commit 85ee5c00b97ec355d09e65ad70196e890b3e1c8c Author: Jiri Slaby Date: Mon Jun 23 10:30:54 2014 +0200 Linux 3.12.23 commit 8d8a2761521c01f70f79fdc69d8209f98ecd9458 Author: Boris BREZILLON Date: Fri Jun 6 14:36:11 2014 -0700 ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs commit 9dcc87fec8947308e0111c65dcd881e6aa5b1673 upstream. sam9x5 SoCs have the following errata: "RTC: Interrupt Mask Register cannot be used Interrupt Mask Register read always returns 0." Hence we should not rely on what IMR claims about already masked IRQs and just disable all IRQs. Signed-off-by: Boris BREZILLON Reported-by: Bryan Evenson Reviewed-by: Johan Hovold Acked-by: Nicolas Ferre Cc: Bryan Evenson Cc: Andrew Victor Cc: Jean-Christophe Plagniol-Villard Cc: Alessandro Zummo Cc: Mark Roszko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit 0067390aaa904826fbc3fa4b0ee2bcd01ac3b7e9 Author: Cong Wang Date: Thu Jun 12 11:53:10 2014 -0700 vxlan: use dev->needed_headroom instead of dev->hard_header_len [ Upstream commit 2853af6a2ea1a8ed09b09dd4fb578e7f435e8d34 ] When we mirror packets from a vxlan tunnel to other device, the mirror device should see the same packets (that is, without outer header). Because vxlan tunnel sets dev->hard_header_len, tcf_mirred() resets mac header back to outer mac, the mirror device actually sees packets with outer headers Vxlan tunnel should set dev->needed_headroom instead of dev->hard_header_len, like what other ip tunnels do. This fixes the above problem. Cc: "David S. Miller" Cc: stephen hemminger Cc: Pravin B Shelar Signed-off-by: Cong Wang Signed-off-by: Cong Wang Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 76acb94289d2ca897bd820b9627f4ade15230663 Author: Michal Schmidt Date: Wed May 28 14:15:19 2014 +0200 rtnetlink: fix userspace API breakage for iproute2 < v3.9.0 [ Upstream commit e5eca6d41f53db48edd8cf88a3f59d2c30227f8e ] When running RHEL6 userspace on a current upstream kernel, "ip link" fails to show VF information. The reason is a kernel<->userspace API change introduced by commit 88c5b5ce5cb57 ("rtnetlink: Call nlmsg_parse() with correct header length"), after which the kernel does not see iproute2's IFLA_EXT_MASK attribute in the netlink request. iproute2 adjusted for the API change in its commit 63338dca4513 ("libnetlink: Use ifinfomsg instead of rtgenmsg in rtnl_wilddump_req_filter"). The problem has been noticed before: http://marc.info/?l=linux-netdev&m=136692296022182&w=2 (Subject: Re: getting VF link info seems to be broken in 3.9-rc8) We can do better than tell those with old userspace to upgrade. We can recognize the old iproute2 in the kernel by checking the netlink message length. Even when including the IFLA_EXT_MASK attribute, its netlink message is shorter than struct ifinfomsg. With this patch "ip link" shows VF information in both old and new iproute2 versions. Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit ddb638e68690ca61959775b262a5ef0719c5c066 Author: Xufeng Zhang Date: Thu Jun 12 10:53:36 2014 +0800 sctp: Fix sk_ack_backlog wrap-around problem [ Upstream commit d3217b15a19a4779c39b212358a5c71d725822ee ] Consider the scenario: For a TCP-style socket, while processing the COOKIE_ECHO chunk in sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a new association would be created in sctp_unpack_cookie(), but afterwards, some processing maybe failed, and sctp_association_free() will be called to free the previously allocated association, in sctp_association_free(), sk_ack_backlog value is decremented for this socket, since the initial value for sk_ack_backlog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full. Fix this issue by only decrementing sk_ack_backlog for associations in the endpoint's list. Fix-suggested-by: Neil Horman Signed-off-by: Xufeng Zhang Acked-by: Daniel Borkmann Acked-by: Vlad Yasevich Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit c671113b05eb8cdcc5ed8610e9cc45a653ea7558 Author: Eric Dumazet Date: Tue Jun 10 06:43:01 2014 -0700 ipv4: fix a race in ip4_datagram_release_cb() [ Upstream commit 9709674e68646cee5a24e3000b3558d25412203a ] Alexey gave a AddressSanitizer[1] report that finally gave a good hint at where was the origin of various problems already reported by Dormando in the past [2] Problem comes from the fact that UDP can have a lockless TX path, and concurrent threads can manipulate sk_dst_cache, while another thread, is holding socket lock and calls __sk_dst_set() in ip4_datagram_release_cb() (this was added in linux-3.8) It seems that all we need to do is to use sk_dst_check() and sk_dst_set() so that all the writers hold same spinlock (sk->sk_dst_lock) to prevent corruptions. TCP stack do not need this protection, as all sk_dst_cache writers hold the socket lock. [1] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel AddressSanitizer: heap-use-after-free in ipv4_dst_check Read of size 2 by thread T15453: [] ipv4_dst_check+0x1a/0x90 ./net/ipv4/route.c:1116 [] __sk_dst_check+0x89/0xe0 ./net/core/sock.c:531 [] ip4_datagram_release_cb+0x46/0x390 ??:0 [] release_sock+0x17a/0x230 ./net/core/sock.c:2413 [] ip4_datagram_connect+0x462/0x5d0 ??:0 [] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534 [] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701 [] SyS_connect+0xe/0x10 ./net/socket.c:1682 [] system_call_fastpath+0x16/0x1b ./arch/x86/kernel/entry_64.S:629 Freed by thread T15455: [] dst_destroy+0xa8/0x160 ./net/core/dst.c:251 [] dst_release+0x45/0x80 ./net/core/dst.c:280 [] ip4_datagram_connect+0xa1/0x5d0 ??:0 [] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534 [] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701 [] SyS_connect+0xe/0x10 ./net/socket.c:1682 [] system_call_fastpath+0x16/0x1b ./arch/x86/kernel/entry_64.S:629 Allocated by thread T15453: [] dst_alloc+0x81/0x2b0 ./net/core/dst.c:171 [] rt_dst_alloc+0x47/0x50 ./net/ipv4/route.c:1406 [< inlined >] __ip_route_output_key+0x3e8/0xf70 __mkroute_output ./net/ipv4/route.c:1939 [] __ip_route_output_key+0x3e8/0xf70 ./net/ipv4/route.c:2161 [] ip_route_output_flow+0x14/0x30 ./net/ipv4/route.c:2249 [] ip4_datagram_connect+0x317/0x5d0 ??:0 [] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534 [] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701 [] SyS_connect+0xe/0x10 ./net/socket.c:1682 [] system_call_fastpath+0x16/0x1b ./arch/x86/kernel/entry_64.S:629 [2] <4>[196727.311203] general protection fault: 0000 [#1] SMP <4>[196727.311224] Modules linked in: xt_TEE xt_dscp xt_DSCP macvlan bridge coretemp crc32_pclmul ghash_clmulni_intel gpio_ich microcode ipmi_watchdog ipmi_devintf sb_edac edac_core lpc_ich mfd_core tpm_tis tpm tpm_bios ipmi_si ipmi_msghandler isci igb libsas i2c_algo_bit ixgbe ptp pps_core mdio <4>[196727.311333] CPU: 17 PID: 0 Comm: swapper/17 Not tainted 3.10.26 #1 <4>[196727.311344] Hardware name: Supermicro X9DRi-LN4+/X9DR3-LN4+/X9DRi-LN4+/X9DR3-LN4+, BIOS 3.0 07/05/2013 <4>[196727.311364] task: ffff885e6f069700 ti: ffff885e6f072000 task.ti: ffff885e6f072000 <4>[196727.311377] RIP: 0010:[] [] ipv4_dst_destroy+0x4f/0x80 <4>[196727.311399] RSP: 0018:ffff885effd23a70 EFLAGS: 00010282 <4>[196727.311409] RAX: dead000000200200 RBX: ffff8854c398ecc0 RCX: 0000000000000040 <4>[196727.311423] RDX: dead000000100100 RSI: dead000000100100 RDI: dead000000200200 <4>[196727.311437] RBP: ffff885effd23a80 R08: ffffffff815fd9e0 R09: ffff885d5a590800 <4>[196727.311451] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 <4>[196727.311464] R13: ffffffff81c8c280 R14: 0000000000000000 R15: ffff880e85ee16ce <4>[196727.311510] FS: 0000000000000000(0000) GS:ffff885effd20000(0000) knlGS:0000000000000000 <4>[196727.311554] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[196727.311581] CR2: 00007a46751eb000 CR3: 0000005e65688000 CR4: 00000000000407e0 <4>[196727.311625] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 <4>[196727.311669] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 <4>[196727.311713] Stack: <4>[196727.311733] ffff8854c398ecc0 ffff8854c398ecc0 ffff885effd23ab0 ffffffff815b7f42 <4>[196727.311784] ffff88be6595bc00 ffff8854c398ecc0 0000000000000000 ffff8854c398ecc0 <4>[196727.311834] ffff885effd23ad0 ffffffff815b86c6 ffff885d5a590800 ffff8816827821c0 <4>[196727.311885] Call Trace: <4>[196727.311907] <4>[196727.311912] [] dst_destroy+0x32/0xe0 <4>[196727.311959] [] dst_release+0x56/0x80 <4>[196727.311986] [] tcp_v4_do_rcv+0x2a5/0x4a0 <4>[196727.312013] [] tcp_v4_rcv+0x7da/0x820 <4>[196727.312041] [] ? ip_rcv_finish+0x360/0x360 <4>[196727.312070] [] ? nf_hook_slow+0x7d/0x150 <4>[196727.312097] [] ? ip_rcv_finish+0x360/0x360 <4>[196727.312125] [] ip_local_deliver_finish+0xb2/0x230 <4>[196727.312154] [] ip_local_deliver+0x4a/0x90 <4>[196727.312183] [] ip_rcv_finish+0x119/0x360 <4>[196727.312212] [] ip_rcv+0x22b/0x340 <4>[196727.312242] [] ? macvlan_broadcast+0x160/0x160 [macvlan] <4>[196727.312275] [] __netif_receive_skb_core+0x512/0x640 <4>[196727.312308] [] ? kmem_cache_alloc+0x13b/0x150 <4>[196727.312338] [] __netif_receive_skb+0x21/0x70 <4>[196727.312368] [] netif_receive_skb+0x31/0xa0 <4>[196727.312397] [] napi_gro_receive+0xe8/0x140 <4>[196727.312433] [] ixgbe_poll+0x551/0x11f0 [ixgbe] <4>[196727.312463] [] ? ip_rcv+0x22b/0x340 <4>[196727.312491] [] net_rx_action+0x111/0x210 <4>[196727.312521] [] ? __netif_receive_skb+0x21/0x70 <4>[196727.312552] [] __do_softirq+0xd0/0x270 <4>[196727.312583] [] call_softirq+0x1c/0x30 <4>[196727.312613] [] do_softirq+0x55/0x90 <4>[196727.312640] [] irq_exit+0x55/0x60 <4>[196727.312668] [] do_IRQ+0x63/0xe0 <4>[196727.312696] [] common_interrupt+0x6a/0x6a <4>[196727.312722] <1>[196727.313071] RIP [] ipv4_dst_destroy+0x4f/0x80 <4>[196727.313100] RSP <4>[196727.313377] ---[ end trace 64b3f14fae0f2e29 ]--- <0>[196727.380908] Kernel panic - not syncing: Fatal exception in interrupt Reported-by: Alexey Preobrazhensky Reported-by: dormando Signed-off-by: Eric Dumazet Fixes: 8141ed9fcedb2 ("ipv4: Add a socket release callback for datagram sockets") Cc: Steffen Klassert Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 4b5b1dd6dc1b26c9996375c783f34e428a2307d8 Author: Dmitry Popov Date: Fri Jun 6 23:19:21 2014 +0400 ipip, sit: fix ipv4_{update_pmtu,redirect} calls [ Upstream commit 2346829e641b804ece9ac9298136b56d9567c278 ] ipv4_{update_pmtu,redirect} were called with tunnel's ifindex (t->dev is a tunnel netdevice). It caused wrong route lookup and failure of pmtu update or redirect. We should use the same ifindex that we use in ip_route_output_* in *tunnel_xmit code. It is t->parms.link . Signed-off-by: Dmitry Popov Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit cbaf35e5ba05b9ff2f43d798fe4082cca8151861 Author: Eric Dumazet Date: Fri Jun 6 06:44:03 2014 -0700 net: force a list_del() in unregister_netdevice_many() [ Upstream commit 87757a917b0b3c0787e0563c679762152be81312 ] unregister_netdevice_many() API is error prone and we had too many bugs because of dangling LIST_HEAD on stacks. See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD") In fact, instead of making sure no caller leaves an active list_head, just force a list_del() in the callee. No one seems to need to access the list after unregister_netdevice_many() Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit ab7dcb1f7b2cb6d4b24c052d76df71e27dc083d6 Author: Bjørn Mork Date: Fri Jun 6 17:27:59 2014 +0200 net: qmi_wwan: add Olivetti Olicard modems [ Upstream commit ba6de0f5304ccdc45ae260e7e0feb6e0ef2dd558 ] Lars writes: "I'm only 99% sure that the net interfaces are qmi interfaces, nothing to lose by adding them in my opinion." And I tend to agree based on the similarity with the two Olicard modems we already have here. Reported-by: Lars Melin Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 099d431e40661f95539300a12a0f78bb0a290e16 Author: Alexei Starovoitov Date: Fri Jun 6 08:35:59 2014 -0700 net: filter: fix sparc32 typo [ Upstream commit 588f5d629b3369aba88f52217d1c473a28fa7723 ] Fixes: 569810d1e327 ("net: filter: fix typo in sparc BPF JIT") Signed-off-by: Alexei Starovoitov Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit eadac3f2480b4cf83a5a26f1f7795762777d4411 Author: Alexei Starovoitov Date: Thu Jun 5 22:47:44 2014 -0700 net: filter: fix typo in sparc BPF JIT [ Upstream commit 569810d1e3278907264f5b115281fca3f0038d53 ] fix typo in sparc codegen for SKF_AD_IFINDEX and SKF_AD_HATYPE classic BPF extensions Fixes: 2809a2087cc4 ("net: filter: Just In Time compiler for sparc") Signed-off-by: Alexei Starovoitov Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit b4e3e36a7e566927dfdc62b36c9c75b8c4b0c30a Author: Sergei Shtylyov Date: Tue Jun 3 23:42:26 2014 +0400 sh_eth: fix SH7619/771x support [ Upstream commit d8b0426af5b67973585712c9af36b86f6ea97815 ] Commit 4a55530f38e4 (net: sh_eth: modify the definitions of register) managed to leave out the E-DMAC register entries in sh_eth_offset_fast_sh3_sh2[], thus totally breaking SH7619/771x support. Add the missing entries using the data from before that commit. Signed-off-by: Sergei Shtylyov Acked-by: Yoshihiro Shimoda Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 84a6e2bdff418af6bd12d1086ec51ff6d0bb1ba6 Author: Ben Dooks Date: Tue Jun 3 12:21:13 2014 +0100 sh_eth: use RNC mode for packet reception [ Upstream commit 530aa2d0d9d55ab2775d47621ddf4b5b15bc1110 ] The current behaviour of the sh_eth driver is not to use the RNC bit for the receive ring. This means that every packet recieved is not only generating an IRQ but it also stops the receive ring DMA as well until the driver re-enables it after unloading the packet. This means that a number of the following errors are generated due to the receive packet FIFO overflowing due to nowhere to put packets: net eth0: Receive FIFO Overflow Since feedback from Yoshihiro Shimoda shows that every supported LSI for this driver should have the bit enabled it seems the best way is to remove the RMCR default value from the per-system data and just write it when initialising the RMCR value. This is discussed in the message (http://www.spinics.net/lists/netdev/msg284912.html). I have tested the 0x00000001 configuration with NFS root filesystem and the driver has not failed yet. There are further test reports from Sergei Shtylov and others for both the R8A7790 and R8A7791. There is also feedback fron Cao Minh Hiep[1] which reports the same issue in (http://comments.gmane.org/gmane.linux.network/316285) showing this fixes issues with losing UDP datagrams under iperf. Tested-by: Sergei Shtylyov Signed-off-by: Ben Dooks Acked-by: Yoshihiro Shimoda Acked-by: Simon Horman Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit dc4d3702659539dc9bdebf3bb4cfd4187c1cc9c5 Author: Yuchung Cheng Date: Fri May 30 15:25:59 2014 -0700 tcp: fix cwnd undo on DSACK in F-RTO [ Upstream commit 0cfa5c07d6d1d7f8e710fc671c5ba1ce85e09fa4 ] This bug is discovered by an recent F-RTO issue on tcpm list https://www.ietf.org/mail-archive/web/tcpm/current/msg08794.html The bug is that currently F-RTO does not use DSACK to undo cwnd in certain cases: upon receiving an ACK after the RTO retransmission in F-RTO, and the ACK has DSACK indicating the retransmission is spurious, the sender only calls tcp_try_undo_loss() if some never retransmisted data is sacked (FLAG_ORIG_DATA_SACKED). The correct behavior is to unconditionally call tcp_try_undo_loss so the DSACK information is used properly to undo the cwnd reduction. Signed-off-by: Yuchung Cheng Signed-off-by: Neal Cardwell Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 14bf635b2a49a67862fbc3ea2db76a5cef3a8bba Author: Jiri Pirko Date: Thu May 29 20:46:17 2014 +0200 team: fix mtu setting [ Upstream commit 9d0d68faea6962d62dd501cd6e71ce5cc8ed262b ] Now it is not possible to set mtu to team device which has a port enslaved to it. The reason is that when team_change_mtu() calls dev_set_mtu() for port device, notificator for NETDEV_PRECHANGEMTU event is called and team_device_event() returns NOTIFY_BAD forbidding the change. So fix this by returning NOTIFY_DONE here in case team is changing mtu in team_change_mtu(). Introduced-by: 3d249d4c "net: introduce ethernet teaming device" Signed-off-by: Jiri Pirko Acked-by: Flavio Leitner Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 12b4aba2d6f870dd8f505ae5dd5fc887d6484a93 Author: Eric Dumazet Date: Thu May 29 08:45:14 2014 -0700 net: fix inet_getid() and ipv6_select_ident() bugs [ Upstream commit 39c36094d78c39e038c1e499b2364e13bce36f54 ] I noticed we were sending wrong IPv4 ID in TCP flows when MTU discovery is disabled. Note how GSO/TSO packets do not have monotonically incrementing ID. 06:37:41.575531 IP (id 14227, proto: TCP (6), length: 4396) 06:37:41.575534 IP (id 14272, proto: TCP (6), length: 65212) 06:37:41.575544 IP (id 14312, proto: TCP (6), length: 57972) 06:37:41.575678 IP (id 14317, proto: TCP (6), length: 7292) 06:37:41.575683 IP (id 14361, proto: TCP (6), length: 63764) It appears I introduced this bug in linux-3.1. inet_getid() must return the old value of peer->ip_id_count, not the new one. Lets revert this part, and remove the prevention of a null identification field in IPv6 Fragment Extension Header, which is dubious and not even done properly. Fixes: 87c48fa3b463 ("ipv6: make fragment identifications less predictable") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit fe2fe574d1e2c377bbfe641a34935db9d76be539 Author: Tom Gundersen Date: Thu May 15 23:21:30 2014 +0200 net: tunnels - enable module autoloading [ Upstream commit f98f89a0104454f35a62d681683c844f6dbf4043 ] Enable the module alias hookup to allow tunnel modules to be autoloaded on demand. This is in line with how most other netdev kinds work, and will allow userspace to create tunnels without having CAP_SYS_MODULE. Signed-off-by: Tom Gundersen Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 3ed50132d6a8244a14f9896e897464c099809462 Author: Toshiaki Makita Date: Mon May 26 15:15:53 2014 +0900 bridge: Prevent insertion of FDB entry with disallowed vlan [ Upstream commit e0d7968ab6c8bce2437b36fa7f04117e333f196d ] br_handle_local_finish() is allowing us to insert an FDB entry with disallowed vlan. For example, when port 1 and 2 are communicating in vlan 10, and even if vlan 10 is disallowed on port 3, port 3 can interfere with their communication by spoofed src mac address with vlan id 10. Note: Even if it is judged that a frame should not be learned, it should not be dropped because it is destined for not forwarding layer but higher layer. See IEEE 802.1Q-2011 8.13.10. Signed-off-by: Toshiaki Makita Acked-by: Vlad Yasevich Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit ec2ab4bc695981aac49a33317c9d8b541f2babd1 Author: Michal Schmidt Date: Mon Jun 2 18:25:02 2014 +0200 netlink: rate-limit leftover bytes warning and print process name [ Upstream commit bfc5184b69cf9eeb286137640351c650c27f118a ] Any process is able to send netlink messages with leftover bytes. Make the warning rate-limited to prevent too much log spam. The warning is supposed to help find userspace bugs, so print the triggering command name to implicate the buggy program. [v2: Use pr_warn_ratelimited instead of printk_ratelimited.] Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit d8981d30858dafaf3b603ffd2d1231f410821e29 Author: Dan Carpenter Date: Fri May 23 19:37:21 2014 +0300 qlcnic: info leak in qlcnic_dcb_peer_app_info() [ Upstream commit 7df566bbdd0af0785542b89466a937e94257fcfb ] This function is called from dcbnl_build_peer_app(). The "info" struct isn't initialized at all so we disclose 2 bytes of uninitialized stack data. We should clear it before passing it to the user. Fixes: 48365e485275 ('qlcnic: dcb: Add support for CEE Netlink interface.') Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit bf5e2defa6e00fba34118b613d3539f818f84636 Author: Eric W. Biederman Date: Fri May 30 11:04:00 2014 -0700 netlink: Only check file credentials for implicit destinations [ Upstream commit 2d7a85f4b06e9c27ff629f07a524c48074f07f81 ] It was possible to get a setuid root or setcap executable to write to it's stdout or stderr (which has been set made a netlink socket) and inadvertently reconfigure the networking stack. To prevent this we check that both the creator of the socket and the currentl applications has permission to reconfigure the network stack. Unfortunately this breaks Zebra which always uses sendto/sendmsg and creates it's socket without any privileges. To keep Zebra working don't bother checking if the creator of the socket has privilege when a destination address is specified. Instead rely exclusively on the privileges of the sender of the socket. Note from Andy: This is exactly Eric's code except for some comment clarifications and formatting fixes. Neither I nor, I think, anyone else is thrilled with this approach, but I'm hesitant to wait on a better fix since 3.15 is almost here. Note to stable maintainers: This is a mess. An earlier series of patches in 3.15 fix a rather serious security issue (CVE-2014-0181), but they did so in a way that breaks Zebra. The offending series includes: commit aa4cf9452f469f16cea8c96283b641b4576d4a7b Author: Eric W. Biederman Date: Wed Apr 23 14:28:03 2014 -0700 net: Add variants of capable for use on netlink messages If a given kernel version is missing that series of fixes, it's probably worth backporting it and this patch. if that series is present, then this fix is critical if you care about Zebra. Cc: stable@vger.kernel.org Signed-off-by: "Eric W. Biederman" Signed-off-by: Andy Lutomirski Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 50b8b6e75fa0c08cef1e1ed30a7ab91f05bcb779 Author: Eric W. Biederman Date: Wed Apr 23 14:29:27 2014 -0700 net: Use netlink_ns_capable to verify the permisions of netlink messages [ Upstream commit 90f62cf30a78721641e08737bda787552428061e ] It is possible by passing a netlink socket to a more privileged executable and then to fool that executable into writing to the socket data that happens to be valid netlink message to do something that privileged executable did not intend to do. To keep this from happening replace bare capable and ns_capable calls with netlink_capable, netlink_net_calls and netlink_ns_capable calls. Which act the same as the previous calls except they verify that the opener of the socket had the desired permissions as well. Reported-by: Andy Lutomirski Signed-off-by: "Eric W. Biederman" Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 3b175c7b361838fe80fdd000bf1f0970ca8fbdaf Author: Eric W. Biederman Date: Wed Apr 23 14:28:03 2014 -0700 net: Add variants of capable for use on netlink messages [ Upstream commit aa4cf9452f469f16cea8c96283b641b4576d4a7b ] netlink_net_capable - The common case use, for operations that are safe on a network namespace netlink_capable - For operations that are only known to be safe for the global root netlink_ns_capable - The general case of capable used to handle special cases __netlink_ns_capable - Same as netlink_ns_capable except taking a netlink_skb_parms instead of the skbuff of a netlink message. Signed-off-by: "Eric W. Biederman" Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 8c91777bd4951c1f1ad59842fe4d208f94a97dfe Author: Eric W. Biederman Date: Wed Apr 23 14:26:56 2014 -0700 net: Add variants of capable for use on on sockets [ Upstream commit a3b299da869d6e78cf42ae0b1b41797bcb8c5e4b ] sk_net_capable - The common case, operations that are safe in a network namespace. sk_capable - Operations that are not known to be safe in a network namespace sk_ns_capable - The general case for special cases. Signed-off-by: "Eric W. Biederman" Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 4dcecf4ce16a20c210e91a62ae28275418e3ed2c Author: Eric W. Biederman Date: Wed Apr 23 14:26:25 2014 -0700 net: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump [ Upstream commit a53b72c83a4216f2eb883ed45a0cbce014b8e62d ] The permission check in sock_diag_put_filterinfo is wrong, and it is so removed from it's sources it is not clear why it is wrong. Move the computation into packet_diag_dump and pass a bool of the result into sock_diag_filterinfo. This does not yet correct the capability check but instead simply moves it to make it clear what is going on. Reported-by: Andy Lutomirski Signed-off-by: "Eric W. Biederman" Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 4587dcd284963b76844da9932f6440aa312aec0a Author: Eric W. Biederman Date: Wed Apr 23 14:25:48 2014 -0700 netlink: Rename netlink_capable netlink_allowed [ Upstream commit 5187cd055b6e81fc6526109456f8b20623148d5f ] netlink_capable is a static internal function in af_netlink.c and we have better uses for the name netlink_capable. Signed-off-by: "Eric W. Biederman" Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit f422f975187e23c15cf8be951490623428659eba Author: Mimi Zohar Date: Sun May 11 00:05:23 2014 -0400 evm: prohibit userspace writing 'security.evm' HMAC value commit 2fb1c9a4f2dbc2f0bd2431c7fa64d0b5483864e4 upstream. Calculating the 'security.evm' HMAC value requires access to the EVM encrypted key. Only the kernel should have access to it. This patch prevents userspace tools(eg. setfattr, cp --preserve=xattr) from setting/modifying the 'security.evm' HMAC value directly. Signed-off-by: Mimi Zohar Signed-off-by: Jiri Slaby commit 4a3802293bfe49344739ff355d9d9f0514f31e19 Author: Dmitry Kasatkin Date: Thu May 8 14:03:22 2014 +0300 ima: introduce ima_kernel_read() commit 0430e49b6e7c6b5e076be8fefdee089958c9adad upstream. Commit 8aac62706 "move exit_task_namespaces() outside of exit_notify" introduced the kernel opps since the kernel v3.10, which happens when Apparmor and IMA-appraisal are enabled at the same time. ---------------------------------------------------------------------- [ 106.750167] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 [ 106.750221] IP: [] our_mnt+0x1a/0x30 [ 106.750241] PGD 0 [ 106.750254] Oops: 0000 [#1] SMP [ 106.750272] Modules linked in: cuse parport_pc ppdev bnep rfcomm bluetooth rpcsec_gss_krb5 nfsd auth_rpcgss nfs_acl nfs lockd sunrpc fscache dm_crypt intel_rapl x86_pkg_temp_thermal intel_powerclamp kvm_intel snd_hda_codec_hdmi kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd snd_hda_codec_realtek dcdbas snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_seq_midi snd_seq_midi_event snd_rawmidi psmouse snd_seq microcode serio_raw snd_timer snd_seq_device snd soundcore video lpc_ich coretemp mac_hid lp parport mei_me mei nbd hid_generic e1000e usbhid ahci ptp hid libahci pps_core [ 106.750658] CPU: 6 PID: 1394 Comm: mysqld Not tainted 3.13.0-rc7-kds+ #15 [ 106.750673] Hardware name: Dell Inc. OptiPlex 9010/0M9KCM, BIOS A08 09/19/2012 [ 106.750689] task: ffff8800de804920 ti: ffff880400fca000 task.ti: ffff880400fca000 [ 106.750704] RIP: 0010:[] [] our_mnt+0x1a/0x30 [ 106.750725] RSP: 0018:ffff880400fcba60 EFLAGS: 00010286 [ 106.750738] RAX: 0000000000000000 RBX: 0000000000000100 RCX: ffff8800d51523e7 [ 106.750764] RDX: ffffffffffffffea RSI: ffff880400fcba34 RDI: ffff880402d20020 [ 106.750791] RBP: ffff880400fcbae0 R08: 0000000000000000 R09: 0000000000000001 [ 106.750817] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800d5152300 [ 106.750844] R13: ffff8803eb8df510 R14: ffff880400fcbb28 R15: ffff8800d51523e7 [ 106.750871] FS: 0000000000000000(0000) GS:ffff88040d200000(0000) knlGS:0000000000000000 [ 106.750910] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 106.750935] CR2: 0000000000000018 CR3: 0000000001c0e000 CR4: 00000000001407e0 [ 106.750962] Stack: [ 106.750981] ffffffff813434eb ffff880400fcbb20 ffff880400fcbb18 0000000000000000 [ 106.751037] ffff8800de804920 ffffffff8101b9b9 0001800000000000 0000000000000100 [ 106.751093] 0000010000000000 0000000000000002 000000000000000e ffff8803eb8df500 [ 106.751149] Call Trace: [ 106.751172] [] ? aa_path_name+0x2ab/0x430 [ 106.751199] [] ? sched_clock+0x9/0x10 [ 106.751225] [] aa_path_perm+0x7d/0x170 [ 106.751250] [] ? native_sched_clock+0x15/0x80 [ 106.751276] [] aa_file_perm+0x33/0x40 [ 106.751301] [] common_file_perm+0x8e/0xb0 [ 106.751327] [] apparmor_file_permission+0x18/0x20 [ 106.751355] [] security_file_permission+0x23/0xa0 [ 106.751382] [] rw_verify_area+0x52/0xe0 [ 106.751407] [] vfs_read+0x6d/0x170 [ 106.751432] [] kernel_read+0x41/0x60 [ 106.751457] [] ima_calc_file_hash+0x225/0x280 [ 106.751483] [] ? ima_calc_file_hash+0x32/0x280 [ 106.751509] [] ima_collect_measurement+0x9d/0x160 [ 106.751536] [] ? trace_hardirqs_on+0xd/0x10 [ 106.751562] [] ? ima_file_free+0x6c/0xd0 [ 106.751587] [] ima_update_xattr+0x34/0x60 [ 106.751612] [] ima_file_free+0xc0/0xd0 [ 106.751637] [] __fput+0xd5/0x300 [ 106.751662] [] ____fput+0xe/0x10 [ 106.751687] [] task_work_run+0xc4/0xe0 [ 106.751712] [] do_exit+0x2bd/0xa90 [ 106.751738] [] ? retint_swapgs+0x13/0x1b [ 106.751763] [] do_group_exit+0x4c/0xc0 [ 106.751788] [] SyS_exit_group+0x14/0x20 [ 106.751814] [] system_call_fastpath+0x1a/0x1f [ 106.751839] Code: c3 0f 1f 44 00 00 55 48 89 e5 e8 22 fe ff ff 5d c3 0f 1f 44 00 00 55 65 48 8b 04 25 c0 c9 00 00 48 8b 80 28 06 00 00 48 89 e5 5d <48> 8b 40 18 48 39 87 c0 00 00 00 0f 94 c0 c3 0f 1f 80 00 00 00 [ 106.752185] RIP [] our_mnt+0x1a/0x30 [ 106.752214] RSP [ 106.752236] CR2: 0000000000000018 [ 106.752258] ---[ end trace 3c520748b4732721 ]--- ---------------------------------------------------------------------- The reason for the oops is that IMA-appraisal uses "kernel_read()" when file is closed. kernel_read() honors LSM security hook which calls Apparmor handler, which uses current->nsproxy->mnt_ns. The 'guilty' commit changed the order of cleanup code so that nsproxy->mnt_ns was not already available for Apparmor. Discussion about the issue with Al Viro and Eric W. Biederman suggested that kernel_read() is too high-level for IMA. Another issue, except security checking, that was identified is mandatory locking. kernel_read honors it as well and it might prevent IMA from calculating necessary hash. It was suggested to use simplified version of the function without security and locking checks. This patch introduces special version ima_kernel_read(), which skips security and mandatory locking checking. It prevents the kernel oops to happen. Signed-off-by: Dmitry Kasatkin Suggested-by: Eric W. Biederman Signed-off-by: Mimi Zohar Signed-off-by: Jiri Slaby commit 4eed5cf5e6d06f1ef7d786ed3f43da55112cb96c Author: Nicholas Bellinger Date: Thu Jun 5 18:08:57 2014 -0700 iscsi-target: Reject mutual authentication with reflected CHAP_C commit 1d2b60a5545942b1376cb48c1d55843d71e3a08f upstream. This patch adds an explicit check in chap_server_compute_md5() to ensure the CHAP_C value received from the initiator during mutual authentication does not match the original CHAP_C provided by the target. This is in line with RFC-3720, section 8.2.1: Originators MUST NOT reuse the CHAP challenge sent by the Responder for the other direction of a bidirectional authentication. Responders MUST check for this condition and close the iSCSI TCP connection if it occurs. Reported-by: Tejas Vaykole Signed-off-by: Nicholas Bellinger Signed-off-by: Jiri Slaby commit ba576fd015636729ae6c55bd96f56014c2526571 Author: Boris BREZILLON Date: Fri Jun 6 14:36:09 2014 -0700 rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq commit 2fe121e1f5aa3bf31b418a9790db6c400e922291 upstream. The rtc user must wait at least 1 sec between each time/calandar update (see atmel's datasheet chapter "Updating Time/Calendar"). Use the 1Hz interrupt to update the at91_rtc_upd_rdy flag and wait for the at91_rtc_wait_upd_rdy event if the rtc is not ready. This patch fixes a deadlock in an uninterruptible wait when the RTC is updated more than once every second. AFAICT the bug is here from the beginning, but I think we should at least backport this fix to 3.10 and the following longterm and stable releases. Signed-off-by: Boris BREZILLON Reported-by: Bryan Evenson Tested-by: Bryan Evenson Cc: Andrew Victor Cc: Nicolas Ferre Cc: Jean-Christophe Plagniol-Villard Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit 07d054ef6765b307277f02c11b51f0695d6b3d7c Author: Michael S. Tsirkin Date: Mon Mar 10 19:28:08 2014 +0200 skbuff: skb_segment: orphan frags before copying [ Upstream commit 1fd819ecb90cc9b822cd84d3056ddba315d3340f ] skb_segment copies frags around, so we need to copy them carefully to avoid accessing user memory after reporting completion to userspace through a callback. skb_segment doesn't normally happen on datapath: TSO needs to be disabled - so disabling zero copy in this case does not look like a big deal. Signed-off-by: Michael S. Tsirkin Acked-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit f2a855e3e126a716b71ddf369754f70573b26bce Author: Michael S. Tsirkin Date: Mon Mar 10 19:27:59 2014 +0200 skbuff: skb_segment: s/fskb/list_skb/ [ Upstream commit 1a4cedaf65491e66e1e55b8428c89209da729209 ] fskb is unrelated to frag: it's coming from frag_list. Rename it list_skb to avoid confusion. Signed-off-by: Michael S. Tsirkin Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 14568bf24e155542476e3cc14cd28bbda61d6f1f Author: Michael S. Tsirkin Date: Mon Mar 10 18:29:19 2014 +0200 skbuff: skb_segment: s/skb/head_skb/ [ Upstream commit df5771ffefb13f8af5392bd54fd7e2b596a3a357 ] rename local variable to make it easier to tell at a glance that we are dealing with a head skb. Signed-off-by: Michael S. Tsirkin Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 74781837f9e968490b4e2fe900f6c1880583dd3e Author: Michael S. Tsirkin Date: Mon Mar 10 18:29:14 2014 +0200 skbuff: skb_segment: s/skb_frag/frag/ [ Upstream commit 4e1beba12d094c6c761ba5c49032b9b9e46380e8 ] skb_frag can in fact point at either skb or fskb so rename it generally "frag". Signed-off-by: Michael S. Tsirkin Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit e7fb29afa611ca364a8f6e26af2128db2a7d7ff0 Author: Michael S. Tsirkin Date: Mon Mar 10 18:29:04 2014 +0200 skbuff: skb_segment: s/frag/nskb_frag/ [ Upstream commit 8cb19905e9287a93ce7c2cbbdf742a060b00e219 ] frag points at nskb, so name it appropriately Signed-off-by: Michael S. Tsirkin Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit e6e3ee68f0906382b0440086b6b33f2bc9adcc0d Author: Mimi Zohar Date: Fri Jun 20 09:12:18 2014 -0400 ima: audit log files opened with O_DIRECT flag commit f9b2a735bdddf836214b5dca74f6ca7712e5a08c upstream. Files are measured or appraised based on the IMA policy. When a file, in policy, is opened with the O_DIRECT flag, a deadlock occurs. The first attempt at resolving this lockdep temporarily removed the O_DIRECT flag and restored it, after calculating the hash. The second attempt introduced the O_DIRECT_HAVELOCK flag. Based on this flag, do_blockdev_direct_IO() would skip taking the i_mutex a second time. The third attempt, by Dmitry Kasatkin, resolves the i_mutex locking issue, by re-introducing the IMA mutex, but uncovered another problem. Reading a file with O_DIRECT flag set, writes directly to userspace pages. A second patch allocates a user-space like memory. This works for all IMA hooks, except ima_file_free(), which is called on __fput() to recalculate the file hash. Until this last issue is addressed, do not 'collect' the measurement for measuring, appraising, or auditing files opened with the O_DIRECT flag set. Based on policy, permit or deny file access. This patch defines a new IMA policy rule option named 'permit_directio'. Policy rules could be defined, based on LSM or other criteria, to permit specific applications to open files with the O_DIRECT flag set. Changelog v1: - permit or deny file access based IMA policy rules Signed-off-by: Mimi Zohar Acked-by: Dmitry Kasatkin Signed-off-by: Jiri Slaby commit a2793aa17bdf13e3959f016b6ee224a9468555e7 Author: Ville Syrjälä Date: Thu Mar 27 11:08:45 2014 +0200 drm/i915: Allow user modes to exceed DVI 165MHz limit commit 40478455fefdc0bde24ae872c3f88d58a1b0e435 upstream. In commit commit 6375b768a9850b6154478993e5fb566fa4614a9c Author: Ville Syrjälä Date: Mon Mar 3 11:33:36 2014 +0200 drm/i915: Reject >165MHz modes w/ DVI monitors the driver started to filter out display modes which exceed the single-link DVI 165Mz dotclock limits when the monitor doesn't report itself as being HDMI compliant. The intent was to filter out all EDID derived modes that require dual-link DVI to operate since we don't support dual-link. However the patch went a bit too far and also causes the driver to reject such modes even when specified by the user. Normally we don't check the sink limitations when setting a mode from the user. This allows the user to specify any mode whether the sink reports to support it or not. This can be useful since often the sinks support more modes than they report in the EDID. So relax the checks a bit, and apply the single-link DVI dotclock limit only when filtering the mode list, and ignore the limit when setting a user specified mode. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=72961 Tested-by: Nicholas Vinson Cc: stable@vger.kernel.org [3.14] Reviewed-by: Daniel Vetter Signed-off-by: Ville Syrjälä Signed-off-by: Jani Nikula Signed-off-by: Takashi Iwai Signed-off-by: Jiri Slaby commit e22c4b0b49a7afb7870817b5a9b508f67c5025a6 Author: Andreas Schrägle Date: Sat May 24 16:35:43 2014 +0200 ahci: add PCI ID for Marvell 88SE91A0 SATA Controller commit 754a292fe6b08196cb135c03b404444e17de520a upstream. Add support for Marvell Technology Group Ltd. 88SE91A0 SATA 6Gb/s Controller by adding its PCI ID. Signed-off-by: Andreas Schrägle Signed-off-by: Tejun Heo Signed-off-by: Jiri Slaby commit e3f3e7f6609d79422703cb8a1d4b17b0485e08ae Author: Jérôme Carretero Date: Tue Jun 3 14:56:25 2014 -0400 ahci: Add Device ID for HighPoint RocketRaid 642L commit d251836508fb26cd1a22b41381739835ee23728d upstream. This device normally comes with a proprietary driver, using a web GUI to configure RAID: http://www.highpoint-tech.com/USA_new/series_rr600-download.htm But thankfully it also works out of the box with the AHCI driver, being just a Marvell 88SE9235. Devices 640L, 644L, 644LS should also be supported but not tested here. Signed-off-by: Jérôme Carretero Signed-off-by: Tejun Heo Signed-off-by: Jiri Slaby commit c176ea1d1913617e39ef146de3e830c33713ed8b Author: Alessandro Miceli Date: Sun May 4 07:50:31 2014 -0300 rtl28xxu: add [1b80:d3af] Sveon STV27 commit 74a86272f05c3dae40f2d7b17ff09a0608cf3304 upstream. Added support for Sveon STV27 device (rtl2832u + FC0013 tuner) Signed-off-by: Alessandro Miceli Signed-off-by: Antti Palosaari Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby commit 885f640c6607745abbb2958143ee4f394f6e9fb1 Author: Alessandro Miceli Date: Sun May 4 07:37:15 2014 -0300 rtl28xxu: add [1b80:d39d] Sveon STV20 commit f27f5b0ee4967babfb8b03511f5e76b79d781014 upstream. Added Sveon STV20 device based on Realtek RTL2832U and FC0012 tuner Signed-off-by: Alessandro Miceli Signed-off-by: Antti Palosaari Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby commit 0b7106f039378ab4f7dfabfc41c92ae124775513 Author: Brian Healy Date: Sun May 4 18:43:39 2014 -0300 rtl28xxu: add 1b80:d395 Peak DVB-T USB commit 9ca24ae4083665bda38da45f4b5dc9bbaf936bc0 upstream. Add USB ID for Peak DVB-T USB. [crope@iki.fi: fix Brian email address and indentation] Signed-off-by: Brian Healy Signed-off-by: Antti Palosaari Signed-off-by: Jiri Slaby Signed-off-by: Mauro Carvalho Chehab commit be7a9c317efde7bad3198f789d37df8ab1ed59db Author: Jan Vcelak Date: Wed Feb 26 15:33:40 2014 -0300 rtl28xxu: add chipset version comments into device list commit 60aa4c6fa5723af72cff154a5cd33ac4995d1e0a upstream. Signed-off-by: Jan Vcelak Signed-off-by: Antti Palosaari Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby commit a049936ef3a7a18d0721da7c27835e8bd5577c10 Author: Jan Vcelak Date: Wed Feb 26 15:33:39 2014 -0300 rtl28xxu: add USB ID for Genius TVGo DVB-T03 commit ac298ccdde4fe9b0a966e548a232ff4e8a6b8a31 upstream. 0458:707f KYE Systems Corp. (Mouse Systems) TVGo DVB-T03 [RTL2832] The USB dongle uses RTL2832U demodulator and FC0012 tuner. Signed-off-by: Jan Vcelak Signed-off-by: Antti Palosaari Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby commit 8ff3e820444d1452991c623cdde32b4fa0d1d3c1 Author: Till Dörges Date: Tue Feb 11 17:27:57 2014 -0300 rtl28xxu: add ID [0ccd:00b4] TerraTec NOXON DAB Stick (rev 3) commit a24bc323eb07e2a3a751e23c172b68d1b239db67 upstream. I've got the following DAB USB stick that also works fine with the DVB_USB_RTL28XXU driver after I added its USB ID: Bus 001 Device 009: ID 0ccd:00b4 TerraTec Electronic GmbH [crope@iki.fi: apply patch partly manually] Signed-off-by: Till Dörges Signed-off-by: Antti Palosaari Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby commit cd07b1ac0cc3d6e2704575ea62884e886e6cefa1 Author: Tomas Winkler Date: Mon May 12 12:19:40 2014 +0300 mei: me: drop harmful wait optimization commit 07cd7be3d92eeeae1f92a017f2cfe4fdd9256526 upstream. It my take time till ME_RDY will be cleared after the reset, so we cannot check the bit before we got the interrupt Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Signed-off-by: Jiri Slaby commit 6004b0e5ac2e8e9e1bb0f012dc9242e03cca95df Author: Andy Lutomirski Date: Wed May 28 23:09:58 2014 -0400 auditsc: audit_krule mask accesses need bounds checking commit a3c54931199565930d6d84f4c3456f6440aefd41 upstream. Fixes an easy DoS and possible information disclosure. This does nothing about the broken state of x32 auditing. eparis: If the admin has enabled auditd and has specifically loaded audit rules. This bug has been around since before git. Wow... Signed-off-by: Andy Lutomirski Signed-off-by: Eric Paris Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit bf8af413dcf4591bcc8f823133c4a2355c189458 Author: Nicholas Bellinger Date: Thu Jun 5 23:37:00 2014 -0700 target: Allow READ_CAPACITY opcode in ALUA Standby access state commit e7810c2d2c37fa8e58dda74b00790dab60fe6fba upstream. This patch allows READ_CAPACITY + SAI_READ_CAPACITY_16 opcode processing to occur while the associated ALUA group is in Standby access state. This is required to avoid host side LUN probe failures during the initial scan if an ALUA group has already implicitly changed into Standby access state. This addresses a bug reported by Chris + Philip using dm-multipath + ESX hosts configured with ALUA multipath. (Drop v3.15 specific set_ascq usage - nab) Reported-by: Chris Boot Reported-by: Philip Gaw Cc: Chris Boot Cc: Philip Gaw Cc: Hannes Reinecke Signed-off-by: Nicholas Bellinger Signed-off-by: Jiri Slaby commit a51660781e72c3663e4e7f7a09b625a38c3d1f1a Author: Nicholas Bellinger Date: Tue Jun 3 18:27:52 2014 -0700 iser-target: Fix multi network portal shutdown regression commit 2363d196686e44c0158929e7cf96c8589a24a81b upstream. This patch fixes a iser-target specific regression introduced in v3.15-rc6 with: commit 14f4b54fe38f3a8f8392a50b951c8aa43b63687a Author: Sagi Grimberg Date: Tue Apr 29 13:13:47 2014 +0300 Target/iscsi,iser: Avoid accepting transport connections during stop stage where the change to set iscsi_np->enabled = false within iscsit_clear_tpg_np_login_thread() meant that a iscsi_np with two iscsi_tpg_np exports would have it's parent iscsi_np set to a disabled state, even if other iscsi_tpg_np exports still existed. This patch changes iscsit_clear_tpg_np_login_thread() to only set iscsi_np->enabled = false when shutdown = true, and also changes iscsit_del_np() to set iscsi_np->enabled = true when iscsi_np->np_exports is non zero. Cc: Sagi Grimberg Signed-off-by: Nicholas Bellinger Signed-off-by: Jiri Slaby commit 39a125dfd39308cbae38f8555d3fa2de017511a0 Author: Sagi Grimberg Date: Tue Apr 29 13:13:47 2014 +0300 Target/iscsi,iser: Avoid accepting transport connections during stop stage commit 14f4b54fe38f3a8f8392a50b951c8aa43b63687a upstream. When the target is in stop stage, iSER transport initiates RDMA disconnects. The iSER initiator may wish to establish a new connection over the still existing network portal. In this case iSER transport should not accept and resume new RDMA connections. In order to learn that, iscsi_np is added with enabled flag so the iSER transport can check when deciding weather to accept and resume a new connection request. The iscsi_np is enabled after successful transport setup, and disabled before iscsi_np login threads are cleaned up. Signed-off-by: Sagi Grimberg Signed-off-by: Nicholas Bellinger Signed-off-by: Jiri Slaby commit 2246a472bce19c0d373fb5488a0e612e3328ce0a Author: Andy Lutomirski Date: Tue Jun 10 12:45:42 2014 -0700 fs,userns: Change inode_capable to capable_wrt_inode_uidgid commit 23adbe12ef7d3d4195e80800ab36b37bee28cd03 upstream. The kernel has no concept of capabilities with respect to inodes; inodes exist independently of namespaces. For example, inode_capable(inode, CAP_LINUX_IMMUTABLE) would be nonsense. This patch changes inode_capable to check for uid and gid mappings and renames it to capable_wrt_inode_uidgid, which should make it more obvious what it does. Fixes CVE-2014-4014. Cc: Theodore Ts'o Cc: Serge Hallyn Cc: "Eric W. Biederman" Cc: Dave Chinner Signed-off-by: Andy Lutomirski Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit 21af26cb47416f782c39b4055eb7de21476838a5 Author: Robert Backhaus Date: Fri Dec 13 09:59:10 2013 -0300 [media] Add USB IDs for Winfast DTV Dongle Mini-D commit d22d32e117c19efa1761d871d9dab5e294b7b77d upstream. GIT_AUTHOR_DATE=1386943312 Add USB IDs for the WinFast DTV Dongle Mini. Device is tested and works fine under MythTV Signed-off-by: Robert Backhaus Acked-by: Antti Palosaari Reviewed-by: Antti Palosaari Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby commit d5b6059bcccdb85a6e42dc1fa73fe7ee33e47316 Author: Antti Palosaari Date: Wed Oct 30 02:33:42 2013 -0300 [media] rtl28xxu: add 15f4:0131 Astrometa DVB-T2 commit 8fdd33b1bcf32ed9cf21aa9e4a66fa68c6beaa1b upstream. Components are RTL2832P + R828D + MN88472. Currently support only DVB-T as there is no driver for MN88472 demod. Signed-off-by: Antti Palosaari Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby commit af1cf97144be97a768b9198be6a9a5bdd2bb19ed Author: Michael Welling Date: Wed Apr 16 20:00:24 2014 -0500 gpio: mcp23s08: Bug fix of SPI device tree registration. commit 99e4b98dbe3ad1fe38a74d12c3b8d44a55930de4 upstream. The chips variable needs to be incremented for each chip that is found in the spi_present_mask when registering via device tree. Without this and the checking a negative index is passed to the data->chip array in a subsequent loop. Signed-off-by: Michael Welling Acked-by: Peter Korsgaard Signed-off-by: Linus Walleij Signed-off-by: Jiri Slaby commit ca55f49d628c4b9805d6567b45c6cc27503ac32f Author: Nicholas Bellinger Date: Fri Jun 6 00:52:57 2014 -0700 target: Fix alua_access_state attribute OOPs for un-configured devices commit f1453773514bb8b0bba0716301e8c8f17f8d39c7 upstream. This patch fixes a OOPs where an attempt to write to the per-device alua_access_state configfs attribute at: /sys/kernel/config/target/core/$HBA/$DEV/alua/$TG_PT_GP/alua_access_state results in an NULL pointer dereference when the backend device has not yet been configured. This patch adds an explicit check for DF_CONFIGURED, and fails with -ENODEV to avoid this case. Reported-by: Chris Boot Reported-by: Philip Gaw Cc: Chris Boot Cc: Philip Gaw Signed-off-by: Nicholas Bellinger Signed-off-by: Jiri Slaby commit a12e3e7bfc80023f8ef4ab17eebeb0e344494036 Author: Nicholas Bellinger Date: Fri May 23 00:48:35 2014 -0700 iser-target: Add missing target_put_sess_cmd for ImmedateData failure commit 6cc44a6fb46e1ecc1c28125aa8fa34d317aa9ea7 upstream. This patch addresses a bug where an early exception for SCSI WRITE with ImmediateData=Yes was missing the target_put_sess_cmd() call to drop the extra se_cmd->cmd_kref reference obtained during the normal iscsit_setup_scsi_cmd() codepath execution. This bug was manifesting itself during session shutdown within isert_cq_rx_comp_err() where target_wait_for_sess_cmds() would end up waiting indefinately for the last se_cmd->cmd_kref put to occur for the failed SCSI WRITE + ImmediateData descriptors. This fix follows what traditional iscsi-target code already does for the same failure case within iscsit_get_immediate_data(). Reported-by: Sagi Grimberg Cc: Sagi Grimberg Cc: Or Gerlitz Signed-off-by: Nicholas Bellinger Signed-off-by: Jiri Slaby commit 3e1b305b53c104d93e1f5d4ac1e682bdf31bb139 Author: Andrey Ryabinin Date: Fri Jun 6 19:09:30 2014 +0400 mm: rmap: fix use-after-free in __put_anon_vma commit 624483f3ea82598ab0f62f1bdb9177f531ab1892 upstream. While working address sanitizer for kernel I've discovered use-after-free bug in __put_anon_vma. For the last anon_vma, anon_vma->root freed before child anon_vma. Later in anon_vma_free(anon_vma) we are referencing to already freed anon_vma->root to check rwsem. This fixes it by freeing the child anon_vma before freeing anon_vma->root. Signed-off-by: Andrey Ryabinin Acked-by: Peter Zijlstra Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit eed37ca3ef2da47c30cc0402f44e1992d4142983 Author: Sebastian Ott Date: Wed Jun 4 15:58:24 2014 +0200 percpu-refcount: fix usage of this_cpu_ops commit 0c36b390a546055b6815d4b93a2c9fed4d980ffb upstream. The percpu-refcount infrastructure uses the underscore variants of this_cpu_ops in order to modify percpu reference counters. (e.g. __this_cpu_inc()). However the underscore variants do not atomically update the percpu variable, instead they may be implemented using read-modify-write semantics (more than one instruction). Therefore it is only safe to use the underscore variant if the context is always the same (process, softirq, or hardirq). Otherwise it is possible to lose updates. This problem is something that Sebastian has seen within the aio subsystem which uses percpu refcounters both in process and softirq context leading to reference counts that never dropped to zeroes; even though the number of "get" and "put" calls matched. Fix this by using the non-underscore this_cpu_ops variant which provides correct per cpu atomic semantics and fixes the corrupted reference counts. Cc: Kent Overstreet Reported-by: Sebastian Ott Signed-off-by: Heiko Carstens Signed-off-by: Tejun Heo References: http://lkml.kernel.org/g/alpine.LFD.2.11.1406041540520.21183@denkbrett Signed-off-by: Jiri Slaby commit 7db4c4d2e0e04ea112a1900aea2fa3a746ebe633 Author: Alan Stern Date: Fri May 23 10:45:54 2014 -0400 USB: Avoid runtime suspend loops for HCDs that can't handle suspend/resume commit 8ef42ddd9a53b73e6fc3934278710c27f80f324f upstream. Not all host controller drivers have bus-suspend and bus-resume methods. When one doesn't, it will cause problems if runtime PM is enabled in the kernel. The PM core will attempt to suspend the controller's root hub, the suspend will fail because there is no bus-suspend routine, and a -EBUSY error code will be returned to the PM core. This will cause the suspend attempt to be repeated shortly thereafter, in a never-ending loop. Part of the problem is that the original error code -ENOENT gets changed to -EBUSY in usb_runtime_suspend(), on the grounds that the PM core will interpret -ENOENT as meaning that the root hub has gotten into a runtime-PM error state. While this change is appropriate for real USB devices, it's not such a good idea for a root hub. In fact, considering the root hub to be in a runtime-PM error state would not be far from the truth. Therefore this patch updates usb_runtime_suspend() so that it adjusts error codes only for non-root-hub devices. Furthermore, the patch attempts to prevent the problem from occurring in the first place by not enabling runtime PM by default for root hubs whose host controller driver doesn't have bus_suspend and bus_resume methods. Signed-off-by: Alan Stern Reported-by: Will Deacon Tested-by: Will Deacon Signed-off-by: Jiri Slaby commit ed7a0e4033fce15bec2424f3c6a7a5531e8b3203 Author: Mathias Nyman Date: Wed May 28 23:18:35 2014 +0300 usb: pci-quirks: Prevent Sony VAIO t-series from switching usb ports commit b38f09ccc3fd453180e96273bf3f34083c30809a upstream. Sony VAIO t-series machines are not capable of switching usb2 ports over from Intel EHCI to xHCI controller. If tried the USB2 port will be left unconnected and unusable. This patch should be backported to stable kernels as old as 3.12, that contain the commit 26b76798e0507429506b93cd49f8c4cfdab06896 "Intel xhci: refactor EHCI/xHCI port switching" Reported-by: Jorge Tested-by: Jorge Signed-off-by: Mathias Nyman Signed-off-by: Jiri Slaby commit 130f4c5a1899ca488a2c501311d9f5a746330f32 Author: Johan Hovold Date: Sat Apr 26 11:53:44 2014 +0200 USB: io_ti: fix firmware download on big-endian machines (part 2) commit c03890ff5e24a4bf59059f2d179f427559b7330a upstream. A recent patch that purported to fix firmware download on big-endian machines failed to add the corresponding sparse annotation to the i2c-header. This was reported by the kbuild test robot. Adding the appropriate annotation revealed another endianess bug related to the i2c-header Size-field in a code path that is exercised when the firmware is actually being downloaded (and not just verified and left untouched unless older than the firmware at hand). This patch adds the required sparse annotation to the i2c-header and makes sure that the Size-field is sent in little-endian byte order during firmware download also on big-endian machines. Note that this patch is only compile-tested, but that there is no functional change for little-endian systems. Reported-by: kbuild test robot Cc: Ludovic Drolez Signed-off-by: Johan Hovold Signed-off-by: Jiri Slaby commit c3300d7c625c606c7619e1eac14a985a48ff40bf Author: Alexej Starschenko Date: Wed May 7 10:43:29 2014 +0200 USB: serial: option: add support for Novatel E371 PCIe card commit 8a61ba3a47ac39f660702aa66a172185dd605a86 upstream. Adds product ID for the Novatel E371 PCI Express Mini Card. $ lsusb Bus 001 Device 024: ID 1410:9011 Novatel Wireless $ usb-devices T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 24 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1410 ProdID=9011 Rev=00.03 S: Manufacturer=Novatel Wireless, Inc. S: Product=Novatel Wireless HSPA S: SerialNumber=012773002115811 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 6 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#= 7 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether Tested with kernel 3.2.0. Signed-off-by: Alexej Starschenko Signed-off-by: Johan Hovold Signed-off-by: Jiri Slaby commit 1507358d93f24d74ba28704347873666e2b629e8 Author: Greg Kroah-Hartman Date: Tue May 27 16:32:10 2014 -0700 USB: cdc-wdm: properly include types.h commit 7ac3764fcafc06e72e1a79a9d998b9fdd900b2a6 upstream. The file include/uapi/linux/usb/cdc-wdm.h uses a __u16 so it needs to include types.h as well to make the build system happy. Fixes: 3edce1cf813a ("USB: cdc-wdm: implement IOCTL_WDM_MAX_COMMAND") Cc: Bjørn Mork Signed-off-by: Jiri Slaby commit a9fad769455dad571ee526bca5a7f52c5dbbaf81 Author: Bjørn Mork Date: Sat May 10 16:31:40 2014 +0200 usb: cdc-wdm: export cdc-wdm uapi header commit 7d1896360f4d055d68565ef8ed56a677580f1a39 upstream. The include/uapi/linux/usb/cdc-wdm.h header defines cdc-wdm userspace APIs and should be exported by make headers_install. Fixes: 3edce1cf813a ("USB: cdc-wdm: implement IOCTL_WDM_MAX_COMMAND") Signed-off-by: Bjørn Mork Signed-off-by: Jiri Slaby commit 05fabc1b425e984177f602fc7e3c9b453373567a Author: George McCollister Date: Sat Apr 26 12:04:47 2014 +0200 USB: ftdi_sio: add NovaTech OrionLXm product ID commit d0839d757e6294921c31b1c4ca4f1dcc5df63bcd upstream. The NovaTech OrionLXm uses an onboard FTDI serial converter for JTAG and console access. Here is the lsusb output: Bus 004 Device 123: ID 0403:7c90 Future Technology Devices International, Ltd Signed-off-by: George McCollister Signed-off-by: Johan Hovold Signed-off-by: Jiri Slaby commit 7588d0a2ca8c6b5f180ae899f99d9fc356dad62e Author: Takashi Iwai Date: Mon Jun 2 15:16:07 2014 +0200 ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup commit 192a98e280e560510a62aca8cfa83b4ae7c095bb upstream. The conversion to a fixup table for Replacer model with ALC260 in commit 20f7d928 took the wrong widget NID for COEF setups. Namely, NID 0x1a should have been used instead of NID 0x20, which is the common node for all Realtek codecs but ALC260. Fixes: 20f7d928fa6e ('ALSA: hda/realtek - Replace ALC260 model=replacer with the auto-parser') Signed-off-by: Takashi Iwai Signed-off-by: Jiri Slaby commit 31c276830276ad8f422d3ad7df2f49ef259e9ecc Author: Ronan Marquet Date: Sun Jun 1 18:38:53 2014 +0200 ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptop commit e30cf2d2bed3aed74a651c64de323ba26e4ff7d0 upstream. Correcion of wrong fixup entries add in commit ca8f0424 to replace static model quirk for PB V7900 laptop (will model). [note: the removal of ALC260_FIXUP_HP_PIN_0F chain is also needed as a part of the fix; otherwise the pin is set up wrongly as a headphone, and user-space (PulseAudio) may be wrongly trying to detect the jack state -- tiwai] Fixes: ca8f04247eaa ('ALSA: hda/realtek - Add the fixup codes for ALC260 model=will') Signed-off-by: Ronan Marquet Signed-off-by: Takashi Iwai Signed-off-by: Jiri Slaby commit 9b3928a84bf3c3c2b2928250225944234905ac71 Author: Takashi Iwai Date: Fri May 23 09:21:06 2014 +0200 ALSA: hda/analog - Fix silent output on ASUS A8JN commit 598e306184d26fa1d546334f2eb370b4d94a4ad3 upstream. ASUS A8JN with AD1986A codec seems following the normal EAPD in the normal order (0 = off, 1 = on) unlike other machines with AD1986A. Apply the workaround used for Toshiba laptop that showed the same problem. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=75041 Signed-off-by: Takashi Iwai Signed-off-by: Jiri Slaby commit d743aefeb796657d61155b0074c43a0eda2e6bdc Author: Ben Hutchings Date: Mon May 19 01:03:06 2014 +0100 Staging: speakup: Update __speakup_paste_selection() tty (ab)usage to match vt commit 28a821c306889b9f2c3fff49abedc9b2c743eb73 upstream. This function is largely a duplicate of paste_selection() in drivers/tty/vt/selection.c, but with its own selection state. The speakup selection mechanism should really be merged with vt. For now, apply the changes from 'TTY: vt, fix paste_selection ldisc handling', 'tty: Make ldisc input flow control concurrency-friendly', and 'tty: Fix unsafe vt paste_selection()'. References: https://bugs.debian.org/735202 References: https://bugs.debian.org/744015 Reported-by: Paul Gevers Reported-and-tested-by: Jarek Czekalski Signed-off-by: Ben Hutchings Signed-off-by: Jiri Slaby commit 089768acf22bb5a9d5a255413e5fdac0ad15c6ea Author: Ian Abbott Date: Mon May 19 11:29:04 2014 +0100 staging: comedi: ni_daq_700: add mux settling delay commit ffed54dced86723f352323f15789d9ad6bee25e1 upstream. I got a patch from the original author, Fred Brooks, to add a small settling delay after setting the AI channel multiplexor. The lack of delay resulted in unstable or scrambled data on faster processors. Signed-off-by: Ian Abbott Reported-by: Fred Brooks Signed-off-by: Jiri Slaby commit e71e310b30ccd69a206412668a6335a682b4e869 Author: Ben Hutchings Date: Mon May 19 00:56:22 2014 +0100 Staging: speakup: Move pasting into a work item commit d7500135802ca55b3f4e01a16544e8b34082f8c3 upstream. Input is handled in softirq context, but when pasting we may need to sleep. speakup_paste_selection() currently tries to bodge this by busy-waiting if in_atomic(), but that doesn't help because the ldisc may also sleep. For bonus breakage, speakup_paste_selection() changes the state of current, even though it's not running in process context. Move it into a work item and make sure to cancel it on exit. References: https://bugs.debian.org/735202 References: https://bugs.debian.org/744015 Reported-by: Paul Gevers Reported-and-tested-by: Jarek Czekalski Signed-off-by: Ben Hutchings Signed-off-by: Jiri Slaby commit 1f405c3d18c969477fa07f0f55cedd71d946e34e Author: Mathias Nyman Date: Wed May 28 23:51:13 2014 +0300 xhci: delete endpoints from bandwidth list before freeing whole device commit 5dc2808c4729bf080487e61b80ee04e0fdb12a37 upstream. Lists of endpoints are stored for bandwidth calculation for roothub ports. Make sure we remove all endpoints from the list before the whole device, containing its endpoints list_head stuctures, is freed. This used to be done in the wrong order in xhci_mem_cleanup(), and triggered an oops in resume from S4 (hibernate). Tested-by: Ville Syrjälä Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Signed-off-by: Jiri Slaby commit ab41ac4c4983f4d7d21e5801d601be34df0b58db Author: NeilBrown Date: Thu May 29 11:40:03 2014 +1000 md: always set MD_RECOVERY_INTR when interrupting a reshape thread. commit 2ac295a544dcae9299cba13ce250419117ae7fd1 upstream. Commit 8313b8e57f55b15e5b7f7fc5d1630bbf686a9a97 md: fix problem when adding device to read-only array with bitmap. added a called to md_reap_sync_thread() which cause a reshape thread to be interrupted (in particular, it could cause md_thread() to never even call md_do_sync()). However it didn't set MD_RECOVERY_INTR so ->finish_reshape() would not know that the reshape didn't complete. This only happens when mddev->ro is set and normally reshape threads don't run in that situation. But raid5 and raid10 can start a reshape thread during "run" is the array is in the middle of a reshape. They do this even if ->ro is set. So it is best to set MD_RECOVERY_INTR before abortingg the sync thread, just in case. Though it rare for this to trigger a problem it can cause data corruption because the reshape isn't finished properly. So it is suitable for any stable which the offending commit was applied to. (3.2 or later) Fixes: 8313b8e57f55b15e5b7f7fc5d1630bbf686a9a97 Signed-off-by: NeilBrown Signed-off-by: Jiri Slaby commit 73e620da4004e2dc8e3ada21cb2974a34ff4288b Author: NeilBrown Date: Wed May 28 13:39:23 2014 +1000 md: always set MD_RECOVERY_INTR when aborting a reshape or other "resync". commit 3991b31ea072b070081ca3bfa860a077eda67de5 upstream. If mddev->ro is set, md_to_sync will (correctly) abort. However in that case MD_RECOVERY_INTR isn't set. If a RESHAPE had been requested, then ->finish_reshape() will be called and it will think the reshape was successful even though nothing happened. Normally a resync will not be requested if ->ro is set, but if an array is stopped while a reshape is on-going, then when the array is started, the reshape will be restarted. If the array is also set read-only at this point, the reshape will instantly appear to success, resulting in data corruption. Consequently, this patch is suitable for any -stable kernel. Signed-off-by: NeilBrown Signed-off-by: Jiri Slaby commit dc99f5d68db77e0536074c394c71dd89d96899d1 Author: Martin K. Petersen Date: Mon Jun 2 19:57:16 2014 -0400 libata: Blacklist queued trim for Crucial M500 commit 3b8d2676d15d6b2326757adb66b70a9cd6650373 upstream. Queued trim only works for some users with MU05 firmware. Revert to blacklisting all firmware versions. Introduced by commit d121f7d0cbb8 ("libata: Update queued trim blacklist for M5x0 drives") which this effectively reverts, while retaining the blacklisting of M550. See https://bugzilla.kernel.org/show_bug.cgi?id=71371 for reports of trouble with MU05 firmware. Signed-off-by: Martin K. Petersen Cc: Alan Cox Cc: Tejun Heo Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit f1daac894b130d348c81bd5e9206edde8354e528 Author: Chris Wilson Date: Fri May 23 10:45:52 2014 +0100 drm/i915: Only copy back the modified fields to userspace from execbuffer commit 9aab8bff7aa3bee567213ad3c1fdfb217bb980a2 upstream. We only want to modifiy a single field in the userspace view of the execbuffer command buffer, so explicitly change that rather than copy everything back again. This serves two purposes: 1. The single fields are much cheaper to copy (constant size so the copy uses special case code) and much smaller than the whole array. 2. We modify the array for internal use that need to be masked from the user. Note: We need this backported since without it the next bugfix will blow up when userspace recycles batchbuffers and relocations. Signed-off-by: Chris Wilson Cc: Daniel Vetter Signed-off-by: Daniel Vetter Signed-off-by: Jiri Slaby commit 9292af256fbd70a11c469af030050d80b4ebad9e Author: Christian König Date: Wed May 21 17:43:59 2014 +0200 drm/radeon: avoid crash if VM command submission isn't available commit 60a445405a1731bac2279eab354173c9c3156747 upstream. Signed-off-by: Christian König Signed-off-by: Jiri Slaby commit 774f680a78bd9ac6ccac097e7826632e506046a9 Author: Lai Jiangshan Date: Fri May 16 11:50:42 2014 +0800 sched: Fix hotplug vs. set_cpus_allowed_ptr() commit 6acbfb96976fc3350e30d964acb1dbbdf876d55e upstream. Lai found that: WARNING: CPU: 1 PID: 13 at arch/x86/kernel/smp.c:124 native_smp_send_reschedule+0x2d/0x4b() ... migration_cpu_stop+0x1d/0x22 was caused by set_cpus_allowed_ptr() assuming that cpu_active_mask is always a sub-set of cpu_online_mask. This isn't true since 5fbd036b552f ("sched: Cleanup cpu_active madness"). So set active and online at the same time to avoid this particular problem. Fixes: 5fbd036b552f ("sched: Cleanup cpu_active madness") Signed-off-by: Lai Jiangshan Signed-off-by: Peter Zijlstra Cc: Andrew Morton Cc: Gautham R. Shenoy Cc: Linus Torvalds Cc: Michael wang Cc: Paul Gortmaker Cc: Rafael J. Wysocki Cc: Srivatsa S. Bhat Cc: Toshi Kani Link: http://lkml.kernel.org/r/53758B12.8060609@cn.fujitsu.com Signed-off-by: Ingo Molnar Signed-off-by: Jiri Slaby commit 3ae4e547f5106b3610ff4e2ead70e4b6263477c2 Author: Heinz Mauelshagen Date: Fri May 23 14:10:01 2014 -0400 dm cache: always split discards on cache block boundaries commit f1daa838e861ae1a0fb7cd9721a21258430fcc8c upstream. The DM cache target cannot cope with discards that span multiple cache blocks, so each discard bio that spans more than one cache block must get split by the DM core. Signed-off-by: Heinz Mauelshagen Acked-by: Joe Thornber Signed-off-by: Mike Snitzer Signed-off-by: Jiri Slaby commit 3ddbd9a2d572434bd5b63757a70d9532c0027de7 Author: Bibek Basu Date: Mon May 19 10:24:01 2014 +0530 cpufreq: remove race while accessing cur_policy commit c5450db85b828d0c46ac8fc570fb8a51bf07ac40 upstream. While accessing cur_policy during executing events CPUFREQ_GOV_START, CPUFREQ_GOV_STOP, CPUFREQ_GOV_LIMITS, same mutex lock is not taken, dbs_data->mutex, which leads to race and data corruption while running continious suspend resume test. This is seen with ondemand governor with suspend resume test using rtcwake. Unable to handle kernel NULL pointer dereference at virtual address 00000028 pgd = ed610000 [00000028] *pgd=adf11831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] PREEMPT SMP ARM Modules linked in: nvhost_vi CPU: 1 PID: 3243 Comm: rtcwake Not tainted 3.10.24-gf5cf9e5 #1 task: ee708040 ti: ed61c000 task.ti: ed61c000 PC is at cpufreq_governor_dbs+0x400/0x634 LR is at cpufreq_governor_dbs+0x3f8/0x634 pc : [] lr : [] psr: 600f0013 sp : ed61dcb0 ip : 000493e0 fp : c1cc14f0 r10: 00000000 r9 : 00000000 r8 : 00000000 r7 : eb725280 r6 : c1cc1560 r5 : eb575200 r4 : ebad7740 r3 : ee708040 r2 : ed61dca8 r1 : 001ebd24 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 10c5387d Table: ad61006a DAC: 00000015 [] (cpufreq_governor_dbs+0x400/0x634) from [] (__cpufreq_governor+0x98/0x1b4) [] (__cpufreq_governor+0x98/0x1b4) from [] (__cpufreq_set_policy+0x250/0x320) [] (__cpufreq_set_policy+0x250/0x320) from [] (cpufreq_update_policy+0xcc/0x168) [] (cpufreq_update_policy+0xcc/0x168) from [] (cpu_freq_notify+0x68/0xdc) [] (cpu_freq_notify+0x68/0xdc) from [] (notifier_call_chain+0x4c/0x8c) [] (notifier_call_chain+0x4c/0x8c) from [] (__blocking_notifier_call_chain+0x50/0x68) [] (__blocking_notifier_call_chain+0x50/0x68) from [] (blocking_notifier_call_chain+0x20/0x28) [] (blocking_notifier_call_chain+0x20/0x28) from [] (pm_qos_update_bounded_target+0xd8/0x310) [] (pm_qos_update_bounded_target+0xd8/0x310) from [] (__pm_qos_update_request+0x64/0x70) [] (__pm_qos_update_request+0x64/0x70) from [] (tegra_pm_notify+0x114/0x134) [] (tegra_pm_notify+0x114/0x134) from [] (notifier_call_chain+0x4c/0x8c) [] (notifier_call_chain+0x4c/0x8c) from [] (__blocking_notifier_call_chain+0x50/0x68) [] (__blocking_notifier_call_chain+0x50/0x68) from [] (blocking_notifier_call_chain+0x20/0x28) [] (blocking_notifier_call_chain+0x20/0x28) from [] (pm_notifier_call_chain+0x1c/0x34) [] (pm_notifier_call_chain+0x1c/0x34) from [] (enter_state+0xec/0x128) [] (enter_state+0xec/0x128) from [] (pm_suspend+0x38/0xa4) [] (pm_suspend+0x38/0xa4) from [] (state_store+0x70/0xc0) [] (state_store+0x70/0xc0) from [] (kobj_attr_store+0x14/0x20) [] (kobj_attr_store+0x14/0x20) from [] (sysfs_write_file+0x104/0x184) [] (sysfs_write_file+0x104/0x184) from [] (vfs_write+0xd0/0x19c) [] (vfs_write+0xd0/0x19c) from [] (SyS_write+0x4c/0x78) [] (SyS_write+0x4c/0x78) from [] (ret_fast_syscall+0x0/0x30) Code: e1a00006 eb084346 e59b0020 e5951024 (e5903028) ---[ end trace 0488523c8f6b0f9d ]--- Signed-off-by: Bibek Basu Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki Signed-off-by: Jiri Slaby commit ae87686e2c356aba851817e804bd4fc4023b6468 Author: Rabin Vincent Date: Sat May 24 17:38:01 2014 +0100 ARM: 8064/1: fix v7-M signal return commit 483a6c9d447f625b991fa04a1530493d893984db upstream. According to the ARM ARM, the behaviour is UNPREDICTABLE if the PC read from the exception return stack is not half word aligned. See the pseudo code for ExceptionReturn() and PopStack(). The signal handler's address has the bit 0 set, and setup_return() directly writes this to regs->ARM_pc. Current hardware happens to discard this bit, but QEMU's emulation doesn't and this makes processes crash. Mask out bit 0 before the exception return in order to get predictable behaviour. Fixes: 19c4d593f0b4 ("ARM: ARMv7-M: Add support for exception handling") Acked-by: Uwe Kleine-König Signed-off-by: Rabin Vincent Signed-off-by: Russell King Signed-off-by: Jiri Slaby commit add232a1a6031431736e0c774cb8e1e7fe89db60 Author: Andrey Ryabinin Date: Wed May 7 08:07:25 2014 +0100 ARM: 8051/1: put_user: fix possible data corruption in put_user commit 537094b64b229bf3ad146042f83e74cf6abe59df upstream. According to arm procedure call standart r2 register is call-cloberred. So after the result of x expression was put into r2 any following function call in p may overwrite r2. To fix this, the result of p expression must be saved to the temporary variable before the assigment x expression to __r2. Signed-off-by: Andrey Ryabinin Reviewed-by: Nicolas Pitre Signed-off-by: Russell King Signed-off-by: Jiri Slaby commit 7e84ef36ae2501e1155e9011ead7e59aadd0910d Author: Laurent Pinchart Date: Mon Apr 21 15:06:23 2014 +0200 ARM: OMAP3: clock: Back-propagate rate change from cam_mclk to dpll4_m5 on all OMAP3 platforms commit 98d7e1aee6dd534f468993f8c6a1bc730d4cfa81 upstream. Commit 7b2e1277598e4187c9be3e61fd9b0f0423f97986 ("ARM: OMAP3: clock: Back-propagate rate change from cam_mclk to dpll4_m5") enabled clock rate back-propagation from cam_mclk do dpll4_m5 on OMAP3630 only. Perform back-propagation on other OMAP3 platforms as well. Reported-by: Jean-Philippe François Signed-off-by: Laurent Pinchart Signed-off-by: Paul Walmsley Signed-off-by: Jiri Slaby commit d0c827e617439816bab3a434835be8a68b66a570 Author: Peter Ujfalusi Date: Fri May 9 11:10:05 2014 +0300 ARM: omap5: hwmod_data: Correct IDLEMODE for McPDM commit 0f9e19ad88eee820f517b85531b555a0fa73e7e4 upstream. McPDM need to be configured to NO_IDLE mode when it is in used otherwise vital clocks will be gated which results 'slow motion' audio playback. Signed-off-by: Peter Ujfalusi Signed-off-by: Paul Walmsley Signed-off-by: Jiri Slaby commit 93a5cb6cf809599758d596e16b659f5944ee9652 Author: Emil Goode Date: Mon May 19 15:07:54 2014 +0800 ARM: imx: fix error handling in ipu device registration commit d1d70e5dc2cfa9047bb935c41ba808ebb8135696 upstream. If we fail to allocate struct platform_device pdev we dereference it after the goto label err. This bug was found using coccinelle. Fixes: afa77ef (ARM: mx3: dynamically allocate "ipu-core" devices) Signed-off-by: Emil Goode Acked-by: Uwe Kleine-König Signed-off-by: Shawn Guo Signed-off-by: Olof Johansson Signed-off-by: Jiri Slaby commit 517e5981c10ff3fe845ace3c2d7e664da72eafdf Author: Joe Lawrence Date: Thu May 22 17:30:54 2014 -0400 SCSI: scsi_transport_sas: move bsg destructor into sas_rphy_remove commit 6aa6caff30f5dcb9e55b03b9710c30b83750cae5 upstream. The recent change in sysfs, bcdde7e221a8750f9b62b6d0bd31b72ea4ad9309 "sysfs: make __sysfs_remove_dir() recursive" revealed an asymmetric rphy device creation/deletion sequence in scsi_transport_sas: modprobe mpt2sas sas_rphy_add device_add A rphy->dev device_add B sas_device transport class device_add C sas_end_device transport class device_add D bsg class rmmod mpt2sas sas_rphy_delete sas_rphy_remove device_del B device_del C device_del A sysfs_remove_group recursive sysfs dir removal sas_rphy_free device_del D warning where device A is the parent of B, C, and D. When sas_rphy_free tries to unregister the bsg request queue (device D above), the ensuing sysfs cleanup discovers that its sysfs group has already been removed and emits a warning, "sysfs group... not found for kobject 'end_device-X:0'". Since bsg creation is a side effect of sas_rphy_add, move its complementary removal call into sas_rphy_remove. This imposes the following tear-down order for the devices above: D, B, C, A. Note the sas_device and sas_end_device transport class devices (B and C above) are created and destroyed both via the list match traversal in attribute_container_device_trigger, so the order in which they are handled is fixed. This is fine as long as they are deleted before their parent device. Signed-off-by: Joe Lawrence Acked-by: Dan Williams Signed-off-by: James Bottomley Signed-off-by: Jiri Slaby commit 7d683054e1c985904faf7b9faa027f239bb9cdcb Author: Alex Deucher Date: Thu May 8 20:04:03 2014 -0400 drm/radeon: handle non-VGA class pci devices with ATRM commit d8ade3526b2aa0505132c404c05a38b73ea15490 upstream. Newer PX systems have non-VGA pci class dGPUs. Update the ATRM fetch method to handle those cases. bug: https://bugzilla.kernel.org/show_bug.cgi?id=75401 Signed-off-by: Alex Deucher Signed-off-by: Christian König Signed-off-by: Jiri Slaby commit bac59d1b797d8b80eb8a38d609f89666bf9f0179 Author: Christian König Date: Mon May 5 18:40:12 2014 +0200 drm/radeon: also try GART for CPU accessed buffers commit 544092596e8ac269f70e70961b5e9381909c9b1e upstream. Placing them exclusively into VRAM might not work all the time. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=78297 Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Jiri Slaby commit afb44e1758741b45be382544527b6edf99fd2f6f Author: Ben Skeggs Date: Tue May 20 16:13:54 2014 +1000 drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setup commit 0f1d360b2ee3a2a0f510d3f1bcd3f5ebe5d41265 upstream. Fixes a LVDS bleed issue on Lenovo W530 that can occur under a number of circumstances. Signed-off-by: Ben Skeggs Signed-off-by: Jiri Slaby commit 1b2b80af293d868bdb762fa896d5b851248ba566 Author: Jean Delvare Date: Sun May 25 17:23:08 2014 +0200 hwmon: (ntc_thermistor) Fix OF device ID mapping commit ead82d6792ef5c600d535bca6ec50a4da14ff7c7 upstream. The mapping from OF device IDs to platform device IDs is wrong. TYPE_NCPXXWB473 is 0, TYPE_NCPXXWL333 is 1, so ntc_thermistor_id[TYPE_NCPXXWB473] is { "ncp15wb473", TYPE_NCPXXWB473 } while ntc_thermistor_id[TYPE_NCPXXWL333] is { "ncp18wb473", TYPE_NCPXXWB473 }. So the name is wrong for all but the "ntc,ncp15wb473" entry, and the type is wrong for the "ntc,ncp15wl333" entry. So map the entries by index, it is neither elegant nor robust but at least it is correct. Signed-off-by: Jean Delvare Fixes: 9e8269de hwmon: (ntc_thermistor) Add DT with IIO support to NTC thermistor driver Reviewed-by: Guenter Roeck Cc: Naveen Krishna Chatradhi Cc: Doug Anderson Signed-off-by: Jiri Slaby commit f8239ad5b39162075371d9d8b445277ba40ea44b Author: Jean Delvare Date: Sun May 25 17:23:08 2014 +0200 hwmon: (ntc_thermistor) Fix dependencies commit 59cf4243e557aa64ab2ef51280454aa1f3828e14 upstream. In commit 9e8269de, support was added for ntc_thermistor devices being declared in the device tree and implemented on top of IIO. With that change, a dependency was added to the ntc_thermistor driver: depends on (!OF && !IIO) || (OF && IIO) This construct has the drawback that the driver can no longer be selected when OF is set and IIO isn't, nor when IIO is set and OF is not. This is a regression for the original users of the driver. As the new code depends on IIO and is useless without OF, include it only if both are enabled, and set the dependencies accordingly. This is clearer, more simple and more correct. Signed-off-by: Jean Delvare Fixes: 9e8269de hwmon: (ntc_thermistor) Add DT with IIO support to NTC thermistor driver Reviewed-by: Guenter Roeck Cc: Naveen Krishna Chatradhi Cc: Doug Anderson Signed-off-by: Jiri Slaby commit 4552eb241957702f9bc1309dba4d936629c5f0c7 Author: Johannes Berg Date: Thu May 22 11:54:23 2014 -0700 Documentation: fix DOCBOOKS=... building commit e60cbeedc48d80689c249ab5dcc3c31ad0452dea upstream. Prior to commit 4266129964b8 ("[media] DocBook: Move all media docbook stuff into its own directory") it was possible to build only a single (or more) book(s) by calling, for example make htmldocs DOCBOOKS=80211.xml This now fails: cp: target `.../Documentation/DocBook//media_api' is not a directory Ignore errors from that copy to make this possible again. Fixes: 4266129964b8 ("[media] DocBook: Move all media docbook stuff into its own directory") Signed-off-by: Johannes Berg Acked-by: Randy Dunlap Cc: Mauro Carvalho Chehab Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit 191df2f25cf91a4e3adeb3e230d3323e7f1b6606 Author: Naoya Horiguchi Date: Thu May 22 11:54:21 2014 -0700 mm/memory-failure.c: fix memory leak by race between poison and unpoison commit 3e030ecc0fc7de10fd0da10c1c19939872a31717 upstream. When a memory error happens on an in-use page or (free and in-use) hugepage, the victim page is isolated with its refcount set to one. When you try to unpoison it later, unpoison_memory() calls put_page() for it twice in order to bring the page back to free page pool (buddy or free hugepage list). However, if another memory error occurs on the page which we are unpoisoning, memory_failure() returns without releasing the refcount which was incremented in the same call at first, which results in memory leak and unconsistent num_poisoned_pages statistics. This patch fixes it. Signed-off-by: Naoya Horiguchi Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit c8db9ba0ae861889aaed1cad87483a966fdda818 Author: Peter Zijlstra Date: Fri May 2 16:56:01 2014 +0200 perf: Fix race in removing an event commit 46ce0fe97a6be7532ce6126bb26ce89fed81528c upstream. When removing a (sibling) event we do: raw_spin_lock_irq(&ctx->lock); perf_group_detach(event); raw_spin_unlock_irq(&ctx->lock); perf_remove_from_context(event); raw_spin_lock_irq(&ctx->lock); ... raw_spin_unlock_irq(&ctx->lock); Now, assuming the event is a sibling, it will be 'unreachable' for things like ctx_sched_out() because that iterates the groups->siblings, and we just unhooked the sibling. So, if during we get ctx_sched_out(), it will miss the event and not call event_sched_out() on it, leaving it programmed on the PMU. The subsequent perf_remove_from_context() call will find the ctx is inactive and only call list_del_event() to remove the event from all other lists. Hereafter we can proceed to free the event; while still programmed! Close this hole by moving perf_group_detach() inside the same ctx->lock region(s) perf_remove_from_context() has. The condition on inherited events only in __perf_event_exit_task() is likely complete crap because non-inherited events are part of groups too and we're tearing down just the same. But leave that for another patch. Most-likely-Fixes: e03a9a55b4e ("perf: Change close() semantics for group events") Reported-by: Vince Weaver Tested-by: Vince Weaver Much-staring-at-traces-by: Vince Weaver Much-staring-at-traces-by: Thomas Gleixner Cc: Arnaldo Carvalho de Melo Cc: Linus Torvalds Signed-off-by: Peter Zijlstra Link: http://lkml.kernel.org/r/20140505093124.GN17778@laptop.programming.kicks-ass.net Signed-off-by: Ingo Molnar Signed-off-by: Jiri Slaby commit ed8acba3f62f4cb479628215582b487872c398d7 Author: Peter Zijlstra Date: Thu May 15 20:23:48 2014 +0200 perf: Limit perf_event_attr::sample_period to 63 bits commit 0819b2e30ccb93edf04876237b6205eef84ec8d2 upstream. Vince reported that using a large sample_period (one with bit 63 set) results in wreckage since while the sample_period is fundamentally unsigned (negative periods don't make sense) the way we implement things very much rely on signed logic. So limit sample_period to 63 bits to avoid tripping over this. Reported-by: Vince Weaver Signed-off-by: Peter Zijlstra Link: http://lkml.kernel.org/n/tip-p25fhunibl4y3qi0zuqmyf4b@git.kernel.org Signed-off-by: Thomas Gleixner Signed-off-by: Jiri Slaby commit e36e8c8f72bc4f8309bf0dea92d58aa661c74c84 Author: Jiri Olsa Date: Mon Apr 7 11:04:08 2014 +0200 perf: Prevent false warning in perf_swevent_add commit 39af6b1678afa5880dda7e375cf3f9d395087f6d upstream. The perf cpu offline callback takes down all cpu context events and releases swhash->swevent_hlist. This could race with task context software event being just scheduled on this cpu via perf_swevent_add while cpu hotplug code already cleaned up event's data. The race happens in the gap between the cpu notifier code and the cpu being actually taken down. Note that only cpu ctx events are terminated in the perf cpu hotplug code. It's easily reproduced with: $ perf record -e faults perf bench sched pipe while putting one of the cpus offline: # echo 0 > /sys/devices/system/cpu/cpu1/online Console emits following warning: WARNING: CPU: 1 PID: 2845 at kernel/events/core.c:5672 perf_swevent_add+0x18d/0x1a0() Modules linked in: CPU: 1 PID: 2845 Comm: sched-pipe Tainted: G W 3.14.0+ #256 Hardware name: Intel Corporation Montevina platform/To be filled by O.E.M., BIOS AMVACRB1.86C.0066.B00.0805070703 05/07/2008 0000000000000009 ffff880077233ab8 ffffffff81665a23 0000000000200005 0000000000000000 ffff880077233af8 ffffffff8104732c 0000000000000046 ffff88007467c800 0000000000000002 ffff88007a9cf2a0 0000000000000001 Call Trace: [] dump_stack+0x4f/0x7c [] warn_slowpath_common+0x8c/0xc0 [] warn_slowpath_null+0x1a/0x20 [] perf_swevent_add+0x18d/0x1a0 [] event_sched_in.isra.75+0x9e/0x1f0 [] group_sched_in+0x6a/0x1f0 [] ? sched_clock_local+0x25/0xa0 [] ctx_sched_in+0x1f6/0x450 [] perf_event_sched_in+0x6b/0xa0 [] perf_event_context_sched_in+0x7b/0xc0 [] __perf_event_task_sched_in+0x43e/0x460 [] ? put_lock_stats.isra.18+0xe/0x30 [] finish_task_switch+0xb8/0x100 [] __schedule+0x30e/0xad0 [] ? pipe_read+0x3e2/0x560 [] ? preempt_schedule_irq+0x3e/0x70 [] ? preempt_schedule_irq+0x3e/0x70 [] preempt_schedule_irq+0x44/0x70 [] retint_kernel+0x20/0x30 [] ? lockdep_sys_exit+0x1a/0x90 [] lockdep_sys_exit_thunk+0x35/0x67 [] ? sysret_check+0x5/0x56 Fixing this by tracking the cpu hotplug state and displaying the WARN only if current cpu is initialized properly. Cc: Corey Ashford Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Reported-by: Fengguang Wu Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra Link: http://lkml.kernel.org/r/1396861448-10097-1-git-send-email-jolsa@redhat.com Signed-off-by: Thomas Gleixner Signed-off-by: Jiri Slaby commit 3cca5deb318f36b8dbba60515f46e1927ac7488c Author: Thomas Gleixner Date: Fri May 2 23:26:24 2014 +0200 sched: Sanitize irq accounting madness commit 2d513868e2a33e1d5315490ef4c861ee65babd65 upstream. Russell reported, that irqtime_account_idle_ticks() takes ages due to: for (i = 0; i < ticks; i++) irqtime_account_process_tick(current, 0, rq); It's sad, that this code was written way _AFTER_ the NOHZ idle functionality was available. I charge myself guitly for not paying attention when that crap got merged with commit abb74cefa ("sched: Export ns irqtimes through /proc/stat") So instead of looping nr_ticks times just apply the whole thing at once. As a side note: The whole cputime_t vs. u64 business in that context wants to be cleaned up as well. There is no point in having all these back and forth conversions. Lets standardise on u64 nsec for all kernel internal accounting and be done with it. Everything else does not make sense at all for fine grained accounting. Frederic, can you please take care of that? Reported-by: Russell King Signed-off-by: Thomas Gleixner Reviewed-by: Paul E. McKenney Signed-off-by: Peter Zijlstra Cc: Venkatesh Pallipadi Cc: Shaun Ruffell Link: http://lkml.kernel.org/r/alpine.DEB.2.02.1405022307000.6261@ionos.tec.linutronix.de Signed-off-by: Ingo Molnar Signed-off-by: Jiri Slaby commit 21af1041b8943eabe04ba00e247c0bda7091a9f1 Author: Steven Rostedt (Red Hat) Date: Sun Apr 13 09:34:53 2014 -0400 sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check commit 6227cb00cc120f9a43ce8313bb0475ddabcb7d01 upstream. The check at the beginning of cpupri_find() makes sure that the task_pri variable does not exceed the cp->pri_to_cpu array length. But that length is CPUPRI_NR_PRIORITIES not MAX_RT_PRIO, where it will miss the last two priorities in that array. As task_pri is computed from convert_prio() which should never be bigger than CPUPRI_NR_PRIORITIES, if the check should cause a panic if it is hit. Reported-by: Mike Galbraith Signed-off-by: Steven Rostedt Signed-off-by: Peter Zijlstra Link: http://lkml.kernel.org/r/1397015410.5212.13.camel@marge.simpson.net Signed-off-by: Ingo Molnar Signed-off-by: Jiri Slaby commit 4801cb6ba3527f1cbb2078e23d3fdbe03ebcc7e7 Author: David Woodhouse Date: Mon Jun 9 14:09:53 2014 +0100 iommu/vt-d: Fix missing IOTLB flush in intel_iommu_unmap() This is a small excerpt of the upstream commit ea8ea460c9ace60bbb5ac6e5521d637d5c15293d (iommu/vt-d: Clean up and fix page table clear/free behaviour). This missing IOTLB flush was added as a minor, inconsequential bug-fix in commit ea8ea460c ("iommu/vt-d: Clean up and fix page table clear/free behaviour") in 3.15. It wasn't originally intended for -stable but a couple of users have reported issues which turn out to be fixed by adding the missing flush. Signed-off-by: David Woodhouse Signed-off-by: Jiri Slaby commit 22259d1fa4111413d7969bae6ad425fbc7fcf3e1 Author: Will Deacon Date: Tue Feb 11 18:08:41 2014 +0000 ARM: perf: hook up perf_sample_event_took around pmu irq handling commit 5f5092e72cc25a6a5785308270e0085b2b2772cc upstream. Since we indirect all of our PMU IRQ handling through a dispatcher, it's trivial to hook up perf_sample_event_took to prevent applications such as oprofile from generating interrupt storms due to an unrealisticly low sample period. Reported-by: Robert Richter Signed-off-by: Will Deacon Signed-off-by: Jiri Slaby commit 4ce1386883095638c80190a37677b978e9650365 Author: Vlastimil Babka Date: Tue Jun 10 11:40:11 2014 +0200 mm/compaction: make isolate_freepages start at pageblock boundary commit 49e068f0b73dd042c186ffa9b420a9943e90389a upstream. The compaction freepage scanner implementation in isolate_freepages() starts by taking the current cc->free_pfn value as the first pfn. In a for loop, it scans from this first pfn to the end of the pageblock, and then subtracts pageblock_nr_pages from the first pfn to obtain the first pfn for the next for loop iteration. This means that when cc->free_pfn starts at offset X rather than being aligned on pageblock boundary, the scanner will start at offset X in all scanned pageblock, ignoring potentially many free pages. Currently this can happen when a) zone's end pfn is not pageblock aligned, or b) through zone->compact_cached_free_pfn with CONFIG_HOLES_IN_ZONE enabled and a hole spanning the beginning of a pageblock This patch fixes the problem by aligning the initial pfn in isolate_freepages() to pageblock boundary. This also permits replacing the end-of-pageblock alignment within the for loop with a simple pageblock_nr_pages increment. Signed-off-by: Vlastimil Babka Reported-by: Heesub Shin Acked-by: Minchan Kim Cc: Mel Gorman Acked-by: Joonsoo Kim Cc: Bartlomiej Zolnierkiewicz Cc: Michal Nazarewicz Cc: Naoya Horiguchi Cc: Christoph Lameter Acked-by: Rik van Riel Cc: Dongjun Shin Cc: Sunghwan Yun Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit 316625576df236aff72dbdb2be1c374e73c769d7 Author: Vlastimil Babka Date: Tue Jun 10 11:40:10 2014 +0200 mm: compaction: detect when scanners meet in isolate_freepages commit 7ed695e069c3cbea5e1fd08f84a04536da91f584 upstream. Compaction of a zone is finished when the migrate scanner (which begins at the zone's lowest pfn) meets the free page scanner (which begins at the zone's highest pfn). This is detected in compact_zone() and in the case of direct compaction, the compact_blockskip_flush flag is set so that kswapd later resets the cached scanner pfn's, and a new compaction may again start at the zone's borders. The meeting of the scanners can happen during either scanner's activity. However, it may currently fail to be detected when it occurs in the free page scanner, due to two problems. First, isolate_freepages() keeps free_pfn at the highest block where it isolated pages from, for the purposes of not missing the pages that are returned back to allocator when migration fails. Second, failing to isolate enough free pages due to scanners meeting results in -ENOMEM being returned by migrate_pages(), which makes compact_zone() bail out immediately without calling compact_finished() that would detect scanners meeting. This failure to detect scanners meeting might result in repeated attempts at compaction of a zone that keep starting from the cached pfn's close to the meeting point, and quickly failing through the -ENOMEM path, without the cached pfns being reset, over and over. This has been observed (through additional tracepoints) in the third phase of the mmtests stress-highalloc benchmark, where the allocator runs on an otherwise idle system. The problem was observed in the DMA32 zone, which was used as a fallback to the preferred Normal zone, but on the 4GB system it was actually the largest zone. The problem is even amplified for such fallback zone - the deferred compaction logic, which could (after being fixed by a previous patch) reset the cached scanner pfn's, is only applied to the preferred zone and not for the fallbacks. The problem in the third phase of the benchmark was further amplified by commit 81c0a2bb515f ("mm: page_alloc: fair zone allocator policy") which resulted in a non-deterministic regression of the allocation success rate from ~85% to ~65%. This occurs in about half of benchmark runs, making bisection problematic. It is unlikely that the commit itself is buggy, but it should put more pressure on the DMA32 zone during phases 1 and 2, which may leave it more fragmented in phase 3 and expose the bugs that this patch fixes. The fix is to make scanners meeting in isolate_freepage() stay that way, and to check in compact_zone() for scanners meeting when migrate_pages() returns -ENOMEM. The result is that compact_finished() also detects scanners meeting and sets the compact_blockskip_flush flag to make kswapd reset the scanner pfn's. The results in stress-highalloc benchmark show that the "regression" by commit 81c0a2bb515f in phase 3 no longer occurs, and phase 1 and 2 allocation success rates are also significantly improved. Signed-off-by: Vlastimil Babka Cc: Mel Gorman Cc: Rik van Riel Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit 948ec1dbfa6a5846473649655c1fd376be286a43 Author: Vlastimil Babka Date: Tue Jun 10 11:40:09 2014 +0200 mm: compaction: reset cached scanner pfn's before reading them commit d3132e4b83e6bd383c74d716f7281d7c3136089c upstream. Compaction caches pfn's for its migrate and free scanners to avoid scanning the whole zone each time. In compact_zone(), the cached values are read to set up initial values for the scanners. There are several situations when these cached pfn's are reset to the first and last pfn of the zone, respectively. One of these situations is when a compaction has been deferred for a zone and is now being restarted during a direct compaction, which is also done in compact_zone(). However, compact_zone() currently reads the cached pfn's *before* resetting them. This means the reset doesn't affect the compaction that performs it, and with good chance also subsequent compactions, as update_pageblock_skip() is likely to be called and update the cached pfn's to those being processed. Another chance for a successful reset is when a direct compaction detects that migration and free scanners meet (which has its own problems addressed by another patch) and sets update_pageblock_skip flag which kswapd uses to do the reset because it goes to sleep. This is clearly a bug that results in non-deterministic behavior, so this patch moves the cached pfn reset to be performed *before* the values are read. Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Rik van Riel Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit 9c7e073545e0a7139d8071b7f012ea885fe69d4f Author: Nicholas Bellinger Date: Thu Jun 12 12:45:02 2014 -0700 target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd commit 0ed6e189e3f6ac3a25383ed5cc8b0ac24c9b97b7 upstream. This patch fixes a NULL pointer dereference regression bug that was introduced with: commit 1e1110c43b1cda9fe77fc4a04835e460550e6b3c Author: Mikulas Patocka Date: Sat May 17 06:49:22 2014 -0400 target: fix memory leak on XCOPY Now that target_put_sess_cmd() -> kref_put_spinlock_irqsave() is called with a valid se_cmd->cmd_kref, a NULL pointer dereference is triggered because the XCOPY passthrough commands don't have an associated se_session pointer. To address this bug, go ahead and checking for a NULL se_sess pointer within target_put_sess_cmd(), and call se_cmd->se_tfo->release_cmd() to release the XCOPY's xcopy_pt_cmd memory. Reported-by: Thomas Glanzmann Cc: Thomas Glanzmann Cc: Mikulas Patocka Cc: stable@vger.kernel.org # 3.12+ Signed-off-by: Nicholas Bellinger Signed-off-by: Jiri Slaby commit 6e8451cbf0d2e90d8cabac10b47848e3aaf8aa4e Author: Justin Maggard Date: Tue Jan 21 11:18:29 2014 -0800 btrfs: fix defrag 32-bit integer overflow commit c41570c9d29764f797fa35490d72b7395a0105c3 upstream. When defragging a very large file, the cluster variable can wrap its 32-bit signed int type and become negative, which eventually gets passed to btrfs_force_ra() as a very large unsigned long value. On 32-bit platforms, this eventually results in an Oops from the SLAB allocator. Change the cluster and max_cluster signed int variables to unsigned long to match the readahead functions. This also allows the min() comparison in btrfs_defrag_file() to work as intended. Signed-off-by: Josef Bacik Signed-off-by: Chris Mason Signed-off-by: Jiri Slaby commit 649066ce296368e2733ce1d4005f10dc673a9e8f Author: Markos Chandras Date: Wed Jan 22 14:40:00 2014 +0000 MIPS: asm: thread_info: Add _TIF_SECCOMP flag commit 137f7df8cead00688524c82360930845396b8a21 upstream. Add _TIF_SECCOMP flag to _TIF_WORK_SYSCALL_ENTRY to indicate that the system call needs to be checked against a seccomp filter. Signed-off-by: Markos Chandras Reviewed-by: Paul Burton Reviewed-by: James Hogan Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/6405/ Signed-off-by: Ralf Baechle Signed-off-by: Jiri Slaby commit d0f30eb91a4beef22aa86c89a21d2492832f33c9 Author: Denis Turischev Date: Tue May 20 14:00:42 2014 +0300 xhci: Switch only Intel Lynx Point-LP ports to EHCI on shutdown. commit 0a939993bff117d3657108ca13b011fc0378aedb upstream. Patch "xhci: Switch Intel Lynx Point ports to EHCI on shutdown." commit c09ec25d3684cad74d851c0f028a495999591279 is not fully correct It switches both Lynx Point and Lynx Point-LP ports to EHCI on shutdown. On some Lynx Point machines it causes spurious interrupt, which wake the system: bugzilla.kernel.org/show_bug.cgi?id=76291 On Lynx Point-LP on the contrary switching ports to EHCI seems to be necessary to fix these spurious interrupts. Signed-off-by: Denis Turischev Reported-by: Wulf Richartz Cc: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Signed-off-by: Jiri Slaby commit be385c37c4c5ce1226cb6dccc0b174ff1900329f Author: Jiri Kosina Date: Wed Jun 18 11:19:06 2014 +0200 floppy: do not corrupt bio.bi_flags when reading block 0 commit 6314a108ec19aefa5160535b2bfe1ca9c38efe37 upstream. Commit 41a55b4de39 ("floppy: silence warning during disk test") caused bio.bi_flags being overwritten, and its initialization to BIO_UPTODATE in bio_init() to be lost. This was unnoticed until 7b7b68bba5 ("floppy: bail out in open() if drive is not responding to block0 read"), because the error value wasn't checked for in the bio completion callback. Now we are actually looking at the error, and the loss of BIO_UPTODATE causes EIO to be wrongly passed to the callback, which confuses the FD_OPEN_SHOULD_FAIL_BIT logic. Fix this by not destroying previous value of bi_flags when setting BIO_QUIET. Signed-off-by: Jiri Kosina Signed-off-by: Jiri Slaby commit ce4a258420cd5444a32694af21bf708bd4e91d12 Author: Daniel Vetter Date: Wed Mar 26 23:42:53 2014 +0100 drm/i915: restrict vt-d stolen memory workaround to pre-gen8 commit fcc9fe1a5ad2b826c6ac58c03cdc0cf17a63c7a1 upstream. We want future generations to at least attempt to use all features, so restrict the stolen memory disabling when vt-d is enabled to the latest generation we have reports for. Which is a HSW per the original report. Also once we get a bit a hold of some of the mysterious framebuffer in stolen memory issues that still haunt bugzilla, we should probably drop this hack again and see what happens. This was introduced in commit 0f4706d2740f2a221cd502922b22e522009041d9 Author: Chris Wilson Date: Tue Mar 18 14:50:50 2014 +0200 drm/i915: Disable stolen memory when DMAR is active Cc: Chris Wilson Cc: Jani Nikula Cc: David Woodhouse References: https://bugs.freedesktop.org/show_bug.cgi?id=68535 Acked-by: Jani Nikula Signed-off-by: Daniel Vetter Signed-off-by: Jiri Slaby commit 66c90702b5e15aa1ca070dcee38164d10e366a5e Author: Igor Gnatenko Date: Fri Apr 25 19:20:15 2014 +0300 xhci: extend quirk for Renesas cards commit 6db249ebefc6bf5c39f35dfaacc046d8ad3ffd70 upstream. After suspend another Renesas PCI-X USB 3.0 card doesn't work. [root@fedora-20 ~]# lspci -vmnnd 1912: Device: 03:00.0 Class: USB controller [0c03] Vendor: Renesas Technology Corp. [1912] Device: uPD720202 USB 3.0 Host Controller [0015] SVendor: Renesas Technology Corp. [1912] SDevice: uPD720202 USB 3.0 Host Controller [0015] Rev: 02 ProgIf: 30 This patch should be applied to stable kernel 3.14 that contain the commit 1aa9578c1a9450fb21501c4f549f5b1edb557e6d "xhci: Fix resume issues on Renesas chips in Samsung laptops" Reported-and-tested-by: Anatoly Kharchenko Reference: http://redmine.russianfedora.pro/issues/1315 Signed-off-by: Igor Gnatenko Cc: stable@vger.kernel.org # 3.14 Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Signed-off-by: Jiri Slaby commit bb15aa8c7ad5a323914de79bc8cc6fa47cb34a68 Author: Larry Finger Date: Fri Apr 25 10:05:43 2014 -0500 rtlwifi: rtl8192se: Fix regression due to commit 1bf4bbb commit 5f9186990ec4579ee5b7a99b3254c29eda479f36 upstream. Beginning with kernel 3.13, this driver fails on some systems. The problem was bisected to: Commit 1bf4bbb4024dcdab5e57634dd8ae1072d42a53ac Author: Felix Fietkau Title: mac80211: send control port protocol frames to the VO queue There is noting wrong with the above commit. The regression occurs because V0 queue on RTL8192SE cards uses priority 6, not the usual 7. The fix is to modify the rtl8192se routine that sets the correct transmit queue. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=74541 Reported-by: Alex Miller Tested-by: Alex Miller Signed-off-by: Larry Finger Cc: Stable [3.13+] Signed-off-by: John W. Linville Signed-off-by: Jiri Slaby commit 55d5f044a1fc96a74e4470e318c0a24f27a9ab7e Author: Helmut Schaa Date: Wed Mar 12 10:37:55 2014 +0100 ath9k: Fix sequence number assignment for non-data frames commit 5998be879719384af2014b79697eed6e38ee2706 upstream. Since commit 558ff225de80ac95b132d3a115ddadcd64498b4f (ath9k: fix ps-poll responses under a-mpdu sessions) non-data frames would have gotten a sequence number from a TIDs sequence counter instead of using the global sequence counter. This can lead to instable connections. To fix this only select the correct TID if we are processing a data frame. Furthermore, prevent non-data frames to get a sequence number from a TID sequence counter by adding a check to ath_tx_setup_buffer. Cc: Felix Fietkau Signed-off-by: Helmut Schaa Acked-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Jiri Slaby