1. 31 Jul, 2013 4 commits
    • Jeff Layton's avatar
      cifs: fix bad error handling in crypto code · ba482029
      Jeff Layton authored
      Jarod reported an Oops like when testing with fips=1:
      
      CIFS VFS: could not allocate crypto hmacmd5
      CIFS VFS: could not crypto alloc hmacmd5 rc -2
      CIFS VFS: Error -2 during NTLMSSP authentication
      CIFS VFS: Send error in SessSetup = -2
      BUG: unable to handle kernel NULL pointer dereference at 000000000000004e
      IP: [<ffffffff812b5c7a>] crypto_destroy_tfm+0x1a/0x90
      PGD 0
      Oops: 0000 [#1] SMP
      Modules linked in: md4 nls_utf8 cifs dns_resolver fscache kvm serio_raw virtio_balloon virtio_net mperf i2c_piix4 cirrus drm_kms_helper ttm drm i2c_core virtio_blk ata_generic pata_acpi
      CPU: 1 PID: 639 Comm: mount.cifs Not tainted 3.11.0-0.rc3.git0.1.fc20.x86_64 #1
      Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
      task: ffff88007bf496e0 ti: ffff88007b080000 task.ti: ffff88007b080000
      RIP: 0010:[<ffffffff812b5c7a>]  [<ffffffff812b5c7a>] crypto_destroy_tfm+0x1a/0x90
      RSP: 0018:ffff88007b081d10  EFLAGS: 00010282
      RAX: 0000000000001f1f RBX: ffff880037422000 RCX: ffff88007b081fd8
      RDX: 000000000000001f RSI: 0000000000000006 RDI: fffffffffffffffe
      RBP: ffff88007b081d30 R08: ffff880037422000 R09: ffff88007c090100
      R10: 0000000000000000 R11: 00000000fffffffe R12: fffffffffffffffe
      R13: ffff880037422000 R14: ffff880037422000 R15: 00000000fffffffe
      FS:  00007fc322f4f780(0000) GS:ffff88007fc80000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      CR2: 000000000000004e CR3: 000000007bdaa000 CR4: 00000000000006e0
      Stack:
       ffffffff81085845 ffff880037422000 ffff8800375e7400 ffff880037422000
       ffff88007b081d48 ffffffffa0176022 ffff880037422000 ffff88007b081d60
       ffffffffa015c07b ffff880037600600 ffff88007b081dc8 ffffffffa01610e1
      Call Trace:
       [<ffffffff81085845>] ? __cancel_work_timer+0x75/0xf0
       [<ffffffffa0176022>] cifs_crypto_shash_release+0x82/0xf0 [cifs]
       [<ffffffffa015c07b>] cifs_put_tcp_session+0x8b/0xe0 [cifs]
       [<ffffffffa01610e1>] cifs_mount+0x9d1/0xad0 [cifs]
       [<ffffffffa014ff50>] cifs_do_mount+0xa0/0x4d0 [cifs]
       [<ffffffff811ab6e9>] mount_fs+0x39/0x1b0
       [<ffffffff811c466f>] vfs_kern_mount+0x5f/0xf0
       [<ffffffff811c6a9e>] do_mount+0x23e/0xa20
       [<ffffffff811c66e6>] ? copy_mount_options+0x36/0x170
       [<ffffffff811c7303>] SyS_mount+0x83/0xc0
       [<ffffffff8165c8d9>] system_call_fastpath+0x16/0x1b
      Code: eb 9e 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 55 41 54 49 89 fc 53 48 83 ec 08 48 85 ff 74 46 <48> 83 7e 48 00 48 8b 5e 50 74 4b 48 89 f7 e8 83 fc ff ff 4c 8b
      RIP  [<ffffffff812b5c7a>] crypto_destroy_tfm+0x1a/0x90
       RSP <ffff88007b081d10>
      CR2: 000000000000004e
      
      The cifs code allocates some crypto structures. If that fails, it
      returns an error, but it leaves the pointers set to their PTR_ERR
      values. Then later when it tries to clean up, it sees that those values
      are non-NULL and then passes them to the routine that frees them.
      
      Fix this by setting the pointers to NULL after collecting the error code
      in this situation.
      
      Cc: Sachin Prabhu <sprabhu@redhat.com>
      Reported-by: default avatarJarod Wilson <jarod@redhat.com>
      Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
      Signed-off-by: default avatarSteve French <smfrench@gmail.com>
      ba482029
    • Andi Shyti's avatar
      cifs: file: initialize oparms.reconnect before using it · fe090e4e
      Andi Shyti authored
      In the cifs_reopen_file function, if the following statement is
      asserted:
      
      (tcon->unix_ext && cap_unix(tcon->ses) &&
                  (CIFS_UNIX_POSIX_PATH_OPS_CAP &
                  (tcon->fsUnixInfo.Capability)))
      
      and we succeed to open with cifs_posix_open, the function jumps
      to the label reopen_success and checks for oparms.reconnect
      which is not initialized.
      
      This issue has been reported by scan.coverity.com
      Signed-off-by: default avatarAndi Shyti <andi@etezian.org>
      Reviewed-by: default avatarJeff Layton <jlayton@redhat.com>
      Signed-off-by: default avatarSteve French <smfrench@gmail.com>
      fe090e4e
    • Steve French's avatar
      Do not attempt to do cifs operations reading symlinks with SMB2 · 1b244081
      Steve French authored
      When use of symlinks is enabled (mounting with mfsymlinks option) to
      non-Samba servers, we always tried to use cifs, even when we
      were mounted with SMB2 or SMB3, which causes the server to drop the
      network connection.
      
      This patch separates out the protocol specific operations for cifs from
      the code which recognizes symlinks, and fixes the problem where
      with SMB2 mounts we attempt cifs operations to open and read
      symlinks.  The next patch will add support for SMB2 for opening
      and reading symlinks.  Additional followon patches will address
      the similar problem creating symlinks.
      Signed-off-by: default avatarSteve French <smfrench@gmail.com>
      1b244081
    • Chen Gang's avatar
      cifs: extend the buffer length enought for sprintf() using · 057d6332
      Chen Gang authored
      For cifs_set_cifscreds() in "fs/cifs/connect.c", 'desc' buffer length
      is 'CIFSCREDS_DESC_SIZE' (56 is less than 256), and 'ses->domainName'
      length may be "255 + '\0'".
      
      The related sprintf() may cause memory overflow, so need extend related
      buffer enough to hold all things.
      
      It is also necessary to be sure of 'ses->domainName' must be less than
      256, and define the related macro instead of hard code number '256'.
      Signed-off-by: default avatarChen Gang <gang.chen@asianux.com>
      Reviewed-by: default avatarJeff Layton <jlayton@redhat.com>
      Reviewed-by: default avatarShirish Pargaonkar <shirishpargaonkar@gmail.com>
      Reviewed-by: default avatarScott Lovenberg <scott.lovenberg@gmail.com>
      CC: <stable@vger.kernel.org>
      Signed-off-by: default avatarSteve French <smfrench@gmail.com>
      057d6332
  2. 19 Jul, 2013 3 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · ecb2cf1a
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "A couple interesting SKB fragment handling fixes, plus the usual small
        bits here and there:
      
         1) Fix 64-bit divide build failure on 32-bit platforms in mlx5, from
            Tim Gardner.
      
         2) Get rid of a stupid reimplementation on "%*phC" in our sysfs MAC
            address printing helper.
      
         3) Fix NETIF_F_SG capability advertisement in hyperv driver, if the
            device can't do checksumming offloads then it shouldn't say it can
            do SG either.  From Haiyang Zhang.
      
         4) bgmac needs to depend on PHYLIB, from Hauke Mehrtens.
      
         5) Don't leak DMA mappings on mapping failures, from Neil Horman.
      
         6) We need to reset the transport header of SKBs in ipv4 before we
            attempt to perform early socket demux, just like ipv6 does.  From
            Eric Dumazet.
      
         7) Add missing locking on vxlan device removal, from Stephen
            Hemminger.
      
         8) xen-netfront has to make two passes over an SKB to prepare it for
            transfer.  One pass calculates the number of slots needed, the
            second massages the SKB and fills the slots.  Unfortunately, the
            first pass doesn't calculate the number of slots properly so we
            can end up trying to build a MAX_SKB_FRAGS + 1 SKB which doesn't
            work out so well.  Fix from Jan Beulich with help and discussion
            with several others.
      
         9) Fix a similar problem in tun and macvtap, which have to split up
            scatter-gather elements at PAGE_SIZE boundaries.  Don't do
            zerocopy if it would result in a > MAX_SKB_FRAGS skb.  Fixes from
            Jason Wang.
      
        10) On receive, once we've decoded the VLAN state completely, clear
            skb->vlan_tci.  Otherwise demuxed tunnels underneath can trigger
            the VLAN code again, corrupting the packet.  Fix from Eric
            Dumazet"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        vlan: fix a race in egress prio management
        vlan: mask vlan prio bits
        macvtap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS
        tuntap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS
        pkt_sched: sch_qfq: remove a source of high packet delay/jitter
        xen-netfront: pull on receive skb may need to happen earlier
        vxlan: add necessary locking on device removal
        hyperv: Fix the NETIF_F_SG flag setting in netvsc
        net: Fix sysfs_format_mac() code duplication.
        be2net: Fix to avoid hardware workaround when not needed
        macvtap: do not assume 802.1Q when send vlan packets
        macvtap: fix the missing ret value of TUNSETQUEUE
        ipv4: set transport header earlier
        mlx5 core: Fix __udivdi3 when compiling for 32 bit arches
        bgmac: add dependency to phylib
        net/irda: fixed style issues in irlan_eth
        ethtool: fixed trailing statements in ethtool
        ndisc: bool initializations should use true and false
        atl1e: unmap partially mapped skb on dma error and free skb
      ecb2cf1a
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · ee114b97
      Linus Torvalds authored
      Pull x86 fixes from Peter Anvin:
       "Trying again to get the fixes queue, including the fixed IDT alignment
        patch.
      
        The UEFI patch is by far the biggest issue at hand: it is currently
        causing quite a few machines to boot.  Which is sad, because the only
        reason they would is because their BIOSes touch memory that has
        already been freed.  The other major issue is that we finally have
        tracked down the root cause of a significant number of machines
        failing to suspend/resume"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86: Make sure IDT is page aligned
        x86, suspend: Handle CPUs which fail to #GP on RDMSR
        x86/platform/ce4100: Add header file for reboot type
        Revert "UEFI: Don't pass boot services regions to SetVirtualAddressMap()"
        efivars: check for EFI_RUNTIME_SERVICES
      ee114b97
    • Linus Torvalds's avatar
      Merge tag 'md-3.11-fixes' of git://neil.brown.name/md · 4b8b8a4a
      Linus Torvalds authored
      Pull md bug fixes from NeilBrown:
       "Sorry boss, back at work now boss.  Here's them nice shiny patches ya
        wanted.  All nicely tagged and justified for -stable and everyfing:
      
        Three bug fixes for md in 3.10
      
        3.10 wasn't a good release for md.  The bio changes left a couple of
        bugs, and an md "fix" created another one.
      
        These three patches appear to fix the issues and have been tagged for
        -stable"
      
      * tag 'md-3.11-fixes' of git://neil.brown.name/md:
        md/raid1: fix bio handling problems in process_checks()
        md: Remove recent change which allows devices to skip recovery.
        md/raid10: fix two problems with RAID10 resync.
      4b8b8a4a
  3. 18 Jul, 2013 15 commits
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 0a693ab6
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "You'll be terribly disappointed in this, I'm not trying to sneak any
        features in or anything, its mostly radeon and intel fixes, a couple
        of ARM driver fixes"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (34 commits)
        drm/radeon/dpm: add debugfs support for RS780/RS880 (v3)
        drm/radeon/dpm/atom: fix broken gcc harder
        drm/radeon/dpm/atom: restructure logic to work around a compiler bug
        drm/radeon/dpm: fix atom vram table parsing
        drm/radeon: fix an endian bug in atom table parsing
        drm/radeon: add a module parameter to disable aspm
        drm/rcar-du: Use the GEM PRIME helpers
        drm/shmobile: Use the GEM PRIME helpers
        uvesafb: Really allow mtrr being 0, as documented and warn()ed
        radeon kms: do not flush uninitialized hotplug work
        drm/radeon/dpm/sumo: handle boost states properly when forcing a perf level
        drm/radeon: align VM PTBs (Page Table Blocks) to 32K
        drm/radeon: allow selection of alignment in the sub-allocator
        drm/radeon: never unpin UVD bo v3
        drm/radeon: fix UVD fence emit
        drm/radeon: add fault decode function for CIK
        drm/radeon: add fault decode function for SI (v2)
        drm/radeon: add fault decode function for cayman/TN (v2)
        drm/radeon: use radeon device for request firmware
        drm/radeon: add missing ttm_eu_backoff_reservation to radeon_bo_list_validate
        ...
      0a693ab6
    • Eric Dumazet's avatar
      vlan: fix a race in egress prio management · 3e3aac49
      Eric Dumazet authored
      egress_priority_map[] hash table updates are protected by rtnl,
      and we never remove elements until device is dismantled.
      
      We have to make sure that before inserting an new element in hash table,
      all its fields are committed to memory or else another cpu could
      find corrupt values and crash.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Patrick McHardy <kaber@trash.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3e3aac49
    • Eric Dumazet's avatar
      vlan: mask vlan prio bits · d4b812de
      Eric Dumazet authored
      In commit 48cc32d3
      ("vlan: don't deliver frames for unknown vlans to protocols")
      Florian made sure we set pkt_type to PACKET_OTHERHOST
      if the vlan id is set and we could find a vlan device for this
      particular id.
      
      But we also have a problem if prio bits are set.
      
      Steinar reported an issue on a router receiving IPv6 frames with a
      vlan tag of 4000 (id 0, prio 2), and tunneled into a sit device,
      because skb->vlan_tci is set.
      
      Forwarded frame is completely corrupted : We can see (8100:4000)
      being inserted in the middle of IPv6 source address :
      
      16:48:00.780413 IP6 2001:16d8:8100:4000:ee1c:0:9d9:bc87 >
      9f94:4d95:2001:67c:29f4::: ICMP6, unknown icmp6 type (0), length 64
             0x0000:  0000 0029 8000 c7c3 7103 0001 a0ae e651
             0x0010:  0000 0000 ccce 0b00 0000 0000 1011 1213
             0x0020:  1415 1617 1819 1a1b 1c1d 1e1f 2021 2223
             0x0030:  2425 2627 2829 2a2b 2c2d 2e2f 3031 3233
      
      It seems we are not really ready to properly cope with this right now.
      
      We can probably do better in future kernels :
      vlan_get_ingress_priority() should be a netdev property instead of
      a per vlan_dev one.
      
      For stable kernels, lets clear vlan_tci to fix the bugs.
      Reported-by: default avatarSteinar H. Gunderson <sesse@google.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d4b812de
    • Jason Wang's avatar
      macvtap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS · ece793fc
      Jason Wang authored
      We try to linearize part of the skb when the number of iov is greater than
      MAX_SKB_FRAGS. This is not enough since each single vector may occupy more than
      one pages, so zerocopy_sg_fromiovec() may still fail and may break the guest
      network.
      
      Solve this problem by calculate the pages needed for iov before trying to do
      zerocopy and switch to use copy instead of zerocopy if it needs more than
      MAX_SKB_FRAGS.
      
      This is done through introducing a new helper to count the pages for iov, and
      call uarg->callback() manually when switching from zerocopy to copy to notify
      vhost.
      
      We can do further optimization on top.
      
      This bug were introduced from b92946e2
      (macvtap: zerocopy: validate vectors before building skb).
      
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ece793fc
    • Jason Wang's avatar
      tuntap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS · 88529176
      Jason Wang authored
      We try to linearize part of the skb when the number of iov is greater than
      MAX_SKB_FRAGS. This is not enough since each single vector may occupy more than
      one pages, so zerocopy_sg_fromiovec() may still fail and may break the guest
      network.
      
      Solve this problem by calculate the pages needed for iov before trying to do
      zerocopy and switch to use copy instead of zerocopy if it needs more than
      MAX_SKB_FRAGS.
      
      This is done through introducing a new helper to count the pages for iov, and
      call uarg->callback() manually when switching from zerocopy to copy to notify
      vhost.
      
      We can do further optimization on top.
      
      The bug were introduced from commit 0690899b
      (tun: experimental zero copy tx support)
      
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      88529176
    • Paolo Valente's avatar
      pkt_sched: sch_qfq: remove a source of high packet delay/jitter · 87f40dd6
      Paolo Valente authored
      QFQ+ inherits from QFQ a design choice that may cause a high packet
      delay/jitter and a severe short-term unfairness. As QFQ, QFQ+ uses a
      special quantity, the system virtual time, to track the service
      provided by the ideal system it approximates. When a packet is
      dequeued, this quantity must be incremented by the size of the packet,
      divided by the sum of the weights of the aggregates waiting to be
      served. Tracking this sum correctly is a non-trivial task, because, to
      preserve tight service guarantees, the decrement of this sum must be
      delayed in a special way [1]: this sum can be decremented only after
      that its value would decrease also in the ideal system approximated by
      QFQ+. For efficiency, QFQ+ keeps track only of the 'instantaneous'
      weight sum, increased and decreased immediately as the weight of an
      aggregate changes, and as an aggregate is created or destroyed (which,
      in its turn, happens as a consequence of some class being
      created/destroyed/changed). However, to avoid the problems caused to
      service guarantees by these immediate decreases, QFQ+ increments the
      system virtual time using the maximum value allowed for the weight
      sum, 2^10, in place of the dynamic, instantaneous value. The
      instantaneous value of the weight sum is used only to check whether a
      request of weight increase or a class creation can be satisfied.
      
      Unfortunately, the problems caused by this choice are worse than the
      temporary degradation of the service guarantees that may occur, when a
      class is changed or destroyed, if the instantaneous value of the
      weight sum was used to update the system virtual time. In fact, the
      fraction of the link bandwidth guaranteed by QFQ+ to each aggregate is
      equal to the ratio between the weight of the aggregate and the sum of
      the weights of the competing aggregates. The packet delay guaranteed
      to the aggregate is instead inversely proportional to the guaranteed
      bandwidth. By using the maximum possible value, and not the actual
      value of the weight sum, QFQ+ provides each aggregate with the worst
      possible service guarantees, and not with service guarantees related
      to the actual set of competing aggregates. To see the consequences of
      this fact, consider the following simple example.
      
      Suppose that only the following aggregates are backlogged, i.e., that
      only the classes in the following aggregates have packets to transmit:
      one aggregate with weight 10, say A, and ten aggregates with weight 1,
      say B1, B2, ..., B10. In particular, suppose that these aggregates are
      always backlogged. Given the weight distribution, the smoothest and
      fairest service order would be:
      A B1 A B2 A B3 A B4 A B5 A B6 A B7 A B8 A B9 A B10 A B1 A B2 ...
      
      QFQ+ would provide exactly this optimal service if it used the actual
      value for the weight sum instead of the maximum possible value, i.e.,
      11 instead of 2^10. In contrast, since QFQ+ uses the latter value, it
      serves aggregates as follows (easy to prove and to reproduce
      experimentally):
      A B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 A A A A A A A A A A B1 B2 ... B10 A A ...
      
      By replacing 10 with N in the above example, and by increasing N, one
      can increase at will the maximum packet delay and the jitter
      experienced by the classes in aggregate A.
      
      This patch addresses this issue by just using the above
      'instantaneous' value of the weight sum, instead of the maximum
      possible value, when updating the system virtual time.  After the
      instantaneous weight sum is decreased, QFQ+ may deviate from the ideal
      service for a time interval in the order of the time to serve one
      maximum-size packet for each backlogged class. The worst-case extent
      of the deviation exhibited by QFQ+ during this time interval [1] is
      basically the same as of the deviation described above (but, without
      this patch, QFQ+ suffers from such a deviation all the time). Finally,
      this patch modifies the comment to the function qfq_slot_insert, to
      make it coherent with the fact that the weight sum used by QFQ+ can
      now be lower than the maximum possible value.
      
      [1] P. Valente, "Extending WF2Q+ to support a dynamic traffic mix",
      Proceedings of AAA-IDEA'05, June 2005.
      Signed-off-by: default avatarPaolo Valente <paolo.valente@unimore.it>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      87f40dd6
    • Linus Torvalds's avatar
      Merge tag 'driver-core-3.11-rc2' of... · 7a62711a
      Linus Torvalds authored
      Merge tag 'driver-core-3.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      
      Pull driver core patches from Greg KH:
       "Here are some driver core patches for 3.11-rc2.  They aren't really
        bugfixes, but a bunch of new helper macros for drivers to properly
        create attribute groups, which drivers and subsystems need to fix up a
        ton of race issues with incorrectly creating sysfs files (binary and
        normal) after userspace has been told that the device is present.
      
        Also here is the ability to create binary files as attribute groups,
        to solve that race condition, which was impossible to do before this,
        so that's my fault the drivers were broken.
      
        The majority of the .c changes is indenting and moving code around a
        bit.  It affects no existing code, but allows the large backlog of 70+
        patches that I already have created to start flowing into the
        different subtrees, instead of having to live in my driver-core tree,
        causing merge nightmares in linux-next for the next few months.
      
        These were finalized too late for the -rc1 merge window, which is why
        they were didn't make that pull request, testing and review from
        others didn't happen until a few weeks ago, and then there's the whole
        distraction of the past few days, which prevented these from getting
        to you sooner, sorry about that.
      
        Oh, and there's a bugfix for the documentation build warning in here
        as well.  All of these have been in linux-next this week, with no
        reported problems"
      
      * tag 'driver-core-3.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        driver-core: fix new kernel-doc warning in base/platform.c
        sysfs: use file mode defines from stat.h
        sysfs: add more helper macro's for (bin_)attribute(_groups)
        driver core: add default groups to struct class
        driver core: Introduce device_create_groups
        sysfs: prevent warning when only using binary attributes
        sysfs: add support for binary attributes in groups
        driver core: device.h: add RW and RO attribute macros
        sysfs.h: add BIN_ATTR macro
        sysfs.h: add ATTRIBUTE_GROUPS() macro
        sysfs.h: add __ATTR_RW() macro
      7a62711a
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging · 5d88d15e
      Linus Torvalds authored
      Pull hwmon fix from Guenter Roeck:
       "Single patch to staticize a local variable"
      
      * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (abx500) Staticize abx500_temp_attributes
      5d88d15e
    • Linus Torvalds's avatar
      Merge branch 'cpuinit_phase2' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux · 3f334c20
      Linus Torvalds authored
      Pull phase two of __cpuinit removal from Paul Gortmaker:
       "With the __cpuinit infrastructure removed earlier, this group of
        commits only removes the function/data tagging that was done with the
        various (now no-op) __cpuinit related prefixes.
      
        Now that the dust has settled with yesterday's v3.11-rc1, there
        hopefully shouldn't be any new users leaking back in tree, but I think
        we can leave the harmless no-op stubs there for a release as a
        courtesy to those who still have out of tree stuff and weren't paying
        attention.
      
        Although the commits are against the recent tag to allow for minor
        context refreshes for things like yesterday's v3.11-rc1~ slab content,
        the patches have been largely unchanged for weeks, aside from such
        trivial updates.
      
        For detail junkies, the largely boring and mostly irrelevant history
        of the patches can be viewed at:
      
          http://git.kernel.org/cgit/linux/kernel/git/paulg/cpuinit-delete.git
      
        If nothing else, I guess it does at least demonstrate the level of
        involvement required to shepherd such a treewide change to completion.
      
        This is the same repository of patches that has been applied to the
        end of the daily linux-next branches for the past several weeks"
      
      * 'cpuinit_phase2' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux: (28 commits)
        block: delete __cpuinit usage from all block files
        drivers: delete __cpuinit usage from all remaining drivers files
        kernel: delete __cpuinit usage from all core kernel files
        rcu: delete __cpuinit usage from all rcu files
        net: delete __cpuinit usage from all net files
        acpi: delete __cpuinit usage from all acpi files
        hwmon: delete __cpuinit usage from all hwmon files
        cpufreq: delete __cpuinit usage from all cpufreq files
        clocksource+irqchip: delete __cpuinit usage from all related files
        x86: delete __cpuinit usage from all x86 files
        score: delete __cpuinit usage from all score files
        xtensa: delete __cpuinit usage from all xtensa files
        openrisc: delete __cpuinit usage from all openrisc files
        m32r: delete __cpuinit usage from all m32r files
        hexagon: delete __cpuinit usage from all hexagon files
        frv: delete __cpuinit usage from all frv files
        cris: delete __cpuinit usage from all cris files
        metag: delete __cpuinit usage from all metag files
        tile: delete __cpuinit usage from all tile files
        sh: delete __cpuinit usage from all sh files
        ...
      3f334c20
    • Linus Torvalds's avatar
      Merge tag 'sound-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · c66bce9b
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Except for a slightly big OMAP changes, all rest are small, mostly
        boring changes; all either 3.11 regression fixes or stable materials.
      
         - ASoC OMAP fixes due to non-DT OMAP4 removals
         - Other ASoC driver changes (sglt5000, wm8978, wm8948, samsung)
         - Fix missing locking for snd_pcm_stop() calls in many drivers
         - Fix the blocking request_module() in OSS sequencer
         - Fix old OSS vwsnd driver builds
         - Add a new HD-audio HDMI codec ID"
      
      * tag 'sound-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (23 commits)
        ALSA: seq-oss: Initialize MIDI clients asynchronously
        ALSA: hda - Add new GPU codec ID to snd-hda
        staging: line6: Fix unlocked snd_pcm_stop() call
        [media] saa7134: Fix unlocked snd_pcm_stop() call
        ASoC: s6000: Fix unlocked snd_pcm_stop() call
        ASoC: atmel: Fix unlocked snd_pcm_stop() call
        ALSA: pxa2xx: Fix unlocked snd_pcm_stop() call
        ALSA: usx2y: Fix unlocked snd_pcm_stop() call
        ALSA: ua101: Fix unlocked snd_pcm_stop() call
        ALSA: 6fire: Fix unlocked snd_pcm_stop() call
        ALSA: atiixp: Fix unlocked snd_pcm_stop() call
        ALSA: asihpi: Fix unlocked snd_pcm_stop() call
        sound: oss/vwsnd: Always define vwsnd_mutex
        sound: oss/vwsnd: Add missing inclusion of linux/delay.h
        ASoC: wm8978: enable symmetric rates
        ASoC: omap-mcbsp: Use different method for DMA request when booted with DT
        ASoC: omap-dmic: Do not use platform_get_resource_byname() for DMA
        ASoC: omap-mcpdm: Do not use platform_get_resource_byname() for DMA
        ASoC: omap-pcm: Request the DMA channel differently when DT is involved
        ASoC: Samsung: Set RFS and BFS in slave mode
        ...
      c66bce9b
    • Dave Airlie's avatar
      Merge branch 'drm/3.11/fixes' of git://linuxtv.org/pinchartl/fbdev into drm-fixes · 3668f0df
      Dave Airlie authored
      Fixes builds
      * 'drm/3.11/fixes' of git://linuxtv.org/pinchartl/fbdev:
        drm/rcar-du: Use the GEM PRIME helpers
        drm/shmobile: Use the GEM PRIME helpers
      3668f0df
    • NeilBrown's avatar
      md/raid1: fix bio handling problems in process_checks() · 30bc9b53
      NeilBrown authored
      Recent change to use bio_copy_data() in raid1 when repairing
      an array is faulty.
      
      The underlying may have changed the bio in various ways using
      bio_advance and these need to be undone not just for the 'sbio' which
      is being copied to, but also the 'pbio' (primary) which is being
      copied from.
      
      So perform the reset on all bios that were read from and do it early.
      
      This also ensure that the sbio->bi_io_vec[j].bv_len passed to
      memcmp is correct.
      
      This fixes a crash during a 'check' of a RAID1 array.  The crash was
      introduced in 3.10 so this is suitable for 3.10-stable.
      
      Cc: stable@vger.kernel.org (3.10)
      Reported-by: default avatarJoe Lawrence <joe.lawrence@stratus.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      30bc9b53
    • NeilBrown's avatar
      md: Remove recent change which allows devices to skip recovery. · 5024c298
      NeilBrown authored
      commit 7ceb17e8
          md: Allow devices to be re-added to a read-only array.
      
      allowed a bit more than just that.  It also allows devices to be added
      to a read-write array and to end up skipping recovery.
      
      This patch removes the offending piece of code pending a rewrite for a
      subsequent release.
      
      More specifically:
       If the array has a bitmap, then the device will still need a bitmap
       based resync ('saved_raid_disk' is set under different conditions
       is a bitmap is present).
       If the array doesn't have a bitmap, then this is correct as long as
       nothing has been written to the array since the metadata was checked
       by ->validate_super.  However there is no locking to ensure that there
       was no write.
      
      Bug was introduced in 3.10 and causes data corruption so
      patch is suitable for 3.10-stable.
      
      Cc: stable@vger.kernel.org (3.10)
      Reported-by: default avatarJoe Lawrence <joe.lawrence@stratus.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      5024c298
    • NeilBrown's avatar
      md/raid10: fix two problems with RAID10 resync. · 7bb23c49
      NeilBrown authored
      1/ When an different between blocks is found, data is copied from
         one bio to the other.  However bv_len is used as the length to
         copy and this could be zero.  So use r10_bio->sectors to calculate
         length instead.
         Using bv_len was probably always a bit dubious, but the introduction
         of bio_advance made it much more likely to be a problem.
      
      2/ When preparing some blocks for sync, we don't set BIO_UPTODATE
         except on bios that we schedule for a read.  This ensures that
         missing/failed devices don't confuse the loop at the top of
         sync_request write.
         Commit 8be185f2 "raid10: Use bio_reset()"
         removed a loop which set BIO_UPTDATE on all appropriate bios.
         So we need to re-add that flag.
      
      These bugs were introduced in 3.10, so this patch is suitable for
      3.10-stable, and can remove a potential for data corruption.
      
      Cc: stable@vger.kernel.org (3.10)
      Reported-by: default avatarBrassow Jonathan <jbrassow@redhat.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      7bb23c49
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-3.11' of git://people.freedesktop.org/~agd5f/linux · fb328d73
      Dave Airlie authored
      more DPM fixes for radeon.
      
      * 'drm-fixes-3.11' of git://people.freedesktop.org/~agd5f/linux:
        drm/radeon/dpm: add debugfs support for RS780/RS880 (v3)
        drm/radeon/dpm/atom: fix broken gcc harder
        drm/radeon/dpm/atom: restructure logic to work around a compiler bug
        drm/radeon/dpm: fix atom vram table parsing
        drm/radeon: fix an endian bug in atom table parsing
        drm/radeon: add a module parameter to disable aspm
      fb328d73
  4. 17 Jul, 2013 16 commits
  5. 16 Jul, 2013 2 commits
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2013-07-11' of git://people.freedesktop.org/~danvet/drm-intel · 6bd2cab2
      Dave Airlie authored
      One feature latecomer, I've forgotten to merge the patch to reeanble the
      Haswell power well feature now that the audio interaction is fixed up.
      Since that was the only unfixed issue with it I've figured I could throw
      it in a bit late, and it's trivial to revert in case I'm wrong.
      
      Otherwise all bug/regression fixes:
      - Fix status page reinit after gpu hangs, spotted by more paranoid igt
        checks.
      - Fix object list walking fumble regression in the shrinker (only the
        counting part, the actual shrinking code was correct so no Oops
        potential), from Xiong Zhang.
      - Fix DP 1.2 bw limits (Imre).
      - Restore legacy forcewake on ivb, too many broken biosen out there. We
        dump a warn though that recent userspace might fall over with that
        config (Guenter Roeck).
      - Patch up the gen2 cs tlb w/a.
      - Improve the fence coherency w/a now that we have a better understanding
        what's going on. The removed wbinvd+ipi should make -rt folks happy. Big
        thanks to Jon Bloomfield for figuring this out, patches from Chris.
      - Fix write-read race when switching ring (Chris). Spotted with code
        inspection, but now we also have an igt for it.
      
      There's an ugly regression we're still working on introduced between
      3.10-rc7 and 3.10.0. Unfortunately we can't just revert the offender since
      that one fixes another regression :( I've asked Steven to include my
      -fixes branch into linux-next to prevent such fallout in the future,
      hopefully.
      
      * tag 'drm-intel-fixes-2013-07-11' of git://people.freedesktop.org/~danvet/drm-intel:
        Revert "drm/i915: Workaround incoherence between fences and LLC across multiple CPUs"
        drm/i915: Fix incoherence with fence updates on Sandybridge+
        drm/i915: Fix write-read race with multiple rings
        Partially revert "drm/i915: unconditionally use mt forcewake on hsw/ivb"
        drm/i915: fix lane bandwidth capping for DP 1.2 sinks
        drm/i915: fix up ring cleanup for the i830/i845 CS tlb w/a
        drm/i915: Correct obj->mm_list link to dev_priv->dev_priv->mm.inactive_list
        drm/i915: switch disable_power_well default value to 1
        drm/i915: reinit status page registers after gpu reset
      6bd2cab2
    • Kees Cook's avatar
      x86: Make sure IDT is page aligned · 4df05f36
      Kees Cook authored
      Since the IDT is referenced from a fixmap, make sure it is page aligned.
      Merge with 32-bit one, since it was already aligned to deal with F00F
      bug. Since bss is cleared before IDT setup, it can live there. This also
      moves the other *_idt_table variables into common locations.
      
      This avoids the risk of the IDT ever being moved in the bss and having
      the mapping be offset, resulting in calling incorrect handlers. In the
      current upstream kernel this is not a manifested bug, but heavily patched
      kernels (such as those using the PaX patch series) did encounter this bug.
      
      The tables other than idt_table technically do not need to be page
      aligned, at least not at the current time, but using a common
      declaration avoids mistakes.  On 64 bits the table is exactly one page
      long, anyway.
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Link: http://lkml.kernel.org/r/20130716183441.GA14232@www.outflux.netReported-by: default avatarPaX Team <pageexec@gmail.com>
      Signed-off-by: default avatarH. Peter Anvin <hpa@linux.intel.com>
      4df05f36