[PATCH 3.15 07/61] ipv6: Fix regression caused by efe4208 in udp_v6_mcast_next()

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Sven Wegener 

[ Upstream commit 3bfdc59a6c24608ed23e903f670aaf5f58c7a6f3 ]

Commit efe4208 ("ipv6: make lookups simpler and faster") introduced a
regression in udp_v6_mcast_next(), resulting in multicast packets not
reaching the destination sockets under certain conditions.

The packet's IPv6 addresses are wrongly compared to the IPv6 addresses
from the function's socket argument, which indicates the starting point
for looping, instead of the loop variable. If the addresses from the
first socket do not match the packet's addresses, no socket in the list
will match.

Signed-off-by: Sven Wegener 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv6/udp.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -716,15 +716,15 @@ static struct sock *udp_v6_mcast_next(st
if (inet->inet_dport != rmt_port)
continue;
}
-   if (!ipv6_addr_any(&sk->sk_v6_daddr) &&
-   !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr))
+   if (!ipv6_addr_any(&s->sk_v6_daddr) &&
+   !ipv6_addr_equal(&s->sk_v6_daddr, rmt_addr))
continue;
 
if (s->sk_bound_dev_if && s->sk_bound_dev_if != dif)
continue;
 
-   if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr)) {
-   if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, 
loc_addr))
+   if (!ipv6_addr_any(&s->sk_v6_rcv_saddr)) {
+   if (!ipv6_addr_equal(&s->sk_v6_rcv_saddr, 
loc_addr))
continue;
}
if (!inet6_mc_check(s, loc_addr, rmt_addr))


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [memcontrol] WARNING: CPU: 0 PID: 1 at kernel/res_counter.c:28 res_counter_uncharge_locked()

[Felipe Balbi]

On Fri, Jun 20, 2014 at 11:42:10AM -0400, Johannes Weiner wrote:
> On Fri, Jun 20, 2014 at 06:27:04PM +0800, Fengguang Wu wrote:
> > Greetings,
> > 
> > 0day kernel testing robot got the below dmesg and the first bad commit is
> > 
> > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
> 
> Thanks for the bisect.
> 
> > commit ddc5bfec501f4be3f9e89084c2db270c0c45d1d6
> > Author: Johannes Weiner 
> > AuthorDate: Fri Jun 20 10:27:58 2014 +1000
> > Commit: Stephen Rothwell 
> > CommitDate: Fri Jun 20 10:27:58 2014 +1000
> > 
> > mm: memcontrol: rewrite uncharge API
> > 
> > The memcg uncharging code that is involved towards the end of a page's
> > lifetime - truncation, reclaim, swapout, migration - is impressively
> > complicated and fragile.
> > 
> > Because anonymous and file pages were always charged before they had 
> > their
> > page->mapping established, uncharges had to happen when the page type
> > could still be known from the context; as in unmap for anonymous, page
> > cache removal for file and shmem pages, and swap cache truncation for 
> > swap
> > pages.  However, these operations happen well before the page is 
> > actually
> > freed, and so a lot of synchronization is necessary:
> > 
> > - Charging, uncharging, page migration, and charge migration all need
> >   to take a per-page bit spinlock as they could race with uncharging.
> > 
> > - Swap cache truncation happens during both swap-in and swap-out, and
> >   possibly repeatedly before the page is actually freed.  This means
> >   that the memcg swapout code is called from many contexts that make
> >   no sense and it has to figure out the direction from page state to
> >   make sure memory and memory+swap are always correctly charged.
> > 
> > - On page migration, the old page might be unmapped but then reused,
> >   so memcg code has to prevent untimely uncharging in that case.
> >   Because this code - which should be a simple charge transfer - is so
> >   special-cased, it is not reusable for replace_page_cache().
> > 
> > But now that charged pages always have a page->mapping, introduce
> > mem_cgroup_uncharge(), which is called after the final put_page(), when 
> > we
> > know for sure that nobody is looking at the page anymore.
> > 
> > For page migration, introduce mem_cgroup_migrate(), which is called 
> > after
> > the migration is successful and the new page is fully rmapped.  Because
> > the old page is no longer uncharged after migration, prevent double
> > charges by decoupling the page's memcg association (PCG_USED and
> > pc->mem_cgroup) from the page holding an actual charge.  The new bits
> > PCG_MEM and PCG_MEMSW represent the respective charges and are 
> > transferred
> > to the new page during migration.
> > 
> > mem_cgroup_migrate() is suitable for replace_page_cache() as well, which
> > gets rid of mem_cgroup_replace_page_cache().
> > 
> > Swap accounting is massively simplified: because the page is no longer
> > uncharged as early as swap cache deletion, a new mem_cgroup_swapout() 
> > can
> > transfer the page's memory+swap charge (PCG_MEMSW) to the swap entry
> > before the final put_page() in page reclaim.
> > 
> > Finally, page_cgroup changes are now protected by whatever protection 
> > the
> > page itself offers: anonymous pages are charged under the page table 
> > lock,
> > whereas page cache insertions, swapin, and migration hold the page lock.
> > Uncharging happens under full exclusion with no outstanding references.
> > Charging and uncharging also ensure that the page is off-LRU, which
> > serializes against charge migration.  Remove the very costly page_cgroup
> > lock and set pc->flags non-atomically.
> > 
> > Signed-off-by: Johannes Weiner 
> > Cc: Michal Hocko 
> > Cc: Hugh Dickins 
> > Cc: Tejun Heo 
> > Cc: Vladimir Davydov 
> > Signed-off-by: Andrew Morton 
> > 
> > +---+++---+
> > |   | 
> > 5b647620c6 | ddc5bfec50 | next-20140620 |
> > +---+++---+
> > | boot_successes| 
> > 60 | 0  | 0 |
> > | boot_failures | 0 
> >  | 20 | 13|
> > | WARNING:CPU:PID:at_kernel/res_counter.c:res_counter_uncharge_locked() | 0 
> >  | 20 | 13|
> > | backtrace:vm_munmap   | 0 
> >  | 20 | 13|
> > | backtrace

Re: Re: [PATCH v2 0/8] Add Keystone PCIe controller driver

[Murali Karicheri]

Pratyush,

On 06/23/2014 12:50 PM, Santosh Shilimkar wrote:




 Original Message 
Subject: Re: [PATCH v2 0/8] Add Keystone PCIe controller driver
On Sat, Jun 21, 2014 at 03:05:30AM +0800, Arnd Bergmann wrote:

On Friday 20 June 2014 13:11:37 Santosh Shilimkar wrote:





Arnd suggestion was to have the version 3.65 code in generic place since
its IP specific and just in case some other vendor using the same version
can leverage the code.


Sorry, I do not follow PCIe mailing list these days, doing something else
now. So coming to this topic a bit delayed.


My Apologies for the email format as I mysteriously lost this email and
had to resort to a forwarded email to respond to this.

Let us have the discussion on this thread as I lost the original emails.


Concern here seems toe really those name of the files. I can't think of
any other appropriate name.


We should definitely keep the version in the DT "compatible" strings
wherever we know it. Regarding a better file name, I have no idea.


In my opinion, we do not need any of dw-v3_65 files, as code in these
files will not be usable by other vendors.

Anything which is implemented in application space, will not be same
across all IP users. For example, MSI0_IRQ_ENABLE_SET has been defined
at offset 0x108 in keystone PCIe application space.Other vendor may
not have this register at the same offset. Moreover, other vendors are
not even obliged to implement MSI Enable signals in same way, so
internal bit definition of the register may change.

Therefore code is not reusable if all register offset and bit
definitions are not same across vendors. So, in case of DW driver none
of the code which are accessed using va_app_base should go to common
area.



I think based on the response far on this issue, it is best to keep
the Application specific code as part of Keystone driver and in
future if there is any driver that has similar application register
implemented. we can refactor the code and re-use.

My V3 will revert back to implementation similar to RFC. Also since this
is individual h/w specific, there is no no need for a compatibility as
well. Will use keystone specific compatibility string for this.

Arnd, hope this is fine. Please respond if you still think a 
compatibility string is needed.


Murali


Pratyush



Arnd





--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 15/61] ipip, sit: fix ipv4_{update_pmtu,redirect} calls

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Popov 

[ Upstream commit 2346829e641b804ece9ac9298136b56d9567c278 ]

ipv4_{update_pmtu,redirect} were called with tunnel's ifindex (t->dev is a
tunnel netdevice). It caused wrong route lookup and failure of pmtu update or
redirect. We should use the same ifindex that we use in ip_route_output_* in
*tunnel_xmit code. It is t->parms.link .

Signed-off-by: Dmitry Popov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv4/ipip.c |4 ++--
 net/ipv6/sit.c  |4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -149,13 +149,13 @@ static int ipip_err(struct sk_buff *skb,
 
if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
ipv4_update_pmtu(skb, dev_net(skb->dev), info,
-t->dev->ifindex, 0, IPPROTO_IPIP, 0);
+t->parms.link, 0, IPPROTO_IPIP, 0);
err = 0;
goto out;
}
 
if (type == ICMP_REDIRECT) {
-   ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0,
+   ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
  IPPROTO_IPIP, 0);
err = 0;
goto out;
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -560,12 +560,12 @@ static int ipip6_err(struct sk_buff *skb
 
if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
ipv4_update_pmtu(skb, dev_net(skb->dev), info,
-t->dev->ifindex, 0, IPPROTO_IPV6, 0);
+t->parms.link, 0, IPPROTO_IPV6, 0);
err = 0;
goto out;
}
if (type == ICMP_REDIRECT) {
-   ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0,
+   ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
  IPPROTO_IPV6, 0);
err = 0;
goto out;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH v2 1/4] clk: samsung: exynos4: Add missing CPU/DMC clock hierarchy

[Tomasz Figa]

This patch adds missing definitions of clocks from CPU and DMC clock
domains, which are necessary to properly represent CLKOUT clock hierarchy
added in further patch.

Signed-off-by: Tomasz Figa 
---
 drivers/clk/samsung/clk-exynos4.c | 50 +++
 1 file changed, 50 insertions(+)

diff --git a/drivers/clk/samsung/clk-exynos4.c 
b/drivers/clk/samsung/clk-exynos4.c
index 4f150c9..f95ae6c 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -397,10 +397,15 @@ PNAME(mout_audio2_p4210) = { "cdclk2", "none", 
"sclk_hdmi24m",
"sclk_epll", "sclk_vpll", };
 PNAME(mout_mixer_p4210)= { "sclk_dac", "sclk_hdmi", };
 PNAME(mout_dac_p4210)  = { "sclk_vpll", "sclk_hdmiphy", };
+PNAME(mout_pwi_p4210) = { "xxti", "xusbxti", "sclk_hdmi24m", "sclk_usbphy0",
+   "sclk_usbphy1", "sclk_hdmiphy", "none",
+   "sclk_epll", "sclk_vpll" };
 
 /* Exynos 4x12-specific parent groups */
 PNAME(mout_mpll_user_p4x12) = { "fin_pll", "sclk_mpll", };
 PNAME(mout_core_p4x12) = { "mout_apll", "mout_mpll_user_c", };
+PNAME(mout_gdl_p4x12)  = { "mout_mpll_user_l", "sclk_apll", };
+PNAME(mout_gdr_p4x12)  = { "mout_mpll_user_r", "sclk_apll", };
 PNAME(sclk_ampll_p4x12)= { "mout_mpll_user_t", "sclk_apll", };
 PNAME(group1_p4x12)= { "xxti", "xusbxti", "sclk_hdmi24m", "sclk_usbphy0",
"none", "sclk_hdmiphy", "mout_mpll_user_t",
@@ -418,6 +423,9 @@ PNAME(aclk_p4412)   = { "mout_mpll_user_t", "sclk_apll", };
 PNAME(mout_user_aclk400_mcuisp_p4x12) = {"fin_pll", "div_aclk400_mcuisp", };
 PNAME(mout_user_aclk200_p4x12) = {"fin_pll", "div_aclk200", };
 PNAME(mout_user_aclk266_gps_p4x12) = {"fin_pll", "div_aclk266_gps", };
+PNAME(mout_pwi_p4x12) = { "xxti", "xusbxti", "sclk_hdmi24m", "sclk_usbphy0",
+   "none", "sclk_hdmiphy", "sclk_mpll",
+   "sclk_epll", "sclk_vpll" };
 
 /* fixed rate clocks generated outside the soc */
 static struct samsung_fixed_rate_clock exynos4_fixed_rate_ext_clks[] 
__initdata = {
@@ -451,6 +459,9 @@ static struct samsung_mux_clock exynos4_mux_clks[] 
__initdata = {
MUX(0, "mout_onenand1", mout_onenand1_p, SRC_TOP0, 0, 1),
MUX(CLK_SCLK_EPLL, "sclk_epll", mout_epll_p, SRC_TOP0, 4, 1),
MUX(0, "mout_onenand", mout_onenand_p, SRC_TOP0, 28, 1),
+
+   MUX(0, "mout_dmc_bus", sclk_ampll_p4210, SRC_DMC, 4, 1),
+   MUX(0, "mout_dphy", sclk_ampll_p4210, SRC_DMC, 8, 1),
 };
 
 /* list of mux clocks supported in exynos4210 soc */
@@ -459,6 +470,10 @@ static struct samsung_mux_clock exynos4210_mux_early[] 
__initdata = {
 };
 
 static struct samsung_mux_clock exynos4210_mux_clks[] __initdata = {
+   MUX(0, "mout_gdl", sclk_ampll_p4210, SRC_LEFTBUS, 0, 1),
+
+   MUX(0, "mout_gdr", sclk_ampll_p4210, SRC_RIGHTBUS, 0, 1),
+
MUX(0, "mout_aclk200", sclk_ampll_p4210, SRC_TOP0, 12, 1),
MUX(0, "mout_aclk100", sclk_ampll_p4210, SRC_TOP0, 16, 1),
MUX(0, "mout_aclk160", sclk_ampll_p4210, SRC_TOP0, 20, 1),
@@ -472,6 +487,7 @@ static struct samsung_mux_clock exynos4210_mux_clks[] 
__initdata = {
MUX(0, "mout_mipi1", group1_p4210, E4210_SRC_LCD1, 12, 4),
MUX(CLK_SCLK_MPLL, "sclk_mpll", mout_mpll_p, SRC_CPU, 8, 1),
MUX(CLK_MOUT_CORE, "mout_core", mout_core_p4210, SRC_CPU, 16, 1),
+   MUX(0, "mout_hpm", mout_core_p4210, SRC_CPU, 20, 1),
MUX(CLK_SCLK_VPLL, "sclk_vpll", sclk_vpll_p4210, SRC_TOP0, 8, 1),
MUX(CLK_MOUT_FIMC0, "mout_fimc0", group1_p4210, SRC_CAM, 0, 4),
MUX(CLK_MOUT_FIMC1, "mout_fimc1", group1_p4210, SRC_CAM, 4, 4),
@@ -503,10 +519,18 @@ static struct samsung_mux_clock exynos4210_mux_clks[] 
__initdata = {
MUX(0, "mout_spi0", group1_p4210, SRC_PERIL1, 16, 4),
MUX(0, "mout_spi1", group1_p4210, SRC_PERIL1, 20, 4),
MUX(0, "mout_spi2", group1_p4210, SRC_PERIL1, 24, 4),
+
+   MUX(0, "mout_pwi", mout_pwi_p4210, SRC_DMC, 16, 4),
 };
 
 /* list of mux clocks supported in exynos4x12 soc */
 static struct samsung_mux_clock exynos4x12_mux_clks[] __initdata = {
+   MUX(0, "mout_mpll_user_l", mout_mpll_p, SRC_LEFTBUS, 4, 1),
+   MUX(0, "mout_gdl", mout_gdl_p4x12, SRC_LEFTBUS, 0, 1),
+
+   MUX(0, "mout_mpll_user_r", mout_mpll_p, SRC_RIGHTBUS, 4, 1),
+   MUX(0, "mout_gdr", mout_gdr_p4x12, SRC_RIGHTBUS, 0, 1),
+
MUX(CLK_MOUT_MPLL_USER_C, "mout_mpll_user_c", mout_mpll_user_p4x12,
SRC_CPU, 24, 1),
MUX(0, "mout_aclk266_gps", aclk_p4412, SRC_TOP1, 4, 1),
@@ -531,6 +555,7 @@ static struct samsung_mux_clock exynos4x12_mux_clks[] 
__initdata = {
MUX(CLK_SCLK_MPLL, "sclk_mpll", mout_mpll_p, SRC_DMC, 12, 1),
MUX(CLK_SCLK_VPLL, "sclk_vpll", mout_vpll_p, SRC_TOP0, 8, 1),
MUX(CLK_MOUT_CORE, "mout_core", mout_core_p4x12, SRC_CPU, 16, 1),
+   MUX(0, "mout_hpm", mout_core_p4x12, SRC_CPU, 20, 1),
  

[PATCH 3.15 08/61] net: tunnels - enable module autoloading

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Tom Gundersen 

[ Upstream commit f98f89a0104454f35a62d681683c844f6dbf4043 ]

Enable the module alias hookup to allow tunnel modules to be autoloaded on 
demand.

This is in line with how most other netdev kinds work, and will allow userspace
to create tunnels without having CAP_SYS_MODULE.

Signed-off-by: Tom Gundersen 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv4/ipip.c   |1 +
 net/ipv6/ip6_tunnel.c |1 +
 net/ipv6/sit.c|1 +
 3 files changed, 3 insertions(+)

--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -486,4 +486,5 @@ static void __exit ipip_fini(void)
 module_init(ipip_init);
 module_exit(ipip_fini);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_RTNL_LINK("ipip");
 MODULE_ALIAS_NETDEV("tunl0");
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -61,6 +61,7 @@
 MODULE_AUTHOR("Ville Nuorvala");
 MODULE_DESCRIPTION("IPv6 tunneling device");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_RTNL_LINK("ip6tnl");
 MODULE_ALIAS_NETDEV("ip6tnl0");
 
 #ifdef IP6_TNL_DEBUG
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1828,4 +1828,5 @@ xfrm_tunnel_failed:
 module_init(sit_init);
 module_exit(sit_cleanup);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_RTNL_LINK("sit");
 MODULE_ALIAS_NETDEV("sit0");


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 06/61] evm: prohibit userspace writing security.evm HMAC value

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Mimi Zohar 

commit 2fb1c9a4f2dbc2f0bd2431c7fa64d0b5483864e4 upstream.

Calculating the 'security.evm' HMAC value requires access to the
EVM encrypted key.  Only the kernel should have access to it.  This
patch prevents userspace tools(eg. setfattr, cp --preserve=xattr)
from setting/modifying the 'security.evm' HMAC value directly.

Signed-off-by: Mimi Zohar 
Signed-off-by: Greg Kroah-Hartman 

---
 security/integrity/evm/evm_main.c |   12 ++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -287,12 +287,20 @@ out:
  * @xattr_value: pointer to the new extended attribute value
  * @xattr_value_len: pointer to the new extended attribute value length
  *
- * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that
- * the current value is valid.
+ * Before allowing the 'security.evm' protected xattr to be updated,
+ * verify the existing value is valid.  As only the kernel should have
+ * access to the EVM encrypted key needed to calculate the HMAC, prevent
+ * userspace from writing HMAC value.  Writing 'security.evm' requires
+ * requires CAP_SYS_ADMIN privileges.
  */
 int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
   const void *xattr_value, size_t xattr_value_len)
 {
+   const struct evm_ima_xattr_data *xattr_data = xattr_value;
+
+   if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0)
+   && (xattr_data->type == EVM_XATTR_HMAC))
+   return -EPERM;
return evm_protect_xattr(dentry, xattr_name, xattr_value,
 xattr_value_len);
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 16/61] sfc: PIO:Restrict to 64bit arch and use 64-bit writes.

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Jon Cooper 

[ Upstream commit daf37b556e437ec1ea1a597dcfeff338068380e1 ]

Fixes:ee45fd92c739
("sfc: Use TX PIO for sufficiently small packets")

The linux net driver uses memcpy_toio() in order to copy into
the PIO buffers.
Even on a 64bit machine this causes 32bit accesses to a write-
combined memory region.
There are hardware limitations that mean that only 64bit
naturally aligned accesses are safe in all cases.
Due to being write-combined memory region two 32bit accesses
may be coalesced to form a 64bit non 64bit aligned access.
Solution was to open-code the memory copy routines using pointers
and to only enable PIO for x86_64 machines.

Not tested on platforms other than x86_64 because this patch
disables the PIO feature on other platforms.
Compile-tested on x86 to ensure that works.

The WARN_ON_ONCE() code in the previous version of this patch
has been moved into the internal sfc debug driver as the
assertion was unnecessary in the upstream kernel code.

This bug fix applies to v3.13 and v3.14 stable branches.

Signed-off-by: Shradha Shah 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/sfc/io.h |7 +++
 drivers/net/ethernet/sfc/tx.c |   22 +-
 2 files changed, 24 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/sfc/io.h
+++ b/drivers/net/ethernet/sfc/io.h
@@ -66,10 +66,17 @@
 #define EFX_USE_QWORD_IO 1
 #endif
 
+/* Hardware issue requires that only 64-bit naturally aligned writes
+ * are seen by hardware. Its not strictly necessary to restrict to
+ * x86_64 arch, but done for safety since unusual write combining behaviour
+ * can break PIO.
+ */
+#ifdef CONFIG_X86_64
 /* PIO is a win only if write-combining is possible */
 #ifdef ARCH_HAS_IOREMAP_WC
 #define EFX_USE_PIO 1
 #endif
+#endif
 
 #ifdef EFX_USE_QWORD_IO
 static inline void _efx_writeq(struct efx_nic *efx, __le64 value,
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -189,6 +189,18 @@ struct efx_short_copy_buffer {
u8 buf[L1_CACHE_BYTES];
 };
 
+/* Copy in explicit 64-bit writes. */
+static void efx_memcpy_64(void __iomem *dest, void *src, size_t len)
+{
+   u64 *src64 = src;
+   u64 __iomem *dest64 = dest;
+   size_t l64 = len / 8;
+   size_t i;
+
+   for (i = 0; i < l64; i++)
+   writeq(src64[i], &dest64[i]);
+}
+
 /* Copy to PIO, respecting that writes to PIO buffers must be dword aligned.
  * Advances piobuf pointer. Leaves additional data in the copy buffer.
  */
@@ -198,7 +210,7 @@ static void efx_memcpy_toio_aligned(stru
 {
int block_len = len & ~(sizeof(copy_buf->buf) - 1);
 
-   memcpy_toio(*piobuf, data, block_len);
+   efx_memcpy_64(*piobuf, data, block_len);
*piobuf += block_len;
len -= block_len;
 
@@ -230,7 +242,7 @@ static void efx_memcpy_toio_aligned_cb(s
if (copy_buf->used < sizeof(copy_buf->buf))
return;
 
-   memcpy_toio(*piobuf, copy_buf->buf, sizeof(copy_buf->buf));
+   efx_memcpy_64(*piobuf, copy_buf->buf, sizeof(copy_buf->buf));
*piobuf += sizeof(copy_buf->buf);
data += copy_to_buf;
len -= copy_to_buf;
@@ -245,7 +257,7 @@ static void efx_flush_copy_buffer(struct
 {
/* if there's anything in it, write the whole buffer, including junk */
if (copy_buf->used)
-   memcpy_toio(piobuf, copy_buf->buf, sizeof(copy_buf->buf));
+   efx_memcpy_64(piobuf, copy_buf->buf, sizeof(copy_buf->buf));
 }
 
 /* Traverse skb structure and copy fragments in to PIO buffer.
@@ -304,8 +316,8 @@ efx_enqueue_skb_pio(struct efx_tx_queue
 */
BUILD_BUG_ON(L1_CACHE_BYTES >
 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
-   memcpy_toio(tx_queue->piobuf, skb->data,
-   ALIGN(skb->len, L1_CACHE_BYTES));
+   efx_memcpy_64(tx_queue->piobuf, skb->data,
+ ALIGN(skb->len, L1_CACHE_BYTES));
}
 
EFX_POPULATE_QWORD_5(buffer->option,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 05/61] ima: introduce ima_kernel_read()

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Kasatkin 

commit 0430e49b6e7c6b5e076be8fefdee089958c9adad upstream.

Commit 8aac62706 "move exit_task_namespaces() outside of exit_notify"
introduced the kernel opps since the kernel v3.10, which happens when
Apparmor and IMA-appraisal are enabled at the same time.

--
[  106.750167] BUG: unable to handle kernel NULL pointer dereference at
0018
[  106.750221] IP: [] our_mnt+0x1a/0x30
[  106.750241] PGD 0
[  106.750254] Oops:  [#1] SMP
[  106.750272] Modules linked in: cuse parport_pc ppdev bnep rfcomm
bluetooth rpcsec_gss_krb5 nfsd auth_rpcgss nfs_acl nfs lockd sunrpc
fscache dm_crypt intel_rapl x86_pkg_temp_thermal intel_powerclamp
kvm_intel snd_hda_codec_hdmi kvm crct10dif_pclmul crc32_pclmul
ghash_clmulni_intel aesni_intel aes_x86_64 glue_helper lrw gf128mul
ablk_helper cryptd snd_hda_codec_realtek dcdbas snd_hda_intel
snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_seq_midi
snd_seq_midi_event snd_rawmidi psmouse snd_seq microcode serio_raw
snd_timer snd_seq_device snd soundcore video lpc_ich coretemp mac_hid lp
parport mei_me mei nbd hid_generic e1000e usbhid ahci ptp hid libahci
pps_core
[  106.750658] CPU: 6 PID: 1394 Comm: mysqld Not tainted 3.13.0-rc7-kds+ #15
[  106.750673] Hardware name: Dell Inc. OptiPlex 9010/0M9KCM, BIOS A08
09/19/2012
[  106.750689] task: 8800de804920 ti: 880400fca000 task.ti:
880400fca000
[  106.750704] RIP: 0010:[]  []
our_mnt+0x1a/0x30
[  106.750725] RSP: 0018:880400fcba60  EFLAGS: 00010286
[  106.750738] RAX:  RBX: 0100 RCX:
8800d51523e7
[  106.750764] RDX: ffea RSI: 880400fcba34 RDI:
880402d20020
[  106.750791] RBP: 880400fcbae0 R08:  R09:
0001
[  106.750817] R10:  R11: 0001 R12:
8800d5152300
[  106.750844] R13: 8803eb8df510 R14: 880400fcbb28 R15:
8800d51523e7
[  106.750871] FS:  () GS:88040d20()
knlGS:
[  106.750910] CS:  0010 DS:  ES:  CR0: 80050033
[  106.750935] CR2: 0018 CR3: 01c0e000 CR4:
001407e0
[  106.750962] Stack:
[  106.750981]  813434eb 880400fcbb20 880400fcbb18

[  106.751037]  8800de804920 8101b9b9 00018000
0100
[  106.751093]  0100 0002 000e
8803eb8df500
[  106.751149] Call Trace:
[  106.751172]  [] ? aa_path_name+0x2ab/0x430
[  106.751199]  [] ? sched_clock+0x9/0x10
[  106.751225]  [] aa_path_perm+0x7d/0x170
[  106.751250]  [] ? native_sched_clock+0x15/0x80
[  106.751276]  [] aa_file_perm+0x33/0x40
[  106.751301]  [] common_file_perm+0x8e/0xb0
[  106.751327]  [] apparmor_file_permission+0x18/0x20
[  106.751355]  [] security_file_permission+0x23/0xa0
[  106.751382]  [] rw_verify_area+0x52/0xe0
[  106.751407]  [] vfs_read+0x6d/0x170
[  106.751432]  [] kernel_read+0x41/0x60
[  106.751457]  [] ima_calc_file_hash+0x225/0x280
[  106.751483]  [] ? ima_calc_file_hash+0x32/0x280
[  106.751509]  [] ima_collect_measurement+0x9d/0x160
[  106.751536]  [] ? trace_hardirqs_on+0xd/0x10
[  106.751562]  [] ? ima_file_free+0x6c/0xd0
[  106.751587]  [] ima_update_xattr+0x34/0x60
[  106.751612]  [] ima_file_free+0xc0/0xd0
[  106.751637]  [] __fput+0xd5/0x300
[  106.751662]  [] fput+0xe/0x10
[  106.751687]  [] task_work_run+0xc4/0xe0
[  106.751712]  [] do_exit+0x2bd/0xa90
[  106.751738]  [] ? retint_swapgs+0x13/0x1b
[  106.751763]  [] do_group_exit+0x4c/0xc0
[  106.751788]  [] SyS_exit_group+0x14/0x20
[  106.751814]  [] system_call_fastpath+0x1a/0x1f
[  106.751839] Code: c3 0f 1f 44 00 00 55 48 89 e5 e8 22 fe ff ff 5d c3
0f 1f 44 00 00 55 65 48 8b 04 25 c0 c9 00 00 48 8b 80 28 06 00 00 48 89
e5 5d <48> 8b 40 18 48 39 87 c0 00 00 00 0f 94 c0 c3 0f 1f 80 00 00 00
[  106.752185] RIP  [] our_mnt+0x1a/0x30
[  106.752214]  RSP 
[  106.752236] CR2: 0018
[  106.752258] ---[ end trace 3c520748b4732721 ]---
--

The reason for the oops is that IMA-appraisal uses "kernel_read()" when
file is closed. kernel_read() honors LSM security hook which calls
Apparmor handler, which uses current->nsproxy->mnt_ns. The 'guilty'
commit changed the order of cleanup code so that nsproxy->mnt_ns was
not already available for Apparmor.

Discussion about the issue with Al Viro and Eric W. Biederman suggested
that kernel_read() is too high-level for IMA. Another issue, except
security checking, that was identified is mandatory locking. kernel_read
honors it as well and it might prevent IMA from calculating necessary hash.
It was suggested to use simplified version of the function without security
and locking checks.

This patch introduces special version ima_kernel_read(), which skips security
a

[PATCH v2 2/4] clk: samsung: exynos4: Add CLKOUT clock hierarchy

[Tomasz Figa]

This patch adds definitions of clocks that are used to drive clock
output signals of particular CMU sub-blocks that are then fed to PMU and
handled by Exynos CLKOUT driver added in further patch.

Signed-off-by: Tomasz Figa 
---
 drivers/clk/samsung/clk-exynos4.c   | 116 ++--
 include/dt-bindings/clock/exynos4.h |   5 ++
 2 files changed, 117 insertions(+), 4 deletions(-)

diff --git a/drivers/clk/samsung/clk-exynos4.c 
b/drivers/clk/samsung/clk-exynos4.c
index f95ae6c..7d1fb99 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -25,10 +25,12 @@
 #define DIV_LEFTBUS0x4500
 #define GATE_IP_LEFTBUS0x4800
 #define E4X12_GATE_IP_IMAGE0x4930
+#define CLKOUT_CMU_LEFTBUS 0x4a00
 #define SRC_RIGHTBUS   0x8200
 #define DIV_RIGHTBUS   0x8500
 #define GATE_IP_RIGHTBUS   0x8800
 #define E4X12_GATE_IP_PERIR0x8960
+#define CLKOUT_CMU_RIGHTBUS0x8a00
 #define EPLL_LOCK  0xc010
 #define VPLL_LOCK  0xc020
 #define EPLL_CON0  0xc110
@@ -98,6 +100,7 @@
 #define GATE_IP_PERIL  0xc950
 #define E4210_GATE_IP_PERIR0xc960
 #define GATE_BLOCK 0xc970
+#define CLKOUT_CMU_TOP 0xca00
 #define E4X12_MPLL_LOCK0x10008
 #define E4X12_MPLL_CON00x10108
 #define SRC_DMC0x10200
@@ -105,6 +108,7 @@
 #define DIV_DMC0   0x10500
 #define DIV_DMC1   0x10504
 #define GATE_IP_DMC0x10900
+#define CLKOUT_CMU_DMC 0x10a00
 #define APLL_LOCK  0x14000
 #define E4210_MPLL_LOCK0x14008
 #define APLL_CON0  0x14100
@@ -114,6 +118,7 @@
 #define DIV_CPU1   0x14504
 #define GATE_SCLK_CPU  0x14800
 #define GATE_IP_CPU0x14900
+#define CLKOUT_CMU_CPU 0x14a00
 #define E4X12_DIV_ISP0 0x18300
 #define E4X12_DIV_ISP1 0x18304
 #define E4X12_GATE_ISP00x18800
@@ -242,6 +247,11 @@ static unsigned long exynos4_clk_regs[] __initdata = {
DIV_CPU1,
GATE_SCLK_CPU,
GATE_IP_CPU,
+   CLKOUT_CMU_LEFTBUS,
+   CLKOUT_CMU_RIGHTBUS,
+   CLKOUT_CMU_TOP,
+   CLKOUT_CMU_DMC,
+   CLKOUT_CMU_CPU,
 };
 
 static const struct samsung_clk_reg_dump src_mask_suspend[] = {
@@ -400,6 +410,23 @@ PNAME(mout_dac_p4210)  = { "sclk_vpll", 
"sclk_hdmiphy", };
 PNAME(mout_pwi_p4210) = { "xxti", "xusbxti", "sclk_hdmi24m", "sclk_usbphy0",
"sclk_usbphy1", "sclk_hdmiphy", "none",
"sclk_epll", "sclk_vpll" };
+PNAME(clkout_left_p4210) = { "sclk_mpll_div_2", "sclk_apll_div_2",
+   "div_gdl", "div_gpl" };
+PNAME(clkout_right_p4210) = { "sclk_mpll_div_2", "sclk_apll_div_2",
+   "div_gdr", "div_gpr" };
+PNAME(clkout_top_p4210) = { "fout_epll", "fout_vpll", "sclk_hdmi24m",
+   "sclk_usbphy0", "sclk_usbphy1", "sclk_hdmiphy",
+   "cdclk0", "cdclk1", "cdclk2", "spdif_extclk",
+   "aclk160", "aclk133", "aclk200", "aclk100",
+   "sclk_mfc", "sclk_g3d", "sclk_g2d",
+   "cam_a_pclk", "cam_b_pclk", "s_rxbyteclkhs0_2l",
+   "s_rxbyteclkhs0_4l" };
+PNAME(clkout_dmc_p4210) = { "div_dmcd", "div_dmcp", "div_acp_pclk", "div_dmc",
+   "div_dphy", "none", "div_pwi" };
+PNAME(clkout_cpu_p4210) = { "fout_apll_div_2", "none", "fout_mpll_div_2",
+   "none", "arm_clk_div_2", "div_corem0",
+   "div_corem1", "div_corem0", "div_atb",
+   "div_periph", "div_pclk_dbg", "div_hpm" };
 
 /* Exynos 4x12-specific parent groups */
 PNAME(mout_mpll_user_p4x12) = { "fin_pll", "sclk_mpll", };
@@ -426,6 +453,29 @@ PNAME(mout_user_aclk266_gps_p4x12) = {"fin_pll", 
"div_aclk266_gps", };
 PNAME(mout_pwi_p4x12) = { "xxti", "xusbxti", "sclk_hdmi24m", "sclk_usbphy0",
"none", "sclk_hdmiphy", "sclk_mpll",
"sclk_epll", "sclk_vpll" };
+PNAME(clkout_left_p4x12) = { "sclk_mpll_user_l_div_2", "sclk_apll_div_2",
+   "div_gdl", "div_gpl" };
+PNAME(clkout_right_p4x12) = { "sclk_mpll_user_r_div_2", "sclk_apll_div_2",
+   "div_gdr", "div_gpr" };
+PNAME(clkout_top_p4x12) = { "fout_epll", "fout_vpll", "sclk_hdmi24m",
+   "sclk_usbphy0", "none", "sclk_hdmiphy",
+   "cdclk0", "cdclk1", "cdclk2", "spdif_extclk",
+   "aclk160", "aclk133", "aclk200", "aclk100",
+   "sclk_mfc", "sclk_g3d", "aclk400_mcuisp",
+   "cam_a_pclk", "cam_b_pclk", "s_rxbyteclkhs0_2l",
+  

[PATCH 3.15 09/61] sh_eth: use RNC mode for packet reception

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Ben Dooks 

[ Upstream commit 530aa2d0d9d55ab2775d47621ddf4b5b15bc1110 ]

The current behaviour of the sh_eth driver is not to use the RNC bit
for the receive ring. This means that every packet recieved is not only
generating an IRQ but it also stops the receive ring DMA as well until
the driver re-enables it after unloading the packet.

This means that a number of the following errors are generated due to
the receive packet FIFO overflowing due to nowhere to put packets:

net eth0: Receive FIFO Overflow

Since feedback from Yoshihiro Shimoda shows that every supported LSI
for this driver should have the bit enabled it seems the best way is
to remove the RMCR default value from the per-system data and just
write it when initialising the RMCR value. This is discussed in
the message (http://www.spinics.net/lists/netdev/msg284912.html).

I have tested the RMCR_RNC configuration with NFS root filesystem and
the driver has not failed yet.  There are further test reports from
Sergei Shtylov and others for both the R8A7790 and R8A7791.

There is also feedback fron Cao Minh Hiep[1] which reports the
same issue in (http://comments.gmane.org/gmane.linux.network/316285)
showing this fixes issues with losing UDP datagrams under iperf.

Tested-by: Sergei Shtylyov 
Signed-off-by: Ben Dooks 
Acked-by: Yoshihiro Shimoda 
Acked-by: Simon Horman 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/renesas/sh_eth.c |   11 ++-
 drivers/net/ethernet/renesas/sh_eth.h |2 --
 2 files changed, 2 insertions(+), 11 deletions(-)

--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -546,7 +546,6 @@ static struct sh_eth_cpu_data sh7757_dat
.register_type  = SH_ETH_REG_FAST_SH4,
 
.eesipr_value   = DMAC_M_RFRMER | DMAC_M_ECI | 0x003f,
-   .rmcr_value = RMCR_RNC,
 
.tx_check   = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
.eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
@@ -624,7 +623,6 @@ static struct sh_eth_cpu_data sh7757_dat
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x072f,
-   .rmcr_value = RMCR_RNC,
 
.irq_flags  = IRQF_SHARED,
.apr= 1,
@@ -752,7 +750,6 @@ static struct sh_eth_cpu_data r8a7740_da
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x070f,
-   .rmcr_value = RMCR_RNC,
 
.apr= 1,
.mpr= 1,
@@ -784,7 +781,6 @@ static struct sh_eth_cpu_data r7s72100_d
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x070f,
-   .rmcr_value = RMCR_RNC,
 
.no_psr = 1,
.apr= 1,
@@ -833,9 +829,6 @@ static void sh_eth_set_default_cpu_data(
if (!cd->fdr_value)
cd->fdr_value = DEFAULT_FDR_INIT;
 
-   if (!cd->rmcr_value)
-   cd->rmcr_value = DEFAULT_RMCR_VALUE;
-
if (!cd->tx_check)
cd->tx_check = DEFAULT_TX_CHECK;
 
@@ -1287,8 +1280,8 @@ static int sh_eth_dev_init(struct net_de
sh_eth_write(ndev, mdp->cd->fdr_value, FDR);
sh_eth_write(ndev, 0, TFTR);
 
-   /* Frame recv control */
-   sh_eth_write(ndev, mdp->cd->rmcr_value, RMCR);
+   /* Frame recv control (enable multiple-packets per rx irq) */
+   sh_eth_write(ndev, RMCR_RNC, RMCR);
 
sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER);
 
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -319,7 +319,6 @@ enum TD_STS_BIT {
 enum RMCR_BIT {
RMCR_RNC = 0x0001,
 };
-#define DEFAULT_RMCR_VALUE 0x
 
 /* ECMR */
 enum FELIC_MODE_BIT {
@@ -466,7 +465,6 @@ struct sh_eth_cpu_data {
unsigned long fdr_value;
unsigned long fcftr_value;
unsigned long rpadir_value;
-   unsigned long rmcr_value;
 
/* interrupt checking mask */
unsigned long tx_check;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 64/68] ALSA: control: Protect user controls against concurrent access

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen 

commit 07f4d9d74a04aa7c72c5dae0ef97565f28f17b92 upstream.

The user-control put and get handlers as well as the tlv do not protect against
concurrent access from multiple threads. Since the state of the control is not
updated atomically it is possible that either two write operations or a write
and a read operation race against each other. Both can lead to arbitrary memory
disclosure. This patch introduces a new lock that protects user-controls from
concurrent access. Since applications typically access controls sequentially
than in parallel a single lock per card should be fine.

Signed-off-by: Lars-Peter Clausen 
Acked-by: Jaroslav Kysela 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 include/sound/core.h |2 ++
 sound/core/control.c |   31 +--
 sound/core/init.c|1 +
 3 files changed, 28 insertions(+), 6 deletions(-)

--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -121,6 +121,8 @@ struct snd_card {
int user_ctl_count; /* count of all user controls */
struct list_head controls;  /* all controls for this card */
struct list_head ctl_files; /* active control files */
+   struct mutex user_ctl_lock; /* protects user controls against
+  concurrent access */
 
struct snd_info_entry *proc_root;   /* root for soundcard specific 
files */
struct snd_info_entry *proc_id; /* the card id */
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -992,6 +992,7 @@ static int snd_ctl_elem_unlock(struct sn
 
 struct user_element {
struct snd_ctl_elem_info info;
+   struct snd_card *card;
void *elem_data;/* element data */
unsigned long elem_data_size;   /* size of element data in bytes */
void *tlv_data; /* TLV data */
@@ -1035,7 +1036,9 @@ static int snd_ctl_elem_user_get(struct
 {
struct user_element *ue = kcontrol->private_data;
 
+   mutex_lock(&ue->card->user_ctl_lock);
memcpy(&ucontrol->value, ue->elem_data, ue->elem_data_size);
+   mutex_unlock(&ue->card->user_ctl_lock);
return 0;
 }
 
@@ -1044,10 +1047,12 @@ static int snd_ctl_elem_user_put(struct
 {
int change;
struct user_element *ue = kcontrol->private_data;
-   
+
+   mutex_lock(&ue->card->user_ctl_lock);
change = memcmp(&ucontrol->value, ue->elem_data, ue->elem_data_size) != 
0;
if (change)
memcpy(ue->elem_data, &ucontrol->value, ue->elem_data_size);
+   mutex_unlock(&ue->card->user_ctl_lock);
return change;
 }
 
@@ -1067,19 +1072,32 @@ static int snd_ctl_elem_user_tlv(struct
new_data = memdup_user(tlv, size);
if (IS_ERR(new_data))
return PTR_ERR(new_data);
+   mutex_lock(&ue->card->user_ctl_lock);
change = ue->tlv_data_size != size;
if (!change)
change = memcmp(ue->tlv_data, new_data, size);
kfree(ue->tlv_data);
ue->tlv_data = new_data;
ue->tlv_data_size = size;
+   mutex_unlock(&ue->card->user_ctl_lock);
} else {
-   if (! ue->tlv_data_size || ! ue->tlv_data)
-   return -ENXIO;
-   if (size < ue->tlv_data_size)
-   return -ENOSPC;
+   int ret = 0;
+
+   mutex_lock(&ue->card->user_ctl_lock);
+   if (!ue->tlv_data_size || !ue->tlv_data) {
+   ret = -ENXIO;
+   goto err_unlock;
+   }
+   if (size < ue->tlv_data_size) {
+   ret = -ENOSPC;
+   goto err_unlock;
+   }
if (copy_to_user(tlv, ue->tlv_data, ue->tlv_data_size))
-   return -EFAULT;
+   ret = -EFAULT;
+err_unlock:
+   mutex_unlock(&ue->card->user_ctl_lock);
+   if (ret)
+   return ret;
}
return change;
 }
@@ -1211,6 +1229,7 @@ static int snd_ctl_elem_add(struct snd_c
ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL);
if (ue == NULL)
return -ENOMEM;
+   ue->card = card;
ue->info = *info;
ue->info.access = 0;
ue->elem_data = (char *)ue + sizeof(*ue);
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -218,6 +218,7 @@ int snd_card_create(int idx, const char
INIT_LIST_HEAD(&card->devices);
init_rwsem(&card->controls_rwsem);
rwlock_init(&card->ctl_files_rwlock);
+   mutex_init(&card->user_ctl_lock);
INIT_LIST_HEAD(&card->controls);
INIT_LIST_HEAD(&card->ctl_files);
spin_lock_init(&card->files_lo

[PATCH 3.15 32/61] USB: cdc-acm: fix open and suspend race

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 703df3297fb1950b0aa53e656108eb936d3f21d9 upstream.

We must not do the usb_autopm_put_interface() before submitting the read
urbs or we might end up doing I/O to a suspended device.

Fixes: 088c64f81284 ("USB: cdc-acm: re-write read processing")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/class/cdc-acm.c |7 +++
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -528,19 +528,15 @@ static int acm_port_activate(struct tty_
if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) {
dev_err(&acm->control->dev,
"%s - usb_submit_urb(ctrl irq) failed\n", __func__);
-   usb_autopm_put_interface(acm->control);
goto error_submit_urb;
}
 
acm->ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS;
if (acm_set_control(acm, acm->ctrlout) < 0 &&
(acm->ctrl_caps & USB_CDC_CAP_LINE)) {
-   usb_autopm_put_interface(acm->control);
goto error_set_control;
}
 
-   usb_autopm_put_interface(acm->control);
-
/*
 * Unthrottle device in case the TTY was closed while throttled.
 */
@@ -552,6 +548,8 @@ static int acm_port_activate(struct tty_
if (acm_submit_read_urbs(acm, GFP_KERNEL))
goto error_submit_read_urbs;
 
+   usb_autopm_put_interface(acm->control);
+
mutex_unlock(&acm->mutex);
 
return 0;
@@ -562,6 +560,7 @@ error_submit_read_urbs:
 error_set_control:
usb_kill_urb(acm->ctrlurb);
 error_submit_urb:
+   usb_autopm_put_interface(acm->control);
 error_get_interface:
 disconnected:
mutex_unlock(&acm->mutex);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 02/61] target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Nicholas Bellinger 

commit 0ed6e189e3f6ac3a25383ed5cc8b0ac24c9b97b7 upstream.

This patch fixes a NULL pointer dereference regression bug that was
introduced with:

commit 1e1110c43b1cda9fe77fc4a04835e460550e6b3c
Author: Mikulas Patocka 
Date:   Sat May 17 06:49:22 2014 -0400

target: fix memory leak on XCOPY

Now that target_put_sess_cmd() -> kref_put_spinlock_irqsave() is
called with a valid se_cmd->cmd_kref, a NULL pointer dereference
is triggered because the XCOPY passthrough commands don't have
an associated se_session pointer.

To address this bug, go ahead and checking for a NULL se_sess pointer
within target_put_sess_cmd(), and call se_cmd->se_tfo->release_cmd()
to release the XCOPY's xcopy_pt_cmd memory.

Reported-by: Thomas Glanzmann 
Cc: Thomas Glanzmann 
Cc: Mikulas Patocka 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/target/target_core_transport.c |4 
 1 file changed, 4 insertions(+)

--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2407,6 +2407,10 @@ static void target_release_cmd_kref(stru
  */
 int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd)
 {
+   if (!se_sess) {
+   se_cmd->se_tfo->release_cmd(se_cmd);
+   return 1;
+   }
return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, 
target_release_cmd_kref,
&se_sess->sess_cmd_lock);
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 14/61] net: force a list_del() in unregister_netdevice_many()

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric Dumazet 

[ Upstream commit 87757a917b0b3c0787e0563c679762152be81312 ]

unregister_netdevice_many() API is error prone and we had too
many bugs because of dangling LIST_HEAD on stacks.

See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD")

In fact, instead of making sure no caller leaves an active list_head,
just force a list_del() in the callee. No one seems to need to access
the list after unregister_netdevice_many()

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/macvlan.c |1 -
 net/core/dev.c|5 -
 net/core/rtnetlink.c  |1 -
 net/mac80211/iface.c  |1 -
 4 files changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1036,7 +1036,6 @@ static int macvlan_device_event(struct n
list_for_each_entry_safe(vlan, next, &port->vlans, list)
vlan->dev->rtnl_link_ops->dellink(vlan->dev, 
&list_kill);
unregister_netdevice_many(&list_kill);
-   list_del(&list_kill);
break;
case NETDEV_PRE_TYPE_CHANGE:
/* Forbid underlaying device to change its type. */
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6613,6 +6613,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue
 /**
  * unregister_netdevice_many - unregister many devices
  * @head: list of devices
+ *
+ *  Note: As most callers use a stack allocated list_head,
+ *  we force a list_del() to make sure stack wont be corrupted later.
  */
 void unregister_netdevice_many(struct list_head *head)
 {
@@ -6622,6 +6625,7 @@ void unregister_netdevice_many(struct li
rollback_registered_many(head);
list_for_each_entry(dev, head, unreg_list)
net_set_todo(dev);
+   list_del(head);
}
 }
 EXPORT_SYMBOL(unregister_netdevice_many);
@@ -7077,7 +7081,6 @@ static void __net_exit default_device_ex
}
}
unregister_netdevice_many(&dev_kill_list);
-   list_del(&dev_kill_list);
rtnl_unlock();
 }
 
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1744,7 +1744,6 @@ static int rtnl_dellink(struct sk_buff *
 
ops->dellink(dev, &list_kill);
unregister_netdevice_many(&list_kill);
-   list_del(&list_kill);
return 0;
 }
 
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1758,7 +1758,6 @@ void ieee80211_remove_interfaces(struct
}
mutex_unlock(&local->iflist_mtx);
unregister_netdevice_many(&unreg_list);
-   list_del(&unreg_list);
 
list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
list_del(&sdata->list);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 00/61] 3.15.2-stable review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 3.15.2 release.
There are 61 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu Jun 26 15:49:36 UTC 2014.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.15.2-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-
Pseudo-Shortlog of commits:

Greg Kroah-Hartman 
Linux 3.15.2-rc1

Joonsoo Kim 
slab: fix oops when reading /proc/slab_allocators

Hugh Dickins 
tmpfs: ZERO_RANGE and COLLAPSE_RANGE not currently supported

Lars-Peter Clausen 
ALSA: control: Make sure that id->index does not overflow

Lars-Peter Clausen 
ALSA: control: Handle numid overflow

Lars-Peter Clausen 
ALSA: control: Don't access controls outside of protected regions

Lars-Peter Clausen 
ALSA: control: Fix replacing user controls

Lars-Peter Clausen 
ALSA: control: Protect user controls against concurrent access

David Henningsson 
ALSA: hda - Add quirk for external mic on Lifebook U904

Mengdong Lin 
ALSA: hda - verify pin:converter connection on unsol event for HSW and VLV

Kailang Yang 
ALSA: hda/realtek - Add more entry for enable HP mute led

Kailang Yang 
ALSA: hda/realtek - Add support of ALC891 codec

Wang, Xiaoming 
ALSA: compress: Cancel the optimization of compiler and fix the size of 
struct for all platform.

Greg Kroah-Hartman 
lz4: ensure length does not wrap

Greg Kroah-Hartman 
lzo: properly check for overruns

Peter Meerwald 
iio: Fix two mpl3115 issues in measurement conversion

Peter Meerwald 
iio: Fix endianness issue in ak8975_read_axis()

Dan Carpenter 
iio: adc: at91: signedness bug in at91_adc_get_trigger_value_by_name()

Robert Hodaszi 
iio: mxs-lradc: fix divider

Dan Carpenter 
iio: adc: checking for NULL instead of IS_ERR() in probe

Mario Schuknecht 
staging: iio: tsl2x7x_core: fix proximity treshold

Jonathan Cameron 
iio:adc:max1363 incorrect resolutions for max11604, max11605, max11610 and 
max11611.

Peter Ujfalusi 
ASoC: tlv320aci3x: Fix custom snd_soc_dapm_put_volsw_aic3x() function

Liam Girdwood 
ASoC: max98090: Fix reset at resume time

Lars-Peter Clausen 
ASoC: dapm: Make sure to always update the DAPM graph in _put_volsw()

Radim Krčmář 
hv: use correct order when freeing monitor_pages

K. Y. Srinivasan 
Drivers: hv: balloon: Ensure pressure reports are posted regularly

Johan Hovold 
USB: cdc-acm: fix runtime PM imbalance at shutdown

Johan Hovold 
USB: cdc-acm: fix I/O after failed open

Johan Hovold 
USB: cdc-acm: fix failed open not being detected

Johan Hovold 
USB: cdc-acm: fix open and suspend race

Johan Hovold 
USB: cdc-acm: fix potential urb leak and PM imbalance in write

Johan Hovold 
USB: cdc-acm: fix shutdown and suspend race

Johan Hovold 
USB: cdc-acm: fix runtime PM for control messages

Johan Hovold 
USB: cdc-acm: fix broken runtime suspend

Johan Hovold 
USB: cdc-acm: fix write and resume race

Johan Hovold 
USB: cdc-acm: fix write and suspend race

James Hogan 
MIPS: KVM: Allocate at least 16KB for exception handlers

Christian Borntraeger 
KVM: s390: Drop pending interrupts on guest exit

Paolo Bonzini 
KVM: lapic: sync highest ISR to hardware apic on EOI

Boris BREZILLON 
ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs

Eric Dumazet 
udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup

Cong Wang 
vxlan: use dev->needed_headroom instead of dev->hard_header_len

Michal Schmidt 
rtnetlink: fix userspace API breakage for iproute2 < v3.9.0

Xufeng Zhang 
sctp: Fix sk_ack_backlog wrap-around problem

Eric Dumazet 
ipv4: fix a race in ip4_datagram_release_cb()

Jon Cooper 
sfc: PIO:Restrict to 64bit arch and use 64-bit writes.

Dmitry Popov 
ipip, sit: fix ipv4_{update_pmtu,redirect} calls

Eric Dumazet 
net: force a list_del() in unregister_netdevice_many()

Bjørn Mork 
net: qmi_wwan: add Olivetti Olicard modems

Alexei Starovoitov 
net: filter: fix sparc32 typo

Alexei Starovoitov 
net: filter: fix typo in sparc BPF JIT

Sergei Shtylyov 
sh_eth: fix SH7619/771x support

Ben Dooks 
sh_eth: use RNC mode for packet reception

Tom Gundersen 
net: tunnels - enable module autoloading

Sven Wegener 
ipv6: Fix regression caused by efe4208 in udp_v6_mcast_next()

Mimi Zohar 
evm: prohibit userspace writing 'security.evm' HMAC value

Dmitry Kasatkin 
ima: introduce ima_kernel_read()

Mimi Zohar 
ima: audit log files opened with O_DIRECT flag

Nicholas Bellinger 
iscsi-target: Reject mutual authentication with reflected CHAP_C

Nicholas Bellinger 
target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd

Boris

[PATCH 3.15 17/61] ipv4: fix a race in ip4_datagram_release_cb()

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric Dumazet 

[ Upstream commit 9709674e68646cee5a24e3000b3558d25412203a ]

Alexey gave a AddressSanitizer[1] report that finally gave a good hint
at where was the origin of various problems already reported by Dormando
in the past [2]

Problem comes from the fact that UDP can have a lockless TX path, and
concurrent threads can manipulate sk_dst_cache, while another thread,
is holding socket lock and calls __sk_dst_set() in
ip4_datagram_release_cb() (this was added in linux-3.8)

It seems that all we need to do is to use sk_dst_check() and
sk_dst_set() so that all the writers hold same spinlock
(sk->sk_dst_lock) to prevent corruptions.

TCP stack do not need this protection, as all sk_dst_cache writers hold
the socket lock.

[1]
https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel

AddressSanitizer: heap-use-after-free in ipv4_dst_check
Read of size 2 by thread T15453:
 [] ipv4_dst_check+0x1a/0x90 ./net/ipv4/route.c:1116
 [] __sk_dst_check+0x89/0xe0 ./net/core/sock.c:531
 [] ip4_datagram_release_cb+0x46/0x390 ??:0
 [] release_sock+0x17a/0x230 ./net/core/sock.c:2413
 [] ip4_datagram_connect+0x462/0x5d0 ??:0
 [] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534
 [] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701
 [] SyS_connect+0xe/0x10 ./net/socket.c:1682
 [] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629

Freed by thread T15455:
 [] dst_destroy+0xa8/0x160 ./net/core/dst.c:251
 [] dst_release+0x45/0x80 ./net/core/dst.c:280
 [] ip4_datagram_connect+0xa1/0x5d0 ??:0
 [] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534
 [] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701
 [] SyS_connect+0xe/0x10 ./net/socket.c:1682
 [] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629

Allocated by thread T15453:
 [] dst_alloc+0x81/0x2b0 ./net/core/dst.c:171
 [] rt_dst_alloc+0x47/0x50 ./net/ipv4/route.c:1406
 [< inlined>] __ip_route_output_key+0x3e8/0xf70
__mkroute_output ./net/ipv4/route.c:1939
 [] __ip_route_output_key+0x3e8/0xf70 ./net/ipv4/route.c:2161
 [] ip_route_output_flow+0x14/0x30 ./net/ipv4/route.c:2249
 [] ip4_datagram_connect+0x317/0x5d0 ??:0
 [] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534
 [] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701
 [] SyS_connect+0xe/0x10 ./net/socket.c:1682
 [] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629

[2]
<4>[196727.311203] general protection fault:  [#1] SMP
<4>[196727.311224] Modules linked in: xt_TEE xt_dscp xt_DSCP macvlan bridge 
coretemp crc32_pclmul ghash_clmulni_intel gpio_ich microcode ipmi_watchdog 
ipmi_devintf sb_edac edac_core lpc_ich mfd_core tpm_tis tpm tpm_bios ipmi_si 
ipmi_msghandler isci igb libsas i2c_algo_bit ixgbe ptp pps_core mdio
<4>[196727.311333] CPU: 17 PID: 0 Comm: swapper/17 Not tainted 3.10.26 #1
<4>[196727.311344] Hardware name: Supermicro 
X9DRi-LN4+/X9DR3-LN4+/X9DRi-LN4+/X9DR3-LN4+, BIOS 3.0 07/05/2013
<4>[196727.311364] task: 885e6f069700 ti: 885e6f072000 task.ti: 
885e6f072000
<4>[196727.311377] RIP: 0010:[]  [] 
ipv4_dst_destroy+0x4f/0x80
<4>[196727.311399] RSP: 0018:885effd23a70  EFLAGS: 00010282
<4>[196727.311409] RAX: dead00200200 RBX: 8854c398ecc0 RCX: 
0040
<4>[196727.311423] RDX: dead00100100 RSI: dead00100100 RDI: 
dead00200200
<4>[196727.311437] RBP: 885effd23a80 R08: 815fd9e0 R09: 
885d5a590800
<4>[196727.311451] R10:  R11:  R12: 

<4>[196727.311464] R13: 81c8c280 R14:  R15: 
880e85ee16ce
<4>[196727.311510] FS:  () GS:885effd2() 
knlGS:
<4>[196727.311554] CS:  0010 DS:  ES:  CR0: 80050033
<4>[196727.311581] CR2: 7a46751eb000 CR3: 005e65688000 CR4: 
000407e0
<4>[196727.311625] DR0:  DR1:  DR2: 

<4>[196727.311669] DR3:  DR6: 0ff0 DR7: 
0400
<4>[196727.311713] Stack:
<4>[196727.311733]  8854c398ecc0 8854c398ecc0 885effd23ab0 
815b7f42
<4>[196727.311784]  88be6595bc00 8854c398ecc0  
8854c398ecc0
<4>[196727.311834]  885effd23ad0 815b86c6 885d5a590800 
8816827821c0
<4>[196727.311885] Call Trace:
<4>[196727.311907]  
<4>[196727.311912]  [] dst_destroy+0x32/0xe0
<4>[196727.311959]  [] dst_release+0x56/0x80
<4>[196727.311986]  [] tcp_v4_do_rcv+0x2a5/0x4a0
<4>[196727.312013]  [] tcp_v4_rcv+0x7da/0x820
<4>[196727.312041]  [] ? ip_rcv_finish+0x360/0x360
<4>[196727.312070]  [] ? nf_hook_slow+0x7d/0x150
<4>[196727.312097]  [] ? ip_rcv_finish+0x360/0x360
<4>[196727.312125]  [] ip_local_deliver_finish+0xb2/0x230
<4>[196727.312154]  [] ip_local_deliver+0x4a/0x90
<4>[196727.312183]  [] ip_rcv_finish+0x119/0x360
<4>[196727.312212]  [] ip_rcv+0x22b/0x340
<4>[196727.312242]  [] ? macvlan_broadca

[PATCH 3.15 19/61] rtnetlink: fix userspace API breakage for iproute2 < v3.9.0

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Michal Schmidt 

[ Upstream commit e5eca6d41f53db48edd8cf88a3f59d2c30227f8e ]

When running RHEL6 userspace on a current upstream kernel, "ip link"
fails to show VF information.

The reason is a kernel<->userspace API change introduced by commit
88c5b5ce5cb57 ("rtnetlink: Call nlmsg_parse() with correct header length"),
after which the kernel does not see iproute2's IFLA_EXT_MASK attribute
in the netlink request.

iproute2 adjusted for the API change in its commit 63338dca4513
("libnetlink: Use ifinfomsg instead of rtgenmsg in rtnl_wilddump_req_filter").

The problem has been noticed before:
http://marc.info/?l=linux-netdev&m=136692296022182&w=2
(Subject: Re: getting VF link info seems to be broken in 3.9-rc8)

We can do better than tell those with old userspace to upgrade. We can
recognize the old iproute2 in the kernel by checking the netlink message
length. Even when including the IFLA_EXT_MASK attribute, its netlink
message is shorter than struct ifinfomsg.

With this patch "ip link" shows VF information in both old and new
iproute2 versions.

Signed-off-by: Michal Schmidt 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 net/core/rtnetlink.c |   22 ++
 1 file changed, 18 insertions(+), 4 deletions(-)

--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1234,6 +1234,7 @@ static int rtnl_dump_ifinfo(struct sk_bu
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
int err;
+   int hdrlen;
 
s_h = cb->args[0];
s_idx = cb->args[1];
@@ -1241,8 +1242,17 @@ static int rtnl_dump_ifinfo(struct sk_bu
rcu_read_lock();
cb->seq = net->dev_base_seq;
 
-   if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
-   ifla_policy) >= 0) {
+   /* A hack to preserve kernel<->userspace interface.
+* The correct header is ifinfomsg. It is consistent with rtnl_getlink.
+* However, before Linux v3.9 the code here assumed rtgenmsg and that's
+* what iproute2 < v3.9.0 used.
+* We can detect the old iproute2. Even including the IFLA_EXT_MASK
+* attribute, its netlink message is shorter than struct ifinfomsg.
+*/
+   hdrlen = nlmsg_len(cb->nlh) < sizeof(struct ifinfomsg) ?
+sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
+
+   if (nlmsg_parse(cb->nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) {
 
if (tb[IFLA_EXT_MASK])
ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
@@ -2094,9 +2104,13 @@ static u16 rtnl_calcit(struct sk_buff *s
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
u16 min_ifinfo_dump_size = 0;
+   int hdrlen;
+
+   /* Same kernel<->userspace interface hack as in rtnl_dump_ifinfo. */
+   hdrlen = nlmsg_len(nlh) < sizeof(struct ifinfomsg) ?
+sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
 
-   if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
-   ifla_policy) >= 0) {
+   if (nlmsg_parse(nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) {
if (tb[IFLA_EXT_MASK])
ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 24/61] KVM: s390: Drop pending interrupts on guest exit

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Christian Borntraeger 

commit 67335e63c9ef59e97b45a08b4a6a93767762031d upstream.

On hard exits (abort, sigkill) we have have some kvm_s390_interrupt_info
structures hanging around. Delete those on exit to avoid memory leaks.

Signed-off-by: Christian Borntraeger 
Reviewed-by: Thomas Huth 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/s390/kvm/interrupt.c |4 ++--
 arch/s390/kvm/kvm-s390.c  |2 ++
 arch/s390/kvm/kvm-s390.h  |1 +
 3 files changed, 5 insertions(+), 2 deletions(-)

--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -900,7 +900,7 @@ int kvm_s390_inject_vcpu(struct kvm_vcpu
return 0;
 }
 
-static void clear_floating_interrupts(struct kvm *kvm)
+void kvm_s390_clear_float_irqs(struct kvm *kvm)
 {
struct kvm_s390_float_interrupt *fi;
struct kvm_s390_interrupt_info  *n, *inti = NULL;
@@ -1246,7 +1246,7 @@ static int flic_set_attr(struct kvm_devi
break;
case KVM_DEV_FLIC_CLEAR_IRQS:
r = 0;
-   clear_floating_interrupts(dev->kvm);
+   kvm_s390_clear_float_irqs(dev->kvm);
break;
case KVM_DEV_FLIC_APF_ENABLE:
dev->kvm->arch.gmap->pfault_enabled = 1;
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -322,6 +322,7 @@ void kvm_arch_vcpu_destroy(struct kvm_vc
 {
VCPU_EVENT(vcpu, 3, "%s", "free cpu");
trace_kvm_s390_destroy_vcpu(vcpu->vcpu_id);
+   kvm_s390_clear_local_irqs(vcpu);
kvm_clear_async_pf_completion_queue(vcpu);
if (!kvm_is_ucontrol(vcpu->kvm)) {
clear_bit(63 - vcpu->vcpu_id,
@@ -372,6 +373,7 @@ void kvm_arch_destroy_vm(struct kvm *kvm
if (!kvm_is_ucontrol(kvm))
gmap_free(kvm->arch.gmap);
kvm_s390_destroy_adapters(kvm);
+   kvm_s390_clear_float_irqs(kvm);
 }
 
 /* Section: vcpu related */
--- a/arch/s390/kvm/kvm-s390.h
+++ b/arch/s390/kvm/kvm-s390.h
@@ -130,6 +130,7 @@ void kvm_s390_tasklet(unsigned long parm
 void kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu);
 void kvm_s390_deliver_pending_machine_checks(struct kvm_vcpu *vcpu);
 void kvm_s390_clear_local_irqs(struct kvm_vcpu *vcpu);
+void kvm_s390_clear_float_irqs(struct kvm *kvm);
 int __must_check kvm_s390_inject_vm(struct kvm *kvm,
struct kvm_s390_interrupt *s390int);
 int __must_check kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH] sysctl: Add a feature to drop caches selectively

[Maksym Planeta]

To clean the page cache one can use /proc/sys/vm/drop_caches. But this
drops the whole page cache. In contrast to that sdrop_caches enables
ability to drop the page cache selectively by path string.

Suggested-by: Thomas Knauth 
Signed-off-by: Maksym Planeta 
---
 Documentation/sysctl/vm.txt |  15 ++
 fs/Makefile |   2 +-
 fs/sdrop_caches.c   | 124 
 3 files changed, 140 insertions(+), 1 deletion(-)
 create mode 100644 fs/sdrop_caches.c

diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index bd4b34c..faad01d 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -28,6 +28,7 @@ Currently, these files are in /proc/sys/vm:
 - dirty_ratio
 - dirty_writeback_centisecs
 - drop_caches
+- sdrop_caches
 - extfrag_threshold
 - hugepages_treat_as_movable
 - hugetlb_shm_group
@@ -211,6 +212,20 @@ with your system.  To disable them, echo 4 (bit 3) into 
drop_caches.
 
 ==
 
+sdrop_caches
+
+Writing to this will cause the kernel to drop clean caches starting from
+specified path.
+
+To free pagecache of a file:
+   echo /home/user/file > /proc/sys/vm/sdrop_caches
+To free pagecache of a directory and all files in it.
+   echo /home/user/directly > /proc/sys/vm/sdrop_caches
+
+Restrictions are the same as for drop_caches.
+
+==
+
 extfrag_threshold
 
 This parameter affects whether the kernel will compact memory or direct
diff --git a/fs/Makefile b/fs/Makefile
index 4030cbf..366c7b9 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -44,7 +44,7 @@ obj-$(CONFIG_FS_MBCACHE)  += mbcache.o
 obj-$(CONFIG_FS_POSIX_ACL) += posix_acl.o
 obj-$(CONFIG_NFS_COMMON)   += nfs_common/
 obj-$(CONFIG_COREDUMP) += coredump.o
-obj-$(CONFIG_SYSCTL)   += drop_caches.o
+obj-$(CONFIG_SYSCTL)   += drop_caches.o sdrop_caches.o
 
 obj-$(CONFIG_FHANDLE)  += fhandle.o
 
diff --git a/fs/sdrop_caches.c b/fs/sdrop_caches.c
new file mode 100644
index 000..c193655
--- /dev/null
+++ b/fs/sdrop_caches.c
@@ -0,0 +1,124 @@
+/*
+ * Implement the manual selective drop pagecache function
+ */
+
+#include 
+
+
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+
+static void clean_mapping(struct dentry *dentry)
+{
+   struct inode *inode = dentry->d_inode;
+
+   if (!inode)
+   return;
+
+   if ((inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) ||
+   (inode->i_mapping->nrpages == 0)) {
+   return;
+   }
+
+   invalidate_mapping_pages(inode->i_mapping, 0, -1);
+}
+
+static void clean_all_dentries_locked(struct dentry *dentry)
+{
+   struct dentry *child;
+
+   list_for_each_entry(child, &dentry->d_subdirs, d_u.d_child) {
+   clean_all_dentries_locked(child);
+   }
+
+   clean_mapping(dentry);
+}
+
+static void clean_all_dentries(struct dentry *dentry)
+{
+   spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+   clean_all_dentries_locked(dentry);
+   spin_unlock(&dentry->d_lock);
+}
+
+static int drop_pagecache(const char * __user filename)
+{
+   unsigned int lookup_flags = LOOKUP_FOLLOW;
+   struct path path;
+   int error;
+
+retry:
+   error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
+   if (!error) {
+   /* clean */
+   clean_all_dentries(path.dentry);
+   }
+   if (retry_estale(error, lookup_flags)) {
+   lookup_flags |= LOOKUP_REVAL;
+   goto retry;
+   }
+   return error;
+}
+
+static int sdrop_ctl_handler(struct ctl_table *table, int write,
+void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+   char __user *pathname = buffer + *lenp - 1;
+
+   put_user('\0', pathname);
+
+   if (!write)
+   return 0;
+
+   return drop_pagecache(buffer);
+}
+
+static struct ctl_path vm_path[] = { { .procname = "vm", }, { } };
+static struct ctl_table sdrop_ctl_table[] = {
+   {
+   .procname = "sdrop_caches",
+   .mode = 0644,
+   .proc_handler = sdrop_ctl_handler,
+   },
+   { }
+};
+
+static struct ctl_table_header *sdrop_proc_entry;
+
+/* Init function called on module entry */
+int sdrop_init(void)
+{
+   int ret = 0;
+
+   sdrop_proc_entry = register_sysctl_paths(vm_path, sdrop_ctl_table);
+
+   if (sdrop_proc_entry == NULL) {
+   ret = -ENOMEM;
+   pr_err("sdrop_caches: Couldn't create proc entry\n");
+   }
+
+   return ret;
+}
+
+/* Cleanup function called on module exit */
+void sdrop_cleanup(void)
+{
+   unregister_sysctl_table(sdrop_proc_entry);
+}
+
+module_init(sdrop_init);
+module_exit(sdrop_cleanup);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Selec

Re: [PATCH v4] sched: Fast idling of CPU when system is partially loaded

[Tim Chen]

On Mon, 2014-06-23 at 12:16 -0700, Tim Chen wrote:
> Thanks to the review from Jason, Andi and Peter. I've updated
> the code as Peter suggested with simplified logic.
> 
> When a system is lightly loaded (i.e. no more than 1 job per cpu),
> attempt to pull job to a cpu before putting it to idle is unnecessary and
> can be skipped.  This patch adds an indicator so the scheduler can know
> when there's no more than 1 active job is on any CPU in the system to
> skip needless job pulls.
> 
> On a 4 socket machine with a request/response kind of workload from
> clients, we saw about 0.13 msec delay when we go through a full load
> balance to try pull job from all the other cpus.  While 0.1 msec was
> spent on processing the request and generating a response, the 0.13 msec
> load balance overhead was actually more than the actual work being done.
> This overhead can be skipped much of the time for lightly loaded systems.
> 
> With this patch, we tested with a netperf request/response workload that
> has the server busy with half the cpus in a 4 socket system.  We found
> the patch eliminated 75% of the load balance attempts before idling a cpu.
> 
> The overhead of setting/clearing the indicator is low as we already gather
> the necessary info while we call add_nr_running and update_sd_lb_stats.
> We switch to full load balance load immediately if any cpu got more than
> one job on its run queue in add_nr_running.  We'll clear the indicator
> to avoid load balance when we detect no cpu's have more than one job
> when we scan the work queues in update_sg_lb_stats.  We are aggressive
> in turning on the load balance and opportunistic in skipping the load
> balance.
> 
> Signed-off-by: Tim Chen 
> Acked-by: Jason Low 

Peter,

I need to fixup the code of updating the indicator under
the CONFIG_SMP compile flag.  

Also attached a complete updated patch.

Thanks.

Tim

diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 6d25f1d..d051712 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1222,9 +1222,10 @@ static inline void add_nr_running(struct rq *rq, 
unsigned count)
rq->nr_running = prev_nr + count;
 
if (prev_nr < 2 && rq->nr_running >= 2) {
+#ifdef CONFIG_SMP
if (!rq->rd->overload)
rq->rd->overload = true;
-
+#endif
 #ifdef CONFIG_NO_HZ_FULL
if (tick_nohz_full_cpu(rq->cpu)) {
/* Order rq->nr_running write against the IPI */



The complete updated patch is attached below:
---
>From 8716a50c85f98a92d2240da923ef4ae9a9719bbe Mon Sep 17 00:00:00 2001
Message-Id: 
<8716a50c85f98a92d2240da923ef4ae9a9719bbe.1403625949.git.tim.c.c...@linux.intel.com>
From: Tim Chen 
Date: Thu, 12 Jun 2014 11:28:38 -0700
Subject: [PATCH v5] sched: Fast idling of CPU when system is partially loaded
To: Ingo Molnar , Peter Zijlstra 
Cc: Andrew Morton , Davidlohr Bueso 
, Alex Shi , Andi Kleen 
, Michel Lespinasse , Rik van Riel 
, Peter Hurley , Thomas Gleixner 
, Paul E.McKenney , Jason Low 
, linux-kernel@vger.kernel.org

When a system is lightly loaded (i.e. no more than 1 job per cpu),
attempt to pull job to a cpu before putting it to idle is unnecessary and
can be skipped.  This patch adds an indicator so the scheduler can know
when there's no more than 1 active job is on any CPU in the system to
skip needless job pulls.

On a 4 socket machine with a request/response kind of workload from
clients, we saw about 0.13 msec delay when we go through a full load
balance to try pull job from all the other cpus.  While 0.1 msec was
spent on processing the request and generating a response, the 0.13 msec
load balance overhead was actually more than the actual work being done.
This overhead can be skipped much of the time for lightly loaded systems.

With this patch, we tested with a netperf request/response workload that
has the server busy with half the cpus in a 4 socket system.  We found
the patch eliminated 75% of the load balance attempts before idling a cpu.

The overhead of setting/clearing the indicator is low as we already gather
the necessary info while we call add_nr_running and update_sd_lb_stats.
We switch to full load balance load immediately if any cpu got more than
one job on its run queue in add_nr_running.  We'll clear the indicator
to avoid load balance when we detect no cpu's have more than one job
when we scan the work queues in update_sg_lb_stats.  We are aggressive
in turning on the load balance and opportunistic in skipping the load
balance.

Signed-off-by: Tim Chen 
Acked-by: Jason Low 
Acked-by: Rik van Riel 
---
 kernel/sched/fair.c  | 21 ++---
 kernel/sched/sched.h | 11 +--
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index fea7d33..7dfe2ad 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5867,7 +5867,8 @@ static inline int sg_capacity_factor(struct lb_env *env, 
struct sched_group *gro
  */
 sta

[PATCH 3.14 67/68] ALSA: control: Handle numid overflow

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen 

commit ac902c112d90a89e59916f751c2745f4dbdbb4bd upstream.

Each control gets automatically assigned its numids when the control is created.
The allocation is done by incrementing the numid by the amount of allocated
numids per allocation. This means that excessive creation and destruction of
controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to
eventually overflow. Currently when this happens for the control that caused the
overflow kctl->id.numid + kctl->count will also over flow causing it to be
smaller than kctl->id.numid. Most of the code assumes that this is something
that can not happen, so we need to make sure that it won't happen

Signed-off-by: Lars-Peter Clausen 
Acked-by: Jaroslav Kysela 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/core/control.c |4 
 1 file changed, 4 insertions(+)

--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -289,6 +289,10 @@ static bool snd_ctl_remove_numid_conflic
 {
struct snd_kcontrol *kctl;
 
+   /* Make sure that the ids assigned to the control do not wrap around */
+   if (card->last_numid >= UINT_MAX - count)
+   card->last_numid = 0;
+
list_for_each_entry(kctl, &card->controls, list) {
if (kctl->id.numid < card->last_numid + 1 + count &&
kctl->id.numid + kctl->count > card->last_numid + 1) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 30/61] USB: cdc-acm: fix shutdown and suspend race

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit ed797074031a37bb9bf4a70952fffc606b77274d upstream.

We should stop I/O unconditionally at suspend rather than rely on the
tty-port initialised flag (which is set prior to stopping I/O during
shutdown) in order to prevent suspend returning with URBs still active.

Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/class/cdc-acm.c |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1550,8 +1550,7 @@ static int acm_suspend(struct usb_interf
if (cnt)
return 0;
 
-   if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags))
-   stop_data_traffic(acm);
+   stop_data_traffic(acm);
 
return 0;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [RFT 0/3] cxgb4: use request_firmware_nowait()

[Casey Leedom]

On 06/23/14 17:29, Luis R. Rodriguez wrote:

On Mon, Jun 23, 2014 at 12:06:48PM -0700, Casey Leedom wrote:

   I've looked through the patch and I might be wrong, but it appears that
all the uses of the asynchronous request_firmware_nowait() are followed
immediately by wait_for_completion() calls which essentially would be the
same as the previous code with an added layer of mechanism.  Am I missing
something?

No you're right and I frailed to mention my original goal really is to
see if we can instead move that to ndo_init().


  Okay, thanks for confirming that.  I thought I was being very stupid.

  The problem I think with ndo_init() is that comes off a Network 
Device (struct net_device) and you can't have Network Devices till you 
talk to the adpater, discover how many ports you have, what their MAC 
Addresses are, etc.  And of course you'd then have to be prepared for an 
ndo_init() call on every instantiated Network Device on an adapter and 
only do the device initialization for the first (while holding off any 
and all activity on the others), etc.  All doable but a bit more 
complicated than doing this at Device Probe time.



   We do have a problem with initialization of multiple adapters with
external PHYs since, for each adapter we can check to see if the main
adapter firmware needs updating, and then load the PHY firmware.  If the
main firmware needs updating on more than one adapter, the combined time to
update each adapter's main firmware plus load the PHY firmware can exceed
some Distribution's default limits for a driver module's load time (since
the kernel seems to be processing the PCI Probe of each device
sequentially).

I noticed that for configuration updates it is optional for these configuration
updates to exist, in which case then if udev is enabled the driver will wait
quite a long time unncessarily. To fix that it seems request_firmware_direct()
would be better.


  Hhmmm, I'm unfamiliar with all of this.  I hadn't looked that far 
under the covers of request_firmware() to know that any of these 
variants existed, what their semantics were and when one over the other 
was the preferred API.



   It seems to me that it's unfortunate that the limit isn't on a per device
basis since a system could have an arbitrary number of devices managed by a
driver module.

The timeout is for the amount of time it takes the kernel to get the firemware,
not for device initialization, so its unclear to me that the 60 timeout thing
is actually causing an issue here.


  Are you sure about that?  I just loaded firmware on two of my 
T4-based adapters and each took about 15 seconds to complete.  The 
firmware is ~0.5MB and needs to be written to the on-adapter FLASH. The 
PHY firmware takes a bit less but not a lot.  Add that to the time to do 
general adapter initialization and you're cruising close to 1 minute for 
two adapters ...  Thus, my comment that whatever timeout is present 
should really be per-adapter based ... and it would be nice if the 
driver could inform the kernel as to the expected maximum device probe 
initialization time so we didn't have to have a huge inappropriate 
timeout for all devices ...



Also, it might be useful if there was a way for the driver
module to "tell" the timeout mechanism that forward progress _is_ being
made so it doesn't blow away the driver module load.

Indeed if this is actually needed, but believe the issue here for the
huge delays might be instead the lack of not using request_firmware_direct()
and actual device initialization time, which I do not believe we penalize,
we should be penalizing only the amount of time it takes either the
kernel or udev to read the firmware from the filesystem.


  If you want I can time the actual phases of loading new firmware: 
request_firmware(), writing it to FLASH, release_firmware() ...



  And maybe, if I'm
right regarding the sequential nature of the introduction of devices to
driver modules, it might make sense for a driver module to be able to
"tell" the kernel that it has no per-device dependencies and multiple
devices may be probed simultaneously ...

What if just configuration updates use request_firmware_direct() and
for the actual firmware which is required a request_firmware_nowait()
with a proper wait_for_completion() on the ndo_init() ?


  I'm not quite sure I understand what you're asking here.  The cxgb4 
driver attaches to the firmware in the probe() stage and, if the 
firmware is older then the supported version, upgrades the firmware and 
RESETs the device.  Then, for adapters with external PHYs (10Gb/s BT 
predominantly), the same process can happen for the PHY firmware (or on 
some adapters which have no PHY-attached FLASH, this happens for every 
driver load).  It's conceivable that we could defer the PHY firmware 
load till the first ndo_open() but we'd still be stuck with the 
seemingly broken idea that a simple timeout for a driver module load is 
good enough when what we seem to need

[PATCH 3.15 01/61] rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Boris BREZILLON 

commit 2fe121e1f5aa3bf31b418a9790db6c400e922291 upstream.

The rtc user must wait at least 1 sec between each time/calandar update
(see atmel's datasheet chapter "Updating Time/Calendar").

Use the 1Hz interrupt to update the at91_rtc_upd_rdy flag and wait for
the at91_rtc_wait_upd_rdy event if the rtc is not ready.

This patch fixes a deadlock in an uninterruptible wait when the RTC is
updated more than once every second.  AFAICT the bug is here from the
beginning, but I think we should at least backport this fix to 3.10 and
the following longterm and stable releases.

Signed-off-by: Boris BREZILLON 
Reported-by: Bryan Evenson 
Tested-by: Bryan Evenson 
Cc: Andrew Victor 
Cc: Nicolas Ferre 
Cc: Jean-Christophe Plagniol-Villard 
Cc: Alessandro Zummo 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/rtc/rtc-at91rm9200.c |   16 ++--
 1 file changed, 14 insertions(+), 2 deletions(-)

--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -48,6 +48,7 @@ struct at91_rtc_config {
 
 static const struct at91_rtc_config *at91_rtc_config;
 static DECLARE_COMPLETION(at91_rtc_updated);
+static DECLARE_COMPLETION(at91_rtc_upd_rdy);
 static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
 static void __iomem *at91_rtc_regs;
 static int irq;
@@ -161,6 +162,8 @@ static int at91_rtc_settime(struct devic
1900 + tm->tm_year, tm->tm_mon, tm->tm_mday,
tm->tm_hour, tm->tm_min, tm->tm_sec);
 
+   wait_for_completion(&at91_rtc_upd_rdy);
+
/* Stop Time/Calendar from counting */
cr = at91_rtc_read(AT91_RTC_CR);
at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
@@ -183,7 +186,9 @@ static int at91_rtc_settime(struct devic
 
/* Restart Time/Calendar */
cr = at91_rtc_read(AT91_RTC_CR);
+   at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_SECEV);
at91_rtc_write(AT91_RTC_CR, cr & ~(AT91_RTC_UPDCAL | AT91_RTC_UPDTIM));
+   at91_rtc_write_ier(AT91_RTC_SECEV);
 
return 0;
 }
@@ -290,8 +295,10 @@ static irqreturn_t at91_rtc_interrupt(in
if (rtsr) { /* this interrupt is shared!  Is it ours? */
if (rtsr & AT91_RTC_ALARM)
events |= (RTC_AF | RTC_IRQF);
-   if (rtsr & AT91_RTC_SECEV)
-   events |= (RTC_UF | RTC_IRQF);
+   if (rtsr & AT91_RTC_SECEV) {
+   complete(&at91_rtc_upd_rdy);
+   at91_rtc_write_idr(AT91_RTC_SECEV);
+   }
if (rtsr & AT91_RTC_ACKUPD)
complete(&at91_rtc_updated);
 
@@ -413,6 +420,11 @@ static int __init at91_rtc_probe(struct
return PTR_ERR(rtc);
platform_set_drvdata(pdev, rtc);
 
+   /* enable SECEV interrupt in order to initialize at91_rtc_upd_rdy
+* completion.
+*/
+   at91_rtc_write_ier(AT91_RTC_SECEV);
+
dev_info(&pdev->dev, "AT91 Real Time Clock driver.\n");
return 0;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 58/68] lzo: properly check for overruns

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Greg Kroah-Hartman 

commit 206a81c18401c0cde6e579164f752c4b147324ce upstream.

The lzo decompressor can, if given some really crazy data, possibly
overrun some variable types.  Modify the checking logic to properly
detect overruns before they happen.

Reported-by: "Don A. Bailey" 
Tested-by: "Don A. Bailey" 
Signed-off-by: Greg Kroah-Hartman 

---
 lib/lzo/lzo1x_decompress_safe.c |   62 ++--
 1 file changed, 41 insertions(+), 21 deletions(-)

--- a/lib/lzo/lzo1x_decompress_safe.c
+++ b/lib/lzo/lzo1x_decompress_safe.c
@@ -19,11 +19,31 @@
 #include 
 #include "lzodefs.h"
 
-#define HAVE_IP(x)  ((size_t)(ip_end - ip) >= (size_t)(x))
-#define HAVE_OP(x)  ((size_t)(op_end - op) >= (size_t)(x))
-#define NEED_IP(x)  if (!HAVE_IP(x)) goto input_overrun
-#define NEED_OP(x)  if (!HAVE_OP(x)) goto output_overrun
-#define TEST_LB(m_pos)  if ((m_pos) < out) goto lookbehind_overrun
+#define HAVE_IP(t, x)  \
+   (((size_t)(ip_end - ip) >= (size_t)(t + x)) &&  \
+(((t + x) >= t) && ((t + x) >= x)))
+
+#define HAVE_OP(t, x)  \
+   (((size_t)(op_end - op) >= (size_t)(t + x)) &&  \
+(((t + x) >= t) && ((t + x) >= x)))
+
+#define NEED_IP(t, x)  \
+   do {\
+   if (!HAVE_IP(t, x)) \
+   goto input_overrun; \
+   } while (0)
+
+#define NEED_OP(t, x)  \
+   do {\
+   if (!HAVE_OP(t, x)) \
+   goto output_overrun;\
+   } while (0)
+
+#define TEST_LB(m_pos) \
+   do {\
+   if ((m_pos) < out)  \
+   goto lookbehind_overrun;\
+   } while (0)
 
 int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
  unsigned char *out, size_t *out_len)
@@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned
while (unlikely(*ip == 0)) {
t += 255;
ip++;
-   NEED_IP(1);
+   NEED_IP(1, 0);
}
t += 15 + *ip++;
}
t += 3;
 copy_literal_run:
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-   if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) 
{
+   if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
const unsigned char *ie = ip + t;
unsigned char *oe = op + t;
do {
@@ -81,8 +101,8 @@ copy_literal_run:
} else
 #endif
{
-   NEED_OP(t);
-   NEED_IP(t + 3);
+   NEED_OP(t, 0);
+   NEED_IP(t, 3);
do {
*op++ = *ip++;
} while (--t > 0);
@@ -95,7 +115,7 @@ copy_literal_run:
m_pos -= t >> 2;
m_pos -= *ip++ << 2;
TEST_LB(m_pos);
-   NEED_OP(2);
+   NEED_OP(2, 0);
op[0] = m_pos[0];
op[1] = m_pos[1];
op += 2;
@@ -119,10 +139,10 @@ copy_literal_run:
while (unlikely(*ip == 0)) {
t += 255;
ip++;
-   NEED_IP(1);
+   NEED_IP(1, 0);
}
t += 31 + *ip++;
-   NEED_IP(2);
+   NEED_IP(2, 0);
}
m_pos = op - 1;
next = get_unaligned_le16(ip);
@@ -137,10 +157,10 @@ copy_literal_run:
while (unlikely(*ip == 0)) {
t += 255;
ip++;
-   NEED_IP(1);
+

[PATCH 3.14 49/68] ASoC: dapm: Make sure to always update the DAPM graph in _put_volsw()

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen 

commit c9e065c27fe9b81e5d6e7681d77a24f7b9616675 upstream.

When using auto-muted controls it may happen that the register value will not
change when changing a control from enabled to disabled (since the control might
be physically disabled due to the auto-muting). We have to make sure to still
update the DAPM graph and disconnect the mixer input.

Fixes: commit 5729507 ("ASoC: dapm: Implement mixer input auto-disable")
Signed-off-by: Lars-Peter Clausen 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/soc-dapm.c |   23 ++-
 1 file changed, 10 insertions(+), 13 deletions(-)

--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2888,22 +2888,19 @@ int snd_soc_dapm_put_volsw(struct snd_kc
mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
 
change = dapm_kcontrol_set_value(kcontrol, val);
-
-   if (reg != SND_SOC_NOPM) {
-   mask = mask << shift;
-   val = val << shift;
-
-   change = snd_soc_test_bits(codec, reg, mask, val);
-   }
-
if (change) {
if (reg != SND_SOC_NOPM) {
-   update.kcontrol = kcontrol;
-   update.reg = reg;
-   update.mask = mask;
-   update.val = val;
+   mask = mask << shift;
+   val = val << shift;
+
+   if (snd_soc_test_bits(codec, reg, mask, val)) {
+   update.kcontrol = kcontrol;
+   update.reg = reg;
+   update.mask = mask;
+   update.val = val;
+   card->update = &update;
+   }
 
-   card->update = &update;
}
 
ret = soc_dapm_mixer_update_power(card, kcontrol, connect);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 51/68] ASoC: tlv320aci3x: Fix custom snd_soc_dapm_put_volsw_aic3x() function

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Peter Ujfalusi 

commit e6c111fac4464e3f4bf7b3802b517dafc80f8e0f upstream.

For some unknown reason the parameters for snd_soc_test_bits() were in wrong
order:
It was:
snd_soc_test_bits(codec, val, mask, reg); /* WRONG!!! */
while it should be:
snd_soc_test_bits(codec, reg, mask, val);

Signed-off-by: Peter Ujfalusi 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/codecs/tlv320aic3x.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -169,7 +169,7 @@ static int snd_soc_dapm_put_volsw_aic3x(
mask <<= shift;
val <<= shift;
 
-   change = snd_soc_test_bits(codec, val, mask, reg);
+   change = snd_soc_test_bits(codec, reg, mask, val);
if (change) {
update.kcontrol = kcontrol;
update.reg = reg;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 52/68] iio:adc:max1363 incorrect resolutions for max11604, max11605, max11610 and max11611.

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Jonathan Cameron 

commit a91a73c8b39a6b8bcc53fafa5372c65387c81233 upstream.

Reported-by: Erik Habbinga 
Signed-off-by: Jonathan Cameron 
Acked-by: Hartmut Knaack 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/iio/adc/max1363.c |   16 
 1 file changed, 8 insertions(+), 8 deletions(-)

--- a/drivers/iio/adc/max1363.c
+++ b/drivers/iio/adc/max1363.c
@@ -1258,8 +1258,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1038_channels,
+   .num_channels = ARRAY_SIZE(max1038_channels),
},
[max11605] = {
.bits = 8,
@@ -1268,8 +1268,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1038_channels,
+   .num_channels = ARRAY_SIZE(max1038_channels),
},
[max11606] = {
.bits = 10,
@@ -1318,8 +1318,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1138_channels,
+   .num_channels = ARRAY_SIZE(max1138_channels),
},
[max11611] = {
.bits = 10,
@@ -1328,8 +1328,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1138_channels,
+   .num_channels = ARRAY_SIZE(max1138_channels),
},
[max11612] = {
.bits = 12,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 62/68] ALSA: hda/realtek - Add more entry for enable HP mute led

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Kailang Yang 

commit 8a02b164d4bfac108bfe37e98108bff1e062bd3d upstream.

More HP machine need mute led support.

Signed-off-by: Kailang Yang 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/pci/hda/patch_realtek.c |   14 ++
 1 file changed, 14 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4427,14 +4427,24 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x103c, 0x1983, "HP Pavilion", 
ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x218b, "HP", 
ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
/* ALC282 */
+   SND_PCI_QUIRK(0x103c, 0x220d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x220e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x220f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2211, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2212, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2213, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2266, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2267, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2268, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2269, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x226c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x226d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x226e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x226f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x227a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x227b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
@@ -4474,6 +4484,10 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x103c, 0x22c8, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x22c3, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x22c4, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2334, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED),
SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", 
ALC269_FIXUP_LIMIT_INT_MIC_BOOST),


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 61/68] ALSA: hda/realtek - Add support of ALC891 codec

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Kailang Yang 

commit b6c5fbad16aa5026f508093a8d651c25e1cb6179 upstream.

New codec support for ALC891.

Signed-off-by: Kailang Yang 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/pci/hda/patch_realtek.c |1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5536,6 +5536,7 @@ static const struct hda_codec_preset snd
{ .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
{ .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 },
{ .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
+   { .id = 0x10ec0867, .name = "ALC891", .patch = patch_alc882 },
{ .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
{ .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
{ .id = 0x10ec0883, .name = "ALC883", .patch = patch_alc882 },


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 53/68] staging: iio: tsl2x7x_core: fix proximity treshold

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Mario Schuknecht 

commit c404618cd06dad771495fe1cf9d5a63b5664f65f upstream.

Consider high byte of proximity min and max treshold in function
'tsl2x7x_chip_on'. So far, the high byte was not set.

Signed-off-by: Mario Schuknecht 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/staging/iio/light/tsl2x7x_core.c |8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/staging/iio/light/tsl2x7x_core.c
+++ b/drivers/staging/iio/light/tsl2x7x_core.c
@@ -667,9 +667,13 @@ static int tsl2x7x_chip_on(struct iio_de
chip->tsl2x7x_config[TSL2X7X_PRX_COUNT] =
chip->tsl2x7x_settings.prox_pulse_count;
chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHLO] =
-   chip->tsl2x7x_settings.prox_thres_low;
+   (chip->tsl2x7x_settings.prox_thres_low) & 0xFF;
+   chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHHI] =
+   (chip->tsl2x7x_settings.prox_thres_low >> 8) & 0xFF;
chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHLO] =
-   chip->tsl2x7x_settings.prox_thres_high;
+   (chip->tsl2x7x_settings.prox_thres_high) & 0xFF;
+   chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHHI] =
+   (chip->tsl2x7x_settings.prox_thres_high >> 8) & 0xFF;
 
/* and make sure we're not already on */
if (chip->tsl2x7x_chip_status == TSL2X7X_CHIP_WORKING) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 59/68] lz4: ensure length does not wrap

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Greg Kroah-Hartman 

commit 206204a1162b995e2185275167b22468c00d6b36 upstream.

Given some pathologically compressed data, lz4 could possibly decide to
wrap a few internal variables, causing unknown things to happen.  Catch
this before the wrapping happens and abort the decompression.

Reported-by: "Don A. Bailey" 
Signed-off-by: Greg Kroah-Hartman 

---
 lib/lz4/lz4_decompress.c |2 ++
 1 file changed, 2 insertions(+)

--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -72,6 +72,8 @@ static int lz4_uncompress(const char *so
len = *ip++;
for (; len == 255; length += 255)
len = *ip++;
+   if (unlikely(length > (size_t)(length + len)))
+   goto _output_error;
length += len;
}
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 50/68] ASoC: max98090: Fix reset at resume time

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Liam Girdwood 

commit 25b4ab430f8e166c9b63f4db28e7e812d5a59396 upstream.

Reset needs to wait 20ms before other codec IO is performed. This wait
was not being performed. Fix this by making sure the reset register is not
restored with the cache, but use the manual reset method in resume with
the wait.

Signed-off-by: Liam Girdwood 
Signed-off-by: Jarkko Nikula 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/codecs/max98090.c |3 +++
 1 file changed, 3 insertions(+)

--- a/sound/soc/codecs/max98090.c
+++ b/sound/soc/codecs/max98090.c
@@ -255,6 +255,7 @@ static struct reg_default max98090_reg[]
 static bool max98090_volatile_register(struct device *dev, unsigned int reg)
 {
switch (reg) {
+   case M98090_REG_SOFTWARE_RESET:
case M98090_REG_DEVICE_STATUS:
case M98090_REG_JACK_STATUS:
case M98090_REG_REVISION_ID:
@@ -2360,6 +2361,8 @@ static int max98090_runtime_resume(struc
 
regcache_cache_only(max98090->regmap, false);
 
+   max98090_reset(max98090);
+
regcache_sync(max98090->regmap);
 
return 0;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 65/68] ALSA: control: Fix replacing user controls

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen 

commit 82262a46627bebb0febcc26664746c25cef08563 upstream.

There are two issues with the current implementation for replacing user
controls. The first is that the code does not check if the control is actually a
user control and neither does it check if the control is owned by the process
that tries to remove it. That allows userspace applications to remove arbitrary
controls, which can cause a user after free if a for example a driver does not
expect a control to be removed from under its feed.

The second issue is that on one hand when a control is replaced the
user_ctl_count limit is not checked and on the other hand the user_ctl_count is
increased (even though the number of user controls does not change). This allows
userspace, once the user_ctl_count limit as been reached, to repeatedly replace
a control until user_ctl_count overflows. Once that happens new controls can be
added effectively bypassing the user_ctl_count limit.

Both issues can be fixed by instead of open-coding the removal of the control
that is to be replaced to use snd_ctl_remove_user_ctl(). This function does
proper permission checks as well as decrements user_ctl_count after the control
has been removed.

Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at
beginning of the function if the control already exists is removed. This is not
a problem though since the check is quite useless, because the lock that is
protecting the control list is released between the check and before adding the
new control to the list, which means that it is possible that a different
control with the same settings is added to the list after the check. Luckily
there is another check that is done while holding the lock in snd_ctl_add(), so
we'll rely on that to make sure that the same control is not added twice.

Signed-off-by: Lars-Peter Clausen 
Acked-by: Jaroslav Kysela 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/core/control.c |   25 +
 1 file changed, 9 insertions(+), 16 deletions(-)

--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1155,8 +1155,6 @@ static int snd_ctl_elem_add(struct snd_c
struct user_element *ue;
int idx, err;
 
-   if (!replace && card->user_ctl_count >= MAX_USER_CONTROLS)
-   return -ENOMEM;
if (info->count < 1)
return -EINVAL;
access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
@@ -1165,21 +1163,16 @@ static int snd_ctl_elem_add(struct snd_c
 SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE));
info->id.numid = 0;
memset(&kctl, 0, sizeof(kctl));
-   down_write(&card->controls_rwsem);
-   _kctl = snd_ctl_find_id(card, &info->id);
-   err = 0;
-   if (_kctl) {
-   if (replace)
-   err = snd_ctl_remove(card, _kctl);
-   else
-   err = -EBUSY;
-   } else {
-   if (replace)
-   err = -ENOENT;
+
+   if (replace) {
+   err = snd_ctl_remove_user_ctl(file, &info->id);
+   if (err)
+   return err;
}
-   up_write(&card->controls_rwsem);
-   if (err < 0)
-   return err;
+
+   if (card->user_ctl_count >= MAX_USER_CONTROLS)
+   return -ENOMEM;
+
memcpy(&kctl.id, &info->id, sizeof(info->id));
kctl.count = info->owner ? info->owner : 1;
access |= SNDRV_CTL_ELEM_ACCESS_USER;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 66/68] ALSA: control: Dont access controls outside of protected regions

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen 

commit fd9f26e4eca5d08a27d12c0933fceef76ed9663d upstream.

A control that is visible on the card->controls list can be freed at any time.
This means we must not access any of its memory while not holding the
controls_rw_lock. Otherwise we risk a use after free access.

Signed-off-by: Lars-Peter Clausen 
Acked-by: Jaroslav Kysela 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/core/control.c |   15 ++-
 1 file changed, 10 insertions(+), 5 deletions(-)

--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -331,6 +331,7 @@ int snd_ctl_add(struct snd_card *card, s
 {
struct snd_ctl_elem_id id;
unsigned int idx;
+   unsigned int count;
int err = -EINVAL;
 
if (! kcontrol)
@@ -359,8 +360,9 @@ int snd_ctl_add(struct snd_card *card, s
card->controls_count += kcontrol->count;
kcontrol->id.numid = card->last_numid + 1;
card->last_numid += kcontrol->count;
+   count = kcontrol->count;
up_write(&card->controls_rwsem);
-   for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
+   for (idx = 0; idx < count; idx++, id.index++, id.numid++)
snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
return 0;
 
@@ -389,6 +391,7 @@ int snd_ctl_replace(struct snd_card *car
bool add_on_replace)
 {
struct snd_ctl_elem_id id;
+   unsigned int count;
unsigned int idx;
struct snd_kcontrol *old;
int ret;
@@ -424,8 +427,9 @@ add:
card->controls_count += kcontrol->count;
kcontrol->id.numid = card->last_numid + 1;
card->last_numid += kcontrol->count;
+   count = kcontrol->count;
up_write(&card->controls_rwsem);
-   for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
+   for (idx = 0; idx < count; idx++, id.index++, id.numid++)
snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
return 0;
 
@@ -898,9 +902,9 @@ static int snd_ctl_elem_write(struct snd
result = kctl->put(kctl, control);
}
if (result > 0) {
+   struct snd_ctl_elem_id id = control->id;
up_read(&card->controls_rwsem);
-   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-  &control->id);
+   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id);
return 0;
}
}
@@ -1334,8 +1338,9 @@ static int snd_ctl_tlv_ioctl(struct snd_
}
err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv);
if (err > 0) {
+   struct snd_ctl_elem_id id = kctl->id;
up_read(&card->controls_rwsem);
-   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, 
&kctl->id);
+   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &id);
return 0;
}
} else {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 60/68] ALSA: compress: Cancel the optimization of compiler and fix the size of struct for all platform.

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: "Wang, Xiaoming" 

commit 2bd0ae464a6cf7363bbf72c8545e0aa43caa57f0 upstream.

Cancel the optimization of compiler for struct snd_compr_avail
which size will be 0x1c in 32bit kernel while 0x20 in 64bit
kernel under the optimizer. That will make compaction between
32bit and 64bit. So add packed to fix the size of struct
snd_compr_avail to 0x1c for all platform.

Signed-off-by: Zhang Dongxing 
Signed-off-by: xiaoming wang 
Acked-by: Vinod Koul 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 include/uapi/sound/compress_offload.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/uapi/sound/compress_offload.h
+++ b/include/uapi/sound/compress_offload.h
@@ -80,7 +80,7 @@ struct snd_compr_tstamp {
 struct snd_compr_avail {
__u64 avail;
struct snd_compr_tstamp tstamp;
-};
+} __attribute__((packed));
 
 enum snd_compr_direction {
SND_COMPRESS_PLAYBACK = 0,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH tip/core/rcu] Reduce overhead of cond_resched() checks for RCU

[Dave Hansen]

On 06/23/2014 05:39 PM, Paul E. McKenney wrote:
> On Mon, Jun 23, 2014 at 05:20:30PM -0700, Dave Hansen wrote:
>> On 06/23/2014 05:15 PM, Paul E. McKenney wrote:
>>> Just out of curiosity, how many CPUs does your system have?  80?
>>> If 160, looks like something bad is happening at 80.
>>
>> 80 cores, 160 threads.  >80 processes/threads is where we start using
>> the second thread on the cores.  The tasks are also pinned to
>> hyperthread pairs, so they disturb each other, and the scheduler moves
>> them between threads on occasion which causes extra noise.
> 
> OK, that could explain the near flattening of throughput near 80
> processes.  Is 3.16.0-rc1-pf2 with the two RCU patches?

It's actually with _just_ e552592e03 applied on top of 3.16-rc1.

> If so, is the new sysfs parameter at its default value?

I didn't record that, and I've forgotten.  I'll re-run it to verify what
it was.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 68/68] ALSA: control: Make sure that id->index does not overflow

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen 

commit 883a1d49f0d77d30012f114b2e19fc141beb3e8e upstream.

The ALSA control code expects that the range of assigned indices to a control is
continuous and does not overflow. Currently there are no checks to enforce this.
If a control with a overflowing index range is created that control becomes
effectively inaccessible and unremovable since snd_ctl_find_id() will not be
able to find it. This patch adds a check that makes sure that controls with a
overflowing index range can not be created.

Signed-off-by: Lars-Peter Clausen 
Acked-by: Jaroslav Kysela 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/core/control.c |3 +++
 1 file changed, 3 insertions(+)

--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -343,6 +343,9 @@ int snd_ctl_add(struct snd_card *card, s
if (snd_BUG_ON(!card || !kcontrol->info))
goto error;
id = kcontrol->id;
+   if (id.index > UINT_MAX - kcontrol->count)
+   goto error;
+
down_write(&card->controls_rwsem);
if (snd_ctl_find_id(card, &id)) {
up_write(&card->controls_rwsem);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 44/68] USB: cdc-acm: fix potential urb leak and PM imbalance in write

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 183a45087d126d126e8dd1d9b2602fc129dff9ad upstream.

Make sure to check return value of autopm get in write() in order to
avoid urb leak and PM counter imbalance on errors.

Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/class/cdc-acm.c |8 +++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -666,7 +666,13 @@ static int acm_tty_write(struct tty_stru
memcpy(wb->buf, buf, count);
wb->len = count;
 
-   usb_autopm_get_interface_async(acm->control);
+   stat = usb_autopm_get_interface_async(acm->control);
+   if (stat) {
+   wb->use = 0;
+   spin_unlock_irqrestore(&acm->write_lock, flags);
+   return stat;
+   }
+
if (acm->susp_count) {
usb_anchor_urb(wb->urb, &acm->delayed);
spin_unlock_irqrestore(&acm->write_lock, flags);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH] Allow increasing the buffer-head per-CPU LRU size

[Sebastien Buisson]

Influence of buffer-head per-CPU LRU size on metadata performance has 
been studied with mdtest, on one ext4 formatted ramdisk device, 
creating, stating and removing 100 files in the same directory. 
Several test cases were evaluated, varying the 'size' of the directory 
in which files are created:

- target directory is empty
- target directory already contains 10 files
- target directory already contains 50 files
- target directory already contains 200 files
- target directory already contains 500 files
- target directory already contains 1000 files

To compare the effect of the patch, the same series of tests was run with:
- a vanilla kernel
- a patched kernel with BH_LRU_SIZE set to 16

The tests launched were:
(a) mdtest on ramdisk device, single shared dir, with large ACL and SELinux
(b) mdtest on ramdisk device, single shared dir, with large ACL but NO 
SELinux


Below are the results showing performance gain (in percentage) when 
increasing BH_LRU_SIZE to 16 (vanilla default value is 8):

(a)
files   tasks   dir sizeCreation   Stat Removal
100 1   0   -8,7   -2,7 -0,5
100 1   10  -5,2   -0,5 -1,1
100 1   50  -5,1   -3,7 -1,5
100 1   200 -5,1   -4,0 -8,5
100 1   500 -4,2   -5,3 -10,2
100 1   1000-3,5   -8,0 -10,9
100 8   0   -0,3   -3,8 -1,2
100 8   10  -1,2   -3,7 -1,5
100 8   50   0,5   -3,2 -5,3
100 8   200 -1,7   -6,1 -8,7
100 8   500 -5,9   -7,7 -11,9
100 8   1000-4,1   -8,8 -13,6

(b)
files   tasks   dir sizeCreation   Stat Removal
100 1   00,0   -0,9 -1,1
100 1   10   1,0   -3,0 -3,5
100 1   50   3,7   -3,0 -2,4
100 1   200  1,13,6 -0,2
100 1   500  3,50,1  5,9
100 1   1000 9,03,8  6,4
100 8   02,4   -1,2 -4,3
100 8   10  -0,2   -1,8 -2,4
100 8   50   1,1   -0,3  2,0
100 8   200 -0,3   -2,8 -3,3
100 8   500  0,3   -3,1 -1,3
100 8   1000 1,50,0  0,7


To sum up briefly, it is very difficult to show performance improvement 
with mdtest. The only positive case is on Create without SELinux when 
using 1 thread. Strangely the more threads we have, the poorer is the 
gain in performance.



Furthermore, metadata tests were run on Lustre with a specific benchmark 
called mds-survey. They used a ramdisk device, creating, stating and 
removing 100 files.


The tests launched were:
(c) mds-survey on ramdisk device, quota enabled, shared directory
(d) mds-survey on ramdisk device, quota enabled, directory per process

Below are the results showing performance gain (in percentage) when 
increasing BH_LRU_SIZE to 16 (vanilla default value is 8):

(c)
files   dir threads create  lookup  destroy
100 1   111,31,2 7,2
100 1   2 6,42,3 6,9
100 1   4 1,93,0 1,3
100 1   8-0,64,3 0,7
100 1   160,54,4 0,6

(d)
files   dir threads create  lookup  destroy
100 4   4 3,2   28,5 5,3
100 8   8 1,2   33,9 2,0
100 16  160,67,9-0,2


Compared to pure ext4 tests, we can see more improvements thanks to 
mds-survey. In shared directory case, gain is between 0 and 10% for 
create, between 1 and 4% for lookup, and between 0 and 7% for destroy, 
depending on the number of threads.


All this test plan has been elaborated in collaboration with Intel, and 
results have been already shared with them.




[PATCH] Allow increasing the buffer-head per-CPU LRU size

Allow increasing the buffer-head per-CPU LRU size to allow efficient
filesystem operations that access many blocks for each transaction.
For example, creating a file in a large ext4 directory with quota
enabled will accesses multiple buffer heads and will overflow the LRU
at the default 8-block LRU size:

* parent directory inode table block (ctime, nlinks for subdirs)
* new inode bitmap

[PATCH 3.14 40/68] USB: cdc-acm: fix write and resume race

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit e144ed28bed10684f9aaec6325ed974d53f76110 upstream.

Fix race between write() and resume() due to improper locking that could
lead to writes being reordered.

Resume must be done atomically and susp_count be protected by the
write_lock in order to prevent racing with write(). This could otherwise
lead to writes being reordered if write() grabs the write_lock after
susp_count is decremented, but before the delayed urb is submitted.

Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/class/cdc-acm.c |   23 +--
 1 file changed, 9 insertions(+), 14 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1539,27 +1539,20 @@ static int acm_resume(struct usb_interfa
struct acm *acm = usb_get_intfdata(intf);
struct acm_wb *wb;
int rv = 0;
-   int cnt;
 
spin_lock_irq(&acm->read_lock);
-   acm->susp_count -= 1;
-   cnt = acm->susp_count;
-   spin_unlock_irq(&acm->read_lock);
+   spin_lock(&acm->write_lock);
 
-   if (cnt)
-   return 0;
+   if (--acm->susp_count)
+   goto out;
 
if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) {
-   rv = usb_submit_urb(acm->ctrlurb, GFP_NOIO);
+   rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC);
 
-   spin_lock_irq(&acm->write_lock);
if (acm->delayed_wb) {
wb = acm->delayed_wb;
acm->delayed_wb = NULL;
-   spin_unlock_irq(&acm->write_lock);
acm_start_wb(acm, wb);
-   } else {
-   spin_unlock_irq(&acm->write_lock);
}
 
/*
@@ -1567,12 +1560,14 @@ static int acm_resume(struct usb_interfa
 * do the write path at all cost
 */
if (rv < 0)
-   goto err_out;
+   goto out;
 
-   rv = acm_submit_read_urbs(acm, GFP_NOIO);
+   rv = acm_submit_read_urbs(acm, GFP_ATOMIC);
}
+out:
+   spin_unlock(&acm->write_lock);
+   spin_unlock_irq(&acm->read_lock);
 
-err_out:
return rv;
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 45/68] USB: cdc-acm: fix I/O after failed open

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit e4c36076c2a6195ec62c35b03c3fde84d0087dc8 upstream.

Make sure to kill any already submitted read urbs on read-urb submission
failures in open in order to prevent doing I/O for a closed port.

Fixes: 088c64f81284 ("USB: cdc-acm: re-write read processing")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/class/cdc-acm.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -506,6 +506,7 @@ static int acm_port_activate(struct tty_
 {
struct acm *acm = container_of(port, struct acm, port);
int retval = -ENODEV;
+   int i;
 
dev_dbg(&acm->control->dev, "%s\n", __func__);
 
@@ -554,6 +555,8 @@ static int acm_port_activate(struct tty_
return 0;
 
 error_submit_read_urbs:
+   for (i = 0; i < acm->rx_buflimit; i++)
+   usb_kill_urb(acm->read_urbs[i]);
acm->ctrlout = 0;
acm_set_control(acm, acm->ctrlout);
 error_set_control:


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 37/68] ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Boris BREZILLON 

commit 9dcc87fec8947308e0111c65dcd881e6aa5b1673 upstream.

sam9x5 SoCs have the following errata:
 "RTC: Interrupt Mask Register cannot be used
  Interrupt Mask Register read always returns 0."

Hence we should not rely on what IMR claims about already masked IRQs
and just disable all IRQs.

Signed-off-by: Boris BREZILLON 
Reported-by: Bryan Evenson 
Reviewed-by: Johan Hovold 
Acked-by: Nicolas Ferre 
Cc: Bryan Evenson 
Cc: Andrew Victor 
Cc: Jean-Christophe Plagniol-Villard 
Cc: Alessandro Zummo 
Cc: Mark Roszko 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm/mach-at91/sysirq_mask.c |   22 +-
 1 file changed, 13 insertions(+), 9 deletions(-)

--- a/arch/arm/mach-at91/sysirq_mask.c
+++ b/arch/arm/mach-at91/sysirq_mask.c
@@ -25,24 +25,28 @@
 
 #include "generic.h"
 
-#define AT91_RTC_IDR   0x24/* Interrupt Disable Register */
-#define AT91_RTC_IMR   0x28/* Interrupt Mask Register */
+#define AT91_RTC_IDR   0x24/* Interrupt Disable Register */
+#define AT91_RTC_IMR   0x28/* Interrupt Mask Register */
+#define AT91_RTC_IRQ_MASK  0x1f/* Available IRQs mask */
 
 void __init at91_sysirq_mask_rtc(u32 rtc_base)
 {
void __iomem *base;
-   u32 mask;
 
base = ioremap(rtc_base, 64);
if (!base)
return;
 
-   mask = readl_relaxed(base + AT91_RTC_IMR);
-   if (mask) {
-   pr_info("AT91: Disabling rtc irq\n");
-   writel_relaxed(mask, base + AT91_RTC_IDR);
-   (void)readl_relaxed(base + AT91_RTC_IMR);   /* flush */
-   }
+   /*
+* sam9x5 SoCs have the following errata:
+* "RTC: Interrupt Mask Register cannot be used
+*  Interrupt Mask Register read always returns 0."
+*
+* Hence we're not relying on IMR values to disable
+* interrupts.
+*/
+   writel_relaxed(AT91_RTC_IRQ_MASK, base + AT91_RTC_IDR);
+   (void)readl_relaxed(base + AT91_RTC_IMR);   /* flush */
 
iounmap(base);
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 32/68] vxlan: use dev->needed_headroom instead of dev->hard_header_len

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Cong Wang 

[ Upstream commit 2853af6a2ea1a8ed09b09dd4fb578e7f435e8d34 ]

When we mirror packets from a vxlan tunnel to other device,
the mirror device should see the same packets (that is, without
outer header). Because vxlan tunnel sets dev->hard_header_len,
tcf_mirred() resets mac header back to outer mac, the mirror device
actually sees packets with outer headers

Vxlan tunnel should set dev->needed_headroom instead of
dev->hard_header_len, like what other ip tunnels do. This fixes
the above problem.

Cc: "David S. Miller" 
Cc: stephen hemminger 
Cc: Pravin B Shelar 
Signed-off-by: Cong Wang 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/vxlan.c |7 +++
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2282,9 +2282,9 @@ static void vxlan_setup(struct net_devic
eth_hw_addr_random(dev);
ether_setup(dev);
if (vxlan->default_dst.remote_ip.sa.sa_family == AF_INET6)
-   dev->hard_header_len = ETH_HLEN + VXLAN6_HEADROOM;
+   dev->needed_headroom = ETH_HLEN + VXLAN6_HEADROOM;
else
-   dev->hard_header_len = ETH_HLEN + VXLAN_HEADROOM;
+   dev->needed_headroom = ETH_HLEN + VXLAN_HEADROOM;
 
dev->netdev_ops = &vxlan_netdev_ops;
dev->destructor = free_netdev;
@@ -2667,8 +2667,7 @@ static int vxlan_newlink(struct net *net
if (!tb[IFLA_MTU])
dev->mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM 
: VXLAN_HEADROOM);
 
-   /* update header length based on lower device */
-   dev->hard_header_len = lowerdev->hard_header_len +
+   dev->needed_headroom = lowerdev->hard_header_len +
   (use_ipv6 ? VXLAN6_HEADROOM : 
VXLAN_HEADROOM);
} else if (use_ipv6)
vxlan->flags |= VXLAN_F_IPV6;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 56/68] iio: Fix endianness issue in ak8975_read_axis()

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Peter Meerwald 

commit 8ba42fb7b17649c9ab5b5e79d4e90370a0b4645e upstream.

i2c_smbus_read_word_data() does host endian conversion already,
no need for le16_to_cpu()

Signed-off-by: Peter Meerwald 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/iio/magnetometer/ak8975.c |9 +
 1 file changed, 1 insertion(+), 8 deletions(-)

--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -352,8 +352,6 @@ static int ak8975_read_axis(struct iio_d
 {
struct ak8975_data *data = iio_priv(indio_dev);
struct i2c_client *client = data->client;
-   u16 meas_reg;
-   s16 raw;
int ret;
 
mutex_lock(&data->lock);
@@ -401,16 +399,11 @@ static int ak8975_read_axis(struct iio_d
dev_err(&client->dev, "Read axis data fails\n");
goto exit;
}
-   meas_reg = ret;
 
mutex_unlock(&data->lock);
 
-   /* Endian conversion of the measured values. */
-   raw = (s16) (le16_to_cpu(meas_reg));
-
/* Clamp to valid range. */
-   raw = clamp_t(s16, raw, -4096, 4095);
-   *val = raw;
+   *val = clamp_t(s16, ret, -4096, 4095);
return IIO_VAL_INT;
 
 exit:


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 39/68] USB: cdc-acm: fix write and suspend race

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 5a345c20c17d87099224a4be12e69e5bd7023dca upstream.

Fix race between write() and suspend() which could lead to writes being
dropped (or I/O while suspended) if the device is runtime suspended
while a write request is being processed.

Specifically, suspend() releases the write_lock after determining the
device is idle but before incrementing the susp_count, thus leaving a
window where a concurrent write() can submit an urb.

Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/class/cdc-acm.c |   15 ++-
 1 file changed, 6 insertions(+), 9 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1512,18 +1512,15 @@ static int acm_suspend(struct usb_interf
struct acm *acm = usb_get_intfdata(intf);
int cnt;
 
+   spin_lock_irq(&acm->read_lock);
+   spin_lock(&acm->write_lock);
if (PMSG_IS_AUTO(message)) {
-   int b;
-
-   spin_lock_irq(&acm->write_lock);
-   b = acm->transmitting;
-   spin_unlock_irq(&acm->write_lock);
-   if (b)
+   if (acm->transmitting) {
+   spin_unlock(&acm->write_lock);
+   spin_unlock_irq(&acm->read_lock);
return -EBUSY;
+   }
}
-
-   spin_lock_irq(&acm->read_lock);
-   spin_lock(&acm->write_lock);
cnt = acm->susp_count++;
spin_unlock(&acm->write_lock);
spin_unlock_irq(&acm->read_lock);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 54/68] iio: mxs-lradc: fix divider

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Robert Hodaszi 

commit 19bc4981a213d0c5b0e1e8b08815c0b26f01ec54 upstream.

All channels' single measurement are happening on CH 0. So enabling / disabling
the divider once is not enough, because it has impact on all channels.

Set only a flag, then check this on each measurement, and enable / disable the
divider as required.

Signed-off-by: Robert Hodaszi 
Acked-by: Alexandre Belloni 
Acked-by: Marek Vasut 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/staging/iio/adc/mxs-lradc.c |   12 
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -846,6 +846,14 @@ static int mxs_lradc_read_single(struct
LRADC_CTRL1);
mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
 
+   /* Enable / disable the divider per requirement */
+   if (test_bit(chan, &lradc->is_divided))
+   mxs_lradc_reg_set(lradc, 1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
+   LRADC_CTRL2);
+   else
+   mxs_lradc_reg_clear(lradc,
+   1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, LRADC_CTRL2);
+
/* Clean the slot's previous content, then set new one. */
mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(0), 
LRADC_CTRL4);
mxs_lradc_reg_set(lradc, chan, LRADC_CTRL4);
@@ -964,15 +972,11 @@ static int mxs_lradc_write_raw(struct ii
if (val == scale_avail[MXS_LRADC_DIV_DISABLED].integer &&
val2 == scale_avail[MXS_LRADC_DIV_DISABLED].nano) {
/* divider by two disabled */
-   writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
-  lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_CLR);
clear_bit(chan->channel, &lradc->is_divided);
ret = 0;
} else if (val == scale_avail[MXS_LRADC_DIV_ENABLED].integer &&
   val2 == scale_avail[MXS_LRADC_DIV_ENABLED].nano) {
/* divider by two enabled */
-   writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
-  lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_SET);
set_bit(chan->channel, &lradc->is_divided);
ret = 0;
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 41/68] USB: cdc-acm: fix broken runtime suspend

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 140cb81ac8c625942a1d695875932c615767a526 upstream.

The current ACM runtime-suspend implementation is broken in several
ways:

Firstly, it buffers only the first write request being made while
suspended -- any further writes are silently dropped.

Secondly, writes being dropped also leak write urbs, which are never
reclaimed (until the device is unbound).

Thirdly, even the single buffered write is not cleared at shutdown
(which may happen before the device is resumed), something which can
lead to another urb leak as well as a PM usage-counter leak.

Fix this by implementing a delayed-write queue using urb anchors and
making sure to discard the queue properly at shutdown.

Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")

Reported-by: Xiao Jin 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/class/cdc-acm.c |   32 ++--
 drivers/usb/class/cdc-acm.h |2 +-
 2 files changed, 23 insertions(+), 11 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -571,6 +571,8 @@ static void acm_port_destruct(struct tty
 static void acm_port_shutdown(struct tty_port *port)
 {
struct acm *acm = container_of(port, struct acm, port);
+   struct urb *urb;
+   struct acm_wb *wb;
int i;
 
dev_dbg(&acm->control->dev, "%s\n", __func__);
@@ -579,6 +581,16 @@ static void acm_port_shutdown(struct tty
if (!acm->disconnected) {
usb_autopm_get_interface(acm->control);
acm_set_control(acm, acm->ctrlout = 0);
+
+   for (;;) {
+   urb = usb_get_from_anchor(&acm->delayed);
+   if (!urb)
+   break;
+   wb = urb->context;
+   wb->use = 0;
+   usb_autopm_put_interface_async(acm->control);
+   }
+
usb_kill_urb(acm->ctrlurb);
for (i = 0; i < ACM_NW; i++)
usb_kill_urb(acm->wb[i].urb);
@@ -646,12 +658,9 @@ static int acm_tty_write(struct tty_stru
 
usb_autopm_get_interface_async(acm->control);
if (acm->susp_count) {
-   if (!acm->delayed_wb)
-   acm->delayed_wb = wb;
-   else
-   usb_autopm_put_interface_async(acm->control);
+   usb_anchor_urb(wb->urb, &acm->delayed);
spin_unlock_irqrestore(&acm->write_lock, flags);
-   return count;   /* A white lie */
+   return count;
}
usb_mark_last_busy(acm->dev);
 
@@ -1267,6 +1276,7 @@ made_compressed_probe:
acm->bInterval = epread->bInterval;
tty_port_init(&acm->port);
acm->port.ops = &acm_port_ops;
+   init_usb_anchor(&acm->delayed);
 
buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
if (!buf) {
@@ -1537,7 +1547,7 @@ static int acm_suspend(struct usb_interf
 static int acm_resume(struct usb_interface *intf)
 {
struct acm *acm = usb_get_intfdata(intf);
-   struct acm_wb *wb;
+   struct urb *urb;
int rv = 0;
 
spin_lock_irq(&acm->read_lock);
@@ -1549,10 +1559,12 @@ static int acm_resume(struct usb_interfa
if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) {
rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC);
 
-   if (acm->delayed_wb) {
-   wb = acm->delayed_wb;
-   acm->delayed_wb = NULL;
-   acm_start_wb(acm, wb);
+   for (;;) {
+   urb = usb_get_from_anchor(&acm->delayed);
+   if (!urb)
+   break;
+
+   acm_start_wb(acm, urb->context);
}
 
/*
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -120,7 +120,7 @@ struct acm {
unsigned int throttled:1;   /* actually throttled */
unsigned int throttle_req:1;/* throttle requested */
u8 bInterval;
-   struct acm_wb *delayed_wb;  /* write queued for a 
device about to be woken */
+   struct usb_anchor delayed;  /* writes queued for a 
device about to be woken */
 };
 
 #define CDC_DATA_INTERFACE_TYPE0x0a


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 36/68] KVM: lapic: sync highest ISR to hardware apic on EOI

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Paolo Bonzini 

commit fc57ac2c9ca8109ea97fcc594f4be436944230cc upstream.

When Hyper-V enlightenments are in effect, Windows prefers to issue an
Hyper-V MSR write to issue an EOI rather than an x2apic MSR write.
The Hyper-V MSR write is not handled by the processor, and besides
being slower, this also causes bugs with APIC virtualization.  The
reason is that on EOI the processor will modify the highest in-service
interrupt (SVI) field of the VMCS, as explained in section 29.1.4 of
the SDM; every other step in EOI virtualization is already done by
apic_send_eoi or on VM entry, but this one is missing.

We need to do the same, and be careful not to muck with the isr_count
and highest_isr_cache fields that are unused when virtual interrupt
delivery is enabled.

Reviewed-by: Yang Zhang 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/x86/kvm/lapic.c |   62 +++
 1 file changed, 43 insertions(+), 19 deletions(-)

--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -360,6 +360,8 @@ static inline void apic_clear_irr(int ve
 
 static inline void apic_set_isr(int vec, struct kvm_lapic *apic)
 {
+   /* Note that we never get here with APIC virtualization enabled.  */
+
if (!__apic_test_and_set_vector(vec, apic->regs + APIC_ISR))
++apic->isr_count;
BUG_ON(apic->isr_count > MAX_APIC_VECTOR);
@@ -371,12 +373,48 @@ static inline void apic_set_isr(int vec,
apic->highest_isr_cache = vec;
 }
 
+static inline int apic_find_highest_isr(struct kvm_lapic *apic)
+{
+   int result;
+
+   /*
+* Note that isr_count is always 1, and highest_isr_cache
+* is always -1, with APIC virtualization enabled.
+*/
+   if (!apic->isr_count)
+   return -1;
+   if (likely(apic->highest_isr_cache != -1))
+   return apic->highest_isr_cache;
+
+   result = find_highest_vector(apic->regs + APIC_ISR);
+   ASSERT(result == -1 || result >= 16);
+
+   return result;
+}
+
 static inline void apic_clear_isr(int vec, struct kvm_lapic *apic)
 {
-   if (__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR))
+   struct kvm_vcpu *vcpu;
+   if (!__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR))
+   return;
+
+   vcpu = apic->vcpu;
+
+   /*
+* We do get here for APIC virtualization enabled if the guest
+* uses the Hyper-V APIC enlightenment.  In this case we may need
+* to trigger a new interrupt delivery by writing the SVI field;
+* on the other hand isr_count and highest_isr_cache are unused
+* and must be left alone.
+*/
+   if (unlikely(kvm_apic_vid_enabled(vcpu->kvm)))
+   kvm_x86_ops->hwapic_isr_update(vcpu->kvm,
+  apic_find_highest_isr(apic));
+   else {
--apic->isr_count;
-   BUG_ON(apic->isr_count < 0);
-   apic->highest_isr_cache = -1;
+   BUG_ON(apic->isr_count < 0);
+   apic->highest_isr_cache = -1;
+   }
 }
 
 int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu)
@@ -456,22 +494,6 @@ static void pv_eoi_clr_pending(struct kv
__clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention);
 }
 
-static inline int apic_find_highest_isr(struct kvm_lapic *apic)
-{
-   int result;
-
-   /* Note that isr_count is always 1 with vid enabled */
-   if (!apic->isr_count)
-   return -1;
-   if (likely(apic->highest_isr_cache != -1))
-   return apic->highest_isr_cache;
-
-   result = find_highest_vector(apic->regs + APIC_ISR);
-   ASSERT(result == -1 || result >= 16);
-
-   return result;
-}
-
 void kvm_apic_update_tmr(struct kvm_vcpu *vcpu, u32 *tmr)
 {
struct kvm_lapic *apic = vcpu->arch.apic;
@@ -1605,6 +1627,8 @@ int kvm_get_apic_interrupt(struct kvm_vc
int vector = kvm_apic_has_interrupt(vcpu);
struct kvm_lapic *apic = vcpu->arch.apic;
 
+   /* Note that we never get here with APIC virtualization enabled.  */
+
if (vector == -1)
return -1;
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 35/68] net/mlx4_core: Keep only one driver entry release mlx4_priv

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Wei Yang 

[ Upstream commit da1de8dfff09d33d4a5345762c21b487028e25f5 ]

Following commit befdf89 "net/mlx4_core: Preserve pci_dev_data after
__mlx4_remove_one()", there are two mlx4 pci callbacks which will
attempt to release the mlx4_priv object -- .shutdown and .remove.

This leads to a use-after-free access to the already freed mlx4_priv
instance and trigger a "Kernel access of bad area" crash when both
.shutdown and .remove are called.

During reboot or kexec, .shutdown is called, with the VFs probed to
the host going through shutdown first and then the PF. Later, the PF
will trigger VFs' .remove since VFs still have driver attached.

Fix that by keeping only one driver entry which releases mlx4_priv.

Fixes: befdf89 ('net/mlx4_core: Preserve pci_dev_data after 
__mlx4_remove_one()')
CC: Bjorn Helgaas 
Signed-off-by: Or Gerlitz 
Signed-off-by: Jack Morgenstein 
Signed-off-by: Wei Yang 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/mellanox/mlx4/main.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2718,7 +2718,7 @@ static struct pci_driver mlx4_driver = {
.name   = DRV_NAME,
.id_table   = mlx4_pci_table,
.probe  = mlx4_init_one,
-   .shutdown   = mlx4_remove_one,
+   .shutdown   = __mlx4_remove_one,
.remove = mlx4_remove_one,
.err_handler= &mlx4_err_handler,
 };


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 47/68] Drivers: hv: balloon: Ensure pressure reports are posted regularly

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: "K. Y. Srinivasan" 

commit ae339336dc950b9b05e7ccd3565dd3e8781c06d9 upstream.

The current code posts periodic memory pressure status from a dedicated thread.
Under some conditions, especially when we are releasing a lot of memory into
the guest, we may not send timely pressure reports back to the host. Fix this
issue by reporting pressure in all contexts that can be active in this driver.

Signed-off-by: K. Y. Srinivasan 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/hv/hv_balloon.c |   29 ++---
 1 file changed, 26 insertions(+), 3 deletions(-)

--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -19,6 +19,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -459,6 +460,11 @@ static bool do_hot_add;
  */
 static uint pressure_report_delay = 45;
 
+/*
+ * The last time we posted a pressure report to host.
+ */
+static unsigned long last_post_time;
+
 module_param(hot_add, bool, (S_IRUGO | S_IWUSR));
 MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add");
 
@@ -542,6 +548,7 @@ struct hv_dynmem_device {
 
 static struct hv_dynmem_device dm_device;
 
+static void post_status(struct hv_dynmem_device *dm);
 #ifdef CONFIG_MEMORY_HOTPLUG
 
 static void hv_bring_pgs_online(unsigned long start_pfn, unsigned long size)
@@ -612,7 +619,7 @@ static void hv_mem_hot_add(unsigned long
 * have not been "onlined" within the allowed time.
 */
wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ);
-
+   post_status(&dm_device);
}
 
return;
@@ -951,11 +958,17 @@ static void post_status(struct hv_dynmem
 {
struct dm_status status;
struct sysinfo val;
+   unsigned long now = jiffies;
+   unsigned long last_post = last_post_time;
 
if (pressure_report_delay > 0) {
--pressure_report_delay;
return;
}
+
+   if (!time_after(now, (last_post_time + HZ)))
+   return;
+
si_meminfo(&val);
memset(&status, 0, sizeof(struct dm_status));
status.hdr.type = DM_STATUS_REPORT;
@@ -983,6 +996,14 @@ static void post_status(struct hv_dynmem
if (status.hdr.trans_id != atomic_read(&trans_id))
return;
 
+   /*
+* If the last post time that we sampled has changed,
+* we have raced, don't post the status.
+*/
+   if (last_post != last_post_time)
+   return;
+
+   last_post_time = jiffies;
vmbus_sendpacket(dm->dev->channel, &status,
sizeof(struct dm_status),
(unsigned long)NULL,
@@ -1117,7 +1138,7 @@ static void balloon_up(struct work_struc
 
if (ret == -EAGAIN)
msleep(20);
-
+   post_status(&dm_device);
} while (ret == -EAGAIN);
 
if (ret) {
@@ -1144,8 +1165,10 @@ static void balloon_down(struct hv_dynme
struct dm_unballoon_response resp;
int i;
 
-   for (i = 0; i < range_count; i++)
+   for (i = 0; i < range_count; i++) {
free_balloon_pages(dm, &range_array[i]);
+   post_status(&dm_device);
+   }
 
if (req->more_pages == 1)
return;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 38/68] MIPS: KVM: Allocate at least 16KB for exception handlers

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: James Hogan 

commit 7006e2dfda9adfa40251093604db76d7e44263b3 upstream.

Each MIPS KVM guest has its own copy of the KVM exception vector. This
contains the TLB refill exception handler at offset 0x000, the general
exception handler at offset 0x180, and interrupt exception handlers at
offset 0x200 in case Cause_IV=1. A common handler is copied to offset
0x2000 and offset 0x3000 is used for temporarily storing k1 during entry
from guest.

However the amount of memory allocated for this purpose is calculated as
0x200 rounded up to the next page boundary, which is insufficient if 4KB
pages are in use. This can lead to the common handler at offset 0x2000
being overwritten and infinitely recursive exceptions on the next exit
from the guest.

Increase the minimum size from 0x200 to 0x4000 to cover the full use of
the page.

Signed-off-by: James Hogan 
Cc: Paolo Bonzini 
Cc: Gleb Natapov 
Cc: k...@vger.kernel.org
Cc: Ralf Baechle 
Cc: linux-m...@linux-mips.org
Cc: Sanjay Lal 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/mips/kvm/kvm_mips.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/mips/kvm/kvm_mips.c
+++ b/arch/mips/kvm/kvm_mips.c
@@ -304,7 +304,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st
if (cpu_has_veic || cpu_has_vint) {
size = 0x200 + VECTORSPACING * 64;
} else {
-   size = 0x200;
+   size = 0x4000;
}
 
/* Save Linux EBASE */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: Re: [PATCH v2 0/8] Add Keystone PCIe controller driver

[Murali Karicheri]

Mohit,

On 06/23/2014 12:49 PM, Santosh Shilimkar wrote:




 Original Message 
Subject: Re: [PATCH v2 0/8] Add Keystone PCIe controller driver
Date: Mon, 23 Jun 2014 10:43:46 +0530
From: Pratyush Anand
To: Murali Karicheri

On Sat, Jun 21, 2014 at 05:17:07AM +0800, Murali Karicheri wrote:


Sorry, my previous response was in html and not sure it has made to the
list. I did
get an error as well. So resending my response.

On 6/18/2014 6:14 AM, Mohit KUMAR DCG wrote:

Hello Murali,





[...]


*pos = pos0;

@@ -349,7 +353,10 @@ static int dw_msi_setup_irq(struct msi_chip *chip,
struct pci_dev *pdev,

*/

desc->msi_attrib.multiple = msgvec;

-msg.address_lo = virt_to_phys((void *)pp->msi_data);

+if (pp->ops->get_msi_data)

+msg.address_lo = pp->ops->get_msi_data(pp);

+else

+msg.address_lo = virt_to_phys((void *)pp->msi_data);

msg.address_hi = 0x0;

msg.data = pos;


What about this code? This requires get_msi_data() as well


pp->msi_data is set in dw_pcie_msi_init, which is a global function
called from vendor specific code. You can have your own
keystone_pcie_msi_init and then you do not need above changes.


My Apologies for the email format as I lost the original email and had
to respond using a forwarded email.

If you look at my original patch, keystone driver was not calling
dw_pcie_msi_init(). However the issue is msi_chip of DW core is
re-used as most of the code is platform independent. However
code that sends write_msi_msg() can be re-used on keystone by
adding this get_msi_data() API as the only difference IMO is the
address EP writes to raise an MSI IRQ event. I don't see any
reason why the entire code needs to be duplicated on Keystone.
BTW, currently I have not tested the MSI IRQ and tested my driver
only with Legacy IRQ. I plan to test this before sending my
v3 of the patch.

Murali




-- 3rd to use pp->ops->msi_set/clear if defined.

Why not API enhancement and refactor the code in a single patch?


Yes, can be. You can send changes in 2 or 3 patches as you wish, but I
believe that should be able to solve problem in best way.

Regards
Pratyush


Murali

Pls let us know for any issue or have different opinion.

Regards
Mohit





--
1.7.9.5







--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 33/68] udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric Dumazet 

[ Upstream commit 63c6f81cdde58c41da62a8d8a209592e42a0203e ]

Its too easy to add thousand of UDP sockets on a particular bucket,
and slow down an innocent multicast receiver.

Early demux is supposed to be an optimization, we should avoid spending
too much time in it.

It is interesting to note __udp4_lib_demux_lookup() only tries to
match first socket in the chain.

10 is the threshold we already have in __udp4_lib_lookup() to switch
to secondary hash.

Fixes: 421b3885bf6d5 ("udp: ipv4: Add udp early demux")
Signed-off-by: Eric Dumazet 
Reported-by: David Held 
Cc: Shawn Bohrer 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv4/udp.c |4 
 1 file changed, 4 insertions(+)

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1833,6 +1833,10 @@ static struct sock *__udp4_lib_mcast_dem
unsigned int count, slot = udp_hashfn(net, hnum, udp_table.mask);
struct udp_hslot *hslot = &udp_table.hash[slot];
 
+   /* Do not bother scanning a too big list */
+   if (hslot->count > 10)
+   return NULL;
+
rcu_read_lock();
 begin:
count = 0;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH v6 4/4] ARM: Add KGDB/KDB FIQ debugger generic code

[Nicolas Pitre]

On Tue, 24 Jun 2014, Daniel Thompson wrote:

> From: Anton Vorontsov 
> 
> The FIQ debugger may be used to debug situations when the kernel stuck
> in uninterruptable sections, e.g. the kernel infinitely loops or
> deadlocked in an interrupt or with interrupts disabled.
> 
> By default KGDB FIQ is disabled in runtime, but can be enabled with
> kgdb_fiq.enable=1 kernel command line option.
> 
> Signed-off-by: Anton Vorontsov 
> Signed-off-by: John Stultz 
> Signed-off-by: Daniel Thompson 
> Cc: Russell King 
> Cc: Ben Dooks 
> Cc: Dave Martin 
> ---
>  arch/arm/Kconfig |   2 +
>  arch/arm/Kconfig.debug   |  18 ++
>  arch/arm/include/asm/kgdb.h  |   7 +++
>  arch/arm/kernel/Makefile |   1 +
>  arch/arm/kernel/kgdb_fiq.c   | 124 
> +++
>  arch/arm/kernel/kgdb_fiq_entry.S |  87 +++
>  6 files changed, 239 insertions(+)
>  create mode 100644 arch/arm/kernel/kgdb_fiq.c
>  create mode 100644 arch/arm/kernel/kgdb_fiq_entry.S

[...]

> +static long kgdb_fiq_setup_stack(void *info)
> +{
> + struct pt_regs regs;
> +
> + regs.ARM_sp = __get_free_pages(GFP_KERNEL, THREAD_SIZE_ORDER) +
> + THREAD_START_SP;
> + WARN_ON(!regs.ARM_sp);

Isn't this rather fatal if you can't allocate any stack? Why not using 
BUG_ON(), or better yet propagate a proper error code back?

> +
> + set_fiq_regs(®s);
> + return 0;
> +}
> +
> +/**
> + * kgdb_fiq_enable_nmi - Manage NMI-triggered entry to KGDB
> + * @on: Flag to either enable or disable an NMI
> + *
> + * This function manages NMIs that usually cause KGDB to enter. That is, not
> + * all NMIs should be enabled or disabled, but only those that issue
> + * kgdb_handle_exception().
> + *
> + * The call counts disable requests, and thus allows to nest disables. But
> + * trying to enable already enabled NMI is an error.
> + */
> +static void kgdb_fiq_enable_nmi(bool on)
> +{
> + static atomic_t cnt;
> + int ret;
> +
> + ret = atomic_add_return(on ? 1 : -1, &cnt);
> + if (ret > 1 && on) {
> + /*
> +  * There should be only one instance that calls this function
> +  * in "enable, disable" order. All other users must call
> +  * disable first, then enable. If not, something is wrong.
> +  */
> + WARN_ON(1);
> + return;
> + }

Minor style suggestion:

/*
 * There should be only one instance that calls this function
 * in "enable, disable" order. All other users must call
 * disable first, then enable. If not, something is wrong.
 */
if (WARN_ON(ret > 1 && on))
return;

Other than that...

Acked-by: Nicolas Pitre 


Nicolas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 26/68] net: force a list_del() in unregister_netdevice_many()

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric Dumazet 

[ Upstream commit 87757a917b0b3c0787e0563c679762152be81312 ]

unregister_netdevice_many() API is error prone and we had too
many bugs because of dangling LIST_HEAD on stacks.

See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD")

In fact, instead of making sure no caller leaves an active list_head,
just force a list_del() in the callee. No one seems to need to access
the list after unregister_netdevice_many()

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/macvlan.c |1 -
 net/core/dev.c|5 -
 net/core/rtnetlink.c  |1 -
 net/mac80211/iface.c  |1 -
 4 files changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1043,7 +1043,6 @@ static int macvlan_device_event(struct n
list_for_each_entry_safe(vlan, next, &port->vlans, list)
vlan->dev->rtnl_link_ops->dellink(vlan->dev, 
&list_kill);
unregister_netdevice_many(&list_kill);
-   list_del(&list_kill);
break;
case NETDEV_PRE_TYPE_CHANGE:
/* Forbid underlaying device to change its type. */
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6548,6 +6548,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue
 /**
  * unregister_netdevice_many - unregister many devices
  * @head: list of devices
+ *
+ *  Note: As most callers use a stack allocated list_head,
+ *  we force a list_del() to make sure stack wont be corrupted later.
  */
 void unregister_netdevice_many(struct list_head *head)
 {
@@ -6557,6 +6560,7 @@ void unregister_netdevice_many(struct li
rollback_registered_many(head);
list_for_each_entry(dev, head, unreg_list)
net_set_todo(dev);
+   list_del(head);
}
 }
 EXPORT_SYMBOL(unregister_netdevice_many);
@@ -7012,7 +7016,6 @@ static void __net_exit default_device_ex
}
}
unregister_netdevice_many(&dev_kill_list);
-   list_del(&dev_kill_list);
rtnl_unlock();
 }
 
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1735,7 +1735,6 @@ static int rtnl_dellink(struct sk_buff *
 
ops->dellink(dev, &list_kill);
unregister_netdevice_many(&list_kill);
-   list_del(&list_kill);
return 0;
 }
 
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1761,7 +1761,6 @@ void ieee80211_remove_interfaces(struct
}
mutex_unlock(&local->iflist_mtx);
unregister_netdevice_many(&unreg_list);
-   list_del(&unreg_list);
 
list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
list_del(&sdata->list);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] vfio: Fix endianness handling for emulated BARs

[Alexey Kardashevskiy]

On 06/25/2014 12:43 AM, Alex Williamson wrote:
> On Wed, 2014-06-25 at 00:33 +1000, Alexey Kardashevskiy wrote:
>> On 06/25/2014 12:21 AM, Alex Williamson wrote:
>>> On Tue, 2014-06-24 at 15:22 +0200, Alexander Graf wrote:
 On 24.06.14 15:01, Alexey Kardashevskiy wrote:
> On 06/24/2014 10:52 PM, Alexander Graf wrote:
>> On 24.06.14 14:50, Alexey Kardashevskiy wrote:
>>> On 06/24/2014 08:41 PM, Alexander Graf wrote:
 On 24.06.14 12:11, Alexey Kardashevskiy wrote:
> On 06/21/2014 09:12 AM, Benjamin Herrenschmidt wrote:
>> On Thu, 2014-06-19 at 21:21 -0600, Alex Williamson wrote:
>>
>>> Working on big endian being an accident may be a matter of 
>>> perspective
>> :-)
>>
>>> The comment remains that this patch doesn't actually fix anything 
>>> except
>>> the overhead on big endian systems doing redundant byte swapping and
>>> maybe the philosophy that vfio regions are little endian.
>> Yes, that works by accident because technically VFIO is a transport 
>> and
>> thus shouldn't perform any endian swapping of any sort, which remains
>> the responsibility of the end driver which is the only one to know
>> whether a given BAR location is a a register or some streaming data
>> and in the former case whether it's LE or BE (some PCI devices are BE
>> even ! :-)
>>
>> But yes, in the end, it works with the dual "cancelling" swaps and 
>> the
>> overhead of those swaps is probably drowned in the noise of the 
>> syscall
>> overhead.
>>
>>> I'm still not a fan of iowrite vs iowritebe, there must be 
>>> something we
>>> can use that doesn't have an implicit swap.
>> Sadly there isn't ... In the old day we didn't even have the "be"
>> variant and readl/writel style accessors still don't have them either
>> for all archs.
>>
>> There is __raw_readl/writel but here the semantics are much more than
>> just "don't swap", they also don't have memory barriers (which means
>> they are essentially useless to most drivers unless those are 
>> platform
>> specific drivers which know exactly what they are doing, or in the 
>> rare
>> cases such as accessing a framebuffer which we know never have side
>> effects).
>>
>>> Calling it iowrite*_native is also an abuse of the namespace.
>>> Next thing we know some common code
>>> will legitimately use that name.
>> I might make sense to those definitions into a common header. There 
>> have
>> been a handful of cases in the past that wanted that sort of "native
>> byte order" MMIOs iirc (though don't ask me for examples, I can't 
>> really
>> remember).
>>
>>> If we do need to define an alias
>>> (which I'd like to avoid) it should be something like 
>>> vfio_iowrite32.
> Ping?
>
> We need to make a decision whether to move those xxx_native() helpers
> somewhere (where?) or leave the patch as is (as we figured out that
> iowriteXX functions implement barriers and we cannot just use raw
> accessors) and fix commit log to explain everything.
 Is there actually any difference in generated code with this patch 
 applied
 and without? I would hope that iowrite..() is inlined and cancels out 
 the
 cpu_to_le..() calls that are also inlined?
>>> iowrite32 is a non-inline function so conversions take place so are the
>>> others. And sorry but I fail to see why this matters. We are not trying 
>>> to
>>> accelerate things, we are removing redundant operations which confuse
>>> people who read the code.
>> The confusion depends on where you're coming from. If you happen to know
>> that "iowrite32" writes in LE, then the LE conversion makes a lot of 
>> sense.
> It was like this (and this is just confusing):
>
> iowrite32(le32_to_cpu(val), io + off);
>
> What would make sense (according to you and I would understand this) is 
> this:
>
> iowrite32(cpu_to_le32(val), io + off);
>
>
> Or I missed your point, did I?

 No, you didn't miss it. I think for people who know how iowrite32() 
 works the above is obvious. I find the fact that iowrite32() writes in 
 LE always pretty scary though ;).

 So IMHO we should either create new, generic iowrite helpers that don't 
 do any endian swapping at all or do iowrite32(cpu_to_le32(val)) calls.
>>>
>>> I'm one of those people for whom iowrite32(le32_to_cpu(val)) makes sense
>>
>>
>> I do not understand why @val is considered LE here and need to be converted
>> to CPU. Really. I truly believe it should be cp

[PATCH 3.14 34/68] net/mlx4_core: Preserve pci_dev_data after __mlx4_remove_one()

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Wei Yang 

[ Upstream commit befdf8978accecac2e0739e6b5075afc62db37fe ]

pci_match_id() just match the static pci_device_id, which may return NULL if
someone binds the driver to a device manually using
/sys/bus/pci/drivers/.../new_id.

This patch wrap up a helper function __mlx4_remove_one() which does the tear
down function but preserve the drv_data. Functions like
mlx4_pci_err_detected() and mlx4_restart_one() will call this one with out
releasing drvdata.

Fixes: 97a5221 "net/mlx4_core: pass pci_device_id.driver_data to 
__mlx4_init_one during reset".

CC: Bjorn Helgaas 
CC: Amir Vadai 
CC: Jack Morgenstein 
CC: Or Gerlitz 
Signed-off-by: Wei Yang 
Acked-by: Jack Morgenstein 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/mellanox/mlx4/main.c |  168 --
 drivers/net/ethernet/mellanox/mlx4/mlx4.h |1 
 2 files changed, 94 insertions(+), 75 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2275,13 +2275,8 @@ static int __mlx4_init_one(struct pci_de
/* Allow large DMA segments, up to the firmware limit of 1 GB */
dma_set_max_seg_size(&pdev->dev, 1024 * 1024 * 1024);
 
-   priv = kzalloc(sizeof(*priv), GFP_KERNEL);
-   if (!priv) {
-   err = -ENOMEM;
-   goto err_release_regions;
-   }
-
-   dev   = &priv->dev;
+   dev   = pci_get_drvdata(pdev);
+   priv  = mlx4_priv(dev);
dev->pdev = pdev;
INIT_LIST_HEAD(&priv->ctx_list);
spin_lock_init(&priv->ctx_lock);
@@ -2465,8 +2460,7 @@ slave_start:
mlx4_sense_init(dev);
mlx4_start_sense(dev);
 
-   priv->pci_dev_data = pci_dev_data;
-   pci_set_drvdata(pdev, dev);
+   priv->removed = 0;
 
return 0;
 
@@ -2532,84 +2526,108 @@ err_disable_pdev:
 
 static int mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 {
+   struct mlx4_priv *priv;
+   struct mlx4_dev *dev;
+
printk_once(KERN_INFO "%s", mlx4_version);
 
+   priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+   if (!priv)
+   return -ENOMEM;
+
+   dev   = &priv->dev;
+   pci_set_drvdata(pdev, dev);
+   priv->pci_dev_data = id->driver_data;
+
return __mlx4_init_one(pdev, id->driver_data);
 }
 
-static void mlx4_remove_one(struct pci_dev *pdev)
+static void __mlx4_remove_one(struct pci_dev *pdev)
 {
struct mlx4_dev  *dev  = pci_get_drvdata(pdev);
struct mlx4_priv *priv = mlx4_priv(dev);
+   int   pci_dev_data;
int p;
 
-   if (dev) {
-   /* in SRIOV it is not allowed to unload the pf's
-* driver while there are alive vf's */
-   if (mlx4_is_master(dev)) {
-   if (mlx4_how_many_lives_vf(dev))
-   printk(KERN_ERR "Removing PF when there are 
assigned VF's !!!\n");
-   }
-   mlx4_stop_sense(dev);
-   mlx4_unregister_device(dev);
+   if (priv->removed)
+   return;
 
-   for (p = 1; p <= dev->caps.num_ports; p++) {
-   mlx4_cleanup_port_info(&priv->port[p]);
-   mlx4_CLOSE_PORT(dev, p);
-   }
+   pci_dev_data = priv->pci_dev_data;
 
-   if (mlx4_is_master(dev))
-   mlx4_free_resource_tracker(dev,
-  RES_TR_FREE_SLAVES_ONLY);
+   /* in SRIOV it is not allowed to unload the pf's
+* driver while there are alive vf's */
+   if (mlx4_is_master(dev) && mlx4_how_many_lives_vf(dev))
+   printk(KERN_ERR "Removing PF when there are assigned VF's 
!!!\n");
+   mlx4_stop_sense(dev);
+   mlx4_unregister_device(dev);
+
+   for (p = 1; p <= dev->caps.num_ports; p++) {
+   mlx4_cleanup_port_info(&priv->port[p]);
+   mlx4_CLOSE_PORT(dev, p);
+   }
 
-   mlx4_cleanup_counters_table(dev);
-   mlx4_cleanup_qp_table(dev);
-   mlx4_cleanup_srq_table(dev);
-   mlx4_cleanup_cq_table(dev);
-   mlx4_cmd_use_polling(dev);
-   mlx4_cleanup_eq_table(dev);
-   mlx4_cleanup_mcg_table(dev);
-   mlx4_cleanup_mr_table(dev);
-   mlx4_cleanup_xrcd_table(dev);
-   mlx4_cleanup_pd_table(dev);
+   if (mlx4_is_master(dev))
+   mlx4_free_resource_tracker(dev,
+  RES_TR_FREE_SLAVES_ONLY);
 
-   if (mlx4_is_master(dev))
-   mlx4_free_resource_tracker(dev,
-  RES_TR_FREE_STRUCTS_ONLY);
+   mlx4_cleanup_counters_table(dev);
+   mlx4_cleanup_qp_table(dev);
+   mlx4_cl

[PATCH 3.14 43/68] USB: cdc-acm: fix shutdown and suspend race

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit ed797074031a37bb9bf4a70952fffc606b77274d upstream.

We should stop I/O unconditionally at suspend rather than rely on the
tty-port initialised flag (which is set prior to stopping I/O during
shutdown) in order to prevent suspend returning with URBs still active.

Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/class/cdc-acm.c |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1548,8 +1548,7 @@ static int acm_suspend(struct usb_interf
if (cnt)
return 0;
 
-   if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags))
-   stop_data_traffic(acm);
+   stop_data_traffic(acm);
 
return 0;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 20/68] tcp: fix cwnd undo on DSACK in F-RTO

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Yuchung Cheng 

[ Upstream commit 0cfa5c07d6d1d7f8e710fc671c5ba1ce85e09fa4 ]

This bug is discovered by an recent F-RTO issue on tcpm list
https://www.ietf.org/mail-archive/web/tcpm/current/msg08794.html

The bug is that currently F-RTO does not use DSACK to undo cwnd in
certain cases: upon receiving an ACK after the RTO retransmission in
F-RTO, and the ACK has DSACK indicating the retransmission is spurious,
the sender only calls tcp_try_undo_loss() if some never retransmisted
data is sacked (FLAG_ORIG_DATA_SACKED).

The correct behavior is to unconditionally call tcp_try_undo_loss so
the DSACK information is used properly to undo the cwnd reduction.

Signed-off-by: Yuchung Cheng 
Signed-off-by: Neal Cardwell 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv4/tcp_input.c |   11 +--
 1 file changed, 5 insertions(+), 6 deletions(-)

--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2683,13 +2683,12 @@ static void tcp_process_loss(struct sock
bool recovered = !before(tp->snd_una, tp->high_seq);
 
if (tp->frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */
-   if (flag & FLAG_ORIG_SACK_ACKED) {
-   /* Step 3.b. A timeout is spurious if not all data are
-* lost, i.e., never-retransmitted data are (s)acked.
-*/
-   tcp_try_undo_loss(sk, true);
+   /* Step 3.b. A timeout is spurious if not all data are
+* lost, i.e., never-retransmitted data are (s)acked.
+*/
+   if (tcp_try_undo_loss(sk, flag & FLAG_ORIG_SACK_ACKED))
return;
-   }
+
if (after(tp->snd_nxt, tp->high_seq) &&
(flag & FLAG_DATA_SACKED || is_dupack)) {
tp->frto = 0; /* Loss was real: 2nd part of step 3.a */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 21/68] sh_eth: use RNC mode for packet reception

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Ben Dooks 

[ Upstream commit 530aa2d0d9d55ab2775d47621ddf4b5b15bc1110 ]

The current behaviour of the sh_eth driver is not to use the RNC bit
for the receive ring. This means that every packet recieved is not only
generating an IRQ but it also stops the receive ring DMA as well until
the driver re-enables it after unloading the packet.

This means that a number of the following errors are generated due to
the receive packet FIFO overflowing due to nowhere to put packets:

net eth0: Receive FIFO Overflow

Since feedback from Yoshihiro Shimoda shows that every supported LSI
for this driver should have the bit enabled it seems the best way is
to remove the RMCR default value from the per-system data and just
write it when initialising the RMCR value. This is discussed in
the message (http://www.spinics.net/lists/netdev/msg284912.html).

I have tested the RMCR_RNC configuration with NFS root filesystem and
the driver has not failed yet.  There are further test reports from
Sergei Shtylov and others for both the R8A7790 and R8A7791.

There is also feedback fron Cao Minh Hiep[1] which reports the
same issue in (http://comments.gmane.org/gmane.linux.network/316285)
showing this fixes issues with losing UDP datagrams under iperf.

Tested-by: Sergei Shtylyov 
Signed-off-by: Ben Dooks 
Acked-by: Yoshihiro Shimoda 
Acked-by: Simon Horman 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/renesas/sh_eth.c |   11 ++-
 drivers/net/ethernet/renesas/sh_eth.h |2 --
 2 files changed, 2 insertions(+), 11 deletions(-)

--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -539,7 +539,6 @@ static struct sh_eth_cpu_data sh7757_dat
.register_type  = SH_ETH_REG_FAST_SH4,
 
.eesipr_value   = DMAC_M_RFRMER | DMAC_M_ECI | 0x003f,
-   .rmcr_value = RMCR_RNC,
 
.tx_check   = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
.eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
@@ -617,7 +616,6 @@ static struct sh_eth_cpu_data sh7757_dat
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x072f,
-   .rmcr_value = RMCR_RNC,
 
.irq_flags  = IRQF_SHARED,
.apr= 1,
@@ -745,7 +743,6 @@ static struct sh_eth_cpu_data r8a7740_da
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x070f,
-   .rmcr_value = RMCR_RNC,
 
.apr= 1,
.mpr= 1,
@@ -777,7 +774,6 @@ static struct sh_eth_cpu_data r7s72100_d
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x070f,
-   .rmcr_value = RMCR_RNC,
 
.no_psr = 1,
.apr= 1,
@@ -826,9 +822,6 @@ static void sh_eth_set_default_cpu_data(
if (!cd->fdr_value)
cd->fdr_value = DEFAULT_FDR_INIT;
 
-   if (!cd->rmcr_value)
-   cd->rmcr_value = DEFAULT_RMCR_VALUE;
-
if (!cd->tx_check)
cd->tx_check = DEFAULT_TX_CHECK;
 
@@ -1281,8 +1274,8 @@ static int sh_eth_dev_init(struct net_de
sh_eth_write(ndev, mdp->cd->fdr_value, FDR);
sh_eth_write(ndev, 0, TFTR);
 
-   /* Frame recv control */
-   sh_eth_write(ndev, mdp->cd->rmcr_value, RMCR);
+   /* Frame recv control (enable multiple-packets per rx irq) */
+   sh_eth_write(ndev, RMCR_RNC, RMCR);
 
sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER);
 
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -320,7 +320,6 @@ enum TD_STS_BIT {
 enum RMCR_BIT {
RMCR_RNC = 0x0001,
 };
-#define DEFAULT_RMCR_VALUE 0x
 
 /* ECMR */
 enum FELIC_MODE_BIT {
@@ -467,7 +466,6 @@ struct sh_eth_cpu_data {
unsigned long fdr_value;
unsigned long fcftr_value;
unsigned long rpadir_value;
-   unsigned long rmcr_value;
 
/* interrupt checking mask */
unsigned long tx_check;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 24/68] net: filter: fix sparc32 typo

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Alexei Starovoitov 

[ Upstream commit 588f5d629b3369aba88f52217d1c473a28fa7723 ]

Fixes: 569810d1e327 ("net: filter: fix typo in sparc BPF JIT")
Signed-off-by: Alexei Starovoitov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/sparc/net/bpf_jit_comp.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -85,7 +85,7 @@ static void bpf_flush_icache(void *start
 #ifdef CONFIG_SPARC64
 #define BE_PTR (F2(0, 1) | CONDE | (2 << 20))
 #else
-#define BE_PTR BNE
+#define BE_PTR BE
 #endif
 
 #define SETHI(K, REG)  \


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 27/68] ipip, sit: fix ipv4_{update_pmtu,redirect} calls

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Popov 

[ Upstream commit 2346829e641b804ece9ac9298136b56d9567c278 ]

ipv4_{update_pmtu,redirect} were called with tunnel's ifindex (t->dev is a
tunnel netdevice). It caused wrong route lookup and failure of pmtu update or
redirect. We should use the same ifindex that we use in ip_route_output_* in
*tunnel_xmit code. It is t->parms.link .

Signed-off-by: Dmitry Popov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv4/ipip.c |4 ++--
 net/ipv6/sit.c  |4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -149,13 +149,13 @@ static int ipip_err(struct sk_buff *skb,
 
if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
ipv4_update_pmtu(skb, dev_net(skb->dev), info,
-t->dev->ifindex, 0, IPPROTO_IPIP, 0);
+t->parms.link, 0, IPPROTO_IPIP, 0);
err = 0;
goto out;
}
 
if (type == ICMP_REDIRECT) {
-   ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0,
+   ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
  IPPROTO_IPIP, 0);
err = 0;
goto out;
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -560,12 +560,12 @@ static int ipip6_err(struct sk_buff *skb
 
if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
ipv4_update_pmtu(skb, dev_net(skb->dev), info,
-t->dev->ifindex, 0, IPPROTO_IPV6, 0);
+t->parms.link, 0, IPPROTO_IPV6, 0);
err = 0;
goto out;
}
if (type == ICMP_REDIRECT) {
-   ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0,
+   ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
  IPPROTO_IPV6, 0);
err = 0;
goto out;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 42/68] USB: cdc-acm: fix runtime PM for control messages

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit bae3f4c53585e9a170da9436e0f06919874bda9a upstream.

Fix runtime PM handling of control messages by adding the required PM
counter operations.

Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/class/cdc-acm.c |   12 +++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -122,13 +122,23 @@ static void acm_release_minor(struct acm
 static int acm_ctrl_msg(struct acm *acm, int request, int value,
void *buf, int len)
 {
-   int retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0),
+   int retval;
+
+   retval = usb_autopm_get_interface(acm->control);
+   if (retval)
+   return retval;
+
+   retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0),
request, USB_RT_ACM, value,
acm->control->altsetting[0].desc.bInterfaceNumber,
buf, len, 5000);
+
dev_dbg(&acm->control->dev,
"%s - rq 0x%02x, val %#x, len %#x, result %d\n",
__func__, request, value, len, retval);
+
+   usb_autopm_put_interface(acm->control);
+
return retval < 0 ? retval : 0;
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 23/68] net: filter: fix typo in sparc BPF JIT

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Alexei Starovoitov 

[ Upstream commit 569810d1e3278907264f5b115281fca3f0038d53 ]

fix typo in sparc codegen for SKF_AD_IFINDEX and SKF_AD_HATYPE
classic BPF extensions

Fixes: 2809a2087cc4 ("net: filter: Just In Time compiler for sparc")
Signed-off-by: Alexei Starovoitov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/sparc/net/bpf_jit_comp.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -83,9 +83,9 @@ static void bpf_flush_icache(void *start
 #define BNE(F2(0, 2) | CONDNE)
 
 #ifdef CONFIG_SPARC64
-#define BNE_PTR(F2(0, 1) | CONDNE | (2 << 20))
+#define BE_PTR (F2(0, 1) | CONDE | (2 << 20))
 #else
-#define BNE_PTRBNE
+#define BE_PTR BNE
 #endif
 
 #define SETHI(K, REG)  \
@@ -600,7 +600,7 @@ void bpf_jit_compile(struct sk_filter *f
case BPF_S_ANC_IFINDEX:
emit_skb_loadptr(dev, r_A);
emit_cmpi(r_A, 0);
-   emit_branch(BNE_PTR, cleanup_addr + 4);
+   emit_branch(BE_PTR, cleanup_addr + 4);
emit_nop();
emit_load32(r_A, struct net_device, ifindex, 
r_A);
break;
@@ -613,7 +613,7 @@ void bpf_jit_compile(struct sk_filter *f
case BPF_S_ANC_HATYPE:
emit_skb_loadptr(dev, r_A);
emit_cmpi(r_A, 0);
-   emit_branch(BNE_PTR, cleanup_addr + 4);
+   emit_branch(BE_PTR, cleanup_addr + 4);
emit_nop();
emit_load16(r_A, struct net_device, type, r_A);
break;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 31/68] rtnetlink: fix userspace API breakage for iproute2 < v3.9.0

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Michal Schmidt 

[ Upstream commit e5eca6d41f53db48edd8cf88a3f59d2c30227f8e ]

When running RHEL6 userspace on a current upstream kernel, "ip link"
fails to show VF information.

The reason is a kernel<->userspace API change introduced by commit
88c5b5ce5cb57 ("rtnetlink: Call nlmsg_parse() with correct header length"),
after which the kernel does not see iproute2's IFLA_EXT_MASK attribute
in the netlink request.

iproute2 adjusted for the API change in its commit 63338dca4513
("libnetlink: Use ifinfomsg instead of rtgenmsg in rtnl_wilddump_req_filter").

The problem has been noticed before:
http://marc.info/?l=linux-netdev&m=136692296022182&w=2
(Subject: Re: getting VF link info seems to be broken in 3.9-rc8)

We can do better than tell those with old userspace to upgrade. We can
recognize the old iproute2 in the kernel by checking the netlink message
length. Even when including the IFLA_EXT_MASK attribute, its netlink
message is shorter than struct ifinfomsg.

With this patch "ip link" shows VF information in both old and new
iproute2 versions.

Signed-off-by: Michal Schmidt 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 net/core/rtnetlink.c |   22 ++
 1 file changed, 18 insertions(+), 4 deletions(-)

--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1166,6 +1166,7 @@ static int rtnl_dump_ifinfo(struct sk_bu
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
int err;
+   int hdrlen;
 
s_h = cb->args[0];
s_idx = cb->args[1];
@@ -1173,8 +1174,17 @@ static int rtnl_dump_ifinfo(struct sk_bu
rcu_read_lock();
cb->seq = net->dev_base_seq;
 
-   if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
-   ifla_policy) >= 0) {
+   /* A hack to preserve kernel<->userspace interface.
+* The correct header is ifinfomsg. It is consistent with rtnl_getlink.
+* However, before Linux v3.9 the code here assumed rtgenmsg and that's
+* what iproute2 < v3.9.0 used.
+* We can detect the old iproute2. Even including the IFLA_EXT_MASK
+* attribute, its netlink message is shorter than struct ifinfomsg.
+*/
+   hdrlen = nlmsg_len(cb->nlh) < sizeof(struct ifinfomsg) ?
+sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
+
+   if (nlmsg_parse(cb->nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) {
 
if (tb[IFLA_EXT_MASK])
ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
@@ -2085,9 +2095,13 @@ static u16 rtnl_calcit(struct sk_buff *s
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
u16 min_ifinfo_dump_size = 0;
+   int hdrlen;
+
+   /* Same kernel<->userspace interface hack as in rtnl_dump_ifinfo. */
+   hdrlen = nlmsg_len(nlh) < sizeof(struct ifinfomsg) ?
+sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
 
-   if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
-   ifla_policy) >= 0) {
+   if (nlmsg_parse(nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) {
if (tb[IFLA_EXT_MASK])
ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 30/68] sctp: Fix sk_ack_backlog wrap-around problem

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Xufeng Zhang 

[ Upstream commit d3217b15a19a4779c39b212358a5c71d725822ee ]

Consider the scenario:
For a TCP-style socket, while processing the COOKIE_ECHO chunk in
sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check,
a new association would be created in sctp_unpack_cookie(), but afterwards,
some processing maybe failed, and sctp_association_free() will be called to
free the previously allocated association, in sctp_association_free(),
sk_ack_backlog value is decremented for this socket, since the initial
value for sk_ack_backlog is 0, after the decrement, it will be 65535,
a wrap-around problem happens, and if we want to establish new associations
afterward in the same socket, ABORT would be triggered since sctp deem the
accept queue as full.
Fix this issue by only decrementing sk_ack_backlog for associations in
the endpoint's list.

Fix-suggested-by: Neil Horman 
Signed-off-by: Xufeng Zhang 
Acked-by: Daniel Borkmann 
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 net/sctp/associola.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -330,7 +330,7 @@ void sctp_association_free(struct sctp_a
/* Only real associations count against the endpoint, so
 * don't bother for if this is a temporary association.
 */
-   if (!asoc->temp) {
+   if (!list_empty(&asoc->asocs)) {
list_del(&asoc->asocs);
 
/* Decrement the backlog value for a TCP-style listening


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH v6 3/4] ARM: Move some macros from entry-armv to entry-header

[Nicolas Pitre]

On Tue, 24 Jun 2014, Daniel Thompson wrote:

> From: Anton Vorontsov 
> 
> Just move the macros into header file as we would want to use them for
> KGDB FIQ entry code.
> 
> The following macros were moved:
> 
>  - svc_entry
>  - usr_entry
>  - kuser_cmpxchg_check
>  - vector_stub
> 
> To make kuser_cmpxchg_check actually work across different files, we
> also have to make kuser_cmpxchg64_fixup global.
> 
> Signed-off-by: Anton Vorontsov 
> Signed-off-by: John Stultz 
> Signed-off-by: Daniel Thompson 
> Cc: Russell King 
> Cc: Nicolas Pitre 
> Cc: Catalin Marinas 
> Cc: Frederic Weisbecker 

Acked-by: Nicolas Pitre 


> ---
>  arch/arm/kernel/entry-armv.S   | 151 +
>  arch/arm/kernel/entry-header.S | 164 
> +
>  2 files changed, 165 insertions(+), 150 deletions(-)
> 
> diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
> index 52a949a..4172cd6 100644
> --- a/arch/arm/kernel/entry-armv.S
> +++ b/arch/arm/kernel/entry-armv.S
> @@ -140,53 +140,6 @@ ENDPROC(__und_invalid)
>   * SVC mode handlers
>   */
>  
> -#if defined(CONFIG_AEABI) && (__LINUX_ARM_ARCH__ >= 5)
> -#define SPFIX(code...) code
> -#else
> -#define SPFIX(code...)
> -#endif
> -
> - .macro  svc_entry, stack_hole=0
> - UNWIND(.fnstart )
> - UNWIND(.save {r0 - pc}  )
> - sub sp, sp, #(S_FRAME_SIZE + \stack_hole - 4)
> -#ifdef CONFIG_THUMB2_KERNEL
> - SPFIX(  str r0, [sp])   @ temporarily saved
> - SPFIX(  mov r0, sp  )
> - SPFIX(  tst r0, #4  )   @ test original stack alignment
> - SPFIX(  ldr r0, [sp])   @ restored
> -#else
> - SPFIX(  tst sp, #4  )
> -#endif
> - SPFIX(  subeq   sp, sp, #4  )
> - stmia   sp, {r1 - r12}
> -
> - ldmia   r0, {r3 - r5}
> - add r7, sp, #S_SP - 4   @ here for interlock avoidance
> - mov r6, #-1 @  ""  ""  ""   ""
> - add r2, sp, #(S_FRAME_SIZE + \stack_hole - 4)
> - SPFIX(  addeq   r2, r2, #4  )
> - str r3, [sp, #-4]!  @ save the "real" r0 copied
> - @ from the exception stack
> -
> - mov r3, lr
> -
> - @
> - @ We are now ready to fill in the remaining blanks on the stack:
> - @
> - @  r2 - sp_svc
> - @  r3 - lr_svc
> - @  r4 - lr_, already fixed up for correct return/restart
> - @  r5 - spsr_
> - @  r6 - orig_r0 (see pt_regs definition in ptrace.h)
> - @
> - stmia   r7, {r2 - r6}
> -
> -#ifdef CONFIG_TRACE_IRQFLAGS
> - bl  trace_hardirqs_off
> -#endif
> - .endm
> -
>   .align  5
>  __dabt_svc:
>   svc_entry
> @@ -306,73 +259,8 @@ ENDPROC(__pabt_svc)
>  
>  /*
>   * User mode handlers
> - *
> - * EABI note: sp_svc is always 64-bit aligned here, so should S_FRAME_SIZE
>   */
>  
> -#if defined(CONFIG_AEABI) && (__LINUX_ARM_ARCH__ >= 5) && (S_FRAME_SIZE & 7)
> -#error "sizeof(struct pt_regs) must be a multiple of 8"
> -#endif
> -
> - .macro  usr_entry
> - UNWIND(.fnstart )
> - UNWIND(.cantunwind  )   @ don't unwind the user space
> - sub sp, sp, #S_FRAME_SIZE
> - ARM(stmib   sp, {r1 - r12}  )
> - THUMB(  stmia   sp, {r0 - r12}  )
> -
> - ldmia   r0, {r3 - r5}
> - add r0, sp, #S_PC   @ here for interlock avoidance
> - mov r6, #-1 @  ""  "" """"
> -
> - str r3, [sp]@ save the "real" r0 copied
> - @ from the exception stack
> -
> - @
> - @ We are now ready to fill in the remaining blanks on the stack:
> - @
> - @  r4 - lr_, already fixed up for correct return/restart
> - @  r5 - spsr_
> - @  r6 - orig_r0 (see pt_regs definition in ptrace.h)
> - @
> - @ Also, separately save sp_usr and lr_usr
> - @
> - stmia   r0, {r4 - r6}
> - ARM(stmdb   r0, {sp, lr}^   )
> - THUMB(  store_user_sp_lr r0, r1, S_SP - S_PC)
> -
> - @
> - @ Enable the alignment trap while in kernel mode
> - @
> - alignment_trap r0, .LCcralign
> -
> - @
> - @ Clear FP to mark the first stack frame
> - @
> - zero_fp
> -
> -#ifdef CONFIG_IRQSOFF_TRACER
> - bl  trace_hardirqs_off
> -#endif
> - ct_user_exit save = 0
> - .endm
> -
> - .macro  kuser_cmpxchg_check
> -#if !defined(CONFIG_CPU_32v6K) && defined(CONFIG_KUSER_HELPERS) && \
> -!defined(CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG)
> -#ifndef CONFIG_MMU
> -#warning "NPTL on non MMU needs fixing"
> -#else
> - @ Make sure our user space atomic helper is restarted
> - @ if it was interrupted in a critical region.  Here we
> - @ perform a quick test inline since it should be false
> - @ 99.% of the time.  The rest is done out of line.
> - cmp r4, #TASK_SIZE
> - blhskuser_cmpxchg64_fixup
> -#endif
> -#endif

Re: [PATCH 2/2] ARM: tegra: roth: enable input on mmc clock pins

[Stephen Warren]

On 06/23/2014 11:44 PM, Alexandre Courbot wrote:
> On 06/24/2014 04:01 AM, Stephen Warren wrote:
>> On 06/23/2014 01:32 AM, Alexandre Courbot wrote:
>>> Input had been disabled by mistake on these pins, leading to issues with
>>> SDIO devices like the Wifi module not being probed or random errors
>>> occuring on the SD card.
>>
>> I thought the host controller always drove the clock, so there should be
>> no need for the pin's input path to be enabled. Perhaps it depends on
>> the transfer mode (e.g. UHS)?
> 
> That's what I thought too, so I went against what was done downstream
> and disabled input mode. Eventually noticed various issues with MMC
> devices, reverted to the downstream settings and noticed my problems
> were solved by this single change.

Hmm. That's odd. Can you talk to one of the HW engineers behind the
SDHCI controller and get a definitive answer. Thanks.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH v2] ARM: dts: Add cros_ec to exynos5420-peach-pit and exynos5800-peach-pi

[Doug Anderson]

Tushar,

On Mon, Jun 23, 2014 at 11:43 PM, Tushar Behera  wrote:
> On 06/24/2014 02:19 AM, Doug Anderson wrote:
>> This adds cros_ec to exynos5420-peach-pit and exynos5800-peach-pi,
>> including:
>> * The keyboard
>> * The i2c tunnel
>> * The tps65090 under the i2c tunnel
>> * The battery under the i2c tunnel
>>
>> To add extra motivation, it should be noted that tps65090 is one of
>> the things needed to get display-related FETs turned on for pit and
>> pi.
>>
>> Note that this relies on a few outstanding changes:
>> * Needs (spi: s3c64xx: fix broken "cs_gpios" usage in the driver) and
>>   (spi: s3c64xx: for DT platofrms always get the chipselect info from
>>   DT node) to work properly and match the documented bindings.  See
>>    and
>>   
>>
>> Signed-off-by: Doug Anderson 
>> Tested-by: Javier Martinez Canillas 
>
> Along with the dependency patches on next-20140623, tested keyboard on
> Peach-Pi board.
>
> Tested-by: Tushar Behera 
>
> Some comments below.
>
>> ---
>> Changes in v2:
>> - Now just one patch since mfd patch landed.
>> - Rebased to ToT linux-next
>>
>>  arch/arm/boot/dts/exynos5420-peach-pit.dts | 145 
>> +
>>  arch/arm/boot/dts/exynos5800-peach-pi.dts  | 145 
>> +
>>  2 files changed, 290 insertions(+)
>>
>> diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts 
>> b/arch/arm/boot/dts/exynos5420-peach-pit.dts
>> index 7649982..581f385 100644
>> --- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
>> +++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
>
>> + regulators {
>> + dcdc1 {
>> + ti,enable-ext-control;
>> + };
>> + dcdc2 {
>> + ti,enable-ext-control;
>> + };
>> + dcdc3 {
>> + ti,enable-ext-control;
>> + };
>> + fet1 {
>
> "tps65090_fet1: fet1 {" ?
>
>> + regulator-name = "vcd_led";
>> + };
>> + tps65090_fet2: fet2 {
>
> I would suggest we add similar labels to fet1, fet3, fet4, fet5 and fet6
> also. That way it would be easy to reference them in subsequent DT nodes.
>
> Same comment for Peach-Pi dts file too.

OK.  I added it to all the regulators in tps65090.  That'll probably
be useful for Javier in his max77802 work.

-Doug
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 08/68] net: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: "Eric W. Biederman" 

[ Upstream commit a53b72c83a4216f2eb883ed45a0cbce014b8e62d ]

The permission check in sock_diag_put_filterinfo is wrong, and it is so removed
from it's sources it is not clear why it is wrong.  Move the computation
into packet_diag_dump and pass a bool of the result into sock_diag_filterinfo.

This does not yet correct the capability check but instead simply moves it to 
make
it clear what is going on.

Reported-by: Andy Lutomirski 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 include/linux/sock_diag.h |2 +-
 net/core/sock_diag.c  |4 ++--
 net/packet/diag.c |7 ++-
 3 files changed, 9 insertions(+), 4 deletions(-)

--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u
 void sock_diag_save_cookie(void *sk, __u32 *cookie);
 
 int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);
-int sock_diag_put_filterinfo(struct sock *sk,
+int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk,
 struct sk_buff *skb, int attrtype);
 
 #endif
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *s
 }
 EXPORT_SYMBOL_GPL(sock_diag_put_meminfo);
 
-int sock_diag_put_filterinfo(struct sock *sk,
+int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk,
 struct sk_buff *skb, int attrtype)
 {
struct nlattr *attr;
@@ -57,7 +57,7 @@ int sock_diag_put_filterinfo(struct sock
unsigned int len;
int err = 0;
 
-   if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
+   if (!may_report_filterinfo) {
nla_reserve(skb, attrtype, 0);
return 0;
}
--- a/net/packet/diag.c
+++ b/net/packet/diag.c
@@ -128,6 +128,7 @@ static int pdiag_put_fanout(struct packe
 
 static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
struct packet_diag_req *req,
+   bool may_report_filterinfo,
struct user_namespace *user_ns,
u32 portid, u32 seq, u32 flags, int sk_ino)
 {
@@ -172,7 +173,8 @@ static int sk_diag_fill(struct sock *sk,
goto out_nlmsg_trim;
 
if ((req->pdiag_show & PACKET_SHOW_FILTER) &&
-   sock_diag_put_filterinfo(sk, skb, PACKET_DIAG_FILTER))
+   sock_diag_put_filterinfo(may_report_filterinfo, sk, skb,
+PACKET_DIAG_FILTER))
goto out_nlmsg_trim;
 
return nlmsg_end(skb, nlh);
@@ -188,9 +190,11 @@ static int packet_diag_dump(struct sk_bu
struct packet_diag_req *req;
struct net *net;
struct sock *sk;
+   bool may_report_filterinfo;
 
net = sock_net(skb->sk);
req = nlmsg_data(cb->nlh);
+   may_report_filterinfo = ns_capable(net->user_ns, CAP_NET_ADMIN);
 
mutex_lock(&net->packet.sklist_lock);
sk_for_each(sk, &net->packet.sklist) {
@@ -200,6 +204,7 @@ static int packet_diag_dump(struct sk_bu
goto next;
 
if (sk_diag_fill(sk, skb, req,
+may_report_filterinfo,
 sk_user_ns(NETLINK_CB(cb->skb).sk),
 NETLINK_CB(cb->skb).portid,
 cb->nlh->nlmsg_seq, NLM_F_MULTI,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 28/68] sfc: PIO:Restrict to 64bit arch and use 64-bit writes.

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Jon Cooper 

[ Upstream commit daf37b556e437ec1ea1a597dcfeff338068380e1 ]

Fixes:ee45fd92c739
("sfc: Use TX PIO for sufficiently small packets")

The linux net driver uses memcpy_toio() in order to copy into
the PIO buffers.
Even on a 64bit machine this causes 32bit accesses to a write-
combined memory region.
There are hardware limitations that mean that only 64bit
naturally aligned accesses are safe in all cases.
Due to being write-combined memory region two 32bit accesses
may be coalesced to form a 64bit non 64bit aligned access.
Solution was to open-code the memory copy routines using pointers
and to only enable PIO for x86_64 machines.

Not tested on platforms other than x86_64 because this patch
disables the PIO feature on other platforms.
Compile-tested on x86 to ensure that works.

The WARN_ON_ONCE() code in the previous version of this patch
has been moved into the internal sfc debug driver as the
assertion was unnecessary in the upstream kernel code.

This bug fix applies to v3.13 and v3.14 stable branches.

Signed-off-by: Shradha Shah 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/sfc/io.h |7 +++
 drivers/net/ethernet/sfc/tx.c |   22 +-
 2 files changed, 24 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/sfc/io.h
+++ b/drivers/net/ethernet/sfc/io.h
@@ -66,10 +66,17 @@
 #define EFX_USE_QWORD_IO 1
 #endif
 
+/* Hardware issue requires that only 64-bit naturally aligned writes
+ * are seen by hardware. Its not strictly necessary to restrict to
+ * x86_64 arch, but done for safety since unusual write combining behaviour
+ * can break PIO.
+ */
+#ifdef CONFIG_X86_64
 /* PIO is a win only if write-combining is possible */
 #ifdef ARCH_HAS_IOREMAP_WC
 #define EFX_USE_PIO 1
 #endif
+#endif
 
 #ifdef EFX_USE_QWORD_IO
 static inline void _efx_writeq(struct efx_nic *efx, __le64 value,
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -189,6 +189,18 @@ struct efx_short_copy_buffer {
u8 buf[L1_CACHE_BYTES];
 };
 
+/* Copy in explicit 64-bit writes. */
+static void efx_memcpy_64(void __iomem *dest, void *src, size_t len)
+{
+   u64 *src64 = src;
+   u64 __iomem *dest64 = dest;
+   size_t l64 = len / 8;
+   size_t i;
+
+   for (i = 0; i < l64; i++)
+   writeq(src64[i], &dest64[i]);
+}
+
 /* Copy to PIO, respecting that writes to PIO buffers must be dword aligned.
  * Advances piobuf pointer. Leaves additional data in the copy buffer.
  */
@@ -198,7 +210,7 @@ static void efx_memcpy_toio_aligned(stru
 {
int block_len = len & ~(sizeof(copy_buf->buf) - 1);
 
-   memcpy_toio(*piobuf, data, block_len);
+   efx_memcpy_64(*piobuf, data, block_len);
*piobuf += block_len;
len -= block_len;
 
@@ -230,7 +242,7 @@ static void efx_memcpy_toio_aligned_cb(s
if (copy_buf->used < sizeof(copy_buf->buf))
return;
 
-   memcpy_toio(*piobuf, copy_buf->buf, sizeof(copy_buf->buf));
+   efx_memcpy_64(*piobuf, copy_buf->buf, sizeof(copy_buf->buf));
*piobuf += sizeof(copy_buf->buf);
data += copy_to_buf;
len -= copy_to_buf;
@@ -245,7 +257,7 @@ static void efx_flush_copy_buffer(struct
 {
/* if there's anything in it, write the whole buffer, including junk */
if (copy_buf->used)
-   memcpy_toio(piobuf, copy_buf->buf, sizeof(copy_buf->buf));
+   efx_memcpy_64(piobuf, copy_buf->buf, sizeof(copy_buf->buf));
 }
 
 /* Traverse skb structure and copy fragments in to PIO buffer.
@@ -304,8 +316,8 @@ efx_enqueue_skb_pio(struct efx_tx_queue
 */
BUILD_BUG_ON(L1_CACHE_BYTES >
 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
-   memcpy_toio(tx_queue->piobuf, skb->data,
-   ALIGN(skb->len, L1_CACHE_BYTES));
+   efx_memcpy_64(tx_queue->piobuf, skb->data,
+ ALIGN(skb->len, L1_CACHE_BYTES));
}
 
EFX_POPULATE_QWORD_5(buffer->option,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 03/68] iscsi-target: Reject mutual authentication with reflected CHAP_C

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Nicholas Bellinger 

commit 1d2b60a5545942b1376cb48c1d55843d71e3a08f upstream.

This patch adds an explicit check in chap_server_compute_md5() to ensure
the CHAP_C value received from the initiator during mutual authentication
does not match the original CHAP_C provided by the target.

This is in line with RFC-3720, section 8.2.1:

   Originators MUST NOT reuse the CHAP challenge sent by the Responder
   for the other direction of a bidirectional authentication.
   Responders MUST check for this condition and close the iSCSI TCP
   connection if it occurs.

Reported-by: Tejas Vaykole 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/target/iscsi/iscsi_target_auth.c |   10 ++
 1 file changed, 10 insertions(+)

--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -314,6 +314,16 @@ static int chap_server_compute_md5(
goto out;
}
/*
+* During mutual authentication, the CHAP_C generated by the
+* initiator must not match the original CHAP_C generated by
+* the target.
+*/
+   if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) {
+   pr_err("initiator CHAP_C matches target CHAP_C, failing"
+  " login attempt\n");
+   goto out;
+   }
+   /*
 * Generate CHAP_N and CHAP_R for mutual authentication.
 */
tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 11/68] net: Use netlink_ns_capable to verify the permisions of netlink messages

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: "Eric W. Biederman" 

[ Upstream commit 90f62cf30a78721641e08737bda787552428061e ]

It is possible by passing a netlink socket to a more privileged
executable and then to fool that executable into writing to the socket
data that happens to be valid netlink message to do something that
privileged executable did not intend to do.

To keep this from happening replace bare capable and ns_capable calls
with netlink_capable, netlink_net_calls and netlink_ns_capable calls.
Which act the same as the previous calls except they verify that the
opener of the socket had the desired permissions as well.

Reported-by: Andy Lutomirski 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 crypto/crypto_user.c|2 +-
 drivers/connector/cn_proc.c |2 +-
 drivers/scsi/scsi_netlink.c |2 +-
 kernel/audit.c  |4 ++--
 net/can/gw.c|4 ++--
 net/core/rtnetlink.c|   20 +++-
 net/dcb/dcbnl.c |2 +-
 net/decnet/dn_dev.c |4 ++--
 net/decnet/dn_fib.c |4 ++--
 net/decnet/netfilter/dn_rtmsg.c |2 +-
 net/netfilter/nfnetlink.c   |2 +-
 net/netlink/genetlink.c |2 +-
 net/packet/diag.c   |2 +-
 net/phonet/pn_netlink.c |8 
 net/sched/act_api.c |2 +-
 net/sched/cls_api.c |2 +-
 net/sched/sch_api.c |6 +++---
 net/tipc/netlink.c  |2 +-
 net/xfrm/xfrm_user.c|2 +-
 19 files changed, 38 insertions(+), 36 deletions(-)

--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -466,7 +466,7 @@ static int crypto_user_rcv_msg(struct sk
type -= CRYPTO_MSG_BASE;
link = &crypto_dispatch[type];
 
-   if (!capable(CAP_NET_ADMIN))
+   if (!netlink_capable(skb, CAP_NET_ADMIN))
return -EPERM;
 
if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -369,7 +369,7 @@ static void cn_proc_mcast_ctl(struct cn_
return;
 
/* Can only change if privileged. */
-   if (!capable(CAP_NET_ADMIN)) {
+   if (!__netlink_ns_capable(nsp, &init_user_ns, CAP_NET_ADMIN)) {
err = EPERM;
goto out;
}
--- a/drivers/scsi/scsi_netlink.c
+++ b/drivers/scsi/scsi_netlink.c
@@ -77,7 +77,7 @@ scsi_nl_rcv_msg(struct sk_buff *skb)
goto next_msg;
}
 
-   if (!capable(CAP_SYS_ADMIN)) {
+   if (!netlink_capable(skb, CAP_SYS_ADMIN)) {
err = -EPERM;
goto next_msg;
}
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -639,13 +639,13 @@ static int audit_netlink_ok(struct sk_bu
case AUDIT_TTY_SET:
case AUDIT_TRIM:
case AUDIT_MAKE_EQUIV:
-   if (!capable(CAP_AUDIT_CONTROL))
+   if (!netlink_capable(skb, CAP_AUDIT_CONTROL))
err = -EPERM;
break;
case AUDIT_USER:
case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
-   if (!capable(CAP_AUDIT_WRITE))
+   if (!netlink_capable(skb, CAP_AUDIT_WRITE))
err = -EPERM;
break;
default:  /* bad msg */
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -804,7 +804,7 @@ static int cgw_create_job(struct sk_buff
u8 limhops = 0;
int err = 0;
 
-   if (!capable(CAP_NET_ADMIN))
+   if (!netlink_capable(skb, CAP_NET_ADMIN))
return -EPERM;
 
if (nlmsg_len(nlh) < sizeof(*r))
@@ -893,7 +893,7 @@ static int cgw_remove_job(struct sk_buff
u8 limhops = 0;
int err = 0;
 
-   if (!capable(CAP_NET_ADMIN))
+   if (!netlink_capable(skb, CAP_NET_ADMIN))
return -EPERM;
 
if (nlmsg_len(nlh) < sizeof(*r))
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1428,7 +1428,8 @@ static int do_set_master(struct net_devi
return 0;
 }
 
-static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
+static int do_setlink(const struct sk_buff *skb,
+ struct net_device *dev, struct ifinfomsg *ifm,
  struct nlattr **tb, char *ifname, int modified)
 {
const struct net_device_ops *ops = dev->netdev_ops;
@@ -1440,7 +1441,7 @@ static int do_setlink(struct net_device
err = PTR_ERR(net);
goto errout;
}
-   if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
+   if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
err = -EPERM;
goto errout;

[PATCH v3] ARM: dts: Add cros_ec to exynos5420-peach-pit and exynos5800-peach-pi

[Doug Anderson]

This adds cros_ec to exynos5420-peach-pit and exynos5800-peach-pi,
including:
* The keyboard
* The i2c tunnel
* The tps65090 under the i2c tunnel
* The battery under the i2c tunnel

To add extra motivation, it should be noted that tps65090 is one of
the things needed to get display-related FETs turned on for pit and
pi.

Note that this relies on a few outstanding changes:
* Needs (spi: s3c64xx: fix broken "cs_gpios" usage in the driver) and
  (spi: s3c64xx: for DT platofrms always get the chipselect info from
  DT node) to work properly and match the documented bindings.  See
   and
  

Signed-off-by: Doug Anderson 
Tested-by: Javier Martinez Canillas 
Tested-by: Tushar Behera 
---
Changes in v3:
- Added aliases for tps65090 regulators as per Tushar.

Changes in v2:
- Now just one patch since mfd patch landed.
- Rebased to ToT linux-next

 arch/arm/boot/dts/exynos5420-peach-pit.dts | 145 +
 arch/arm/boot/dts/exynos5800-peach-pi.dts  | 145 +
 2 files changed, 290 insertions(+)

diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts 
b/arch/arm/boot/dts/exynos5420-peach-pit.dts
index 7649982..b2f1237 100644
--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
+++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
@@ -25,6 +25,11 @@
"google,pit", "google,peach","samsung,exynos5420",
"samsung,exynos5";
 
+   aliases {
+   /* Assign 20 so we don't get confused w/ builtin ones */
+   i2c20 = "/spi@12d4/cros-ec@0/i2c-tunnel";
+   };
+
backlight {
compatible = "pwm-backlight";
pwms = <&pwm 0 100 0>;
@@ -87,6 +92,13 @@
pinctrl-0 = <&usb301_vbus_en>;
enable-active-high;
};
+
+   vbat: fixed-regulator {
+   compatible = "regulator-fixed";
+   regulator-name = "vbat-supply";
+   regulator-boot-on;
+   regulator-always-on;
+   };
 };
 
 &dp {
@@ -231,6 +243,20 @@
samsung,pin-drv = <0>;
};
 
+   ec_irq: ec-irq {
+   samsung,pins = "gpx1-5";
+   samsung,pin-function = <0>;
+   samsung,pin-pud = <0>;
+   samsung,pin-drv = <0>;
+   };
+
+   tps65090_irq: tps65090-irq {
+   samsung,pins = "gpx2-5";
+   samsung,pin-function = <0>;
+   samsung,pin-pud = <0>;
+   samsung,pin-drv = <0>;
+   };
+
dp_hpd_gpio: dp_hpd_gpio {
samsung,pins = "gpx2-6";
samsung,pin-function = <0>;
@@ -247,6 +273,19 @@
 };
 
 &pinctrl_3 {
+   /* Drive SPI lines at x2 for better integrity */
+   spi2-bus {
+   samsung,pin-drv = <2>;
+   };
+
+   /* Drive SPI chip select at x2 for better integrity */
+   ec_spi_cs: ec-spi-cs {
+   samsung,pins = "gpb1-2";
+   samsung,pin-function = <1>;
+   samsung,pin-pud = <0>;
+   samsung,pin-drv = <2>;
+   };
+
usb300_vbus_en: usb300-vbus-en {
samsung,pins = "gph0-0";
samsung,pin-function = <1>;
@@ -266,6 +305,111 @@
status = "okay";
 };
 
+&spi_2 {
+   status = "okay";
+   num-cs = <1>;
+   samsung,spi-src-clk = <0>;
+   cs-gpios = <&gpb1 2 0>;
+
+   cros_ec: cros-ec@0 {
+   compatible = "google,cros-ec-spi";
+   interrupt-parent = <&gpx1>;
+   interrupts = <5 0>;
+   pinctrl-names = "default";
+   pinctrl-0 = <&ec_spi_cs &ec_irq>;
+   reg = <0>;
+   spi-max-frequency = <3125000>;
+
+   controller-data {
+   samsung,spi-feedback-delay = <1>;
+   };
+
+   i2c-tunnel {
+   compatible = "google,cros-ec-i2c-tunnel";
+   #address-cells = <1>;
+   #size-cells = <0>;
+   google,remote-bus = <0>;
+
+   battery: sbs-battery@b {
+   compatible = "sbs,sbs-battery";
+   reg = <0xb>;
+   sbs,poll-retry-count = <1>;
+   sbs,i2c-retry-count = <2>;
+   };
+
+   power-regulator@48 {
+   compatible = "ti,tps65090";
+   reg = <0x48>;
+
+   /*
+* Config irq to disable internal pulls
+* even though we run in polling mode.
+*/
+   pinctrl-names = "default";
+   pinctrl-0 = <&tps65090_irq>;
+
+   vsys1-supply = <&vbat>;
+  

[PATCH 3.14 19/68] team: fix mtu setting

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Jiri Pirko 

[ Upstream commit 9d0d68faea6962d62dd501cd6e71ce5cc8ed262b ]

Now it is not possible to set mtu to team device which has a port
enslaved to it. The reason is that when team_change_mtu() calls
dev_set_mtu() for port device, notificator for NETDEV_PRECHANGEMTU
event is called and team_device_event() returns NOTIFY_BAD forbidding
the change. So fix this by returning NOTIFY_DONE here in case team is
changing mtu in team_change_mtu().

Introduced-by: 3d249d4c "net: introduce ethernet teaming device"
Signed-off-by: Jiri Pirko 
Acked-by: Flavio Leitner 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/team/team.c |7 ++-
 include/linux/if_team.h |1 +
 2 files changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1732,6 +1732,7 @@ static int team_change_mtu(struct net_de
 * to traverse list in reverse under rcu_read_lock
 */
mutex_lock(&team->lock);
+   team->port_mtu_change_allowed = true;
list_for_each_entry(port, &team->port_list, list) {
err = dev_set_mtu(port->dev, new_mtu);
if (err) {
@@ -1740,6 +1741,7 @@ static int team_change_mtu(struct net_de
goto unwind;
}
}
+   team->port_mtu_change_allowed = false;
mutex_unlock(&team->lock);
 
dev->mtu = new_mtu;
@@ -1749,6 +1751,7 @@ static int team_change_mtu(struct net_de
 unwind:
list_for_each_entry_continue_reverse(port, &team->port_list, list)
dev_set_mtu(port->dev, dev->mtu);
+   team->port_mtu_change_allowed = false;
mutex_unlock(&team->lock);
 
return err;
@@ -2857,7 +2860,9 @@ static int team_device_event(struct noti
break;
case NETDEV_PRECHANGEMTU:
/* Forbid to change mtu of underlaying device */
-   return NOTIFY_BAD;
+   if (!port->team->port_mtu_change_allowed)
+   return NOTIFY_BAD;
+   break;
case NETDEV_PRE_TYPE_CHANGE:
/* Forbid to change type of underlaying device */
return NOTIFY_BAD;
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -194,6 +194,7 @@ struct team {
bool user_carrier_enabled;
bool queue_override_enabled;
struct list_head *qom_lists; /* array of queue override mapping lists */
+   bool port_mtu_change_allowed;
struct {
unsigned int count;
unsigned int interval; /* in ms */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 10/68] net: Add variants of capable for use on netlink messages

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: "Eric W. Biederman" 

[ Upstream commit aa4cf9452f469f16cea8c96283b641b4576d4a7b ]

netlink_net_capable - The common case use, for operations that are safe on a 
network namespace
netlink_capable - For operations that are only known to be safe for the global 
root
netlink_ns_capable - The general case of capable used to handle special cases

__netlink_ns_capable - Same as netlink_ns_capable except taking a 
netlink_skb_parms instead of
   the skbuff of a netlink message.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 include/linux/netlink.h  |7 +
 net/netlink/af_netlink.c |   65 +++
 2 files changed, 72 insertions(+)

--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -169,4 +169,11 @@ struct netlink_tap {
 extern int netlink_add_tap(struct netlink_tap *nt);
 extern int netlink_remove_tap(struct netlink_tap *nt);
 
+bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
+ struct user_namespace *ns, int cap);
+bool netlink_ns_capable(const struct sk_buff *skb,
+   struct user_namespace *ns, int cap);
+bool netlink_capable(const struct sk_buff *skb, int cap);
+bool netlink_net_capable(const struct sk_buff *skb, int cap);
+
 #endif /* __LINUX_NETLINK_H */
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1360,6 +1360,71 @@ retry:
return err;
 }
 
+/**
+ * __netlink_ns_capable - General netlink message capability test
+ * @nsp: NETLINK_CB of the socket buffer holding a netlink command from 
userspace.
+ * @user_ns: The user namespace of the capability to use
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap in the user namespace @user_ns.
+ */
+bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
+   struct user_namespace *user_ns, int cap)
+{
+   return sk_ns_capable(nsp->sk, user_ns, cap);
+}
+EXPORT_SYMBOL(__netlink_ns_capable);
+
+/**
+ * netlink_ns_capable - General netlink message capability test
+ * @skb: socket buffer holding a netlink command from userspace
+ * @user_ns: The user namespace of the capability to use
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap in the user namespace @user_ns.
+ */
+bool netlink_ns_capable(const struct sk_buff *skb,
+   struct user_namespace *user_ns, int cap)
+{
+   return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);
+}
+EXPORT_SYMBOL(netlink_ns_capable);
+
+/**
+ * netlink_capable - Netlink global message capability test
+ * @skb: socket buffer holding a netlink command from userspace
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap in all user namespaces.
+ */
+bool netlink_capable(const struct sk_buff *skb, int cap)
+{
+   return netlink_ns_capable(skb, &init_user_ns, cap);
+}
+EXPORT_SYMBOL(netlink_capable);
+
+/**
+ * netlink_net_capable - Netlink network namespace message capability test
+ * @skb: socket buffer holding a netlink command from userspace
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap over the network namespace of
+ * the socket we received the message from.
+ */
+bool netlink_net_capable(const struct sk_buff *skb, int cap)
+{
+   return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);
+}
+EXPORT_SYMBOL(netlink_net_capable);
+
 static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
 {
return (nl_table[sock->sk->sk_protocol].flags & flag) ||


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 12/68] netlink: Only check file credentials for implicit destinations

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: "Eric W. Biederman" 

[ Upstream commit 2d7a85f4b06e9c27ff629f07a524c48074f07f81 ]

It was possible to get a setuid root or setcap executable to write to
it's stdout or stderr (which has been set made a netlink socket) and
inadvertently reconfigure the networking stack.

To prevent this we check that both the creator of the socket and
the currentl applications has permission to reconfigure the network
stack.

Unfortunately this breaks Zebra which always uses sendto/sendmsg
and creates it's socket without any privileges.

To keep Zebra working don't bother checking if the creator of the
socket has privilege when a destination address is specified.  Instead
rely exclusively on the privileges of the sender of the socket.

Note from Andy: This is exactly Eric's code except for some comment
clarifications and formatting fixes.  Neither I nor, I think, anyone
else is thrilled with this approach, but I'm hesitant to wait on a
better fix since 3.15 is almost here.

Note to stable maintainers: This is a mess.  An earlier series of
patches in 3.15 fix a rather serious security issue (CVE-2014-0181),
but they did so in a way that breaks Zebra.  The offending series
includes:

commit aa4cf9452f469f16cea8c96283b641b4576d4a7b
Author: Eric W. Biederman 
Date:   Wed Apr 23 14:28:03 2014 -0700

net: Add variants of capable for use on netlink messages

If a given kernel version is missing that series of fixes, it's
probably worth backporting it and this patch.  if that series is
present, then this fix is critical if you care about Zebra.

Cc: sta...@vger.kernel.org
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Andy Lutomirski 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 include/linux/netlink.h  |7 ---
 net/netlink/af_netlink.c |7 ++-
 2 files changed, 10 insertions(+), 4 deletions(-)

--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -16,9 +16,10 @@ static inline struct nlmsghdr *nlmsg_hdr
 }
 
 enum netlink_skb_flags {
-   NETLINK_SKB_MMAPED  = 0x1,  /* Packet data is mmaped */
-   NETLINK_SKB_TX  = 0x2,  /* Packet was sent by userspace 
*/
-   NETLINK_SKB_DELIVERED   = 0x4,  /* Packet was delivered */
+   NETLINK_SKB_MMAPED  = 0x1,  /* Packet data is mmaped */
+   NETLINK_SKB_TX  = 0x2,  /* Packet was sent by userspace */
+   NETLINK_SKB_DELIVERED   = 0x4,  /* Packet was delivered */
+   NETLINK_SKB_DST = 0x8,  /* Dst set in sendto or sendmsg */
 };
 
 struct netlink_skb_parms {
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1373,7 +1373,9 @@ retry:
 bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
struct user_namespace *user_ns, int cap)
 {
-   return sk_ns_capable(nsp->sk, user_ns, cap);
+   return ((nsp->flags & NETLINK_SKB_DST) ||
+   file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
+   ns_capable(user_ns, cap);
 }
 EXPORT_SYMBOL(__netlink_ns_capable);
 
@@ -2293,6 +2295,7 @@ static int netlink_sendmsg(struct kiocb
struct sk_buff *skb;
int err;
struct scm_cookie scm;
+   u32 netlink_skb_flags = 0;
 
if (msg->msg_flags&MSG_OOB)
return -EOPNOTSUPP;
@@ -2314,6 +2317,7 @@ static int netlink_sendmsg(struct kiocb
if ((dst_group || dst_portid) &&
!netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
goto out;
+   netlink_skb_flags |= NETLINK_SKB_DST;
} else {
dst_portid = nlk->dst_portid;
dst_group = nlk->dst_group;
@@ -2343,6 +2347,7 @@ static int netlink_sendmsg(struct kiocb
NETLINK_CB(skb).portid  = nlk->portid;
NETLINK_CB(skb).dst_group = dst_group;
NETLINK_CB(skb).creds   = siocb->scm->creds;
+   NETLINK_CB(skb).flags   = netlink_skb_flags;
 
err = -EFAULT;
if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: mm: shm: hang in shmem_fallocate

[Vlastimil Babka]

On 06/16/2014 04:29 AM, Hugh Dickins wrote:
> On Thu, 12 Jun 2014, Sasha Levin wrote:
>> On 02/09/2014 08:41 PM, Sasha Levin wrote:
>>> On 02/08/2014 10:25 PM, Hugh Dickins wrote:
 Would trinity be likely to have a thread or process repeatedly faulting
 in pages from the hole while it is being punched?
>>>
>>> I can see how trinity would do that, but just to be certain - Cc davej.
>>>
>>> On 02/08/2014 10:25 PM, Hugh Dickins wrote:
 Does this happen with other holepunch filesystems?  If it does not,
 I'd suppose it's because the tmpfs fault-in-newly-created-page path
 is lighter than a consistent disk-based filesystem's has to be.
 But we don't want to make the tmpfs path heavier to match them.
>>>
>>> No, this is strictly limited to tmpfs, and AFAIK trinity tests hole
>>> punching in other filesystems and I make sure to get a bunch of those
>>> mounted before starting testing.
>>
>> Just pinging this one again. I still see hangs in -next where the hang
>> location looks same as before:
>>
> 
> Please give this patch a try.  It fixes what I can reproduce, but given
> your unexplained page_mapped() BUG in this area, we know there's more
> yet to be understood, so perhaps this patch won't do enough for you.
> 

Hi,

since this got a CVE, I've been looking at backport to an older kernel where
fallocate(FALLOC_FL_PUNCH_HOLE) is not yet supported, and there's also no
range notification mechanism yet. There's just madvise(MADV_REMOVE) and since
it doesn't guarantee anything, it seems simpler just to give up retrying to
truncate really everything. Then I realized that maybe it would work for
current kernel as well, without having to add any checks in the page fault
path. The semantics of fallocate(FALLOC_FL_PUNCH_HOLE) might look different
from madvise(MADV_REMOVE), but it seems to me that as long as it does discard
the old data from the range, it's fine from any information leak point of view.
If someone races page faulting, it IMHO doesn't matter if he gets a new zeroed
page before the parallel truncate has ended, or right after it has ended.
So I'm posting it here as a RFC. I haven't thought about the
i915_gem_object_truncate caller yet. I think that this path wouldn't satisfy
the new "lstart < inode->i_size" condition, but I don't know if it's 
"vulnerable"
to the problem.

-8<-
From: Vlastimil Babka 
Subject: [RFC PATCH] shmem: prevent livelock between page fault and hole 
punching

---
 mm/shmem.c | 19 +++
 1 file changed, 19 insertions(+)

diff --git a/mm/shmem.c b/mm/shmem.c
index f484c27..6d6005c 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -476,6 +476,25 @@ static void shmem_undo_range(struct inode *inode, loff_t 
lstart, loff_t lend,
if (!pvec.nr) {
if (index == start || unfalloc)
break;
+/* 
+ * When this condition is true, it means we were
+ * called from fallocate(FALLOC_FL_PUNCH_HOLE).
+ * To prevent a livelock when someone else is faulting
+ * pages back, we are content with single pass and do
+ * not retry with index = start. It's important that
+ * previous page content has been discarded, and
+ * faulter(s) got new zeroed pages.
+ *
+ * The other callsites are shmem_setattr (for
+ * truncation) and shmem_evict_inode, which set i_size
+ * to truncated size or 0, respectively, and then call
+ * us with lstart == inode->i_size. There we do want to
+ * retry, and livelock cannot happen for other reasons.
+ *
+ * XXX what about i915_gem_object_truncate?
+ */
+if (lstart < inode->i_size)
+break;
index = start;
continue;
}
-- 
1.8.4.5




--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 09/68] net: Add variants of capable for use on on sockets

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: "Eric W. Biederman" 

[ Upstream commit a3b299da869d6e78cf42ae0b1b41797bcb8c5e4b ]

sk_net_capable - The common case, operations that are safe in a network 
namespace.
sk_capable - Operations that are not known to be safe in a network namespace
sk_ns_capable - The general case for special cases.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 include/net/sock.h |5 +
 net/core/sock.c|   49 +
 2 files changed, 54 insertions(+)

--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2278,6 +2278,11 @@ int sock_get_timestampns(struct sock *,
 int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len, int level,
   int type);
 
+bool sk_ns_capable(const struct sock *sk,
+  struct user_namespace *user_ns, int cap);
+bool sk_capable(const struct sock *sk, int cap);
+bool sk_net_capable(const struct sock *sk, int cap);
+
 /*
  * Enable debug/info messages
  */
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -145,6 +145,55 @@
 static DEFINE_MUTEX(proto_list_mutex);
 static LIST_HEAD(proto_list);
 
+/**
+ * sk_ns_capable - General socket capability test
+ * @sk: Socket to use a capability on or through
+ * @user_ns: The user namespace of the capability to use
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket had when the socket was
+ * created and the current process has the capability @cap in the user
+ * namespace @user_ns.
+ */
+bool sk_ns_capable(const struct sock *sk,
+  struct user_namespace *user_ns, int cap)
+{
+   return file_ns_capable(sk->sk_socket->file, user_ns, cap) &&
+   ns_capable(user_ns, cap);
+}
+EXPORT_SYMBOL(sk_ns_capable);
+
+/**
+ * sk_capable - Socket global capability test
+ * @sk: Socket to use a capability on or through
+ * @cap: The global capbility to use
+ *
+ * Test to see if the opener of the socket had when the socket was
+ * created and the current process has the capability @cap in all user
+ * namespaces.
+ */
+bool sk_capable(const struct sock *sk, int cap)
+{
+   return sk_ns_capable(sk, &init_user_ns, cap);
+}
+EXPORT_SYMBOL(sk_capable);
+
+/**
+ * sk_net_capable - Network namespace socket capability test
+ * @sk: Socket to use a capability on or through
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket had when the socke was created
+ * and the current process has the capability @cap over the network namespace
+ * the socket is a member of.
+ */
+bool sk_net_capable(const struct sock *sk, int cap)
+{
+   return sk_ns_capable(sk, sock_net(sk)->user_ns, cap);
+}
+EXPORT_SYMBOL(sk_net_capable);
+
+
 #ifdef CONFIG_MEMCG_KMEM
 int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH -mm 3/3] page-cgroup: fix flags definition

[Vladimir Davydov]

Since commit a9ce315aaec1f ("mm: memcontrol: rewrite uncharge API"),
PCG_* flags are used as bit masks, but they are still defined in a enum
as bit numbers. Fix it.

Signed-off-by: Vladimir Davydov 
---
 include/linux/page_cgroup.h |   12 +---
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/include/linux/page_cgroup.h b/include/linux/page_cgroup.h
index fb60e4a466c0..9065a61345a1 100644
--- a/include/linux/page_cgroup.h
+++ b/include/linux/page_cgroup.h
@@ -1,12 +1,10 @@
 #ifndef __LINUX_PAGE_CGROUP_H
 #define __LINUX_PAGE_CGROUP_H
 
-enum {
-   /* flags for mem_cgroup */
-   PCG_USED,   /* This page is charged to a memcg */
-   PCG_MEM,/* This page holds a memory charge */
-   PCG_MEMSW,  /* This page holds a memory+swap charge */
-};
+/* flags for mem_cgroup */
+#define PCG_USED   0x01/* This page is charged to a memcg */
+#define PCG_MEM0x02/* This page holds a memory charge */
+#define PCG_MEMSW  0x04/* This page holds a memory+swap charge */
 
 struct pglist_data;
 
@@ -44,7 +42,7 @@ struct page *lookup_cgroup_page(struct page_cgroup *pc);
 
 static inline int PageCgroupUsed(struct page_cgroup *pc)
 {
-   return test_bit(PCG_USED, &pc->flags);
+   return !!(pc->flags & PCG_USED);
 }
 #else /* !CONFIG_MEMCG */
 struct page_cgroup;
-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 14/68] ipv6: Fix regression caused by efe4208 in udp_v6_mcast_next()

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Sven Wegener 

[ Upstream commit 3bfdc59a6c24608ed23e903f670aaf5f58c7a6f3 ]

Commit efe4208 ("ipv6: make lookups simpler and faster") introduced a
regression in udp_v6_mcast_next(), resulting in multicast packets not
reaching the destination sockets under certain conditions.

The packet's IPv6 addresses are wrongly compared to the IPv6 addresses
from the function's socket argument, which indicates the starting point
for looping, instead of the loop variable. If the addresses from the
first socket do not match the packet's addresses, no socket in the list
will match.

Signed-off-by: Sven Wegener 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv6/udp.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -716,15 +716,15 @@ static struct sock *udp_v6_mcast_next(st
if (inet->inet_dport != rmt_port)
continue;
}
-   if (!ipv6_addr_any(&sk->sk_v6_daddr) &&
-   !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr))
+   if (!ipv6_addr_any(&s->sk_v6_daddr) &&
+   !ipv6_addr_equal(&s->sk_v6_daddr, rmt_addr))
continue;
 
if (s->sk_bound_dev_if && s->sk_bound_dev_if != dif)
continue;
 
-   if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr)) {
-   if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, 
loc_addr))
+   if (!ipv6_addr_any(&s->sk_v6_rcv_saddr)) {
+   if (!ipv6_addr_equal(&s->sk_v6_rcv_saddr, 
loc_addr))
continue;
}
if (!inet6_mc_check(s, loc_addr, rmt_addr))


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 15/68] netlink: rate-limit leftover bytes warning and print process name

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Michal Schmidt 

[ Upstream commit bfc5184b69cf9eeb286137640351c650c27f118a ]

Any process is able to send netlink messages with leftover bytes.
Make the warning rate-limited to prevent too much log spam.

The warning is supposed to help find userspace bugs, so print the
triggering command name to implicate the buggy program.

[v2: Use pr_warn_ratelimited instead of printk_ratelimited.]

Signed-off-by: Michal Schmidt 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
---
 lib/nlattr.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -201,8 +201,8 @@ int nla_parse(struct nlattr **tb, int ma
}
 
if (unlikely(rem > 0))
-   printk(KERN_WARNING "netlink: %d bytes leftover after parsing "
-  "attributes.\n", rem);
+   pr_warn_ratelimited("netlink: %d bytes leftover after parsing 
attributes in process `%s'.\n",
+   rem, current->comm);
 
err = 0;
 errout:


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 04/68] ima: audit log files opened with O_DIRECT flag

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Mimi Zohar 

commit f9b2a735bdddf836214b5dca74f6ca7712e5a08c upstream.

Files are measured or appraised based on the IMA policy.  When a
file, in policy, is opened with the O_DIRECT flag, a deadlock
occurs.

The first attempt at resolving this lockdep temporarily removed the
O_DIRECT flag and restored it, after calculating the hash.  The
second attempt introduced the O_DIRECT_HAVELOCK flag. Based on this
flag, do_blockdev_direct_IO() would skip taking the i_mutex a second
time.  The third attempt, by Dmitry Kasatkin, resolves the i_mutex
locking issue, by re-introducing the IMA mutex, but uncovered
another problem.  Reading a file with O_DIRECT flag set, writes
directly to userspace pages.  A second patch allocates a user-space
like memory.  This works for all IMA hooks, except ima_file_free(),
which is called on __fput() to recalculate the file hash.

Until this last issue is addressed, do not 'collect' the
measurement for measuring, appraising, or auditing files opened
with the O_DIRECT flag set.  Based on policy, permit or deny file
access.  This patch defines a new IMA policy rule option named
'permit_directio'.  Policy rules could be defined, based on LSM
or other criteria, to permit specific applications to open files
with the O_DIRECT flag set.

Changelog v1:
- permit or deny file access based IMA policy rules

Signed-off-by: Mimi Zohar 
Acked-by: Dmitry Kasatkin 
Signed-off-by: Greg Kroah-Hartman 

---
 Documentation/ABI/testing/ima_policy |2 +-
 security/integrity/ima/ima_api.c |   10 +-
 security/integrity/ima/ima_main.c|5 -
 security/integrity/ima/ima_policy.c  |6 +-
 security/integrity/integrity.h   |1 +
 5 files changed, 20 insertions(+), 4 deletions(-)

--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -23,7 +23,7 @@ Description:
 [fowner]]
lsm:[[subj_user=] [subj_role=] [subj_type=]
 [obj_user=] [obj_role=] [obj_type=]]
-   option: [[appraise_type=]]
+   option: [[appraise_type=]] [permit_directio]
 
base:   func:= 
[BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -199,6 +199,7 @@ int ima_collect_measurement(struct integ
struct evm_ima_xattr_data **xattr_value,
int *xattr_len)
 {
+   const char *audit_cause = "failed";
struct inode *inode = file_inode(file);
const char *filename = file->f_dentry->d_name.name;
int result = 0;
@@ -213,6 +214,12 @@ int ima_collect_measurement(struct integ
if (!(iint->flags & IMA_COLLECTED)) {
u64 i_version = file_inode(file)->i_version;
 
+   if (file->f_flags & O_DIRECT) {
+   audit_cause = "failed(directio)";
+   result = -EACCES;
+   goto out;
+   }
+
/* use default hash algorithm */
hash.hdr.algo = ima_hash_algo;
 
@@ -233,9 +240,10 @@ int ima_collect_measurement(struct integ
result = -ENOMEM;
}
}
+out:
if (result)
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
-   filename, "collect_data", "failed",
+   filename, "collect_data", audit_cause,
result, 0);
return result;
 }
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -217,8 +217,11 @@ static int process_measurement(struct fi
xattr_ptr = &xattr_value;
 
rc = ima_collect_measurement(iint, file, xattr_ptr, &xattr_len);
-   if (rc != 0)
+   if (rc != 0) {
+   if (file->f_flags & O_DIRECT)
+   rc = (iint->flags & IMA_PERMIT_DIRECTIO) ? 0 : -EACCES;
goto out_digsig;
+   }
 
pathname = !filename ? ima_d_path(&file->f_path, &pathbuf) : filename;
if (!pathname)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -351,7 +351,7 @@ enum {
Opt_obj_user, Opt_obj_role, Opt_obj_type,
Opt_subj_user, Opt_subj_role, Opt_subj_type,
Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner,
-   Opt_appraise_type, Opt_fsuuid
+   Opt_appraise_type, Opt_fsuuid, Opt_permit_directio
 };
 
 static match_table_t policy_tokens = {
@@ -373,6 +373,7 @@ static match_table_t policy_tokens = {
{Opt_uid, "uid=%s"},
{Opt_fowner, "fowner=%s"},
{Opt_appraise_type, "appraise_type=%s"},
+   {Opt_permit_directio, "permit_directio"},

[PATCH -mm 2/3] page-cgroup: get rid of NR_PCG_FLAGS

[Vladimir Davydov]

It's not used anywhere today, so let's remove it.

Signed-off-by: Vladimir Davydov 
---
 include/linux/page_cgroup.h |6 --
 kernel/bounds.c |2 --
 2 files changed, 8 deletions(-)

diff --git a/include/linux/page_cgroup.h b/include/linux/page_cgroup.h
index 23863edb95ff..fb60e4a466c0 100644
--- a/include/linux/page_cgroup.h
+++ b/include/linux/page_cgroup.h
@@ -6,12 +6,8 @@ enum {
PCG_USED,   /* This page is charged to a memcg */
PCG_MEM,/* This page holds a memory charge */
PCG_MEMSW,  /* This page holds a memory+swap charge */
-   __NR_PCG_FLAGS,
 };
 
-#ifndef __GENERATING_BOUNDS_H
-#include 
-
 struct pglist_data;
 
 #ifdef CONFIG_MEMCG
@@ -107,6 +103,4 @@ static inline void swap_cgroup_swapoff(int type)
 
 #endif /* CONFIG_MEMCG_SWAP */
 
-#endif /* !__GENERATING_BOUNDS_H */
-
 #endif /* __LINUX_PAGE_CGROUP_H */
diff --git a/kernel/bounds.c b/kernel/bounds.c
index 9fd4246b04b8..e1d1d1952bfa 100644
--- a/kernel/bounds.c
+++ b/kernel/bounds.c
@@ -9,7 +9,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 
@@ -18,7 +17,6 @@ void foo(void)
/* The enum constants to put into include/generated/bounds.h */
DEFINE(NR_PAGEFLAGS, __NR_PAGEFLAGS);
DEFINE(MAX_NR_ZONES, __MAX_NR_ZONES);
-   DEFINE(NR_PCG_FLAGS, __NR_PCG_FLAGS);
 #ifdef CONFIG_SMP
DEFINE(NR_CPUS_BITS, ilog2(CONFIG_NR_CPUS));
 #endif
-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 06/68] evm: prohibit userspace writing security.evm HMAC value

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Mimi Zohar 

commit 2fb1c9a4f2dbc2f0bd2431c7fa64d0b5483864e4 upstream.

Calculating the 'security.evm' HMAC value requires access to the
EVM encrypted key.  Only the kernel should have access to it.  This
patch prevents userspace tools(eg. setfattr, cp --preserve=xattr)
from setting/modifying the 'security.evm' HMAC value directly.

Signed-off-by: Mimi Zohar 
Signed-off-by: Greg Kroah-Hartman 

---
 security/integrity/evm/evm_main.c |   12 ++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -285,12 +285,20 @@ out:
  * @xattr_value: pointer to the new extended attribute value
  * @xattr_value_len: pointer to the new extended attribute value length
  *
- * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that
- * the current value is valid.
+ * Before allowing the 'security.evm' protected xattr to be updated,
+ * verify the existing value is valid.  As only the kernel should have
+ * access to the EVM encrypted key needed to calculate the HMAC, prevent
+ * userspace from writing HMAC value.  Writing 'security.evm' requires
+ * requires CAP_SYS_ADMIN privileges.
  */
 int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
   const void *xattr_value, size_t xattr_value_len)
 {
+   const struct evm_ima_xattr_data *xattr_data = xattr_value;
+
+   if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0)
+   && (xattr_data->type == EVM_XATTR_HMAC))
+   return -EPERM;
return evm_protect_xattr(dentry, xattr_name, xattr_value,
 xattr_value_len);
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH v2] ARM: dts: Add cros_ec to exynos5420-peach-pit and exynos5800-peach-pi

[Javier Martinez Canillas]

Hello Doug,

On 06/24/2014 06:28 PM, Doug Anderson wrote:
> Tushar,
> 
> On Mon, Jun 23, 2014 at 11:43 PM, Tushar Behera  wrote:
>> On 06/24/2014 02:19 AM, Doug Anderson wrote:
>>> This adds cros_ec to exynos5420-peach-pit and exynos5800-peach-pi,
>>> including:
>>> * The keyboard
>>> * The i2c tunnel
>>> * The tps65090 under the i2c tunnel
>>> * The battery under the i2c tunnel
>>>
>>> To add extra motivation, it should be noted that tps65090 is one of
>>> the things needed to get display-related FETs turned on for pit and
>>> pi.
>>>
>>> Note that this relies on a few outstanding changes:
>>> * Needs (spi: s3c64xx: fix broken "cs_gpios" usage in the driver) and
>>>   (spi: s3c64xx: for DT platofrms always get the chipselect info from
>>>   DT node) to work properly and match the documented bindings.  See
>>>    and
>>>   
>>>
>>> Signed-off-by: Doug Anderson 
>>> Tested-by: Javier Martinez Canillas 
>>
>> Along with the dependency patches on next-20140623, tested keyboard on
>> Peach-Pi board.
>>
>> Tested-by: Tushar Behera 
>>
>> Some comments below.
>>
>>> ---
>>> Changes in v2:
>>> - Now just one patch since mfd patch landed.
>>> - Rebased to ToT linux-next
>>>
>>>  arch/arm/boot/dts/exynos5420-peach-pit.dts | 145 
>>> +
>>>  arch/arm/boot/dts/exynos5800-peach-pi.dts  | 145 
>>> +
>>>  2 files changed, 290 insertions(+)
>>>
>>> diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts 
>>> b/arch/arm/boot/dts/exynos5420-peach-pit.dts
>>> index 7649982..581f385 100644
>>> --- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
>>> +++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
>>
>>> + regulators {
>>> + dcdc1 {
>>> + ti,enable-ext-control;
>>> + };
>>> + dcdc2 {
>>> + ti,enable-ext-control;
>>> + };
>>> + dcdc3 {
>>> + ti,enable-ext-control;
>>> + };
>>> + fet1 {
>>
>> "tps65090_fet1: fet1 {" ?
>>
>>> + regulator-name = "vcd_led";
>>> + };
>>> + tps65090_fet2: fet2 {
>>
>> I would suggest we add similar labels to fet1, fet3, fet4, fet5 and fet6
>> also. That way it would be easy to reference them in subsequent DT nodes.
>>
>> Same comment for Peach-Pi dts file too.
> 
> OK.  I added it to all the regulators in tps65090.  That'll probably
> be useful for Javier in his max77802 work.
>

Thanks, in fact I did add both tps65090_dcdc1 and tps65090_dcdc2 labels to be
able to use these regulators as supply for some of the max77802 regulators.

Will rebase on top of this.

Best regards,
Javier

> -Doug
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [RFT 0/3] cxgb4: use request_firmware_nowait()

[Casey Leedom]

On 06/24/14 08:55, Casey Leedom wrote:


On 06/23/14 17:29, Luis R. Rodriguez wrote:

On Mon, Jun 23, 2014 at 12:06:48PM -0700, Casey Leedom wrote:


Also, it might be useful if there was a way for the driver
module to "tell" the timeout mechanism that forward progress _is_ being
made so it doesn't blow away the driver module load.

Indeed if this is actually needed, but believe the issue here for the
huge delays might be instead the lack of not using 
request_firmware_direct()
and actual device initialization time, which I do not believe we 
penalize,

we should be penalizing only the amount of time it takes either the
kernel or udev to read the firmware from the filesystem.


  If you want I can time the actual phases of loading new firmware: 
request_firmware(), writing it to FLASH, release_firmware() ...


  So I just did this for a normal modprobe (after the system is up):

JiffiesProcess
---
  0begin firmware load process
  3request_firmware() returns
  7start looking at the adapter
 10finish reading the first sector of existing adapter firmware
 26we've decided that we're going to upgrade the firmware
 28actual firmware upgrade process starts
448we've finished halting the adapter processor
451we enter the firmware write routine
  8,470we've finished erasing the firmware FLASH sectors
 14,336write of new firmware is complete
 14,340the new firmware load is complete
 14,949the adapter processor has been restarted; new firmware running
 14,952firmware upgrade process complete

Maybe request_firmware() takes more time during the boot phase but as we 
can see from the above timings, it's the actual firmware upgrade process 
which takes the most time ...


Casey
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 05/68] ima: introduce ima_kernel_read()

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Kasatkin 

commit 0430e49b6e7c6b5e076be8fefdee089958c9adad upstream.

Commit 8aac62706 "move exit_task_namespaces() outside of exit_notify"
introduced the kernel opps since the kernel v3.10, which happens when
Apparmor and IMA-appraisal are enabled at the same time.

--
[  106.750167] BUG: unable to handle kernel NULL pointer dereference at
0018
[  106.750221] IP: [] our_mnt+0x1a/0x30
[  106.750241] PGD 0
[  106.750254] Oops:  [#1] SMP
[  106.750272] Modules linked in: cuse parport_pc ppdev bnep rfcomm
bluetooth rpcsec_gss_krb5 nfsd auth_rpcgss nfs_acl nfs lockd sunrpc
fscache dm_crypt intel_rapl x86_pkg_temp_thermal intel_powerclamp
kvm_intel snd_hda_codec_hdmi kvm crct10dif_pclmul crc32_pclmul
ghash_clmulni_intel aesni_intel aes_x86_64 glue_helper lrw gf128mul
ablk_helper cryptd snd_hda_codec_realtek dcdbas snd_hda_intel
snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_seq_midi
snd_seq_midi_event snd_rawmidi psmouse snd_seq microcode serio_raw
snd_timer snd_seq_device snd soundcore video lpc_ich coretemp mac_hid lp
parport mei_me mei nbd hid_generic e1000e usbhid ahci ptp hid libahci
pps_core
[  106.750658] CPU: 6 PID: 1394 Comm: mysqld Not tainted 3.13.0-rc7-kds+ #15
[  106.750673] Hardware name: Dell Inc. OptiPlex 9010/0M9KCM, BIOS A08
09/19/2012
[  106.750689] task: 8800de804920 ti: 880400fca000 task.ti:
880400fca000
[  106.750704] RIP: 0010:[]  []
our_mnt+0x1a/0x30
[  106.750725] RSP: 0018:880400fcba60  EFLAGS: 00010286
[  106.750738] RAX:  RBX: 0100 RCX:
8800d51523e7
[  106.750764] RDX: ffea RSI: 880400fcba34 RDI:
880402d20020
[  106.750791] RBP: 880400fcbae0 R08:  R09:
0001
[  106.750817] R10:  R11: 0001 R12:
8800d5152300
[  106.750844] R13: 8803eb8df510 R14: 880400fcbb28 R15:
8800d51523e7
[  106.750871] FS:  () GS:88040d20()
knlGS:
[  106.750910] CS:  0010 DS:  ES:  CR0: 80050033
[  106.750935] CR2: 0018 CR3: 01c0e000 CR4:
001407e0
[  106.750962] Stack:
[  106.750981]  813434eb 880400fcbb20 880400fcbb18

[  106.751037]  8800de804920 8101b9b9 00018000
0100
[  106.751093]  0100 0002 000e
8803eb8df500
[  106.751149] Call Trace:
[  106.751172]  [] ? aa_path_name+0x2ab/0x430
[  106.751199]  [] ? sched_clock+0x9/0x10
[  106.751225]  [] aa_path_perm+0x7d/0x170
[  106.751250]  [] ? native_sched_clock+0x15/0x80
[  106.751276]  [] aa_file_perm+0x33/0x40
[  106.751301]  [] common_file_perm+0x8e/0xb0
[  106.751327]  [] apparmor_file_permission+0x18/0x20
[  106.751355]  [] security_file_permission+0x23/0xa0
[  106.751382]  [] rw_verify_area+0x52/0xe0
[  106.751407]  [] vfs_read+0x6d/0x170
[  106.751432]  [] kernel_read+0x41/0x60
[  106.751457]  [] ima_calc_file_hash+0x225/0x280
[  106.751483]  [] ? ima_calc_file_hash+0x32/0x280
[  106.751509]  [] ima_collect_measurement+0x9d/0x160
[  106.751536]  [] ? trace_hardirqs_on+0xd/0x10
[  106.751562]  [] ? ima_file_free+0x6c/0xd0
[  106.751587]  [] ima_update_xattr+0x34/0x60
[  106.751612]  [] ima_file_free+0xc0/0xd0
[  106.751637]  [] __fput+0xd5/0x300
[  106.751662]  [] fput+0xe/0x10
[  106.751687]  [] task_work_run+0xc4/0xe0
[  106.751712]  [] do_exit+0x2bd/0xa90
[  106.751738]  [] ? retint_swapgs+0x13/0x1b
[  106.751763]  [] do_group_exit+0x4c/0xc0
[  106.751788]  [] SyS_exit_group+0x14/0x20
[  106.751814]  [] system_call_fastpath+0x1a/0x1f
[  106.751839] Code: c3 0f 1f 44 00 00 55 48 89 e5 e8 22 fe ff ff 5d c3
0f 1f 44 00 00 55 65 48 8b 04 25 c0 c9 00 00 48 8b 80 28 06 00 00 48 89
e5 5d <48> 8b 40 18 48 39 87 c0 00 00 00 0f 94 c0 c3 0f 1f 80 00 00 00
[  106.752185] RIP  [] our_mnt+0x1a/0x30
[  106.752214]  RSP 
[  106.752236] CR2: 0018
[  106.752258] ---[ end trace 3c520748b4732721 ]---
--

The reason for the oops is that IMA-appraisal uses "kernel_read()" when
file is closed. kernel_read() honors LSM security hook which calls
Apparmor handler, which uses current->nsproxy->mnt_ns. The 'guilty'
commit changed the order of cleanup code so that nsproxy->mnt_ns was
not already available for Apparmor.

Discussion about the issue with Al Viro and Eric W. Biederman suggested
that kernel_read() is too high-level for IMA. Another issue, except
security checking, that was identified is mandatory locking. kernel_read
honors it as well and it might prevent IMA from calculating necessary hash.
It was suggested to use simplified version of the function without security
and locking checks.

This patch introduces special version ima_kernel_read(), which skips security
a

[PATCH 3.14 00/68] 3.14.9-stable review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 3.14.9 release.
There are 68 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu Jun 26 15:47:04 UTC 2014.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.14.9-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-
Pseudo-Shortlog of commits:

Greg Kroah-Hartman 
Linux 3.14.9-rc1

Lars-Peter Clausen 
ALSA: control: Make sure that id->index does not overflow

Lars-Peter Clausen 
ALSA: control: Handle numid overflow

Lars-Peter Clausen 
ALSA: control: Don't access controls outside of protected regions

Lars-Peter Clausen 
ALSA: control: Fix replacing user controls

Lars-Peter Clausen 
ALSA: control: Protect user controls against concurrent access

David Henningsson 
ALSA: hda - Add quirk for external mic on Lifebook U904

Kailang Yang 
ALSA: hda/realtek - Add more entry for enable HP mute led

Kailang Yang 
ALSA: hda/realtek - Add support of ALC891 codec

Wang, Xiaoming 
ALSA: compress: Cancel the optimization of compiler and fix the size of 
struct for all platform.

Greg Kroah-Hartman 
lz4: ensure length does not wrap

Greg Kroah-Hartman 
lzo: properly check for overruns

Peter Meerwald 
iio: Fix two mpl3115 issues in measurement conversion

Peter Meerwald 
iio: Fix endianness issue in ak8975_read_axis()

Dan Carpenter 
iio: adc: at91: signedness bug in at91_adc_get_trigger_value_by_name()

Robert Hodaszi 
iio: mxs-lradc: fix divider

Mario Schuknecht 
staging: iio: tsl2x7x_core: fix proximity treshold

Jonathan Cameron 
iio:adc:max1363 incorrect resolutions for max11604, max11605, max11610 and 
max11611.

Peter Ujfalusi 
ASoC: tlv320aci3x: Fix custom snd_soc_dapm_put_volsw_aic3x() function

Liam Girdwood 
ASoC: max98090: Fix reset at resume time

Lars-Peter Clausen 
ASoC: dapm: Make sure to always update the DAPM graph in _put_volsw()

Radim Krčmář 
hv: use correct order when freeing monitor_pages

K. Y. Srinivasan 
Drivers: hv: balloon: Ensure pressure reports are posted regularly

Johan Hovold 
USB: cdc-acm: fix runtime PM imbalance at shutdown

Johan Hovold 
USB: cdc-acm: fix I/O after failed open

Johan Hovold 
USB: cdc-acm: fix potential urb leak and PM imbalance in write

Johan Hovold 
USB: cdc-acm: fix shutdown and suspend race

Johan Hovold 
USB: cdc-acm: fix runtime PM for control messages

Johan Hovold 
USB: cdc-acm: fix broken runtime suspend

Johan Hovold 
USB: cdc-acm: fix write and resume race

Johan Hovold 
USB: cdc-acm: fix write and suspend race

James Hogan 
MIPS: KVM: Allocate at least 16KB for exception handlers

Boris BREZILLON 
ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs

Paolo Bonzini 
KVM: lapic: sync highest ISR to hardware apic on EOI

Wei Yang 
net/mlx4_core: Keep only one driver entry release mlx4_priv

Wei Yang 
net/mlx4_core: Preserve pci_dev_data after __mlx4_remove_one()

Eric Dumazet 
udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup

Cong Wang 
vxlan: use dev->needed_headroom instead of dev->hard_header_len

Michal Schmidt 
rtnetlink: fix userspace API breakage for iproute2 < v3.9.0

Xufeng Zhang 
sctp: Fix sk_ack_backlog wrap-around problem

Eric Dumazet 
ipv4: fix a race in ip4_datagram_release_cb()

Jon Cooper 
sfc: PIO:Restrict to 64bit arch and use 64-bit writes.

Dmitry Popov 
ipip, sit: fix ipv4_{update_pmtu,redirect} calls

Eric Dumazet 
net: force a list_del() in unregister_netdevice_many()

Bjørn Mork 
net: qmi_wwan: add Olivetti Olicard modems

Alexei Starovoitov 
net: filter: fix sparc32 typo

Alexei Starovoitov 
net: filter: fix typo in sparc BPF JIT

Sergei Shtylyov 
sh_eth: fix SH7619/771x support

Ben Dooks 
sh_eth: use RNC mode for packet reception

Yuchung Cheng 
tcp: fix cwnd undo on DSACK in F-RTO

Jiri Pirko 
team: fix mtu setting

Eric Dumazet 
net: fix inet_getid() and ipv6_select_ident() bugs

Tom Gundersen 
net: tunnels - enable module autoloading

Toshiaki Makita 
bridge: Prevent insertion of FDB entry with disallowed vlan

Michal Schmidt 
netlink: rate-limit leftover bytes warning and print process name

Sven Wegener 
ipv6: Fix regression caused by efe4208 in udp_v6_mcast_next()

Dan Carpenter 
qlcnic: info leak in qlcnic_dcb_peer_app_info()

Eric W. Biederman 
netlink: Only check file credentials for implicit destinations

Eric W. Biederman 
net: Use netlink_ns_capable to verify the permisions of netlink messages

Eric W. Biederman 
net: Add variants of capable for use on netlink messages

Eric W. Biederman 
net: Add variants of capable for use on on sockets

Eric W. Bie

[PATCH 3.10 39/52] iio:adc:max1363 incorrect resolutions for max11604, max11605, max11610 and max11611.

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Jonathan Cameron 

commit a91a73c8b39a6b8bcc53fafa5372c65387c81233 upstream.

Reported-by: Erik Habbinga 
Signed-off-by: Jonathan Cameron 
Acked-by: Hartmut Knaack 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/iio/adc/max1363.c |   16 
 1 file changed, 8 insertions(+), 8 deletions(-)

--- a/drivers/iio/adc/max1363.c
+++ b/drivers/iio/adc/max1363.c
@@ -1214,8 +1214,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1038_channels,
+   .num_channels = ARRAY_SIZE(max1038_channels),
},
[max11605] = {
.bits = 8,
@@ -1224,8 +1224,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1038_channels,
+   .num_channels = ARRAY_SIZE(max1038_channels),
},
[max11606] = {
.bits = 10,
@@ -1274,8 +1274,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1138_channels,
+   .num_channels = ARRAY_SIZE(max1138_channels),
},
[max11611] = {
.bits = 10,
@@ -1284,8 +1284,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1138_channels,
+   .num_channels = ARRAY_SIZE(max1138_channels),
},
[max11612] = {
.bits = 12,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 37/52] Drivers: hv: balloon: Ensure pressure reports are posted regularly

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: "K. Y. Srinivasan" 

commit ae339336dc950b9b05e7ccd3565dd3e8781c06d9 upstream.

The current code posts periodic memory pressure status from a dedicated thread.
Under some conditions, especially when we are releasing a lot of memory into
the guest, we may not send timely pressure reports back to the host. Fix this
issue by reporting pressure in all contexts that can be active in this driver.

Signed-off-by: K. Y. Srinivasan 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/hv/hv_balloon.c |   29 ++---
 1 file changed, 26 insertions(+), 3 deletions(-)

--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -19,6 +19,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -459,6 +460,11 @@ static bool do_hot_add;
  */
 static uint pressure_report_delay = 45;
 
+/*
+ * The last time we posted a pressure report to host.
+ */
+static unsigned long last_post_time;
+
 module_param(hot_add, bool, (S_IRUGO | S_IWUSR));
 MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add");
 
@@ -542,6 +548,7 @@ struct hv_dynmem_device {
 
 static struct hv_dynmem_device dm_device;
 
+static void post_status(struct hv_dynmem_device *dm);
 #ifdef CONFIG_MEMORY_HOTPLUG
 
 static void hv_bring_pgs_online(unsigned long start_pfn, unsigned long size)
@@ -612,7 +619,7 @@ static void hv_mem_hot_add(unsigned long
 * have not been "onlined" within the allowed time.
 */
wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ);
-
+   post_status(&dm_device);
}
 
return;
@@ -951,11 +958,17 @@ static void post_status(struct hv_dynmem
 {
struct dm_status status;
struct sysinfo val;
+   unsigned long now = jiffies;
+   unsigned long last_post = last_post_time;
 
if (pressure_report_delay > 0) {
--pressure_report_delay;
return;
}
+
+   if (!time_after(now, (last_post_time + HZ)))
+   return;
+
si_meminfo(&val);
memset(&status, 0, sizeof(struct dm_status));
status.hdr.type = DM_STATUS_REPORT;
@@ -983,6 +996,14 @@ static void post_status(struct hv_dynmem
if (status.hdr.trans_id != atomic_read(&trans_id))
return;
 
+   /*
+* If the last post time that we sampled has changed,
+* we have raced, don't post the status.
+*/
+   if (last_post != last_post_time)
+   return;
+
+   last_post_time = jiffies;
vmbus_sendpacket(dm->dev->channel, &status,
sizeof(struct dm_status),
(unsigned long)NULL,
@@ -1117,7 +1138,7 @@ static void balloon_up(struct work_struc
 
if (ret == -EAGAIN)
msleep(20);
-
+   post_status(&dm_device);
} while (ret == -EAGAIN);
 
if (ret) {
@@ -1144,8 +1165,10 @@ static void balloon_down(struct hv_dynme
struct dm_unballoon_response resp;
int i;
 
-   for (i = 0; i < range_count; i++)
+   for (i = 0; i < range_count; i++) {
free_balloon_pages(dm, &range_array[i]);
+   post_status(&dm_device);
+   }
 
if (req->more_pages == 1)
return;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 32/52] USB: cdc-acm: fix broken runtime suspend

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 140cb81ac8c625942a1d695875932c615767a526 upstream.

The current ACM runtime-suspend implementation is broken in several
ways:

Firstly, it buffers only the first write request being made while
suspended -- any further writes are silently dropped.

Secondly, writes being dropped also leak write urbs, which are never
reclaimed (until the device is unbound).

Thirdly, even the single buffered write is not cleared at shutdown
(which may happen before the device is resumed), something which can
lead to another urb leak as well as a PM usage-counter leak.

Fix this by implementing a delayed-write queue using urb anchors and
making sure to discard the queue properly at shutdown.

Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")

Reported-by: Xiao Jin 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/class/cdc-acm.c |   32 ++--
 drivers/usb/class/cdc-acm.h |2 +-
 2 files changed, 23 insertions(+), 11 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -233,12 +233,9 @@ static int acm_write_start(struct acm *a
acm->susp_count);
usb_autopm_get_interface_async(acm->control);
if (acm->susp_count) {
-   if (!acm->delayed_wb)
-   acm->delayed_wb = wb;
-   else
-   usb_autopm_put_interface_async(acm->control);
+   usb_anchor_urb(wb->urb, &acm->delayed);
spin_unlock_irqrestore(&acm->write_lock, flags);
-   return 0;   /* A white lie */
+   return 0;
}
usb_mark_last_busy(acm->dev);
 
@@ -591,6 +588,8 @@ static void acm_port_destruct(struct tty
 static void acm_port_shutdown(struct tty_port *port)
 {
struct acm *acm = container_of(port, struct acm, port);
+   struct urb *urb;
+   struct acm_wb *wb;
int i;
 
dev_dbg(&acm->control->dev, "%s\n", __func__);
@@ -599,6 +598,16 @@ static void acm_port_shutdown(struct tty
if (!acm->disconnected) {
usb_autopm_get_interface(acm->control);
acm_set_control(acm, acm->ctrlout = 0);
+
+   for (;;) {
+   urb = usb_get_from_anchor(&acm->delayed);
+   if (!urb)
+   break;
+   wb = urb->context;
+   wb->use = 0;
+   usb_autopm_put_interface_async(acm->control);
+   }
+
usb_kill_urb(acm->ctrlurb);
for (i = 0; i < ACM_NW; i++)
usb_kill_urb(acm->wb[i].urb);
@@ -1190,6 +1199,7 @@ made_compressed_probe:
acm->bInterval = epread->bInterval;
tty_port_init(&acm->port);
acm->port.ops = &acm_port_ops;
+   init_usb_anchor(&acm->delayed);
 
buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
if (!buf) {
@@ -1459,7 +1469,7 @@ static int acm_suspend(struct usb_interf
 static int acm_resume(struct usb_interface *intf)
 {
struct acm *acm = usb_get_intfdata(intf);
-   struct acm_wb *wb;
+   struct urb *urb;
int rv = 0;
 
spin_lock_irq(&acm->read_lock);
@@ -1471,10 +1481,12 @@ static int acm_resume(struct usb_interfa
if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) {
rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC);
 
-   if (acm->delayed_wb) {
-   wb = acm->delayed_wb;
-   acm->delayed_wb = NULL;
-   acm_start_wb(acm, wb);
+   for (;;) {
+   urb = usb_get_from_anchor(&acm->delayed);
+   if (!urb)
+   break;
+
+   acm_start_wb(acm, urb->context);
}
 
/*
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -117,7 +117,7 @@ struct acm {
unsigned int throttled:1;   /* actually throttled */
unsigned int throttle_req:1;/* throttle requested */
u8 bInterval;
-   struct acm_wb *delayed_wb;  /* write queued for a 
device about to be woken */
+   struct usb_anchor delayed;  /* writes queued for a 
device about to be woken */
 };
 
 #define CDC_DATA_INTERFACE_TYPE0x0a


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 35/52] USB: cdc-acm: fix I/O after failed open

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit e4c36076c2a6195ec62c35b03c3fde84d0087dc8 upstream.

Make sure to kill any already submitted read urbs on read-urb submission
failures in open in order to prevent doing I/O for a closed port.

Fixes: 088c64f81284 ("USB: cdc-acm: re-write read processing")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/class/cdc-acm.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -523,6 +523,7 @@ static int acm_port_activate(struct tty_
 {
struct acm *acm = container_of(port, struct acm, port);
int retval = -ENODEV;
+   int i;
 
dev_dbg(&acm->control->dev, "%s\n", __func__);
 
@@ -571,6 +572,8 @@ static int acm_port_activate(struct tty_
return 0;
 
 error_submit_read_urbs:
+   for (i = 0; i < acm->rx_buflimit; i++)
+   usb_kill_urb(acm->read_urbs[i]);
acm->ctrlout = 0;
acm_set_control(acm, acm->ctrlout);
 error_set_control:


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 50/52] ALSA: control: Dont access controls outside of protected regions

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen 

commit fd9f26e4eca5d08a27d12c0933fceef76ed9663d upstream.

A control that is visible on the card->controls list can be freed at any time.
This means we must not access any of its memory while not holding the
controls_rw_lock. Otherwise we risk a use after free access.

Signed-off-by: Lars-Peter Clausen 
Acked-by: Jaroslav Kysela 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/core/control.c |   15 ++-
 1 file changed, 10 insertions(+), 5 deletions(-)

--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -331,6 +331,7 @@ int snd_ctl_add(struct snd_card *card, s
 {
struct snd_ctl_elem_id id;
unsigned int idx;
+   unsigned int count;
int err = -EINVAL;
 
if (! kcontrol)
@@ -359,8 +360,9 @@ int snd_ctl_add(struct snd_card *card, s
card->controls_count += kcontrol->count;
kcontrol->id.numid = card->last_numid + 1;
card->last_numid += kcontrol->count;
+   count = kcontrol->count;
up_write(&card->controls_rwsem);
-   for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
+   for (idx = 0; idx < count; idx++, id.index++, id.numid++)
snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
return 0;
 
@@ -389,6 +391,7 @@ int snd_ctl_replace(struct snd_card *car
bool add_on_replace)
 {
struct snd_ctl_elem_id id;
+   unsigned int count;
unsigned int idx;
struct snd_kcontrol *old;
int ret;
@@ -424,8 +427,9 @@ add:
card->controls_count += kcontrol->count;
kcontrol->id.numid = card->last_numid + 1;
card->last_numid += kcontrol->count;
+   count = kcontrol->count;
up_write(&card->controls_rwsem);
-   for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
+   for (idx = 0; idx < count; idx++, id.index++, id.numid++)
snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
return 0;
 
@@ -898,9 +902,9 @@ static int snd_ctl_elem_write(struct snd
result = kctl->put(kctl, control);
}
if (result > 0) {
+   struct snd_ctl_elem_id id = control->id;
up_read(&card->controls_rwsem);
-   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-  &control->id);
+   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id);
return 0;
}
}
@@ -1334,8 +1338,9 @@ static int snd_ctl_tlv_ioctl(struct snd_
}
err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv);
if (err > 0) {
+   struct snd_ctl_elem_id id = kctl->id;
up_read(&card->controls_rwsem);
-   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, 
&kctl->id);
+   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &id);
return 0;
}
} else {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 49/52] ALSA: control: Fix replacing user controls

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen 

commit 82262a46627bebb0febcc26664746c25cef08563 upstream.

There are two issues with the current implementation for replacing user
controls. The first is that the code does not check if the control is actually a
user control and neither does it check if the control is owned by the process
that tries to remove it. That allows userspace applications to remove arbitrary
controls, which can cause a user after free if a for example a driver does not
expect a control to be removed from under its feed.

The second issue is that on one hand when a control is replaced the
user_ctl_count limit is not checked and on the other hand the user_ctl_count is
increased (even though the number of user controls does not change). This allows
userspace, once the user_ctl_count limit as been reached, to repeatedly replace
a control until user_ctl_count overflows. Once that happens new controls can be
added effectively bypassing the user_ctl_count limit.

Both issues can be fixed by instead of open-coding the removal of the control
that is to be replaced to use snd_ctl_remove_user_ctl(). This function does
proper permission checks as well as decrements user_ctl_count after the control
has been removed.

Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at
beginning of the function if the control already exists is removed. This is not
a problem though since the check is quite useless, because the lock that is
protecting the control list is released between the check and before adding the
new control to the list, which means that it is possible that a different
control with the same settings is added to the list after the check. Luckily
there is another check that is done while holding the lock in snd_ctl_add(), so
we'll rely on that to make sure that the same control is not added twice.

Signed-off-by: Lars-Peter Clausen 
Acked-by: Jaroslav Kysela 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/core/control.c |   25 +
 1 file changed, 9 insertions(+), 16 deletions(-)

--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1155,8 +1155,6 @@ static int snd_ctl_elem_add(struct snd_c
struct user_element *ue;
int idx, err;
 
-   if (!replace && card->user_ctl_count >= MAX_USER_CONTROLS)
-   return -ENOMEM;
if (info->count < 1)
return -EINVAL;
access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
@@ -1165,21 +1163,16 @@ static int snd_ctl_elem_add(struct snd_c
 SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE));
info->id.numid = 0;
memset(&kctl, 0, sizeof(kctl));
-   down_write(&card->controls_rwsem);
-   _kctl = snd_ctl_find_id(card, &info->id);
-   err = 0;
-   if (_kctl) {
-   if (replace)
-   err = snd_ctl_remove(card, _kctl);
-   else
-   err = -EBUSY;
-   } else {
-   if (replace)
-   err = -ENOENT;
+
+   if (replace) {
+   err = snd_ctl_remove_user_ctl(file, &info->id);
+   if (err)
+   return err;
}
-   up_write(&card->controls_rwsem);
-   if (err < 0)
-   return err;
+
+   if (card->user_ctl_count >= MAX_USER_CONTROLS)
+   return -ENOMEM;
+
memcpy(&kctl.id, &info->id, sizeof(info->id));
kctl.count = info->owner ? info->owner : 1;
access |= SNDRV_CTL_ELEM_ACCESS_USER;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 41/52] iio: adc: at91: signedness bug in at91_adc_get_trigger_value_by_name()

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit 4f3bcd878f1d3c730fe00f619b7260c6125d49eb upstream.

at91_adc_get_trigger_value_by_name() was returning -ENOMEM truncated to
a positive u8 and that doesn't work.  I've changed it to int and
refactored it to preserve the error code.

Signed-off-by: Dan Carpenter 
Acked-by: Alexandre Belloni 
Tested-by: Alexandre Belloni 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/iio/adc/at91_adc.c |   16 
 1 file changed, 8 insertions(+), 8 deletions(-)

--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -161,12 +161,11 @@ static int at91_adc_channel_init(struct
return idev->num_channels;
 }
 
-static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
+static int at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
 struct at91_adc_trigger *triggers,
 const char *trigger_name)
 {
struct at91_adc_state *st = iio_priv(idev);
-   u8 value = 0;
int i;
 
for (i = 0; i < st->trigger_number; i++) {
@@ -179,15 +178,16 @@ static u8 at91_adc_get_trigger_value_by_
return -ENOMEM;
 
if (strcmp(trigger_name, name) == 0) {
-   value = triggers[i].value;
kfree(name);
-   break;
+   if (triggers[i].value == 0)
+   return -EINVAL;
+   return triggers[i].value;
}
 
kfree(name);
}
 
-   return value;
+   return -EINVAL;
 }
 
 static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
@@ -197,14 +197,14 @@ static int at91_adc_configure_trigger(st
struct iio_buffer *buffer = idev->buffer;
struct at91_adc_reg_desc *reg = st->registers;
u32 status = at91_adc_readl(st, reg->trigger_register);
-   u8 value;
+   int value;
u8 bit;
 
value = at91_adc_get_trigger_value_by_name(idev,
   st->trigger_list,
   idev->trig->name);
-   if (value == 0)
-   return -EINVAL;
+   if (value < 0)
+   return value;
 
if (state) {
st->buffer = kmalloc(idev->scan_bytes, GFP_KERNEL);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 45/52] ALSA: compress: Cancel the optimization of compiler and fix the size of struct for all platform.

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: "Wang, Xiaoming" 

commit 2bd0ae464a6cf7363bbf72c8545e0aa43caa57f0 upstream.

Cancel the optimization of compiler for struct snd_compr_avail
which size will be 0x1c in 32bit kernel while 0x20 in 64bit
kernel under the optimizer. That will make compaction between
32bit and 64bit. So add packed to fix the size of struct
snd_compr_avail to 0x1c for all platform.

Signed-off-by: Zhang Dongxing 
Signed-off-by: xiaoming wang 
Acked-by: Vinod Koul 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 include/uapi/sound/compress_offload.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/uapi/sound/compress_offload.h
+++ b/include/uapi/sound/compress_offload.h
@@ -80,7 +80,7 @@ struct snd_compr_tstamp {
 struct snd_compr_avail {
__u64 avail;
struct snd_compr_tstamp tstamp;
-};
+} __attribute__((packed));
 
 enum snd_compr_direction {
SND_COMPRESS_PLAYBACK = 0,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 02/68] target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Nicholas Bellinger 

commit 0ed6e189e3f6ac3a25383ed5cc8b0ac24c9b97b7 upstream.

This patch fixes a NULL pointer dereference regression bug that was
introduced with:

commit 1e1110c43b1cda9fe77fc4a04835e460550e6b3c
Author: Mikulas Patocka 
Date:   Sat May 17 06:49:22 2014 -0400

target: fix memory leak on XCOPY

Now that target_put_sess_cmd() -> kref_put_spinlock_irqsave() is
called with a valid se_cmd->cmd_kref, a NULL pointer dereference
is triggered because the XCOPY passthrough commands don't have
an associated se_session pointer.

To address this bug, go ahead and checking for a NULL se_sess pointer
within target_put_sess_cmd(), and call se_cmd->se_tfo->release_cmd()
to release the XCOPY's xcopy_pt_cmd memory.

Reported-by: Thomas Glanzmann 
Cc: Thomas Glanzmann 
Cc: Mikulas Patocka 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/target/target_core_transport.c |4 
 1 file changed, 4 insertions(+)

--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2342,6 +2342,10 @@ static void target_release_cmd_kref(stru
  */
 int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd)
 {
+   if (!se_sess) {
+   se_cmd->se_tfo->release_cmd(se_cmd);
+   return 1;
+   }
return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, 
target_release_cmd_kref,
&se_sess->sess_cmd_lock);
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/