Commit graph

506917 commits

Author SHA1 Message Date
David S. Miller
08c852c43a Merge branch 'xen-netback'
David Vrabel says:

====================
xen-netback: fix ethtool stats and memory leak

A couple of bug fixes for netback:
- make ethool stats to report the correct values.
- don't leak 1 MiB every time a VIF is destroyed.

Changes in v2:
- Split 2nd patch into leak fix and refactor patches
====================

Acked-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-03-05 14:59:32 -05:00
David Vrabel
b0c21badf1 xen-netback: refactor xenvif_handle_frag_list()
When handling a from-guest frag list, xenvif_handle_frag_list()
replaces the frags before calling the destructor to clean up the
original (foreign) frags.  Whilst this is safe (the destructor doesn't
actually use the frags), it looks odd.

Reorder the function to be less confusing.

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-03-05 14:58:18 -05:00
David Vrabel
49d9991a18 xen-netback: unref frags when handling a from-guest skb with a frag list
Every time a VIF is destroyed up to 256 pages may be leaked if packets
with more than MAX_SKB_FRAGS frags were transmitted from the guest.
Even worse, if another user of ballooned pages allocated one of these
ballooned pages it would not handle the unexpectedly >1 page count
(e.g., gntdev would deadlock when unmapping a grant because the page
count would never reach 1).

When handling a from-guest skb with a frag list, unref the frags
before releasing them so they are freed correctly when the VIF is
destroyed.

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-03-05 14:58:17 -05:00
David Vrabel
d63951d744 xen-netback: return correct ethtool stats
Use correct pointer arithmetic to get the pointer to each stat.

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-03-05 14:58:17 -05:00
Ingo Molnar
e678fefa07 perf/urgent fix:
- Fix SEGFAULT when freeing unparsed lock prefixed instructions in 'perf
   annotate' (Arnaldo Carvalho de Melo)
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJU+KfeAAoJEBpxZoYYoA71dd4IAKoMogzWi1+8WG1EToXP7kRR
 XuAneJ110ssv86ut2UmZinHiOWud1sue2mRpN6P9x2TJHBQRmfvMUydJKmdXR1Je
 4yoUWacLbCj4D+gBAlLh2bR+RMZK4TVpQt9TZSYzuaOzDkfWhnTpHAxYw3+m+X/v
 AC9XbRo1F6rg2OP64ukyWw0wgph308Fqgz5PJRKFUe00DAxAxT3vBaFc2yrgOuJZ
 tFRUgEPb6gaFMlZGdZr3rfS4MPKF8uva4Nuj/+pUsBmE12vJspSb53MxbNrbU/oU
 2QCbx+KIOe/rpd29kYQjuTr2lm3YCHyF6ePZYAoG3qF+rO9bqjPdEisYGBTW3BU=
 =zHDD
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent

Pull perf/urgent fix from Arnaldo Carvalho de Melo:

 " - Fix SEGFAULT when freeing unparsed lock prefixed instructions in 'perf
     annotate' (Arnaldo Carvalho de Melo)"

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-03-05 20:32:43 +01:00
Linus Torvalds
99aedde086 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
 "Misc fixes: EFI fixes, an Intel Quark fix, an asm fix and an FPU
  handling fix"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/fpu/xsaves: Fix improper uses of __ex_table
  x86/intel/quark: Select COMMON_CLK
  x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization
  firmware: dmi_scan: Fix dmi_len type
  efi/libstub: Fix boundary checking in efi_high_alloc()
  firmware: dmi_scan: Fix dmi scan to handle "End of Table" structure
2015-03-05 11:25:23 -08:00
Arnaldo Carvalho de Melo
3995614d9b perf annotate: Fix fallback to unparsed disassembler line
When annotating source/disasm lines the perf tools parse the output of
objdump, trying to provide augmented output that allows navigating
jumps, calls, etc.

But when a line output by objdump can't be parsed the annotation code
falls back to just presenting the unparsed line.

When fixing a leak in the 0fb9f2aab7 commit ("perf annotate: Fix
memory leaks in LOCK handling") we failed to take that into account and
instead tried to free one of the data structures that should be freed
only when successfully allocated, oops, segfault.

There was a change in the way the objdump output for lock prefixed
instructions is formatted that lead the relevant parser to fail to grok
it.

At least RHEL7 works ok, but Fedora 20 segfaults.

Fix it by making the ins__delete() destructor work like the most basic
destructor: free().

Namely make it accept a NULL pointer and when handling it just do
nothing.

Further investigation is needed to figure out the nature of the objdump
output change so as to make the parser grok it.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Rabin Vincent <rabin@rab.in>
Link: http://lkml.kernel.org/n/tip-7wsy0zo292pif0yjoqpfryrz@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2015-03-05 15:27:28 -03:00
Marcelo Tosatti
bfb8fb4775 KVM: s390: Fixups for changes in merge window for 4.0
Here are some fixups/improvements for
 
 commit 658b6eda20 ("KVM: s390: add cpu model support")
 commit 9d8d578605 ("KVM: s390: use facilities and cpu_id per KVM")
 commit a374e892c3 ("KVM: s390/cpacf: Enable/disable protected key
 functions for kvm guest")
 commit 45c9b47c58 ("KVM: s390/CPACF: Choose crypto control block format")
 
 which all have been merged during the merge window for 4.0.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.14 (GNU/Linux)
 
 iQIcBAABAgAGBQJU9ucxAAoJEBF7vIC1phx8OOoP/iJhd73h4QsjjU/ZaXSNW+65
 pwgOhD3eSXdUkGNsKUMp9nsyDo89puSZdUo9+5hvtbal5P89BpLx2VQxryZY0SAU
 21D/AjaaxJ6YcL5mfT6lyp1W5jznOobZLl8wSHoIAWyKrmqv0hLG1M/Ip5TxmdE0
 7rSeABHJyQNcTnOLL9Iq/uut8Qaf8ApD2rxzNfZILjlyQveS1I+l2qRAyi4MYTU0
 E3wZAOirzzNZfhbe049hvyNYd086GfOucwf1wsezvhbVJeqi2MNRf61yCGpedRdw
 2V5ce6LefMSx+sdqBOoKCYziO/vnTMdQjBfsm9315fTMHlGVBY0PgPWLQFVe77pI
 2enB20/T4hTJ203Nwaa0jBkQ2IyunSrE1rP6M+E7g90ZgiXrR9TsURAfl+u5EzE4
 QZe7BcQRJ+Wrj1lrM7W67Mr+hzIlRvWeEJjKsHa/q8BPD4mbQRacPN2OKW2zcbrx
 Ye4Vr0Fanom5nyZqPDbMl5dWlN0xuboFksSMkdaR7KDp5fb4WMITOl0WeOZPRAn9
 16TTO6Mr19I3uCCuJFhZaI1HPyUQPJja2JZqB/HUcribTcp+GGPt8od0Yxvd07kP
 B4T5OlpiYbOIimIIkukGvbdNIBOcfvyiInq3offrE1S/q4PWo3uWf2HyeQE+/G8V
 d9gCVWo+st4Sj5UVRCm0
 =ZaGi
 -----END PGP SIGNATURE-----

Merge tag 'kvm-s390-master-20150303' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux

KVM: s390: Fixups for changes in merge window for 4.0

Here are some fixups/improvements for

commit 658b6eda20 ("KVM: s390: add cpu model support")
commit 9d8d578605 ("KVM: s390: use facilities and cpu_id per KVM")
commit a374e892c3 ("KVM: s390/cpacf: Enable/disable protected key
functions for kvm guest")
commit 45c9b47c58 ("KVM: s390/CPACF: Choose crypto control block format")

which all have been merged during the merge window for 4.0.
2015-03-05 14:42:48 -03:00
Quentin Casasnovas
06c8173eb9 x86/fpu/xsaves: Fix improper uses of __ex_table
Commit:

  f31a9f7c71 ("x86/xsaves: Use xsaves/xrstors to save and restore xsave area")

introduced alternative instructions for XSAVES/XRSTORS and commit:

  adb9d526e9 ("x86/xsaves: Add xsaves and xrstors support for booting time")

added support for the XSAVES/XRSTORS instructions at boot time.

Unfortunately both failed to properly protect them against faulting:

The 'xstate_fault' macro will use the closest label named '1'
backward and that ends up in the .altinstr_replacement section
rather than in .text. This means that the kernel will never find
in the __ex_table the .text address where this instruction might
fault, leading to serious problems if userspace manages to
trigger the fault.

Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Signed-off-by: Jamie Iles <jamie.iles@oracle.com>
[ Improved the changelog, fixed some whitespace noise. ]
Acked-by: Borislav Petkov <bp@alien8.de>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Cc: Allan Xavier <mr.a.xavier@gmail.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: adb9d526e9 ("x86/xsaves: Add xsaves and xrstors support for booting time")
Fixes: f31a9f7c71 ("x86/xsaves: Use xsaves/xrstors to save and restore xsave area")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-03-05 18:20:36 +01:00
Ingo Molnar
9ab2b7f3ac Merge branch 'clockevents/4.0-rc2' of http://git.linaro.org/people/daniel.lezcano/linux into timers/urgent
Pull clockevents fixes from Daniel Lezcano:

 " These two patches fix a potential crash at boot time.

   - Fix setup_irq / clockevents_config_and_register init ordering in order to
     prevent to have an interrupt to be fired before the handler is set for sun5i
     and efm32. (Yongbae Park)"

Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-03-05 17:46:31 +01:00
Robert Jarzmik
ecb9b4241f dmaengine: mmp_pdma: fix warning about slave caps
Fix the dmaengine complaint about missing slave caps :
 - declare the available bus widths
 - declare the available transfer types
 - declare the residue calculation type

Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2015-03-05 22:15:35 +05:30
Andy Shevchenko
9ab6eb51ef x86/intel/quark: Select COMMON_CLK
The commit 8bbc2a135b ("x86/intel/quark: Add Intel Quark
platform support") introduced a minimal support of Intel Quark
SoC. That allows to use core parts of the SoC. However, the SPI,
I2C, and GPIO drivers can't be selected by kernel configuration
because they depend on COMMON_CLK. The patch adds a COMMON_CLK
selection to the platfrom definition to allow user choose the drivers.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Ong, Boon Leong <boon.leong.ong@intel.com>
Cc: Bryan O'Donoghue <pure.logic@nexus-software.ie>
Cc: Darren Hart <dvhart@linux.intel.com>
Fixes: 8bbc2a135b ("x86/intel/quark: Add Intel Quark platform support")
Link: http://lkml.kernel.org/r/1425569044-2867-1-git-send-email-andriy.shevchenko@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-03-05 17:44:53 +01:00
Stanimir Varbanov
90b1047f13 dmaengine: qcom_bam_dma: fix wrong register offsets
The commit fb93f520e (dmaengine: qcom_bam_dma: Generalize BAM
register offset calculations) wrongly populated base offsets
for event registers for bam v1.4.

Signed-off-by: Stanimir Varbanov <svarbanov@mm-sol.com>
Reviewed-by: Archit Taneja <architt@codeaurora.org>
Reviewed-by: Andy Gross <agross@codeaurora.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2015-03-05 22:07:12 +05:30
Stanimir Varbanov
fe4be5e9f9 dmaengine: bam-dma: fix a warning about missing capabilities
Avoid the warning below triggered during dmaengine async device
registration.

WARNING: CPU: 1 PID: 1 at linux/drivers/dma/dmaengine.c:863
dma_async_device_register+0x2a8/0x4b8()
this driver doesn't support generic slave capabilities reporting

To do that fill mandatory .directions bit mask,
.src/dst_addr_widths and .residue_granularity dma_device fields
with appropriate values.

Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2015-03-05 21:44:38 +05:30
Greg Kroah-Hartman
d3d5389475 USB-serial fixes for v4.0-rc3
Here are a few fixes for reported problems including a usb-debug device
 buffer overflow, potential use-after-free on failed probe, and a couple
 of issues with the USB console.
 
 Some new device IDs are also added.
 
 Signed-off-by: Johan Hovold <johan@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJU+Fy4AAoJEEEN5E/e4bSVxSIQAM/ekC0n6/v2BqF+RJ+1YmGs
 pELjhVxgiUJ+TqgncxhFkbSVVKhBJ7JN8qOj2wV9r55WX8OgoGVoqFopz+PHeHWC
 2JvPYkGi0UhCxCLto/XFnS8KYT+ODCqDF3E9CJKZEl6X3TGmQJ0Lyka953vYRWO3
 0g3DwHGVdAHCH1ZZFJB4R/45i6ACLWd5A7zlyfvjrDYWfTgfONIFbaOjNATJFjre
 3FyUXM2TP/AZNAcPYt8IUrbrUIriKptmQJk0F2gZEyLvYwlmJvtutpMLUL+Xs0Hx
 rbQVsQfKt7Plo2nkUkJ+1B/Q15+0aTyA5dqdXeYG77R6O5Y9v1c6fpc5Jr+fIPI/
 jMP9LBeAUqQpKsLvtN4LG93a19r+0lJfdZtNTComLmSvQXYIiqRPNBlLmrBUN+Tq
 KG7TYHCoDsxw6jgMRPNLGn3lMEHxWej1lhI3UYSAXks1qixHLm+5+hVcqbKqMeaQ
 2gX/xEHIFgaHNvfl9Hr1ke2vMxHB/tSt7DcrQVgBsBQgEP6PgvG+fQajoIZ7YQJC
 K+ElAwUiGeYq2Kqp8ljqVd+q1LyQo0w9B3eJSG5URnmLkxzQ4PPVf2tnVxy+xq3q
 N10cp/6vKLFATF4+Gu2dMGuSbK5LsNvOAGpjr6VDAqb2wAFmaT+MaQKQlgo/6TQH
 L/Cj0mx7uyGwhtPBZES6
 =0CrX
 -----END PGP SIGNATURE-----

Merge tag 'usb-serial-4.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

Johan writes:

USB-serial fixes for v4.0-rc3

Here are a few fixes for reported problems including a usb-debug device
buffer overflow, potential use-after-free on failed probe, and a couple
of issues with the USB console.

Some new device IDs are also added.

Signed-off-by: Johan Hovold <johan@kernel.org>
2015-03-05 07:15:17 -08:00
Yongbae Park
1096be084a clockevents: sun5i: Fix setup_irq init sequence
The interrupt is enabled before the handler is set. Even this bug
did not appear, it is potentially dangerous as it can lead to a
NULL pointer dereference.

Fix the error by enabling the interrupt after
clockevents_config_and_register() is called.

Cc: stable@vger.kernel.org
Signed-off-by: Yongbae Park <yongbae2@gmail.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
2015-03-05 15:01:37 +01:00
Yongbae Park
7b8f10da3b clocksource: efm32: Fix a NULL pointer dereference
The initialisation of the efm32 clocksource first sets up the irq and only
after that initialises the data needed for irq handling. In case this
initialisation is delayed the irq handler would dereference a NULL pointer.

I'm not aware of anything that could delay the process in such a way, but it's
better to be safe than sorry, so setup the irq only when the clock event device
is ready.

Cc: stable@vger.kernel.org
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Yongbae Park <yongbae2@gmail.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
2015-03-05 15:01:36 +01:00
Tejun Heo
8603e1b300 workqueue: fix hang involving racing cancel[_delayed]_work_sync()'s for PREEMPT_NONE
cancel[_delayed]_work_sync() are implemented using
__cancel_work_timer() which grabs the PENDING bit using
try_to_grab_pending() and then flushes the work item with PENDING set
to prevent the on-going execution of the work item from requeueing
itself.

try_to_grab_pending() can always grab PENDING bit without blocking
except when someone else is doing the above flushing during
cancelation.  In that case, try_to_grab_pending() returns -ENOENT.  In
this case, __cancel_work_timer() currently invokes flush_work().  The
assumption is that the completion of the work item is what the other
canceling task would be waiting for too and thus waiting for the same
condition and retrying should allow forward progress without excessive
busy looping

Unfortunately, this doesn't work if preemption is disabled or the
latter task has real time priority.  Let's say task A just got woken
up from flush_work() by the completion of the target work item.  If,
before task A starts executing, task B gets scheduled and invokes
__cancel_work_timer() on the same work item, its try_to_grab_pending()
will return -ENOENT as the work item is still being canceled by task A
and flush_work() will also immediately return false as the work item
is no longer executing.  This puts task B in a busy loop possibly
preventing task A from executing and clearing the canceling state on
the work item leading to a hang.

task A			task B			worker

						executing work
__cancel_work_timer()
  try_to_grab_pending()
  set work CANCELING
  flush_work()
    block for work completion
						completion, wakes up A
			__cancel_work_timer()
			while (forever) {
			  try_to_grab_pending()
			    -ENOENT as work is being canceled
			  flush_work()
			    false as work is no longer executing
			}

This patch removes the possible hang by updating __cancel_work_timer()
to explicitly wait for clearing of CANCELING rather than invoking
flush_work() after try_to_grab_pending() fails with -ENOENT.

Link: http://lkml.kernel.org/g/20150206171156.GA8942@axis.com

v3: bit_waitqueue() can't be used for work items defined in vmalloc
    area.  Switched to custom wake function which matches the target
    work item and exclusive wait and wakeup.

v2: v1 used wake_up() on bit_waitqueue() which leads to NULL deref if
    the target bit waitqueue has wait_bit_queue's on it.  Use
    DEFINE_WAIT_BIT() and __wake_up_bit() instead.  Reported by Tomeu
    Vizoso.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Rabin Vincent <rabin.vincent@axis.com>
Cc: Tomeu Vizoso <tomeu.vizoso@gmail.com>
Cc: stable@vger.kernel.org
Tested-by: Jesper Nilsson <jesper.nilsson@axis.com>
Tested-by: Rabin Vincent <rabin.vincent@axis.com>
2015-03-05 08:04:13 -05:00
Nicolin Chen
6c8ca30eec ASoC: fsl_ssi: Don't try to round-up for PM divisor calculation
According to i.MX6 Series Reference Manual, the formula to calculate
the sys clock is

sysclk rate = bclk rate * (div2 + 1) * (7 * psr + 1) * (pm + 1) * 2

Commit aafa85e71a ("ASoC: fsl_ssi: Add DAI master mode support for
SSI on i.MX series") added the divisor calculation which relies on
the clk_round_rate(). However, at that time, clk_round_rate() didn't
provide closest clock rates for some cases because it might not use
a correct rounding policy. So using the original formula (pm + 1) for
PM divisor was not able to give us a desired clock rate. And then we
used (pm + 2) to do the trick.

However, the clk-divider driver has been refined a lot since commit
b11d282dbe ("clk: divider: fix rate calculation for fractional rates")
Now using (pm + 2) trick would result an incorrect clock rate.

So this patch fixes the problem by removing the useless trick.

Reported-by: Stephane Cerveau <scerveau@voxtok.com>
Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-05 12:23:29 +00:00
Emmanuel Grumbach
4cd4b50cc2 iwlwifi: mvm: BT Coex - fix a NULL pointer exception
The commit below introduced an unsafe dereference of
mvmvif->phy_ctxt. It can be NULL even if we hold the mutex.
We can be handling a BT Coex notification while the vif has
already been unassigned. This can happen since the BT Coex
notification is hanled asynchronuously: we can have started
to handle the BT Coex notification trying to acquire the
mutex while the unassign flow already got it. The BT Coex
notification handling will wait for the mutext. I'll get it
later, but then mvmvif->phy_ctxt will be NULL.

Panic log:

BUG: unable to handle kernel NULL pointer dereference at   (null)
IP: [<f985180d>] iwl_mvm_bt_notif_iterator+0x9d/0x340 [iwlmvm]
*pdpt = 0000000000000000 *pde = f000eef300000007
Oops: 0000 [#1] SMP
Workqueue: events iwl_mvm_async_handlers_wk [iwlmvm]
task: ed719b20 ti: ec03e000 task.ti: ec03e000
EIP: 0060:[<f985180d>] EFLAGS: 00010202 CPU: 2
EIP is at iwl_mvm_bt_notif_iterator+0x9d/0x340 [iwlmvm]
EAX: 00000000 EBX: f6d3cb70 ECX: f6d3cb70 EDX: 00000000
ESI: ec03fe40 EDI: efeb8810 EBP: ec03fdf0 ESP: ec03fdac
 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 80050033 CR2: 00000000 CR3: 01a1a000 CR4: 001407f0
Stack:
 f743ca80 f744a404 ec03fdcc c10e3952 00003aba f743ca80 00000246 f743ca80
 00000246 00000000 00000001 00000000 ebd45ff6 ebd458a4 f6d3c500 ebd45578
 ebd44b01 ec03fe18 f99e1bc2 00000002 ebd44bc0 f9851770 00000000 f6d3c500
Call Trace:
 [<c10e3952>] ? ring_buffer_unlock_commit+0xa2/0xd0
 [<f99e1bc2>] __iterate_interfaces+0x82/0x110 [mac80211]
 [<f9851770>] ? iwl_mvm_bt_coex_reduced_txp+0x140/0x140 [iwlmvm]
 [<f99e1c6a>] ieee80211_iterate_active_interfaces_atomic+0x1a/0x20 [mac80211]
 [<f9851427>] iwl_mvm_bt_coex_notif_handle+0x77/0x280 [iwlmvm]
 [<f9852161>] iwl_mvm_rx_bt_coex_notif_old+0x211/0x220 [iwlmvm]
 [<f9850b8b>] iwl_mvm_rx_bt_coex_notif+0x19b/0x1b0 [iwlmvm]
 [<f983944f>] iwl_mvm_async_handlers_wk+0x7f/0xe0 [iwlmvm]

CC: <stable@vger.kernel.org> [3.19+]
Fixes: 123f515635 ("iwlwifi: mvm: BT Coex - add support for TTC / RRC")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2015-03-05 14:13:20 +02:00
Takashi Iwai
f44f07cf39 ALSA: line6: Clamp values correctly
The usages of clamp() macro in sound/usb/line6/playback.c are just
wrong, the low and high values are swapped.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-03-05 13:03:28 +01:00
Dan Carpenter
096a020a9e ALSA: msnd: add some missing curly braces
There were some curly braces intended here.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-03-05 13:02:10 +01:00
Patrice Vilchez
5957457a2d ARM: at91/pm: MOR register KEY was missing
Because writing the MOR register requires the PASSWD(0x37),
if missed, the write operation will be aborted.

Signed-off-by: Patrice Vilchez <patrice.vilchez@atmel.com>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
2015-03-05 11:43:02 +01:00
Boris BREZILLON
db68e71a0e ARM: at91/dt: sama5d4: fix lcdck clock definition
lcdck takes mck (not smd) as its parent. It is also assigned id 3 and not 4.

Signed-off-by: Boris BREZILLON <boris.brezillon@free-electrons.com>
[nicolas.ferre@atmel.com: squashed 2 related patches]
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
2015-03-05 10:58:59 +01:00
Boris BREZILLON
b6d7d3f1f3 ARM: at91/dt: sama5d4: rename lcd_clk into lcdc_clk
Rename lcd_clk into lcdc_clk to be consistent with sama5d3 clock
definitions.

Signed-off-by: Boris BREZILLON <boris.brezillon@free-electrons.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
2015-03-05 10:58:51 +01:00
Alexandre Belloni
5a5a6451ac ARM: at91: debug: fix non MMU debug
Linux may be used without MMU on atmel SoCs, fix debug in this configuration.

Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
2015-03-05 10:55:13 +01:00
Linus Walleij
40eeb111d7 Revert "pinctrl: consumer: use correct retval for placeholder functions"
This reverts commit 5a7d2efdd9.

As per discussion on the mailing list, this is not the right
thing to do. NULL cookies are valid in the stubs.

Reported-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2015-03-05 10:08:14 +01:00
Dave Jiang
9ca1c5f2ab dmaengine: ioatdma: workaround for incorrect DMACAP register
BDX-DE IOATDMA reports incorrect DMACAP register for PQ related
ops. Ignoring those bits.

Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2015-03-05 14:32:02 +05:30
Ludovic Desroches
6eb9d3c1e9 dmaengine: at_xdmac: fix for chan conf simplification
When simplificating the channel configuration, the cyclic case has been
forgotten. It leads to use bad configuration causing many bugs.

Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2015-03-05 14:29:57 +05:30
Jie Yang
94b3eed7b8 dmaengine: dw: don't handle interrupt when dmaengine is not used
When dma controller is not used by any user and set off,
we should disble interrupt handler, at least the interrupt
reset part, for some subsystem, e.g. ADSP, may use the
dma in its own logic, here reset the interrupt may make
this subsystem work abnormally.

Signed-off-by: Jie Yang <yang.jie@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2015-03-05 14:07:48 +05:30
Matthias Kaehlcke
2dc10f8963 thermal: Make sysfs attributes of cooling devices default attributes
Default attributes are created when the device is registered. Attributes
created after device registration can lead to race conditions, where user space
(e.g. udev) sees the device but not the attributes.

Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
2015-03-05 01:47:57 -04:00
Srinivas Pandruvada
d5bce86777 Thermal/int340x: Fix memleak for aux trip
When thermal zone device register fails or on module exit, the memory
for aux_trip is not freed. This change fixes this issue.

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
2015-03-05 01:41:51 -04:00
Steven Rostedt (Red Hat)
4d4eb4d4fb seq_buf: Fix seq_buf_bprintf() truncation
In seq_buf_bprintf(), bstr_printf() is used to copy the format into the
buffer remaining in the seq_buf structure. The return of bstr_printf()
is the amount of characters written to the buffer excluding the '\0',
unless the line was truncated!

If the line copied does not fit, it is truncated, and a '\0' is added
to the end of the buffer. But in this case, '\0' is included in the length
of the line written. To know if the buffer had overflowed, the return
length will be the same or greater than the length of the buffer passed in.

The check in seq_buf_bprintf() only checked if the length returned from
bstr_printf() would fit in the buffer, as the seq_buf_bprintf() is only
to be an all or nothing command. It either writes all the string into
the seq_buf, or none of it. If the string is truncated, the pointers
inside the seq_buf must be reset to what they were when the function was
called. This is not the case. On overflow, it copies only part of the string.

The fix is to change the overflow check to see if the length returned from
bstr_printf() is less than the length remaining in the seq_buf buffer, and not
if it is less than or equal to as it currently does. Then seq_buf_bprintf()
will know if the write from bstr_printf() was truncated or not.

Link: http://lkml.kernel.org/r/1425500481.2712.27.camel@perches.com

Cc: stable@vger.kernel.org
Reported-by: Joe Perches <joe@perches.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2015-03-04 23:40:19 -05:00
Arnd Bergmann
04b91701d4 ARM: fix typos in smc91x platform data
I recently did a rework of the smc91x driver and did some build-testing
by compiling hundreds of randconfig kernels. Unfortunately, my script
was wrong and did not actually test the configurations that mattered,
so I introduced stupid typos in almost every file I touched.

I fixed my script now, built all configurations that actually matter
and fixed all the typos, this is the result.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: b70661c708 ("net: smc91x: use run-time configuration on all ARM machines")
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-03-04 23:32:26 -05:00
Michael S. Tsirkin
eeb8a7e8bb virtio_console: avoid config access from irq
when multiport is off, virtio console invokes config access from irq
context, config access is blocking on s390.
Fix this up by scheduling work from config irq - similar to what we do
for multiport configs.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: stable@kernel.org
2015-03-05 13:36:18 +10:30
Michael S. Tsirkin
4f6e24ed9d virtio_console: init work unconditionally
when multiport is off, we don't initialize config work,
but we then cancel uninitialized control_work on freeze.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: stable@kernel.org
2015-03-05 13:36:17 +10:30
Maciej S. Szmigiero
90aff15b3e fsl_ssi: fix of_property_read_u32_array return value check
of_property_read_u32_array returns 0 on success,
so the return value shouldn't be inverted twice,
first on assignment then in condition expression.

Signed-off-by: Maciej Szmigiero <mail@maciej.szmigiero.name>
Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-05 01:01:12 +00:00
Lars-Peter Clausen
cdd3d2a93f ASoC: sn95031: Fix control-less DAPM routes
Routes without a control must use NULL for the control name. The sn95031
driver uses "NULL" instead in a few places. Previous to commit 5fe5b767dc
("ASoC: dapm: Do not pretend to support controls for non mixer/mux widgets")
the DAPM core silently ignored non-NULL controls on non-mixer and non-mux
routes. But starting with that commit it will complain and not add the
route breaking the sn95031 driver in the process.

This patch replaces the incorrect "NULL" control name with NULL to fix the
issue.

Fixes: 5fe5b767dc ("ASoC: dapm: Do not pretend to support controls for non mixer/mux widgets")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
2015-03-05 00:59:43 +00:00
Lars-Peter Clausen
8e6a75c102 ASoC: da732x: Fix control-less DAPM routes
Routes without a control must use NULL for the control name. The da732x
driver uses "NULL" instead in a few places. Previous to commit 5fe5b767dc
("ASoC: dapm: Do not pretend to support controls for non mixer/mux widgets")
the DAPM core silently ignored non-NULL controls on non-mixer and non-mux
routes. But starting with that commit it will complain and not add the
route breaking the da732x driver in the process.

This patch replaces the incorrect "NULL" control name with NULL to fix the
issue.

Fixes: 5fe5b767dc ("ASoC: dapm: Do not pretend to support controls for non mixer/mux widgets")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
2015-03-05 00:58:54 +00:00
Lars-Peter Clausen
ce9594c6b3 ASoC: ak4671: Fix control-less DAPM routes
Routes without a control must use NULL for the control name. The ak4671
driver uses "NULL" instead in a few places. Previous to commit 5fe5b767dc
("ASoC: dapm: Do not pretend to support controls for non mixer/mux widgets")
the DAPM core silently ignored non-NULL controls on non-mixer and non-mux
routes. But starting with that commit it will complain and not add the
route breaking the ak4671 driver in the process.

This patch replaces the incorrect "NULL" control name with NULL to fix the
issue.

Fixes: 5fe5b767dc ("ASoC: dapm: Do not pretend to support controls for non mixer/mux widgets")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
2015-03-05 00:58:11 +00:00
Andy Lutomirski
956421fbb7 x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization
'ret_from_fork' checks TIF_IA32 to determine whether 'pt_regs' and
the related state make sense for 'ret_from_sys_call'.  This is
entirely the wrong check.  TS_COMPAT would make a little more
sense, but there's really no point in keeping this optimization
at all.

This fixes a return to the wrong user CS if we came from int
0x80 in a 64-bit task.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/4710be56d76ef994ddf59087aad98c000fbab9a4.1424989793.git.luto@amacapital.net
[ Backported from tip:x86/asm. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-03-05 01:12:23 +01:00
Dave Airlie
4afb153477 Merge branch 'msm-fixes-4.0' of git://people.freedesktop.org/~robclark/linux into drm-fixes
Fixup some fallout of the fallout of atomic dpms, few mdp5 cursor
fixes, fix a leak in error path, and some fixes for kexec

* 'msm-fixes-4.0' of git://people.freedesktop.org/~robclark/linux:
  drm/msm: kexec fixes
  drm/msm/mdp5: fix cursor blending
  drm/msm/mdp5: fix cursor ROI
  drm/msm/atomic: Don't leak atomic commit object when commit fails
  drm/msm/mdp5: Avoid flushing registers when CRTC is disabled
  drm/msm: update generated headers (add 6th lm.base entry)
  drm/msm/mdp5: fixup "drm/msm: fix fallout of atomic dpms changes"
2015-03-05 09:36:27 +10:00
Rob Clark
aa80a4a519 drm/msm: kexec fixes
In kexec environment, we are more likely to encounter irq's already
enabled from previous environment.  At which point we find that writes
to disable/clear pending irq's are slightly less than useless without
first enabling clocks.

TODO: full blown state read-in so kexec'd kernel can inherit the mode
already setup.

Signed-off-by: Rob Clark <robdclark@gmail.com>
2015-03-04 18:23:41 -05:00
Rob Clark
757fdfaf41 drm/msm/mdp5: fix cursor blending
Seems like we just want BLEND_EN and not BLEND_TRANSP_EN (setting the
latter results in black pixels in the cursor image treated as
transparent).

Signed-off-by: Rob Clark <robdclark@gmail.com>
2015-03-04 18:23:40 -05:00
Rob Clark
58560890b3 drm/msm/mdp5: fix cursor ROI
If cursor is set near the edge of the screen, it is not valid to use the
new cursor width/height as the ROI dimensions.  Split out the ROI calc
and use it both cursor_set and cursor_move.

Signed-off-by: Rob Clark <robdclark@gmail.com>
2015-03-04 18:23:40 -05:00
Laurent Pinchart
5b2e2b6c5e drm/msm/atomic: Don't leak atomic commit object when commit fails
If the atomic commit fails due to completion wait interruption the
atomic commit object is not freed and is thus leaked. Free it.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2015-03-04 18:23:40 -05:00
Stephane Viau
ba0312a610 drm/msm/mdp5: Avoid flushing registers when CRTC is disabled
When a CRTC is disabled, no CTL is allocated to it (CRTC->ctl == NULL);
in that case we should not try to FLUSH registers and do nothing instead.

This can happen when we try to move a cursor but the CRTC's CTL
(CONTROL) has not been allocated yet (inactive CRTC).
It can also happens when we .atomic_check()/.atomic_flush() on a
disabled CRTC.

A CTL needs to be kept as long as the CRTC is alive. Releasing it
after the last VBlank is safer than in .atomic_flush().

Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2015-03-04 18:23:39 -05:00
Stephane Viau
8a4247d645 drm/msm: update generated headers (add 6th lm.base entry)
Some target have up to 6 layer mixers (LM).
Let the header file access the last LM's base address.

Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2015-03-04 18:23:39 -05:00
Stephane Viau
5db0f6e880 drm/msm/mdp5: fixup "drm/msm: fix fallout of atomic dpms changes"
Commit 0b776d457b ("drm/msm: fix fallout of atomic dpms
changes") has a typo in both mdp5_encoder_helper_funcs and
mdp5_crtc_helper_funcs definitions:

	.dpms entry should be replaced by .disable and .enable

Also fixed a typo in mdp5_encoder_enable().

Note that these typos are only present for MDP5. MDP4 is fine.

Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2015-03-04 18:23:38 -05:00
Dave Airlie
92eed291e9 Merge branch 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
Radeon fixes for 4.0:
- Fix some fallout from the audio rework
- Fix a possible oops in the CS ioctl
- Fix interlaced modes on DCE8
- Do a posting read in irq_set callbacks to make sure
  interrupts are properly flushed through the pci bridge

* 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: fix interlaced modes on DCE8
  drm/radeon: fix DRM_IOCTL_RADEON_CS oops
  drm/radeon: do a posting read in cik_set_irq
  drm/radeon: do a posting read in si_set_irq
  drm/radeon: do a posting read in evergreen_set_irq
  drm/radeon: do a posting read in r600_set_irq
  drm/radeon: do a posting read in rs600_set_irq
  drm/radeon: do a posting read in r100_set_irq
  radeon/audio: fix DP audio on DCE6
  radeon/audio: fix whitespace
  drm/radeon: adjust audio callback order
  drm/radeon: properly set dto for dp on DCE4/5
  drm/radeon/audio: update EDID derived fields in modeset
  drm/radeon: don't toggle audio state in modeset
  drm/radeon/audio: set mute around state setup
  drm/radeon: assign pin in detect
  drm/radeon: fix the audio dpms callbacks
2015-03-05 09:21:51 +10:00