1. 20 Nov, 2014 15 commits
    • Richard Guy Briggs's avatar
      audit: AUDIT_FEATURE_CHANGE message format missing delimiting space · 0960c0d8
      Richard Guy Briggs authored
      commit 897f1acb upstream.
      
      Add a space between subj= and feature= fields to make them parsable.
      Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
      Signed-off-by: default avatarPaul Moore <pmoore@redhat.com>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      0960c0d8
    • Johannes Berg's avatar
      mac80211: properly flush delayed scan work on interface removal · b1101d48
      Johannes Berg authored
      commit 46238845 upstream.
      
      When an interface is deleted, an ongoing hardware scan is canceled and
      the driver must abort the scan, at the very least reporting completion
      while the interface is removed.
      
      However, if it scheduled the work that might only run after everything
      is said and done, which leads to cfg80211 warning that the scan isn't
      reported as finished yet; this is no fault of the driver, it already
      did, but mac80211 hasn't processed it.
      
      To fix this situation, flush the delayed work when the interface being
      removed is the one that was executing the scan.
      Reported-by: default avatarSujith Manoharan <sujith@msujith.org>
      Tested-by: default avatarSujith Manoharan <sujith@msujith.org>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      b1101d48
    • Luciano Coelho's avatar
      mac80211: schedule the actual switch of the station before CSA count 0 · 074c0bf0
      Luciano Coelho authored
      commit ff1e417c upstream.
      
      Due to the time it takes to process the beacon that started the CSA
      process, we may be late for the switch if we try to reach exactly
      beacon 0.  To avoid that, use count - 1 when calculating the switch time.
      Reported-by: default avatarJouni Malinen <j@w1.fi>
      Signed-off-by: default avatarLuciano Coelho <luciano.coelho@intel.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      074c0bf0
    • Luciano Coelho's avatar
      mac80211: use secondary channel offset IE also beacons during CSA · da82b513
      Luciano Coelho authored
      commit 84469a45 upstream.
      
      If we are switching from an HT40+ to an HT40- channel (or vice-versa),
      we need the secondary channel offset IE to specify what is the
      post-CSA offset to be used.  This applies both to beacons and to probe
      responses.
      
      In ieee80211_parse_ch_switch_ie() we were ignoring this IE from
      beacons and using the *current* HT information IE instead.  This was
      causing us to use the same offset as before the switch.
      
      Fix that by using the secondary channel offset IE also for beacons and
      don't ever use the pre-switch offset.  Additionally, remove the
      "beacon" argument from ieee80211_parse_ch_switch_ie(), since it's not
      needed anymore.
      Reported-by: default avatarJouni Malinen <j@w1.fi>
      Signed-off-by: default avatarLuciano Coelho <luciano.coelho@intel.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      da82b513
    • Krzysztof Kozlowski's avatar
      power: charger-manager: Fix accessing invalidated power supply after charger unbind · 8ff3aebf
      Krzysztof Kozlowski authored
      commit cdaf3e15 upstream.
      
      The charger manager obtained in probe references to power supplies for
      all chargers with power_supply_get_by_name() for later usage. However
      if such charger driver was removed then this reference would point to
      old power supply (from driver which was removed).
      
      This lead to accessing invalid memory which could be observed with:
      $ echo "max77693-charger" > /sys/bus/platform/drivers/max77693-charger/unbind
      $ grep . /sys/devices/virtual/power_supply/battery/charger.0/*
      $ grep . /sys/devices/virtual/power_supply/battery/*
      [   15.339817] Unable to handle kernel paging request at virtual address 0001c12c
      [   15.346187] pgd = edd08000
      [   15.348814] [0001c12c] *pgd=6dce2831, *pte=00000000, *ppte=00000000
      [   15.355075] Internal error: Oops: 80000007 [#1] PREEMPT SMP ARM
      [   15.360967] Modules linked in:
      [   15.364010] CPU: 2 PID: 1388 Comm: grep Not tainted 3.17.0-next-20141007-00027-ga95e761db1b0 #245
      [   15.372859] task: ee03ad00 ti: edcf6000 task.ti: edcf6000
      [   15.378241] PC is at 0x1c12c
      [   15.381113] LR is at is_ext_pwr_online+0x30/0x6c
      [   15.385706] pc : [<0001c12c>]    lr : [<c0339fc4>]    psr: a0000013
      [   15.385706] sp : edcf7e88  ip : 00000000  fp : 00000000
      [   15.397161] r10: eeb02c08  r9 : c04b1f84  r8 : eeb02c00
      [   15.402369] r7 : edc69a10  r6 : eea6ac10  r5 : eea6ac10  r4 : 00000004
      [   15.408878] r3 : 0001c12c  r2 : edcf7e8c  r1 : 00000004  r0 : ee914418
      [   15.415390] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
      [   15.422506] Control: 10c5387d  Table: 6dd0804a  DAC: 00000015
      [   15.428236] Process grep (pid: 1388, stack limit = 0xedcf6240)
      [   15.434050] Stack: (0xedcf7e88 to 0xedcf8000)
      [   15.438395] 7e80:                   ee03ad00 00000000 edcf7f80 eea6aca8 edcf7ec4 c033b7b0
      [   15.446554] 7ea0: 00000001 ee1cc3f0 00000004 c06e1e44 eebdc000 c06e1e44 eeb02c00 c0337144
      [   15.454713] 7ec0: ee2dac68 c005cffc ee1cc3c0 c06e1e44 00000fff 00001000 eebdc000 c0278ca8
      [   15.462872] 7ee0: c0278c8c ee1cc3c0 eeb7ce00 c014422c edcf7f20 00008000 ee1cc3c0 ee9a48c0
      [   15.471030] 7f00: 00000001 00000001 edcf7f80 c0142d94 c0142d70 c01060f4 00021000 ee1cc3f0
      [   15.479190] 7f20: 00000000 00000000 c06a2150 eebdc000 2e7ec000 ee9a48c0 00008000 00021000
      [   15.487349] 7f40: edcf7f80 00008000 edcf6000 00021000 00021000 c00e39a4 00000000 ee9a48c0
      [   15.495508] 7f60: 00004000 00000000 00000000 ee9a48c0 ee9a48c0 00008000 00021000 c00e3aa0
      [   15.503668] 7f80: 00000000 00000000 0001f2e0 0001f2e0 00021000 00001000 00000003 c000f364
      [   15.511826] 7fa0: 00000000 c000f1a0 0001f2e0 00021000 00000003 00021000 00008000 00000000
      [   15.519986] 7fc0: 0001f2e0 00021000 00001000 00000003 00000001 000205e8 00000000 00021000
      [   15.528145] 7fe0: 00008000 bebbe910 0000a7ad b6edc49c 60000010 00000003 aaaaaaaa aaaaaaaa
      [   15.536320] [<c0339fc4>] (is_ext_pwr_online) from [<c033b7b0>] (charger_get_property+0x170/0x314)
      [   15.545164] [<c033b7b0>] (charger_get_property) from [<c0337144>] (power_supply_show_property+0x48/0x20c)
      [   15.554719] [<c0337144>] (power_supply_show_property) from [<c0278ca8>] (dev_attr_show+0x1c/0x48)
      [   15.563577] [<c0278ca8>] (dev_attr_show) from [<c014422c>] (sysfs_kf_seq_show+0x84/0x104)
      [   15.571725] [<c014422c>] (sysfs_kf_seq_show) from [<c0142d94>] (kernfs_seq_show+0x24/0x28)
      [   15.579973] [<c0142d94>] (kernfs_seq_show) from [<c01060f4>] (seq_read+0x1b0/0x484)
      [   15.587614] [<c01060f4>] (seq_read) from [<c00e39a4>] (vfs_read+0x88/0x144)
      [   15.594552] [<c00e39a4>] (vfs_read) from [<c00e3aa0>] (SyS_read+0x40/0x8c)
      [   15.601417] [<c00e3aa0>] (SyS_read) from [<c000f1a0>] (ret_fast_syscall+0x0/0x48)
      [   15.608877] Code: bad PC value
      [   15.611991] ---[ end trace a88fcc95208db283 ]---
      
      The charger-manager should get reference to charger power supply on
      each use of get_property callback.
      Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Fixes: 3bb3dbbd ("power_supply: Add initial Charger-Manager driver")
      Signed-off-by: default avatarSebastian Reichel <sre@kernel.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      8ff3aebf
    • Krzysztof Kozlowski's avatar
      power: charger-manager: Fix accessing invalidated power supply after fuel gauge unbind · d4ce860a
      Krzysztof Kozlowski authored
      commit bdbe8144 upstream.
      
      The charger manager obtained reference to fuel gauge power supply in probe
      with power_supply_get_by_name() for later usage. However if fuel gauge
      driver was removed and re-added then this reference would point to old
      power supply (from driver which was removed).
      
      This lead to accessing old (and probably invalid) memory which could be
      observed with:
      $ echo "12-0036" > /sys/bus/i2c/drivers/max17042/unbind
      $ echo "12-0036" > /sys/bus/i2c/drivers/max17042/bind
      $ cat /sys/devices/virtual/power_supply/battery/capacity
      [  240.480084] INFO: task cat:1393 blocked for more than 120 seconds.
      [  240.484799]       Not tainted 3.17.0-next-20141007-00028-ge60b6dd79570 #203
      [  240.491782] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
      [  240.499589] cat             D c0469530     0  1393      1 0x00000000
      [  240.505947] [<c0469530>] (__schedule) from [<c0469d3c>] (schedule_preempt_disabled+0x14/0x20)
      [  240.514449] [<c0469d3c>] (schedule_preempt_disabled) from [<c046af08>] (mutex_lock_nested+0x1bc/0x458)
      [  240.523736] [<c046af08>] (mutex_lock_nested) from [<c0287a98>] (regmap_read+0x30/0x60)
      [  240.531647] [<c0287a98>] (regmap_read) from [<c032238c>] (max17042_get_property+0x2e8/0x350)
      [  240.540055] [<c032238c>] (max17042_get_property) from [<c03247d8>] (charger_get_property+0x264/0x348)
      [  240.549252] [<c03247d8>] (charger_get_property) from [<c0320764>] (power_supply_show_property+0x48/0x1e0)
      [  240.558808] [<c0320764>] (power_supply_show_property) from [<c027308c>] (dev_attr_show+0x1c/0x48)
      [  240.567664] [<c027308c>] (dev_attr_show) from [<c0141fb0>] (sysfs_kf_seq_show+0x84/0x104)
      [  240.575814] [<c0141fb0>] (sysfs_kf_seq_show) from [<c0140b18>] (kernfs_seq_show+0x24/0x28)
      [  240.584061] [<c0140b18>] (kernfs_seq_show) from [<c0104574>] (seq_read+0x1b0/0x484)
      [  240.591702] [<c0104574>] (seq_read) from [<c00e1e24>] (vfs_read+0x88/0x144)
      [  240.598640] [<c00e1e24>] (vfs_read) from [<c00e1f20>] (SyS_read+0x40/0x8c)
      [  240.605507] [<c00e1f20>] (SyS_read) from [<c000e760>] (ret_fast_syscall+0x0/0x48)
      [  240.612952] 4 locks held by cat/1393:
      [  240.616589]  #0:  (&p->lock){+.+.+.}, at: [<c01043f4>] seq_read+0x30/0x484
      [  240.623414]  #1:  (&of->mutex){+.+.+.}, at: [<c01417dc>] kernfs_seq_start+0x1c/0x8c
      [  240.631086]  #2:  (s_active#31){++++.+}, at: [<c01417e4>] kernfs_seq_start+0x24/0x8c
      [  240.638777]  #3:  (&map->mutex){+.+...}, at: [<c0287a98>] regmap_read+0x30/0x60
      
      The charger-manager should get reference to fuel gauge power supply on
      each use of get_property callback. The thermal zone 'tzd' field of
      power supply should not be used because of the same reason.
      
      Additionally this change solves also the issue with nested
      thermal_zone_get_temp() calls and related false lockdep positive for
      deadlock for thermal zone's mutex [1]. When fuel gauge is used as source of
      temperature then the charger manager forwards its get_temp calls to fuel
      gauge thermal zone. So actually different mutexes are used (one for
      charger manager thermal zone and second for fuel gauge thermal zone) but
      for lockdep this is one class of mutex.
      
      The recursion is removed by retrieving temperature through power
      supply's get_property().
      
      In case external thermal zone is used ('cm-thermal-zone' property is
      present in DTS) the recursion does not exist. Charger manager simply
      exports POWER_SUPPLY_PROP_TEMP_AMBIENT property (instead of
      POWER_SUPPLY_PROP_TEMP) thus no thermal zone is created for this power
      supply.
      
      [1] https://lkml.org/lkml/2014/10/6/309Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Fixes: 3bb3dbbd ("power_supply: Add initial Charger-Manager driver")
      Signed-off-by: default avatarSebastian Reichel <sre@kernel.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      d4ce860a
    • Krzysztof Kozlowski's avatar
      power: bq2415x_charger: Fix memory leak on DTS parsing error · 9863a157
      Krzysztof Kozlowski authored
      commit 21e863b2 upstream.
      
      Memory allocated for 'name' was leaking if required binding properties
      were not present.
      
      The memory for 'name' was allocated early at probe with kasprintf(). It
      was freed in error paths executed before and after parsing DTS but not
      in that error path.
      
      Fix the error path for parsing device tree properties.
      Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Fixes: faffd234 ("bq2415x_charger: Add DT support")
      Signed-off-by: default avatarSebastian Reichel <sre@kernel.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      9863a157
    • Krzysztof Kozlowski's avatar
      power: bq2415x_charger: Properly handle ENODEV from power_supply_get_by_phandle · fe652189
      Krzysztof Kozlowski authored
      commit 0eaf437a upstream.
      
      The power_supply_get_by_phandle() on error returns ENODEV or NULL.
      The driver later expects obtained pointer to power supply to be
      valid or NULL. If it is not NULL then it dereferences it in
      bq2415x_notifier_call() which would lead to dereferencing ENODEV-value
      pointer.
      
      Properly handle the power_supply_get_by_phandle() error case by
      replacing error value with NULL. This indicates that usb charger
      detection won't be used.
      
      Fix also memory leak of 'name' if power_supply_get_by_phandle() fails
      with NULL and probe should defer.
      Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Fixes: faffd234 ("bq2415x_charger: Add DT support")
      [small fix regarding the missing ti,usb-charger-detection info message]
      Signed-off-by: default avatarSebastian Reichel <sre@kernel.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      fe652189
    • James Ralston's avatar
      ahci: Add Device IDs for Intel Sunrise Point PCH · f3916f16
      James Ralston authored
      commit 690000b9 upstream.
      
      This patch adds the AHCI-mode SATA Device IDs for the Intel Sunrise Point PCH.
      Signed-off-by: default avatarJames Ralston <james.d.ralston@intel.com>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      f3916f16
    • Tejun Heo's avatar
      ahci: disable MSI instead of NCQ on Samsung pci-e SSDs on macbooks · d14dfad7
      Tejun Heo authored
      commit 66a7cbc3 upstream.
      
      Samsung pci-e SSDs on macbooks failed miserably on NCQ commands, so
      67809f85 ("ahci: disable NCQ on Samsung pci-e SSDs on macbooks")
      disabled NCQ on them.  It turns out that NCQ is fine as long as MSI is
      not used, so let's turn off MSI and leave NCQ on.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=60731
      Tested-by: <dorin@i51.org>
      Tested-by: default avatarImre Kaloz <kaloz@openwrt.org>
      Fixes: 67809f85 ("ahci: disable NCQ on Samsung pci-e SSDs on macbooks")
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      d14dfad7
    • Simon Horman's avatar
      ata: sata_rcar: Disable DIPM mode for r8a7790 ES1 · 892d2eb0
      Simon Horman authored
      commit aa1cf258 upstream.
      
      Unlike other SATA R-Car r8a7790 controllers the r8a7790 ES1 SATA R-Car
      controller needs to be run with DIPM disabled.
      Signed-off-by: default avatarSimon Horman <horms+renesas@verge.net.au>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      892d2eb0
    • Heinz Mauelshagen's avatar
      dm raid: ensure superblock's size matches device's logical block size · 3b24fbed
      Heinz Mauelshagen authored
      commit 40d43c4b upstream.
      
      The dm-raid superblock (struct dm_raid_superblock) is padded to 512
      bytes and that size is being used to read it in from the metadata
      device into one preallocated page.
      
      Reading or writing this on a 512-byte sector device works fine but on
      a 4096-byte sector device this fails.
      
      Set the dm-raid superblock's size to the logical block size of the
      metadata device, because IO at that size is guaranteed too work.  Also
      add a size check to avoid silent partial metadata loss in case the
      superblock should ever grow past the logical block size or PAGE_SIZE.
      
      [includes pointer math fix from Dan Carpenter]
      Reported-by: default avatar"Liuhua Wang" <lwang@suse.com>
      Signed-off-by: default avatarHeinz Mauelshagen <heinzm@redhat.com>
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      3b24fbed
    • Max Filippov's avatar
      xtensa: re-wire umount syscall to sys_oldumount · feb19c87
      Max Filippov authored
      commit 2651cc69 upstream.
      
      Userspace actually passes single parameter (path name) to the umount
      syscall, so new umount just fails. Fix it by requesting old umount
      syscall implementation and re-wiring umount to it.
      Signed-off-by: default avatarMax Filippov <jcmvbkbc@gmail.com>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      feb19c87
    • Mikulas Patocka's avatar
      dm bufio: change __GFP_IO to __GFP_FS in shrinker callbacks · e370dd4c
      Mikulas Patocka authored
      commit 9d28eb12 upstream.
      
      The shrinker uses gfp flags to indicate what kind of operation can the
      driver wait for. If __GFP_IO flag is present, the driver can wait for
      block I/O operations, if __GFP_FS flag is present, the driver can wait on
      operations involving the filesystem.
      
      dm-bufio tested for __GFP_IO. However, dm-bufio can run on a loop block
      device that makes calls into the filesystem. If __GFP_IO is present and
      __GFP_FS isn't, dm-bufio could still block on filesystem operations if it
      runs on a loop block device.
      
      The change from __GFP_IO to __GFP_FS supposedly fixes one observed (though
      unreproducible) deadlock involving dm-bufio and loop device.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      e370dd4c
    • Dan Carpenter's avatar
      [media] ttusb-dec: buffer overflow in ioctl · 36bb34da
      Dan Carpenter authored
      commit f2e323ec upstream.
      
      We need to add a limit check here so we don't overflow the buffer.
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Cc: Moritz Mühlenhoff <jmm@inutil.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      36bb34da
  2. 17 Nov, 2014 25 commits