summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-03-24tipc: fix spinlock recursion bug for failed subscriptionsErik Hugne
If a topology event subscription fails for any reason, such as out of memory, max number reached or because we received an invalid request the correct behavior is to terminate the subscribers connection to the topology server. This is currently broken and produces the following oops: [27.953662] tipc: Subscription rejected, illegal request [27.955329] BUG: spinlock recursion on CPU#1, kworker/u4:0/6 [27.957066] lock: 0xffff88003c67f408, .magic: dead4ead, .owner: kworker/u4:0/6, .owner_cpu: 1 [27.958054] CPU: 1 PID: 6 Comm: kworker/u4:0 Not tainted 3.14.0-rc6+ #5 [27.960230] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [27.960874] Workqueue: tipc_rcv tipc_recv_work [tipc] [27.961430] ffff88003c67f408 ffff88003de27c18 ffffffff815c0207 ffff88003de1c050 [27.962292] ffff88003de27c38 ffffffff815beec5 ffff88003c67f408 ffffffff817f0a8a [27.963152] ffff88003de27c58 ffffffff815beeeb ffff88003c67f408 ffffffffa0013520 [27.964023] Call Trace: [27.964292] [<ffffffff815c0207>] dump_stack+0x45/0x56 [27.964874] [<ffffffff815beec5>] spin_dump+0x8c/0x91 [27.965420] [<ffffffff815beeeb>] spin_bug+0x21/0x26 [27.965995] [<ffffffff81083df6>] do_raw_spin_lock+0x116/0x140 [27.966631] [<ffffffff815c6215>] _raw_spin_lock_bh+0x15/0x20 [27.967256] [<ffffffffa0008540>] subscr_conn_shutdown_event+0x20/0xa0 [tipc] [27.968051] [<ffffffffa000fde4>] tipc_close_conn+0xa4/0xb0 [tipc] [27.968722] [<ffffffffa00101ba>] tipc_conn_terminate+0x1a/0x30 [tipc] [27.969436] [<ffffffffa00089a2>] subscr_conn_msg_event+0x1f2/0x2f0 [tipc] [27.970209] [<ffffffffa0010000>] tipc_receive_from_sock+0x90/0xf0 [tipc] [27.970972] [<ffffffffa000fa79>] tipc_recv_work+0x29/0x50 [tipc] [27.971633] [<ffffffff8105dbf5>] process_one_work+0x165/0x3e0 [27.972267] [<ffffffff8105e869>] worker_thread+0x119/0x3a0 [27.972896] [<ffffffff8105e750>] ? manage_workers.isra.25+0x2a0/0x2a0 [27.973622] [<ffffffff810648af>] kthread+0xdf/0x100 [27.974168] [<ffffffff810647d0>] ? kthread_create_on_node+0x1a0/0x1a0 [27.974893] [<ffffffff815ce13c>] ret_from_fork+0x7c/0xb0 [27.975466] [<ffffffff810647d0>] ? kthread_create_on_node+0x1a0/0x1a0 The recursion occurs when subscr_terminate tries to grab the subscriber lock, which is already taken by subscr_conn_msg_event. We fix this by checking if the request to establish a new subscription was successful, and if not we initiate termination of the subscriber after we have released the subscriber lock. Signed-off-by: Erik Hugne <erik.hugne@ericsson.com> Reviewed-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24vxlan: fix nonfunctional neigh_reduce()David Stevens
The VXLAN neigh_reduce() code is completely non-functional since check-in. Specific errors: 1) The original code drops all packets with a multicast destination address, even though neighbor solicitations are sent to the solicited-node address, a multicast address. The code after this check was never run. 2) The neighbor table lookup used the IPv6 header destination, which is the solicited node address, rather than the target address from the neighbor solicitation. So neighbor lookups would always fail if it got this far. Also for L3MISSes. 3) The code calls ndisc_send_na(), which does a send on the tunnel device. The context for neigh_reduce() is the transmit path, vxlan_xmit(), where the host or a bridge-attached neighbor is trying to transmit a neighbor solicitation. To respond to it, the tunnel endpoint needs to do a *receive* of the appropriate neighbor advertisement. Doing a send, would only try to send the advertisement, encapsulated, to the remote destinations in the fdb -- hosts that definitely did not do the corresponding solicitation. 4) The code uses the tunnel endpoint IPv6 forwarding flag to determine the isrouter flag in the advertisement. This has nothing to do with whether or not the target is a router, and generally won't be set since the tunnel endpoint is bridging, not routing, traffic. The patch below creates a proxy neighbor advertisement to respond to neighbor solicitions as intended, providing proper IPv6 support for neighbor reduction. Signed-off-by: David L Stevens <dlstevens@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24Merge branch 'davinci_emac'David S. Miller
Christian Riesch says: ==================== net: davinci_emac: Fix interrupt requests and error handling since commit 6892b41d9701283085b655c6086fb57a5d63fa47 (Linux 3.11) the davinci_emac driver is broken. After doing ifconfig down, ifconfig up, requesting the interrupts for the driver fails. The interface remains dead until the board is rebooted. The first patch in this patchset reverts commit 6892b41d9701283085b655c6086fb57a5d63fa47 partially and makes the driver useable again. During the work on the first patch, a number of bugs in the error handling of the driver's ndo_open code were found. The second patch fixes these bugs. I believe the first patch meets the rules for stable kernels, I therefore added the stable tag to this patch. The second patch is just cleanup, the code that is fixed by this patch is only executed in case of an error. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24net: davinci_emac: Fix rollback of emac_dev_open()Christian Riesch
If an error occurs during the initialization in emac_dev_open() (the driver's ndo_open function), interrupts, DMA descriptors etc. must be freed. The current rollback code is buggy in several ways. 1) Freeing the interrupts. The current code will not free all interrupts that were requested by the driver. Furthermore, the code tries to do a platform_get_resource(priv->pdev, IORESOURCE_IRQ, -1) in its last iteration. This patch fixes these bugs. 2) Wrong order of err: and rollback: labels. If the setup of the PHY in the code fails, the interrupts that have been requested before are not freed: request irq if requesting irqs fails, goto rollback setup phy if phy setup fails, goto err return 0 rollback: free irqs err: This patch brings the code into the correct order. 3) The code calls napi_enable() and emac_int_enable(), but does not undo both in case of an error. This patch adds calls of emac_int_disable() and napi_disable() to the rollback code. 4) RX DMA descriptors are not freed in case of an error: Right before requesting the irqs, the function creates DMA descriptors for the RX channel. These RX descriptors are never freed when we jump to either rollback or err. This patch adds code for freeing the DMA descriptors in the case of an initialization error. This required a modification of cpdma_ctrl_stop() in davinci_cpdma.c: We must be able to call this function to free the DMA descriptors while the DMA channels are in IDLE state (before cpdma_ctlr_start() was called). Tested on a custom board with the Texas Instruments AM1808. Signed-off-by: Christian Riesch <christian.riesch@omicron.at> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24net: davinci_emac: Replace devm_request_irq with request_irqChristian Riesch
In commit 6892b41d9701283085b655c6086fb57a5d63fa47 Author: Lad, Prabhakar <prabhakar.csengg@gmail.com> Date: Tue Jun 25 21:24:51 2013 +0530 net: davinci: emac: Convert to devm_* api the call of request_irq is replaced by devm_request_irq and the call of free_irq is removed. But since interrupts are requested in emac_dev_open, doing ifconfig up/down on the board requests the interrupts again each time, causing devm_request_irq to fail. The interface is dead until the device is rebooted. This patch reverts said commit partially: It changes the driver back to use request_irq instead of devm_request_irq, puts free_irq back in place, but keeps the remaining changes of the original patch. Reported-by: Jon Ringle <jon@ringle.org> Signed-off-by: Christian Riesch <christian.riesch@omicron.at> Cc: Lad, Prabhakar <prabhakar.csengg@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24ext4: fix comment typoMatthew Wilcox
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
2014-03-24ext4: make ext4_block_zero_page_range staticMatthew Wilcox
It's only called within inode.c, so make it static, remove its prototype from ext4.h and move it above all of its callers so it doesn't need a prototype within inode.c. Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
2014-03-24netpoll: fix the skb check in pkt_is_nsLi RongQing
Neighbor Solicitation is ipv6 protocol, so we should check skb->protocol with ETH_P_IPV6 Signed-off-by: Li RongQing <roy.qing.li@gmail.com> Cc: WANG Cong <amwang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24sparc64: Make sure %pil interrupts are enabled during hypervisor yield.David S. Miller
In arch_cpu_idle() we must enable %pil based interrupts before potentially invoking the hypervisor cpu yield call. As per the Hypervisor API documentation for cpu_yield: Interrupts which are blocked by some mechanism other that pstate.ie (for example %pil) are not guaranteed to cause a return from this service. It seems that only first generation Niagara chips are hit by this bug. My best guess is that later chips implement this in hardware and wake up anyways from %pil events, whereas in first generation chips the yield is implemented completely in hypervisor code and requires %pil to be enabled in order to wake properly from this call. Fixes: 87fa05aeb3a5 ("sparc: Use generic idle loop") Reported-by: Fabio M. Di Nitto <fabbione@fabbione.net> Reported-by: Jan Engelhardt <jengelh@inai.de> Tested-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24ext4: atomically set inode->i_flags in ext4_set_inode_flags()Theodore Ts'o
Use cmpxchg() to atomically set i_flags instead of clearing out the S_IMMUTABLE, S_APPEND, etc. flags and then setting them from the EXT4_IMMUTABLE_FL, EXT4_APPEND_FL flags, since this opens up a race where an immutable file has the immutable flag cleared for a brief window of time. Reported-by: John Sullivan <jsrhbz@kanargh.force9.co.uk> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Cc: stable@kernel.org
2014-03-24ext4: optimize Hurd tests when reading/writing inodesTheodore Ts'o
Set a in-memory superblock flag to indicate whether the file system is designed to support the Hurd. Also, add a sanity check to make sure the 64-bit feature is not set for Hurd file systems, since i_file_acl_high conflicts with a Hurd-specific field. Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
2014-03-24x86, kaslr: fix module lock ordering problemKees Cook
There was a potential lock ordering problem with the module kASLR patch ("x86, kaslr: randomize module base load address"). This patch removes the usage of the module_mutex and creates a new mutex to protect the module base address offset value. Chain exists of: text_mutex --> kprobe_insn_slots.mutex --> module_mutex [ 0.515561] Possible unsafe locking scenario: [ 0.515561] [ 0.515561] CPU0 CPU1 [ 0.515561] ---- ---- [ 0.515561] lock(module_mutex); [ 0.515561] lock(kprobe_insn_slots.mutex); [ 0.515561] lock(module_mutex); [ 0.515561] lock(text_mutex); [ 0.515561] [ 0.515561] *** DEADLOCK *** Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Andy Honig <ahonig@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com> Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
2014-03-24RDMA/cxgb4: Update snd_seq when sending MPA messagesSteve Wise
Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24RDMA/cxgb4: Connect_request_upcall fixesSteve Wise
When processing an MPA Start Request, if the listening endpoint is DEAD, then abort the connection. If the IWCM returns an error, then we must abort the connection and release resources. Also abort_connection() should not post a CLOSE event, so clean that up too. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24RDMA/cxgb4: Ignore read reponse type 1 CQEsSteve Wise
These are generated by HW in some error cases and need to be silently discarded. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24RDMA/cxgb4: Fix possible memory leak in RX_PKT processingSteve Wise
If cxgb4_ofld_send() returns < 0, then send_fw_pass_open_req() must free the request skb and the saved skb with the tcp header. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24RDMA/cxgb4: Don't leak skb in c4iw_uld_rx_handler()Steve Wise
Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24IB/srp: Fix a race condition between failing I/O and I/O completionBart Van Assche
Avoid that srp_terminate_io() can access req->scmnd after it has been cleared by the I/O completion code. Do this by protecting req->scmnd accesses from srp_terminate_io() via locking Signed-off-by: Bart Van Assche <bvanassche@acm.org> Acked-by: Sagi Grimberg <sagig@mellanox.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24IB/srp: Avoid that writing into "add_target" hangs due to a cable pullBart Van Assche
If a cable is pulled while srp_connect_target() is in progress that can result in that function never to return. That makes the process, e.g. srp_daemon, that invoked this function unkillable. Avoid this by letting srp_connect_target() finish if the event IB_CM_TIMEWAIT_EXIT is received. This patch fixes a hang with the following call trace: [<ffffffff814eae85>] schedule_timeout+0x215/0x2e0 [<ffffffff814eab03>] wait_for_common+0x123/0x180 [<ffffffff814eac1d>] wait_for_completion+0x1d/0x20 [<ffffffffa03b398c>] srp_connect_target+0x1dc/0x410 [ib_srp] [<ffffffffa03b5809>] srp_create_target+0xba9/0xe70 [ib_srp] [<ffffffff8133e590>] dev_attr_store+0x20/0x30 [<ffffffff811eb8f5>] sysfs_write_file+0xe5/0x170 [<ffffffff811767c8>] vfs_write+0xb8/0x1a0 [<ffffffff811770c1>] sys_write+0x51/0x90 [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24IB/srp: Make writing into the "add_target" sysfs attribute interruptibleBart Van Assche
Avoid that stopping srp_daemon takes unusually long due to a cable pull by making writing into the "add_target" sysfs attribute interruptible. Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24IB/srp: Avoid duplicate connectionsBart Van Assche
The connection uniqueness check is performed before a new connection is added to the target list. This patch protects both actions by a mutex such that simultaneous writes from two different threads into the "add_target" variable do not result in duplicate connections. Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24IB/srp: Add more loggingBart Van Assche
Log sgid and dgid when reporting that a login has been rejected or when a host has been added. This makes it easy to figure out which initiator and target ports these messages apply to. Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24IB/srp: Check ib_query_gid return valueSagi Grimberg
Detected by Coverity. Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24scsi_transport_srp: Fix two kernel-doc warningsBart Van Assche
This patch fixes the following two kernel-doc warnings: Warning(drivers/scsi/scsi_transport_srp.c:819): No description found for parameter 'rport' Warning(include/scsi/scsi_transport_srp.h:75): Excess struct/union/enum/typedef member 'deleted' description in 'srp_rport' Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reported-by: Masanari Iida <standby24x7@gmail.com> Acked-by: Sebastian Riemer <sebastian.riemer@profitbricks.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-03-24Merge git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-nextDavid S. Miller
Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates This series contains updates to igb, ixgbe, ixgbevf, i40e and i40evf. Anjali provides a i40e/i40evf patch to add Energy Efficient Ethernet Low Power Idle stats and a fix for i40e to change the string "Side Band" to "Sideband" for consistency. Mitch provides 2 patches for i40evf to fix if the driver encounters an error while communicating with the PF driver, do not shut down the admin queue unconditionally. Add an error message when the admin queue message never completes and fix formatting on another message that was unnecessarily wrapped. Mark provides a ixgbe patch and five ixgbevf patches. Fix a possible infinite recursion when an adapter is removed and registers all read as all one's in ixgbe_clear_vmdq_generic() and ixgbe_clear_rar_generic(). Converts macros to static inline functions to align kernel coding standard and prepare for adding Live Error Recovery (LER) to ixgbevf. Change the ethtool register test to use the normal register accessor functions and eliminate macors used for calling register test functions to make error exits more clear. Checks all register reads for adapter removal by checking the status register after any register read that returns all F's since the status register will never return 0xFFFFFFFF unless the adapter is removed. Jacob implements SIOCGHWTSTAMP ioctl for igb which enables user processes to read the current hardware stamp config settings non-destructively. Todd adds the initial register read and write for surprise removal (LER) for igb. Christian Engelmayer fixes an igb memory leak in the igb_get_module_eeprom() error handling path. Ken Ichikawa provides a fix for igb, specifically for 82575 hardware to specify -1 to the phc_index for ethtool's get_ts_info, otherwise a wrong value will be set to the phc_index. Christopher Paasch fixes a null pointer dereference in igb and makes sure to unset the HAS_MSIX flag when the driver falls back to MSI only. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24ipv4: remove ip_rt_dump from route.cLi RongQing
ip_rt_dump do nothing after IPv4 route caches removal, so we can remove it. Signed-off-by: Li RongQing <roy.qing.li@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24atheros/atlx: use SET_ETHTOOL_OPS directlywangweidong
As commit a6e28b34205b("staging/et131x: use SET_ETHTOOL_OPS directly"), using a wrapper around SET_ETHTOOL_OPS macro is not actually required, remove and use SET_ETHTOOL_OPS directly. Signed-off-by: Wang Weidong <wangweidong1@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24Altera TSE: Correct two typos in original submissionVince Bridgers
This patch addresses two typos in the original driver submission. One derived from a cut & paste error, and another is a misspelling. Signed-off-by: Vince Bridgers <vbridgers2013@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24Altera TSE: Correct typecast issue detected by kbuild test robotVince Bridgers
This patch addresses a portable pointer arithmetic issue in the original submission found by the kbuild test robot. config: make ARCH=i386 allyesconfig altera_sgdma.c: In function 'sgdma_txphysaddr': >> altera_sgdma.c:393:33: warning: cast from >> pointer to integer of different size [-Wpointer-to-int-cast] dma_addr_t offs = (dma_addr_t)((dma_addr_t)desc - ^ >> altera_sgdma.c:394:5: warning: cast from >> pointer to integer of different size [-Wpointer-to-int-cast] (dma_addr_t)priv->tx_dma_desc); ^ altera_sgdma.c: In function 'sgdma_rxphysaddr': >> altera_sgdma.c:403:33: warning: cast from >> pointer to integer of different size [-Wpointer-to-int-cast] dma_addr_t offs = (dma_addr_t)((dma_addr_t)desc - ^ >> altera_sgdma.c:404:5: warning: cast from >> pointer to integer of different size [-Wpointer-to-int-cast] (dma_addr_t)priv->rx_dma_desc); ^ Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Vince Bridgers <vbridgers2013@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24Altera TSE: Set version number by driver's get regsVince Bridgers
Set the version number returned by the driver's get regs routine invoked by ethtool so formatting can be dependent on the version number returned, and any interesting formatted output can check the version number for specific types of register data returned. Signed-off-by: Vince Bridgers <vbridgers2013@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-24x86, vdso: Fix size of get_unmapped_area()Stefani Seibold
The size of the reserved memory for a 32 bit vdso must be the size of the 32 bit vDSO in pages + HPET page + VVAR page. One page is not enough for this. Grrrr.... silly copy and paste bug, was right in previous patch. Signed-off-by: Stefani Seibold <stefani@seibold.net> Cc: Andy Lutomirski <luto@amacapital.net> Link: http://lkml.kernel.org/r/1395592694-20571-1-git-send-email-stefani@seibold.net Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
2014-03-24Bluetooth: Remove unnecessary assignment in SMPJohan Hedberg
The smp variable in smp_conn_security is not used anywhere before the smp = smp_chan_create() call in the smp_conn_security function so it makes no sense to assign any other value to it before that. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-03-24Bluetooth: Fix potential NULL pointer dereference in smp_conn_securityJohan Hedberg
The smp pointer might not be initialized for jumps to the "done" label in the smp_conn_security function. Furthermore doing the set_bit after done might "overwrite" a previous value of the flag in case pairing was already in progress. This patch moves the call to set_bit before the label so that it is only done for a newly created smp context (as returned by smp_chan_create). Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-03-24Bluetooth: Remove LTK re-encryption procedureJohan Hedberg
Due to several devices being unable to handle this procedure reliably (resulting in forced disconnections before pairing completes) it's better to remove it altogether. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-03-24Bluetooth: Don't try to confirm locally initiated SMP pairingJohan Hedberg
In the case that the just-works model would be triggered we only want to confirm remotely initiated pairings (i.e. those triggered by a Security Request or Pairing Request). This patch adds the necessary check to the tk_request function to fall back to the JUST_WORKS method in the case of a locally initiated pairing. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-03-24Bluetooth: Add SMP flag to track which side is the initiatorJohan Hedberg
For remotely initiated just-works pairings we want to show the user a confirmation dialog for the pairing. However, we can only know which side was the initiator by tracking which side sends the first Security Request or Pairing Request PDU. This patch adds a new SMP flag to indicate whether our side was the initiator for the pairing. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-03-24Bluetooth: Fix SMP confirmation callback handlingJohan Hedberg
In the case that a local pairing confirmation (JUST_CFM) has been selected as the method we need to use the user confirm request mgmt event for it with the confirm_hint set to 1 (to indicate confirmation without any specific passkey value). Without this (if passkey_notify was used) the pairing would never proceed. This patch adds the necessary call to mgmt_user_confirm_request in this scenario. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-03-24Bluetooth: Add missing cmd_status handler for LE_Start_EncryptionJohan Hedberg
It is possible that the HCI_LE_Start_Encryption command fails in an early stage and triggers a command status event with the failure code. In such a case we need to properly notify the hci_conn object and cleanly bring the connection down. This patch adds the missing command status handler for this HCI command. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-03-24Bluetooth: Fix potential NULL pointer dereference in SMPJohan Hedberg
If a sudden disconnection happens the l2cap_conn pointer may already have been cleaned up by the time hci_conn_security gets called, resulting in the following oops if we don't have a proper NULL check: BUG: unable to handle kernel NULL pointer dereference at 000000c8 IP: [<c132e2ed>] smp_conn_security+0x26/0x151 *pde = 00000000 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC CPU: 1 PID: 673 Comm: memcheck-x86-li Not tainted 3.14.0-rc2+ #437 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: f0ef0520 ti: f0d6a000 task.ti: f0d6a000 EIP: 0060:[<c132e2ed>] EFLAGS: 00010246 CPU: 1 EIP is at smp_conn_security+0x26/0x151 EAX: f0ec1770 EBX: f0ec1770 ECX: 00000002 EDX: 00000002 ESI: 00000002 EDI: 00000000 EBP: f0d6bdc0 ESP: f0d6bda0 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 CR0: 80050033 CR2: 000000c8 CR3: 30f0f000 CR4: 00000690 Stack: f4f55000 00000002 f0d6bdcc c1097a2b c1319f40 f0ec1770 00000002 f0d6bdd0 f0d6bde8 c1312a82 f0d6bdfc c1312a82 c1319f84 00000008 f4d81c20 f0e5fd86 f0ec1770 f0d6bdfc f0d6be28 c131be3b c131bdc1 f0d25270 c131be3b 00000008 Call Trace: [<c1097a2b>] ? __kmalloc+0x118/0x128 [<c1319f40>] ? mgmt_pending_add+0x49/0x9b [<c1312a82>] hci_conn_security+0x4a/0x1dd [<c1312a82>] ? hci_conn_security+0x4a/0x1dd [<c1319f84>] ? mgmt_pending_add+0x8d/0x9b [<c131be3b>] pair_device+0x1e1/0x206 [<c131bdc1>] ? pair_device+0x167/0x206 [<c131be3b>] ? pair_device+0x1e1/0x206 [<c131ed44>] mgmt_control+0x275/0x2d6 Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-03-24tracing: Add BUG_ON when stack end location is over writtenAaron Tomlin
It is difficult to detect a stack overrun when it actually occurs. We have observed that this type of corruption is often silent and can go unnoticed. Once the corrupted region is examined, the outcome is undefined and often results in sporadic system crashes. When the stack tracing feature is enabled, let's check for this condition and take appropriate action. Note: init_task doesn't get its stack end location set to STACK_END_MAGIC. Link: http://lkml.kernel.org/r/1395669837-30209-1-git-send-email-atomlin@redhat.com Signed-off-by: Aaron Tomlin <atomlin@redhat.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2014-03-24i2c: cpm: Fix build by adding of_address.h and of_irq.hScott Wood
Fixes a build break due to the undeclared use of irq_of_parse_and_map() and of_iomap(). This build break was apparently introduced while the driver was unbuildable due to the bug fixed by 62c19c9d29e65086e5ae76df371ed2e6b23f00cd ("i2c: Remove usage of orphaned symbol OF_I2C"). When 62c19c was added in v3.14-rc7, the driver was enabled again, breaking the powerpc mpc85xx_defconfig and mpc85xx_smp_defconfig. 62c19c is marked for stable, so this should go there as well. Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Scott Wood <scottwood@freescale.com> Signed-off-by: Wolfram Sang <wsa@the-dreams.de> Cc: stable@kernel.org
2014-03-24cgroup: Use RCU_INIT_POINTER(x, NULL) in cgroup.cMonam Agarwal
This patch replaces rcu_assign_pointer(x, NULL) with RCU_INIT_POINTER(x, NULL) The rcu_assign_pointer() ensures that the initialization of a structure is carried out before storing a pointer to that structure. And in the case of the NULL pointer, there is no structure to initialize. So, rcu_assign_pointer(p, NULL) can be safely converted to RCU_INIT_POINTER(p, NULL) Signed-off-by: Monam Agarwal <monamagarwal123@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2014-03-24Merge remote-tracking branch 'asoc/topic/rcar' into asoc-nextMark Brown
2014-03-24Merge tag 'asoc-v3.15-3' into asoc-nextMark Brown
ASoC: Updates for v3.15 A few more updates for the merge window: - Fixes for the simple-card DAI format DT mess. - A new driver for Cirrus cs42xx8 devices. - DT support for a couple more devices. - A revert of a previous buggy fix for soc-pcm, plus a few more fixes and cleanups. # gpg: Signature made Sun 23 Mar 2014 16:56:11 GMT using RSA key ID 7EA229BD # gpg: Good signature from "Mark Brown <broonie@sirena.org.uk>" # gpg: aka "Mark Brown <broonie@debian.org>" # gpg: aka "Mark Brown <broonie@kernel.org>" # gpg: aka "Mark Brown <broonie@tardis.ed.ac.uk>" # gpg: aka "Mark Brown <broonie@linaro.org>" # gpg: aka "Mark Brown <Mark.Brown@linaro.org>"
2014-03-24Merge tag 'asoc-v3.15-2' into asoc-nextMark Brown
ASoC: Updates for v3.15 This is mostly a few additional fixes from Lars-Peter, a new driver and cleaning up a git failure with merging the Intel branch (combined with an xargs failure to pay attention to error codes). The history lists a bunch of additional commits for the branch but the content of those commits is actually present already but not recorded in history due to git failing. Unfortunately xargs is used in the merge script and it doesn't do a good job of noticing errors from the commands it invokes. # gpg: Signature made Thu 13 Mar 2014 14:25:44 GMT using RSA key ID 7EA229BD # gpg: Good signature from "Mark Brown <broonie@sirena.org.uk>" # gpg: aka "Mark Brown <broonie@debian.org>" # gpg: aka "Mark Brown <broonie@kernel.org>" # gpg: aka "Mark Brown <broonie@tardis.ed.ac.uk>" # gpg: aka "Mark Brown <broonie@linaro.org>" # gpg: aka "Mark Brown <Mark.Brown@linaro.org>"
2014-03-24Merge tag 'asoc-v3.15' into asoc-nextMark Brown
ASoC: Updates for v3.15 Quite a busy release for ASoC this time, more on janitorial work than exciting new features but welcome nontheless: - Lots of cleanups from Takashi for enumerations; the original API for these was error prone so he's refactored lots of code to use more modern APIs which avoid issues. - Elimination of the ASoC level wrappers for I2C and SPI moving us closer to converting to regmap completely and avoiding some randconfig hassle. - Provide both manually and transparently locked DAPM APIs rather than a mix of the two fixing some concurrency issues. - Start converting CODEC drivers to use separate bus interface drivers rather than having them all in one file helping avoid dependency issues. - DPCM support for Intel Haswell and Bay Trail platforms. - Lots of work on improvements for simple-card, DaVinci and the Renesas rcar drivers. - New drivers for Analog Devices ADAU1977, TI PCM512x and parts of the CSR SiRF SoC. # gpg: Signature made Wed 12 Mar 2014 23:05:45 GMT using RSA key ID 7EA229BD # gpg: Good signature from "Mark Brown <broonie@sirena.org.uk>" # gpg: aka "Mark Brown <broonie@debian.org>" # gpg: aka "Mark Brown <broonie@kernel.org>" # gpg: aka "Mark Brown <broonie@tardis.ed.ac.uk>" # gpg: aka "Mark Brown <broonie@linaro.org>" # gpg: aka "Mark Brown <Mark.Brown@linaro.org>"
2014-03-24Merge remote-tracking branches 'asoc/fix/cs42l51', 'asoc/fix/cs42l52', ↵Mark Brown
'asoc/fix/cs42l73', 'asoc/fix/rcar', 'asoc/fix/spear' and 'asoc/fix/tegra' into asoc-linus
2014-03-24spi: topcliff-pch: Properly unregister platform devices on probe() error pathsAxel Lin
Ensure all registered platform devices are unregistered on probe() error paths. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@linaro.org>
2014-03-24Merge branch 'kvms390-irqfd' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-next
2014-03-24regulator: st-pwm: Convert to get_voltage_selAxel Lin
Also remove test for selector in st_pwm_regulator_set_voltage_sel, the checking is already done in .list_voltage. Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Mark Brown <broonie@linaro.org>
generated by cgit (git 2.34.1) at 2025-09-16 01:33:54 +0000