summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-10-23Merge tag 'trace-fixes-v4.3-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Running tests on other changes, the system locked up due to lots of warnings. It was caused by the stack tracer triggering a warning about using rcu_dereference() when RCU was not watching. This can happen due to the fact that the stack tracer uses the function tracer to check each function, and there are functions that may be called and traced when RCU stopped watching. Namely when a function is called just before going idle or to userspace and after RCU stopped watching that current CPU. The first patch makes sure that RCU is watching when the stack tracer uses RCU. The second patch is to make sure that the stack tracer does not get called by functions in NMI, as it's not NMI safe" * tag 'trace-fixes-v4.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Do not allow stack_tracer to record stack in NMI tracing: Have stack tracer force RCU to be watching
2015-10-23Merge tag 'sound-4.3-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "There is nothing to worry you much, only a few small & stable patches are found for usual stuff, HD-audio (a Lenovo laptop quirk, a fix for minor error handling) and ASoC (trivial fixes for RT298 and WM codecs). The only remaining major change is the fix for ASoC SX_TLV control that was overseen during refactoring, but the fix itself is trivial and safe" * tag 'sound-4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: wm8962: mark cache_dirty flag after software reset in pm_resume ASoC: rt298: fix wrong setting of gpio2_en ASoC: wm8904: Correct number of EQ registers ALSA: hda - Fix deadlock at error in building PCM ASoC: Add info callback for SX_TLV controls ASoC: rt298: correct index default value ALSA: hda - Fix inverted internal mic on Lenovo G50-80 ALSA: hdac: Explicitly add io.h
2015-10-23Merge tag 'media/v4.3-4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "Some regression fixes and potential security issues: - netup_unidvb: fix potential crash when spi is NULL - rtl28xxu: fix control message flaws - m88ds3103: fix a regression on Kernel 4.2 - c8sectpfe: fix some issues on this new driver - v4l2-flash-led-class: fix a Kbuild dependency - si2157 and si2158: check for array boundary when uploading firmware files - horus3a and lnbh25: fix some building troubles when some options aren't selected - ir-hix5hd2: drop the use of IRQF_NO_SUSPEND" * tag 'media/v4.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] m88ds3103: use own reg update_bits() implementation [media] rtl28xxu: fix control message flaws [media] v4l2-flash-led-class: Add missing VIDEO_V4L2 Kconfig dependency [media] netup_unidvb: fix potential crash when spi is NULL [media] si2168: Bounds check firmware [media] si2157: Bounds check firmware [media] ir-hix5hd2: drop the use of IRQF_NO_SUSPEND [media] c8sectpfe: fix return of garbage [media] c8sectpfe: fix ininitialized error return on firmware load failure [media] lnbh25: Fix lnbh25_attach() function return type [media] horus3a: Fix horus3a_attach() function parameters
2015-10-23Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
Pull drm fixes from Dave Airlie: "I've been a bit slow gathering these: - drm/mst: one mutex leak in a fail path - radeon: two oops fixes, one dpm fix - i915: one messy set of fixes, where we revert the original fix, and pull back the proper set of fixes from -next on top. - nouveau: one fix for an illegal buffer placement. Doesn't look too bad, hopefully shouldn't be too much more" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/nouveau/gem: return only valid domain when there's only one drm: fix mutex leak in drm_dp_get_mst_branch_device drm/amdgpu: add missing dpm check for KV dpm late init drm/amdgpu/dpm: don't add pwm attributes if DPM is disabled drm/radeon/dpm: don't add pwm attributes if DPM is disabled drm/i915: Add primary plane to mask if it's visible drm/i915: Move sprite/cursor plane disable to intel_sanitize_crtc() drm/i915: Assign hwmode after encoder state readout Revert "drm/i915: Add primary plane to mask if it's visible" drm/i915: Deny wrapping an userptr into a framebuffer drm/i915: Enable DPLL VGA mode before P1/P2 divider write drm/i915: Restore lost DPLL register write on gen2-4 drm/i915: Flush pipecontrol post-sync writes drm/i915: Fix kerneldoc for i915_gem_shrink_all
2015-10-23Merge tag 'asoc-fix-v4.3-rc6' of ↵Takashi Iwai
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v4.3 A bunch of driver fixes plus one core fix which fixes problems with misreporting values from _SX controls following a recent refactoring. This had gone unnoticed as such controls are quite rare.
2015-10-23Merge remote-tracking branches 'asoc/fix/rt298', 'asoc/fix/sx', ↵Mark Brown
'asoc/fix/wm8904' and 'asoc/fix/wm8962' into asoc-linus
2015-10-23Merge remote-tracking branch 'asoc/fix/rt5645' into asoc-linusMark Brown
2015-10-22[media] m88ds3103: use own reg update_bits() implementationAntti Palosaari
Device stopped to tuning some channels after regmap conversion. Reason is that regmap_update_bits() works a bit differently for partially volatile registers than old homemade routine. Return back to old routine in order to fix issue. Fixes: 478932b16052f5ded74685d096ae920cd17d6424 Cc: <stable@kernel.org> # 4.2+ Reported-by: Mark Clarkstone <hello@markclarkstone.co.uk> Tested-by: Mark Clarkstone <hello@markclarkstone.co.uk> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-10-22[media] rtl28xxu: fix control message flawsAntti Palosaari
Add lock to prevent concurrent access for control message as control message function uses shared buffer. Without the lock there may be remote control polling which messes the buffer causing IO errors. Increase buffer size and add check for maximum supported message length. Link: https://bugzilla.kernel.org/show_bug.cgi?id=103391 Fixes: c56222a6b25c ("[media] rtl28xxu: move usb buffers to state") Cc: <stable@vger.kernel.org> # 4.0+ Signed-off-by: Antti Palosaari <crope@iki.fi>
2015-10-22[media] v4l2-flash-led-class: Add missing VIDEO_V4L2 Kconfig dependencyJacek Anaszewski
Fixes the following randconfig problem: drivers/built-in.o: In function `v4l2_flash_release': (.text+0x12204f): undefined reference to `v4l2_async_unregister_subdev' drivers/built-in.o: In function `v4l2_flash_release': (.text+0x122057): undefined reference to `v4l2_ctrl_handler_free' drivers/built-in.o: In function `v4l2_flash_close': v4l2-flash-led-class.c:(.text+0x12208f): undefined reference to `v4l2_fh_is_singular' v4l2-flash-led-class.c:(.text+0x1220c8): undefined reference to `__v4l2_ctrl_s_ctrl' drivers/built-in.o: In function `v4l2_flash_open': v4l2-flash-led-class.c:(.text+0x12227f): undefined reference to `v4l2_fh_is_singular' drivers/built-in.o: In function `v4l2_flash_init_controls': v4l2-flash-led-class.c:(.text+0x12274e): undefined reference to `v4l2_ctrl_handler_init_class' v4l2-flash-led-class.c:(.text+0x122797): undefined reference to `v4l2_ctrl_new_std_menu' v4l2-flash-led-class.c:(.text+0x1227e0): undefined reference to `v4l2_ctrl_new_std' v4l2-flash-led-class.c:(.text+0x122826): undefined reference to `v4l2_ctrl_handler_setup' v4l2-flash-led-class.c:(.text+0x122839): undefined reference to `v4l2_ctrl_handler_free' drivers/built-in.o: In function `v4l2_flash_init': (.text+0x1228e2): undefined reference to `v4l2_subdev_init' drivers/built-in.o: In function `v4l2_flash_init': (.text+0x12293b): undefined reference to `v4l2_async_register_subdev' drivers/built-in.o: In function `v4l2_flash_init': (.text+0x122949): undefined reference to `v4l2_ctrl_handler_free' drivers/built-in.o:(.rodata+0x20ef8): undefined reference to `v4l2_subdev_queryctrl' drivers/built-in.o:(.rodata+0x20f10): undefined reference to `v4l2_subdev_querymenu' Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com> Reported-by: kbuild test robot <fengguang.wu@intel.com> Cc: Sakari Ailus <sakari.ailus@iki.fi> Cc: Hans Verkuil <hans.verkuil@cisco.com>
2015-10-22[media] netup_unidvb: fix potential crash when spi is NULLAbylay Ospan
Signed-off-by: Abylay Ospan <aospan@netup.ru> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-10-22[media] si2168: Bounds check firmwareLaura Abbott
When reading the firmware and sending commands, the length must be bounds checked to avoid overrunning the size of the command buffer and smashing the stack if the firmware is not in the expected format: si2168 11-0064: found a 'Silicon Labs Si2168-B40' si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw' si2168 11-0064: firmware download failed -95 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f Add the proper check. Cc: stable@kernel.org Reported-by: Stuart Auchterlonie <sauchter@redhat.com> Reviewed-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Laura Abbott <labbott@fedoraproject.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-10-22[media] si2157: Bounds check firmwareLaura Abbott
When reading the firmware and sending commands, the length must be bounds checked to avoid overrunning the size of the command buffer and smashing the stack if the firmware is not in the expected format. Add the proper check. Cc: stable@kernel.org Signed-off-by: Laura Abbott <labbott@fedoraproject.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-10-22[media] ir-hix5hd2: drop the use of IRQF_NO_SUSPENDSudeep Holla
This driver doesn't claim the IR transmitter to be wakeup source. It even disables the clock and the IR during suspend-resume cycle. This patch removes yet another misuse of IRQF_NO_SUSPEND. Cc: Patrice Chotard <patrice.chotard@st.com> Cc: Fabio Estevam <fabio.estevam@freescale.com> Cc: Guoxiong Yan <yanguoxiong@huawei.com> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-10-22[media] c8sectpfe: fix return of garbageSudip Mukherjee
The variable err was never initialized, that means we had been checking a garbage value in the for loop. Moreover if the segment is not outside the firmware file then also we have been returning the garbage. Initialize it to 0 so that on success we return the value and no need to check in the for loop also as it is initially 0 and whenever that value changes we have done a break from the loop. Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-10-22[media] c8sectpfe: fix ininitialized error return on firmware load failureColin Ian King
static analysis with cppcheck detected the following error: [drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c:1210]: (error) Uninitialized variable: ret ret is never initialised, so garbage is being returned. Instead return the error return from the call of request_firmware_nowait Signed-off-by: Colin Ian King <colin.king@canonical.com>
2015-10-22[media] lnbh25: Fix lnbh25_attach() function return typeJavier Martinez Canillas
If CONFIG_DVB_LNBH25 is disabled, a stub static inline function is defined that just prints a warning about the driver being disabled but the function return type was wrong which caused a build error. Fixes: e025273b86fb ("[media] lnbh25: LNBH25 SEC controller driver") Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
2015-10-22[media] horus3a: Fix horus3a_attach() function parametersJavier Martinez Canillas
If CONFIG_DVB_HORUS3A is disabled a stub static inline function is defined that just prints a warning about the driver being disabled but the function parameters were wrong which caused a build error. Fixes: a5d32b358254f ("[media] horus3a: Sony Horus3A DVB-S/S2 tuner driver") Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
2015-10-22ASoC: wm8962: mark cache_dirty flag after software reset in pm_resumeJiada Wang
By doing software reset of wm8962 in pm_resume, all registers which have already been set will be reset to default value without regmap interface be involved, thus driver need to mark cache_dirty flag, to let regcache can be updated by regcache_sync(). Signed-off-by: Jiada Wang <jiada_wang@mentor.com> Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-10-22Merge branch 'drm-fixes-4.3' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie
into drm-fixes Just a crash fix for radeon and amdgpu if the user has forcibly disabled dpm and tries to access the pwm sysfs controls. * 'drm-fixes-4.3' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu: add missing dpm check for KV dpm late init drm/amdgpu/dpm: don't add pwm attributes if DPM is disabled drm/radeon/dpm: don't add pwm attributes if DPM is disabled
2015-10-22Merge tag 'drm-intel-fixes-2015-10-16' of ↵Dave Airlie
git://anongit.freedesktop.org/drm-intel into drm-fixes The revert dance could use some explanation: we had stuff fixed in -next, and initially backported one commit to v4.3. Now, turns out we need more fixes, and we could cherry-pick them all without conflicts if we reverted the backported one first. So did that to not have to edit and backport them all. * tag 'drm-intel-fixes-2015-10-16' of git://anongit.freedesktop.org/drm-intel: drm/i915: Add primary plane to mask if it's visible drm/i915: Move sprite/cursor plane disable to intel_sanitize_crtc() drm/i915: Assign hwmode after encoder state readout Revert "drm/i915: Add primary plane to mask if it's visible" drm/i915: Deny wrapping an userptr into a framebuffer drm/i915: Enable DPLL VGA mode before P1/P2 divider write drm/i915: Restore lost DPLL register write on gen2-4 drm/i915: Flush pipecontrol post-sync writes drm/i915: Fix kerneldoc for i915_gem_shrink_all
2015-10-22Merge branch 'linux-4.3' of git://anongit.freedesktop.org/nouveau/linux-2.6 ↵Dave Airlie
into drm-fixes Just one fix from Ilia to resolve various issues that have resulted from buffer eviction. * 'linux-4.3' of git://anongit.freedesktop.org/nouveau/linux-2.6: drm/nouveau/gem: return only valid domain when there's only one
2015-10-22drm/nouveau/gem: return only valid domain when there's only oneIlia Mirkin
On nv50+, we restrict the valid domains to just the one where the buffer was originally created. However after the buffer is evicted to system memory, we might move it back to a different domain that was not originally valid. When sharing the buffer and retrieving its GEM_INFO data, we still want the domain that will be valid for this buffer in a pushbuf, not the one where it currently happens to be. This resolves fdo#92504 and several others. These are due to suspend evicting all buffers, making it more likely that they temporarily end up in the wrong place. Cc: stable@vger.kernel.org Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92504 Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2015-10-22drm: fix mutex leak in drm_dp_get_mst_branch_deviceAdam Richter
In Linux 4.3-rc5, there is an error case in drm_dp_get_branch_device that returns without releasing mgr->lock, resulting a spew of kernel messages about a kernel work function possibly having leaked a mutex and presumably more serious adverse consequences later. This patch changes the error to "goto out" to unlock the mutex before returning. [airlied: grabbed from drm-next as it fixes something we've seen] Signed-off-by: Adam J. Richter <adam_richter2004@yahoo.com> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Dave Airlie <airlied@redhat.com>
2015-10-22Merge tag 'for-linus-20151021' of git://git.infradead.org/intel-iommuLinus Torvalds
Pull intel-iommu bugfix from David Woodhouse: "This contains a single fix, for when the IOMMU API is used to overlay an existing mapping comprised of 4KiB pages, with a mapping that can use superpages. For the *first* superpage in the new mapping, we were correctly¹ freeing the old bottom-level page table page and clearing the link to it, before installing the superpage. For subsequent superpages, however, we weren't. This causes a memory leak, and a warning about setting a PTE which is already set. ¹ Well, not *entirely* correctly. We just free the page table pages right there and then, which is wrong. In fact they should only be freed *after* the IOTLB is flushed so we know the hardware will no longer be looking at them.... and in fact I note that the IOTLB flush is completely missing from the intel_iommu_map() code path, although it needs to be there if it's permitted to overwrite existing mappings. Fixing those is somewhat more intrusive though, and will probably need to wait for 4.4 at this point" * tag 'for-linus-20151021' of git://git.infradead.org/intel-iommu: iommu/vt-d: fix range computation when making room for large pages
2015-10-22Merge tag 'mmc-v4.3-rc5' of git://git.linaro.org/people/ulf.hansson/mmcLinus Torvalds
Pull MMC bugfix from Ulf Hansson: "Here's yet another MMC fix intended for v4.3 rc7. I don't expect to send any further pull requests for 4.3 rc[n]. MMC core: - Don't re-tune in the reset sequence to allow re-init of the card" * tag 'mmc-v4.3-rc5' of git://git.linaro.org/people/ulf.hansson/mmc: mmc: core: Fix init_card in 52Mhz
2015-10-21ASoC: rt298: fix wrong setting of gpio2_enBard Liao
The register value to enable gpio2 was incorrect. So fix it. Signed-off-by: Bard Liao <bardliao@realtek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-10-21mmc: core: Fix init_card in 52MhzChaotian Jing
Suppose that we got a data crc error, and it triggers the mmc_reset. mmc_reset will call mmc_send_status to see if HW reset was supported. before issue CMD13, it will do retune, and if EMMC was in HS400 mode, it will reduce frequency to 52Mhz firstly, then results in card init was doing at 52Mhz. The mmc_send_status was originally only done for mmc_test, should drop it. And, rename the "eMMC hardware reset" to "Reset test", as we would also be able to use the test for SD-cards. Signed-off-by: Chaotian Jing <chaotian.jing@mediatek.com> Suggested-by: Adrian Hunter <adrian.hunter@intel.com> Fixes: bd11e8bd03ca ("mmc: core: Flag re-tuning is needed on CRC errors") Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2015-10-20tracing: Do not allow stack_tracer to record stack in NMISteven Rostedt (Red Hat)
The code in stack tracer should not be executed within an NMI as it grabs spinlocks and stack tracing an NMI gives the possibility of causing a deadlock. Although this is safe on x86_64, because it does not perform stack traces when the task struct stack is not in use (interrupts and NMIs), it may be an issue for NMIs on i386 and other archs that use the same stack as the NMI. Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2015-10-20tracing: Have stack tracer force RCU to be watchingSteven Rostedt (Red Hat)
The stack tracer was triggering the WARN_ON() in module.c: static void module_assert_mutex_or_preempt(void) { #ifdef CONFIG_LOCKDEP if (unlikely(!debug_locks)) return; WARN_ON(!rcu_read_lock_sched_held() && !lockdep_is_held(&module_mutex)); #endif } The reason is that the stack tracer traces all function calls, and some of those calls happen while exiting or entering user space and idle. Some of these functions are called after RCU had already stopped watching, as RCU does not watch userspace or idle CPUs. If a max stack is hit, then the save_stack_trace() is called, which will check module addresses and call module_assert_mutex_or_preempt(), and then trigger the warning. Sad part is, the warning itself will also do a stack trace and tigger the same warning. That probably should be fixed. The warning was added by 0be964be0d45 "module: Sanitize RCU usage and locking" but this bug has probably been around longer. But it's unlikely to cause much harm, but the new warning causes the system to lock up. Cc: stable@vger.kernel.org # 4.2+ Cc: Peter Zijlstra <peterz@infradead.org> Cc:"Paul E. McKenney" <paulmck@linux.vnet.ibm.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2015-10-20ASoC: wm8904: Correct number of EQ registersCharles Keepax
There are 24 EQ registers not 25, I suspect this bug came about because the registers start at EQ1 not zero. The bug is relatively harmless as the extra register written is an unused one. Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2015-10-20ALSA: hda - Fix deadlock at error in building PCMTakashi Iwai
The HDA codec driver issues snd_hda_codec_reset() at the error path of PCM build. This was needed in the earlier code base, but the recent rewrite to use the standard bus binding made this a deadlock: modprobe D 0000000000000005 0 720 716 0x00000080 Call Trace: [<ffffffff816a5dbe>] schedule+0x3e/0x90 [<ffffffff816a61a5>] schedule_preempt_disabled+0x15/0x20 [<ffffffff816a7ae5>] __mutex_lock_slowpath+0xb5/0x120 [<ffffffff816a7b6b>] mutex_lock+0x1b/0x30 [<ffffffff8148656b>] device_release_driver+0x1b/0x30 [<ffffffff81485c15>] bus_remove_device+0x105/0x180 [<ffffffff814822b9>] device_del+0x139/0x260 [<ffffffffa05e0ec5>] snd_hdac_device_unregister+0x25/0x30 [snd_hda_core] [<ffffffffa074fa6a>] snd_hda_codec_reset+0x2a/0x70 [snd_hda_codec] [<ffffffffa075007b>] snd_hda_codec_build_pcms+0x18b/0x1b0 [snd_hda_codec] [<ffffffffa074a44e>] hda_codec_driver_probe+0xbe/0x140 [snd_hda_codec] [<ffffffff81486ac4>] driver_probe_device+0x1f4/0x460 [<ffffffff81486dc0>] __driver_attach+0x90/0xa0 [<ffffffff81484844>] bus_for_each_dev+0x64/0xa0 [<ffffffff814862de>] driver_attach+0x1e/0x20 [<ffffffff81485e7b>] bus_add_driver+0x1eb/0x280 [<ffffffff81487680>] driver_register+0x60/0xe0 [<ffffffffa074a0da>] __hda_codec_driver_register+0x5a/0x60 [snd_hda_codec] [<ffffffffa070a01e>] realtek_driver_init+0x1e/0x1000 [snd_hda_codec_realtek] [<ffffffff810002f3>] do_one_initcall+0xb3/0x200 [<ffffffff816a1fc5>] do_init_module+0x60/0x1f8 [<ffffffff810ee5c3>] load_module+0x1653/0x1bd0 [<ffffffff810eed48>] SYSC_finit_module+0x98/0xc0 [<ffffffff810eed8e>] SyS_finit_module+0xe/0x10 [<ffffffff816aa032>] entry_SYSCALL_64_fastpath+0x16/0x75 The simple fix is just to remove this call, since we don't need to think about unbinding at there any longer. Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=948758 Cc: <stable@vger.kernel.org> # v4.1+ Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-10-20Merge branch 'for-linus-4.3-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML fixes from Richard Weinberger: "This contains four overdue UML regression fixes" * 'for-linus-4.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: Fix kernel mode fault condition um: Fix waitpid() usage in helper code um: Do not rely on libc to provide modify_ldt() um: Fix out-of-tree build
2015-10-20Merge branch 'keys-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull key handling fixes from David Howells: "Here are two patches, the first of which at least should go upstream immediately: (1) Prevent a user-triggerable crash in the keyrings destructor when a negatively instantiated keyring is garbage collected. I have also seen this triggered for user type keys. (2) Prevent the user from using requesting that a keyring be created and instantiated through an upcall. Doing so is probably safe since the keyring type ignores the arguments to its instantiation function - but we probably shouldn't let keyrings be created in this manner" * 'keys-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: KEYS: Don't permit request_key() to construct a new keyring KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
2015-10-19um: Fix kernel mode fault conditionRichard Weinberger
We have to exclude memory locations <= PAGE_SIZE from the condition and let the kernel mode fault path catch it. Otherwise a kernel NULL pointer exception will be reported as a kernel user space access. Fixes: d2313084e2c (um: Catch unprotected user memory access) Signed-off-by: Richard Weinberger <richard@nod.at>
2015-10-19um: Fix waitpid() usage in helper codeRichard Weinberger
If UML is executing a helper program it is using waitpid() with the __WCLONE flag to wait for the program as the helper is executed from a clone()'ed thread. While using __WCLONE is perfectly fine for clone()'ed childs it won't detect terminated childs if the helper has issued an execve(). We have to use __WALL to wait for both clone()'ed and regular childs to detect the termination before and after an execve(). Reported-and-tested-by: Thomas Meyer <thomas@m3y3r.de> Signed-off-by: Richard Weinberger <richard@nod.at>
2015-10-19um: Do not rely on libc to provide modify_ldt()Hans-Werner Hilse
modify_ldt() was declared as an external symbol. Despite the man page for this syscall telling that there is no wrapper in glibc, since version 2.1 there actually is, so linking to the glibc works. Since modify_ldt() is not a POSIX interface, other libc implementations do not always provide a wrapper function. Even glibc headers do not provide a corresponding declaration. So go the recommended way to call this using syscall(). Signed-off-by: Hans-Werner Hilse <hwhilse@gmail.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2015-10-19um: Fix out-of-tree buildRichard Weinberger
Commit 30b11ee9a (um: Remove copy&paste code from init.h) uncovered an issue wrt. out-of-tree builds. For out-of-tree builds, we must not rely on relative paths. Before 30b11ee9a it worked by chance as no host code included generated header files. Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Richard Weinberger <richard@nod.at>
2015-10-19drm/amdgpu: add missing dpm check for KV dpm late initAlex Deucher
Skip dpm late init if dpm is disabled. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2015-10-19drm/amdgpu/dpm: don't add pwm attributes if DPM is disabledAlex Deucher
PWM fan control is only available with DPM. There is no non-DPM support on amdgpu, so we should never get a crash here because the sysfs nodes would never be created in the first place. Add the check just in case to be on the safe side. Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-10-19drm/radeon/dpm: don't add pwm attributes if DPM is disabledAlex Deucher
PWM fan control is only available with DPM. If DPM disabled, don't expose the PWM fan controls to avoid a crash. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=92524 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2015-10-19Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds
Pull networking fixes from David Miller: 1) Account for extra headroom in ath9k driver, from Felix Fietkau. 2) Fix OOPS in pppoe driver due to incorrect socket state transition, from Guillaume Nault. 3) Kill memory leak in amd-xgbe debugfx, from Geliang Tang. 4) Power management fixes for iwlwifi, from Johannes Berg. 5) Fix races in reqsk_queue_unlink(), from Eric Dumazet. 6) Fix dst_entry usage in ARP replies, from Jiri Benc. 7) Cure OOPSes with SO_GET_FILTER, from Daniel Borkmann. 8) Missing allocation failure check in amd-xgbe, from Tom Lendacky. 9) Various resource allocation/freeing cures in DSA< from Neil Armstrong. 10) A series of bug fixes in the openvswitch conntrack support, from Joe Stringer. 11) Fix two cases (BPF and act_mirred) where we have to clean the sender cpu stored in the SKB before transmitting. From WANG Cong and Alexei Starovoitov. 12) Disable VLAN filtering in promiscuous mode in mlx5 driver, from Achiad Shochat. 13) Older bnx2x chips cannot do 4-tuple UDP hashing, so prevent this configuration via ethtool. From Yuval Mintz. 14) Don't call rt6_uncached_list_flush_dev() from rt6_ifdown() when 'dev' is NULL, from Eric Biederman. 15) Prevent stalled link synchronization in tipc, from Jon Paul Maloy. 16) kcalloc() gstrings ethtool buffer before having driver fill it in, in order to prevent kernel memory leaking. From Joe Perches. 17) Fix mixxing rt6_info initialization for blackhole routes, from Martin KaFai Lau. 18) Kill VLAN regression in via-rhine, from Andrej Ota. 19) Missing pfmemalloc check in sk_add_backlog(), from Eric Dumazet. 20) Fix spurious MSG_TRUNC signalling in netlink dumps, from Ronen Arad. 21) Scrube SKBs when pushing them between namespaces in openvswitch, from Joe Stringer. 22) bcmgenet enables link interrupts too early, fix from Florian Fainelli. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (92 commits) net: bcmgenet: Fix early link interrupt enabling tunnels: Don't require remote endpoint or ID during creation. openvswitch: Scrub skb between namespaces xen-netback: correctly check failed allocation net: asix: add support for the Billionton GUSB2AM-1G-B USB adapter netlink: Trim skb to alloc size to avoid MSG_TRUNC net: add pfmemalloc check in sk_add_backlog() via-rhine: fix VLAN receive handling regression. ipv6: Initialize rt6_info properly in ip6_blackhole_route() ipv6: Move common init code for rt6_info to a new function rt6_info_init() Bluetooth: Fix initializing conn_params in scan phase Bluetooth: Fix conn_params list update in hci_connect_le_scan_cleanup Bluetooth: Fix remove_device behavior for explicit connects Bluetooth: Fix LE reconnection logic Bluetooth: Fix reference counting for LE-scan based connections Bluetooth: Fix double scan updates mlxsw: core: Fix race condition in __mlxsw_emad_transmit tipc: move fragment importance field to new header position ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings tipc: eliminate risk of stalled link synchronization ...
2015-10-19KEYS: Don't permit request_key() to construct a new keyringDavid Howells
If request_key() is used to find a keyring, only do the search part - don't do the construction part if the keyring was not found by the search. We don't really want keyrings in the negative instantiated state since the rejected/negative instantiation error value in the payload is unioned with keyring metadata. Now the kernel gives an error: request_key("keyring", "#selinux,bdekeyring", "keyring", KEY_SPEC_USER_SESSION_KEYRING) = -1 EPERM (Operation not permitted) Signed-off-by: David Howells <dhowells@redhat.com>
2015-10-18net: bcmgenet: Fix early link interrupt enablingFlorian Fainelli
Link interrupts are enabled in init_umac(), which is too early for us to process them since we do not yet have a valid PHY device pointer. On BCM7425 chips for instance, we will crash calling phy_mac_interrupt() because phydev is NULL. Fix this by moving the link interrupts enabling in bcmgenet_netif_start(), under a specific function: bcmgenet_link_intr_enable() and while at it, update the comments surrounding the code. Fixes: 6cc8e6d4dcb36 ("net: bcmgenet: Delay PHY initialization to bcmgenet_open()") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-18Merge tag 'wireless-drivers-for-davem-2015-10-17' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== iwlwifi: * mvm: flush fw_dump_wk when mvm fails to start * mvm: init card correctly on ctkill exit check * pci: add a few more PCI subvendor IDs for the 7265 series * fix firmware filename for 3160 * mvm: clear csa countdown when AP is stopped * mvm: fix D3 firmware PN programming * dvm: fix D3 firmware PN programming * mvm: fix D3 CCMP TX PN assignment rtlwifi: * rtl8821ae: Fix system lockups on boot ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-18tunnels: Don't require remote endpoint or ID during creation.Jesse Gross
Before lightweight tunnels existed, it really didn't make sense to create a tunnel that was not fully specified, such as without a destination IP address - the resulting packets would go nowhere. However, with lightweight tunnels, the opposite is true - it doesn't make sense to require this information when it will be provided later on by the route. This loosens the requirements for this information. An alternative would be to allow the relaxed version only when COLLECT_METADATA is enabled. However, since there are several variations on this theme (such as NBMA tunnels in GRE), just dropping the restrictions seems the most consistent across tunnels and with the existing configuration. CC: John Linville <linville@tuxdriver.com> Signed-off-by: Jesse Gross <jesse@nicira.com> Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-18openvswitch: Scrub skb between namespacesJoe Stringer
If OVS receives a packet from another namespace, then the packet should be scrubbed. However, people have already begun to rely on the behaviour that skb->mark is preserved across namespaces, so retain this one field. This is mainly to address information leakage between namespaces when using OVS internal ports, but by placing it in ovs_vport_receive() it is more generally applicable, meaning it should not be overlooked if other port types are allowed to be moved into namespaces in future. Signed-off-by: Joe Stringer <joestringer@nicira.com> Acked-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-18Merge branch 'for-upstream' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Johan Hedberg says: ==================== pull request: bluetooth 2015-10-16 First of all, sorry for the late set of patches for the 4.3 cycle. We just finished an intensive week of testing at the Bluetooth UnPlugFest and discovered (and fixed) issues there. Unfortunately a few issues affect 4.3-rc5 in a way that they break existing Bluetooth LE mouse and keyboard support. The regressions result from supporting LE privacy in conjunction with scanning for Resolvable Private Addresses before connecting. A feature that has been tested heavily (including automated unit tests), but sadly some regressions slipped in. The UnPlugFest with its multitude of test platforms is a good battle testing ground for uncovering every corner case. The patches in this pull request focus only on fixing the regressions in 4.3-rc5. The patches look a bit larger since we also added comments in the critical sections of the fixes to improve clarity. I would appreciate if we can get these regression fixes to Linus quickly. Please let me know if there are any issues pulling. Thanks. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-18xen-netback: correctly check failed allocationInsu Yun
Since vzalloc can be failed in memory pressure, writes -ENOMEM to xenstore to indicate error. Signed-off-by: Insu Yun <wuninsu@gmail.com> Acked-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-18net: asix: add support for the Billionton GUSB2AM-1G-B USB adapterChia-Sheng Chang
Just another AX88178-based 10/100/1000 USB-to-Ethernet dongle. This one shows up in lsusb as: "ID 08dd:0114 Billionton Systems, Inc". Signed-off-by: Chia-Sheng Chang <changchias@gmail.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Luca Ceresoli <luca@lucaceresoli.net> Cc: Christoph Jaeger <cj@linux.com> Cc: "Woojung.Huh@microchip.com" <Woojung.Huh@microchip.com> Cc: Matthew Garrett <mjg59@srcf.ucam.org> Cc: Markus Elfring <elfring@users.sourceforge.net> Cc: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> Cc: netdev@vger.kernel.org Cc: linux-usb@vger.kernel.org Signed-off-by: David S. Miller <davem@davemloft.net>