqKkIbtLrn5Nr4fYnRvwAse/lHsxRUGEmxq6UZoCfswiwtkay4Rvv3Pr
 bdOp/Dg9Bj++FS6BBJrL9OhU5QvdXw4Oug/3x7l5oH9LWdlKxeArIo57lsw3G4RX
 Q4PfAICXdEoPoWmJdP0+k0Y4ZFV3gjIEwvJxqu2rbtAXoyIHyeZu1SgbEhx/uZ23
 igl52wFeY0UYXanFbHHqx9ZQVHuMWkS7DbcNssO4JK1Py4QQB6PBDfySFDSFgXwI
 SDf1SAYi2tdch/ieLeRb
 =B6NO
 -----END PGP SIGNATURE-----

Merge tag 'vexpress-fixes-4.8-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into fixes

SCPI/Vexpress fixes for v4.8-rc

Couple of minor fixes to add missing of_node_put after calling
of_parse_phandle in SCPI and vexpress-config bus drivers(Peter Chen)

* tag 'vexpress-fixes-4.8-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_scpi: add missing of_node_put after calling of_parse_phandle
  bus: vexpress-config: add missing of_node_put after calling of_parse_phandle

Signed-off-by: Olof Johansson <olof@lixom.net>
2016-08-25 17:00:10 -07:00
Anjali Singhai Jain
f38ff2ee77 i40e: Change some init flow for the client
This change makes a common flow for Client instance open during init
and reset path. The Client subtask can handle both the cases instead of
making a separate notify_client_of_open call.
Also it may fix a bug during reset where the service task was leaking
some memory and causing issues.

Change-Id: I7232a32fd52b82e863abb54266fa83122f80a0cd
Signed-off-by: Anjali Singhai Jain <anjali.singhai@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-08-25 16:59:30 -07:00
Olof Johansson
84ba04f26d OMAP-GPMC: fixes for v4.8-rc1
* Allow other children of GPMC to probe even if any child fails.
 This fixes problem on Overo boards where networking device child
 doesn't probe due to broken NAND child.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJXraKzAAoJENJaa9O+djCTq8QP/RIj9TnKQr3Plc7yD0dJ03kH
 YU4ChBW8pfcxdhnflx4GBxD19k2kp4UJmhDi/H7u+tlXS+OEf7X6EdoYHAqnfi0+
 4E3Ai2Frzi++nZATCsJ4Nj8XaGVzAj4tmjvgx4ktNpbvU4UnmhUVBMEhtNJ3y5sC
 BQrOHAHlsmq44+Ko9vphmaRpnQzt4EgbTxn6yc07SWqjwCskIcOB98xTlC4uaKOX
 ozksRwoGB6BDmNYlzYZFry1ebvaTXa4/K/ymxwmmB3yhL9eCV4Qhg6JHEYnuw0sv
 HyqId34AjS3YUf3zHMtTgRCVjg/iewZSfgLBFNyxp0LZpGzgYiVuOffbiPwRRa2C
 0ciDFMKjhF264ztrl+k/OhG6FxEO96Wqx5eXtcifmR9AG7SHzW2k5aE5XLZogjc3
 cgmWK0QEJ2R1RCmOJ09/c+ap/ap4iwq9rtdu6jSEO737w0mrgLuchkF6DCUVw6j9
 k4CAW16TmJiPqJy3eDkJbTxyZovXT5zgPabuHVtOXWEkxeTOR8bDpKb0VbluEUtT
 mwrU5onLHCLXTXIBb2wrv9g5NUZKoTuK5ONpRAWxQC5BbnyKnY6VK6RTwQJzM/uC
 vziPvLmA+pfxsslowjAy/RLSld3fAqELi8mNgaAPlZZrB1/mzoXa+ZFX+/JkISAu
 66hOYyqQNonNVskW7eIS
 =nLSS
 -----END PGP SIGNATURE-----

Merge tag 'gpmc-omap-v4.8-rc1' of https://github.com/rogerq/linux into fixes

OMAP-GPMC: fixes for v4.8-rc1

Allow other children of GPMC to probe even if any child fails.  This fixes
problem on Overo boards where networking device child doesn't probe due
to broken NAND child.

* tag 'gpmc-omap-v4.8-rc1' of https://github.com/rogerq/linux:
  memory: omap-gpmc: allow probe of child nodes to fail

Signed-off-by: Olof Johansson <olof@lixom.net>
2016-08-25 16:54:16 -07:00
Xander Huff
c3e70edd7c Revert "phy: IRQ cannot be shared"
This reverts:
  commit 33c133cc75 ("phy: IRQ cannot be shared")

On hardware with multiple PHY devices hooked up to the same IRQ line, allow
them to share it.

Sergei Shtylyov says:
  "I'm not sure now what was the reason I concluded that the IRQ sharing
  was impossible... most probably I thought that the kernel IRQ handling
  code exited the loop over the IRQ actions once IRQ_HANDLED was returned
  -- which is obviously not so in reality..."

Signed-off-by: Xander Huff <xander.huff@ni.com>
Signed-off-by: Nathan Sullivan <nathan.sullivan@ni.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-08-25 16:53:47 -07:00
Olof Johansson
2586d61f81 mvebu fixes for 4.8 (part 1)
Fix lan numbering for the Armada 388 clearfog board
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iEYEABECAAYFAlesKVsACgkQCwYYjhRyO9Ur9gCeNVvnJzBfqYg1t4LBHpjTUdyS
 IPoAnjUOm8j9Upl+blN11iLw4hCwxYey
 =SEqa
 -----END PGP SIGNATURE-----

Merge tag 'mvebu-fixes-4.8-1' of git://git.infradead.org/linux-mvebu into fixes

mvebu fixes for 4.8 (part 1)

Fix lan numbering for the Armada 388 clearfog board

* tag 'mvebu-fixes-4.8-1' of git://git.infradead.org/linux-mvebu:
  ARM: dts: armada-388-clearfog: number LAN ports properly

Signed-off-by: Olof Johansson <olof@lixom.net>
2016-08-25 16:52:29 -07:00
Florian Fainelli
4f101c4779 net: dsa: bcm_sf2: Fix race condition while unmasking interrupts
We kept shadow copies of which interrupt sources we have enabled and
disabled, but due to an order bug in how intrl2_mask_clear was defined,
we could run into the following scenario:

CPU0					CPU1
intrl2_1_mask_clear(..)
sets INTRL2_CPU_MASK_CLEAR
					bcm_sf2_switch_1_isr
					read INTRL2_CPU_STATUS and masks with stale
					irq1_mask value
updates irq1_mask value

Which would make us loop again and again trying to process and interrupt
we are not clearing since our copy of whether it was enabled before
still indicates it was not. Fix this by updating the shadow copy first,
and then unasking at the HW level.

Fixes: 246d7f773c ("net: dsa: add Broadcom SF2 switch driver")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-08-25 16:49:25 -07:00
Eric Dumazet
166ee5b878 qdisc: fix a module refcount leak in qdisc_create_dflt()
Should qdisc_alloc() fail, we must release the module refcount
we got right before.

Fixes: 6da7c8fcbc ("qdisc: allow setting default queuing discipline")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: John Fastabend <john.r.fastabend@intel.com>
Acked-by: John Fastabend <john.r.fastabend@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-08-25 16:44:20 -07:00
Wei Yongjun
a5de125dd4 tipc: fix the error handling in tipc_udp_enable()
Fix to return a negative error code in enable_mcast() error handling
case, and release udp socket when necessary.

Fixes: d0f91938be ("tipc: add ip/udp media type")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-08-25 16:32:34 -07:00
Greg Kroah-Hartman
d1228f4ff3 USB-serial fixes for v4.8-rc4
Here are a couple of fixes for non-atomic allocations in write paths,
 and some new option device ids.
 
 Signed-off-by: Johan Hovold <johan@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJXvxNgAAoJEEEN5E/e4bSVibEP/1HuoOsGKaOR9RI3y/dRzcFe
 ZVYtKQZ2M+zYBRlkbTGKpGO8urzfNL3T+TfA51i2HUnsa9s4AEFuyoC8eW/amj3D
 mKm2rn0BwPH+E86Pvg0Jgf/tyveCGB3u2rbkZWHhbbJDA/eI2nX1w9DlldSHpZfx
 PgFKPemBeUSc+AKIuw2eAbw4y9Br2hnvb2ZDzXE7CHpiu/Jnk6UuXCO6aygr+IAj
 KK0dcW1D+QBoefHgNNMydk1OMvs5BAl/GdnUn5UqlMfe95b617eaOhkQlM0h+JVk
 yO2zLF8tz64xE5gYzT0PWeHBSl5Ugf0yVQdIypYToldIellIz+2z8TxfQ38U0Fu5
 fyB4c2KAy3+CESDgNZZMYXOPY1sfkjArTrvrbp4lwbgZTlg+CTtcn63OXl0DDhIW
 x5w0KpguralZvjmhjKrmi46TljEX05UV/PqtConXuFujylyXTq36RLF+1OeH+ZyW
 +MGYHHHvqjK4/uqesXmu52UQPq08VaBktxUwqaKhh/0Pg1ta0XcdCH+6dBEeWy5i
 idHFFQBqV9QE08DhLPa24kS+DOpmEUiTi/AOxpdlpDtsW4XkbVv7IF/t3W+sx6G5
 U+XfoujHcYBrIbfiN/kcE1W896Y+MeJ8VhCRxCt8vwmgYXTjwpkYaq2eYaA+zp/Z
 PddZx/fqr8W5ADICIyyj
 =bKLC
 -----END PGP SIGNATURE-----

Merge tag 'usb-serial-4.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

Johan writes:

USB-serial fixes for v4.8-rc4

Here are a couple of fixes for non-atomic allocations in write paths,
and some new option device ids.

Signed-off-by: Johan Hovold <johan@kernel.org>
2016-08-25 17:00:01 -04:00
Adrian Hunter
869c554808 mmc: fix use-after-free of struct request
We call mmc_req_is_special() after having processed a request, but
it could be freed after that. Check that ahead of time, and use
the cached value.

Reported-by: Hans de Goede <hdegoede@redhat.com>
Tested-by: Hans de Goede <hdegoede@redhat.com>
Fixes: c2df40dfb8 ("drivers: use req op accessor")

Signed-off-by: Jens Axboe <axboe@fb.com>
2016-08-25 14:11:43 -06:00
Dave Airlie
969af80f77 Merge tag 'drm-intel-fixes-2016-08-25' of git://anongit.freedesktop.org/drm-intel into drm-fixes
i915 fixes queue.

* tag 'drm-intel-fixes-2016-08-25' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Fix botched merge that downgrades CSR versions.
  drm/i915/skl: Ensure pipes with changed wms get added to the state
  drm/i915/gen9: Only copy WM results for changed pipes to skl_hw
  drm/i915/skl: Add support for the SAGV, fix underrun hangs
  drm/i915/gen6+: Interpret mailbox error flags
  drm/i915: Reattach comment, complete type specification
  drm/i915: Unconditionally flush any chipset buffers before execbuf
  drm/i915/gen9: Drop invalid WARN() during data rate calculation
  drm/i915/gen9: Initialize intel_state->active_crtcs during WM sanitization (v2)
2016-08-26 05:18:40 +10:00
Daniel Vetter
2b721f2077 drm: Protect fb_defio in drivers with CONFIG_KMS_FBDEV_EMULATION
For reasons that entirely elude me fb.h exposes all the structures,
even when it is not enabled. Except for special stuff like fb_defio.

Which means all the drivers which haven't yet switched over to the
defio support in the helpers and still roll their own, will fail
to compile when fbdev emulation is disabled. Protect just those
bits, as a gnarly reminder that conversion to the core defio helpers
would be good.

Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1470847958-28465-6-git-send-email-daniel.vetter@ffwll.ch
Signed-off-by: Dave Airlie <airlied@redhat.com>
2016-08-26 05:11:35 +10:00
Luiz Augusto von Dentz
4f34228b67 Bluetooth: Fix hci_sock_recvmsg when MSG_TRUNC is not set
Similar to bt_sock_recvmsg MSG_TRUNC shall be checked using the original
flags not msg_flags.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2016-08-25 20:58:47 +02:00
Luiz Augusto von Dentz
90a56f72ed Bluetooth: Fix bt_sock_recvmsg when MSG_TRUNC is not set
Commit b5f34f9420 attempt to introduce
proper handling for MSG_TRUNC but recv and variants should still work
as read if no flag is passed, but because the code may set MSG_TRUNC to
msg->msg_flags that shall not be used as it may cause it to be behave as
if MSG_TRUNC is always, so instead of using it this changes the code to
use the flags parameter which shall contain the original flags.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2016-08-25 20:58:47 +02:00