summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-05-04Removed unused typedef to avoid "unused local typedef" warnings.Han Shen
Fix warnings about unused local typedefs (reported by gcc 4.8). Signed-off-by: Han Shen (shenhan@google.com) Change-Id: I4bccc234f1390daa808d2b309ed112e20c0ac096 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-05-04kill fs/read_write.hAl Viro
fs/compat.c doesn't need it anymore, so let's just move the remaining contents (two typedefs) into fs/read_write.c Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-05-04fs: Fix hang with BSD accounting on frozen filesystemJan Kara
When BSD process accounting is enabled and logs information to a filesystem which gets frozen, system easily becomes unusable because each attempt to account process information blocks. Thus e.g. every task gets blocked in exit. It seems better to drop accounting information (which can already happen when filesystem is running out of space) instead of locking system up. So we just skip the write if the filesystem is frozen. Reported-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-05-04sun3_scsi: add ->show_info()Geert Uytterhoeven
Based on Al's changes to atari_scsi. Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-05-04nubus: Kill nubus_proc_detach_device()Geert Uytterhoeven
Commit 59d8053f1e16904d54ed7469d4b36801ea6b8f2c ("proc: Move non-public stuff from linux/proc_fs.h to fs/proc/internal.h") broke Apple NuBus support: drivers/nubus/proc.c: In function ‘nubus_proc_detach_device’: drivers/nubus/proc.c:156: error: dereferencing pointer to incomplete type drivers/nubus/proc.c:158: error: dereferencing pointer to incomplete type Fortunately nubus_proc_detach_device() is unused, and appears to have never been used, so just remove it. Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-05-04more mode_t whack-a-mole...Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-05-04do_coredump(): don't wait for thaw if coredump has already been interruptedAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-05-04do_mount(): fix a leak introduced in 3.9 ("mount: consolidate permission ↵Al Viro
checks") Cc: stable@vger.kernel.org Bisected-by: Michael Leun <lkml20130126@newton.leun.net> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-05-04ipc: sem_putref() does not need the semaphore lock any moreLinus Torvalds
ipc_rcu_putref() uses atomics for the refcount, and the games to lock and unlock the semaphore just to try to keep the reference counting working are no longer useful. Acked-by: Davidlohr Bueso <davidlohr.bueso@hp.com> Cc: Rik van Riel <riel@redhat.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-05-04ipc: move rcu_read_unlock() out of sem_unlock() and into callersLinus Torvalds
The IPC locking is a mess, and sem_unlock() unlocks not only the semaphore spinlock, it also drops the rcu read lock. Unlike sem_lock(), which just gets the spin-lock, and expects the caller to get the rcu read lock. This all makes things very hard to follow, and it's very confusing when you take the rcu read lock in one function, and then release it in another. And it has caused actual bugs: the sem_obtain_lock() function ended up dropping the RCU read lock twice in one error path, because it first did the sem_unlock(), and then did a rcu_read_unlock() to match the rcu_read_lock() it had done. This is just a totally mindless "remove rcu_read_unlock() from sem_unlock() and add it immediately after each caller" (except for the aforementioned bug where we did too many rcu_read_unlock(), and in find_alloc_undo() where we just got the rcu_read_lock() to correct for the fact that sem_unlock would immediately drop it again). We can (and should) clean things up further, but this fixes the bug with the minimal amount of subtlety. Reviewed-by: Davidlohr Bueso <davidlohr.bueso@hp.com> Cc: Rik van Riel <riel@redhat.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-05-04ARM: finally enable IRQ time accounting configRussell King
We've had IRQ time accounting for the last six months, except for the Kconfig symbol. This somehow got missed out of the original patch. Add this now. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2013-05-04hwmon: (lm75) Add support for the Dallas/Maxim DS7505Jean Delvare
Basically it's the same as the original DS75 but much faster. Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <linux@roeck-us.net>
2013-05-04hwmon: (lm75) Tune resolution and sample time per chipJean Delvare
Most LM75-compatible chips can either sample much faster or with a much better resolution than the original LM75 chip. So far the lm75 driver did not let the user take benefit of these improvements. Do it now. I decided to almost always configure the chip to use the best resolution possible, which also means the longest sample time. The only chips for which I didn't are the DS75, DS1775 and STDS75, because they are really too slow in 12-bit mode (1.2 to 1.5 second worst case) so I went for 11-bit mode as a more reasonable tradeoff. This choice is dictated by the fact that the hwmon subsystem is meant for system monitoring, it has never been supposed to be ultra-fast, and as a matter of fact we do cache the sampled values in almost all drivers. If anyone isn't pleased with these default settings, they can always introduce a platform data structure or DT support for the lm75. That being said, it seems nobody ever complained that the driver wouldn't refresh the value faster than every 1.5 second, and the change made it faster for all chips even in 12-bit mode, so I don't expect any complaint. Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <linux@roeck-us.net>
2013-05-04hwmon: (lm75) Prepare to support per-chip resolution and sample timeJean Delvare
Prepare the lm75 driver to support per-chip resolution and sample time. For now we only make the code generic enough to support it, but we still use the same, unchanged resolution (9-bit) and sample time (1.5 s) for all chips. Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <linux@roeck-us.net>
2013-05-04hwmon: (lm75) Per-chip configuration register initializationJean Delvare
There is no standard for the configuration register bits of LM75-like chips. We shouldn't blindly clear bits setting the resolution as they are either unused or used for something else on some of the supported chips. So, switch to per-chip configuration initialization. This will allow for better tuning later, for example using more resolution bits when available. Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <linux@roeck-us.net>
2013-05-04ALSA: hda - Fix 3.9 regression of EAPD init on Conexant codecsTakashi Iwai
The older Conexant codecs have up to two EAPDs and these are supposed to be rather statically turned on. The new generic parser code assumes the dynamic on/off per path usage, thus it resulted in the silent output on some machines. This patch fixes the problem by simply assuming the static EAPD on for such old Conexant codecs as we did until 3.8 kernel. Reported-and-tested-by: Christopher K. <c.krooss@gmail.com> Cc: <stable@vger.kernel.org> [v3.9] Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-05-04drm/i915: hsw: fix link training for eDP on port-AImre Deak
According to BSpec the link training sequence for eDP on HSW port-A should be as follows: 1. link training: clock recovery 2. link training: equalization 3. link training: set idle transmission mode 4. display pipe enable 5. link training: disable (set normal mode) Contrary to this at the moment we don't do step 3. and we do step 5. before step 4. Fix this by setting idle transmission mode for eDP at the end of intel_dp_complete_link_train and adding a new intel_dp_stop_link_training function to disable link training. With these changes we'll end up with the following functions corresponding to the above steps: intel_dp_start_link_train -> step 1. intel_dp_complete_link_train -> step 2., step 3. intel_dp_stop_link_train -> step 5. For port-A we'll call intel_dp_stop_link_train only after enabling the pipe, for everything else we'll call it right after intel_dp_complete_link_train to preserve the current behavior. Tested on HSW/HSW-ULT. In v2: - Due to a HW issue we must set idle transmission mode for port-A too before enabling the pipe. Thanks for Arthur Runyan for explaining this. - Update the patch subject to make it clear that it's an eDP fix, DP is not affected. v3: - rename intel_dp_link_train() to intel_dp_set_link_train(), use 'val' instead 'l' as var name. (Paulo) Signed-off-by: Imre Deak <imre.deak@intel.com> Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com> Tested-by: Paulo Zanoni <paulo.r.zanoni@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-05-04Revert "drm/i915: revert eDP bpp clamping code changes"Daniel Vetter
This reverts commit 57c219633275c7e7413f8bc7be250dc092887458. It's an ugly hack for a Haswell SDV platform where the vbt doesn't seem to fully agree with the panel. Since it seems to cause issues on real eDP platform let's just kill this hack again. Reported-and-tested-by: Josh Boyer <jwboyer@gmail.com> References: https://lkml.org/lkml/2013/5/3/467 Cc: Paulo Zanoni <przanoni@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-05-04perf/x86/intel/lbr: Fix LBR filterPeter Zijlstra
The LBR 'from' adddress is under full userspace control; ensure we validate it before reading from it. Note: is_module_text_address() can potentially be quite expensive; for those running into that with high overhead in modules optimize it using an RCU backed rb-tree. Reported-by: Andi Kleen <ak@linux.intel.com> Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: <stable@kernel.org> Cc: eranian@google.com Link: http://lkml.kernel.org/r/20130503121256.158211806@chello.nl Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: http://lkml.kernel.org/n/tip-mk8i82ffzax01cnqo829iy1q@git.kernel.org
2013-05-04perf/x86: Blacklist all MEM_*_RETIRED events for Ivy BridgePeter Zijlstra
Errata BV98 states that all MEM_*_RETIRED events corrupt the counter value of the SMT sibling's counters. Blacklist these events Reported-by: Andi Kleen <ak@linux.intel.com> Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: <stable@kernel.org> Cc: eranian@google.com Link: http://lkml.kernel.org/r/20130503121256.083340271@chello.nl Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: http://lkml.kernel.org/n/tip-jwra43mujrv1oq9xk6mfe57v@git.kernel.org
2013-05-04sched: Keep at least 1 tick per second for active dynticks tasksFrederic Weisbecker
The scheduler doesn't yet fully support environments with a single task running without a periodic tick. In order to ensure we still maintain the duties of scheduler_tick(), keep at least 1 tick per second. This makes sure that we keep the progression of various scheduler accounting and background maintainance even with a very low granularity. Examples include cpu load, sched average, CFS entity vruntime, avenrun and events such as load balancing, amongst other details handled in sched_class::task_tick(). This limitation will be removed in the future once we get these individual items to work in full dynticks CPUs. Suggested-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com> Cc: Christoph Lameter <cl@linux.com> Cc: Hakan Akkan <hakanakkan@gmail.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: Kevin Hilman <khilman@linaro.org> Cc: Li Zhong <zhong@linux.vnet.ibm.com> Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Paul Gortmaker <paul.gortmaker@windriver.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Thomas Gleixner <tglx@linutronix.de>
2013-05-04rcu: Fix full dynticks' dependency on wide RCU nocb modeFrederic Weisbecker
Commit 0637e029392386e6996f5d6574aadccee8315efa ("nohz: Select wide RCU nocb for full dynticks") intended to force CONFIG_RCU_NOCB_CPU_ALL=y when full dynticks is enabled. However this option is part of a choice menu and Kconfig's "select" instruction has no effect on such targets. Fix this by using reverse dependencies on the targets we don't want instead. Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com> Cc: Christoph Lameter <cl@linux.com> Cc: Hakan Akkan <hakanakkan@gmail.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: Kevin Hilman <khilman@linaro.org> Cc: Li Zhong <zhong@linux.vnet.ibm.com> Cc: Paul Gortmaker <paul.gortmaker@windriver.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Thomas Gleixner <tglx@linutronix.de>
2013-05-03iscsi-target: Make buf param of iscsit_do_crypto_hash_buf() const void *Geert Uytterhoeven
Make the "buf" input param of iscsit_do_crypto_hash_buf() "const void *". This allows to remove lots of casts in its callers. Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-05-03iscsi-target: Fix NULL pointer dereference in iscsit_send_rejectNicholas Bellinger
Fix up a NULL pointer dereference regression in iscsit_send_reject() introduced by from commit 2ec5a8c11. Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-05-03target: Have dev/enable show if TCM device is configuredAndy Grover
User tools need to know if the device is properly configured, since if not, some other attributes are invalid. Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-05-03target: Use FD_MAX_SECTORS/FD_BLOCKSIZE for blockdevs using fileioAndy Grover
We can still see the error reported in https://patchwork.kernel.org/patch/2338981/ when using fileio backed by a block device. I'm assuming this will get us past that error (from sbc_parse_cdb), and also assuming it's OK to have our max_sectors be larger than the block's queue max hw sectors? Reported-by: Eric Harney <eharney@redhat.com> Signed-off-by: Andy Grover <agrover@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-05-03target: Remove unused struct members in se_dev_entryAndy Grover
Some were incremented, but never used anywhere from what I could tell. Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-05-03ring-buffer: Select IRQ_WORKSteven Rostedt (Red Hat)
As the wake up logic for waiters on the buffer has been moved from the tracing code to the ring buffer, it requires also adding IRQ_WORK as the wake up code is performed via irq_work. This fixes compile breakage when a user of the ring buffer is selected but tracing and irq_work are not. Link http://lkml.kernel.org/r/20130503115332.GT8356@rric.localhost Cc: Arnd Bergmann <arnd@arndb.de> Reported-by: Robert Richter <rric@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-05-03ARM: OMAP2+: Fix unmet direct dependencies for SERIAL_OMAPTony Lindgren
Commit 8a6201b9 (ARM: OMAP2+: Fix unmet direct dependencies for zoom for 8250 serial) fixed unmet direct dependencies for 8250, but failed to do the same for omap serial. This can cause the following warning: warning: (ARCH_OMAP2PLUS_TYPICAL) selects SERIAL_OMAP which has unmet direct dependencies (TTY && HAS_IOMEM && GENERIC_HARDIRQS && ARCH_OMAP2PLUS). We should not select drivers, they should be selected by the user. Fix the issue by removing the select and adding them to omap2plus_defconfig instead. Signed-off-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-05-03ARM: ux500: always select ABX500_COREArnd Bergmann
We are probably selecting more drivers than we should in ux500, but cleaning up that logic for good can be left for another time. Most of these could be converted into silent options in the future, since they are always enabled on ux500 and never needed elsewhere. As a fixup for 3.10, let's at least select the dependencies for the other drivers we already select, to make it consistent. warning: (UX500_SOC_COMMON) selects AB8500_CORE which has unmet direct dependencies (HAS_IOMEM && GENERIC_HARDIRQS && ABX500_CORE && MFD_DB8500_PRCMU) Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Linus Walleij <linus.walleij@linaro.org>
2013-05-03ARM: SIRF: select SMP_ON_UP only on SMP buildsArnd Bergmann
Like all other platforms, we can only select SMP_ON_UP if SMP is also enabled. warning: (SOC_IMX31 && SOC_IMX35 && ARCH_MARCO) selects SMP_ON_UP which has unmet direct dependencies (SMP && !XIP_KERNEL) Cc: Barry Song <baohua.song@csr.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-05-03ARM: SPEAr: conditionalize l2x0 supportArnd Bergmann
If the cache controller implementation is disabled at build time, we must not call any functions related to it. arch/arm/mach-spear/built-in.o: In function `spear13xx_l2x0_init': arch/arm/mach-spear/spear13xx.c:47: undefined reference to `l2x0_init' Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Viresh Kumar <viresh.linux@gmail.com>
2013-05-03ARM: imx: build CPU suspend code only when neededArnd Bergmann
The ARM CPU suspend function has its own configuration symbol, which we need to use for conditionalizing any code calling into it as well. arch/arm/mach-imx/built-in.o: In function `v7_cpu_resume': /git/arm-soc/arch/arm/mach-imx/headsmp.S:57: undefined reference to `cpu_resume' Cc: Sascha Hauer <kernel@pengutronix.de> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-05-03ARM: OMAP: build SMP code only for OMAP4/5Arnd Bergmann
The OMAP platform code assumes that SMP is only ever enabled when CONFIG_ARCH_OMAP4 or CONFIG_SOC_OMAP5 is enabled, which is not necessarirly true in a multiplatform configuration. arch/arm/mach-omap2/built-in.o: In function `omap4_smp_prepare_cpus': :(.init.text+0x413c): undefined reference to `omap_get_wakeupgen_base' :(.init.text+0x415c): undefined reference to `omap_secure_apis_support' arch/arm/mach-omap2/built-in.o: In function `omap4_boot_secondary': :(.cpuinit.text+0x28): undefined reference to `omap_get_wakeupgen_base' :(.cpuinit.text+0x3c): undefined reference to `omap_secure_apis_support' arch/arm/mach-omap2/built-in.o: In function `omap4_cpu_die': :(.ref.text+0x8): undefined reference to `omap_get_wakeupgen_base' :(.ref.text+0x10): undefined reference to `omap_secure_apis_support' :(.ref.text+0x4c): undefined reference to `omap4_hotplug_cpu' :(.ref.text+0x50): undefined reference to `omap_secure_apis_support' Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Tony Lindgren <tony@atomide.com>
2013-05-03nfsd4: don't allow owner override on 4.1 CLAIM_FH opensJ. Bruce Fields
The Linux client is using CLAIM_FH to implement regular opens, not just recovery cases, so it depends on the server to check permissions correctly. Therefore the owner override, which may make sense in the delegation recovery case, isn't right in the CLAIM_FH case. Symptoms: on a client with 49f9a0fafd844c32f2abada047c0b9a5ba0d6255 "NFSv4.1: Enable open-by-filehandle", Bryan noticed this: touch test.txt chmod 000 test.txt echo test > test.txt succeeding. Cc: stable@kernel.org Reported-by: Bryan Schumaker <bjschuma@netapp.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2013-05-03ARM: tegra: Tegra114 needs CPU_FREQ_TABLEArnd Bergmann
Like the other Tegra SoCs using the same cpufreq driver, we have to enable CPU_FREQ_TABLE for this one. drivers/built-in.o: In function `tegra_cpu_exit': drivers/cpufreq/tegra-cpufreq.c:237: undefined reference to `cpufreq_frequency_table_cpuinfo' Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Cc: Stephen Warren <swarren@nvidia.com> Cc: Hiroshi Doyu <hdoyu@nvidia.com>
2013-05-03cxgb4: fix error recovery when t4_fw_hello returns a positive valueThadeu Lima de Souza Cascardo
Since commit 636f9d371f70f22961fd598fe18380057518ca31 ("cxgb4: Add support for T4 configuration file"), t4_fw_hello may return a positive value instead of 0 for success. The recovery code tests only for zero and fails recovery for any other value. This fix tests for negative error values and fails only on those cases. Error recovery after an error injection works after this change. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03sky2: Fix crash on receiving VLAN framesKirill Smelkov
After recent 86a9bad3 (net: vlan: add protocol argument to packet tagging functions) my sky2 started to crash on receive of tagged frames, with backtrace similar to #CRASH!!! vlan_do_receive __netif_receive_skb_core __netif_receive_skb netif_receive_skb sky2_poll ... __net_rx_action __do_softirq The problem turned out to be: 1) sky2 copies small packets from ring on RX, and in its receive_copy() skb header is copied manually field, by field, and only for some fields; 2) 86a9bad3 added skb->vlan_proto, which vlan_untag() or __vlan_hwaccel_put_tag() set, and which is later used in vlan_do_receive(). That patch updated copy_skb_header() for newly introduced skb->vlan_proto, but overlooked the need to also copy it in sky2's receive_copy(). Because of 2, we have the following scenario: - frame is received and tagged in a ring, by sky2_rx_tag(). Both skb->vlan_proto and skb->vlan_tci are set; - later skb is decided to be copied, but skb->vlan_proto is forgotten and becomes 0. - in the beginning of vlan_do_receive() we call __be16 vlan_proto = skb->vlan_proto; vlan_dev = vlan_find_dev(skb->dev, vlan_proto, vlan_id); which eventually invokes vlan_proto_idx(vlan_proto) and that routine BUGs for everything except ETH_P_8021Q and ETH_P_8021AD. Oops. Fix it. P.S. Stephen, I wonder, why copy_skb_header() is not used in sky2.c::receive_copy() ? Problems, where receive_copy was updated field by field showed several times already, e.g. 3f42941b (sky2: propogate rx hash when packet is copied) e072b3fa (sky2: fix receive length error in mixed non-VLAN/VLAN traffic) Cc: Patrick McHardy <kaber@trash.net> Cc: Stephen Hemminger <stephen@networkplumber.org> Cc: Mirko Lindner <mlindner@marvell.com> Signed-off-by: Kirill Smelkov <kirr@mns.spb.ru> Acked-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03packet: tpacket_v3: do not trigger bug() on wrong header statusDaniel Borkmann
Jakub reported that it is fairly easy to trigger the BUG() macro from user space with TPACKET_V3's RX_RING by just giving a wrong header status flag. We already had a similar situation in commit 7f5c3e3a80e6654 (``af_packet: remove BUG statement in tpacket_destruct_skb'') where this was the case in the TX_RING side that could be triggered from user space. So really, don't use BUG() or BUG_ON() unless there's really no way out, and i.e. don't use it for consistency checking when there's user space involved, no excuses, especially not if you're slapping the user with WARN + dump_stack + BUG all at once. The two functions are of concern: prb_retire_current_block() [when block status != TP_STATUS_KERNEL] prb_open_block() [when block_status != TP_STATUS_KERNEL] Calls to prb_open_block() are guarded by ealier checks if block_status is really TP_STATUS_KERNEL (racy!), but the first one BUG() is easily triggable from user space. System behaves still stable after they are removed. Also remove that yoda condition entirely, since it's already guarded. Reported-by: Jakub Zawadzki <darkjames-ws@darkjames.pl> Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03asix: fix BUG in receive path when lowering MTUholger@eitzenberger.org
There is bug in the receive path of the asix driver at the time a packet is received larger than MTU size and DF bit set: BUG: unable to handle kernel paging request at 0000004000000001 IP: [<ffffffff8126f65b>] skb_release_head_state+0x2d/0xd2 ... Call Trace: <IRQ> [<ffffffff8126f86d>] ? skb_release_all+0x9/0x1e [<ffffffff8126f8ad>] ? __kfree_skb+0x9/0x6f [<ffffffffa00b4200>] ? asix_rx_fixup_internal+0xff/0x1ae [asix] [<ffffffffa00fb3dc>] ? usbnet_bh+0x4f/0x226 [usbnet] ... It is easily reproducable by setting an MTU of 512 e. g. and sending something like ping -s 1472 -c 1 -M do $SELF from another box. And this is because the rx->ax_skb is freed on error, but rx->ax_skb is not reset, and the size is not reset to zero in this case. And since the skb is added again to the usbnet->done skb queue it is accessing already freed memory, resulting in the BUG when freeing a 2nd time. I therefore think the value 0x0000004000000001 show in the trace is more or less random data. Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03net: qmi_wwan: Add Telewell TW-LTE 4GTeppo Kotilainen
Information from driver description files: diag: VID_19D2&PID_0412&MI_00 nmea: VID_19D2&PID_0412&MI_01 at: VID_19D2&PID_0412&MI_02 modem: VID_19D2&PID_0412&MI_03 net: VID_19D2&PID_0412&MI_04 Signed-off-by: Teppo Kotilainen <qubit303@gmail.com> Acked-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03usbnet: pegasus: endian bug in write_mii_word()Dan Carpenter
We're only passing the two high bytes of an integer. It works for little endian but not for big endian. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03vxlan: Fix TCPv6 segmentation.Pravin B Shelar
This patch set correct skb->protocol so that inner packet can lookup correct gso handler. Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03gre: Fix GREv4 TCPv6 segmentation.Pravin B Shelar
For ipv6 traffic, GRE can generate packet with strange GSO bits, e.g. ipv4 packet with SKB_GSO_TCPV6 flag set. Therefore following patch relaxes check in inet gso handler to allow such packet for segmentation. This patch also fixes wrong skb->protocol set that was done in gre_gso_segment() handler. Reported-by: Steinar H. Gunderson <sesse@google.com> CC: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03bridge: fix race with topology change timerstephen hemminger
A bridge should only send topology change notice if it is not the root bridge. It is possible for message age timer to elect itself as a new root bridge, and still have a topology change timer running but waiting for bridge lock on other CPU. Solve the race by checking if we are root bridge before continuing. This was the root cause of the cases where br_send_tcn_bpdu would OOPS. Reported-by: JerryKang <jerry.kang@samsung.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03tipc: pskb_copy() buffers when sending on more than one bearerGerlando Falauto
When sending packets, TIPC bearers use skb_clone() before writing their hardware header. This will however NOT copy the data buffer. So when the same packet is sent over multiple bearers (to reach multiple nodes), the same socket buffer data will be treated by multiple tipc_media drivers which will write their own hardware header through dev_hard_header(). Most of the time this is not a problem, because by the time the packet is processed by the second media, it has already been sent over the first one. However, when the first transmission is delayed (e.g. because of insufficient bandwidth or through a shaper), the next bearer will overwrite the hardware header, resulting in the packet being sent: a) with the wrong source address, when bearers of the same type, e.g. ethernet, are involved b) with a completely corrupt header, or even dropped, when bearers of different types are involved. So when the same socket buffer is to be sent multiple times, send a pskb_copy() instead (from the second instance on), and release it afterwards (the bearer will skb_clone() it anyway). Signed-off-by: Gerlando Falauto <gerlando.falauto@keymile.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03tipc: tipc_bcbearer_send(): simplify bearer selectionGerlando Falauto
Signed-off-by: Gerlando Falauto <gerlando.falauto@keymile.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03tipc: cosmetic: clean up comments and break a long lineGerlando Falauto
Signed-off-by: Gerlando Falauto <gerlando.falauto@keymile.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-03Merge branch 'for-3.10' of git://linux-nfs.org/~bfields/linuxLinus Torvalds
Pull nfsd changes from J Bruce Fields: "Highlights include: - Some more DRC cleanup and performance work from Jeff Layton - A gss-proxy upcall from Simo Sorce: currently krb5 mounts to the server using credentials from Active Directory often fail due to limitations of the svcgssd upcall interface. This replacement lifts those limitations. The existing upcall is still supported for backwards compatibility. - More NFSv4.1 support: at this point, if a user with a current client who upgrades from 4.0 to 4.1 should see no regressions. In theory we do everything a 4.1 server is required to do. Patches for a couple minor exceptions are ready for 3.11, and with those and some more testing I'd like to turn 4.1 on by default in 3.11." Fix up semantic conflict as per Stephen Rothwell and linux-next: Commit 030d794bf498 ("SUNRPC: Use gssproxy upcall for server RPCGSS authentication") adds two new users of "PDE(inode)->data", but we're supposed to use "PDE_DATA(inode)" instead since commit d9dda78bad87 ("procfs: new helper - PDE_DATA(inode)"). The old PDE() macro is no longer available since commit c30480b92cf4 ("proc: Make the PROC_I() and PDE() macros internal to procfs") * 'for-3.10' of git://linux-nfs.org/~bfields/linux: (60 commits) NFSD: SECINFO doesn't handle unsupported pseudoflavors correctly NFSD: Simplify GSS flavor encoding in nfsd4_do_encode_secinfo() nfsd: make symbol nfsd_reply_cache_shrinker static svcauth_gss: fix error return code in rsc_parse() nfsd4: don't remap EISDIR errors in rename svcrpc: fix gss-proxy to respect user namespaces SUNRPC: gssp_procedures[] can be static SUNRPC: define {create,destroy}_use_gss_proxy_proc_entry in !PROC case nfsd4: better error return to indicate SSV non-support nfsd: fix EXDEV checking in rename SUNRPC: Use gssproxy upcall for server RPCGSS authentication. SUNRPC: Add RPC based upcall mechanism for RPCGSS auth SUNRPC: conditionally return endtime from import_sec_context SUNRPC: allow disabling idle timeout SUNRPC: attempt AF_LOCAL connect on setup nfsd: Decode and send 64bit time values nfsd4: put_client_renew_locked can be static nfsd4: remove unused macro nfsd4: remove some useless code nfsd4: implement SEQ4_STATUS_RECALLABLE_STATE_REVOKED ...
2013-05-03ath5k: do not reschedule tx_complete_work on stopStanislaw Gruszka
This patch claim to fix "WARNING: at net/mac80211/util.c:599 ieee80211_can_queue_work.isra.7+0x30/0x40", which was reported at: https://bugzilla.redhat.com/show_bug.cgi?id=922295 We use ATH_STAT_STARTED flag to disallow to perform ath5k_tx_complete_poll_work() code, hence reschedule ah->tx_complete_work, when we stop device. This flag was defined in ath5k code, but it was not used. I didn't get feedback if the fix works, so patch is compile only tested. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>