1. 12 Jul, 2014 2 commits
    • Namjae Jeon's avatar
      ext4: fix potential null pointer dereference in ext4_free_inode · bf40c926
      Namjae Jeon authored
      Fix potential null pointer dereferencing problem caused by e43bb4e6
      ("ext4: decrement free clusters/inodes counters when block group declared bad")
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarNamjae Jeon <namjae.jeon@samsung.com>
      Signed-off-by: default avatarAshish Sangwan <a.sangwan@samsung.com>
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      Reviewed-by: default avatarLukas Czerner <lczerner@redhat.com>
    • Theodore Ts'o's avatar
      ext4: fix a potential deadlock in __ext4_es_shrink() · 3f1f9b85
      Theodore Ts'o authored
      This fixes the following lockdep complaint:
      [ INFO: possible circular locking dependency detected ]
      3.16.0-rc2-mm1+ #7 Tainted: G           O  
      kworker/u24:0/4356 is trying to acquire lock:
       (&(&sbi->s_es_lru_lock)->rlock){+.+.-.}, at: [<ffffffff81285fff>] __ext4_es_shrink+0x4f/0x2e0
      but task is already holding lock:
       (&ei->i_es_lock){++++-.}, at: [<ffffffff81286961>] ext4_es_insert_extent+0x71/0x180
      which lock already depends on the new lock.
       Possible unsafe locking scenario:
             CPU0                    CPU1
             ----                    ----
       *** DEADLOCK ***
      6 locks held by kworker/u24:0/4356:
       #0:  ("writeback"){.+.+.+}, at: [<ffffffff81071d00>] process_one_work+0x180/0x560
       #1:  ((&(&wb->dwork)->work)){+.+.+.}, at: [<ffffffff81071d00>] process_one_work+0x180/0x560
       #2:  (&type->s_umount_key#22){++++++}, at: [<ffffffff811a9c74>] grab_super_passive+0x44/0x90
       #3:  (jbd2_handle){+.+...}, at: [<ffffffff812979f9>] start_this_handle+0x189/0x5f0
       #4:  (&ei->i_data_sem){++++..}, at: [<ffffffff81247062>] ext4_map_blocks+0x132/0x550
       #5:  (&ei->i_es_lock){++++-.}, at: [<ffffffff81286961>] ext4_es_insert_extent+0x71/0x180
      stack backtrace:
      CPU: 0 PID: 4356 Comm: kworker/u24:0 Tainted: G           O   3.16.0-rc2-mm1+ #7
      Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
      Workqueue: writeback bdi_writeback_workfn (flush-253:0)
       ffffffff8213dce0 ffff880014b07538 ffffffff815df0bb 0000000000000007
       ffffffff8213e040 ffff880014b07588 ffffffff815db3dd ffff880014b07568
       ffff880014b07610 ffff88003b868930 ffff88003b868908 ffff88003b868930
      Call Trace:
       [<ffffffff815df0bb>] dump_stack+0x4e/0x68
       [<ffffffff815db3dd>] print_circular_bug+0x1fb/0x20c
       [<ffffffff810a7a3e>] __lock_acquire+0x163e/0x1d00
       [<ffffffff815e89dc>] ? retint_restore_args+0xe/0xe
       [<ffffffff815ddc7b>] ? __slab_alloc+0x4a8/0x4ce
       [<ffffffff81285fff>] ? __ext4_es_shrink+0x4f/0x2e0
       [<ffffffff810a8707>] lock_acquire+0x87/0x120
       [<ffffffff81285fff>] ? __ext4_es_shrink+0x4f/0x2e0
       [<ffffffff8128592d>] ? ext4_es_free_extent+0x5d/0x70
       [<ffffffff815e6f09>] _raw_spin_lock+0x39/0x50
       [<ffffffff81285fff>] ? __ext4_es_shrink+0x4f/0x2e0
       [<ffffffff8119760b>] ? kmem_cache_alloc+0x18b/0x1a0
       [<ffffffff81285fff>] __ext4_es_shrink+0x4f/0x2e0
       [<ffffffff812869b8>] ext4_es_insert_extent+0xc8/0x180
       [<ffffffff812470f4>] ext4_map_blocks+0x1c4/0x550
       [<ffffffff8124c4c4>] ext4_writepages+0x6d4/0xd00
      Reported-by: default avatarMinchan Kim <minchan@kernel.org>
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      Reported-by: default avatarMinchan Kim <minchan@kernel.org>
      Cc: stable@vger.kernel.org
      Cc: Zheng Liu <gnehzuil.liu@gmail.com>
  2. 11 Jul, 2014 1 commit
  3. 05 Jul, 2014 4 commits
  4. 29 Jun, 2014 11 commits
  5. 28 Jun, 2014 6 commits
    • Linus Torvalds's avatar
      Merge tag 'spi-v3.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · 24b414d5
      Linus Torvalds authored
      Pull spi fixes from Mark Brown:
       "A few driver specific fixes, the biggest one being a fix for the newly
        added Qualcomm SPI controller driver to make it not use its internal
        chip select due to hardware bugs, replacing it with GPIOs"
      * tag 'spi-v3.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: qup: Remove chip select function
        spi: qup: Fix order of spi_register_master
        spi: sh-sci: fix use-after-free in sh_sci_spi_remove()
        spi/pxa2xx: fix incorrect SW mode chipselect setting for BayTrail LPSS SPI
    • Linus Torvalds's avatar
      Merge tag 'regulator-v3.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator · 4194976b
      Linus Torvalds authored
      Pull regulator fixes from Mark Brown:
       "Several driver specific fixes here, the palmas fixes being especially
        important for a range of boards - the recent updates to support new
        devices have introduced several regressions"
      * tag 'regulator-v3.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
        regulator: tps65218: Correct the the config register for LDO1
        regulator: tps65218: Add the missing of_node assignment in probe
        regulator: palmas: fix typo in enable_reg calculation
        regulator: bcm590xx: fix vbus name
        regulator: palmas: Fix SMPS enable/disable/is_enabled
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · eb477e03
      Linus Torvalds authored
      Pull SCSI target fixes from Nicholas Bellinger:
       "Mostly minor fixes this time around.  The highlights include:
         - iscsi-target CHAP authentication fixes to enforce explicit key
           values (Tejas Vaykole + rahul.rane)
         - fix a long-standing OOPs in target-core when a alua configfs
           attribute is accessed after port symlink has been removed.
           (Sebastian Herbszt)
         - fix a v3.10.y iscsi-target regression causing the login reject
           status class/detail to be ignored (Christoph Vu-Brugier)
         - fix a v3.10.y iscsi-target regression to avoid rejecting an
           existing ITT during Data-Out when data-direction is wrong (Santosh
           Kulkarni + Arshad Hussain)
         - fix a iscsi-target related shutdown deadlock on UP kernels (Mikulas
         - fix a v3.16-rc1 build issue with vhost-scsi + !CONFIG_NET (MST)"
      * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
        iscsi-target: fix iscsit_del_np deadlock on unload
        iovec: move memcpy_from/toiovecend to lib/iovec.c
        iscsi-target: Avoid rejecting incorrect ITT for Data-Out
        tcm_loop: Fix memory leak in tcm_loop_submission_work error path
        iscsi-target: Explicily clear login response PDU in exception path
        target: Fix left-over se_lun->lun_sep pointer OOPs
        iscsi-target; Enforce 1024 byte maximum for CHAP_C key value
        iscsi-target: Convert chap_server_compute_md5 to use kstrtoul
    • Mark Brown's avatar
    • Mark Brown's avatar
      Merge remote-tracking branches 'regulator/fix/bcm590xx',... · 11767484
      Mark Brown authored
      Merge remote-tracking branches 'regulator/fix/bcm590xx', 'regulator/fix/palmas' and 'regulator/fix/tps65218' into regulator-linus
    • Mikulas Patocka's avatar
      iscsi-target: fix iscsit_del_np deadlock on unload · 81a9c5e7
      Mikulas Patocka authored
      On uniprocessor preemptible kernel, target core deadlocks on unload. The
      following events happen:
      * iscsit_del_np is called
      * it calls send_sig(SIGINT, np->np_thread, 1);
      * the scheduler switches to the np_thread
      * the np_thread is woken up, it sees that kthread_should_stop() returns
        false, so it doesn't terminate
      * the np_thread clears signals with flush_signals(current); and goes back
        to sleep in iscsit_accept_np
      * the scheduler switches back to iscsit_del_np
      * iscsit_del_np calls kthread_stop(np->np_thread);
      * the np_thread is waiting in iscsit_accept_np and it doesn't respond to
      The deadlock could be resolved if the administrator sends SIGINT signal to
      the np_thread with killall -INT iscsi_np
      The reproducible deadlock was introduced in commit
      , but the thread-stopping code was
      racy even before.
      This patch fixes the problem. Using kthread_should_stop to stop the
      np_thread is unreliable, so we test np_thread_state instead. If
      np_thread_state equals ISCSI_NP_THREAD_SHUTDOWN, the thread exits.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
  6. 27 Jun, 2014 14 commits
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v3.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 3e7b256c
      Linus Torvalds authored
      Pull IOMMU fixes from Joerg Roedel:
       - fix VT-d regression with handling multiple RMRR entries per device
       - fix a small race that was left in the mmu_notifier handling in the
         AMD IOMMUv2 driver
      * tag 'iommu-fixes-v3.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        iommu/amd: Fix small race between invalidate_range_end/start
        iommu/vt-d: fix bug in handling multiple RMRRs for the same PCI device
    • Linus Torvalds's avatar
      Merge branch 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · d1fc98ba
      Linus Torvalds authored
      Pull x86 fixes from Peter Anvin:
       "A pile of fixes related to the VDSO, EFI and 32-bit badsys handling.
        It turns out that removing the section headers from the VDSO breaks
        gdb, so this puts back most of them.  A very simple typo broke
        rt_sigreturn on some versions of glibc, with obviously disastrous
        results.  The rest is pretty much fixes for the corresponding fallout.
        The EFI fixes fixes an arithmetic overflow on 32-bit systems and
        quiets some build warnings.
        Finally, when invoking an invalid system call number on x86-32, we
        bypass a bunch of handling, which can make the audit code oops"
      * 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        efi-pstore: Fix an overflow on 32-bit builds
        x86/vdso: Error out in vdso2c if DT_RELA is present
        x86/vdso: Move DISABLE_BRANCH_PROFILING into the vdso makefile
        x86_32, signal: Fix vdso rt_sigreturn
        x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
        x86/vdso: Create .build-id links for unstripped vdso files
        x86/vdso: Remove some redundant in-memory section headers
        x86/vdso: Improve the fake section headers
        x86/vdso2c: Use better macros for ELF bitness
        x86/vdso: Discard the __bug_table section
        efi: Fix compiler warnings (unused, const, type)
    • Linus Torvalds's avatar
      Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus · c9a60666
      Linus Torvalds authored
      Pull MIPS fixes from Ralf Baechle:
       "This is dominated by a large number of changes necessary for the MIPS
        BPF code.  code.  Aside of that there are
         - a fix for the MSC system controller support code.
         - a Turbochannel fix.
         - a recordmcount fix that's MIPS-specific.
         - barrier fixes to smp-cps / pm-cps after unrelated changes elsewhere
           in the kernel.
         - revert support for MSA registers in the signal frames.  The
           reverted patch did modify the signal stack frame which of course is
         - fix math-emu build breakage with older compilers.
         - some related cleanup.
         - fix Lasat build error if CONFIG_CRC32 isn't set to y by the user"
      * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (27 commits)
        MIPS: Lasat: Fix build error if CRC32 is not enabled.
        TC: Handle device_register() errors.
        MIPS: MSC: Prevent out-of-bounds writes to MIPS SC ioremap'd region
        MIPS: bpf: Fix stack space allocation for BPF memwords on MIPS64
        MIPS: BPF: Use 32 or 64-bit load instruction to load an address to register
        MIPS: bpf: Fix PKT_TYPE case for big-endian cores
        MIPS: BPF: Prevent kernel fall over for >=32bit shifts
        MIPS: bpf: Drop update_on_xread and always initialize the X register
        MIPS: bpf: Fix is_range() semantics
        MIPS: bpf: Use pr_debug instead of pr_warn for unhandled opcodes
        MIPS: bpf: Fix return values for VLAN_TAG_PRESENT case
        MIPS: bpf: Use correct mask for VLAN_TAG case
        MIPS: bpf: Fix branch conditional for BPF_J{GT/GE} cases
        MIPS: bpf: Add SEEN_SKB to flags when looking for the PKT_TYPE
        MIPS: bpf: Use 'andi' instead of 'and' for the VLAN cases
        MIPS: bpf: Return error code if the offset is a negative number
        MIPS: bpf: Use the LO register to get division's quotient
        MIPS: mm: uasm: Fix lh micro-assembler instruction
        MIPS: uasm: Add SLT uasm instruction
        MIPS: uasm: Add s3s1s2 instruction builder
    • Linus Torvalds's avatar
      Merge tag 'arc-fixes-for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc · 1857a5b6
      Linus Torvalds authored
      Pull ARC fixes from Vineet Gupta:
       "Some SMP changes, a ptrace request for NPTL debugging, bunch of build
      * tag 'arc-fixes-for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
        ARC: [SMP] Enable icache coherency
        ARC: [SMP] Fix IPI IRQ registration
        ARC: Implement ptrace(PTRACE_GET_THREAD_AREA)
        ARC: optimize kernel bss clearing in early boot code
        ARC: Fix build breakage for !CONFIG_ARC_DW2_UNWIND
        ARC: fix build warning in devtree
        ARC: remove checks for CONFIG_ARC_MMU_V4
    • Linus Torvalds's avatar
      Merge tag 'compress-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core · 8dd68eb3
      Linus Torvalds authored
      Pull compress bugfix from Greg KH:
       "Here is another lz4 bugfix for 3.16-rc3 that resolves a reported issue
        with that compression algorithm"
      * tag 'compress-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        lz4: fix another possible overrun
    • Linus Torvalds's avatar
      Merge tag 'stable/for-linus-3.16-rc1-tag' of... · 772205d8
      Linus Torvalds authored
      Merge tag 'stable/for-linus-3.16-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb
      Pull swiotlb bugfix from Konrad Rzeszutek Wilk:
       "One bug-fix that had been in tree for quite some time.  We had assumed
        that the physical address zero was invalid and would fail it.  But
        that is not true and on some architectures it is not reserved and
        valid.  This fixes it"
      * tag 'stable/for-linus-3.16-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb:
        swiotlb: don't assume PA 0 is invalid
    • Linus Torvalds's avatar
      Merge tag 'sound-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · cf0d1356
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Here includes a few patchset for fixing mostly HD-audio issues in
        addition to a patch assuring the compress API bytes alignment and a
        fix for the die-hard existing race condition at USB-audio
        disconnection.  The volume looks big in Realtek HD-audio code, but
        it's just a translation of the fixup tables, and the actual changes
        are rather trivial"
      * tag 'sound-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - restore BCLK M/N values when resuming HSW/BDW display controller
        ALSA: usb-audio: Fix races at disconnection and PCM closing
        ALSA: hda - Adjust speaker HPF and add LED support for HP Spectre 13
        ALSA: hda - Make the pin quirk tables use the SND_HDA_PIN_QUIRK macro
        ALSA: hda - Make a SND_HDA_PIN_QUIRK macro
        ALSA: hda - Add pin quirk for Dell XPS 15
        ALSA: hda - hdmi: call overridden init on resume
        ALSA: hda - Fix usage of "model" module parameter
        ALSA: compress: fix the struct alignment to 4 bytes
    • Linus Torvalds's avatar
      Merge tag 'mfd-fixes-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd · 5ded6ea4
      Linus Torvalds authored
      Pull MFD fixes from Lee Jones:
       "Couple of simple fixes due for the v3.16 -rcs"
      * tag 'mfd-fixes-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd:
        mfd: ab8500: Fix dt irq mapping
        mfd: davinci: Voicecodec needs regmap_mmio
        mfd: STw481x: Allow modular build
        mfd: UCB1x00: Enable modular build
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · c163b524
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Exynos, i915 and msm fixes and one core fix.
           hdmi power off and mixer issues
           iommu, build fixes,
           regression races and warning fixes"
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (22 commits)
        drm/i915: vlv_prepare_pll is only needed in case of non DSI interfaces
        drm: fix NULL pointer access by wrong ioctl
        drm/exynos: enable vsync interrupt while waiting for vblank
        drm/exynos: soft reset mixer before reconfigure after power-on
        drm/exynos: allow multiple layer updates per vsync for mixer
        drm/i915: Hold the table lock whilst walking the file's idr and counting the objects in debugfs
        drm/i915: BDW: Adding Reserved PCI IDs.
        drm/i915: Only mark the ctx as initialised after a SET_CONTEXT operation
        drm/exynos: stop mixer before gating clocks during poweroff
        drm/exynos: set power state variable after enabling clocks and power
        drm/exynos: disable unused windows on apply
        drm/exynos: Fix de-registration ordering
        drm/exynos: change zero to NULL for sparse
        drm/exynos: dpi: Fix NULL pointer dereference with legacy bindings
        drm/exynos: hdmi: fix power order issue
        drm/i915: default to having backlight if VBT not available
        drm/i915: cache hw power well enabled state
        drm/msm: fix IOMMU cleanup for -EPROBE_DEFER
        drm/msm: use PAGE_ALIGNED instead of IS_ALIGNED(PAGE_SIZE)
        drm/msm/hdmi: set hdp clock rate before prepare_enable
    • Michael S. Tsirkin's avatar
      iovec: move memcpy_from/toiovecend to lib/iovec.c · ac5ccdba
      Michael S. Tsirkin authored
      ERROR: "memcpy_fromiovecend" [drivers/vhost/vhost_scsi.ko] undefined!
      commit 9f977ef7
          vhost-scsi: Include prot_bytes into expected data transfer length
      in target-pending makes drivers/vhost/scsi.c call memcpy_fromiovecend().
      This function is not available when CONFIG_NET is not enabled.
      socket.h already includes uio.h, so no callers need updating.
      Reported-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: Stephen Rothwell <sfr@canb.auug.org.au>
      Cc: "David S. Miller" <davem@davemloft.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
    • Nicholas Bellinger's avatar
      iscsi-target: Avoid rejecting incorrect ITT for Data-Out · 97c99b47
      Nicholas Bellinger authored
      This patch changes iscsit_check_dataout_hdr() to dump the incoming
      Data-Out payload when the received ITT is not associated with a
      WRITE, instead of calling iscsit_reject_cmd() for the non WRITE
      ITT descriptor.
      This addresses a bug where an initiator sending an Data-Out for
      an ITT associated with a READ would end up generating a reject
      for the READ, eventually resulting in list corruption.
      Reported-by: default avatarSantosh Kulkarni <santosh.kulkarni@calsoftinc.com>
      Reported-by: default avatarArshad Hussain <arshad.hussain@calsoftinc.com>
      Cc: stable@vger.kernel.org # 3.10+
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
    • Greg Kroah-Hartman's avatar
      lz4: fix another possible overrun · 4148c1f6
      Greg Kroah-Hartman authored
      There is one other possible overrun in the lz4 code as implemented by
      Linux at this point in time (which differs from the upstream lz4
      codebase, but will get synced at in a future kernel release.)  As
      pointed out by Don, we also need to check the overflow in the data
      While we are at it, replace the odd error return value with just a
      "simple" -1 value as the return value is never used for anything other
      than a basic "did this work or not" check.
      Reported-by: default avatar"Don A. Bailey" <donb@securitymouse.com>
      Reported-by: default avatarWilly Tarreau <w@1wt.eu>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    • H. Peter Anvin's avatar
      Merge tag 'efi-urgent' into x86/urgent · ba3f35c7
      H. Peter Anvin authored
       * Fix a few compiler warnings (one being a real bug) in the arm64 EFI
         code that lots of people are running into and reporting - Catalin Marinas
       * Use a cast to avoid a 32-bit overflow issue when generating pstore
         filenames - Andrzej Zaborowski
      Signed-off-by: default avatarH. Peter Anvin <hpa@zytor.com>
    • Andrzej Zaborowski's avatar
      efi-pstore: Fix an overflow on 32-bit builds · 783ee431
      Andrzej Zaborowski authored
      In generic_id the long int timestamp is multiplied by 100000 and needs
      an explicit cast to u64.
      Without that the id in the resulting pstore filename is wrong and
      userspace may have problems parsing it, but more importantly files in
      pstore can never be deleted and may fill the EFI flash (brick device?).
      This happens because when generic pstore code wants to delete a file,
      it passes the id to the EFI backend which reinterpretes it and a wrong
      variable name is attempted to be deleted.  There's no error message but
      after remounting pstore, deleted files would reappear.
      Signed-off-by: default avatarAndrew Zaborowski <andrew.zaborowski@intel.com>
      Acked-by: default avatarDavid Rientjes <rientjes@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarMatt Fleming <matt.fleming@intel.com>
  7. 26 Jun, 2014 2 commits