1. 28 Jun, 2013 2 commits
    • Akira Takeuchi's avatar
      mn10300: Use early_param() to parse "mem=" parameter · e3f12a53
      Akira Takeuchi authored
      This fixes the problem that "init=" options may not be passed to kernel
      correctly.
      
      parse_mem_cmdline() of mn10300 arch gets rid of "mem=" string from
      redboot_command_line. Then init_setup() parses the "init=" options from
      static_command_line, which is a copy of redboot_command_line, and keeps
      the pointer to the init options in execute_command variable.
      
      Since the commit 026cee00 upstream (params: <level>_initcall-like kernel
      parameters), static_command_line becomes overwritten by saved_command_line at
      do_initcall_level(). Notice that saved_command_line is a command line
      which includes "mem=" string.
      
      As a result, execute_command may point to weird string by the length of
      "mem=" parameter.
      I noticed this problem when using the command line like this:
      
          mem=128M console=ttyS0,115200 init=/bin/sh
      
      Here is the processing flow of command line parameters.
          start_kernel()
            setup_arch(&command_line)
               parse_mem_cmdline(cmdline_p)
                 * strcpy(boot_command_line, redboot_command_line);
                 * Remove "mem=xxx" from redboot_command_line.
                 * *cmdline_p = redboot_command_line;
            setup_command_line(command_line) <-- command_line is redboot_command_line
              * strcpy(saved_command_line, boot_command_line)
              * strcpy(static_command_line, command_line)
            parse_early_param()
              strlcpy(tmp_cmdline, boot_command_line, COMMAND_LINE_SIZE);
              parse_early_options(tmp_cmdline);
                parse_args("early options", cmdline, NULL, 0, 0, 0, do_early_param);
            parse_args("Booting ..", static_command_line, ...);
              init_setup() <-- save the pointer in execute_command
            rest_init()
              kernel_thread(kernel_init, NULL, CLONE_FS | CLONE_SIGHAND);
      
      At this point, execute_command points to "/bin/sh" string.
      
          kernel_init()
            kernel_init_freeable()
              do_basic_setup()
                do_initcalls()
                  do_initcall_level()
                    (*) strcpy(static_command_line, saved_command_line);
      
      Here, execute_command gets to point to "200" string !!
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      e3f12a53
    • Akira Takeuchi's avatar
      mn10300: Allow to pass array name to get_user() · c6dc9f0a
      Akira Takeuchi authored
      This fixes the following compile error:
      
      CC block/scsi_ioctl.o
      block/scsi_ioctl.c: In function 'sg_scsi_ioctl':
      block/scsi_ioctl.c:449: error: invalid initializer
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      c6dc9f0a
  2. 27 Jun, 2013 2 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 98b6ed0f
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Found via trinity:
      
          If you connect up an ipv6 socket to an ipv4 mapped address then an
          ipv6 one, sendmsg() can croak because ip6_sk_dst_check() assumes the
          route cached in the socket is an ipv6 one.  In this case there is an
          ipv4 route attached, so it gets stomped on.
      
          Reported by Dave Jones and Hannes Frederic Sowa, fixed by Eric
          Dumazet.
      
       2) AF_KEY notifications leak some kernel memory to userspace, fix from
          Mathias Krause.
      
       3) DLCI calls __dev_get_by_name() without proper locking, and dlci_del
          doesn't validate that the device being deleted is actually a DLCI
          one.  Fixes from Li Zefan.
      
       4) Length check on bluetooth l2cap information responses is wrong, each
          response type has a different lenth, so we should make sure it's in
          a given range rather than enforce one single valid length.  From
          Jaganath Kanakkassery.
      
       5) Receive FIFO overflow is really easy to trigger in stress scenerios
          in the sh_eth driver, but the event isn't being handled properly at
          all.  Specifically, the mask of error interrupts doesn't include the
          event so we never clear it, resulting in the driver becomming wedged
          processing an interrupt that never gets cleared.
      
          Fix from Sergei Shtylyov.
      
       6) qlcnic sleeps while holding a spinlock, use mdelay() instead of
          msleep().  From Shahed Shaikh.
      
       7) Missing curly braces causes SIP netfilter NAT module to always drop
          packets.  Fix from Balazs Peter Odor.
      
       8) ipt_ULOG in netfilter passes the wrong value to timer setup, causing
          the timer to dereference crap when it fires.  Fix from Gao Feng.
      
       9) Missing RCU protection around txq->axq_acq traversal in
          ath_txq_schedule().  Fix from Felix Fietkau.
      
      10) Idle state transition test in ath9k_htc_config() is reversed, fix
          from Sujith Manoharan.
      
      11) IPV6 forwarding handles unicast Router Alert packets incorrectly.
          It tests the wrong option state.  Previously opt->ra being non-zero
          indicated a router alert marking in the SKB, but now it's indicated
          by a bit in opt->flags.  Fix from YOSHIFUJI Hideaki.
      
      12) SKB leak in GRE tunnel GSO handling, from Eric Dumazet.
      
      13) get_user_pages_fast() error handling in TUN and MACVTAP use the same
          local variable for the base index and the loop iterator for page
          traversal, oops! Fix from Michael S Tsirkin.
      
      14) ipv6_get_lladdr() can fail, and we must therefore check it's return
          value in inet6_set_iftoken().  For from Hannes Frederic Sowa.
      
      15) If you change an interface name and meanwhile can sneak in something
          that looks up the name (like SO_BINDTODEVICE or SIOCGIFNAME) we can
          deadlock with CONFIG_PREEMPT=n.  Fix this by providing a helper
          function that properly uses raw_seqcount_begin().  From Nicolas
          Schichan.
      
      16) Chain noise calibration test is inverted in iwlwifi, fix from
          Nikolay Martynov.
      
      17) Properly set TX iwlwifi descriptor flags for back requests.  Fix
          from Emmanuel Grumbach.
      
      18) We can't assume skb_transport_header() is set in xt_TCPOPTSTRAP
          module, fix from Pablo Neira Ayuso.
      
      19) Some crummy APs don't provide the proper High Throughput info in
          association response frames.  Add a workaround by assume we'll use
          whatever is in the beacon/probe.  Fix from Johannes Berg.
      
      20) mac80211 call to rate_idx_match_mask() swaps two arguments (mask and
          channel width).  Fix from Simon Wunderlich.
      
      21) xt_TCPMSS (like xt_TCPOPTSTRAP) must not try to handle fragmented
          frames.  Fix from Phil Oester.
      
      22) Fix rate control regression causing iwlwifi/iwlegacy chips to use
          1Mbit/s on pre-11n networks.  From Moshe Benji and Stanslaw Gruszka.
      
      23) Disable brcmsmac power-save functions, they cause regressions.  From
          Arend van Spriel.
      
      24) Enforce a sane minimum MTU in l2cap_build_cmd() otherwise we can
          easily crash.  Fix from Anderson Lizardo.
      
      25) If a learning packet arrives during vxlan_stop() we crash, easily
          fixed by checking netif_running().  From Stephen Hemminger.
      
      26) Static vxlan FDB entries should not be migrated, also from Stephen.
      
      27) skb_clone() failures not handled in vxlan_xmit(), oops.  Also from
          Stephen.
      
      28) Add minimal driver for AR816x/AR817x ethernet chips, from Johannes
          Berg.
      
      29) Fix regression in userspace VLAN acceleration control, added by the
          802.1ad support changes.  Fix from Fernando Luis Vazquez Cao.
      
      30) Interval selection for MLD queries in the bridging code was
          reversed.  Fix from Linus Lüssing.
      
      31) ipv6's ndisc_send_redirect() erroneously writes to the packet we
          received not the packet we are building to send out.  Fix from
          Matthias Schiffer.
      
      32) Don't free netdev before unregistering it, in usb_8dev can driver.
          From Marc Kleine-Budde.
      
      33) Fix nl80211 attribute buffer races, from Johannes Berg.
      
      34) Although netlink_diag.h is under uapi/ it isn't present in Kbuild.
          From Stephen Hemminger.
      
      35) Wrong address and family passed to MD5 key lookups in TCP, from
          Aydin Arik.
      
      36) phy_type attribute created by SFC driver should not be writable.
          From Ben Hutchings.
      
      37) Receive/Transmit queue allocations in pxa168_eth and mv643xx_eth
          should use kzalloc().  Otherwise if setup fails half-way, we'll
          dereference garbage when trying to teardown the rings.  From Lubomir
          Rintel.
      
      38) Fix double-allocation of dst (resulting in unfreeable net device) in
          ipv6's init_loopback().  From Gao Feng.
      
      39) Fix fragmentation handling SKB leak in netfilter conntrack, we were
          freeing the wrong skb pointer.  From Phil Oester.
      
      40) Don't report "-1" (SPEED_UNKNOWN) in bond_miimon_commit(), from
          Nikolay Aleksandrov.
      
      41) davinci_cpdma doesn't check for DMA mapping errors, letting the
          device scribble to random addresses.  From Sebastian Siewior.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (69 commits)
        dlci: validate the net device in dlci_del()
        dlci: acquire rtnl_lock before calling __dev_get_by_name()
        af_key: fix info leaks in notify messages
        ipv6: ip6_sk_dst_check() must not assume ipv6 dst
        net: fix kernel deadlock with interface rename and netdev name retrieval.
        net/tg3: Avoid delay during MMIO access
        ipv6: check return value of ipv6_get_lladdr
        macvtap: fix recovery from gup errors
        tun: fix recovery from gup errors
        gre: fix a possible skb leak
        ipv6: Process unicast packet with Router Alert by checking flag in skb.
        ath9k_htc: Handle IDLE state transition properly
        ath9k: fix an RCU issue in calling ieee80211_get_tx_rates
        netfilter: ipt_ULOG: fix incorrect setting of ulog timer
        netfilter: ctnetlink: send event when conntrack label was modified
        netfilter: nf_nat_sip: fix mangling
        qlcnic: Do not sleep while holding spinlock
        drivers: net: cpsw: fix compilation error with cpsw driver
        tcp: doc : fix the syncookies default value
        sh_eth: fix misreporting of transmit abort
        ...
      98b6ed0f
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 1a506e47
      Linus Torvalds authored
      Pull i915 drm fixes from Dave Airlie:
       "These should be the last two fixes for i915, one is for a fence leak
        killing X on some older GPUs, and one is a late regression partial
        revert for an swiotlb/xen/i915 interaction, Konrad has promised to
        figure out the proper answer, and this patch is the best thing to do
        at this stage to avoid regressing"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/i915: make compact dma scatter lists creation work with SWIOTLB backend.
        drm/i915: Restore fences after resume and GPU resets
      1a506e47
  3. 26 Jun, 2013 14 commits
  4. 25 Jun, 2013 18 commits
  5. 24 Jun, 2013 4 commits
    • Aaron Lu's avatar
      libata-acpi: add back ACPI based hotplug functionality · 44521527
      Aaron Lu authored
      Commit 30dcf76a "libata: migrate ACPI code over to new bindings"
      mistakenly dropped the code to register hotplug notificaion handler
      for ATA port/devices, causing regression for people using ATA bay,
      as kernel bug #59871 shows.
      
      Fix this by adding back the hotplug notification handler registration
      code.  Since this code has to be run once and notification needs to
      be installed on every ATA port/devices handle no matter if there is
      actual device attached, we can't do this in binding time for ATA
      device ACPI handle, as the binding only occurs when a SCSI device is
      created, i.e. there is device attached.  So introduce the
      ata_acpi_hotplug_init() function to loop scan all ATA ACPI handles
      and if it is available, install the notificaion handler for it during
      ATA init time.
      
      With the ATA ACPI handle binding to SCSI device tree, it is possible
      now that when the SCSI hotplug work removes the SCSI device, the ACPI
      unbind function will find that the corresponding ACPI device has
      already been deleted by dock driver, causing a scaring message like:
      [  128.263966] scsi 4:0:0:0: Oops, 'acpi_handle' corrupt
      Fix this by waiting for SCSI hotplug task finish in our notificaion
      handler, so that the removal of ACPI device done in ACPI unbind
      function triggered by the removal of SCSI device is run earlier when
      ACPI device is still available.
      
      [rjw: Rebased]
      References: https://bugzilla.kernel.org/show_bug.cgi?id=59871Reported-bisected-and-tested-by: default avatarDirk Griesbach <spamthis@freenet.de>
      Signed-off-by: default avatarAaron Lu <aaron.lu@intel.com>
      Acked-by: default avatarTejun Heo <tj@kernel.org>
      Cc: 3.6+ <stable@vger.kernel.org>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      44521527
    • Rojhalat Ibrahim's avatar
      powerpc/pci: Fix boot panic on mpc83xx (regression) · b37e1613
      Rojhalat Ibrahim authored
      The following commit caused a fatal oops when booting on mpc83xx with
      a non-express PCI bus (regardless of whether a PCI device is present):
      
      commit 50d8f87d
      Author: Rojhalat Ibrahim <imr@rtschenk.de>
      Date:   Mon Apr 8 10:15:28 2013 +0200
      
          powerpc/fsl-pci Make PCIe hotplug work with Freescale PCIe controllers
      
          Up to now the PCIe link status on Freescale PCIe controllers was only
          checked once at boot time. So hotplug did not work. With this patch the
          link status is checked on every config read. PCIe devices not present at
          boot time are found after doing 'echo 1 >/sys/bus/pci/rescan'.
      Signed-off-by: default avatarRojhalat Ibrahim <imr@rtschenk.de>
      Signed-off-by: default avatarKumar Gala <galak@kernel.crashing.org>
      
      This patch fixes the issue by calling setup_indirect_pci for all device types.
      fsl_indirect_read_config is now only used for booke/86xx PCIe controllers.
      Reported-by: default avatarMichael Guntsche <mike@it-loops.com>
      Cc: Scott Wood <scottwood@freescale.com>
      Signed-off-by: default avatarRojhalat Ibrahim <imr@rtschenk.de>
      Signed-off-by: default avatarScott Wood <scottwood@freescale.com>
      b37e1613
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · a3d9dd89
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      The following patchset contains five fixes for Netfilter/IPVS, they are:
      
      * A skb leak fix in fragmentation handling in case that helpers are in place,
        it occurs since the IPV6 NAT infrastructure, from Phil Oester.
      
      * Fix SCTP port mangling in ICMP packets for IPVS, from Julian Anastasov.
      
      * Fix event delivery in ctnetlink regarding the new connlabel infrastructure,
        from Florian Westphal.
      
      * Fix mangling in the SIP NAT helper, from Balazs Peter Odor.
      
      * Fix crash in ipt_ULOG introduced while adding netnamespace support,
        from Gao Feng.
      
      I'll take care of passing several of these patches to -stable once they hit
      Linus' tree.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a3d9dd89
    • John W. Linville's avatar