Commit Graph

388770 Commits

Author SHA1 Message Date
Avinash Patil 953b3539ef mwifiex: check for bss_role instead of bss_mode for STA operations
This patch fixes an issue wherein association would fail on P2P
interfaces. This happened because we are checking priv->mode
against NL80211_IFTYPE_STATION. While this check is correct for
infrastructure stations, it would fail P2P clients for which mode
is NL80211_IFTYPE_P2P_CLIENT.

Better check would be bss_role which has only 2 values: STA/AP.

Cc: <stable@vger.kernel.org> # 3.10.y
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Stone Piao <piaoyun@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-07-31 15:06:45 -04:00
Linus Torvalds 75eaff0105 Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus
Pull MIPS fixes from Ralf Baechle:
 - BMIPS SMP fixes
 - a build fix necessary for older compilers
 - two more bugs found my Chandras' testing
 - and one more build fix

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
  MIPS: BMIPS: fix slave CPU booting when physical CPU is not 0
  MIPS: BMIPS: do not change interrupt routing depending on boot CPU
  MIPS: powertv: Fix arguments for free_reserved_area()
  MIPS: Set default CPU type for BCM47XX platforms
  MIPS: uapi/asm/siginfo.h: Fix GCC 4.1.2 compilation
  MIPS: Fix multiple definitions of UNCAC_BASE.
2013-07-31 11:38:38 -07:00
Linus Torvalds f66d95d69d Fixes:
- Three fixes for ARM/ARM64 to either compile or not certain generic drivers
  - Fix for avoiding a potential deadlock when an user space event channel is destroyed.
  - Fix a workqueue resuming multiple times.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.13 (GNU/Linux)
 
 iQEcBAABAgAGBQJR9/upAAoJEFjIrFwIi8fJueIH/0/cw1AP/wcUfD8QMmF8ySw2
 s8BKUAZo6his9fepLw7mWN1r3SDR+TBBq3Oi/M96O3OZNEbLPxQBAIc/rTXJTxKH
 Jw82IIWSNn50eUX3oldwbNZW+V0rzIupsRwESLOc48wbVnwyw74vU4/8lljH7Xyp
 u8sSGw+2Q7mx9Pa85fA+HHMJA1LO1QemoSQqFVCbTFdv1MHJgFxb1eeDNQ/8X0by
 wAOMDkyboWYK84kRxJTh+bj+Ie4Z+kC+NlDS/gvch9cdxHrVENZyND3grNwUXkMr
 3S1zF6f0529IwkKjYDNCHtrAdRy6+o1KNvKnbp9/iylSnBRPquukMU1AmuvlrNM=
 =lwZR
 -----END PGP SIGNATURE-----

Merge tag 'stable/for-linus-3.11-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull Xen fixes from Konrad Rzeszutek Wilk:
 - Three fixes for ARM/ARM64 to either compile or not certain generic
   drivers
 - Fix for avoiding a potential deadlock when an user space event
   channel is destroyed.
 - Fix a workqueue resuming multiple times.

* tag 'stable/for-linus-3.11-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/tmem: do not allow XEN_TMEM on ARM64
  xen/evtchn: avoid a deadlock when unbinding an event channel
  xen/arm: enable PV control for ARM
  xen/arm64: Don't compile cpu hotplug
  xenbus: frontend resume cleanup
2013-07-31 11:37:43 -07:00
Linus Torvalds 878d2cd673 Xen ARM fix for 3.11
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.10 (GNU/Linux)
 
 iQIcBAABAgAGBQJR9j2HAAoJEIlPj0hw4a6QVakP/0/fq5/7x0tbj9MFm3UDHsg+
 7Et6QwLXgJd/hYQKmEIUYV1VJLmQsNXWiGJmTjqoNupTrQjqPJ3rZntZM/lBAHoW
 KNVOuQW/wHm+sQuXtbxcujJUxOX2mwYr+5vHsNvpPgKxVKClAAUOtsFdU1Lp7uXV
 PHCyondq4noggvDQTmjlnSZPYQt/JHLC+fdFqvcW4JSmmDvODYaeIFoXOVlVlJ5n
 SH5i4buLs4Q3YJoKS3mEsUsMoIOPZ40M79MZWrOzKB7ZyPi7RxQejYuZO3j+UeB7
 kHwoherWKTaX9UKXtHFnuBIDRVQ4Hmze4aUFWHE7Y8ELS++0NbOGMQfkXnR2uGqw
 9kDFBkoexTHnwT7hKebYNZt64iK3Ytb6knp10umrCr/dnqkIyt0r8xT3qam5seFb
 prYnaHIh7TpVN6lk+1ew1E8Cze9Qik+jO8wOsH3W4ez2OGrwIMTShHXCTNo7Aokr
 EXOC8TBviAzIHSFWjF/nBGNE7KxwAWjw6I6u40/M/4NecvwJ3ntCxwrKsywB3FDR
 WS+VK5WbseQ9z96jqoTooWGf3OXjWLFb+L8PqikLZoyF2hIxaZaYjIzRtcXJsije
 0XB7PQIUMnZwWGOVORwormk7fiJJi1619doMX49OUIzJbS9eYUdIq1YQkUjHKqvV
 LLZITB90VOEAF9FKEWDq
 =WzdH
 -----END PGP SIGNATURE-----

Merge tag 'xen-arm-3.11-rc2-warn-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/sstabellini/xen

Pull Xen ARM fix from Stefano Stabellini.

Update xen_restart to new calling convention.

* tag 'xen-arm-3.11-rc2-warn-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/sstabellini/xen:
  xen/arm,arm64: update xen_restart after ff701306cd and 7b6d864b48
2013-07-31 11:34:56 -07:00
Linus Torvalds 3132be9aef USB fixes for 3.11-rc4
Here are some tiny USB fixes for 3.11-rc4
 
 Nothing major, some gadget fixes, some new device ids, a new tiny driver
 for the ANT+ USB device, and a number of fixes for the mos7840 driver
 that were much needed.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.19 (GNU/Linux)
 
 iEYEABECAAYFAlH4EDUACgkQMUfUDdst+ynOJQCeLaSvPjYMIERxRNObzQ6Ggg6Z
 vaoAn0tG1jItvDuBFll5efIDwBxITRBc
 =XlRP
 -----END PGP SIGNATURE-----

Merge tag 'usb-3.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some tiny USB fixes for 3.11-rc4

  Nothing major, some gadget fixes, some new device ids, a new tiny
  driver for the ANT+ USB device, and a number of fixes for the mos7840
  driver that were much needed"

* tag 'usb-3.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: serial: ftdi_sio: add more RT Systems ftdi devices
  usb: chipidea: fix the build error with randconfig
  usb: chipidea: cast PORTSC_PTS and DEVLC_PTS macros
  usb: gadget: udc-core: fix the typo of udc state attribute
  usb: gadget: f_phonet: remove unused preprocessor conditional
  usb: gadget: multi: fix error return code in cdc_do_config()
  USB: mos7840: fix pointer casts
  USB: mos7840: fix race in led handling
  USB: mos7840: fix device-type detection
  USB: mos7840: fix race in register handling
  USB: serial: add driver for Suunto ANT+ USB device
  usb: gadget: free opts struct on error recovery
  usb: gadget: ether: put_usb_function on unbind
  usb: musb: fix resource passed from glue layer to musb
2013-07-31 11:31:36 -07:00
Linus Torvalds a93f66dc5f TTY/Serial driver fixes for 3.11-rc4
Here are 4 tiny tty and serial driver fixes for 3.11-rc4.
 
 Nothing big, a refcount leak, a module alias fix, and two fixes to the
 mxs-auart serial driver.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.19 (GNU/Linux)
 
 iEYEABECAAYFAlH4ELoACgkQMUfUDdst+yktaACg1NxfFkjuz7A8uG7sST5pGJPb
 +K8AoKmTPl0hGXOWEdgXdCnCmL+B223g
 =u0GE
 -----END PGP SIGNATURE-----

Merge tag 'tty-3.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial driver fixes from Greg KH:
 "Here are 4 tiny tty and serial driver fixes for 3.11-rc4.

  Nothing big, a refcount leak, a module alias fix, and two fixes to the
  mxs-auart serial driver"

* tag 'tty-3.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: arc_uart: Fix module alias
  tty_port: Fix refcounting leak in tty_port_tty_hangup()
  serial/mxs-auart: increase time to wait for transmitter to become idle
  serial/mxs-auart: fix race condition in interrupt handler
2013-07-31 11:31:06 -07:00
Yonghua Zheng 8e552e5359 HID: hidraw: fix improper mutex release
Mutex can not be released unless all hid_device members are properly
initialized. Otherwise it would result in a race condition that can
cause NULL pointer kernel panic issue in hidraw_open where it uses
uninitialized 'list' member in list_add_tail().

Signed-off-by: Yonghua Zheng <younghua.zheng@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-07-31 19:48:55 +02:00
Steven Rostedt (Red Hat) 2ba64035d0 tracing: Add comment to describe special break case in probe_remove_event_call()
The "break" used in the do_for_each_event_file() is used as an optimization
as the loop is really a double loop. The loop searches all event files
for each trace_array. There's only one matching event file per trace_array
and after we find the event file for the trace_array, the break is used
to jump to the next trace_array and start the search there.

As this is not a standard way of using "break" in C code, it requires
a comment right before the break to let people know what is going on.

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-31 13:16:22 -04:00
Oleg Nesterov 2816c551c7 tracing: trace_remove_event_call() should fail if call/file is in use
Change trace_remove_event_call(call) to return the error if this
call is active. This is what the callers assume but can't verify
outside of the tracing locks. Both trace_kprobe.c/trace_uprobe.c
need the additional changes, unregister_trace_probe() should abort
if trace_remove_event_call() fails.

The caller is going to free this call/file so we must ensure that
nobody can use them after trace_remove_event_call() succeeds.
debugfs should be fine after the previous changes and event_remove()
does TRACE_REG_UNREGISTER, but still there are 2 reasons why we need
the additional checks:

- There could be a perf_event(s) attached to this tp_event, so the
  patch checks ->perf_refcount.

- TRACE_REG_UNREGISTER can be suppressed by FTRACE_EVENT_FL_SOFT_MODE,
  so we simply check FTRACE_EVENT_FL_ENABLED protected by event_mutex.

Link: http://lkml.kernel.org/r/20130729175033.GB26284@redhat.com

Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-31 13:12:48 -04:00
Oleg Nesterov 776164c1fa debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs)
debugfs_remove_recursive() is wrong,

1. it wrongly assumes that !list_empty(d_subdirs) means that this
   dir should be removed.

   This is not that bad by itself, but:

2. if d_subdirs does not becomes empty after __debugfs_remove()
   it gives up and silently fails, it doesn't even try to remove
   other entries.

   However ->d_subdirs can be non-empty because it still has the
   already deleted !debugfs_positive() entries.

3. simple_release_fs() is called even if __debugfs_remove() fails.

Suppose we have

	dir1/
		dir2/
			file2
		file1

and someone opens dir1/dir2/file2.

Now, debugfs_remove_recursive(dir1/dir2) succeeds, and dir1/dir2 goes
away.

But debugfs_remove_recursive(dir1) silently fails and doesn't remove
this directory. Because it tries to delete (the already deleted)
dir1/dir2/file2 again and then fails due to "Avoid infinite loop"
logic.

Test-case:

	#!/bin/sh

	cd /sys/kernel/debug/tracing
	echo 'p:probe/sigprocmask sigprocmask' >> kprobe_events
	sleep 1000 < events/probe/sigprocmask/id &
	echo -n >| kprobe_events

	[ -d events/probe ] && echo "ERR!! failed to rm probe"

And after that it is not possible to create another probe entry.

With this patch debugfs_remove_recursive() skips !debugfs_positive()
files although this is not strictly needed. The most important change
is that it does not try to make ->d_subdirs empty, it simply scans
the whole list(s) recursively and removes as much as possible.

Link: http://lkml.kernel.org/r/20130726151256.GC19472@redhat.com

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-31 12:16:31 -04:00
Torsten Kaiser d982057f63 x86, amd, microcode: Fix error path in apply_microcode_amd()
Return -1 (like Intels apply_microcode) when the loading fails, also
do not set the active microcode level on failure.

Signed-off-by: Torsten Kaiser <just.for.lkml@googlemail.com>
Link: http://lkml.kernel.org/r/20130723225823.2e4e7588@googlemail.com
Acked-by: Borislav Petkov <bp@suse.de>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
2013-07-31 08:37:14 -07:00
Dimitris Papastamos 4f8b19143d ASoC: wm0010: Fix resource leak
If kzalloc() fails for `img' then we are going to leak the memory
for `out'.  We are freeing the memory of all the tx/rx transfers
but the tx/rx buf pointers will be NULL if we drop out earlier.

Signed-off-by: Dimitris Papastamos <dp@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2013-07-31 14:50:34 +01:00
Li Zefan da0a12caff cgroup: fix a leak when percpu_ref_init() fails
ss->css_free() is not called when perfcpu_ref_init() fails.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2013-07-31 06:13:25 -04:00
Paul Walmsley 067e710b9a ARM: 7801/1: v6: prevent gcc 4.5 from reordering extended CP15 reads above is_smp() test
Commit 621a0147d5 ("ARM: 7757/1: mm:
don't flush icache in switch_mm with hardware broadcasting") breaks
the boot on OMAP2430SDP with omap2plus_defconfig.  Tracked to an
undefined instruction abort from the CP15 read in
cache_ops_need_broadcast().  It turns out that gcc 4.5 reorders the
extended CP15 read above the is_smp() test.  This breaks ARM1136 r0
cores, since they don't support several CP15 registers that later ARM
cores do.  ARM1136JF-S TRM section 3.2.1 "Register allocation" has the
details.

So mark the extended CP15 read as clobbering memory, which prevents
the compiler from reordering it before the is_smp() test.  Russell
states that the code generated from this approach is preferable to
marking the inline asm as volatile.  Remove the existing condition
code clobber as it's obsolete, per Nico's post:

    http://www.spinics.net/lists/arm-kernel/msg261208.html

This patch is a collaboration with Will Deacon and Russell King.

Comments from Paul Walmsley:

 Russell, if you accept this one, might you also add Will's ack from the lists:

Comments from Paul Walmsley:

 I'd also be obliged if you could add a Cc: line for Jonathan Austin, since he helped test:

Signed-off-by: Paul Walmsley <paul@pwsan.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Nicolas Pitre <nicolas.pitre@linaro.org>
Cc: Tony Lindgren <tony@atomide.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Cc: Jonathan Austin <jonathan.austin@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2013-07-31 11:12:59 +01:00
Uwe Kleine-König bed859c1ee ARM: 7800/1: ARMv7-M: Fix name of NVIC handler function
The name changed in response to review comments for the nvic irqchip
driver when the original name was already accepted into Russell King's
tree.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2013-07-31 11:12:58 +01:00
Ralf Baechle d2ee88d0aa ASoC: au1x: Fix build
d8b51c11ff [ASoC: ac97c: Use
module_platform_driver()] broke the build:

 CC      sound/soc/au1x/ac97c.o
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: expected identifier or ‘(’ before ‘&’ token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: pasting "__initcall_" and "&" does not give a valid preprocessing token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘&’ token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: expected identifier or ‘(’ before ‘&’ token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: pasting "__exitcall_" and "&" does not give a valid preprocessing token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘&’ token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:334:31: warning: ‘au1xac97c_driver’ defined but not used [-Wunused-variable]
make[5]: *** [sound/soc/au1x/ac97c.o] Error 1
make[4]: *** [sound/soc/au1x] Error 2
make[3]: *** [sound/soc] Error 2

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2013-07-31 10:06:04 +01:00
Sean Hefty 5eb695c177 RDMA/cma: Only call cma_save_ib_info() for CM REQs
Calling cma_save_ib_info() for CM SIDR REQs results in a crash
accessing an invalid path record pointer.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-31 00:50:44 -07:00
Sean Hefty e511d1ae16 RDMA/cma: Fix accessing invalid private data for UD
If a application is using AF_IB with a UD QP, but does not provide any
private data, we will end up accessing invalid memory.  Check for this
case and handle it appropriately.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-31 00:50:40 -07:00
Wei Yongjun a661b43fd0 mlx5: fix error return code in mlx5_alloc_uuars()
Fix to return -ENOMEM from the ioremap error handling
case instead of 0, as done elsewhere in this function.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 19:33:45 -07:00
Arnaud Patard \(Rtp\) 5445eaf309 mvneta: Try to fix mvneta when compiled as module
When the mvneta driver is compiled as module, the clock is disabled before
it's loading. This will reset the registers values and all configuration
made by the bootloader.

This patch sets the "sgmii serdes configuration" register to a magical value
found in:
https://github.com/yellowback/ubuntu-precise-armadaxp/blob/master/arch/arm/mach-armadaxp/armada_xp_family/ctrlEnv/mvCtrlEnvLib.c

With this change, the interrupts are working/generated and ethernet is
working.

Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 19:32:36 -07:00
Arnaud Patard \(Rtp\) aded09555b mvneta: Fix hang when loading the mvneta driver
When the mvneta driver is compiled, it'll be loaded with clocks disabled.
This implies that the clocks should be enabled again before any register
access or it'll hang.

To fix it:
- enable clock earlier
- move timer callback after setting timer.data

Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 19:32:36 -07:00
Eric Dumazet 7b70176421 atl1c: Fix misuse of netdev_alloc_skb in refilling rx ring
On Mon, 2013-07-29 at 08:30 -0700, Eric Dumazet wrote:
> On Mon, 2013-07-29 at 13:09 +0100, Luis Henriques wrote:
>
> >
> > I confirm that I can't reproduce the issue using this patch.
> >
>
> Thanks, I'll send a polished patch, as this one had an error if
> build_skb() returns NULL (in case sk_buff allocation fails)

Please try the following patch : It should use 2K frags instead of 4K
for normal 1500 mtu

Thanks !

[PATCH] atl1c: use custom skb allocator

We had reports ( https://bugzilla.kernel.org/show_bug.cgi?id=54021 )
that using high order pages for skb allocations is problematic for atl1c

We do not know exactly what the problem is, but we suspect that crossing
4K pages is not well supported by this hardware.

Use a custom allocator, using page allocator and 2K fragments for
optimal stack behavior. We might make this allocator generic
in future kernels.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Luis Henriques <luis.henriques@canonical.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 18:12:07 -07:00
Steven Rostedt (Red Hat) 8c4f3c3fa9 ftrace: Check module functions being traced on reload
There's been a nasty bug that would show up and not give much info.
The bug displayed the following warning:

 WARNING: at kernel/trace/ftrace.c:1529 __ftrace_hash_rec_update+0x1e3/0x230()
 Pid: 20903, comm: bash Tainted: G           O 3.6.11+ #38405.trunk
 Call Trace:
  [<ffffffff8103e5ff>] warn_slowpath_common+0x7f/0xc0
  [<ffffffff8103e65a>] warn_slowpath_null+0x1a/0x20
  [<ffffffff810c2ee3>] __ftrace_hash_rec_update+0x1e3/0x230
  [<ffffffff810c4f28>] ftrace_hash_move+0x28/0x1d0
  [<ffffffff811401cc>] ? kfree+0x2c/0x110
  [<ffffffff810c68ee>] ftrace_regex_release+0x8e/0x150
  [<ffffffff81149f1e>] __fput+0xae/0x220
  [<ffffffff8114a09e>] ____fput+0xe/0x10
  [<ffffffff8105fa22>] task_work_run+0x72/0x90
  [<ffffffff810028ec>] do_notify_resume+0x6c/0xc0
  [<ffffffff8126596e>] ? trace_hardirqs_on_thunk+0x3a/0x3c
  [<ffffffff815c0f88>] int_signal+0x12/0x17
 ---[ end trace 793179526ee09b2c ]---

It was finally narrowed down to unloading a module that was being traced.

It was actually more than that. When functions are being traced, there's
a table of all functions that have a ref count of the number of active
tracers attached to that function. When a function trace callback is
registered to a function, the function's record ref count is incremented.
When it is unregistered, the function's record ref count is decremented.
If an inconsistency is detected (ref count goes below zero) the above
warning is shown and the function tracing is permanently disabled until
reboot.

The ftrace callback ops holds a hash of functions that it filters on
(and/or filters off). If the hash is empty, the default means to filter
all functions (for the filter_hash) or to disable no functions (for the
notrace_hash).

When a module is unloaded, it frees the function records that represent
the module functions. These records exist on their own pages, that is
function records for one module will not exist on the same page as
function records for other modules or even the core kernel.

Now when a module unloads, the records that represents its functions are
freed. When the module is loaded again, the records are recreated with
a default ref count of zero (unless there's a callback that traces all
functions, then they will also be traced, and the ref count will be
incremented).

The problem is that if an ftrace callback hash includes functions of the
module being unloaded, those hash entries will not be removed. If the
module is reloaded in the same location, the hash entries still point
to the functions of the module but the module's ref counts do not reflect
that.

With the help of Steve and Joern, we found a reproducer:

 Using uinput module and uinput_release function.

 cd /sys/kernel/debug/tracing
 modprobe uinput
 echo uinput_release > set_ftrace_filter
 echo function > current_tracer
 rmmod uinput
 modprobe uinput
 # check /proc/modules to see if loaded in same addr, otherwise try again
 echo nop > current_tracer

 [BOOM]

The above loads the uinput module, which creates a table of functions that
can be traced within the module.

We add uinput_release to the filter_hash to trace just that function.

Enable function tracincg, which increments the ref count of the record
associated to uinput_release.

Remove uinput, which frees the records including the one that represents
uinput_release.

Load the uinput module again (and make sure it's at the same address).
This recreates the function records all with a ref count of zero,
including uinput_release.

Disable function tracing, which will decrement the ref count for uinput_release
which is now zero because of the module removal and reload, and we have
a mismatch (below zero ref count).

The solution is to check all currently tracing ftrace callbacks to see if any
are tracing any of the module's functions when a module is loaded (it already does
that with callbacks that trace all functions). If a callback happens to have
a module function being traced, it increments that records ref count and starts
tracing that function.

There may be a strange side effect with this, where tracing module functions
on unload and then reloading a new module may have that new module's functions
being traced. This may be something that confuses the user, but it's not
a big deal. Another approach is to disable all callback hashes on module unload,
but this leaves some ftrace callbacks that may not be registered, but can
still have hashes tracing the module's function where ftrace doesn't know about
it. That situation can cause the same bug. This solution solves that case too.
Another benefit of this solution, is it is possible to trace a module's
function on unload and load.

Link: http://lkml.kernel.org/r/20130705142629.GA325@redhat.com

Reported-by: Jörn Engel <joern@logfs.org>
Reported-by: Dave Jones <davej@redhat.com>
Reported-by: Steve Hodgson <steve@purestorage.com>
Tested-by: Steve Hodgson <steve@purestorage.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-30 20:52:51 -04:00
Ben Widawsky e1b4d3036c drm/i915: fix missed hunk after GT access breakage
Upon some code refactoring, a hunk was missed. This was fixed for
next, but missed the current trees, and hasn't yet been merged by Dave
Airlie. It is fixed in:
commit 907b28c56e
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Jul 19 20:36:52 2013 +0100

    drm/i915: Colocate all GT access routines in the same file

It is introduced by:
commit 181d1b9e31
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Sun Jul 21 13:16:24 2013 +0200

    drm/i915: fix up gt init sequence fallout

Reported-by: Dave Jones <davej@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Ben Widawsky <ben@bwidawsk.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-07-31 09:54:09 +10:00
Pablo Neira e1ee3673a8 genetlink: fix usage of NLM_F_EXCL or NLM_F_REPLACE
Currently, it is not possible to use neither NLM_F_EXCL nor
NLM_F_REPLACE from genetlink. This is due to this checking in
genl_family_rcv_msg:

	if (nlh->nlmsg_flags & NLM_F_DUMP)

NLM_F_DUMP is NLM_F_MATCH|NLM_F_ROOT. Thus, if NLM_F_EXCL or
NLM_F_REPLACE flag is set, genetlink believes that you're
requesting a dump and it calls the .dumpit callback.

The solution that I propose is to refine this checking to
make it stricter:

	if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP)

And given the combination NLM_F_REPLACE and NLM_F_EXCL does
not make sense to me, it removes the ambiguity.

There was a patch that tried to fix this some time ago (0ab03c2
netlink: test for all flags of the NLM_F_DUMP composite) but it
tried to resolve this ambiguity in *all* existing netlink subsystems,
not only genetlink. That patch was reverted since it broke iproute2,
which is using NLM_F_ROOT to request the dump of the routing cache.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 16:43:19 -07:00
Dan Carpenter ff862a4668 af_key: more info leaks in pfkey messages
This is inspired by a5cc68f3d6 "af_key: fix info leaks in notify
messages".  There are some struct members which don't get initialized
and could disclose small amounts of private information.

Acked-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 16:26:16 -07:00
Samuel Ortiz 9ea7187c53 NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD
Loading a firmware into a target is typically called firmware
download, not firmware upload. So we rename the netlink API to
NFC_CMD_FW_DOWNLOAD in order to avoid any terminology confusion from
userspace.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-07-31 01:19:43 +02:00
Paul Bolle 8fb488d740 RDMA/cma: Fix gcc warning
Building cma.o triggers this gcc warning:

    drivers/infiniband/core/cma.c: In function ‘rdma_resolve_addr’:
    drivers/infiniband/core/cma.c:465:23: warning: ‘port’ may be used uninitialized in this function [-Wmaybe-uninitialized]
    drivers/infiniband/core/cma.c:426:5: note: ‘port’ was declared here

This is a false positive, as "port" will always be initialized if we're
at "found". But if we assign to "id_priv->id.port_num" directly, we can
drop "port". That will, obviously, silence gcc.

Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 16:11:22 -07:00
Uwe Kleine-König a264b981f2 net/fec: Don't let ndo_start_xmit return NETDEV_TX_BUSY without link
Don't test for having link and let hardware deal with this situation.

Without this patch I see a machine running an -rt patched Linux being
stuck in sch_direct_xmit when it looses link while there is still a
packet to be sent. In this case the fec_enet_start_xmit routine returned
NETDEV_TX_BUSY which makes the network stack reschedule the packet and
so sch_direct_xmit calls fec_enet_start_xmit again.
I failed to reproduce a complete hang without -rt, but I think the
problem exists there, too.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 16:05:04 -07:00
Roland Dreier 3c93f039d2 Revert "RDMA/nes: Fix compilation error when nes_debug is enabled"
This reverts commit bca1935ccd, which removes variables
nes_tcp_state_str and nes_iwarp_state_str, assuming that they aren't
defined.  However, they are defined within a #ifdef NES_DEBUG statement,
which if enabled causes "defined but not used" compiler warning, when
the variables are removed.

Signed-off-by: Tatyana Nikolova <Tatyana.E.Nikolova@intel.com>
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 15:48:35 -07:00
Dave Airlie f34f516a8d Merge branch 'drm-fixes-3.11' of git://people.freedesktop.org/~agd5f/linux
Alex writes:
- more fixes for SI dpm
- fix DP on some rv6xx boards

* 'drm-fixes-3.11' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon/dpm: re-enable cac control on SI
  drm/radeon/dpm: fix calculations in si_calculate_leakage_for_v_and_t_formula
  drm: fix 64 bit drm fixed point helpers
  drm/radeon/atom: initialize more atom interpretor elements to 0
2013-07-31 08:46:21 +10:00
Stephen Boyd 011b2039df gpio_msm: Fix build error due to missing err.h
drivers/gpio/gpio-msm-v1.c: In function 'gpio_msm_v1_probe':
drivers/gpio/gpio-msm-v1.c:656:2:
error: implicit declaration of function 'IS_ERR'
[-Werror=implicit-function-declaration]
drivers/gpio/gpio-msm-v1.c:657:3:
error: implicit declaration of function 'PTR_ERR'
[-Werror=implicit-function-declaration]

This driver failed to compile after commit 68515bb
(gpio_msm: Convert to use devm_ioremap_resource,
2013-06-10).

Acked-by: Tushar Behera <tushar.behera@linaro.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2013-07-31 00:34:31 +02:00
Linus Walleij 253403b035 Revert "gpio/omap: don't create an IRQ mapping for every GPIO on DT"
This reverts commit 0e970cec05.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2013-07-31 00:34:31 +02:00
Linus Walleij c119fee063 Revert "gpio/omap: auto request GPIO as input if used as IRQ via DT"
This reverts commit b4419e1a15.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2013-07-31 00:34:31 +02:00
Linus Walleij 27d470c1ab Revert "gpio/omap: fix build error when OF_GPIO is not defined."
This reverts commit 949eb1a4d2.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2013-07-31 00:34:30 +02:00
Alex Deucher 5a344dda94 drm/radeon/dpm: re-enable cac control on SI
Now that the fixed point functions are fixed we
can re-enable cac support.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-30 17:24:14 -04:00
Alex Deucher 31f731af51 drm/radeon/dpm: fix calculations in si_calculate_leakage_for_v_and_t_formula
Need to make some slight adjustments for the fixed point math to
work properly.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-30 17:24:13 -04:00
Alex Deucher a838834b2f drm: fix 64 bit drm fixed point helpers
Sign bit wasn't handled properly and a small typo.

Thanks to Christian for helping me sort this out.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-30 17:24:13 -04:00
Alex Deucher 42a21826dc drm/radeon/atom: initialize more atom interpretor elements to 0
The ProcessAuxChannel table on some rv635 boards assumes
the divmul members are initialized to 0 otherwise we get
an invalid fb offset since it has a bad mask set when
setting the fb base.  While here initialize all the
atom interpretor elements to 0.

Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=60639

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2013-07-30 17:24:12 -04:00
Dongsheng Wang e00c9a0c2e powerpc/mpc85xx: invalidate TLB after hibernation resume
This problem belongs to the core synchronization issues.
The cpu1 already updated spin_table values, but bootcore cannot get
this value in time.

After bootcpu hibiernation restore the pages. we are now running
with the kernel data of the old kernel fully restored. if we reset
the non-bootcpus that will be reset cache(tlb), the non-bootcpus
will get new address(map virtual and physical address spaces).
but bootcpu tlb cache still use boot kernel data, so we need to
invalidate the bootcpu tlb cache make it to get new main memory data.

log:
Enabling non-boot CPUs ...
smp_85xx_kick_cpu: timeout waiting for core 1 to reset
smp: failed starting cpu 1 (rc -2)
Error taking CPU1 up: -2

Signed-off-by: Wang Dongsheng <dongsheng.wang@freescale.com>
Reviewed-by: Anton Vorontsov <anton@enomsg.org>
[scottwood@freescale.com: reworded code comment for clarity]
Signed-off-by: Scott Wood <scottwood@freescale.com>
2013-07-30 15:50:08 -05:00
Wei Yongjun f8dc6eb757 powerpc/fsl_msi: fix error return code in fsl_of_msi_probe()
Fix to return a negative error code in the MSI bitmap alloc error
handling case instead of 0, as done elsewhere in this function.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Scott Wood <scottwood@freescale.com>
2013-07-30 15:50:08 -05:00
Hongtao Jia 4e0e3435b5 powerpc/85xx: Add machine check handler to fix PCIe erratum on mpc85xx
A PCIe erratum of mpc85xx may causes a core hang when a link of PCIe
goes down. when the link goes down, Non-posted transactions issued
via the ATMU requiring completion result in an instruction stall.
At the same time a machine-check exception is generated to the core
to allow further processing by the handler. We implements the handler
which skips the instruction caused the stall.

This patch depends on patch:
powerpc/85xx: Add platform_device declaration to fsl_pci.h

Signed-off-by: Zhao Chenhui <b35336@freescale.com>
Signed-off-by: Li Yang <leoli@freescale.com>
Signed-off-by: Liu Shuo <soniccat.liu@gmail.com>
Signed-off-by: Jia Hongtao <hongtao.jia@freescale.com>
Signed-off-by: Scott Wood <scottwood@freescale.com>
2013-07-30 15:50:07 -05:00
Hongtao Jia 9123c5ed45 powerpc: Move opcode definitions from kvm/emulate.c to asm/ppc-opcode.h
Opcode and xopcode are useful definitions not just for KVM. Move these
definitions to asm/ppc-opcode.h for public use.

Also add the opcodes for LHAUX and LWZUX.

Signed-off-by: Jia Hongtao <hongtao.jia@freescale.com>
Signed-off-by: Li Yang <leoli@freescale.com>
[scottwood@freesacle.com: update commit message and rebase]
Signed-off-by: Scott Wood <scottwood@freescale.com>
2013-07-30 15:50:07 -05:00
Ingo Molnar f155b6303d * The size of memory that gets freed by free_pages() needs to be
specified in pages, not bytes - Roy Franz.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.13 (GNU/Linux)
 
 iQIcBAABAgAGBQJR8o2aAAoJEC84WcCNIz1VmC8QAKTvaLsaAkg603K1AOtNBRLq
 OIRxffV78Xw2mpVnJR0oWcKdGkh0R1QyXY/epxezuZ72gOZFPbjlt6o26FWpR4wD
 0vzxDZatvpW6+b0nm65IcXA2dOBKyHkgpQH1hB0N++Vze7aMvNaCnzWehzTK7QQr
 Ns2t7ZzXIzDMzbBxDr7WFJu/QBmfByDpHS2/w56+kKr8LiZoz4SP6F+c62l+dKW5
 SoQ4ZEir/khd2sCeebjK4OKJcAqpPByJrpJY6uYcNrXCaykKyHEebAeWMx+9aIEq
 kZ3jl8D1sP1lYeHj/gJfLiDs5gW+39rao5+HrToU/BC6ghBGnEHSCQcecgWYmmUG
 Z3KXt7KfyThe+Xbw1JnBwc649Cx7rw7sks3POlgKxsyvoRCXMTj5/KxImydY4fbG
 HTMgtgJhuhwsXGuUeJnR7JUMBqjR3k6EMgGbRqFwkn/UXD6thlJuoRJwqSurc4Lh
 Tkekivbw5OgNEL44ZzCXzmBw7VN0Rt0+esKxbAhnEPAzwFjB18F5AzfONuUX/ull
 9k/Ed1tVsMgIFmzmCx2LTwj/U3QJ1uCdpIeouzN+jvS86vPo6HB9launENRjcj/X
 fA6cLgypfIj5qYD/SCPMq4nysC2ab551XABWidvkmbaDCiJgch5TXksuIcbpnZqJ
 s8I8gub6hqh+9VFcw+5R
 =QwjF
 -----END PGP SIGNATURE-----

Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/urgent

Pull EFI fix from Matt Fleming:

 * The size of memory that gets freed by free_pages() needs to be
   specified in pages, not bytes - by Roy Franz.

Signed-off-by: Ingo Molnar <mingo@kernel.org>
2013-07-30 20:50:33 +02:00
Stefano Stabellini 741ddbcfd2 xen/tmem: do not allow XEN_TMEM on ARM64
tmem is not supported on arm or arm64 yet. Will revert this
once the Xen hypervisor supports it.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2013-07-30 13:44:02 -04:00
Mike Marciniszyn b268e4db3d IB/qib: Add err_decode() call for ring dump
Commit 0b3ddf380c ("Log all SDMA errors unconditionally") missed
part of the patch.

This also corrects a format warning when dma_addr_t is 32 bits
on a 64 bit system.

Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:13:00 -07:00
Dan Carpenter 246fcdbc9d RDMA/cxgb3: Fix stack info leak in iwch_create_cq()
The "uresp.reserved" field isn't initialized on this path so it could
leak uninitialized stack information to the user.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:11:33 -07:00
Dan Carpenter 604296303f RDMA/nes: Fix info leaks in nes_create_qp() and nes_create_cq()
We pass a few bytes of uninitialized stack memory to the user here.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:10:35 -07:00
Dan Carpenter 63ea374957 RDMA/ocrdma: Fix several stack info leaks
A grab bag of places which don't properly initialize stack data.  I
removed one place which cleared ".rsvd" because it's not needed now
that I have added a memset() earlier in the function.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:09:16 -07:00
Dan Carpenter ae1fe07f3f RDMA/cxgb4: Fix stack info leak in c4iw_create_qp()
"uresp.ma_sync_key" doesn't get set on this path so we leak 8 bytes of data.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:07:56 -07:00