Commit graph

636,674 commits

Author SHA1 Message Date
Dave Airlie
c0c4249da5 Merge branch 'drm-fixes-4.9' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
Regression fixes for PX and a powerplay fix.

* 'drm-fixes-4.9' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: fix check for port PM availability
  drm/amdgpu: fix check for port PM availability
  drm/amd/powerplay: initialize the soft_regs offset in struct smu7_hwmgr
2016-11-30 14:15:57 +10:00
Linus Torvalds
ded6e842cf ARC fixes for 4.9 final
- PAE40 crash	[Yuriy]
  - Disabling IO-Coherency by default
  - Using a different inline asm constraint for Zero Overhead loops
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJYPhn7AAoJEGnX8d3iisJeqCkP/0DfP3r9QwEPgmuv38wL9G+y
 RN1lYLvtNLOE7jHe0NksV7hJxDTRk3b+GoJCjTNmEt0rp0ePNqv0Hu8IAB3vwMWt
 bYosIoYHi0/AWTgchlNf7/Az3Qwg61Pk6nk2RvqgEPo6K8/rQJtzlFhCi2X6Oqei
 SYMKSmQ8Mu76kBW09Zj46SS9q+6bKIT7XhPThFxt2uM80SKZwUr42w9hWehQ2bPi
 EMU1bgBOw5YUDOL2V38jXrhMokgjF7Idk/yMtQROy05k3FYj66tur528eOxemFKc
 nCsAHVE0keEQ9ZKoPao9NDRRChMW/kRMxmMboTxEccpUFlhBzZOzG4/RtTymyq97
 f9kX3zGmuaaL6JF4OgZXcHz5hzpRVlUhRRmBMPpL8iNPyz1wuxGAyy8Q9ZGWioX8
 157hQF1w2QfsUeNGBvwwcKAIKuR/uxx83WX58h5TEqq6RE6v1+JvGMT6u+0Zwmdk
 mwEyq9YbWOcFPFnkijdK/TJi0Cg4RC9yKnO8Zt4qkXKexVFLA+Rid6i7/8qanUHU
 uf9XkI1m4R1oVN11hZkBEmZbhsdh7Vv9KiI22sci5WQV2rIZUW1lP67pfEpSLtY8
 zC0Y8V6Mcmh3PYi+Cj2eEdeiE3wVwsA5l1UHRaKpcBwK3N71dY4oRop6V1mCbj7T
 3Sq8+f+b6uq9VyFfvlsD
 =M8Kh
 -----END PGP SIGNATURE-----

Merge tag 'arc-4.9-final' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc

Pull ARC fixes from Vineet Gupta:

 - fix PAE40 crash [Yuriy]

 - disable IO-Coherency by default

 - use a different inline asm constraint for Zero Overhead loops

* tag 'arc-4.9-final' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
  ARC: mm: PAE40: Fix crash at munmap
  ARC: mm: IOC: Don't enable IOC by default
  ARC: Don't use "+l" inline asm constraint
2016-11-29 18:30:50 -08:00
Arnaldo Carvalho de Melo
a510887824 GSO: Reload iph after pskb_may_pull
As it may get stale and lead to use after free.

Acked-by: Eric Dumazet <[email protected]>
Cc: Alexander Duyck <[email protected]>
Cc: Andrey Konovalov <[email protected]>
Fixes: cbc53e08a7 ("GSO: Add GSO type for fixed IPv4 ID")
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
Acked-by: Alexander Duyck <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-29 20:45:54 -05:00
Jiri Pirko
725cbb62e7 sched: cls_flower: remove from hashtable only in case skip sw flag is not set
Be symmetric to hashtable insert and remove filter from hashtable only
in case skip sw flag is not set.

Fixes: e69985c67c ("net/sched: cls_flower: Introduce support in SKIP SW flag")
Signed-off-by: Jiri Pirko <[email protected]>
Reviewed-by: Amir Vadai <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-29 20:44:38 -05:00
Eric Dumazet
648f0c28df net/dccp: fix use-after-free in dccp_invalid_packet
pskb_may_pull() can reallocate skb->head, we need to reload dh pointer
in dccp_invalid_packet() or risk use after free.

Bug found by Andrey Konovalov using syzkaller.

Signed-off-by: Eric Dumazet <[email protected]>
Reported-by: Andrey Konovalov <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-29 20:37:26 -05:00
Zumeng Chen
ffac0e967f net: macb: ensure ordering write to re-enable RX smoothly
When a hardware issue happened as described by inline comments, the register
write pattern looks like the following:

<write ~MACB_BIT(RE)>
+ wmb();
<write MACB_BIT(RE)>

There might be a memory barrier between these two write operations, so add wmb
to ensure an flip from 0 to 1 for NCR.

Signed-off-by: Zumeng Chen <[email protected]>
Acked-by: Nicolas Ferre <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-29 20:33:55 -05:00
Cyrille Pitchen
a0b44eea37 net: macb: fix the RX queue reset in macb_rx()
On macb only (not gem), when a RX queue corruption was detected from
macb_rx(), the RX queue was reset: during this process the RX ring
buffer descriptor was initialized by macb_init_rx_ring() but we forgot
to also set bp->rx_tail to 0.

Indeed, when processing the received frames, bp->rx_tail provides the
macb driver with the index in the RX ring buffer of the next buffer to
process. So when the whole ring buffer is reset we must also reset
bp->rx_tail so the driver is synchronized again with the hardware.

Since macb_init_rx_ring() is called from many locations, currently from
macb_rx() and macb_init_rings(), we'd rather add the "bp->rx_tail = 0;"
line inside macb_init_rx_ring() than add the very same line after each
call of this function.

Without this fix, the rx queue is not reset properly to recover from
queue corruption and connection drop may occur.

Signed-off-by: Cyrille Pitchen <[email protected]>
Fixes: 9ba723b081 ("net: macb: remove BUG_ON() and reset the queue to handle RX errors")
Acked-by: Nicolas Ferre <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-29 20:01:31 -05:00
Herbert Xu
707693c8a4 netlink: Call cb->done from a worker thread
The cb->done interface expects to be called in process context.
This was broken by the netlink RCU conversion.  This patch fixes
it by adding a worker struct to make the cb->done call where
necessary.

Fixes: 21e4902aea ("netlink: Lockless lookup with RCU grace...")
Reported-by: Subash Abhinov Kasiviswanathan <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>
Acked-by: Cong Wang <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-29 19:48:38 -05:00
Amir Vadai
95c2027bfe net/sched: pedit: make sure that offset is valid
Add a validation function to make sure offset is valid:
1. Not below skb head (could happen when offset is negative).
2. Validate both 'offset' and 'at'.

Signed-off-by: Amir Vadai <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-29 19:46:00 -05:00
Linus Torvalds
faaae2a581 Re-enable CONFIG_MODVERSIONS in a slightly weaker form
This enables CONFIG_MODVERSIONS again, but allows for missing symbol CRC
information in order to work around the issue that newer binutils
versions seem to occasionally drop the CRC on the floor.  binutils 2.26
seems to work fine, while binutils 2.27 seems to break MODVERSIONS of
symbols that have been defined in assembler files.

[ We've had random missing CRC's before - it may be an old problem that
  just is now reliably triggered with the weak asm symbols and a new
  version of binutils ]

Some day I really do want to remove MODVERSIONS entirely.  Sadly, today
does not appear to be that day: Debian people apparently do want the
option to enable MODVERSIONS to make it easier to have external modules
across kernel versions, and this seems to be a fairly minimal fix for
the annoying problem.

Cc: Ben Hutchings <[email protected]>
Acked-by: Michal Marek <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2016-11-29 16:01:30 -08:00
Linus Torvalds
22d3d4fbbd Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6
Pull CIFS fixes from Steve French:
 "A few misc important cifs fixes, including a fix for a 4.9 regression
  in posix_acl xattr handling"

* 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
  CIFS: iterate over posix acl xattr entry correctly in ACL_to_cifs_posix()
  Call echo service immediately after socket reconnect
  CIFS: Fix BUG() in calc_seckey()
2016-11-29 11:33:28 -08:00
Florian Westphal
9b57da0630 netfilter: ipv6: nf_defrag: drop mangled skb on ream error
Dmitry Vyukov reported GPF in network stack that Andrey traced down to
negative nh offset in nf_ct_frag6_queue().

Problem is that all network headers before fragment header are pulled.
Normal ipv6 reassembly will drop the skb when errors occur further down
the line.

netfilter doesn't do this, and instead passed the original fragment
along.  That was also fine back when netfilter ipv6 defrag worked with
cloned fragments, as the original, pristine fragment was passed on.

So we either have to undo the pull op, or discard such fragments.
Since they're malformed after all (e.g. overlapping fragment) it seems
preferrable to just drop them.

Same for temporary errors -- it doesn't make sense to accept (and
perhaps forward!) only some fragments of same datagram.

Fixes: 029f7f3b87 ("netfilter: ipv6: nf_defrag: avoid/free clone operations")
Reported-by: Dmitry Vyukov <[email protected]>
Debugged-by: Andrey Konovalov <[email protected]>
Diagnosed-by: Eric Dumazet <Eric Dumazet <[email protected]>
Signed-off-by: Florian Westphal <[email protected]>
Acked-by: Eric Dumazet <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>
2016-11-29 20:23:58 +01:00
Linus Torvalds
ab59d1f4b6 SCSI fixes on 20161129
Four small fixes.  The be2iscsi is a potential device overrun in
 consistent memory, which could have nasty consequences if the
 consistent allocations are packed.  The hpsa one fixes a regression
 where older controllers can now get a numbering clash between the
 first internal disk and the controller. The libfc one is a regression
 in timespec conversions which causes a user visible issue in a command
 line tool and the mpt3sas one fixes a regression where the controller
 could remain permanently blocked after an ATA pass through command
 followed by a reset.
 
 Signed-off-by: James E.J. Bottomley <[email protected]>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJYPc7BAAoJEAVr7HOZEZN4odIP/2Rt4QLYQyAlwRcPoMOhhxgL
 4DcZuU/aEqv7jb2UHDQxmYPyuGu4rSti/Zlj1GYo94KuZKd5nmC3U+vyMWEeBcfE
 l0v5A+rsRNJjVesGoTf0lcIuFWgUvy9nRA/XXIuWr1Aq8+ySy8ACFx91PamW9aiT
 yznBgZ8dbPSMozEveTv+Wy02T/w1H67idzOrAoH4oIyYHhDdeU1xkUwMFp87/OLL
 0IGJLNHqkmrCTMXq533jAG9wIZVgJGBP5ddqxKz1P6sUBQfZ6YbSwecyC7d6/85X
 sadUiTMqT1mwCUbLYREyAuqSkuz7WhSBCB57N9yN33NUlW0kSbb4EkFZAj7rAEsU
 vWb0bMxqB8k2IwGhwsQhTESgxQNXGPGbfd/BNpN/ffeYfhCjxB0jLIHPjxTANJah
 E3j6HMWp4lxJJJEupQKoY2SeE20CMCTKaubRv8yw7EV2xng/slMVgzQL3XLszzFF
 h7WqkhPOyqgtBRaDuVsig1ZkwBhgZXkMM5sUGJp1nGZRoVnUbhtxdTS/xcN5pcnt
 G/Aq0LdDgYYtf1FQ83gX62rF8SSMu5xSVgBEDdVq/G/AaN/PwAr6DTWWV9rTodwH
 t4sdz/soPOwBvyp+m4S6RtPbNaF0Px8QRIWeaIUpQbvUhgwgmAGSOCIjhgJK3RMR
 /Hu9N+VFANZBf06Bv5Tk
 =9LSa
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Four small fixes.

  The be2iscsi is a potential device overrun in consistent memory, which
  could have nasty consequences if the consistent allocations are
  packed.

  The hpsa one fixes a regression where older controllers can now get a
  numbering clash between the first internal disk and the controller.

  The libfc one is a regression in timespec conversions which causes a
  user visible issue in a command line tool and the mpt3sas one fixes a
  regression where the controller could remain permanently blocked after
  an ATA pass through command followed by a reset"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: be2iscsi: allocate enough memory in beiscsi_boot_get_sinfo()
  scsi: mpt3sas: Unblock device after controller reset
  scsi: hpsa: use bus '3' for legacy HBA devices
  scsi: libfc: fix seconds_since_last_reset miscalculation
2016-11-29 11:15:37 -08:00
Jan Glauber
dfa2ccc30e Revert "i2c: octeon: thunderx: Limit register access retries"
This reverts commit 70121f7f37 ("i2c: octeon: thunderx: Limit register access retries").
Using readq_poll_timeout instead of __raw_readq triggers the following
debug warning:

[   78.871568] ipmi_ssif: Trying hotmod-specified SSIF interface at i2c address 0x12, adapter Cavium ThunderX i2c adapter at 0000:01:09.4, slave address 0x0
[   78.886107] do not call blocking ops when !TASK_RUNNING; state=2 set at [<fffffc00080e0088>] prepare_to_wait_event+0x58/0x10c
[   78.897436] ------------[ cut here ]------------
[   78.902050] WARNING: CPU: 6 PID: 2235 at kernel/sched/core.c:7718 __might_sleep+0x80/0x88

[...]

[   79.133553] [<fffffc00080c3aac>] __might_sleep+0x80/0x88
[   79.138862] [<fffffc0000e30138>] octeon_i2c_test_iflg+0x4c/0xbc [i2c_thunderx]
[   79.146077] [<fffffc0000e30958>] octeon_i2c_test_ready+0x18/0x70 [i2c_thunderx]
[   79.153379] [<fffffc0000e30b04>] octeon_i2c_wait+0x154/0x1a4 [i2c_thunderx]
[   79.160334] [<fffffc0000e310bc>] octeon_i2c_xfer+0xf4/0xf60 [i2c_thunderx]

Signed-off-by: Jan Glauber <[email protected]>
Acked-by: Steven J. Hill <[email protected]>
Signed-off-by: Wolfram Sang <[email protected]>
2016-11-29 20:04:21 +01:00
Jyri Sarha
2d53a18098 drm/tilcdc: Fix race from forced shutdown of crtc in unload
Fix race from forced shutdown of crtc in unload by adding internal
locking and a boolean telling if device is going to be shutdown.

Signed-off-by: Jyri Sarha <[email protected]>
2016-11-29 21:03:20 +02:00
Jyri Sarha
9e79e062dc drm/tilcdc: Use unload to handle initialization failures
Use unload to handle initialization failures instead of complex goto
label mess. To do this the initialization sequence needed slight
reordering and some unload functions needed to become conditional.

Signed-off-by: Jyri Sarha <[email protected]>
2016-11-29 21:03:19 +02:00
Jyri Sarha
923310ba73 drm/tilcdc: Stop using struct drm_driver load() callback
Stop using struct drm_driver load() and unload() callbacks. The
callbacks should not be used anymore. Instead of using load the
drm_device is allocated with drm_dev_alloc() and registered with
drm_dev_register() only after the driver is completely initialized.
The deinitialization is done directly either in component unbind
callback or in platform driver demove callback.

Signed-off-by: Jyri Sarha <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
2016-11-29 21:03:19 +02:00
Jyri Sarha
15d704e53c drm/tilcdc: Remove obsolete drm_connector_register() calls
Remove obsolete drm_connector_register() calls from tilcdc_panel.c and
tilcdc_tfp410.c. All connectors are registered when drm_dev_register()
is called.

Signed-off-by: Jyri Sarha <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
2016-11-29 21:03:18 +02:00
Daniel Schultz
d701453bd5 drm/tilcdc: Correct misspelling in error message
This error message will be printed when a FIFO underflow irq has
triggered. Since this happens sometimes and the error message will be
displayed on the console, it should have a correct spelling.

Signed-off-by: Daniel Schultz <[email protected]>
Signed-off-by: Jyri Sarha <[email protected]>
2016-11-29 21:03:17 +02:00
Daniel Schultz
4c268d635f drm/tilcdc: Add revision handling for FB_CEILING
The commit d8ff0c63fbcb ("drm/tilcdc: Adjust the FB_CEILING address")
added an adjustment of the FB_CEILING address. This is done by decrementing
the address by one.

On the AM335x (rev 0x4F201000) the framebuffer is rotated left over the
display border, because the ceiling address is 8f276fff instead of
8f277000. Since this adjustment isn't necessary for the LCDC v2, the
origin ceiling address should be used.

Signed-off-by: Daniel Schultz <[email protected]>
Signed-off-by: Jyri Sarha <[email protected]>
2016-11-29 21:03:17 +02:00
Bartosz Golaszewski
507b72b24c drm/tilcdc: add a da850-specific compatible string
Due to some potential tweaks for the da850 LCDC (for example: the
required memory bandwith settings) we need a separate compatible
for the IP present on the da850 boards.

Suggested-by: Sekhar Nori <[email protected]>
Signed-off-by: Bartosz Golaszewski <[email protected]>
Acked-by: Rob Herring <[email protected]>
Signed-off-by: Jyri Sarha <[email protected]>
2016-11-29 21:03:16 +02:00
Bartosz Golaszewski
cb42e20ea0 drm/tilcdc: add a workaround for failed clk_set_rate()
Some architectures don't use the common clock framework and don't
implement all the clk interfaces for every clock. This is the case
for da850-lcdk where clk_set_rate() only works for PLL0 and PLL1.

Trying to set the clock rate for the LCDC clock results in -EINVAL
being returned.

As a workaround for that: if the call to clk_set_rate() fails, fall
back to adjusting the clock divider instead. Proper divider value is
calculated by dividing the current clock rate by the required pixel
clock rate in HZ.

This code is based on a hack initially developed internally for
baylibre by Karl Beldan <[email protected]>.

Tested with a da850-lcdk with an LCD display connected over VGA.

Signed-off-by: Bartosz Golaszewski <[email protected]>
Signed-off-by: Jyri Sarha <[email protected]>
2016-11-29 21:03:15 +02:00
Yuriy Kolerov
6a8b2ca702 ARC: mm: PAE40: Fix crash at munmap
commit 1c3c909303 broke PAE40. Macro pfn_pte(pfn, prot) creates paddr
from pfn, but the page shift was getting truncated to 32 bits since we lost
the proper cast to 64 bits (for PAE400

Instead of reverting that commit, use a better helper which is 32/64 bits
safe just like ARM implementation.

Fixes: 1c3c909303 ("ARC: mm: fix build breakage with STRICT_MM_TYPECHECKS")
Cc: <[email protected]>   #4.4+
Signed-off-by: Yuriy Kolerov <[email protected]>
[vgupta: massaged changelog]
Signed-off-by: Vineet Gupta <[email protected]>
2016-11-29 09:12:08 -08:00
Aaron Lu
a2ce2666aa mremap: move_ptes: check pte dirty after its removal
Linus found there still is a race in mremap after commit 5d1904204c
("mremap: fix race between mremap() and page cleanning").

As described by Linus:
 "the issue is that another thread might make the pte be dirty (in the
  hardware walker, so no locking of ours will make any difference)
  *after* we checked whether it was dirty, but *before* we removed it
  from the page tables"

Fix it by moving the check after we removed it from the page table.

Suggested-by: Linus Torvalds <[email protected]>
Signed-off-by: Aaron Lu <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2016-11-29 08:20:24 -08:00
Johan Hovold
0e1614ac84 pwm: Fix device reference leak
Make sure to drop the reference to the parent device taken by
class_find_device() after "unexporting" any children when deregistering
a PWM chip.

Fixes: 0733424c9b ("pwm: Unexport children before chip removal")
Signed-off-by: Johan Hovold <[email protected]>
Signed-off-by: Thierry Reding <[email protected]>
2016-11-29 16:43:24 +01:00
Alex Deucher
bcfdd5d510 drm/radeon: fix check for port PM availability
The ATPX method does not always exist on the dGPU, it may be located at
the iGPU. The parent device of the iGPU is the root port for which
bridge_d3 is false. This accidentally enables the legacy PM method which
conflicts with port PM and prevented the dGPU from powering on.

Ported from amdgpu commit:
drm/amdgpu: fix check for port PM availability
from Peter Wu.

Fixes: d3ac31f3b4 (drm/radeon: fix power state when port pm is unavailable (v2))
Signed-off-by: Alex Deucher <[email protected]>
Cc: Peter Wu <[email protected]>
Cc: <[email protected]> # 4.8+
2016-11-29 09:24:13 -05:00
Peter Wu
7ac33e47d5 drm/amdgpu: fix check for port PM availability
The ATPX method does not always exist on the dGPU, it may be located at
the iGPU. The parent device of the iGPU is the root port for which
bridge_d3 is false. This accidentally enables the legacy PM method which
conflicts with port PM and prevented the dGPU from powering on.

Fixes: 1db4496f16 ("drm/amdgpu: fix power state when port pm is unavailable")

Reported-and-tested-by: Mike Lothian <[email protected]>
Signed-off-by: Peter Wu <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Cc: <[email protected]> # 4.8+
2016-11-29 09:23:39 -05:00
Chris Wilson
389f78b361 drm: Introduce drm_framebuffer_assign()
In a couple of places currently, and with the intent to add more, we
update a pointer to a framebuffer to hold a new fb reference (evicting
the old).

Signed-off-by: Chris Wilson <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2016-11-29 10:22:08 +01:00
Miklos Szeredi
c4fcfc1619 ovl: fix d_real() for stacked fs
Handling of recursion in d_real() is completely broken.  Recursion is only
done in the 'inode != NULL' case.  But when opening the file we have
'inode == NULL' hence d_real() will return an overlay dentry.  This won't
work since overlayfs doesn't define its own file operations, so all file
ops will fail.

Fix by doing the recursion first and the check against the inode second.

Bash script to reproduce the issue written by Quentin:

 - 8< - - - - - 8< - - - - - 8< - - - - - 8< - - - -
tmpdir=$(mktemp -d)
pushd ${tmpdir}

mkdir -p {upper,lower,work}
echo -n 'rocks' > lower/ksplice
mount -t overlay level_zero upper -o lowerdir=lower,upperdir=upper,workdir=work
cat upper/ksplice

tmpdir2=$(mktemp -d)
pushd ${tmpdir2}

mkdir -p {upper,work}
mount -t overlay level_one upper -o lowerdir=${tmpdir}/upper,upperdir=upper,workdir=work
ls -l upper/ksplice
cat upper/ksplice
 - 8< - - - - - 8< - - - - - 8< - - - - - 8< - - - - 

Reported-by: Quentin Casasnovas <[email protected]>
Signed-off-by: Miklos Szeredi <[email protected]>
Fixes: 2d902671ce ("vfs: merge .d_select_inode() into .d_real()")
Cc: <[email protected]> # v4.8+
2016-11-29 10:20:24 +01:00
Eryu Guan
ae9ebe7c4e CIFS: iterate over posix acl xattr entry correctly in ACL_to_cifs_posix()
Commit 2211d5ba5c ("posix_acl: xattr representation cleanups")
removes the typedefs and the zero-length a_entries array in struct
posix_acl_xattr_header, and uses bare struct posix_acl_xattr_header
and struct posix_acl_xattr_entry directly.

But it failed to iterate over posix acl slots when converting posix
acls to CIFS format, which results in several test failures in
xfstests (generic/053 generic/105) when testing against a samba v1
server, starting from v4.9-rc1 kernel. e.g.

  [root@localhost xfstests]# diff -u tests/generic/105.out /root/xfstests/results//generic/105.out.bad
  --- tests/generic/105.out       2016-09-19 16:33:28.577962575 +0800
  +++ /root/xfstests/results//generic/105.out.bad 2016-10-22 15:41:15.201931110 +0800
  @@ -1,3 +1,4 @@
   QA output created by 105
   -rw-r--r-- root
  +setfacl: subdir: Invalid argument
   -rw-r--r-- root

Fix it by introducing a new "ace" var, like what
cifs_copy_posix_acl() does, and iterating posix acl xattr entries
over it in the for loop.

Signed-off-by: Eryu Guan <[email protected]>
Signed-off-by: Steve French <[email protected]>
2016-11-28 23:08:53 -06:00
Sachin Prabhu
b8c600120f Call echo service immediately after socket reconnect
Commit 4fcd1813e6 ("Fix reconnect to not defer smb3 session reconnect
long after socket reconnect") changes the behaviour of the SMB2 echo
service and causes it to renegotiate after a socket reconnect. However
under default settings, the echo service could take up to 120 seconds to
be scheduled.

The patch forces the echo service to be called immediately resulting a
negotiate call being made immediately on reconnect.

Signed-off-by: Sachin Prabhu <[email protected]>
Reviewed-by: Pavel Shilovsky <[email protected]>
Signed-off-by: Steve French <[email protected]>
2016-11-28 23:08:52 -06:00
Sachin Prabhu
5f4b55699a CIFS: Fix BUG() in calc_seckey()
Andy Lutromirski's new virtually mapped kernel stack allocations moves
kernel stacks the vmalloc area. This triggers the bug
 kernel BUG at ./include/linux/scatterlist.h:140!
at calc_seckey()->sg_init()

Signed-off-by: Sachin Prabhu <[email protected]>
Signed-off-by: Steve French <[email protected]>
Reviewed-by: Jeff Layton <[email protected]>
2016-11-28 23:08:52 -06:00
Srinivas Kandagatla
b2383fa359 drm/bridge: adv7511: Enable the audio data and clock pads on adv7533
This patch enables the Audio Data and Clock pads to the adv7533 bridge.
Without this patch audio can not be played.

Cc: David Airlie <[email protected]>
Cc: Archit Taneja <[email protected]>
Cc: Laurent Pinchart <[email protected]>
Cc: Wolfram Sang <[email protected]>
Cc: Srinivas Kandagatla <[email protected]>
Cc: "Ville Syrjälä" <[email protected]>
Cc: Boris Brezillon <[email protected]>
Cc: Andy Green <[email protected]>
Cc: Dave Long <[email protected]>
Cc: Guodong Xu <[email protected]>
Cc: Zhangfei Gao <[email protected]>
Cc: Mark Brown <[email protected]>
Cc: Lars-Peter Clausen <[email protected]>
Cc: Jose Abreu <[email protected]>
Cc: Kuninori Morimoto <[email protected]>
Cc: [email protected]
Signed-off-by: Srinivas Kandagatla <[email protected]>
Signed-off-by: John Stultz <[email protected]>
Signed-off-by: Archit Taneja <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2016-11-29 09:48:54 +05:30
John Stultz
53c515befe drm/bridge: adv7511: Add Audio support
This patch adds support to Audio for both adv7511 and adv7533
bridge chips.

This patch was originally from [1] by Lars-Peter Clausen <[email protected]>
and was adapted by Archit Taneja <[email protected]> and
Srinivas Kandagatla <[email protected]>.

Then I heavily reworked it to use the hdmi-codec driver. And also
folded in some audio packet initialization done by Andy Green
<[email protected]>. So credit to them, but blame to me.

[1] https://github.com/analogdevicesinc/linux/blob/xcomm_zynq/drivers/gpu/drm/i2c/adv7511_audio.c

Cc: David Airlie <[email protected]>
Cc: Archit Taneja <[email protected]>
Cc: Laurent Pinchart <[email protected]>
Cc: Wolfram Sang <[email protected]>
Cc: Srinivas Kandagatla <[email protected]>
Cc: "Ville Syrjälä" <[email protected]>
Cc: Boris Brezillon <[email protected]>
Cc: Andy Green <[email protected]>
Cc: Dave Long <[email protected]>
Cc: Guodong Xu <[email protected]>
Cc: Zhangfei Gao <[email protected]>
Cc: Mark Brown <[email protected]>
Cc: Lars-Peter Clausen <[email protected]>
Cc: Jose Abreu <[email protected]>
Cc: Kuninori Morimoto <[email protected]>
Cc: [email protected]
Acked-by: Lars-Peter Clausen <[email protected]>
Signed-off-by: John Stultz <[email protected]>
Signed-off-by: Archit Taneja <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2016-11-29 09:48:46 +05:30
Rex Zhu
b64268d8a3 drm/amd/powerplay: initialize the soft_regs offset in struct smu7_hwmgr
This could lead to mclk dpm problems on some boards.

Signed-off-by: Rex Zhu <[email protected]>
Ack-by: Tom St Denis <[email protected]>
Reviewed-by: Huang Rui <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
2016-11-28 18:22:37 -05:00
Linus Torvalds
88abd8249e Merge branch 'for-4.9-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata
Pull libata fixes from Tejun Heo:
 "The recent changes in ahci MSI handling need one more fix.  Hopefully,
  this restores parity with before.

  The other two are minor fixes with both low impact and risk"

* 'for-4.9-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
  ahci: always fall back to single-MSI mode
  libata-scsi: Fixup ata_gen_passthru_sense()
  mvsas: fix error return code in mvs_task_prep()
2016-11-28 14:17:10 -08:00
Linus Torvalds
96e52d3ac8 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc
Pull sparc fixes from David Miller:
 "Two ugly build warning fixes"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
  dbri: Fix compiler warning
  qlogicpti: Fix compiler warnings
2016-11-28 13:53:19 -08:00
Michael Holzheu
2dbb4c05d0 bpf/samples: Fix PT_REGS_IP on s390x and use it
The files "sampleip_kern.c" and "trace_event_kern.c" directly access
"ctx->regs.ip" which is not available on s390x. Fix this and use the
PT_REGS_IP() macro instead.

Also fix the macro for s390x and use "psw.addr" from "pt_regs".

Reported-by: Zvonko Kosic <[email protected]>
Signed-off-by: Michael Holzheu <[email protected]>
Acked-by: Alexei Starovoitov <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-28 16:26:46 -05:00
Nikita Yushchenko
7a99cd6e21 net: dsa: fix unbalanced dsa_switch_tree reference counting
_dsa_register_switch() gets a dsa_switch_tree object either via
dsa_get_dst() or via dsa_add_dst(). Former path does not increase kref
in returned object (resulting into caller not owning a reference),
while later path does create a new object (resulting into caller owning
a reference).

The rest of _dsa_register_switch() assumes that it owns a reference, and
calls dsa_put_dst().

This causes a memory breakage if first switch in the tree initialized
successfully, but second failed to initialize. In particular, freed
dsa_swith_tree object is left referenced by switch that was initialized,
and later access to sysfs attributes of that switch cause OOPS.

To fix, need to add kref_get() call to dsa_get_dst().

Fixes: 83c0afaec7 ("net: dsa: Add new binding implementation")
Signed-off-by: Nikita Yushchenko <[email protected]>
Reviewed-by: Andrew Lunn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-28 16:15:45 -05:00
David Ahern
79dc7e3f1c net: handle no dst on skb in icmp6_send
Andrey reported the following while fuzzing the kernel with syzkaller:

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 3859 Comm: a.out Not tainted 4.9.0-rc6+ #429
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff8800666d4200 task.stack: ffff880067348000
RIP: 0010:[<ffffffff833617ec>]  [<ffffffff833617ec>]
icmp6_send+0x5fc/0x1e30 net/ipv6/icmp.c:451
RSP: 0018:ffff88006734f2c0  EFLAGS: 00010206
RAX: ffff8800666d4200 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000000018
RBP: ffff88006734f630 R08: ffff880064138418 R09: 0000000000000003
R10: dffffc0000000000 R11: 0000000000000005 R12: 0000000000000000
R13: ffffffff84e7e200 R14: ffff880064138484 R15: ffff8800641383c0
FS:  00007fb3887a07c0(0000) GS:ffff88006cc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 000000006b040000 CR4: 00000000000006f0
Stack:
 ffff8800666d4200 ffff8800666d49f8 ffff8800666d4200 ffffffff84c02460
 ffff8800666d4a1a 1ffff1000ccdaa2f ffff88006734f498 0000000000000046
 ffff88006734f440 ffffffff832f4269 ffff880064ba7456 0000000000000000
Call Trace:
 [<ffffffff83364ddc>] icmpv6_param_prob+0x2c/0x40 net/ipv6/icmp.c:557
 [<     inline     >] ip6_tlvopt_unknown net/ipv6/exthdrs.c:88
 [<ffffffff83394405>] ip6_parse_tlv+0x555/0x670 net/ipv6/exthdrs.c:157
 [<ffffffff8339a759>] ipv6_parse_hopopts+0x199/0x460 net/ipv6/exthdrs.c:663
 [<ffffffff832ee773>] ipv6_rcv+0xfa3/0x1dc0 net/ipv6/ip6_input.c:191
 ...

icmp6_send / icmpv6_send is invoked for both rx and tx paths. In both
cases the dst->dev should be preferred for determining the L3 domain
if the dst has been set on the skb. Fallback to the skb->dev if it has
not. This covers the case reported here where icmp6_send is invoked on
Rx before the route lookup.

Fixes: 5d41ce29e ("net: icmp6_send should use dst dev to determine L3 domain")
Reported-by: Andrey Konovalov <[email protected]>
Signed-off-by: David Ahern <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-28 16:13:01 -05:00
Tushar Dave
16f46050e7 dbri: Fix compiler warning
dbri uses 'u32' for dma handle while invoking kernel DMA APIs,
instead of using dma_addr_t. This hasn't caused any 'incompatible
pointer type' warning on SPARC because until now dma_addr_t is of
type u32. However, recent changes in SPARC ATU (iommu) enabled 64bit
DMA and therefore dma_addr_t became of type u64. This makes
'incompatible pointer type' warnings inevitable.

e.g.
sound/sparc/dbri.c: In function ‘snd_dbri_create’:
sound/sparc/dbri.c:2538: warning: passing argument 3 of ‘dma_zalloc_coherent’ from incompatible pointer type
./include/linux/dma-mapping.h:608: note: expected ‘dma_addr_t *’ but argument is of type ‘u32 *’

For the record, dbri(sbus) driver never executes on sun4v. Therefore
even though 64bit DMA is enabled on SPARC, dbri continues to use
legacy iommu that guarantees DMA address is always in 32bit range.

This patch resolves above compiler warning.

Signed-off-by: Tushar Dave <[email protected]>
Reviewed-by: thomas tai <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-28 15:51:31 -05:00
Tushar Dave
e58566b1b1 qlogicpti: Fix compiler warnings
qlogicpti uses '__u32' for dma handle while invoking kernel DMA APIs,
instead of using dma_addr_t. This hasn't caused any 'incompatible
pointer type' warning on SPARC because until now dma_addr_t is of
type u32. However, recent changes in SPARC ATU (iommu) enabled 64bit
DMA and therefore dma_addr_t became of type u64. This makes
'incompatible pointer type' warnings inevitable.

e.g.
drivers/scsi/qlogicpti.c: In function ‘qpti_map_queues’:
drivers/scsi/qlogicpti.c:813: warning: passing argument 3 of ‘dma_alloc_coherent’ from incompatible pointer type
./include/linux/dma-mapping.h:445: note: expected ‘dma_addr_t *’ but argument is of type ‘__u32 *’
drivers/scsi/qlogicpti.c:822: warning: passing argument 3 of ‘dma_alloc_coherent’ from incompatible pointer type
./include/linux/dma-mapping.h:445: note: expected ‘dma_addr_t *’ but argument is of type ‘__u32 *’

For the record, qlogicpti never executes on sun4v. Therefore even
though 64bit DMA is enabled on SPARC, qlogicpti continues to use
legacy iommu that guarantees DMA address is always in 32bit range.

This patch resolves aforementioned compiler warnings.

Signed-off-by: Tushar Dave <[email protected]>
Reviewed-by: thomas tai <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-28 15:51:31 -05:00
David S. Miller
2fc8d112d7 Merge branch 'mlx4-fixes'
Tariq Toukan says:

====================
mlx4 bug fixes for 4.9

This patchset includes 2 bug fixes:
* In patch 1 we revert the commit that avoids invoking unregister_netdev
in shutdown flow, as it introduces netdev presence issues where
it can be accessed unsafely by ndo operations during the flow.
* Patch 2 is a simple fix for a variable uninitialization issue.

Series generated against net commit:
6998cc6ec2 tipc: resolve connection flow control compatibility problem
====================

Signed-off-by: David S. Miller <[email protected]>
2016-11-28 15:33:47 -05:00
Jack Morgenstein
44b911e777 net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering
In procedure mlx4_flow_steer_promisc_add(), several fields
were left uninitialized in the rule structure.
Correctly initialize these fields.

Fixes: 592e49dda8 ("net/mlx4: Implement promiscuous mode with device managed flow-steering")
Signed-off-by: Jack Morgenstein <[email protected]>
Signed-off-by: Tariq Toukan <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-28 15:33:46 -05:00
Tariq Toukan
b4353708f5 Revert "net/mlx4_en: Avoid unregister_netdev at shutdown flow"
This reverts commit 9d76931180.

Using unregister_netdev at shutdown flow prevents calling
the netdev's ndos or trying to access its freed resources.

This fixes crashes like the following:
 Call Trace:
  [<ffffffff81587a6e>] dev_get_phys_port_id+0x1e/0x30
  [<ffffffff815a36ce>] rtnl_fill_ifinfo+0x4be/0xff0
  [<ffffffff815a53f3>] rtmsg_ifinfo_build_skb+0x73/0xe0
  [<ffffffff815a5476>] rtmsg_ifinfo.part.27+0x16/0x50
  [<ffffffff815a54c8>] rtmsg_ifinfo+0x18/0x20
  [<ffffffff8158a6c6>] netdev_state_change+0x46/0x50
  [<ffffffff815a5e78>] linkwatch_do_dev+0x38/0x50
  [<ffffffff815a6165>] __linkwatch_run_queue+0xf5/0x170
  [<ffffffff815a6205>] linkwatch_event+0x25/0x30
  [<ffffffff81099a82>] process_one_work+0x152/0x400
  [<ffffffff8109a325>] worker_thread+0x125/0x4b0
  [<ffffffff8109a200>] ? rescuer_thread+0x350/0x350
  [<ffffffff8109fc6a>] kthread+0xca/0xe0
  [<ffffffff8109fba0>] ? kthread_park+0x60/0x60
  [<ffffffff816a1285>] ret_from_fork+0x25/0x30

Fixes: 9d76931180 ("net/mlx4_en: Avoid unregister_netdev at shutdown flow")
Signed-off-by: Tariq Toukan <[email protected]>
Reported-by: Sebastian Ott <[email protected]>
Reported-by: Steve Wise <[email protected]>
Cc: Jiri Pirko <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2016-11-28 15:33:46 -05:00
Jordan Crouse
2401a00846 drm/msm: gpu: Add support for the GPMU
Most 5XX targets have GPMU (Graphics Power Management Unit) that
handles a lot of the heavy lifting for power management including
thermal and limits management and dynamic power collapse. While
the GPMU itself is optional, it is usually nessesary to hit
aggressive power targets.

The GPMU firmware needs to be loaded into the GPMU at init time via a
shared hardware block of registers. Using the GPU to write the microcode
is more efficient than using the CPU so at first load create an indirect
buffer that can be executed during subsequent initalization sequences.

After loading the GPMU gets initalized through a shared register
interface and then we mostly get out of its way and let it do
its thing.

Signed-off-by: Jordan Crouse <[email protected]>
Signed-off-by: Rob Clark <[email protected]>
2016-11-28 15:14:16 -05:00
Jordan Crouse
b5f103ab98 drm/msm: gpu: Add A5XX target support
Add support for the A5XX family of Adreno GPUs.

Signed-off-by: Jordan Crouse <[email protected]>
Signed-off-by: Rob Clark <[email protected]>
2016-11-28 15:14:15 -05:00
Jordan Crouse
4ac277cd9d drm/msm: Disable interrupts during init
Disable the interrupt during the init sequence to avoid having
interrupts fired for errors and other things that we are not
ready to handle while initializing.

Signed-off-by: Jordan Crouse <[email protected]>
Signed-off-by: Rob Clark <[email protected]>
2016-11-28 15:14:14 -05:00
Jordan Crouse
89d777a572 drm/msm: Remove 'src_clk' from adreno configuration
The adreno code inherited a silly workaround from downstream
from the bad old days before decent clock control. grp_clk[0]
(named 'src_clk') doesn't actually exist - it was used as a proxy
for whatever the core clock actually was (usually 'core_clk').

All targets should be able to correctly request 'core_clk' and
get the right thing back so zap the anachronism and directly
use grp_clk[0] to control the clock rate.

Signed-off-by: Jordan Crouse <[email protected]>
Signed-off-by: Rob Clark <[email protected]>
2016-11-28 15:14:13 -05:00
Jordan Crouse
05b9401bee drm/msm: gpu: Add OUT_TYPE4 and OUT_TYPE7
Add helper functions for TYPE4 and TYPE7 ME opcodes that replace
TYPE0 and TYPE3 starting with the A5XX targets.

Signed-off-by: Jordan Crouse <[email protected]>
Signed-off-by: Rob Clark <[email protected]>
2016-11-28 15:14:13 -05:00