summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-07-30staging: comedi: comedi_fops: do not call blocking ops when !TASK_RUNNINGIan Abbott
Comedi's read and write file operation handlers (`comedi_read()` and `comedi_write()`) currently call `copy_to_user()` or `copy_from_user()` whilst in the `TASK_INTERRUPTIBLE` state, which falls foul of the `might_fault()` checks when enabled. Fix it by setting the current task state back to `TASK_RUNNING` a bit earlier before calling these functions. Reported-by: Piotr Gregor <piotrgregor@rsyncme.org> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Cc: <stable@vger.kernel.org> # 4.5+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-30tty: pl011: fix initialization order of QDF2400 E44Timur Tabi
The work-around for Qualcomm Technologies QDF2400 Erratum 44 hinges on a global variable defined in the pl011 driver. The ACPI SPCR parsing code determines whether the work-around is needed, and if so, it changes the console name from "pl011" to "qdf2400_e44". The expectation is that the pl011 driver will implement the work-around when it sees the console name. The global variable qdf2400_e44_present is set when that happens. The problem is that work-around needs to be enabled when the pl011 driver probes, not when the console name is queried. However, sbsa_probe() is called before pl011_console_match(). The work-around appeared to work previously because the default console on QDF2400 platforms was always ttyAMA1. The first time sbsa_probe() is called (for ttyAMA0), qdf2400_e44_present is still false. Then pl011_console_match() is called, and it sets qdf2400_e44_present to true. All subsequent calls to sbsa_probe() enable the work-around. The solution is to move the global variable into spcr.c and let the pl011 driver query it during probe time. This works because all QDF2400 platforms require SPCR, so parse_spcr() will always be called. pl011_console_match still checks for the "qdf2400_e44" console name, but it doesn't do anything else special. Fixes: 5a0722b898f8 ("tty: pl011: use "qdf2400_e44" as the earlycon name for QDF2400 E44") Tested-by: Jeffrey Hugo <jhugo@codeaurora.org> Signed-off-by: Timur Tabi <timur@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-30usb: musb: fix tx fifo flush handling againBin Liu
commit 68fe05e2a451 ("usb: musb: fix tx fifo flush handling") drops the 1ms delay trying to solve the long disconnect time issue when application queued many tx urbs. However, the 1ms delay is needed for some use cases, for example, without the delay, reconnecting AR9271 WIFI dongle no longer works if the connection is dropped from the AP. So let's add back the 1ms delay in musb_h_tx_flush_fifo(), and solve the long disconnect time problem with a separate patch for usb_hcd_flush_endpoint(). Cc: stable@vger.kernel.org # v4.4+ Signed-off-by: Bin Liu <b-liu@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-30usb: core: unlink urbs from the tail of the endpoint's urb_listBin Liu
While unlink an urb, if the urb has been programmed in the controller, the controller driver might do some hw related actions to tear down the urb. Currently usb_hcd_flush_endpoint() passes each urb from the head of the endpoint's urb_list to the controller driver, which could make the controller driver think each urb has been programmed and take the unnecessary actions for each urb. This patch changes the behavior in usb_hcd_flush_endpoint() to pass the urbs from the tail of the list, to avoid any unnecessary actions in an controller driver. Cc: stable@vger.kernel.org # v4.4+ Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Bin Liu <b-liu@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-30usb-storage: fix deadlock involving host lock and scsi_doneAlan Stern
Christoph Hellwig says that since version 4.12, the kernel switched to using blk-mq by default. The old code used a softirq for handling request completions, but blk-mq can handle completions in the caller's context. This may cause a problem for usb-storage, because it invokes the ->scsi_done callback while holding the host lock, and the completion routine sometimes tries to acquire the same lock (when running the error handler, for example). The consequence is that the existing code will sometimes deadlock upon error completion of a SCSI command (with a lockdep warning). This is easy enough to fix, since usb-storage doesn't really need to hold the host lock while the callback runs. It was simpler to write it that way, but moving the call outside the locked region is pretty easy and there's no downside. That's what this patch does. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-and-tested-by: Arthur Marsh <arthur.marsh@internode.on.net> CC: Christoph Hellwig <hch@lst.de> CC: <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-30uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069Alan Swanson
Similar to commit d595259fbb7a ("usb-storage: Add ignore-residue quirk for Initio INIC-3619") for INIC-3169 in unusual_devs.h but INIC-3069 already present in unusual_uas.h. Both in same controller IC family. Issue is that MakeMKV fails during key exchange with installed bluray drive with following error: 002004:0000 Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0' Signed-off-by: Alan Swanson <reiver@improbability.net> Acked-by: Oliver Neukum <oneukum@suse.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-30USB: hcd: Mark secondary HCD as dead if the primary one diedRafael J. Wysocki
Make usb_hc_died() clear the HCD_FLAG_RH_RUNNING flag for the shared HCD and set HCD_FLAG_DEAD for it, in analogy with what is done for the primary one. Among other thigs, this prevents check_root_hub_suspended() from returning -EBUSY for dead HCDs which helps to work around system suspend issues in some situations. This actually fixes occasional suspend failures on one of my test machines. Suggested-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-30ACPI: APD: Fix HID for Hisilicon Hip07/08Hanjun Guo
ACPI HID for Hisilicon Hip07/08 should be HISI02A1/2, not HISI0A21/2, HISI02A1/2 was tested ok but was modified by the stupid typo when upstream the patches (by me), correct them to the right IDs (matching the IDs in drivers/i2c/busses/i2c-designware-platdrv.c). Fixes: 6e14cf361a0c (ACPI / APD: Add clock frequency for Hisilicon Hip07/08 I2C controller) Reported-by: Tao Tian <tiantao6@huawei.com> Signed-off-by: Hanjun Guo <hanjun.guo@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2017-07-30cpufreq: x86: Make scaling_cur_freq behave more as expectedRafael J. Wysocki
After commit f8475cef9008 "x86: use common aperfmperf_khz_on_cpu() to calculate KHz using APERF/MPERF" the scaling_cur_freq policy attribute in sysfs only behaves as expected on x86 with APERF/MPERF registers available when it is read from at least twice in a row. The value returned by the first read may not be meaningful, because the computations in there use cached values from the previous iteration of aperfmperf_snapshot_khz() which may be stale. To prevent that from happening, modify arch_freq_get_on_cpu() to call aperfmperf_snapshot_khz() twice, with a short delay between these calls, if the previous invocation of aperfmperf_snapshot_khz() was too far back in the past (specifically, more that 1s ago). Also, as pointed out by Doug Smythies, aperf_delta is limited now and the multiplication of it by cpu_khz won't overflow, so simplify the s->khz computations too. Fixes: f8475cef9008 "x86: use common aperfmperf_khz_on_cpu() to calculate KHz using APERF/MPERF" Reported-by: Doug Smythies <dsmythies@telus.net> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2017-07-29bpf: fix bpf_prog_get_info_by_fd to dump correct xlated_prog_lenDaniel Borkmann
bpf_prog_size(prog->len) is not the correct length we want to dump back to user space. The code in bpf_prog_get_info_by_fd() uses this to copy prog->insnsi to user space, but bpf_prog_size(prog->len) also includes the size of struct bpf_prog itself plus program instructions and is usually used either in context of accounting or for bpf_prog_alloc() et al, thus we copy out of bounds in bpf_prog_get_info_by_fd() potentially. Use the correct bpf_prog_insn_size() instead. Fixes: 1e2709769086 ("bpf: Add BPF_OBJ_GET_INFO_BY_FD") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29tcp: avoid bogus gcc-7 array-bounds warningArnd Bergmann
When using CONFIG_UBSAN_SANITIZE_ALL, the TCP code produces a false-positive warning: net/ipv4/tcp_output.c: In function 'tcp_connect': net/ipv4/tcp_output.c:2207:40: error: array subscript is below array bounds [-Werror=array-bounds] tp->chrono_stat[tp->chrono_type - 1] += now - tp->chrono_start; ^~ net/ipv4/tcp_output.c:2207:40: error: array subscript is below array bounds [-Werror=array-bounds] tp->chrono_stat[tp->chrono_type - 1] += now - tp->chrono_start; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ I have opened a gcc bug for this, but distros have already shipped compilers with this problem, and it's not clear yet whether there is a way for gcc to avoid the warning. As the problem is related to the bitfield access, this introduces a temporary variable to store the old enum value. I did not notice this warning earlier, since UBSAN is disabled when building with COMPILE_TEST, and that was always turned on in both allmodconfig and randconfig tests. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81601 Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29Merge tag 'wireless-drivers-for-davem-2017-07-28' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.13 Two fixes for for brcmfmac, the crash was reported by two people already so it's a high priority fix. brcmfmac * fix a crash in skb headroom handling in v4.13-rc1 * fix a memory leak due to a merge error in v4.6 ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29net: tc35815: fix spelling mistake: "Intterrupt" -> "Interrupt"Colin Ian King
Trivial fix to spelling mistake in printk message Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29block, bfq: consider also in_service_entity to state whether an entity is activePaolo Valente
Groups of BFQ queues are represented by generic entities in BFQ. When a queue belonging to a parent entity is deactivated, the parent entity may need to be deactivated too, in case the deactivated queue was the only active queue for the parent entity. This deactivation may need to be propagated upwards if the entity belongs, in its turn, to a further higher-level entity, and so on. In particular, the upward propagation of deactivation stops at the first parent entity that remains active even if one of its child entities has been deactivated. To decide whether the last non-deactivation condition holds for a parent entity, BFQ checks whether the field next_in_service is still not NULL for the parent entity, after the deactivation of one of its child entity. If it is not NULL, then there are certainly other active entities in the parent entity, and deactivations can stop. Unfortunately, this check misses a corner case: if in_service_entity is not NULL, then next_in_service may happen to be NULL, although the parent entity is evidently active. This happens if: 1) the entity pointed by in_service_entity is the only active entity in the parent entity, and 2) according to the definition of next_in_service, the in_service_entity cannot be considered as next_in_service. See the comments on the definition of next_in_service for details on this second point. Hitting the above corner case causes crashes. To address this issue, this commit: 1) Extends the above check on only next_in_service to controlling both next_in_service and in_service_entity (if any of them is not NULL, then no further deactivation is performed) 2) Improves the (important) comments on how next_in_service is defined and updated; in particular it fixes a few rather obscure paragraphs Reported-by: Eric Wheeler <bfq-sched@lists.ewheeler.net> Reported-by: Rick Yiu <rick_yiu@htc.com> Reported-by: Tom X Nguyen <tom81094@gmail.com> Signed-off-by: Paolo Valente <paolo.valente@linaro.org> Tested-by: Eric Wheeler <bfq-sched@lists.ewheeler.net> Tested-by: Rick Yiu <rick_yiu@htc.com> Tested-by: Laurentiu Nicola <lnicola@dend.ro> Tested-by: Tom X Nguyen <tom81094@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2017-07-29block, bfq: reset in_service_entity if it becomes idlePaolo Valente
BFQ implements hierarchical scheduling by representing each group of queues with a generic parent entity. For each parent entity, BFQ maintains an in_service_entity pointer: if one of the child entities happens to be in service, in_service_entity points to it. The resetting of these pointers happens only on queue expirations: when the in-service queue is expired, i.e., stops to be the queue in service, BFQ resets all in_service_entity pointers along the parent-entity path from this queue to the root entity. Functions handling the scheduling of entities assume, naturally, that in-service entities are active, i.e., have pending I/O requests (or, as a special case, even if they have no pending requests, they are expected to receive a new request very soon, with the scheduler idling the storage device while waiting for such an event). Unfortunately, the above resetting scheme of the in_service_entity pointers may cause this assumption to be violated. For example, the in-service queue may happen to remain without requests because of a request merge. In this case the queue does become idle, and all related data structures are updated accordingly. But in_service_entity still points to the queue in the parent entity. This inconsistency may even propagate to higher-level parent entities, if they happen to become idle as well, as a consequence of the leaf queue becoming idle. For this queue and parent entities, scheduling functions have an undefined behaviour, and, as reported, may easily lead to kernel crashes or hangs. This commit addresses this issue by simply resetting the in_service_entity field also when it is detected to point to an entity becoming idle (regardless of why the entity becomes idle). Reported-by: Laurentiu Nicola <lnicola@dend.ro> Signed-off-by: Paolo Valente <paolo.valente@linaro.org> Tested-by: Laurentiu Nicola <lnicola@dend.ro> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2017-07-29bpf: don't indicate success when copy_from_user failsDaniel Borkmann
err in bpf_prog_get_info_by_fd() still holds 0 at that time from prior check_uarg_tail_zero() check. Explicitly return -EFAULT instead, so user space can be notified of buggy behavior. Fixes: 1e2709769086 ("bpf: Add BPF_OBJ_GET_INFO_BY_FD") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29udp6: fix socket leak on early demuxPaolo Abeni
When an early demuxed packet reaches __udp6_lib_lookup_skb(), the sk reference is retrieved and used, but the relevant reference count is leaked and the socket destructor is never called. Beyond leaking the sk memory, if there are pending UDP packets in the receive queue, even the related accounted memory is leaked. In the long run, this will cause persistent forward allocation errors and no UDP skbs (both ipv4 and ipv6) will be able to reach the user-space. Fix this by explicitly accessing the early demux reference before the lookup, and properly decreasing the socket reference count after usage. Also drop the skb_steal_sock() in __udp6_lib_lookup_skb(), and the now obsoleted comment about "socket cache". The newly added code is derived from the current ipv4 code for the similar path. v1 -> v2: fixed the __udp6_lib_rcv() return code for resubmission, as suggested by Eric Reported-by: Sam Edwards <CFSworks@gmail.com> Reported-by: Marc Haber <mh+netdev@zugschlus.de> Fixes: 5425077d73e0 ("net: ipv6: Add early demux handler for UDP unicast") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29net: thunderx: Fix BGX transmit stall due to underflowSunil Goutham
For SGMII/RGMII/QSGMII interfaces when physical link goes down while traffic is high is resulting in underflow condition being set on that specific BGX's LMAC. Which assets a backpresure and VNIC stops transmitting packets. This is due to BGX being disabled in link status change callback while packet is in transit. This patch fixes this issue by not disabling BGX but instead just disables packet Rx and Tx. Signed-off-by: Sunil Goutham <sgoutham@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29Revert "vhost: cache used event for better performance"Jason Wang
This reverts commit 809ecb9bca6a9424ccd392d67e368160f8b76c92. Since it was reported to break vhost_net. We want to cache used event and use it to check for notification. The assumption was that guest won't move the event idx back, but this could happen in fact when 16 bit index wraps around after 64K entries. Signed-off-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29v4l: vsp1: Add support for the BRS entityLaurent Pinchart
The Blend/ROP Sub Unit (BRS) is a stripped-down version of the BRU found in several VSP2 instances. Compared to a regular BRU, it supports two inputs only, and thus has no ROP unit. Add support for the BRS by modelling it as a new entity type, but reuse the vsp1_bru object underneath. Chaining the BRU and BRS entities seems to be supported by the hardware but isn't implemented yet as it isn't the primary use case for the BRS. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Acked-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-29v4l: vsp1: Add pipe index argument to the VSP-DU APILaurent Pinchart
In the H3 ES2.0 SoC the VSP2-DL instance has two connections to DU channels that need to be configured independently. Extend the VSP-DU API with a pipeline index to identify which pipeline the caller wants to operate on. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Acked-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-29v4l: vsp1: Don't create links for DRM pipelineLaurent Pinchart
When the VSP1 is used in a DRM pipeline the driver doesn't register the media device. Links between entities are not exposed to userspace, but are still used internally for the sole purpose of setting up internal source to sink pointers through the link setup handler. Instead of going through this complex procedure, remove link creation and set the sink pointers directly. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Acked-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-29v4l: vsp1: Store source and sink pointers as vsp1_entityLaurent Pinchart
The internal VSP entity source and sink pointers are stored as media_entity pointers, which are then cast to a vsp1_entity. As all sources and sinks are vsp1_entity instances, we can store the vsp1_entity pointers directly. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Acked-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-29v4l: vsp1: Don't set WPF sink pointerLaurent Pinchart
The sink pointer is used to configure routing inside the VSP, and as such must point to the next VSP entity in the pipeline. The WPF being a pipeline terminal sink, its output route can't be configured. The routing configuration code already handles this correctly without referring to the sink pointer, which thus doesn't need to be set. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Acked-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-29v4l: vsp1: Don't recycle active list at display startLaurent Pinchart
When the display start interrupt occurs, we know that the hardware has finished loading the active display list. The driver then proceeds to recycle the list, assuming it won't be needed anymore. This assumption holds true for headerless display lists, as the VSP doesn't reload the list for the next frame if it hasn't changed. However, this isn't true anymore for header display lists, as they are loaded at every frame start regardless of whether they have been updated. To prepare for header display lists usage in display pipelines, we need to postpone recycling the list until it gets replaced by a new one through a page flip. The driver already does so in the frame end interrupt handler, so all we need is to skip list recycling in the display start interrupt handler. While the active list can be recycled at display start for headerless display lists, there's no real harm in postponing that to the frame end interrupt handler in all cases. This simplifies interrupt handling as we don't need to process the display start interrupt anymore. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Acked-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-29v4l: vsp1: Fill display list headers without holding dlm spinlockLaurent Pinchart
The display list headers are filled using information from the display list only. Lower the display list manager spinlock contention by filling the headers without holding the lock. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Acked-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-29Merge tag 'mlx5-fixes-2017-07-27-V2' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2017-07-27 This series contains some misc fixes to the mlx5 driver. Please pull and let me know if there's any problem. V1->V2: - removed redundant braces for -stable: 4.7 net/mlx5: Fix command bad flow on command entry allocation failure 4.9 net/mlx5: Consider tx_enabled in all modes on remap net/mlx5e: Fix outer_header_zero() check size 4.10 net/mlx5: Fix mlx5_add_flow_rules call with correct num of dests 4.11 net/mlx5: Fix mlx5_ifc_mtpps_reg_bits structure size net/mlx5e: Add field select to MTPPS register net/mlx5e: Fix broken disable 1PPS flow net/mlx5e: Change 1PPS out scheme net/mlx5e: Add missing support for PTP_CLK_REQ_PPS request net/mlx5e: Fix wrong delay calculation for overflow check scheduling net/mlx5e: Schedule overflow check work to mlx5e workqueue 4.12 net/mlx5: Fix command completion after timeout access invalid structure net/mlx5e: IPoIB, Modify add/remove underlay QPN flows I hope this is not too much, but most of the patches do apply cleanly on -stable. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29team: use a larger struct for mac addressWANG Cong
IPv6 tunnels use sizeof(struct in6_addr) as dev->addr_len, but in many places especially bonding, we use struct sockaddr to copy and set mac addr, this could lead to stack out-of-bounds access. Fix it by using a larger address storage like bonding. Reported-by: Andrey Konovalov <andreyknvl@google.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29net: check dev->addr_len for dev_set_mac_address()WANG Cong
Historically, dev_ifsioc() uses struct sockaddr as mac address definition, this is why dev_set_mac_address() accepts a struct sockaddr pointer as input but now we have various types of mac addresse whose lengths are up to MAX_ADDR_LEN, longer than struct sockaddr, and saved in dev->addr_len. It is too late to fix dev_ifsioc() due to API compatibility, so just reject those larger than sizeof(struct sockaddr), otherwise we would read and use some random bytes from kernel stack. Fortunately, only a few IPv6 tunnel devices have addr_len larger than sizeof(struct sockaddr) and they don't support ndo_set_mac_addr(). But with team driver, in lb mode, they can still be enslaved to a team master and make its mac addr length as the same. Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29dma-buf/sync_file: Allow multiple sync_files to wrap a single dma-fenceChris Wilson
Up until recently sync_file were create to export a single dma-fence to userspace, and so we could canabalise a bit insie dma-fence to mark whether or not we had enable polling for the sync_file itself. However, with the advent of syncobj, we do allow userspace to create multiple sync_files for a single dma-fence. (Similarly, that the sw-sync validation framework also started returning multiple sync-files wrapping a single dma-fence for a syncpt also triggering the problem.) This patch reverts my suggestion in commit e24165537312 ("dma-buf/sync_file: only enable fence signalling on poll()") to use a single bit in the shared dma-fence and restores the sync_file->flags for tracking the bits individually. Reported-by: Gustavo Padovan <gustavo.padovan@collabora.com> Fixes: f1e8c67123cf ("dma-buf/sw-sync: Use an rbtree to sort fences in the timeline") Fixes: e9083420bbac ("drm: introduce sync objects (v4)") Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Sumit Semwal <sumit.semwal@linaro.org> Cc: Sean Paul <seanpaul@chromium.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: dri-devel@lists.freedesktop.org Cc: <drm-intel-fixes@lists.freedesktop.org> # v4.13-rc1+ Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com> Link: http://patchwork.freedesktop.org/patch/msgid/20170728212951.7818-1-chris@chris-wilson.co.uk
2017-07-29tinydrm: repaper: add CONFIG_THERMAL dependencyArnd Bergmann
The new RePaper driver uses the thermal subsystem, and fails to link when it is built-in but thermal is a loadable module: drivers/gpu/drm/tinydrm/repaper.o: In function `repaper_probe': repaper.c:(.text+0x540): undefined reference to `thermal_zone_get_zone_by_name' drivers/gpu/drm/tinydrm/repaper.o: In function `repaper_fb_dirty': repaper.c:(.text+0xff4): undefined reference to `thermal_zone_get_temp' This adds another Kconfig dependency to prevent the broken configuration, forcing repaper to be a module too. Fixes: 3589211e9b03 ("drm/tinydrm: Add RePaper e-ink driver") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Link: https://patchwork.freedesktop.org/patch/msgid/20170727100004.300665-1-arnd@arndb.de
2017-07-29drm/hisilicon: hibmc: Use the drm_driver.dumb_destroy defaultNoralf Trønnes
drm_gem_dumb_destroy() is the drm_driver.dumb_destroy default, so no need to set it. Cc: Chen Feng <puck.chen@hisilicon.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Reviewed-by: Sean Paul <seanpaul@chromium.org> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-37-git-send-email-noralf@tronnes.org
2017-07-29drm/nouveau: Use the drm_driver.dumb_destroy defaultNoralf Trønnes
drm_gem_dumb_destroy() is the drm_driver.dumb_destroy default, so no need to set it. Cc: Ben Skeggs <bskeggs@redhat.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Acked-by: Alex Deucher <alexander.deucher@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-33-git-send-email-noralf@tronnes.org
2017-07-29drm/omapdrm: Use the drm_driver.dumb_destroy defaultNoralf Trønnes
drm_gem_dumb_destroy() is the drm_driver.dumb_destroy default, so no need to set it. Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-31-git-send-email-noralf@tronnes.org
2017-07-29drm/amdgpu: Use the drm_driver.dumb_destroy defaultNoralf Trønnes
drm_gem_dumb_destroy() is the drm_driver.dumb_destroy default, so no need to set it. Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Acked-by: Alex Deucher <alexander.deucher@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-30-git-send-email-noralf@tronnes.org
2017-07-29drm/rockchip: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Mark Yao <mark.yao@rock-chips.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Reviewed-by: Sean Paul <seanpaul@chromium.org> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-25-git-send-email-noralf@tronnes.org
2017-07-29drm/mediatek: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: CK Hu <ck.hu@mediatek.com> Cc: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Acked-by: Philipp Zabel <p.zabel@pengutronix.de> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-23-git-send-email-noralf@tronnes.org
2017-07-29drm/tinydrm: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
tinydrm can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Reviewed-by: Sean Paul <seanpaul@chromium.org> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-22-git-send-email-noralf@tronnes.org
2017-07-29drm/zte: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Shawn Guo <shawnguo@kernel.org> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Acked-by: Shawn Guo <shawnguo@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-21-git-send-email-noralf@tronnes.org
2017-07-29drm/vc4: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Eric Anholt <eric@anholt.net> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Reviewed-by: Eric Anholt <eric@anholt.net> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-20-git-send-email-noralf@tronnes.org
2017-07-29drm/tilcdc: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Jyri Sarha <jsarha@ti.com> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Acked-by: Jyri Sarha <jsarha@ti.com> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-19-git-send-email-noralf@tronnes.org
2017-07-29drm/sun4i: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Maxime Ripard <maxime.ripard@free-electrons.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-18-git-send-email-noralf@tronnes.org
2017-07-29drm/stm: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Yannick Fertre <yannick.fertre@st.com> Cc: Philippe Cornu <philippe.cornu@st.com> Cc: Benjamin Gaignard <benjamin.gaignard@linaro.org> Cc: Vincent Abriou <vincent.abriou@st.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Tested-by: Philippe Cornu <philippe.cornu@st.com> Acked-by: Philippe Cornu <philippe.cornu@st.com> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-17-git-send-email-noralf@tronnes.org
2017-07-29drm/shmobile: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-15-git-send-email-noralf@tronnes.org
2017-07-29drm/rcar-du: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-14-git-send-email-noralf@tronnes.org
2017-07-29drm/pl111: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Eric Anholt <eric@anholt.net> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Reviewed-by: Eric Anholt <eric@anholt.net> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-13-git-send-email-noralf@tronnes.org
2017-07-29drm/imx: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Acked-by: Philipp Zabel <p.zabel@pengutronix.de> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-10-git-send-email-noralf@tronnes.org
2017-07-29drm/atmel-hlcdc: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-7-git-send-email-noralf@tronnes.org
2017-07-29drm/arm: mali-dp: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Liviu Dudau <liviu.dudau@arm.com> Cc: Brian Starkey <brian.starkey@arm.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Acked-by: Brian Starkey <brian.starkey@arm.com> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-6-git-send-email-noralf@tronnes.org
2017-07-29drm/arm: hdlcd: Use .dumb_map_offset and .dumb_destroy defaultsNoralf Trønnes
This driver can use the drm_driver.dumb_destroy and drm_driver.dumb_map_offset defaults, so no need to set them. Cc: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> Acked-by: Brian Starkey <brian.starkey@arm.com> Link: https://patchwork.freedesktop.org/patch/msgid/1500837417-40580-5-git-send-email-noralf@tronnes.org