summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-12-06Merge branch 'locking-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull lockdep fix from Ingo Molnar: "Fix a possible NULL dereference for the (rare) case when a task doesn't have ->xhlocks space allocated due to kmalloc() OOM-ing" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/lockdep: Fix possible NULL deref
2017-12-07drm/exynos: remove unnecessary function declarationInki Dae
Removed exynos_drm_get_dma_device funtion declaration on top of exynos_drm_drv.c file. We can remove this declaration by moving the implementation of this function upwards. Signed-off-by: Inki Dae <inki.dae@samsung.com>
2017-12-07drm/exynos: remove unnecessary descrptionsInki Dae
Removed two descriptions to 'da_start' and 'da_space_size' from exynos_drm_private structure. These members don't exist anymore. Signed-off-by: Inki Dae <inki.dae@samsung.com>
2017-12-06ARM: dts: meson8b: use stable UART bindings with correct gate clockMartin Blumenstingl
Switch to the stable UART bindings and add the correct gate clocks to the non-AO UART nodes. This fixes the non-AO UARTs if the bootloader didn't un-gate the clocks. Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Acked-by: Jerome Brunet <jbrunet@baylibre.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2017-12-06ARM: dts: meson8: use stable UART bindings with correct gate clockMartin Blumenstingl
Switch to the stable UART bindings and add the correct gate clocks to the non-AO UART nodes. This fixes the non-AO UARTs if the bootloader didn't un-gate the clocks. Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Acked-by: Jerome Brunet <jbrunet@baylibre.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2017-12-06ARM: dts: meson: drop "sana" clock from SAR ADCXingyu Chen
The SAR ADC modules doesn't require The "sana" clock. Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com> Signed-off-by: Yixun Lan <yixun.lan@amlogic.com> Tested-by: Kevin Hilman <khilman@baylibre.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2017-12-06ARM: dts: meson8: add more L2 cache settingsMartin Blumenstingl
Amlogic's vendor kernel prints these PL310 L2 cache controller settings during boot: 8 ways, 4096 sets, CACHE_ID 0x4100a0c9, Cache size: 1048576 B AUX_CTRL 0x7ec80001, PERFETCH_CTRL 0x71000007, POWER_CTRL 0x00000000 TAG_LATENCY 0x00000111, DATA_LATENCY 0x00000222 Add the "prefetch-data", "prefetch-instr" and "arm,shared-override" properties to get the same L2 cache controller configuration as the vendor kernel. Two differences still remain: - L310_AUX_CTRL_NS_INT_CTRL is currently not supported by the cache-l2x0 driver - bit 23 is set by the vendor kernel, but this is defined in cache-l2x0.h Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Tested-by: Kevin Hilman <khilman@baylibre.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2017-12-06ARM: dts: meson8b: add more L2 cache settingsMartin Blumenstingl
Amlogic's vendor kernel prints these PL310 L2 cache controller settings during boot: 8 ways, 2048 sets, CACHE_ID 0x4100a0c9, Cache size: 524288 B AUX_CTRL 0x7ec60001, PERFETCH_CTRL 0x75000007, POWER_CTRL 0x00000000 TAG_LATENCY 0x00000111, DATA_LATENCY 0x00000222 Add the "prefetch-data", "prefetch-instr" and "arm,shared-override" properties to get the same L2 cache controller configuration as the vendor kernel. Four differences still remain: - L310_AUX_CTRL_EARLY_BRESP is enabled by the vendor kernel, however this is only supported on Cortex-A9 cores (Meson8b has Cortex-A5 cores though) - L310_AUX_CTRL_NS_INT_CTRL is currently not supported by the cache-l2x0 driver - bit 23 is set by the vendor kernel, but this is defined in cache-l2x0.h - L310_AUX_CTRL_FULL_LINE_ZERO is enabled by the vendor kernel which is also only supported on Cortex-A9 cores Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Tested-by: Kevin Hilman <khilman@baylibre.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2017-12-07drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMUMarek Szyprowski
When no IOMMU is available, all GEM buffers allocated by Exynos DRM driver are contiguous, because of the underlying dma_alloc_attrs() function provides only such buffers. In such case it makes no sense to keep BO_NONCONTIG flag for the allocated GEM buffers. This allows to avoid failures for buffer contiguity checks in the subsequent operations on GEM objects. Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com> CC: stable@vger.kernel.org # v4.4+
2017-12-07drm/exynos: Fix dma-buf importMarek Szyprowski
When IOMMU support was enabled, dma-buf import in Exynos DRM was broken since commit f43c35966a5a ("drm/exynos: use real device for DMA-mapping operations") due to using wrong struct device in drm_gem_prime_import() function. This patch fixes following kernel BUG caused by incorrect buffer mapping to DMA address space: exynos-sysmmu 14650000.sysmmu: 14450000.mixer: PAGE FAULT occurred at 0xb2e00000 ------------[ cut here ]------------ kernel BUG at drivers/iommu/exynos-iommu.c:449! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.14.0-rc4-next-20171016-00033-g990d723669fd #3165 Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) task: c0e0b7c0 task.stack: c0e00000 PC is at exynos_sysmmu_irq+0x1d0/0x24c LR is at exynos_sysmmu_irq+0x154/0x24c ------------[ cut here ]------------ Reported-by: Marian Mihailescu <mihailescu2m@gmail.com> Fixes: f43c35966a5a ("drm/exynos: use real device for DMA-mapping operations") Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Reviewed-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2017-12-06Merge branch 'irq-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: "Two fixes: use bool type consistently, plus a irq_matrix_available() bugfix" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqdesc: Use bool return type instead of int genirq/matrix: Fix the precedence fix for real
2017-12-07btrfs: Fix possible off-by-one in btrfs_search_path_in_treeNikolay Borisov
The name char array passed to btrfs_search_path_in_tree is of size BTRFS_INO_LOOKUP_PATH_MAX (4080). So the actual accessible char indexes are in the range of [0, 4079]. Currently the code uses the define but this represents an off-by-one. Implications: Size of btrfs_ioctl_ino_lookup_args is 4096, so the new byte will be written to extra space, not some padding that could be provided by the allocator. btrfs-progs store the arguments on stack, but kernel does own copy of the ioctl buffer and the off-by-one overwrite does not affect userspace, but the ending 0 might be lost. Kernel ioctl buffer is allocated dynamically so we're overwriting somebody else's memory, and the ioctl is privileged if args.objectid is not 256. Which is in most cases, but resolving a subvolume stored in another directory will trigger that path. Before this patch the buffer was one byte larger, but then the -1 was not added. Fixes: ac8e9819d71f907 ("Btrfs: add search and inode lookup ioctls") Signed-off-by: Nikolay Borisov <nborisov@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> [ added implications ] Signed-off-by: David Sterba <dsterba@suse.com>
2017-12-07Btrfs: disable FUA if mounted with nobarrierOmar Sandoval
I was seeing disk flushes still happening when I mounted a Btrfs filesystem with nobarrier for testing. This is because we use FUA to write out the first super block, and on devices without FUA support, the block layer translates FUA to a flush. Even on devices supporting true FUA, using FUA when we asked for no barriers is surprising. Fixes: 387125fc722a8ed ("Btrfs: fix barrier flushes") Signed-off-by: Omar Sandoval <osandov@fb.com> Reviewed-by: Qu Wenruo <wqu@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2017-12-07btrfs: fix missing error return in btrfs_drop_snapshotJeff Mahoney
If btrfs_del_root fails in btrfs_drop_snapshot, we'll pick up the error but then return 0 anyway due to mixing err and ret. Fixes: 79787eaab4612 ("btrfs: replace many BUG_ONs with proper error handling") Cc: <stable@vger.kernel.org> # v3.4+ Signed-off-by: Jeff Mahoney <jeffm@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2017-12-07btrfs: handle errors while updating refcounts in update_ref_for_cowJeff Mahoney
Since commit fb235dc06fa (btrfs: qgroup: Move half of the qgroup accounting time out of commit trans) the assumption that btrfs_add_delayed_{data,tree}_ref can only return 0 or -ENOMEM has been false. The qgroup operations call into btrfs_search_slot and friends and can now return the full spectrum of error codes. Fortunately, the fix here is easy since update_ref_for_cow failing is already handled so we just need to bail early with the error code. Fixes: fb235dc06fa (btrfs: qgroup: Move half of the qgroup accounting ...) Cc: <stable@vger.kernel.org> # v4.11+ Signed-off-by: Jeff Mahoney <jeffm@suse.com> Reviewed-by: Edmund Nadolski <enadolski@suse.com> Reviewed-by: Qu Wenruo <wqu@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2017-12-07btrfs: Fix quota reservation leak on preallocated filesJustin Maggard
Commit c6887cd11149 ("Btrfs: don't do nocow check unless we have to") changed the behavior of __btrfs_buffered_write() so that it first tries to get a data space reservation, and then skips the relatively expensive nocow check if the reservation succeeded. If we have quotas enabled, the data space reservation also includes a quota reservation. But in the rewrite case, the space has already been accounted for in qgroups. So btrfs_check_data_free_space() increases the quota reservation, but it never gets decreased when the data actually gets written and overwrites the pre-existing data. So we're left with both the qgroup and qgroup reservation accounting for the same space. This commit adds the missing btrfs_qgroup_free_data() call in the case of BTRFS_ORDERED_PREALLOC extents. Fixes: c6887cd11149 ("Btrfs: don't do nocow check unless we have to") Signed-off-by: Justin Maggard <jmaggard@netgear.com> Reviewed-by: Qu Wenruo <wqu@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2017-12-06Merge branch 'efi-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Ingo Molnar: "Misc fixes: world-readable pointer removal from sysfs, a ESRT kfree() bug fix and a comment update" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi: Add comment to avoid future expanding of sysfs systab efi/esrt: Use memunmap() instead of kfree() to free the remapping efi: Move some sysfs files to be read-only by root
2017-12-06Merge branch 'core-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core fixes from Ingo Molnar: "Two fixes: - objtool cross-build fixes - removal of an obsolete CPU-hotplug state name from comments" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Fix 64-bit build on 32-bit host cpu/hotplug: Fix state name in takedown_cpu() comment
2017-12-07Merge tag 'drm-misc-fixes-2017-12-06' of ↵Dave Airlie
git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Just the connector_iter corner-case regression fix. * tag 'drm-misc-fixes-2017-12-06' of git://anongit.freedesktop.org/drm/drm-misc: drm: safely free connectors from connector_iter
2017-12-06kgdb/kdb/debug_core: Add co-maintainer Daniel ThompsonJason Wessel
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
2017-12-06kdb: Fix handling of kallsyms_symbol_next() return valueDaniel Thompson
kallsyms_symbol_next() returns a boolean (true on success). Currently kdb_read() tests the return value with an inequality that unconditionally evaluates to true. This is fixed in the obvious way and, since the conditional branch is supposed to be unreachable, we also add a WARN_ON(). Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org> Cc: linux-stable <stable@vger.kernel.org> Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
2017-12-06of: overlay: Fix (un)locking in of_overlay_apply()Geert Uytterhoeven
The special overlay mutex is taken first, hence it should be released last in the error path. of_resolve_phandles() must be called with of_mutex held. Without it, a node and new phandle could be added via of_attach_node(), making the max phandle wrong. free_overlay_changeset() must be called with of_mutex held, if any non-trivial cleanup is to be done. Hence move "mutex_lock(&of_mutex)" up, as suggested by Frank, and merge the two tail statements of the success and error paths, now they became identical. Note that while the two mutexes are adjacent, we still need both: __of_changeset_apply_notify(), which is called by __of_changeset_apply() unlocks of_mutex, then does notifications then locks of_mutex. So the mutex get released in the middle of of_overlay_apply() Fixes: f948d6d8b792bb90 ("of: overlay: avoid race condition between applying multiple overlays") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Frank Rowand <frank.rowand@sony.com> Signed-off-by: Rob Herring <robh@kernel.org>
2017-12-06of: overlay: Fix memory leak in of_overlay_apply() error pathGeert Uytterhoeven
If of_resolve_phandles() fails, free_overlay_changeset() is called in the error path. However, that function returns early if the list hasn't been initialized yet, before freeing the object. Explicitly calling kfree() instead would solve that issue. However, that complicates matter, by having to consider which of two different methods to use to dispose of the same object. Hence make free_overlay_changeset() consider initialization state of the different parts of the object, making it always safe to call (once!) to dispose of a (partially) initialized overlay_changeset: - Only destroy the changeset if the list was initialized, - Make init_overlay_changeset() store the ID in ovcs->id on success, to avoid calling idr_remove() with an error value or an already released ID. Reported-by: Colin King <colin.king@canonical.com> Fixes: f948d6d8b792bb90 ("of: overlay: avoid race condition between applying multiple overlays") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Frank Rowand <frank.rowand@sony.com> Signed-off-by: Rob Herring <robh@kernel.org>
2017-12-06tooling/headers: Synchronize updated s390 and x86 UAPI headersIngo Molnar
There were two trivial updates to these upstream UAPI headers: arch/s390/include/uapi/asm/kvm.h arch/s390/include/uapi/asm/kvm_perf.h arch/x86/lib/x86-opcode-map.txt Synchronize them with their tooling copies. (The x86 opcode map includes a new instruction pattern now.) Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-12-06Merge branch 'linus' into perf/urgent, to synchronize UAPI headersIngo Molnar
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-12-06objtool: Fix 64-bit build on 32-bit hostMikulas Patocka
The new ORC unwinder breaks the build of a 64-bit kernel on a 32-bit host. Building the kernel on a i386 or x32 host fails with: orc_dump.c: In function 'orc_dump': orc_dump.c:105:26: error: passing argument 2 of 'elf_getshdrnum' from incompatible pointer type [-Werror=incompatible-pointer-types] if (elf_getshdrnum(elf, &nr_sections)) { ^ In file included from /usr/local/include/gelf.h:32:0, from elf.h:22, from warn.h:26, from orc_dump.c:20: /usr/local/include/libelf.h:304:12: note: expected 'size_t * {aka unsigned int *}' but argument is of type 'long unsigned int *' extern int elf_getshdrnum (Elf *__elf, size_t *__dst); ^~~~~~~~~~~~~~ orc_dump.c:190:17: error: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'Elf64_Sxword {aka long long int}' [-Werror=format=] printf("%s+%lx:", name, rela.r_addend); ~~^ ~~~~~~~~~~~~~ %llx Fix the build failure. Another problem is that if the user specifies HOSTCC or HOSTLD variables, they are ignored in the objtool makefile. Change the Makefile to respect these variables. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Sven Joachim <svenjoac@gmx.de> Cc: Thomas Gleixner <tglx@linutronix.de> Fixes: 627fce14809b ("objtool: Add ORC unwind table generation") Link: http://lkml.kernel.org/r/19f0e64d8e07e30a7b307cd010eb780c404fe08d.1512252895.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-12-06dt-bindings: eeprom: at25: Document device-specific compatible valuesGeert Uytterhoeven
Document the recommended presence of a device-specific compatible value, and list examples that are already in use or soon will be. This will allow checkpatch to validate compatible values in DTS. Update the example to match current best practices (generic node name, specific compatible value first). Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Rob Herring <robh@kernel.org>
2017-12-06dt-bindings: eeprom: at25: Grammar s/are can/can/Geert Uytterhoeven
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Rob Herring <robh@kernel.org>
2017-12-06x86/PCI: Only enable a 64bit BAR on single-socket AMD Family 15hChristian König
When we have a multi-socket system, each CPU core needs the same setup. Since this is tricky to do in the fixup code, don't enable a 64bit BAR on multi-socket systems for now. Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
2017-12-06x86/PCI: Fix infinite loop in search for 64bit BAR placementChristian König
Break the loop if we can't find some address space for a 64bit BAR. Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
2017-12-06dt-bindings: Remove leading 0x from bindings notationMathieu Malaterre
Improve the binding example by removing all the leading 0x to fix the following dtc warnings: Warning (unit_address_format): Node /XXX unit name should not have leading "0x" Converted using the following command: find Documentation/devicetree/bindings -name "*.txt" -exec sed -i -e 's/([^ ])\@0x([0-9a-f])/$1\@$2/g' {} + This is a follow up to commit 48c926cd3414 Signed-off-by: Mathieu Malaterre <malat@debian.org> Signed-off-by: Rob Herring <robh@kernel.org>
2017-12-06of: overlay: Remove else after gotoGeert Uytterhoeven
If an "if" branch is terminated by a "goto", there's no need to have an "else" statement and an indented block of code. Remove the "else" statement to simplify the code flow for the casual reviewer. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Rob Herring <robh@kernel.org>
2017-12-06of: Spelling s/changset/changeset/Geert Uytterhoeven
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Rob Herring <robh@kernel.org>
2017-12-06of: unittest: Remove bogus overlay mutex release from overlay_data_add()Geert Uytterhoeven
overlay_data_add() never takes the special overlay mutex, so it must not be released in the error patch. Presumably the call to of_overlay_mutex_unlock() is a relic from v1 of the patch. Fixes: f948d6d8b792bb90 ("of: overlay: avoid race condition between applying multiple overlays") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Frank Rowand <frank.rowand@sony.com> Signed-off-by: Rob Herring <robh@kernel.org>
2017-12-06PCI: Add pci_get_domain_bus_and_slot() stubRandy Dunlap
The coretemp driver build fails when CONFIG_PCI is not enabled because it uses a function that does not have a stub for that config case, so add the function stub. ../drivers/hwmon/coretemp.c: In function 'adjust_tjmax': ../drivers/hwmon/coretemp.c:250:9: error: implicit declaration of function 'pci_get_domain_bus_and_slot' [-Werror=implicit-function-declaration] struct pci_dev *host_bridge = pci_get_domain_bus_and_slot(0, 0, devfn); ../drivers/hwmon/coretemp.c:250:32: warning: initialization makes pointer from integer without a cast [enabled by default] struct pci_dev *host_bridge = pci_get_domain_bus_and_slot(0, 0, devfn); Signed-off-by: Randy Dunlap <rdunlap@infradead.org> [bhelgaas: identical patch also by Arnd Bergmann <arnd@arndb.de>] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Guenter Roeck <linux@roeck-us.net>
2017-12-06drivers: net: dsa: remove duplicate includesPravin Shedge
These duplicate includes have been found with scripts/checkincludes.pl but they have been removed manually to avoid removing false positives. Signed-off-by: Pravin Shedge <pravin.shedge4linux@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-06rds: Fix NULL pointer dereference in __rds_rdma_mapHåkon Bugge
This is a fix for syzkaller719569, where memory registration was attempted without any underlying transport being loaded. Analysis of the case reveals that it is the setsockopt() RDS_GET_MR (2) and RDS_GET_MR_FOR_DEST (7) that are vulnerable. Here is an example stack trace when the bug is hit: BUG: unable to handle kernel NULL pointer dereference at 00000000000000c0 IP: __rds_rdma_map+0x36/0x440 [rds] PGD 2f93d03067 P4D 2f93d03067 PUD 2f93d02067 PMD 0 Oops: 0000 [#1] SMP Modules linked in: bridge stp llc tun rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache rds binfmt_misc sb_edac intel_powerclamp coretemp kvm_intel kvm irqbypass crct10dif_pclmul c rc32_pclmul ghash_clmulni_intel pcbc aesni_intel crypto_simd glue_helper cryptd iTCO_wdt mei_me sg iTCO_vendor_support ipmi_si mei ipmi_devintf nfsd shpchp pcspkr i2c_i801 ioatd ma ipmi_msghandler wmi lpc_ich mfd_core auth_rpcgss nfs_acl lockd grace sunrpc ip_tables ext4 mbcache jbd2 mgag200 i2c_algo_bit drm_kms_helper ixgbe syscopyarea ahci sysfillrect sysimgblt libahci mdio fb_sys_fops ttm ptp libata sd_mod mlx4_core drm crc32c_intel pps_core megaraid_sas i2c_core dca dm_mirror dm_region_hash dm_log dm_mod CPU: 48 PID: 45787 Comm: repro_set2 Not tainted 4.14.2-3.el7uek.x86_64 #2 Hardware name: Oracle Corporation ORACLE SERVER X5-2L/ASM,MOBO TRAY,2U, BIOS 31110000 03/03/2017 task: ffff882f9190db00 task.stack: ffffc9002b994000 RIP: 0010:__rds_rdma_map+0x36/0x440 [rds] RSP: 0018:ffffc9002b997df0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff882fa2182580 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffc9002b997e40 RDI: ffff882fa2182580 RBP: ffffc9002b997e30 R08: 0000000000000000 R09: 0000000000000002 R10: ffff885fb29e3838 R11: 0000000000000000 R12: ffff882fa2182580 R13: ffff882fa2182580 R14: 0000000000000002 R15: 0000000020000ffc FS: 00007fbffa20b700(0000) GS:ffff882fbfb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000c0 CR3: 0000002f98a66006 CR4: 00000000001606e0 Call Trace: rds_get_mr+0x56/0x80 [rds] rds_setsockopt+0x172/0x340 [rds] ? __fget_light+0x25/0x60 ? __fdget+0x13/0x20 SyS_setsockopt+0x80/0xe0 do_syscall_64+0x67/0x1b0 entry_SYSCALL64_slow_path+0x25/0x25 RIP: 0033:0x7fbff9b117f9 RSP: 002b:00007fbffa20aed8 EFLAGS: 00000293 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00000000000c84a4 RCX: 00007fbff9b117f9 RDX: 0000000000000002 RSI: 0000400000000114 RDI: 000000000000109b RBP: 00007fbffa20af10 R08: 0000000000000020 R09: 00007fbff9dd7860 R10: 0000000020000ffc R11: 0000000000000293 R12: 0000000000000000 R13: 00007fbffa20b9c0 R14: 00007fbffa20b700 R15: 0000000000000021 Code: 41 56 41 55 49 89 fd 41 54 53 48 83 ec 18 8b 87 f0 02 00 00 48 89 55 d0 48 89 4d c8 85 c0 0f 84 2d 03 00 00 48 8b 87 00 03 00 00 <48> 83 b8 c0 00 00 00 00 0f 84 25 03 00 0 0 48 8b 06 48 8b 56 08 The fix is to check the existence of an underlying transport in __rds_rdma_map(). Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com> Reported-by: syzbot <syzkaller@googlegroups.com> Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-06net_sched: use macvlan real dev trans_start in dev_trans_start()Chris Dion
Macvlan devices are similar to vlans and do not update their own trans_start. In order for arp monitoring to work for a bond device when the slaves are macvlans, obtain its real device. Signed-off-by: Chris Dion <christopher.dion@dell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-06x86/vdso: Change time() prototype to match __vdso_time()Arnd Bergmann
gcc-8 warns that time() is an alias for __vdso_time() but the two have different prototypes: arch/x86/entry/vdso/vclock_gettime.c:327:5: error: 'time' alias between functions of incompatible types 'int(time_t *)' {aka 'int(long int *)'} and 'time_t(time_t *)' {aka 'long int(long int *)'} [-Werror=attribute-alias] int time(time_t *t) ^~~~ arch/x86/entry/vdso/vclock_gettime.c:318:16: note: aliased declaration here I could not figure out whether this is intentional, but I see that changing it to return time_t avoids the warning. Returning 'int' from time() is also a bit questionable, as it causes an overflow in y2038 even on 64-bit architectures that use a 64-bit time_t type. On 32-bit architecture with 64-bit time_t, time() should always be implement by the C library by calling a (to be added) clock_gettime() variant that takes a sufficiently wide argument. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Thomas Gleixner <tglx@linutronix.de> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Vitaly Kuznetsov <vkuznets@redhat.com> Link: http://lkml.kernel.org/r/20171204150203.852959-1-arnd@arndb.de Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-12-07Merge branch 'drm-fixes-4.15' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie
into drm-fixes ttm and license fixes * 'drm-fixes-4.15' of git://people.freedesktop.org/~agd5f/linux: drm/ttm: swap consecutive allocated pooled pages v4 drm/ttm: swap consecutive allocated cached pages v3 drm/ttm: roundup the shrink request to prevent skip huge pool drm/ttm: add page order support in ttm_pages_put drm/ttm: add set_pages_wb for handling page order more than zero drm/ttm: add page order in page pool drm/ttm: use NUM_PAGES_TO_ALLOC always drm/amdgpu: add license to files where it was missing drm/amdgpu: add license to Makefiles
2017-12-06xen-netback: Fix logging message with spurious period after newlineJoe Perches
Using a period after a newline causes bad output. Signed-off-by: Joe Perches <joe@perches.com> Reviewed-by: Paul Durrant <paul.durrant@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-06ARM64: dts: meson: drop "sana" clock from SAR ADCXingyu Chen
The SAR ADC modules doesn't require The "sana" clock. Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Singed-off-by: Xingyu Chen <xingyu.chen@amlogic.com> Signed-off-by: Yixun Lan <yixun.lan@amlogic.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2017-12-06net: thunderx: Fix TCP/UDP checksum offload for IPv4 pktsFlorian Westphal
Offload IP header checksum to NIC. This fixes a previous patch which disabled checksum offloading for both IPv4 and IPv6 packets. So L3 checksum offload was getting disabled for IPv4 pkts. And HW is dropping these pkts for some reason. Without this patch, IPv4 TSO appears to be broken: WIthout this patch I get ~16kbyte/s, with patch close to 2mbyte/s when copying files via scp from test box to my home workstation. Looking at tcpdump on sender it looks like hardware drops IPv4 TSO skbs. This patch restores performance for me, ipv6 looks good too. Fixes: fa6d7cb5d76c ("net: thunderx: Fix TCP/UDP checksum offload for IPv6 pkts") Cc: Sunil Goutham <sgoutham@cavium.com> Cc: Aleksey Makarov <aleksey.makarov@auriga.com> Cc: Eric Dumazet <edumazet@google.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-06arm64/sve: Avoid dereference of dead task_struct in KVM guest entryDave Martin
When deciding whether to invalidate FPSIMD state cached in the cpu, the backend function sve_flush_cpu_state() attempts to dereference __this_cpu_read(fpsimd_last_state). However, this is not safe: there is no guarantee that this task_struct pointer is still valid, because the task could have exited in the meantime. This means that we need another means to get the appropriate value of TIF_SVE for the associated task. This patch solves this issue by adding a cached copy of the TIF_SVE flag in fpsimd_last_state, which we can check without dereferencing the task pointer. In particular, although this patch is not a KVM fix per se, this means that this check is now done safely in the KVM world switch path (which is currently the only user of this code). Signed-off-by: Dave Martin <Dave.Martin@arm.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Christoffer Dall <christoffer.dall@linaro.org> Cc: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com>
2017-12-06Merge tag 'iommu-v4.15-rc3' of git://github.com/awilliam/linux-vfioLinus Torvalds
Pull IOMMU fix from Alex Williamson: "Fix VT-d handling of scatterlists where sg->offset exceeds PAGE_SIZE" * tag 'iommu-v4.15-rc3' of git://github.com/awilliam/linux-vfio: iommu/vt-d: Fix scatterlist offset handling
2017-12-06Merge tag 'sound-4.15-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "All fixes are small and for stable: - a PCM ioctl race fix - yet another USB-audio hardening for malicious descriptors - Realtek ALC257 codec support" * tag 'sound-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: pcm: prevent UAF in snd_pcm_info ALSA: hda/realtek - New codec support for ALC257 ALSA: usb-audio: Add check return value for usb_string() ALSA: usb-audio: Fix out-of-bound error ALSA: seq: Remove spurious WARN_ON() at timer check
2017-12-06CIFS: don't log STATUS_NOT_FOUND errors for DFSAurelien Aptel
cifs.ko makes DFS queries regardless of the type of the server and non-DFS servers are common. This often results in superfluous logging of non-critical errors. Signed-off-by: Aurelien Aptel <aaptel@suse.com> Signed-off-by: Steve French <smfrench@gmail.com> Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
2017-12-06cifs: fix NULL deref in SMB2_readRonnie Sahlberg
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com> Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com> CC: Stable <stable@vger.kernel.org> Signed-off-by: Steve French <smfrench@gmail.com>
2017-12-06ARM64: dts: odroid-c2: Add HDMI and CEC NodesNeil Armstrong
Now the VPU Power Domain has been fixed while boothing from Mainline U-Boot, VPU and HDMI nodes can finally be added to the Odroid-C2 DTS. Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2017-12-06ARM64: dts: meson-gx: grow reset controller memory zoneNeil Armstrong
Now the Amlogic Meson GX SoCs datasheet documents all the Reset registers, grow the memory in the node to allow usage of the level registers. Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>