summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2015-11-18Merge tag 'iio-fixes-for-4.4a' of ↵Greg Kroah-Hartman
ssh://ra.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: First set of IIO fixes for the 4.4 cycle. This set does not include those for issues introduced during the merge window. Fixes of those will follow in a future series. * ad5064 - Make sure the local i2c_write returns 0 on success rather than the number of bytes transfered. Otherwise we report an error on all writes. - Fix a shift for ad5629 and ad5669 which gives incorrect DAC output on these parts. * ad7793 - The product ID on the datasheet is wrong. Fix it in the driver. * IIO_DUMMY_EVGEN - select IRQ_WORK as a dependency. * lpc32xx - make sure clock is prepared before enabling. * si7020 - data byte order was reversed. Fix it. * vf610 - Internal temperature calculation was wrong if a different reference voltage was used. Now use a linear interpolation function to make it work over the full range. - Fix a division by zero in the case of a device tree property not being present (same issue two fixes). * xilinx XADC - VREFN scale was wrong - fix it.
2015-11-18usb: gadget: functionfs: fix missing access_ok checksDaniel Walter
use safe copy_*_user instead of unsafe __copy_*_user functions when accessing userland memory. Signed-off-by: Daniel Walter <dwalter@sigma-star.at> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-11-18usb: musb: USB_TI_CPPI41_DMA requires dmaengine supportArnd Bergmann
The CPPI-4.1 driver selects TI_CPPI41, which is a dmaengine driver and that may not be available when CONFIG_DMADEVICES is not set: warning: (USB_TI_CPPI41_DMA) selects TI_CPPI41 which has unmet direct dependencies (DMADEVICES && ARCH_OMAP) This adds an extra dependency to avoid generating warnings in randconfig builds. Ideally we'd remove the 'select' statement, but that has the potential to break defconfig files. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Fixes: 411dd19c682d ("usb: musb: Kconfig: Select the DMA driver if DMA mode of MUSB is enabled") Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-11-18net: macb: Add support for sgmii phy interfacePunnaiah Choudary Kalluri
This patch adds support for the sgmii phy interface. Signed-off-by: Punnaiah Choudary Kalluri <punnaia@xilinx.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-18ethernet/atheros/alx: add Killer E2400 device IDBen Pope
This patch adds the PCI device ID (0xe0a1) and alx_pci_tbl entry for the Killer E2400 Ethernet controller, modeled after the Killer E2200 controller support (0xe091) already present in the alx driver. This patch was originally authored by Ben Pope, but it got held up by issues in the commit message, so I'm resubmitting it on his behalf. I've extensively used a kernel with this patch on a System76 serw9 laptop and am quite confident it works well (at least on the hardware I have available for testing). Note that as a favor to System76, Ubuntu has been carrying this as a sauce patch in their 4.2 based Wily kernel, which presumably has given it real-world testing on other E2400 equipped hardware (I don't know of any Ubuntu kernel bugs filed about it): https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1498633 Signed-off-by: Jason Gerard DeRose <jason@system76.com> Signed-off-by: Ben Pope <benpope81@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-18hdlc: fix null-deref on allocation failurestephen hemminger
If alloc_netdev() failed and return NULL, then the next instruction would dereference it. Found by Coverity. Compile tested only. Not sure if anyone still uses this driver (or the whole WAN subsystem). Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-18fm10k: fix memory leakstephen hemminger
This was detected by Coverity. The function skb_cow_head leaves skb alone on failure, so caller needs to free. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-18xhci: Fix a race in usb2 LPM resume, blocking U3 for usb2 devicesMathias Nyman
Clear device initiated resume variables once device is fully up and running in U0 state. Resume needs to be signaled for 20ms for usb2 devices before they can be moved to U0 state. An interrupt is triggered if a device initiates resume. As we handle the event in interrupt context we can not sleep for 20ms, so we instead set a resume flag, a timestamp, and start the roothub polling. The roothub code will later move the port to U0 when it finds a port in resume state with the resume flag set, and timestamp passed by 20ms. A host initiated resume is however not done in interrupt context, and host initiated resume code will directly signal resume, wait 20ms and then move the port to U0. These two codepaths can race, if we are in the middle of a host initated resume, while sleeping for 20ms, we may handle a port event and find the port in resume state. The port event handling code will assume the resume was device initiated and set the resume flag and timestamp. Root hub code will however not catch the port in resume state again as the host initated resume code has already moved the port to U0. The resume flag and timestamp will remain set for this port preventing port from suspending again (LPM setting port to U3) Fix this for now by always clearing the device initated resume parameters once port is in U0 Cc: stable <stable@vger.kernel.org> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-11-18usb: xhci: fix checking ep busy for CFCLu Baolu
Function ep_ring_is_processing() checks the dequeue pointer in endpoint context to know whether an endpoint is busy with processing TRBs. This is not correct since dequeue pointer field in an endpoint context is only valid when the endpoint is in Halted or Stopped states. This buggy code causes audio noise when playing sound with USB headset connected to host controllers which support CFC (one of xhci 1.1 features). This patch should exist in stable kernel since v4.3. Reported-and-tested-by: YD Tseng <yd_tseng@asmedia.com.tw> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Cc: stable <stable@vger.kernel.org> # v4.3 Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-11-18xhci: Workaround to get Intel xHCI reset working more reliablyRajmohan Mani
Existing Intel xHCI controllers require a delay of 1 mS, after setting the CMD_RESET bit in command register, before accessing any HC registers. This allows the HC to complete the reset operation and be ready for HC register access. Without this delay, the subsequent HC register access, may result in a system hang, very rarely. Verified CherryView / Braswell platforms go through over 5000 warm reboot cycles (which was not possible without this patch), without any xHCI reset hang. Signed-off-by: Rajmohan Mani <rajmohan.mani@intel.com> Tested-by: Joe Lawrence <joe.lawrence@stratus.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-11-18Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: "Assorted bug fixes, the mlock2 system call gets added, and one improvement. The boot from dasd devices is now possible from a wider range of devices" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: remove SALIPL loader s390: wire up mlock2 system call s390: remove g5 elf platform support s390: avoid cache aliasing under z/VM and KVM s390/sclp: _sclp_wait_int(): retain full PSW mask s390/zcrypt: Fix initialisation when zcrypt is built-in s390/zcrypt: Fix kernel crash on systems without AP bus support s390: add support for ipl devices in subchannel sets > 0 s390/ipl: fix out of bounds access in scpdata_write s390/pci_dma: improve debugging of errors during dma map s390/pci_dma: handle dma table failures s390/pci_dma: unify label of invalid translation table entries s390/syscalls: remove system call number calculation s390/cio: simplify css_generate_pgid s390/diag: add a s390 prefix to the diagnose trace point s390/head: fix error message on unsupported hardware
2015-11-18Merge tag 'hwmon-for-linus-v4.4-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Fix build issues in scpi and ina2xx drivers, update scpi driver to support recent firmware, and fix an uninitialized variable warning in applesmc driver" * tag 'hwmon-for-linus-v4.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (scpi) skip unsupported sensors properly hwmon: (scpi) add thermal-of dependency hwmon : (applesmc) Fix uninitialized variables warnings hwmon: (ina2xx) Fix build issue by selecting REGMAP_I2C
2015-11-18drm/amdgpu: reserve/unreserve objects out of map/unmap operationsChunming Zhou
Change-Id: Id6514f2fb6e002437fdbe99353d5d35f4ac736c7 Signed-off-by: Chunming Zhou <David1.Zhou@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com>
2015-11-18drm/amdgpu: move bo_reserve out of amdgpu_vm_clear_boChunming Zhou
Change-Id: Ifbb0c06680494bfa04d0be5e5941d31ae2e5ef28 Signed-off-by: Chunming Zhou <David1.Zhou@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com>
2015-11-18drm/amdgpu: add lock for interval tree in vmChunming Zhou
Change-Id: I62b892a22af37b32e6b4aefca80a25cf45426ed2 Signed-off-by: Chunming Zhou <David1.Zhou@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com>
2015-11-18drm/amdgpu: keep the owner for VMIDsChristian König
We don't need the last VM use any more, keep the owner directly. Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Chunming Zhou <davdi1.zhou@amd.com>
2015-11-18drm/amdgpu: move VM manager clean into the VM code againChristian König
It's not a good idea to duplicate that code. Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Chunming Zhou <davdi1.zhou@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
2015-11-18drm/amdgpu: cleanup VM coding styleChristian König
Fix the indentation and move the VM functions to the structures. Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Chunming Zhou <davdi1.zhou@amd.com> Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
2015-11-18drm/amdgpu: remove unused VM manager fieldChristian König
Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Chunming Zhou <davdi1.zhou@amd.com> Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
2015-11-18drm/amdgpu: cleanup scheduler command submissionChristian König
Unify the two code path again, cause they do pretty much the same thing. Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Chunming Zhou <davdi1.zhou@amd.com> Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
2015-11-18advansys: fix big-endian buildsArnd Bergmann
Building the advansys driver in a big-endian configuration such as ARM allmodconfig shows a warning: drivers/scsi/advansys.c: In function 'adv_build_req': include/uapi/linux/byteorder/big_endian.h:32:26: warning: large integer implicitly truncated to unsigned type [-Woverflow] #define __cpu_to_le32(x) ((__force __le32)__swab32((x))) drivers/scsi/advansys.c:7806:22: note: in expansion of macro 'cpu_to_le32' scsiqp->sense_len = cpu_to_le32(SCSI_SENSE_BUFFERSIZE); It turns out that the commit that introduced this used the cpu_to_le32() incorrectly on an 8-bit field, which results in the sense_len to always be set to zero, as the SCSI_SENSE_BUFFERSIZE value gets moved to upper byte of the 32-bit intermediate. This removes the cpu_to_le32() call to restore the original version. I found this only by looking at the compiler output and have not done a full review for possible further endianess bugs in the same driver. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Fixes: 811ddc057aac ("advansys: use DMA-API for mapping sense buffer") Reviewed-by: Hannes Reinecke <hare@suse.de> Cc: stable@vger.kernel.org # v4.2+ Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2015-11-18drm/amdgpu: fix typo in firmware nameChristian König
Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Chunming Zhou <david1.zhou@amd.com>
2015-11-18pinctrl: mediatek: Add get_direction support.Hongzhou Yang
Since Linux gpio framework return 0 for output, 1 for input. But HW use 0 stands for input, and 1 stands for output. So use negative to correct it. And gpio_chip.get is used to get input value, no need to get output value, so removing it. Signed-off-by: Hongzhou Yang <hongzhou.yang@mediatek.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-11-18drm/i915: Consider SPLL as another shared pll, v2.Maarten Lankhorst
When diagnosing a unrelated bug for someone on irc, it would seem the hardware can be brought up by the BIOS with the embedded displayport using the SPLL for spread spectrum. Right now this is not handled well in i915, and it calculates the crtc needs to be reprogrammed on the first modeset without SSC, but the SPLL itself was kept active. Fix this by exposing SPLL as a shared pll that will not be returned by intel_get_shared_dpll; you have to know it exists to use it. Changes since v1: - Create a separate dpll_hw_state.spll for spll, and use separate pll functions for spll. Tested-by: Emil Renner Berthing <kernel@esmil.dk> Tested-by: Gabriel Feceoru <gabriel.feceoru@intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: http://patchwork.freedesktop.org/patch/msgid/1447681332-6318-1-git-send-email-maarten.lankhorst@linux.intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2015-11-18drm/i915: Fix gpu frequency change tracingMika Kuoppala
With gen < 9 we have had always 50Mhz units as our hw ratio. With gen >= 9 the hw ratio changed to 16.667Mhz (50/3). The result was that our gpu frequency tracing started to output values 3 times larger than expected due to hardcoded scaling value. Fix this by using Use intel_gpu_freq() when generating Mhz value from ratio for 'intel_gpu_freq_change' trace event. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92591 Cc: stable@vger.kernel.org # v4.3+ Reported-by: Eero Tamminen <eero.t.tamminen@intel.com> Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Link: http://patchwork.freedesktop.org/patch/msgid/1447776866-29384-1-git-send-email-mika.kuoppala@intel.com
2015-11-18usb: chipidea: imx: fix a possible NULL dereferenceLABBE Corentin
of_match_device could return NULL, and so cause a NULL pointer dereference later. Reported-by: coverity (CID 1324138) Signed-off-by: LABBE Corentin <clabbe.montjoie@gmail.com> Signed-off-by: Peter Chen <peter.chen@freescale.com>
2015-11-18usb: chipidea: usbmisc_imx: fix a possible NULL dereferenceLABBE Corentin
of_match_device could return NULL, and so cause a NULL pointer dereference later. Renaming tmp_dev to of_id (like all others do) in the process. Reported-by: coverity (CID 1324135) Signed-off-by: LABBE Corentin <clabbe.montjoie@gmail.com> Signed-off-by: Peter Chen <peter.chen@freescale.com>
2015-11-18usb: chipidea: otg: gadget module load and unload supportLi Jun
This patch is to support load and unload gadget driver in full OTG mode. Signed-off-by: Li Jun <jun.li@freescale.com> Signed-off-by: Peter Chen <peter.chen@freescale.com> Tested-by: Jiada Wang <jiada_wang@mentor.com> Cc: <stable@vger.kernel.org> #v4.0+
2015-11-18usb: chipidea: debug: disable usb irq while role switchLi Jun
Since the ci->role will be set after the host role start is complete, there will be nobody cared irq during start host if usb irq enabled. This error can be reproduced on i.mx6 sololite EVK board by: 1. disable otg id irq(IDIE) and disable all real otg properties of usbotg1 in dts. 2. boot up the board with ID cable and usb device connected. 3. echo gadget > /sys/kernel/debug/ci_hdrc.0/role 4. echo host > /sys/kernel/debug/ci_hdrc.0/role 5. irq 212: nobody cared. Cc: <stable@vger.kernel.org> # v3.10+ Signed-off-by: Li Jun <jun.li@freescale.com> Signed-off-by: Peter Chen <peter.chen@freescale.com>
2015-11-18usb: chipidea: imx: refine clock operations to adapt for all platformsPeter Chen
Some i.mx platforms need three clocks to let controller work, but others only need one, refine clock operation to adapt for all platforms, it fixes a regression found at i.mx27. Signed-off-by: Peter Chen <peter.chen@freescale.com> Tested-by: Fabio Estevam <fabio.estevam@freescale.com> Cc: <stable@vger.kernel.org> #v4.1+
2015-11-17qla2xxx: Fix rwlock recursionBart Van Assche
This patch fixes the following kernel bug: kernel:BUG: rwlock recursion on CPU#2, insmod/39333, ffff8803e998cb28 kernel: Call Trace: kernel: [<ffffffff812bce44>] dump_stack+0x48/0x64 kernel: [<ffffffff810a8047>] rwlock_bug+0x67/0x70 kernel: [<ffffffff810a833a>] do_raw_write_lock+0x8a/0xa0 kernel: [<ffffffff815f3033>] _raw_write_lock_irqsave+0x63/0x80 kernel: [<ffffffffa08087c8>] qla82xx_rd_32+0xe8/0x140 [qla2xxx] kernel: [<ffffffffa0808845>] qla82xx_crb_win_lock+0x25/0x60 [qla2xxx] kernel: [<ffffffffa0808976>] qla82xx_wr_32+0xf6/0x150 [qla2xxx] kernel: [<ffffffffa0808ac0>] qla82xx_disable_intrs+0x50/0x80 [qla2xxx] kernel: [<ffffffffa080630a>] qla82xx_reset_chip+0x1a/0x20 [qla2xxx] kernel: [<ffffffffa07d6ef2>] qla2x00_initialize_adapter+0x132/0x420 [qla2xxx] kernel: [<ffffffffa08087c8>] qla82xx_rd_32+0xe8/0x140 [qla2xxx] kernel: [<ffffffffa0808845>] qla82xx_crb_win_lock+0x25/0x60 [qla2xxx] kernel: [<ffffffffa0808976>] qla82xx_wr_32+0xf6/0x150 [qla2xxx] kernel: [<ffffffffa0808ac0>] qla82xx_disable_intrs+0x50/0x80 [qla2xxx] kernel: [<ffffffffa080630a>] qla82xx_reset_chip+0x1a/0x20 [qla2xxx] kernel: [<ffffffffa07d6ef2>] qla2x00_initialize_adapter+0x132/0x420 [qla2xxx] kernel: [<ffffffffa07c964e>] qla2x00_probe_one+0xefe/0x2130 [qla2xxx] kernel: [<ffffffff8130052c>] local_pci_probe+0x4c/0xa0 kernel: [<ffffffff81300603>] pci_call_probe+0x83/0xa0 kernel: [<ffffffff813008cf>] pci_device_probe+0x7f/0xb0 kernel: [<ffffffff813e2e83>] really_probe+0x133/0x390 kernel: [<ffffffff813e3139>] driver_probe_device+0x59/0xd0 kernel: [<ffffffff813e3251>] __driver_attach+0xa1/0xb0 kernel: [<ffffffff813e0cdd>] bus_for_each_dev+0x8d/0xb0 kernel: [<ffffffff813e28ee>] driver_attach+0x1e/0x20 kernel: [<ffffffff813e2252>] bus_add_driver+0x1d2/0x290 kernel: [<ffffffff813e3970>] driver_register+0x60/0xe0 kernel: [<ffffffff813009e4>] __pci_register_driver+0x64/0x70 kernel: [<ffffffffa04bc1cb>] qla2x00_module_init+0x1cb/0x21b [qla2xxx] kernel: [<ffffffff8100027d>] do_one_initcall+0xad/0x1c0 kernel: [<ffffffff810e2859>] do_init_module+0x69/0x210 kernel: [<ffffffff810e4e5c>] load_module+0x5cc/0x750 kernel: [<ffffffff810e5162>] SyS_init_module+0x92/0xc0 kernel: [<ffffffff815f37d7>] entry_SYSCALL_64_fastpath+0x12/0x6f Fixes: 8dfa4b5a9b44 ("qla2xxx: Fix sparse annotation") Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Reported-by: Himanshu Madhani <himanshu.madhani@qlogic.com> Tested-by: Himanshu Madhani <himanshu.madhani@qlogic.com> Reviewed-by: Himanshu Madhani <himanshu.madhani@qlogic.com> Reviewed-by: Chad Dupuis <chad.dupuis@qlogic.com> Cc: Giridhar Malavali <giridhar.malavali@qlogic.com> Cc: Xose Vazquez Perez <xose.vazquez@gmail.com> Cc: stable <stable@vger.kernel.org> # v4.3+ Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2015-11-17Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds
Pull networking fixes from David Miller: 1) Fix list tests in netfilter ingress support, from Florian Westphal. 2) Fix reversal of input and output interfaces in ingress hook invocation, from Pablo Neira Ayuso. 3) We have a use after free in r8169, caught by Dave Jones, fixed by Francois Romieu. 4) Splice use-after-free fix in AF_UNIX frmo Hannes Frederic Sowa. 5) Three ipv6 route handling bug fixes from Martin KaFai Lau: a) Don't create clone routes not managed by the fib6 tree b) Don't forget to check expiration of DST_NOCACHE routes. c) Handle rt->dst.from == NULL properly. 6) Several AF_PACKET fixes wrt transport header setting and SKB protocol setting, from Daniel Borkmann. 7) Fix thunder driver crash on shutdown, from Pavel Fedin. 8) Several Mellanox driver fixes (max MTU calculations, use of correct DMA unmap in TX path, etc.) from Saeed Mahameed, Tariq Toukan, Doron Tsur, Achiad Shochat, Eran Ben Elisha, and Noa Osherovich. 9) Several mv88e6060 DSA driver fixes (wrong bit definitions for certain registers, etc.) from Neil Armstrong. 10) Make sure to disable preemption while updating per-cpu stats of ip tunnels, from Jason A. Donenfeld. 11) Various ARM64 bpf JIT fixes, from Yang Shi. 12) Flush icache properly in ARM JITs, from Daniel Borkmann. 13) Fix masking of RX and TX interrupts in ravb driver, from Masaru Nagai. 14) Fix netdev feature propagation for devices not implementing ->ndo_set_features(). From Nikolay Aleksandrov. 15) Big endian fix in vmxnet3 driver, from Shrikrishna Khare. 16) RAW socket code increments incorrect SNMP counters, fix from Ben Cartwright-Cox. 17) IPv6 multicast SNMP counters are bumped twice, fix from Neil Horman. 18) Fix handling of VLAN headers on stacked devices when REORDER is disabled. From Vlad Yasevich. 19) Fix SKB leaks and use-after-free in ipvlan and macvlan drivers, from Sabrina Dubroca. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (83 commits) MAINTAINERS: Update Mellanox's Eth NIC driver entries net/core: revert "net: fix __netdev_update_features return.." and add comment af_unix: take receive queue lock while appending new skb rtnetlink: fix frame size warning in rtnl_fill_ifinfo net: use skb_clone to avoid alloc_pages failure. packet: Use PAGE_ALIGNED macro packet: Don't check frames_per_block against negative values net: phy: Use interrupts when available in NOLINK state phy: marvell: Add support for 88E1540 PHY arm64: bpf: make BPF prologue and epilogue align with ARM64 AAPCS macvlan: fix leak in macvlan_handle_frame ipvlan: fix use after free of skb ipvlan: fix leak in ipvlan_rcv_frame vlan: Do not put vlan headers back on bridge and macvlan ports vlan: Fix untag operations of stacked vlans with REORDER_HEADER off via-velocity: unconditionally drop frames with bad l2 length ipg: Remove ipg driver dl2k: Add support for IP1000A-based cards snmp: Remove duplicate OUTMCAST stat increment net: thunder: Check for driver data in nicvf_remove() ...
2015-11-17drm/vc4: Make sure that planes aren't scaled.Eric Anholt
We would scan out the memory around them if an upscale was attempted, and would just scan out incorrectly for downscaling. Signed-off-by: Eric Anholt <eric@anholt.net>
2015-11-17drm/vc4: Fix some failure to track __iomem decorations on pointers.Eric Anholt
Caught by the kbuild test robot. v2: Fix the +i I dropped in the first version. Signed-off-by: Eric Anholt <eric@anholt.net>
2015-11-17drm/vc4: checking for NULL instead of IS_ERRDan Carpenter
vc4_plane_init() returns an ERR_PTR on error, it doesn't return NULL. This was obviously intended because the next lines call PTR_ERR(primary_plane) already. Fixes: c8b75bca92cb ('Eric Anholt <eric@anholt.net>') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Eric Anholt <eric@anholt.net>
2015-11-17drm/vc4: fix itnull.cocci warningsJulia Lawall
Connector cannot be null because it is a list entry, ie accessed at an offset from the positions of the list structure pointers themselves. Generated by: scripts/coccinelle/iterators/itnull.cocci Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Eric Anholt <eric@anholt.net>
2015-11-17drm/vc4: fix platform_no_drv_owner.cocci warningsJulia Lawall
drivers/gpu/drm/vc4/vc4_drv.c:248:3-8: No need to set .owner here. The core will do it. Remove .owner field if calls are used which set it automatically Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Eric Anholt <eric@anholt.net>
2015-11-17drm/vc4: vc4_plane_duplicate_state() can be statickbuild test robot
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Eric Anholt <eric@anholt.net>
2015-11-17net: phy: Use interrupts when available in NOLINK stateAndrew Lunn
The NOLINK state will poll the phy once a second to see if the link has come up. If the phy has an interrupt line, this polling can be skipped, since the phy should interrupt when the link returns. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-17phy: marvell: Add support for 88E1540 PHYAndrew Lunn
The 88E1540 can be found embedded in the Marvell 88E6352 switch. It is compatible with the 88E1510, so add support for it, using the 88E1510 specific functions. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-17macvlan: fix leak in macvlan_handle_frameSabrina Dubroca
Reset pskb in macvlan_handle_frame in case skb_share_check returned a clone. Fixes: 8a4eb5734e8d ("net: introduce rx_handler results and logic around that") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-17ipvlan: fix use after free of skbSabrina Dubroca
ipvlan_handle_frame is a rx_handler, and when it returns a value other than RX_HANDLER_CONSUMED (here, NET_RX_DROP aka RX_HANDLER_ANOTHER), __netif_receive_skb_core expects that the skb still exists and will process it further, but we just freed it. Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-17ipvlan: fix leak in ipvlan_rcv_frameSabrina Dubroca
Pass a **skb to ipvlan_rcv_frame so that if skb_share_check returns a new skb, we actually use it during further processing. It's safe to ignore the new skb in the ipvlan_xmit_* functions, because they call ipvlan_rcv_frame with local == true, so that dev_forward_skb is called and always takes ownership of the skb. Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-17via-velocity: unconditionally drop frames with bad l2 lengthTimo Teräs
By default the driver allowed incorrect frames to be received. What is worse the code does not handle very short frames correctly. The FCS length is unconditionally subtracted, and the underflow can cause skb_put to be called with large number after implicit cast to unsigned. And indeed, an skb_over_panic() was observed with via-velocity. This removes the module parameter as it does not work in it's current state, and should be implemented via NETIF_F_RXALL if needed. Suggested-by: Francois Romieu <romieu@fr.zoreil.com> Signed-off-by: Timo Teräs <timo.teras@iki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-17dm mpath: fix infinite recursion in ioctl when no paths and !queue_if_no_pathJunichi Nomura
In multipath_prepare_ioctl(), - pgpath is a path selected from available paths - m->queue_io is true if we cannot send a request immediately to paths, either because: * there is no available path * the path group needs activation (pg_init) - pg_init is not started - pg_init is still running - m->queue_if_no_path is true if the device is configured to queue I/O if there are no available paths If !pgpath && !m->queue_if_no_path, the handler should return -EIO. However in the course of refactoring the condition check has broken and returns success in that case. Since bdev points to the dm device itself, dm_blk_ioctl() calls __blk_dev_driver_ioctl() for itself and recurses until crash. You could reproduce the problem like this: # dmsetup create mp --table '0 1024 multipath 0 0 0 0' # sg_inq /dev/mapper/mp <crash> [ 172.648615] BUG: unable to handle kernel paging request at fffffffc81b10268 [ 172.662843] PGD 19dd067 PUD 0 [ 172.666269] Thread overran stack, or stack corrupted [ 172.671808] Oops: 0000 [#1] SMP ... Fix the condition check with some clarifications. Fixes: e56f81e0b01e ("dm: refactor ioctl handling") Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-11-17dm: do not reuse dm_blk_ioctl block_device input as local variableMike Snitzer
(Ab)using the @bdev passed to dm_blk_ioctl() opens the potential for targets' .prepare_ioctl to fail if they go on to check the bdev for !NULL. Fixes: e56f81e0b01e ("dm: refactor ioctl handling") Reported-by: Junichi Nomura <j-nomura@ce.jp.nec.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-11-17dm: fix ioctl retry termination with signalJunichi Nomura
dm-mpath retries ioctl, when no path is readily available and the device is configured to queue I/O in such a case. If you want to stop the retry before multipathd decides to turn off queueing mode, you could send signal for the process to exit from the loop. However the check of fatal signal has not carried along when commit 6c182cd88d17 ("dm mpath: fix ioctl deadlock when no paths") moved the loop from dm-mpath to dm core. As a result, we can't terminate such a process in the retry loop. Easy reproducer of the situation is: # dmsetup create mp --table '0 1024 multipath 0 0 0 0' # dmsetup message mp 0 'queue_if_no_path' # sg_inq /dev/mapper/mp then you should be able to terminate sg_inq by pressing Ctrl+C. Fixes: 6c182cd88d17 ("dm mpath: fix ioctl deadlock when no paths") Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com> Cc: Hannes Reinecke <hare@suse.de> Cc: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Cc: stable@vger.kernel.org
2015-11-17Input: parkbd - clear unused function pointersSudip Mukherjee
parkbd_parport_cb is a local uninitialized structure and the member function pointers will be pointing to arbitrary locations unless they are cleared. Fixes: 33ca8ab97cbb ("Input: parkbd - use parallel port device model") Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2015-11-17Input: walkera0701 - clear unused function pointersSudip Mukherjee
walkera0701_parport_cb is a local uninitialized structure and the member function pointers will be pointing to arbitrary locations unless they are cleared. Fixes: 221bcb24c653 ("Input: walkera0701 - use parallel port device model") Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2015-11-17Input: turbografx - clear unused function pointersSudip Mukherjee
tgfx_parport_cb is a local uninitialized structure and the member function pointers will be pointing to arbitrary locations unless they are cleared. Fixes: 4de27a638a99 ("Input: turbografx - use parallel port device model") Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>