summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-02-13net: ethernet: ti: remove redundant NULL check.Cyril Roelandt
cpdma_chan_destroy() on a NULL pointer is a no-op, so the NULL check in cpdma_ctlr_destroy() can safely be removed. Signed-off-by: Cyril Roelandt <tipecaml@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13batman-adv: Fix NULL pointer dereference in DAT hash collision avoidancePau Koning
An entry in DAT with the hashed position of 0 can cause a NULL pointer dereference when the first entry is checked by batadv_choose_next_candidate. This first candidate automatically has the max value of 0 and the max_orig_node of NULL. Not checking max_orig_node for NULL in batadv_is_orig_node_eligible will lead to a NULL pointer dereference when checking for the lowest address. This problem was added in 785ea1144182c341b8b85b0f8180291839d176a8 ("batman-adv: Distributed ARP Table - create DHT helper functions"). Signed-off-by: Pau Koning <paukoning@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13net/macb: fix race with RX interrupt while doing NAPINicolas Ferre
When interrupts are disabled, an RX condition can occur but it is not reported when enabling interrupts again. We need to check RSR and use napi_reschedule() if condition is met. Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13atl1c: add error checking for pci_map_single functionsHuang, Xiong
it is reported that code hit DMA-API errors on 3.8-rc6+, (see https://bugzilla.redhat.com/show_bug.cgi?id=908436, and https://bugzilla.redhat.com/show_bug.cgi?id=908550) this patch just adds error handler for pci_map_single and skb_frag_dma_map. Signed-off-by: xiong <xiong@qca.qualcomm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13net: Fix possible wrong checksum generation.Pravin B Shelar
Patch cef401de7be8c4e (net: fix possible wrong checksum generation) fixed wrong checksum calculation but it broke TSO by defining new GSO type but not a netdev feature for that type. net_gso_ok() would not allow hardware checksum/segmentation offload of such packets without the feature. Following patch fixes TSO and wrong checksum. This patch uses same logic that Eric Dumazet used. Patch introduces new flag SKBTX_SHARED_FRAG if at least one frag can be modified by the user. but SKBTX_SHARED_FRAG flag is kept in skb shared info tx_flags rather than gso_type. tx_flags is better compared to gso_type since we can have skb with shared frag without gso packet. It does not link SHARED_FRAG to GSO, So there is no need to define netdev feature for this. Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13Merge branch 'tcp_tsoffset'David S. Miller
Andrey Vagin says: ==================== If a TCP socket will get live-migrated from one box to another the timestamps (which are typically ON) will get screwed up -- the new kernel will generate TS values that has nothing to do with what they were on dump. The solution is to yet again fix the kernel and put a "timestamp offset" on a socket. A socket offset is added in places where externally visible tcp timestamp option is parsed/initialized. Connections in the SYN_RECV state are not supported, global tcp_time_stamp is used for them, because repair mode doesn't support this state. In a future it can be implemented by the similar way as for TIME_WAIT sockets. For time-wait sockets offset is inhereted by a proper tcp_sock. A per-socket offset can be set only for sockets in repair mode. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13tcp: send packets with a socket timestampAndrey Vagin
A socket timestamp is a sum of the global tcp_time_stamp and a per-socket offset. A socket offset is added in places where externally visible tcp timestamp option is parsed/initialized. Connections in the SYN_RECV state are not supported, global tcp_time_stamp is used for them, because repair mode doesn't support this state. In a future it can be implemented by the similar way as for TIME_WAIT sockets. Cc: "David S. Miller" <davem@davemloft.net> Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Cc: James Morris <jmorris@namei.org> Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org> Cc: Patrick McHardy <kaber@trash.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Pavel Emelyanov <xemul@parallels.com> Signed-off-by: Andrey Vagin <avagin@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13tcp: set and get per-socket timestampAndrey Vagin
A timestamp can be set, only if a socket is in the repair mode. This patch adds a new socket option TCP_TIMESTAMP, which allows to get and set current tcp times stamp. Cc: "David S. Miller" <davem@davemloft.net> Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Cc: James Morris <jmorris@namei.org> Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org> Cc: Patrick McHardy <kaber@trash.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Pavel Emelyanov <xemul@parallels.com> Signed-off-by: Andrey Vagin <avagin@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13tcp: adding a per-socket timestamp offsetAndrey Vagin
This functionality is used for restoring tcp sockets. A tcp timestamp depends on how long a system has been running, so it's differ for each host. The solution is to set a per-socket offset. A per-socket offset for a TIME_WAIT socket is inherited from a proper tcp socket. tcp_request_sock doesn't have a timestamp offset, because the repair mode for them are not implemented. Cc: "David S. Miller" <davem@davemloft.net> Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Cc: James Morris <jmorris@namei.org> Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org> Cc: Patrick McHardy <kaber@trash.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Pavel Emelyanov <xemul@parallels.com> Signed-off-by: Andrey Vagin <avagin@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13Merge branch 'gfar-ethtool-atomic' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux Paul Gortmaker says: ==================== Eric noticed that the handling of local u64 ethtool counters for this driver commonly found on Freescale ppc-32 boards was racy. However, before converting them over to atomic64_t, I noticed that an internal struct was being used to determine the offsets for exporting this data into the ethtool buffer, and in doing so, it assumed that the counters would always be u64. Rather than keep this implicit assumption, a simple code cleanup gets rid of the struct completely, and leaves less conversion sites. The alternative solution would have been to take advantage of the fact that the counters are all relating to error conditions, and hence make them internally u32. In doing so, we'd be assuming that U32_MAX of any particular error condition is highly unlikely. This might have made sense if any increments were in a hot path. Tested with "ethtool -S eth0" on sbc8548 board. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13netpoll: fix smatch warnings in netpoll core codeNeil Horman
Dan Carpenter contacted me with some notes regarding some smatch warnings in the netpoll code, some of which I introduced with my recent netpoll locking fixes, some which were there prior. Specifically they were: net-next/net/core/netpoll.c:243 netpoll_poll_dev() warn: inconsistent returns mutex:&ni->dev_lock: locked (213,217) unlocked (210,243) net-next/net/core/netpoll.c:706 netpoll_neigh_reply() warn: potential pointer math issue ('skb_transport_header(send_skb)' is a 128 bit pointer) This patch corrects the locking imbalance (the first error), and adds some parenthesis to correct the second error. Tested by myself. Applies to net-next Signed-off-by: Neil Horman <nhorman@tuxdriver.com> CC: Dan Carpenter <dan.carpenter@oracle.com> CC: "David S. Miller" <davem@davemloft.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13net: skbuff: fix compile error in skb_panic()James Hogan
I get the following build error on next-20130213 due to the following commit: commit f05de73bf82fbbc00265c06d12efb7273f7dc54a ("skbuff: create skb_panic() function and its wrappers"). It adds an argument called panic to a function that uses the BUG() macro which tries to call panic, but the argument masks the panic() function declaration, resulting in the following error (gcc 4.2.4): net/core/skbuff.c In function 'skb_panic': net/core/skbuff.c +126 : error: called object 'panic' is not a function This is fixed by renaming the argument to msg. Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Jean Sacren <sakiwit@gmail.com> Cc: Jiri Pirko <jiri@resnulli.us> Cc: David S. Miller <davem@davemloft.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-13ACPI / hotplug: Fix concurrency issues and memory leaksRafael J. Wysocki
This changeset is aimed at fixing a few different but related problems in the ACPI hotplug infrastructure. First of all, since notify handlers may be run in parallel with acpi_bus_scan(), acpi_bus_trim() and acpi_bus_hot_remove_device() and some of them are installed for ACPI handles that have no struct acpi_device objects attached (i.e. before those objects are created), those notify handlers have to take acpi_scan_lock to prevent races from taking place (e.g. a struct acpi_device is found to be present for the given ACPI handle, but right after that it is removed by acpi_bus_trim() running in parallel to the given notify handler). Moreover, since some of them call acpi_bus_scan() and acpi_bus_trim(), this leads to the conclusion that acpi_scan_lock should be acquired by the callers of these two funtions rather by these functions themselves. For these reasons, make all notify handlers that can handle device addition and eject events take acpi_scan_lock and remove the acpi_scan_lock locking from acpi_bus_scan() and acpi_bus_trim(). Accordingly, update all of their users to make sure that they are always called under acpi_scan_lock. Furthermore, since eject operations are carried out asynchronously with respect to the notify events that trigger them, with the help of acpi_bus_hot_remove_device(), even if notify handlers take the ACPI scan lock, it still is possible that, for example, acpi_bus_trim() will run between acpi_bus_hot_remove_device() and the notify handler that scheduled its execution and that acpi_bus_trim() will remove the device node passed to acpi_bus_hot_remove_device() for ejection. In that case, the struct acpi_device object obtained by acpi_bus_hot_remove_device() will be invalid and not-so-funny things will ensue. To protect agaist that, make the users of acpi_bus_hot_remove_device() run get_device() on ACPI device node objects that are about to be passed to it and make acpi_bus_hot_remove_device() run put_device() on them and check if their ACPI handles are not NULL (make acpi_device_unregister() clear the device nodes' ACPI handles for that check to work). Finally, observe that acpi_os_hotplug_execute() actually can fail, in which case its caller ought to free memory allocated for the context object to prevent leaks from happening. It also needs to run put_device() on the device node that it ran get_device() on previously in that case. Modify the code accordingly. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Yinghai Lu <yinghai@kernel.org>
2013-02-13cfg80211: configuration for WoWLAN over TCPJohannes Berg
Intel Wireless devices are able to make a TCP connection after suspending, sending some data and waking up when the connection receives wakeup data (or breaks). Add the WoWLAN configuration and feature advertising API for it. Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-02-13regulator: tps51632: Use regulator_[get|set]_voltage_sel_regmapAxel Lin
Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Laxman Dewangan <ldewangan@nvidia.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2013-02-13regulator: as3711: Fix checking if no platform initialization dataAxel Lin
To skip registering regulator if no platform initialization data, we should check reg_data rather than ri->desc.name. Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2013-02-13regulator: s5m8767: Prevent possible NULL pointer dereferenceAxel Lin
s5m8767_pmic_dt_parse_pdata dereferenes pdata, thus check pdata earlier to avoid NULL pointer dereference. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2013-02-13regulator: s5m8767: Fix dev argument for devm_kzalloc and ↵Axel Lin
of_get_regulator_init_data Use &pdev->dev rather than iodev->dev for devm_kzalloc() and of_get_regulator_init_data(), this fixes memory leak. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2013-02-13ACPI: Remove the use of CONFIG_ACPI_CONTAINER_MODULEToshi Kani
config ACPI_CONTAINER has been changed to bool (y/n), and its module option is no longer valid. So, remove the use of CONFIG_ACPI_CONTAINER_MODULE. Signed-off-by: Toshi Kani <toshi.kani@hp.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-02-13ACPI / scan: Full transition to D3cold in acpi_device_unregister()Rafael J. Wysocki
In order to drop reference counts of all power resources used by an ACPI device node being removed, acpi_device_unregister() calls acpi_power_transition(device, ACPI_STATE_D3_COLD), which effectively transitions the device node into D3cold if it uses any power resources. However, for some device nodes it may not be appropriate to remove power from them entirely before putting them into D3hot before. On the other hand, executing _PS3 for devices that don't use power resources before removing them shouldn't really hurt. In fact, that is done by acpi_bus_hot_remove_device(), but this is not the right place to do it, because the bus trimming may have caused power to be removed from the device node in question already before. For these reasons, make acpi_device_unregister() carry out full power-off transition for all device nodes supporting that and remove the direct evaluation of _PS3 from acpi_bus_hot_remove_device(). Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-02-13ACPI / scan: Make acpi_bus_hot_remove_device() acquire the scan lockRafael J. Wysocki
The ACPI scan lock has been introduced to prevent acpi_bus_scan() and acpi_bus_trim() from running in parallel with each other for overlapping ACPI namespace scopes. However, it is not sufficient to do that, because if acpi_bus_scan() is run (for an overlapping namespace scope) right after the acpi_bus_trim() in acpi_bus_hot_remove_device(), the subsequent eject will remove devices without removing the corresponding struct acpi_device objects (and possibly companion "physical" device objects). Therefore acpi_bus_hot_remove_device() has to acquire the scan lock before carrying out the bus trimming and hold it through the evaluation of _EJ0, so make that happen. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Toshi Kani <toshi.kani@hp.com>
2013-02-13ACPI: Drop the container.h header fileRafael J. Wysocki
The include/acpi/container.h only contains a definition of a structure that is not used any more, so drop it entirely. Similar change was proposed earlier by Toshi Kani. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Toshi Kani <toshi.kani@hp.com>
2013-02-13ACPI / Documentation: refer to correct file for acpi_platform_device_ids[] tableMika Westerberg
When the ACPI platform device code was converted to the new ACPI scan handler facility, the the acpi_platform_device_ids[] was moved to drivers/acpi/acpi_platform.c. Update the documentation accordingly. Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-02-13ACPI / scan: Make container driver use struct acpi_scan_handlerRafael J. Wysocki
Make the ACPI container driver use struct acpi_scan_handler for representing the object used to initialize ACPI containers and remove the ACPI driver structure used previously and the data structures created by it, since in fact they were not used for any purpose. This simplifies the code and reduces the kernel's memory footprint by avoiding the registration of a struct device_driver object with the driver core and creation of its sysfs directory which is unnecessary. In addition to that, make the namespace walk callback used for installing the notify handlers for ACPI containers more straightforward. This change includes fixes from Toshi Kani. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Yinghai Lu <yinghai@kernel.org> Acked-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com> Tested-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com> Reviewed-by: Toshi Kani <toshi.kani@hp.com> Tested-by: Toshi Kani <toshi.kani@hp.com>
2013-02-13ACPI / scan: Remove useless #ifndef from acpi_eject_store()Rafael J. Wysocki
Since the FORCE_EJECT symbol is never defined, the #ifndef FORCE_EJECT in acpi_eject_store() is always true, so drop it. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com> Tested-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com> Reviewed-by: Toshi Kani <toshi.kani@hp.com> Tested-by: Toshi Kani <toshi.kani@hp.com>
2013-02-13ACPI: Unbind ACPI drv when probe failedToshi Kani
When acpi_device_install_notify_handler() failed in acpi_device_probe(), it calls acpi_drv->ops.remove() and fails the probe. However, the ACPI driver is left bound to the acpi_device. Fix it by clearing the driver and driver_data fields. Signed-off-by: Toshi Kani <toshi.kani@hp.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-02-13ACPI: sysfs eject support for ACPI scan handlersToshi Kani
Changed sysfs eject, acpi_eject_store(), so that it doesn't return error codes for devices nodes with ACPI scan handlers attached and no ACPI drivers. [rjw: Changelog] Signed-off-by: Toshi Kani <toshi.kani@hp.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-02-13ACPI / scan: Follow priorities of IDs when matching scan handlersRafael J. Wysocki
The IDs of ACPI device nodes stored in their pnp.ids member arrays are sorted by decreasing priority (i.e. the highest-priority ID is the first entry). This means that when matching scan handlers to device nodes, the namespace scanning code should walk the list of scan handlers for each device node ID instead of walking the list of device node IDs for each handler (the latter causes the first handler matching any of the device node IDs to be chosen, although there may be another handler matching an ID of a higher priority which should be preferred). Make the code follow this observation. This change has been suggested and justified by Toshi Kani. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Toshi Kani <toshi.kani@hp.com>
2013-02-13ACPI / PCI: pci_slot: replace printk(KERN_xxx) with pr_xxx()Jiang Liu
Trivial changes to replace printk(KERN_xxx) with pr_xxx(). Signed-off-by: Jiang Liu <jiang.liu@huawei.com> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-02-13GFS2: Reinstate withdraw ack systemSteven Whitehouse
This patch reinstates the ack system which withdraw should be using. It appears to have been accidentally forgotten when the lock module was merged into GFS2, due to two different sysfs files having the same name. Reported-by: David Teigland <teigland@redhat.com> Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
2013-02-13kbuild: limit dtc+cpp include pathStephen Warren
Device tree source files may now include header files. The intent is that those header files define/name constants used as part of the DT bindings. Currently this feature is open to abuse, since any kernel header file at all can be included, This could allow device tree files to become dependant on kernel headers files, and thus make them no longer OS-independent. This would also prevent separating the device tree source files from the kernel repository. Solve this by limiting the cpp include path for device tree files to separate directories. Signed-off-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2013-02-13gpio: Make of_count_named_gpios() use new of_count_phandle_with_args()Grant Likely
This patch replaces the horribly coded of_count_named_gpios() with a call to of_count_phandle_with_args() which is far more efficient. This also changes the return value of of_gpio_count() & of_gpio_named_count() from 'unsigned int' to 'int' so that it can return an error code. All the users of that function are fixed up to correctly handle a negative return value. v2: Split GPIO portion into a separate patch Tested-by: Andreas Larsson <andreas@gaisler.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca> Cc: Linus Walleij <linus.walleij@linaro.org> Cc: Rob Herring <rob.herring@calxeda.com>
2013-02-13of: Create function for counting number of phandles in a propertyGrant Likely
This patch creates of_count_phandle_with_args(), a new function for counting the number of phandle+argument tuples in a given property. This is better than the existing method of parsing each phandle individually until parsing fails which is a horribly slow way to do the count. Tested on ARM using the selftest code. v3: - Rebased on top of selftest code cleanup patch v2: - fix bug where of_parse_phandle_with_args() could behave like _count_. - made of_gpio_named_count() into a static inline regardless of CONFIG_OF_GPIO Tested-by: Andreas Larsson <andreas@gaisler.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca> Cc: Linus Walleij <linus.walleij@linaro.org> Cc: Rob Herring <rob.herring@calxeda.com>
2013-02-13of/base: Clean up exit paths for of_parse_phandle_with_args()Grant Likely
Some of the exit paths were not correctly releasing the node. Fix it by creating an 'err' label for collecting the error paths and releasing the node. Cc: Rob Herring <rob.herring@calxeda.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2013-02-13of/selftest: Use selftest() macro throughoutGrant Likely
Some of the selftests are open-coded. Others use the selftest() macro defined in drivers/of/selftest.c. The macro makes for cleaner selftest code, so refactor the of_parse_phandle_with_args() tests to use it. Cc: Rob Herring <rob.herring@calxeda.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2013-02-13of/selftest: Fix GPIOs selftest to cover the 7th caseGrant Likely
The of_gpio_named_count() self test doesn't hit the out-of-range condition even though it is coded. Fix the bug by increasing the for loop range by one. Reported-by: Andreas Larsson <andreas@gaisler.com> Cc: Rob Herring <rob.herring@calxeda.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2013-02-13of: fix recursive locking in of_get_next_available_child()Stephen Warren
of_get_next_available_child() acquires devtree_lock, then calls of_device_is_available() which calls of_get_property() which calls of_find_property() which tries to re-acquire devtree_lock, thus causing deadlock. To avoid this, create a new __of_device_is_available() which calls __of_get_property() instead, which calls __of_find_property(), which does not take the lock,. Update of_get_next_available_child() to call the new __of_device_is_available() since it already owns the lock. Signed-off-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2013-02-13Merge branch 'for-next' from git://sources.calxeda.com/kernel/linux.gitGrant Likely
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2013-02-13mac80211/minstrel_ht: add support for using CCK ratesFelix Fietkau
When MCS rates start to get bad in 2.4 GHz because of long range or strong interference, CCK rates can be a lot more robust. This patch adds a pseudo MCS group containing CCK rates (long preamble in the lower 4 slots, short preamble in the upper slots). Signed-off-by: Felix Fietkau <nbd@openwrt.org> [make minstrel_ht_get_stats static] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-02-13cfg80211: check vendor IE length to avoid overrunLuciano Coelho
cfg80211_find_vendor_ie() was checking only that the vendor IE would fit in the remaining IEs buffer. If a corrupt includes a vendor IE that is too small, we could potentially overrun the IEs buffer. Fix this by checking that the vendor IE fits in the reported IE length field and skip it otherwise. Reported-by: Jouni Malinen <j@w1.fi> Signed-off-by: Luciano Coelho <coelho@ti.com> [change BUILD_BUG_ON to != 1 (from >= 2)] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-02-13nl80211: add packet offset information for wowlan patternAmitkumar Karwar
If user knows the location of a wowlan pattern to be matched in Rx packet, he can provide an offset with the pattern. This will help drivers to ignore initial bytes and match the pattern efficiently. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> [refactor pattern sending] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-02-13x86/mm: Check if PUD is large when validating a kernel addressMel Gorman
A user reported the following oops when a backup process reads /proc/kcore: BUG: unable to handle kernel paging request at ffffbb00ff33b000 IP: [<ffffffff8103157e>] kern_addr_valid+0xbe/0x110 [...] Call Trace: [<ffffffff811b8aaa>] read_kcore+0x17a/0x370 [<ffffffff811ad847>] proc_reg_read+0x77/0xc0 [<ffffffff81151687>] vfs_read+0xc7/0x130 [<ffffffff811517f3>] sys_read+0x53/0xa0 [<ffffffff81449692>] system_call_fastpath+0x16/0x1b Investigation determined that the bug triggered when reading system RAM at the 4G mark. On this system, that was the first address using 1G pages for the virt->phys direct mapping so the PUD is pointing to a physical address, not a PMD page. The problem is that the page table walker in kern_addr_valid() is not checking pud_large() and treats the physical address as if it was a PMD. If it happens to look like pmd_none then it'll silently fail, probably returning zeros instead of real data. If the data happens to look like a present PMD though, it will be walked resulting in the oops above. This patch adds the necessary pud_large() check. Unfortunately the problem was not readily reproducible and now they are running the backup program without accessing /proc/kcore so the patch has not been validated but I think it makes sense. Signed-off-by: Mel Gorman <mgorman@suse.de> Reviewed-by: Rik van Riel <riel@redhat.coM> Reviewed-by: Michal Hocko <mhocko@suse.cz> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: stable@vger.kernel.org Cc: linux-mm@kvack.org Link: http://lkml.kernel.org/r/20130211145236.GX21389@suse.de Signed-off-by: Ingo Molnar <mingo@kernel.org>
2013-02-13Merge branch 'rcu/srcu' of ↵Ingo Molnar
git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu Pull SRCU changes from Paul E. McKenney. " These include debugging aids, updates that move towards the goal of permitting srcu_read_lock() and srcu_read_unlock() to be used from idle and offline CPUs, and a few small fixes. " Signed-off-by: Ingo Molnar <mingo@kernel.org>
2013-02-12x86, hyperv: HYPERV depends on X86_LOCAL_APICH. Peter Anvin
In order to compile in the special Hyper-V interrupt vector, we need infrastructure in arch/x86/apic/apic.c. At least for now, simply require CONFIG_X86_LOCAL_APIC in order to enable CONFIG_HYPERV. Link: http://lkml.kernel.org/r/tip-bc2b0331e077f576369a2b6c75d15ed4de4ef91f@git.kernel.org Cc: K. Y. Srinivasan <kys@microsoft.com> Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
2013-02-12X86: Handle Hyper-V vmbus interrupts as special hypervisor interruptsK. Y. Srinivasan
Starting with win8, vmbus interrupts can be delivered on any VCPU in the guest and furthermore can be concurrently active on multiple VCPUs. Support this interrupt delivery model by setting up a separate IDT entry for Hyper-V vmbus. interrupts. I would like to thank Jan Beulich <JBeulich@suse.com> and Thomas Gleixner <tglx@linutronix.de>, for their help. In this version of the patch, based on the feedback, I have merged the IDT vector for Xen and Hyper-V and made the necessary adjustments. Furhermore, based on Jan's feedback I have added the necessary compilation switches. Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Link: http://lkml.kernel.org/r/1359940959-32168-3-git-send-email-kys@microsoft.com Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
2013-02-12X86: Add a check to catch Xen emulation of Hyper-VK. Y. Srinivasan
Xen emulates Hyper-V to host enlightened Windows. Looks like this emulation may be turned on by default even for Linux guests. Check and fail Hyper-V detection if we are on Xen. [ hpa: the problem here is that Xen doesn't emulate Hyper-V well enough, and if the Xen support isn't compiled in, we end up stubling over the Hyper-V emulation and try to activate it -- and it fails. ] Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Link: http://lkml.kernel.org/r/1359940959-32168-2-git-send-email-kys@microsoft.com Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
2013-02-12x86: Hyper-V: register clocksource only if its advertisedOlaf Hering
Enable hyperv_clocksource only if its advertised as a feature. XenServer 6 returns the signature which is checked in ms_hyperv_platform(), but it does not offer all features. Currently the clocksource is enabled unconditionally in ms_hyperv_init_platform(), and the result is a hanging guest. Hyper-V spec Bit 1 indicates the availability of Partition Reference Counter. Register the clocksource only if this bit is set. The guest in question prints this in dmesg: [ 0.000000] Hypervisor detected: Microsoft HyperV [ 0.000000] HyperV: features 0x70, hints 0x0 This bug can be reproduced easily be setting 'viridian=1' in a HVM domU .cfg file. A workaround without this patch is to boot the HVM guest with 'clocksource=jiffies'. Signed-off-by: Olaf Hering <olaf@aepfle.de> Link: http://lkml.kernel.org/r/1359940959-32168-1-git-send-email-kys@microsoft.com Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Cc: <stable@vger.kernel.org> Cc: Greg KH <gregkh@linuxfoundation.org> Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
2013-02-12Merge branch 'autofs-fix' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux into akpm Pull hp parisc automounter fix from Helge Deller: "This unbreaks automounter support for the parisc architecture (and probably aarch64 as well)."" * 'autofs-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: unbreak automounter support on 64-bit kernel with 32-bit userspace (v2)
2013-02-12Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux into akpm Pull s390 regression fix from Martin Schwidefsky: "The recent fix for the s390 sched_clock() function uncovered yet another bug in s390_next_ktime which causes an endless loop in KVM. This regression should be fixed before v3.8. I keep the fingers crossed that this is the last one for v3.8." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/timer: avoid overflow when programming clock comparator
2013-02-12Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu into akpm Pull m68knommu fix from Greg Ungerer: "This contains a single critical fix for the non-MMU m68k platforms. The change of the kernel exec code path has revealed a problem in the start thread code that causes crashing on boot. This is the fix for it." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: fix trap on execing /bin/init