aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-01-23dm cache: fix problematic dual use of a single migration count variableJoe Thornber
Introduce a new variable to count the number of allocated migration structures. The existing variable cache->nr_migrations became overloaded. It was used to: i) track of the number of migrations in flight for the purposes of quiescing during suspend. ii) to estimate the amount of background IO occuring. Recent discard changes meant that REQ_DISCARD bios are processed with a migration. Discards are not background IO so nr_migrations was not incremented. However this could cause quiescing to complete early. (i) is now handled with a new variable cache->nr_allocated_migrations. cache->nr_migrations has been renamed cache->nr_io_migrations. cleanup_migration() is now called free_io_migration(), since it decrements that variable. Also, remove the unused cache->next_migration variable that got replaced with with prealloc_structs a while ago. Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Cc: stable@vger.kernel.org
2015-01-23dm cache: share cache-metadata object across inactive and active DM tablesJoe Thornber
If a DM table is reloaded with an inactive table when the device is not suspended (normal procedure for LVM2), then there will be two dm-bufio objects that can diverge. This can lead to a situation where the inactive table uses bufio to read metadata at the same time the active table writes metadata -- resulting in the inactive table having stale metadata buffers once it is promoted to the active table slot. Fix this by using reference counting and a global list of cache metadata objects to ensure there is only one metadata object per metadata device. Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Cc: stable@vger.kernel.org
2015-01-23of/unittest: Overlays with sub-devices testsPantelis Antoniou
Introduce selftests for overlays using sub-devices present in children nodes. Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com> Signed-off-by: Grant Likely <grant.likely@linaro.org>
2015-01-23KVM: x86: SYSENTER emulation is brokenNadav Amit
SYSENTER emulation is broken in several ways: 1. It misses the case of 16-bit code segments completely (CVE-2015-0239). 2. MSR_IA32_SYSENTER_CS is checked in 64-bit mode incorrectly (bits 0 and 1 can still be set without causing #GP). 3. MSR_IA32_SYSENTER_EIP and MSR_IA32_SYSENTER_ESP are not masked in legacy-mode. 4. There is some unneeded code. Fix it. Cc: stable@vger.linux.org Signed-off-by: Nadav Amit <namit@cs.technion.ac.il> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-01-23KVM: x86: Fix of previously incomplete fix for CVE-2014-8480Nadav Amit
STR and SLDT with rip-relative operand can cause a host kernel oops. Mark them as DstMem as well. Cc: stable@vger.linux.org Signed-off-by: Nadav Amit <namit@cs.technion.ac.il> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-01-23arm64: dump: Fix implicit inclusion of definition for PCI_IOBASEMark Brown
Since c9465b4ec37a68425 (arm64: add support to dump the kernel page tables) allmodconfig has failed to build on arm64 as a result of: ../arch/arm64/mm/dump.c:55:20: error: 'PCI_IOBASE' undeclared here (not in a function) Fix this by explicitly including io.h to ensure that a definition is present. Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Will Deacon <will.deacon@arm.com>
2015-01-23x86/tsc: Change Fast TSC calibration failed from error to infoAlexandre Demers
Many users see this message when booting without knowning that it is of no importance and that TSC calibration may have succeeded by another way. As explained by Paul Bolle in http://lkml.kernel.org/r/1348488259.1436.22.camel@x61.thuisdomein "Fast TSC calibration failed" should not be considered as an error since other calibration methods are being tried afterward. At most, those send a warning if they fail (not an error). So let's change the message from error to warning. [ tglx: Make if pr_info. It's really not important at all ] Fixes: c767a54ba065 x86/debug: Add KERN_<LEVEL> to bare printks, convert printks to pr_<level> Signed-off-by: Alexandre Demers <alexandre.f.demers@gmail.com> Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1418106470-6906-1-git-send-email-alexandre.f.demers@gmail.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-23x86/apic: Re-enable PCI_MSI support for non-SMP X86_32Bryan O'Donoghue
Commit 0dbc6078c06bc0 ('x86, build, pci: Fix PCI_MSI build on !SMP') introduced the dependency that X86_UP_APIC is only available when PCI_MSI is false. This effectively prevents PCI_MSI support on 32bit UP systems because it disables both APIC and IO-APIC. But APIC support is architecturally required for PCI_MSI. The intention of the patch was to enforce APIC support when PCI_MSI is enabled, but failed to do so. Remove the !PCI_MSI dependency from X86_UP_APIC and enforce X86_UP_APIC when PCI_MSI support is enabled on 32bit UP systems. [ tglx: Massaged changelog ] Fixes 0dbc6078c06bc0 'x86, build, pci: Fix PCI_MSI build on !SMP' Signed-off-by: Bryan O'Donoghue <pure.logic@nexus-software.ie> Suggested-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1421967529-9037-1-git-send-email-pure.logic@nexus-software.ie Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22x86, mm: Change cachemode exports to non-gplJuergen Gross
Commit 281d4078bec3 ("x86: Make page cache mode a real type") introduced the symbols __cachemode2pte_tbl and __pte2cachemode_tbl and exported them via EXPORT_SYMBOL_GPL. The exports are part of a replacement of code which has been EXPORT_SYMBOL before these changes resulting in build breakage of out-of-tree non-gpl modules. Change EXPORT_SYMBOL_GPL to EXPORT-SYMBOL for these two symbols. Fixes: 281d4078bec3 "x86: Make page cache mode a real type" Reported-and-tested-by: Steven Noonan <steven@uplinklabs.net> Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Toshi Kani <toshi.kani@hp.com> Link: http://lkml.kernel.org/r/1421926997-28615-1-git-send-email-jgross@suse.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22x86, tls: Interpret an all-zero struct user_desc as "no segment"Andy Lutomirski
The Witcher 2 did something like this to allocate a TLS segment index: struct user_desc u_info; bzero(&u_info, sizeof(u_info)); u_info.entry_number = (uint32_t)-1; syscall(SYS_set_thread_area, &u_info); Strictly speaking, this code was never correct. It should have set read_exec_only and seg_not_present to 1 to indicate that it wanted to find a free slot without putting anything there, or it should have put something sensible in the TLS slot if it wanted to allocate a TLS entry for real. The actual effect of this code was to allocate a bogus segment that could be used to exploit espfix. The set_thread_area hardening patches changed the behavior, causing set_thread_area to return -EINVAL and crashing the game. This changes set_thread_area to interpret this as a request to find a free slot and to leave it empty, which isn't *quite* what the game expects but should be close enough to keep it working. In particular, using the code above to allocate two segments will allocate the same segment both times. According to FrostbittenKing on Github, this fixes The Witcher 2. If this somehow still causes problems, we could instead allocate a limit==0 32-bit data segment, but that seems rather ugly to me. Fixes: 41bdc78544b8 x86/tls: Validate TLS entries to protect espfix Signed-off-by: Andy Lutomirski <luto@amacapital.net> Cc: stable@vger.kernel.org Cc: torvalds@linux-foundation.org Link: http://lkml.kernel.org/r/0cb251abe1ff0958b8e468a9a9a905b80ae3a746.1421954363.git.luto@amacapital.net Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22x86, tls, ldt: Stop checking lm in LDT_emptyAndy Lutomirski
32-bit programs don't have an lm bit in their ABI, so they can't reliably cause LDT_empty to return true without resorting to memset. They shouldn't need to do this. This should fix a longstanding, if minor, issue in all 64-bit kernels as well as a potential regression in the TLS hardening code. Fixes: 41bdc78544b8 x86/tls: Validate TLS entries to protect espfix Cc: stable@vger.kernel.org Signed-off-by: Andy Lutomirski <luto@amacapital.net> Cc: torvalds@linux-foundation.org Link: http://lkml.kernel.org/r/72a059de55e86ad5e2935c80aa91880ddf19d07c.1421954363.git.luto@amacapital.net Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22x86, mpx: Strictly enforce empty prctl() argsDave Hansen
Description from Michael Kerrisk. He suggested an identical patch to one I had already coded up and tested. commit fe3d197f8431 "x86, mpx: On-demand kernel allocation of bounds tables" added two new prctl() operations, PR_MPX_ENABLE_MANAGEMENT and PR_MPX_DISABLE_MANAGEMENT. However, no checks were included to ensure that unused arguments are zero, as is done in many existing prctl()s and as should be done for all new prctl()s. This patch adds the required checks. Suggested-by: Andy Lutomirski <luto@amacapital.net> Suggested-by: Michael Kerrisk <mtk.manpages@gmail.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: Dave Hansen <dave@sr71.net> Link: http://lkml.kernel.org/r/20150108223022.7F56FD13@viggo.jf.intel.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22x86, mpx: Fix potential performance issue on unmapsDave Hansen
The 3.19 merge window saw some TLB modifications merged which caused a performance regression. They were fixed in commit 045bbb9fa. Once that fix was applied, I also noticed that there was a small but intermittent regression still present. It was not present consistently enough to bisect reliably, but I'm fairly confident that it came from (my own) MPX patches. The source was reading a relatively unused field in the mm_struct via arch_unmap. I also noted that this code was in the main instruction flow of do_munmap() and probably had more icache impact than we want. This patch does two things: 1. Adds a static (via Kconfig) and dynamic (via cpuid) check for MPX with cpu_feature_enabled(). This keeps us from reading that cacheline in the mm and trades it for a check of the global CPUID variables at least on CPUs without MPX. 2. Adds an unlikely() to ensure that the MPX call ends up out of the main instruction flow in do_munmap(). I've added a detailed comment about why this was done and why we want it even on systems where MPX is present. Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: luto@amacapital.net Cc: Dave Hansen <dave@sr71.net> Link: http://lkml.kernel.org/r/20150108223021.AEEAB987@viggo.jf.intel.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22x86, mpx: Explicitly disable 32-bit MPX support on 64-bit kernelsDave Hansen
We had originally planned on submitting MPX support in one patch set. We eventually broke it up in to two pieces for easier review. One of the features that didn't make the first round was supporting 32-bit binaries on 64-bit kernels. Once we split the set up, we never added code to restrict 32-bit binaries from _using_ MPX on 64-bit kernels. The 32-bit bounds tables are a different format than the 64-bit ones. Without this patch, the kernel will try to read a 32-bit binary's tables as if they were the 64-bit version. They will likely be noticed as being invalid rather quickly and the app will get killed, but that's kinda mean. This patch adds an explicit check, and will make a 64-bit kernel essentially behave as if it has no MPX support when called from a 32-bit binary. Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Dave Hansen <dave@sr71.net> Link: http://lkml.kernel.org/r/20150108223020.9E9AA511@viggo.jf.intel.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22MAINTAINERS: Update Richard Zhu's email addressLucas Stach
The old cryptic address bounces, fix it by using a properly working one. Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Richard Zhu <Richard.Zhu@freescale.com>
2015-01-23Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: "Five more bug fixes from Michael for the s390 BPF jit" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/bpf: Zero extend parameters before calling C function s390/bpf: Fix sk_load_byte_msh() s390/bpf: Fix offset parameter for skb_copy_bits() s390/bpf: Fix skb_copy_bits() parameter passing s390/bpf: Fix JMP_JGE_K (A >= K) and JMP_JGT_K (A > K)
2015-01-23Merge tag 'nios2-fixes-v3.19-rc6' of ↵Linus Torvalds
git://git.rocketboards.org/linux-socfpga-next Pull one arch/nios2 fix from Ley Foon Tan: "Fix kuser trampoline address" * tag 'nios2-fixes-v3.19-rc6' of git://git.rocketboards.org/linux-socfpga-next: nios2: fix kuser trampoline address
2015-01-23Merge tag 'fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux Pull module and param fixes from Rusty Russell: "Surprising number of fixes this merge window :( The first two are minor fallout from the param rework which went in this merge window. The next three are a series which fixes a longstanding (but never previously reported and unlikely , so no CC stable) race between kallsyms and freeing the init section. Finally, a minor cleanup as our module refcount will now be -1 during unload" * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: module: make module_refcount() a signed integer. module: fix race in kallsyms resolution during module load success. module: remove mod arg from module_free, rename module_memfree(). module_arch_freeing_init(): new hook for archs before module->module_init freed. param: fix uninitialized read with CONFIG_DEBUG_LOCK_ALLOC param: initialize store function to NULL if not available.
2015-01-22MAINTAINERS: ibmvscsi driver maintainer changeTyrel Datwyler
Change maintainer of ibmvscsi driver to Tyrel Datwyler. Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com> Acked-by: Nathan Fontenot <nfont@linux.vnet.ibm.com> Cc: Brian King <brking@linux.vnet.ibm.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22MAINTAINERS: ibmvfc driver maintainer changeTyrel Datwyler
Change maintainer of ibmvfc driver to Tyrel Datwyler. Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com> Cc: Nathan Fontenot <nfont@linux.vnet.ibm.com> Cc: Brian King <brking@linux.vnet.ibm.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22MAINTAINERS: Remove self as isci maintainerDave Jiang
Removing myself as a maintainer. Signed-off-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22scsi_debug: test always evaluates to false, || should be used insteadColin Ian King
cppcheck found the following issue: (warning) Logical conjunction always evaluates to false: alloc_len < 4 && alloc_len > 65535. ..the test should be instead: if (alloc_len < 4 || alloc_len > 65536) This error was introduced by recent commit 38d5c8336e60bf6e53a1da9 ("scsi_debug: add Report supported opcodes+tmfs; Compare and write") Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22of/platform: Handle of_populate drivers in notifierPantelis Antoniou
When using overlays with drivers calling of_populate the notifier will try to create the device twice. Using the populated bit before proceeding protects against this. Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com> Signed-off-by: Grant Likely <grant.likely@linaro.org>
2015-01-22of/overlay: Do not generate duplicate nodesPantelis Antoniou
During the course of the rewrites a bug sneaked in when dealing with children nodes of overlays, which ends up duplicating sub nodes. Simply remove the duplicate traversal of child nodes to fix. Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com> Signed-off-by: Grant Likely <grant.likely@linaro.org>
2015-01-22Merge branch 'fortglx/3.19-stable/time' of ↵Thomas Gleixner
https://git.linaro.org/people/john.stultz/linux into timers/urgent Pull urgent fixes from John Stultz: Two urgent fixes for user triggerable time related overflow issues
2015-01-22nios2: fix kuser trampoline addressLey Foon Tan
__kuser_sigtramp address should be 0x1044 instead of 0x1040. Signed-off-by: Ley Foon Tan <lftan@altera.com>
2015-01-21Merge tag 'renesas-soc-fixes2-for-v3.19' of ↵Olof Johansson
git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes Merge "Second Round of Renesas ARM Based SoC Fixes for v3.19" from Simon Horman: * Instantiate GIC from C board code in legacy builds on r8a7778 and r8a7779 * tag 'renesas-soc-fixes2-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: ARM: shmobile: r8a7779: Instantiate GIC from C board code in legacy builds ARM: shmobile: r8a7778: Instantiate GIC from C board code in legacy builds Signed-off-by: Olof Johansson <olof@lixom.net>
2015-01-22module: make module_refcount() a signed integer.Rusty Russell
James Bottomley points out that it will be -1 during unload. It's only used for diagnostics, so let's not hide that as it could be a clue as to what's gone wrong. Cc: Jason Wessel <jason.wessel@windriver.com> Acked-and-documention-added-by: James Bottomley <James.Bottomley@HansenPartnership.com> Reviewed-by: Masami Hiramatsu <maasami.hiramatsu.pt@hitachi.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2015-01-21[media] omap3isp: Correctly set QUERYCAP capabilitiesSakari Ailus
device_caps in struct v4l2_capability were inadequately set in VIDIOC_QUERYCAP. Fix this. Without this a WARN_ON in the v4l2 core is triggered. This WARN_ON was added for kernel 3.19 exactly to detect these situations. Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi> Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21[media] cx23885: fix free interrupt bugHans Verkuil
First free the interrupt, then disable the PCI device. The other way around will lead to this warning: Jan 19 11:42:02 telek kernel: [ 1440.161234] WARNING: CPU: 0 PID: 2191 at kernel/irq/manage.c:1311 __free_irq+0x97/0x1f0() Jan 19 11:42:02 telek kernel: [ 1440.161236] Trying to free already-free IRQ 0 Jan 19 11:42:02 telek kernel: [ 1440.161237] Modules linked in: tda8290 tda10048 cx25840 cx23885(-) altera_ci tda18271 altera_stapl videobuf2_dvb tveeprom cx2341x videobuf2_dma_sg dvb_core rc_core videobuf2_memops videobuf2_core v4l2_common videodev media nouveau x86_pkg_temp_thermal cfbfillrect cfbimgblt cfbcopyarea ttm drm_kms_helper processor button isci Jan 19 11:42:02 telek kernel: [ 1440.161266] CPU: 0 PID: 2191 Comm: rmmod Tainted: G W 3.19.0-rc1-telek #345 Jan 19 11:42:02 telek kernel: [ 1440.161268] Hardware name: ASUSTeK COMPUTER INC. Z9PE-D8 WS/Z9PE-D8 WS, BIOS 5404 02/10/2014 Jan 19 11:42:02 telek kernel: [ 1440.161270] ffffffff81bf1fce ffff8808958b7cc8 ffffffff8194a97f 0000000000000000 Jan 19 11:42:02 telek kernel: [ 1440.161274] ffff8808958b7d18 ffff8808958b7d08 ffffffff810c56b0 0000000000000286 Jan 19 11:42:02 telek kernel: [ 1440.161279] 0000000000000000 0000000000000000 ffff88089f808890 ffff88089f808800 Jan 19 11:42:02 telek kernel: [ 1440.161284] Call Trace: Jan 19 11:42:02 telek kernel: [ 1440.161290] [<ffffffff8194a97f>] dump_stack+0x4f/0x7b Jan 19 11:42:02 telek kernel: [ 1440.161295] [<ffffffff810c56b0>] warn_slowpath_common+0x80/0xc0 Jan 19 11:42:02 telek kernel: [ 1440.161299] [<ffffffff810c5731>] warn_slowpath_fmt+0x41/0x50 Jan 19 11:42:02 telek kernel: [ 1440.161303] [<ffffffff81955d36>] ? _raw_spin_lock_irqsave+0x56/0x70 Jan 19 11:42:02 telek kernel: [ 1440.161307] [<ffffffff81114849>] ? __free_irq+0x49/0x1f0 Jan 19 11:42:02 telek kernel: [ 1440.161311] [<ffffffff81114897>] __free_irq+0x97/0x1f0 Jan 19 11:42:02 telek kernel: [ 1440.161316] [<ffffffff81114a88>] free_irq+0x48/0xd0 Jan 19 11:42:02 telek kernel: [ 1440.161323] [<ffffffffa00e6deb>] cx23885_finidev+0x4b/0x90 [cx23885] Jan 19 11:42:02 telek kernel: [ 1440.161329] [<ffffffff814529fa>] pci_device_remove+0x3a/0xc0 Jan 19 11:42:02 telek kernel: [ 1440.161334] [<ffffffff8153b4ea>] __device_release_driver+0x7a/0xf0 Jan 19 11:42:02 telek kernel: [ 1440.161338] [<ffffffff8153bc98>] driver_detach+0xc8/0xd0 Jan 19 11:42:02 telek kernel: [ 1440.161341] [<ffffffff8153b1de>] bus_remove_driver+0x4e/0xb0 Jan 19 11:42:02 telek kernel: [ 1440.161345] [<ffffffff8153c2eb>] driver_unregister+0x2b/0x60 Jan 19 11:42:02 telek kernel: [ 1440.161349] [<ffffffff814525c5>] pci_unregister_driver+0x25/0x70 Jan 19 11:42:02 telek kernel: [ 1440.161355] [<ffffffffa00f6ddc>] cx23885_fini+0x10/0x12 [cx23885] Jan 19 11:42:02 telek kernel: [ 1440.161360] [<ffffffff81139a98>] SyS_delete_module+0x1a8/0x1f0 Jan 19 11:42:02 telek kernel: [ 1440.161364] [<ffffffff819561a9>] system_call_fastpath+0x12/0x17 Jan 19 11:42:02 telek kernel: [ 1440.161367] ---[ end trace a9c07cb5f3357020 ]--- Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21[media] pvrusb2: fix missing device_caps in querycapHans Verkuil
The VIDIOC_QUERYCAP function should set device_caps, but this was missing. In addition, it set the version field as well, but that should be done by the core, not by the driver. If a driver doesn't set device_caps the v4l2 core will issue a WARN_ON, so it's important that this is set correctly. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21[media] vb2: fix vb2_thread_stop race conditionsHans Verkuil
The locking scheme inside the vb2 thread is unsafe when stopping the thread. In particular kthread_stop was called *after* internal data structures were cleaned up instead of doing that before. In addition, internal vb2 functions were called after threadio->stop was set to true and vb2_internal_streamoff was called. This is also not allowed. All this led to a variety of race conditions and kernel warnings and/or oopses. Fixed by moving the kthread_stop call up before the cleanup takes place, and by checking threadio->stop before calling internal vb2 queuing operations. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Cc: <stable@vger.kernel.org> # for v3.16 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21[media] rcar_vin: Update device_caps and capabilities in querycapNobuhiro Iwamatsu
The V4L2 API requires both .capabilities and .device_caps fields of struct v4l2_capability to be set. Otherwise the compliance checker complains and since commit "v4l2-ioctl: WARN_ON if querycap didn't fill device_caps" a compile-time warning is issued. Fix this non-compliance in the rcar_vin driver. Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21[media] soc-camera: fix device capabilities in multiple camera host driversGuennadi Liakhovetski
The V4L2 API requires both .capabilities and .device_caps fields of struct v4l2_capability to be set. Otherwise the compliance checker complains and since commit "v4l2-ioctl: WARN_ON if querycap didn't fill device_caps" a compile-time warning is issued. Fix this non-compliance in several soc-camera camera host drivers. Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21[media] Fix Mygica T230 supportJonathan McDowell
Commit 2adb177e57417cf8409e86bda2c516e5f99a2099 removed 2 devices from the cxusb device table but failed to fix up the T230 properties that follow, meaning that this device no longer gets detected properly. Adjust the cxusb_table index appropriate so detection works. Signed-off-by: Jonathan McDowell <noodles@earth.li> Reviewed-by: Olli Salonen <olli.salonen@iki.fi> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21[media] cx23885: Split Hauppauge WinTV Starburst from HVR4400 card entryMatthias Schwarzott
Unconditionally attaching Si2161/Si2165 demod driver breaks Hauppauge WinTV Starburst. So create own card entry for this. Add card name comments to the subsystem ids. This fixes a regression introduced in 3.17 by 36efec48e2e6016e05364906720a0ec350a5d768 ([media] cx23885: Add si2165 support for HVR-5500) Signed-off-by: Matthias Schwarzott <zzam@gentoo.org> Tested-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> CC: stable@vger.kernel.org # for 3.17 and upper Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-21[media] tlg2300: Fix media dependenciesMauro Carvalho Chehab
X-Patchwork-Delegate: m.chehab@samsung.com Changeset ea2e813e8cc3 moved the driver to staging, but it forgot to preserve the existing dependency. Fixes: ea2e813e8cc3 ("[media] tlg2300: move to staging in preparation for removal") Reported-by: Jim Davis <jim.epost@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-01-22Merge tag 'trace-sh-3.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull superh tracing fix from Steven Rostedt: "It's been reported that function tracing does not work on the sh architecture because gcc 4.8 for superH does not support -m32, and the recordmcount.pl script adds "-m32" when re-compiling the object files with the mcount locations. I was not able to reproduce this problem, as it seems that -m32 works fine for my cross compiler gcc 4.6.3, but I have to assume that -m32 was deprecated somewhere between 4.6 and 4.8. As it still seems to compile fine without -m32, I have no reason not to add this patch, as having -m32 seems to cause trouble for others" * tag 'trace-sh-3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: scripts/recordmcount.pl: There is no -m32 gcc option on Super-H anymore
2015-01-21ARM: 8292/1: mm: fix size rounding-down of arm_add_memory() functionMasahiro Yamada
The current rounding of "size" is wrong: - If "start" is sufficiently near the next page boundary, "size" is decremented by more than enough and the last page is lost. - If "size" is sufficiently small, it is wrapped around and gets a bogus value. Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2015-01-21watchdog: drop owner assignment from platform_driversWolfram Sang
This platform_driver does not need to set an owner, it will be populated by the driver core. Signed-off-by: Wolfram Sang <wsa@the-dreams.de> Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
2015-01-21watchdog: imx2_wdt: Disable power down counter on bootMarkus Pargmann
Disable power down counter of the watchdog to avoid system resets. The watchdog power down counter is set automatically by the chip. If it is not set to 0 in the driver, the system resets. Signed-off-by: Markus Pargmann <mpa@pengutronix.de> Acked-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
2015-01-21watchdog: imx2_wdt: Improve power management support.Xiubo Li
Improve power management operations(suspend and resume) as part of dev_pm_ops for IMX2 watchdog driver. If PM will be supported, please make sure that the wdev->clk could disable the watchdog's counter input clock source or can mask watchdog's reset request to the core. If watchdog is still used by consumers and resumes from deep sleep state, we need to restart the watchdog again without enabling the timer. If watchdog been has started --> stopped by the consumers and resumes from non-deep sleep state, then start the timer again. If watchdog has been started --> stopped by the consumers and resumes from deep sleep state, will do nothing. The watchdog will be restarted by consumers next time to be used. Signed-off-by: Xiubo Li <Li.Xiubo@freescale.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
2015-01-21Merge tag 'sound-3.19-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This batch contains two fixes for FireWire lib module and a quirk for yet another Logitech WebCam. The former is the fixes for MIDI handling I forgot to pick up during the merge window. All the fixed code is pretty local and shouldn't give any regressions" * tag 'sound-3.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: Add mic volume fix quirk for Logitech Webcam C210 ALSA: firewire-lib: limit the MIDI data rate ALSA: firewire-lib: remove rx_blocks_for_midi quirk
2015-01-21Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
Pull drm fixes from Dave Airlie: "Just back from LCA + some days off, had some fixes from the past 2 weeks, Some amdkfd code removal for a feature that wasn't ready, otherwise just one fix for core helper sleeping, exynos, i915, and radeon fixes. I thought I had some sti fixes but they were already in, and it confused me for a few mins this morning" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm: fb helper should avoid sleeping in panic context drm/exynos: fix warning of vblank reference count drm/exynos: remove unnecessary runtime pm operations drm/exynos: fix reset codes for memory mapped hdmi phy drm/radeon: use rv515_ring_start on r5xx drm/radeon: add si dpm quirk list drm/radeon: don't print error on -ERESTARTSYS drm/i915: Fix mutex->owner inspection race under DEBUG_MUTEXES drm/i915: Ban Haswell from using RCS flips drm/i915: vlv: sanitize RPS interrupt mask during GPU idling drm/i915: fix HW lockup due to missing RPS IRQ workaround on GEN6 drm/i915: gen9: fix RPS interrupt routing to CPU vs. GT drm/exynos: remove the redundant machine checking code drm/radeon: add a dpm quirk list drm/amdkfd: Fix sparse warning (different address space) drm/radeon: fix VM flush on CIK (v3) drm/radeon: fix VM flush on SI (v3) drm/radeon: fix VM flush on cayman/aruba (v3) drm/amdkfd: Drop interrupt SW ring buffer
2015-01-21Merge tag 'mfd-fixes-3.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD fixes from Lee Jones: - Avoid platform ID collision in da9052 - Skip caching volatile registers in tps65218 - Use correct address base in tps65218 - Repair deadlock on suspend in rtsx_usb * tag 'mfd-fixes-3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: mfd: rtsx_usb: Fix runtime PM deadlock mfd: tps65218: Make INT1 our status_base register mfd: tps65218: Make INT[12] and STATUS registers volatile mfd: da9052-core: Fix platform-device id collision
2015-01-20btrfs: Don't call btrfs_start_transaction() on frozen fs to avoid deadlock.Qu Wenruo
Commit 6b5fe46dfa52 (btrfs: do commit in sync_fs if there are pending changes) will call btrfs_start_transaction() in sync_fs(), to handle some operations needed to be done in next transaction. However this can cause deadlock if the filesystem is frozen, with the following sys_r+w output: [ 143.255932] Call Trace: [ 143.255936] [<ffffffff816c0e09>] schedule+0x29/0x70 [ 143.255939] [<ffffffff811cb7f3>] __sb_start_write+0xb3/0x100 [ 143.255971] [<ffffffffa040ec06>] start_transaction+0x2e6/0x5a0 [btrfs] [ 143.255992] [<ffffffffa040f1eb>] btrfs_start_transaction+0x1b/0x20 [btrfs] [ 143.256003] [<ffffffffa03dc0ba>] btrfs_sync_fs+0xca/0xd0 [btrfs] [ 143.256007] [<ffffffff811f7be0>] sync_fs_one_sb+0x20/0x30 [ 143.256011] [<ffffffff811cbd01>] iterate_supers+0xe1/0xf0 [ 143.256014] [<ffffffff811f7d75>] sys_sync+0x55/0x90 [ 143.256017] [<ffffffff816c49d2>] system_call_fastpath+0x12/0x17 [ 143.256111] Call Trace: [ 143.256114] [<ffffffff816c0e09>] schedule+0x29/0x70 [ 143.256119] [<ffffffff816c3405>] rwsem_down_write_failed+0x1c5/0x2d0 [ 143.256123] [<ffffffff8133f013>] call_rwsem_down_write_failed+0x13/0x20 [ 143.256131] [<ffffffff811caae8>] thaw_super+0x28/0xc0 [ 143.256135] [<ffffffff811db3e5>] do_vfs_ioctl+0x3f5/0x540 [ 143.256187] [<ffffffff811db5c1>] SyS_ioctl+0x91/0xb0 [ 143.256213] [<ffffffff816c49d2>] system_call_fastpath+0x12/0x17 The reason is like the following: (Holding s_umount) VFS sync_fs staff: |- btrfs_sync_fs() |- btrfs_start_transaction() |- sb_start_intwrite() (Waiting thaw_fs to unfreeze) VFS thaw_fs staff: thaw_fs() (Waiting sync_fs to release s_umount) So deadlock happens. This can be easily triggered by fstest/generic/068 with inode_cache mount option. The fix is to check if the fs is frozen, if the fs is frozen, just return and waiting for the next transaction. Cc: David Sterba <dsterba@suse.cz> Reported-by: Gui Hecheng <guihc.fnst@cn.fujitsu.com> Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com> [enhanced comment, changed to SB_FREEZE_WRITE] Signed-off-by: David Sterba <dsterba@suse.cz> Signed-off-by: Chris Mason <clm@fb.com>
2015-01-20btrfs: Fix the bug that fs_info->pending_changes is never cleared.Qu Wenruo
Fs_info->pending_changes is never cleared since the original code uses cmpxchg(&fs_info->pending_changes, 0, 0), which will only clear it if pending_changes is already 0. This will cause a lot of problem when mount it with inode_cache mount option. If the btrfs is mounted as inode_cache, pending_changes will always be 1, even when the fs is frozen. Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com> Reviewed-by: David Sterba <dsterba@suse.cz> Signed-off-by: David Sterba <dsterba@suse.cz> Signed-off-by: Chris Mason <clm@fb.com>
2015-01-21Merge tag 'drm-amdkfd-fixes-2015-01-13' of ↵Dave Airlie
git://people.freedesktop.org/~gabbayo/linux into drm-fixes - Remove the interrupt SW ring buffer impl. as it is not used by any module in amdkfd. - Fix a sparse warning * tag 'drm-amdkfd-fixes-2015-01-13' of git://people.freedesktop.org/~gabbayo/linux: drm/amdkfd: Fix sparse warning (different address space) drm/amdkfd: Drop interrupt SW ring buffer
2015-01-21Merge tag 'drm-intel-fixes-2015-01-15' of ↵Dave Airlie
git://anongit.freedesktop.org/drm-intel into drm-fixes misc i915 fixes * tag 'drm-intel-fixes-2015-01-15' of git://anongit.freedesktop.org/drm-intel: drm/i915: Fix mutex->owner inspection race under DEBUG_MUTEXES drm/i915: Ban Haswell from using RCS flips drm/i915: vlv: sanitize RPS interrupt mask during GPU idling drm/i915: fix HW lockup due to missing RPS IRQ workaround on GEN6 drm/i915: gen9: fix RPS interrupt routing to CPU vs. GT
2015-01-21drm: fb helper should avoid sleeping in panic contextRui Wang
There are still some places in the fb helper that need to avoid sleeping in panic context. Here's an example: [ 65.615496] bad: scheduling from the idle thread! [ 65.620747] CPU: 92 PID: 0 Comm: swapper/92 Tainted: G M E 3.18.0-rc4-7-default+ #20 [ 65.630364] Hardware name: Intel Corporation BRICKLAND/BRICKLAND, BIOS BRHSXSD1.86B.0056.R01.1409242327 09/24/2014 [ 65.641923] ffff88087f693d80 ffff88087f689878 ffffffff81566db9 0000000000000000 [ 65.650226] ffff88087f693d80 ffff88087f689898 ffffffff810871ff ffff88046eb3e0d0 [ 65.658527] ffff88087f693d80 ffff88087f6898c8 ffffffff8107c1fa 000000017f6898b8 [ 65.666830] Call Trace: [ 65.669557] <#MC> [<ffffffff81566db9>] dump_stack+0x46/0x58 [ 65.675994] [<ffffffff810871ff>] dequeue_task_idle+0x2f/0x40 [ 65.682412] [<ffffffff8107c1fa>] dequeue_task+0x5a/0x80 [ 65.688345] [<ffffffff810804f3>] deactivate_task+0x23/0x30 [ 65.694569] [<ffffffff81569050>] __schedule+0x580/0x7f0 [ 65.700502] [<ffffffff81569739>] schedule_preempt_disabled+0x29/0x70 [ 65.707696] [<ffffffff8156abb6>] __ww_mutex_lock_slowpath+0xb8/0x162 [ 65.714891] [<ffffffff8156acb3>] __ww_mutex_lock+0x53/0x85 [ 65.721125] [<ffffffffa00b3a5d>] drm_modeset_lock+0x3d/0x110 [drm] [ 65.728132] [<ffffffffa00b3c2a>] __drm_modeset_lock_all+0x8a/0x120 [drm] [ 65.735721] [<ffffffffa00b3cd0>] drm_modeset_lock_all+0x10/0x30 [drm] [ 65.743015] [<ffffffffa01af8bf>] drm_fb_helper_pan_display+0x2f/0xf0 [drm_kms_helper] [ 65.751857] [<ffffffff8132bd21>] fb_pan_display+0xd1/0x1a0 [ 65.758081] [<ffffffff81326010>] bit_update_start+0x20/0x50 [ 65.764400] [<ffffffff813259f2>] fbcon_switch+0x3a2/0x550 [ 65.770528] [<ffffffff813a01c9>] redraw_screen+0x189/0x240 [ 65.776750] [<ffffffff81322f8a>] fbcon_blank+0x20a/0x2d0 [ 65.782778] [<ffffffff8137d359>] ? erst_writer+0x209/0x330 [ 65.789002] [<ffffffff810ba2f3>] ? internal_add_timer+0x63/0x80 [ 65.795710] [<ffffffff810bc137>] ? mod_timer+0x127/0x1e0 [ 65.801740] [<ffffffff813a0cd8>] do_unblank_screen+0xa8/0x1d0 [ 65.808255] [<ffffffff813a0e10>] unblank_screen+0x10/0x20 [ 65.814381] [<ffffffff812ca0d9>] bust_spinlocks+0x19/0x40 [ 65.820508] [<ffffffff81561ca7>] panic+0x106/0x1f5 [ 65.825955] [<ffffffff8102336c>] mce_panic+0x2ac/0x2e0 [ 65.831789] [<ffffffff812c796a>] ? delay_tsc+0x4a/0x80 [ 65.837625] [<ffffffff81024e1f>] do_machine_check+0xbaf/0xbf0 [ 65.844138] [<ffffffff813365d7>] ? intel_idle+0xc7/0x150 [ 65.850166] [<ffffffff8156f03f>] machine_check+0x1f/0x30 [ 65.856195] [<ffffffff813365d7>] ? intel_idle+0xc7/0x150 [ 65.862222] <<EOE>> [<ffffffff814283d5>] cpuidle_enter_state+0x55/0x170 [ 65.869823] [<ffffffff814285a7>] cpuidle_enter+0x17/0x20 [ 65.875852] [<ffffffff81097b08>] cpu_startup_entry+0x2d8/0x370 [ 65.882467] [<ffffffff8102fe29>] start_secondary+0x159/0x180 There's __drm_modeset_lock_all() which Daniel Vetter introduced for this purpose. We can leverage that without reinventing anything. This patch works with the latest kernel. Reviewed-by: Rob Clark <robdclark@gmail.com> Tested-by: Tony Luck <tony.luck@intel.com> Signed-off-by: Rui Wang <rui.y.wang@intel.com> Signed-off-by: Dave Airlie <airlied@redhat.com>