Skip to content
Snippets Groups Projects
  1. Dec 12, 2015
    • Helge Deller's avatar
      parisc: Wire up mlock2 syscall · 5c477b45
      Helge Deller authored
      
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      5c477b45
    • Bjorn Helgaas's avatar
      parisc: Remove unused pcibios_init_bus() · 5f0e9b4c
      Bjorn Helgaas authored
      
      There are no callers of pcibios_init_bus(), so remove it.
      
      Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      5f0e9b4c
    • Mikulas Patocka's avatar
      parisc iommu: fix panic due to trying to allocate too large region · e46e31a3
      Mikulas Patocka authored
      
      When using the Promise TX2+ SATA controller on PA-RISC, the system often
      crashes with kernel panic, for example just writing data with the dd
      utility will make it crash.
      
      Kernel panic - not syncing: drivers/parisc/sba_iommu.c: I/O MMU @ 000000000000a000 is out of mapping resources
      
      CPU: 0 PID: 18442 Comm: mkspadfs Not tainted 4.4.0-rc2 #2
      Backtrace:
       [<000000004021497c>] show_stack+0x14/0x20
       [<0000000040410bf0>] dump_stack+0x88/0x100
       [<000000004023978c>] panic+0x124/0x360
       [<0000000040452c18>] sba_alloc_range+0x698/0x6a0
       [<0000000040453150>] sba_map_sg+0x260/0x5b8
       [<000000000c18dbb4>] ata_qc_issue+0x264/0x4a8 [libata]
       [<000000000c19535c>] ata_scsi_translate+0xe4/0x220 [libata]
       [<000000000c19a93c>] ata_scsi_queuecmd+0xbc/0x320 [libata]
       [<0000000040499bbc>] scsi_dispatch_cmd+0xfc/0x130
       [<000000004049da34>] scsi_request_fn+0x6e4/0x970
       [<00000000403e95a8>] __blk_run_queue+0x40/0x60
       [<00000000403e9d8c>] blk_run_queue+0x3c/0x68
       [<000000004049a534>] scsi_run_queue+0x2a4/0x360
       [<000000004049be68>] scsi_end_request+0x1a8/0x238
       [<000000004049de84>] scsi_io_completion+0xfc/0x688
       [<0000000040493c74>] scsi_finish_command+0x17c/0x1d0
      
      The cause of the crash is not exhaustion of the IOMMU space, there is
      plenty of free pages. The function sba_alloc_range is called with size
      0x11000, thus the pages_needed variable is 0x11. The function
      sba_search_bitmap is called with bits_wanted 0x11 and boundary size is
      0x10 (because dma_get_seg_boundary(dev) returns 0xffff).
      
      The function sba_search_bitmap attempts to allocate 17 pages that must not
      cross 16-page boundary - it can't satisfy this requirement
      (iommu_is_span_boundary always returns true) and fails even if there are
      many free entries in the IOMMU space.
      
      How did it happen that we try to allocate 17 pages that don't cross
      16-page boundary? The cause is in the function iommu_coalesce_chunks. This
      function tries to coalesce adjacent entries in the scatterlist. The
      function does several checks if it may coalesce one entry with the next,
      one of those checks is this:
      
      	if (startsg->length + dma_len > max_seg_size)
      		break;
      
      When it finishes coalescing adjacent entries, it allocates the mapping:
      
      sg_dma_len(contig_sg) = dma_len;
      dma_len = ALIGN(dma_len + dma_offset, IOVP_SIZE);
      sg_dma_address(contig_sg) =
      	PIDE_FLAG
      	| (iommu_alloc_range(ioc, dev, dma_len) << IOVP_SHIFT)
      	| dma_offset;
      
      It is possible that (startsg->length + dma_len > max_seg_size) is false
      (we are just near the 0x10000 max_seg_size boundary), so the funcion
      decides to coalesce this entry with the next entry. When the coalescing
      succeeds, the function performs
      	dma_len = ALIGN(dma_len + dma_offset, IOVP_SIZE);
      And now, because of non-zero dma_offset, dma_len is greater than 0x10000.
      iommu_alloc_range (a pointer to sba_alloc_range) is called and it attempts
      to allocate 17 pages for a device that must not cross 16-page boundary.
      
      To fix the bug, we must make sure that dma_len after addition of
      dma_offset and alignment doesn't cross the segment boundary. I.e. change
      	if (startsg->length + dma_len > max_seg_size)
      		break;
      to
      	if (ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) > max_seg_size)
      		break;
      
      This patch makes this change (it precalculates max_seg_boundary at the
      beginning of the function iommu_coalesce_chunks). I also added a check
      that the mapping length doesn't exceed dma_get_seg_boundary(dev) (it is
      not needed for Promise TX2+ SATA, but it may be needed for other devices
      that have dma_get_seg_boundary lower than dma_get_max_seg_size).
      
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      e46e31a3
    • Linus Torvalds's avatar
      Merge tag 'dm-4.4-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm · b9d85451
      Linus Torvalds authored
      Pull device mapper fixes from Mike Snitzer:
       "Five stable fixes:
      
         - Two DM btree bufio buffer leak fixes that resolve reported BUG_ONs
           during DM thinp metadata close's dm_bufio_client_destroy().
      
         - A DM thinp range discard fix to handle discarding a partially
           mapped range.
      
         - A DM thinp metadata snapshot fix to make sure the btree roots saved
           in the metadata snapshot are the most current.
      
         - A DM space map metadata refcounting fix that improves both DM thinp
           and DM cache metadata"
      
      * tag 'dm-4.4-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm btree: fix bufio buffer leaks in dm_btree_del() error path
        dm space map metadata: fix ref counting bug when bootstrapping a new space map
        dm thin metadata: fix bug when taking a metadata snapshot
        dm thin metadata: fix bug in dm_thin_remove_range()
        dm btree: fix leak of bufio-backed block in btree_split_sibling error path
      b9d85451
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse · 732c4a9e
      Linus Torvalds authored
      Pull fuse fixes from Miklos Szeredi:
       "Two bugfixes, both bound for -stable"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
        fuse: break infinite loop in fuse_fill_write_pages()
        cuse: fix memory leak
      732c4a9e
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 4be460d9
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Not too much this time.
      
         - One nouveau workaround extended to a few more GPUs
         - Some amdgpu big endian fixes, and a regression fixer
         - Some vmwgfx fixes
         - One ttm locking fix
         - One vgaarb fix"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        vgaarb: fix signal handling in vga_get()
        radeon: Fix VCE IB test on Big-Endian systems
        radeon: Fix VCE ring test for Big-Endian systems
        radeon/cik: Fix GFX IB test on Big-Endian
        drm/amdgpu: fix the lost duplicates checking
        drm/nouveau/pmu: remove whitelist for PGOB-exit WAR, enable by default
        drm/vmwgfx: Implement the cursor_set2 callback v2
        drm/vmwgfx: fix a warning message
        drm/ttm: Fixed a read/write lock imbalance
      4be460d9
  2. Dec 11, 2015
    • Kirill A. Shutemov's avatar
      vgaarb: fix signal handling in vga_get() · 9f5bd308
      Kirill A. Shutemov authored
      
      There are few defects in vga_get() related to signal hadning:
      
        - we shouldn't check for pending signals for TASK_UNINTERRUPTIBLE
          case;
      
        - if we found pending signal we must remove ourself from wait queue
          and change task state back to running;
      
        - -ERESTARTSYS is more appropriate, I guess.
      
      Signed-off-by: default avatarKirill A. Shutemov <kirill@shutemov.name>
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarDavid Herrmann <dh.herrmann@gmail.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      9f5bd308
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.4' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 49307da3
      Dave Airlie authored
      some big endian fixes and one regression fix.
      
      * 'drm-fixes-4.4' of git://people.freedesktop.org/~agd5f/linux:
        radeon: Fix VCE IB test on Big-Endian systems
        radeon: Fix VCE ring test for Big-Endian systems
        radeon/cik: Fix GFX IB test on Big-Endian
        drm/amdgpu: fix the lost duplicates checking
      49307da3
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · 0bd0f1e6
      Linus Torvalds authored
      Pull rdma fixes from Doug Ledford:
       "Most are minor to important fixes.
      
        There is one performance enhancement that I took on the grounds that
        failing to check if other processes can run before running what's
        intended to be a background, idle-time task is a bug, even though the
        primary effect of the fix is to improve performance (and it was a very
        simple patch)"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
        IB/mlx5: Postpone remove_keys under knowledge of coming preemption
        IB/mlx4: Use vmalloc for WR buffers when needed
        IB/mlx4: Use correct order of variables in log message
        iser-target: Remove explicit mlx4 work-around
        mlx4: Expose correct max_sge_rd limit
        IB/mad: Require CM send method for everything except ClassPortInfo
        IB/cma: Add a missing rcu_read_unlock()
        IB core: Fix ib_sg_to_pages()
        IB/srp: Fix srp_map_sg_fr()
        IB/srp: Fix indirect data buffer rkey endianness
        IB/srp: Initialize dma_length in srp_map_idb
        IB/srp: Fix possible send queue overflow
        IB/srp: Fix a memory leak
        IB/sa: Put netlink request into the request list before sending
        IB/iser: use sector_div instead of do_div
        IB/core: use RCU for uverbs id lookup
        IB/qib: Minor fixes to qib per SFF 8636
        IB/core: Fix user mode post wr corruption
        IB/qib: Fix qib_mr structure
      0bd0f1e6
    • Linus Torvalds's avatar
      Merge tag 'sound-4.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · a80c47da
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Again less intensive changes in this rc: you can find only a few
        HD-audio fixes (noise fixes for Intel Broxton chip and a few Thinkpad
        models, quirks for Alienware 17 and Packard Bell DOTS) in addition to
        a long-standing rme96 bug fix"
      
      * tag 'sound-4.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda/ca0132 - quirk for Alienware 17 2015
        ALSA: hda - Fix noise problems on Thinkpad T440s
        ALSA: hda - Fixing speaker noise on the two latest thinkpad models
        ALSA: hda - Add inverted dmic for Packard Bell DOTS
        ALSA: hda - Fix playback noise with 24/32 bit sample size on BXT
        ALSA: rme96: Fix unexpected volume reset after rate changes
      a80c47da
  3. Dec 10, 2015
    • Joe Thornber's avatar
      dm btree: fix bufio buffer leaks in dm_btree_del() error path · ed8b45a3
      Joe Thornber authored
      
      If dm_btree_del()'s call to push_frame() fails, e.g. due to
      btree_node_validator finding invalid metadata, the dm_btree_del() error
      path must unlock all frames (which have active dm-bufio buffers) that
      were pushed onto the del_stack.
      
      Otherwise, dm_bufio_client_destroy() will BUG_ON() because dm-bufio
      buffers have leaked, e.g.:
        device-mapper: bufio: leaked buffer 3, hold count 1, list 0
      
      Signed-off-by: default avatarJoe Thornber <ejt@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Cc: stable@vger.kernel.org
      ed8b45a3
    • Linus Torvalds's avatar
      Merge tag 'vfio-v4.4-rc5' of git://github.com/awilliam/linux-vfio · 6764e5eb
      Linus Torvalds authored
      Pull VFIO fixes from Alex Williamson:
      
       - Various fixes for removing redundancy, const'ifying structs, avoiding
         stack usage, fixing WARN usage (Krzysztof Kozlowski, Julia Lawall,
         Kees Cook, Dan Carpenter)
      
       - Revert No-IOMMU mode as the intended user has not emerged (Alex
         Williamson)
      
      * tag 'vfio-v4.4-rc5' of git://github.com/awilliam/linux-vfio:
        Revert: "vfio: Include No-IOMMU mode"
        vfio: fix a warning message
        vfio: platform: remove needless stack usage
        vfio-pci: constify pci_error_handlers structures
        vfio: Drop owner assignment from platform_driver
      6764e5eb
    • Linus Torvalds's avatar
      Merge tag 'devicetree-fixes-for-4.4-rc4' of... · eef121f4
      Linus Torvalds authored
      Merge tag 'devicetree-fixes-for-4.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
      
      Pull DT fixes from Rob Herring:
       "I think this should be all for 4.4:
      
         - Fix incorrect warning about overlapping memory regions
      
         - Export of_irq_find_parent again which was made static in 4.4, but
           has users pending for 4.5.
      
         - Fix of_msi_map_rid declaration location
      
         - Fix re-entrancy for of_fdt_unflatten_tree
      
         - Clean-up of phys_addr_t printks"
      
      * tag 'devicetree-fixes-for-4.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
        of/irq: move of_msi_map_rid declaration to the correct ifdef section
        of/irq: Export of_irq_find_parent again
        of/fdt: Add mutex protection for calls to __unflatten_device_tree()
        of/address: fix typo in comment block of of_translate_one()
        of: do not use 0x in front of %pa
        of: Fix comparison of reserved memory regions
      eef121f4
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · abb7e2b3
      Linus Torvalds authored
      Pull clk fixes from Stephen Boyd:
       "One small build fix, a couple do_div() fixes, and a fix for the gpio
        basic clock type are the major changes here.  There's also a couple
        fixes for the TI, sunxi, and scpi clock drivers"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: sunxi: pll2: Fix clock running too fast
        clk: scpi: add missing of_node_put
        clk: qoriq: fix memory leak
        imx/clk-pllv2: fix wrong do_div() usage
        imx/clk-pllv1: fix wrong do_div() usage
        clk: mmp: add linux/clk.h includes
        clk: ti: drop locking code from mux/divider drivers
        clk: ti816x: Add missing dmtimer clkdev entries
        clk: ti: fapll: fix wrong do_div() usage
        clk: ti: clkt_dpll: fix wrong do_div() usage
        clk: gpio: Get parent clk names in of_gpio_clk_setup()
      abb7e2b3
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.4-1' of git://git.code.sf.net/p/openipmi/linux-ipmi · 9a0f76fd
      Linus Torvalds authored
      Pull IPMI fix from Corey Minyard:
       "Fix an Oops if an interrupt occurs at startup.  This can happen on
        some hardware"
      
      * tag 'for-linus-4.4-1' of git://git.code.sf.net/p/openipmi/linux-ipmi:
        ipmi: move timer init to before irq is setup
      9a0f76fd
    • Jan Stancek's avatar
      ipmi: move timer init to before irq is setup · 27f972d3
      Jan Stancek authored
      
      We encountered a panic on boot in ipmi_si on a dell per320 due to an
      uninitialized timer as follows.
      
      static int smi_start_processing(void       *send_info,
                                      ipmi_smi_t intf)
      {
              /* Try to claim any interrupts. */
              if (new_smi->irq_setup)
                      new_smi->irq_setup(new_smi);
      
       --> IRQ arrives here and irq handler tries to modify uninitialized timer
      
          which triggers BUG_ON(!timer->function) in __mod_timer().
      
       Call Trace:
         <IRQ>
         [<ffffffffa0532617>] start_new_msg+0x47/0x80 [ipmi_si]
         [<ffffffffa053269e>] start_check_enables+0x4e/0x60 [ipmi_si]
         [<ffffffffa0532bd8>] smi_event_handler+0x1e8/0x640 [ipmi_si]
         [<ffffffff810f5584>] ? __rcu_process_callbacks+0x54/0x350
         [<ffffffffa053327c>] si_irq_handler+0x3c/0x60 [ipmi_si]
         [<ffffffff810efaf0>] handle_IRQ_event+0x60/0x170
         [<ffffffff810f245e>] handle_edge_irq+0xde/0x180
         [<ffffffff8100fc59>] handle_irq+0x49/0xa0
         [<ffffffff8154643c>] do_IRQ+0x6c/0xf0
         [<ffffffff8100ba53>] ret_from_intr+0x0/0x11
      
              /* Set up the timer that drives the interface. */
              setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
      
      The following patch fixes the problem.
      
      To: Openipmi-developer@lists.sourceforge.net
      To: Corey Minyard <minyard@acm.org>
      CC: linux-kernel@vger.kernel.org
      
      Signed-off-by: default avatarJan Stancek <jstancek@redhat.com>
      Signed-off-by: default avatarTony Camuso <tcamuso@redhat.com>
      Signed-off-by: default avatarCorey Minyard <cminyard@mvista.com>
      Cc: stable@vger.kernel.org # Applies cleanly to 3.10-, needs small rework before
      27f972d3
    • Sasha Levin's avatar
      bitops.h: correctly handle rol32 with 0 byte shift · d7e35dfa
      Sasha Levin authored
      ROL on a 32 bit integer with a shift of 32 or more is undefined and the
      result is arch-dependent. Avoid this by handling the trivial case of
      roling by 0 correctly.
      
      The trivial solution of checking if shift is 0 breaks gcc's detection
      of this code as a ROL instruction, which is unacceptable.
      
      This bug was reported and fixed in GCC
      (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=57157
      
      ):
      
      	The standard rotate idiom,
      
      	  (x << n) | (x >> (32 - n))
      
      	is recognized by gcc (for concreteness, I discuss only the case that x
      	is an uint32_t here).
      
      	However, this is portable C only for n in the range 0 < n < 32. For n
      	== 0, we get x >> 32 which gives undefined behaviour according to the
      	C standard (6.5.7, Bitwise shift operators). To portably support n ==
      	0, one has to write the rotate as something like
      
      	  (x << n) | (x >> ((-n) & 31))
      
      	And this is apparently not recognized by gcc.
      
      Note that this is broken on older GCCs and will result in slower ROL.
      
      Acked-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d7e35dfa
    • Joe Thornber's avatar
      dm space map metadata: fix ref counting bug when bootstrapping a new space map · 50dd842a
      Joe Thornber authored
      
      When applying block operations (BOPs) do not remove them from the
      uncommitted BOP ring-buffer until after they've been applied -- in case
      we recurse.
      
      Also, perform BOP_INC operation, in dm_sm_metadata_create() and
      sm_metadata_extend(), in terms of the uncommitted BOP ring-buffer rather
      than using direct calls to sm_ll_inc().
      
      Signed-off-by: default avatarJoe Thornber <ejt@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Cc: stable@vger.kernel.org
      50dd842a
    • Joe Thornber's avatar
      dm thin metadata: fix bug when taking a metadata snapshot · 49e99fc7
      Joe Thornber authored
      
      When you take a metadata snapshot the btree roots for the mapping and
      details tree need to have their reference counts incremented so they
      persist for the lifetime of the metadata snap.
      
      The roots being incremented were those currently written in the
      superblock, which could possibly be out of date if concurrent IO is
      triggering new mappings, breaking of sharing, etc.
      
      Fix this by performing a commit with the metadata lock held while taking
      a metadata snapshot.
      
      Signed-off-by: default avatarJoe Thornber <ejt@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Cc: stable@vger.kernel.org
      49e99fc7
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 626d114f
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "A couple of fixes, both -stable fodder (9p one all way back to 2.6.32,
        dio - to all branches where "Fix negative return from dio read beyond
        eof" will end up it; it's a fixup to commit marked for -stable)"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        fix the regression from "direct-io: Fix negative return from dio read beyond eof"
        9p: ->evict_inode() should kick out ->i_data, not ->i_mapping
      626d114f
    • Linus Torvalds's avatar
      Merge tag 'pci-v4.4-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · 978d6a90
      Linus Torvalds authored
      Pull PCI fixes from Bjorn Helgaas:
       "These are more fixes I'd like to have in v4.4.  Several for the Altera
        driver added for v4.4, and one for an MSI domain problem that affects
        several arm64 platforms:
      
        MSI:
         - Only use the generic MSI layer when domain is hierarchical (Marc
           Zyngier)
      
        Altera host bridge driver:
         - Fix loop in tlp_read_packet() (Dan Carpenter)
         - Fix Requester ID for config accesses (Ley Foon Tan)
         - Check TLP completion status (Ley Foon Tan)
         - Fix error when INTx is 4 (Ley Foon Tan)"
      
      * tag 'pci-v4.4-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        PCI: altera: Fix error when INTx is 4
        PCI: altera: Check TLP completion status
        PCI: altera: Fix Requester ID for config accesses
        PCI: altera: Fix loop in tlp_read_packet()
        PCI/MSI: Only use the generic MSI layer when domain is hierarchical
      978d6a90
    • Gabriele Martino's avatar
      ALSA: hda/ca0132 - quirk for Alienware 17 2015 · 5328e1ea
      Gabriele Martino authored
      
      The Alienware 17 (2015) has the same card and pin configuration of the
      Alienware 15, so the same quirks must be applied.
      
      Signed-off-by: default avatarGabriele Martino <g.martino@gmx.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      5328e1ea
  4. Dec 09, 2015