1. 11 6月, 2015 4 次提交
  2. 06 6月, 2015 9 次提交
  3. 05 6月, 2015 2 次提交
    • H
      compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap() · 9b7b819c
      Helge Deller 提交于
      In the functions compat_get_bitmap() and compat_put_bitmap() the
      variable nr_compat_longs stores how many compat_ulong_t words should be
      copied in a loop.
      
      The copy loop itself is this:
        if (nr_compat_longs-- > 0) {
            if (__get_user(um, umask)) return -EFAULT;
        } else {
            um = 0;
        }
      
      Since nr_compat_longs gets unconditionally decremented in each loop and
      since it's type is unsigned this could theoretically lead to out of
      bounds accesses to userspace if nr_compat_longs wraps around to
      (unsigned)(-1).
      
      Although the callers currently do not trigger out-of-bounds accesses, we
      should better implement the loop in a safe way to completely avoid such
      warp-arounds.
      Signed-off-by: NHelge Deller <deller@gmx.de>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      9b7b819c
    • L
      Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma · ff25ea8f
      Linus Torvalds 提交于
      Pull dmaengine fixes from Vinod Koul:
       "We have two small fixes:
      
         - pl330 termination hang fix by Krzysztof
      
         - hsu memory leak fix by Peter"
      
      * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: hsu: Fix memory leak when stopping a running transfer
        dmaengine: pl330: Fix hang on dmaengine_terminate_all on certain boards
      ff25ea8f
  4. 04 6月, 2015 9 次提交
  5. 03 6月, 2015 8 次提交
  6. 02 6月, 2015 8 次提交
    • P
      dmaengine: hsu: Fix memory leak when stopping a running transfer · 42977082
      Peter Ujfalusi 提交于
      The vd->node is removed from the lists when the transfer started so the
      vchan_get_all_descriptors() will not find it. This results memory leak.
      Signed-off-by: NPeter Ujfalusi <peter.ujfalusi@ti.com>
      [andy: fix the typo to prevent a compilation error]
      Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: NVinod Koul <vinod.koul@intel.com>
      42977082
    • A
      x86/asm/irq: Stop relying on magic JMP behavior for early_idt_handlers · 425be567
      Andy Lutomirski 提交于
      The early_idt_handlers asm code generates an array of entry
      points spaced nine bytes apart.  It's not really clear from that
      code or from the places that reference it what's going on, and
      the code only works in the first place because GAS never
      generates two-byte JMP instructions when jumping to global
      labels.
      
      Clean up the code to generate the correct array stride (member size)
      explicitly. This should be considerably more robust against
      screw-ups, as GAS will warn if a .fill directive has a negative
      count.  Using '. =' to advance would have been even more robust
      (it would generate an actual error if it tried to move
      backwards), but it would pad with nulls, confusing anyone who
      tries to disassemble the code.  The new scheme should be much
      clearer to future readers.
      
      While we're at it, improve the comments and rename the array and
      common code.
      
      Binutils may start relaxing jumps to non-weak labels.  If so,
      this change will fix our build, and we may need to backport this
      change.
      
      Before, on x86_64:
      
        0000000000000000 <early_idt_handlers>:
           0:   6a 00                   pushq  $0x0
           2:   6a 00                   pushq  $0x0
           4:   e9 00 00 00 00          jmpq   9 <early_idt_handlers+0x9>
                                5: R_X86_64_PC32        early_idt_handler-0x4
        ...
          48:   66 90                   xchg   %ax,%ax
          4a:   6a 08                   pushq  $0x8
          4c:   e9 00 00 00 00          jmpq   51 <early_idt_handlers+0x51>
                                4d: R_X86_64_PC32       early_idt_handler-0x4
        ...
         117:   6a 00                   pushq  $0x0
         119:   6a 1f                   pushq  $0x1f
         11b:   e9 00 00 00 00          jmpq   120 <early_idt_handler>
                                11c: R_X86_64_PC32      early_idt_handler-0x4
      
      After:
      
        0000000000000000 <early_idt_handler_array>:
           0:   6a 00                   pushq  $0x0
           2:   6a 00                   pushq  $0x0
           4:   e9 14 01 00 00          jmpq   11d <early_idt_handler_common>
        ...
          48:   6a 08                   pushq  $0x8
          4a:   e9 d1 00 00 00          jmpq   120 <early_idt_handler_common>
          4f:   cc                      int3
          50:   cc                      int3
        ...
         117:   6a 00                   pushq  $0x0
         119:   6a 1f                   pushq  $0x1f
         11b:   eb 03                   jmp    120 <early_idt_handler_common>
         11d:   cc                      int3
         11e:   cc                      int3
         11f:   cc                      int3
      Signed-off-by: NAndy Lutomirski <luto@kernel.org>
      Acked-by: NH. Peter Anvin <hpa@linux.intel.com>
      Cc: Binutils <binutils@sourceware.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: H.J. Lu <hjl.tools@gmail.com>
      Cc: Jan Beulich <JBeulich@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: <stable@vger.kernel.org>
      Link: http://lkml.kernel.org/r/ac027962af343b0c599cbfcf50b945ad2ef3d7a8.1432336324.git.luto@kernel.orgSigned-off-by: NIngo Molnar <mingo@kernel.org>
      425be567
    • J
      Revert "iommu/amd: Don't allocate with __GFP_ZERO in alloc_coherent" · 2d0ec7a1
      Joerg Roedel 提交于
      This reverts commit 5fc872c7.
      
      The DMA-API does not strictly require that the memory
      returned by dma_alloc_coherent is zeroed out. For that
      another function (dma_zalloc_coherent) should be used. But
      all other x86 DMA-API implementation I checked zero out the
      memory, so that some drivers rely on it and break when it is
      not.
      
      It seems the (driver-)world is not yet ready for this
      change, so revert it.
      Signed-off-by: NJoerg Roedel <jroedel@suse.de>
      2d0ec7a1
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c46a024e
      Linus Torvalds 提交于
      Pull networking fixes from David Miller:
      
       1) Various VTI tunnel (mark handling, PMTU) bug fixes from Alexander
          Duyck and Steffen Klassert.
      
       2) Revert ethtool PHY query change, it wasn't correct.  The PHY address
          selected by the driver running the PHY to MAC connection decides
          what PHY address GET ethtool operations return information from.
      
       3) Fix handling of sequence number bits for encryption IV generation in
          ESP driver, from Herbert Xu.
      
       4) UDP can return -EAGAIN when we hit a bad checksum on receive, even
          when there are other packets in the receive queue which is wrong.
          Just respect the error returned from the generic socket recv
          datagram helper.  From Eric Dumazet.
      
       5) Fix BNA driver firmware loading on big-endian systems, from Ivan
          Vecera.
      
       6) Fix regression in that we were inheriting the congestion control of
          the listening socket for new connections, the intended behavior
          always was to use the default in this case.  From Neal Cardwell.
      
       7) Fix NULL deref in brcmfmac driver, from Arend van Spriel.
      
       8) OTP parsing fix in iwlwifi from Liad Kaufman.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits)
        vti6: Add pmtu handling to vti6_xmit.
        Revert "net: core: 'ethtool' issue with querying phy settings"
        bnx2x: Move statistics implementation into semaphores
        xen: netback: read hotplug script once at start of day.
        xen: netback: fix printf format string warning
        Revert "netfilter: ensure number of counters is >0 in do_replace()"
        net: dsa: Properly propagate errors from dsa_switch_setup_one
        tcp: fix child sockets to use system default congestion control if not set
        udp: fix behavior of wrong checksums
        sfc: free multiple Rx buffers when required
        bna: fix soft lock-up during firmware initialization failure
        bna: remove unreasonable iocpf timer start
        bna: fix firmware loading on big-endian machines
        bridge: fix br_multicast_query_expired() bug
        via-rhine: Resigning as maintainer
        brcmfmac: avoid null pointer access when brcmf_msgbuf_get_pktid() fails
        mac80211: Fix mac80211.h docbook comments
        iwlwifi: nvm: fix otp parsing in 8000 hw family
        iwlwifi: pcie: fix tracking of cmd_in_flight
        ip_vti/ip6_vti: Preserve skb->mark after rcv_cb call
        ...
      c46a024e
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 2459c609
      Linus Torvalds 提交于
      Pull Sparc fixes from David Miller:
      
       1) Setup the core/threads/sockets bitmaps correctly so that 'lscpus'
          and friends operate properly.  Frtom Chris Hyser.
      
       2) The bit that normally means "Cached Virtually" on sun4v systems,
          actually changes meaning in M7 and later chips.  Fix from Khalid
          Aziz.
      
       3) One some PCI-E systems we need to probe different OF properties to
          fill in the PCI slot information properly, from Eric Snowberg.
      
       4) Kill an extraneous memset after kzalloc(), from Christophe Jaillet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc: Resolve conflict between sparc v9 and M7 on usage of bit 9 of TTE
        sparc64: pci slots information is not populated in sysfs
        sparc: kernel: GRPCI2: Remove a useless memset
        sparc64: Setup sysfs to mark LDOM sockets, cores and threads correctly
      2459c609
    • A
      drm/radeon: use proper ACR regisiter for DCE3.2 · 091f0a70
      Alex Deucher 提交于
      Using the DCE2 one by accident afer the audio rework.
      
      Bug:
      https://bugs.freedesktop.org/show_bug.cgi?id=90777Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
      Cc: stable@vger.kernel.org
      091f0a70
    • L
      Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost · fec345ba
      Linus Torvalds 提交于
      Pull virtio fix from Michael Tsirkin:
       "Last-minute virtio fix for 4.1
      
        This tweaks an exported user-space header to fix build breakage for
        userspace using it"
      
      * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
        include/uapi/linux/virtio_balloon.h: include linux/virtio_types.h
      fec345ba
    • D
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · e453581d
      David S. Miller 提交于
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fix for net
      
      The following patch reverts the ebtables chunk that enforces counters that was
      introduced in the recently applied d26e2c9f ('Revert "netfilter: ensure
      number of counters is >0 in do_replace()"') since this breaks ebtables.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e453581d