1. 13 Sep, 2016 7 commits
  2. 12 Sep, 2016 10 commits
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · e8988e05
      Linus Torvalds authored
      Pull clk fixes from Stephen Boyd:
       "Some small fixes for the new sunxi clk driver introduced this merge
        window"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: sunxi-ng: Fix wrong reset register offsets
        clk: sunxi-ng: nk: Make ccu_nk_find_best static
        clk: sunxi-ng: Fix inverted test condition in ccu_helper_wait_for_lock
        clk: sunxi: Fix return value check in sun8i_a23_mbus_setup()
        clk: sunxi: pll2: Fix return value check in sun4i_pll2_setup()
      e8988e05
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · ac059c4f
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       - s390: nested virt fixes (new 4.8 feature)
       - x86: fixes for 4.8 regressions
       - ARM: two small bugfixes
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        kvm-arm: Unmap shadow pagetables properly
        x86, clock: Fix kvm guest tsc initialization
        arm: KVM: Fix idmap overlap detection when the kernel is idmap'ed
        KVM: lapic: adjust preemption timer correctly when goes TSC backward
        KVM: s390: vsie: fix riccbd
        KVM: s390: don't use current->thread.fpu.* when accessing registers
      ac059c4f
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-4.8-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · 2c937eb4
      Linus Torvalds authored
      Pull NFS client bugfixes from Trond Myklebust:
       "Highlights include:
      
        Stable patches:
         - We must serialise LAYOUTGET and LAYOUTRETURN to ensure correct
           state accounting
         - Fix the CREATE_SESSION slot number
      
        Bugfixes:
         - sunrpc: fix a UDP memory accounting regression
         - NFS: Fix an error reporting regression in nfs_file_write()
         - pNFS: Fix further layout stateid issues
         - RPC/rdma: Revert 3d4cf35b ("xprtrdma: Reply buffer
           exhaustion...")
         - RPC/rdma: Fix receive buffer accounting"
      
      * tag 'nfs-for-4.8-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        NFSv4.1: Fix the CREATE_SESSION slot number accounting
        xprtrdma: Fix receive buffer accounting
        xprtrdma: Revert 3d4cf35b ("xprtrdma: Reply buffer exhaustion...")
        pNFS: Don't forget the layout stateid if there are outstanding LAYOUTGETs
        pNFS: Clear out all layout segments if the server unsets lrp->res.lrs_present
        pNFS: Fix pnfs_set_layout_stateid() to clear NFS_LAYOUT_INVALID_STID
        pNFS: Ensure LAYOUTGET and LAYOUTRETURN are properly serialised
        NFS: Fix error reporting in nfs_file_write()
        sunrpc: fix UDP memory accounting
      2c937eb4
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · da499f8f
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "Mostly small sets of driver fixes scattered all over the place.
      
         1) Mediatek driver fixes from Sean Wang.  Forward port not written
            correctly during TX map, missed handling of EPROBE_DEFER, and
            mistaken use of put_page() instead of skb_free_frag().
      
         2) Fix socket double-free in KCM code, from WANG Cong.
      
         3) QED driver fixes from Sudarsana Reddy Kalluru, including a fix for
            using the dcbx buffers before initializing them.
      
         4) Mellanox Switch driver fixes from Jiri Pirko, including a fix for
            double fib removals and an error handling fix in
            mlxsw_sp_module_init().
      
         5) Fix kernel panic when enabling LLDP in i40e driver, from Dave
            Ertman.
      
         6) Fix padding of TSO packets in thunderx driver, from Sunil Goutham.
      
         7) TCP's rcv_wup not initialized properly when using fastopen, from
            Neal Cardwell.
      
         8) Don't use uninitialized flow keys in flow dissector, from Gao
            Feng.
      
         9) Use after free in l2tp module unload, from Sabrina Dubroca.
      
        10) Fix interrupt registry ordering issues in smsc911x driver, from
            Jeremy Linton.
      
        11) Fix crashes in bonding having to do with enslaving and rx_handler,
            from Mahesh Bandewar.
      
        12) AF_UNIX deadlock fixes from Linus.
      
        13) In mlx5 driver, don't read skb->xmit_mode after it might have been
            freed from the TX reclaim path.  From Tariq Toukan.
      
        14) Fix a bug from 2015 in TCP Yeah where the congestion window does
            not increase, from Artem Germanov.
      
        15) Don't pad frames on receive in NFP driver, from Jakub Kicinski.
      
        16) Fix chunk fragmenting in SCTP wrt. GSO, from Marcelo Ricardo
            Leitner.
      
        17) Fix deletion of VRF routes, from Mark Tomlinson.
      
        18) Fix device refcount leak when DAD fails in ipv6, from Wei Yongjun"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (101 commits)
        net/mlx4_en: Fix panic on xmit while port is down
        net/mlx4_en: Fixes for DCBX
        net/mlx4_en: Fix the return value of mlx4_en_dcbnl_set_state()
        net/mlx4_en: Fix the return value of mlx4_en_dcbnl_set_all()
        net: ethernet: renesas: sh_eth: add POST registers for rz
        drivers: net: phy: mdio-xgene: Add hardware dependency
        dwc_eth_qos: do not register semi-initialized device
        sctp: identify chunks that need to be fragmented at IP level
        mlxsw: spectrum: Set port type before setting its address
        mlxsw: spectrum_router: Fix error path in mlxsw_sp_router_init
        nfp: don't pad frames on receive
        nfp: drop support for old firmware ABIs
        nfp: remove linux/version.h includes
        tcp: cwnd does not increase in TCP YeAH
        net/mlx5e: Fix parsing of vlan packets when updating lro header
        net/mlx5e: Fix global PFC counters replication
        net/mlx5e: Prevent casting overflow
        net/mlx5e: Move an_disable_cap bit to a new position
        net/mlx5e: Fix xmit_more counter race issue
        tcp: fastopen: avoid negative sk_forward_alloc
        ...
      da499f8f
    • Linus Torvalds's avatar
      Linux 4.8-rc6 · 9395452b
      Linus Torvalds authored
      9395452b
    • David S. Miller's avatar
      Merge branch 'mlx4-fixes' · 373df313
      David S. Miller authored
      Tariq Toukan says:
      
      ====================
      mlx4 fixes
      
      This patchset contains several bug fixes from the team to the
      mlx4 Eth driver.
      
      Series generated against net commit:
      c2f57fb9 "drivers: net: phy: mdio-xgene: Add hardware dependency"
      
      v2:
      * excluded some cleanup patches.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      373df313
    • Moshe Shemesh's avatar
      net/mlx4_en: Fix panic on xmit while port is down · 7a61fc86
      Moshe Shemesh authored
      When port is down, tx drop counter update is not needed.
      Updating the counter in this case can cause a kernel
      panic as when the port is down, ring can be NULL.
      
      Fixes: 63a664b7 ("net/mlx4_en: fix tx_dropped bug")
      Signed-off-by: default avatarMoshe Shemesh <moshe@mellanox.com>
      Signed-off-by: default avatarTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7a61fc86
    • Tariq Toukan's avatar
      net/mlx4_en: Fixes for DCBX · 564ed9b1
      Tariq Toukan authored
      This patch adds a capability check before enabling DCBX.
      In addition, it re-organizes the relevant data structures,
      and fixes a typo in a define.
      
      Fixes: af7d5185 ("net/mlx4_en: Add DCB PFC support through CEE netlink commands")
      Signed-off-by: default avatarTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      564ed9b1
    • Kamal Heib's avatar
      net/mlx4_en: Fix the return value of mlx4_en_dcbnl_set_state() · c6770717
      Kamal Heib authored
      mlx4_en_dcbnl_set_state() returns u8, the return value from
      mlx4_en_setup_tc() could be negative in case of failure, so fix that.
      
      Fixes: af7d5185 ("net/mlx4_en: Add DCB PFC support through CEE netlink commands")
      Signed-off-by: default avatarKamal Heib <kamalh@mellanox.com>
      Signed-off-by: default avatarTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c6770717
    • Kamal Heib's avatar
      net/mlx4_en: Fix the return value of mlx4_en_dcbnl_set_all() · 74a9e905
      Kamal Heib authored
      mlx4_en_dcbnl_set_all() returns u8, so return value can't be negative in
      case of failure.
      
      Fixes: af7d5185 ("net/mlx4_en: Add DCB PFC support through CEE netlink commands")
      Signed-off-by: default avatarKamal Heib <kamalh@mellanox.com>
      Signed-off-by: default avatarRana Shahout <ranas@mellanox.com>
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      74a9e905
  3. 11 Sep, 2016 5 commits
  4. 10 Sep, 2016 18 commits
    • Linus Torvalds's avatar
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · 98ac9a60
      Linus Torvalds authored
      Pull libnvdimm fixes from Dan Williams:
       "nvdimm fixes for v4.8, two of them are tagged for -stable:
      
         - Fix devm_memremap_pages() to use track_pfn_insert().  Otherwise,
           DAX pmd mappings end up with an uncached pgprot, and unusable
           performance for the device-dax interface.  The device-dax interface
           appeared in 4.7 so this is tagged for -stable.
      
         - Fix a couple VM_BUG_ON() checks in the show_smaps() path to
           understand DAX pmd entries.  This fix is tagged for -stable.
      
         - Fix a mis-merge of the nfit machine-check handler to flip the
           polarity of an if() to match the final version of the patch that
           Vishal sent for 4.8-rc1.  Without this the nfit machine check
           handler never detects / inserts new 'badblocks' entries which
           applications use to identify lost portions of files.
      
         - For test purposes, fix the nvdimm_clear_poison() path to operate on
           legacy / simulated nvdimm memory ranges.  Without this fix a test
           can set badblocks, but never clear them on these ranges.
      
         - Fix the range checking done by dax_dev_pmd_fault().  This is not
           tagged for -stable since this problem is mitigated by specifying
           aligned resources at device-dax setup time.
      
        These patches have appeared in a next release over the past week.  The
        recent rebase you can see in the timestamps was to drop an invalid fix
        as identified by the updated device-dax unit tests [1].  The -mm
        touches have an ack from Andrew"
      
      [1]: "[ndctl PATCH 0/3] device-dax test for recent kernel bugs"
         https://lists.01.org/pipermail/linux-nvdimm/2016-September/006855.html
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        libnvdimm: allow legacy (e820) pmem region to clear bad blocks
        nfit, mce: Fix SPA matching logic in MCE handler
        mm: fix cache mode of dax pmd mappings
        mm: fix show_smap() for zone_device-pmd ranges
        dax: fix mapping size check
      98ac9a60
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · b8db3714
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "Mostly driver bugfixes, but also a few cleanups which are nice to have
        out of the way"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: rk3x: Restore clock settings at resume time
        i2c: Spelling s/acknowedge/acknowledge/
        i2c: designware: save the preset value of DW_IC_SDA_HOLD
        Documentation: i2c: slave-interface: add note for driver development
        i2c: mux: demux-pinctrl: run properly with multiple instances
        i2c: bcm-kona: fix inconsistent indenting
        i2c: rcar: use proper device with dma_mapping_error
        i2c: sh_mobile: use proper device with dma_mapping_error
        i2c: mux: demux-pinctrl: invalidate properly when switching fails
      b8db3714
    • Linus Torvalds's avatar
      Merge tag 'for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 6905732c
      Linus Torvalds authored
      Pull fscrypto fixes fromTed Ts'o:
       "Fix some brown-paper-bag bugs for fscrypto, including one one which
        allows a malicious user to set an encryption policy on an empty
        directory which they do not own"
      
      * tag 'for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        fscrypto: require write access to mount to set encryption policy
        fscrypto: only allow setting encryption policy on directories
        fscrypto: add authorization check for setting encryption policy
      6905732c
    • Peter Zijlstra's avatar
      perf/x86/intel: Fix PEBSv3 record drain · 8ef9b845
      Peter Zijlstra authored
      Alexander hit the WARN_ON_ONCE(!event) on his Skylake while running
      the perf fuzzer.
      
      This means the PEBSv3 record included a status bit for an inactive
      event, something that _should_ not happen.
      
      Move the code that filters the status bits against our known PEBS
      events up a spot to guarantee we only deal with events we know about.
      
      Further add "continue" statements to the WARN_ON_ONCE()s such that
      we'll not die nor generate silly events in case we ever do hit them
      again.
      Reported-by: default avatarAlexander Shishkin <alexander.shishkin@linux.intel.com>
      Tested-by: default avatarAlexander Shishkin <alexander.shishkin@linux.intel.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Kan Liang <kan.liang@intel.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Vince Weaver <vince@deater.net>
      Cc: stable@vger.kernel.org
      Fixes: a3d86542 ("perf/x86/intel/pebs: Add PEBSv3 decoding")
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      8ef9b845
    • Alexander Shishkin's avatar
      perf/x86/intel/bts: Kill a silly warning · ef9ef3be
      Alexander Shishkin authored
      At the moment, intel_bts will WARN() out if there is more than one
      event writing to the same ring buffer, via SET_OUTPUT, and will only
      send data from one event to a buffer.
      
      There is no reason to have this warning in, so kill it.
      Signed-off-by: default avatarAlexander Shishkin <alexander.shishkin@linux.intel.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Arnaldo Carvalho de Melo <acme@infradead.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: vince@deater.net
      Link: http://lkml.kernel.org/r/20160906132353.19887-6-alexander.shishkin@linux.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      ef9ef3be
    • Alexander Shishkin's avatar
      perf/x86/intel/bts: Fix BTS PMI detection · 4d4c4741
      Alexander Shishkin authored
      Since BTS doesn't have a dedicated PMI status bit, the driver needs to
      take extra care to check for the condition that triggers it to avoid
      spurious NMI warnings.
      
      Regardless of the local BTS context state, the only way of knowing that
      the NMI is ours is to compare the write pointer against the interrupt
      threshold.
      Reported-by: default avatarVince Weaver <vincent.weaver@maine.edu>
      Signed-off-by: default avatarAlexander Shishkin <alexander.shishkin@linux.intel.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Arnaldo Carvalho de Melo <acme@infradead.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: vince@deater.net
      Link: http://lkml.kernel.org/r/20160906132353.19887-5-alexander.shishkin@linux.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      4d4c4741
    • Alexander Shishkin's avatar
      perf/x86/intel/bts: Fix confused ordering of PMU callbacks · a9a94401
      Alexander Shishkin authored
      The intel_bts driver is using a CPU-local 'started' variable to order
      callbacks and PMIs and make sure that AUX transactions don't get messed
      up. However, the ordering rules in regard to this variable is a complete
      mess, which recently resulted in perf_fuzzer-triggered warnings and
      panics.
      
      The general ordering rule that is patch is enforcing is that this
      cpu-local variable be set only when the cpu-local AUX transaction is
      active; consequently, this variable is to be checked before the AUX
      related bits can be touched.
      Reported-by: default avatarVince Weaver <vincent.weaver@maine.edu>
      Signed-off-by: default avatarAlexander Shishkin <alexander.shishkin@linux.intel.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Arnaldo Carvalho de Melo <acme@infradead.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: vince@deater.net
      Link: http://lkml.kernel.org/r/20160906132353.19887-4-alexander.shishkin@linux.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      a9a94401
    • Alexander Shishkin's avatar
      perf/core: Fix aux_mmap_count vs aux_refcount order · b79ccadd
      Alexander Shishkin authored
      The order of accesses to ring buffer's aux_mmap_count and aux_refcount
      has to be preserved across the users, namely perf_mmap_close() and
      perf_aux_output_begin(), otherwise the inversion can result in the latter
      holding the last reference to the aux buffer and subsequently free'ing
      it in atomic context, triggering a warning.
      
      > ------------[ cut here ]------------
      > WARNING: CPU: 0 PID: 257 at kernel/events/ring_buffer.c:541 __rb_free_aux+0x11a/0x130
      > CPU: 0 PID: 257 Comm: stopbug Not tainted 4.8.0-rc1+ #2596
      > Call Trace:
      >  [<ffffffff810f3e0b>] __warn+0xcb/0xf0
      >  [<ffffffff810f3f3d>] warn_slowpath_null+0x1d/0x20
      >  [<ffffffff8121182a>] __rb_free_aux+0x11a/0x130
      >  [<ffffffff812127a8>] rb_free_aux+0x18/0x20
      >  [<ffffffff81212913>] perf_aux_output_begin+0x163/0x1e0
      >  [<ffffffff8100c33a>] bts_event_start+0x3a/0xd0
      >  [<ffffffff8100c42d>] bts_event_add+0x5d/0x80
      >  [<ffffffff81203646>] event_sched_in.isra.104+0xf6/0x2f0
      >  [<ffffffff8120652e>] group_sched_in+0x6e/0x190
      >  [<ffffffff8120694e>] ctx_sched_in+0x2fe/0x5f0
      >  [<ffffffff81206ca0>] perf_event_sched_in+0x60/0x80
      >  [<ffffffff81206d1b>] ctx_resched+0x5b/0x90
      >  [<ffffffff81207281>] __perf_event_enable+0x1e1/0x240
      >  [<ffffffff81200639>] event_function+0xa9/0x180
      >  [<ffffffff81202000>] ? perf_cgroup_attach+0x70/0x70
      >  [<ffffffff8120203f>] remote_function+0x3f/0x50
      >  [<ffffffff811971f3>] flush_smp_call_function_queue+0x83/0x150
      >  [<ffffffff81197bd3>] generic_smp_call_function_single_interrupt+0x13/0x60
      >  [<ffffffff810a6477>] smp_call_function_single_interrupt+0x27/0x40
      >  [<ffffffff81a26ea9>] call_function_single_interrupt+0x89/0x90
      >  [<ffffffff81120056>] finish_task_switch+0xa6/0x210
      >  [<ffffffff81120017>] ? finish_task_switch+0x67/0x210
      >  [<ffffffff81a1e83d>] __schedule+0x3dd/0xb50
      >  [<ffffffff81a1efe5>] schedule+0x35/0x80
      >  [<ffffffff81128031>] sys_sched_yield+0x61/0x70
      >  [<ffffffff81a25be5>] entry_SYSCALL_64_fastpath+0x18/0xa8
      > ---[ end trace 6235f556f5ea83a9 ]---
      
      This patch puts the checks in perf_aux_output_begin() in the same order
      as that of perf_mmap_close().
      Reported-by: default avatarVince Weaver <vincent.weaver@maine.edu>
      Signed-off-by: default avatarAlexander Shishkin <alexander.shishkin@linux.intel.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Arnaldo Carvalho de Melo <acme@infradead.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: vince@deater.net
      Link: http://lkml.kernel.org/r/20160906132353.19887-3-alexander.shishkin@linux.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      b79ccadd
    • Alexander Shishkin's avatar
      perf/core: Fix a race between mmap_close() and set_output() of AUX events · 767ae086
      Alexander Shishkin authored
      In the mmap_close() path we need to stop all the AUX events that are
      writing data to the AUX area that we are unmapping, before we can
      safely free the pages. To determine if an event needs to be stopped,
      we're comparing its ->rb against the one that's getting unmapped.
      However, a SET_OUTPUT ioctl may turn up inside an AUX transaction
      and swizzle event::rb to some other ring buffer, but the transaction
      will keep writing data to the old ring buffer until the event gets
      scheduled out. At this point, mmap_close() will skip over such an
      event and will proceed to free the AUX area, while it's still being
      used by this event, which will set off a warning in the mmap_close()
      path and cause a memory corruption.
      
      To avoid this, always stop an AUX event before its ->rb is updated;
      this will release the (potentially) last reference on the AUX area
      of the buffer. If the event gets restarted, its new ring buffer will
      be used. If another SET_OUTPUT comes and switches it back to the
      old ring buffer that's getting unmapped, it's also fine: this
      ring buffer's aux_mmap_count will be zero and AUX transactions won't
      start any more.
      Reported-by: default avatarVince Weaver <vincent.weaver@maine.edu>
      Signed-off-by: default avatarAlexander Shishkin <alexander.shishkin@linux.intel.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Arnaldo Carvalho de Melo <acme@infradead.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: vince@deater.net
      Link: http://lkml.kernel.org/r/20160906132353.19887-2-alexander.shishkin@linux.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      767ae086
    • Eric Biggers's avatar
      fscrypto: require write access to mount to set encryption policy · ba63f23d
      Eric Biggers authored
      Since setting an encryption policy requires writing metadata to the
      filesystem, it should be guarded by mnt_want_write/mnt_drop_write.
      Otherwise, a user could cause a write to a frozen or readonly
      filesystem.  This was handled correctly by f2fs but not by ext4.  Make
      fscrypt_process_policy() handle it rather than relying on the filesystem
      to get it right.
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Cc: stable@vger.kernel.org # 4.1+; check fs/{ext4,f2fs}
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      Acked-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
      ba63f23d
    • Eric Biggers's avatar
      fscrypto: only allow setting encryption policy on directories · 002ced4b
      Eric Biggers authored
      The FS_IOC_SET_ENCRYPTION_POLICY ioctl allowed setting an encryption
      policy on nondirectory files.  This was unintentional, and in the case
      of nonempty regular files did not behave as expected because existing
      data was not actually encrypted by the ioctl.
      
      In the case of ext4, the user could also trigger filesystem errors in
      ->empty_dir(), e.g. due to mismatched "directory" checksums when the
      kernel incorrectly tried to interpret a regular file as a directory.
      
      This bug affected ext4 with kernels v4.8-rc1 or later and f2fs with
      kernels v4.6 and later.  It appears that older kernels only permitted
      directories and that the check was accidentally lost during the
      refactoring to share the file encryption code between ext4 and f2fs.
      
      This patch restores the !S_ISDIR() check that was present in older
      kernels.
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      002ced4b
    • Eric Biggers's avatar
      fscrypto: add authorization check for setting encryption policy · 163ae1c6
      Eric Biggers authored
      On an ext4 or f2fs filesystem with file encryption supported, a user
      could set an encryption policy on any empty directory(*) to which they
      had readonly access.  This is obviously problematic, since such a
      directory might be owned by another user and the new encryption policy
      would prevent that other user from creating files in their own directory
      (for example).
      
      Fix this by requiring inode_owner_or_capable() permission to set an
      encryption policy.  This means that either the caller must own the file,
      or the caller must have the capability CAP_FOWNER.
      
      (*) Or also on any regular file, for f2fs v4.6 and later and ext4
          v4.8-rc1 and later; a separate bug fix is coming for that.
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Cc: stable@vger.kernel.org # 4.1+; check fs/{ext4,f2fs}
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      163ae1c6
    • Jean Delvare's avatar
      drivers: net: phy: mdio-xgene: Add hardware dependency · c2f57fb9
      Jean Delvare authored
      The mdio-xgene driver is only useful on X-Gene SoC.
      Signed-off-by: default avatarJean Delvare <jdelvare@suse.de>
      Cc: Iyappan Subramanian <isubramanian@apm.com>
      Cc: David S. Miller <davem@davemloft.net>
      Acked-by: default avatarIyappan Subramanian <isubramanian@apm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c2f57fb9
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-for-davem-2016-09-08' of... · 0808a29a
      David S. Miller authored
      Merge tag 'wireless-drivers-for-davem-2016-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      wireless-drivers fixes for 4.8
      
      iwlwifi
      
      * fix P2P dump trigger
      * prevent a potential null dereference in iwlmvm
      * prevent an uninitialized value from being returned in iwlmvm
      * advertise support for channel width change in AP mode
      
      ath10k
      
      * fix racy rx status retrieval from htt context
      * QCA9887 support is not experimental anymore, remove the warning message
      
      ath9k
      
      * fix regression with led GPIOs
      * fix AR5416 GPIO access warning
      
      brcmfmac
      
      * avoid potential stack overflow in brcmf_cfg80211_start_ap()
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0808a29a
    • Lars Persson's avatar
      dwc_eth_qos: do not register semi-initialized device · 47b02f72
      Lars Persson authored
      We move register_netdev() to the end of dwceqos_probe() to close any
      races where the netdev callbacks are called before the initialization
      has finished.
      Reported-by: default avatarPavel Andrianov <andrianov@ispras.ru>
      Signed-off-by: default avatarLars Persson <larper@axis.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      47b02f72
    • Marcelo Ricardo Leitner's avatar
      sctp: identify chunks that need to be fragmented at IP level · 7303a147
      Marcelo Ricardo Leitner authored
      Previously, without GSO, it was easy to identify it: if the chunk didn't
      fit and there was no data chunk in the packet yet, we could fragment at
      IP level. So if there was an auth chunk and we were bundling a big data
      chunk, it would fragment regardless of the size of the auth chunk. This
      also works for the context of PMTU reductions.
      
      But with GSO, we cannot distinguish such PMTU events anymore, as the
      packet is allowed to exceed PMTU.
      
      So we need another check: to ensure that the chunk that we are adding,
      actually fits the current PMTU. If it doesn't, trigger a flush and let
      it be fragmented at IP level in the next round.
      Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7303a147
    • Dave Jiang's avatar
      libnvdimm: allow legacy (e820) pmem region to clear bad blocks · 1e8b8d96
      Dave Jiang authored
      Bad blocks can be injected via /sys/block/pmemN/badblocks. In a situation
      where legacy pmem is being used or a pmem region created by using memmap
      kernel parameter, the injected bad blocks are not cleared due to
      nvdimm_clear_poison() failing from lack of ndctl function pointer. In
      this case we need to just return as handled and allow the bad blocks to
      be cleared rather than fail.
      Reviewed-by: default avatarVishal Verma <vishal.l.verma@intel.com>
      Signed-off-by: default avatarDave Jiang <dave.jiang@intel.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      1e8b8d96
    • Vishal Verma's avatar
      nfit, mce: Fix SPA matching logic in MCE handler · 2e21807d
      Vishal Verma authored
      The check for a 'pmem' type SPA in the MCE handler was inverted due to a
      merge/rebase error.
      
      Fixes: 6839a6d9 nfit: do an ARS scrub on hitting a latent media error
      Cc: linux-acpi@vger.kernel.org
      Cc: Dan Williams <dan.j.williams@intel.com>
      Signed-off-by: default avatarVishal Verma <vishal.l.verma@intel.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      2e21807d