Commit graph

562315 commits

Author SHA1 Message Date
Ville Syrjälä a781ce79d5 drm/i915: Clean up AUX power domain handling
Introduce intel_display_port_aux_power_domain() which simply returns
the appropriate AUX power domain for a specific port, and then replace
the intel_display_port_power_domain() with calls to the new function
in the DP code. As long as we're not actually enabling the port we don't
need the lane power domains, and those are handled now purely from
modeset_update_crtc_power_domains().

My initial motivation for this was to see if I could keep the DPIO power
wells powered down while doing AUX on CHV, but turns out I can't so this
doesn't change anything for CHV at least. But I think it's still a
worthwile change.

v2: Add case for PORT E. Default to POWER_DOMAIN_AUX_D for now. (Ville)

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Patrik Jakobsson <patrik.jakobsson@linux.intel.com>
[Cherry-picked from drm-intel-next-queued 25f78f58 (Imre)]
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1448643329-18675-2-git-send-email-imre.deak@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2015-12-02 16:42:30 +02:00
Imre Deak 06bf403de3 PCI / PM: Tune down retryable runtime suspend error messages
The runtime PM core doesn't treat EBUSY and EAGAIN retvals from the driver
suspend hooks as errors, but they still show up as errors in dmesg. Tune
them down. See rpm_suspend() for details of handling these return values.

Note that we use dev_dbg() for the retryable retvals, so after this
change you'll need either CONFIG_DYNAMIC_DEBUG or CONFIG_PCI_DEBUG
for them to show up in the log.

One problem caused by this was noticed by Daniel: the i915 driver
returns EAGAIN to signal a temporary failure to suspend and as a request
towards the RPM core for scheduling a suspend again. This is a normal
event, but the resulting error message flags a breakage during the
driver's automated testing which parses dmesg and picks up the error.

Reported-by: Daniel Vetter <daniel.vetter@intel.com>
Link: https://bugs.freedesktop.org/show_bug.cgi?id=92992
Signed-off-by: Imre Deak <imre.deak@intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2015-12-02 15:24:21 +01:00
Ulf Hansson 712caed435 PM / Domains: Validate cases of a non-bound driver in genpd governor
Recently genpd removed the requirement of a having a driver bound for its
attached devices to allow genpd to power off. That change should also have
removed a corresponding validation in the governor, let's correct that.

Fixes: 298cd0f088 (PM / Domains: Remove dev->driver check for runtime)
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2015-12-02 15:21:21 +01:00
Dan Carpenter 86f98a3abb MAINTAINERS: ACPI / video: update a file name in drivers/acpi/
We renamed drivers/acpi/video.c to drivers/acpi/acpi_video.c in commit
14ca7a47d0 ('acpi-video-detect: video: Make video_detect code part of
the video module').

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2015-12-02 15:17:32 +01:00
Hanjun Guo 64031e3e8a ACPI / property: fix compile error for acpi_node_get_property_reference() when CONFIG_ACPI=n
In commit 60ba032ed7 ("ACPI / property: Drop size_prop from
acpi_dev_get_property_reference()"), the argument "const char *cells_name"
was dropped, but forgot to update the stub function in no-ACPI case,
it will lead to compile error when CONFIG_ACPI=n, easliy remove
"const char *cells_name" to fix it.

Fixes: 60ba032ed7 "ACPI / property: Drop size_prop from acpi_dev_get_property_reference()"
Reported-by: Kejian Yan <yankejian@huawei.com>
Signed-off-by: Hanjun Guo <hanjun.guo@linaro.org>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2015-12-02 15:15:14 +01:00
Benjamin Tissoires 2078665a7e HID: lg: restrict filtering out of first interface to G29 only
Looks like 29fae1c85 ("HID: logitech: Add support for G29") was a little
bit aggressive and broke other devices.

Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=108121

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2015-12-02 14:51:00 +01:00
Dave Airlie c936a69981 Merge branch 'drm-fixes-rockchip-2015-12-02' of https://github.com/markyzq/kernel-drm-rockchip into drm-fixes
Rockchip fixes from Mark.

* 'drm-fixes-rockchip-2015-12-02' of https://github.com/markyzq/kernel-drm-rockchip:
  drm/rockchip: Use CRTC vblank event interface
  drm/rockchip: Fix module autoload for OF platform driver
  drm/rockchip: vop: fix window origin calculation
  drm/rockchip: unset pgoff when mmap'ing gems
  drm/rockchip: vop: Correct enabled clocks during setup
2015-12-02 13:16:24 +10:00
Daniel Borkmann fbca9d2d35 bpf, array: fix heap out-of-bounds access when updating elements
During own review but also reported by Dmitry's syzkaller [1] it has been
noticed that we trigger a heap out-of-bounds access on eBPF array maps
when updating elements. This happens with each map whose map->value_size
(specified during map creation time) is not multiple of 8 bytes.

In array_map_alloc(), elem_size is round_up(attr->value_size, 8) and
used to align array map slots for faster access. However, in function
array_map_update_elem(), we update the element as ...

memcpy(array->value + array->elem_size * index, value, array->elem_size);

... where we access 'value' out-of-bounds, since it was allocated from
map_update_elem() from syscall side as kmalloc(map->value_size, GFP_USER)
and later on copied through copy_from_user(value, uvalue, map->value_size).
Thus, up to 7 bytes, we can access out-of-bounds.

Same could happen from within an eBPF program, where in worst case we
access beyond an eBPF program's designated stack.

Since 1be7f75d16 ("bpf: enable non-root eBPF programs") didn't hit an
official release yet, it only affects priviledged users.

In case of array_map_lookup_elem(), the verifier prevents eBPF programs
from accessing beyond map->value_size through check_map_access(). Also
from syscall side map_lookup_elem() only copies map->value_size back to
user, so nothing could leak.

  [1] http://github.com/google/syzkaller

Fixes: 28fbcfa08d ("bpf: add array type of eBPF maps")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-01 21:56:17 -05:00
Daniel Stone c9fbb7f7b5 drm/rockchip: Use CRTC vblank event interface
Passing -1 as the pipe for vblank events now triggers a WARN_ON, but had
previously made multi-screen unusable anyway. Pass the correct pipe to
the event-send function, and use the new API to make this a bit easier
for us.

Fixes WARN present since cc1ef118fc for every pageflip event sent:
[  209.549969] ------------[ cut here ]------------
[  209.554592] WARNING: CPU: 3 PID: 238 at drivers/gpu/drm/drm_irq.c:924 drm_vblank_count_and_time+0x80/0x88 [drm]()
[  209.564832] Modules linked in: [...]
[  209.612401] CPU: 3 PID: 238 Comm: irq/41-ff940000 Tainted: G        W       4.3.0-rc6+ #71
[  209.620647] Hardware name: Rockchip (Device Tree)
[  209.625348] [<c001bb80>] (unwind_backtrace) from [<c001615c>] (show_stack+0x20/0x24)
[  209.633079] [<c001615c>] (show_stack) from [<c02b2c50>] (dump_stack+0x8c/0x9c)
[  209.640289] [<c02b2c50>] (dump_stack) from [<c0052e88>] (warn_slowpath_common+0x94/0xc4)
[  209.648364] [<c0052e88>] (warn_slowpath_common) from [<c0052f74>] (warn_slowpath_null+0x2c/0x34)
[  209.657139] [<c0052f74>] (warn_slowpath_null) from [<bf17dc30>] (drm_vblank_count_and_time+0x80/0x88 [drm])
[  209.666875] [<bf17dc30>] (drm_vblank_count_and_time [drm]) from [<bf17e484>] (drm_send_vblank_event+0x74/0x7c [drm])
[  209.677385] [<bf17e484>] (drm_send_vblank_event [drm]) from [<bf4c1144>] (vop_win_state_complete+0x4c/0x70 [rockchip_drm_vop])
[  209.688757] [<bf4c1144>] (vop_win_state_complete [rockchip_drm_vop]) from [<bf4c3bdc>] (vop_isr_thread+0x170/0x1d4 [rockchip_drm_vop])
[  209.700822] [<bf4c3bdc>] (vop_isr_thread [rockchip_drm_vop]) from [<c00ab93c>] (irq_thread_fn+0x2c/0x50)
[  209.710284] [<c00ab93c>] (irq_thread_fn) from [<c00abcac>] (irq_thread+0x13c/0x188)
[  209.717927] [<c00abcac>] (irq_thread) from [<c00723c8>] (kthread+0xec/0x104)
[  209.724965] [<c00723c8>] (kthread) from [<c0011638>] (ret_from_fork+0x14/0x3c)
[  209.732171] ---[ end trace 0690bc604f5d535d ]---

Signed-off-by: Daniel Stone <daniels@collabora.com>
Cc: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Cc: Thierry Reding <treding@nvidia.com>
Cc: Heiko Stuebner <heiko@sntech.de>
Tested-By: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Thierry Reding <treding@nvidia.com>
2015-12-02 10:22:21 +08:00
Stefan Agner 531ee1f4ea ARM: dts: vf610: fix clock definition for SAI2
So far, only the bus clock has been assigned, but in reality the
SAI IP has for clock inputs. The driver has been updated to
make use of the additional clock inputs by c3ecef21c3 ("ASoC:
fsl_sai: add sai master mode support"). Due to a bug in the
clock tree, the audio clock has been enabled none the less by
the specified bus clock (see "ARM: imx: clk-vf610: fix SAI
clock tree"), which made master mode even without the proper
clock assigned working.

This patch completes the clock definition for SAI2. On Vybrid,
only two MCLK out of the four options are available (the first
being the bus clock itself). See chapter 8.10.1.2.3 of the
Vybrid Reference manual ("SAI transmitter and receiver options
for MCLK selection"). Note: The audio clocks are only required
in master mode.

Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-12-02 09:46:59 +08:00
Stefan Agner 3b60a26fdc ARM: imx: clk-vf610: fix SAI clock tree
The Synchronous Audio Interface (SAI) instances are clocked by
independent clocks: The bus clock and the audio clock (as shown in
Figure 51-1 in the Vybrid Reference Manual). The clock gates in
CCGR0/CCGR1 for SAI0 through SAI3 are bus clock gates, as access
tests to the registers with/without gating those clocks have shown.
The audio clock is gated by the SAIx_EN gates in CCM_CSCDR1,
followed by a clock divider (SAIx_DIV). Currently, the parent of
the bus clock gates has been assigned to SAIx_DIV, which is not
involved in the bus clock path for the SAI instances (see chapter
9.10.12, SAI clocking in the Vybrid Reference Manual).

Fix this by define the parent clock of VF610_CLK_SAIx to be the bus
clock.

If the driver needs the audio clock (when used in master mode), a
fixed device tree is required which assign the audio clock properly
to VF610_CLK_SAIx_DIV.

Signed-off-by: Stefan Agner <stefan@agner.ch>
Acked-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-12-02 09:46:26 +08:00
Liu Jiang 727ae8be30 x86/PCI/ACPI: Fix regression caused by commit 4d6b4e69a2
Commit 4d6b4e69a2 ("x86/PCI/ACPI: Use common interface to support
PCI host bridge") converted x86 to use the common interface
acpi_pci_root_create, but the conversion missed on code piece in
arch/x86/pci/bus_numa.c, which causes regression on some legacy
AMD platforms as reported by Arthur Marsh <arthur.marsh@internode.on.net>.
The root causes is that acpi_pci_root_create() fails to insert
host bridge resources into iomem_resource/ioport_resource because
x86_pci_root_bus_resources() has already inserted those resources.
So change x86_pci_root_bus_resources() to not insert resources into
iomem_resource/ioport_resource.

Fixes: 4d6b4e69a2 ("x86/PCI/ACPI: Use common interface to support PCI host bridge")
Signed-off-by: Jiang Liu <jiang.liu@linux.intel.com>
Reported-and-tested-by: Arthur Marsh <arthur.marsh@internode.on.net>
Reported-and-tested-by: Krzysztof Kolasa <kkolasa@winsoft.pl>
Reported-and-tested-by: Keith Busch <keith.busch@intel.com>
Reported-and-tested-by: Hans de Bruin <jmdebruin@xmsnet.nl>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2015-12-02 02:30:15 +01:00
Luis de Bethencourt 3b134ced9c drm/rockchip: Fix module autoload for OF platform driver
This platform driver has a OF device ID table but the OF module
alias information is not created so module autoloading won't work.

Signed-off-by: Luis de Bethencourt <luisbg@osg.samsung.com>
2015-12-02 09:13:19 +08:00
Dominik Behr 72906ce030 drm/rockchip: vop: fix window origin calculation
VOP_WINx_DSP_ST does not require subtracting 1 from the values written to
it. It actually causes the screen to be shifted by one pixel.

Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
Tested-by: Yakir Yang <ykk@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Dominik Behr <dbehr@chromium.org>
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
2015-12-02 09:13:18 +08:00
Heiko Stuebner a8594f20ca drm/rockchip: unset pgoff when mmap'ing gems
Commit 371f0f085f ("ARM: 8426/1: dma-mapping: add missing range check
 in dma_mmap()") introduced offset-checking for mappings, which collides
with the fake-offset the drm sets for gems.

Other drm-drivers set this offset to 0 before doing the mapping, so
this looks like the correct way to go for rockchip as well.

Fixes: 371f0f085f ("ARM: 8426/1: dma-mapping: add missing range check in dma_mmap()")
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2015-12-02 09:13:17 +08:00
Ben Hutchings 5377adb092 usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message
usb_parse_ss_endpoint_companion() now decodes the burst multiplier
correctly in order to check that it's <= 3, but still uses the wrong
expression if warning that it's > 3.

Fixes: ff30cbc8da ("usb: Use the USB_SS_MULT() macro to get the ...")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-01 14:45:52 -08:00
Alexey Khoroshilov f9fa1887dc USB: whci-hcd: add check for dma mapping error
qset_fill_page_list() do not check for dma mapping errors.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-01 14:45:52 -08:00
Hans Yang 464ad8c43a usb: core : hub: Fix BOS 'NULL pointer' kernel panic
When a USB 3.0 mass storage device is disconnected in transporting
state, storage device driver may handle it as a transport error and
reset the device by invoking usb_reset_and_verify_device()
and following could happen:

in usb_reset_and_verify_device():
   udev->bos = NULL;

For U1/U2 enabled devices, driver will disable LPM, and in some
conditions:
   from usb_unlocked_disable_lpm()
    --> usb_disable_lpm()
    --> usb_enable_lpm()
        udev->bos->ss_cap->bU1devExitLat;

And it causes 'NULL pointer' and 'kernel panic':

[  157.976257] Unable to handle kernel NULL pointer dereference
at virtual address 00000010
...
[  158.026400] PC is at usb_enable_link_state+0x34/0x2e0
[  158.031442] LR is at usb_enable_lpm+0x98/0xac
...
[  158.137368] [<ffffffc0006a1cac>] usb_enable_link_state+0x34/0x2e0
[  158.143451] [<ffffffc0006a1fec>] usb_enable_lpm+0x94/0xac
[  158.148840] [<ffffffc0006a20e8>] usb_disable_lpm+0xa8/0xb4
...
[  158.214954] Kernel panic - not syncing: Fatal exception

This commit moves 'udev->bos = NULL' behind usb_unlocked_disable_lpm()
to prevent from NULL pointer access.

Issue can be reproduced by following setup:
1) A SS pen drive behind a SS hub connected to the host.
2) Transporting data between the pen drive and the host.
3) Abruptly disconnect hub and pen drive from host.
4) With a chance it crashes.

Signed-off-by: Hans Yang <hansy@nvidia.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-01 14:45:52 -08:00
Arnd Bergmann d66e5139ae ARM: ixp4xx: fix read{b,w,l} return types
On ixp4xx, the readl() function returns an 'unsigned long' output
when indirect I/O is used. This is unlike any other platform, and
it causes lots of harmless compiler warnings, such as:

drivers/ata/libahci.c: In function 'ahci_show_host_version':
drivers/ata/libahci.c:254:22: warning: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'long unsigned int' [-Wformat=]
drivers/block/mtip32xx/mtip32xx.c: In function 'mtip_hw_read_registers':
drivers/block/mtip32xx/mtip32xx.c:2602:31: warning: format '%X' expects argument of type 'unsigned int', but argument 3 has type 'long unsigned int' [-Wformat=]
drivers/block/cciss.c: In function 'print_cfg_table':
drivers/block/cciss.c:3845:25: warning: format '%d' expects argument of type 'int', but argument 4 has type 'long unsigned int' [-Wformat=]

This changes all six of the ixp4xx specific I/O read functions
to return the same types that we have in the normal asm/io.h,
to avoid the warnings.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Krzysztof Halasa <khalasa@piap.pl>
2015-12-01 23:45:30 +01:00
Adrien Vergé 33bd2dd03d USB: quirks: Apply ALWAYS_POLL to all ELAN devices
All ELAN hid devices seem to require the ALWAYS_POLL quirk. Let's use
this quirk for all devices from this vendor, rather than maintaining a
list of all its known product IDs.

Tested-by: Adrien Vergé <adrienverge@gmail.com>
Signed-off-by: Adrien Vergé <adrienverge@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-01 14:22:22 -08:00
Guillaume Delbergue d5d4fdd86f irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB
This patch is specifically for PCI support on the Versatile PB board using
a DT. Currently, the dynamic IRQ mapping is broken when using DTs. For
example, on QEMU, the SCSI driver is unable to request the IRQ. To fix
this issue, this patch replaces the current dynamic mechanism with a
static value as is done in the non-DT case.

Signed-off-by: Guillaume Delbergue <guillaume.delbergue@greensocs.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable@vger.kernel.org
2015-12-01 22:50:16 +01:00
Steven Rostedt (Red Hat) 0f72e37e42 tracing: Add sched_wakeup_new and sched_waking tracepoints for pid filter
The set_event_pid filter relies on attaching to the sched_switch and
sched_wakeup tracepoints to see if it should filter the tracing on schedule
tracepoints. By adding the callbacks to sched_wakeup, pids in the
set_event_pid file will trace the wakeups of those tasks with those pids.

But sched_wakeup_new and sched_waking were missed. These two should also be
traced. Luckily, these tracepoints share the same class as sched_wakeup
which means they can use the same pre and post callbacks as sched_wakeup
does.

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2015-12-01 16:08:05 -05:00
Eric Dumazet ceb5d58b21 net: fix sock_wake_async() rcu protection
Dmitry provided a syzkaller (http://github.com/google/syzkaller)
triggering a fault in sock_wake_async() when async IO is requested.

Said program stressed af_unix sockets, but the issue is generic
and should be addressed in core networking stack.

The problem is that by the time sock_wake_async() is called,
we should not access the @flags field of 'struct socket',
as the inode containing this socket might be freed without
further notice, and without RCU grace period.

We already maintain an RCU protected structure, "struct socket_wq"
so moving SOCKWQ_ASYNC_NOSPACE & SOCKWQ_ASYNC_WAITDATA into it
is the safe route.

It also reduces number of cache lines needing dirtying, so might
provide a performance improvement anyway.

In followup patches, we might move remaining flags (SOCK_NOSPACE,
SOCK_PASSCRED, SOCK_PASSSEC) to save 8 bytes and let 'struct socket'
being mostly read and let it being shared between cpus.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-01 15:45:05 -05:00
Eric Dumazet 9cd3e072b0 net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA
This patch is a cleanup to make following patch easier to
review.

Goal is to move SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA
from (struct socket)->flags to a (struct socket_wq)->flags
to benefit from RCU protection in sock_wake_async()

To ease backports, we rename both constants.

Two new helpers, sk_set_bit(int nr, struct sock *sk)
and sk_clear_bit(int net, struct sock *sk) are added so that
following patch can change their implementation.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-01 15:45:05 -05:00
Stephan Günther 1f390c1fde nvme: temporary fix for Apple controller reset
Recent patches added basic support for the Apple NVMe controller but
still cause resets and data corruption on that particular controller
when a specific pattern of read/flush commands occurs. Limiting the
queue depth to 2 works around that issue.

This patch enforces that limit only for the Apple controller and is
considered a temporary fix until we find the root source of that
problem.

Signed-off-by: Stephan Günther <guenther@tum.de>
Signed-off-by: Maurice Leclaire <leclaire@in.tum.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
2015-12-01 13:23:22 -07:00
Alexey Khoroshilov 5738a09d58 vmxnet3: fix checks for dma mapping errors
vmxnet3_drv does not check dma_addr with dma_mapping_error()
after mapping dma memory. The patch adds the checks and
tries to handle failures.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Shrikrishna Khare <skhare@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-01 15:19:16 -05:00
Peter Hurley ee9159ddce wan/x25: Fix use-after-free in x25_asy_open_tty()
The N_X25 line discipline may access the previous line discipline's closed
and already-freed private data on open [1].

The tty->disc_data field _never_ refers to valid data on entry to the
line discipline's open() method. Rather, the ldisc is expected to
initialize that field for its own use for the lifetime of the instance
(ie. from open() to close() only).

[1]
    [  634.336761] ==================================================================
    [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
    [  634.339558] Read of size 4 by task syzkaller_execu/8981
    [  634.340359] =============================================================================
    [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
    ...
    [  634.405018] Call Trace:
    [  634.405277] dump_stack (lib/dump_stack.c:52)
    [  634.405775] print_trailer (mm/slub.c:655)
    [  634.406361] object_err (mm/slub.c:662)
    [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
    [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
    [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
    [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
    [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
    [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
    [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
    [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
    [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)

Reported-and-tested-by: Sasha Levin <sasha.levin@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-01 15:17:42 -05:00
Al Viro 9225c0b7b9 staging: lustre: echo_copy.._lsm() dereferences userland pointers directly
missing get_user()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-01 12:13:32 -08:00
Nicolas Dichtel 304d888b29 Revert "ipv6: ndisc: inherit metadata dst when creating ndisc requests"
This reverts commit ab450605b3.

In IPv6, we cannot inherit the dst of the original dst. ndisc packets
are IPv6 packets and may take another route than the original packet.

This patch breaks the following scenario: a packet comes from eth0 and
is forwarded through vxlan1. The encapsulated packet triggers an NS
which cannot be sent because of the wrong route.

CC: Jiri Benc <jbenc@redhat.com>
CC: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-01 15:07:59 -05:00
Dmitry Katsubo 9fa62b1a31 usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter JMicron
The patch extends the family of SATA-to-USB JMicron adapters that need
FUA to be disabled and applies the same policy for uas driver.
See details in http://unix.stackexchange.com/questions/237204/

Signed-off-by: Dmitry Katsubo <dmitry.katsubo@gmail.com>
Tested-by: Dmitry Katsubo <dmitry.katsubo@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-01 10:23:33 -08:00
Adrien Vergé df36c5bede USB: quirks: Fix another ELAN touchscreen
Like other buggy models that had their fixes [1], the touchscreen with
id 04f3:21b8 from ELAN Microelectronics needs the device-qualifier
quirk. Otherwise, it fails to respond, blocks the boot for a random
amount of time and pollutes dmesg with:

[ 2887.373196] usb 1-5: new full-speed USB device number 41 using xhci_hcd
[ 2889.502000] usb 1-5: unable to read config index 0 descriptor/start: -71
[ 2889.502005] usb 1-5: can't read configurations, error -71
[ 2889.654571] usb 1-5: new full-speed USB device number 42 using xhci_hcd
[ 2891.783438] usb 1-5: unable to read config index 0 descriptor/start: -71
[ 2891.783443] usb 1-5: can't read configurations, error -71

[1]: See commits c68929f, 876af5d, d749947, a32c99e and dc703ec.

Tested-by: Adrien Vergé <adrienverge@gmail.com>
Signed-off-by: Adrien Vergé <adrienverge@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-01 10:23:33 -08:00
Arianna Avanzini dbac117542 null_blk: change type of completion_nsec to unsigned long
This commit at least doubles the maximum value for
completion_nsec. This helps in special cases where one wants/needs to
emulate an extremely slow I/O (for example to spot bugs).

Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
Signed-off-by: Arianna Avanzini <avanzini@google.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
2015-12-01 10:52:12 -07:00
Arianna Avanzini cf8ecc5a84 null_blk: guarantee device restart in all irq modes
In single-queue (block layer) mode,the function null_rq_prep_fn stops
the device if alloc_cmd fails. Then, once stopped, the device must be
restarted on the next command completion, so that the request(s) for
which alloc_cmd failed can be requeued. Otherwise the device hangs.

Unfortunately, device restart is currently performed only for delayed
completions, i.e., in irqmode==2. This fact causes hangs, for the
above reasons, with the other irqmodes in combination with single-queue
block layer.

This commits addresses this issue by making sure that, if stopped, the
device is properly restarted for all irqmodes on completions.

Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
Signed-off-by: Arianna AVanzini <avanzini@google.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
2015-12-01 10:52:10 -07:00
Paolo Valente 3c395a969a null_blk: set a separate timer for each command
For the Timer IRQ mode (i.e., when command completions are delayed),
there is one timer for each CPU. Each of these timers
. has a completion queue associated with it, containing all the
  command completions to be executed when the timer fires;
. is set, and a new completion-to-execute is inserted into its
  completion queue, every time the dispatch code for a new command
  happens to be executed on the CPU related to the timer.

This implies that, if the dispatch of a new command happens to be
executed on a CPU whose timer has already been set, but has not yet
fired, then the timer is set again, to the completion time of the
newly arrived command. When the timer eventually fires, all its queued
completions are executed.

This way of handling delayed command completions entails the following
problem: if more than one command completion is inserted into the
queue of a timer before the timer fires, then the expiration time for
the timer is moved forward every time each of these completions is
enqueued. As a consequence, only the last completion enqueued enjoys a
correct execution time, while all previous completions are unjustly
delayed until the last completion is executed (and at that time they
are executed all together).

Specifically, if all the above completions are enqueued almost at the
same time, then the problem is negligible. On the opposite end, if
every completion is enqueued a while after the previous completion was
enqueued (in the extreme case, it is enqueued only right before the
timer would have expired), then every enqueued completion, except for
the last one, experiences an inflated delay, proportional to the number
of completions enqueued after it. In the end, commands, and thus I/O
requests, may be completed at an arbitrarily lower rate than the
desired one.

This commit addresses this issue by replacing per-CPU timers with
per-command timers, i.e., by associating an individual timer with each
command.

Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
Signed-off-by: Arianna Avanzini <avanzini@google.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
2015-12-01 10:52:08 -07:00
Linus Torvalds 6a24e72d23 Remoteproc fixes for 4.4: two 1-liners coming from Suman and Arnd.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJWXVa1AAoJELLolMlTRIoMSoEP/083QrbVCaLaqcbdgSkoS7E+
 IJbzio7fnNhABL8twu/4KujIFlmcOh6L86LVE17TED7QB23DsszZBsbXE5US7Lhc
 zA97ssnhxr+OnUZXNHV8sHhYE+mpYo0qKLTgQZfH62XGdmTs9EDjWKjKgI5tzfSL
 GrbTZLWWhPb2C4m2+/QrJLKEyif3ToPa5FUrtJ7nmLcWN+l6UKxCiCfLcDVqgmFr
 pE0gAjO+LILEUgcAKqNfAyYASkA00q5mHSAPSa8McJqTrmJuCLo0hcrY10LdU+T0
 c5WmoGTZbwXPphz1x4GQ2VHpHV/HOFsdJF4HI39i/SRtLEScosLbeImhBOH1cMxC
 T4vQyzcWnSPmxp8U0Qsjz1xI1sigyWUxYmNe4UCHkTsS4JNPVIKJpDXQmkkVC1W6
 vIuGtjNZSFsbg3cGL776fdzCCvdodLKXZu9pA9nQkD6C9eO45Y0UtPWbGik+wsKL
 7jyz7gxQpgSCk9eF0Vur/5/Ie5++o4hyoFbns94zi6YFRwstJiEO8REkWQDpetRt
 3+gJg1RoyQEV08kVnTUZJTCMuB57uUfAhsPdUIH+2Ny4f0NmTVZh135O8imHDUwG
 DYuNyi8A0rkhEEUYPBfPtepTD3U8PiqRAVAFavtg+QHmT2dDU3b4iQYXd1jlCcAU
 eFlI5E2tYoDpnNwWfNH3
 =YMLt
 -----END PGP SIGNATURE-----

Merge tag 'remoteproc-4.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc

Pull remoteproc fixes from Ohad Ben-Cohen:
 "Two one-liners coming from Suman and Arnd"

* tag 'remoteproc-4.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc:
  remoteproc: fix memory leak of remoteproc ida cache layers
  remoteproc: avoid stack overflow in debugfs file
2015-12-01 09:43:06 -08:00
Greg Kroah-Hartman f235cead56 USB-serial fixes for v4.4-rc3
Here are some device-id fixes that remove a HID device from cp210x, and
 adds support for another Infineon flash-loader device. The flash-loader
 device presents itself as a CDC-ACM device even though it is clearly
 not, so we need to blacklist it in the cdc-acm driver as well.
 
 Signed-off-by: Johan Hovold <johan@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJWVsA4AAoJEEEN5E/e4bSVY4kP/ij/9LiNL9ogqDKe0dLGV7vu
 ygJ8XSHl56naqp41+4hAt0t+wzfV80DCsjiNv8Q4KvMGc4q90EcbU4CQixbV00rw
 V55I8F13dDJzYGyAGrV4KQewJZHUMRw8WfxjUXTWz8fnoVtIxcQmRO/2h1UrK8l7
 zAgjcQHNNd7slY7riyuJwObD7BQ9Lr6OHyYk8plStV6VU+6gyaLR/gE5AwxrujBs
 teoHx7Ak0/4irykGaoxCxcPrkxNXHzID0MSJwVnw/lkxxOlD26ZLAFmgyw22WHNe
 6fQVHpl6Bmh71DpYIbbPNxUyqIFGSNXP065/jbxbgxLO5rB+UG9yFtn1T5cWnluc
 Huax41g4cvuq6LU8w6jSUEbyhnne02TnrmXhISeWTD6mMgk8f3UZb3PkJXVd2ysj
 0V+R4CdaUNmjk66eOuGhzeyXFZh0DJYfxPqGNvxqvl172/MC+141vW3re+SjAyy5
 rpLyfJe7L+3VriJTjf8tcIYaNl5z8eklfEHJ8gUWTG/kdjXNqoCqjIZb2KG779dc
 r3fdE2aJT3aSDJ2vhOzTTEsp91rnzQC0mbmRofMBxosHZxNpnrYJVYy168nEvTpI
 hULSm8z1csjyj0xcm/SbEeZfmZ/IaTPdQZhxRdjwlBZ9X+zjXvx7aECDrqFkKeTt
 WwPxPJsWYJvSG3PGTp56
 =JdcP
 -----END PGP SIGNATURE-----

Merge tag 'usb-serial-4.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

Johan writes:

USB-serial fixes for v4.4-rc3

Here are some device-id fixes that remove a HID device from cp210x, and
adds support for another Infineon flash-loader device. The flash-loader
device presents itself as a CDC-ACM device even though it is clearly
not, so we need to blacklist it in the cdc-acm driver as well.

Signed-off-by: Johan Hovold <johan@kernel.org>
2015-12-01 09:21:53 -08:00
Greg Kroah-Hartman a4861761e5 usb: fixes for v4.4-rc3
Here's our second round of fixes. Some of the bugs are pretty old like
 the one on pxa27x suspend implementation.
 
 The most important part is a randbuild warning fix on MUSB CPPI DMA
 engine by Arnd, a couple fixes by Felipe Tonello on f_midi (first one
 makes sure we only transmit on enabled ep IN while second plugs a memory
 leak) and a NULL pointer dereference fix on renesas usbhs.
 
 Note that we also have a new compatible string being added for the MXS
 PHY.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJWT5bKAAoJEIaOsuA1yqRE/88P/38CT6/DC4TGS+jJ07ZaNL3Z
 3e9OVG02J+qF8LEvjanKDaDiOIJKCUA0cFtA+WyBskgfhAD1NUA+mYwwR22juqns
 M/3URYHXGTXckoE3zEoPxNEL2JGpDvmyUT8RwJnoDWgV9jtv36tVfUuc9C6RaRmp
 Ip9lgu/GQI3Emwwo723prV34qBMvcCucPmQQzHZGA/O4FX3XW869/rWhFQf/Jxm0
 7YONdBiICKWONjkA5mDrs2po+T4WXj5LHvFCJaDwKW2vsbHmEyrCuWA+06gTuz6a
 H/dx85CT2i+8WhOaIzQTX2y1euIO2CrbvnyExZfQfafBbdX1TprqC0Ig0Co1Tx/o
 j18jK+5nP5uBXwG5dxSLfzEu2g7XDtw1iFLJvwOXRt3cf2p1noGyKct+ef8A4/yH
 QrJVG19S3HRQsp18aMAhbjcBFBf5B9RDpCsaJf7OHxcJQLKPcLwSVDGAuI/4F35V
 sNkHjzXDwBWBx6ZMimgvIrDtyH6Jk0Cg9bNTxCvZSCziNs5aL0Mm6MdMkUMKB28w
 58LR/nuSXRjxmU8hy90sk0QW6GusQe2RKQRirWAKluKiO9OMRGGld0xeHsEjhpwu
 EyXlpDQMKMHBHI4dIse5hjMxD0e/yO1p5vmUQUztnfLK/oOD3uA7I42G0CHhiHoO
 tfUwsdtckpbRkxXqGgtM
 =qfZS
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-v4.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

Felipe writes:

usb: fixes for v4.4-rc3

Here's our second round of fixes. Some of the bugs are pretty old like
the one on pxa27x suspend implementation.

The most important part is a randbuild warning fix on MUSB CPPI DMA
engine by Arnd, a couple fixes by Felipe Tonello on f_midi (first one
makes sure we only transmit on enabled ep IN while second plugs a memory
leak) and a NULL pointer dereference fix on renesas usbhs.

Note that we also have a new compatible string being added for the MXS
PHY.
2015-12-01 09:14:54 -08:00
Greg Kroah-Hartman f3cf3fb7ec First set of new device support, features and cleanups for IIO in the 4.5 cycle
Usual mixed bag, but the big item perhaps in this series is the DMA buffer
 support added by Lars-Peter Clausen. It's been in the works for a long time
 and it will be interesting to see what hardware support shows up now that
 this is available.
 
 New core features + associate cleanup.
 * Add generic DMA buffer infrastructure
 * Add a DMAengine framework based buffer
  Also associated minor changes.
    - Set the device buffer watermark based on the minimum watermark for all
      attached buffers rather than just the 'primary' one.
    - iio_buffer_init - only set the watermark default if one hasn't already
      been provided.  This allows simple support for devices with a fixed
      watermark.
    - read only attribute for watermark on fixed watermark devices.
    - add explicit buffer enable/disable callbacks to allow the buffer to
      do more than trivial actions when it is being turned on and off.
 * IIO_VAL_INT support in write_raw_get_fmt function.
 
 New device support
 * Freescale MMA7455/7456L accelerometers
 * Memsic MXC6255XC accelerometer
 * ST lis2dh12 accelerometer
 * TI ADS8688 ADC
 * TI Palamas (twl6035/7) gpadc
 
 New driver features
 * mma8452
   - support either of the available interrupt pins to cope with the case
     where board layout has lead to a particular one being connected.
 
 Staging graduation
 * Dummy driver
   - this driver acts as both an example and a test device for those with
     out hardware to develop userspace code against.
 
 Cleanups and minor bits and bobs.
 * treewide
   - Sort out the ordering of iio_device_register/unregister vs runtime
     pm function calls so that it's all nice and consistent and not race
     prone.
   - Check sscanf return values.  None of the cases will actually happen as
     the strings are supplied internally, but best to be consistent on this.
 * ad7780
   - switch over to the gpio descriptor interface and remove the now unused
     platform data which gets rid of a header entirely.
 * ad7793
   - drop a pointless else statement.
 * at91_adc
   - Swap kmalloc_array in for a kmalloc doing the same job.
 * dummy
   - get rid of some commented out lines that snuck in during the move of
     the driver.
 * lm3533-als
   - Print an error message on provision of an invalid resistance.
 * mcp320x
   - Add compatible strings with vendor prefix and deprecate those with
     no vendor prefix.
 * mxs-lradc
   - Use BIT macro in various places rather than shifted ones.
 * pa12203001
   - Power off the chip if the registration fails.
 * pulsedlight-lidar-lite
   - add runtime PM support.
 * xilinx XADC
   - constify an iio_buffer_setup_ops structure.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJWUcmhAAoJEFSFNJnE9BaIyjYP/0A+CZMUqIGbYG9qFxnq7yYZ
 977Wt/gGI8+Jq5RwNw6gTfhp2GrCN+5gzDbE2mBEn94c6SKBrj2Q9trW1FQ+Nhfx
 9bZoyq3ZPRCV+efEDGfeK/JWRwv+V6IWwAF2J/iCPWpRMTEsIW5kM1JSO3ISlnma
 diyil1hefGTJY8aCqGApthfX4fyZK98oCV6zojxpCZfFPdsa+vf5n1RQ143odnOk
 6NSfXHYLI+2e+mJ1lw4GdpZdF+rF+7jWsUYC5EDNmvlIJYiKmm13whSQeWO0NHo8
 oD0pYboSIWnmdXx4s3RbWF2+Y28O1+oJDKZfXabB8DjVwtvlGnmWBRhgKji2e6E6
 Hhct83YbDWtEpbNkXcWpnc5v5ynmAMTYTxADhinTGUtVQh3Q4wWduuoHK6IyeI4s
 dbfpO2Wh6N/5k3a4UoA69IcI2DzPzb2sIFWpdS8wuNv5xDhV2OmmY2PjTfq2w+Qz
 hEoMCNDUG6rQAYf4auXK5JjhI4CaG/mz/qjIibTUqGODYECzQQyvq+c2Gdq0S8O/
 CUHOgui6aHbyuhWmXlEzhhkjuvBQZYaTxCA+LGMzy8w7UY9m4n5L/fX9M9IfFsMH
 NFCPrUfmxKPQj/mHlhu7KHaTMUlQ0pTqV5flSwqsjstZ2QddvI5EAKiLwIEhg7/2
 RpnOZoiFIxykduEYLxeh
 =CfCl
 -----END PGP SIGNATURE-----

Merge tag 'iio-for-4.5a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-next

Jonathan writes:

First set of new device support, features and cleanups for IIO in the 4.5 cycle

Usual mixed bag, but the big item perhaps in this series is the DMA buffer
support added by Lars-Peter Clausen. It's been in the works for a long time
and it will be interesting to see what hardware support shows up now that
this is available.

New core features + associate cleanup.
* Add generic DMA buffer infrastructure
* Add a DMAengine framework based buffer
 Also associated minor changes.
   - Set the device buffer watermark based on the minimum watermark for all
     attached buffers rather than just the 'primary' one.
   - iio_buffer_init - only set the watermark default if one hasn't already
     been provided.  This allows simple support for devices with a fixed
     watermark.
   - read only attribute for watermark on fixed watermark devices.
   - add explicit buffer enable/disable callbacks to allow the buffer to
     do more than trivial actions when it is being turned on and off.
* IIO_VAL_INT support in write_raw_get_fmt function.

New device support
* Freescale MMA7455/7456L accelerometers
* Memsic MXC6255XC accelerometer
* ST lis2dh12 accelerometer
* TI ADS8688 ADC
* TI Palamas (twl6035/7) gpadc

New driver features
* mma8452
  - support either of the available interrupt pins to cope with the case
    where board layout has lead to a particular one being connected.

Staging graduation
* Dummy driver
  - this driver acts as both an example and a test device for those with
    out hardware to develop userspace code against.

Cleanups and minor bits and bobs.
* treewide
  - Sort out the ordering of iio_device_register/unregister vs runtime
    pm function calls so that it's all nice and consistent and not race
    prone.
  - Check sscanf return values.  None of the cases will actually happen as
    the strings are supplied internally, but best to be consistent on this.
* ad7780
  - switch over to the gpio descriptor interface and remove the now unused
    platform data which gets rid of a header entirely.
* ad7793
  - drop a pointless else statement.
* at91_adc
  - Swap kmalloc_array in for a kmalloc doing the same job.
* dummy
  - get rid of some commented out lines that snuck in during the move of
    the driver.
* lm3533-als
  - Print an error message on provision of an invalid resistance.
* mcp320x
  - Add compatible strings with vendor prefix and deprecate those with
    no vendor prefix.
* mxs-lradc
  - Use BIT macro in various places rather than shifted ones.
* pa12203001
  - Power off the chip if the registration fails.
* pulsedlight-lidar-lite
  - add runtime PM support.
* xilinx XADC
  - constify an iio_buffer_setup_ops structure.
2015-12-01 09:13:29 -08:00
Sjoerd Simons d7b53fd9e3 drm/rockchip: vop: Correct enabled clocks during setup
When doing the initial setup both the hclk and the aclk need to be
enabled otherwise the board will simply hang. This only occurs when
building the vop driver as a module, when its built-in the initial setup
happens to run before the clock framework shuts of unused clocks
(including the aclk).

While there also switch to doing prepare and enable in one step rather
then separate steps to reduce the amount of code required.

Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Acked-by: Mark Yao <mark.yao@rock-chips.com>
Tested-by: Yakir Yang <ykk@rock-chips.com>
Tested-by: Romain Perier <romain.perier@gmail.com>
2015-12-01 18:52:05 +08:00
Geert Uytterhoeven 48111b79b7 pinctrl: sh-pfc: sh7734: Add missing cfg macro parameter to fix build
When building for SH7734:

    drivers/pinctrl/sh-pfc/pfc-sh7734.c:586:1: error: macro "_GP_DATA" passed 5 arguments, but takes just 4
    drivers/pinctrl/sh-pfc/pfc-sh7734.c:586:2: error: '_GP_DATA' undeclared here (not in a function)
    drivers/pinctrl/sh-pfc/pfc-sh7734.c:586:1: error: macro "_GP_DATA" passed 5 arguments, but takes just 4
    drivers/pinctrl/sh-pfc/pfc-sh7734.c:586:1: error: macro "_GP_DATA" passed 5 arguments, but takes just 4
    ...
    drivers/pinctrl/sh-pfc/pfc-sh7734.c:2389:1: error: macro "_GP_INOUTSEL" passed 5 arguments, but takes just 4
    drivers/pinctrl/sh-pfc/pfc-sh7734.c:2389:53: error: '_GP_INOUTSEL' undeclared here (not in a function)
    drivers/pinctrl/sh-pfc/pfc-sh7734.c:2389:2: warning: initialization makes integer from pointer without a cast [enabled by default]
    drivers/pinctrl/sh-pfc/pfc-sh7734.c:2389:2: warning: (near initialization for '(anonymous)[0]') [enabled by default]
    ...
    drivers/pinctrl/sh-pfc/pfc-sh7734.c:2416:1: error: macro "_GP_INDT" passed 5 arguments, but takes just 4
    drivers/pinctrl/sh-pfc/pfc-sh7734.c:2416:47: error: '_GP_INDT' undeclared here (not in a function)
    drivers/pinctrl/sh-pfc/pfc-sh7734.c:2416:2: warning: initialization makes integer from pointer without a cast [enabled by default]
    drivers/pinctrl/sh-pfc/pfc-sh7734.c:2416:2: warning: (near initialization for '(anonymous)[0]') [enabled by default]
    ...

Add the missing "cfg" macro parameters to the sh7734-specific
_GP_DATA(), _GP_INOUTSEL(), and _GP_INDT() macros to fix this.

Fixes: 22768fc60a ("pinctrl: sh-pfc: Add macros defining GP ports with config flags")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-12-01 11:13:04 +01:00
Chris Wilson bb6d19846d drm/i915: Check the timeout passed to i915_wait_request
We have relied upon the sole caller (wait_ioctl) validating the timeout
argument. However, when waiting for multiple requests I forgot to ensure
that the timeout was still positive on the later requests. This is more
simply done inside __i915_wait_request.

Fixes regression introduced in
commit b47161858b
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Mon Apr 27 13:41:17 2015 +0100

    drm/i915: Implement inter-engine read-read optimisations

The impact of the regression is 1 jiffie for each extra active ring for
a wait_ioctl with a timeout -- I don't think anyone has noticed.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Lionel Landwerlin <lionel.g.landwerlin@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1448544702-5594-1-git-send-email-chris@chris-wilson.co.uk
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2015-12-01 10:48:58 +02:00
Takashi Iwai bcdda2ec28 ALSA: hda - Add Conexant CX8200 (14f1:2008) codec entry
It's supposed to be equivalent with CX20724.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-12-01 07:01:14 +01:00
Takashi Iwai 3b7e2a7d9d ALSA: hda - Correct codec names for 14f1:50f1 and 14f1:50f3
The numbers aren't always linear, just like in the real world.
Correct to the right numbers stated in the datasheet (although we
can't trust the datasheet as well).

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-12-01 07:01:12 +01:00
Greg Kroah-Hartman cc4c60cc25 Second set of IIO fixes for the 4.4 cycle.
Some of these were waiting for various code to hit during the merge
 window - others have simply shown up recently.
 
 * Dummy - fix a bug introduced recently that stops events actually
   reaching userspace.
 * Lidar - return -EINVAL on getting a report of an invalid reading from
   the device.  This could mean that nothing is in range, or something
   else has gone wrong.  Basically it tells us nothing useful beyond the
   reading is bogus and should be ignored.
 * apds9660 - make sure to call pm_runtime_mark_last_busy when reading
   from the device to avoid a premature disabling of the power.
 * core - fix up a few missues of the WARN macro.
 * spmi-vadc - fix a missing of_node_put when breaking out of
   a for_each_available_child_of_node loop.
 
 The dummy driver is going to result in a slightly interesting
 merge when this meets the togreg branch as that driver has graduated
 from staging in the meantime.  I'll send an email in reply to that
 pull request highlighting this as well.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJWUc8MAAoJEFSFNJnE9BaIlCoQAI873uKlChbGt8uperACvvfn
 Q6UAcFIenEJrudve/C4zfjnYIKzxG6v6A1fUhoiOmJ0k/2wHYd6Lb27jT15Nsnkm
 2hS4KAzc4mngxCc0upK0qCOWTVCHmRuvm1i2cHaMAugcExpyoXRmLkWRvwwrEb4h
 NS5Qr9wQOGnBU7mOlZyqP6PQq2tU18eNLCg6A+cVMoq3z9CN0MH/x6pTV6O29PIx
 88jwaNnPL7EoBxSTziYIbyXLEy7/x4RlIxxkSU75jHc5JHChoH4f+BXKzxjdVqh+
 nL2Ok8BSnJV1cngqZDPZXcBrbeAKvhXyi7vExE6ntzMh0pTd+8wwyggddETJ/zIw
 JsiN1qg4jSre97UCnW/F+owSxVkg+ptgT4zZGNikffA5W+HsE6CxHMiGiuzAkBf3
 AdUdIv778/KKkblQGmlHADLwLWo0r09yqilkNEzqH5zY+v+02aEWzJSnJl6Qh55v
 7DEgcuzhYzKuIzuq1RYjT+HhAIPFFTRTYIPLjT0zBcwHtYhfpVpq3UzNJ4p3ehNd
 Pumg+OY7jWabPDar7ZthYYxGLzD5u4jeFdXiua7kUat84O8n0YomoPkobHEP1IcI
 AvBZisjeREorVfwMtphyL0mL1bAZxo+/KS4NlbbZv+LKNeP1fk/T4wbgtI/tYJNF
 mdr3uk6y4FVFHm4WrNCe
 =MrHH
 -----END PGP SIGNATURE-----

Merge tag 'iio-fixes-for-4.4b' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus

Jonathan writes:

Second set of IIO fixes for the 4.4 cycle.

Some of these were waiting for various code to hit during the merge
window - others have simply shown up recently.

* Dummy - fix a bug introduced recently that stops events actually
  reaching userspace.
* Lidar - return -EINVAL on getting a report of an invalid reading from
  the device.  This could mean that nothing is in range, or something
  else has gone wrong.  Basically it tells us nothing useful beyond the
  reading is bogus and should be ignored.
* apds9660 - make sure to call pm_runtime_mark_last_busy when reading
  from the device to avoid a premature disabling of the power.
* core - fix up a few missues of the WARN macro.
* spmi-vadc - fix a missing of_node_put when breaking out of
  a for_each_available_child_of_node loop.

The dummy driver is going to result in a slightly interesting
merge when this meets the togreg branch as that driver has graduated
from staging in the meantime.  I'll send an email in reply to that
pull request highlighting this as well.
2015-11-30 20:00:44 -08:00
Martin K. Petersen b840c3627b mpt3sas: Add dummy Kconfig option for backwards compatibility
The mpt2sas driver was recently folded into mpt3sas to reduce code
duplication.

To avoid problems for people that only have CONFIG_SCSI_MPT2SAS in their
.config we introduce a dummy option that will select MPT3SAS if MPT2SAS
was previously enabled.

This is a temporary measure and we will deprecate this config option in
4.6.

Reported-by: Peter Zijlstra <peterz@infradead.org>
Acked-by: Christoph Hellwig <hch@lst.de>
Acked-by: James Bottomley <James.Bottomley@hansenpartnership.com>
CC: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2015-11-30 20:36:08 -05:00
Bart Van Assche b49493f996 Fix a memory leak in scsi_host_dev_release()
Avoid that kmemleak reports the following memory leak if a
SCSI LLD calls scsi_host_alloc() and scsi_host_put() but neither
scsi_host_add() nor scsi_host_remove(). The following shell
command triggers that scenario:

for ((i=0; i<2; i++)); do
  srp_daemon -oac |
  while read line; do
    echo $line >/sys/class/infiniband_srp/srp-mlx4_0-1/add_target
  done
done

unreferenced object 0xffff88021b24a220 (size 8):
  comm "srp_daemon", pid 56421, jiffies 4295006762 (age 4240.750s)
  hex dump (first 8 bytes):
    68 6f 73 74 35 38 00 a5                          host58..
  backtrace:
    [<ffffffff8151014a>] kmemleak_alloc+0x7a/0xc0
    [<ffffffff81165c1e>] __kmalloc_track_caller+0xfe/0x160
    [<ffffffff81260d2b>] kvasprintf+0x5b/0x90
    [<ffffffff81260e2d>] kvasprintf_const+0x8d/0xb0
    [<ffffffff81254b0c>] kobject_set_name_vargs+0x3c/0xa0
    [<ffffffff81337e3c>] dev_set_name+0x3c/0x40
    [<ffffffff81355757>] scsi_host_alloc+0x327/0x4b0
    [<ffffffffa03edc8e>] srp_create_target+0x4e/0x8a0 [ib_srp]
    [<ffffffff8133778b>] dev_attr_store+0x1b/0x20
    [<ffffffff811f27fa>] sysfs_kf_write+0x4a/0x60
    [<ffffffff811f1e8e>] kernfs_fop_write+0x14e/0x180
    [<ffffffff81176eef>] __vfs_write+0x2f/0xf0
    [<ffffffff811771e4>] vfs_write+0xa4/0x100
    [<ffffffff81177c64>] SyS_write+0x54/0xc0
    [<ffffffff8151b257>] entry_SYSCALL_64_fastpath+0x12/0x6f

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2015-11-30 20:33:34 -05:00
Marc-André Lureau d6d38d9d79 virtio-gpu: use no-merge for fill-modes
Avoid the sticky preferred mode bit by using the no-merge version of the
function (this allows gnome-shell to resize to lower resolutions than
the default resolution)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
2015-12-01 10:33:35 +10:00
Julia Lawall e80cf2e50b clk: scpi: add missing of_node_put
for_each_available_child_of_node performs an of_node_get on each iteration,
so a break out of the loop requires an of_node_put.

The semantic patch that fixes this problem is as follows
(http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_available_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Acked-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-11-30 16:29:15 -08:00
Linus Torvalds 2255702db4 A single patch to fix mn10300 build failures
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJWXGWxAAoJEMsfJm/On5mBEKwP/3dNqitzrigktNVozqYhujwI
 RuubApdsLNW6V1PhK2aDmnTy9HjyKfUnrJPRUT0WVpLh89L4SjxB8OygFFHsJFBb
 UAx3nOpSG/2izmOY2cDgkjfkLnuRBUPxPdhB5ssL37XdfXcniq17OcMhVnd2B874
 urA7XtPYt8AT1j/WwS3Oy8j5FoHYUFi9S04/HxW9l8BAoPBnDguVYWKFBfvwRCzS
 wQ3Vqp+S6Rpv7H0n22WSiMBdV7Sfz+STB1D6y//0JtCTm9cbuj9kCJnz9ei9FUfr
 g5ie8E9UBuIkj6tk/sPTKd+zH0WIYGnd3eGN4fBl8TUMGKtHyDLj7GvnCZZDJhYV
 dAmcrcxRUC+OPdea1X0Fnuh2jWce5OY32CCfxRjS4wcehabYs1YrCp149+HbzK/X
 DHO76WfmTdMG2KL6SSvkskGPGXc6aWNik9mYYn/fSD+gvwgBSs/fRnMDo5DxOXDn
 Gju2ZqexPp+iViHWy/43MQq6F38+nVkFRGtPi/qgB3c0//XYpq7xgll4Gx1n5JG2
 8zmd3aC4fiWRSDEc9W2PDqb9mgOz2lSUH3nXbEDJNWShRjjEJhmg6vHYIQeV53Lu
 jZ1A5PM45fzGHmd3QP7kME1OGAz6bGmz1Rk/xKsSJiMWgbyKsfxBZ+xookZKGDfh
 wR/f/S4z/0N5R8gjjarx
 =J06l
 -----END PGP SIGNATURE-----

Merge tag 'mn10300-for-linus-v4.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull mn10300 fix from Guenter Roeck:
 "A single patch to fix mn10300 build failures"

* tag 'mn10300-for-linus-v4.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  mn10300: Select CONFIG_HAVE_UID16 to fix build failure
2015-11-30 16:06:44 -08:00
Masahiro Yamada ba85edbe0d of/address: fix typo in comment block of of_translate_one()
Remove the "not" before "cannot".

I am fixing the comment block style while I am here.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Rob Herring <robh@kernel.org>
2015-11-30 17:57:01 -06:00