Commit 0b776d457b ("drm/msm: fix fallout of atomic dpms
changes") has a typo in both mdp5_encoder_helper_funcs and
mdp5_crtc_helper_funcs definitions:
.dpms entry should be replaced by .disable and .enable
Also fixed a typo in mdp5_encoder_enable().
Note that these typos are only present for MDP5. MDP4 is fine.
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Radeon fixes for 4.0:
- Fix some fallout from the audio rework
- Fix a possible oops in the CS ioctl
- Fix interlaced modes on DCE8
- Do a posting read in irq_set callbacks to make sure
interrupts are properly flushed through the pci bridge
* 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux:
drm/radeon: fix interlaced modes on DCE8
drm/radeon: fix DRM_IOCTL_RADEON_CS oops
drm/radeon: do a posting read in cik_set_irq
drm/radeon: do a posting read in si_set_irq
drm/radeon: do a posting read in evergreen_set_irq
drm/radeon: do a posting read in r600_set_irq
drm/radeon: do a posting read in rs600_set_irq
drm/radeon: do a posting read in r100_set_irq
radeon/audio: fix DP audio on DCE6
radeon/audio: fix whitespace
drm/radeon: adjust audio callback order
drm/radeon: properly set dto for dp on DCE4/5
drm/radeon/audio: update EDID derived fields in modeset
drm/radeon: don't toggle audio state in modeset
drm/radeon/audio: set mute around state setup
drm/radeon: assign pin in detect
drm/radeon: fix the audio dpms callbacks
Since commit 1c6c69525b ("genirq: Reject
bogus threaded irq requests") threaded IRQs without a primary handler
need to be requested with IRQF_ONESHOT, otherwise the request will fail.
Currently, plat->irqtype is only set to IRQF_TRIGGER_FALLING. This
patch sets the ONESHOT flag directly in request_threaded_irq() to
enforce the flag without being affected by future changes to
plat->irqtype.
Generated by: scripts/coccinelle/misc/irqf_oneshot.cocci
Signed-off-by: Valentin Rothberg <Valentin.Rothberg@lip6.fr>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
We need to store device offsets in 64 bit as the device
address space may be larger than the CPU's.
Fixes GPU init failures on radeons with 4GB or more of
vram on 32 bit kernels. We put vram at the start of the
GPU's address space so the gart aperture starts at 4 GB
causing all GPU addresses in the gart aperture to get
truncated.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=89072
[airlied: fix warning on nouveau build]
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: thellstrom@vmware.com
Acked-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
The current implementation is limited by the number of addresses that
fit into an unsigned long. This causes problems on 32-bit Tegra where
unsigned long is 32-bit but drm_mm is used to manage an IOVA space of
4 GiB. Given the 32-bit limitation, the range is limited to 4 GiB - 1
(or 4 GiB - 4 KiB for page granularity).
This commit changes the start and size of the range to be an unsigned
64-bit integer, thus allowing much larger ranges to be supported.
[airlied: fix i915 warnings and coloring callback]
Signed-off-by: Thierry Reding <treding@nvidia.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
fixupo
Commit 8634b51f6c (locks: convert lease handling to file_lock_context)
introduced a regression in the handling of lease upgrade/downgrades.
In the event that we already have a lease on a file and are going to
either upgrade or downgrade it, we skip doing any list insertion or
deletion and simply re-call lm_setup on the existing lease.
As of commit 8634b51f6c however, we end up calling lm_setup on the
lease that was passed in, instead of on the existing lease. This causes
us to leak the fasync_struct that was allocated in the event that there
was not already an existing one (as it always appeared that there
wasn't one).
Fixes: 8634b51f6c (locks: convert lease handling to file_lock_context)
Reported-and-Tested-by: Daniel Wagner <daniel.wagner@bmw-carit.de>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
- The eCryptfs ioctl handling functions should only pass known-good ioctl
commands to the lower filesystem
- A static checker found a potential buffer overflow. Upon inspection, it is
not triggerable due to input validation performed on the mount parameters.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABCgAGBQJU94JWAAoJENaSAD2qAscK5z0P/3rrZv7w4rWnPeLfzddRCSpt
QMCPGGXE2fo3nP9w6e7HirAQKg474CFdmNXbNzAKR08irQNRM9lMMEkUp8B9kwXN
8Ms+lHPVuTZuBPXkqtpG/p47kAJdc1d9QePa0iU5PPp5GcdI/knPR/Md42NxUd4y
kqMdgK7brO/y16i5aCC40CG2x+OPc5I8Xz/9MT9fm9+NTRzOxFhbLxis5LKUrQgj
SnzkXn4Z1jsLt3y8OCFhrP9n9sHrKmcHpxBExa7GziADbIcw+nv/ugQy8Dvi8sHK
zzO1G21uUlZXfMoWdv+DbwgU6subaT/D6NjcyVEhZ0ziYQDdMMOVvqDUFzwIV9W7
WiIV2fYLxYlZHSv318BlYTT6XiDVveINUcLI2107cw4pBwMYUt9QY3QoKLQ7027o
HhdX4Ys6chzwggWU0CRRI7W45/LTF0KeJ3g06tAsYVV6GFGoJAnZe7olHA6X7nGE
s8rXzpT5zZqdcz7Y5ln5NtrzWBER91iBUDivafw6y7b0rqj6o+fEUk4vXNdsyuzZ
y5Qn5dus1ImPLwtCAsfqZMjUUnNtOaBPd52k0sHIkRoY6W7GlXZNOjXA7ki+X5tX
Jq4tm0n3fkInEhjJDQ/sxtPa+TcZGgcoyc3qNsX80Lob7QpaTvBczKFgBadNnMnK
TKJEvJQuLIlAq3Lw5DGL
=4fdp
-----END PGP SIGNATURE-----
Merge tag 'ecryptfs-4.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs
Pull eCryptfs fixes from Tyler Hicks:
"Fixes for proper ioctl handling and an untriggerable buffer overflow
- The eCryptfs ioctl handling functions should only pass known-good
ioctl commands to the lower filesystem
- A static checker found a potential buffer overflow. Upon
inspection, it is not triggerable due to input validation performed
on the mount parameters"
* tag 'ecryptfs-4.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
eCryptfs: don't pass fs-specific ioctl commands through
eCryptfs: ensure copy to crypt_stat->cipher does not overrun
The irq line used by the PMC block is shared with several peripherals
including the init timer which is registering its handler with
IRQF_NO_SUSPEND.
Implement the appropriate suspend/resume callback for the PMC irqchip,
and inform irq core that PMC irq handler can be safely called while
the system is suspended by setting IRQF_COND_SUSPEND.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Reviewed-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
The IRQ line used by the RTC device is usually shared with the system
timer (PIT) on at91 platforms.
Since timers are registering their handlers with IRQF_NO_SUSPEND, we
should expect being called in suspended state, and properly wake the
system up when this is the case.
Set IRQF_COND_SUSPEND flag when registering the IRQ handler to inform
irq core that it can safely be called while the system is suspended.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Reviewed-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
The IRQ line used by the RTC device is usually shared with the system timer
(PIT) on at91 platforms.
Since timers are registering their handlers with IRQF_NO_SUSPEND, we should
expect being called in suspended state, and properly wake the system up
when this is the case.
Set IRQF_COND_SUSPEND flag when registering the IRQ handler to inform
irq core that it can safely be called while the system is suspended.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Reviewed-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Export pm_system_wakeup function to allow irq handlers to deal with system
wakeup.
This is needed for shared IRQ lines where one of the handler is registered
with IRQF_NO_SUSPEND, while the other ones want to configure it as a wakeup
source.
In this specific case, irq core does not handle the wakeup process and
leave the decision to each irq handler.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Reviewed-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Currently the list is traversed using rcu variant. That is not correct
since dev_set_mac_address can be called which eventually calls
rtmsg_ifinfo_build_skb and there, skb allocation can sleep. So fix this
by remove the rcu usage here.
Fixes: 3d249d4ca7 "net: introduce ethernet teaming device"
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Iyappan Subramanian says:
====================
drivers: net: xgene: Fix backward compatibility of newer firmware with older kernel
Kernel 3.17 driver supports only RGMII ethernet interface.
Since the Tianocore DT contains same compatibility string for RGMII,
SGMII based 1G and XFI based 10G interfaces, crash happens when probe called
on SGMII based 1G and XFI based 10G interface.
This patch fixes the backward compatibility of the older driver with the
newer firmware by making the binding unique so that the older driver won't
recognize the non-supported interfaces.
v2: Address comments from v1
* updated cover letter subject line with net: xgene
* Documentation: formatted compatible string values as list
v1:
* Initial version
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
This patch fixes the backward compatibile of the older driver with the
newer firmware by making the binding unique so that the older driver won't
recognize the non-supported interfaces.
Signed-off-by: Iyappan Subramanian <isubramanian@apm.com>
Signed-off-by: Keyur Chudgar <kchudgar@apm.com>
Tested-by: Mark Langsdorf <mlangsdo@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This patch fixes the backward compatibility of the older driver with the
newer firmware by making the binding unique so that the older driver won't
recognize the non-supported interfaces.
The new bindings are in sync with the newer firmware.
Signed-off-by: Iyappan Subramanian <isubramanian@apm.com>
Signed-off-by: Keyur Chudgar <kchudgar@apm.com>
Tested-by: Mark Langsdorf <mlangsdo@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Iyappan Subramanian <isubramanian@apm.com>
Signed-off-by: Keyur Chudgar <kchudgar@apm.com>
Tested-by: Mark Langsdorf <mlangsdo@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1. For an IPv4 ping socket, ping_check_bind_addr does not check
the family of the socket address that's passed in. Instead,
make it behave like inet_bind, which enforces either that the
address family is AF_INET, or that the family is AF_UNSPEC and
the address is 0.0.0.0.
2. For an IPv6 ping socket, ping_check_bind_addr returns EINVAL
if the socket family is not AF_INET6. Return EAFNOSUPPORT
instead, for consistency with inet6_bind.
3. Make ping_v4_sendmsg and ping_v6_sendmsg return EAFNOSUPPORT
instead of EINVAL if an incorrect socket address structure is
passed in.
4. Make IPv6 ping sockets be IPv6-only. The code does not support
IPv4, and it cannot easily be made to support IPv4 because
the protocol numbers for ICMP and ICMPv6 are different. This
makes connect(::ffff:192.0.2.1) fail with EAFNOSUPPORT instead
of making the socket unusable.
Among other things, this fixes an oops that can be triggered by:
int s = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
struct sockaddr_in6 sin6 = {
.sin6_family = AF_INET6,
.sin6_addr = in6addr_any,
};
bind(s, (struct sockaddr *) &sin6, sizeof(sin6));
Change-Id: If06ca86d9f1e4593c0d6df174caca3487c57a241
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
In case there was some tx buffer reclaimed and not enough rx packets
to consume the whole budget, napi_complete would not be called and
interrupts would be kept disabled, effectively resulting in the
network core never to call the poll callback again and no rx/tx
interrupts to be fired either.
Fix that by only accounting the rx work done in the poll callback.
Signed-off-by: Nicolas Schichan <nschichan@freebox.fr>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Currently we're getting IRQs after lots of resources are already
allocated:
* netdev
* clocks
* MDIO bus
Also HW gets initialized by the time when checking IRQs as well.
Now there's a possibility for master interrupt controller to be not
probed yet. This will lead to exit from GMAC probe routine with "-
EPROBE_DEFER" and so deferred probe will hapen later on.
But since we exited the first GMAC probe without release of all
allocated resources there could be conflicts on subsequent probes.
For example this is what happens for me:
--->8---
stmmaceth e0018000.ethernet: no reset control found
stmmac - user ID: 0x10, Synopsys ID: 0x37
Ring mode enabled
DMA HW capability register supported
Normal descriptors
RX Checksum Offload Engine supported (type 2)
TX Checksum insertion supported
Enable RX Mitigation via HW Watchdog Timer
libphy: stmmac: probed
eth0: PHY ID 20005c7a at 1 IRQ POLL (stmmac-0:01) active
platform e0018000.ethernet: Driver stmmaceth requests probe deferral
...
...
...
stmmaceth e0018000.ethernet: no reset control found
stmmac - user ID: 0x10, Synopsys ID: 0x37
Ring mode enabled
DMA HW capability register supported
Normal descriptors
RX Checksum Offload Engine supported (type 2)
TX Checksum insertion supported
Enable RX Mitigation via HW Watchdog Timer
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x4e/0x68()
sysfs: cannot create duplicate filename
'/devices/platform/axs10x_mb/e0018000.ethernet/mdio_bus/stmmac-0'
CPU: 0 PID: 6 Comm: kworker/u2:0 Not tainted 4.0.0-rc1-next-20150303+#8
Workqueue: deferwq deferred_probe_work_func
Stack Trace:
arc_unwind_core+0xb8/0x114
warn_slowpath_common+0x5a/0x8c
warn_slowpath_fmt+0x2e/0x38
sysfs_warn_dup+0x4e/0x68
sysfs_create_dir_ns+0x98/0xa0
kobject_add_internal+0x8c/0x2e8
kobject_add+0x4a/0x8c
device_add+0xc6/0x448
mdiobus_register+0x6c/0x164
stmmac_mdio_register+0x112/0x264
stmmac_dvr_probe+0x6c0/0x85c
stmmac_pltfr_probe+0x2e4/0x50c
platform_drv_probe+0x26/0x5c
really_probe+0x76/0x1dc
bus_for_each_drv+0x42/0x7c
device_attach+0x64/0x6c
bus_probe_device+0x74/0xa4
deferred_probe_work_func+0x50/0x84
process_one_work+0xf8/0x2cc
worker_thread+0x110/0x478
kthread+0x8a/0x9c
ret_from_fork+0x14/0x18
---[ end trace a2dfaa7d630c8be1 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6 at lib/kobject.c:240
kobject_add_internal+0x218/0x2e8()
kobject_add_internal failed for stmmac-0 with -EEXIST, don't try to
register things with the same name in the same di.
CPU: 0 PID: 6 Comm: kworker/u2:0 Tainted: G W
4.0.0-rc1-next-20150303+ #8
Workqueue: deferwq deferred_probe_work_func
Stack Trace:
arc_unwind_core+0xb8/0x114
warn_slowpath_common+0x5a/0x8c
warn_slowpath_fmt+0x2e/0x38
kobject_add_internal+0x218/0x2e8
kobject_add+0x4a/0x8c
device_add+0xc6/0x448
mdiobus_register+0x6c/0x164
stmmac_mdio_register+0x112/0x264
stmmac_dvr_probe+0x6c0/0x85c
stmmac_pltfr_probe+0x2e4/0x50c
platform_drv_probe+0x26/0x5c
really_probe+0x76/0x1dc
bus_for_each_drv+0x42/0x7c
device_attach+0x64/0x6c
bus_probe_device+0x74/0xa4
deferred_probe_work_func+0x50/0x84
process_one_work+0xf8/0x2cc
worker_thread+0x110/0x478
kthread+0x8a/0x9c
ret_from_fork+0x14/0x18
---[ end trace a2dfaa7d630c8be2 ]---
libphy: mii_bus stmmac-0 failed to register
: Cannot register as MDIO bus
stmmac_pltfr_probe: main driver probe failed
stmmaceth: probe of e0018000.ethernet failed with error -22
--->8---
Essential fix is to check for IRQs availability as early as possible and
then safely go to deferred probe if IRQs are not there yet.
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Vineet Gupta <vgupta@synopsys.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Cc: Sonic Zhang <sonic.zhang@analog.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
It currently is required that all users of NO_SUSPEND interrupt
lines pass the IRQF_NO_SUSPEND flag when requesting the IRQ or the
WARN_ON_ONCE() in irq_pm_install_action() will trigger. That is
done to warn about situations in which unprepared interrupt handlers
may be run unnecessarily for suspended devices and may attempt to
access those devices by mistake. However, it may cause drivers
that have no technical reasons for using IRQF_NO_SUSPEND to set
that flag just because they happen to share the interrupt line
with something like a timer.
Moreover, the generic handling of wakeup interrupts introduced by
commit 9ce7a25849 (genirq: Simplify wakeup mechanism) only works
for IRQs without any NO_SUSPEND users, so the drivers of wakeup
devices needing to use shared NO_SUSPEND interrupt lines for
signaling system wakeup generally have to detect wakeup in their
interrupt handlers. Thus if they happen to share an interrupt line
with a NO_SUSPEND user, they also need to request that their
interrupt handlers be run after suspend_device_irqs().
In both cases the reason for using IRQF_NO_SUSPEND is not because
the driver in question has a genuine need to run its interrupt
handler after suspend_device_irqs(), but because it happens to
share the line with some other NO_SUSPEND user. Otherwise, the
driver would do without IRQF_NO_SUSPEND just fine.
To make it possible to specify that condition explicitly, introduce
a new IRQ action handler flag for shared IRQs, IRQF_COND_SUSPEND,
that, when set, will indicate to the IRQ core that the interrupt
user is generally fine with suspending the IRQ, but it also can
tolerate handler invocations after suspend_device_irqs() and, in
particular, it is capable of detecting system wakeup and triggering
it as appropriate from its interrupt handler.
That will allow us to work around a problem with a shared timer
interrupt line on at91 platforms.
Link: http://marc.info/?l=linux-kernel&m=142252777602084&w=2
Link: http://marc.info/?t=142252775300011&r=1&w=2
Link: https://lkml.org/lkml/2014/12/15/552
Reported-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Mark Rutland <mark.rutland@arm.com>
- minor timeout & other fixes on reservation/fence
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJU9q1GAAoJEAG+/NWsLn5bzhEQAOOVtIPmM2mF/FChUXROAv/M
AFNGamRi+F1cJH2dWNJCUKpqBDKw/73g84Qj7LH7VcnBZO3nc8fy9cBYIJ3yBrYE
fcUl88yzm7iQSlunlayBT+krItCxzzhVjS31OoEsQKlm1UdllYre0VPX/F50Zz2q
eB+ts6pRj7qRBfrX4bJ/zAoaAvLnHYxLCF/ib6toHCY2q0gnSzKq+LCUheGAKcc9
6Yi8uDd3oqOU9TJbP5kQgUhNgv/CmWeHATssmpbf81WUSavg7+WDQAy+eQz65z93
DIdP97GWEz+I9ClU1u0eG8JYUozvQ/YiY/DMqDcrZxoyTVSMdyRlnTMAXZZDVExJ
Op/n2IGj6Bu7sluDdtGvO8xSypCufLZm29upUWtmLsR5tsTtBcKGidBC0sqfpdSI
pDq4+KpFfxCfCx0iFnDATHnjFANNUZIOt14+eKnQZ58mximYphn/0iLO4q68VvSE
1E4JVMTOGXKcsA0XLqbIz8lsCEOva29svooXrOA7Hybb7bUnWXAfMMthvyAhWWVe
At0ZBJF1Ajx/UadfvhdRMuiZDPCbxrTcU344rxxANHfjBiDX99VqyvCoSFEqAMyL
iDhBK8xkOB/5f9k9KEd3dGU9ABvTmrg9sw2UbS0rDxkU0yZLE2+ajseQTFmJB4Dh
qHwFXLXN91FM4NwgeS73
=k3LO
-----END PGP SIGNATURE-----
Merge tag 'dma-buf-for-4.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/sumits/dma-buf
Pull dma-buf fixes from Sumit Semwal:
"Minor timeout & other fixes on reservation/fence"
* tag 'dma-buf-for-4.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/sumits/dma-buf:
reservation: Remove shadowing local variable 'ret'
dma-buf/fence: don't wait when specified timeout is zero
reservation: wait only with non-zero timeout specified (v3)
In general, if a transaction object is added to the list successfully,
we can rely on the abort path to undo what we've done. This allows us to
simplify the error handling of the rule replacement path in
nf_tables_newrule().
This implicitly fixes an unnecessary removal of the old rule, which
needs to be left in place if we fail to replace.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
The NFT_USERDATA_MAXLEN is defined to 256, however we only have a u8
to store its size. Introduce a struct nft_userdata which contains a
length field and indicate its presence using a single bit in the rule.
The length field of struct nft_userdata is also a u8, however we don't
store zero sized data, so the actual length is udata->len + 1.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Check that the space required for the expressions doesn't exceed the
size of the dlen field, which would lead to the iterators crashing.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
A race condition exists in the rule transaction code for rules that
get added and removed within the same transaction.
The new rule starts out as inactive in the current and active in the
next generation and is inserted into the ruleset. When it is deleted,
it is additionally set to inactive in the next generation as well.
On commit the next generation is begun, then the actions are finalized.
For the new rule this would mean clearing out the inactive bit for
the previously current, now next generation.
However nft_rule_clear() clears out the bits for *both* generations,
activating the rule in the current generation, where it should be
deactivated due to being deleted. The rule will thus be active until
the deletion is finalized, removing the rule from the ruleset.
Similarly, when aborting a transaction for the same case, the undo
of insertion will remove it from the RCU protected rule list, the
deletion will clear out all bits. However until the next RCU
synchronization after all operations have been undone, the rule is
active on CPUs which can still see the rule on the list.
Generally, there may never be any modifications of the current
generations' inactive bit since this defeats the entire purpose of
atomicity. Change nft_rule_clear() to only touch the next generations
bit to fix this.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
DMA_BIT_MASK of 64 is not valid dma address mask for OMAPs, it should be
set to 32.
The 64 was introduced by commit (in 2009):
a152ff24b9 ASoC: OMAP: Make DMA 64 aligned
But the dma_mask and coherent_dma_mask can not be used to specify alignment.
Fixes: a152ff24b9 (ASoC: OMAP: Make DMA 64 aligned)
Reported-by: Grygorii Strashko <Grygorii.Strashko@linaro.org>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
- Fix for dynticks.
- Fix for smpboot bug.
- Fix for IOMMU group refcounting.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJU9mwsAAoJEFHr6jzI4aWAS28QALF6rTNK0lywqO+eV75BRLco
z8eINZozRJBBXjt5ATp4zJSAjOpnRNFlclfDPEcYav51cyxZRREbD322rMYR5uOL
9ixnOTDGpOFE9Sgt562OEVmRadAVrJf9gKw7/Cjebxb9XgfwpepvwBfN8Xxl1yc+
LnvnkJN327nDaBnWP7eTSkTeiznhDCdXz0HYmO1zUnrico2AZ/9qVdd+XD/QTk6o
t6m+aTowy9+4Ps7B4Y/l5dmKuOruFMxwSWFhUZrC6huvArJrYAMGvMT7++r2JTW4
tyHBCuB3pWHBm3BjlcR23sZoi8jPVkulKKLShGiXwaZxCSOhwMLwwFFVBHw2gJIW
grzzAtkM5cXACmGKiCWzAc8WMM0+u4vz/w1md+Nt4XvtZssRJwbXdJJHh7nXq+RE
M7IDnyvLI5m8Ae7qAnAts2Lf1SRZALY0zOUyS0jsn6jDJUw49BbKD54RuFqNzuhL
70dEsHy+awHEagIO47q+JEFWPaG20HzupVDe33j7KEx20xROvC4R2u+LIEG8YiJH
ve4xDVwTM7rVqvIvb17Rs0LLqKs8P9O7sQFoQf2V/xie/X1QwHDZsC24C4r07M/+
7ZqL9og3/nMo9SIKE1eNgBHq0FmUgOYkoaF+biDuzava9JYNxeT7nOhFfOqNz4RO
M+tgZwHU1NDpVHJerdP3
=8wky
-----END PGP SIGNATURE-----
Merge tag 'powerpc-4.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux
Pull powerpc fixes from Michael Ellerman:
- Fix for dynticks.
- Fix for smpboot bug.
- Fix for IOMMU group refcounting.
* tag 'powerpc-4.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux:
powerpc/iommu: Remove IOMMU device references via bus notifier
powerpc/smp: Wait until secondaries are active & online
powerpc: Re-enable dynticks
In seq_buf_vprintf(), vsnprintf() is used to copy the format into the
buffer remaining in the seq_buf structure. The return of vsnprintf()
is the amount of characters written to the buffer excluding the '\0',
unless the line was truncated!
If the line copied does not fit, it is truncated, and a '\0' is added
to the end of the buffer. But in this case, '\0' is included in the length
of the line written. To know if the buffer had overflowed, the return
length will be the same as the length of the buffer passed in.
The check in seq_buf_vprintf() only checked if the length returned from
vsnprintf() would fit in the buffer, as the seq_buf_vprintf() is only
to be an all or nothing command. It either writes all the string into
the seq_buf, or none of it. If the string is truncated, the pointers
inside the seq_buf must be reset to what they were when the function was
called. This is not the case. On overflow, it copies only part of the string.
The fix is to change the overflow check to see if the length returned from
vsnprintf() is less than the length remaining in the seq_buf buffer, and not
if it is less than or equal to as it currently does. Then seq_buf_vprintf()
will know if the write from vsnpritnf() was truncated or not.
Cc: stable@vger.kernel.org
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
This patch fixes two bugs in the Microblaze syscall trap handler when an invalid
syscall ID is used.
First, the range check on line 351 only checks for syscall IDs greater than
__NR_syscalls. A negative syscall ID (either passed to `syscall()` or as returned
by `do_syscall_trace_enter()` on error) will still satisfy this test and cause
the Linux kernel to access an invalid memory location and cause a kernel oops.
This has been fixed by also checking for r12 < 0.
Secondly, the current error recovery at line 378 returns using the wrong register
(r15 instead of r14) and does not restore the previous stack state. This has been
fixed by invoking `ret_from_trap` on error, setting r3 to `-ENOSYS`, similar to
what would happen when calling a valid syscall.
Signed-off-by: Jamie Garside <jamie.garside@york.ac.uk>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Report the actual error code from acpi_bus_register_driver(), it may
help future debugging (typically ENODEV as previously reported, but the
unusual cases are where it may help most).
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Acked-by: Aaron Lu <aaron.lu@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
i915.ko depends upon the acpi/video.ko module and so refuses to load if
ACPI is disabled at runtime if for example the BIOS is broken beyond
repair. acpi/video provides an optional service for i915.ko and so we
should just allow the modules to load, but do no nothing in order to let
the machines boot correctly.
Reported-by: Bill Augur <bill-auger@programmer.net>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: All applicable <stable@vger.kernel.org>
Acked-by: Aaron Lu <aaron.lu@intel.com>
[ rjw: Fixed up the new comment in acpi_video_init() ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
To keep consisitency with the rest of the file, use 'genpd' as the
name of the 'struct generic_pm_domain' pointer instead of 'gpd'.
This is just a rename, no functional changes.
Signed-off-by: Kevin Hilman <khilman@linaro.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
If CONFIG_SMP=n, <linux/smp.h> does not include <asm/smp.h>, causing:
drivers/cpufreq/ppc-corenet-cpufreq.c: In function 'corenet_cpufreq_cpu_init':
drivers/cpufreq/ppc-corenet-cpufreq.c:173:3: error: implicit declaration of function 'get_hard_smp_processor_id' [-Werror=implicit-function-declaration]
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
