1. 24 Jun, 2015 2 commits
    • Alexey Brodkin's avatar
      stmmac: troubleshoot unexpected bits in des0 & des1 · f1590670
      Alexey Brodkin authored
      Current implementation of descriptor init procedure only takes
      care about setting/clearing ownership flag in "des0"/"des1"
      fields while it is perfectly possible to get unexpected bits
      set because of the following factors:
      
       [1] On driver probe underlying memory allocated with
           dma_alloc_coherent() might not be zeroed and so
           it will be filled with garbage.
      
       [2] During driver operation some bits could be set by SD/MMC
           controller (for example error flags etc).
      
      And unexpected and/or randomly set flags in "des0"/"des1"
      fields may lead to unpredictable behavior of GMAC DMA block.
      
      This change addresses both items above with:
      
       [1] Use of dma_zalloc_coherent() instead of simple
           dma_alloc_coherent() to make sure allocated memory is
           zeroed. That shouldn't affect performance because
           this allocation only happens once on driver probe.
      
       [2] Do explicit zeroing of both "des0" and "des1" fields
           of all buffer descriptors during initialization of
           DMA transfer.
      
      And while at it fixed identation of dma_free_coherent()
      counterpart as well.
      Signed-off-by: default avatarAlexey Brodkin <abrodkin@synopsys.com>
      Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
      Cc: arc-linux-dev@synopsys.com
      Cc: linux-kernel@vger.kernel.org
      Cc: stable@vger.kernel.org
      Cc: David Miller <davem@davemloft.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f1590670
    • Julian Anastasov's avatar
      ip: report the original address of ICMP messages · 34b99df4
      Julian Anastasov authored
      ICMP messages can trigger ICMP and local errors. In this case
      serr->port is 0 and starting from Linux 4.0 we do not return
      the original target address to the error queue readers.
      Add function to define which errors provide addr_offset.
      With this fix my ping command is not silent anymore.
      
      Fixes: c247f053 ("ip: fix error queue empty skb handling")
      Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
      Acked-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      34b99df4
  2. 23 Jun, 2015 8 commits
    • Gilad Ben-Yossef's avatar
      rocker: call correct unregister function on error · a076e6bf
      Gilad Ben-Yossef authored
      Use the correct unregister function matching the register
      function on the error path.
      Signed-off-by: default avatarGilad Ben-Yossef <gilad@benyossef.com>
      Fixes: c1beeef7 ("rocker: implement IPv4 fib offloading")
      Acked-by: default avatarJiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a076e6bf
    • David S. Miller's avatar
      Merge tag 'linux-can-fixes-for-4.1-20150621' of... · 5b3f87db
      David S. Miller authored
      Merge tag 'linux-can-fixes-for-4.1-20150621' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
      
      Marc Kleine-Budde says:
      
      ====================
      Oliver Hartkopp fixed a bug in the generic CAN frame handling code, which may
      lead to loss of CAN frames. It was introduced during v4.1 development.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
       gpg: Signature made Sun 21 Jun 2015 09:59:36 AM PDT using RSA key ID C9B5CFC7
      5b3f87db
    • Alexander Popov's avatar
      net: fs_enet: Fix NETIF_F_SG feature for Freescale MPC5121 · 26c0a14f
      Alexander Popov authored
      Commit 4fc9b87b ("net: fs_enet: Implement NETIF_F_SG feature")
      brings a trouble to Freescale MPC512x: a kernel oops happens
      during sending non-linear sk_buff with .data not aligned by 4.
      
      Log quotation:
      
      Unable to handle kernel paging request for data at address 0xe467c000
      Faulting instruction address: 0xc000cd44
      Oops: Kernel access of bad area, sig: 11 [#1]
      MPC512x generic
      Modules linked in:
      CPU: 0 PID: 984 Comm: kworker/0:1H Not tainted 4.1.0-rc8-00024-gbb16140a #2
      Workqueue: rpciod rpc_async_schedule
      task: cf364a50 ti: cf362000 task.ti: cf362000
      NIP: c000cd44 LR: c000c720 CTR: 00000206
      REGS: cf363ac0 TRAP: 0300   Not tainted  (4.1.0-rc8-00024-gbb16140a)
      MSR: 00009032 <EE,ME,IR,DR,RI>  CR: 42004082  XER: 00000000
      DAR: e467c000 DSISR: 20000000
      GPR00: c0279e24 cf363b70 cf364a50 e467c000 00000206 0000001f 00000001 00000001
      GPR08: 00000000 e467c000 e46800be 000139a6 82002082 00000000 c002e46c cf3c3680
      GPR16: c044cb30 c04b0000 cf363c48 00000000 00000001 fde0315c 00000000 0000000b
      GPR24: 0000002c 000040be cf339aa0 0000000b 00000001 cf873210 00282f85 00000000
      NIP [c000cd44] clean_dcache_range+0x1c/0x30
      LR [c000c720] dma_direct_map_page+0x40/0x94
      Call Trace:
      [cf363b70] [cf339b60] 0xcf339b60 (unreliable)
      [cf363b90] [c0279e24] fs_enet_start_xmit+0x1c8/0x42c
      [cf363bd0] [c02ff710] dev_hard_start_xmit+0x2dc/0x3d4
      [cf363c40] [c0319c60] sch_direct_xmit+0xcc/0x1cc
      [cf363c70] [c02ff9c0] __dev_queue_xmit+0x1b8/0x47c
      [cf363ca0] [c032a3e8] ip_finish_output+0x1fc/0x9a8
      [cf363ce0] [c032c31c] ip_send_skb+0x1c/0xa4
      [cf363cf0] [c035112c] udp_send_skb+0xe4/0x2e8
      [cf363d10] [c0351368] udp_push_pending_frames+0x38/0x84
      [cf363d20] [c03537b8] udp_sendpage+0x134/0x174
      [cf363d70] [c0384fd4] xs_sendpages+0x21c/0x250
      [cf363db0] [c03852bc] xs_udp_send_request+0x50/0xf8
      [cf363de0] [c0382f08] xprt_transmit+0x64/0x280
      [cf363e20] [c038017c] call_transmit+0x168/0x234
      [cf363e40] [c0387918] __rpc_execute+0x88/0x2b0
      [cf363e80] [c00296f8] process_one_work+0x124/0x2fc
      [cf363ea0] [c0029a00] worker_thread+0x130/0x480
      [cf363ef0] [c002e528] kthread+0xbc/0xd0
      [cf363f40] [c000e4a8] ret_from_kernel_thread+0x5c/0x64
      Instruction dump:
      7c70faa6 60630800 7c70fba6 4c00012c 4e800020 38a0001f 7c632878 7c832050
      7c842a14 5484d97f 4d820020 7c8903a6 <7c00186c> 38630020 4200fff8 7c0004ac
      ---[ end trace c846c1eceb513c85 ]---
      
      The reason:
      
      MPC5121 FEC requires 4-byte alignment for TX data buffer and calls
      tx_skb_align_workaround() for copying sk_buff with not aligned .data to a new
      sk_buff with aligned one. But tx_skb_align_workaround() uses
      skb_copy_from_linear_data() which doesn't work for non-linear sk_buff:
      a new sk_buff has non-zero nr_frags and zero .data_len.
      
      So improve the condition of calling tx_skb_align_workaround() and use
      skb_linearize() in it.
      Signed-off-by: default avatarAlexander Popov <alex.popov@linux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      26c0a14f
    • Palik, Imre's avatar
      xen-netback: fix a BUG() during initialization · 12b322ac
      Palik, Imre authored
      Commit edafc132 ("xen-netback: making the bandwidth limiter runtime settable")
      introduced the capability to change the bandwidth rate limit at runtime.
      But it also introduced a possible crashing bug.
      
      If netback receives two XenbusStateConnected without getting the
      hotplug-status watch firing in between, then it will try to register the
      watches for the rate limiter again.  But this triggers a BUG() in the watch
      registration code.
      
      The fix modifies connect() to remove the possibly existing packet-rate
      watches before trying to install those watches.  This behaviour is in line
      with how connect() deals with the hotplug-status watch.
      Signed-off-by: default avatarImre Palik <imrep@amazon.de>
      Cc: Matt Wilson <msw@amazon.com>
      Acked-by: default avatarWei Liu <wei.liu2@citrix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      12b322ac
    • Satish Ashok's avatar
      bridge: multicast: restore router configuration on port link down/up · 754bc547
      Satish Ashok authored
      When a port goes through a link down/up the multicast router configuration
      is not restored.
      Signed-off-by: default avatarSatish Ashok <sashok@cumulusnetworks.com>
      Signed-off-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
      Fixes: 0909e117 ("bridge: Add multicast_router sysfs entries")
      Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      754bc547
    • Ralf Baechle's avatar
      NET: ROSE: Don't dereference NULL neighbour pointer. · d496f784
      Ralf Baechle authored
      A ROSE socket doesn't necessarily always have a neighbour pointer so check
      if the neighbour pointer is valid before dereferencing it.
      Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      Tested-by: default avatarBernard Pidoux <f6bvp@free.fr>
      Cc: stable@vger.kernel.org #2.6.11+
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d496f784
    • Christoph Paasch's avatar
      tcp: Do not call tcp_fastopen_reset_cipher from interrupt context · dfea2aa6
      Christoph Paasch authored
      tcp_fastopen_reset_cipher really cannot be called from interrupt
      context. It allocates the tcp_fastopen_context with GFP_KERNEL and
      calls crypto_alloc_cipher, which allocates all kind of stuff with
      GFP_KERNEL.
      
      Thus, we might sleep when the key-generation is triggered by an
      incoming TFO cookie-request which would then happen in interrupt-
      context, as shown by enabling CONFIG_DEBUG_ATOMIC_SLEEP:
      
      [   36.001813] BUG: sleeping function called from invalid context at mm/slub.c:1266
      [   36.003624] in_atomic(): 1, irqs_disabled(): 0, pid: 1016, name: packetdrill
      [   36.004859] CPU: 1 PID: 1016 Comm: packetdrill Not tainted 4.1.0-rc7 #14
      [   36.006085] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
      [   36.008250]  00000000000004f2 ffff88007f8838a8 ffffffff8171d53a ffff880075a084a8
      [   36.009630]  ffff880075a08000 ffff88007f8838c8 ffffffff810967d3 ffff88007f883928
      [   36.011076]  0000000000000000 ffff88007f8838f8 ffffffff81096892 ffff88007f89be00
      [   36.012494] Call Trace:
      [   36.012953]  <IRQ>  [<ffffffff8171d53a>] dump_stack+0x4f/0x6d
      [   36.014085]  [<ffffffff810967d3>] ___might_sleep+0x103/0x170
      [   36.015117]  [<ffffffff81096892>] __might_sleep+0x52/0x90
      [   36.016117]  [<ffffffff8118e887>] kmem_cache_alloc_trace+0x47/0x190
      [   36.017266]  [<ffffffff81680d82>] ? tcp_fastopen_reset_cipher+0x42/0x130
      [   36.018485]  [<ffffffff81680d82>] tcp_fastopen_reset_cipher+0x42/0x130
      [   36.019679]  [<ffffffff81680f01>] tcp_fastopen_init_key_once+0x61/0x70
      [   36.020884]  [<ffffffff81680f2c>] __tcp_fastopen_cookie_gen+0x1c/0x60
      [   36.022058]  [<ffffffff816814ff>] tcp_try_fastopen+0x58f/0x730
      [   36.023118]  [<ffffffff81671788>] tcp_conn_request+0x3e8/0x7b0
      [   36.024185]  [<ffffffff810e3872>] ? __module_text_address+0x12/0x60
      [   36.025327]  [<ffffffff8167b2e1>] tcp_v4_conn_request+0x51/0x60
      [   36.026410]  [<ffffffff816727e0>] tcp_rcv_state_process+0x190/0xda0
      [   36.027556]  [<ffffffff81661f97>] ? __inet_lookup_established+0x47/0x170
      [   36.028784]  [<ffffffff8167c2ad>] tcp_v4_do_rcv+0x16d/0x3d0
      [   36.029832]  [<ffffffff812e6806>] ? security_sock_rcv_skb+0x16/0x20
      [   36.030936]  [<ffffffff8167cc8a>] tcp_v4_rcv+0x77a/0x7b0
      [   36.031875]  [<ffffffff816af8c3>] ? iptable_filter_hook+0x33/0x70
      [   36.032953]  [<ffffffff81657d22>] ip_local_deliver_finish+0x92/0x1f0
      [   36.034065]  [<ffffffff81657f1a>] ip_local_deliver+0x9a/0xb0
      [   36.035069]  [<ffffffff81657c90>] ? ip_rcv+0x3d0/0x3d0
      [   36.035963]  [<ffffffff81657569>] ip_rcv_finish+0x119/0x330
      [   36.036950]  [<ffffffff81657ba7>] ip_rcv+0x2e7/0x3d0
      [   36.037847]  [<ffffffff81610652>] __netif_receive_skb_core+0x552/0x930
      [   36.038994]  [<ffffffff81610a57>] __netif_receive_skb+0x27/0x70
      [   36.040033]  [<ffffffff81610b72>] process_backlog+0xd2/0x1f0
      [   36.041025]  [<ffffffff81611482>] net_rx_action+0x122/0x310
      [   36.042007]  [<ffffffff81076743>] __do_softirq+0x103/0x2f0
      [   36.042978]  [<ffffffff81723e3c>] do_softirq_own_stack+0x1c/0x30
      
      This patch moves the call to tcp_fastopen_init_key_once to the places
      where a listener socket creates its TFO-state, which always happens in
      user-context (either from the setsockopt, or implicitly during the
      listen()-call)
      
      Cc: Eric Dumazet <eric.dumazet@gmail.com>
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Fixes: 222e83d2 ("tcp: switch tcp_fastopen key generation to net_get_random_once")
      Signed-off-by: default avatarChristoph Paasch <cpaasch@apple.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dfea2aa6
    • Stas Sergeev's avatar
      mvneta: add forgotten initialization of autonegotiation bits · 538761b7
      Stas Sergeev authored
      The commit 898b2970 ("mvneta: implement SGMII-based in-band link state
      signaling")
      changed mvneta_adjust_link() so that it does not clear the auto-negotiation
      bits in MVNETA_GMAC_AUTONEG_CONFIG register. This was necessary for
      auto-negotiation mode to work.
      Unfortunately I haven't checked if these bits are ever initialized.
      It appears they are not.
      This patch adds the missing initialization of the auto-negotiation bits
      in the MVNETA_GMAC_AUTONEG_CONFIG register.
      It fixes the following regression:
      https://www.mail-archive.com/netdev@vger.kernel.org/msg67928.html
      
      Since the patch was tested to fix a regression, it should be applied to
      stable tree.
      Tested-by: default avatarArnaud Ebalard <arno@natisbad.org>
      
      CC: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
      CC: Florian Fainelli <f.fainelli@gmail.com>
      CC: netdev@vger.kernel.org
      CC: linux-kernel@vger.kernel.org
      CC: stable@vger.kernel.org
      Signed-off-by: default avatarStas Sergeev <stsp@users.sourceforge.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      538761b7
  3. 21 Jun, 2015 6 commits
  4. 18 Jun, 2015 1 commit
    • Nikolay Aleksandrov's avatar
      bridge: fix br_stp_set_bridge_priority race conditions · 2dab80a8
      Nikolay Aleksandrov authored
      After the ->set() spinlocks were removed br_stp_set_bridge_priority
      was left running without any protection when used via sysfs. It can
      race with port add/del and could result in use-after-free cases and
      corrupted lists. Tested by running port add/del in a loop with stp
      enabled while setting priority in a loop, crashes are easily
      reproducible.
      The spinlocks around sysfs ->set() were removed in commit:
      14f98f25 ("bridge: range check STP parameters")
      There's also a race condition in the netlink priority support that is
      fixed by this change, but it was introduced recently and the fixes tag
      covers it, just in case it's needed the commit is:
      af615762 ("bridge: add ageing_time, stp_state, priority over netlink")
      Signed-off-by: default avatarNikolay Aleksandrov <razor@blackwall.org>
      Fixes: 14f98f25 ("bridge: range check STP parameters")
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2dab80a8
  5. 15 Jun, 2015 1 commit
  6. 14 Jun, 2015 1 commit
    • Marcelo Ricardo Leitner's avatar
      sctp: fix ASCONF list handling · 2d45a02d
      Marcelo Ricardo Leitner authored
      ->auto_asconf_splist is per namespace and mangled by functions like
      sctp_setsockopt_auto_asconf() which doesn't guarantee any serialization.
      
      Also, the call to inet_sk_copy_descendant() was backuping
      ->auto_asconf_list through the copy but was not honoring
      ->do_auto_asconf, which could lead to list corruption if it was
      different between both sockets.
      
      This commit thus fixes the list handling by using ->addr_wq_lock
      spinlock to protect the list. A special handling is done upon socket
      creation and destruction for that. Error handlig on sctp_init_sock()
      will never return an error after having initialized asconf, so
      sctp_destroy_sock() can be called without addrq_wq_lock. The lock now
      will be take on sctp_close_sock(), before locking the socket, so we
      don't do it in inverse order compared to sctp_addr_wq_timeout_handler().
      
      Instead of taking the lock on sctp_sock_migrate() for copying and
      restoring the list values, it's preferred to avoid rewritting it by
      implementing sctp_copy_descendant().
      
      Issue was found with a test application that kept flipping sysctl
      default_auto_asconf on and off, but one could trigger it by issuing
      simultaneous setsockopt() calls on multiple sockets or by
      creating/destroying sockets fast enough. This is only triggerable
      locally.
      
      Fixes: 9f7d653b ("sctp: Add Auto-ASCONF support (core).")
      Reported-by: default avatarJi Jianwen <jiji@redhat.com>
      Suggested-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Suggested-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2d45a02d
  7. 13 Jun, 2015 1 commit
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c8d17b45
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix uninitialized struct station_info in cfg80211_wireless_stats(),
          from Johannes Berg.
      
       2) Revert commit attempt to fix ipv6 protocol resubmission, it adds
          regressions.
      
       3) Endless loops can be created in bridge port lists, fix from Nikolay
          Aleksandrov.
      
       4) Don't WARN_ON() if sk->sk_forward_alloc is non-zero in
          sk_clear_memalloc, it is a legal situation during swap deactivation.
          Fix from Mel Gorman.
      
       5) Fix order of disabling interrupts and unlocking NAPI in enic driver
          to avoid a race.  From Govindarajulu Varadarajan.
      
       6) High and low register writes are swapped when programming the start
          of periodic output in igb driver.  From Richard Cochran.
      
       7) Fix device rename handling in mpls stack, from Robert Shearman.
      
       8) Do not trigger compaction synchronously when optimistically trying
          to allocate an order 3 page in alloc_skb_with_frags() and
          skb_page_frag_refill().  From Shaohua Li.
      
       9) Authentication with COOKIE_ECHO is not handled properly in SCTP, fix
          from Marcelo Ricardo Leitner.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        Doc: networking: Fix URL for wiki.wireshark.org in udplite.txt
        sctp: allow authenticating DATA chunks that are bundled with COOKIE_ECHO
        net: don't wait for order-3 page allocation
        mpls: handle device renames for per-device sysctls
        net: igb: fix the start time for periodic output signals
        enic: fix memory leak in rq_clean
        enic: check return value for stat dump
        enic: unlock napi busy poll before unmasking intr
        net, swap: Remove a warning and clarify why sk_mem_reclaim is required when deactivating swap
        bridge: fix multicast router rlist endless loop
        tipc: disconnect socket directly after probe failure
        Revert "ipv6: Fix protocol resubmission"
        cfg80211: wext: clear sinfo struct before calling driver
      c8d17b45
  8. 12 Jun, 2015 13 commits
    • Masanari Iida's avatar
      Doc: networking: Fix URL for wiki.wireshark.org in udplite.txt · b07d4961
      Masanari Iida authored
      This patch fix URL (http to https) for wiki.wireshark.org.
      Signed-off-by: default avatarMasanari Iida <standby24x7@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b07d4961
    • Marcelo Ricardo Leitner's avatar
      sctp: allow authenticating DATA chunks that are bundled with COOKIE_ECHO · ae36806a
      Marcelo Ricardo Leitner authored
      Currently, we can ask to authenticate DATA chunks and we can send DATA
      chunks on the same packet as COOKIE_ECHO, but if you try to combine
      both, the DATA chunk will be sent unauthenticated and peer won't accept
      it, leading to a communication failure.
      
      This happens because even though the data was queued after it was
      requested to authenticate DATA chunks, it was also queued before we
      could know that remote peer can handle authenticating, so
      sctp_auth_send_cid() returns false.
      
      The fix is whenever we set up an active key, re-check send queue for
      chunks that now should be authenticated. As a result, such packet will
      now contain COOKIE_ECHO + AUTH + DATA chunks, in that order.
      Reported-by: default avatarLiu Wei <weliu@redhat.com>
      Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Acked-by: default avatarVlad Yasevich <vyasevich@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ae36806a
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · b85dfd30
      Linus Torvalds authored
      Pull block layer fixes from Jens Axboe:
       "Remember about a week ago when I sent the last pull request for 4.1?
        Well, I lied.  Now, I don't want to shift the blame, but Dan, Ming,
        and Richard made a liar out of me.
      
        Here are three small patches that should go into 4.1.  More
        specifically, this pull request contains:
      
         - A Kconfig dependency for the pmem block driver, so it can't be
           selected if HAS_IOMEM isn't availble.  From Richard Weinberger.
      
         - A fix for genhd, making the ext_devt_lock softirq safe.  This makes
           lockdep happier, since we also end up grabbing this lock on release
           off the softirq path.  From Dan Williams.
      
         - A blk-mq software queue release fix from Ming Lei.
      
        Last two are headed to stable, first fixes an issue introduced in this
        cycle"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        block: pmem: Add dependency on HAS_IOMEM
        block: fix ext_dev_lock lockdep report
        blk-mq: free hctx->ctxs in queue's release handler
      b85dfd30
    • Linus Torvalds's avatar
      Merge tag 'md/4.1-rc7-fixes' of git://neil.brown.name/md · 7b565d9d
      Linus Torvalds authored
      Pull three more md fixes from Neil Brown:
       "Hasn't been a good cycle for md has it :-(
      
        The main issue fixed here is a rare race which can result in two
        reshape threads running at once, which doesn't end well.
      
        Also a minor issue with a write to a sysfs file returning the wrong
        value.  Backports to 4.0-stable are indicated"
      
      * tag 'md/4.1-rc7-fixes' of git://neil.brown.name/md:
        md: make sure MD_RECOVERY_DONE is clear before starting recovery/resync
        md: Close race when setting 'action' to 'idle'.
        md: don't return 0 from array_state_store
      7b565d9d
    • Linus Torvalds's avatar
      Merge git://git.infradead.org/intel-iommu · c39f3bc6
      Linus Torvalds authored
      Pull VT-d hardware workarounds from David Woodhouse:
       "This contains a workaround for hardware issues which I *thought* were
        never going to be seen on production hardware.  I'm glad I checked
        that before the 4.1 release...
      
        Firstly, PASID support is so broken on existing chips that we're just
        going to declare the old capability bit 28 as 'reserved' and change
        the VT-d spec to move PASID support to another bit.  So any existing
        hardware doesn't support SVM; it only sets that (now) meaningless bit
        28.
      
        That patch *wasn't* imperative for 4.1 because we don't have PASID
        support yet.  But *even* the extended context tables are broken — if
        you just enable the wider tables and use none of the new bits in them,
        which is precisely what 4.1 does, you find that translations don't
        work.  It's this problem which I thought was caught in time to be
        fixed before production, but wasn't.
      
        To avoid triggering this issue, we now *only* enable the extended
        context tables on hardware which also advertises "we have PASID
        support and we actually tested it this time" with the new PASID
        feature bit.
      
        In addition, I've added an 'intel_iommu=ecs_off' command line
        parameter to allow us to disable it manually if we need to"
      
      * git://git.infradead.org/intel-iommu:
        iommu/vt-d: Only enable extended context tables if PASID is supported
        iommu/vt-d: Change PASID support to bit 40 of Extended Capability Register
      c39f3bc6
    • David Woodhouse's avatar
      iommu/vt-d: Only enable extended context tables if PASID is supported · c83b2f20
      David Woodhouse authored
      Although the extended tables are theoretically a completely orthogonal
      feature to PASID and anything else that *uses* the newly-available bits,
      some of the early hardware has problems even when all we do is enable
      them and use only the same bits that were in the old context tables.
      
      For now, there's no motivation to support extended tables unless we're
      going to use PASID support to do SVM. So just don't use them unless
      PASID support is advertised too. Also add a command-line bailout just in
      case later chips also have issues.
      
      The equivalent problem for PASID support has already been fixed with the
      upcoming VT-d spec update and commit bd00c606 ("iommu/vt-d: Change
      PASID support to bit 40 of Extended Capability Register"), because the
      problematic platforms use the old definition of the PASID-capable bit,
      which is now marked as reserved and meaningless.
      
      So with this change, we'll magically start using ECS again only when we
      see the new hardware advertising "hey, we have PASID support and we
      actually tested it this time" on bit 40.
      
      The VT-d hardware architect has promised that we are not going to have
      any reason to support ECS *without* PASID any time soon, and he'll make
      sure he checks with us before changing that.
      
      In the future, if hypothetical new features also use new bits in the
      context tables and can be seen on implementations *without* PASID support,
      we might need to add their feature bits to the ecs_enabled() macro.
      Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
      c83b2f20
    • NeilBrown's avatar
      md: make sure MD_RECOVERY_DONE is clear before starting recovery/resync · ea358cd0
      NeilBrown authored
      MD_RECOVERY_DONE is normally cleared by md_check_recovery after a
      resync etc finished.  However it is possible for raid5_start_reshape
      to race and start a reshape before MD_RECOVERY_DONE is cleared.  This
      can lean to multiple reshapes running at the same time, which isn't
      good.
      
      To make sure it is cleared before starting a reshape, and also clear
      it when reaping a thread, just to be safe.
      Signed-off-by: default avatarNeilBrown  <neilb@suse.de>
      ea358cd0
    • NeilBrown's avatar
      md: Close race when setting 'action' to 'idle'. · 8e8e2518
      NeilBrown authored
      Checking ->sync_thread without holding the mddev_lock()
      isn't really safe, even after flushing the workqueue which
      ensures md_start_sync() has been run.
      
      While this code is waiting for the lock, md_check_recovery could reap
      the thread itself, and then start another thread (e.g. recovery might
      finish, then reshape starts).  When this thread gets the lock
      md_start_sync() hasn't run so it doesn't get reaped, but
      MD_RECOVERY_RUNNING gets cleared.  This allows two threads to start
      which leads to confusion.
      
      So don't both if MD_RECOVERY_RUNNING isn't set, but if it is do
      the flush and the test and the reap all under the mddev_lock to
      avoid any race with md_check_recovery.
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      Fixes: 6791875e ("md: make reconfig_mutex optional for writes to md sysfs files.")
      Cc: stable@vger.kernel.org (v4.0+)
      8e8e2518
    • NeilBrown's avatar
      md: don't return 0 from array_state_store · c008f1d3
      NeilBrown authored
      Returning zero from a 'store' function is bad.
      The return value should be either len length of the string
      or an error.
      
      So use 'len' if 'err' is zero.
      
      Fixes: 6791875e ("md: make reconfig_mutex optional for writes to md sysfs files.")
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      Cc: stable@vger.kernel (v4.0+)
      c008f1d3
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · df5f4158
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "i915 and radeon fixes:
      
        i915:
            fix for connector oops regression
            DDC probing fix
      
        radeon:
            two radeon reverts, along with a freeze workaround and a fix"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/radeon: Make sure radeon_vm_bo_set_addr always unreserves the BO
        Revert "drm/radeon: adjust pll when audio is not enabled"
        Revert "drm/radeon: don't share plls if monitors differ in audio support"
        drm/radeon: fix freeze for laptop with Turks/Thames GPU.
        drm/i915: Fix DDC probe for passive adapters
        drm/i915: Properly initialize SDVO analog connectors
      df5f4158
    • Shaohua Li's avatar
      net: don't wait for order-3 page allocation · fb05e7a8
      Shaohua Li authored
      We saw excessive direct memory compaction triggered by skb_page_frag_refill.
      This causes performance issues and add latency. Commit 5640f768
      introduces the order-3 allocation. According to the changelog, the order-3
      allocation isn't a must-have but to improve performance. But direct memory
      compaction has high overhead. The benefit of order-3 allocation can't
      compensate the overhead of direct memory compaction.
      
      This patch makes the order-3 page allocation atomic. If there is no memory
      pressure and memory isn't fragmented, the alloction will still success, so we
      don't sacrifice the order-3 benefit here. If the atomic allocation fails,
      direct memory compaction will not be triggered, skb_page_frag_refill will
      fallback to order-0 immediately, hence the direct memory compaction overhead is
      avoided. In the allocation failure case, kswapd is waken up and doing
      compaction, so chances are allocation could success next time.
      
      alloc_skb_with_frags is the same.
      
      The mellanox driver does similar thing, if this is accepted, we must fix
      the driver too.
      
      V3: fix the same issue in alloc_skb_with_frags as pointed out by Eric
      V2: make the changelog clearer
      
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Chris Mason <clm@fb.com>
      Cc: Debabrata Banerjee <dbavatar@gmail.com>
      Signed-off-by: default avatarShaohua Li <shli@fb.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fb05e7a8
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2015-06-11' of git://anongit.freedesktop.org/drm-intel into drm-fixes · 6e2eb00f
      Dave Airlie authored
      Fix for the regression Linus called out, and another for probing
      dongles.
      
      * tag 'drm-intel-fixes-2015-06-11' of git://anongit.freedesktop.org/drm-intel:
        drm/i915: Fix DDC probe for passive adapters
        drm/i915: Properly initialize SDVO analog connectors
      6e2eb00f
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.1' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 950c3707
      Dave Airlie authored
      Two regression reverts, and two fixes, one for a dpm boot freeze.
      
      * 'drm-fixes-4.1' of git://people.freedesktop.org/~agd5f/linux:
        drm/radeon: Make sure radeon_vm_bo_set_addr always unreserves the BO
        Revert "drm/radeon: adjust pll when audio is not enabled"
        Revert "drm/radeon: don't share plls if monitors differ in audio support"
        drm/radeon: fix freeze for laptop with Turks/Thames GPU.
      950c3707
  9. 11 Jun, 2015 7 commits
    • Robert Shearman's avatar
      mpls: handle device renames for per-device sysctls · 0fae3bf0
      Robert Shearman authored
      If a device is renamed and the original name is subsequently reused
      for a new device, the following warning is generated:
      
      sysctl duplicate entry: /net/mpls/conf/veth0//input
      CPU: 3 PID: 1379 Comm: ip Not tainted 4.1.0-rc4+ #20
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
       0000000000000000 0000000000000000 ffffffff81566aaf 0000000000000000
       ffffffff81236279 ffff88002f7d7f00 0000000000000000 ffff88000db336d8
       ffff88000db33698 0000000000000005 ffff88002e046000 ffff8800168c9280
      Call Trace:
       [<ffffffff81566aaf>] ? dump_stack+0x40/0x50
       [<ffffffff81236279>] ? __register_sysctl_table+0x289/0x5a0
       [<ffffffffa051a24f>] ? mpls_dev_notify+0x1ff/0x300 [mpls_router]
       [<ffffffff8108db7f>] ? notifier_call_chain+0x4f/0x70
       [<ffffffff81470e72>] ? register_netdevice+0x2b2/0x480
       [<ffffffffa0524748>] ? veth_newlink+0x178/0x2d3 [veth]
       [<ffffffff8147f84c>] ? rtnl_newlink+0x73c/0x8e0
       [<ffffffff8147f27a>] ? rtnl_newlink+0x16a/0x8e0
       [<ffffffff81459ff2>] ? __kmalloc_reserve.isra.30+0x32/0x90
       [<ffffffff8147ccfd>] ? rtnetlink_rcv_msg+0x8d/0x250
       [<ffffffff8145b027>] ? __alloc_skb+0x47/0x1f0
       [<ffffffff8149badb>] ? __netlink_lookup+0xab/0xe0
       [<ffffffff8147cc70>] ? rtnetlink_rcv+0x30/0x30
       [<ffffffff8149e7a0>] ? netlink_rcv_skb+0xb0/0xd0
       [<ffffffff8147cc64>] ? rtnetlink_rcv+0x24/0x30
       [<ffffffff8149df17>] ? netlink_unicast+0x107/0x1a0
       [<ffffffff8149e4be>] ? netlink_sendmsg+0x50e/0x630
       [<ffffffff8145209c>] ? sock_sendmsg+0x3c/0x50
       [<ffffffff81452beb>] ? ___sys_sendmsg+0x27b/0x290
       [<ffffffff811bd258>] ? mem_cgroup_try_charge+0x88/0x110
       [<ffffffff811bd5b6>] ? mem_cgroup_commit_charge+0x56/0xa0
       [<ffffffff811d7700>] ? do_filp_open+0x30/0xa0
       [<ffffffff8145336e>] ? __sys_sendmsg+0x3e/0x80
       [<ffffffff8156c3f2>] ? system_call_fastpath+0x16/0x75
      
      Fix this by unregistering the previous sysctl table (registered for
      the path containing the original device name) and re-registering the
      table for the path containing the new device name.
      
      Fixes: 37bde799 ("mpls: Per-device enabling of packet input")
      Reported-by: default avatarScott Feldman <sfeldma@gmail.com>
      Signed-off-by: default avatarRobert Shearman <rshearma@brocade.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0fae3bf0
    • Richard Cochran's avatar
      net: igb: fix the start time for periodic output signals · 58c98be1
      Richard Cochran authored
      When programming the start of a periodic output, the code wrongly places
      the seconds value into the "low" register and the nanoseconds into the
      "high" register.  Even though this is backwards, it slipped through my
      testing, because the re-arming code in the interrupt service routine is
      correct, and the signal does appear starting with the second edge.
      
      This patch fixes the issue by programming the registers correctly.
      Signed-off-by: default avatarRichard Cochran <richardcochran@gmail.com>
      Reviewed-by: default avatarJacob Keller <jacob.e.keller@intel.com>
      Acked-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      58c98be1
    • Richard Weinberger's avatar
      block: pmem: Add dependency on HAS_IOMEM · b6f2098f
      Richard Weinberger authored
      Not all architectures have io memory.
      
      Fixes:
      drivers/block/pmem.c: In function ‘pmem_alloc’:
      drivers/block/pmem.c:146:2: error: implicit declaration of function ‘ioremap_nocache’ [-Werror=implicit-function-declaration]
        pmem->virt_addr = ioremap_nocache(pmem->phys_addr, pmem->size);
        ^
      drivers/block/pmem.c:146:18: warning: assignment makes pointer from integer without a cast [enabled by default]
        pmem->virt_addr = ioremap_nocache(pmem->phys_addr, pmem->size);
                        ^
      drivers/block/pmem.c:182:2: error: implicit declaration of function ‘iounmap’ [-Werror=implicit-function-declaration]
        iounmap(pmem->virt_addr);
        ^
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      Reviewed-by: default avatarRoss Zwisler <ross.zwisler@linux.intel.com>
      Signed-off-by: default avatarJens Axboe <axboe@fb.com>
      b6f2098f
    • Linus Torvalds's avatar
      Merge tag 'trace-rb-bm-fix-4.1-rc7' of... · cff100f5
      Linus Torvalds authored
      Merge tag 'trace-rb-bm-fix-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
      
      Pull ring buffer benchmark buglet fix from Steven Rostedt:
       "Wang Long fixed a minor bug in the module parameter for the ring
        buffer benchmark, where the produce_fifo was being ignored and the
        producer thread's priority was being set with the consumer_fifo
        parameter"
      
      * tag 'trace-rb-bm-fix-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        ring-buffer-benchmark: Fix the wrong sched_priority of producer
      cff100f5
    • Dan Williams's avatar
      block: fix ext_dev_lock lockdep report · 4d66e5e9
      Dan Williams authored
       =================================
       [ INFO: inconsistent lock state ]
       4.1.0-rc7+ #217 Tainted: G           O
       ---------------------------------
       inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
       swapper/6/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
        (ext_devt_lock){+.?...}, at: [<ffffffff8143a60c>] blk_free_devt+0x3c/0x70
       {SOFTIRQ-ON-W} state was registered at:
         [<ffffffff810bf6b1>] __lock_acquire+0x461/0x1e70
         [<ffffffff810c1947>] lock_acquire+0xb7/0x290
         [<ffffffff818ac3a8>] _raw_spin_lock+0x38/0x50
         [<ffffffff8143a07d>] blk_alloc_devt+0x6d/0xd0  <-- take the lock in process context
      [..]
        [<ffffffff810bf64e>] __lock_acquire+0x3fe/0x1e70
        [<ffffffff810c00ad>] ? __lock_acquire+0xe5d/0x1e70
        [<ffffffff810c1947>] lock_acquire+0xb7/0x290
        [<ffffffff8143a60c>] ? blk_free_devt+0x3c/0x70
        [<ffffffff818ac3a8>] _raw_spin_lock+0x38/0x50
        [<ffffffff8143a60c>] ? blk_free_devt+0x3c/0x70
        [<ffffffff8143a60c>] blk_free_devt+0x3c/0x70    <-- take the lock in softirq
        [<ffffffff8143bfec>] part_release+0x1c/0x50
        [<ffffffff8158edf6>] device_release+0x36/0xb0
        [<ffffffff8145ac2b>] kobject_cleanup+0x7b/0x1a0
        [<ffffffff8145aad0>] kobject_put+0x30/0x70
        [<ffffffff8158f147>] put_device+0x17/0x20
        [<ffffffff8143c29c>] delete_partition_rcu_cb+0x16c/0x180
        [<ffffffff8143c130>] ? read_dev_sector+0xa0/0xa0
        [<ffffffff810e0e0f>] rcu_process_callbacks+0x2ff/0xa90
        [<ffffffff810e0dcf>] ? rcu_process_callbacks+0x2bf/0xa90
        [<ffffffff81067e2e>] __do_softirq+0xde/0x600
      
      Neil sees this in his tests and it also triggers on pmem driver unbind
      for the libnvdimm tests.  This fix is on top of an initial fix by Keith
      for incorrect usage of mutex_lock() in this path: 2da78092 "block:
      Fix dev_t minor allocation lifetime".  Both this and 2da78092 are
      candidates for -stable.
      
      Fixes: 2da78092 ("block: Fix dev_t minor allocation lifetime")
      Cc: <stable@vger.kernel.org>
      Cc: Keith Busch <keith.busch@intel.com>
      Reported-by: default avatarNeilBrown <neilb@suse.de>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      Signed-off-by: default avatarJens Axboe <axboe@fb.com>
      4d66e5e9
    • Michel Dänzer's avatar
      drm/radeon: Make sure radeon_vm_bo_set_addr always unreserves the BO · ee18e599
      Michel Dänzer authored
      Some error paths didn't unreserve the BO. This resulted in a deadlock
      down the road on the next attempt to reserve the (still reserved) BO.
      
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=90873
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarMichel Dänzer <michel.daenzer@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      ee18e599
    • Alex Deucher's avatar
      Revert "drm/radeon: adjust pll when audio is not enabled" · ebb9bf18
      Alex Deucher authored
      This reverts commit 7fe04d6f.
      
      Fixes some systems at the expense of others.  Need to properly
      fix the pll divider selection.
      
      bug:
      https://bugzilla.kernel.org/show_bug.cgi?id=99651
      
      Cc: stable@vger.kernel.org
      ebb9bf18