Commit Graph

482262 Commits

Author SHA1 Message Date
David Howells 054f6180d8 KEYS: Simplify KEYRING_SEARCH_{NO,DO}_STATE_CHECK flags
Simplify KEYRING_SEARCH_{NO,DO}_STATE_CHECK flags to be two variations of the
same flag.  They are effectively mutually exclusive and one or the other
should be provided, but not both.

Keyring cycle detection and key possession determination are the only things
that set NO_STATE_CHECK, except that neither flag really does anything there
because neither purpose makes use of the keyring_search_iterator() function,
but rather provides their own.

For cycle detection we definitely want to check inside of expired keyrings,
just so that we don't create a cycle we can't get rid of.  Revoked keyrings
are cleared at revocation time and can't then be reused, so shouldn't be a
problem either way.

For possession determination, we *might* want to validate each keyring before
searching it: do you possess a key that's hidden behind an expired or just
plain inaccessible keyring?  Currently, the answer is yes.  Note that you
cannot, however, possess a key behind a revoked keyring because they are
cleared on revocation.

keyring_search() sets DO_STATE_CHECK, which is correct.

request_key_and_link() currently doesn't specify whether to check the key
state or not - but it should set DO_STATE_CHECK.

key_get_instantiation_authkey() also currently doesn't specify whether to
check the key state or not - but it probably should also set DO_STATE_CHECK.

Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Chuck Lever <chuck.lever@oracle.com>
2014-12-01 22:52:50 +00:00
David Howells aa9d443789 KEYS: Fix the size of the key description passed to/from userspace
When a key description argument is imported into the kernel from userspace, as
happens in add_key(), request_key(), KEYCTL_JOIN_SESSION_KEYRING,
KEYCTL_SEARCH, the description is copied into a buffer up to PAGE_SIZE in size.
PAGE_SIZE, however, is a variable quantity, depending on the arch.  Fix this at
4096 instead (ie. 4095 plus a NUL termination) and define a constant
(KEY_MAX_DESC_SIZE) to this end.

When reading the description back with KEYCTL_DESCRIBE, a PAGE_SIZE internal
buffer is allocated into which the information and description will be
rendered.  This means that the description will get truncated if an extremely
long description it has to be crammed into the buffer with the stringified
information.  There is no particular need to copy the description into the
buffer, so just copy it directly to userspace in a separate operation.

Reported-by: Christian Kastner <debian@kvr.at>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Christian Kastner <debian@kvr.at>
2014-12-01 22:52:45 +00:00
Linus Torvalds 009d0431c3 Linux 3.18-rc7 2014-11-30 16:42:27 -08:00
Linus Torvalds df20ce5a6f Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
 "Two i915 regressions and one dual-gpu laptop radeon fix"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon: report disconnected for LVDS/eDP with PX if ddc fails
  drm/i915: Cancel vdd off work before suspend
  drm/i915: Ignore SURFLIVE and flip counter when the GPU gets reset
2014-11-30 16:21:37 -08:00
Chris Mason 2f19cad94c btrfs: zero out left over bytes after processing compression streams
Don Bailey noticed that our page zeroing for compression at end-io time
isn't complete.  This reworks a patch from Linus to push the zeroing
into the zlib and lzo specific functions instead of trying to handle the
corners inside btrfs_decompress_buf2page

Signed-off-by: Chris Mason <clm@fb.com>
Reviewed-by: Josef Bacik <jbacik@fb.com>
Reported-by: Don A. Bailey <donb@securitymouse.com>
cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-11-30 09:33:51 -08:00
Linus Torvalds 7a5a4f9787 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq fixes from Thomas Gleixner:
 "Three fixlets from the ARM SoC camp:
   - correct irqdomain initialization for atmel-aic
   - correct error handling for device tree parsing in bcm controllers"

* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip: brcmstb-l2: Fix error handling of irq_of_parse_and_map
  irqchip: bcm7120-l2: Fix error handling of irq_of_parse_and_map
  irqchip: atmel-aic: Fix irqdomain initialization
2014-11-29 10:49:24 -08:00
Linus Torvalds ed02bfa4aa SCSI fixes on 20141128
This is a set of ten fixes: 8 for UFS including four static checker warnings,
 a potential null deref in the voltage regulator code, a race on module unload,
 a ref counting fix on the well known LUNs which made it impossible to remove
 the ufs module and fix to correct the information in pwr_info.  In addition to
 UFS, there's a blacklist for the Intel Multi-Flex array which chokes on report
 supported operation codes and a fix to an oops in bnx2fc caused by shared
 skbs.
 
 Signed-off-by: James Bottomley <JBottomley@Parallels.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQEcBAABAgAGBQJUeXohAAoJEDeqqVYsXL0MKUMH/3/+cCrlKRHlYxY7wB3/7J4+
 iVF5zC75598YAXfFWSkQqcITRsL8Azd7A+hd58a1JDNaA3VrpGW0E5fEYcBekJB9
 wzbOPeAfq0G7hPfJ2nIP8exuJAAo84bHB3XmcduT0QubqfnQib1QG7oxX8qcGYP7
 PeP/aXGYe/b7E9m7xSAxuYsnvc/XZwKqmGcIdkvf+GRbke1DYR+52zYWa4alwgiY
 mKLZwn3LOOOGlYqbu6B1m4/Swfv1r5weWCtDXnHaX1Hy/wMZCR+GUtVfm+Qh3EXs
 5vLSk7BPNnTS/WEe/z3qYmnPAvFcEe7Z0fKxHxQT/n1F4AdvLds/B98C871UtiQ=
 =VKAj
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "This is a set of ten fixes: 8 for UFS including four static checker
  warnings, a potential null deref in the voltage regulator code, a race
  on module unload, a ref counting fix on the well known LUNs which made
  it impossible to remove the ufs module and fix to correct the
  information in pwr_info.

  In addition to UFS, there's a blacklist for the Intel Multi-Flex array
  which chokes on report supported operation codes and a fix to an oops
  in bnx2fc caused by shared skbs"

[ For us non-SCSI people: "UFS" here is "Universal Flash Storage" not
  the filesystem.  - Linus ]

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  ufs: fix NULL dereference when no regulators are defined
  ufs: ensure clk gating work is finished before module unloading
  scsi: ufs: fix static checker warning in ufshcd_parse_clock_info
  scsi: ufs: fix static checker warning in __ufshcd_setup_clocks
  scsi: ufs: fix static checker warning in ufshcd_populate_vreg
  scsi: ufs: fix static checker errors in ufshcd_system_suspend
  ufs: fix power info after link start-up
  ufs: fix reference counting of W-LUs
  scsi: add Intel Multi-Flex to scsi scan blacklist
  bnx2fc: do not add shared skbs to the fcoe_rx_list
2014-11-29 10:15:31 -08:00
Linus Torvalds 8891063871 Staging/IIO driver fixes for 3.18-rc7
Here are some Staging and IIO driver fixes for 3.18-rc7 that resolve a
 number of reported issues, and a new device id for a staging wireless
 driver.
 
 All of these have been in linux-next.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlR4+R4ACgkQMUfUDdst+ynr6ACgwT/lNLkrC9it9f46Wzlrx+G7
 vH0An1OPrgAGjpiu8LYou1CpzsJkMTAq
 =3+bs
 -----END PGP SIGNATURE-----

Merge tag 'staging-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging/IIO driver fixes from Greg KH:
 "Here are some staging and IIO driver fixes for 3.18-rc7 that resolve a
  number of reported issues, and a new device id for a staging wireless
  driver.

  All of these have been in linux-next"

* tag 'staging-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: r8188eu: Add new device ID for DLink GO-USB-N150
  staging: r8188eu: Fix scheduling while atomic error introduced in commit fadbe0cd
  iio: accel: bmc150: set low default thresholds
  iio: accel: bmc150: Fix iio_event_spec direction
  iio: accel: bmc150: Send x, y and z motion separately
  iio: accel: bmc150: Error handling when mode set fails
  iio: gyro: bmg160: Fix iio_event_spec direction
  iio: gyro: bmg160: Send x, y and z motion separately
  iio: gyro: bmg160: Don't let interrupt mode to be open drain
  iio: gyro: bmg160: Error handling when mode set fails
  iio: adc: men_z188_adc: Add terminating entry for men_z188_ids
  iio: accel: kxcjk-1013: Fix kxcjk10013_set_range
  iio: Fix IIO_EVENT_CODE_EXTRACT_DIR bit mask
2014-11-28 16:08:09 -08:00
Linus Torvalds 6f93840d56 TTY/Serial fix for 3.18-rc7
Here is a single revert for the of-serial driver that resolves a
 reported issue.
 
 This revert has been in linux-next for a while.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlR4+KcACgkQMUfUDdst+ykQiwCglYDZ1zGBpqulsviysX5vT1nM
 1ycAnjiZCWWodRGCF0lHyyl/mxtRb6G0
 =NquU
 -----END PGP SIGNATURE-----

Merge tag 'tty-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial fix from Greg KH:
 "Here is a single revert for the of-serial driver that resolves a
  reported issue.

  This revert has been in linux-next for a while"

* tag 'tty-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  Revert "serial: of-serial: add PM suspend/resume support"
2014-11-28 16:03:24 -08:00
Linus Torvalds 4742eb3dad USB fixes for 3.18-rc7
Here are some USB driver fixes and new device ids for 3.18-rc7.
 
 Full details are in the shortlog, and all of these have been in the
 linux-next tree for a while.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlR4+ZAACgkQMUfUDdst+ylSwQCfaS767td92FsGWX72y5nzt9+h
 HmoAoMT4V3REnelEXI8e6wc0vJs8BPlb
 =+Oc7
 -----END PGP SIGNATURE-----

Merge tag 'usb-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some USB driver fixes and new device ids for 3.18-rc7.

  Full details are in the shortlog, and all of these have been in the
  linux-next tree for a while"

* tag 'usb-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb-quirks: Add reset-resume quirk for MS Wireless Laser Mouse 6000
  usb: xhci: rework root port wake bits if controller isn't allowed to wakeup
  USB: xhci: Reset a halted endpoint immediately when we encounter a stall.
  Revert "xhci: clear root port wake on bits if controller isn't wake-up capable"
  USB: xhci: don't start a halted endpoint before its new dequeue is set
  USB: uas: Add no-uas quirk for Hitachi usb-3 enclosures 4971:1012
  USB: ssu100: fix overrun-error reporting
  USB: keyspan: fix overrun-error reporting
  USB: keyspan: fix tty line-status reporting
  usb: serial: ftdi_sio: add PIDs for Matrix Orbital products
  usb: dwc3: ep0: fix for dead code
  USB: serial: cp210x: add IDs for CEL MeshConnect USB Stick
2014-11-28 15:55:14 -08:00
Linus Torvalds cba3b00dea Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal
Pull thermal fixes from Eduardo Valentin:
 "In this -rc still very minor changes:

   - Lee Jones fixes compilation warning in sti thermal driver
   - Marjus Elfring removes unnecessary checks in exynos thermal driver
     (as per coccinelle)
   - Now we always update cpufreq policies, and thus get (hopefully)
     always in sync with cpufreq, thanks to Yadwinder"

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal:
  thermal: Exynos: Deletion of unnecessary checks before two function calls
  thermal: sti: Ignore suspend/resume functions when !PM_SLEEP
  thermal: cpu_cooling: Update always cpufreq policy with thermal constraints
2014-11-28 14:00:33 -08:00
Linus Torvalds 16cf45c09c sound fixes for 3.18-rc7
No excitement, here are only minor fixes: an endian fix for the
 new DSD format we added in 3.18, a fix for HP mute LED, and a
 fix for Native Instrument quirk.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJUeC5WAAoJEGwxgFQ9KSmkaR4P/0NQWq7Vd5DsRk2DSW1XhYpQ
 gZlpxWwc7De4W4MsZQtWSQQn1e3Mm6OYa0srZGzmFQTI1ZBXLZq9O/wott4Q6QgZ
 lrWWBzgFenguA8r0bl/VGhFpySt/RE+8hi5Z/vMNG3ATHZxq3DzwE3xB3CaOc+ON
 PI5ba7XGLz2Q9txTaFD0g0EZT0uLpZnRZZDD12cHCPvAUIGL1IdvSQio3NFlia+l
 9gCTe8uZ8BPUt1+LYAcbVKl5xZn8vVOw9fUbcFj7OOoFu48ve2GgtHRVWdYyI9k9
 F6yBOMUQtw+XyKvlcectNbEX/6ORewIV0m15damK4REMQeCapGIaoTXMB6yRd3Ld
 zyj1Ld/JAxqrd3Iy0wF4tP/SHy+fJ1e+WSe5rIurCMlUa4CXkSwX65n1DCuonbsG
 GsVaXlspSk2j/ZhkqB0rDqTQKqKxSrutqHHwwsfA41iRpOUECmUZU8wM/mj/0THV
 0RoWYbJjc0STs+x0ysVo2OudumnMcEhx56SHqJK8Kr1y16m9boxn2exk139qMDb/
 Ua6ZGxJiohNICzHsADDcETtnfzOc1bTDhyP058cKAmtmw/U91zpyEAp40xAUe+hL
 Ix/z8yVjyIM8RLNizxad90s00hpOmOHDp/idLH4Ok8DoDx97IVhHzqyu8mbiTp8A
 wb69fsQApL/lRoTVDbtU
 =azkh
 -----END PGP SIGNATURE-----

Merge tag 'sound-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "No excitement, here are only minor fixes: an endian fix for the new
  DSD format we added in 3.18, a fix for HP mute LED, and a fix for
  Native Instrument quirk"

* tag 'sound-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: pcm: Add big-endian DSD sample formats and fix XMOS DSD sample format
  ALSA: hda - One more HP machine needs to change mute led quirk
  ALSA: usb-audio: Use snd_usb_ctl_msg() for Native Instruments quirk
2014-11-28 13:54:53 -08:00
Linus Torvalds 615b994e64 ARM: SoC fixes for 3.18-rc7
Just four simple fixes this week:
 
 - one missing of_node_put() on armv7 based mvebu
 - forcing the USB host into the right mode on Chromebook (exynos5-snow)
 - enabling two important drivers for exynos_defconfig
 - fixing a noncritical bug for tegra that would cause a
   regression with common code patches queued for 3.19
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIVAwUAVHh5G2CrR//JCVInAQKkFxAAukN2SEF7pRWfnnse7WPks+jem5Ye+67g
 WwfZclkSz2RujZRmtCENK1AK4ZI5vmdtu+xBB3OTm/GQZjmkfQNYgfQOMdaVaG7y
 Y2SDSVCzZFSboQtc45oAXZZ/xVAAEevWf/kT9PWyXn6GJ48zLNOtCofrw7RE89lg
 uz7/BTjc/4m0vlwAL6l38EMSin3I5peXBQ4pOGYqts0ADOKhSrW9Zv5kk7wyeDwC
 IWMQIb6p2hZ+KDRpzbA0vpAXESzVcJLLsGQpCuCNCy/2iv8guIMhc/A6nzBQibl2
 GDmXsWUC66+hpp509UxuiYLMFhDpoWmEEuR18g2DHT/9/nxhvxqfOOLwjHHE1bts
 5eN62IGQ/Onosvch+1P5MHe+SJ1hpIhGA/nF/kW6JfzaRzOhlvIhGLTD/bXXXRtB
 rNNRDxp0eymHLTC+zyzIaEYs6ND9mxAIY+l2Cr3st6rlwPMdIuvwwJHRIOPai4N+
 z/h1ouXRuyf8yj6Vyn0UDkNuWNFwSQocs1at4AgDreG5HZ5lMSQBbWu674p/7x9p
 o56HRKIZT0Ou4dsAWJMAsS8WEbdMdTstyj7dZbUijcTTv80BdoZe8jWiNo8O++4E
 P9Zqq+Dn+PKWOn7vbAkvank6rRcrhk5F/E118pEV9Plvdv+/wxMDLnHm+YB0ah17
 7qtVIXv1B/Y=
 =68UY
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-for-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC fixes from Arnd Bergmann:
 "Not much interesting going on fixes-wise for us this week, as it
  should be for an -rc7.  I'm not expecting Olof to work much over
  Thanksgiving weekend, so I decided to take over again and push these
  out to you.

  Just four simple fixes this week:

   - one missing of_node_put() on armv7 based mvebu
   - forcing the USB host into the right mode on Chromebook
     (exynos5-snow)
   - enabling two important drivers for exynos_defconfig
   - fixing a noncritical bug for tegra that would cause a regression
     with common code patches queued for 3.19"

* tag 'armsoc-for-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: tegra: irq: fix buggy usage of irq_data irq field
  ARM: exynos_defconfig: Enable max77802 rtc and clock drivers
  ARM: dts: Explicitly set dr_mode on exynos5250-snow
  ARM: mvebu: add missing of_node_put() call in coherency.c
2014-11-28 13:34:32 -08:00
Linus Torvalds e818d5ed2a Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm
Pull ARM fixes from Russell King:
 "Another round of relatively small ARM fixes.

  Thomas spotted that the strex backoff delay bit was a disable bit, so
  it needed to be clear for this to work.  Vladimir spotted that using a
  restart block for the cache flush operation would return -EINTR, which
  userspace was not expecting.  Dmitry spotted that the auxiliary
  control register accesses for Xscale were not correct"

* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
  ARM: 8226/1: cacheflush: get rid of restarting block
  ARM: 8222/1: mvebu: enable strex backoff delay
  ARM: 8216/1: xscale: correct auxiliary register in suspend/resume
2014-11-28 13:32:47 -08:00
Dave Airlie 21124e5c52 Merge tag 'drm-intel-fixes-2014-11-27' of git://anongit.freedesktop.org/drm-intel into drm-fixes
Two regression fixes from Ville.

* tag 'drm-intel-fixes-2014-11-27' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Cancel vdd off work before suspend
  drm/i915: Ignore SURFLIVE and flip counter when the GPU gets reset
2014-11-28 13:56:31 +10:00
Linus Torvalds 98e8d2e094 Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus
Pull mips fixes from Ralf Baechle:
 "The hopefully final round of fixes for 3.18:

   - Fix a number of build errors affecting particular configurations.
   - Handle EVA correctly when flushing a signal trampoline and dcache
     lines.
   - Fix printks printing jibberish.
   - Handle 64 bit memory addresses correctly when adding memory chunk
     on 32 bit kernels.
   - Fix a race condition in the hardware tablewalker code"

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
  MIPS: tlbex: Fix potential HTW race on TLBL/M/S handlers
  MIPS: Fix address type used for early memory detection.
  MIPS: Kconfig: Don't allow both microMIPS and SmartMIPS to be selected.
  MIPS: kernel: cps-vec: Set ISA level to mips32r2 for the MIPS MT ASE
  MIPS: Netlogic: handle modular AHCI builds
  MIPS: Netlogic: handle modular USB case
  MIPS: Loongson: Make platform serial setup always built-in.
  MIPS: fix EVA & non-SMP non-FPU FP context signal handling
  MIPS: cpu-probe: Set the FTLB probability bit on supported cores
  MIPS: BMIPS: Fix ".previous without corresponding .section" warnings
  MIPS: uaccess.h: Fix strnlen_user comment.
  MIPS: r4kcache: Add EVA case for protected_writeback_dcache_line
  MIPS: Fix info about plat_setup in arch_mem_init comment
  MIPS: rtlx: Remove KERN_DEBUG from pr_debug() arguments in rtlx.c
  MIPS: SEAD3: Fix LED device registration.
  MIPS: Fix a copy & paste error in unistd.h
2014-11-27 18:32:49 -08:00
Linus Torvalds 21f122f472 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux
Pull powerpc fixes from Michael Ellerman:
 "Here are five fixes for you to pull please.

  They're all CC'ed to stable except the "Fix PE state format" one which
  went in this release"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux:
  powerpc: 32 bit getcpu VDSO function uses 64 bit instructions
  powerpc/powernv: Replace OPAL_DEASSERT_RESET with EEH_RESET_DEACTIVATE
  powerpc/eeh: Fix PE state format
  powerpc/pseries: Fix endiannes issue in RTAS call from xmon
  powerpc/powernv: Fix the hmi event version check.
2014-11-27 18:23:41 -08:00
Linus Torvalds ae979430e3 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc
Pull sparc fixlet from David Miller:
 "Aparc fix to add dma_cache_sync(), even if a nop it should be provided
  if dma_{alloc,free}_noncoherent() is provided too"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
  sparc: Add NOP dma_cache_sync() implementation.
2014-11-27 18:19:25 -08:00
Linus Torvalds 8e8459719c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:
 "Several small fixes here:

   1) Don't crash in tg3 driver when the number of tx queues has been
      configured to be different from the number of rx queues.  From
      Thadeu Lima de Souza Cascardo.

   2) VLAN filter not disabled properly in promisc mode in ixgbe driver,
      from Vlad Yasevich.

   3) Fix OOPS on dellink op in VTI tunnel driver, from Xin Long.

   4) IPV6 GRE driver WCCP code checks skb->protocol for ETH_P_IP
      instead of ETH_P_IPV6, whoops.  From Yuri Chislov.

   5) Socket matching in ping driver is buggy when packet AF does not
      match socket's AF.  Fix from Jane Zhou.

   6) Fix checksum calculation errors in VXLAN due to where the
      udp_tunnel6_xmit_skb() helper gets it's saddr/daddr from.  From
      Alexander Duyck.

   7) Fix 5G detection problem in rtlwifi driver, from Larry Finger.

   8) Fix NULL deref in tcp_v{4,6}_send_reset, from Eric Dumazet.

   9) Various missing netlink attribute verifications in bridging code,
      from Thomas Graf.

  10) tcp_recvmsg() unconditionally calls ipv4 ip_recv_error even for
      ipv6 sockets, whoops.  Fix from Willem de Bruijn"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (29 commits)
  net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks
  bridge: Sanitize IFLA_EXT_MASK for AF_BRIDGE:RTM_GETLINK
  bridge: Add missing policy entry for IFLA_BRPORT_FAST_LEAVE
  net: Check for presence of IFLA_AF_SPEC
  net: Validate IFLA_BRIDGE_MODE attribute length
  bridge: Validate IFLA_BRIDGE_FLAGS attribute length
  stmmac: platform: fix default values of the filter bins setting
  net/mlx4_core: Limit count field to 24 bits in qp_alloc_res
  net: dsa: bcm_sf2: reset switch prior to initialization
  net: dsa: bcm_sf2: fix unmapping registers in case of errors
  tg3: fix ring init when there are more TX than RX channels
  tcp: fix possible NULL dereference in tcp_vX_send_reset()
  rtlwifi: Change order in device startup
  rtlwifi: rtl8821ae: Fix 5G detection problem
  Revert "netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse"
  vxlan: Fix boolean flip in VXLAN_F_UDP_ZERO_CSUM6_[TX|RX]
  ip6_udp_tunnel: Fix checksum calculation
  net-timestamp: Fix a documentation typo
  net/ping: handle protocol mismatching scenario
  af_packet: fix sparse warning
  ...
2014-11-27 18:05:05 -08:00
Linus Torvalds 190fc9d968 spi: Fixes for v3.18
There's a couple of driver fixes here, plus one core fix for the DMA
 mapping which wasn't doing the right thing for vmalloc()ed addresses
 that hadn't been through kmap().  It's fairly rare to use vmalloc() with
 SPI and it's a subset of those users who might fail so it's unsurprising
 that this wasn't noticed sooner.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJUdiZZAAoJECTWi3JdVIfQ4ncH/Rf8zsdc2sWT791fOHEuWBAF
 vIAuyVKKoaJXY/mGvzJ/afm9Qjkr//fhlVJCvjwAS+vTKCfe/yi5x4ic+gcgHU+Q
 S5FuRdAvTeN9chIGIY/0A5u0p9Y2tSEzhyw5RIVtyLJpRgWP7mIhuP7zdFECzFEx
 A9VtH30dQdcVXFVIcfXoo2ltzcvWSampZIb6NezWkz5foNWJk4KxQ34TkgEDUioT
 TIEXX0e4C2KqQuibeiz/GFgfPlqgu1wXfS8XKtUN4LXj6Yz1BS2ADTBK4i3tx9M/
 iBwwj6cd1n8ESYJno0kCBOvoTTHnuWmOPRVt3BIzI7wzjCnP/uD/4oWEmFafx0w=
 =/6dY
 -----END PGP SIGNATURE-----

Merge tag 'spi-v3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "There's a couple of driver fixes here, plus one core fix for the DMA
  mapping which wasn't doing the right thing for vmalloc()ed addresses
  that hadn't been through kmap().  It's fairly rare to use vmalloc()
  with SPI and it's a subset of those users who might fail so it's
  unsurprising that this wasn't noticed sooner"

* tag 'spi-v3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: sirf: fix word width configuration
  spi: Fix mapping from vmalloc-ed buffer to scatter list
  spi: dw: Fix dynamic speed change.
2014-11-27 17:55:42 -08:00
Linus Torvalds 0210bb6083 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input layer fixes from Dmitry Torokhov:
 "The main change is to fix breakage in Elantech driver introduced by
  the recent commit adding trackpoint reporting to protocol v4.  Now we
  are trusting the hardware to advertise the trackpoint properly and do
  not try to decode the data as trackpoint if firmware told us it is not
  present"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: xpad - use proper endpoint type
  Input: elantech - trust firmware about trackpoint presence
  Input: synaptics - adjust min/max on Thinkpad E540
2014-11-27 17:51:50 -08:00
Larry Finger 6d4556fc03 staging: r8188eu: Add new device ID for DLink GO-USB-N150
The DLink GO-USB-N150 with revision B1 uses this driver.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-11-27 08:55:01 -08:00
Leonid Yegoshin 070e76cb3f MIPS: tlbex: Fix potential HTW race on TLBL/M/S handlers
There is a potential race when probing the TLB in TLBL/M/S exception
handlers for a matching entry. Between the time we hit a TLBL/S/M
exception and the time we get to execute the TLBP instruction, the
HTW may have replaced the TLB entry we are interested in hence the TLB
probe may fail. However, in the existing handlers, we never checked the
status of the TLBP (ie check the result in the C0/Index register). We
fix this by adding such a check when the core implements the HTW. If
we couldn't find a matching entry, we return back and try again.

Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Reviewed-by: James Hogan <james.hogan@imgtec.com>
Cc: <stable@vger.kernel.org> # v3.17+
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/8599/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2014-11-27 17:21:56 +01:00
Vladimir Murzin 3f4aa45cee ARM: 8226/1: cacheflush: get rid of restarting block
We cannot restart cacheflush safely if a process provides user-defined
signal handler and signal is pending. In this case -EINTR is returned
and it is expected that process re-invokes syscall. However, there are
a few problems with that:
 * looks like nobody bothers checking return value from cacheflush
 * but if it did, we don't provide the restart address for that, so the
   process has to use the same range again
 * ...and again, what might lead to looping forever

So, remove cacheflush restarting code and terminate cache flushing
as early as fatal signal is pending.

Cc: stable@vger.kernel.org # 3.12+
Reported-by: Chanho Min <chanho.min@lge.com>
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2014-11-27 15:55:35 +00:00
Thomas Petazzoni 995ab5189d ARM: 8222/1: mvebu: enable strex backoff delay
Under extremely rare conditions, in an MPCore node consisting of at
least 3 CPUs, two CPUs trying to perform a STREX to data on the same
shared cache line can enter a livelock situation.

This patch enables the HW mechanism that overcomes the bug. This fixes
the incorrect setup of the STREX backoff delay bit due to a wrong
description in the specification.

Note that enabling the STREX backoff delay mechanism is done by
leaving the bit *cleared*, while the bit was currently being set by
the proc-v7.S code.

[Thomas: adapt to latest mainline, slightly reword the commit log, add
stable markers.]

Fixes: de4901933f ("arm: mm: Add support for PJ4B cpu and init routines")

Cc: <stable@vger.kernel.org> # v3.8+
Signed-off-by: Nadav Haklai <nadavh@marvell.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Acked-by: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2014-11-27 15:55:04 +00:00
Arnd Bergmann 96ba18ffd0 mvebu fixes for v3.18 (round 2)
- mvebu
     - coherency.c needed an of_node_put()
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJUdVscAAoJEP45WPkGe8ZnPpEP/Al0FDmdX+cZVBgqUqCT5I0L
 dIljNZPXtBoORDZ88te9w66ELx3mzdEQOuW5nN5wPKVdlL3l9jchEPWGcr/Vy/hn
 ZA0CoRC+51d43puru5zPHfx3WTn9TvoOnVUhSdsOmaYlduysBXV4AJciEKGNXyzQ
 35qKNM3EHWENbIjh9a3wmIAn94AzKarFoSfTmF2LcpwN0hZcp5VFr9y30Gx6r8nE
 z2AguA7I8Yzms9cJv+adaK5We/wTfHNJECvGNDjIEAZOOqNrOx2diGmOrEMCJdSG
 5q/Kh0zxlbtgrTY/br7Ggym0XFGCouj4/OLeMtbLOCZYFpIubD4ltMItjZuOwgDp
 VW9ApO9k9jJcV/EmT1LEfE6C/Qlt8wfX/g1L5+MMKti315fymyJ4P4jj+F8c8ve9
 qy3fVCOz8f4fSH7yWorVypVNvl1lP7xLWv9vIxOHBtS7mlcYjUrsqDPW63Zg90Jz
 uQR9+F/8YhW7U/wNm2bMZGm+g3EskXgRnKXCnZmuOCWqtkux+u4nVsdAa/lghvMy
 yKemZobnse2G9En82rdA4R2Br552OsI09m9r5ZJYl34qTzSClkvaae9OhOziXtKV
 rpq1aT6SPux3Xux5mLBSS80sTqbaXu6RxCW4apfmrnG8ZrqP8YTNCHR5K4Ewdsy7
 k/XPhl0QiVh6PdBTwJf/
 =e1Lu
 -----END PGP SIGNATURE-----

Merge tag 'mvebu-fixes-3.18-2' of git://git.infradead.org/linux-mvebu into fixes

Pull "mvebu fixes for v3.18 (round 2)" frm Jason Cooper:

 - mvebu
    - coherency.c needed an of_node_put()

* tag 'mvebu-fixes-3.18-2' of git://git.infradead.org/linux-mvebu:
  ARM: mvebu: add missing of_node_put() call in coherency.c

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-11-27 14:29:23 +01:00
Arnd Bergmann a572c9dd83 Samsung defconfig update for v3.18
- enable max77802 rtc and clock drivers for exynos_defconfig
   : enable the kernel config options to have the drivers for
     max77802 including rtc and 2-ch 32kHz clock outputs
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJUbzu+AAoJEA0Cl+kVi2xqKVsP/iV4UkX2poWBOvU/RQMx9Spb
 JEHyBmfsco/qCfQDE+yMttWfvzLgc1zURFDiZqIvk//jp+LjSDGXWEEPo/WMyXBN
 FUXAijltgzz2aqPiFNWwzbqVHbxnfLBybjasAahmv8rvYyu2LAex+n9k/OKC1F9o
 JwptV3w1GISMWMdE/ed6wsfIhpmshlYax6IYOK4+iJyviexV7xi3qBAeAT9CtR0n
 uEG76+coSWNnSR21RM69SWCf2FzMlNO6YjaTq+6D5Gd45q/CfnUF7XtZgdBC56IJ
 u6WGvHZB7Bh/aPOxJWEpWGKAk6k4FYDzYKo7b64nD+8xHTvgTi28nYsjtKZAJNo0
 9Q/9U5AQKsmE1nPU4NHCEednMUGSYKuKqQvUXOThr/qvSasCzbsoKot3sjOxZ4FA
 4rkj4AwV8f78nfwLH19yPAep6Ba2ldFRTgoYUdm6ZBXqrkl1QbiBzcFMJDJqOdqc
 KjQd7/iwRO+uvwE+4RB94koYTzzqUSsUJTWKFHZZdc2ZzyhfMPTdY3W0r4daf+TH
 Ydm+MHUM9UDXUdYRLtCLqjb9R4+v/KQRHgjMD+db6ISQPpSuiNv8eGAS6wVJLxsb
 UMpW2mYA9JW2bJNlJuP26CkJ/j0rs9BPD/c0CgwFpCvzODvK9LCY1GTUef+w9C3S
 oOCMbrtSNTqupaTsN8DR
 =gg9h
 -----END PGP SIGNATURE-----

Merge tag 'samsung-defconfig-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes

Pull "Samsung defconfig update for v3.18" from Kukjin Kim:

- enable max77802 rtc and clock drivers for exynos_defconfig
  : enable the kernel config options to have the drivers for
    max77802 including rtc and 2-ch 32kHz clock outputs

* tag 'samsung-defconfig-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
  ARM: exynos_defconfig: Enable max77802 rtc and clock drivers

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-11-27 14:26:52 +01:00
Arnd Bergmann d168c852d3 Samsung fixes for v3.18
- explicitly set dr_mode on exynos5250-snow
   this is required when kernel is built with USB gadget support.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJUbzslAAoJEA0Cl+kVi2xq+McP/0pVBRa2lBe+RATj+bn6qzlV
 2GzcpcjaSZviUovrNputE4puwsuz7+DslIWMXvbKQLt7NJfuNrPvnveKhCGFi/nV
 Mn6TpZnMSkWQK0x8wXwq1wgOX0kRTFZFg0YEA3HvmUyLTpe9cx+yOxPgkvG0RdoH
 SY+UOtZv6zy5znD177UEEqB3EfwnaAwJB8uJY0Vv1vAXa4edm3KoTAuuRMvewbZ/
 73I3Qr4saezDSHsu00pv+Rx6rc7C3UIDi9W4AjG1hd5QYbDAMDgdXrxNiWEPI/il
 a4iCsOv2amLewY8YBnEo1Up0U0T+o1KsM4BtyUXrLU0q9y8wv+/vYocpbbSnqbCs
 clErECT51+tTbFvKlROTdsQfl3w0z8K91MXLH0Nh5pBS/5UfQ2e7mmxluJ+t2mW4
 GU4X7GV7zKIdOXxCnTKFttv+O9IWSE/s31sIoCQqnKqWf7ZmsoJ6Et3r4bp0piFP
 +DNhf/e5NQ9a11wHOQPKPJB1Ddv32SZuyaNL9GVlF0QgJA8hFoji8QZFd4P5qJb4
 vynqhARTvV1+fiLkOzkI31fiUpXQtm0HcRAYJC1jIYEUkbaPs9VPgMbJ4wGUFmz3
 6/tXSoE/g/69IIpKUxzB/rXt9oGw1H5QqgqV9mB6xqw3uM9a1suQoL0J1t5Qeb5J
 nKlvoI6yOSmXg188f/PS
 =R/UY
 -----END PGP SIGNATURE-----

Merge tag 'samsung-fixes-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes

Pull "Samsung fixes for v3.18" from Kukjin Kim:

- explicitly set dr_mode on exynos5250-snow
  this is required when kernel is built with USB gadget support.

* tag 'samsung-fixes-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
  ARM: dts: Explicitly set dr_mode on exynos5250-snow

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-11-27 14:24:41 +01:00
Marc Zyngier 9a343b9eb8 ARM: tegra: irq: fix buggy usage of irq_data irq field
The crazy gic_arch_extn thing that Tegra uses contains multiple
references to the irq field in struct irq_data, and uses this
to directly poke hardware register.

But irq is the *virtual* irq number, something that has nothing
to do with the actual HW irq (stored in the hwirq field). And once
we put the stacked domain code in action, the whole thing explodes,
as these two values are *very* different:

root@bacon-fat:~# cat /proc/interrupts
            CPU0       CPU1
 16:      25801       2075       GIC  29  twd
 17:          0          0       GIC  73  timer0
112:          0          0      GPIO  58  c8000600.sdhci cd
123:          0          0      GPIO  69  c8000200.sdhci cd
279:       1126          0       GIC 122  serial
281:          0          0       GIC  70  7000c000.i2c
282:          0          0       GIC 116  7000c400.i2c
283:          0          0       GIC 124  7000c500.i2c
284:        300          0       GIC  85  7000d000.i2c
[...]

Just replacing all instances of irq with hwirq fixes the issue.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-11-27 14:01:55 +01:00
Dave Airlie 8e4890fbfb Merge branch 'drm-fixes-3.18' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
one fix for PX laptops.

* 'drm-fixes-3.18' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: report disconnected for LVDS/eDP with PX if ddc fails
2014-11-27 13:01:57 +10:00
Alex Deucher 1348579433 drm/radeon: report disconnected for LVDS/eDP with PX if ddc fails
If ddc fails, presumably the i2c mux (and hopefully the signal
mux) are switched to the other GPU so don't fetch the edid from
the vbios so that the connector reports disconnected.

bug:
https://bugzilla.opensuse.org/show_bug.cgi?id=904417

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2014-11-26 20:56:37 -05:00
Anton Blanchard 152d44a853 powerpc: 32 bit getcpu VDSO function uses 64 bit instructions
I used some 64 bit instructions when adding the 32 bit getcpu VDSO
function. Fix it.

Fixes: 18ad51dd34 ("powerpc: Add VDSO version of getcpu")
Cc: stable@vger.kernel.org
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-11-27 09:42:12 +11:00
Gavin Shan 360d88a9e3 powerpc/powernv: Replace OPAL_DEASSERT_RESET with EEH_RESET_DEACTIVATE
The flag passed to ioda_eeh_phb_reset() should be EEH_RESET_DEACTIVATE,
which is translated to OPAL_DEASSERT_RESET or something else by the
EEH backend accordingly.

The patch replaces OPAL_DEASSERT_RESET with EEH_RESET_DEACTIVATE for
ioda_eeh_phb_reset().

Cc: stable@vger.kernel.org
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-11-27 09:40:32 +11:00
Gavin Shan 7531473c30 powerpc/eeh: Fix PE state format
Obviously I had wrong format given to the PE state output from
/sys/bus/pci/devices/xxxx/eeh_pe_state with some typoes, which
was introduced by commit 2013add4ce. The patch fixes it up.

Fixes: 2013add4ce ("powerpc/eeh: Show hex prefix for PE state sysfs")
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-11-27 09:32:58 +11:00
Laurent Dufour 3b8a3c0109 powerpc/pseries: Fix endiannes issue in RTAS call from xmon
On pseries system (LPAR) xmon failed to enter when running in LE mode,
system is hunging. Inititating xmon will lead to such an output on the
console:

SysRq : Entering xmon
cpu 0x15: Vector: 0  at [c0000003f39ffb10]
    pc: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70
    lr: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70
    sp: c0000003f39ffc70
   msr: 8000000000009033
  current = 0xc0000003fafa7180
  paca    = 0xc000000007d75e80	 softe: 0	 irq_happened: 0x01
    pid   = 14617, comm = bash
Bad kernel stack pointer fafb4b0 at eca7cc4
cpu 0x15: Vector: 300 (Data Access) at [c000000007f07d40]
    pc: 000000000eca7cc4
    lr: 000000000eca7c44
    sp: fafb4b0
   msr: 8000000000001000
   dar: 10000000
 dsisr: 42000000
  current = 0xc0000003fafa7180
  paca    = 0xc000000007d75e80	 softe: 0	 irq_happened: 0x01
    pid   = 14617, comm = bash
cpu 0x15: Exception 300 (Data Access) in xmon, returning to main loop
xmon: WARNING: bad recursive fault on cpu 0x15

The root cause is that xmon is calling RTAS to turn off the surveillance
when entering xmon, and RTAS is requiring big endian parameters.

This patch is byte swapping the RTAS arguments when running in LE mode.

Cc: stable@vger.kernel.org
Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-11-27 09:32:57 +11:00
Mahesh Salgaonkar 6acbc5a1da powerpc/powernv: Fix the hmi event version check.
The current HMI event structure is an ABI and carries a version field to
accommodate future changes without affecting/rearranging current structure
members that are valid for previous versions.

The current version check "if (hmi_evt->version != OpalHMIEvt_V1)"
doesn't accomodate the fact that the version number may change in
future.

If firmware starts returning an HMI event with version > 1, this check
will fail and no HMI information will be printed on older kernels.

This patch fixes this issue.

Cc: stable@vger.kernel.org # 3.17+
Signed-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
[mpe: Reword changelog]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2014-11-27 09:32:52 +11:00
Larry Finger 33dc85c3c6 staging: r8188eu: Fix scheduling while atomic error introduced in commit fadbe0cd
In commit fadbe0cd52 entitled "staging:
rtl8188eu:Remove rtw_zmalloc(), wrapper for kzalloc()", the author failed
to note that the original code in the wrapper tested whether the caller
could sleep, and set the flags argument to kzalloc() appropriately.
After the patch, GFP_KERNEL is used unconditionally. Unfortunately, several
of the routines may be entered from an interrupt routine and generate
a BUG splat for every such call. Routine rtw_sitesurvey_cmd() is used in the
example below:

BUG: sleeping function called from invalid context at mm/slub.c:1240
in_atomic(): 1, irqs_disabled(): 0, pid: 756, name: wpa_supplicant
INFO: lockdep is turned off.
CPU: 2 PID: 756 Comm: wpa_supplicant Tainted: G        WC O   3.18.0-rc4+ #34
Hardware name: TOSHIBA TECRA A50-A/TECRA A50-A, BIOS Version 4.20   04/17/2014
ffffc90005557000 ffff880216fafaa8 ffffffff816b0bbf 0000000000000000
ffff8800c3b58000 ffff880216fafac8 ffffffff8107af77 0000000000000001
0000000000000010 ffff880216fafb18 ffffffff811b06ce 0000000000000000
Call Trace:
 [<ffffffff816b0bbf>] dump_stack+0x4e/0x71
 [<ffffffff8107af77>] __might_sleep+0xf7/0x120
 [<ffffffff811b06ce>] kmem_cache_alloc_trace+0x4e/0x1f0
 [<ffffffffa0888226>] ? rtw_sitesurvey_cmd+0x56/0x2a0 [r8188eu]
 [<ffffffffa0888226>] rtw_sitesurvey_cmd+0x56/0x2a0 [r8188eu]
 [<ffffffffa088f00d>] rtw_do_join+0x22d/0x370 [r8188eu]
 [<ffffffffa088f6e8>] rtw_set_802_11_ssid+0x218/0x3d0 [r8188eu]
 [<ffffffffa08c3ca5>] rtw_wx_set_essid+0x1e5/0x410 [r8188eu]
 [<ffffffffa08c3ac0>] ? rtw_wx_get_rate+0x50/0x50 [r8188eu]
 [<ffffffff816938f1>] ioctl_standard_iw_point+0x151/0x3f0
 [<ffffffff81693d52>] ioctl_standard_call+0xb2/0xe0
 [<ffffffff81597df7>] ? rtnl_lock+0x17/0x20
 [<ffffffff816945a0>] ? iw_handler_get_private+0x70/0x70
 [<ffffffff81693ca0>] ? call_commit_handler+0x40/0x40
 [<ffffffff81693256>] wireless_process_ioctl+0x176/0x1c0
 [<ffffffff81693e79>] wext_handle_ioctl+0x69/0xc0
 [<ffffffff8159fe79>] dev_ioctl+0x309/0x5e0
 [<ffffffff810be9c7>] ? call_rcu+0x17/0x20
 [<ffffffff8156a472>] sock_ioctl+0x142/0x2e0
 [<ffffffff811e0c70>] do_vfs_ioctl+0x300/0x520
 [<ffffffff81101514>] ? __audit_syscall_entry+0xb4/0x110
 [<ffffffff81101514>] ? __audit_syscall_entry+0xb4/0x110
 [<ffffffff810102bc>] ? do_audit_syscall_entry+0x6c/0x70
 [<ffffffff811e0f11>] SyS_ioctl+0x81/0xa0
 [<ffffffff816ba1d2>] system_call_fastpath+0x12/0x17

Additional routines that generate this BUG are rtw_joinbss_cmd(),
rtw_dynamic_chk_wk_cmd(), rtw_lps_ctrl_wk_cmd(), rtw_rpt_timer_cfg_cmd(),
rtw_ps_cmd(), report_survey_event(), report_join_res(), survey_timer_hdl(),
and rtw_check_bcn_info().

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: navin patidar <navin.patidar@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-11-26 14:03:48 -08:00
David S. Miller d1c637c51d Merge tag 'master-2014-11-25' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
John W. Linville says:

====================
pull request: wireless 2014-11-26

Please pull this little batch of fixes intended for the 3.18 stream...

For the iwlwifi one, Emmanuel says:

"Not all the firmware know how to handle the HOT_SPOT_CMD.
Make sure that the firmware will know this command before
sending it. This avoids a firmware crash."

Along with that, Larry sends a pair of rtlwifi fixes to address some
discrepancies from moving drivers out of staging.  Larry says:

"These two patches are needed to fix a regression introduced when
driver rtl8821ae was moved from staging to the regular wireless tree."

Please let me know if there are problems!
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26 16:38:35 -05:00
David S. Miller 0d1d9092b5 sparc: Add NOP dma_cache_sync() implementation.
This can be a NOP because we forward dma_{alloc,free}_noncoherent to
dma_{alloc,free}_coherent.

Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26 13:36:41 -08:00
Willem de Bruijn f4713a3dfa net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks
TCP timestamping introduced MSG_ERRQUEUE handling for TCP sockets.
If the socket is of family AF_INET6, call ipv6_recv_error instead
of ip_recv_error.

This change is more complex than a single branch due to the loadable
ipv6 module. It reuses a pre-existing indirect function call from
ping. The ping code is safe to call, because it is part of the core
ipv6 module and always present when AF_INET6 sockets are active.

Fixes: 4ed2d765 (net-timestamp: TCP timestamping)
Signed-off-by: Willem de Bruijn <willemb@google.com>

----

It may also be worthwhile to add WARN_ON_ONCE(sk->family == AF_INET6)
to ip_recv_error.
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26 15:45:04 -05:00
David S. Miller a7650238a0 Merge branch 'bridge_nl_validation'
Thomas Graf says:

====================
bridge: Fix missing Netlink message validations

Adds various missing length checks in the bridging code for Netlink
messages and corresponding attributes provided by user space.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26 15:29:10 -05:00
Thomas Graf aa68c20ff3 bridge: Sanitize IFLA_EXT_MASK for AF_BRIDGE:RTM_GETLINK
Only search for IFLA_EXT_MASK if the message actually carries a
ifinfomsg header and validate minimal length requirements for
IFLA_EXT_MASK.

Fixes: 6cbdceeb ("bridge: Dump vlan information from a bridge port")
Cc: Vlad Yasevich <vyasevic@redhat.com>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26 15:29:01 -05:00
Thomas Graf 6f705d8cfc bridge: Add missing policy entry for IFLA_BRPORT_FAST_LEAVE
Fixes: c2d3babf ("bridge: implement multicast fast leave")
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26 15:29:01 -05:00
Thomas Graf 4ea85e831e net: Check for presence of IFLA_AF_SPEC
ndo_bridge_setlink() is currently only called on the slave if
IFLA_AF_SPEC is set but this is a very fragile assumption and may
change in the future.

Cc: Ajit Khaparde <ajit.khaparde@emulex.com>
Cc: John Fastabend <john.r.fastabend@intel.com>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26 15:29:01 -05:00
Thomas Graf b7c1a31411 net: Validate IFLA_BRIDGE_MODE attribute length
Payload is currently accessed blindly and may exceed valid message
boundaries.

Fixes: a77dcb8c8 ("be2net: set and query VEB/VEPA mode of the PF interface")
Fixes: 815cccbf1 ("ixgbe: add setlink, getlink support to ixgbe and ixgbevf")
Cc: Ajit Khaparde <ajit.khaparde@emulex.com>
Cc: John Fastabend <john.r.fastabend@intel.com>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Acked-by: John Fastabend <john.r.fastabend@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26 15:29:00 -05:00
Thomas Graf 6e8d1c5545 bridge: Validate IFLA_BRIDGE_FLAGS attribute length
Payload is currently accessed blindly and may exceed valid message
boundaries.

Fixes: 407af3299 ("bridge: Add netlink interface to configure vlans on bridge ports")
Cc: Vlad Yasevich <vyasevic@redhat.com>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-26 15:29:00 -05:00
Linus Torvalds 3314bf6ba2 Last minute KVM/ARM fixes; even the generic change actually
affects nothing but ARM.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQEcBAABAgAGBQJUddkVAAoJEL/70l94x66D0awIAK+Zy4CnoLdtEpWFZsuoK2YO
 TXOUg3z0WNR4sD/dFMlh1jLxiBG5f/JkDHBBecSZTi+L9PcU15mrAeS+k1F4rDkw
 0GNwRQas+WDElD9rRnqIeBF8A83BmunsVnCsOmn3w+xeXuB8L0HBy6Pgh/wnfHbQ
 +G4gODi0JMDVcvEujN2NNBf60LcM/G3U0VIFXHHGblEIOUtNCUy9mnGRBCg75vwb
 CORpMC+8JV7gFF7jVnqurYc2SyN9a6fzun1evIQJWlFN+ohU8XjkVn4JsrsHpv+E
 6Eqy1wgEWLW1TQhApsh5EYkIRTvvGLgdKm5KCBu15xUw/i3OTOc1BQ0VrSEPs/Y=
 =rEqk
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "Last minute KVM/ARM fixes; even the generic change actually affects
  nothing but ARM"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  kvm: fix kvm_is_mmio_pfn() and rename to kvm_is_reserved_pfn()
  arm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn()
  arm/arm64: KVM: vgic: Fix error code in kvm_vgic_create()
  arm64: KVM: Handle traps of ICC_SRE_EL1 as RAZ/WI
  arm64: KVM: fix unmapping with 48-bit VAs
2014-11-26 11:16:44 -08:00
Greg Kroah-Hartman 8bb9b9a006 Third set of IIO fixes for the 3.18 cycle.
Most of these are fairly standard little fixes, a bmc150 and bmg160 patch
 is to make an ABI change to indicated a specific axis in an event rather
 than the generic option in the original drivers.  As both of these drivers
 are new in this cycle it would be ideal to push this minor change through
 even though it isn't strictly a fix.  A couple of other 'fixes' change
 defaults for some settings on these new drivers to more intuitive calues.
 Looks like some useful feedback has been coming in for this driver
 since it was applied.
 
 * IIO_EVENT_CODE_EXTRACT_DIR bit mask was wrong and has been for a while
   0xCF clearly doesn't give a contiguous bitmask.
 * kxcjk-1013 range setting was failing to mask out the previous value
   in the register and hence was 'enable only'.
 * men_z188 device id table wasn't null terminated.
 * bmg160 and bmc150 both failed to correctly handling an error in mode
   setting.
 * bmg160 and bmc150 both had a bug in setting the event direction in the
   event spec (leads to an attribute name being incorrect)
 * bmg160 defaulted to an open drain output for the interrupt - as a default
   this obviously only works with some interrupt chips - hence change the
   default to push-pull (note this is a new driver so we aren't going to
   cause any regressions with this change).
 * bmc150 had an unintuitive default for the rate of change (motion detector)
   so change it to 0 (new driver so change of default won't cause any
   regressions).
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJUaRGrAAoJEFSFNJnE9BaIrWgP/jdxYsA7l7gAamjkK6Dm+jmR
 FIDaD1eJ0ZMRS43guIwaGJ90OC2Mxc7xIAgbE3xurI0r/73YagTwWtUwzUOGRnE1
 kqRKyo8NEu3+BZtasoigEZfm9pHmsmkdD+lQLAnLlDeVFhYpTbsr/j9qeMD7L8CN
 b+hTwQBsObnpJ/tN61KLSjlx57D8c47ghCgqEaGqXrfR4r/wMItMN6cB1xbM4yU4
 tHJQBBbOv03vZI5oaxJ3+Q4aBGf4TdrL3z/P/vrmMUyyQrmbS6jCBjUlmjcylVSn
 Yz2mr5oPyRgRRzH/KcMT/S+i8BELxBuC5nURBAkO35YqHhXvZENgg29edEWX4s4c
 KOTC+FgbEEPEu5wcUl5NuFPP3D8NNuOxDl677bLz9I6ufhwFLCNtyN6vGsqAMPA+
 s/eviz/W8u2L90/+ryiEV+UESXjqLszWU7xpfdheo4Z6jokpWi9ZT65m11Z+aJ79
 QldzeniUxR9ycH6O6z9GxkdhXV79OACjkvoNZgh33MfmuX7jLMIodWfrI/Xn2+Pb
 N0hpWzcADcd2KfXoXRvuN8t3Wgz09T7CuodOSBsAOjhvkUiufj+iOhwU96rNnNzl
 ZWtYAbRr+DmKks+bzoobyCypaH/0hPuC/YUSBUALlg80P8ozGiIs+E1phiZze+rB
 fHyT8lUFg4a0syWOfx8s
 =IPMl
 -----END PGP SIGNATURE-----

Merge tag 'iio-fixes-for-3.18c' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus

Jonathan writes:

Third set of IIO fixes for the 3.18 cycle.

Most of these are fairly standard little fixes, a bmc150 and bmg160 patch
is to make an ABI change to indicated a specific axis in an event rather
than the generic option in the original drivers.  As both of these drivers
are new in this cycle it would be ideal to push this minor change through
even though it isn't strictly a fix.  A couple of other 'fixes' change
defaults for some settings on these new drivers to more intuitive calues.
Looks like some useful feedback has been coming in for this driver
since it was applied.

* IIO_EVENT_CODE_EXTRACT_DIR bit mask was wrong and has been for a while
  0xCF clearly doesn't give a contiguous bitmask.
* kxcjk-1013 range setting was failing to mask out the previous value
  in the register and hence was 'enable only'.
* men_z188 device id table wasn't null terminated.
* bmg160 and bmc150 both failed to correctly handling an error in mode
  setting.
* bmg160 and bmc150 both had a bug in setting the event direction in the
  event spec (leads to an attribute name being incorrect)
* bmg160 defaulted to an open drain output for the interrupt - as a default
  this obviously only works with some interrupt chips - hence change the
  default to push-pull (note this is a new driver so we aren't going to
  cause any regressions with this change).
* bmc150 had an unintuitive default for the rate of change (motion detector)
  so change it to 0 (new driver so change of default won't cause any
  regressions).
2014-11-26 11:06:36 -08:00
Mark Brown ec058615f1 Merge remote-tracking branches 'spi/fix/dw' and 'spi/fix/sirf' into spi-linus 2014-11-26 19:05:25 +00:00
Mark Brown 13616c7133 Merge remote-tracking branch 'spi/fix/dma' into spi-linus 2014-11-26 19:05:25 +00:00