1. 02 Mar, 2014 2 commits
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma · 3750c140
      Linus Torvalds authored
      Pull slave-dma fixes from Vinod Koul:
       "This request brings you two small fixes.  First one for fixing
        dereference of freed descriptor and second for fixing sdma bindings
        for it to work for imx25.
      
        I was planning to send this about 10days ago but then I had to proceed
        on my paternity leave and didnt get chance to send this.  Now got a
        bit of time from dady duties :)"
      
      * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
        dma: sdma: Add imx25 compatible
        dma: ste_dma40: don't dereference free:d descriptor
      3750c140
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-3.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 751a03c3
      Linus Torvalds authored
      Pull ACPI and power management fixes from Rafael Wysocki:
       "These three commits fix a recent intel_pstate regression and two old
        bugs that should be fixed in -stable too, one in the ACPI processor
        driver and one in the firmare loader.
      
        Specifics:
      
         - One of the recent intel_pstate driver fixes introduced a rounding
           error that on some systems causes the frequency to be stuck at the
           lowest level forever.  Fix from Dirk Brandewie.
      
         - The firmware_class driver's PM notifier doesn't handle the
           PM_RESTORE_PREPARE event during hibernation image restore and that
           leads to a deadlock on umhelper_sem in __usermodehelper_disable().
           Fix from Sebastian Capella.
      
         - acpi_processor_set_throttling() abuses set_cpus_allowed_ptr() in a
           nasty way which triggers the WARN_ON_ONCE() in wq_worker_waking_up()
           among other things.  Fix from Lan Tianyu"
      
      * tag 'pm+acpi-3.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI / processor: Rework processor throttling with work_on_cpu()
        PM / hibernate: Fix restore hang in freeze_processes()
        intel_pstate: Change busy calculation to use fixed point math.
      751a03c3
  2. 28 Feb, 2014 18 commits
  3. 27 Feb, 2014 16 commits
    • Rafael J. Wysocki's avatar
      Merge branches 'pm-cpufreq', 'pm-hibernate' and 'acpi-processor' · 6c09ea49
      Rafael J. Wysocki authored
      * pm-cpufreq:
        intel_pstate: Change busy calculation to use fixed point math.
      
      * pm-hibernate:
        PM / hibernate: Fix restore hang in freeze_processes()
      
      * acpi-processor:
        ACPI / processor: Rework processor throttling with work_on_cpu()
      6c09ea49
    • Paolo Bonzini's avatar
      kvm, vmx: Really fix lazy FPU on nested guest · 1b385cbd
      Paolo Bonzini authored
      Commit e504c909 (kvm, vmx: Fix lazy FPU on nested guest, 2013-11-13)
      highlighted a real problem, but the fix was subtly wrong.
      
      nested_read_cr0 is the CR0 as read by L2, but here we want to look at
      the CR0 value reflecting L1's setup.  In other words, L2 might think
      that TS=0 (so nested_read_cr0 has the bit clear); but if L1 is actually
      running it with TS=1, we should inject the fault into L1.
      
      The effective value of CR0 in L2 is contained in vmcs12->guest_cr0, use
      it.
      
      Fixes: e504c909Reported-by: default avatarKashyap Chamarty <kchamart@redhat.com>
      Reported-by: default avatarStefan Bader <stefan.bader@canonical.com>
      Tested-by: default avatarKashyap Chamarty <kchamart@redhat.com>
      Tested-by: default avatarAnthoine Bourgeois <bourgeois@bertin.fr>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      1b385cbd
    • Linus Torvalds's avatar
      Merge tag 'metag-fixes-v3.14' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag · 86c7654f
      Linus Torvalds authored
      Pull Metag arch and asm-generic fixes from James Hogan:
      
       - Add the new sched_setattr/sched_getattr syscalls to the asm-generic
         syscall list, which is used by arc, arm64, c6x, hexagon, metag,
        openrisc, score, tile, and unicore32.
      
       - An IRQ affinity bug fix for metag to prevent interrupts being
         vectored to offline CPUs when their affinity is changed via
         /proc/irq/ (thanks tglx).
      
      * tag 'metag-fixes-v3.14' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag:
        irq-metag*: stop set_affinity vectoring to offline cpus
        asm-generic: add sched_setattr/sched_getattr syscalls
      86c7654f
    • Linus Torvalds's avatar
      Merge tag 'pwm/for-3.14-rc5' of... · 3ebd3da6
      Linus Torvalds authored
      Merge tag 'pwm/for-3.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm
      
      Pull pwm fix from Thierry Reding:
       "Just a single trivial patch to plug a memory leak in an error path"
      
      * tag 'pwm/for-3.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm:
        pwm: lp3943: Fix potential memory leak during request
      3ebd3da6
    • Linus Torvalds's avatar
      Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · 8d753182
      Linus Torvalds authored
      Pull filesystem fixes from Jan Kara:
       "Notification, writeback, udf, quota fixes
      
        The notification patches are (with one exception) a fallout of my
        fsnotify rework which went into -rc1 (I've extented LTP to cover these
        cornercases to avoid similar breakage in future).
      
        The UDF patch is a nasty data corruption Al has recently reported,
        the revert of the writeback patch is due to possibility of violating
        sync(2) guarantees, and a quota bug can lead to corruption of quota
        files in ocfs2"
      
      * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        fsnotify: Allocate overflow events with proper type
        fanotify: Handle overflow in case of permission events
        fsnotify: Fix detection whether overflow event is queued
        Revert "writeback: do not sync data dirtied after sync start"
        quota: Fix race between dqput() and dquot_scan_active()
        udf: Fix data corruption on file type conversion
        inotify: Fix reporting of cookies for inotify events
      8d753182
    • Linus Torvalds's avatar
      Merge tag 'upstream-3.14-rc5' of git://git.infradead.org/linux-ubifs · bb7d43b1
      Linus Torvalds authored
      Pull ubifs fix from Artem Bityutskiy:
       "Just a single fix for the UBI module unload path which makes sure we
        do not touch freed memory"
      
      * tag 'upstream-3.14-rc5' of git://git.infradead.org/linux-ubifs:
        UBI: fix some use after free bugs
      bb7d43b1
    • Andrew Honig's avatar
      kvm: x86: fix emulator buffer overflow (CVE-2014-0049) · a08d3b3b
      Andrew Honig authored
      The problem occurs when the guest performs a pusha with the stack
      address pointing to an mmio address (or an invalid guest physical
      address) to start with, but then extending into an ordinary guest
      physical address.  When doing repeated emulated pushes
      emulator_read_write sets mmio_needed to 1 on the first one.  On a
      later push when the stack points to regular memory,
      mmio_nr_fragments is set to 0, but mmio_is_needed is not set to 0.
      
      As a result, KVM exits to userspace, and then returns to
      complete_emulated_mmio.  In complete_emulated_mmio
      vcpu->mmio_cur_fragment is incremented.  The termination condition of
      vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments is never achieved.
      The code bounces back and fourth to userspace incrementing
      mmio_cur_fragment past it's buffer.  If the guest does nothing else it
      eventually leads to a a crash on a memcpy from invalid memory address.
      
      However if a guest code can cause the vm to be destroyed in another
      vcpu with excellent timing, then kvm_clear_async_pf_completion_queue
      can be used by the guest to control the data that's pointed to by the
      call to cancel_work_item, which can be used to gain execution.
      
      Fixes: f78146b0Signed-off-by: default avatarAndrew Honig <ahonig@google.com>
      Cc: stable@vger.kernel.org (3.5+)
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      a08d3b3b
    • Marc Zyngier's avatar
      arm/arm64: KVM: detect CPU reset on CPU_PM_EXIT · b20c9f29
      Marc Zyngier authored
      Commit 1fcf7ce0 (arm: kvm: implement CPU PM notifier) added
      support for CPU power-management, using a cpu_notifier to re-init
      KVM on a CPU that entered CPU idle.
      
      The code assumed that a CPU entering idle would actually be powered
      off, loosing its state entierely, and would then need to be
      reinitialized. It turns out that this is not always the case, and
      some HW performs CPU PM without actually killing the core. In this
      case, we try to reinitialize KVM while it is still live. It ends up
      badly, as reported by Andre Przywara (using a Calxeda Midway):
      
      [    3.663897] Kernel panic - not syncing: unexpected prefetch abort in Hyp mode at: 0x685760
      [    3.663897] unexpected data abort in Hyp mode at: 0xc067d150
      [    3.663897] unexpected HVC/SVC trap in Hyp mode at: 0xc0901dd0
      
      The trick here is to detect if we've been through a full re-init or
      not by looking at HVBAR (VBAR_EL2 on arm64). This involves
      implementing the backend for __hyp_get_vectors in the main KVM HYP
      code (rather small), and checking the return value against the
      default one when the CPU notifier is called on CPU_PM_EXIT.
      Reported-by: default avatarAndre Przywara <osp@andrep.de>
      Tested-by: default avatarAndre Przywara <osp@andrep.de>
      Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Cc: Rob Herring <rob.herring@linaro.org>
      Acked-by: default avatarChristoffer Dall <christoffer.dall@linaro.org>
      Signed-off-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      b20c9f29
    • Mike Snitzer's avatar
      dm thin: allow metadata space larger than supported to go unused · 7d48935e
      Mike Snitzer authored
      It was always intended that a user could provide a thin metadata device
      that is larger than the max supported by the on-disk format.  The extra
      space would just go unused.
      
      Unfortunately that never worked.  If the user attempted to use a larger
      metadata device on creation they would get an error like the following:
      
       device-mapper: space map common: space map too large
       device-mapper: transaction manager: couldn't create metadata space map
       device-mapper: thin metadata: tm_create_with_sm failed
       device-mapper: table: 252:17: thin-pool: Error creating metadata object
       device-mapper: ioctl: error adding target to table
      
      Fix this by allowing the initial metadata space map creation to cap its
      size at the max number of blocks supported (DM_SM_METADATA_MAX_BLOCKS).
      get_metadata_dev_size() must also impose DM_SM_METADATA_MAX_BLOCKS (via
      THIN_METADATA_MAX_SECTORS), otherwise extending metadata would cap at
      THIN_METADATA_MAX_SECTORS_WARNING (which is larger than supported).
      
      Also, the calculation for THIN_METADATA_MAX_SECTORS didn't account for
      the sizeof the disk_bitmap_header.  So the supported maximum metadata
      size is a bit smaller (reduced from 33423360 to 33292800 sectors).
      
      Lastly, remove the "excess space will not be used" warning message from
      get_metadata_dev_size(); it resulted in printing the warning multiple
      times.  Factor out warn_if_metadata_device_too_big(), call it from
      pool_ctr() and maybe_resize_metadata_dev().
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Acked-by: default avatarJoe Thornber <ejt@redhat.com>
      7d48935e
    • Takashi Iwai's avatar
      Merge tag 'asoc-v3.14-rc4-2' of... · 997e7547
      Takashi Iwai authored
      Merge tag 'asoc-v3.14-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
      
      ASoC: Updates for v3.14
      
      A few more driver specific bug fixes, all driver specific things that
      only affect users of those devices.
      997e7547
    • Mark Brown's avatar
    • Mark Brown's avatar
    • Mark Brown's avatar
      Merge tag 'asoc-v3.14-rc4' into asoc-linus · f3cfc7d9
      Mark Brown authored
      ASoC: Fixes for v3.14
      
      A somewhat large set of fixes here due to the identification of some
      systematic problems with hard to use APIs in the subsystem.  Takashi did
      a lot of work to address the enumeration API which uncovered a number of
      off by one bugs caused by confusing APIs while Charles addressed issues
      in the locking around DAPM.
      
      # gpg: Signature made Sun 23 Feb 2014 13:29:34 KST using RSA key ID 7EA229BD
      # gpg: Good signature from "Mark Brown <broonie@sirena.org.uk>"
      # gpg:                 aka "Mark Brown <broonie@debian.org>"
      # gpg:                 aka "Mark Brown <broonie@kernel.org>"
      # gpg:                 aka "Mark Brown <broonie@tardis.ed.ac.uk>"
      # gpg:                 aka "Mark Brown <broonie@linaro.org>"
      # gpg:                 aka "Mark Brown <Mark.Brown@linaro.org>"
      f3cfc7d9
    • Mark Brown's avatar
      Merge tag 'asoc-v3.14-rc3' into asoc-linus · e2f45592
      Mark Brown authored
      ASoC: Fixes for v3.14
      
      A few fixes, all driver speccific ones.  The DaVinci ones aren't as
      clear as they should be from the subject lines on the commits but they
      fix issues which will prevent correct operation in some use cases and
      only affect that particular driver so are reasonably safe.
      
      # gpg: Signature made Wed 19 Feb 2014 13:23:13 KST using RSA key ID 7EA229BD
      # gpg: Good signature from "Mark Brown <broonie@sirena.org.uk>"
      # gpg:                 aka "Mark Brown <broonie@debian.org>"
      # gpg:                 aka "Mark Brown <broonie@kernel.org>"
      # gpg:                 aka "Mark Brown <broonie@tardis.ed.ac.uk>"
      # gpg:                 aka "Mark Brown <broonie@linaro.org>"
      # gpg:                 aka "Mark Brown <Mark.Brown@linaro.org>"
      e2f45592
    • Takashi Iwai's avatar
      ASoC: sta32x: Fix wrong enum for limiter2 release rate · b3619b28
      Takashi Iwai authored
      There is a typo in the Limiter2 Release Rate control, a wrong enum for
      Limiter1 is assigned.  It must point to Limiter2.
      Spotted by a compile warning:
      
      In file included from sound/soc/codecs/sta32x.c:34:0:
      sound/soc/codecs/sta32x.c:223:29: warning: ‘sta32x_limiter2_release_rate_enum’ defined but not used [-Wunused-variable]
       static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum,
                                   ^
      include/sound/soc.h:275:18: note: in definition of macro ‘SOC_ENUM_DOUBLE_DECL’
        struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
                        ^
      sound/soc/codecs/sta32x.c:223:8: note: in expansion of macro ‘SOC_ENUM_SINGLE_DECL’
       static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum,
              ^
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: default avatarMark Brown <broonie@linaro.org>
      Cc: <stable@vger.kernel.org>
      b3619b28
    • Takashi Iwai's avatar
      Merge tag 'asoc-v3.14-rc4' of... · e2755cf9
      Takashi Iwai authored
      Merge tag 'asoc-v3.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
      
      ASoC: Fixes for v3.14
      
      A somewhat large set of fixes here due to the identification of some
      systematic problems with hard to use APIs in the subsystem.  Takashi did
      a lot of work to address the enumeration API which uncovered a number of
      off by one bugs caused by confusing APIs while Charles addressed issues
      in the locking around DAPM.
      e2755cf9
  4. 26 Feb, 2014 4 commits