1. 27 Sep, 2015 11 commits
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 685b5f1d
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "Our first real batch of fixes this release cycle.  Nothing really
        concerning, and diffstat is a bit inflated due to some DT contents
        moving around on STi platforms.
      
        There's a collection of them here:
      
         - A fixup for a build breakage that hits on arm64 allmodconfig in
           QCOM SCM firmware drivers
         - MMC fixes for OMAP that had quite a bit of breakage this merge
           window.
         - Misc build/warning fixes on PXA and OMAP
         - A couple of minor fixes for Beagleboard X15 which is now starting
           to see a few more users in the wild"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (31 commits)
        ARM: sti: dt: adapt DT to fix probe/bind issues in DRM driver
        ARM: dts: fix omap2+ address translation for pbias
        firmware: qcom: scm: Add function stubs for ARM64
        ARM: dts: am57xx-beagle-x15: use palmas-usb for USB2
        ARM: omap2plus_defconfig: enable GPIO_PCA953X
        ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets
        ARM: OMAP2+: AM43XX: Enable autoidle for clks in am43xx_init_late
        ARM: dts: am57xx-beagle-x15: Update Phy supplies
        ARM: pxa: balloon3: Fix build error
        ARM: dts: Fixup model name for HP t410 dts
        ARM: dts: DRA7: fix a typo in ethernet
        ARM: omap2plus_defconfig: make PCF857x built-in
        ARM: dts: Use ti,pbias compatible string for pbias
        ARM: OMAP5: Cleanup options for SoC only build
        ARM: DRA7: Select missing options for SoC only build
        ARM: OMAP2+: board-generic: Remove stale of_irq macros
        ARM: OMAP4+: PM: erratum is used by OMAP5 and DRA7 as well
        ARM: dts: omap3-igep: Move eth IRQ pinmux to IGEPv2 common dtsi
        ARM: dts: am57xx-beagle-x15: Add wakeup irq for mcp79410
        ARM: dts: am335x-phycore-som: Fix mpu voltage
        ...
      685b5f1d
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 · 69ea8b85
      Linus Torvalds authored
      Pull CIFS fixes from Steve French:
       "Four fixes from testing at the recent SMB3 Plugfest including two
        important authentication ones (one fixes authentication problems to
        some popular servers when clock times differ more than two hours
        between systems, the other fixes Kerberos authentication for SMB3)"
      
      * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
        fix encryption error checks on mount
        [SMB3] Fix sec=krb5 on smb3 mounts
        cifs: use server timestamp for ntlmv2 authentication
        disabling oplocks/leases via module parm enable_oplocks broken for SMB3
      69ea8b85
    • Olof Johansson's avatar
      Merge tag 'pxa-fixes-v4.3' of https://github.com/rjarzmik/linux into fixes · e46fc90e
      Olof Johansson authored
      ARM: pxa: fixes for v4.3
      
      These fixes are mainly regression fixes triggered by irq changes,
      common clock framework introduction and sound side-effect of
      other platforms.
      
      * tag 'pxa-fixes-v4.3' of https://github.com/rjarzmik/linux:
        ARM: pxa: balloon3: Fix build error
        ARM: pxa: ssp: Fix build error by removing originally incorrect DT binding
        ARM: pxa: fix DFI bus lockups on startup
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      e46fc90e
    • Olof Johansson's avatar
      Merge tag 'omap-for-v4.3/fixes-rc2' of... · b8ba826f
      Olof Johansson authored
      Merge tag 'omap-for-v4.3/fixes-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes
      
      Fixes for omaps for v4.3-rc cycle:
      
      - Two more patches to fix most of the MMC regressions with the
        PBIAS regulator changes. At least two MMC driver related issues
        still seems to remain for omap3 legacy booting and omap4 duovero.
        Note that the dts changes depend on a recent regulator fix, and
        are based on the regulator commit now in mainline kernel
      
      - Enable autoidle for am43xx clocks to prevent clocks from staying
        always on
      
      - Fix i2c5 pinctrl offsets for omap5-uevm
      
      - Enable PCA953X as that's needed for HDMI to work on omap5
      
      - Update phy supplies for beagle x15 beta board
      
      - Use palmas-usb for on beagle x15 to start using the related
        driver that recently got merged
      
      * tag 'omap-for-v4.3/fixes-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
        ARM: dts: fix omap2+ address translation for pbias
        ARM: dts: am57xx-beagle-x15: use palmas-usb for USB2
        ARM: omap2plus_defconfig: enable GPIO_PCA953X
        ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets
        ARM: OMAP2+: AM43XX: Enable autoidle for clks in am43xx_init_late
        ARM: dts: am57xx-beagle-x15: Update Phy supplies
        regulator: pbias: program pbias register offset in pbias driver
        ARM: omap2plus_defconfig: Enable MUSB DMA support
        ARM: DRA752: Add ID detect for ES2.0
        ARM: OMAP3: vc: fix 'or' always true warning
        ARM: OMAP2+: Fix booting if no timer parent clock is available
        ARM: OMAP2+: omap-device: fix race deferred probe of omap_hsmmc vs omap_device_late_init
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      b8ba826f
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · d8cc3972
      Linus Torvalds authored
      Pull crypto fixes from Herbert Xu:
       "This fixes the following issues:
      
         - check the return value of platform_get_irq as signed int in xgene.
      
         - skip adf_dev_restore on virtual functions in qat.
      
         - fix double-free with backlogged requests in marvell_cesa"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        hwrng: xgene - fix handling platform_get_irq
        crypto: qat - VF should never trigger SBR on PH
        crypto: marvell - properly handle CRYPTO_TFM_REQ_MAY_BACKLOG-flagged requests
      d8cc3972
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · c91d7072
      Linus Torvalds authored
      Pull SCSI target fixes from Nicholas Bellinger:
       "This includes a iser-target series from Jenny + Sagi @ Mellanox that
        addresses the few remaining active I/O shutdown bugs, along with a
        patch to support zero-copy for immediate data payloads that gives a
        nice performance improvement for small block WRITEs.
      
        Also included are some recent >= v4.2 regression bug-fixes.  The most
        notable is a RCU conversion regression for SPC-3 PR registrations, and
        recent removal of obsolete RFC-3720 markers that introduced a login
        regression bug with MSFT iSCSI initiators.
      
        Thanks to everyone who has been testing + reporting bugs for v4.x"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
        iscsi-target: Avoid OFMarker + IFMarker negotiation
        target: Make TCM_WRITE_PROTECT failure honor D_SENSE bit
        target: Fix target_sense_desc_format NULL pointer dereference
        target: Propigate backend read-only to core_tpg_add_lun
        target: Fix PR registration + APTPL RCU conversion regression
        iser-target: Skip data copy if all the command data comes as immediate
        iser-target: Change the recv buffers posting logic
        iser-target: Fix pending connections handling in target stack shutdown sequnce
        iser-target: Remove np_ prefix from isert_np members
        iser-target: Remove unused variables
        iser-target: Put the reference on commands waiting for unsol data
        iser-target: remove command with state ISTATE_REMOVE
      c91d7072
    • Linus Torvalds's avatar
      Merge tag 'usb-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · bcba282a
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are some USB driver fixes for 4.3-rc3.
      
        There's the usual assortment of new device ids, combined with xhci and
        gadget driver fixes.  Full details in the shortlog.  All of these have
        been in linux-next with no reported problems"
      
      * tag 'usb-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (34 commits)
        MAINTAINERS: remove amd5536udc USB gadget driver maintainer
        USB: whiteheat: fix potential null-deref at probe
        xhci: init command timeout timer earlier to avoid deleting it uninitialized
        xhci: change xhci 1.0 only restrictions to support xhci 1.1
        usb: xhci: exit early in xhci_setup_device() if we're halted or dying
        usb: xhci: stop everything on the first call to xhci_stop
        usb: xhci: Clear XHCI_STATE_DYING on start
        usb: xhci: lock mutex on xhci_stop
        xhci: Move xhci_pme_quirk() behind #ifdef CONFIG_PM
        xhci: give command abortion one more chance before killing xhci
        usb: Use the USB_SS_MULT() macro to get the burst multiplier.
        usb: dwc3: gadget: Fix BUG in RT config
        usb: musb: fix cppi channel teardown for isoch transfer
        usb: phy: isp1301: Export I2C module alias information
        usb: gadget: drop null test before destroy functions
        usb: gadget: dummy_hcd: in transfer(), return data sent, not limit
        usb: gadget: dummy_hcd: fix rescan logic for transfer
        usb: gadget: dummy_hcd: fix unneeded else-if condition
        usb: gadget: dummy_hcd: emulate sending zlp in packet logic
        usb: musb: dsps: fix polling in device-only mode
        ...
      bcba282a
    • Linus Torvalds's avatar
      Merge tag 'tty-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · fb740f9b
      Linus Torvalds authored
      Pull serial driver fix from Greg KH:
       "Here is one serial driver fix for 4.3-rc3 that resolves a module
        loading issue due to splitting up of the 8250 driver into smaller
        pieces.  It's been in linux-next with no reported problems"
      
      * tag 'tty-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: serial: Add missing module license for 8250_base.ko
      fb740f9b
    • Linus Torvalds's avatar
      Merge tag 'staging-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · b11e7b81
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Here are some tiny staging driver and documentation fixes for 4.3-rc3.
      
        All of these resolve reported issues that people have found and have
        been in the linux-next tree for a while with no problems"
      
      * tag 'staging-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        MAINTAINERS: Update email address for Martyn Welch
        staging: ion: fix corruption of ion_import_dma_buf
        staging: dgap: Remove myself from the MAINTAINERS file
        staging: most: Add dependency to HAS_IOMEM
        staging: unisys: remove reference of visorutil
        staging: unisys: visornic: handle error return from device registration
        staging: unisys: stop device registration before visorbus registration
        staging: unisys: visorbus: Unregister driver on error
        staging: unisys: visornic: Fix receive bytes statistics
        staging: unisys: unregister netdev when create debugfs fails
        staging: fbtft: replace master->setup() with spi_setup()
        staging: fbtft: fix 9-bit SPI support detection
        staging/lustre: change Lustre URLs and mailing list
        staging/android: Update ION TODO per LPC discussion
        Staging: most: MOST and MOSTCORE should depend on HAS_DMA
        staging: most: fix HDM_USB dependencies and build errors
      b11e7b81
    • Linus Torvalds's avatar
      Merge tag 'driver-core-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core · 7c1efeae
      Linus Torvalds authored
      Pull driver core fix from Greg KH:
       "Here is one driver core fix for 4.3-rc3 that resolves a reported oops"
      
      * tag 'driver-core-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        cpu/cacheinfo: Fix teardown path
      7c1efeae
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 64b796e2
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here's some tiny char and misc driver fixes that resolve some reported
        errors for 4.3-rc3.
      
        All of these have been in linux-next with no problems for a while"
      
      * tag 'char-misc-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        extcon: Fix attached value returned by is_extcon_changed
        Drivers: hv: vmbus: fix init_vp_index() for reloading hv_netvsc
        mei: fix debugfs files leak on error path
        thunderbolt: Allow loading of module on recent Apple MacBooks with thunderbolt 2 controller
      64b796e2
  2. 26 Sep, 2015 4 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 518a7cb6
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) When we run a tap on netlink sockets, we have to copy mmap'd SKBs
          instead of cloning them.  From Daniel Borkmann.
      
       2) When converting classical BPF into eBPF, fix the setting of the
          source reg to BPF_REG_X.  From Tycho Andersen.
      
       3) Fix igmpv3/mldv2 report parsing in the bridge multicast code, from
          Linus Lussing.
      
       4) Fix dst refcounting for ipv6 tunnels, from Martin KaFai Lau.
      
       5) Set NLM_F_REPLACE flag properly when replacing ipv6 routes, from
          Roopa Prabhu.
      
       6) Add some new cxgb4 PCI device IDs, from Hariprasad Shenai.
      
       7) Fix headroom tests and SKB leaks in ipv6 fragmentation code, from
          Florian Westphal.
      
       8) Check DMA mapping errors in bna driver, from Ivan Vecera.
      
       9) Several 8139cp bug fixes (dev_kfree_skb_any in interrupt context,
          misclearing of interrupt status in TX timeout handler, etc.) from
          David Woodhouse.
      
      10) In tipc, reset SKB header pointer after skb_linearize(), from Erik
          Hugne.
      
      11) Fix autobind races et al. in netlink code, from Herbert Xu with
          help from Tejun Heo and others.
      
      12) Missing SET_NETDEV_DEV in sunvnet driver, from Sowmini Varadhan.
      
      13) Fix various races in timewait timer and reqsk_queue_hadh_req, from
          Eric Dumazet.
      
      14) Fix array overruns in mac80211, from Johannes Berg and Dan
          Carpenter.
      
      15) Fix data race in rhashtable_rehash_one(), from Dmitriy Vyukov.
      
      16) Fix race between poll_one_napi and napi_disable, from Neil Horman.
      
      17) Fix byte order in geneve tunnel port config, from John W Linville.
      
      18) Fix handling of ARP replies over lightweight tunnels, from Jiri
          Benc.
      
      19) We can loop when fib rule dumps cross multiple SKBs, fix from Wilson
          Kok and Roopa Prabhu.
      
      20) Several reference count handling bug fixes in the PHY/MDIO layer
          from Russel King.
      
      21) Fix lockdep splat in ppp_dev_uninit(), from Guillaume Nault.
      
      22) Fix crash in icmp_route_lookup(), from David Ahern.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (116 commits)
        net: Fix panic in icmp_route_lookup
        net: update docbook comment for __mdiobus_register()
        ppp: fix lockdep splat in ppp_dev_uninit()
        net: via/Kconfig: GENERIC_PCI_IOMAP required if PCI not selected
        phy: marvell: add link partner advertised modes
        net: fix net_device refcounting
        phy: add phy_device_remove()
        phy: fixed-phy: properly validate phy in fixed_phy_update_state()
        net: fix phy refcounting in a bunch of drivers
        of_mdio: fix MDIO phy device refcounting
        phy: add proper phy struct device refcounting
        phy: fix mdiobus module safety
        net: dsa: fix of_mdio_find_bus() device refcount leak
        phy: fix of_mdio_find_bus() device refcount leak
        ip6_tunnel: Reduce log level in ip6_tnl_err() to debug
        ip6_gre: Reduce log level in ip6gre_err() to debug
        fib_rules: fix fib rule dumps across multiple skbs
        bnx2x: byte swap rss_key to comply to Toeplitz specs
        net: revert "net_sched: move tp->root allocation into fw_init()"
        lwtunnel: remove source and destination UDP port config option
        ...
      518a7cb6
    • David Ahern's avatar
      net: Fix panic in icmp_route_lookup · bdb06cbf
      David Ahern authored
      Andrey reported a panic:
      
      [ 7249.865507] BUG: unable to handle kernel pointer dereference at 000000b4
      [ 7249.865559] IP: [<c16afeca>] icmp_route_lookup+0xaa/0x320
      [ 7249.865598] *pdpt = 0000000030f7f001 *pde = 0000000000000000
      [ 7249.865637] Oops: 0000 [#1]
      ...
      [ 7249.866811] CPU: 0 PID: 0 Comm: swapper/0 Not tainted
      4.3.0-999-generic #201509220155
      [ 7249.866876] Hardware name: MSI MS-7250/MS-7250, BIOS 080014  08/02/2006
      [ 7249.866916] task: c1a5ab00 ti: c1a52000 task.ti: c1a52000
      [ 7249.866949] EIP: 0060:[<c16afeca>] EFLAGS: 00210246 CPU: 0
      [ 7249.866981] EIP is at icmp_route_lookup+0xaa/0x320
      [ 7249.867012] EAX: 00000000 EBX: f483ba48 ECX: 00000000 EDX: f2e18a00
      [ 7249.867045] ESI: 000000c0 EDI: f483ba70 EBP: f483b9ec ESP: f483b974
      [ 7249.867077]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
      [ 7249.867108] CR0: 8005003b CR2: 000000b4 CR3: 36ee07c0 CR4: 000006f0
      [ 7249.867141] Stack:
      [ 7249.867165]  320310ee 00000000 00000042 320310ee 00000000 c1aeca00
      f3920240 f0c69180
      [ 7249.867268]  f483ba04 f855058b a89b66cd f483ba44 f8962f4b 00000000
      e659266c f483ba54
      [ 7249.867361]  8004753c f483ba5c f8962f4b f2031140 000003c1 ffbd8fa0
      c16b0e00 00000064
      [ 7249.867448] Call Trace:
      [ 7249.867494]  [<f855058b>] ? e1000_xmit_frame+0x87b/0xdc0 [e1000e]
      [ 7249.867534]  [<f8962f4b>] ? tcp_in_window+0xeb/0xb10 [nf_conntrack]
      [ 7249.867576]  [<f8962f4b>] ? tcp_in_window+0xeb/0xb10 [nf_conntrack]
      [ 7249.867615]  [<c16b0e00>] ? icmp_send+0xa0/0x380
      [ 7249.867648]  [<c16b102f>] icmp_send+0x2cf/0x380
      [ 7249.867681]  [<f89c8126>] nf_send_unreach+0xa6/0xc0 [nf_reject_ipv4]
      [ 7249.867714]  [<f89cd0da>] reject_tg+0x7a/0x9f [ipt_REJECT]
      [ 7249.867746]  [<f88c29a7>] ipt_do_table+0x317/0x70c [ip_tables]
      [ 7249.867780]  [<f895e0a6>] ? __nf_conntrack_find_get+0x166/0x3b0
      [nf_conntrack]
      [ 7249.867838]  [<f895eea8>] ? nf_conntrack_in+0x398/0x600 [nf_conntrack]
      [ 7249.867889]  [<f84c0035>] iptable_filter_hook+0x35/0x80 [iptable_filter]
      [ 7249.867933]  [<c16776a1>] nf_iterate+0x71/0x80
      [ 7249.867970]  [<c1677715>] nf_hook_slow+0x65/0xc0
      [ 7249.868002]  [<c1681811>] __ip_local_out_sk+0xc1/0xd0
      [ 7249.868034]  [<c1680f30>] ? ip_forward_options+0x1a0/0x1a0
      [ 7249.868066]  [<c1681836>] ip_local_out_sk+0x16/0x30
      [ 7249.868097]  [<c1684054>] ip_send_skb+0x14/0x80
      [ 7249.868129]  [<c16840f4>] ip_push_pending_frames+0x34/0x40
      [ 7249.868163]  [<c16844a2>] ip_send_unicast_reply+0x282/0x310
      [ 7249.868196]  [<c16a0863>] tcp_v4_send_reset+0x1b3/0x380
      [ 7249.868227]  [<c16a1b63>] tcp_v4_rcv+0x323/0x990
      [ 7249.868257]  [<c16776a1>] ? nf_iterate+0x71/0x80
      [ 7249.868289]  [<c167dc2b>] ip_local_deliver_finish+0x8b/0x230
      [ 7249.868322]  [<c167df4c>] ip_local_deliver+0x4c/0xa0
      [ 7249.868353]  [<c167dba0>] ? ip_rcv_finish+0x390/0x390
      [ 7249.868384]  [<c167d88c>] ip_rcv_finish+0x7c/0x390
      [ 7249.868415]  [<c167e280>] ip_rcv+0x2e0/0x420
      ...
      
      Prior to the VRF change the oif was not set in the flow struct, so the
      VRF support should really have only added the vrf_master_ifindex lookup.
      
      Fixes: 613d09b3 ("net: Use VRF device index for lookups on TX")
      Cc: Andrey Melnikov <temnota.am@gmail.com>
      Signed-off-by: default avatarDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bdb06cbf
    • Russell King's avatar
      net: update docbook comment for __mdiobus_register() · 59f06978
      Russell King authored
      Update the docbook comment for __mdiobus_register() to include the new
      module owner argument.  This resolves a warning found by the 0-day
      builder.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      59f06978
    • Greg Kroah-Hartman's avatar
      MAINTAINERS: remove amd5536udc USB gadget driver maintainer · b4731977
      Greg Kroah-Hartman authored
      Thomas can no longer work on the driver, so he asked me to mark the
      MAINTAINER entry as "Orphan" with the hope that someone else would
      someday pick it up.
      
      Cc: Thomas Dahlmann <dahlmann.thomas@arcor.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b4731977
  3. 25 Sep, 2015 25 commits
    • Linus Torvalds's avatar
      Merge branch 'for-4.3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup · d4a748a1
      Linus Torvalds authored
      Pull another cgroup fix from Tejun Heo:
       "The cgroup writeback support got inadvertently enabled for traditional
        hierarchies revealing two regressions which are currently being worked
        on.  It shouldn't have been enabled on traditional hierarchies, so
        disable it on them.  This is enough to make the regressions go away
        for people who aren't experimenting with cgroup"
      
      * 'for-4.3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
        cgroup, writeback: don't enable cgroup writeback on traditional hierarchies
      d4a748a1
    • Guillaume Nault's avatar
      ppp: fix lockdep splat in ppp_dev_uninit() · 58a89eca
      Guillaume Nault authored
      ppp_dev_uninit() locks all_ppp_mutex while under rtnl mutex protection.
      ppp_create_interface() must then lock these mutexes in that same order
      to avoid possible deadlock.
      
      [  120.880011] ======================================================
      [  120.880011] [ INFO: possible circular locking dependency detected ]
      [  120.880011] 4.2.0 #1 Not tainted
      [  120.880011] -------------------------------------------------------
      [  120.880011] ppp-apitest/15827 is trying to acquire lock:
      [  120.880011]  (&pn->all_ppp_mutex){+.+.+.}, at: [<ffffffffa0145f56>] ppp_dev_uninit+0x64/0xb0 [ppp_generic]
      [  120.880011]
      [  120.880011] but task is already holding lock:
      [  120.880011]  (rtnl_mutex){+.+.+.}, at: [<ffffffff812e4255>] rtnl_lock+0x12/0x14
      [  120.880011]
      [  120.880011] which lock already depends on the new lock.
      [  120.880011]
      [  120.880011]
      [  120.880011] the existing dependency chain (in reverse order) is:
      [  120.880011]
      [  120.880011] -> #1 (rtnl_mutex){+.+.+.}:
      [  120.880011]        [<ffffffff81073a6f>] lock_acquire+0xcf/0x10e
      [  120.880011]        [<ffffffff813ab18a>] mutex_lock_nested+0x56/0x341
      [  120.880011]        [<ffffffff812e4255>] rtnl_lock+0x12/0x14
      [  120.880011]        [<ffffffff812d9d94>] register_netdev+0x11/0x27
      [  120.880011]        [<ffffffffa0147b17>] ppp_ioctl+0x289/0xc98 [ppp_generic]
      [  120.880011]        [<ffffffff8113b367>] do_vfs_ioctl+0x4ea/0x532
      [  120.880011]        [<ffffffff8113b3fd>] SyS_ioctl+0x4e/0x7d
      [  120.880011]        [<ffffffff813ad7d7>] entry_SYSCALL_64_fastpath+0x12/0x6f
      [  120.880011]
      [  120.880011] -> #0 (&pn->all_ppp_mutex){+.+.+.}:
      [  120.880011]        [<ffffffff8107334e>] __lock_acquire+0xb07/0xe76
      [  120.880011]        [<ffffffff81073a6f>] lock_acquire+0xcf/0x10e
      [  120.880011]        [<ffffffff813ab18a>] mutex_lock_nested+0x56/0x341
      [  120.880011]        [<ffffffffa0145f56>] ppp_dev_uninit+0x64/0xb0 [ppp_generic]
      [  120.880011]        [<ffffffff812d5263>] rollback_registered_many+0x19e/0x252
      [  120.880011]        [<ffffffff812d5381>] rollback_registered+0x29/0x38
      [  120.880011]        [<ffffffff812d53fa>] unregister_netdevice_queue+0x6a/0x77
      [  120.880011]        [<ffffffffa0146a94>] ppp_release+0x42/0x79 [ppp_generic]
      [  120.880011]        [<ffffffff8112d9f6>] __fput+0xec/0x192
      [  120.880011]        [<ffffffff8112dacc>] ____fput+0x9/0xb
      [  120.880011]        [<ffffffff8105447a>] task_work_run+0x66/0x80
      [  120.880011]        [<ffffffff81001801>] prepare_exit_to_usermode+0x8c/0xa7
      [  120.880011]        [<ffffffff81001900>] syscall_return_slowpath+0xe4/0x104
      [  120.880011]        [<ffffffff813ad931>] int_ret_from_sys_call+0x25/0x9f
      [  120.880011]
      [  120.880011] other info that might help us debug this:
      [  120.880011]
      [  120.880011]  Possible unsafe locking scenario:
      [  120.880011]
      [  120.880011]        CPU0                    CPU1
      [  120.880011]        ----                    ----
      [  120.880011]   lock(rtnl_mutex);
      [  120.880011]                                lock(&pn->all_ppp_mutex);
      [  120.880011]                                lock(rtnl_mutex);
      [  120.880011]   lock(&pn->all_ppp_mutex);
      [  120.880011]
      [  120.880011]  *** DEADLOCK ***
      
      Fixes: 8cb775bc ("ppp: fix device unregistration upon netns deletion")
      Reported-by: default avatarSedat Dilek <sedat.dilek@gmail.com>
      Tested-by: default avatarSedat Dilek <sedat.dilek@gmail.com>
      Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      58a89eca
    • Sudip Mukherjee's avatar
      net: via/Kconfig: GENERIC_PCI_IOMAP required if PCI not selected · 21343ac2
      Sudip Mukherjee authored
      The builds of allmodconfig of avr32 is failing with:
      
      drivers/net/ethernet/via/via-rhine.c:1098:2: error: implicit declaration
      of function 'pci_iomap' [-Werror=implicit-function-declaration]
      drivers/net/ethernet/via/via-rhine.c:1119:2: error: implicit declaration
      of function 'pci_iounmap' [-Werror=implicit-function-declaration]
      
      The generic empty pci_iomap and pci_iounmap is used only if CONFIG_PCI
      is not defined and CONFIG_GENERIC_PCI_IOMAP is defined.
      
      Add GENERIC_PCI_IOMAP in the dependency list for VIA_RHINE as we are
      getting build failure when CONFIG_PCI and CONFIG_GENERIC_PCI_IOMAP both
      are not defined.
      Signed-off-by: default avatarSudip Mukherjee <sudip@vectorindia.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      21343ac2
    • Russell King's avatar
      phy: marvell: add link partner advertised modes · 357cd64c
      Russell King authored
      Read the standard link partner advertisment registers and store it in
      phydev->lp_advertising, so ethtool can report this information to
      userspace via ethtool.  Zero it as per genphy if autonegotiation is
      disabled.  Tested with a Marvell 88E1512 PHY.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      357cd64c
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 03e8f644
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "This is an assorted set I've been queuing up:
      
        Jeff Mahoney tracked down a tricky one where we ended up starting IO
        on the wrong mapping for special files in btrfs_evict_inode.  A few
        people reported this one on the list.
      
        Filipe found (and provided a test for) a difficult bug in reading
        compressed extents, and Josef fixed up some quota record keeping with
        snapshot deletion.  Chandan killed off an accounting bug during DIO
        that lead to WARN_ONs as we freed inodes"
      
      * 'for-linus-4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: keep dropped roots in cache until transaction commit
        Btrfs: Direct I/O: Fix space accounting
        btrfs: skip waiting on ordered range for special files
        Btrfs: fix read corruption of compressed and shared extents
        Btrfs: remove unnecessary locking of cleaner_mutex to avoid deadlock
        Btrfs: don't initialize a space info as full to prevent ENOSPC
      03e8f644
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-4.3-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · 101688f5
      Linus Torvalds authored
      Pull NFS client bugfixes from Trond Myklebust:
       "Highlights include:
      
        Stable patches:
         - fix v4.2 SEEK on files over 2 gigs
         - Fix a layout segment reference leak when pNFS I/O falls back to inband I/O.
         - Fix recovery of recalled read delegations
      
        Bugfixes:
         - Fix a case where NFSv4 fails to send CLOSE after a server reboot
         - Fix sunrpc to wait for connections to complete before retrying
         - Fix sunrpc races between transport connect/disconnect and shutdown
         - Fix an infinite loop when layoutget fail with BAD_STATEID
         - nfs/filelayout: Fix NULL reference caused by double freeing of fh_array
         - Fix a bogus WARN_ON_ONCE() in O_DIRECT when layout commit_through_mds is set
         - Fix layoutreturn/close ordering issues"
      
      * tag 'nfs-for-4.3-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        NFS41: make close wait for layoutreturn
        NFS: Skip checking ds_cinfo.buckets when lseg's commit_through_mds is set
        NFSv4.x/pnfs: Don't try to recover stateids twice in layoutget
        NFSv4: Recovery of recalled read delegations is broken
        NFS: Fix an infinite loop when layoutget fail with BAD_STATEID
        NFS: Do cleanup before resetting pageio read/write to mds
        SUNRPC: xs_sock_mark_closed() does not need to trigger socket autoclose
        SUNRPC: Lock the transport layer on shutdown
        nfs/filelayout: Fix NULL reference caused by double freeing of fh_array
        SUNRPC: Ensure that we wait for connections to complete before retrying
        SUNRPC: drop null test before destroy functions
        nfs: fix v4.2 SEEK on files over 2 gigs
        SUNRPC: Fix races between socket connection and destroy code
        nfs: fix pg_test page count calculation
        Failing to send a CLOSE if file is opened WRONLY and server reboots on a 4.x mount
      101688f5
    • Linus Torvalds's avatar
      Merge tag 'sound-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · ddff42e5
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This ended up with a larger set of fixes than wished, unfortunately.
      
        As diffstat shows, the majority of changes are for various ASoC
        drivers (Realtek, Wolfson codec drivers, etc), in addition to a couple
        of HD-audio regression fixes.  All these are reasonably small and
        nothing to scare much"
      
      * tag 'sound-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (29 commits)
        ALSA: hda - Disable power_save_node for Thinkpads
        ALSA: hda/tegra - async probe for avoiding module loading deadlock
        ASoC: rt5645: Prevent the pop sound in case of playback and the jack is plugging
        ASoC: rt5645: Increase the delay time to remove the pop sound
        ASoC: rt5645: Use the type SOC_DAPM_SINGLE_AUTODISABLE to prevent the weird sound in runtime of power up
        ASoC: pxa: pxa2xx-ac97: fix dma requestor lines
        MAINTAINERS: Update website and git repo for Wolfson Microelectronics
        ASoC: fsl_ssi: Fix checking of dai format for AC97 mode
        ASoC: wm0010: fix error path
        ASoC: wm0010: fix memory leak
        ASoC: wm8960: correct the max register value of mic boost pga
        ASoC: wm8962: remove 64k sample rate support
        ASoC: davinci-mcasp: Fix devm_kasprintf format string
        ASoC: fix broken pxa SoC support
        ASoC: davinci-mcasp: Set .symmetric_rates = 1 in snd_soc_dai_driver
        ASoC: au1x: psc-i2s: Fix unused variable 'ret' warning
        ASoC: SPEAr: Make SND_SPEAR_SOC select SND_SOC_GENERIC_DMAENGINE_PCM
        ASoC: mediatek: Increase periods_min in capture
        ASoC: davinci-mcasp: Revise the FIFO threshold calculation
        ASoC: wm8960: correct gain value for input PGA and add microphone PGA
        ...
      ddff42e5
    • Linus Torvalds's avatar
      Merge tag 'pci-v4.3-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · 966966a6
      Linus Torvalds authored
      Pull PCI fixes from Bjorn Helgaas:
       "These are fixes for things we merged for v4.3 (VPD, MSI, and bridge
        window management), and a new Renesas R8A7794 SoC device ID.
      
        Details:
      
        Resource management:
         - Revert pci_read_bridge_bases() unification (Bjorn Helgaas)
         - Clear IORESOURCE_UNSET when clipping a bridge window (Bjorn
           Helgaas)
      
        MSI:
         - Fix MSI IRQ domains for VFs on virtual buses (Alex Williamson)
      
        Renesas R-Car host bridge driver:
         - Add R8A7794 support (Sergei Shtylyov)
      
        Miscellaneous:
         - Fix devfn for VPD access through function 0 (Alex Williamson)
         - Use function 0 VPD only for identical functions (Alex Williamson)"
      
      * tag 'pci-v4.3-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        PCI: rcar: Add R8A7794 support
        PCI: Use function 0 VPD for identical functions, regular VPD for others
        PCI: Fix devfn for VPD access through function 0
        PCI/MSI: Fix MSI IRQ domains for VFs on virtual buses
        PCI: Clear IORESOURCE_UNSET when clipping a bridge window
        PCI: Revert "PCI: Call pci_read_bridge_bases() from core instead of arch code"
      966966a6
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · b6d980f4
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "AMD fixes for bugs introduced in the 4.2 merge window, and a few PPC
        bug fixes too"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: disable halt_poll_ns as default for s390x
        KVM: x86: fix off-by-one in reserved bits check
        KVM: x86: use correct page table format to check nested page table reserved bits
        KVM: svm: do not call kvm_set_cr0 from init_vmcb
        KVM: x86: trap AMD MSRs for the TSeg base and mask
        KVM: PPC: Book3S: Take the kvm->srcu lock in kvmppc_h_logical_ci_load/store()
        KVM: PPC: Book3S HV: Pass the correct trap argument to kvmhv_commence_exit
        KVM: PPC: Book3S HV: Fix handling of interrupted VCPUs
        kvm: svm: reset mmu on VCPU reset
      b6d980f4
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 57cb635c
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       - Wire up sys_membarrier()
       - cxl: Fix lockdep warning while creating afu_err_buff from Vaibhav
      
      * tag 'powerpc-4.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        cxl: Fix lockdep warning while creating afu_err_buff attribute
        powerpc: Wire up sys_membarrier()
      57cb635c
    • David Hildenbrand's avatar
      KVM: disable halt_poll_ns as default for s390x · 920552b2
      David Hildenbrand authored
      We observed some performance degradation on s390x with dynamic
      halt polling. Until we can provide a proper fix, let's enable
      halt_poll_ns as default only for supported architectures.
      
      Architectures are now free to set their own halt_poll_ns
      default value.
      Signed-off-by: default avatarDavid Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      920552b2
    • Paolo Bonzini's avatar
      KVM: x86: fix off-by-one in reserved bits check · 58c95070
      Paolo Bonzini authored
      29ecd660 ("KVM: x86: avoid uninitialized variable warning",
      2015-09-06) introduced a not-so-subtle problem, which probably
      escaped review because it was not part of the patch context.
      
      Before the patch, leaf was always equal to iterator.level.  After,
      it is equal to iterator.level - 1 in the call to is_shadow_zero_bits_set,
      and when is_shadow_zero_bits_set does another "-1" the check on
      reserved bits becomes incorrect.  Using "iterator.level" in the call
      fixes this call trace:
      
      WARNING: CPU: 2 PID: 17000 at arch/x86/kvm/mmu.c:3385 handle_mmio_page_fault.part.93+0x1a/0x20 [kvm]()
      Modules linked in: tun sha256_ssse3 sha256_generic drbg binfmt_misc ipv6 vfat fat fuse dm_crypt dm_mod kvm_amd kvm crc32_pclmul aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd fam15h_power amd64_edac_mod k10temp edac_core amdkfd amd_iommu_v2 radeon acpi_cpufreq
      [...]
      Call Trace:
        dump_stack+0x4e/0x84
        warn_slowpath_common+0x95/0xe0
        warn_slowpath_null+0x1a/0x20
        handle_mmio_page_fault.part.93+0x1a/0x20 [kvm]
        tdp_page_fault+0x231/0x290 [kvm]
        ? emulator_pio_in_out+0x6e/0xf0 [kvm]
        kvm_mmu_page_fault+0x36/0x240 [kvm]
        ? svm_set_cr0+0x95/0xc0 [kvm_amd]
        pf_interception+0xde/0x1d0 [kvm_amd]
        handle_exit+0x181/0xa70 [kvm_amd]
        ? kvm_arch_vcpu_ioctl_run+0x68b/0x1730 [kvm]
        kvm_arch_vcpu_ioctl_run+0x6f6/0x1730 [kvm]
        ? kvm_arch_vcpu_ioctl_run+0x68b/0x1730 [kvm]
        ? preempt_count_sub+0x9b/0xf0
        ? mutex_lock_killable_nested+0x26f/0x490
        ? preempt_count_sub+0x9b/0xf0
        kvm_vcpu_ioctl+0x358/0x710 [kvm]
        ? __fget+0x5/0x210
        ? __fget+0x101/0x210
        do_vfs_ioctl+0x2f4/0x560
        ? __fget_light+0x29/0x90
        SyS_ioctl+0x4c/0x90
        entry_SYSCALL_64_fastpath+0x16/0x73
      ---[ end trace 37901c8686d84de6 ]---
      Reported-by: default avatarBorislav Petkov <bp@alien8.de>
      Tested-by: default avatarBorislav Petkov <bp@alien8.de>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      58c95070
    • Paolo Bonzini's avatar
      KVM: x86: use correct page table format to check nested page table reserved bits · 6fec2144
      Paolo Bonzini authored
      Intel CPUID on AMD host or vice versa is a weird case, but it can
      happen.  Handle it by checking the host CPU vendor instead of the
      guest's in reset_tdp_shadow_zero_bits_mask.  For speed, the
      check uses the fact that Intel EPT has an X (executable) bit while
      AMD NPT has NX.
      Reported-by: default avatarBorislav Petkov <bp@alien8.de>
      Tested-by: default avatarBorislav Petkov <bp@alien8.de>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      6fec2144
    • Paolo Bonzini's avatar
      KVM: svm: do not call kvm_set_cr0 from init_vmcb · 79a8059d
      Paolo Bonzini authored
      kvm_set_cr0 may want to call kvm_zap_gfn_range and thus access the
      memslots array (SRCU protected).  Using a mini SRCU critical section
      is ugly, and adding it to kvm_arch_vcpu_create doesn't work because
      the VMX vcpu_create callback calls synchronize_srcu.
      
      Fixes this lockdep splat:
      
      ===============================
      [ INFO: suspicious RCU usage. ]
      4.3.0-rc1+ #1 Not tainted
      -------------------------------
      include/linux/kvm_host.h:488 suspicious rcu_dereference_check() usage!
      
      other info that might help us debug this:
      rcu_scheduler_active = 1, debug_locks = 0
      1 lock held by qemu-system-i38/17000:
       #0:  (&(&kvm->mmu_lock)->rlock){+.+...}, at: kvm_zap_gfn_range+0x24/0x1a0 [kvm]
      
      [...]
      Call Trace:
       dump_stack+0x4e/0x84
       lockdep_rcu_suspicious+0xfd/0x130
       kvm_zap_gfn_range+0x188/0x1a0 [kvm]
       kvm_set_cr0+0xde/0x1e0 [kvm]
       init_vmcb+0x760/0xad0 [kvm_amd]
       svm_create_vcpu+0x197/0x250 [kvm_amd]
       kvm_arch_vcpu_create+0x47/0x70 [kvm]
       kvm_vm_ioctl+0x302/0x7e0 [kvm]
       ? __lock_is_held+0x51/0x70
       ? __fget+0x101/0x210
       do_vfs_ioctl+0x2f4/0x560
       ? __fget_light+0x29/0x90
       SyS_ioctl+0x4c/0x90
       entry_SYSCALL_64_fastpath+0x16/0x73
      Reported-by: default avatarBorislav Petkov <bp@alien8.de>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      79a8059d
    • Nicholas Bellinger's avatar
      iscsi-target: Avoid OFMarker + IFMarker negotiation · 673681ca
      Nicholas Bellinger authored
      This patch fixes a v4.2+ regression introduced by commit c04a6091
      that removed support for obsolete sync-and-steering markers usage
      as originally defined in RFC-3720.
      
      The regression would involve attempting to send OFMarker=No +
      IFMarker=No keys during opertional negotiation login phase,
      including when initiators did not actually propose these keys.
      
      The result for MSFT iSCSI initiators would be random junk in
      TCP stream after the last successful login request was been sent
      signaling the move to full feature phase (FFP) operation.
      
      To address this bug, go ahead and avoid negotiating these keys
      by default unless the initiator explicitly proposes them, but
      still respond to them with 'No' if they are proposed.
      Reported-by: default avatarDragan Milivojević <galileo@pkm-inc.com>
      Bisected-by: default avatarChristophe Vu-Brugier <cvubrugier@fastmail.fm>
      Tested-by: default avatarChristophe Vu-Brugier <cvubrugier@fastmail.fm>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      673681ca
    • Nicholas Bellinger's avatar
      target: Make TCM_WRITE_PROTECT failure honor D_SENSE bit · 8fa3a867
      Nicholas Bellinger authored
      This patch changes transport_lookup_cmd_lun() to obtain
      se_lun->lun_ref + se_cmd->se_device rcu_dereference during
      TCM_WRITE_PROTECT -> CHECK_CONDITION failure status.
      
      Do this to ensure the active control D_SENSE mode page bit
      is being honored.
      Reported-by: default avatarSagi Grimberg <sagig@mellanox.com>
      Reviewed-by: default avatarSagi Grimberg <sagig@mellanox.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      8fa3a867
    • Nicholas Bellinger's avatar
      target: Fix target_sense_desc_format NULL pointer dereference · f3bb467f
      Nicholas Bellinger authored
      This patch allows target_sense_desc_format() to be called without a
      valid se_device pointer, which can occur during an early exception
      ahead of transport_lookup_cmd_lun() setting up se_cmd->se_device.
      
      This addresses a v4.3-rc1 specific NULL pointer dereference
      regression introduced by commit 4e4937e8.
      
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Hannes Reinecke <hare@suse.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      f3bb467f
    • Nicholas Bellinger's avatar
      target: Propigate backend read-only to core_tpg_add_lun · eeeb9522
      Nicholas Bellinger authored
      This patch adds a DF_READ_ONLY flag that is used by IBLOCK to
      signal when a backend has been set to read-only mode, in order
      to propigate read-only status up to core_tpg_add_lun() for all
      future LUN fabric exports.
      
      With this is place, existing emulation for reporting read-only
      in spc_emulate_modesense() and normal transport_lookup_cmd_lun()
      TCM_WRITE_PROTECTED status checking just works as expected.
      Reported-by: default avatarJoeue Deng <joeue404@gmail.com>
      Reported-by: default avatarAndy Grover <agrover@redhat.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      eeeb9522
    • Nicholas Bellinger's avatar
      target: Fix PR registration + APTPL RCU conversion regression · 3ccd6e83
      Nicholas Bellinger authored
      This patch fixes a v4.2+ regression introduced by commit 79dc9c9e
      where lookup of t10_pr_registration->pr_reg_deve and associated
      ->pr_kref get was missing from __core_scsi3_do_alloc_registration(),
      which is responsible for setting DEF_PR_REG_ACTIVE.
      
      This would result in REGISTER operations completing successfully,
      but subsequent core_scsi3_pr_seq_non_holder() checking would fail
      with !DEF_PR_REG_ACTIVE -> RESERVATION CONFLICT status.
      
      Update __core_scsi3_add_registration() to drop ->pr_kref reference
      after registration and any optional ALL_TG_PT=1 processing has
      completed.  Update core_scsi3_decode_spec_i_port() to release
      the new parent local_pr_reg->pr_kref as well.
      
      Also, update __core_scsi3_check_aptpl_registration() to perform
      the same target_nacl_find_deve() lookup + ->pr_kref get, now that
      __core_scsi3_add_registration() expects to drop the reference.
      
      Finally, since there are cases when se_dev_entry->se_lun_acl can
      still be dereferenced in core_scsi3_lunacl_undepend_item() while
      holding ->pr_kref, go ahead and move explicit rcu_assign_pointer()
      NULL assignments within core_disable_device_list_for_node() until
      after orig->pr_comp finishes.
      Reported-by: default avatarScott L. Lykens <scott@lykens.org>
      Tested-by: default avatarScott L. Lykens <scott@lykens.org>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Hannes Reinecke <hare@suse.de>
      Cc: Lee Duncan <lduncan@suse.com>
      Cc: <stable@vger.kernel.org> # v4.2+
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      3ccd6e83
    • David S. Miller's avatar
      Merge branch 'phy-mdio-refcnt' · b626ef01
      David S. Miller authored
      Russell King says:
      
      ====================
      Phy, mdiobus, and netdev struct device fixes
      
      The third version of this series fixes the build error which David
      identified, and drops the broken changes for the Cavium Thunger BGX
      ethernet driver as this driver requires some complex changes to
      resolve the leakage - and this is best done by people who can test
      the driver.
      
      Compared to v2, the only patch which has changed is patch 6
        "net: fix phy refcounting in a bunch of drivers"
      
      I _think_ I've been able to build-test all the drivers touched by
      that patch to some degree now, though several of them needed the
      Kconfig hacked to allow it (not all had || COMPILE_TEST clause on
      their dependencies.)
      
      Previous cover letters below:
      
      This is the second version of the series, with the comments David had
      on the first patch fixed up.  Original series description with updated
      diffstat below.
      
      While looking at the DSA code, I noticed we have a
      of_find_net_device_by_node(), and it looks like users of that are
      similarly buggy - it looks like net/dsa/dsa.c is the only user.  Fix
      that too.
      
      Hi,
      
      While looking at the phy code, I identified a number of weaknesses
      where refcounting on device structures was being leaked, where
      modules could be removed while in-use, and where the fixed-phy could
      end up having unintended consequences caused by incorrect calls to
      fixed_phy_update_state().
      
      This patch series resolves those issues, some of which were discovered
      with testing on an Armada 388 board.  Not all patches are fully tested,
      particularly the one which touches several network drivers.
      
      When resolving the struct device refcounting problems, several different
      solutions were considered before settling on the implementation here -
      one of the considerations was to avoid touching many network drivers.
      The solution here is:
      
      	phy_attach*() - takes a refcount
      	phy_detach*() - drops the phy_attach refcount
      
      Provided drivers always attach and detach their phys, which they should
      already be doing, this should change nothing, even if they leak a refcount.
      
      	of_phy_find_device() and of_* functions which use that take
      	a refcount.  Arrange for this refcount to be dropped once
      	the phy is attached.
      
      This is the reason why the previous change is important - we can't drop
      this refcount taken by of_phy_find_device() until something else holds
      a reference on the device.  This resolves the leaked refcount caused by
      using of_phy_connect() or of_phy_attach().
      
      Even without the above changes, these drivers are leaking by calling
      of_phy_find_device().  These drivers are addressed by adding the
      appropriate release of that refcount.
      
      The mdiobus code also suffered from the same kind of leak, but thankfully
      this only happened in one place - the mdio-mux code.
      
      I also found that the try_module_get() in the phy layer code was utterly
      useless: phydev->dev.driver was guaranteed to always be NULL, so
      try_module_get() was always being called with a NULL argument.  I proved
      this with my SFP code, which declares its own MDIO bus - the module use
      count was never incremented irrespective of how I set the MDIO bus up.
      This allowed the MDIO bus code to be removed from the kernel while there
      were still PHYs attached to it.
      
      One other bug was discovered: while using in-band-status with mvneta, it
      was found that if a real phy is attached with in-band-status enabled,
      and another ethernet interface is using the fixed-phy infrastructure, the
      interface using the fixed-phy infrastructure is configured according to
      the other interface using the in-band-status - which is caused by the
      fixed-phy code not verifying that the phy_device passed in is actually
      a fixed-phy device, rather than a real MDIO phy.
      
      Lastly, having mdio_bus reversing phy_device_register() internals seems
      like a layering violation - it's trivial to move that code to the phy
      device layer.
      ====================
      Tested-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b626ef01
    • Russell King's avatar
      net: fix net_device refcounting · 9861f720
      Russell King authored
      of_find_net_device_by_node() uses class_find_device() internally to
      lookup the corresponding network device.  class_find_device() returns
      a reference to the embedded struct device, with its refcount
      incremented.
      
      Add a comment to the definition in net/core/net-sysfs.c indicating the
      need to drop this refcount, and fix the DSA code to drop this refcount
      when the OF-generated platform data is cleaned up and freed.  Also
      arrange for the ref to be dropped when handling errors.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9861f720
    • Russell King's avatar
      phy: add phy_device_remove() · 38737e49
      Russell King authored
      Add a phy_device_remove() function to complement phy_device_register(),
      which undoes the effects of phy_device_register() by removing the phy
      device from visibility, but not freeing it.
      
      This allows these details to be moved out of the mdio bus code into
      the phy code where this action belongs.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      38737e49
    • Russell King's avatar
      phy: fixed-phy: properly validate phy in fixed_phy_update_state() · d618bf2b
      Russell King authored
      Validate that the phy_device passed into fixed_phy_update_state() is a
      fixed-phy device before walking the list of phys for a fixed phy at the
      same address.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d618bf2b
    • Russell King's avatar
      net: fix phy refcounting in a bunch of drivers · 04d53b20
      Russell King authored
      of_phy_find_device() increments the phy struct device refcount, which
      we need to properly balance.  Add code to network drivers using this
      function to ensure that the struct device refcount is correctly
      balanced.
      
      For xgene, looking back in the history, we should be able to use
      of_phy_connect() with a zero flags argument for the DT case as this is
      how the driver used to operate prior to de7b5b3d ("net: eth: xgene:
      change APM X-Gene SoC platform ethernet to support ACPI").
      
      This leaves the Cavium Thunder BGX unfixed; fixing this driver is a
      complicated task, one which the maintainers need to be involved with.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      04d53b20
    • Russell King's avatar
      of_mdio: fix MDIO phy device refcounting · f018ae7a
      Russell King authored
      bus_find_device() is defined as:
      
       * This is similar to the bus_for_each_dev() function above, but it
       * returns a reference to a device that is 'found' for later use, as
       * determined by the @match callback.
      
      and it does indeed return a reference-counted pointer to the device:
      
              while ((dev = next_device(&i)))
                      if (match(dev, data) && get_device(dev))
                                              ^^^^^^^^^^^^^^^
                              break;
              klist_iter_exit(&i);
              return dev;
      
      What that means is that when we're done with the struct device, we must
      drop that reference.  Neither of_phy_connect() nor of_phy_attach() did
      this when phy_connect_direct() or phy_attach_direct() failed.
      
      With our previous patch, phy_connect_direct() and phy_attach_direct()
      take a new refcount on the phy device when successful, so we can drop
      our local reference immediatley after these functions, whether or not
      they succeeded.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      Acked-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f018ae7a