1. 22 May, 2015 28 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 0b6280c6
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Don't leak ipvs->sysctl_tbl, from Tommi Rentala.
      
       2) Fix neighbour table entry leak in rocker driver, from Ying Xue.
      
       3) Do not emit bonding notifications for unregistered interfaces, from
          Nicolas Dichtel.
      
       4) Set ipv6 flow label properly when in TIME_WAIT state, from Florent
          Fourcot.
      
       5) Fix regression in ipv6 multicast filter test, from Henning Rogge.
      
       6) do_replace() in various footables netfilter modules is missing a
          check for 0 counters in the datastructure provided by the user.  Fix
          from Dave Jones, and found with trinity.
      
       7) Fix RCU bug in packet scheduler classifier module unloads, from
          Daniel Borkmann.
      
       8) Avoid deadlock in tcp_get_info() by using u64_sync.  From Eric
          Dumzaet.
      
       9) Input packet processing can race with inetdev_destroy() teardown,
          fix potential OOPS in ip_error() by explicitly testing whether the
          inetdev is still attached.  From Eric W Biederman.
      
      10) MLDv2 parser in bridge multicast code breaks too early while
          parsing.  Fix from Thadeu Lima de Souza Cascardo.
      
      11) Asking for settings on non-zero PHYID doesn't work because we do not
          import the command structure from the user and use the PHYID
          provided there.  Fix from Arun Parameswaran.
      
      12) Fix UDP checksums with IPV6 RAW sockets, from Vlad Yasevich.
      
      13) Missing NF_TABLES depends for TPROXY etc can cause build failures,
          fix from Florian Westphal.
      
      14) Fix netfilter conntrack to handle RFC5961 challenge ACKs properly,
          from Jesper Dangaard Brouer.
      
      15) If netlink autobind retry fails, we have to reset the sockets portid
          back to zero.  From Herbert Xu.
      
      16) VXLAN netns exit code unregisters using wrong device, from John W
          Linville.
      
      17) Add some USB device IDs to ath3k and btusb bluetooth drivers, from
          Dmitry Tunin and Wen-chien Jesse Sung.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits)
        bridge: fix lockdep splat
        net: core: 'ethtool' issue with querying phy settings
        bridge: fix parsing of MLDv2 reports
        ARM: zynq: DT: Use the zynq binding with macb
        net: macb: Disable half duplex gigabit on Zynq
        net: macb: Document zynq gem dt binding
        ipv4: fill in table id when replacing a route
        cdc_ncm: Fix tx_bytes statistics
        ipv4: Avoid crashing in ip_error
        tcp: fix a potential deadlock in tcp_get_info()
        net: sched: fix call_rcu() race on classifier module unloads
        net: phy: Make sure phy_start() always re-enables the phy interrupts
        ipv6: fix ECMP route replacement
        ipv6: do not delete previously existing ECMP routes if add fails
        Revert "netfilter: bridge: query conntrack about skb dnat"
        netfilter: ensure number of counters is >0 in do_replace()
        netfilter: nfnetlink_{log,queue}: Register pernet in first place
        tcp: don't over-send F-RTO probes
        tcp: only undo on partial ACKs in CA_Loss
        net/ipv6/udp: Fix ipv6 multicast socket filter regression
        ...
      0b6280c6
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 1c8df7bd
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Three small fixes that have been picked up the last few weeks.
        Specifically:
      
         - Fix a memory corruption issue in NVMe with malignant user
           constructed request.  From Christoph.
      
         - Kill (now) unused blk_queue_bio(), dm was changed to not need this
           anymore.  From Mike Snitzer.
      
         - Always use blk_schedule_flush_plug() from the io_schedule() path
           when flushing a plug, fixing a !TASK_RUNNING warning with md.  From
           Shaohua"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        sched: always use blk_schedule_flush_plug in io_schedule_out
        nvme: fix kernel memory corruption with short INQUIRY buffers
        block: remove export for blk_queue_bio
      1c8df7bd
    • Linus Torvalds's avatar
      Merge tag 'md/4.1-rc4-fixes' of git://neil.brown.name/md · a30ec4b3
      Linus Torvalds authored
      Pull md bugfixes from Neil Brown:
       "I have a few more raid5 bugfixes pending, but I want them to get a bit
        more review first.  In the meantime:
      
         - one serious RAID0 data corruption - caused by recent bugfix that
           wasn't reviewed properly.
      
         - one raid5 fix in new code (a couple more of those to come).
      
         - one little fix to stop static analysis complaining about silly rcu
           annotation"
      
      * tag 'md/4.1-rc4-fixes' of git://neil.brown.name/md:
        md/bitmap: remove rcu annotation from pointer arithmetic.
        md/raid0: fix restore to sector variable in raid0_make_request
        raid5: fix broken async operation chain
      a30ec4b3
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 1d82b0ba
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
       "Updates for the input subsystem.
      
        The main change is that we tell joydev not to touch "absolute mice",
        such as VMware virtual mouse, as that produced bad result (cursor
        stuck in upper right corner) with games"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: smtpe-ts - wait 50mS until polling for pen-up
        Input: smtpe-ts - use msecs_to_jiffies() instead of HZ
        Input: joydev - don't classify the vmmouse as a joystick
        Input: vmmouse - do not reference non-existing version of X driver
        Input: alps - fix finger jumps on lifting 2 fingers on v7 touchpad
        Input: elantech - fix semi-mt protocol for v3 HW
        Input: sx8654 - fix memory allocation check
      1d82b0ba
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · 2a058f38
      Linus Torvalds authored
      Pull another crypto fix from Herbert Xu:
       "Fix ICV corruption in s390/ghash when the same tfm is used by more
        than one thread"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: s390/ghash - Fix incorrect ghash icv buffer handling.
      2a058f38
    • Eric Dumazet's avatar
      bridge: fix lockdep splat · 93a33a58
      Eric Dumazet authored
      Following lockdep splat was reported :
      
      [   29.382286] ===============================
      [   29.382315] [ INFO: suspicious RCU usage. ]
      [   29.382344] 4.1.0-0.rc0.git11.1.fc23.x86_64 #1 Not tainted
      [   29.382380] -------------------------------
      [   29.382409] net/bridge/br_private.h:626 suspicious
      rcu_dereference_check() usage!
      [   29.382455]
                     other info that might help us debug this:
      
      [   29.382507]
                     rcu_scheduler_active = 1, debug_locks = 0
      [   29.382549] 2 locks held by swapper/0/0:
      [   29.382576]  #0:  (((&p->forward_delay_timer))){+.-...}, at:
      [<ffffffff81139f75>] call_timer_fn+0x5/0x4f0
      [   29.382660]  #1:  (&(&br->lock)->rlock){+.-...}, at:
      [<ffffffffa0450dc1>] br_forward_delay_timer_expired+0x31/0x140
      [bridge]
      [   29.382754]
                     stack backtrace:
      [   29.382787] CPU: 0 PID: 0 Comm: swapper/0 Not tainted
      4.1.0-0.rc0.git11.1.fc23.x86_64 #1
      [   29.382838] Hardware name: LENOVO 422916G/LENOVO, BIOS A1KT53AUS 04/07/2015
      [   29.382882]  0000000000000000 3ebfc20364115825 ffff880666603c48
      ffffffff81892d4b
      [   29.382943]  0000000000000000 ffffffff81e124e0 ffff880666603c78
      ffffffff8110bcd7
      [   29.383004]  ffff8800785c9d00 ffff88065485ac58 ffff880c62002800
      ffff880c5fc88ac0
      [   29.383065] Call Trace:
      [   29.383084]  <IRQ>  [<ffffffff81892d4b>] dump_stack+0x4c/0x65
      [   29.383130]  [<ffffffff8110bcd7>] lockdep_rcu_suspicious+0xe7/0x120
      [   29.383178]  [<ffffffffa04520f9>] br_fill_ifinfo+0x4a9/0x6a0 [bridge]
      [   29.383225]  [<ffffffffa045266b>] br_ifinfo_notify+0x11b/0x4b0 [bridge]
      [   29.383271]  [<ffffffffa0450d90>] ? br_hold_timer_expired+0x70/0x70 [bridge]
      [   29.383320]  [<ffffffffa0450de8>]
      br_forward_delay_timer_expired+0x58/0x140 [bridge]
      [   29.383371]  [<ffffffffa0450d90>] ? br_hold_timer_expired+0x70/0x70 [bridge]
      [   29.383416]  [<ffffffff8113a033>] call_timer_fn+0xc3/0x4f0
      [   29.383454]  [<ffffffff81139f75>] ? call_timer_fn+0x5/0x4f0
      [   29.383493]  [<ffffffff8110a90f>] ? lock_release_holdtime.part.29+0xf/0x200
      [   29.383541]  [<ffffffffa0450d90>] ? br_hold_timer_expired+0x70/0x70 [bridge]
      [   29.383587]  [<ffffffff8113a6a4>] run_timer_softirq+0x244/0x490
      [   29.383629]  [<ffffffff810b68cc>] __do_softirq+0xec/0x670
      [   29.383666]  [<ffffffff810b70d5>] irq_exit+0x145/0x150
      [   29.383703]  [<ffffffff8189f506>] smp_apic_timer_interrupt+0x46/0x60
      [   29.383744]  [<ffffffff8189d523>] apic_timer_interrupt+0x73/0x80
      [   29.383782]  <EOI>  [<ffffffff816f131f>] ? cpuidle_enter_state+0x5f/0x2f0
      [   29.383832]  [<ffffffff816f131b>] ? cpuidle_enter_state+0x5b/0x2f0
      
      Problem here is that br_forward_delay_timer_expired() is a timer
      handler, calling br_ifinfo_notify() which assumes either rcu_read_lock()
      or RTNL are held.
      
      Simplest fix seems to add rcu read lock section.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarJosh Boyer <jwboyer@fedoraproject.org>
      Reported-by: default avatarDominick Grift <dac.override@gmail.com>
      Cc: Vlad Yasevich <vyasevich@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      93a33a58
    • Arun Parameswaran's avatar
      net: core: 'ethtool' issue with querying phy settings · f96dee13
      Arun Parameswaran authored
      When trying to configure the settings for PHY1, using commands
      like 'ethtool -s eth0 phyad 1 speed 100', the 'ethtool' seems to
      modify other settings apart from the speed of the PHY1, in the
      above case.
      
      The ethtool seems to query the settings for PHY0, and use this
      as the base to apply the new settings to the PHY1. This is
      causing the other settings of the PHY 1 to be wrongly
      configured.
      
      The issue is caused by the '_ethtool_get_settings()' API, which
      gets called because of the 'ETHTOOL_GSET' command, is clearing
      the 'cmd' pointer (of type 'struct ethtool_cmd') by calling
      memset. This clears all the parameters (if any) passed for the
      'ETHTOOL_GSET' cmd. So the driver's callback is always invoked
      with 'cmd->phy_address' as '0'.
      
      The '_ethtool_get_settings()' is called from other files in the
      'net/core'. So the fix is applied to the 'ethtool_get_settings()'
      which is only called in the context of the 'ethtool'.
      Signed-off-by: default avatarArun Parameswaran <aparames@broadcom.com>
      Reviewed-by: default avatarRay Jui <rjui@broadcom.com>
      Reviewed-by: default avatarScott Branden <sbranden@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f96dee13
    • Thadeu Lima de Souza Cascardo's avatar
      bridge: fix parsing of MLDv2 reports · 47cc84ce
      Thadeu Lima de Souza Cascardo authored
      When more than a multicast address is present in a MLDv2 report, all but
      the first address is ignored, because the code breaks out of the loop if
      there has not been an error adding that address.
      
      This has caused failures when two guests connected through the bridge
      tried to communicate using IPv6. Neighbor discoveries would not be
      transmitted to the other guest when both used a link-local address and a
      static address.
      
      This only happens when there is a MLDv2 querier in the network.
      
      The fix will only break out of the loop when there is a failure adding a
      multicast address.
      
      The mdb before the patch:
      
      dev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp
      dev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp
      dev ovirtmgmt port bond0.86 grp ff02::2 temp
      
      After the patch:
      
      dev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp
      dev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp
      dev ovirtmgmt port bond0.86 grp ff02::fb temp
      dev ovirtmgmt port bond0.86 grp ff02::2 temp
      dev ovirtmgmt port bond0.86 grp ff02::d temp
      dev ovirtmgmt port vnet0 grp ff02::1:ff00:76 temp
      dev ovirtmgmt port bond0.86 grp ff02::16 temp
      dev ovirtmgmt port vnet1 grp ff02::1:ff00:77 temp
      dev ovirtmgmt port bond0.86 grp ff02::1:ff00:def temp
      dev ovirtmgmt port bond0.86 grp ff02::1:ffa1:40bf temp
      
      Fixes: 08b202b6 ("bridge br_multicast: IPv6 MLD support.")
      Reported-by: default avatarRik Theys <Rik.Theys@esat.kuleuven.be>
      Signed-off-by: default avatarThadeu Lima de Souza Cascardo <cascardo@redhat.com>
      Tested-by: default avatarRik Theys <Rik.Theys@esat.kuleuven.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      47cc84ce
    • Nathan Sullivan's avatar
      ARM: zynq: DT: Use the zynq binding with macb · 9eeb5161
      Nathan Sullivan authored
      Use the new zynq binding for macb ethernet, since it will disable half
      duplex gigabit like the Zynq TRM says to do.
      Signed-off-by: default avatarNathan Sullivan <nathan.sullivan@ni.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9eeb5161
    • Nathan Sullivan's avatar
      net: macb: Disable half duplex gigabit on Zynq · 222ca8e0
      Nathan Sullivan authored
      According to the Zynq TRM, gigabit half duplex is not supported.  Add a
      new cap and compatible string so Zynq can avoid advertising that mode.
      Signed-off-by: default avatarNathan Sullivan <nathan.sullivan@ni.com>
      Acked-by: default avatarNicolas Ferre <nicolas.ferre@atmel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      222ca8e0
    • Nathan Sullivan's avatar
    • Michal Kubeček's avatar
      ipv4: fill in table id when replacing a route · d4e64c29
      Michal Kubeček authored
      When replacing an IPv4 route, tb_id member of the new fib_alias
      structure is not set in the replace code path so that the new route is
      ignored.
      
      Fixes: 0ddcf43d ("ipv4: FIB Local/MAIN table collapse")
      Signed-off-by: default avatarMichal Kubecek <mkubecek@suse.cz>
      Acked-by: default avatarAlexander Duyck <alexander.h.duyck@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d4e64c29
    • Bjørn Mork's avatar
      cdc_ncm: Fix tx_bytes statistics · 44f6731d
      Bjørn Mork authored
      The tx_curr_frame_payload field is u32. When we try to calculate a
      small negative delta based on it, we end up with a positive integer
      close to 2^32 instead.  So the tx_bytes pointer increases by about
      2^32 for every transmitted frame.
      
      Fix by calculating the delta as a signed long.
      
      Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
      Reported-by: default avatarFlorian Bruhin <me@the-compiler.org>
      Fixes: 7a1e890e ("usbnet: Fix tx_bytes statistic running backward in cdc_ncm")
      Signed-off-by: default avatarBjørn Mork <bjorn@mork.no>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      44f6731d
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 572152ad
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contain Netfilter fixes for your net tree, they are:
      
      1) Fix a race in nfnetlink_log and nfnetlink_queue that can lead to a crash.
         This problem is due to wrong order in the per-net registration and netlink
         socket events. Patch from Francesco Ruggeri.
      
      2) Make sure that counters that userspace pass us are higher than 0 in all the
         x_tables frontends. Discovered via Trinity, patch from Dave Jones.
      
      3) Revert a patch for br_netfilter to rely on the conntrack status bits. This
         breaks stateless IPv6 NAT transformations. Patch from Florian Westphal.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      572152ad
    • Eric W. Biederman's avatar
      ipv4: Avoid crashing in ip_error · 381c759d
      Eric W. Biederman authored
      ip_error does not check if in_dev is NULL before dereferencing it.
      
      IThe following sequence of calls is possible:
      CPU A                          CPU B
      ip_rcv_finish
          ip_route_input_noref()
              ip_route_input_slow()
                                     inetdev_destroy()
          dst_input()
      
      With the result that a network device can be destroyed while processing
      an input packet.
      
      A crash was triggered with only unicast packets in flight, and
      forwarding enabled on the only network device.   The error condition
      was created by the removal of the network device.
      
      As such it is likely the that error code was -EHOSTUNREACH, and the
      action taken by ip_error (if in_dev had been accessible) would have
      been to not increment any counters and to have tried and likely failed
      to send an icmp error as the network device is going away.
      
      Therefore handle this weird case by just dropping the packet if
      !in_dev.  It will result in dropping the packet sooner, and will not
      result in an actual change of behavior.
      
      Fixes: 251da413 ("ipv4: Cache ip_error() routes even when not forwarding.")
      Reported-by: default avatarVittorio Gambaletta <linuxbugs@vittgam.net>
      Tested-by: default avatarVittorio Gambaletta <linuxbugs@vittgam.net>
      Signed-off-by: default avatarVittorio Gambaletta <linuxbugs@vittgam.net>
      Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      381c759d
    • Eric Dumazet's avatar
      tcp: fix a potential deadlock in tcp_get_info() · d654976c
      Eric Dumazet authored
      Taking socket spinlock in tcp_get_info() can deadlock, as
      inet_diag_dump_icsk() holds the &hashinfo->ehash_locks[i],
      while packet processing can use the reverse locking order.
      
      We could avoid this locking for TCP_LISTEN states, but lockdep would
      certainly get confused as all TCP sockets share same lockdep classes.
      
      [  523.722504] ======================================================
      [  523.728706] [ INFO: possible circular locking dependency detected ]
      [  523.734990] 4.1.0-dbg-DEV #1676 Not tainted
      [  523.739202] -------------------------------------------------------
      [  523.745474] ss/18032 is trying to acquire lock:
      [  523.750002]  (slock-AF_INET){+.-...}, at: [<ffffffff81669d44>] tcp_get_info+0x2c4/0x360
      [  523.758129]
      [  523.758129] but task is already holding lock:
      [  523.763968]  (&(&hashinfo->ehash_locks[i])->rlock){+.-...}, at: [<ffffffff816bcb75>] inet_diag_dump_icsk+0x1d5/0x6c0
      [  523.774661]
      [  523.774661] which lock already depends on the new lock.
      [  523.774661]
      [  523.782850]
      [  523.782850] the existing dependency chain (in reverse order) is:
      [  523.790326]
      -> #1 (&(&hashinfo->ehash_locks[i])->rlock){+.-...}:
      [  523.796599]        [<ffffffff811126bb>] lock_acquire+0xbb/0x270
      [  523.802565]        [<ffffffff816f5868>] _raw_spin_lock+0x38/0x50
      [  523.808628]        [<ffffffff81665af8>] __inet_hash_nolisten+0x78/0x110
      [  523.815273]        [<ffffffff816819db>] tcp_v4_syn_recv_sock+0x24b/0x350
      [  523.822067]        [<ffffffff81684d41>] tcp_check_req+0x3c1/0x500
      [  523.828199]        [<ffffffff81682d09>] tcp_v4_do_rcv+0x239/0x3d0
      [  523.834331]        [<ffffffff816842fe>] tcp_v4_rcv+0xa8e/0xc10
      [  523.840202]        [<ffffffff81658fa3>] ip_local_deliver_finish+0x133/0x3e0
      [  523.847214]        [<ffffffff81659a9a>] ip_local_deliver+0xaa/0xc0
      [  523.853440]        [<ffffffff816593b8>] ip_rcv_finish+0x168/0x5c0
      [  523.859624]        [<ffffffff81659db7>] ip_rcv+0x307/0x420
      
      Lets use u64_sync infrastructure instead. As a bonus, 64bit
      arches get optimized, as these are nop for them.
      
      Fixes: 0df48c26 ("tcp: add tcpi_bytes_acked to tcp_info")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d654976c
    • Harald Freudenberger's avatar
      crypto: s390/ghash - Fix incorrect ghash icv buffer handling. · a1cae34e
      Harald Freudenberger authored
      Multitheaded tests showed that the icv buffer in the current ghash
      implementation is not handled correctly. A move of this working ghash
      buffer value to the descriptor context fixed this. Code is tested and
      verified with an multithreaded application via af_alg interface.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarHarald Freudenberger <freude@linux.vnet.ibm.com>
      Signed-off-by: default avatarGerald Schaefer <geraldsc@linux.vnet.ibm.com>
      Reported-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      a1cae34e
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.1b-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 865d8722
      Linus Torvalds authored
      Pull two xen bugfixes from David Vrabel:
      
       - fix ARM build regression.
      
       - fix VIRQ_CONSOLE related oops.
      
      * tag 'for-linus-4.1b-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen/events: don't bind non-percpu VIRQs with percpu chip
        xen/arm: Define xen_arch_suspend()
      865d8722
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · f0d8690a
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "This includes a fix for two oopses, one on PPC and on x86.
      
        The rest is fixes for bugs with newer Intel processors"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        kvm/fpu: Enable eager restore kvm FPU for MPX
        Revert "KVM: x86: drop fpu_activate hook"
        kvm: fix crash in kvm_vcpu_reload_apic_access_page
        KVM: MMU: fix SMAP virtualization
        KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages
        KVM: MMU: fix smap permission check
        KVM: PPC: Book3S HV: Fix list traversal in error case
      f0d8690a
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · 2f8126e3
      Linus Torvalds authored
      Pull s390 fixes from Martin Schwidefsky:
       "Bug fixes.
      
        Three for our crypto code, two for eBPF, and one memory management fix
        to get machines with memory > 8TB working"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/mm: correct return value of pmd_pfn
        s390/crypto: fix stckf loop
        s390/zcrypt: Fix invalid domain handling during ap module unload
        s390/bpf: Fix gcov stack space problem
        s390/zcrypt: fixed ap poll timer behavior
        s390/bpf: Adjust ALU64_DIV/MOD to match interpreter change
      2f8126e3
    • Linus Torvalds's avatar
      Merge tag 'sound-4.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 0c68e5bf
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This batch became slightly large, just because I've been on vacation
        for the last two weeks.  Nothing to scare much here, all
        device-specific fixes, mostly small patches.
      
        Majority of patches are for HD-audio, especially Dell machines.  The
        rest are small ASoC fixes for various codecs, and a USB-audio quirk.
      
        One PCM fix is included to ease the faulty condition checks in the
        case of two periods PCM buffers"
      
      * tag 'sound-4.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - Disable widget power-saving for ALC292 & co
        ALSA: hda - Reduce verbs by node power-saves
        ALSA: sound/atmel/ac97c.c: remove unused variable
        ALSA: usb-audio: Add quirk for MS LifeCam Studio
        ALSA: pcm: Modify double acknowledged interrupts check condition
        ALSA: hda/realtek - ALC292 dock fix for Thinkpad L450
        ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724
        ALSA: hda - Fix headset mic and mic-in for a Dell desktop
        ASoC: wm8994: correct BCLK DIV 348 to 384
        ASoC: wm8960: fix "RINPUT3" audio route error
        ASoC: dapm: Modify widget stream name according to prefix
        ALSA: hda - Add headset mic quirk for Dell Inspiron 5548
        ASoC: rt5645: Fix mask for setting RT5645_DMIC_2_DP_GPIO12 bit
        ASoC: rt5645: Add ACPI match ID
        ALSA: hda/realtek - Add ALC298 alias name for Dell
        ASoC: uda1380: Avoid accessing i2c bus when codec is disabled
        ALSA: hda/realtek - Fix typo for ALC286/ALC288
        ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls
        ALSA: hda - Add headphone quirk for Lifebook E752
        ASoC: davinci-mcasp: Correct pm status check in suspend callback
      0c68e5bf
    • Linus Torvalds's avatar
      Merge branch 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux · 18658921
      Linus Torvalds authored
      Pull thermal fixes from Zhang Rui:
       "Three fixes for Armada (380) and TI (dra7 and OMAP5) thermal soc
        drivers"
      
      * 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
        thermal: armada: Update Armada 380 thermal sensor coefficients
        thermal: ti-soc-thermal: OMAP5: Implement Workaround for Errata i813
        thermal: ti-soc-thermal: dra7: Implement Workaround for Errata i814
      18658921
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · 83ee4121
      Linus Torvalds authored
      Pull infiniband/rdma fixes from Doug Ledford:
       "This should hopefully be the last request for 4.1-rc for the RDMA
        stack.  It contains some late ocrdma fixes that I'm including because
        they are small and self contained.  It also contains two bug fixes
        that are simple and easily verified.
      
        Summary:
      
         - a number of small, well contained bug fixes for ocrdma driver
      
         - a simple fix for the connection negotiation sequence on IB
      
         - fix for broken AF_IB address on UD queue pair support"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
        IB/cma: Fix broken AF_IB UD support
        ib/cm: Change reject message type when destroying cm_id
        RDMA/ocrdma: Update ocrdma version number
        RDMA/ocrdma: Fail connection for MTU lesser than 512
        RDMA/ocrdma: Fix dmac resolution for link local address
        RDMA/ocrdma: Prevent allocation of DPP PDs if FW doesnt support it
        RDMA/ocrdma: Fix the request length for RDMA_QUERY_QP mailbox command to FW.
        RDMA/ocrdma: Use VID 0 if PFC is enabled and vlan is not configured
        RDMA/ocrdma: Fix QP state transition in destroy_qp
        RDMA/ocrdma: Report EQ full fatal error
        RDMA/ocrdma: Fix EQ destroy failure during driver unload
      83ee4121
    • Linus Torvalds's avatar
      Merge tag 'mmc-4.1-rc3' of git://git.linaro.org/people/ulf.hansson/mmc · 97793a81
      Linus Torvalds authored
      Pull MMC fix from Ulf Hansson:
       "One more mmc fix intended for v4.1 rc5:
      
        MMC host:
         - atmel-mci: fix bad variable type for clkdiv"
      
      * tag 'mmc-4.1-rc3' of git://git.linaro.org/people/ulf.hansson/mmc:
        mmc: atmel-mci: fix bad variable type for clkdiv
      97793a81
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid · 6efdb114
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
       "Bugfixes for HID subsystem that should go in 4.1.  Important
        highlights:
      
         - the patch that extended support for HID++ protocol for TK820
           touchpad turns out to be causing regressions due to firmware
           issues; patch reverting back to basic support from Benjamin
           Tissoires
      
         - Wacom driver can oops for devices that report non-touch data on
           touch interfaces.  Fix from Ping Cheng
      
         - gpiolib is not mandatory for i2c-hid, so the driver shouldn't fail
           if gpiolib is not enabled.  Fix from Mika Westerberg"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
        HID: wacom: fix an Oops caused by wacom_wac_finger_count_touches
        HID: usbhid: Add HID_QUIRK_NOGET for Aten DVI KVM switch
        HID: hid-sensor-hub: Fix debug lock warning
        Revert "HID: logitech-hidpp: support combo keyboard touchpad TK820"
        HID: i2c-hid: Do not fail probing if gpiolib is not enabled
      6efdb114
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · e51a3630
      Linus Torvalds authored
      Pull crypto fix from Herbert Xu:
       "This fixes a the crash in the newly added algif_aead interface when it
        tries to link SG lists"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: algif_aead - fix invalid sgl linking
      e51a3630
    • Marek Vasut's avatar
      Input: smtpe-ts - wait 50mS until polling for pen-up · 77b071e7
      Marek Vasut authored
      Wait a little bit longer, 50mS instead of 20mS, until the driver starts
      polling for pen-up. The problematic behavior before this patch is applied
      is as follows. The behavior was observed on the STMPE610QTR controller.
      
      Upon a physical pen-down event, the touchscreen reports one set of x-y-p
      coordinates and a pen-down event. After that, the pen-up polling is
      triggered and since the controller is not ready yet, the polling mistakenly
      detects a pen-up event while the physical state is still such that the pen
      is down on the touch surface.
      
      The pen-up handling flushes the controller FIFO, so after that, all the
      samples in the controller are discarded. The controller becomes ready
      shortly after this bogus pen-up handling and does generate again a pen-down
      interrupt. This time, the controller contains x-y-p samples which all read
      as zero. Since pressure value is zero, this set of samples is effectively
      ignored by userland.
      
      In the end, the driver just bounces between pen-down and bogus pen-up
      handling, generating no useful results. Fix this by giving the controller a
      bit more time before polling it for pen-up.
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      Reviewed-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      77b071e7
    • Marek Vasut's avatar
      Input: smtpe-ts - use msecs_to_jiffies() instead of HZ · e686e9e1
      Marek Vasut authored
      Use msecs_to_jiffies(20) instead of plain (HZ / 50), as the former is much
      more explicit about it's behavior. We want to schedule the task 20 mS from
      now, so make it explicit in the code.
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      Reviewed-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      e686e9e1
  2. 21 May, 2015 4 commits
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · 3d854120
      Linus Torvalds authored
      Pull clk fixes from Michael Turquette:
       "The first set of clk fixes for 4.1 are all driver bugs, with the
        exception of a single locking fix in the core code.
      
        All driver fixes are for code that was merged recently.  The Samsung
        stuff is mostly fixes around suspend/resume, the Qualcomm fixes are
        for invalid hardware configuration data and the Silicon Labs patches
        are fixes following their move away from platform_data to Device Tree"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: si5351: Do not pass struct clk in platform_data
        clk: si5351: Mention clock-names in the binding documentation
        clk: add missing lock when call clk_core_enable in clk_set_parent
        clk: exynos5420: Restore GATE_BUS_TOP on suspend
        clk: qcom: Fix MSM8916 gfx3d_clk_src configuration
        clk: qcom: Fix MSM8916 venus divider value
        clk: exynos5433: Fix wrong PMS value of exynos5433_pll_rates
        clk: exynos5433: Fix wrong parent clock of sclk_apollo clock
        clk: exynos5433: Fix CLK_PCLK_MONOTONIC_CNT clk register assignment
        clk: exynos5433: Fix wrong offset of PCLK_MSCL_SECURE_SMMU_JPEG
        clk: Use CONFIG_ARCH_EXYNOS instead of CONFIG_ARCH_EXYNOS5433
      3d854120
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-linus-v4.1-rc5' of... · 4cce593f
      Linus Torvalds authored
      Merge tag 'hwmon-for-linus-v4.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fixlet from Guenter Roeck:
       "Update location of Jean Delvare's hwmon quilt tree"
      
      * tag 'hwmon-for-linus-v4.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: Update the location of my quilt tree
      4cce593f
    • Thomas Hellstrom's avatar
      Input: joydev - don't classify the vmmouse as a joystick · 15397f15
      Thomas Hellstrom authored
      Joydev is currently thinking some absolute mice are joystick, and that
      messes up games in VMware guests, as the cursor typically gets stuck in
      the top left corner.
      
      Try to detect the event signature of a VMmouse input device and back off
      for such devices. We're still incorrectly detecting, for example, the
      VMware absolute USB mouse as a joystick, but adding an event signature
      matching also that device would be considerably more risky, so defer that
      to a later merge window.
      Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      15397f15
    • Daniel Borkmann's avatar
      net: sched: fix call_rcu() race on classifier module unloads · c78e1746
      Daniel Borkmann authored
      Vijay reported that a loop as simple as ...
      
        while true; do
          tc qdisc add dev foo root handle 1: prio
          tc filter add dev foo parent 1: u32 match u32 0 0  flowid 1
          tc qdisc del dev foo root
          rmmod cls_u32
        done
      
      ... will panic the kernel. Moreover, he bisected the change
      apparently introducing it to 78fd1d0a ("netlink: Re-add
      locking to netlink_lookup() and seq walker").
      
      The removal of synchronize_net() from the netlink socket
      triggering the qdisc to be removed, seems to have uncovered
      an RCU resp. module reference count race from the tc API.
      Given that RCU conversion was done after e341694e ("netlink:
      Convert netlink_lookup() to use RCU protected hash table")
      which added the synchronize_net() originally, occasion of
      hitting the bug was less likely (not impossible though):
      
      When qdiscs that i) support attaching classifiers and,
      ii) have at least one of them attached, get deleted, they
      invoke tcf_destroy_chain(), and thus call into ->destroy()
      handler from a classifier module.
      
      After RCU conversion, all classifier that have an internal
      prio list, unlink them and initiate freeing via call_rcu()
      deferral.
      
      Meanhile, tcf_destroy() releases already reference to the
      tp->ops->owner module before the queued RCU callback handler
      has been invoked.
      
      Subsequent rmmod on the classifier module is then not prevented
      since all module references are already dropped.
      
      By the time, the kernel invokes the RCU callback handler from
      the module, that function address is then invalid.
      
      One way to fix it would be to add an rcu_barrier() to
      unregister_tcf_proto_ops() to wait for all pending call_rcu()s
      to complete.
      
      synchronize_rcu() is not appropriate as under heavy RCU
      callback load, registered call_rcu()s could be deferred
      longer than a grace period. In case we don't have any pending
      call_rcu()s, the barrier is allowed to return immediately.
      
      Since we came here via unregister_tcf_proto_ops(), there
      are no users of a given classifier anymore. Further nested
      call_rcu()s pointing into the module space are not being
      done anywhere.
      
      Only cls_bpf_delete_prog() may schedule a work item, to
      unlock pages eventually, but that is not in the range/context
      of cls_bpf anymore.
      
      Fixes: 25d8c0d5 ("net: rcu-ify tcf_proto")
      Fixes: 9888faef ("net: sched: cls_basic use RCU")
      Reported-by: default avatarVijay Subramanian <subramanian.vijay@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Cc: John Fastabend <john.r.fastabend@intel.com>
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Thomas Graf <tgraf@suug.ch>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Alexei Starovoitov <ast@plumgrid.com>
      Tested-by: default avatarVijay Subramanian <subramanian.vijay@gmail.com>
      Acked-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c78e1746
  3. 20 May, 2015 8 commits
    • NeilBrown's avatar
      md/bitmap: remove rcu annotation from pointer arithmetic. · 8532e343
      NeilBrown authored
      Evaluating  "&mddev->disks" is simple pointer arithmetic, so
      it does not need 'rcu' annotations - no dereferencing is happening.
      
      Also enhance the comment to explain that 'rdev' in that case
      is not actually a pointer to an rdev.
      Reported-by: default avatarPatrick Marlier <patrick.marlier@gmail.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      8532e343
    • Eric Work's avatar
      md/raid0: fix restore to sector variable in raid0_make_request · a8115776
      Eric Work authored
      The variable "sector" in "raid0_make_request()" was improperly updated
      by a call to "sector_div()" which modifies its first argument in place.
      Commit 47d68979 restored this variable
      after the call for later re-use.  Unfortunetly the restore was done after
      the referenced variable "bio" was advanced.  This lead to the original
      value and the restored value being different.  Here we move this line to
      the proper place.
      
      One observed side effect of this bug was discarding a file though
      unlinking would cause an unrelated file's contents to be discarded.
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      Fixes: 47d68979 ("md/raid0: fix bug with chunksize not a power of 2.")
      Cc: stable@vger.kernel.org (any that received above backport)
      URL: https://bugzilla.kernel.org/show_bug.cgi?id=98501
      a8115776
    • Shaohua Li's avatar
      raid5: fix broken async operation chain · 48769695
      Shaohua Li authored
      ops_run_reconstruct6() doesn't correctly chain asyn operations. The tx returned
      by async_gen_syndrome should be added as the dependent tx of next stripe.
      
      The issue is introduced by commit 59fc630b
          RAID5: batch adjacent full stripe write
      Reported-and-tested-by: default avatarMaxime Ripard <maxime.ripard@free-electrons.com>
      Signed-off-by: default avatarShaohua Li <shli@fb.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      48769695
    • Thomas Hellstrom's avatar
      Input: vmmouse - do not reference non-existing version of X driver · 412dbad2
      Thomas Hellstrom authored
      The vmmouse Kconfig help text was referring to an incorrect user-space
      driver version. Fix this.
      Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      412dbad2
    • Hans de Goede's avatar
      Input: alps - fix finger jumps on lifting 2 fingers on v7 touchpad · 72eceab7
      Hans de Goede authored
      On v7 touchpads sometimes when 2 fingers are moved down on the touchpad
      until they "fall of" the touchpad, the second touch will report 0 for y
      (max y really since the y axis is inverted) and max x as coordinates,
      rather then reporting 0, 0 as is expected for a non touching finger.
      
      This commit detects this and treats these touches as non touching.
      
      See the evemu-recording here:
      https://bugzilla.redhat.com/attachment.cgi?id=1025058
      
      BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1221200Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      72eceab7
    • Matthew Finlay's avatar
      IB/cma: Fix broken AF_IB UD support · c07678bb
      Matthew Finlay authored
      Support for using UD and AF_IB is currently broken.  The
      IB_CM_SIDR_REQ_RECEIVED message is not handled properly in
      cma_save_net_info() and we end up falling into code that will try and
      process the request as ipv4/ipv6, which will end up failing.
      
      The resolution is to add a check for the SIDR_REQ and call
      cma_save_ib_info() with a NULL path record.  Change cma_save_ib_info()
      to copy the src sib info from the listen_id when the path record is NULL.
      Reported-by: default avatarHari Shankar <Hari.Shankar@netapp.com>
      Signed-off-by: default avatarMatt Finlay <matt@mellanox.com>
      Acked-by: default avatarSean Hefty <sean.hefty@intel.com>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      c07678bb
    • Ted Kim's avatar
      ib/cm: Change reject message type when destroying cm_id · c29ed5a4
      Ted Kim authored
      Problem reported by: Ted Kim <ted.h.kim@oracle.com>:
      
      We have a case where a Linux system and a non-Linux system are
      trying to interoperate.  The Linux host is the active side and
      starts the connection establishment, but later decides to not go
      through with the connection setup and does rdma_destroy_id().
      
      The rdma_destroy_id() eventually works its way down to cm_destroy_id()
      in core/cm.c, where a REJ is sent. The non-Linux system
      has some trouble recognizing the REJ because of:
      
      A. CM states which can't receive the REJ
      B. Some issues about REJ formatting (missing comm ID)
      
      ISSUE A: That part of the spec says, a Consumer Reject REJ can be
      sent for a connection abort, but it goes further
      and says: can send a REJ message with a "Consumer Reject"
      Reason code if they are in a CM state (i.e. REP
      Rcvd, MRA(REP) Sent, REQ Rcvd, MRA Sent) that allows
      a REJ to be sent (lines 35-38).
      
      Of the states listed there in that sentence, it would
      seem to limit the active side to using the Consumer Reject
      (for the abort case) in just the REP-Rcvd and MRA-REP-Sent
      states. That is basically only after the active side
      sees a REP (or alternatively goes down the state transitions
      to timeout in which case a Timeout REJ is sent).
      
      As a fix, in cm-destroy-id() move the IB-CM-MRA-REQ-RCVD case
      to the same as REQ-SENT.  Essentially, make a REJ sent after
      getting an MRA on active side a timeout rather than Consumer-
      Reject, which is arguably more correct with the CM state
      diagrams previous to getting a REP.
      Signed-off-by: default avatarTed Kim <ted.h.kim@oracle.com>
      Signed-off-by: default avatarSean Hefty <sean.hefty@intel.com>
      c29ed5a4
    • Tim Beale's avatar
      net: phy: Make sure phy_start() always re-enables the phy interrupts · c15e10e7
      Tim Beale authored
      This is an alternative way of fixing:
       commit db9683fb ("net: phy: Make sure PHY_RESUMING state change
                            is always processed")
      
      When the PHY state transitions from PHY_HALTED to PHY_RESUMING, there are
      two things we need to do:
      1). Re-enable interrupts (and power up the physical link, if powered down)
      2). Update the PHY state and net-device based on the link status.
      
      There's no strict reason why #1 has to be done from within the main
      phy_state_machine() function. There is a risk that other changes to the
      PHY (e.g. setting speed/duplex, which calls phy_start_aneg()) could cause
      a subsequent state transition before phy_state_machine() has processed
      the PHY_RESUMING state change. This would leave the PHY with interrupts
      disabled and/or still in the BMCR_PDOWN/low-power mode.
      
      Moving enabling the interrupts and phy_resume() into phy_start() will
      guarantee this work always gets done. As the PHY is already in the HALTED
      state and interrupts are disabled, it shouldn't conflict with any work
      being done in phy_state_machine(). The downside of this change is that if
      the PHY_RESUMING state is ever entered from anywhere else, it'll also have
      to repeat this work.
      Signed-off-by: default avatarTim Beale <tim.beale@alliedtelesis.co.nz>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c15e10e7