summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2015-09-25Merge tag 'nfs-for-4.3-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfsLinus Torvalds16-95/+172
Pull NFS client bugfixes from Trond Myklebust: "Highlights include: Stable patches: - fix v4.2 SEEK on files over 2 gigs - Fix a layout segment reference leak when pNFS I/O falls back to inband I/O. - Fix recovery of recalled read delegations Bugfixes: - Fix a case where NFSv4 fails to send CLOSE after a server reboot - Fix sunrpc to wait for connections to complete before retrying - Fix sunrpc races between transport connect/disconnect and shutdown - Fix an infinite loop when layoutget fail with BAD_STATEID - nfs/filelayout: Fix NULL reference caused by double freeing of fh_array - Fix a bogus WARN_ON_ONCE() in O_DIRECT when layout commit_through_mds is set - Fix layoutreturn/close ordering issues" * tag 'nfs-for-4.3-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFS41: make close wait for layoutreturn NFS: Skip checking ds_cinfo.buckets when lseg's commit_through_mds is set NFSv4.x/pnfs: Don't try to recover stateids twice in layoutget NFSv4: Recovery of recalled read delegations is broken NFS: Fix an infinite loop when layoutget fail with BAD_STATEID NFS: Do cleanup before resetting pageio read/write to mds SUNRPC: xs_sock_mark_closed() does not need to trigger socket autoclose SUNRPC: Lock the transport layer on shutdown nfs/filelayout: Fix NULL reference caused by double freeing of fh_array SUNRPC: Ensure that we wait for connections to complete before retrying SUNRPC: drop null test before destroy functions nfs: fix v4.2 SEEK on files over 2 gigs SUNRPC: Fix races between socket connection and destroy code nfs: fix pg_test page count calculation Failing to send a CLOSE if file is opened WRONLY and server reboots on a 4.x mount
2015-09-25Merge tag 'sound-4.3-rc3' of ↵Linus Torvalds21-92/+166
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This ended up with a larger set of fixes than wished, unfortunately. As diffstat shows, the majority of changes are for various ASoC drivers (Realtek, Wolfson codec drivers, etc), in addition to a couple of HD-audio regression fixes. All these are reasonably small and nothing to scare much" * tag 'sound-4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (29 commits) ALSA: hda - Disable power_save_node for Thinkpads ALSA: hda/tegra - async probe for avoiding module loading deadlock ASoC: rt5645: Prevent the pop sound in case of playback and the jack is plugging ASoC: rt5645: Increase the delay time to remove the pop sound ASoC: rt5645: Use the type SOC_DAPM_SINGLE_AUTODISABLE to prevent the weird sound in runtime of power up ASoC: pxa: pxa2xx-ac97: fix dma requestor lines MAINTAINERS: Update website and git repo for Wolfson Microelectronics ASoC: fsl_ssi: Fix checking of dai format for AC97 mode ASoC: wm0010: fix error path ASoC: wm0010: fix memory leak ASoC: wm8960: correct the max register value of mic boost pga ASoC: wm8962: remove 64k sample rate support ASoC: davinci-mcasp: Fix devm_kasprintf format string ASoC: fix broken pxa SoC support ASoC: davinci-mcasp: Set .symmetric_rates = 1 in snd_soc_dai_driver ASoC: au1x: psc-i2s: Fix unused variable 'ret' warning ASoC: SPEAr: Make SND_SPEAR_SOC select SND_SOC_GENERIC_DMAENGINE_PCM ASoC: mediatek: Increase periods_min in capture ASoC: davinci-mcasp: Revise the FIFO threshold calculation ASoC: wm8960: correct gain value for input PGA and add microphone PGA ...
2015-09-25Merge tag 'pci-v4.3-fixes-1' of ↵Linus Torvalds17-43/+80
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: "These are fixes for things we merged for v4.3 (VPD, MSI, and bridge window management), and a new Renesas R8A7794 SoC device ID. Details: Resource management: - Revert pci_read_bridge_bases() unification (Bjorn Helgaas) - Clear IORESOURCE_UNSET when clipping a bridge window (Bjorn Helgaas) MSI: - Fix MSI IRQ domains for VFs on virtual buses (Alex Williamson) Renesas R-Car host bridge driver: - Add R8A7794 support (Sergei Shtylyov) Miscellaneous: - Fix devfn for VPD access through function 0 (Alex Williamson) - Use function 0 VPD only for identical functions (Alex Williamson)" * tag 'pci-v4.3-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: rcar: Add R8A7794 support PCI: Use function 0 VPD for identical functions, regular VPD for others PCI: Fix devfn for VPD access through function 0 PCI/MSI: Fix MSI IRQ domains for VFs on virtual buses PCI: Clear IORESOURCE_UNSET when clipping a bridge window PCI: Revert "PCI: Call pci_read_bridge_bases() from core instead of arch code"
2015-09-25Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds14-11/+44
Pull KVM fixes from Paolo Bonzini: "AMD fixes for bugs introduced in the 4.2 merge window, and a few PPC bug fixes too" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: disable halt_poll_ns as default for s390x KVM: x86: fix off-by-one in reserved bits check KVM: x86: use correct page table format to check nested page table reserved bits KVM: svm: do not call kvm_set_cr0 from init_vmcb KVM: x86: trap AMD MSRs for the TSeg base and mask KVM: PPC: Book3S: Take the kvm->srcu lock in kvmppc_h_logical_ci_load/store() KVM: PPC: Book3S HV: Pass the correct trap argument to kvmhv_commence_exit KVM: PPC: Book3S HV: Fix handling of interrupted VCPUs kvm: svm: reset mmu on VCPU reset
2015-09-25Merge tag 'powerpc-4.3-3' of ↵Linus Torvalds4-1/+5
git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Wire up sys_membarrier() - cxl: Fix lockdep warning while creating afu_err_buff from Vaibhav * tag 'powerpc-4.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: cxl: Fix lockdep warning while creating afu_err_buff attribute powerpc: Wire up sys_membarrier()
2015-09-25KVM: disable halt_poll_ns as default for s390xDavid Hildenbrand7-2/+8
We observed some performance degradation on s390x with dynamic halt polling. Until we can provide a proper fix, let's enable halt_poll_ns as default only for supported architectures. Architectures are now free to set their own halt_poll_ns default value. Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-09-25KVM: x86: fix off-by-one in reserved bits checkPaolo Bonzini1-1/+1
29ecd6601904 ("KVM: x86: avoid uninitialized variable warning", 2015-09-06) introduced a not-so-subtle problem, which probably escaped review because it was not part of the patch context. Before the patch, leaf was always equal to iterator.level. After, it is equal to iterator.level - 1 in the call to is_shadow_zero_bits_set, and when is_shadow_zero_bits_set does another "-1" the check on reserved bits becomes incorrect. Using "iterator.level" in the call fixes this call trace: WARNING: CPU: 2 PID: 17000 at arch/x86/kvm/mmu.c:3385 handle_mmio_page_fault.part.93+0x1a/0x20 [kvm]() Modules linked in: tun sha256_ssse3 sha256_generic drbg binfmt_misc ipv6 vfat fat fuse dm_crypt dm_mod kvm_amd kvm crc32_pclmul aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd fam15h_power amd64_edac_mod k10temp edac_core amdkfd amd_iommu_v2 radeon acpi_cpufreq [...] Call Trace: dump_stack+0x4e/0x84 warn_slowpath_common+0x95/0xe0 warn_slowpath_null+0x1a/0x20 handle_mmio_page_fault.part.93+0x1a/0x20 [kvm] tdp_page_fault+0x231/0x290 [kvm] ? emulator_pio_in_out+0x6e/0xf0 [kvm] kvm_mmu_page_fault+0x36/0x240 [kvm] ? svm_set_cr0+0x95/0xc0 [kvm_amd] pf_interception+0xde/0x1d0 [kvm_amd] handle_exit+0x181/0xa70 [kvm_amd] ? kvm_arch_vcpu_ioctl_run+0x68b/0x1730 [kvm] kvm_arch_vcpu_ioctl_run+0x6f6/0x1730 [kvm] ? kvm_arch_vcpu_ioctl_run+0x68b/0x1730 [kvm] ? preempt_count_sub+0x9b/0xf0 ? mutex_lock_killable_nested+0x26f/0x490 ? preempt_count_sub+0x9b/0xf0 kvm_vcpu_ioctl+0x358/0x710 [kvm] ? __fget+0x5/0x210 ? __fget+0x101/0x210 do_vfs_ioctl+0x2f4/0x560 ? __fget_light+0x29/0x90 SyS_ioctl+0x4c/0x90 entry_SYSCALL_64_fastpath+0x16/0x73 ---[ end trace 37901c8686d84de6 ]--- Reported-by: Borislav Petkov <bp@alien8.de> Tested-by: Borislav Petkov <bp@alien8.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-09-25KVM: x86: use correct page table format to check nested page table reserved bitsPaolo Bonzini1-6/+17
Intel CPUID on AMD host or vice versa is a weird case, but it can happen. Handle it by checking the host CPU vendor instead of the guest's in reset_tdp_shadow_zero_bits_mask. For speed, the check uses the fact that Intel EPT has an X (executable) bit while AMD NPT has NX. Reported-by: Borislav Petkov <bp@alien8.de> Tested-by: Borislav Petkov <bp@alien8.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-09-25KVM: svm: do not call kvm_set_cr0 from init_vmcbPaolo Bonzini1-1/+2
kvm_set_cr0 may want to call kvm_zap_gfn_range and thus access the memslots array (SRCU protected). Using a mini SRCU critical section is ugly, and adding it to kvm_arch_vcpu_create doesn't work because the VMX vcpu_create callback calls synchronize_srcu. Fixes this lockdep splat: =============================== [ INFO: suspicious RCU usage. ] 4.3.0-rc1+ #1 Not tainted ------------------------------- include/linux/kvm_host.h:488 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 1 lock held by qemu-system-i38/17000: #0: (&(&kvm->mmu_lock)->rlock){+.+...}, at: kvm_zap_gfn_range+0x24/0x1a0 [kvm] [...] Call Trace: dump_stack+0x4e/0x84 lockdep_rcu_suspicious+0xfd/0x130 kvm_zap_gfn_range+0x188/0x1a0 [kvm] kvm_set_cr0+0xde/0x1e0 [kvm] init_vmcb+0x760/0xad0 [kvm_amd] svm_create_vcpu+0x197/0x250 [kvm_amd] kvm_arch_vcpu_create+0x47/0x70 [kvm] kvm_vm_ioctl+0x302/0x7e0 [kvm] ? __lock_is_held+0x51/0x70 ? __fget+0x101/0x210 do_vfs_ioctl+0x2f4/0x560 ? __fget_light+0x29/0x90 SyS_ioctl+0x4c/0x90 entry_SYSCALL_64_fastpath+0x16/0x73 Reported-by: Borislav Petkov <bp@alien8.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-09-24iscsi-target: Avoid OFMarker + IFMarker negotiationNicholas Bellinger1-2/+3
This patch fixes a v4.2+ regression introduced by commit c04a6091 that removed support for obsolete sync-and-steering markers usage as originally defined in RFC-3720. The regression would involve attempting to send OFMarker=No + IFMarker=No keys during opertional negotiation login phase, including when initiators did not actually propose these keys. The result for MSFT iSCSI initiators would be random junk in TCP stream after the last successful login request was been sent signaling the move to full feature phase (FFP) operation. To address this bug, go ahead and avoid negotiating these keys by default unless the initiator explicitly proposes them, but still respond to them with 'No' if they are proposed. Reported-by: Dragan Milivojević <galileo@pkm-inc.com> Bisected-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm> Tested-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2015-09-24target: Make TCM_WRITE_PROTECT failure honor D_SENSE bitNicholas Bellinger1-17/+23
This patch changes transport_lookup_cmd_lun() to obtain se_lun->lun_ref + se_cmd->se_device rcu_dereference during TCM_WRITE_PROTECT -> CHECK_CONDITION failure status. Do this to ensure the active control D_SENSE mode page bit is being honored. Reported-by: Sagi Grimberg <sagig@mellanox.com> Reviewed-by: Sagi Grimberg <sagig@mellanox.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2015-09-24target: Fix target_sense_desc_format NULL pointer dereferenceNicholas Bellinger1-1/+1
This patch allows target_sense_desc_format() to be called without a valid se_device pointer, which can occur during an early exception ahead of transport_lookup_cmd_lun() setting up se_cmd->se_device. This addresses a v4.3-rc1 specific NULL pointer dereference regression introduced by commit 4e4937e8. Cc: Sagi Grimberg <sagig@mellanox.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Hannes Reinecke <hare@suse.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2015-09-24target: Propigate backend read-only to core_tpg_add_lunNicholas Bellinger3-1/+7
This patch adds a DF_READ_ONLY flag that is used by IBLOCK to signal when a backend has been set to read-only mode, in order to propigate read-only status up to core_tpg_add_lun() for all future LUN fabric exports. With this is place, existing emulation for reporting read-only in spc_emulate_modesense() and normal transport_lookup_cmd_lun() TCM_WRITE_PROTECTED status checking just works as expected. Reported-by: Joeue Deng <joeue404@gmail.com> Reported-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2015-09-24target: Fix PR registration + APTPL RCU conversion regressionNicholas Bellinger2-26/+70
This patch fixes a v4.2+ regression introduced by commit 79dc9c9e86 where lookup of t10_pr_registration->pr_reg_deve and associated ->pr_kref get was missing from __core_scsi3_do_alloc_registration(), which is responsible for setting DEF_PR_REG_ACTIVE. This would result in REGISTER operations completing successfully, but subsequent core_scsi3_pr_seq_non_holder() checking would fail with !DEF_PR_REG_ACTIVE -> RESERVATION CONFLICT status. Update __core_scsi3_add_registration() to drop ->pr_kref reference after registration and any optional ALL_TG_PT=1 processing has completed. Update core_scsi3_decode_spec_i_port() to release the new parent local_pr_reg->pr_kref as well. Also, update __core_scsi3_check_aptpl_registration() to perform the same target_nacl_find_deve() lookup + ->pr_kref get, now that __core_scsi3_add_registration() expects to drop the reference. Finally, since there are cases when se_dev_entry->se_lun_acl can still be dereferenced in core_scsi3_lunacl_undepend_item() while holding ->pr_kref, go ahead and move explicit rcu_assign_pointer() NULL assignments within core_disable_device_list_for_node() until after orig->pr_comp finishes. Reported-by: Scott L. Lykens <scott@lykens.org> Tested-by: Scott L. Lykens <scott@lykens.org> Cc: Christoph Hellwig <hch@lst.de> Cc: Hannes Reinecke <hare@suse.de> Cc: Lee Duncan <lduncan@suse.com> Cc: <stable@vger.kernel.org> # v4.2+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2015-09-24Merge branch 'phy-mdio-refcnt'David S. Miller13-51/+181
Russell King says: ==================== Phy, mdiobus, and netdev struct device fixes The third version of this series fixes the build error which David identified, and drops the broken changes for the Cavium Thunger BGX ethernet driver as this driver requires some complex changes to resolve the leakage - and this is best done by people who can test the driver. Compared to v2, the only patch which has changed is patch 6 "net: fix phy refcounting in a bunch of drivers" I _think_ I've been able to build-test all the drivers touched by that patch to some degree now, though several of them needed the Kconfig hacked to allow it (not all had || COMPILE_TEST clause on their dependencies.) Previous cover letters below: This is the second version of the series, with the comments David had on the first patch fixed up. Original series description with updated diffstat below. While looking at the DSA code, I noticed we have a of_find_net_device_by_node(), and it looks like users of that are similarly buggy - it looks like net/dsa/dsa.c is the only user. Fix that too. Hi, While looking at the phy code, I identified a number of weaknesses where refcounting on device structures was being leaked, where modules could be removed while in-use, and where the fixed-phy could end up having unintended consequences caused by incorrect calls to fixed_phy_update_state(). This patch series resolves those issues, some of which were discovered with testing on an Armada 388 board. Not all patches are fully tested, particularly the one which touches several network drivers. When resolving the struct device refcounting problems, several different solutions were considered before settling on the implementation here - one of the considerations was to avoid touching many network drivers. The solution here is: phy_attach*() - takes a refcount phy_detach*() - drops the phy_attach refcount Provided drivers always attach and detach their phys, which they should already be doing, this should change nothing, even if they leak a refcount. of_phy_find_device() and of_* functions which use that take a refcount. Arrange for this refcount to be dropped once the phy is attached. This is the reason why the previous change is important - we can't drop this refcount taken by of_phy_find_device() until something else holds a reference on the device. This resolves the leaked refcount caused by using of_phy_connect() or of_phy_attach(). Even without the above changes, these drivers are leaking by calling of_phy_find_device(). These drivers are addressed by adding the appropriate release of that refcount. The mdiobus code also suffered from the same kind of leak, but thankfully this only happened in one place - the mdio-mux code. I also found that the try_module_get() in the phy layer code was utterly useless: phydev->dev.driver was guaranteed to always be NULL, so try_module_get() was always being called with a NULL argument. I proved this with my SFP code, which declares its own MDIO bus - the module use count was never incremented irrespective of how I set the MDIO bus up. This allowed the MDIO bus code to be removed from the kernel while there were still PHYs attached to it. One other bug was discovered: while using in-band-status with mvneta, it was found that if a real phy is attached with in-band-status enabled, and another ethernet interface is using the fixed-phy infrastructure, the interface using the fixed-phy infrastructure is configured according to the other interface using the in-band-status - which is caused by the fixed-phy code not verifying that the phy_device passed in is actually a fixed-phy device, rather than a real MDIO phy. Lastly, having mdio_bus reversing phy_device_register() internals seems like a layering violation - it's trivial to move that code to the phy device layer. ==================== Tested-by: Florian Fainelli <f.fainelli@gmail.com> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24net: fix net_device refcountingRussell King2-1/+13
of_find_net_device_by_node() uses class_find_device() internally to lookup the corresponding network device. class_find_device() returns a reference to the embedded struct device, with its refcount incremented. Add a comment to the definition in net/core/net-sysfs.c indicating the need to drop this refcount, and fix the DSA code to drop this refcount when the OF-generated platform data is cleaned up and freed. Also arrange for the ref to be dropped when handling errors. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24phy: add phy_device_remove()Russell King4-7/+32
Add a phy_device_remove() function to complement phy_device_register(), which undoes the effects of phy_device_register() by removing the phy device from visibility, but not freeing it. This allows these details to be moved out of the mdio bus code into the phy code where this action belongs. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24phy: fixed-phy: properly validate phy in fixed_phy_update_state()Russell King1-1/+1
Validate that the phy_device passed into fixed_phy_update_state() is a fixed-phy device before walking the list of phys for a fixed phy at the same address. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24net: fix phy refcounting in a bunch of driversRussell King5-9/+30
of_phy_find_device() increments the phy struct device refcount, which we need to properly balance. Add code to network drivers using this function to ensure that the struct device refcount is correctly balanced. For xgene, looking back in the history, we should be able to use of_phy_connect() with a zero flags argument for the DT case as this is how the driver used to operate prior to de7b5b3d790a ("net: eth: xgene: change APM X-Gene SoC platform ethernet to support ACPI"). This leaves the Cavium Thunder BGX unfixed; fixing this driver is a complicated task, one which the maintainers need to be involved with. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24of_mdio: fix MDIO phy device refcountingRussell King1-4/+23
bus_find_device() is defined as: * This is similar to the bus_for_each_dev() function above, but it * returns a reference to a device that is 'found' for later use, as * determined by the @match callback. and it does indeed return a reference-counted pointer to the device: while ((dev = next_device(&i))) if (match(dev, data) && get_device(dev)) ^^^^^^^^^^^^^^^ break; klist_iter_exit(&i); return dev; What that means is that when we're done with the struct device, we must drop that reference. Neither of_phy_connect() nor of_phy_attach() did this when phy_connect_direct() or phy_attach_direct() failed. With our previous patch, phy_connect_direct() and phy_attach_direct() take a new refcount on the phy device when successful, so we can drop our local reference immediatley after these functions, whether or not they succeeded. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24phy: add proper phy struct device refcountingRussell King1-0/+12
Take a refcount on the phy struct device when the phy device is attached to a network device, and drop it after it's detached. This ensures that a refcount is held on the phy device while the device is being used by a network device, thereby preventing the phy_device from being unexpectedly kfree()'d by phy_device_release(). Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24phy: fix mdiobus module safetyRussell King3-17/+25
Re-implement the mdiobus module refcounting to ensure that we actually ensure that the mdiobus module code does not go away while we might call into it. The old scheme using bus->dev.driver was buggy, because bus->dev is a class device which never has a struct device_driver associated with it, and hence the associated code trying to obtain a refcount did nothing useful. Instead, take the approach that other subsystems do: pass the module when calling mdiobus_register(), and record that in the mii_bus struct. When we need to increment the module use count in the phy code, use this stored pointer. When the phy is deteched, drop the module refcount, remembering that the phy device might go away at that point. This doesn't stop the mii_bus going away while there are in-use phys - it merely stops the underlying code vanishing. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24net: dsa: fix of_mdio_find_bus() device refcount leakRussell King1-7/+31
Current users of of_mdio_find_bus() leak a struct device refcount, as they fail to clean up the reference obtained inside class_find_device(). Fix the DSA code to properly refcount the returned MDIO bus by: 1. taking a reference on the struct device whenever we assign it to pd->chip[x].host_dev. 2. dropping the reference when we overwrite the existing reference. 3. dropping the reference when we free the data structure. 4. dropping the initial reference we obtained after setting up the platform data structure, or on failure. In step 2 above, where we obtain a new MDIO bus, there is no need to take a reference on it as we would only have to drop it immediately after assignment again, iow: put_device(cd->host_dev); /* drop original assignment ref */ cd->host_dev = get_device(&mdio_bus_switch->dev); /* get our ref */ put_device(&mdio_bus_switch->dev); /* drop of_mdio_find_bus ref */ Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24phy: fix of_mdio_find_bus() device refcount leakRussell King2-7/+16
of_mdio_find_bus() leaks a struct device refcount, caused by using class_find_device() and not realising that the device reference has its refcount incremented: * Note, you will need to drop the reference with put_device() after use. ... while ((dev = class_dev_iter_next(&iter))) { if (match(dev, data)) { get_device(dev); break; } Update the comment, and arrange for the phy code to drop this refcount when disposing of a reference to it. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24Merge branch 'next' of ↵Linus Torvalds9-100/+269
git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux Pull thermal management fixes from Zhang Rui: - Power allocator governor changes to allow binding on thermal zones with missing power estimates information. From Javi Merino. - Add compile test flags on thermal drivers that allow it without producing compilation errors. From Eduardo Valentin. - Fixes around memory allocation on cpu_cooling. From Javi Merino. - Fix on db8500 cpufreq code to allow autoload. From Luis de Bethencourt. - Maintainer entries for cpu cooling device * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux: thermal: power_allocator: exit early if there are no cooling devices thermal: power_allocator: don't require tzp to be present for the thermal zone thermal: power_allocator: relax the requirement of two passive trip points thermal: power_allocator: relax the requirement of a sustainable_power in tzp thermal: Add a function to get the minimum power thermal: cpu_cooling: free power table on error or when unregistering thermal: cpu_cooling: don't call kcalloc() under rcu_read_lock thermal: db8500_cpufreq_cooling: Fix module autoload for OF platform driver thermal: cpu_cooling: Add MAINTAINERS entry thermal: ti-soc: Kconfig fix to avoid menu showing wrongly thermal: ti-soc: allow compile test thermal: qcom_spmi: allow compile test thermal: exynos: allow compile test thermal: armada: allow compile test thermal: dove: allow compile test thermal: kirkwood: allow compile test thermal: rockchip: allow compile test thermal: spear: allow compile test thermal: hisi: allow compile test thermal: Fix thermal_zone_of_sensor_register to match documentation
2015-09-24Merge tag 'devicetree-fixes-for-4.3' of ↵Linus Torvalds9-27/+46
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull DeviceTree fixes from Rob Herring: - Silence bogus warning for of_irq_parse_pci - Fix typo in ARM idle-states binding doc and dts files - Various minor binding documentation updates * tag 'devicetree-fixes-for-4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: Documentation: arm: Fix typo in the idle-states bindings examples gpio: mention in DT binding doc that <name>-gpio is deprecated of_pci_irq: Silence bogus "of_irq_parse_pci() failed ..." messages. devicetree: bindings: Extend the bma180 bindings with bma250 info of: thermal: Mark cooling-*-level properties optional of: thermal: Fix inconsitency between cooling-*-state and cooling-*-level Docs: dt: add #msi-cells to GICv3 ITS binding of: add vendor prefix for Socionext Inc.
2015-09-24Merge tag 'v4.3-rockchip32-dtsfixes1' of ↵Olof Johansson1-0/+1
git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into fixes Add the ddc-i2c-bus reference to the veyron hdmi nodes, so that they can read the edid of connected displays. * tag 'v4.3-rockchip32-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: Add ddc i2c reference to veyron Signed-off-by: Olof Johansson <olof@lixom.net>
2015-09-24ARM: sti: dt: adapt DT to fix probe/bind issues in DRM driverBenjamin Gaignard2-84/+80
STI drm drivers probe and bind using component framework was incorrect. In addition to drivers fix DT update is needed to make all sub-components become childs of sti-display-subsystem. Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org> Signed-off-by: Maxime Coquelin <maxime.coquelin@st.com> Signed-off-by: Olof Johansson <olof@lixom.net>
2015-09-24Merge tag 'qcom-fixes-for-4.3-rc1' of ↵Olof Johansson3-1/+73
git://codeaurora.org/quic/kernel/agross-msm into fixes Qualcomm fixes for v4.3-rc1 * Add SCM function call stubs on ARM64 * tag 'qcom-fixes-for-4.3-rc1' of git://codeaurora.org/quic/kernel/agross-msm: firmware: qcom: scm: Add function stubs for ARM64 Signed-off-by: Olof Johansson <olof@lixom.net>
2015-09-24ARM: dts: fix omap2+ address translation for pbiasKishon Vijay Abraham I5-12/+17
"ARM: dts: <omap2/omap4/omap5/dra7>: add minimal l4 bus layout with control module support" moved pbias_regulator dt node from being a child node of ocp to be the child node of 'syscon'. Since 'syscon' doesn't have the 'ranges' property, address translation fails while trying to convert the address to resource. Fix it here by populating 'ranges' property in syscon dt node. Fixes: 72b10ac00eb1 ("ARM: dts: omap24xx: add minimal l4 bus layout with control module support") Fixes: 7415b0b4c645 ("ARM: dts: omap4: add minimal l4 bus layout with control module support") Fixes: ed8509edddeb ("ARM: dts: omap5: add minimal l4 bus layout with control module support") Fixes: d919501feffa ("ARM: dts: dra7: add minimal l4 bus layout with control module support") Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com> [tony@atomide.com: fixed omap3 pbias to work] Signed-off-by: Tony Lindgren <tony@atomide.com>
2015-09-24Merge commit 'b8c93646fd5c' into omap-for-v4.3/fixesTony Lindgren2-7/+56
2015-09-24ip6_tunnel: Reduce log level in ip6_tnl_err() to debugMatt Bennett1-8/+8
Currently error log messages in ip6_tnl_err are printed at 'warn' level. This is different to other tunnel types which don't print any messages. These log messages don't provide any information that couldn't be deduced with networking tools. Also it can be annoying to have one end of the tunnel go down and have the logs fill with pointless messages such as "Path to destination invalid or inactive!". This patch reduces the log level of these messages to 'dbg' level to bring the visible behaviour into line with other tunnel types. Signed-off-by: Matt Bennett <matt.bennett@alliedtelesis.co.nz> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24Documentation: arm: Fix typo in the idle-states bindings examplesLorenzo Pieralisi3-3/+3
The idle-states bindings mandate that the entry-method string in the idle-states node must be "psci" for ARM v8 64-bit systems, but the examples in the bindings report a wrong entry-method string. Owing to this typo, some dts in the kernel wrongly defined the entry-method property, since they likely cut and pasted the example definition without paying attention to the bindings definitions. This patch fixes the typo in the DT idle states bindings examples and respective dts in the kernel so that the bindings and related dts files are made compliant. Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Cc: Howard Chen <howard.chen@linaro.org> Cc: Rob Herring <robh+dt@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Heiko Stuebner <heiko@sntech.de> Signed-off-by: Rob Herring <robh@kernel.org>
2015-09-24gpio: mention in DT binding doc that <name>-gpio is deprecatedJavier Martinez Canillas1-1/+3
The gpiolib supports parsing DT properties of the form <name>-gpio but it was only added for compatibility with older DT bindings that got it wrong and should not be used in newer bindings. The commit that added support for this was: dd34c37aa3e8 ("gpio: of: Allow -gpio suffix for property names") but didn't update the documentation to explain this so it's been a source of confusion. So let's make this clear in the GPIO DT binding doc. Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com> Signed-off-by: Rob Herring <robh@kernel.org>
2015-09-24Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds63-544/+691
Pull drm fixes from Dave Airlie: "Most of the GPU drivers people were at XDC last week, so I didn't get much to send, so I let it rollover until this week. Also Alex was away for 3 weeks so amdgpu/radeon got a bit more stuff than usual in one go. I've been trying to figure out some 4.2 issues with i915 still (that are fixed in 4.3, but bisecting ends up in a merge commit). Hopefully next week I or i915 people can work that out" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (46 commits) drm: Allow also control clients to check the drm version drm/vmwgfx: Fix uninitialized return in vmw_kms_helper_dirty() drm/vmwgfx: Fix uninitialized return in vmw_cotable_unbind() drm/layerscape: fix handling fsl_dcu_drm_plane_index result drm/mgag200: Fix driver_load error handling drm/mgag200: Fix error handling paths in fbdev driver drm/qxl: only report first monitor as connected if we have no state drm/radeon: add quirk for MSI R7 370 drm/amdgpu: Sprinkle drm_modeset_lock_all to appease locking checks drm/radeon: Sprinkle drm_modeset_lock_all to appease locking checks drm/amdgpu: sync ce and me with SWITCH_BUFFER(2) drm/amdgpu: integer overflow in amdgpu_mode_dumb_create() drm/amdgpu: info leak in amdgpu_gem_metadata_ioctl() drm/amdgpu: integer overflow in amdgpu_info_ioctl() drm/amdgpu: unwind properly in amdgpu_cs_parser_init() drm/amdgpu: Fix max_vblank_count value for current display engines drm/amdgpu: use kmemdup rather than duplicating its implementation drm/amdgpu: fix UVD suspend and resume for VI APU drm/amdgpu: fix the UVD suspend sequence order drm/amdgpu: make UVD handle checking more strict ...
2015-09-24Merge tag 'mac80211-for-davem-2015-09-22' of ↵David S. Miller1-5/+8
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Just two small fixes: * VHT MCS mask array overrun, reported by Dan Carpenter * reset CQM history to always get a notification, from Sara Sharon ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24ip6_gre: Reduce log level in ip6gre_err() to debugMatt Bennett1-8/+8
Currently error log messages in ip6gre_err are printed at 'warn' level. This is different to most other tunnel types which don't print any messages. These log messages don't provide any information that couldn't be deduced with networking tools. Also it can be annoying to have one end of the tunnel go down and have the logs fill with pointless messages such as "Path to destination invalid or inactive!". This patch reduces the log level of these messages to 'dbg' level to bring the visible behaviour into line with other tunnel types. Signed-off-by: Matt Bennett <matt.bennett@alliedtelesis.co.nz> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24fib_rules: fix fib rule dumps across multiple skbsWilson Kok1-5/+9
dump_rules returns skb length and not error. But when family == AF_UNSPEC, the caller of dump_rules assumes that it returns an error. Hence, when family == AF_UNSPEC, we continue trying to dump on -EMSGSIZE errors resulting in incorrect dump idx carried between skbs belonging to the same dump. This results in fib rule dump always only dumping rules that fit into the first skb. This patch fixes dump_rules to return error so that we exit correctly and idx is correctly maintained between skbs that are part of the same dump. Signed-off-by: Wilson Kok <wkok@cumulusnetworks.com> Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24PCI: rcar: Add R8A7794 supportSergei Shtylyov2-1/+3
Add Renesas R8A7794 SoC support to the Renesas R-Car gen2 PCI driver. Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Signed-off-by: Bjorn Helgaas <helgaas@kernel.org> Acked-by: Simon Horman <horms+renesas@verge.net.au>
2015-09-24PCI: Use function 0 VPD for identical functions, regular VPD for othersAlex Williamson2-24/+18
932c435caba8 ("PCI: Add dev_flags bit to access VPD through function 0") added PCI_DEV_FLAGS_VPD_REF_F0. Previously, we set the flag on every non-zero function of quirked devices. If a function turned out to be different from function 0, i.e., it had a different class, vendor ID, or device ID, the flag remained set but we didn't make VPD accessible at all. Flip this around so we only set PCI_DEV_FLAGS_VPD_REF_F0 for functions that are identical to function 0, and allow regular VPD access for any other functions. [bhelgaas: changelog, stable tag] Fixes: 932c435caba8 ("PCI: Add dev_flags bit to access VPD through function 0") Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Bjorn Helgaas <helgaas@kernel.org> Acked-by: Myron Stowe <myron.stowe@redhat.com> Acked-by: Mark Rustad <mark.d.rustad@intel.com> CC: stable@vger.kernel.org
2015-09-24PCI: Fix devfn for VPD access through function 0Alex Williamson1-3/+6
Commit 932c435caba8 ("PCI: Add dev_flags bit to access VPD through function 0") passes PCI_SLOT(devfn) for the devfn parameter of pci_get_slot(). Generally this works because we're fairly well guaranteed that a PCIe device is at slot address 0, but for the general case, including conventional PCI, it's incorrect. We need to get the slot and then convert it back into a devfn. Fixes: 932c435caba8 ("PCI: Add dev_flags bit to access VPD through function 0") Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Bjorn Helgaas <helgaas@kernel.org> Acked-by: Myron Stowe <myron.stowe@redhat.com> Acked-by: Mark Rustad <mark.d.rustad@intel.com> CC: stable@vger.kernel.org
2015-09-24PCI/MSI: Fix MSI IRQ domains for VFs on virtual busesAlex Williamson1-6/+11
SR-IOV creates a virtual bus where bus->self is NULL. When we add VFs and scan for an MSI domain, pci_set_bus_msi_domain() dereferences bus->self, which causes a kernel NULL pointer dereference oops. Scan up to the parent bus until we find a real bridge where we can get the MSI domain. [bhelgaas: changelog] Fixes: 44aa0c657e3e ("PCI/MSI: Add hooks to populate the msi_domain field") Tested-by: Joerg Roedel <joro@8bytes.org> Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Bjorn Helgaas <helgaas@kernel.org> Acked-by: Marc Zyngier <marc.zyngier@arm.com>
2015-09-24bnx2x: byte swap rss_key to comply to Toeplitz specsEric Dumazet1-2/+10
After a good amount of debugging, I found bnx2x was byte swaping the 40 bytes of rss_key. If we byte swap the key, then bnx2x generates hashes matching MSDN specs as documented in (Verifying the RSS Hash Calculation) https://msdn.microsoft.com/en-us/library/windows/hardware/ff571021% 28v=vs.85%29.aspx It is mostly a non issue, unless we want to mix different NIC in a host, and want consistent hashing among all of them, ie if they all use the boot time generated rss key, or if some application is choosing specific tuple(s) so that incoming traffic lands into known rx queue(s). Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24net: revert "net_sched: move tp->root allocation into fw_init()"WANG Cong1-15/+15
fw filter uses tp->root==NULL to check if it is the old method, so it doesn't need allocation at all in this case. This patch reverts the offending commit and adds some comments for old method to make it obvious. Fixes: 33f8b9ecdb15 ("net_sched: move tp->root allocation into fw_init()") Reported-by: Akshat Kakkar <akshat.1984@gmail.com> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24Merge branch 'akpm' (patches from Andrew)Linus Torvalds17-66/+83
Merge misc fixes from Andrew Morton: "15 fixes" * emailed patches from Andrew Morton <akpm@linux-foundation.org>: ocfs2/dlm: fix deadlock when dispatch assert master membarrier: clean up selftest vmscan: fix sane_reclaim helper for legacy memcg lib/iommu-common.c: do not try to deref a null iommu->lazy_flush() pointer when n < pool->hint x86, efi, kasan: #undef memset/memcpy/memmove per arch mm: migrate: hugetlb: putback destination hugepage to active list mm, dax: VMA with vm_ops->pfn_mkwrite wants to be write-notified userfaultfd: register uapi generic syscall (aarch64) userfaultfd: selftest: don't error out if pthread_mutex_t isn't identical userfaultfd: selftest: return an error if BOUNCE_VERIFY fails userfaultfd: selftest: avoid my_bcmp false positives with powerpc userfaultfd: selftest: only warn if __NR_userfaultfd is undefined userfaultfd: selftest: headers fixup userfaultfd: selftests: vm: pick up sanitized kernel headers userfaultfd: revert "userfaultfd: waitqueue: add nr wake parameter to __wake_up_locked_key"
2015-09-24Merge branch 'lwt_arp'David S. Miller4-42/+55
Jiri Benc says: ==================== lwtunnel: make it really work, for IPv4 One of the selling points of lwtunnel was the ability to specify the tunnel destination using routes. However, this doesn't really work currently, as ARP and ndisc replies are not handled correctly. ARP and ndisc replies won't have tunnel metadata attached, thus they will be sent out with the default parameters or not sent at all, either way never reaching the requester. Most of the egress tunnel parameters can be inferred from the ingress metada. The only and important exception is UDP ports. This patchset infers the egress data from the ingress data and disallow settings of UDP ports in tunnel routes. If there's a need for different UDP ports, a new interface needs to be created for each port combination. Note that it's still possible to specify the UDP ports to use, it just needs to be done while creating the vxlan/geneve interface. This covers only ARPs. IPv6 ndisc has the same problem but is harder to solve, as there's already dst attached to outgoing skbs. Ideas to solve this are welcome. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24lwtunnel: remove source and destination UDP port config optionJiri Benc2-28/+0
The UDP tunnel config is asymmetric wrt. to the ports used. The source and destination ports from one direction of the tunnel are not related to the ports of the other direction. We need to be able to respond to ARP requests using the correct ports without involving routing. As the consequence, UDP ports need to be fixed property of the tunnel interface and cannot be set per route. Remove the ability to set ports per route. This is still okay to do, as no kernel has been released with these attributes yet. Note that the ability to specify source and destination ports is preserved for other users of the lwtunnel API which don't use routes for tunnel key specification (like openvswitch). If in the future we rework ARP handling to allow port specification, the attributes can be added back. Signed-off-by: Jiri Benc <jbenc@redhat.com> Acked-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24ipv4: send arp replies to the correct tunnelJiri Benc3-14/+55
When using ip lwtunnels, the additional data for xmit (basically, the actual tunnel to use) are carried in ip_tunnel_info either in dst->lwtstate or in metadata dst. When replying to ARP requests, we need to send the reply to the same tunnel the request came from. This means we need to construct proper metadata dst for ARP replies. We could perform another route lookup to get a dst entry with the correct lwtstate. However, this won't always ensure that the outgoing tunnel is the same as the incoming one, and it won't work anyway for IPv4 duplicate address detection. The only thing to do is to "reverse" the ip_tunnel_info. Signed-off-by: Jiri Benc <jbenc@redhat.com> Acked-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24net: gianfar: remove misuse of IRQF_NO_SUSPEND flagSudeep Holla1-4/+5
The device is set as wakeup capable using proper wakeup API but the driver misuses IRQF_NO_SUSPEND to set the interrupt as wakeup source which is incorrect. This patch removes the use of IRQF_NO_SUSPEND flags replacing it with enable_irq_wake instead. Cc: "David S. Miller" <davem@davemloft.net> Cc: Claudiu Manoil <claudiu.manoil@freescale.com> Cc: Kevin Hao <haokexin@gmail.com> Cc: netdev@vger.kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Acked-by: Claudiu Manoil <claudiu.manoil@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-24skbuff: Fix skb checksum flag on skb pullPravin B Shelar1-0/+3
VXLAN device can receive skb with checksum partial. But the checksum offset could be in outer header which is pulled on receive. This results in negative checksum offset for the skb. Such skb can cause the assert failure in skb_checksum_help(). Following patch fixes the bug by setting checksum-none while pulling outer header. Following is the kernel panic msg from old kernel hitting the bug. ------------[ cut here ]------------ kernel BUG at net/core/dev.c:1906! RIP: 0010:[<ffffffff81518034>] skb_checksum_help+0x144/0x150 Call Trace: <IRQ> [<ffffffffa0164c28>] queue_userspace_packet+0x408/0x470 [openvswitch] [<ffffffffa016614d>] ovs_dp_upcall+0x5d/0x60 [openvswitch] [<ffffffffa0166236>] ovs_dp_process_packet_with_key+0xe6/0x100 [openvswitch] [<ffffffffa016629b>] ovs_dp_process_received_packet+0x4b/0x80 [openvswitch] [<ffffffffa016c51a>] ovs_vport_receive+0x2a/0x30 [openvswitch] [<ffffffffa0171383>] vxlan_rcv+0x53/0x60 [openvswitch] [<ffffffffa01734cb>] vxlan_udp_encap_recv+0x8b/0xf0 [openvswitch] [<ffffffff8157addc>] udp_queue_rcv_skb+0x2dc/0x3b0 [<ffffffff8157b56f>] __udp4_lib_rcv+0x1cf/0x6c0 [<ffffffff8157ba7a>] udp_rcv+0x1a/0x20 [<ffffffff8154fdbd>] ip_local_deliver_finish+0xdd/0x280 [<ffffffff81550128>] ip_local_deliver+0x88/0x90 [<ffffffff8154fa7d>] ip_rcv_finish+0x10d/0x370 [<ffffffff81550365>] ip_rcv+0x235/0x300 [<ffffffff8151ba1d>] __netif_receive_skb+0x55d/0x620 [<ffffffff8151c360>] netif_receive_skb+0x80/0x90 [<ffffffff81459935>] virtnet_poll+0x555/0x6f0 [<ffffffff8151cd04>] net_rx_action+0x134/0x290 [<ffffffff810683d8>] __do_softirq+0xa8/0x210 [<ffffffff8162fe6c>] call_softirq+0x1c/0x30 [<ffffffff810161a5>] do_softirq+0x65/0xa0 [<ffffffff810687be>] irq_exit+0x8e/0xb0 [<ffffffff81630733>] do_IRQ+0x63/0xe0 [<ffffffff81625f2e>] common_interrupt+0x6e/0x6e Reported-by: Anupam Chanda <achanda@vmware.com> Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Tom Herbert <tom@herbertland.com> Signed-off-by: David S. Miller <davem@davemloft.net>