summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-04-13ALSA: hda - Fix regression of monitor_present flag in eld proc fileHyungwon Hwang
The commit [bd48128539ab: ALSA: hda - Fix forgotten HDMI monitor_present update] covered the missing update of monitor_present flag, but this caused a regression for devices without the i915 eld notifier. Since the old code supposed that pin_eld->monitor_present was updated by the caller side, the hdmi_present_sense_via_verbs() doesn't update the temporary eld->monitor_present but only pin_eld->monitor_present, which is now overridden in update_eld(). The fix is to update pin_eld->monitor_present as well before calling update_eld(). Note that this may still leave monitor_present flag in an inconsistent state when the driver repolls, but this is at least the old behavior. More proper fix will follow in the later patch. Fixes: bd48128539ab ('ALSA: hda - Fix forgotten HDMI monitor_present update') Signed-off-by: Hyungwon Hwang <hyungwon.hwang7@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-04-12ext4/fscrypto: avoid RCU lookup in d_revalidateJaegeuk Kim
As Al pointed, d_revalidate should return RCU lookup before using d_inode. This was originally introduced by: commit 34286d666230 ("fs: rcu-walk aware d_revalidate method"). Reported-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Cc: Theodore Ts'o <tytso@mit.edu> Cc: stable <stable@vger.kernel.org>
2016-04-13Merge tag 'keys-fixes-20160412' of ↵James Morris
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into for-linus
2016-04-12debugfs: Make automount point inodes permanently emptySeth Forshee
Starting with 4.1 the tracing subsystem has its own filesystem which is automounted in the tracing subdirectory of debugfs. Prior to this debugfs could be bind mounted in a cloned mount namespace, but if tracefs has been mounted under debugfs this now fails because there is a locked child mount. This creates a regression for container software which bind mounts debugfs to satisfy the assumption of some userspace software. In other pseudo filesystems such as proc and sysfs we're already creating mountpoints like this in such a way that no dirents can be created in the directories, allowing them to be exceptions to some MNT_LOCKED tests. In fact we're already do this for the tracefs mountpoint in sysfs. Do the same in debugfs_create_automount(), since the intention here is clearly to create a mountpoint. This fixes the regression, as locked child mounts on permanently empty directories do not cause a bind mount to fail. Cc: stable@vger.kernel.org # v4.1+ Signed-off-by: Seth Forshee <seth.forshee@canonical.com> Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-12Merge tag 'mvebu-fixes-4.6-1' of git://git.infradead.org/linux-mvebu into fixesOlof Johansson
mvebu fixes for 4.6 (part 1) - fix USB adress register for Linksys Armada 388 based boards - fix build warning in mvebu-mbus * tag 'mvebu-fixes-4.6-1' of git://git.infradead.org/linux-mvebu: ARM: mvebu: Correct unit address for linksys bus: mvebu-mbus: use %pa to print phys_addr_t Signed-off-by: Olof Johansson <olof@lixom.net>
2016-04-12ARM: sa1100: remove references to the defunct handhelds.orgLinus Walleij
The website handhelds.org has been down for a long time and is likely never coming back online. Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Olof Johansson <olof@lixom.net>
2016-04-12Merge tag 'pxa-fixes-v4.6' of https://github.com/rjarzmik/linux into fixesOlof Johansson
ARM: pxa: fixes for v4.6 There is only a single fix for dma requestor lines initial setup, triggered by dmaengine previous fix. * tag 'pxa-fixes-v4.6' of https://github.com/rjarzmik/linux: ARM: pxa: fix the number of DMA requestor lines Signed-off-by: Olof Johansson <olof@lixom.net>
2016-04-12Merge tag 'omap-for-v4.6/fixes-rc1' of ↵Olof Johansson
git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Fixes for omaps against v4.6-rc1. Mostly minor fixes for the newer SoCs with few board fixes and a fix for a long time hwmod bug: - Fix cpsw_emac0 link type for baltos-ir5221 - Fix interrupt type for TWD - Fix edma memcpy channel allocation for am43x - Fix am43x-epos sycntimer32k by using the correct assigned clock - Fix interconnect barrier for dra7 - Fix a long time hwmod bug for updating sysconfig register properly - Fix flakey booting on dm814x where USB reset needs a delay And there is one minor change that is not strictly a fix, but is good to have for proper hardware detection: - Detect dra7 silicon revision 2.0 properly * tag 'omap-for-v4.6/fixes-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: am335x-baltos-ir5221: fix cpsw_emac0 link type ARM: OMAP: Correct interrupt type for ARM TWD ARM: DRA722: Add ID detect for Silicon Rev 2.0 ARM: dts: am43xx: fix edma memcpy channel allocation ARM: dts: AM43x-epos: Fix clk parent for synctimer ARM: OMAP2: Fix up interconnect barrier initialization for DRA7 ARM: OMAP2+: hwmod: Fix updating of sysconfig register ARM: OMAP2+: Use srst_udelay for USB on dm814x Signed-off-by: Olof Johansson <olof@lixom.net>
2016-04-12bus: uniphier-system-bus: fix condition of overlap checkKunihiko Hayashi
This patch fixes condition whether the specified address ranges overlap each other. Fixes: 4b7f48d395a7 ("bus: uniphier-system-bus: add UniPhier System Bus driver") Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com> Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com> Signed-off-by: Olof Johansson <olof@lixom.net>
2016-04-12ARM: uniphier: drop weird sizeof()Masahiro Yamada
My intention was to ioremap a 4-byte register. Coincidentally enough, sizeof(SZ_4) equals to SZ_4, but this code is weird anyway. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com> Signed-off-by: Olof Johansson <olof@lixom.net>
2016-04-12fscrypto: don't let data integrity writebacks fail with ENOMEMJaegeuk Kim
This patch fixes the issue introduced by the ext4 crypto fix in a same manner. For F2FS, however, we flush the pending IOs and wait for a while to acquire free memory. Fixes: c9af28fdd4492 ("ext4 crypto: don't let data integrity writebacks fail with ENOMEM") Cc: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2016-04-12f2fs: use dget_parent and file_dentry in f2fs_file_openJaegeuk Kim
This patch synced with the below two ext4 crypto fixes together. In 4.6-rc1, f2fs newly introduced accessing f_path.dentry which crashes overlayfs. To fix, now we need to use file_dentry() to access that field. Fixes: c0a37d487884 ("ext4: use file_dentry()") Fixes: 9dd78d8c9a7b ("ext4: use dget_parent() in ext4_file_open()") Cc: Miklos Szeredi <mszeredi@redhat.com> Cc: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2016-04-12fscrypto: use dget_parent() in fscrypt_d_revalidate()Jaegeuk Kim
This patch updates fscrypto along with the below ext4 crypto change. Fixes: 3d43bcfef5f0 ("ext4 crypto: use dget_parent() in ext4_d_revalidate()") Cc: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2016-04-13drm/exynos: Use VIDEO_SAMSUNG_S5P_G2D=n as G2D Kconfig dependencyJavier Martinez Canillas
Commit 254d4d111ee1 ("drm/exynos: Add dependency for G2D in Kconfig") made the DRM_EXYNOS_G2D symbol to only be selectable if the s5p-g2d V4L2 driver is not enabled, since both use the same HW IP block. But added the dependency as depends on !VIDEO_SAMSUNG_S5P_G2D which isn't correct since Kconfig expressions are not boolean but tristate. So it will only evaluate to 'n' if VIDEO_SAMSUNG_S5P_G2D=y but it will evaluate to m if VIDEO_SAMSUNG_S5P_G2D=m. This means that both the V4L2 and DRM drivers can be enabled if the former is enabled as a module, which is not what we want. Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-04-12drm/exynos: fix a warning messageDan Carpenter
The "ret = regmap_write()" assignment was missing so this error message is never printed. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-04-12drm/exynos: mic: fix an error codeDan Carpenter
We accidentally return success instead of a negative error code here. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-04-12drm/exynos: fimd: fix broken dp_clock controlMarek Szyprowski
Commit 1feafd3afd294b03dbbedb8e8f94e0c4db526f10 ("drm/exynos: add exynos5420 support for fimd") add support for Exynos 5420 SoC, but it broke enabling display clock feature because of incorrect condition check. This patch fixes it, so display is working again on platforms requiring display clock control (i.e. Exynos5250-based SNOW platform). Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-04-12drm/exynos: build fbdev code conditionallyAndrzej Hajda
Fbdev code should be compiled only if CONFIG_DRM_FBDEV_EMULATION option is enabled. The patch fixes exynos-drm code trying to manipulate fbdev data which is not initialized in case CONFIG_DRM_FBDEV_EMULATION is disabled. Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-04-12drm/exynos: fix adjusted_mode pointer in exynos_plane_mode_setAndrzej Hajda
exynos_plane_mode_set should use adjusted_mode from the same atomic state as plane state. Otherwise it will result in incorrect behavior in case crtc mode changes. The patch fixes bug with black console framebuffer in case of command mode panels. Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-04-12drm/exynos: fix error handling in exynos_drm_subdrv_openArnd Bergmann
gcc-6 warns about a pointless loop in exynos_drm_subdrv_open: drivers/gpu/drm/exynos/exynos_drm_core.c: In function 'exynos_drm_subdrv_open': drivers/gpu/drm/exynos/exynos_drm_core.c:104:199: error: self-comparison always evaluates to false [-Werror=tautological-compare] list_for_each_entry_reverse(subdrv, &subdrv->list, list) { Here, the list_for_each_entry_reverse immediately terminates because the subdrv pointer is compared to itself as the loop end condition. If we were to take the current subdrv pointer as the start of the list (as we would do if list_for_each_entry_reverse() was not a macro), we would iterate backwards over the &exynos_drm_subdrv_list anchor, which would be even worse. Instead, we need to use list_for_each_entry_continue_reverse() to go back over each subdrv that was successfully opened until the first entry. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-04-12ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB DockKailang Yang
This is Dell usb dock audio workaround. It was fixed the master volume keep lower. [Some background: the patch essentially skips the controls of a couple of FU volumes. Although the firmware exposes the dB and the value information via the usb descriptor, changing the values (we set the min volume as default) screws up the device. Although this has been fixed in the newer firmware, the devices are shipped with the old firmware, thus we need the workaround in the driver side. -- tiwai] Signed-off-by: Kailang Yang <kailang@realtek.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-04-12mailbox: Stop using ENOSYS for anything other than unimplemented syscallsLee Jones
In accordance with e15f431fe2d5 ("errno.h: Improve ENOSYS's comment") and 91c9afaf97ee ("checkpatch.pl: new instances of ENOSYS are errors") we're converting from the old meaning of: ENOSYS "Function not implemented" to a more standard EINVAL. Reported-by: Seraphin Bonnaffe <seraphin.bonnaffe@st.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
2016-04-12mailbox: mailbox-test: Prevent memory leakLee Jones
If we set the Signal twice or more, without using it as part of a message, memory will be re-allocated and the pointer over-written. Prevent this potential leak by only allocating memory when there isn't any already. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
2016-04-12mailbox: mailbox-test: Use more consistent format for calling copy_from_user()Lee Jones
While we're at it, ensure copy-to location is NULL'ed in the error path. Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
2016-04-11Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: - fix for how scaling linearization is computed in wiimote driver, by Cyan Ogilvie - endless retry loop fix in generic USB HID core reset-resume handling, by Alan Stern - two functional fixes affecting particular devices, and oops fix for wacom driver, by Jason Gerecke - multitouch slot numbering fix from Gabriele Mazzotta - a couple more small fixes on top * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: wacom: Support switching from vendor-defined device mode on G9 and G11 HID: wacom: Initialize hid_data.inputmode to -1 HID: microsoft: add support for 3 more devices HID: multitouch: Synchronize MT frame on reset_resume HID: wacom: fix Bamboo ONE oops HID: lenovo: Don't use stack variables for DMA buffers HID: usbhid: fix inconsistent reset/resume/reset-resume behavior HID: wiimote: Fix wiimote mp scale linearization
2016-04-11Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k update from Geert Uytterhoeven. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k/defconfig: Update defconfigs for v4.6-rc2 m68k: Wire up preadv2 and pwritev2
2016-04-11Merge tag 'arc-4.6-rc4-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - fix Kconfig splat due to pcie rework - make ethernet work again on axs103 - provide fb_pgprotect() for future video driver integration * tag 'arc-4.6-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: [plat-axs103] Enable loop block devices Revert "ARC: [plat-axs10x] add Ethernet PHY description in .dts" arc: Add our own implementation of fb_pgprotect() ARC: Don't source drivers/pci/pcie/Kconfig ourselves
2016-04-11NVMe: Fix reset/remove raceKeith Busch
This fixes a scenario where device is present and being reset, but a request to unbind the driver occurs. A previous patch series addressing a device failure removal scenario flushed reset_work after controller disable to unblock reset_work waiting on a completion that wouldn't occur. This isn't safe as-is. The broken scenario can potentially be induced with: modprobe nvme && modprobe -r nvme To fix, the reset work is flushed immediately after setting the controller removing flag, and any subsequent reset will not proceed with controller initialization if the flag is set. The controller status must be polled while active, so the watchdog timer is also left active until the controller is disabled to cleanup requests that may be stuck during namespace removal. [Fixes: ff23a2a15a2117245b4599c1352343c8b8fb4c43] Signed-off-by: Keith Busch <keith.busch@intel.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Jens Axboe <axboe@fb.com>
2016-04-11dm: fix dm_target_io leak if clone_bio() returns an errorMikulas Patocka
Commit c80914e81ec5b08 ("dm: return error if bio_integrity_clone() fails in clone_bio()") changed clone_bio() such that if it does return error then the alloc_tio() created resources (both the bio that was allocated to be a clone and the containing dm_target_io struct) will leak. Fix this by calling free_tio() in __clone_and_map_data_bio()'s clone_bio() error path. Fixes: c80914e81ec5b08 ("dm: return error if bio_integrity_clone() fails in clone_bio()") Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2016-04-11ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460sSven Eckelmann
The Lenovo Thinkpad T460s requires the alc_fixup_tpt440_dock as well in order to get working sound output on the docking stations headphone jack. Patch tested on a Thinkpad T460s (20F9CT01WW) using a ThinkPad Ultradock on kernel 4.4.6. Signed-off-by: Sven Eckelmann <sven@narfation.org> Tested-by: Simon Wunderlich <sw@simonwunderlich.de> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-04-11ALSA: sscape: Use correct format identifier for size_tWilliam Breathitt Gray
The 'size' member of a struct firmware is passed to snd_printk with a respective format string using the %d identifier. The 'size' member is of type size_t, but format identifier %d indicates a signed int data type. This patch replaces the %d format identifier with the correct %zu format identifier for size_t data types. Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-04-11Merge tag 'drm-intel-fixes-2016-04-07' of ↵Dave Airlie
git://anongit.freedesktop.org/drm-intel into drm-fixes misc i915 fixes. * tag 'drm-intel-fixes-2016-04-07' of git://anongit.freedesktop.org/drm-intel: drm/i915: fix deadlock on lid open drm/i915: Exit cherryview_irq_handler() after one pass drm/i915: Call intel_dp_mst_resume() before resuming displays drm/i915: Fix race condition in intel_dp_destroy_mst_connector()
2016-04-11Merge tag 'topic/drm-fixes-2016-04-07' of ↵Dave Airlie
git://anongit.freedesktop.org/drm-intel into drm-fixes The qxl fix I've picked up quite some time ago, and unfortunately neglected. Then there's established timing fixes, of which particularly "drm/edid: Fix parsing of EDID 1.4 Established Timings III descriptor" is quite surprising. It looks like we've never got any of them right. I am not sure what the full implications of this are. That combined with lack of any details of real world bugs fixed made me decide against cc: stable. * tag 'topic/drm-fixes-2016-04-07' of git://anongit.freedesktop.org/drm-intel: drm/edid: Fix DMT 1024x768@43Hz (interlaced) timings drm/edid: Fix parsing of EDID 1.4 Established Timings III descriptor drm/edid: Fix EDID Established Timings I and II drm/qxl: fix cursor position with non-zero hotspot
2016-04-11m68k/gpio: remove arch specific sysfs bus deviceGreg Ungerer
The ColdFire architecture specific gpio support code registers a sysfs bus device named "gpio". This clashes with the new generic API device added in commit 3c702e99 ("gpio: add a userspace chardev ABI for GPIOs"). The old ColdFire sysfs gpio device was never used for anything specific, and no links or other nodes were created under it. The new API sysfs gpio device has all the same default sysfs links (device, drivers, etc) and they are properly populated. Remove the old ColdFire sysfs gpio registration. Signed-off-by: Greg Ungerer <gerg@uclinux.org> Acked-by: Linus Walleij <linus.walleij@linaro.org>
2016-04-10Linux 4.6-rc3v4.6-rc3Linus Torvalds
2016-04-10Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-armLinus Torvalds
Pull ARM fixes from Russell King: "A couple of small fixes, and wiring up the new syscalls which appeared during the merge window" * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: ARM: 8550/1: protect idiv patching against undefined gcc behavior ARM: wire up preadv2 and pwritev2 syscalls ARM: SMP enable of cache maintanence broadcast
2016-04-10Merge tag 'mmc-v4.6-rc1' of git://git.linaro.org/people/ulf.hansson/mmcLinus Torvalds
Pull MMC fixes from Ulf Hansson: "Here are a couple of mmc fixes intended for v4.6 rc3: MMC host: - sdhci: Fix regression setting power on Trats2 board - sdhci-pci: Add support and PCI IDs for more Broxton host controllers" * tag 'mmc-v4.6-rc1' of git://git.linaro.org/people/ulf.hansson/mmc: mmc: sdhci-pci: Add support and PCI IDs for more Broxton host controllers mmc: sdhci: Fix regression setting power on Trats2 board
2016-04-10Merge branch 'i2c/for-current' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Some bugfixes from I2C: - fix a uevent triggered boot problem by removing a useless debug print - fix sysfs-attributes of the new i2c-demux-pinctrl driver to follow standard kernel behaviour - fix a potential division-by-zero error (needed two takes)" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: jz4780: really prevent potential division by zero Revert "i2c: jz4780: prevent potential division by zero" i2c: jz4780: prevent potential division by zero i2c: mux: demux-pinctrl: Update docs to new sysfs-attributes i2c: mux: demux-pinctrl: Clean up sysfs attributes i2c: prevent endless uevent loop with CONFIG_I2C_DEBUG_CORE
2016-04-10Revert "ext4: allow readdir()'s of large empty directories to be interrupted"Linus Torvalds
This reverts commit 1028b55bafb7611dda1d8fed2aeca16a436b7dff. It's broken: it makes ext4 return an error at an invalid point, causing the readdir wrappers to write the the position of the last successful directory entry into the position field, which means that the next readdir will now return that last successful entry _again_. You can only return fatal errors (that terminate the readdir directory walk) from within the filesystem readdir functions, the "normal" errors (that happen when the readdir buffer fills up, for example) happen in the iterorator where we know the position of the actual failing entry. I do have a very different patch that does the "signal_pending()" handling inside the iterator function where it is allowable, but while that one passes all the sanity checks, I screwed up something like four times while emailing it out, so I'm not going to commit it today. So my track record is not good enough, and the stars will have to align better before that one gets committed. And it would be good to get some review too, of course, since celestial alignments are always an iffy debugging model. IOW, let's just revert the commit that caused the problem for now. Reported-by: Greg Thelen <gthelen@google.com> Cc: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-04-10KVM: x86: mask CPUID(0xD,0x1).EAX against host valuePaolo Bonzini
This ensures that the guest doesn't see XSAVE extensions (e.g. xgetbv1 or xsavec) that the host lacks. Cc: stable@vger.kernel.org Reviewed-by: Radim Krčmář <rkrcmar@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-04-10kvm: x86: do not leak guest xcr0 into host interrupt handlersDavid Matlack
An interrupt handler that uses the fpu can kill a KVM VM, if it runs under the following conditions: - the guest's xcr0 register is loaded on the cpu - the guest's fpu context is not loaded - the host is using eagerfpu Note that the guest's xcr0 register and fpu context are not loaded as part of the atomic world switch into "guest mode". They are loaded by KVM while the cpu is still in "host mode". Usage of the fpu in interrupt context is gated by irq_fpu_usable(). The interrupt handler will look something like this: if (irq_fpu_usable()) { kernel_fpu_begin(); [... code that uses the fpu ...] kernel_fpu_end(); } As long as the guest's fpu is not loaded and the host is using eager fpu, irq_fpu_usable() returns true (interrupted_kernel_fpu_idle() returns true). The interrupt handler proceeds to use the fpu with the guest's xcr0 live. kernel_fpu_begin() saves the current fpu context. If this uses XSAVE[OPT], it may leave the xsave area in an undesirable state. According to the SDM, during XSAVE bit i of XSTATE_BV is not modified if bit i is 0 in xcr0. So it's possible that XSTATE_BV[i] == 1 and xcr0[i] == 0 following an XSAVE. kernel_fpu_end() restores the fpu context. Now if any bit i in XSTATE_BV == 1 while xcr0[i] == 0, XRSTOR generates a #GP. The fault is trapped and SIGSEGV is delivered to the current process. Only pre-4.2 kernels appear to be vulnerable to this sequence of events. Commit 653f52c ("kvm,x86: load guest FPU context more eagerly") from 4.2 forces the guest's fpu to always be loaded on eagerfpu hosts. This patch fixes the bug by keeping the host's xcr0 loaded outside of the interrupts-disabled region where KVM switches into guest mode. Cc: stable@vger.kernel.org Suggested-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: David Matlack <dmatlack@google.com> [Move load after goto cancel_injection. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-04-10KVM: MMU: fix permission_fault()Xiao Guangrong
kvm-unit-tests complained about the PFEC is not set properly, e.g,: test pte.rw pte.d pte.nx pde.p pde.rw pde.pse user fetch: FAIL: error code 15 expected 5 Dump mapping: address: 0x123400000000 ------L4: 3e95007 ------L3: 3e96007 ------L2: 2000083 It's caused by the reason that PFEC returned to guest is copied from the PFEC triggered by shadow page table This patch fixes it and makes the logic of updating errcode more clean Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> [Do not assume pfec.p=1. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-04-09Merge branch 'parisc-4.6-3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: "Since commit 0de798584bde ("parisc: Use generic extable search and sort routines") module loading is boken on parisc, because the parisc module loader wasn't prepared for the new R_PARISC_PCREL32 relocations. In addition, due to that breakage, Mikulas Patocka noticed that handling exceptions from modules probably never worked on parisc. It was just masked by the fact that exceptions from modules don't happen during normal use. This patch series fixes those issues and survives the tests of the lib/test_user_copy kernel module test. Some patches are tagged for stable" * 'parisc-4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Update comment regarding relative extable support parisc: Unbreak handling exceptions from kernel modules parisc: Fix kernel crash with reversed copy_from_user() parisc: Avoid function pointers for kernel exception routines parisc: Handle R_PARISC_PCREL32 relocations in kernel modules
2016-04-09Merge branch 'libnvdimm-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: "Three fixes, the first two are tagged for -stable: - The ndctl utility/library gained expanded unit tests illuminating a long standing bug in the libnvdimm SMART data retrieval implementation. It has been broken since its initial implementation, now fixed. - Another one line fix for the detection of stale info blocks. Without this change userspace can get into a situation where it is unable to reconfigure a namespace. - Fix the badblock initialization path in the presence of the new (in v4.6-rc1) section alignment workarounds. Without this change badblocks will be reported at the wrong offset. These have received a build success report from the kbuild robot and have appeared in -next with no reported issues" * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: libnvdimm, pfn: fix nvdimm_namespace_add_poison() vs section alignment libnvdimm, pfn: fix uuid validation libnvdimm: fix smart data retrieval
2016-04-09Merge tag 'gpio-v4.6-3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Here is a set of four GPIO fixes. The two fixes to the core are serious as they are regressing minor architectures. Core fixes: - Defer GPIO device setup until after gpiolib is initialized. It turns out that a few very tightly integrated GPIO platform drivers initialize so early (befor core_initcall()) so that the gpiolib isn't even initialized itself. That limits what the library can do, and we cannot reference uninitialized fields until later. Defer some of the initialization until right after the gpiolib is initialized in these (rare) cases. - As a consequence: do not use devm_* resources when allocating the states in the initial set-up of the gpiochip. Driver fixes: - In ACPI retrieveal: ignore GpioInt when looking for output GPIOs. - Fix legacy builds on the PXA without a backing pin controller. - Use correct datatype on pca953x register writes" * tag 'gpio-v4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: pca953x: Use correct u16 value for register word write gpiolib: Defer gpio device setup until after gpiolib initialization gpiolib: Do not use devm functions when registering gpio chip gpio: pxa: fix legacy non pinctrl aware builds gpio / ACPI: ignore GpioInt() GPIOs when requesting GPIO_OUT_*
2016-04-09Merge tag 'tty-4.6-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty fixes from Greg KH: "Here are two tty fixes for issues found. One was due to a merge error in 4.6-rc1, and the other a regression fix for UML consoles that broke in 4.6-rc1. Both have been in linux-next for a while" * tag 'tty-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: Fix merge of "tty: Refactor tty_open()" tty: Fix UML console breakage
2016-04-09Merge tag 'usb-4.6-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some USB fixes and new device ids for 4.6-rc3. Nothing major, the normal USB gadget fixes and usb-serial driver ids, along with some other fixes mixed in. All except the USB serial ids have been tested in linux-next, the id additions should be fine as they are 'trivial'" * tag 'usb-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits) USB: option: add "D-Link DWM-221 B1" device id USB: serial: cp210x: Adding GE Healthcare Device ID USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices usb: dwc3: keystone: drop dma_mask configuration usb: gadget: udc-core: remove manual dma configuration usb: dwc3: pci: add ID for one more Intel Broxton platform usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done() usb: dwc2: do not override forced dr_mode in gadget setup usb: gadget: f_midi: unlock on error USB: digi_acceleport: do sanity checking for the number of ports USB: cypress_m8: add endpoint sanity check USB: mct_u232: add sanity checking in probe usb: fix regression in SuperSpeed endpoint descriptor parsing USB: usbip: fix potential out-of-bounds write usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler() usb: gadget: f_midi: Fixed a bug when buflen was smaller than wMaxPacketSize usb: phy: qcom-8x16: fix regulator API abuse usb: ch9: Fix SSP Device Cap wFunctionalitySupport type usb: gadget: composite: Access SSP Dev Cap fields properly ...
2016-04-09Merge tag 'staging-4.6-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging and IIO driver fixes from Greg KH: "Here are some IIO driver fixes, along with two staging driver fixes for 4.6-rc3. One staging driver patch reverts the deletion of a driver that happened in 4.6-rc1. We thought that laptop.org was dead, but it's still alive and kicking, and has users that were mad we broke their hardware by deleting a driver for their machines. So that driver is added back and everyone is happy again. All of these have been in linux-next for a while with no reported issues" * tag 'staging-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: Revert "Staging: olpc_dcon: Remove obsolete driver" staging/rdma/hfi1: select CRC32 iio: gyro: bmg160: fix buffer read values iio: gyro: bmg160: fix endianness when reading axes iio: accel: bmc150: fix endianness when reading axes iio: st_magn: always define ST_MAGN_TRIGGER_SET_STATE iio: fix config watermark initial value iio: health: max30100: correct FIFO check condition iio: imu: Fix inv_mpu6050 dependencies iio: adc: Fix build error of missing devm_ioremap_resource on UM iio: light: apds9960: correct FIFO check condition iio: adc: max1363: correct reference voltage iio: adc: max1363: add missing adc to max1363_id
2016-04-09Merge tag 'scsi-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is a set of eight fixes. Two are trivial gcc-6 updates (brace additions and unused variable removal). There's a couple of cxlflash regressions, a correction for sd being overly chatty on revalidation (causing excess log increases). A VPD issue which could crash USB devices because they seem very intolerant to VPD inquiries, an ALUA deadlock fix and a mpt3sas buffer overrun fix" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: Do not attach VPD to devices that don't support it sd: Fix excessive capacity printing on devices with blocks bigger than 512 bytes scsi_dh_alua: Fix a recently introduced deadlock scsi: Declare local symbols static cxlflash: Move to exponential back-off when cmd_room is not available cxlflash: Fix regression issue with re-ordering patch mpt3sas: Don't overreach ioc->reply_post[] during initialization aacraid: add missing curly braces
2016-04-09Merge tag 'md/4.6-rc2-fix' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/shli/md Pull MD fixes from Shaohua Li: "This update mainly fixes bugs: - fix error handling (Guoqing) - fix a crash when a disk is hotremoved (me) - fix a dead loop (Wei Fang)" * tag 'md/4.6-rc2-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md: md/bitmap: clear bitmap if bitmap_create failed MD: add rdev reference for super write md: fix a trivial typo in comments md:raid1: fix a dead loop when read from a WriteMostly disk