Commit Graph

495676 Commits

Author SHA1 Message Date
Linus Torvalds b8de08da04 Devicetree updates for v3.19-rc6
A few bugfixes for the new DT overlay feature, documentation updates,
 spelling corrections, and changes to MAINTAINERS. Nothing earth
 shattering here.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJUwnLYAAoJEMWQL496c2LNR88P/R7PbMZndqGhThzfPkbrEUx2
 7Myb9TtIwOSdGnB2Q+QLplDEn5qhO/S37PjIhEq4lo07QTVvzSJY4x+SP+w5cXyC
 9yfEVhsLzcQb54U7G9F5MHANgaeHMPn8p70l3MWUSMiathcc/2akG9IwD4OlxR7s
 CcH/wSlzd8GTPwd2k+k2OxTTRt8PexaySpa9oHd1CzKwMENMvIexm4xFXTYDEX1f
 tyjdcPnQWe0LbzWlOMYO/N2kXb4a+ILoB5v4YJMZXi44+1bugbGLvqlNmG1UR+5d
 xEMHxgt0ukzYrtrILBiTj3IZHyluIyiz142Xah0kMj2GDrGB+NouxWuTsrZt8Bql
 4/9co1qAYSlD2pdoaBczaqum72OkIvFtJKJFsV8tNTk3aUVfi/RtHAqoWcSvvoZv
 o40VxIozMC5M14wtlPvMHF7g38mUerGL04+wXSzIUitTDZLSe5Huxg1olN0jh0zn
 G+1OsyleUnOwwFyN+e1lBxd03TTZu/8Jy01HJZub1106ch2ympfIm6V8i7UI1GZS
 RfmPE90/3JqsX9fjvCN3h4beX2mavpquPQvR85pRPsu6Fls7unSFeSU6v6J91xfb
 G1lhVgdj+PwUiMzOoOjzzs9sLejBf7Z6IJNtTQ3g+iBA4VwhkWc+e5JzheiHD76Q
 XUroHBEVAugg/iT9jmBJ
 =/bBX
 -----END PGP SIGNATURE-----

Merge tag 'devicetree-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux

Pull devicetree bug fixes and documentation updates from Grant Likely:
 "A few bugfixes for the new DT overlay feature, documentation updates,
  spelling corrections, and changes to MAINTAINERS.  Nothing earth
  shattering here"

* tag 'devicetree-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux:
  of/unittest: Overlays with sub-devices tests
  of/platform: Handle of_populate drivers in notifier
  of/overlay: Do not generate duplicate nodes
  devicetree: document the "qemu" and "virtio" vendor prefixes
  devicetree: document ARM bindings for QEMU's Firmware Config interface
  Documentation: of: fix typo in graph bindings
  dma-mapping: fix debug print to display correct dma_pfn_offset
  of: replace Asahi Kasei Corp vendor prefix
  ARM: dt: GIC: Spelling s/specific/specifier/, s/flaggs/flags/
  dt/bindings: arm-boards: Spelling s/pointong/pointing/
  MAINTAINERS: Update DT website and git repository
  MAINTAINERS: drop DT regex matching on of_get_property and of_match_table
2015-01-24 10:55:05 +12:00
Olof Johansson 4b3415c936 The i.MX fixes for 3.19, 2nd round:
- Correct pwm clock assignment in i.MX25 device tree to fix the broken
    pwm support on i.MX25
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJUwZrwAAoJEFBXWFqHsHzOEMoH/iIU+ChvOXbJe7DfITJiwPXG
 hjILxqR4sjcJAIfd3y67ydD4fg6wRf/Gfp3tij/Ydbjrl7TbWOaQveo7Uolr6Jaj
 MiXXOvQDyISHNoS09UjmCf8+4VSDx+5hamkWSlJTXC365RI6PAQihduvCWCUF5/Y
 GwUaZBNTOE8VMgel20BKmvGKGPwJDAw3K5jO5Lfwg2DYLDSqZEHa+kuOxgBjbRJp
 2VkrNplkVQ7QAO4HrNIuyVSXXvgSS4fJQ1unbd+EgRBkh2yLUAOlHmOXxZouYTbh
 uPr7rp2Q4pDruJj/C2O9t5ng2nnMQ6I1z54umJp+2h0VSsNOX2ZjLTHq7/SvyHE=
 =SrqB
 -----END PGP SIGNATURE-----

Merge tag 'imx-fixes-3.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes

Merge "ARM: imx: fixes for 3.19, 2nd round" from Shawn Guo:

The i.MX fixes for 3.19, 2nd round:
 - Correct pwm clock assignment in i.MX25 device tree to fix the broken
   pwm support on i.MX25

* tag 'imx-fixes-3.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  ARM: dts: imx25: Fix PWM "per" clocks

Signed-off-by: Olof Johansson <olof@lixom.net>
2015-01-23 14:23:40 -08:00
Robin Murphy e0b2180010 arm64: dts: add baud rate to Juno stdout-path
Without explicit command-line parameters, the Juno UART ends up running
at 57600 baud in the kernel, which is at odds with the 115200 baud used
by the rest of the firmware. Since commit 7914a7c565 now lets us
fix this by specifying default options in stdout-path, do so.

Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
2015-01-23 14:17:56 -08:00
Olof Johansson 5cf920619e mvebu fixes for 3.19. (Part 4)
bus: mvebu-mbus: fix support of MBus window 13
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJUwDNwAAoJEOa/DcumaUyEkx0QALyev1odfUDjlRqbpsmIh6c4
 sdQFjmIyAoK2SZBsYZE51sFiEBuCw4hF7jMKjgG0JUVOEcrl1pzS6AzdojexinBr
 +b761WDXNsSijls3Uks7NATtuzY2MMqFhTYgXVHLLmw8/vdu3ZWcK6qXtHpIplbH
 yw9GzSN5eZtQ10vx4dwCiAONfHbIFGWeeq57kojIvasCutLwWcEWE96s38hAVYFd
 Vrm7xEng3A+0WOLx6zhTIOZggrNLrv7mAhyhegW7r6PQE44yzyuVeRSnm8ezQ+Rw
 pcLTt92iVVmA8O8dC7MFWr3/0G2zzCZRpKtRwt1iBhfvtb3cDx8qzWfPSiTwFK80
 6sJfFvxrO08qdiduIsJof8sPb/OrcdvCqEw32nOepfrDiv5HP1Z6ReCu98Avitih
 T42OcFc05NY68A72urr0LXJpx3QA8TDkopBmc8H4Z9E+W9sU0ik2MNhUjkUB+biW
 1ll/t1RmFUEENrF+9zKUiqOIvZNacT4kuPPqNx0m9oKB4KhpxuST8qkV79Hthsic
 ayxsfNWys+wOlips9QBVpdOPd2WMDLOD1WSUpd9D8tATJa8N7J7yFHXo3KJrnwvf
 CnKTTh37TrZ/Ddd0KRKvAqLLwWrIkgg+xNzaJIpjeewkwtdDDH2ZlhHLg/uUIQ/h
 wWF0OM0DVmWU5Tq+3kjd
 =9jyZ
 -----END PGP SIGNATURE-----

Merge tag 'mvebu-fixes-3.19-4' of git://git.infradead.org/linux-mvebu into fixes

Merge "mvebu/fixes #3" from Andrew Lunn:

mvebu fixes for 3.19. (Part 4)

bus: mvebu-mbus: fix support of MBus window 13

* tag 'mvebu-fixes-3.19-4' of git://git.infradead.org/linux-mvebu:
  bus: mvebu-mbus: fix support of MBus window 13
  ARM: mvebu: completely disable hardware I/O coherency

Signed-off-by: Olof Johansson <olof@lixom.net>
2015-01-23 14:08:13 -08:00
Linus Torvalds 2e3810da41 Three small fixes. Two for x86 and one avoids that sparse bails out.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQEcBAABAgAGBQJUwkVXAAoJEL/70l94x66DwPEH/RPBmxJ+lD0nRyXVECSWxjN6
 DYJvp4HsLV8BhBx/ATjAkjiVPKTUk9vQBjfgl72YatjASP9aNIkBqnN0AOVdVQ2i
 04ZvYaSw3jY0A5PSecdFQZ4u8MAvaRS4AYNOYM3Kpf0EOrIwanXFpEfVRGT8ichT
 uBK/mbN7vDO1SsgAnB00fCew4wFrHIa7fJ8eLNnebDOuC72oUZA+2nKx8ApWq4ca
 ZaziqkI2CFaV2rqJokKDun2arxI2Q6/L87g7qyo+HMd1b+aepLTWYNOs1vH0YoSc
 73aHg+3crIqx75XmnaxKP5SPOr6vpmnloux9yre8u1tvejBIbCMz1g9Mdl0YOmA=
 =YRTn
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "Three small fixes.

  Two for x86 and one avoids that sparse bails out"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: x86: SYSENTER emulation is broken
  KVM: x86: Fix of previously incomplete fix for CVE-2014-8480
  KVM: fix sparse warning in include/trace/events/kvm.h
2015-01-24 09:58:17 +12:00
Linus Torvalds 0ad4989d62 Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm
Pull ARM fixes from Russell King:
 "Another round of small ARM fixes.

  restore_user_regs early stack deallocation is buggy in the presence of
  FIQs which switch to SVC mode, and could lead to corrupted registers
  being returned to a user process given an inopportune FIQ event.

  Another bug was spotted in the ARM perf code where it could lose track
  of perf counter overflows, leading to incorrect perf results.

  Lastly, a bug in arm_add_memory() was spotted where the memory sizes
  aren't properly rounded.  As most people pass properly rounded sizes,
  this hasn't been noticed"

* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
  ARM: 8292/1: mm: fix size rounding-down of arm_add_memory() function
  ARM: 8255/1: perf: Prevent wraparound during overflow
  ARM: 8266/1: Remove early stack deallocation from restore_user_regs
2015-01-24 09:57:01 +12:00
Linus Torvalds 222713bb1e arm64 fixes:
- Fix cleaning of .dtbs following directory restructuring
 - Fix allmodconfig build breakage in -next due to missing include
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABCgAGBQJUwjspAAoJELescNyEwWM0KO4IAI6uyVYrsGZa+j7HUnvr6xQp
 jqqlVyTfl3mxS8o0BfquGHn55CT2S3Vn0pPs8RSy5gvzqqoB2c2N1ULEpRGHFErE
 OpxCpNrCnWnCRKRaV4T0sjU4nPIYQg78G82tJmn2WS52dt1/jl3KRlhcykf9G+o6
 m2fMAe+/V5Q6Zi4GV3ULYGjE7O7Cb/HQskFRe7uhltDbmQFXW1KCcDwwTm4w8uTW
 2uzqz4qn1GtrsP+nS8IW7CCIUZpMRDRWoo28xbRtPgiQwRp4vdzNN5JDno+YG6w+
 WddR8XvJRDCsvrJq6jJoIGmOA+b6WYAaMQ+bubulb7wmCnQzGr2ackvuT9WyB2o=
 =P6S+
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull two arm64 fixes from Will Deacon:
 "Arm64 fixes seem to come in pairs recently.  We've got a fix for
  removing device-tree blobs when doing a make clean and another one
  addressing a missing include, which fixes build failures in -next for
  allmodconfig (spotted by Mark's buildbot).

  Summary from signed tag:

   - fix cleaning of .dtbs following directory restructuring
   - fix allmodconfig build breakage in -next due to missing include"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: dump: Fix implicit inclusion of definition for PCI_IOBASE
  arm64: Add dtb files to archclean rule
2015-01-24 09:55:13 +12:00
Darren Hart b78695a71d Revert "platform: x86: dell-laptop: Add support for keyboard backlight"
This reverts commit 02b2aaaa57.

This interface was determined to be flawed and required too invasive a
fix for the RC cycle. This will be revisited in 3.20.

Signed-off-by: Darren Hart <dvhart@linux.intel.com>
2015-01-23 11:10:32 -08:00
Darren Hart dc58376921 Revert "Documentation: Add entry for dell-laptop sysfs interface"
This reverts commit 3161293ba6.

This interface was determined to be flawed and required too invasive a
fix for the RC cycle. This will be revisited in 3.20.

Signed-off-by: Darren Hart <dvhart@linux.intel.com>
2015-01-23 11:10:12 -08:00
Joe Thornber a59db67656 dm cache: fix problematic dual use of a single migration count variable
Introduce a new variable to count the number of allocated migration
structures.  The existing variable cache->nr_migrations became
overloaded.  It was used to:

 i) track of the number of migrations in flight for the purposes of
    quiescing during suspend.

 ii) to estimate the amount of background IO occuring.

Recent discard changes meant that REQ_DISCARD bios are processed with
a migration.  Discards are not background IO so nr_migrations was not
incremented.  However this could cause quiescing to complete early.

(i) is now handled with a new variable cache->nr_allocated_migrations.
cache->nr_migrations has been renamed cache->nr_io_migrations.
cleanup_migration() is now called free_io_migration(), since it
decrements that variable.

Also, remove the unused cache->next_migration variable that got replaced
with with prealloc_structs a while ago.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org
2015-01-23 11:06:08 -05:00
Joe Thornber 9b1cc9f251 dm cache: share cache-metadata object across inactive and active DM tables
If a DM table is reloaded with an inactive table when the device is not
suspended (normal procedure for LVM2), then there will be two dm-bufio
objects that can diverge.  This can lead to a situation where the
inactive table uses bufio to read metadata at the same time the active
table writes metadata -- resulting in the inactive table having stale
metadata buffers once it is promoted to the active table slot.

Fix this by using reference counting and a global list of cache metadata
objects to ensure there is only one metadata object per metadata device.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org
2015-01-23 10:57:15 -05:00
Pantelis Antoniou 6b1271de37 of/unittest: Overlays with sub-devices tests
Introduce selftests for overlays using sub-devices present
in children nodes.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>
2015-01-23 13:10:07 +00:00
Nadav Amit f3747379ac KVM: x86: SYSENTER emulation is broken
SYSENTER emulation is broken in several ways:
1. It misses the case of 16-bit code segments completely (CVE-2015-0239).
2. MSR_IA32_SYSENTER_CS is checked in 64-bit mode incorrectly (bits 0 and 1 can
   still be set without causing #GP).
3. MSR_IA32_SYSENTER_EIP and MSR_IA32_SYSENTER_ESP are not masked in
   legacy-mode.
4. There is some unneeded code.

Fix it.

Cc: stable@vger.linux.org
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-01-23 13:57:15 +01:00
Nadav Amit 63ea0a49ae KVM: x86: Fix of previously incomplete fix for CVE-2014-8480
STR and SLDT with rip-relative operand can cause a host kernel oops.
Mark them as DstMem as well.

Cc: stable@vger.linux.org
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-01-23 13:56:56 +01:00
Mark Brown 284be28565 arm64: dump: Fix implicit inclusion of definition for PCI_IOBASE
Since c9465b4ec3 (arm64: add support to dump the kernel page tables)
allmodconfig has failed to build on arm64 as a result of:

../arch/arm64/mm/dump.c:55:20: error: 'PCI_IOBASE' undeclared here (not in a function)

Fix this by explicitly including io.h to ensure that a definition is
present.

Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2015-01-23 10:47:42 +00:00
Johannes Berg 0fa7b39131 nl80211: fix per-station group key get/del and memory leak
In case userspace attempts to obtain key information for or delete a
unicast key, this is currently erroneously rejected unless the driver
sets the WIPHY_FLAG_IBSS_RSN flag. Apparently enough drivers do so it
was never noticed.

Fix that, and while at it fix a potential memory leak: the error path
in the get_key() function was placed after allocating a message but
didn't free it - move it to a better place. Luckily admin permissions
are needed to call this operation.

Cc: stable@vger.kernel.org
Fixes: e31b82136d ("cfg80211/mac80211: allow per-station GTKs")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-01-23 11:21:02 +01:00
Mathy Vanhoef 3a5c5e81d8 mac80211: properly set CCK flag in radiotap
Fix a regression introduced by commit a5e70697d0 ("mac80211: add radiotap flag
and handling for 5/10 MHz") where the IEEE80211_CHAN_CCK channel type flag was
incorrectly replaced by the IEEE80211_CHAN_OFDM flag. This commit fixes that by
using the CCK flag again.

Cc: stable@vger.kernel.org
Fixes: a5e70697d0 ("mac80211: add radiotap flag and handling for 5/10 MHz")
Signed-off-by: Mathy Vanhoef <vanhoefm@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-01-23 10:53:58 +01:00
Alexandre Demers 520452172e x86/tsc: Change Fast TSC calibration failed from error to info
Many users see this message when booting without knowning that it is
of no importance and that TSC calibration may have succeeded by
another way.

As explained by Paul Bolle in
http://lkml.kernel.org/r/1348488259.1436.22.camel@x61.thuisdomein

  "Fast TSC calibration failed" should not be considered as an error
  since other calibration methods are being tried afterward. At most,
  those send a warning if they fail (not an error). So let's change
  the message from error to warning.

[ tglx: Make if pr_info. It's really not important at all ]

Fixes: c767a54ba0 x86/debug: Add KERN_<LEVEL> to bare printks, convert printks to pr_<level>
Signed-off-by: Alexandre Demers <alexandre.f.demers@gmail.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/1418106470-6906-1-git-send-email-alexandre.f.demers@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-23 10:53:52 +01:00
Fred Chou fb142f4bbb mac80211: correct header length calculation
HT Control field may also be present in management frames, as defined
in 8.2.4.1.10 of 802.11-2012. Account for this in calculation of header
length.

Signed-off-by: Fred Chou <fred.chou.nd@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-01-23 10:52:48 +01:00
Luciano Coelho 2af81d6718 mac80211: only roll back station states for WDS when suspending
In normal cases (i.e. when we are fully associated), cfg80211 takes
care of removing all the stations before calling suspend in mac80211.

But in the corner case when we suspend during authentication or
association, mac80211 needs to roll back the station states.  But we
shouldn't roll back the station states in the suspend function,
because this is taken care of in other parts of the code, except for
WDS interfaces.  For AP types of interfaces, cfg80211 takes care of
disconnecting all stations before calling the driver's suspend code.
For station interfaces, this is done in the quiesce code.

For WDS interfaces we still need to do it here, so move the code into
a new switch case for WDS.

Cc: stable@kernel.org [3.15+]
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-01-23 10:47:40 +01:00
Bryan O'Donoghue 38a1dfda8e x86/apic: Re-enable PCI_MSI support for non-SMP X86_32
Commit 0dbc6078c0 ('x86, build, pci: Fix PCI_MSI build on !SMP')
introduced the dependency that X86_UP_APIC is only available when
PCI_MSI is false. This effectively prevents PCI_MSI support on 32bit
UP systems because it disables both APIC and IO-APIC. But APIC support
is architecturally required for PCI_MSI.

The intention of the patch was to enforce APIC support when PCI_MSI is
enabled, but failed to do so.

Remove the !PCI_MSI dependency from X86_UP_APIC and enforce
X86_UP_APIC when PCI_MSI support is enabled on 32bit UP systems.

[ tglx: Massaged changelog ]

Fixes 0dbc6078c0 'x86, build, pci: Fix PCI_MSI build on !SMP'
Signed-off-by: Bryan O'Donoghue <pure.logic@nexus-software.ie>
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/1421967529-9037-1-git-send-email-pure.logic@nexus-software.ie
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-23 10:20:30 +01:00
Rusty Russell dc4515ea26 scsi: always increment reference count
James reported:
> After e513cc1 module: Remove stop_machine from module unloading,
> module_refcount() is returning (unsigned long)-1 when called from within
> a routine that runs in module_exit.  This is confusing the scsi device
> put code which is coded to detect a module_refcount() of zero for
> running within a module exit routine and not try to do another
> module_put.  The fix is to restore the original behaviour of
> module_refcount() and return zero if we're running inside an exit
> routine.

The correct fix is to turn try_module_get() into __module_get(), and
always do the module_put().

Acked-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2015-01-23 14:42:16 +10:30
Juergen Gross 31bb772370 x86, mm: Change cachemode exports to non-gpl
Commit 281d4078be ("x86: Make page cache mode a real type")
introduced the symbols __cachemode2pte_tbl and __pte2cachemode_tbl and
exported them via EXPORT_SYMBOL_GPL.  The exports are part of a
replacement of code which has been EXPORT_SYMBOL before these changes
resulting in build breakage of out-of-tree non-gpl modules.

Change EXPORT_SYMBOL_GPL to EXPORT-SYMBOL for these two symbols.

Fixes: 281d4078be "x86: Make page cache mode a real type"
Reported-and-tested-by: Steven Noonan <steven@uplinklabs.net>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Toshi Kani <toshi.kani@hp.com>
Link: http://lkml.kernel.org/r/1421926997-28615-1-git-send-email-jgross@suse.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22 21:50:14 +01:00
Andy Lutomirski 3669ef9fa7 x86, tls: Interpret an all-zero struct user_desc as "no segment"
The Witcher 2 did something like this to allocate a TLS segment index:

        struct user_desc u_info;
        bzero(&u_info, sizeof(u_info));
        u_info.entry_number = (uint32_t)-1;

        syscall(SYS_set_thread_area, &u_info);

Strictly speaking, this code was never correct.  It should have set
read_exec_only and seg_not_present to 1 to indicate that it wanted
to find a free slot without putting anything there, or it should
have put something sensible in the TLS slot if it wanted to allocate
a TLS entry for real.  The actual effect of this code was to
allocate a bogus segment that could be used to exploit espfix.

The set_thread_area hardening patches changed the behavior, causing
set_thread_area to return -EINVAL and crashing the game.

This changes set_thread_area to interpret this as a request to find
a free slot and to leave it empty, which isn't *quite* what the game
expects but should be close enough to keep it working.  In
particular, using the code above to allocate two segments will
allocate the same segment both times.

According to FrostbittenKing on Github, this fixes The Witcher 2.

If this somehow still causes problems, we could instead allocate
a limit==0 32-bit data segment, but that seems rather ugly to me.

Fixes: 41bdc78544 x86/tls: Validate TLS entries to protect espfix
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Cc: stable@vger.kernel.org
Cc: torvalds@linux-foundation.org
Link: http://lkml.kernel.org/r/0cb251abe1ff0958b8e468a9a9a905b80ae3a746.1421954363.git.luto@amacapital.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22 21:45:07 +01:00
Andy Lutomirski e30ab185c4 x86, tls, ldt: Stop checking lm in LDT_empty
32-bit programs don't have an lm bit in their ABI, so they can't
reliably cause LDT_empty to return true without resorting to memset.
They shouldn't need to do this.

This should fix a longstanding, if minor, issue in all 64-bit kernels
as well as a potential regression in the TLS hardening code.

Fixes: 41bdc78544 x86/tls: Validate TLS entries to protect espfix
Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Cc: torvalds@linux-foundation.org
Link: http://lkml.kernel.org/r/72a059de55e86ad5e2935c80aa91880ddf19d07c.1421954363.git.luto@amacapital.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22 21:11:06 +01:00
Dave Hansen e9d1b4f3c6 x86, mpx: Strictly enforce empty prctl() args
Description from Michael Kerrisk.  He suggested an identical patch
to one I had already coded up and tested.

commit fe3d197f84 "x86, mpx: On-demand kernel allocation of bounds
tables" added two new prctl() operations, PR_MPX_ENABLE_MANAGEMENT and
PR_MPX_DISABLE_MANAGEMENT.  However, no checks were included to ensure
that unused arguments are zero, as is done in many existing prctl()s
and as should be done for all new prctl()s. This patch adds the
required checks.

Suggested-by: Andy Lutomirski <luto@amacapital.net>
Suggested-by: Michael Kerrisk <mtk.manpages@gmail.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dave Hansen <dave@sr71.net>
Link: http://lkml.kernel.org/r/20150108223022.7F56FD13@viggo.jf.intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22 21:11:06 +01:00
Dave Hansen c922228efe x86, mpx: Fix potential performance issue on unmaps
The 3.19 merge window saw some TLB modifications merged which caused a
performance regression. They were fixed in commit 045bbb9fa.

Once that fix was applied, I also noticed that there was a small
but intermittent regression still present.  It was not present
consistently enough to bisect reliably, but I'm fairly confident
that it came from (my own) MPX patches.  The source was reading
a relatively unused field in the mm_struct via arch_unmap.

I also noted that this code was in the main instruction flow of
do_munmap() and probably had more icache impact than we want.

This patch does two things:
1. Adds a static (via Kconfig) and dynamic (via cpuid) check
   for MPX with cpu_feature_enabled().  This keeps us from
   reading that cacheline in the mm and trades it for a check
   of the global CPUID variables at least on CPUs without MPX.
2. Adds an unlikely() to ensure that the MPX call ends up out
   of the main instruction flow in do_munmap().  I've added
   a detailed comment about why this was done and why we want
   it even on systems where MPX is present.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: luto@amacapital.net
Cc: Dave Hansen <dave@sr71.net>
Link: http://lkml.kernel.org/r/20150108223021.AEEAB987@viggo.jf.intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22 21:11:06 +01:00
Dave Hansen 814564a0a1 x86, mpx: Explicitly disable 32-bit MPX support on 64-bit kernels
We had originally planned on submitting MPX support in one patch
set.  We eventually broke it up in to two pieces for easier
review.  One of the features that didn't make the first round
was supporting 32-bit binaries on 64-bit kernels.

Once we split the set up, we never added code to restrict 32-bit
binaries from _using_ MPX on 64-bit kernels.

The 32-bit bounds tables are a different format than the 64-bit
ones.  Without this patch, the kernel will try to read a 32-bit
binary's tables as if they were the 64-bit version.  They will
likely be noticed as being invalid rather quickly and the app
will get killed, but that's kinda mean.

This patch adds an explicit check, and will make a 64-bit kernel
essentially behave as if it has no MPX support when called from
a 32-bit binary.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <dave@sr71.net>
Link: http://lkml.kernel.org/r/20150108223020.9E9AA511@viggo.jf.intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22 21:11:06 +01:00
Lucas Stach f175aa2c9f MAINTAINERS: Update Richard Zhu's email address
The old cryptic address bounces, fix it by using a properly working one.

Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Richard Zhu <Richard.Zhu@freescale.com>
2015-01-22 13:40:59 -06:00
Linus Torvalds f8de05ca38 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Martin Schwidefsky:
 "Five more bug fixes from Michael for the s390 BPF jit"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/bpf: Zero extend parameters before calling C function
  s390/bpf: Fix sk_load_byte_msh()
  s390/bpf: Fix offset parameter for skb_copy_bits()
  s390/bpf: Fix skb_copy_bits() parameter passing
  s390/bpf: Fix JMP_JGE_K (A >= K) and JMP_JGT_K (A > K)
2015-01-23 06:53:06 +12:00
Linus Torvalds fcb237317f nios2 fixes for v3.19-rc6
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.5 (GNU/Linux)
 
 iQIVAwUAVMDAS1WoEK+e3syCAQJB7A//SBSV6rbvPRhHddkzsBlAT2+saTkSJytz
 OG763mRDKFT5QbB30ClAXiNVMqvMK/C+++vnRkL5Nklp8ogPyOxlOS2JnYF77R55
 C6ekQbntQtlcq8X9pbFXSSexxhTbFWPW6YBgb2zenQWQqTkmI3mZ4uTa5f+uB4DK
 tnGNyY5SP6t1TLbM5oI0JOstcPwaDxH/s5+WeA+5Kutcc3m1W/xFu9po+XMGdjxy
 KT76a5uTMfzKtnGw5EjbtPuBoSU8MqBCZKg/BoDpyvkFLMD/s7fakiSJ6MZHBrDy
 Ov1ExP2WdC4s+jy9yFLfOSp3xSjKGicnUTuuUp1hI9blpOqmoTjivXITP1xeDtPg
 FWohBO/TqerROdH85b4seXj5BMgnrR58WaNK0RblIJSpTBzqDTsZRwcl348fWdvp
 LArsiCdgs14NtacrYng47nsi9Ys/pnGVHP7pdM53RY818qsei3ODv5Oba95n2pjW
 Qgv2CdkWlGY8dGQaPe61D6XapFQKctMy9HYi7Pou/n96510SHT2nJ5MWDjwa971i
 zF+xBbvbtsidUcJrYqslzAMGEBfH0CHAhEwpZjal3HfB9RjpdMrQSc7xggce/Brb
 DOSsNeFmnvkaYFhYjnstfn1Hf9Iz1H0KRaw3H0EgNq2qpV9WunfQ94HaQnNcV7Z0
 ZZZ0RyyJtaA=
 =ZFRY
 -----END PGP SIGNATURE-----

Merge tag 'nios2-fixes-v3.19-rc6' of git://git.rocketboards.org/linux-socfpga-next

Pull one arch/nios2 fix from Ley Foon Tan:
 "Fix kuser trampoline address"

* tag 'nios2-fixes-v3.19-rc6' of git://git.rocketboards.org/linux-socfpga-next:
  nios2: fix kuser trampoline address
2015-01-23 06:52:14 +12:00
Linus Torvalds 193934123c Surprising number of fixes this merge window :(
First two are minor fallout from the param rework which went in this merge
 window.
 
 Next three are a series which fixes a longstanding (but never previously
 reported and unlikely , so no CC stable) race between kallsyms and freeing
 the init section.
 
 Finally, a minor cleanup as our module refcount will now be -1 during
 unload.
 
 Thanks,
 Rusty.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJUwEmwAAoJENkgDmzRrbjx77kP/1cNQR2eG2sBwokg3q0tvHnQ
 IKqEXErW7NvxRa+RAMEmy2uQoGt6+uNklAbtyJEYM9oR1NieFbPi2yrt9Xn5SAXS
 Brp1S8WYBMilA3W3o6I0trFDRWHdpdtkKIQwLWgJNSEWjbTXh8bSwp/2X1rlOPyI
 ZmphCMOQMU2/uFEyJhTz1WMEV8eVXiRLN8OxSkPxToxdZoGln2U8IBCCCJC9OG+f
 Cf3eMgEcNdEXNcPKqr11NIcHkAx6M6qI/eMDOqk151PslHa8lbis6di9Z87aE0ps
 i8PyrkJGTmgM9cCjXwE8deNseeCmuKYlbPIF+NoxcqtvZstfaMrISwTIEuzV4JHi
 p13YhDxy4XiC3H6pKHub/jo7UCl+wWtFh9SqpqGgduFX/p6FtUHQJm0S0X/DFFZt
 C+2MFVSe6HRHE8B7bFz86+619Qd/rU7+806CLCE+NbYlYAKIBYKzWt/bml6VH3RJ
 OjwXhQqmznWhJjsfD3BUUUpZpHijmylI9gAe2F1oErb8YjRU6gIm7P8hlkOzD7AS
 TfGHPFq2raQcfAiGdVmvkbvvhvYZXnB3WVsAexrYoqrT9I8eEfRI+7SkL75MLR2E
 ikzhJS3SHkAUAd7fUVMt7xMwh0jmhsPjWCCqc13m6UUFoXhTaDgKgPGftltN0bI2
 g85+enZ3/eca6xh/KxvW
 =Kf9b
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux

Pull module and param fixes from Rusty Russell:
 "Surprising number of fixes this merge window :(

  The first two are minor fallout from the param rework which went in
  this merge window.

  The next three are a series which fixes a longstanding (but never
  previously reported and unlikely , so no CC stable) race between
  kallsyms and freeing the init section.

  Finally, a minor cleanup as our module refcount will now be -1 during
  unload"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
  module: make module_refcount() a signed integer.
  module: fix race in kallsyms resolution during module load success.
  module: remove mod arg from module_free, rename module_memfree().
  module_arch_freeing_init(): new hook for archs before module->module_init freed.
  param: fix uninitialized read with CONFIG_DEBUG_LOCK_ALLOC
  param: initialize store function to NULL if not available.
2015-01-23 06:40:36 +12:00
Tyrel Datwyler bcbde52b14 MAINTAINERS: ibmvscsi driver maintainer change
Change maintainer of ibmvscsi driver to Tyrel Datwyler.

Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Acked-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
Cc: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22 17:50:53 +01:00
Tyrel Datwyler 44b4dad9b5 MAINTAINERS: ibmvfc driver maintainer change
Change maintainer of ibmvfc driver to Tyrel Datwyler.

Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Cc: Nathan Fontenot <nfont@linux.vnet.ibm.com>
Cc: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22 17:50:53 +01:00
Dave Jiang 2a5a69d8f7 MAINTAINERS: Remove self as isci maintainer
Removing myself as a maintainer.

Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22 17:50:52 +01:00
Colin Ian King 6d310dfb38 scsi_debug: test always evaluates to false, || should be used instead
cppcheck found the following issue:
(warning) Logical conjunction always evaluates to false:
  alloc_len < 4 && alloc_len > 65535.

..the test should be instead:

  if (alloc_len < 4 || alloc_len > 65536)

This error was introduced by recent commit 38d5c8336e
("scsi_debug: add Report supported opcodes+tmfs; Compare and write")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22 17:50:52 +01:00
Pantelis Antoniou 15204ab1eb of/platform: Handle of_populate drivers in notifier
When using overlays with drivers calling of_populate the notifier
will try to create the device twice. Using the populated bit
before proceeding protects against this.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>
2015-01-22 15:36:55 +00:00
Pantelis Antoniou 3e7f7626fd of/overlay: Do not generate duplicate nodes
During the course of the rewrites a bug sneaked in when dealing
with children nodes of overlays, which ends up duplicating
sub nodes.

Simply remove the duplicate traversal of child nodes to fix.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>
2015-01-22 15:36:48 +00:00
Johannes Weiner 3c606d35fe cgroup: prevent mount hang due to memory controller lifetime
Since b2052564e6 ("mm: memcontrol: continue cache reclaim from
offlined groups"), re-mounting the memory controller after using it is
very likely to hang.

The cgroup core assumes that any remaining references after deleting a
cgroup are temporary in nature, and synchroneously waits for them, but
the above-mentioned commit has left-over page cache pin its css until
it is reclaimed naturally.  That being said, swap entries and charged
kernel memory have been doing the same indefinite pinning forever, the
bug is just more likely to trigger with left-over page cache.

Reparenting kernel memory is highly impractical, which leaves changing
the cgroup assumptions to reflect this: once a controller has been
mounted and used, it has internal state that is independent from mount
and cgroup lifetime.  It can be unmounted and remounted, but it can't
be reconfigured during subsequent mounts.

Don't offline the controller root as long as there are any children,
dead or alive.  A remount will no longer wait for these old references
to drain, it will simply mount the persistent controller state again.

Reported-by: "Suzuki K. Poulose" <Suzuki.Poulose@arm.com>
Reported-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2015-01-22 10:26:43 -05:00
Thomas Gleixner 5fbaba8603 Merge branch 'fortglx/3.19-stable/time' of https://git.linaro.org/people/john.stultz/linux into timers/urgent
Pull urgent fixes from John Stultz:

  Two urgent fixes for user triggerable time related overflow issues
2015-01-22 12:28:02 +01:00
Ley Foon Tan d24c8163b7 nios2: fix kuser trampoline address
__kuser_sigtramp address should be 0x1044 instead of 0x1040.

Signed-off-by: Ley Foon Tan <lftan@altera.com>
2015-01-22 17:05:16 +08:00
Shreyas B. Prabhu 0eb13208aa powerpc/powernv: Restore LPCR with LPCR_PECE1 cleared
LPCR_PECE1 bit controls whether decrementer interrupts are allowed to
cause exit from power-saving mode. While waking up from winkle, restoring
LPCR with LPCR_PECE1 set (i.e Decrementer interrupts allowed) can cause
issue in the following scenario:

- All the threads in a core are offlined. The core enters deep winkle.
- Spurious interrupt wakes up a thread in the core. Here LPCR is restored
  with LPCR_PECE1 bit set.
- Since it was a spurious interrupt on a offline thread, the thread clears
  the interrupt and goes back to winkle.
- Here before the thread executes winkle and puts the core into deep winkle,
  if a decrementer interrupt occurs on any of the sibling threads in the core
  that thread wakes up.
- Since in offline loop we are flushing interrupt only in case of external
  interrupt, the decrementer interrupt does not get flushed. So at this stage
  the thread is stuck in this is loop of waking up at 0x100 due to decrementer
  interrupt, not flushing the interrupt as only external interrupts get flushed,
  entering winkle, waking up at 0x100 again.

Fix this by programming PORE to restore LPCR with LPCR_PECE1 bit
cleared when waking up from winkle.

Signed-off-by: Shreyas B. Prabhu <shreyas@linux.vnet.ibm.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-01-22 17:22:57 +11:00
Olof Johansson 604beee864 Second Round of Renesas ARM Based SoC Fixes for v3.19
* Instantiate GIC from C board code in legacy builds on r8a7778 and r8a7779
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJUvax/AAoJENfPZGlqN0++7d4P/ic/OC82lPZuhmqCzdE03ptb
 8wvQNiQdHHA1q1hVZPC4cVGDqIymv9Si5q8AliPT5hqT2iSZIUjlTPe4WO350zSl
 qZZoAM4Qk6DzxFNw6I/+j7HcR9NEzCBpfCEkNH7peXzmrlGnAdBPKY0Lw9wf47a/
 uh4xwaKsi7583AN2m1NB9jYESUNXyP/lWEsA+goUqIZTudJLpcvML6y96nHJ9JEv
 5MXFAwVVDJ+huz6Q8hG3ImviUihiIWX25oQ2pmhFczPIf+RDHWDMhQd5Xp/5VBVn
 +3ckUFjXgzhYp5BvPvFhrU46nHolGALDbEIOGgMZwM8GRIA9ffAttK3j4Du1ixa3
 XDrNCbfOCeXfRAr+HcTHdwUtKcJxVz9oVZmlOMzc6yZfrAR0Y5dz3M8iUa2tqFqK
 +DUGstqm26rSwDVGkY7vElRz5nnQhb0/yWpUrO2Augsh04e28V5SkFiIHRFWJ/uT
 53h8qbqyDChw9ZVqg0Na01N0aVRa5a1XpYqtAEs+ta+y3/A35NVBToXhVh3aOQUt
 qAdFrwykyR32bMR0vUg8XVLm2rcaV87D6MDKGElKlkTxPoDK9+RPzfiu0sK4fmfV
 TULb9izepRRfJLDWTeDJm3uxbt1qaOVc1ry24R4HvDsC48BmfuZEVedIn9+Mp+SW
 xhrHiW1bUa3NL/p2BuPX
 =Mb4f
 -----END PGP SIGNATURE-----

Merge tag 'renesas-soc-fixes2-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes

Merge "Second Round of Renesas ARM Based SoC Fixes for v3.19" from Simon
Horman:

* Instantiate GIC from C board code in legacy builds on r8a7778 and r8a7779

* tag 'renesas-soc-fixes2-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  ARM: shmobile: r8a7779: Instantiate GIC from C board code in legacy builds
  ARM: shmobile: r8a7778: Instantiate GIC from C board code in legacy builds

Signed-off-by: Olof Johansson <olof@lixom.net>
2015-01-21 17:15:49 -08:00
Rusty Russell d5db139ab3 module: make module_refcount() a signed integer.
James Bottomley points out that it will be -1 during unload.  It's
only used for diagnostics, so let's not hide that as it could be a
clue as to what's gone wrong.

Cc: Jason Wessel <jason.wessel@windriver.com>
Acked-and-documention-added-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: Masami Hiramatsu <maasami.hiramatsu.pt@hitachi.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2015-01-22 11:15:54 +10:30
Sakari Ailus 2c0108e1c0 [media] omap3isp: Correctly set QUERYCAP capabilities
device_caps in struct v4l2_capability were inadequately set in
VIDIOC_QUERYCAP. Fix this. Without this a WARN_ON in the v4l2 core
is triggered. This WARN_ON was added for kernel 3.19 exactly to
detect these situations.

Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21 21:09:11 -02:00
Hans Verkuil 8d4d9329cd [media] cx23885: fix free interrupt bug
First free the interrupt, then disable the PCI device. The other way
around will lead to this warning:

Jan 19 11:42:02 telek kernel: [ 1440.161234] WARNING: CPU: 0 PID: 2191 at kernel/irq/manage.c:1311 __free_irq+0x97/0x1f0()
Jan 19 11:42:02 telek kernel: [ 1440.161236] Trying to free already-free IRQ 0
Jan 19 11:42:02 telek kernel: [ 1440.161237] Modules linked in: tda8290 tda10048 cx25840 cx23885(-) altera_ci tda18271 altera_stapl videobuf2_dvb tveeprom cx2341x videobuf2_dma_sg dvb_core rc_core videobuf2_memops videobuf2_core v4l2_common videodev media nouveau x86_pkg_temp_thermal cfbfillrect cfbimgblt cfbcopyarea ttm drm_kms_helper processor button isci
Jan 19 11:42:02 telek kernel: [ 1440.161266] CPU: 0 PID: 2191 Comm: rmmod Tainted: G        W      3.19.0-rc1-telek #345
Jan 19 11:42:02 telek kernel: [ 1440.161268] Hardware name: ASUSTeK COMPUTER INC. Z9PE-D8 WS/Z9PE-D8 WS, BIOS 5404 02/10/2014
Jan 19 11:42:02 telek kernel: [ 1440.161270]  ffffffff81bf1fce ffff8808958b7cc8 ffffffff8194a97f 0000000000000000
Jan 19 11:42:02 telek kernel: [ 1440.161274]  ffff8808958b7d18 ffff8808958b7d08 ffffffff810c56b0 0000000000000286
Jan 19 11:42:02 telek kernel: [ 1440.161279]  0000000000000000 0000000000000000 ffff88089f808890 ffff88089f808800
Jan 19 11:42:02 telek kernel: [ 1440.161284] Call Trace:
Jan 19 11:42:02 telek kernel: [ 1440.161290]  [<ffffffff8194a97f>] dump_stack+0x4f/0x7b
Jan 19 11:42:02 telek kernel: [ 1440.161295]  [<ffffffff810c56b0>] warn_slowpath_common+0x80/0xc0
Jan 19 11:42:02 telek kernel: [ 1440.161299]  [<ffffffff810c5731>] warn_slowpath_fmt+0x41/0x50
Jan 19 11:42:02 telek kernel: [ 1440.161303]  [<ffffffff81955d36>] ? _raw_spin_lock_irqsave+0x56/0x70
Jan 19 11:42:02 telek kernel: [ 1440.161307]  [<ffffffff81114849>] ? __free_irq+0x49/0x1f0
Jan 19 11:42:02 telek kernel: [ 1440.161311]  [<ffffffff81114897>] __free_irq+0x97/0x1f0
Jan 19 11:42:02 telek kernel: [ 1440.161316]  [<ffffffff81114a88>] free_irq+0x48/0xd0
Jan 19 11:42:02 telek kernel: [ 1440.161323]  [<ffffffffa00e6deb>] cx23885_finidev+0x4b/0x90 [cx23885]
Jan 19 11:42:02 telek kernel: [ 1440.161329]  [<ffffffff814529fa>] pci_device_remove+0x3a/0xc0
Jan 19 11:42:02 telek kernel: [ 1440.161334]  [<ffffffff8153b4ea>] __device_release_driver+0x7a/0xf0
Jan 19 11:42:02 telek kernel: [ 1440.161338]  [<ffffffff8153bc98>] driver_detach+0xc8/0xd0
Jan 19 11:42:02 telek kernel: [ 1440.161341]  [<ffffffff8153b1de>] bus_remove_driver+0x4e/0xb0
Jan 19 11:42:02 telek kernel: [ 1440.161345]  [<ffffffff8153c2eb>] driver_unregister+0x2b/0x60
Jan 19 11:42:02 telek kernel: [ 1440.161349]  [<ffffffff814525c5>] pci_unregister_driver+0x25/0x70
Jan 19 11:42:02 telek kernel: [ 1440.161355]  [<ffffffffa00f6ddc>] cx23885_fini+0x10/0x12 [cx23885]
Jan 19 11:42:02 telek kernel: [ 1440.161360]  [<ffffffff81139a98>] SyS_delete_module+0x1a8/0x1f0
Jan 19 11:42:02 telek kernel: [ 1440.161364]  [<ffffffff819561a9>] system_call_fastpath+0x12/0x17
Jan 19 11:42:02 telek kernel: [ 1440.161367] ---[ end trace a9c07cb5f3357020 ]---

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21 21:08:38 -02:00
Hans Verkuil 42639f6de6 [media] pvrusb2: fix missing device_caps in querycap
The VIDIOC_QUERYCAP function should set device_caps, but this was missing.
In addition, it set the version field as well, but that should be done by
the core, not by the driver.

If a driver doesn't set device_caps the v4l2 core will issue a WARN_ON, so
it's important that this is set correctly.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21 21:08:03 -02:00
Hans Verkuil 6cf11ee630 [media] vb2: fix vb2_thread_stop race conditions
The locking scheme inside the vb2 thread is unsafe when stopping the
thread. In particular kthread_stop was called *after* internal data
structures were cleaned up instead of doing that before. In addition,
internal vb2 functions were called after threadio->stop was set to
true and vb2_internal_streamoff was called. This is also not allowed.

All this led to a variety of race conditions and kernel warnings and/or
oopses.

Fixed by moving the kthread_stop call up before the cleanup takes
place, and by checking threadio->stop before calling internal vb2
queuing operations.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: <stable@vger.kernel.org>      # for v3.16 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21 21:07:26 -02:00
Nobuhiro Iwamatsu 42d74e4fe6 [media] rcar_vin: Update device_caps and capabilities in querycap
The V4L2 API requires both .capabilities and .device_caps fields of
struct v4l2_capability to be set. Otherwise the compliance checker
complains and since commit "v4l2-ioctl: WARN_ON if querycap didn't fill
device_caps" a compile-time warning is issued. Fix this non-compliance
in the rcar_vin driver.

Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21 21:05:58 -02:00
Guennadi Liakhovetski 7d96c3e446 [media] soc-camera: fix device capabilities in multiple camera host drivers
The V4L2 API requires both .capabilities and .device_caps fields of
struct v4l2_capability to be set. Otherwise the compliance checker
complains and since commit "v4l2-ioctl: WARN_ON if querycap didn't fill
device_caps" a compile-time warning is issued. Fix this non-compliance
in several soc-camera camera host drivers.

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21 21:05:45 -02:00