1. 31 Jul, 2014 6 commits
  2. 30 Jul, 2014 19 commits
    • David Rientjes's avatar
      kexec: fix build error when hugetlbfs is disabled · 3a1122d2
      David Rientjes authored
      free_huge_page() is undefined without CONFIG_HUGETLBFS and there's no
      need to filter PageHuge() page is such a configuration either, so avoid
      exporting the symbol to fix a build error:
      
         In file included from kernel/kexec.c:14:0:
         kernel/kexec.c: In function 'crash_save_vmcoreinfo_init':
         kernel/kexec.c:1623:20: error: 'free_huge_page' undeclared (first use in this function)
           VMCOREINFO_SYMBOL(free_huge_page);
                             ^
      
      Introduced by commit 8f1d26d0 ("kexec: export free_huge_page to
      VMCOREINFO")
      Reported-by: default avatarkbuild test robot <fengguang.wu@intel.com>
      Acked-by: default avatarOlof Johansson <olof@lixom.net>
      Cc: Atsushi Kumagai <kumagai-atsushi@mxc.nes.nec.co.jp>
      Cc: Baoquan He <bhe@redhat.com>
      Cc: Vivek Goyal <vgoyal@redhat.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarDavid Rientjes <rientjes@google.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      3a1122d2
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew Morton) · 4d0bd657
      Linus Torvalds authored
      Merge fixes from Andrew Morton:
       "10 fixes"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        Josh has moved
        kexec: export free_huge_page to VMCOREINFO
        mm: fix filemap.c pagecache_get_page() kernel-doc warnings
        mm: debugfs: move rounddown_pow_of_two() out from do_fault path
        memcg: oom_notify use-after-free fix
        hwpoison: call action_result() in failure path of hwpoison_user_mappings()
        hwpoison: fix hugetlbfs/thp precheck in hwpoison_user_mappings()
        rapidio/tsi721_dma: fix failure to obtain transaction descriptor
        mm, thp: do not allow thp faults to avoid cpuset restrictions
        mm/page-writeback.c: fix divide by zero in bdi_dirty_limits()
      4d0bd657
    • Josh Triplett's avatar
      Josh has moved · e0198b29
      Josh Triplett authored
      My IBM email addresses haven't worked for years; also map some
      old-but-functional forwarding addresses to my canonical address.
      
      Update my GPG key fingerprint; I moved to 4096R a long time ago.
      
      Update description.
      Signed-off-by: default avatarJosh Triplett <josh@joshtriplett.org>
      Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e0198b29
    • Atsushi Kumagai's avatar
      kexec: export free_huge_page to VMCOREINFO · 8f1d26d0
      Atsushi Kumagai authored
      PG_head_mask was added into VMCOREINFO to filter huge pages in b3acc56b
      ("kexec: save PG_head_mask in VMCOREINFO"), but makedumpfile still need
      another symbol to filter *hugetlbfs* pages.
      
      If a user hope to filter user pages, makedumpfile tries to exclude them by
      checking the condition whether the page is anonymous, but hugetlbfs pages
      aren't anonymous while they also be user pages.
      
      We know it's possible to detect them in the same way as PageHuge(),
      so we need the start address of free_huge_page():
      
          int PageHuge(struct page *page)
          {
                  if (!PageCompound(page))
                          return 0;
      
                  page = compound_head(page);
                  return get_compound_page_dtor(page) == free_huge_page;
          }
      
      For that reason, this patch changes free_huge_page() into public
      to export it to VMCOREINFO.
      Signed-off-by: default avatarAtsushi Kumagai <kumagai-atsushi@mxc.nes.nec.co.jp>
      Acked-by: default avatarBaoquan He <bhe@redhat.com>
      Cc: Vivek Goyal <vgoyal@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8f1d26d0
    • Randy Dunlap's avatar
      mm: fix filemap.c pagecache_get_page() kernel-doc warnings · 75325189
      Randy Dunlap authored
      Fix kernel-doc warnings in mm/filemap.c: pagecache_get_page():
      
        Warning(..//mm/filemap.c:1054): No description found for parameter 'cache_gfp_mask'
        Warning(..//mm/filemap.c:1054): No description found for parameter 'radix_gfp_mask'
        Warning(..//mm/filemap.c:1054): Excess function parameter 'gfp_mask' description in 'pagecache_get_page'
      
      Fixes: 2457aec6 ("mm: non-atomically mark page accessed during page cache allocation where possible")
      
      [mgorman@suse.de: change everything]
      [akpm@linux-foundation.org: coding-style fixes]
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: Mel Gorman <mgorman@suse.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      75325189
    • Andrey Ryabinin's avatar
      mm: debugfs: move rounddown_pow_of_two() out from do_fault path · b4903d6e
      Andrey Ryabinin authored
      do_fault_around() expects fault_around_bytes rounded down to nearest page
      order.  Instead of calling rounddown_pow_of_two every time in
      fault_around_pages()/fault_around_mask() we could do round down when user
      changes fault_around_bytes via debugfs interface.
      
      This also fixes bug when user set fault_around_bytes to 0.  Result of
      rounddown_pow_of_two(0) is not defined, therefore fault_around_bytes == 0
      doesn't work without this patch.
      
      Let's set fault_around_bytes to PAGE_SIZE if user sets to something less
      than PAGE_SIZE
      
      [akpm@linux-foundation.org: tweak code layout]
      Fixes: a9b0f861("mm: nominate faultaround area in bytes rather than page order")
      Signed-off-by: default avatarAndrey Ryabinin <a.ryabinin@samsung.com>
      Reported-by: default avatarSasha Levin <sasha.levin@oracle.com>
      Acked-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: <stable@vger.kernel.org>	[3.15.x]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b4903d6e
    • Michal Hocko's avatar
      memcg: oom_notify use-after-free fix · 2bcf2e92
      Michal Hocko authored
      Paul Furtado has reported the following GPF:
      
        general protection fault: 0000 [#1] SMP
        Modules linked in: ipv6 dm_mod xen_netfront coretemp hwmon x86_pkg_temp_thermal crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel ablk_helper cryptd lrw gf128mul glue_helper aes_x86_64 microcode pcspkr ext4 jbd2 mbcache raid0 xen_blkfront
        CPU: 3 PID: 3062 Comm: java Not tainted 3.16.0-rc5 #1
        task: ffff8801cfe8f170 ti: ffff8801d2ec4000 task.ti: ffff8801d2ec4000
        RIP: e030:mem_cgroup_oom_synchronize+0x140/0x240
        RSP: e02b:ffff8801d2ec7d48  EFLAGS: 00010283
        RAX: 0000000000000001 RBX: ffff88009d633800 RCX: 000000000000000e
        RDX: fffffffffffffffe RSI: ffff88009d630200 RDI: ffff88009d630200
        RBP: ffff8801d2ec7da8 R08: 0000000000000012 R09: 00000000fffffffe
        R10: 0000000000000000 R11: 0000000000000000 R12: ffff88009d633800
        R13: ffff8801d2ec7d48 R14: dead000000100100 R15: ffff88009d633a30
        FS:  00007f1748bb4700(0000) GS:ffff8801def80000(0000) knlGS:0000000000000000
        CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
        CR2: 00007f4110300308 CR3: 00000000c05f7000 CR4: 0000000000002660
        Call Trace:
          pagefault_out_of_memory+0x18/0x90
          mm_fault_error+0xa9/0x1a0
          __do_page_fault+0x478/0x4c0
          do_page_fault+0x2c/0x40
          page_fault+0x28/0x30
        Code: 44 00 00 48 89 df e8 40 ca ff ff 48 85 c0 49 89 c4 74 35 4c 8b b0 30 02 00 00 4c 8d b8 30 02 00 00 4d 39 fe 74 1b 0f 1f 44 00 00 <49> 8b 7e 10 be 01 00 00 00 e8 42 d2 04 00 4d 8b 36 4d 39 fe 75
        RIP  mem_cgroup_oom_synchronize+0x140/0x240
      
      Commit fb2a6fc5 ("mm: memcg: rework and document OOM waiting and
      wakeup") has moved mem_cgroup_oom_notify outside of memcg_oom_lock
      assuming it is protected by the hierarchical OOM-lock.
      
      Although this is true for the notification part the protection doesn't
      cover unregistration of event which can happen in parallel now so
      mem_cgroup_oom_notify can see already unlinked and/or freed
      mem_cgroup_eventfd_list.
      
      Fix this by using memcg_oom_lock also in mem_cgroup_oom_notify.
      
      Addresses https://bugzilla.kernel.org/show_bug.cgi?id=80881
      
      Fixes: fb2a6fc5 (mm: memcg: rework and document OOM waiting and wakeup)
      Signed-off-by: default avatarMichal Hocko <mhocko@suse.cz>
      Reported-by: default avatarPaul Furtado <paulfurtado91@gmail.com>
      Tested-by: default avatarPaul Furtado <paulfurtado91@gmail.com>
      Acked-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Cc: <stable@vger.kernel.org>	[3.12+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2bcf2e92
    • Naoya Horiguchi's avatar
      hwpoison: call action_result() in failure path of hwpoison_user_mappings() · 52089b14
      Naoya Horiguchi authored
      hwpoison_user_mappings() could fail for various reasons, so printk()s to
      print out the reasons should be done in each failure check inside
      hwpoison_user_mappings().
      
      And currently we don't call action_result() when hwpoison_user_mappings()
      fails, which is not consistent with other exit points of memory error
      handler.  So this patch fixes these messaging problems.
      Signed-off-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Cc: Andi Kleen <andi@firstfloor.org>
      Cc: Chen Yucong <slaoub@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      52089b14
    • Naoya Horiguchi's avatar
      hwpoison: fix hugetlbfs/thp precheck in hwpoison_user_mappings() · 93a9eb39
      Naoya Horiguchi authored
      A recent fix from Chen Yucong, commit 0bc1f8b0 ("hwpoison: fix the
      handling path of the victimized page frame that belong to non-LRU")
      rejects going into unmapping operation for hugetlbfs/thp pages, which
      results in failing error containing on such pages.  This patch fixes it.
      
      With this patch, hwpoison functional tests in mce-test testsuite pass.
      Signed-off-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Cc: Andi Kleen <andi@firstfloor.org>
      Cc: Chen Yucong <slaoub@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      93a9eb39
    • Alexandre Bounine's avatar
      rapidio/tsi721_dma: fix failure to obtain transaction descriptor · 0193ed82
      Alexandre Bounine authored
      This is a bug fix for the situation when function tsi721_desc_get() fails
      to obtain a free transaction descriptor.
      
      The bug usually results in a memory access crash dump when data transfer
      scatter-gather list has more entries than size of hardware buffer
      descriptors ring.  This fix ensures that error is properly returned to a
      caller instead of an invalid entry.
      
      This patch is applicable to kernel versions starting from v3.5.
      Signed-off-by: default avatarAlexandre Bounine <alexandre.bounine@idt.com>
      Cc: Matt Porter <mporter@kernel.crashing.org>
      Cc: Andre van Herk <andre.van.herk@prodrive-technologies.com>
      Cc: Stef van Os <stef.van.os@prodrive-technologies.com>
      Cc: Vinod Koul <vinod.koul@intel.com>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: <stable@vger.kernel.org>	[3.5+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0193ed82
    • David Rientjes's avatar
      mm, thp: do not allow thp faults to avoid cpuset restrictions · b104a35d
      David Rientjes authored
      The page allocator relies on __GFP_WAIT to determine if ALLOC_CPUSET
      should be set in allocflags.  ALLOC_CPUSET controls if a page allocation
      should be restricted only to the set of allowed cpuset mems.
      
      Transparent hugepages clears __GFP_WAIT when defrag is disabled to prevent
      the fault path from using memory compaction or direct reclaim.  Thus, it
      is unfairly able to allocate outside of its cpuset mems restriction as a
      side-effect.
      
      This patch ensures that ALLOC_CPUSET is only cleared when the gfp mask is
      truly GFP_ATOMIC by verifying it is also not a thp allocation.
      Signed-off-by: default avatarDavid Rientjes <rientjes@google.com>
      Reported-by: default avatarAlex Thorlton <athorlton@sgi.com>
      Tested-by: default avatarAlex Thorlton <athorlton@sgi.com>
      Cc: Bob Liu <lliubbo@gmail.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Hedi Berriche <hedi@sgi.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Mel Gorman <mgorman@suse.de>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b104a35d
    • Maxim Patlasov's avatar
      mm/page-writeback.c: fix divide by zero in bdi_dirty_limits() · f6789593
      Maxim Patlasov authored
      Under memory pressure, it is possible for dirty_thresh, calculated by
      global_dirty_limits() in balance_dirty_pages(), to equal zero.  Then, if
      strictlimit is true, bdi_dirty_limits() tries to resolve the proportion:
      
        bdi_bg_thresh : bdi_thresh = background_thresh : dirty_thresh
      
      by dividing by zero.
      Signed-off-by: default avatarMaxim Patlasov <mpatlasov@parallels.com>
      Acked-by: default avatarRik van Riel <riel@redhat.com>
      Cc: Michal Hocko <mhocko@suse.cz>
      Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Cc: Wu Fengguang <fengguang.wu@intel.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f6789593
    • Linus Torvalds's avatar
      Merge tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux · 26bcd8b7
      Linus Torvalds authored
      Pull Exynos platform DT fix from Grant Likely:
       "Device tree Exynos bug fix for v3.16-rc7
      
        This bug fix has been brewing for a while.  I hate sending it to you
        so late, but I only got confirmation that it solves the problem this
        past weekend.  The diff looks big for a bug fix, but the majority of
        it is only executed in the Exynos quirk case.  Unfortunately it
        required splitting early_init_dt_scan() in two and adding quirk
        handling in the middle of it on ARM.
      
        Exynos has buggy firmware that puts bad data into the memory node.
        Commit 1c2f87c2 ("ARM: Get rid of meminfo") exposed the bug by
        dropping the artificial upper bound on the number of memory banks that
        can be added.  Exynos fails to boot after that commit.  This branch
        fixes it by splitting the early DT parse function and inserting a
        fixup hook.  Exynos uses the hook to correct the DT before parsing
        memory regions"
      
      * tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux:
        arm: Add devicetree fixup machine function
        of: Add memory limiting function for flattened devicetrees
        of: Split early_init_dt_scan into two parts
      26bcd8b7
    • Linus Torvalds's avatar
      Merge tag 'stable/for-linus-3.16-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · acba648d
      Linus Torvalds authored
      Pull Xen fix from David Vrabel:
       "Fix BUG when trying to expand the grant table.  This seems to occur
        often during boot with Ubuntu 14.04 PV guests"
      
      * tag 'stable/for-linus-3.16-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        x86/xen: safely map and unmap grant frames when in atomic context
      acba648d
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · d8772157
      Linus Torvalds authored
      Pull KVM fix from Paolo Bonzini:
       "Fix a bug which allows KVM guests to bring down the entire system on
        some 64K enabled ARM64 hosts"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        kvm: arm64: vgic: fix hyp panic with 64k pages on juno platform
      d8772157
    • Linus Torvalds's avatar
      Revert "cdc_subset: deal with a device that needs reset for timeout" · 1d8fcba1
      Linus Torvalds authored
      This reverts commit 20fbe3ae.
      
      As reported by Stephen Rothwell, it causes compile failures in certain
      configurations:
      
        drivers/net/usb/cdc_subset.c:360:15: error: 'dummy_prereset' undeclared here (not in a function)
          .pre_reset = dummy_prereset,
                       ^
        drivers/net/usb/cdc_subset.c:361:16: error: 'dummy_postreset' undeclared here (not in a function)
          .post_reset = dummy_postreset,
                        ^
      Reported-by: default avatarStephen Rothwell <sfr@canb.auug.org.au>
      Acked-by: default avatarDavid Miller <davem@davemloft.net>
      Cc: Oliver Neukum <oneukum@suse.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1d8fcba1
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · b527caee
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Make fragmentation IDs less predictable, from Eric Dumazet.
      
       2) TSO tunneling can crash in bnx2x driver, fix from Dmitry Kravkov.
      
       3) Don't allow NULL msg->msg_name just because msg->msg_namelen is
          non-zero, from Andrey Ryabinin.
      
       4) ndm->ndm_type set using wrong macros, from Jun Zhao.
      
       5) cdc-ether devices can come up with entries in their address filter,
          so explicitly clear the filter after the device initializes.  From
          Oliver Neukum.
      
       6) Forgotten refcount bump in xfrm_lookup(), from Steffen Klassert.
      
       7) Short packets not padded properly, exposing random data, in bcmgenet
          driver.  Fix from Florian Fainelli.
      
       8) xgbe_probe() doesn't return an error code, but rather zero, when
          netif_set_real_num_tx_queues() fails.  Fix from Wei Yongjun.
      
       9) USB speed not probed properly in r8152 driver, from Hayes Wang.
      
      10) Transmit logic choosing the outgoing port in the sunvnet driver
          needs to consider a) is the port actually up and b) whether it is a
          switch port.  Fix from David L Stevens.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (27 commits)
        net: phy: re-apply PHY fixups during phy_register_device
        cdc-ether: clean packet filter upon probe
        cdc_subset: deal with a device that needs reset for timeout
        net: sendmsg: fix NULL pointer dereference
        isdn/bas_gigaset: fix a leak on failure path in gigaset_probe()
        ip: make IP identifiers less predictable
        neighbour : fix ndm_type type error issue
        sunvnet: only use connected ports when sending
        can: c_can_platform: Fix raminit, use devm_ioremap() instead of devm_ioremap_resource()
        bnx2x: fix crash during TSO tunneling
        r8152: fix the checking of the usb speed
        net: phy: Ensure the MDIO bus module is held
        net: phy: Set the driver when registering an MDIO bus device
        bnx2x: fix set_setting for some PHYs
        hyperv: Fix error return code in netvsc_init_buf()
        amd-xgbe: Fix error return code in xgbe_probe()
        ath9k: fix aggregation session lockup
        net: bcmgenet: correctly pad short packets
        net: sctp: inherit auth_capable on INIT collisions
        mac80211: fix crash on getting sta info with uninitialized rate control
        ...
      b527caee
    • David Vrabel's avatar
      x86/xen: safely map and unmap grant frames when in atomic context · b7dd0e35
      David Vrabel authored
      arch_gnttab_map_frames() and arch_gnttab_unmap_frames() are called in
      atomic context but were calling alloc_vm_area() which might sleep.
      
      Also, if a driver attempts to allocate a grant ref from an interrupt
      and the table needs expanding, then the CPU may already by in lazy MMU
      mode and apply_to_page_range() will BUG when it tries to re-enable
      lazy MMU mode.
      
      These two functions are only used in PV guests.
      
      Introduce arch_gnttab_init() to allocates the virtual address space in
      advance.
      
      Avoid the use of apply_to_page_range() by using saving and using the
      array of PTE addresses from the alloc_vm_area() call (which ensures
      that the required page tables are pre-allocated).
      Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
      Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      b7dd0e35
    • Will Deacon's avatar
      kvm: arm64: vgic: fix hyp panic with 64k pages on juno platform · 63afbe7a
      Will Deacon authored
      If the physical address of GICV isn't page-aligned, then we end up
      creating a stage-2 mapping of the page containing it, which causes us to
      map neighbouring memory locations directly into the guest.
      
      As an example, consider a platform with GICV at physical 0x2c02f000
      running a 64k-page host kernel. If qemu maps this into the guest at
      0x80010000, then guest physical addresses 0x80010000 - 0x8001efff will
      map host physical region 0x2c020000 - 0x2c02efff. Accesses to these
      physical regions may cause UNPREDICTABLE behaviour, for example, on the
      Juno platform this will cause an SError exception to EL3, which brings
      down the entire physical CPU resulting in RCU stalls / HYP panics / host
      crashing / wasted weeks of debugging.
      
      SBSA recommends that systems alias the 4k GICV across the bounding 64k
      region, in which case GICV physical could be described as 0x2c020000 in
      the above scenario.
      
      This patch fixes the problem by failing the vgic probe if the physical
      base address or the size of GICV aren't page-aligned. Note that this
      generated a warning in dmesg about freeing enabled IRQs, so I had to
      move the IRQ enabling later in the probe.
      
      Cc: Christoffer Dall <christoffer.dall@linaro.org>
      Cc: Marc Zyngier <marc.zyngier@arm.com>
      Cc: Gleb Natapov <gleb@kernel.org>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Joel Schopp <joel.schopp@amd.com>
      Cc: Don Dutile <ddutile@redhat.com>
      Acked-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Acked-by: default avatarJoel Schopp <joel.schopp@amd.com>
      Acked-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarChristoffer Dall <christoffer.dall@linaro.org>
      63afbe7a
  3. 29 Jul, 2014 14 commits
    • Laura Abbott's avatar
      arm: Add devicetree fixup machine function · 5a12a597
      Laura Abbott authored
      Commit 1c2f87c2
      (ARM: 8025/1: Get rid of meminfo) dropped the upper bound on
      the number of memory banks that can be added as there was no
      technical need in the kernel. It turns out though, some bootloaders
      (specifically the arndale-octa exynos boards) may pass invalid memory
      information and rely on the kernel to not parse this data. This is a
      bug in the bootloader but we still need to work around this.
      Work around this by introducing a dt_fixup function. This function
      gets called before the flattened devicetree is scanned for memory
      and the like. In this fixup function for exynos, limit the maximum
      number of memory regions in the devicetree.
      Signed-off-by: default avatarLaura Abbott <lauraa@codeaurora.org>
      Tested-by: default avatarAndreas Färber <afaerber@suse.de>
      [glikely: Added a comment and fixed up function name]
      Signed-off-by: default avatarGrant Likely <grant.likely@linaro.org>
      5a12a597
    • Laura Abbott's avatar
      of: Add memory limiting function for flattened devicetrees · 704033ce
      Laura Abbott authored
      Buggy bootloaders may pass bogus memory entries in the devicetree.
      Add of_fdt_limit_memory to add an upper bound on the number of
      entries that can be present in the devicetree.
      Signed-off-by: default avatarLaura Abbott <lauraa@codeaurora.org>
      Tested-by: default avatarAndreas Färber <afaerber@suse.de>
      Signed-off-by: default avatarGrant Likely <grant.likely@linaro.org>
      704033ce
    • Laura Abbott's avatar
      of: Split early_init_dt_scan into two parts · 4972a74b
      Laura Abbott authored
      Currently, early_init_dt_scan validates the header, sets the
      boot params, and scans for chosen/memory all in one function.
      Split this up into two separate functions (validation/setting
      boot params in one, scanning in another) to allow for
      additional setup between boot params and scanning the memory.
      Signed-off-by: default avatarLaura Abbott <lauraa@codeaurora.org>
      Tested-by: default avatarAndreas Färber <afaerber@suse.de>
      [glikely: s/early_init_dt_scan_all/early_init_dt_scan_nodes/]
      Signed-off-by: default avatarGrant Likely <grant.likely@linaro.org>
      4972a74b
    • Rafael J. Wysocki's avatar
      ACPI / PNP: Fix acpi_pnp_match() · b6328a07
      Rafael J. Wysocki authored
      The acpi_pnp_match() function is used for finding the ACPI device
      object that should be associated with the given PNP device.
      Unfortunately, the check used by that function is not strict enough
      and may cause success to be returned for a wrong ACPI device object.
      
      To fix that, use the observation that the pointer to the ACPI
      device object in question is already stored in the data field
      in struct pnp_dev, so acpi_pnp_match() can simply use that
      field to do its job.
      
      This problem was uncovered in 3.14 by commit 202317a5 (ACPI / scan:
      Add acpi_device objects for all device nodes in the namespace).
      
      Fixes: 202317a5 (ACPI / scan: Add acpi_device objects for all device nodes in the namespace)
      Reported-and-tested-by: default avatarVinson Lee <vlee@twopensource.com>
      Cc: 3.14+ <stable@vger.kernel.org> # 3.14+
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      b6328a07
    • Florian Fainelli's avatar
      net: phy: re-apply PHY fixups during phy_register_device · d92f5dec
      Florian Fainelli authored
      Commit 87aa9f9c ("net: phy: consolidate PHY reset in phy_init_hw()")
      moved the call to phy_scan_fixups() in phy_init_hw() after a software
      reset is performed.
      
      By the time phy_init_hw() is called in phy_device_register(), no driver
      has been bound to this PHY yet, so all the checks in phy_init_hw()
      against the PHY driver and the PHY driver's config_init function will
      return 0. We will therefore never call phy_scan_fixups() as we should.
      
      Fix this by calling phy_scan_fixups() and check for its return value to
      restore the intended functionality.
      
      This broke PHY drivers which do register an early PHY fixup callback to
      intercept the PHY probing and do things like changing the 32-bits unique
      PHY identifier when a pseudo-PHY address has been used, as well as
      board-specific PHY fixups that need to be applied during driver probe
      time.
      Reported-by: default avatarHauke Merthens <hauke-m@hauke-m.de>
      Reported-by: default avatarJonas Gorski <jogo@openwrt.org>
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d92f5dec
    • Oliver Neukum's avatar
      cdc-ether: clean packet filter upon probe · c472ab68
      Oliver Neukum authored
      There are devices that don't do reset all the way. So the packet filter should
      be set to a sane initial value. Failure to do so leads to intermittent failures
      of DHCP on some systems under some conditions.
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c472ab68
    • Oliver Neukum's avatar
      cdc_subset: deal with a device that needs reset for timeout · 20fbe3ae
      Oliver Neukum authored
      This device needs to be reset to recover from a timeout.
      Unfortunately this can be handled only at the level of
      the subdrivers.
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      20fbe3ae
    • Andrey Ryabinin's avatar
      net: sendmsg: fix NULL pointer dereference · 40eea803
      Andrey Ryabinin authored
      Sasha's report:
      	> While fuzzing with trinity inside a KVM tools guest running the latest -next
      	> kernel with the KASAN patchset, I've stumbled on the following spew:
      	>
      	> [ 4448.949424] ==================================================================
      	> [ 4448.951737] AddressSanitizer: user-memory-access on address 0
      	> [ 4448.952988] Read of size 2 by thread T19638:
      	> [ 4448.954510] CPU: 28 PID: 19638 Comm: trinity-c76 Not tainted 3.16.0-rc4-next-20140711-sasha-00046-g07d3099-dirty #813
      	> [ 4448.956823]  ffff88046d86ca40 0000000000000000 ffff880082f37e78 ffff880082f37a40
      	> [ 4448.958233]  ffffffffb6e47068 ffff880082f37a68 ffff880082f37a58 ffffffffb242708d
      	> [ 4448.959552]  0000000000000000 ffff880082f37a88 ffffffffb24255b1 0000000000000000
      	> [ 4448.961266] Call Trace:
      	> [ 4448.963158] dump_stack (lib/dump_stack.c:52)
      	> [ 4448.964244] kasan_report_user_access (mm/kasan/report.c:184)
      	> [ 4448.965507] __asan_load2 (mm/kasan/kasan.c:352)
      	> [ 4448.966482] ? netlink_sendmsg (net/netlink/af_netlink.c:2339)
      	> [ 4448.967541] netlink_sendmsg (net/netlink/af_netlink.c:2339)
      	> [ 4448.968537] ? get_parent_ip (kernel/sched/core.c:2555)
      	> [ 4448.970103] sock_sendmsg (net/socket.c:654)
      	> [ 4448.971584] ? might_fault (mm/memory.c:3741)
      	> [ 4448.972526] ? might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3740)
      	> [ 4448.973596] ? verify_iovec (net/core/iovec.c:64)
      	> [ 4448.974522] ___sys_sendmsg (net/socket.c:2096)
      	> [ 4448.975797] ? put_lock_stats.isra.13 (./arch/x86/include/asm/preempt.h:98 kernel/locking/lockdep.c:254)
      	> [ 4448.977030] ? lock_release_holdtime (kernel/locking/lockdep.c:273)
      	> [ 4448.978197] ? lock_release_non_nested (kernel/locking/lockdep.c:3434 (discriminator 1))
      	> [ 4448.979346] ? check_chain_key (kernel/locking/lockdep.c:2188)
      	> [ 4448.980535] __sys_sendmmsg (net/socket.c:2181)
      	> [ 4448.981592] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600)
      	> [ 4448.982773] ? trace_hardirqs_on (kernel/locking/lockdep.c:2607)
      	> [ 4448.984458] ? syscall_trace_enter (arch/x86/kernel/ptrace.c:1500 (discriminator 2))
      	> [ 4448.985621] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600)
      	> [ 4448.986754] SyS_sendmmsg (net/socket.c:2201)
      	> [ 4448.987708] tracesys (arch/x86/kernel/entry_64.S:542)
      	> [ 4448.988929] ==================================================================
      
      This reports means that we've come to netlink_sendmsg() with msg->msg_name == NULL and msg->msg_namelen > 0.
      
      After this report there was no usual "Unable to handle kernel NULL pointer dereference"
      and this gave me a clue that address 0 is mapped and contains valid socket address structure in it.
      
      This bug was introduced in f3d33426
      (net: rework recvmsg handler msg_name and msg_namelen logic).
      Commit message states that:
      	"Set msg->msg_name = NULL if user specified a NULL in msg_name but had a
      	 non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't
      	 affect sendto as it would bail out earlier while trying to copy-in the
      	 address."
      But in fact this affects sendto when address 0 is mapped and contains
      socket address structure in it. In such case copy-in address will succeed,
      verify_iovec() function will successfully exit with msg->msg_namelen > 0
      and msg->msg_name == NULL.
      
      This patch fixes it by setting msg_namelen to 0 if msg_name == NULL.
      
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: <stable@vger.kernel.org>
      Reported-by: default avatarSasha Levin <sasha.levin@oracle.com>
      Signed-off-by: default avatarAndrey Ryabinin <a.ryabinin@samsung.com>
      Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      40eea803
    • Alexey Khoroshilov's avatar
      isdn/bas_gigaset: fix a leak on failure path in gigaset_probe() · 86b7987d
      Alexey Khoroshilov authored
      There is a lack of usb_put_dev(udev) on failure path in gigaset_probe().
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
      Acked-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      86b7987d
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · c98158ed
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "A nice small set of bug fixes for arm-soc:
      
         - two incorrect register addresses in DT files on shmobile and hisilicon
         - one revert for a regression on omap
         - one bug fix for a newly introduced pin controller binding
         - one regression fix for the memory controller on omap
         - one patch to avoid a harmless WARN_ON"
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: dts: Revert enabling of twl configuration for n900
        ARM: dts: fix L2 address in Hi3620
        ARM: OMAP2+: gpmc: fix gpmc_hwecc_bch_capable()
        pinctrl: dra: dt-bindings: Fix pull enable/disable
        ARM: shmobile: r8a7791: Fix SD2CKCR register address
        ARM: OMAP2+: l2c: squelch warning dump on power control setting
      c98158ed
    • David Howells's avatar
      AFS: Correctly assemble the client UUID · 0ef13515
      David Howells authored
      Correctly assemble the client UUID by OR'ing in the flags rather than
      assigning them over the other components.
      Reported-by: default avatarHimangi Saraogi <himangi774@gmail.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0ef13515
    • Randy Dunlap's avatar
      mm: fix page_alloc.c kernel-doc warnings · 1aab4d77
      Randy Dunlap authored
      Fix kernel-doc warnings and function name in mm/page_alloc.c:
      
        Warning(..//mm/page_alloc.c:6074): No description found for parameter 'pfn'
        Warning(..//mm/page_alloc.c:6074): No description found for parameter 'mask'
        Warning(..//mm/page_alloc.c:6074): Excess function parameter 'start_bitidx' description in 'get_pfnblock_flags_mask'
        Warning(..//mm/page_alloc.c:6102): No description found for parameter 'pfn'
        Warning(..//mm/page_alloc.c:6102): No description found for parameter 'mask'
        Warning(..//mm/page_alloc.c:6102): Excess function parameter 'start_bitidx' description in 'set_pfnblock_flags_mask'
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Acked-by: default avatarMel Gorman <mgorman@suse.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1aab4d77
    • Arnd Bergmann's avatar
      Merge tag 'omap-for-v3.16/n900-regression' of... · a1ae5b12
      Arnd Bergmann authored
      Merge tag 'omap-for-v3.16/n900-regression' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes
      
      Merge "omap n900 regression fix for v3.16 rc series" from Tony Lindgren:
      
      Minimal regression fix for n900 display that got broken with
      enabling of twl4030 PM features. Turns out more work is needed
      before we can enable twl4030 PM on n900.
      
      I did not notice this earlier as I have my n900 in a rack
      and the display did not get enabled for device tree based booting
      until for v3.16.
      
      * tag 'omap-for-v3.16/n900-regression' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
        ARM: dts: Revert enabling of twl configuration for n900
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      a1ae5b12
    • Tony Lindgren's avatar
      ARM: dts: Revert enabling of twl configuration for n900 · d937678a
      Tony Lindgren authored
      Commit 9188883f (ARM: dts: Enable twl4030 off-idle configuration
      for selected omaps) allowed n900 to cut off core voltages during
      off-idle. This however caused a regression where twl regulator
      vaux1 was not getting enabled for the LCD panel as we are not
      requesting it for the panel.
      
      Turns out quite a few devices on n900 are using vaux1, and we need
      to either stop idling it, or add proper regulator_get calls for all
      users. But until we have a proper solution implemented and tested,
      let's just disable the twl off-idle configuration for now for n900.
      Reported-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
      Fixes: 9188883f (ARM: dts: Enable twl4030 off-idle configuration for selected omaps)
      Signed-off-by: default avatarTony Lindgren <tony@atomide.com>
      d937678a
  4. 28 Jul, 2014 1 commit
    • Eric Dumazet's avatar
      ip: make IP identifiers less predictable · 04ca6973
      Eric Dumazet authored
      In "Counting Packets Sent Between Arbitrary Internet Hosts", Jeffrey and
      Jedidiah describe ways exploiting linux IP identifier generation to
      infer whether two machines are exchanging packets.
      
      With commit 73f156a6 ("inetpeer: get rid of ip_id_count"), we
      changed IP id generation, but this does not really prevent this
      side-channel technique.
      
      This patch adds a random amount of perturbation so that IP identifiers
      for a given destination [1] are no longer monotonically increasing after
      an idle period.
      
      Note that prandom_u32_max(1) returns 0, so if generator is used at most
      once per jiffy, this patch inserts no hole in the ID suite and do not
      increase collision probability.
      
      This is jiffies based, so in the worst case (HZ=1000), the id can
      rollover after ~65 seconds of idle time, which should be fine.
      
      We also change the hash used in __ip_select_ident() to not only hash
      on daddr, but also saddr and protocol, so that ICMP probes can not be
      used to infer information for other protocols.
      
      For IPv6, adds saddr into the hash as well, but not nexthdr.
      
      If I ping the patched target, we can see ID are now hard to predict.
      
      21:57:11.008086 IP (...)
          A > target: ICMP echo request, seq 1, length 64
      21:57:11.010752 IP (... id 2081 ...)
          target > A: ICMP echo reply, seq 1, length 64
      
      21:57:12.013133 IP (...)
          A > target: ICMP echo request, seq 2, length 64
      21:57:12.015737 IP (... id 3039 ...)
          target > A: ICMP echo reply, seq 2, length 64
      
      21:57:13.016580 IP (...)
          A > target: ICMP echo request, seq 3, length 64
      21:57:13.019251 IP (... id 3437 ...)
          target > A: ICMP echo reply, seq 3, length 64
      
      [1] TCP sessions uses a per flow ID generator not changed by this patch.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarJeffrey Knockel <jeffk@cs.unm.edu>
      Reported-by: default avatarJedidiah R. Crandall <crandall@cs.unm.edu>
      Cc: Willy Tarreau <w@1wt.eu>
      Cc: Hannes Frederic Sowa <hannes@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      04ca6973