summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-11-27iov_iter.c: convert copy_from_iter() to iterate_and_advanceAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-27iov_iter.c: get rid of bvec_copy_page_{to,from}_iter()Al Viro
Just have copy_page_{to,from}_iter() fall back to kmap_atomic + copy_{to,from}_iter() + kunmap_atomic() in ITER_BVEC case. As the matter of fact, that's what we want to do for any iov_iter kind that isn't blocking - e.g. ITER_KVEC will also go that way once we recognize it on iov_iter.c primitives level Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-27iov_iter.c: convert iov_iter_zero() to iterate_and_advanceAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-27iov_iter.c: convert iov_iter_get_pages_alloc() to iterate_all_kindsAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-27iov_iter.c: convert iov_iter_get_pages() to iterate_all_kindsAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-27iov_iter.c: convert iov_iter_npages() to iterate_all_kindsAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-27iov_iter.c: iterate_and_advanceAl Viro
same as iterate_all_kinds, but iterator is moved to the position past the last byte we'd handled. iov_iter_advance() converted to it Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-27iov_iter.c: macros for iterating over iov_iterAl Viro
iterate_all_kinds(iter, size, ident, step_iovec, step_bvec) iterates through the ranges covered by iter (up to size bytes total), repeating step_iovec or step_bvec for each of those. ident is declared in expansion of that thing, either as struct iovec or struct bvec, and it contains the range we are currently looking at. step_bvec should be a void expression, step_iovec - a size_t one, with non-zero meaning "stop here, that many bytes from this range left". In the end, the amount actually handled is stored in size. iov_iter_copy_from_user_atomic() and iov_iter_alignment() converted to it. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-27staging: r8188eu: Add new device ID for DLink GO-USB-N150Larry Finger
The DLink GO-USB-N150 with revision B1 uses this driver. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-11-27mac80211: copy chandef from AP vif to VLANsFelix Fietkau
Instead of keeping track of all those special cases where VLAN interfaces have no bss_conf.chandef, just make sure they have the same as the AP interface they belong to. Among others, this fixes a crash getting a VLAN's channel from userspace since a NULL channel is returned as a good result (return value 0) for VLANs since the commit below. Cc: stable@vger.kernel.org [3.18 only] Fixes: c12bc4885f4b3 ("mac80211: return the vif's chandef in ieee80211_cfg_get_channel()") Signed-off-by: Felix Fietkau <nbd@openwrt.org> [rewrite commit log] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2014-11-27nl80211: don't crash sending invalid chandefJohannes Berg
One of the cases for an invalid channel definition is that the channel pointer is NULL, in which case the warning is a bit late since we'll dereference the pointer. Bail out of the function upon warning about this. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2014-11-27MIPS: tlbex: Fix potential HTW race on TLBL/M/S handlersLeonid Yegoshin
There is a potential race when probing the TLB in TLBL/M/S exception handlers for a matching entry. Between the time we hit a TLBL/S/M exception and the time we get to execute the TLBP instruction, the HTW may have replaced the TLB entry we are interested in hence the TLB probe may fail. However, in the existing handlers, we never checked the status of the TLBP (ie check the result in the C0/Index register). We fix this by adding such a check when the core implements the HTW. If we couldn't find a matching entry, we return back and try again. Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> Reviewed-by: James Hogan <james.hogan@imgtec.com> Cc: <stable@vger.kernel.org> # v3.17+ Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8599/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2014-11-27ARM: 8226/1: cacheflush: get rid of restarting blockVladimir Murzin
We cannot restart cacheflush safely if a process provides user-defined signal handler and signal is pending. In this case -EINTR is returned and it is expected that process re-invokes syscall. However, there are a few problems with that: * looks like nobody bothers checking return value from cacheflush * but if it did, we don't provide the restart address for that, so the process has to use the same range again * ...and again, what might lead to looping forever So, remove cacheflush restarting code and terminate cache flushing as early as fatal signal is pending. Cc: stable@vger.kernel.org # 3.12+ Reported-by: Chanho Min <chanho.min@lge.com> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Acked-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2014-11-27ARM: 8222/1: mvebu: enable strex backoff delayThomas Petazzoni
Under extremely rare conditions, in an MPCore node consisting of at least 3 CPUs, two CPUs trying to perform a STREX to data on the same shared cache line can enter a livelock situation. This patch enables the HW mechanism that overcomes the bug. This fixes the incorrect setup of the STREX backoff delay bit due to a wrong description in the specification. Note that enabling the STREX backoff delay mechanism is done by leaving the bit *cleared*, while the bit was currently being set by the proc-v7.S code. [Thomas: adapt to latest mainline, slightly reword the commit log, add stable markers.] Fixes: de4901933f6d ("arm: mm: Add support for PJ4B cpu and init routines") Cc: <stable@vger.kernel.org> # v3.8+ Signed-off-by: Nadav Haklai <nadavh@marvell.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com> Acked-by: Jason Cooper <jason@lakedaemon.net> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2014-11-27Merge tag 'mvebu-fixes-3.18-2' of git://git.infradead.org/linux-mvebu into fixesArnd Bergmann
Pull "mvebu fixes for v3.18 (round 2)" frm Jason Cooper: - mvebu - coherency.c needed an of_node_put() * tag 'mvebu-fixes-3.18-2' of git://git.infradead.org/linux-mvebu: ARM: mvebu: add missing of_node_put() call in coherency.c Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-11-27Merge tag 'samsung-defconfig-v3.18' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes Pull "Samsung defconfig update for v3.18" from Kukjin Kim: - enable max77802 rtc and clock drivers for exynos_defconfig : enable the kernel config options to have the drivers for max77802 including rtc and 2-ch 32kHz clock outputs * tag 'samsung-defconfig-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: exynos_defconfig: Enable max77802 rtc and clock drivers Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-11-27Merge tag 'samsung-fixes-v3.18' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes Pull "Samsung fixes for v3.18" from Kukjin Kim: - explicitly set dr_mode on exynos5250-snow this is required when kernel is built with USB gadget support. * tag 'samsung-fixes-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: dts: Explicitly set dr_mode on exynos5250-snow Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-11-27ARM: tegra: irq: fix buggy usage of irq_data irq fieldMarc Zyngier
The crazy gic_arch_extn thing that Tegra uses contains multiple references to the irq field in struct irq_data, and uses this to directly poke hardware register. But irq is the *virtual* irq number, something that has nothing to do with the actual HW irq (stored in the hwirq field). And once we put the stacked domain code in action, the whole thing explodes, as these two values are *very* different: root@bacon-fat:~# cat /proc/interrupts CPU0 CPU1 16: 25801 2075 GIC 29 twd 17: 0 0 GIC 73 timer0 112: 0 0 GPIO 58 c8000600.sdhci cd 123: 0 0 GPIO 69 c8000200.sdhci cd 279: 1126 0 GIC 122 serial 281: 0 0 GIC 70 7000c000.i2c 282: 0 0 GIC 116 7000c400.i2c 283: 0 0 GIC 124 7000c500.i2c 284: 300 0 GIC 85 7000d000.i2c [...] Just replacing all instances of irq with hwirq fixes the issue. Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Acked-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-11-27netfilter: combine IPv4 and IPv6 nf_nat_redirect code in one modulePablo Neira Ayuso
This resolves linking problems with CONFIG_IPV6=n: net/built-in.o: In function `redirect_tg6': xt_REDIRECT.c:(.text+0x6d021): undefined reference to `nf_nat_redirect_ipv6' Reported-by: Andreas Ruprecht <rupran@einserver.de> Reported-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-11-27netfilter: nf_tables_bridge: set the pktinfo for IPv4/IPv6 trafficAlvaro Neira
This patch adds the missing bits to allow to match per meta l4proto from the bridge. Example: nft add rule bridge filter input ether type {ip, ip6} meta l4proto udp counter Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-11-27netfilter: nf_tables_bridge: export nft_reject_ip*hdr_validate functionsAlvaro Neira
This patch exports the functions nft_reject_iphdr_validate and nft_reject_ip6hdr_validate to use it in follow up patches. These functions check if the IPv4/IPv6 header is correct. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-11-27netfilter: conntrack: avoid zeroing timerFlorian Westphal
add a __nfct_init_offset annotation member to struct nf_conn to make it clear which members are covered by the memset when the conntrack is allocated. This avoids zeroing timer_list and ct_net; both are already inited explicitly. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-11-27netfilter: xt_recent: relax ip_pkt_list_tot restrictionsFlorian Westphal
The maximum value for the hitcount parameter is given by "ip_pkt_list_tot" parameter (default: 20). Exceeding this value on the command line will cause the rule to be rejected. The parameter is also readonly, i.e. it cannot be changed without module unload or reboot. Store size per table, then base nstamps[] size on the hitcount instead. The module parameter is retained for backwards compatibility. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-11-27Bluetooth: Automatically flushable packets aren't allowed on LE linksSteven Walter
The Bluetooth spec states that automatically flushable packets may not be sent over a LE-U link. Signed-off-by: Steven Walter <stevenrwalter@gmail.com> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2014-11-27Merge branch 'drm-fixes-3.18' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie
into drm-fixes one fix for PX laptops. * 'drm-fixes-3.18' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: report disconnected for LVDS/eDP with PX if ddc fails
2014-11-26drm/radeon: report disconnected for LVDS/eDP with PX if ddc failsAlex Deucher
If ddc fails, presumably the i2c mux (and hopefully the signal mux) are switched to the other GPU so don't fetch the edid from the vbios so that the connector reports disconnected. bug: https://bugzilla.opensuse.org/show_bug.cgi?id=904417 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-11-27powerpc: 32 bit getcpu VDSO function uses 64 bit instructionsAnton Blanchard
I used some 64 bit instructions when adding the 32 bit getcpu VDSO function. Fix it. Fixes: 18ad51dd342a ("powerpc: Add VDSO version of getcpu") Cc: stable@vger.kernel.org Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-11-27powerpc/powernv: Replace OPAL_DEASSERT_RESET with EEH_RESET_DEACTIVATEGavin Shan
The flag passed to ioda_eeh_phb_reset() should be EEH_RESET_DEACTIVATE, which is translated to OPAL_DEASSERT_RESET or something else by the EEH backend accordingly. The patch replaces OPAL_DEASSERT_RESET with EEH_RESET_DEACTIVATE for ioda_eeh_phb_reset(). Cc: stable@vger.kernel.org Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-11-27powerpc/eeh: Fix PE state formatGavin Shan
Obviously I had wrong format given to the PE state output from /sys/bus/pci/devices/xxxx/eeh_pe_state with some typoes, which was introduced by commit 2013add4ce73. The patch fixes it up. Fixes: 2013add4ce73 ("powerpc/eeh: Show hex prefix for PE state sysfs") Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-11-27powerpc/pseries: Fix endiannes issue in RTAS call from xmonLaurent Dufour
On pseries system (LPAR) xmon failed to enter when running in LE mode, system is hunging. Inititating xmon will lead to such an output on the console: SysRq : Entering xmon cpu 0x15: Vector: 0 at [c0000003f39ffb10] pc: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70 lr: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70 sp: c0000003f39ffc70 msr: 8000000000009033 current = 0xc0000003fafa7180 paca = 0xc000000007d75e80 softe: 0 irq_happened: 0x01 pid = 14617, comm = bash Bad kernel stack pointer fafb4b0 at eca7cc4 cpu 0x15: Vector: 300 (Data Access) at [c000000007f07d40] pc: 000000000eca7cc4 lr: 000000000eca7c44 sp: fafb4b0 msr: 8000000000001000 dar: 10000000 dsisr: 42000000 current = 0xc0000003fafa7180 paca = 0xc000000007d75e80 softe: 0 irq_happened: 0x01 pid = 14617, comm = bash cpu 0x15: Exception 300 (Data Access) in xmon, returning to main loop xmon: WARNING: bad recursive fault on cpu 0x15 The root cause is that xmon is calling RTAS to turn off the surveillance when entering xmon, and RTAS is requiring big endian parameters. This patch is byte swapping the RTAS arguments when running in LE mode. Cc: stable@vger.kernel.org Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-11-27powerpc/powernv: Fix the hmi event version check.Mahesh Salgaonkar
The current HMI event structure is an ABI and carries a version field to accommodate future changes without affecting/rearranging current structure members that are valid for previous versions. The current version check "if (hmi_evt->version != OpalHMIEvt_V1)" doesn't accomodate the fact that the version number may change in future. If firmware starts returning an HMI event with version > 1, this check will fail and no HMI information will be printed on older kernels. This patch fixes this issue. Cc: stable@vger.kernel.org # 3.17+ Signed-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com> [mpe: Reword changelog] Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-11-26staging: r8188eu: Fix scheduling while atomic error introduced in commit ↵Larry Finger
fadbe0cd In commit fadbe0cd5292851608e2e01b91d9295fa287b9fe entitled "staging: rtl8188eu:Remove rtw_zmalloc(), wrapper for kzalloc()", the author failed to note that the original code in the wrapper tested whether the caller could sleep, and set the flags argument to kzalloc() appropriately. After the patch, GFP_KERNEL is used unconditionally. Unfortunately, several of the routines may be entered from an interrupt routine and generate a BUG splat for every such call. Routine rtw_sitesurvey_cmd() is used in the example below: BUG: sleeping function called from invalid context at mm/slub.c:1240 in_atomic(): 1, irqs_disabled(): 0, pid: 756, name: wpa_supplicant INFO: lockdep is turned off. CPU: 2 PID: 756 Comm: wpa_supplicant Tainted: G WC O 3.18.0-rc4+ #34 Hardware name: TOSHIBA TECRA A50-A/TECRA A50-A, BIOS Version 4.20 04/17/2014 ffffc90005557000 ffff880216fafaa8 ffffffff816b0bbf 0000000000000000 ffff8800c3b58000 ffff880216fafac8 ffffffff8107af77 0000000000000001 0000000000000010 ffff880216fafb18 ffffffff811b06ce 0000000000000000 Call Trace: [<ffffffff816b0bbf>] dump_stack+0x4e/0x71 [<ffffffff8107af77>] __might_sleep+0xf7/0x120 [<ffffffff811b06ce>] kmem_cache_alloc_trace+0x4e/0x1f0 [<ffffffffa0888226>] ? rtw_sitesurvey_cmd+0x56/0x2a0 [r8188eu] [<ffffffffa0888226>] rtw_sitesurvey_cmd+0x56/0x2a0 [r8188eu] [<ffffffffa088f00d>] rtw_do_join+0x22d/0x370 [r8188eu] [<ffffffffa088f6e8>] rtw_set_802_11_ssid+0x218/0x3d0 [r8188eu] [<ffffffffa08c3ca5>] rtw_wx_set_essid+0x1e5/0x410 [r8188eu] [<ffffffffa08c3ac0>] ? rtw_wx_get_rate+0x50/0x50 [r8188eu] [<ffffffff816938f1>] ioctl_standard_iw_point+0x151/0x3f0 [<ffffffff81693d52>] ioctl_standard_call+0xb2/0xe0 [<ffffffff81597df7>] ? rtnl_lock+0x17/0x20 [<ffffffff816945a0>] ? iw_handler_get_private+0x70/0x70 [<ffffffff81693ca0>] ? call_commit_handler+0x40/0x40 [<ffffffff81693256>] wireless_process_ioctl+0x176/0x1c0 [<ffffffff81693e79>] wext_handle_ioctl+0x69/0xc0 [<ffffffff8159fe79>] dev_ioctl+0x309/0x5e0 [<ffffffff810be9c7>] ? call_rcu+0x17/0x20 [<ffffffff8156a472>] sock_ioctl+0x142/0x2e0 [<ffffffff811e0c70>] do_vfs_ioctl+0x300/0x520 [<ffffffff81101514>] ? __audit_syscall_entry+0xb4/0x110 [<ffffffff81101514>] ? __audit_syscall_entry+0xb4/0x110 [<ffffffff810102bc>] ? do_audit_syscall_entry+0x6c/0x70 [<ffffffff811e0f11>] SyS_ioctl+0x81/0xa0 [<ffffffff816ba1d2>] system_call_fastpath+0x12/0x17 Additional routines that generate this BUG are rtw_joinbss_cmd(), rtw_dynamic_chk_wk_cmd(), rtw_lps_ctrl_wk_cmd(), rtw_rpt_timer_cfg_cmd(), rtw_ps_cmd(), report_survey_event(), report_join_res(), survey_timer_hdl(), and rtw_check_bcn_info(). Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: navin patidar <navin.patidar@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-11-26Merge tag 'master-2014-11-25' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless John W. Linville says: ==================== pull request: wireless 2014-11-26 Please pull this little batch of fixes intended for the 3.18 stream... For the iwlwifi one, Emmanuel says: "Not all the firmware know how to handle the HOT_SPOT_CMD. Make sure that the firmware will know this command before sending it. This avoids a firmware crash." Along with that, Larry sends a pair of rtlwifi fixes to address some discrepancies from moving drivers out of staging. Larry says: "These two patches are needed to fix a regression introduced when driver rtl8821ae was moved from staging to the regular wireless tree." Please let me know if there are problems! ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26sparc: Add NOP dma_cache_sync() implementation.David S. Miller
This can be a NOP because we forward dma_{alloc,free}_noncoherent to dma_{alloc,free}_coherent. Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socksWillem de Bruijn
TCP timestamping introduced MSG_ERRQUEUE handling for TCP sockets. If the socket is of family AF_INET6, call ipv6_recv_error instead of ip_recv_error. This change is more complex than a single branch due to the loadable ipv6 module. It reuses a pre-existing indirect function call from ping. The ping code is safe to call, because it is part of the core ipv6 module and always present when AF_INET6 sockets are active. Fixes: 4ed2d765 (net-timestamp: TCP timestamping) Signed-off-by: Willem de Bruijn <willemb@google.com> ---- It may also be worthwhile to add WARN_ON_ONCE(sk->family == AF_INET6) to ip_recv_error. Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26Merge branch 'bridge_nl_validation'David S. Miller
Thomas Graf says: ==================== bridge: Fix missing Netlink message validations Adds various missing length checks in the bridging code for Netlink messages and corresponding attributes provided by user space. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26bridge: Sanitize IFLA_EXT_MASK for AF_BRIDGE:RTM_GETLINKThomas Graf
Only search for IFLA_EXT_MASK if the message actually carries a ifinfomsg header and validate minimal length requirements for IFLA_EXT_MASK. Fixes: 6cbdceeb ("bridge: Dump vlan information from a bridge port") Cc: Vlad Yasevich <vyasevic@redhat.com> Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26bridge: Add missing policy entry for IFLA_BRPORT_FAST_LEAVEThomas Graf
Fixes: c2d3babf ("bridge: implement multicast fast leave") Cc: David S. Miller <davem@davemloft.net> Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26net: Check for presence of IFLA_AF_SPECThomas Graf
ndo_bridge_setlink() is currently only called on the slave if IFLA_AF_SPEC is set but this is a very fragile assumption and may change in the future. Cc: Ajit Khaparde <ajit.khaparde@emulex.com> Cc: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: Thomas Graf <tgraf@suug.ch> Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26net: Validate IFLA_BRIDGE_MODE attribute lengthThomas Graf
Payload is currently accessed blindly and may exceed valid message boundaries. Fixes: a77dcb8c8 ("be2net: set and query VEB/VEPA mode of the PF interface") Fixes: 815cccbf1 ("ixgbe: add setlink, getlink support to ixgbe and ixgbevf") Cc: Ajit Khaparde <ajit.khaparde@emulex.com> Cc: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: Thomas Graf <tgraf@suug.ch> Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Acked-by: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26bridge: Validate IFLA_BRIDGE_FLAGS attribute lengthThomas Graf
Payload is currently accessed blindly and may exceed valid message boundaries. Fixes: 407af3299 ("bridge: Add netlink interface to configure vlans on bridge ports") Cc: Vlad Yasevich <vyasevic@redhat.com> Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26sky2: Fix crash inside sky2_rx_cleanMirko Lindner
If sky2->tx_le = pci_alloc_consistent() or sky2->tx_ring = kcalloc() in sky2_alloc_buffers() fails, sky2->rx_ring = kcalloc() will never be called. In this error case handling, sky2_rx_clean() is called from within sky2_free_buffers(). In sky2_rx_clean() we find the following: ... memset(sky2->rx_le, 0, RX_LE_BYTES); ... This results in a memset using a NULL pointer and will crash the system. Signed-off-by: Mirko Lindner <mlindner@marvell.com> Acked-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26ipvlan: fix sparse warningsMahesh Bandewar
Fix sparse warnings reported by kbuild robot drivers/net/ipvlan/ipvlan_main.c:172:13: warning: symbol 'ipvlan_start_xmit' was not declared. Should it be static? drivers/net/ipvlan/ipvlan_main.c:256:33: warning: incorrect type in initializer (different address spaces) drivers/net/ipvlan/ipvlan_main.c:256:33: expected void const [noderef] <asn:3>*__vpp_verify drivers/net/ipvlan/ipvlan_main.c:256:33: got struct ipvl_pcpu_stats *<noident> drivers/net/ipvlan/ipvlan_main.c:544:5: warning: symbol 'ipvlan_link_register' was not declared. Should it be static Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Mahesh Bandewar <maheshb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26Merge branch 'bcmgenet_eee'David S. Miller
Florian Fainelli says: ==================== net: bcmgenet: EEE support This patch series add EEE support to the Broadcom GENET driver, first patch basically adds register definitions for the hardware, the second patch does the actual implementation and hooks the {get,set}_eee ethtool callbacks, the last patch adds auto-negotiation restart capability. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26net: bcmgenet: support restarting auto-negotiationFlorian Fainelli
Hook a nway_reset ethtool callback to allow restarting the auto-negotiation process when asked to. We defer to the PHY library call to do the heavy lifting. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26net: bcmgenet: add EEE supportFlorian Fainelli
Allow enabling and disabling EEE using the designated ethtool getters and setters. GENET allows controlling EEE at the UniMAC, RBUF and TBUF levels. We also take care of restoring EEE after a suspend/resume cycle if it was enabled prior to suspending. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26net: bcmgenet: add register definitions for EEEFlorian Fainelli
Add register definitions to control EEE in the UniMAC, RBUF and TBUF register ranges. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26cfg80211: clean up beacon loss CQM eventJohannes Berg
Having it as a sub-event for RSSI thresholds is very ugly, but luckily no userspace actually uses the events yet. Move the event to its own function call internally and to its own event attribute in nl80211. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2014-11-26Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm fixes from Paolo Bonzini: "Last minute KVM/ARM fixes; even the generic change actually affects nothing but ARM" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvm: fix kvm_is_mmio_pfn() and rename to kvm_is_reserved_pfn() arm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn() arm/arm64: KVM: vgic: Fix error code in kvm_vgic_create() arm64: KVM: Handle traps of ICC_SRE_EL1 as RAZ/WI arm64: KVM: fix unmapping with 48-bit VAs
2014-11-26Merge tag 'iio-fixes-for-3.18c' of ↵Greg Kroah-Hartman
git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: Third set of IIO fixes for the 3.18 cycle. Most of these are fairly standard little fixes, a bmc150 and bmg160 patch is to make an ABI change to indicated a specific axis in an event rather than the generic option in the original drivers. As both of these drivers are new in this cycle it would be ideal to push this minor change through even though it isn't strictly a fix. A couple of other 'fixes' change defaults for some settings on these new drivers to more intuitive calues. Looks like some useful feedback has been coming in for this driver since it was applied. * IIO_EVENT_CODE_EXTRACT_DIR bit mask was wrong and has been for a while 0xCF clearly doesn't give a contiguous bitmask. * kxcjk-1013 range setting was failing to mask out the previous value in the register and hence was 'enable only'. * men_z188 device id table wasn't null terminated. * bmg160 and bmc150 both failed to correctly handling an error in mode setting. * bmg160 and bmc150 both had a bug in setting the event direction in the event spec (leads to an attribute name being incorrect) * bmg160 defaulted to an open drain output for the interrupt - as a default this obviously only works with some interrupt chips - hence change the default to push-pull (note this is a new driver so we aren't going to cause any regressions with this change). * bmc150 had an unintuitive default for the rate of change (motion detector) so change it to 0 (new driver so change of default won't cause any regressions).