1. 18 Oct, 2013 2 commits
    • Chris Wilson's avatar
      drm: Pad drm_mode_get_connector to 64-bit boundary · bc5bd37c
      Chris Wilson authored
      Pavel Roskin reported that DRM_IOCTL_MODE_GETCONNECTOR was overwritting
      the 4 bytes beyond the end of its structure with a 32-bit userspace
      running on a 64-bit kernel. This is due to the padding gcc inserts as
      the drm_mode_get_connector struct includes a u64 and its size is not a
      natural multiple of u64s.
      
      64-bit kernel:
      
      sizeof(drm_mode_get_connector)=80, alignof=8
      sizeof(drm_mode_get_encoder)=20, alignof=4
      sizeof(drm_mode_modeinfo)=68, alignof=4
      
      32-bit userspace:
      
      sizeof(drm_mode_get_connector)=76, alignof=4
      sizeof(drm_mode_get_encoder)=20, alignof=4
      sizeof(drm_mode_modeinfo)=68, alignof=4
      
      Fortuituously we can insert explicit padding to the tail of our
      structures without breaking ABI.
      Reported-by: default avatarPavel Roskin <proski@gnu.org>
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: dri-devel@lists.freedesktop.org
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      bc5bd37c
    • Chris Wilson's avatar
      drm: Prevent overwriting from userspace underallocating core ioctl structs · b062672e
      Chris Wilson authored
      Apply the protections from
      
      commit 1b2f1489
      Author: Dave Airlie <airlied@redhat.com>
      Date:   Sat Aug 14 20:20:34 2010 +1000
      
          drm: block userspace under allocating buffer and having drivers overwrite it (v2)
      
      to the core ioctl structs as well, for we found one instance where there
      is a 32-/64-bit size mismatch and were guilty of writing beyond the end
      of the user's buffer.
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Dave Airlie <airlied@redhat.com>
      Reviewed-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
      Cc: dri-devel@lists.freedesktop.org
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      b062672e
  2. 15 Oct, 2013 2 commits
  3. 11 Oct, 2013 3 commits
    • Dave Airlie's avatar
      Revert "i915: Update VGA arbiter support for newer devices" · ebff5fa9
      Dave Airlie authored
      This reverts commit 81b5c7bc.
      
      Adding drm/i915 into the vga arbiter chain means that X (in a piece of
      well-meant paranoia) will do a get/put on the vga decoding around
      _every_ accel call down into the ddx. Which results in some nice
      performance disasters [1]. This really breaks userspace, by disabling
      DRI for everyone, and stops OpenGL from working, this isn't limited
      to just the i915 but both the integrated and discrete GPUs on
      multi-gpu systems, in other words this causes untold worlds of pain,
      
      Ville tried to come up with a Great Hack to fiddle the required VGA
      I/O ops behind everyone's back using stop_machine, but that didn't
      really work out [2]. Given that we're fairly late in the -rc stage for
      such games let's just revert this all.
      
      One thing we might want to keep is to delay the disabling of the vga
      decoding until the fbdev emulation and the fbcon screen is set up. If
      we kill vga mem decoding beforehand fbcon can end up with a white
      square in the top-left corner it tried to save from the vga memory for
      a seamless transition. And we have bug reports on older platforms
      which seem to match these symptoms.
      
      But again that's something to play around with in -next.
      
      References: [1] http://lists.x.org/archives/xorg-devel/2013-September/037763.html
      References: [2] http://www.spinics.net/lists/intel-gfx/msg34062.html
      Cc: Alex Williamson <alex.williamson@redhat.com>
      Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
      Cc: Chris Wilson <chris@chris-wilson.co.uk>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      ebff5fa9
    • Dave Airlie's avatar
      Revert "drm/i915: Delay disabling of VGA memory until vgacon->fbcon handoff is done" · e1264ebe
      Dave Airlie authored
      This reverts commit 6e1b4fda.
      
      This is part of a revert due to a userspace breakage, better explained in the revert of 1a1a4cbf4906a13c0c377f708df5d94168e7b582.
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      e1264ebe
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-3.12' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 23026285
      Dave Airlie authored
      Regression fixes for audio and UVD, several hang fixes,
      some DPM fixes.
      
      * 'drm-fixes-3.12' of git://people.freedesktop.org/~agd5f/linux:
        drm/radeon: re-enable sw ACR support on pre-DCE4
        drm/radeon/dpm: disable bapm on TN asics
        drm/radeon: improve soft reset on CIK
        drm/radeon: improve soft reset on SI
        drm/radeon/dpm: off by one in si_set_mc_special_registers()
        drm/radeon/dpm/btc: off by one in btc_set_mc_special_registers()
        drm/radeon: forever loop on error in radeon_do_test_moves()
        drm/radeon: fix hw contexts for SUMO2 asics
        drm/radeon: fix typo in CP DMA register headers
        drm/radeon/dpm: disable multiple UVD states
        drm/radeon: use hw generated CTS/N values for audio
        drm/radeon: fix N/CTS clock matching for audio
        drm/radeon: use 64-bit math to calculate CTS values for audio (v2)
        drm/edid: catch kmalloc failure in drm_edid_to_speaker_allocation
      23026285
  4. 10 Oct, 2013 1 commit
  5. 09 Oct, 2013 16 commits
  6. 08 Oct, 2013 1 commit
  7. 07 Oct, 2013 1 commit
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2013-10-07' of... · 12444d5f
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2013-10-07' of git://people.freedesktop.org/~danvet/drm-intel into drm-fixes
      
      Daniel writes:
      Just a few important fixes, all cc: stable (I've checked this time around
      and made sure they're really there ...). The dpms one is a regression from
      the modeset rework and has a good chance to rectify Linus' hdmi issues.
      
      * tag 'drm-intel-fixes-2013-10-07' of git://people.freedesktop.org/~danvet/drm-intel:
        drm/i915: Only apply DPMS to the encoder if enabled
        drm/i915: Mask LPSP to get PSR working even with Power Well in use by audio.
        drm/i915/hsw: Disable L3 caching of atomic memory operations.
        drm/i915: fix rps.vlv_work initialization
      12444d5f
  8. 06 Oct, 2013 4 commits
    • Linus Torvalds's avatar
      Linux 3.12-rc4 · d0e639c9
      Linus Torvalds authored
      d0e639c9
    • Eric W. Biederman's avatar
      net: Update the sysctl permissions handler to test effective uid/gid · 2433c8f0
      Eric W. Biederman authored
      Modify the code to use current_euid(), and in_egroup_p, as in done
      in fs/proc/proc_sysctl.c:test_perm()
      
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarEric Sandeen <sandeen@redhat.com>
      Reported-by: default avatarEric Sandeen <sandeen@redhat.com>
      Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2433c8f0
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · 13caa8ed
      Linus Torvalds authored
      Pull SCSI target fixes from Nicholas Bellinger:
       "Here are the outstanding target fixes queued up for v3.12-rc4 code.
      
        The highlights include:
      
         - Make vhost/scsi tag percpu_ida_alloc() use GFP_ATOMIC
         - Allow sess_cmd_map allocation failure fallback to use vzalloc
         - Fix COMPARE_AND_WRITE se_cmd->data_length bug with FILEIO backends
         - Fixes for COMPARE_AND_WRITE callback recursive failure OOPs + non
           zero scsi_status bug
         - Make iscsi-target do acknowledgement tag release from RX context
         - Setup iscsi-target with extra (cmdsn_depth / 2) percpu_ida tags
      
        Also included is a iscsi-target patch CC'ed for v3.10+ that avoids
        legacy wait_for_task=true release during fast-past StatSN
        acknowledgement, and two other SRP target related patches that address
        long-standing issues that are CC'ed for v3.3+.
      
        Extra thanks to Thomas Glanzmann for his testing feedback with
        COMPARE_AND_WRITE + EXTENDED_COPY VAAI logic"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
        iscsi-target; Allow an extra tag_num / 2 number of percpu_ida tags
        iscsi-target: Perform release of acknowledged tags from RX context
        iscsi-target: Only perform wait_for_tasks when performing shutdown
        target: Fail on non zero scsi_status in compare_and_write_callback
        target: Fix recursive COMPARE_AND_WRITE callback failure
        target: Reset data_length for COMPARE_AND_WRITE to NoLB * block_size
        ib_srpt: always set response for task management
        target: Fall back to vzalloc upon ->sess_cmd_map kzalloc failure
        vhost/scsi: Use GFP_ATOMIC with percpu_ida_alloc for obtaining tag
        ib_srpt: Destroy cm_id before destroying QP.
        target: Fix xop->dbl assignment in target_xcopy_parse_segdesc_02
      13caa8ed
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma · 831ae3c1
      Linus Torvalds authored
      Pull slave-dmaengine fixes from Vinod Koul:
       "Here is the slave dmanegine fixes.  We have the fix for deadlock issue
        on imx-dma by Michael and Josh's edma config fix along with author
        change"
      
      * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: imx-dma: fix callback path in tasklet
        dmaengine: imx-dma: fix lockdep issue between irqhandler and tasklet
        dmaengine: imx-dma: fix slow path issue in prep_dma_cyclic
        dma/Kconfig: Make TI_EDMA select TI_PRIV_EDMA
        edma: Update author email address
      831ae3c1
  9. 05 Oct, 2013 9 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · e62063d6
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "This is a small collection of fixes, including a regression fix from
        Liu Bo that solves rare crashes with compression on.
      
        I've merged my for-linus up to 3.12-rc3 because the top commit is only
        meant for 3.12.  The rest of the fixes are also available in my master
        branch on top of my last 3.11 based pull"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        btrfs: Fix crash due to not allocating integrity data for a bioset
        Btrfs: fix a use-after-free bug in btrfs_dev_replace_finishing
        Btrfs: eliminate races in worker stopping code
        Btrfs: fix crash of compressed writes
        Btrfs: fix transid verify errors when recovering log tree
      e62063d6
    • Linus Torvalds's avatar
      Merge tag 'gpio-v3.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 85f6d2db
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "Two patches for the OMAP driver, dealing with setting up IRQs properly
        on the device tree boot path"
      
      * tag 'gpio-v3.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio/omap: auto-setup a GPIO when used as an IRQ
        gpio/omap: maintain GPIO and IRQ usage separately
      85f6d2db
    • Linus Torvalds's avatar
      Merge tag 'usb-3.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 4ed54764
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are none fixes for various USB driver problems.  The majority are
        gadget/musb fixes, but there are some new device ids in here as well"
      
      * tag 'usb-3.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: chipidea: add Intel Clovertrail pci id
        usb: gadget: s3c-hsotg: fix can_write limit for non-periodic endpoints
        usb: gadget: f_fs: fix error handling
        usb: musb: dsps: do not bind to "musb-hdrc"
        USB: serial: option: Ignore card reader interface on Huawei E1750
        usb: musb: gadget: fix otg active status flag
        usb: phy: gpio-vbus: fix deferred probe from __init
        usb: gadget: pxa25x_udc: fix deferred probe from __init
        usb: musb: fix otg default state
      4ed54764
    • Linus Torvalds's avatar
      Merge tag 'tty-3.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · e3757a1f
      Linus Torvalds authored
      Pull tty fixes from Greg KH:
       "Here are two tty driver fixes for 3.12-rc4.
      
        One fixes the reported regression in the n_tty code that a number of
        people found recently, and the other one fixes an issue with xen
        consoles that broke in 3.10"
      
      * tag 'tty-3.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        xen/hvc: allow xenboot console to be used again
        tty: Fix pty master read() after slave closes
      e3757a1f
    • Linus Torvalds's avatar
      Merge tag 'staging-3.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 20fa7867
      Linus Torvalds authored
      Pull staging fixes from Greg KH:
       "Here are 4 tiny staging and iio driver fixes for 3.12-rc4.  Nothing
        major, just some small fixes for reported issues"
      
      * tag 'staging-3.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: comedi: ni_65xx: (bug fix) confine insn_bits to one subdevice
        iio:magnetometer: Bugfix magnetometer default output registers
        iio: Remove debugfs entries in iio_device_unregister()
        iio: amplifiers: ad8366: Remove regulator_put
      20fa7867
    • Darrick J. Wong's avatar
      btrfs: Fix crash due to not allocating integrity data for a bioset · b208c2f7
      Darrick J. Wong authored
      When btrfs creates a bioset, we must also allocate the integrity data pool.
      Otherwise btrfs will crash when it tries to submit a bio to a checksumming
      disk:
      
       BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
       IP: [<ffffffff8111e28a>] mempool_alloc+0x4a/0x150
       PGD 2305e4067 PUD 23063d067 PMD 0
       Oops: 0000 [#1] PREEMPT SMP
       Modules linked in: btrfs scsi_debug xfs ext4 jbd2 ext3 jbd mbcache
      sch_fq_codel eeprom lpc_ich mfd_core nfsd exportfs auth_rpcgss af_packet
      raid6_pq xor zlib_deflate libcrc32c [last unloaded: scsi_debug]
       CPU: 1 PID: 4486 Comm: mount Not tainted 3.12.0-rc1-mcsum #2
       Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
       task: ffff8802451c9720 ti: ffff880230698000 task.ti: ffff880230698000
       RIP: 0010:[<ffffffff8111e28a>]  [<ffffffff8111e28a>] mempool_alloc+0x4a/0x150
       RSP: 0018:ffff880230699688  EFLAGS: 00010286
       RAX: 0000000000000001 RBX: 0000000000000000 RCX: 00000000005f8445
       RDX: 0000000000000001 RSI: 0000000000000010 RDI: 0000000000000000
       RBP: ffff8802306996f8 R08: 0000000000011200 R09: 0000000000000008
       R10: 0000000000000020 R11: ffff88009d6e8000 R12: 0000000000011210
       R13: 0000000000000030 R14: ffff8802306996b8 R15: ffff8802451c9720
       FS:  00007f25b8a16800(0000) GS:ffff88024fc80000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
       CR2: 0000000000000018 CR3: 0000000230576000 CR4: 00000000000007e0
       Stack:
        ffff8802451c9720 0000000000000002 ffffffff81a97100 0000000000281250
        ffffffff81a96480 ffff88024fc99150 ffff880228d18200 0000000000000000
        0000000000000000 0000000000000040 ffff880230e8c2e8 ffff8802459dc900
       Call Trace:
        [<ffffffff811b2208>] bio_integrity_alloc+0x48/0x1b0
        [<ffffffff811b26fc>] bio_integrity_prep+0xac/0x360
        [<ffffffff8111e298>] ? mempool_alloc+0x58/0x150
        [<ffffffffa03e8041>] ? alloc_extent_state+0x31/0x110 [btrfs]
        [<ffffffff81241579>] blk_queue_bio+0x1c9/0x460
        [<ffffffff8123e58a>] generic_make_request+0xca/0x100
        [<ffffffff8123e639>] submit_bio+0x79/0x160
        [<ffffffffa03f865e>] btrfs_map_bio+0x48e/0x5b0 [btrfs]
        [<ffffffffa03c821a>] btree_submit_bio_hook+0xda/0x110 [btrfs]
        [<ffffffffa03e7eba>] submit_one_bio+0x6a/0xa0 [btrfs]
        [<ffffffffa03ef450>] read_extent_buffer_pages+0x250/0x310 [btrfs]
        [<ffffffff8125eef6>] ? __radix_tree_preload+0x66/0xf0
        [<ffffffff8125f1c5>] ? radix_tree_insert+0x95/0x260
        [<ffffffffa03c66f6>] btree_read_extent_buffer_pages.constprop.128+0xb6/0x120
      [btrfs]
        [<ffffffffa03c8c1a>] read_tree_block+0x3a/0x60 [btrfs]
        [<ffffffffa03caefd>] open_ctree+0x139d/0x2030 [btrfs]
        [<ffffffffa03a282a>] btrfs_mount+0x53a/0x7d0 [btrfs]
        [<ffffffff8113ab0b>] ? pcpu_alloc+0x8eb/0x9f0
        [<ffffffff81167305>] ? __kmalloc_track_caller+0x35/0x1e0
        [<ffffffff81176ba0>] mount_fs+0x20/0xd0
        [<ffffffff81191096>] vfs_kern_mount+0x76/0x120
        [<ffffffff81193320>] do_mount+0x200/0xa40
        [<ffffffff81135cdb>] ? strndup_user+0x5b/0x80
        [<ffffffff81193bf0>] SyS_mount+0x90/0xe0
        [<ffffffff8156d31d>] system_call_fastpath+0x1a/0x1f
       Code: 4c 8d 75 a8 4c 89 6d e8 45 89 e0 4c 8d 6f 30 48 89 5d d8 41 83 e0 af 48
      89 fb 49 83 c6 18 4c 89 7d f8 65 4c 8b 3c 25 c0 b8 00 00 <48> 8b 73 18 44 89 c7
      44 89 45 98 ff 53 20 48 85 c0 48 89 c2 74
       RIP  [<ffffffff8111e28a>] mempool_alloc+0x4a/0x150
        RSP <ffff880230699688>
       CR2: 0000000000000018
       ---[ end trace 7a96042017ed21e2 ]---
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarJosef Bacik <jbacik@fusionio.com>
      Signed-off-by: default avatarChris Mason <chris.mason@fusionio.com>
      b208c2f7
    • Chris Mason's avatar
      Merge branch 'for-linus' into for-linus-3.12 · 1329dfc8
      Chris Mason authored
      1329dfc8
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6 · a5c984cc
      Linus Torvalds authored
      Pull CIFS fixes from Steve French:
       "Small set of cifs fixes.  Most important is Jeff's fix that works
        around disconnection problems which can be caused by simultaneous use
        of user space tools (starting a long running smbclient backup then
        doing a cifs kernel mount) or multiple cifs mounts through a NAT, and
        Jim's fix to deal with reexport of cifs share.
      
        I expect to send two more cifs fixes next week (being tested now) -
        fixes to address an SMB2 unmount hang when server dies and a fix for
        cifs symlink handling of Windows "NFS" symlinks"
      
      * 'for-linus' of git://git.samba.org/sfrench/cifs-2.6:
        [CIFS] update cifs.ko version
        [CIFS] Remove ext2 flags that have been moved to fs.h
        [CIFS] Provide sane values for nlink
        cifs: stop trying to use virtual circuits
        CIFS: FS-Cache: Uncache unread pages in cifs_readpages() before freeing them
      a5c984cc
    • Linus Torvalds's avatar
      Merge tag 'pci-v3.12-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · 95167aad
      Linus Torvalds authored
      Pull PCI fix from Bjorn Helgaas:
       "We merged what was intended to be an MMCONFIG cleanup, but in fact,
        for systems without _CBA (which is almost everything), it broke
        extended config space for domain 0 and it broke all config space for
        other domains.
      
        This reverts the change"
      
      * tag 'pci-v3.12-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        Revert "x86/PCI: MMCONFIG: Check earlier for MMCONFIG region at address zero"
      95167aad
  10. 04 Oct, 2013 1 commit