summaryrefslogtreecommitdiffstats
path: root/.mailmap (unfollow)
Commit message (Collapse)AuthorFilesLines
2014-04-16workqueue: fix bugs in wq_update_unbound_numa() failure pathDaeseok Youn1-1/+2
wq_update_unbound_numa() failure path has the following two bugs. - alloc_unbound_pwq() is called without holding wq->mutex; however, if the allocation fails, it jumps to out_unlock which tries to unlock wq->mutex. - The function should switch to dfl_pwq on failure but didn't do so after alloc_unbound_pwq() failure. Fix it by regrabbing wq->mutex and jumping to use_dfl_pwq on alloc_unbound_pwq() failure. Signed-off-by: Daeseok Youn <daeseok.youn@gmail.com> Acked-by: Lai Jiangshan <laijs@cn.fujitsu.com> Signed-off-by: Tejun Heo <tj@kernel.org> Cc: stable@vger.kernel.org Fixes: 4c16bd327c74 ("workqueue: implement NUMA affinity for unbound workqueues")
2014-04-13Linux 3.15-rc1v3.15-rc1Linus Torvalds1-2/+2
2014-04-13mm: Initialize error in shmem_file_aio_read()Geert Uytterhoeven1-1/+1
Some versions of gcc even warn about it: mm/shmem.c: In function ‘shmem_file_aio_read’: mm/shmem.c:1414: warning: ‘error’ may be used uninitialized in this function If the loop is aborted during the first iteration by one of the two first break statements, error will be uninitialized. Introduced by commit 6e58e79db8a1 ("introduce copy_page_to_iter, kill loop over iovec in generic_file_aio_read()"). Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-13cifs: Use min_t() when comparing "size_t" and "unsigned long"Geert Uytterhoeven1-1/+1
On 32 bit, size_t is "unsigned int", not "unsigned long", causing the following warning when comparing with PAGE_SIZE, which is always "unsigned long": fs/cifs/file.c: In function ‘cifs_readdata_to_iov’: fs/cifs/file.c:2757: warning: comparison of distinct pointer types lacks a cast Introduced by commit 7f25bba819a3 ("cifs_iovec_read: keep iov_iter between the calls of cifs_readdata_to_iov()"), which changed the signedness of "remaining" and the code from min_t() to min(). Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-13sym53c8xx_2: Set DID_REQUEUE return code when aborting squeueMikulas Patocka1-0/+4
This patch fixes I/O errors with the sym53c8xx_2 driver when the disk returns QUEUE FULL status. When the controller encounters an error (including QUEUE FULL or BUSY status), it aborts all not yet submitted requests in the function sym_dequeue_from_squeue. This function aborts them with DID_SOFT_ERROR. If the disk has full tag queue, the request that caused the overflow is aborted with QUEUE FULL status (and the scsi midlayer properly retries it until it is accepted by the disk), but the sym53c8xx_2 driver aborts the following requests with DID_SOFT_ERROR --- for them, the midlayer does just a few retries and then signals the error up to sd. The result is that disk returning QUEUE FULL causes request failures. The error was reproduced on 53c895 with COMPAQ BD03685A24 disk (rebranded ST336607LC) with command queue 48 or 64 tags. The disk has 64 tags, but under some access patterns it return QUEUE FULL when there are less than 64 pending tags. The SCSI specification allows returning QUEUE FULL anytime and it is up to the host to retry. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Cc: Matthew Wilcox <matthew@wil.cx> Cc: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-13powerpc: Don't try to set LPCR unless we're in hypervisor modePaul Mackerras1-1/+2
Commit 8f619b5429d9 ("powerpc/ppc64: Do not turn AIL (reloc-on interrupts) too early") added code to set the AIL bit in the LPCR without checking whether the kernel is running in hypervisor mode. The result is that when the kernel is running as a guest (i.e., under PowerKVM or PowerVM), the processor takes a privileged instruction interrupt at that point, causing a panic. The visible result is that the kernel hangs after printing "returning from prom_init". This fixes it by checking for hypervisor mode being available before setting LPCR. If we are not in hypervisor mode, we enable relocation-on interrupts later in pSeries_setup_arch using the H_SET_MODE hcall. Signed-off-by: Paul Mackerras <paulus@samba.org> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-13futex: update documentation for ordering guaranteesDavidlohr Bueso1-9/+23
Commits 11d4616bd07f ("futex: revert back to the explicit waiter counting code") and 69cd9eba3886 ("futex: avoid race between requeue and wake") changed some of the finer details of how we think about futexes. One was a late fix and the other a consequence of overlooking the whole requeuing logic. The first change caused our documentation to be incorrect, and the second made us aware that we need to explicitly add more details to it. Signed-off-by: Davidlohr Bueso <davidlohr@hp.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-13ceph: fix pr_fmt() redefinitionLinus Torvalds1-2/+1
The vfs merge caused a latent bug to show up: In file included from fs/ceph/super.h:4:0, from fs/ceph/ioctl.c:3: include/linux/ceph/ceph_debug.h:4:0: warning: "pr_fmt" redefined [enabled by default] #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt ^ In file included from include/linux/kernel.h:13:0, from include/linux/uio.h:12, from include/linux/socket.h:7, from include/uapi/linux/in.h:22, from include/linux/in.h:23, from fs/ceph/ioctl.c:1: include/linux/printk.h:214:0: note: this is the location of the previous definition #define pr_fmt(fmt) fmt ^ where the reason is that <linux/ceph_debug.h> is included much too late for the "pr_fmt()" define. The include of <linux/ceph_debug.h> needs to be the first include in the file, but fs/ceph/ioctl.c had for some reason missed that, and it wasn't noticeable until some unrelated header file changes brought in an indirect earlier include of <linux/kernel.h>. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-12vti: don't allow to add the same tunnel twiceNicolas Dichtel1-1/+1
Before the patch, it was possible to add two times the same tunnel: ip l a vti1 type vti remote 10.16.0.121 local 10.16.0.249 key 41 ip l a vti2 type vti remote 10.16.0.121 local 10.16.0.249 key 41 It was possible, because ip_tunnel_newlink() calls ip_tunnel_find() with the argument dev->type, which was set only later (when calling ndo_init handler in register_netdevice()). Let's set this type in the setup handler, which is called before newlink handler. Introduced by commit b9959fd3b0fa ("vti: switch to new ip tunnel code"). CC: Cong Wang <amwang@redhat.com> CC: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-12gre: don't allow to add the same tunnel twiceNicolas Dichtel1-1/+1
Before the patch, it was possible to add two times the same tunnel: ip l a gre1 type gre remote 10.16.0.121 local 10.16.0.249 ip l a gre2 type gre remote 10.16.0.121 local 10.16.0.249 It was possible, because ip_tunnel_newlink() calls ip_tunnel_find() with the argument dev->type, which was set only later (when calling ndo_init handler in register_netdevice()). Let's set this type in the setup handler, which is called before newlink handler. Introduced by commit c54419321455 ("GRE: Refactor GRE tunneling code."). CC: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-12drivers: net: xen-netfront: fix array initialization bugVincenzo Maffione1-1/+1
This patch fixes the initialization of an array used in the TX datapath that was mistakenly initialized together with the RX datapath arrays. An out of range array access could happen when RX and TX rings had different sizes. Signed-off-by: Vincenzo Maffione <v.maffione@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-12missing bits of "splice: fix racy pipe->buffers uses"Al Viro3-4/+4
that commit has fixed only the parts of that mess in fs/splice.c itself; there had been more in several other ->splice_read() instances... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-04-12cifs: fix the race in cifs_writev()Al Viro1-5/+18
O_APPEND handling there hadn't been completely fixed by Pavel's patch; it checks the right value, but it's racy - we can't really do that until i_mutex has been taken. Fix by switching to __generic_file_aio_write() (open-coding generic_file_aio_write(), actually) and pulling mutex_lock() above inode_size_read(). Cc: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-04-12ceph_sync_{,direct_}write: fix an oops on ceph_osdc_new_request() failureAl Viro1-2/+2
ceph_osdc_put_request(ERR_PTR(-error)) oopses. What we want there is break, not goto out. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-04-12pktgen: be friendly to LLTX devicesDaniel Borkmann1-2/+6
Similarly to commit 43279500deca ("packet: respect devices with LLTX flag in direct xmit"), we can basically apply the very same to pktgen. This will help testing against LLTX devices such as dummy driver (or others), which only have a single netdevice txq and would otherwise require locking their txq from pktgen side while e.g. in dummy case, we would not need any locking. Fix this by making use of HARD_TX_{UN,}LOCK API, so that NETIF_F_LLTX will be respected. Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> Cc: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-12r8152: check RTL8152_UNPLUGhayeswang1-0/+48
When the device is unplugged, the driver would try to disable the device. Add checking the flag of RTL8152_UNPLUG to skip setting the device when it is unplugged. This could shorten the time of unloading the driver. Signed-off-by: Hayes Wang <hayeswang@realtek.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-12net: sun4i-emac: add promiscuous supportMarc Zyngier1-9/+21
The sun4i-emac driver is rather primitive, and doesn't support promiscuous mode. This makes usage such as bridging impossible, which is a shame on virtualization capable HW such as the Allwinner A20. The fix is fairly simple: move the RX setup code to the ndo_set_rx_mode vector, and add the required HW configuration when IFF_PROMISC is passed by the core code. This has been tested on a generic A20 box running a few virtual machines hanging off a bridge with the EMAC chip as the link to the outside world. Cc: Stefan Roese <sr@denx.de> Cc: Maxime Ripard <maxime.ripard@free-electrons.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Acked-by: Stefan Roese <sr@denx.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-12net/apne: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERODuan Jiong1-3/+1
This patch fixes coccinelle error regarding usage of IS_ERR and PTR_ERR instead of PTR_ERR_OR_ZERO. Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-12blackfin: cleanup board filesSteven Miao28-1209/+1089
using IS_ENABLED() macro instead of defined(CONFIG_XXX) || defined(CONFIG_XXX_MODULE) Signed-off-by: Steven Miao <realmz6@gmail.com>
2014-04-12bf609: clock: drop unused clock bit set/clear functionsSteven Miao1-18/+0
Signed-off-by: Steven Miao <realmz6@gmail.com>
2014-04-12Blackfin: bf537: rename "CONFIG_ADT75"Paul Bolle1-1/+1
In v3.2 the Analog Devices ADT75 temperature sensor driver was removed as an IIO driver and support for it was added to the LM75 HWMON driver. But it was apparently overlooked to rename one reference to CONFIG_ADT75 to CONFIG_SENSORS_LM75. Do so now. Use the IS_ENABLED() macro, while we're at it. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
2014-04-12Blackfin: bf537: rename "CONFIG_AD7314"Paul Bolle1-2/+2
In v3.2 the Analog Devices AD7314 temperature sensor driver was removed as an IIO driver and added as a HWMON driver. But it was apparently overlooked to rename two references to CONFIG_AD7314 to CONFIG_SENSORS_AD7314. Do so now. Use the IS_ENABLED() macro, while we're at it. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
2014-04-12Blackfin: bf537: rename ad2s120x ->ad2s1200Paul Bolle1-7/+7
In v3.2 the Analog Devices ad2s1200/ad2s1205 driver was renamed from ad2s120x to ad2s1200. But it apparently forgot to rename the references to this driver in the BF537-STAMP code. Rename these now, and use the IS_ENABLED() macro, while we're at it. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
2014-04-12blackfin: bf537: fix typo "CONFIG_SND_SOC_ADV80X_MODULE"Paul Bolle1-1/+1
There's a (rather subtle) typo in "CONFIG_SND_SOC_ADV80X_MODULE". Fix it once and for all by using IS_ENABLED(), which is designed to avoid issues like this. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
2014-04-12blackfin: dma: current count mmr is read onlySonic Zhang1-2/+0
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
2014-04-12bfin_crc: Move architecture independant crc header file out of the blackfin ↵Sonic Zhang1-125/+0
folder. Signed-off-by: Sonic Zhang <sonic.zhang@analog.com> Signed-off-by: Steven Miao <realmz6@gmail.com>
2014-04-12bf54x: drop unuesd HOST status,control,timeout registers bit define macrosSteven Miao2-60/+0
Signed-off-by: Steven Miao <realmz6@gmail.com>
2014-04-12blackfin: portmux: cleanup head fileSteven Miao1-6/+4
drop unused head file change pinmux request/free macro for backward compatiblity add function declaration Signed-off-by: Steven Miao <realmz6@gmail.com>
2014-04-12ib_srpt: Use correct ib_sg_dma primitivesMike Marciniszyn1-6/+10
The code was incorrectly using sg_dma_address() and sg_dma_len() instead of ib_sg_dma_address() and ib_sg_dma_len(). This prevents srpt from functioning with the Intel HCA and indeed will corrupt memory badly. Cc: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Tested-by: Vinod Kumar <vinod.kumar@intel.com> Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Cc: stable@vger.kernel.org # 3.3+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-04-12target/tcm_fc: Rename ft_tport_create to ft_tport_getAndy Grover1-3/+3
Because it doesn't always create, if there's an existing one it just returns it. Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-04-12target/tcm_fc: Rename ft_{add,del}_lport to {add,del}_wwnAndy Grover1-6/+6
These functions are not adding or deleting an lport. They are adding a wwn that may match with an lport that is present on the system. Renaming ft_del_lport also means we won't have functions named both ft_del_lport and ft_lport_del any more. Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-04-12target/tcm_fc: Rename structs and list members for clarityAndy Grover2-33/+32
Rename struct ft_lport_acl to ft_lport_wwn. "acl" is associated with something different in LIO terms. Really, ft_lport_wwn is the fabric-specific wrapper for the struct se_wwn. Rename "lacl" local variables to "ft_wwn" as well. Rename list_heads used as list members to make it clear they're nodes, not heads. Rename lport_node to ft_wwn_node. Rename ft_lport_list to ft_wwn_list Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-04-12target/tcm_fc: Limit to 1 TPG per wwnAndy Grover2-11/+12
tcm_fc doesn't support multiple TPGs per wwn. For proof, see ft_lport_find_tpg. Enforce this in the code. Replace ft_lport_wwn.tpg_list with a single pointer. We can't fold ft_tpg into ft_lport_wwn because they can have different lifetimes. Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-04-12target/tcm_fc: Don't export ft_lport_listAndy Grover2-2/+1
Nobody outside tfc_conf.c uses it. Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-04-12target/tcm_fc: Fix use-after-free of ft_tpgAndy Grover1-0/+1
ft_del_tpg checks tpg->tport is set before unlinking the tpg from the tport when the tpg is being removed. Set this pointer in ft_tport_create, or the unlinking won't happen in ft_del_tpg and tport->tpg will reference a deleted object. This patch sets tpg->tport in ft_tport_create, because that's what ft_del_tpg checks, and is the only way to get back to the tport to clear tport->tpg. The bug was occuring when: - lport created, tport (our per-lport, per-provider context) is allocated. tport->tpg = NULL - tpg created - a PRLI is received. ft_tport_create is called, tpg is found and tport->tpg is set - tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not set, tport->tpg is not cleared and points at freed memory - Future calls to ft_tport_create return tport via first conditional, instead of searching for new tpg by calling ft_lport_find_tpg. tport->tpg is still invalid, and will access freed memory. see https://bugzilla.redhat.com/show_bug.cgi?id=1071340 Cc: stable@vger.kernel.org # 3.0+ Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-04-12target: Add check to prevent Abort Task from aborting itselfAlex Leung1-0/+5
This patch addresses an issue that occurs when an ABTS is received for an se_cmd that completes just before the sess_cmd_list is searched in core_tmr_abort_task(). When the sess_cmd_list is searched, since the ABTS and the FCP_CMND being aborted (that just completed) both have the same OXID, TFO->get_task_tag(TMR) returns a value that matches tmr->ref_task_tag (from TFO->get_task_tag(FCP_CMND)), and the Abort Task tries to abort itself. When this occurs, transport_wait_for_tasks() hangs forever since the TMR is waiting for itself to finish. This patch adds a check to core_tmr_abort_task() to make sure the TMR does not attempt to abort itself. Signed-off-by: Alex Leung <alex.leung@emulex.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-04-11net: ipv6: Fix oif in TCP SYN+ACK route lookup.Lorenzo Colitti1-1/+1
net-next commit 9c76a11, ipv6: tcp_ipv6 policy route issue, had a boolean logic error that caused incorrect behaviour for TCP SYN+ACK when oif-based rules are in use. Specifically: 1. If a SYN comes in from a global address, and sk_bound_dev_if is not set, the routing lookup has oif set to the interface the SYN came in on. Instead, it should have oif unset, because for global addresses, the incoming interface doesn't necessarily have any bearing on the interface the SYN+ACK is sent out on. 2. If a SYN comes in from a link-local address, and sk_bound_dev_if is set, the routing lookup has oif set to the interface the SYN came in on. Instead, it should have oif set to sk_bound_dev_if, because that's what the application requested. Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11drivers: net: cpsw: enable interrupts after napi enable and clearing ↵Mugunthan V N1-6/+6
previous interrupts When the Ethernet interface is put down and up with heavy Ethernet traffic, then there is prossibility of an interrupt waiting in irq controller to be processed, so when the interface is brought up again just after enable interrupt, it goes to ISR due to the previous unhandled interrutp and in ISR napi is not scheduled as the napi is not enabled in ndo_open which results in disabled interrupt for CPSW and no packets are received in cpsw. So this patch moves enabling of interupts after napi_enable and clearing CPDMA interrupts. Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11drivers: net: cpsw: discard all packets received when interface is downMugunthan V N1-1/+1
When the Ethernet interface is brought down during high Ethernet traffic, then cpsw creates the following warn dump. When cpdma has already processed the packet then the status will be greater than 0, so the cpsw_rx_handler considers that the interface is up and try to resubmit one more rx buffer to cpdma which fails as the DMA is in teardown process. This can be avoided by checking the interface state and then process the received packet, if the interface is down just discard and free the skb and return. [ 2823.104591] WARNING: CPU: 0 PID: 1823 at drivers/net/ethernet/ti/cpsw.c:711 cpsw_rx_handler+0x148/0x164() [ 2823.114654] Modules linked in: [ 2823.117872] CPU: 0 PID: 1823 Comm: ifconfig Tainted: G W 3.14.0-11992-gf34c4a3 #11 [ 2823.126860] [<c0014b5c>] (unwind_backtrace) from [<c00117e4>] (show_stack+0x10/0x14) [ 2823.135030] [<c00117e4>] (show_stack) from [<c0533a9c>] (dump_stack+0x80/0x9c) [ 2823.142619] [<c0533a9c>] (dump_stack) from [<c003f0e0>] (warn_slowpath_common+0x6c/0x90) [ 2823.151141] [<c003f0e0>] (warn_slowpath_common) from [<c003f120>] (warn_slowpath_null+0x1c/0x24) [ 2823.160336] [<c003f120>] (warn_slowpath_null) from [<c03caeb0>] (cpsw_rx_handler+0x148/0x164) [ 2823.169314] [<c03caeb0>] (cpsw_rx_handler) from [<c03c730c>] (__cpdma_chan_free+0x90/0xa8) [ 2823.178028] [<c03c730c>] (__cpdma_chan_free) from [<c03c7418>] (__cpdma_chan_process+0xf4/0x134) [ 2823.187279] [<c03c7418>] (__cpdma_chan_process) from [<c03c7560>] (cpdma_chan_stop+0xb4/0x17c) [ 2823.196349] [<c03c7560>] (cpdma_chan_stop) from [<c03c766c>] (cpdma_ctlr_stop+0x44/0x9c) [ 2823.204872] [<c03c766c>] (cpdma_ctlr_stop) from [<c03cb708>] (cpsw_ndo_stop+0x154/0x188) [ 2823.213321] [<c03cb708>] (cpsw_ndo_stop) from [<c046f0ec>] (__dev_close_many+0x84/0xc8) [ 2823.221761] [<c046f0ec>] (__dev_close_many) from [<c046f158>] (__dev_close+0x28/0x3c) [ 2823.230012] [<c046f158>] (__dev_close) from [<c0474ca8>] (__dev_change_flags+0x88/0x160) [ 2823.238483] [<c0474ca8>] (__dev_change_flags) from [<c0474da0>] (dev_change_flags+0x18/0x48) [ 2823.247316] [<c0474da0>] (dev_change_flags) from [<c04d12c4>] (devinet_ioctl+0x61c/0x6e0) [ 2823.255884] [<c04d12c4>] (devinet_ioctl) from [<c045c660>] (sock_ioctl+0x68/0x2a4) [ 2823.263789] [<c045c660>] (sock_ioctl) from [<c0125fe4>] (do_vfs_ioctl+0x78/0x61c) [ 2823.271629] [<c0125fe4>] (do_vfs_ioctl) from [<c01265ec>] (SyS_ioctl+0x64/0x74) [ 2823.279284] [<c01265ec>] (SyS_ioctl) from [<c000e580>] (ret_fast_syscall+0x0/0x48) Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11net: Fix use after free by removing length arg from sk_data_ready callbacks.David S. Miller58-121/+112
Several spots in the kernel perform a sequence like: skb_queue_tail(&sk->s_receive_queue, skb); sk->sk_data_ready(sk, skb->len); But at the moment we place the SKB onto the socket receive queue it can be consumed and freed up. So this skb->len access is potentially to freed up memory. Furthermore, the skb->len can be modified by the consumer so it is possible that the value isn't accurate. And finally, no actual implementation of this callback actually uses the length argument. And since nobody actually cared about it's value, lots of call sites pass arbitrary values in such as '0' and even '1'. So just remove the length argument from the callback, that way there is no confusion whatsoever and all of these use-after-free cases get fixed as a side effect. Based upon a patch by Eric Dumazet and his suggestion to audit this issue tree-wide. Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11Drivers: net: hyperv: Address UDP checksum issuesKY Srinivasan3-2/+37
ws2008r2 does not support UDP checksum offload. Thus, we cannnot turn on UDP offload in the host. Also, on ws2012 and ws2012 r2, there appear to be an issue with UDP checksum offload. Fix this issue by computing the UDP checksum in the Hyper-V driver. Based on Dave Miller's comments, in this version, I have COWed the skb before modifying the UDP header (the checksum field). Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11Drivers: net: hyperv: Negotiate suitable ndis version for offload supportKY Srinivasan1-1/+1
Ws2008R2 supports ndis_version 6.1 and 6.1 is the minimal version required for various offloads. Negotiate ndis_version 6.1 when on ws2008r2. Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11Drivers: net: hyperv: Allocate memory for all possible per-pecket informationKY Srinivasan1-1/+3
An outgoing packet can potentially need per-packet information for all the offloads and VLAN tagging. Fix this issue. Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11bridge: Fix double free and memory leak around br_allowed_ingressToshiaki Makita2-4/+5
br_allowed_ingress() has two problems. 1. If br_allowed_ingress() is called by br_handle_frame_finish() and vlan_untag() in br_allowed_ingress() fails, skb will be freed by both vlan_untag() and br_handle_frame_finish(). 2. If br_allowed_ingress() is called by br_dev_xmit() and br_allowed_ingress() fails, the skb will not be freed. Fix these two problems by freeing the skb in br_allowed_ingress() if it fails. Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11bonding: Remove debug_fs files when module init failsThomas Richter1-0/+1
Remove the bonding debug_fs entries when the module initialization fails. The debug_fs entries should be removed together with all other already allocated resources. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Signed-off-by: Jay Vosburgh <j.vosburgh@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernelsH. Peter Anvin1-0/+11
The IRET instruction, when returning to a 16-bit segment, only restores the bottom 16 bits of the user space stack pointer. We have a software workaround for that ("espfix") for the 32-bit kernel, but it relies on a nonzero stack segment base which is not available in 32-bit mode. Since 16-bit support is somewhat crippled anyway on a 64-bit kernel (no V86 mode), and most (if not quite all) 64-bit processors support virtualization for the users who really need it, simply reject attempts at creating a 16-bit segment when running on top of a 64-bit kernel. Cc: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Link: http://lkml.kernel.org/n/tip-kicdm89kzw9lldryb1br9od0@git.kernel.org Cc: <stable@vger.kernel.org>
2014-04-11Blackfin: remove "config IP_CHECKSUM_L1"Paul Bolle1-8/+0
The only user of Kconfig symbol IP_CHECKSUM_L1 got removed in v2.6.33, with commit ddf9ddacef0989fdeb22e182212a232488f0f3ad ("Blackfin: convert to generic checksum code"). We can remove the Kconfig entry for this unused symbol now. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
2014-04-11blackfin: Remove GENERIC_GPIO config option againPaul Bolle1-3/+0
The Kconfig symbol GENERIC_GPIO was removed in v3.10. Nothing cares about it anymore. It popped up somehow in v3.13, so it can be removed again. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
2014-04-11blackfin:Use generic /proc/interrupts implementationThomas Gleixner2-30/+10
There is nothing special in that blackfin code. Use the core implementation. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Steven Miao <realmz6@gmail.com> Cc: bfin <adi-buildroot-devel@lists.sourceforge.net>
2014-04-11blackfin: bf60x: fix typo "CONFIG_PM_BFIN_WAKE_PA15_POL"Paul Bolle1-1/+1
Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: Steven Miao <realmz6@gmail.com>