1. 08 Jul, 2016 11 commits
  2. 07 Jul, 2016 7 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · ac904ae6
      Linus Torvalds authored
      Pull block IO fixes from Jens Axboe:
       "Three small fixes that have been queued up and tested for this series:
      
         - A bug fix for xen-blkfront from Bob Liu, fixing an issue with
           incomplete requests during migration.
      
         - A fix for an ancient issue in retrieving the IO priority of a
           different PID than self, preventing that task from going away while
           we access it.  From Omar.
      
         - A writeback fix from Tahsin, fixing a case where we'd call ihold()
           with a zero ref count inode"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        block: fix use-after-free in sys_ioprio_get()
        writeback: inode cgroup wb switch should not call ihold()
        xen-blkfront: save uncompleted reqs in blkfront_resume()
      ac904ae6
    • Linus Torvalds's avatar
      Merge tag 'configfs-for-4.7' of git://git.infradead.org/users/hch/configfs · 4c2a8499
      Linus Torvalds authored
      Pull configfs fix from Christoph Hellwig:
       "A fix from Marek for ppos handling in configfs_write_bin_file, which
        was introduced in Linux 4.5, but didn't have any users until recently"
      
      * tag 'configfs-for-4.7' of git://git.infradead.org/users/hch/configfs:
        configfs: Remove ppos increment in configfs_write_bin_file
      4c2a8499
    • Rafael J. Wysocki's avatar
      Merge branches 'acpica-fixes', 'acpi-pci-fixes' and 'acpi-debug-fixes' · b6d90158
      Rafael J. Wysocki authored
      * acpica-fixes:
        ACPICA: Namespace: Fix namespace/interpreter lock ordering
      
      * acpi-pci-fixes:
        ACPI,PCI,IRQ: separate ISA penalty calculation
        Revert "ACPI, PCI, IRQ: remove redundant code in acpi_irq_penalty_init()"
        ACPI,PCI,IRQ: factor in PCI possible
      
      * acpi-debug-fixes:
        ACPI / debugger: Fix regression introduced by IS_ERR_VALUE() removal
      b6d90158
    • Rafael J. Wysocki's avatar
      Merge branches 'pm-cpuidle-fixes' and 'pm-sleep-fixes' · 7fe39a21
      Rafael J. Wysocki authored
      * pm-cpuidle-fixes:
        cpuidle: Fix last_residency division
      
      * pm-sleep-fixes:
        x86/power/64: Fix kernel text mapping corruption during image restoration
      7fe39a21
    • Mark Rutland's avatar
      perf/core: Fix pmu::filter_match for SW-led groups · 2c81a647
      Mark Rutland authored
      The following commit:
      
        66eb579e ("perf: allow for PMU-specific event filtering")
      
      added the pmu::filter_match() callback. This was intended to
      avoid HW constraints on events from resulting in extremely
      pessimistic scheduling.
      
      However, pmu::filter_match() is only called for the leader of each event
      group. When the leader is a SW event, we do not filter the groups, and
      may fail at pmu::add() time, and when this happens we'll give up on
      scheduling any event groups later in the list until they are rotated
      ahead of the failing group.
      
      This can result in extremely sub-optimal event scheduling behaviour,
      e.g. if running the following on a big.LITTLE platform:
      
      $ taskset -c 0 ./perf stat \
       -e 'a57{context-switches,armv8_cortex_a57/config=0x11/}' \
       -e 'a53{context-switches,armv8_cortex_a53/config=0x11/}' \
       ls
      
           <not counted>      context-switches                                              (0.00%)
           <not counted>      armv8_cortex_a57/config=0x11/                                 (0.00%)
                      24      context-switches                                              (37.36%)
                57589154      armv8_cortex_a53/config=0x11/                                 (37.36%)
      
      Here the 'a53' event group was always eligible to be scheduled, but
      the 'a57' group never eligible to be scheduled, as the task was always
      affine to a Cortex-A53 CPU. The SW (group leader) event in the 'a57'
      group was eligible, but the HW event failed at pmu::add() time,
      resulting in ctx_flexible_sched_in giving up on scheduling further
      groups with HW events.
      
      One way of avoiding this is to check pmu::filter_match() on siblings
      as well as the group leader. If any of these fail their
      pmu::filter_match() call, we must skip the entire group before
      attempting to add any events.
      Signed-off-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Will Deacon <will.deacon@arm.com>
      Fixes: 66eb579e ("perf: allow for PMU-specific event filtering")
      Link: http://lkml.kernel.org/r/1465917041-15339-1-git-send-email-mark.rutland@arm.com
      [ Small readability edits. ]
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      2c81a647
    • Dave Airlie's avatar
      Merge branch 'linux-4.7' of git://github.com/skeggsb/linux into drm-fixes · 27c0b741
      Dave Airlie authored
      Just one fix for a stupid thinko in a DP training pattern commit.
      
      * 'linux-4.7' of git://github.com/skeggsb/linux:
        drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern
      27c0b741
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.7' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · fd508702
      Dave Airlie authored
      Just a couple of fixes for amdgpu for 4.7:
      - 2 small tonga powerplay fixes
      - Additional Polaris fixes
      
      * 'drm-fixes-4.7' of git://people.freedesktop.org/~agd5f/linux:
        drm/amd/powerplay: Update CKS on/ CKS off voltage offset calculation.
        drm/amd/powerplay: fix bug that get wrong polaris evv voltage.
        drm/amd/powerplay: incorrectly use of the function return value
        drm/amd/powerplay: fix incorrect voltage table value for tonga
        drm/amd/powerplay: fix incorrect voltage table value for polaris10
      fd508702
  3. 06 Jul, 2016 10 commits
  4. 05 Jul, 2016 12 commits
    • Martin KaFai Lau's avatar
      ipv6: Fix mem leak in rt6i_pcpu · 903ce4ab
      Martin KaFai Lau authored
      It was first reported and reproduced by Petr (thanks!) in
      https://bugzilla.kernel.org/show_bug.cgi?id=119581
      
      free_percpu(rt->rt6i_pcpu) used to always happen in ip6_dst_destroy().
      
      However, after fixing a deadlock bug in
      commit 9c7370a1 ("ipv6: Fix a potential deadlock when creating pcpu rt"),
      free_percpu() is not called before setting non_pcpu_rt->rt6i_pcpu to NULL.
      
      It is worth to note that rt6i_pcpu is protected by table->tb6_lock.
      
      kmemleak somehow did not report it.  We nailed it down by
      observing the pcpu entries in /proc/vmallocinfo (first suggested
      by Hannes, thanks!).
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Fixes: 9c7370a1 ("ipv6: Fix a potential deadlock when creating pcpu rt")
      Reported-by: default avatarPetr Novopashenniy <pety@rusnet.ru>
      Tested-by: default avatarPetr Novopashenniy <pety@rusnet.ru>
      Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Cc: Petr Novopashenniy <pety@rusnet.ru>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      903ce4ab
    • Vegard Nossum's avatar
      net: fix decnet rtnexthop parsing · ab58298c
      Vegard Nossum authored
      dn_fib_count_nhs() could enter an infinite loop if nhp->rtnh_len == 0
      (i.e. if userspace passes a malformed netlink message).
      
      Let's use the helpers from net/nexthop.h which take care of all this
      stuff. We can do exactly the same as e.g. fib_count_nexthops() and
      fib_get_nhs() from net/ipv4/fib_semantics.c.
      
      This fixes the softlockup for me.
      
      Cc: Thomas Graf <tgraf@suug.ch>
      Signed-off-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ab58298c
    • Lv Zheng's avatar
      ACPI / debugger: Fix regression introduced by IS_ERR_VALUE() removal · 7e3fd813
      Lv Zheng authored
      The FIFO unlocking mechanism in acpi_dbg has been broken by the
      following commit:
      
        Commit: 287980e4
        Subject: remove lots of IS_ERR_VALUE abuses
      
      It converted !IS_ERR_VALUE(ret) into !ret which was not entirely
      correct. Fix the regression by taking ret > 0 into account too as
      appropriate.
      
      Fixes: 287980e4 (remove lots of IS_ERR_VALUE abuses)
      Signed-off-by: default avatarLv Zheng <lv.zheng@intel.com>
      [ rjw: Simplifications, changelog & subject massage ]
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      7e3fd813
    • Dan Carpenter's avatar
      platform/chrome: cros_ec_dev - double fetch bug in ioctl · 096cdc6f
      Dan Carpenter authored
      We verify "u_cmd.outsize" and "u_cmd.insize" but we need to make sure
      that those values have not changed between the two copy_from_user()
      calls.  Otherwise it could lead to a buffer overflow.
      
      Additionally, cros_ec_cmd_xfer() can set s_cmd->insize to a lower value.
      We should use the new smaller value so we don't copy too much data to
      the user.
      Reported-by: default avatarPengfei Wang <wpengfeinudt@gmail.com>
      Fixes: a8411784 ('mfd: cros_ec: Use a zero-length array for command data')
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Reviewed-by: default avatarKees Cook <keescook@chromium.org>
      Tested-by: default avatarGwendal Grignou <gwendal@chromium.org>
      Cc: <stable@vger.kernel.org> # v4.2+
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      096cdc6f
    • Ben Skeggs's avatar
      drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern · 21721504
      Ben Skeggs authored
      Fixes a regression caused by a stupid thinko from "disp/sor/gf119: both
      links use the same training register".
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      Cc: stable@vger.kernel.org
      21721504
    • Lv Zheng's avatar
      ACPICA: Namespace: Fix namespace/interpreter lock ordering · 45209046
      Lv Zheng authored
      There is a lock order issue in acpi_load_tables(). The namespace lock
      is held before holding the interpreter lock.
      
      With ACPI_MUTEX_DEBUG enabled in the kernel, this is printed to the
      log during boot:
      
        [    0.885699] ACPI Error: Invalid acquire order: Thread 405884224 owns [ACPI_MTX_Namespace], wants [ACPI_MTX_Interpreter] (20160422/utmutex-263)
        [    0.885881] ACPI Error: Could not acquire AML Interpreter mutex (20160422/exutils-95)
        [    0.893846] ACPI Error: Mutex [0x0] is not acquired, cannot release (20160422/utmutex-326)
        [    0.894019] ACPI Error: Could not release AML Interpreter mutex (20160422/exutils-133)
      
      The issue has been introduced by the following commit:
      
        Commit: 2f38b1b1
        ACPICA Commit: bfe03ffcde8ed56a7eae38ea0b188aeb12f9c52e
        Subject: ACPICA: Namespace: Fix a regression that MLC support triggers
                 dead lock in dynamic table loading
      
      Which fixed a deadlock issue for acpi_ns_load_table() in
      acpi_ex_add_table() but didn't take care of the lock order in
      acpi_ns_load_table() correctly.
      
      Originally (before the above commit), ACPICA used the
      namespace/interpreter locks in the following 2 key code
      paths:
      
       1. Table loading:
       acpi_ns_load_table
      	L(Namespace)
      		acpi_ns_parse_table
      			acpi_ns_one_complete_parse
      	U(Namespace)
       2. Object evaluation:
       acpi_ns_evaluate
      	L(Interpreter)
      	acpi_ps_execute_method
      		U(Interpreter)
      		acpi_ns_load_table
      			L(Namespace)
      			U(Namespace)
      		acpi_ev_initialize_region
      			L(Namespace)
      			U(Namespace)
      		address_space.setup
      			L(Namespace)
      			U(Namespace)
      		address_space.handler
      			L(Namespace)
      			U(Namespace)
      		acpi_os_wait_semaphore
      		acpi_os_acquire_mutex
      		acpi_os_sleep
      		L(Interpreter)
      	U(Interpreter)
      
      During runtime, while acpi_ns_evaluate is called, the lock order is
      always Interpreter -> Namespace.
      
      In turn, the problematic commit acquires the locks in the following
      order:
      
       3. Table loading:
       acpi_ns_load_table
      	L(Namespace)
      		acpi_ns_parse_table
      		L(Interpreter)
      			acpi_ns_one_complete_parse
      		U(Interpreter)
      	U(Namespace)
      
      To fix the lock order issue, move the interpreter lock to
      acpi_ns_load_table() to ensure the lock order correctness:
      
       4. Table loading:
       acpi_ns_load_table
      	L(Interpreter)
      	L(Namespace)
      		acpi_ns_parse_table
      			acpi_ns_one_complete_parse
      	U(Namespace)
      	U(Interpreter)
      
      However, this doesn't fix the current design issues related to the
      namespace lock. For example, we can notice that in acpi_ns_evaluate(),
      outside of acpi_ns_load_table(), the namespace objects may be created
      by the named object creation control methods. And the creation of
      the method-owned namespace objects are not locked by the namespace
      lock. This patch doesn't try to fix such kind of existing issues.
      
      Fixes: 2f38b1b1 (ACPICA: Namespace: Fix a regression that MLC support triggers dead lock in dynamic table loading)
      Signed-off-by: default avatarLv Zheng <lv.zheng@intel.com>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      45209046
    • Ganesh Goudar's avatar
      cxgb4: update latest firmware version supported · f5d65161
      Ganesh Goudar authored
      Change t4fw_version.h to update latest firmware version number
      Signed-off-by: default avatarGanesh Goudar <ganeshgr@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f5d65161
    • Or Gerlitz's avatar
      net/mlx5: Avoid setting unused var when modifying vport node GUID · eae033c1
      Or Gerlitz authored
      GCC complains on unused-but-set-variable, clean this up.
      
      Fixes: 23898c76 ('net/mlx5: E-Switch, Modify node guid on vf set MAC')
      Signed-off-by: default avatarOr Gerlitz <ogerlitz@mellanox.com>
      Acked-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      eae033c1
    • Aviv Heller's avatar
      bonding: fix enslavement slave link notifications · a30b0168
      Aviv Heller authored
      Currently, link notifications are not sent by
      bond_set_slave_link_state() upon enslavement if
      the slave is enslaved when up.
      
      This happens because slave->link default init value
      is 0, which is the same as BOND_LINK_UP, resulting
      in bond_set_slave_link_state() ignoring this transition.
      
      This patch sets the default value of slave->link to
      BOND_LINK_NOCHANGE, assuring it will count as a state
      transition and thus trigger notification logic.
      Signed-off-by: default avatarAviv Heller <avivh@mellanox.com>
      Reviewed-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a30b0168
    • hayeswang's avatar
      r8152: fix runtime function for RTL8152 · 2609af19
      hayeswang authored
      The RTL8152 doesn't have U1U2 and U2P3 features, so use different
      runtime functions for RTL812 and RTL8153 by adding autosuspend_en()
      to rtl_ops.
      Signed-off-by: default avatarHayes Wang <hayeswang@realtek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2609af19
    • Linus Walleij's avatar
      Revert "gpio: gpiolib-of: Allow compile testing" · 92c74bce
      Linus Walleij authored
      This reverts commit 1e4a8064.
      
      This creates more problems than it solves right now. Compile
      testing needs to go in with patches fixing the problems it
      uncovers.
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      92c74bce
    • Paul Burton's avatar
      irqchip/mips-gic: Match IPI IRQ domain by bus token only · 547aefc4
      Paul Burton authored
      Commit fbde2d7d ("MIPS: Add generic SMP IPI support") introduced
      code which calls irq_find_matching_host with a NULL node parameter in
      order to discover IPI IRQ domains which are not associated with the DT
      root node's interrupt parent. This suggests that implementations of IPI
      IRQ domains should effectively ignore the node parameter if it is NULL
      and search purely based upon the bus token. Commit 2af70a96
      ("irqchip/mips-gic: Add a IPI hierarchy domain") did not do this when
      implementing the GIC IPI IRQ domain, and on MIPS Boston boards this
      leads to no IPI domain being discovered and a NULL pointer dereference
      when attempting to send an IPI:
      
        CPU 0 Unable to handle kernel paging request at virtual address 0000000000000040, epc == ffffffff8016e70c, ra == ffffffff8010ff5c
        Oops[#1]:
        CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.7.0-rc6-00223-gad0d1b6 #945
        task: a8000000ff066fc0 ti: a8000000ff068000 task.ti: a8000000ff068000
        $ 0   : 0000000000000000 0000000000000001 ffffffff80730000 0000000000000003
        $ 4   : 0000000000000000 ffffffff8057e5b0 a800000001e3ee00 0000000000000000
        $ 8   : 0000000000000000 0000000000000023 0000000000000001 0000000000000001
        $12   : 0000000000000000 ffffffff803323d0 0000000000000000 0000000000000000
        $16   : 0000000000000000 0000000000000000 0000000000000001 ffffffff801108fc
        $20   : 0000000000000000 ffffffff8057e5b0 0000000000000001 0000000000000000
        $24   : 0000000000000000 ffffffff8012de28
        $28   : a8000000ff068000 a8000000ff06fbc0 0000000000000000 ffffffff8010ff5c
        Hi    : ffffffff8014c174
        Lo    : a800000001e1e140
        epc   : ffffffff8016e70c __ipi_send_mask+0x24/0x11c
        ra    : ffffffff8010ff5c mips_smp_send_ipi_mask+0x68/0x178
        Status: 140084e2        KX SX UX KERNEL EXL
        Cause : 00800008 (ExcCode 02)
        BadVA : 0000000000000040
        PrId  : 0001a920 (MIPS I6400)
        Process swapper/0 (pid: 1, threadinfo=a8000000ff068000, task=a8000000ff066fc0, tls=0000000000000000)
        Stack : 0000000000000000 0000000000000000 0000000000000001 ffffffff801108fc
                  0000000000000000 ffffffff8057e5b0 0000000000000001 ffffffff8010ff5c
                  0000000000000001 0000000000000020 0000000000000000 0000000000000000
                  0000000000000000 ffffffff801108fc 0000000000000000 0000000000000001
                  0000000000000001 0000000000000000 0000000000000000 ffffffff801865e8
                  a8000000ff0c7500 a8000000ff06fc90 0000000000000001 0000000000000002
                  ffffffff801108fc ffffffff801868b8 0000000000000000 ffffffff801108fc
                  0000000000000000 0000000000000003 ffffffff8068c700 0000000000000001
                  ffffffff80730000 0000000000000001 a8000000ff00a290 ffffffff80110c50
                  0000000000000003 a800000001e48308 0000000000000003 0000000000000008
                  ...
        Call Trace:
        [<ffffffff8016e70c>] __ipi_send_mask+0x24/0x11c
        [<ffffffff8010ff5c>] mips_smp_send_ipi_mask+0x68/0x178
        [<ffffffff801865e8>] generic_exec_single+0x150/0x170
        [<ffffffff801868b8>] smp_call_function_single+0x108/0x160
        [<ffffffff80110c50>] cps_boot_secondary+0x328/0x394
        [<ffffffff80110534>] __cpu_up+0x38/0x90
        [<ffffffff8012de4c>] bringup_cpu+0x24/0xac
        [<ffffffff8012df40>] cpuhp_up_callbacks+0x58/0xdc
        [<ffffffff8012e648>] cpu_up+0x118/0x18c
        [<ffffffff806dc158>] smp_init+0xbc/0xe8
        [<ffffffff806d4c18>] kernel_init_freeable+0xa0/0x228
        [<ffffffff8056c908>] kernel_init+0x10/0xf0
        [<ffffffff80105098>] ret_from_kernel_thread+0x14/0x1c
      
      Fix this by allowing the GIC IPI IRQ domain to match purely based upon
      the bus token if the node provided is NULL.
      
      Fixes: 2af70a96 ("irqchip/mips-gic: Add a IPI hierarchy domain")
      Signed-off-by: default avatarPaul Burton <paul.burton@imgtec.com>
      Cc: linux-mips@linux-mips.org
      Cc: Jason Cooper <jason@lakedaemon.net>
      Cc: Qais Yousef <qsyousef@gmail.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Marc Zyngier <marc.zyngier@arm.com>
      Cc: stable@vger.kernel.org
      Link: http://lkml.kernel.org/r/20160705132600.27730-2-paul.burton@imgtec.comSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      547aefc4