1. 05 Mar, 2015 1 commit
    • Emmanuel Grumbach's avatar
      iwlwifi: mvm: BT Coex - fix a NULL pointer exception · 4cd4b50c
      Emmanuel Grumbach authored
      The commit below introduced an unsafe dereference of
      mvmvif->phy_ctxt. It can be NULL even if we hold the mutex.
      We can be handling a BT Coex notification while the vif has
      already been unassigned. This can happen since the BT Coex
      notification is hanled asynchronuously: we can have started
      to handle the BT Coex notification trying to acquire the
      mutex while the unassign flow already got it. The BT Coex
      notification handling will wait for the mutext. I'll get it
      later, but then mvmvif->phy_ctxt will be NULL.
      
      Panic log:
      
      BUG: unable to handle kernel NULL pointer dereference at   (null)
      IP: [<f985180d>] iwl_mvm_bt_notif_iterator+0x9d/0x340 [iwlmvm]
      *pdpt = 0000000000000000 *pde = f000eef300000007
      Oops: 0000 [#1] SMP
      Workqueue: events iwl_mvm_async_handlers_wk [iwlmvm]
      task: ed719b20 ti: ec03e000 task.ti: ec03e000
      EIP: 0060:[<f985180d>] EFLAGS: 00010202 CPU: 2
      EIP is at iwl_mvm_bt_notif_iterator+0x9d/0x340 [iwlmvm]
      EAX: 00000000 EBX: f6d3cb70 ECX: f6d3cb70 EDX: 00000000
      ESI: ec03fe40 EDI: efeb8810 EBP: ec03fdf0 ESP: ec03fdac
       DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
      CR0: 80050033 CR2: 00000000 CR3: 01a1a000 CR4: 001407f0
      Stack:
       f743ca80 f744a404 ec03fdcc c10e3952 00003aba f743ca80 00000246 f743ca80
       00000246 00000000 00000001 00000000 ebd45ff6 ebd458a4 f6d3c500 ebd45578
       ebd44b01 ec03fe18 f99e1bc2 00000002 ebd44bc0 f9851770 00000000 f6d3c500
      Call Trace:
       [<c10e3952>] ? ring_buffer_unlock_commit+0xa2/0xd0
       [<f99e1bc2>] __iterate_interfaces+0x82/0x110 [mac80211]
       [<f9851770>] ? iwl_mvm_bt_coex_reduced_txp+0x140/0x140 [iwlmvm]
       [<f99e1c6a>] ieee80211_iterate_active_interfaces_atomic+0x1a/0x20 [mac80211]
       [<f9851427>] iwl_mvm_bt_coex_notif_handle+0x77/0x280 [iwlmvm]
       [<f9852161>] iwl_mvm_rx_bt_coex_notif_old+0x211/0x220 [iwlmvm]
       [<f9850b8b>] iwl_mvm_rx_bt_coex_notif+0x19b/0x1b0 [iwlmvm]
       [<f983944f>] iwl_mvm_async_handlers_wk+0x7f/0xe0 [iwlmvm]
      
      CC: <stable@vger.kernel.org> [3.19+]
      Fixes: 123f5156 ("iwlwifi: mvm: BT Coex - add support for TTC / RRC")
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      4cd4b50c
  2. 25 Feb, 2015 1 commit
  3. 23 Feb, 2015 5 commits
  4. 18 Feb, 2015 7 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · f5af19d1
      Linus Torvalds authored
      Pull networking updates from David Miller:
      
       1) Missing netlink attribute validation in nft_lookup, from Patrick
          McHardy.
      
       2) Restrict ipv6 partial checksum handling to UDP, since that's the
          only case it works for.  From Vlad Yasevich.
      
       3) Clear out silly device table sentinal macros used by SSB and BCMA
          drivers.  From Joe Perches.
      
       4) Make sure the remote checksum code never creates a situation where
          the remote checksum is applied yet the tunneling metadata describing
          the remote checksum transformation is still present.  Otherwise an
          external entity might see this and apply the checksum again.  From
          Tom Herbert.
      
       5) Use msecs_to_jiffies() where applicable, from Nicholas Mc Guire.
      
       6) Don't explicitly initialize timer struct fields, use setup_timer()
          and mod_timer() instead.  From Vaishali Thakkar.
      
       7) Don't invoke tg3_halt() without the tp->lock held, from Jun'ichi
          Nomura.
      
       8) Missing __percpu annotation in ipvlan driver, from Eric Dumazet.
      
       9) Don't potentially perform skb_get() on shared skbs, also from Eric
          Dumazet.
      
      10) Fix COW'ing of metrics for non-DST_HOST routes in ipv6, from Martin
          KaFai Lau.
      
      11) Fix merge resolution error between the iov_iter changes in vhost and
          some bug fixes that occurred at the same time.  From Jason Wang.
      
      12) If rtnl_configure_link() fails we have to perform a call to
          ->dellink() before unregistering the device.  From WANG Cong.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (39 commits)
        net: dsa: Set valid phy interface type
        rtnetlink: call ->dellink on failure when ->newlink exists
        com20020-pci: add support for eae single card
        vhost_net: fix wrong iter offset when setting number of buffers
        net: spelling fixes
        net/core: Fix warning while make xmldocs caused by dev.c
        net: phy: micrel: disable NAND-tree for KSZ8021, KSZ8031, KSZ8051, KSZ8081
        ipv6: fix ipv6_cow_metrics for non DST_HOST case
        openvswitch: Fix key serialization.
        r8152: restore hw settings
        hso: fix rx parsing logic when skb allocation fails
        tcp: make sure skb is not shared before using skb_get()
        bridge: netfilter: Move sysctl-specific error code inside #ifdef
        ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc
        ipvlan: add a missing __percpu pcpu_stats
        tg3: Hold tp->lock before calling tg3_halt() from tg3_init_one()
        bgmac: fix device initialization on Northstar SoCs (condition typo)
        qlcnic: Delete existing multicast MAC list before adding new
        net/mlx5_core: Fix configuration of log_uar_page_sz
        sunvnet: don't change gso data on clones
        ...
      f5af19d1
    • Linus Torvalds's avatar
      Merge tag 'md/3.20-fixes' of git://neil.brown.name/md · 0d695d6d
      Linus Torvalds authored
      Pull md bugfixes from Neil Brown:
       "Three bug md fixes for 3.20
      
        yet-another-livelock in raid5, and a problem with write errors to
        4K-block devices"
      
      * tag 'md/3.20-fixes' of git://neil.brown.name/md:
        md/raid5: Fix livelock when array is both resyncing and degraded.
        md/raid10: round up to bdev_logical_block_size in narrow_write_error.
        md/raid1: round up to bdev_logical_block_size in narrow_write_error
      0d695d6d
    • Linus Torvalds's avatar
      Merge tag 'please-pull-fixmcelog' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras · d96c757e
      Linus Torvalds authored
      Pull mcelog regression fix from Tony Luck:
       "Fix regression - functions on the mce notifier chain should not be
        able to decide that an event should not be logged"
      
      * tag 'please-pull-fixmcelog' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
        x86/mce: Fix regression. All error records should report via /dev/mcelog
      d96c757e
    • Linus Torvalds's avatar
      Merge tag 'docs-fix' of git://git.lwn.net/linux-2.6 · fbe4da49
      Linus Torvalds authored
      Pull DocBook build fix from Jonathan Corbet:
       "Fix the DocBook build failure caused by the move of the i2o subsystem
        to the staging tree"
      
      * tag 'docs-fix' of git://git.lwn.net/linux-2.6:
        Fix docs build failure caused by i2o removal
      fbe4da49
    • Linus Torvalds's avatar
      Merge branch 'for-3.20' of git://linux-nfs.org/~bfields/linux · 533cf7ae
      Linus Torvalds authored
      Pull nfsd bugfixes from Bruce Fields:
       "These are fixes for two bugs introduced during the merge window"
      
      * 'for-3.20' of git://linux-nfs.org/~bfields/linux:
        nfsd4: fix v3-less build
        nfsd: fix comparison in fh_fsid_match()
      533cf7ae
    • NeilBrown's avatar
      md/raid5: Fix livelock when array is both resyncing and degraded. · 26ac1073
      NeilBrown authored
      Commit a7854487:
        md: When RAID5 is dirty, force reconstruct-write instead of read-modify-write.
      
      Causes an RCW cycle to be forced even when the array is degraded.
      A degraded array cannot support RCW as that requires reading all data
      blocks, and one may be missing.
      
      Forcing an RCW when it is not possible causes a live-lock and the code
      spins, repeatedly deciding to do something that cannot succeed.
      
      So change the condition to only force RCW on non-degraded arrays.
      Reported-by: default avatarManibalan P <pmanibalan@amiindia.co.in>
      Bisected-by: default avatarJes Sorensen <Jes.Sorensen@redhat.com>
      Tested-by: default avatarJes Sorensen <Jes.Sorensen@redhat.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      Fixes: a7854487
      Cc: stable@vger.kernel.org (v3.7+)
      26ac1073
    • Linus Torvalds's avatar
      Merge branch 'lazytime' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 03891159
      Linus Torvalds authored
      Pull lazytime mount option support from Al Viro:
       "Lazytime stuff from tytso"
      
      * 'lazytime' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        ext4: add optimization for the lazytime mount option
        vfs: add find_inode_nowait() function
        vfs: add support for a lazytime mount option
      03891159
  5. 17 Feb, 2015 26 commits