This fixes a regression on Keystone 2 platforms caused by patch
57303488cd
"usb: dwc3: adapt dwc3 core to use Generic PHY Framework" which adds
optional support of generic phy in DWC3 core.
On Keystone 2 platforms the USB is not working now because
CONFIG_GENERIC_PHY isn't set and, as result, Generic PHY APIs stubs
return -ENOSYS always. The log shows:
dwc3 2690000.dwc3: failed to initialize core
dwc3: probe of 2690000.dwc3 failed with error -38
Hence, fix it by making NULL a valid phy reference in Generic PHY
APIs stubs in the same way as it was done by the patch
04c2facad8 "drivers: phy: Make NULL
a valid phy reference".
Acked-by: Felipe Balbi <balbi@ti.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The kernel oopses in phy_lookup() due to 'phy->init_data' being NULL if we
register PHYs from a device tree probing driver and then call phy_get() on a
device that has no representation in the device tree (e.g. a PCI device).
Checking the pointer before dereferening it and skipping an interation if
it's NULL prevents this kernel oops.
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When OMAP_CONTROL_USB was renamed to OMAP_CONTROL_PHY (commit
14da699b), its dependencies were lost in the process. Nothing in the
commit message indicates that this removal was intentional, so I think
it was by accident and the dependencies should be restored.
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Acked-by: Roger Quadros <rogerq@ti.com>
Cc: Felipe Balbi <balbi@ti.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The top-level phy-samsung-usb2 driver may be configured as a
loadable module, which currently causes link errors because
of the dependency on the exynos{5250,4x12,4210}_usb2_phy_config
symbol. Solving this could be achieved by exporting these
symbols, but as the SoC-specific parts of the driver are not
currently built as modules, it seems better to just link
everything into one module and avoid the need for the export.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Kamil Debski <k.debski@samsung.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix driver new_id sysfs-attribute removal deadlock by making sure to
not hold any locks that the attribute operations grab when removing the
attribute.
Specifically, usb_serial_deregister holds the table mutex when
deregistering the driver, which includes removing the new_id attribute.
This can lead to a deadlock as writing to new_id increments the
attribute's active count before trying to grab the same mutex in
usb_serial_probe.
The deadlock can easily be triggered by inserting a sleep in
usb_serial_deregister and writing the id of an unbound device to new_id
during module unload.
As the table mutex (in this case) is used to prevent subdriver unload
during probe, it should be sufficient to only hold the lock while
manipulating the usb-serial driver list during deregister. A racing
probe will then either fail to find a matching subdriver or fail to get
the corresponding module reference.
Since v3.15-rc1 this also triggers the following lockdep warning:
======================================================
[ INFO: possible circular locking dependency detected ]
3.15.0-rc2 #123 Tainted: G W
-------------------------------------------------------
modprobe/190 is trying to acquire lock:
(s_active#4){++++.+}, at: [<c0167aa0>] kernfs_remove_by_name_ns+0x4c/0x94
but task is already holding lock:
(table_lock){+.+.+.}, at: [<bf004d84>] usb_serial_deregister+0x3c/0x78 [usbserial]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (table_lock){+.+.+.}:
[<c0075f84>] __lock_acquire+0x1694/0x1ce4
[<c0076de8>] lock_acquire+0xb4/0x154
[<c03af3cc>] _raw_spin_lock+0x4c/0x5c
[<c02bbc24>] usb_store_new_id+0x14c/0x1ac
[<bf007eb4>] new_id_store+0x68/0x70 [usbserial]
[<c025f568>] drv_attr_store+0x30/0x3c
[<c01690e0>] sysfs_kf_write+0x5c/0x60
[<c01682c0>] kernfs_fop_write+0xd4/0x194
[<c010881c>] vfs_write+0xbc/0x198
[<c0108e4c>] SyS_write+0x4c/0xa0
[<c000f880>] ret_fast_syscall+0x0/0x48
-> #0 (s_active#4){++++.+}:
[<c03a7a28>] print_circular_bug+0x68/0x2f8
[<c0076218>] __lock_acquire+0x1928/0x1ce4
[<c0076de8>] lock_acquire+0xb4/0x154
[<c0166b70>] __kernfs_remove+0x254/0x310
[<c0167aa0>] kernfs_remove_by_name_ns+0x4c/0x94
[<c0169fb8>] remove_files.isra.1+0x48/0x84
[<c016a2fc>] sysfs_remove_group+0x58/0xac
[<c016a414>] sysfs_remove_groups+0x34/0x44
[<c02623b8>] driver_remove_groups+0x1c/0x20
[<c0260e9c>] bus_remove_driver+0x3c/0xe4
[<c026235c>] driver_unregister+0x38/0x58
[<bf007fb4>] usb_serial_bus_deregister+0x84/0x88 [usbserial]
[<bf004db4>] usb_serial_deregister+0x6c/0x78 [usbserial]
[<bf005330>] usb_serial_deregister_drivers+0x2c/0x4c [usbserial]
[<bf016618>] usb_serial_module_exit+0x14/0x1c [sierra]
[<c009d6cc>] SyS_delete_module+0x184/0x210
[<c000f880>] ret_fast_syscall+0x0/0x48
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(table_lock);
lock(s_active#4);
lock(table_lock);
lock(s_active#4);
*** DEADLOCK ***
1 lock held by modprobe/190:
#0: (table_lock){+.+.+.}, at: [<bf004d84>] usb_serial_deregister+0x3c/0x78 [usbserial]
stack backtrace:
CPU: 0 PID: 190 Comm: modprobe Tainted: G W 3.15.0-rc2 #123
[<c0015e10>] (unwind_backtrace) from [<c0013728>] (show_stack+0x20/0x24)
[<c0013728>] (show_stack) from [<c03a9a54>] (dump_stack+0x24/0x28)
[<c03a9a54>] (dump_stack) from [<c03a7cac>] (print_circular_bug+0x2ec/0x2f8)
[<c03a7cac>] (print_circular_bug) from [<c0076218>] (__lock_acquire+0x1928/0x1ce4)
[<c0076218>] (__lock_acquire) from [<c0076de8>] (lock_acquire+0xb4/0x154)
[<c0076de8>] (lock_acquire) from [<c0166b70>] (__kernfs_remove+0x254/0x310)
[<c0166b70>] (__kernfs_remove) from [<c0167aa0>] (kernfs_remove_by_name_ns+0x4c/0x94)
[<c0167aa0>] (kernfs_remove_by_name_ns) from [<c0169fb8>] (remove_files.isra.1+0x48/0x84)
[<c0169fb8>] (remove_files.isra.1) from [<c016a2fc>] (sysfs_remove_group+0x58/0xac)
[<c016a2fc>] (sysfs_remove_group) from [<c016a414>] (sysfs_remove_groups+0x34/0x44)
[<c016a414>] (sysfs_remove_groups) from [<c02623b8>] (driver_remove_groups+0x1c/0x20)
[<c02623b8>] (driver_remove_groups) from [<c0260e9c>] (bus_remove_driver+0x3c/0xe4)
[<c0260e9c>] (bus_remove_driver) from [<c026235c>] (driver_unregister+0x38/0x58)
[<c026235c>] (driver_unregister) from [<bf007fb4>] (usb_serial_bus_deregister+0x84/0x88 [usbserial])
[<bf007fb4>] (usb_serial_bus_deregister [usbserial]) from [<bf004db4>] (usb_serial_deregister+0x6c/0x78 [usbserial])
[<bf004db4>] (usb_serial_deregister [usbserial]) from [<bf005330>] (usb_serial_deregister_drivers+0x2c/0x4c [usbserial])
[<bf005330>] (usb_serial_deregister_drivers [usbserial]) from [<bf016618>] (usb_serial_module_exit+0x14/0x1c [sierra])
[<bf016618>] (usb_serial_module_exit [sierra]) from [<c009d6cc>] (SyS_delete_module+0x184/0x210)
[<c009d6cc>] (SyS_delete_module) from [<c000f880>] (ret_fast_syscall+0x0/0x48)
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
If no valid CHID value has previously been set on an HWA, writing a
value of all zeros will cause a kernel panic in uwb_radio_stop because
wusbhc->uwb_rc has not been set. This patch skips the call to
uwb_radio_stop if wusbhc->uwb_rc has not been initialized.
Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Nesting a spin_lock_irq/unlock_irq inside a lock that has already
disabled interrupts will enable interrupts before we are ready when
spin_unlock_irq is called. This patch converts the inner lock to use
spin_lock and spin_unlock instead.
Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch converts the use of spin_lock_irq/spin_unlock_irq to
spin_lock_irqsave/spin_unlock_irqrestore in uwb_rc_set_drp_cmd_done
which is called from a USB completion handler. There are also
whitespace cleanups to make checkpatch.pl happy.
Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
For internal PHY (like UTMI), the phy clock may from internal pll,
it is on/off on the fly, the access PORTSC.PTS will hang without
phy clock. So, the usb_phy_init which will open phy clock needs to
be called before hw_phymode_configure.
See: http://marc.info/?l=linux-arm-kernel&m=139350618732108&w=2
For external PHY (like ulpi), it needs to configure portsc.pts before
visit viewport, or the viewport can't be visited. so phy_phymode_configure
needs to be called before usb_phy_init.
See: cd0b42c2a6
It may not the best solution, but it can work for all situations.
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Chris Ruehl <chris.ruehl@gtsys.com.hk>
Cc: shc_work@mail.ru
Cc: denis@eukrea.com
Cc: festevam@gmail.com
Cc: stable <stable@vger.kernel.org> # 3.14
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Quite a few fixes this time since I lost v3.15-rc2
window.
Most fixes are MUSB which learned to remove its debugfs directories
properly, got a fix for PHY handling and now knows that it should
make sure its clocks aren't gated before trying to access registers.
ffs got a race fix between ffs_epfile_io() and ffs_func_eps_disable().
dwc3 got a fix for system suspend/resume and now only iterates over
valid endpoints when trying to resize TX fifos.
usb_get_phy() now will properly return an error if try_module_get() fails.
We also have a revert for a NAPI conversion on the ethernet gadget which
was causing a kernel BUG.
Signed-of-by: Felipe Balbi <balbi@ti.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJTVTiZAAoJEIaOsuA1yqREKHAP/ip+Exini4jKaVTnZkOSQkct
gc+SLRKEt2C+/VmoFJkGa3EzcCr6jNvGO4rrYUjgLti9+nON+/qjWof3AmrP9gIs
z1ZBXj4I2dOq7gILRlUdfuj5H3UAOg799mn+6DnPkjidR1PqqBlD1EoTFoGqh4Lc
bqiWout3R9aWoYjmFLYS6eXFQGeDCHdtSloVXUxYjMHsrNRIv4XL9DDGwcY2gGxc
6qskSCKP5HSCJbwS7jb4pf+J5nCuKASLTAGroSy8mV2cWxfGj+jLXegr4IdjaH0V
73UkMcufacncvhxA3GTEdjQTy6aBKGnLyZgSEIk30RvDz6C1z4J6v2lffm49bpaa
wnZ3g4AToagiXSeWUsi50Ri7oaksFnLSxCh6JYZ0CvTrbMhM3b1/R0r+hB/r5xba
xsjGIZPpp8CCx31cID/FNMP8gxBgtwCAE0WvYl5WlUl5ESXWyt6fQQAlCZLb4kny
fBgoM1IMuirQXKqNC62gSSKsSqSzZbJVK7dTc+nJFxDjRmmcgdrM1VuQyJMVY8rh
DklMYmfYTdP1JL410Ee3Z50c0SriUS3FLuDqkGd5pbKhbuGWTvoogPRY5d3pewrQ
Tq+O4GhYMlluDK9UF8BM4cbXQMu3ov2ddmm9H9ZH71fmVp8CFMdI0s5Q7BZGryh/
+9aatVH5usptuIiZrRlw
=aYvY
-----END PGP SIGNATURE-----
Merge tag 'fixes-for-v3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
Felipe writes:
usb: fixes for v3.15-rc3
Quite a few fixes this time since I lost v3.15-rc2
window.
Most fixes are MUSB which learned to remove its debugfs directories
properly, got a fix for PHY handling and now knows that it should
make sure its clocks aren't gated before trying to access registers.
ffs got a race fix between ffs_epfile_io() and ffs_func_eps_disable().
dwc3 got a fix for system suspend/resume and now only iterates over
valid endpoints when trying to resize TX fifos.
usb_get_phy() now will properly return an error if try_module_get() fails.
We also have a revert for a NAPI conversion on the ethernet gadget which
was causing a kernel BUG.
Signed-of-by: Felipe Balbi <balbi@ti.com>
A couple of things here:
- Fixes for pbias that didn't make it in during the merge window due to
the driver coming in via MMC. The conversion to use helpers is a
fix as it implements list_voltage() which the main user (MMC) relies
on for correct functioning.
- Change the !REGULATOR stub for optional regulators to return an
error rather than a dummy; this is more in keeping with the intended
use of optional regulators and fixes some issues seen MMC where it
got confused by a dummy being provided.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJTWP4ZAAoJELSic+t+oim9D54P/1iF292i/GenPCAHJo/kIV/j
uoiTcE5igqVoEeEtseqkSOy2Wsf9rukNZvQOyyioT6Pm6f+zOKW7pLPuJZmjqiHk
9FOJYfQcoiYL7HpDMIAAANl5rSHlmDZPs4T40+pHh3LJB/NTnrig5MA0tfW7tcyi
TF4PadYavvNwUYivE8NrMJs0qnuzqiXvEFIqZCxR7zm0AYqdVMkI27f4uKTRodcW
8K8VkQ7F7gDyoCiD8ptviB6v9o2WofnZfLI+9qbxexKmb6TFRrvzTkQ8UdyV9LDs
pLstzJsef7IGUDD6F/i3joKzB8Dp9Qp0+ykrffIbRfm+2Jo0xWXX+h9Ko10m1jji
zhzi/dgWp+e7SkXNaWB4hX1mD+jO6KHEg7RRF0GG4Gv6Jql6shDqNwMLHS8TH/s3
owKHdIaYHoyOx73xTJEePFbHgZTc+7YcC9NPtPe0bN2uheSMV9aHePiLoKuzx832
ee6dPIqoMU/g8zvY5CPqLqdqx1Z64MNTg52QraGsYhQ7ik9cHf0cArp5QAbMjnKI
XC7VY0Fulc0rlKkmCQ3KKxs3w+ahRgrdC+Ogne5SHQsB+5eHSGw+t3MIXWq/iiaE
XwuAQKWIy/DbkG3LgcqQGCA5RgwNWO4lJ13mENtJ4CmYDqO0qDIEdKdZ0lqnLsz+
5siSNt87fIcj5BpX2ZRm
=t/Ad
-----END PGP SIGNATURE-----
Merge tag 'regulator-v3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"A couple of things here:
- Fixes for pbias that didn't make it in during the merge window due
to the driver coming in via MMC. The conversion to use helpers is
a fix as it implements list_voltage() which the main user (MMC)
relies on for correct functioning.
- Change the !REGULATOR stub for optional regulators to return an
error rather than a dummy; this is more in keeping with the
intended use of optional regulators and fixes some issues seen MMC
where it got confused by a dummy being provided"
* tag 'regulator-v3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: core: Return error in get optional stub
regulator: pbias: Convert to use regmap helper functions
regulator: pbias: Fix is_enabled callback implementation
A few driver specific fixes here:
- SH HSPI was dealing with its clocks incorrectly which meant it didn't
work on some SoCs, fixing this also requires a small fix to one of
the SoC clock trees to avoid breaking existing users.
- The SiRF driver appears to have had several quality problems, it's
fairly new and not widely used so this isn't too worrying.
- A brute force fix for excessive locking in the Atmel driver, it needs
further investigation but this deals with the immediate issue.
- A build fix for the Blackfin driver.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJTWPNeAAoJELSic+t+oim9VOYP/1s4R3EsLg/CoO6T3jqDqizZ
0jnQgqTUi11q8+5ozLdt0zhmGOwmoTaqP3RhNqntwFyMucEWmBjrJcRlcmbfq5ve
IWAArM++RvzCgUmK2DfnQ+KxvLNbdDzO6Q+DIzUb1lia5T64Ope3JBWUG2CT5YSE
Yhi1qaktVWP57toZQmuidW+Q48d+fBxdzQ8VIfP1q2GqISwuabALjzp0I+oG5Sa1
3yd0037WmIYXUM+dKMijPQjNtB4FLJ545RR+Y5s9RXn9Pq/KpLL2aVCaPbDW36Oz
bK4zO80mS6zfurk9Yi7RiOV1uTCd/dg4G2MLTzrtP5LgdKpqthVElKbLJUv9cv0z
gZ19wFM0tGe3raxUsXUlcxAyETiNPP+pm6QriS9rgrdazIiS0gP6tvpfU8Szxv3o
EJMJEQ76ieuVA8LVLskPehNYTl5z4CiISS8SrBUdvV4P96RdyD4rGLdDJw5PDIEL
GBEpdcg48QFt6twO52xAQEzRx0T98c/C0GGYR38CbRiNFFZCh5IAr0po1iwTY3WC
vR/2YJw2Lf/+rf6Hu0cNuFd1csaTBQqh6x4JqVHdmL+xIqut2yhP3DLynK9+APR2
6oIHameZGAY1s0iDpCbeEZoTJF0uJw4+qV3xpCDnSTwiBQoD8whwJUnrFyKb1Mo2
+T5hNKls3vDpNwVPFueU
=kM6u
-----END PGP SIGNATURE-----
Merge tag 'spi-v3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A few driver specific fixes here:
- SH HSPI was dealing with its clocks incorrectly which meant it
didn't work on some SoCs, fixing this also requires a small fix to
one of the SoC clock trees to avoid breaking existing users.
- The SiRF driver appears to have had several quality problems, it's
fairly new and not widely used so this isn't too worrying.
- A brute force fix for excessive locking in the Atmel driver, it
needs further investigation but this deals with the immediate
issue.
- A build fix for the Blackfin driver"
* tag 'spi-v3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: atmel: Fix scheduling while atomic bug
spi: sh-hspi: Do not specifically request shyway_clk clock
ARM: shmobile: r8a7778: Use clks as MSTP007 parent
spi: sirf: make GPIO chipselect function work well
spi: sirf: set SPI controller in RISC IO chipselect mode
spi: sirf: correct TXFIFO empty interrupt status bit
spi: bfin5xx: fix build error
David Gibson says:
====================
Fix problems with with IFLA_VF_PORTS (v2)
I've had a customer encounter a problem with getifaddrs(3) freezing up
on a system with a Cisco enic device.
I've discovered that the problem is caused by an enic device with a
large number of SR-IOV virtual functions overflowing the normal sized
packet buffer for netlink, leading to interfaces not being reported
from an RTM_GETLINK request.
The first patch here just makes the problem easier to locate if it
occurs again in a different way, by adding a WARN_ON() when we run out
of room in a netlink packet in this manner.
The second patch actually fixes the problem, by only reporting
IFLA_VF_PORTS information when the RTEXT_FILTER_VF flag is specified.
v2: Corrected some CodingStyle problems
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Since 115c9b8192 (rtnetlink: Fix problem with
buffer allocation), RTM_NEWLINK messages only contain the IFLA_VFINFO_LIST
attribute if they were solicited by a GETLINK message containing an
IFLA_EXT_MASK attribute with the RTEXT_FILTER_VF flag.
That was done because some user programs broke when they received more data
than expected - because IFLA_VFINFO_LIST contains information for each VF
it can become large if there are many VFs.
However, the IFLA_VF_PORTS attribute, supplied for devices which implement
ndo_get_vf_port (currently the 'enic' driver only), has the same problem.
It supplies per-VF information and can therefore become large, but it is
not currently conditional on the IFLA_EXT_MASK value.
Worse, it interacts badly with the existing EXT_MASK handling. When
IFLA_EXT_MASK is not supplied, the buffer for netlink replies is fixed at
NLMSG_GOODSIZE. If the information for IFLA_VF_PORTS exceeds this, then
rtnl_fill_ifinfo() returns -EMSGSIZE on the first message in a packet.
netlink_dump() will misinterpret this as having finished the listing and
omit data for this interface and all subsequent ones. That can cause
getifaddrs(3) to enter an infinite loop.
This patch addresses the problem by only supplying IFLA_VF_PORTS when
IFLA_EXT_MASK is supplied with the RTEXT_FILTER_VF flag set.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Without IFLA_EXT_MASK specified, the information reported for a single
interface in response to RTM_GETLINK is expected to fit within a netlink
packet of NLMSG_GOODSIZE.
If it doesn't, however, things will go badly wrong, When listing all
interfaces, netlink_dump() will incorrectly treat -EMSGSIZE on the first
message in a packet as the end of the listing and omit information for
that interface and all subsequent ones. This can cause getifaddrs(3) to
enter an infinite loop.
This patch won't fix the problem, but it will WARN_ON() making it easier to
track down what's going wrong.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Jiri Pirko <jpirko@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/netfilter/nfnetlink.c: In function ‘nfnetlink_rcv’:
net/netfilter/nfnetlink.c:371:14: warning: unused variable ‘net’ [-Wunused-variable]
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric W. Biederman says:
====================
netlink: Preventing abuse when passing file descriptors.
Andy Lutomirski when looking at the networking stack noticed that it is
possible to trick privilged processes into calling write on a netlink
socket and send netlink messages they did not intend.
In particular from time to time there are suid applications that will
write to stdout or stderr without checking exactly what kind of file
descriptors those are and can be tricked into acting as a limited form
of suid cat. In other conversations the magic string CVE-2014-0181 has
been used to talk about this issue.
This patchset cleans things up a bit, adds some clean abstractions that
when used prevent this kind of problem and then finally changes all of
the handlers of netlink messages that I could find that call capable to
use netlink_ns_capable or an appropriate wrapper.
The abstraction netlink_ns_capable verifies that the original creator of
the netlink socket a message is sent from had the necessary capabilities
as well as verifying that the current sender of a netlink packet has the
necessary capabilities.
The idea is to prevent file descriptor passing of any form from
resulting in a file descriptor that can do more than it can for the
creator of the file descriptor.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
It is possible by passing a netlink socket to a more privileged
executable and then to fool that executable into writing to the socket
data that happens to be valid netlink message to do something that
privileged executable did not intend to do.
To keep this from happening replace bare capable and ns_capable calls
with netlink_capable, netlink_net_calls and netlink_ns_capable calls.
Which act the same as the previous calls except they verify that the
opener of the socket had the desired permissions as well.
Reported-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
netlink_net_capable - The common case use, for operations that are safe on a network namespace
netlink_capable - For operations that are only known to be safe for the global root
netlink_ns_capable - The general case of capable used to handle special cases
__netlink_ns_capable - Same as netlink_ns_capable except taking a netlink_skb_parms instead of
the skbuff of a netlink message.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
sk_net_capable - The common case, operations that are safe in a network namespace.
sk_capable - Operations that are not known to be safe in a network namespace
sk_ns_capable - The general case for special cases.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
The permission check in sock_diag_put_filterinfo is wrong, and it is so removed
from it's sources it is not clear why it is wrong. Move the computation
into packet_diag_dump and pass a bool of the result into sock_diag_filterinfo.
This does not yet correct the capability check but instead simply moves it to make
it clear what is going on.
Reported-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
netlink_capable is a static internal function in af_netlink.c and we
have better uses for the name netlink_capable.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This fixes a seg fault on 'ethtool -A' entry if the
interface is down. Obviously we need to have the
phy device initialized / "connected" (see of_phy_connect())
to be able to advertise pause frame capabilities.
Fixes: 23402bddf9
Signed-off-by: Claudiu Manoil <claudiu.manoil@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Shahed Shaikh says:
====================
qlcnic: Bug fixes
This patch series contains following fixes -
* Fix memory leak caused because of issuing mailbox
command which can not wait for its completion.
* Reset firmware API lock which might be in inconsistent state.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
o In case QLC_83XX_MBX_CMD_NO_WAIT command type the calling
function does not free the memory as it does not wait for
response. So free it when get a response from adapter after
sending the command.
Signed-off-by: Rajesh Borundia <rajesh.borundia@qlogic.com>
Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Some firmware versions fails to reset the lock during
initialization. Force reset firmware API lock during driver
probe to ensure lock availability.
Signed-off-by: Sony Chacko <sony.chacko@qlogic.com>
Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit 1a699476e2 "ACPI / hotplug / PCI: Hotplug notifications from
acpi_bus_notify()" changed the root notify handler, acpi_bus_notify(),
to block unknown type norifications, but it overlooked the fact that
they might be propagated to drivers via the ->notify() callback.
Fix the problem by allowing drivers to receive unknown type
notifications via ->notify() as before.
Fixes: 1a699476e2 (ACPI / hotplug / PCI: Hotplug notifications from acpi_bus_notify())
Reported-and-tested-by: Mantas Mikulėnas <grawity@gmail.com>
Reported-and-tested-by: Sitsofe Wheeler <sitsofe@yahoo.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
There are two breaks missing there. The result is that userspace
receives multiple messages which might be confusing.
Introduced-by: 3d249d4c "net: introduce ethernet teaming device"
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
I was told that the Cadence macb driver is also useful on Microblaze.
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Mark Brown <broonie@kernel.org>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Redefine some macros that were conditioned upon SMC_DEBUG level.
By allowing compiler to verify parameters used by these macros
unconditionally, we can flag compilation failures.
Compiler will still optimize out the unused code path depending on
SMC_DEBUG, so this is a net gain.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Zi Shen Lim <zlim.lnx@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pull dma-mapping fix from Marek Szyprowski:
"A small fix for dma-mapping subsystem for ARM"
* 'fixes_for_v3.15' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping:
arm: dma-mapping: Fix mapping size value
Pull libata fixes from Tejun Heo:
"Dan updated tag allocation to accomodate devices which choke when tags
jump back and forth. Quite a few ahci MSI related fixes. A couple
config dependency fixes and other misc fixes"
* 'for-3.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
libata/ahci: accommodate tag ordered controllers
ahci: Do not receive interrupts sent by dummy ports
ahci: Use pci_enable_msi_exact() instead of pci_enable_msi_range()
ahci: Ensure "MSI Revert to Single Message" mode is not enforced
ahci: do not request irq for dummy port
pata_samsung_cf: fix ata_host_activate() failure handling
pata_arasan_cf: fix ata_host_activate() failure handling
ata: fix i.MX AHCI driver dependencies
pata_at91: fix ata_host_activate() failure handling
libata: Update queued trim blacklist for M5x0 drives
libata: make AHCI_XGENE depend on PHY_XGENE
The SPC stores voltage in mV while the code assumes it was returning
uV. Convert the returned voltage to uV before storing. Also fix the
comment depicting voltage to uV.
Signed-off-by: Punit Agrawal <punit.agrawal@arm.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Pawel Moll <pawel.moll@arm.com>
The restart/power off implementation in the vexpress driver
used to obtain the config function when necessary. This was
wrong in two respects:
1. It required memory allocation with disabled interrupts
(it worked, but lockdep - when enabled - reported warnings).
2. Used jiffies-based timeout, while jiffies are not running
at this stage of system shutdown (therefore a config
transaction error - if happened - would have never be reported).
Fixed by pre-allocating the config function per device
and using mdelay for timeout.
Signed-off-by: Pawel Moll <pawel.moll@arm.com>
Signed-off-by: Rob Herring <robh@kernel.org>
[grant.likely: fixed failure when root node specifies the interrupt parent]
Signed-off-by: Grant Likely <grant.likely@linaro.org>
According to:"On-The-Go and Embedded Host Supplement to the USB Revision 2.0
Specification July 27, 2012 Revision 2.0 version 1.1a"
- add a_wait_vrise to a_wait_vfall
- update condition from a_wait_vrise to a_wait_bcon
Signed-off-by: Li Jun <b47624@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
The Tegra124 clock DT binding currently provides 3 clocks that don't
actually exist; 2 for NAND and one for UART5/UARTE. Delete these. While
this is technically an incompatible DT ABI change, nothing could have
used these clock IDs for anything practical, since the HW doesn't exist.
Cc: <stable@vger.kernel.org>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The Tegra124 clock driver currently provides 3 clocks that don't actually
exist; 2 for NAND and one for UART5/UARTE. Delete these.
Cc: <stable@vger.kernel.org>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Tegra124 only has 4 UARTs. Parts of the documentation hint at a fifth
UART, but this appears to be left-over from earlier SoC documentation.
Remove the non-existent DT node for UART5.
Cc: <stable@vger.kernel.org>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
device tree based booting. And turns out BeagleBoard xM A/B
needs it's own minimal dts in addition to the related u-boot
changes. Also few minor documentation and typo fixes are merged
to get them out of the way.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJTWAV8AAoJEBvUPslcq6Vz1+0P/3zagpaCsmh3rqr5u5jLYkS6
UXqrfjQTScQ9SK4xlwHJzCEI8oA/VvgAhk9RetT3Nd8HX4HFM2T1cCyx0s+01n0L
SrERzwVn1VxFaX4/xYSwVyt2GLdiltnCgzS2yQGjESN79aPTaKtJSbyhoah7GJQC
RB+UnE1gpBpQIpjIRSrhIWGCPH4HlLyoAgSY/u3QjBmfbm6DqCsjOx7l7tFx04gR
xQJ/EueWyQtEsmBjAQIIYJ3vZB14TI/HVAmdwsFMz4/eOcKoCtt+iGigZ0jFIP8w
6XOfJu5s0Nn2hAJ26KxoX+SXN1DJefAYmnLRsBGgCueWkOpC7v0TgeQ2b0Wr7e//
eaM5Rnv3xHWvXlv7zzNWOp3n96Mnm4WPNARCuS86Gc2PyvV3+SqK25WDy+HPSGQP
e9RkGipHG2YKX5HLcq2l2O7pfftB+ZcDEfADuR/8chasDxqSd4zVxsGOsWzWk/fG
2d9zZifnYeXDo/Tu6PqriXNPIBBD5TDHK5Df28EIvtVig5AqerApay2zBt9zXn/H
Ux6Yfw06iVCr8okk8s55CYBhYUqQfg9LEZMJLRkXAplErLvGgt46rh2DD2SU7T61
I4I40tuwRzEhCuIOlG5ztngkCpL+QnKC477sPx9KtQ4i3Rg6yKT8HZc0jSwhr0vB
sZMVDWxsRJWBxnbZyaoL
=co/l
-----END PGP SIGNATURE-----
Merge tag 'omap-for-v3.15/fixes-v2-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes
Fixes for omaps, mostly to fix some GPMC, DSS and USB issues for
device tree based booting. And turns out BeagleBoard xM A/B
needs it's own minimal dts in addition to the related u-boot
changes. Also few minor documentation and typo fixes are merged
to get them out of the way.
* tag 'omap-for-v3.15/fixes-v2-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
ARM: OMAP2+: Fix GPMC remap for devices using an offset
ARM: OMAP2+: Fix oops for GPMC free
ARM: dts: Add support for the BeagleBoard xM A/B
ARM: dts: Grammar /that will/it will/
ARM: dts: Grammar /is uses/ is used/
ARM: OMAP2+: Fix config name for USB3 PHY
ARM: dts: am335x: update USB DT references
ARM: dts: OMAP2+: remove uses of obsolete gpmc,device-nand
ARM: AM335X: EVM: fix pinmux documentation in devicetree
ARM: OMAP2+: N900: remove omapdss init for DT boot
ARM: dts: dra7xx-clocks: Correct mcasp2_ahclkx_mux bit-shift
ARM: dts: omap5: Add clocks to USB3 PHY node
ARM: OMAP2+: hwmod: fix missing braces in _init()
ARM: AM43xx: fix dpll init in bypass mode
ARM: OMAP3: hwmod data: Correct clock domains for USB modules
ARM: OMAP3: PM: remove access to PRM_VOLTCTRL register
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
- Updates the Ux500 (U8500) defconfig
- Selects PARTITION_ADVANCED for Ux500 and U300
- Configure in IIO sensor drivers for the Ux500
- Configure in the CW1200 WLAN chip for the Ux500
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJTS6ZhAAoJEEEQszewGV1zyokQAJWRYpC5T3uSDOSw/nenLwa2
5DusWzEDvz7Bip6UxVif1SIvEaPs1gHMnhSquwlDfyVPM1SygvxvsZCD4daKEGru
zsvMSRAUTaG2tKxo7QeSwErSIdg+HQtJ0rhgHyzSYUajDjQ0QQ/qGc6vIcJ8PvDj
4uMmc3F0dk7wqSgTXtnMBD/L8/YSqIuUHTAbAmA84s64jLCXicbubgqjv0XNX5IM
Hzm6RP/HVFE6tcji6dUPZNM54lRrJ0/o6Fg7G3l10JehAgSlUpR7weH+jtm01Cjc
lkdGl3buOn0ZE6mcJO7GAPlZySzhljNoL7rn8M2APr1MR5v3FLRN6mzVEoTGJBMJ
EufQlh0tAPuy6vnGroW+pzDZTSyhSXMcT38hnRW50hYRGrOH1B16n2NKLoiw/4X4
kcxOsPMK1+4RLs0+LbWzCrCJVxBzTsrzFc/z10SLfoePEZPuC0UUczx88GRR02eZ
gAyO7FtCXvNDbQCh1fv2at0/17yvP3hcNQmC5MruRCJ55HTiUlwkDBbD7GS5bWG9
pYV+bWENJy7bY4nccXP8XqzIpxqkJ1nO917PycWhvGHFJFFp0dLFbje9ejqFCjY5
kyBZGRQ8lqN7qTdESbiameazStJCSmZbH+lCDf9uFy3ram30vasmkqlSaEfFDSZA
PX32S9J2WQgrRq2W60oR
=Xe+n
-----END PGP SIGNATURE-----
Merge tag 'ux500-defconfig-for-arm-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson into fixes
This is a patch set for some ST-Ericsson devices:
- Updates the Ux500 (U8500) defconfig
- Selects PARTITION_ADVANCED for Ux500 and U300
- Configure in IIO sensor drivers for the Ux500
- Configure in the CW1200 WLAN chip for the Ux500
* tag 'ux500-defconfig-for-arm-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson:
ARM: ux500: configure for CW1200 WLAN chip
ARM: ux500: configure in sensors
ARM: u300: u300_defconfig: Enable PARTITION_ADVANCED
ARM: ux500: u8500_defconfig: Enable PARTITION_ADVANCED
ARM: ux500: update defconfig
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Correct renesas,groups in SDHI nodes of for r8a7790 (R-Car H2) based
Lager board.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
iQIcBAABAgAGBQJTS11TAAoJENfPZGlqN0++Aj8P/0pnafIdmAWgbowAKWiqMc6d
xWe41o1hOvlq7YI9CjrGWNLtSRfBB3L5ckF/tA68Ra20RS/IlzicpiMWfjbyCtlV
ZpCOHvLNyc9a6qQ73K3932Fgv0dFolyxJpx29kKNV7Qt+PKiiaBnelwQsA3a66YU
HLlBpDMkYfP+/Qz1tQ8Jy6jGLjDn+sP2Do4oXWe84zLrf1x7hZxVcMc56KOCnpNt
Uj0qHRvo5mAmL4OvdQuS4qIpL0FDBOkSetwxhdq8Bn0Fp4w3ioD/Os7axcMscVKS
2CROkfR5mWbVf2z2IXwZ89RPVYW9c/kPzlXh9ak03Y3dPGoos3NqKu4oOQqAd+IK
pQs3TO2Aqi31CC/g8jPygIKNMyyudmMhUDd2YIhDQRYZLa6Vh1DyzuDwaFL4Sv7D
1ouGzYj+yq1sUDzVSXXHS0mJEcAC0yS3DUAvT8LO8LAgiVb7h7DlcQ03eO7uc2k/
1LGAHNp3d/AW8v34oru8tVFpCFMZeHiTLIzY16B2IMggtijnuL1kLk5cLoj6KnhT
cYthsw+f0fbaxB4MDUa6bTQj3U9pL1VS+2MpIrUjiTR45IKbsSn+UMqyTzQlQttN
KB68yVHd/3CJsN39e4rrkBkagdFZJHSGHlYyA+ThNllgczdcvkVR7h97r0Tz8E39
mADRC9jDGsGKl05qxS/0
=ANme
-----END PGP SIGNATURE-----
Merge tag 'renesas-dt5-for-v3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes
Fifth Round of Renesas ARM Based SoC DT Updates for v3.15
Correct renesas,groups in SDHI nodes of for r8a7790 (R-Car H2) based
Lager board.
* tag 'renesas-dt5-for-v3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
ARM: shmobile: lager: correct renesas,gpios to renesas,groups in sd[02] pfc
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
- A couple of dts changes for the fallout of imx-drm binding update
- Parent DI clocks to video PLL for better HDMI support
- PCIe interrupt mapping and GIC node fixes
- A series of edmqmx6 board fixes
- Other small and random fixes on imx5 and imx6 dts
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
iQEcBAABAgAGBQJTTOc9AAoJEFBXWFqHsHzO+S0H+wbYC7IJxwJ8YVRHChFAs6gV
vUP3MICQV49PUReGxhsc0iJmjnc8fJtXDR4wH7rmzlxQYdrYsnFYBk+yPXO6GhqW
Js4hkS4V/9CbGmL7v53eGhW9TyTq0yE+vWpKXZTyDoCbKKkfhKrtfRIjZgkdNBZD
3XAZ4zm3LFwca/GwLN2RSjJ6mdPX24pm+SDnblHqDvz/3KyfBQj2AYUYjRxElide
YcsUMcXU+/aJD1JTVdriw9lsP7sqJzsemj948j8XakBoU32A+DuoBuB0Dhm9Uv10
2qydt1R5pR9q2iX1/FYzZyTjs+KOW3ds8/Z36+MbWTytYS9TwzQ6bln0nOCUNhw=
=eymy
-----END PGP SIGNATURE-----
Merge tag 'imx-fixes-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes
The i.MX fixes for 3.15:
- A couple of dts changes for the fallout of imx-drm binding update
- Parent DI clocks to video PLL for better HDMI support
- PCIe interrupt mapping and GIC node fixes
- A series of edmqmx6 board fixes
- Other small and random fixes on imx5 and imx6 dts
* tag 'imx-fixes-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
ARM: i.MX6: ipu_di_sel clocks can set parent rates
ARM: imx6q: clk: Parent DI clocks to video PLL via di_pre_sel
ARM: dts: imx: add required #clock-cells for fixed-clock
ARM: dts: vybrid: drop address and size cells from GIC node
ARM: dts: imx6sl-evk: Add an entry for MX6SL_PAD_ECSPI1_SS0__GPIO4_IO11
ARM: dts: imx53: fix apparent copy/paste error
ARM: dts: imx6q-gw5xxx: remove dead 'crtcs' property
ARM: dts: imx53-tx53: add IPU DI ports and endpoints
ARM: dts: imx6: edmqmx6: add second STMPE
ARM: dts: imx6: edmqmx6: USB H1 only supports host mode
ARM: dts: imx6: edmqmx6: Do not use the OTG switch as VBUS regulator
ARM: dts: imx6: edmqmx6: Fix usbotg id pin
ARM: dt: microsom: don't set bit 7 for ethernet mux settings
ARM: imx6q-clk: parent lvds_gate from lvds_sel
ARM: dts: imx: drop invalid size and address cells properties
ARM: dts: mx5: fix wrong stmpe-ts bindings
ARM: dts: imx53-m53evk: Fix memory region description
ARM: dts: imx53-qsb-common: Fix memory region description
ARM: dts: imx6: add PCIe interrupt mapping properties
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Commit a7cbe92cef ("ARM: tegra: remove tegra EMC scaling driver")
removed the only user of TEGRA_EMC_SCALING_ENABLE. Remove its Kconfig
entry too.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Few things were out of order:
- removed ARCH_BCM2835 duplicate
- shuffled ARCH_BCM_5301X, ARCH_U8500 and ARCH_U300 around so to keep the
list sorted
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Olof Johansson <olof@lixom.net>
Signed-by: Domenico Andreoli <domenico.andreoli@linux.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
In commit ddb902cc34 (ARM: centralize common multi-platform kconfig
options), CLKSRC_OF was removed from some platforms, but not added to
ARCH_MULTIPLATFORM. Fix this.
Reported-by: Lauri Hintsala <lauri.hintsala@bluegiga.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
