1. 27 Mar, 2013 7 commits
  2. 26 Mar, 2013 16 commits
    • Al Viro's avatar
      Nest rename_lock inside vfsmount_lock · 7ea600b5
      Al Viro authored
      ... lest we get livelocks between path_is_under() and d_path() and friends.
      
      The thing is, wrt fairness lglocks are more similar to rwsems than to rwlocks;
      it is possible to have thread B spin on attempt to take lock shared while thread
      A is already holding it shared, if B is on lower-numbered CPU than A and there's
      a thread C spinning on attempt to take the same lock exclusive.
      
      As the result, we need consistent ordering between vfsmount_lock (lglock) and
      rename_lock (seq_lock), even though everything that takes both is going to take
      vfsmount_lock only shared.
      Spotted-by: default avatarBrad Spengler <spender@grsecurity.net>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      7ea600b5
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · b175293c
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Always increment IPV4 ID field in encapsulated GSO packets, even
          when DF is set.  Regression fix from Pravin B Shelar.
      
       2) Fix per-net subsystem initialization in netfilter conntrack,
          otherwise we may access dynamically allocated memory before it is
          actually allocated.  From Gao Feng.
      
       3) Fix DMA buffer lengths in iwl3945 driver, from Stanislaw Gruszka.
      
       4) Fix race between submission of sync vs async commands in mwifiex
          driver, from Amitkumar Karwar.
      
       5) Add missing cancel of command timer in mwifiex driver, from Bing
          Zhao.
      
       6) Missing SKB free in rtlwifi USB driver, from Jussi Kivilinna.
      
       7) Thermal layer tries to use a genetlink multicast string that is
          longer than the 16 character limit.  Fix it and add a BUG check to
          prevent this kind of thing from happening in the future.
      
       From Masatake YAMATO.
      
       8) Fix many bugs in the handling of the teardown of L2TP connections,
          UDP encapsulation instances, and sockets.  From Tom Parkin.
      
       9) Missing socket release in IRDA, from Kees Cook.
      
      10) Fix fec driver modular build, from Fabio Estevam.
      
      11) Erroneous use of kfree() instead of free_netdev() in lantiq_etop,
          from Wei Yongjun.
      
      12) Fix bugs in handling of queue numbers and steering rules in mlx4
          driver, from Moshe Lazer, Hadar Hen Zion, and Or Gerlitz.
      
      13) Some FOO_DIAG_MAX constants were defined off by one, fix from Andrey
          Vagin.
      
      14) TCP segmentation deferral is unintentionally done too strongly,
          breaking ACK clocking.  Fix from Eric Dumazet.
      
      15) net_enable_timestamp() can legitimately be invoked from software
          interrupts, and in a way that is safe, so remove the WARN_ON().
          Also from Eric Dumazet.
      
      16) Fix use after free in VLANs, from Cong Wang.
      
      17) Fix TCP slow start retransmit storms after SACK reneging, from
          Yuchung Cheng.
      
      18) Unix socket release should mark a socket dead before NULL'ing out
          sock->sk, otherwise we can race.  Fix from Paul Moore.
      
      19) IPV6 addrconf code can try to free static memory, from Hong Zhiguo.
      
      20) Fix register mis-programming, NULL pointer derefs, and wrong PHC
          clock frequency in IGB driver.  From Lior LevyAlex Williamson, Jiri
          Benc, and Jeff Kirsher.
      
      21) skb->ip_summed logic in pch_gbe driver is reversed, breaking packet
          forwarding.  Fix from Veaceslav Falico.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (65 commits)
        ipv4: Fix ip-header identification for gso packets.
        bonding: remove already created master sysfs link on failure
        af_unix: dont send SCM_CREDENTIAL when dest socket is NULL
        pch_gbe: fix ip_summed checksum reporting on rx
        igb: fix PHC stopping on max freq
        igb: make sensor info static
        igb: SR-IOV init reordering
        igb: Fix null pointer dereference
        igb: fix i350 anti spoofing config
        ixgbevf: don't release the soft entries
        ipv6: fix bad free of addrconf_init_net
        unix: fix a race condition in unix_release()
        tcp: undo spurious timeout after SACK reneging
        bnx2x: fix assignment of signed expression to unsigned variable
        bridge: fix crash when set mac address of br interface
        8021q: fix a potential use-after-free
        net: remove a WARN_ON() in net_enable_timestamp()
        tcp: preserve ACK clocking in TSO
        net: fix *_DIAG_MAX constants
        net/mlx4_core: Disallow releasing VF QPs which have steering rules
        ...
      b175293c
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-3.9-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · 5d538483
      Linus Torvalds authored
      Pull NFS client bugfixes from Trond Myklebust:
       - Fix an NFSv4 idmapper regression
       - Fix an Oops in the pNFS blocks client
       - Fix up various issues with pNFS layoutcommit
       - Ensure correct read ordering of variables in
         rpc_wake_up_task_queue_locked
      
      * tag 'nfs-for-3.9-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        SUNRPC: Add barriers to ensure read ordering in rpc_wake_up_task_queue_locked
        NFSv4.1: Add a helper pnfs_commit_and_return_layout
        NFSv4.1: Always clear the NFS_INO_LAYOUTCOMMIT in layoutreturn
        NFSv4.1: Fix a race in pNFS layoutcommit
        pnfs-block: removing DM device maybe cause oops when call dev_remove
        NFSv4: Fix the string length returned by the idmapper
      5d538483
    • Pravin B Shelar's avatar
      ipv4: Fix ip-header identification for gso packets. · 330305cc
      Pravin B Shelar authored
      ip-header id needs to be incremented even if IP_DF flag is set.
      This behaviour was changed in commit 490ab081
      (IP_GRE: Fix IP-Identification).
      
      Following patch fixes it so that identification is always
      incremented.
      Reported-by: default avatarCong Wang <amwang@redhat.com>
      Signed-off-by: default avatarPravin B Shelar <pshelar@nicira.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      330305cc
    • Veaceslav Falico's avatar
      bonding: remove already created master sysfs link on failure · 9fe16b78
      Veaceslav Falico authored
      If slave sysfs symlink failes to be created - we end up without removing
      the master sysfs symlink. Remove it in case of failure.
      Signed-off-by: default avatarVeaceslav Falico <vfalico@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9fe16b78
    • dingtianhong's avatar
      af_unix: dont send SCM_CREDENTIAL when dest socket is NULL · 14134f65
      dingtianhong authored
      SCM_SCREDENTIALS should apply to write() syscalls only either source or destination
      socket asserted SOCK_PASSCRED. The original implememtation in maybe_add_creds is wrong,
      and breaks several LSB testcases ( i.e. /tset/LSB.os/netowkr/recvfrom/T.recvfrom).
      Origionally-authored-by: default avatarKarel Srot <ksrot@redhat.com>
      Signed-off-by: default avatarDing Tianhong <dingtianhong@huawei.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      14134f65
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net · 465c0a16
      David S. Miller authored
      Jeff Kirsher says:
      
      ====================
      This series contains updates to ixgbevf and igb.
      
      The ixgbevf calls to pci_disable_msix() and to free the msix_entries
      memory should not occur if device open fails.  Instead they should be
      called during device driver removal to balance with the call to
      pci_enable_msix() and the call to allocate msix_entries memory
      during the device probe and driver load.
      
      The remaining 4 of 5 igb patches are simple 1-3 line patches to fix
      several issues such as possible null pointer dereference, PHC stopping
      on max frequency, make sensor info static and SR-IOV initialization
      reordering.
      
      The remaining igb patch to fix anti-spoofing config fixes a problem
      in i350 where anti spoofing configuration was written into a wrong
      register.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      465c0a16
    • Veaceslav Falico's avatar
      pch_gbe: fix ip_summed checksum reporting on rx · 76a0e681
      Veaceslav Falico authored
      skb->ip_summed should be CHECKSUM_UNNECESSARY when the driver reports that
      checksums were correct and CHECKSUM_NONE in any other case. They're
      currently placed vice versa, which breaks the forwarding scenario. Fix it
      by placing them as described above.
      Signed-off-by: default avatarVeaceslav Falico <vfalico@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      76a0e681
    • Wei Yongjun's avatar
      x86, io_apic: remove duplicated include from irq_remapping.c · 4fdc7824
      Wei Yongjun authored
      Remove duplicated include.
      Signed-off-by: default avatarWei Yongjun <yongjun_wei@trendmicro.com.cn>
      Signed-off-by: default avatarJoerg Roedel <joro@8bytes.org>
      4fdc7824
    • Jiri Benc's avatar
      igb: fix PHC stopping on max freq · 75517d92
      Jiri Benc authored
      For 82576 MAC type, max_adj is reported as 1000000000 ppb. However, if
      this value is passed to igb_ptp_adjfreq_82576, incvalue overflows out of
      INCVALUE_82576_MASK, resulting in setting of zero TIMINCA.incvalue, stopping
      the PHC (instead of going at twice the nominal speed).
      
      Fix the advertised max_adj value to the largest value hardware can handle.
      As there is no min_adj value available (-max_adj is used instead), this will
      also prevent stopping the clock intentionally. It's probably not a big deal,
      other igb MAC types don't support stopping the clock, either.
      Signed-off-by: default avatarJiri Benc <jbenc@redhat.com>
      Acked-by: default avatarMatthew Vick <matthew.vick@intel.com>
      Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      75517d92
    • Stephen Hemminger's avatar
      igb: make sensor info static · 05ec29e8
      Stephen Hemminger authored
      Trivial sparse warning.
      Signed-off-by: default avatarStephen Hemminger <stephen@networkplumber.org>
      Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      05ec29e8
    • Alex Williamson's avatar
      igb: SR-IOV init reordering · d5e51a10
      Alex Williamson authored
      igb is ineffective at setting a lower total VFs because:
      
      int pci_sriov_set_totalvfs(struct pci_dev *dev, u16 numvfs)
      {
              ...
              /* Shouldn't change if VFs already enabled */
              if (dev->sriov->ctrl & PCI_SRIOV_CTRL_VFE)
                      return -EBUSY;
      
      Swap init ordering.
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      Acked-by: default avatarGreg Rose <gregory.v.rose@intel.com>
      Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      d5e51a10
    • Alex Williamson's avatar
      igb: Fix null pointer dereference · d0f63acc
      Alex Williamson authored
      The max_vfs= option has always been self limiting to the number of VFs
      supported by the device.  fa44f2f1 added SR-IOV configuration via
      sysfs, but in the process broke this self correction factor.  The
      failing path is:
      
      igb_probe
        igb_sw_init
          if (max_vfs > 7) {
              adapter->vfs_allocated_count = 7;
          ...
          igb_probe_vfs
          igb_enable_sriov(, max_vfs)
            if (num_vfs > 7) {
              err = -EPERM;
              ...
      
      This leaves vfs_allocated_count = 7 and vf_data = NULL, so we bomb out
      when igb_probe finally calls igb_reset.  It seems like a really bad
      idea, and somewhat pointless, to set vfs_allocated_count separate from
      vf_data, but limiting max_vfs is enough to avoid the null pointer.
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      Acked-by: default avatarGreg Rose <gregory.v.rose@intel.com>
      Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      d0f63acc
    • Lior Levy's avatar
      igb: fix i350 anti spoofing config · 22c12752
      Lior Levy authored
      Fix a problem in i350 where anti spoofing configuration was written into a
      wrong register.
      Signed-off-by: default avatarLior Levy <lior.levy@intel.com>
      Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      22c12752
    • xunleer's avatar
      ixgbevf: don't release the soft entries · a1f6c6b1
      xunleer authored
      When the ixgbevf driver is opened the request to allocate MSIX irq
      vectors may fail.  In that case the driver will call ixgbevf_down()
      which will call ixgbevf_irq_disable() to clear the HW interrupt
      registers and calls synchronize_irq() using the msix_entries pointer in
      the adapter structure.  However, when the function to request the MSIX
      irq vectors failed it had already freed the msix_entries which causes
      an OOPs from using the NULL pointer in synchronize_irq().
      
      The calls to pci_disable_msix() and to free the msix_entries memory
      should not occur if device open fails.  Instead they should be called
      during device driver removal to balance with the call to
      pci_enable_msix() and the call to allocate msix_entries memory
      during the device probe and driver load.
      Signed-off-by: default avatarLi Xun <xunleer.li@huawei.com>
      Signed-off-by: default avatarGreg Rose <gregory.v.rose@intel.com>
      Tested-by: default avatarSibai Li <sibai.li@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      a1f6c6b1
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · a12183c6
      Linus Torvalds authored
      Pull timer fix from Thomas Gleixner:
       "A single bugfix which prevents that a non functional timer device is
        selected to provide the fallback device, which is supposed to serve
        timer interrupts on behalf of non functional devices ..."
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        clockevents: Don't allow dummy broadcast timers
      a12183c6
  3. 25 Mar, 2013 9 commits
    • Hong Zhiguo's avatar
      ipv6: fix bad free of addrconf_init_net · a79ca223
      Hong Zhiguo authored
      Signed-off-by: default avatarHong Zhiguo <honkiko@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a79ca223
    • Paul Moore's avatar
      unix: fix a race condition in unix_release() · ded34e0f
      Paul Moore authored
      As reported by Jan, and others over the past few years, there is a
      race condition caused by unix_release setting the sock->sk pointer
      to NULL before properly marking the socket as dead/orphaned.  This
      can cause a problem with the LSM hook security_unix_may_send() if
      there is another socket attempting to write to this partially
      released socket in between when sock->sk is set to NULL and it is
      marked as dead/orphaned.  This patch fixes this by only setting
      sock->sk to NULL after the socket has been marked as dead; I also
      take the opportunity to make unix_release_sock() a void function
      as it only ever returned 0/success.
      
      Dave, I think this one should go on the -stable pile.
      
      Special thanks to Jan for coming up with a reproducer for this
      problem.
      Reported-by: default avatarJan Stancek <jan.stancek@gmail.com>
      Signed-off-by: default avatarPaul Moore <pmoore@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ded34e0f
    • Linus Torvalds's avatar
      Merge tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband · 53b68092
      Linus Torvalds authored
      Pull infiniband/rdma fixes from Roland Dreier:
       "Small batch of InfiniBand/RDMA fixes for 3.9:
      
         - Fix for TX lockup in IPoIB
         - QLogic -> Intel update for qib driver
         - Small static checker fix for qib
         - Fix error path return value in cxgb4"
      
      * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
        IB/qib: change QLogic to Intel
        IB/ipath: Silence a static checker warning
        IPoIB: Fix send lockup due to missed TX completion
        RDMA/cxgb4: Fix error return code in create_qp()
      53b68092
    • Linus Torvalds's avatar
      Merge tag 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · fb9bb182
      Linus Torvalds authored
      Pull ARM SoC bug fixes from Arnd Bergmann:
       "Four patches for arm-soc this week:
      
         - Kevin Hilman is no longer reachable under his previous email
           address.  He submitted the patch earlier, but nobody felt
           responsible to pick it up.
      
         - One Tegra fix for an incorect register address in device tree.
      
         - IMX multiplatform support exposes a configuration option that leads
           to unbootable kernels on all other machines and that needs to
           depend on that platform.
      
         - A nontrivial bug fix for the setup of the mxs video output."
      
      * tag 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        MAINTAINERS: update email address for Kevin Hilman
        ARM: tegra: fix register address of slink controller
        ARM: imx: add dependency check for DEBUG_IMX_UART_PORT
        ARM: video: mxs: Fix mxsfb misconfiguring VDCTRL0
      fb9bb182
    • Linus Torvalds's avatar
      Merge branch 'for-3.9' of git://linux-nfs.org/~bfields/linux · 844fdd9a
      Linus Torvalds authored
      Pull nfsd bugfixes from J Bruce Fields:
       "Fixes for a couple mistakes in the new DRC code.  And thanks to Kent
        Overstreet for noticing we've been sync'ing the wrong range on stable
        writes since 3.8."
      
      * 'for-3.9' of git://linux-nfs.org/~bfields/linux:
        nfsd: fix bad offset use
        nfsd: fix startup order in nfsd_reply_cache_init
        nfsd: only unhash DRC entries that are in the hashtable
      844fdd9a
    • Trond Myklebust's avatar
      SUNRPC: Add barriers to ensure read ordering in rpc_wake_up_task_queue_locked · 1166fde6
      Trond Myklebust authored
      We need to be careful when testing task->tk_waitqueue in
      rpc_wake_up_task_queue_locked, because it can be changed while we
      are holding the queue->lock.
      By adding appropriate memory barriers, we can ensure that it is safe to
      test task->tk_waitqueue for equality if the RPC_TASK_QUEUED bit is set.
      Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
      Cc: stable@vger.kernel.org
      1166fde6
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · c4052ba9
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Exynos and Intel fixes.
      
        The intel fixes are fairly straightforward, mostly reverts due to bugs
        found.  The exynos one is a big larger since they found some issues
        with the G2D engine and iommu interaction, and needed to verify the
        operations a lot better than they were previously, otherwise a user
        app can just crash the kernel with an iommu fault."
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        Revert "drm/i915: write backlight harder"
        drm/i915: don't disable the power well yet
        Revert "drm/i915: set TRANSCODER_EDP even earlier"
        drm/exynos: Check g2d cmd list for g2d restrictions
        drm/exynos: Add a new function to get gem buffer size
        drm/exynos: Deal with g2d buffer info more efficiently
        drm/exynos: Clean up some G2D codes for readability
        drm/exynos: Fix G2D core malfunctioning issue
        drm/exynos: clear node object type at gem unmap
        drm/exynos: Fix error routine to getting dma addr.
        drm/exynos: Replaced kzalloc & memcpy with kmemdup
        drm/exynos: fimd: calculate the correct address offset
        drm/exynos: Make mixer_check_timing static
        drm/exynos: modify the compatible string for exynos fimd
      c4052ba9
    • Dave Airlie's avatar
      Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel into HEAD · 7ac8833f
      Dave Airlie authored
      Daniel writes:
      "Just three revert/disable by default patches, one of them cc: stable
      (since the offending commit was cc: stable, too)."
      
      * 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel:
        Revert "drm/i915: write backlight harder"
        drm/i915: don't disable the power well yet
        Revert "drm/i915: set TRANSCODER_EDP even earlier"
      7ac8833f
    • Dave Airlie's avatar
      Merge branch 'exynos-drm-fixes' of... · ac165b00
      Dave Airlie authored
      Merge branch 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into HEAD
      
      Inki writes:
      Includes bug fixes and code cleanups.
      And it considers some restrictions to G2D hardware.
      With this, the malfunction and page fault issues to g2d driver
      would be fixed.
      
      * 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
        drm/exynos: Check g2d cmd list for g2d restrictions
        drm/exynos: Add a new function to get gem buffer size
        drm/exynos: Deal with g2d buffer info more efficiently
        drm/exynos: Clean up some G2D codes for readability
        drm/exynos: Fix G2D core malfunctioning issue
        drm/exynos: clear node object type at gem unmap
        drm/exynos: Fix error routine to getting dma addr.
        drm/exynos: Replaced kzalloc & memcpy with kmemdup
        drm/exynos: fimd: calculate the correct address offset
        drm/exynos: Make mixer_check_timing static
        drm/exynos: modify the compatible string for exynos fimd
      ac165b00
  4. 24 Mar, 2013 8 commits
    • Yuchung Cheng's avatar
      tcp: undo spurious timeout after SACK reneging · 7ebe183c
      Yuchung Cheng authored
      On SACK reneging the sender immediately retransmits and forces a
      timeout but disables Eifel (undo). If the (buggy) receiver does not
      drop any packet this can trigger a false slow-start retransmit storm
      driven by the ACKs of the original packets. This can be detected with
      undo and TCP timestamps.
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7ebe183c
    • Kumar Amit Mehta's avatar
      bnx2x: fix assignment of signed expression to unsigned variable · 8fe7f99a
      Kumar Amit Mehta authored
      fix for incorrect assignment of signed expression to unsigned variable.
      Signed-off-by: default avatarKumar Amit Mehta <gmate.amit@gmail.com>
      Acked-by: default avatarDmitry Kravkov <dmitry@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8fe7f99a
    • Hong zhi guo's avatar
      bridge: fix crash when set mac address of br interface · 9b46922e
      Hong zhi guo authored
      When I tried to set mac address of a bridge interface to a mac
      address which already learned on this bridge, I got system hang.
      
      The cause is straight forward: function br_fdb_change_mac_address
      calls fdb_insert with NULL source nbp. Then an fdb lookup is
      performed. If an fdb entry is found and it's local, it's OK. But
      if it's not local, source is dereferenced for printk without NULL
      check.
      Signed-off-by: default avatarHong Zhiguo <honkiko@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9b46922e
    • Cong Wang's avatar
      8021q: fix a potential use-after-free · 4a7df340
      Cong Wang authored
      vlan_vid_del() could possibly free ->vlan_info after a RCU grace
      period, however, we may still refer to the freed memory area
      by 'grp' pointer. Found by code inspection.
      
      This patch moves vlan_vid_del() as behind as possible.
      
      Cc: Patrick McHardy <kaber@trash.net>
      Cc: "David S. Miller" <davem@davemloft.net>
      Signed-off-by: default avatarCong Wang <amwang@redhat.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4a7df340
    • Eric Dumazet's avatar
      net: remove a WARN_ON() in net_enable_timestamp() · 9979a55a
      Eric Dumazet authored
      The WARN_ON(in_interrupt()) in net_enable_timestamp() can get false
      positive, in socket clone path, run from softirq context :
      
      [ 3641.624425] WARNING: at net/core/dev.c:1532 net_enable_timestamp+0x7b/0x80()
      [ 3641.668811] Call Trace:
      [ 3641.671254]  <IRQ>  [<ffffffff80286817>] warn_slowpath_common+0x87/0xc0
      [ 3641.677871]  [<ffffffff8028686a>] warn_slowpath_null+0x1a/0x20
      [ 3641.683683]  [<ffffffff80742f8b>] net_enable_timestamp+0x7b/0x80
      [ 3641.689668]  [<ffffffff80732ce5>] sk_clone_lock+0x425/0x450
      [ 3641.695222]  [<ffffffff8078db36>] inet_csk_clone_lock+0x16/0x170
      [ 3641.701213]  [<ffffffff807ae449>] tcp_create_openreq_child+0x29/0x820
      [ 3641.707663]  [<ffffffff807d62e2>] ? ipt_do_table+0x222/0x670
      [ 3641.713354]  [<ffffffff807aaf5b>] tcp_v4_syn_recv_sock+0xab/0x3d0
      [ 3641.719425]  [<ffffffff807af63a>] tcp_check_req+0x3da/0x530
      [ 3641.724979]  [<ffffffff8078b400>] ? inet_hashinfo_init+0x60/0x80
      [ 3641.730964]  [<ffffffff807ade6f>] ? tcp_v4_rcv+0x79f/0xbe0
      [ 3641.736430]  [<ffffffff807ab9bd>] tcp_v4_do_rcv+0x38d/0x4f0
      [ 3641.741985]  [<ffffffff807ae14a>] tcp_v4_rcv+0xa7a/0xbe0
      
      Its safe at this point because the parent socket owns a reference
      on the netstamp_needed, so we cant have a 0 -> 1 transition, which
      requires to lock a mutex.
      
      Instead of refining the check, lets remove it, as all known callers
      are safe. If it ever changes in the future, static_key_slow_inc()
      will complain anyway.
      Reported-by: default avatarLaurent Chavey <chavey@google.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9979a55a
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-fixes-for-v3.9' of... · 3912a677
      Linus Torvalds authored
      Merge tag 'pinctrl-fixes-for-v3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
      
      Pull pinctrl fixes from Linus Walleij:
       "Here are a few pinctrl fixes for the v3.9 rc series:
         - Usecount bounds checking so we do not go below zero on mux
           usecounts.
         - Loop range checking in GPIO ranges in the DT range parser.
         - Proper print in debugfs for pinconf state.
         - Fix compilation bug in generic pinconf code.
         - Minor bugfixes to abx500 and mvebu drivers."
      
      * tag 'pinctrl-fixes-for-v3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinmux: forbid mux_usecount to be set at UINT_MAX
        pinctrl: mvebu: fix checking for SoC specific controls
        pinctrl: generic: Fix compilation error
        pinctrl: Print the correct information in debugfs pinconf-state file
        pinctrl: abx500: Fix checking if pin use AlternateFunction register
        gpio: fix wrong checking condition for gpio range
      3912a677
    • Linus Torvalds's avatar
      Merge branch 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 33b73e9b
      Linus Torvalds authored
      Pull x86 fixes from Peter Anvin:
       "A collection of minor fixes, more EFI variables paranoia
        (anti-bricking) plus the ability to disable the pstore either as a
        runtime default or completely, due to bricking concerns."
      
      * 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        efivars: Fix check for CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE
        x86, microcode_intel_early: Mark apply_microcode_early() as cpuinit
        efivars: Handle duplicate names from get_next_variable()
        efivars: explicitly calculate length of VariableName
        efivars: Add module parameter to disable use as a pstore backend
        efivars: Allow disabling use as a pstore backend
        x86-32, microcode_intel_early: Fix crash with CONFIG_DEBUG_VIRTUAL
        x86-64: Fix the failure case in copy_user_handle_tail()
      33b73e9b
    • Daniel Vetter's avatar
      Revert "drm/i915: write backlight harder" · b1289371
      Daniel Vetter authored
      This reverts commit cf0a6584.
      
      Turns out that cargo-culting breaks systems. Note that we can't revert
      further, since
      
      commit 770c1231
      Author: Takashi Iwai <tiwai@suse.de>
      Date:   Sat Aug 11 08:56:42 2012 +0200
      
          drm/i915: Fix blank panel at reopening lid
      
      fixed a regression in 3.6-rc kernels for which we've never figured out
      the exact root cause. But some further inspection of the backlight
      code reveals that it's seriously lacking locking. And especially the
      asle backlight update is know to get fired (through some smm magic)
      when writing specific backlight control registers. So the possibility
      of suffering from races is rather real.
      
      Until those races are fixed I don't think it makes sense to try
      further hacks. Which sucks a bit, but sometimes that's how it is :(
      
      References: http://www.mail-archive.com/intel-gfx@lists.freedesktop.org/msg18788.html
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47941Tested-by: default avatarTakashi Iwai <tiwai@suse.de>
      Cc: Jani Nikula <jani.nikula@intel.com>
      Cc: Takashi Iwai <tiwai@suse.de>
      Cc: stable@vger.kernel.org (the reverted commit was cc: stable, too)
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      b1289371