1. 08 3月, 2016 1 次提交
    • K
      PCI: Allow a NULL "parent" pointer in pci_bus_assign_domain_nr() · 54c6e2dd
      Krzysztof =?utf-8?Q?Ha=C5=82asa?= 提交于
      pci_create_root_bus() passes a "parent" pointer to
      pci_bus_assign_domain_nr().  When CONFIG_PCI_DOMAINS_GENERIC is defined,
      pci_bus_assign_domain_nr() dereferences that pointer.  Many callers of
      pci_create_root_bus() supply a NULL "parent" pointer, which leads to a NULL
      pointer dereference error.
      
      7c674700 ("PCI: Move domain assignment from arm64 to generic code")
      moved the "parent" dereference from arm64 to generic code.  Only arm64 used
      that code (because only arm64 defined CONFIG_PCI_DOMAINS_GENERIC), and it
      always supplied a valid "parent" pointer.  Other arches supplied NULL
      "parent" pointers but didn't defined CONFIG_PCI_DOMAINS_GENERIC, so they
      used a no-op version of pci_bus_assign_domain_nr().
      
      8c7d1474 ("ARM/PCI: Move to generic PCI domains") defined
      CONFIG_PCI_DOMAINS_GENERIC on ARM, and many ARM platforms use
      pci_common_init(), which supplies a NULL "parent" pointer.
      These platforms (cns3xxx, dove, footbridge, iop13xx, etc.) crash
      with a NULL pointer dereference like this while probing PCI:
      
        Unable to handle kernel NULL pointer dereference at virtual address 000000a4
        PC is at pci_bus_assign_domain_nr+0x10/0x84
        LR is at pci_create_root_bus+0x48/0x2e4
        Kernel panic - not syncing: Attempted to kill init!
      
      [bhelgaas: changelog, add "Reported:" and "Fixes:" tags]
      Reported: http://forum.doozan.com/read.php?2,17868,22070,quote=1
      Fixes: 8c7d1474 ("ARM/PCI: Move to generic PCI domains")
      Fixes: 7c674700 ("PCI: Move domain assignment from arm64 to generic code")
      Signed-off-by: NKrzysztof Hałasa <khalasa@piap.pl>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      Acked-by: NLorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      CC: stable@vger.kernel.org	# v4.0+
      54c6e2dd
  2. 01 3月, 2016 2 次提交
    • M
      PCI: layerscape: Fix MSG TLP drop setting · 1195c103
      Minghuan Lian 提交于
      Some kinds of Layerscape PCIe controllers will forward the received message
      TLPs to system application address space, which could corrupt system memory
      or lead to a system hang.  Enable MSG_DROP to fix this issue.
      Signed-off-by: NMinghuan Lian <Minghuan.Lian@nxp.com>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      1195c103
    • M
      PCI: keystone: Fix MSI code that retrieves struct pcie_port pointer · 79e3f4a8
      Murali Karicheri 提交于
      Commit cbce7900 ("PCI: designware: Make driver arch-agnostic") changed
      the host bridge sysdata pointer from the ARM pci_sys_data to the DesignWare
      pcie_port structure, and changed pcie-designware.c to reflect that.  But it
      did not change the corresponding code in pci-keystone-dw.c, so it caused
      crashes on Keystone:
      
        Unable to handle kernel NULL pointer dereference at virtual address 00000030
        pgd = c0003000
        [00000030] *pgd=80000800004003, *pmd=00000000
        Internal error: Oops: 206 [#1] PREEMPT SMP ARM
        CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.4.2-00139-gb74f926 #2
        Hardware name: Keystone
        PC is at ks_dw_pcie_msi_irq_unmask+0x24/0x58
      
      Change pci-keystone-dw.c to expect sysdata to be the struct pcie_port
      pointer.
      
      [bhelgaas: changelog]
      Fixes: cbce7900 ("PCI: designware: Make driver arch-agnostic")
      Signed-off-by: NMurali Karicheri <m-karicheri2@ti.com>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      CC: stable@vger.kernel.org	# v4.4+
      CC: Zhou Wang <wangzhou1@hisilicon.com>
      79e3f4a8
  3. 27 2月, 2016 2 次提交
  4. 18 2月, 2016 2 次提交
  5. 06 2月, 2016 2 次提交
  6. 28 1月, 2016 1 次提交
  7. 26 1月, 2016 1 次提交
    • S
      PCI/AER: Flush workqueue on device remove to avoid use-after-free · 4ae2182b
      Sebastian Andrzej Siewior 提交于
      A Root Port's AER structure (rpc) contains a queue of events.  aer_irq()
      enqueues AER status information and schedules aer_isr() to dequeue and
      process it.  When we remove a device, aer_remove() waits for the queue to
      be empty, then frees the rpc struct.
      
      But aer_isr() references the rpc struct after dequeueing and possibly
      emptying the queue, which can cause a use-after-free error as in the
      following scenario with two threads, aer_isr() on the left and a
      concurrent aer_remove() on the right:
      
        Thread A                      Thread B
        --------                      --------
        aer_irq():
          rpc->prod_idx++
                                      aer_remove():
                                        wait_event(rpc->prod_idx == rpc->cons_idx)
                                        # now blocked until queue becomes empty
        aer_isr():                      # ...
          rpc->cons_idx++               # unblocked because queue is now empty
          ...                           kfree(rpc)
          mutex_unlock(&rpc->rpc_mutex)
      
      To prevent this problem, use flush_work() to wait until the last scheduled
      instance of aer_isr() has completed before freeing the rpc struct in
      aer_remove().
      
      I reproduced this use-after-free by flashing a device FPGA and
      re-enumerating the bus to find the new device.  With SLUB debug, this
      crashes with 0x6b bytes (POISON_FREE, the use-after-free magic number) in
      GPR25:
      
        pcieport 0000:00:00.0: AER: Multiple Corrected error received: id=0000
        Unable to handle kernel paging request for data at address 0x27ef9e3e
        Workqueue: events aer_isr
        GPR24: dd6aa000 6b6b6b6b 605f8378 605f8360 d99b12c0 604fc674 606b1704 d99b12c0
        NIP [602f5328] pci_walk_bus+0xd4/0x104
      
      [bhelgaas: changelog, stable tag]
      Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      CC: stable@vger.kernel.org
      4ae2182b
  8. 25 1月, 2016 11 次提交
    • L
      Linux 4.5-rc1 · 92e963f5
      Linus Torvalds 提交于
      92e963f5
    • L
      Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus · e2464688
      Linus Torvalds 提交于
      Pull MIPS updates from Ralf Baechle:
       "This is the main pull request for MIPS for 4.5 plus some 4.4 fixes.
      
        The executive summary:
      
         - ATH79 platform improvments, use DT bindings for the ATH79 USB PHY.
         - Avoid useless rebuilds for zboot.
         - jz4780: Add NEMC, BCH and NAND device tree nodes
         - Initial support for the MicroChip's DT platform.  As all the device
           drivers are missing this is still of limited use.
         - Some Loongson3 cleanups.
         - The unavoidable whitespace polishing.
         - Reduce clock skew when synchronizing the CPU cycle counters on CPU
           startup.
         - Add MIPS R6 fixes.
         - Lots of cleanups across arch/mips as fallout from KVM.
         - Lots of minor fixes and changes for IEEE 754-2008 support to the
           FPU emulator / fp-assist software.
         - Minor Ralink, BCM47xx and bcm963xx platform support improvments.
         - Support SMP on BCM63168"
      
      * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (84 commits)
        MIPS: zboot: Add support for serial debug using the PROM
        MIPS: zboot: Avoid useless rebuilds
        MIPS: BMIPS: Enable ARCH_WANT_OPTIONAL_GPIOLIB
        MIPS: bcm63xx: nvram: Remove unused bcm63xx_nvram_get_psi_size() function
        MIPS: bcm963xx: Update bcm_tag field image_sequence
        MIPS: bcm963xx: Move extended flash address to bcm_tag header file
        MIPS: bcm963xx: Move Broadcom BCM963xx image tag data structure
        MIPS: bcm63xx: nvram: Use nvram structure definition from header file
        MIPS: bcm963xx: Add Broadcom BCM963xx board nvram data structure
        MAINTAINERS: Add KVM for MIPS entry
        MIPS: KVM: Add missing newline to kvm_err()
        MIPS: Move KVM specific opcodes into asm/inst.h
        MIPS: KVM: Use cacheops.h definitions
        MIPS: Break down cacheops.h definitions
        MIPS: Use EXCCODE_ constants with set_except_vector()
        MIPS: Update trap codes
        MIPS: Move Cause.ExcCode trap codes to mipsregs.h
        MIPS: KVM: Make kvm_mips_{init,exit}() static
        MIPS: KVM: Refactor added offsetof()s
        MIPS: KVM: Convert EXPORT_SYMBOL to _GPL
        ...
      e2464688
    • L
      Merge tag 'platform-drivers-x86-v4.5-2' of... · e1c10879
      Linus Torvalds 提交于
      Merge tag 'platform-drivers-x86-v4.5-2' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86
      
      Pull x86 platform driver updates from Darren Hart:
       "Emergency travel prevented me from completing my final testing on this
        until today.  Nothing here that couldn't wait until RC1 fixes, but I
        thought it best to get it out sooner rather than later as it does
        contain a build warning fix.
      
        Summary:
      
        A build warning fix, MAINTAINERS cleanup, and a new DMI quirk:
      
        ideapad-laptop:
         - Add Lenovo Yoga 700 to no_hw_rfkill dmi list
      
        MAINTAINERS:
         - Combine multiple telemetry entries
      
        intel_telemetry_debugfs:
         - Fix unused warnings in telemetry debugfs"
      
      * tag 'platform-drivers-x86-v4.5-2' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86:
        ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list
        MAINTAINERS: Combine multiple telemetry entries
        intel_telemetry_debugfs: Fix unused warnings in telemetry debugfs
      e1c10879
    • L
      Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux · 81f05fee
      Linus Torvalds 提交于
      Pull thermal management updates from Zhang Rui:
       "The top merge commit was re-generated yesterday because two topic
        branches were dropped from this pull request in the last minute due to
        some unaddressed comments.  All the other material has been in
        linux-next for quite a while.
      
        Specifics:
      
         - Enhance thermal core to handle unexpected device cooling states
           after fresh boot and system resume.  From Zhang Rui and Chen Yu.
      
         - Several fixes and cleanups on Rockchip and RCAR thermal drivers.
           From Caesar Wang and Kuninori Morimoto.
      
         - Add Broxton support for Intel processor thermal reporting device
           driver.  From Amy Wiles"
      
      * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
        thermal: trip_point_temp_store() calls thermal_zone_device_update()
        thermal: rcar: rcar_thermal_get_temp() return error if strange temp
        thermal: rcar: check irq possibility in rcar_thermal_irq_xxx()
        thermal: rcar: check every rcar_thermal_update_temp() return value
        thermal: rcar: move rcar_thermal_dt_ids to upside
        thermal: rockchip: Support the RK3399 SoCs in thermal driver
        thermal: rockchip: Support the RK3228 SoCs in thermal driver
        dt-bindings: rockchip-thermal: Support the RK3228/RK3399 SoCs compatible
        thermal: rockchip: fix a trivial typo
        Thermal: Enable Broxton SoC thermal reporting device
        thermal: constify pch_dev_ops structure
        Thermal: do thermal zone update after a cooling device registered
        Thermal: handle thermal zone device properly during system sleep
        Thermal: initialize thermal zone device correctly
      81f05fee
    • L
      Merge tag 'for-linus-4.5-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs · c52cb431
      Linus Torvalds 提交于
      Pull 9p updates from Eric Van Hensbergen:
       "Sorry for the last minute pull request, there's was a change that
        didn't get pulled into for-next until two weeks ago and I wanted to
        give it some bake time.
      
        Summary:
      
        Rework and error handling fixes, primarily in the fscatch and fd
        transports"
      
      * tag 'for-linus-4.5-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
        fs/9p: use fscache mutex rather than spinlock
        9p: trans_fd, bail out if recv fcall if missing
        9p: trans_fd, read rework to use p9_parse_header
        net/9p: Add device name details on error
      c52cb431
    • L
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client · 00e3f5cc
      Linus Torvalds 提交于
      Pull Ceph updates from Sage Weil:
       "The two main changes are aio support in CephFS, and a series that
        fixes several issues in the authentication key timeout/renewal code.
      
        On top of that are a variety of cleanups and minor bug fixes"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
        libceph: remove outdated comment
        libceph: kill off ceph_x_ticket_handler::validity
        libceph: invalidate AUTH in addition to a service ticket
        libceph: fix authorizer invalidation, take 2
        libceph: clear messenger auth_retry flag if we fault
        libceph: fix ceph_msg_revoke()
        libceph: use list_for_each_entry_safe
        ceph: use i_size_{read,write} to get/set i_size
        ceph: re-send AIO write request when getting -EOLDSNAP error
        ceph: Asynchronous IO support
        ceph: Avoid to propagate the invalid page point
        ceph: fix double page_unlock() in page_mkwrite()
        rbd: delete an unnecessary check before rbd_dev_destroy()
        libceph: use list_next_entry instead of list_entry_next
        ceph: ceph_frag_contains_value can be boolean
        ceph: remove unused functions in ceph_frag.h
      00e3f5cc
    • L
      Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 · 772950ed
      Linus Torvalds 提交于
      Pull SMB3 fixes from Steve French:
       "A collection of CIFS/SMB3 fixes.
      
        It includes a couple bug fixes, a few for improved debugging of
        cifs.ko and some improvements to the way cifs does key generation.
      
        I do have some additional bug fixes I expect in the next week or two
        (to address a problem found by xfstest, and some fixes for SMB3.11
        dialect, and a couple patches that just came in yesterday that I am
        reviewing)"
      
      * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
        cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
        cifs: fix race between call_async() and reconnect()
        Prepare for encryption support (first part). Add decryption and encryption key generation. Thanks to Metze for helping with this.
        cifs: Allow using O_DIRECT with cache=loose
        cifs: Make echo interval tunable
        cifs: Check uniqueid for SMB2+ and return -ESTALE if necessary
        Print IP address of unresponsive server
        cifs: Ratelimit kernel log messages
      772950ed
    • J
      ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list · 6b31de3e
      Josh Boyer 提交于
      Like the Yoga 900 models the Lenovo Yoga 700 does not have a
      hw rfkill switch, and trying to read the hw rfkill switch through the
      ideapad module causes it to always reported blocking breaking wifi.
      
      This commit adds the Lenovo Yoga 700 to the no_hw_rfkill dmi list, fixing
      the wifi breakage.
      
      BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1295272
      Tested-by: <dinyar.rabady+spam@gmail.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NJosh Boyer <jwboyer@fedoraproject.org>
      Signed-off-by: NDarren Hart <dvhart@linux.intel.com>
      6b31de3e
    • S
      MAINTAINERS: Combine multiple telemetry entries · f1fc3cd8
      Souvik Kumar Chakravarty 提交于
      This patch combines all the telemetry file entries in MAINTAINERS via
      wildcard.
      Signed-off-by: NSouvik Kumar Chakravarty <souvik.k.chakravarty@intel.com>
      Signed-off-by: NDarren Hart <dvhart@linux.intel.com>
      f1fc3cd8
    • S
      intel_telemetry_debugfs: Fix unused warnings in telemetry debugfs · 7885f2f9
      Souvik Kumar Chakravarty 提交于
      This patch fixes compile time warnings when CONFIG_PM_SLEEP
      is undefined. In this case sleep related counters are unused.
      Signed-off-by: NSouvik Kumar Chakravarty <souvik.k.chakravarty@intel.com>
      Signed-off-by: NDarren Hart <dvhart@linux.intel.com>
      7885f2f9
    • C
      vmstat: Remove BUG_ON from vmstat_update · 587198ba
      Christoph Lameter 提交于
      If we detect that there is nothing to do just set the flag and do not
      check if it was already set before.  Races really do not matter.  If the
      flag is set by any code then the shepherd will start dealing with the
      situation and reenable the vmstat workers when necessary again.
      
      Since commit 0eb77e98 ("vmstat: make vmstat_updater deferrable again
      and shut down on idle") quiet_vmstat might update cpu_stat_off and mark
      a particular cpu to be handled by vmstat_shepherd.  This might trigger a
      VM_BUG_ON in vmstat_update because the work item might have been
      sleeping during the idle period and see the cpu_stat_off updated after
      the wake up.  The VM_BUG_ON is therefore misleading and no more
      appropriate.  Moreover it doesn't really suite any protection from real
      bugs because vmstat_shepherd will simply reschedule the vmstat_work
      anytime it sees a particular cpu set or vmstat_update would do the same
      from the worker context directly.  Even when the two would race the
      result wouldn't be incorrect as the counters update is fully idempotent.
      Reported-by: NSasha Levin <sasha.levin@oracle.com>
      Signed-off-by: NChristoph Lameter <cl@linux.com>
      Acked-by: NMichal Hocko <mhocko@suse.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      587198ba
  9. 24 1月, 2016 18 次提交