commit ea5dd38e93b3bec3427e5d3eef000bbf5d637e76 Author: Sasha Levin Date: Sun Jun 28 13:40:40 2015 -0400 Linux 3.18.17 Signed-off-by: Sasha Levin commit d24b9b8d95f0df8c3b1430ff76396fd705cc0140 Author: Linus Torvalds Date: Fri Feb 20 15:46:31 2015 -0800 kernel: make READ_ONCE() valid on const arguments [ Upstream commit dd36929720f40f17685e841ae0d4c581c165ea60 ] The use of READ_ONCE() causes lots of warnings witht he pending paravirt spinlock fixes, because those ends up having passing a member to a 'const' structure to READ_ONCE(). There should certainly be nothing wrong with using READ_ONCE() with a const source, but the helper function __read_once_size() would cause warnings because it would drop the 'const' qualifier, but also because the destination would be marked 'const' too due to the use of 'typeof'. Use a union of types in READ_ONCE() to avoid this issue. Also make sure to use parenthesis around the macro arguments to avoid possible operator precedence issues. Tested-by: Ingo Molnar Cc: Christian Borntraeger Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin commit ac54513c498163cb043c2564d8062596a788f4a2 Author: Ben Serebrin Date: Thu Apr 16 11:58:05 2015 -0700 KVM: VMX: Preserve host CR4.MCE value while in guest mode. [ Upstream commit 085e68eeafbf76e21848ad5bafaecec88a11dd64 ] The host's decision to enable machine check exceptions should remain in force during non-root mode. KVM was writing 0 to cr4 on VCPU reset and passed a slightly-modified 0 to the vmcs.guest_cr4 value. Tested: Built. On earlier version, tested by injecting machine check while a guest is spinning. Before the change, if guest CR4.MCE==0, then the machine check is escalated to Catastrophic Error (CATERR) and the machine dies. If guest CR4.MCE==1, then the machine check causes VMEXIT and is handled normally by host Linux. After the change, injecting a machine check causes normal Linux machine check handling. Signed-off-by: Ben Serebrin Reviewed-by: Venkatesh Srinivas Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini Signed-off-by: Sasha Levin commit 63753fac67e11fb6bac3d5c6a48bd319d9e612c2 Author: Andy Lutomirski Date: Fri Oct 24 15:58:08 2014 -0700 x86: Store a per-cpu shadow copy of CR4 [ Upstream commit 1e02ce4cccdcb9688386e5b8d2c9fa4660b45389 ] Context switches and TLB flushes can change individual bits of CR4. CR4 reads take several cycles, so store a shadow copy of CR4 in a per-cpu variable. To avoid wasting a cache line, I added the CR4 shadow to cpu_tlbstate, which is already touched in switch_mm. The heaviest users of the cr4 shadow will be switch_mm and __switch_to_xtra, and __switch_to_xtra is called shortly after switch_mm during context switch, so the cacheline is likely to be hot. Signed-off-by: Andy Lutomirski Reviewed-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Cc: Kees Cook Cc: Andrea Arcangeli Cc: Vince Weaver Cc: "hillf.zj" Cc: Valdis Kletnieks Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Linus Torvalds Link: http://lkml.kernel.org/r/3a54dd3353fffbf84804398e00dfdc5b7c1afd7d.1414190806.git.luto@amacapital.net Signed-off-by: Ingo Molnar Signed-off-by: Sasha Levin commit 8ca6fadf220ab0a1369a667462d8d8c0c5d6ac29 Author: Andy Lutomirski Date: Fri Oct 24 15:58:07 2014 -0700 x86: Clean up cr4 manipulation [ Upstream commit 375074cc736ab1d89a708c0a8d7baa4a70d5d476 ] CR4 manipulation was split, seemingly at random, between direct (write_cr4) and using a helper (set/clear_in_cr4). Unfortunately, the set_in_cr4 and clear_in_cr4 helpers also poke at the boot code, which only a small subset of users actually wanted. This patch replaces all cr4 access in functions that don't leave cr4 exactly the way they found it with new helpers cr4_set_bits, cr4_clear_bits, and cr4_set_bits_and_update_boot. Signed-off-by: Andy Lutomirski Reviewed-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Cc: Andrea Arcangeli Cc: Vince Weaver Cc: "hillf.zj" Cc: Valdis Kletnieks Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Kees Cook Cc: Linus Torvalds Link: http://lkml.kernel.org/r/495a10bdc9e67016b8fd3945700d46cfd5c12c2f.1414190806.git.luto@amacapital.net Signed-off-by: Ingo Molnar Signed-off-by: Sasha Levin commit 4621614dd5115749c2b04c80f0f53861cd93590e Author: Pelle Nilsson Date: Tue Apr 14 15:40:17 2015 +0200 spi: bitbang: Make setup_transfer() callback optional [ Upstream commit 7d0ec8b6f40b356f780b79de63eeafd6b907d68c ] Some controller drivers have no need of this callback (spi-altera even causes a NULL pointer dereference because it doesn't register the callback, falsely assuming that it is already optional). Fixes: 30af9b558a56 ("spi/bitbang: Drop empty setup() functions") Signed-off-by: Pelle Nilsson Reviewed-by: Ezequiel Garcia Signed-off-by: Mark Brown Signed-off-by: Sasha Levin commit 0fee5a3955ed36b15db56c77c0e316b9ecf8c93f Author: Arnd Bergmann Date: Sat Apr 11 00:27:58 2015 +0200 dmaengine: shdmac: avoid unused variable warnings [ Upstream commit 7d3beab16dd9eee86bb1a4dd05b51159fc7772f0 ] This driver uses '#ifdef CONFIG_ARCH_SHMOBILE' and '#ifdef CONFIG_ARM' interchangeably in its sh_dmae_probe function, which causes a build warning when building for ARM without also enabling shmobile: dma/sh/shdmac.c: In function sh_dmae_probe: dma/sh/shdmac.c:696:6: warning: unused variable errirq [-Wunused-variable] dma/sh/shdmac.c:695:16: warning: unused variable irqflags [-Wunused-variable] dma/sh/shdmac.c: At top level: dma/sh/shdmac.c:447:20: warning: sh_dmae_err defined but not used [-Wunused-function] This changes all the #ifdef to test for CONFIG_ARCH_SHMOBILE to avoid that warning. An earlier patch from Laurent had fixed the warning for non-ARM case, but it still remained present in ARM randconfig builds. Signed-off-by: Arnd Bergmann Fixes: 52d6a5ee101bf ("DMA: shdma: Fix warnings due to declared but unused symbols") Acked-by: Laurent Pinchart Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin commit 12e17659b59a626dfe5e58436ffbd420aa271f3f Author: Eric Dumazet Date: Thu Apr 16 16:12:28 2015 -0700 tcp: tcp_get_info() should fetch socket fields once [ Upstream commit fad9dfefea6405039491e7e4fc21fb6e59e7d26c ] tcp_get_info() can be called without holding socket lock, so any socket fields can change under us. Use READ_ONCE() to fetch sk_pacing_rate and sk_max_pacing_rate Fixes: 977cb0ecf82e ("tcp: add pacing_rate information into tcp_info") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit c2c3964c8567d5d2b6bfa8534202850112de1d7d Author: Roy Franz Date: Wed Apr 15 16:32:24 2015 -0700 x86/efi: Store upper bits of command line buffer address in ext_cmd_line_ptr [ Upstream commit 98b228f55014870092c15d7d168fecac69f2f12a ] Until now, the EFI stub was only setting the 32 bit cmd_line_ptr in the setup_header structure, so on 64 bit platforms this could be truncated. This patch adds setting the upper bits of the buffer address in ext_cmd_line_ptr. This case was likely never hit, as the allocation for this buffer is done at the lowest available address. Only x86_64 kernels have this problem, as the 1-1 mapping mandated by EFI ensures that all memory is 32 bit addressable on 32 bit platforms. The EFI stub does not support mixed mode, so the 32 bit kernel on 64 bit firmware case does not need to be handled. Signed-off-by: Roy Franz Cc: Signed-off-by: Matt Fleming Signed-off-by: Sasha Levin commit ccf63e05bb863b7cc821fb4e1429f0a4e7ed1686 Author: Ross Lagerwall Date: Thu Apr 2 08:39:00 2015 +0100 efivarfs: Ensure VariableName is NUL-terminated [ Upstream commit c57dcb566d3d866a302a1da2e06344bec31d5bcd ] Some buggy firmware implementations update VariableNameSize on success such that it does not include the final NUL character which results in garbage in the efivarfs name entries. Use kzalloc on the efivar_entry (as is done in efivars.c) to ensure that the name is always NUL-terminated. The buggy firmware is: BIOS Information Vendor: Intel Corp. Version: S1200RP.86B.02.02.0005.102320140911 Release Date: 10/23/2014 BIOS Revision: 4.6 System Information Manufacturer: Intel Corporation Product Name: S1200RP_SE Signed-off-by: Ross Lagerwall Acked-by: Matthew Garrett Cc: Jeremy Kerr Cc: Signed-off-by: Matt Fleming Signed-off-by: Sasha Levin commit ba8e7f8c53394b2386e6bd55e487780480f6e0aa Author: Nicolas Iooss Date: Thu Apr 16 12:44:02 2015 -0700 firmware/ihex2fw.c: restore missing default in switch statement [ Upstream commit d43698e8abb58a6ac47d16e0f47bb55f452e4fc4 ] Commit 2473238eac95 ("ihex: add support for CS:IP/EIP records") removes the "default:" statement in the switch block, making the "return usage();" line dead code and ihex2fw silently ignoring unknown options. Restore this statement. This bug was found by building with HOSTCC=clang and adding -Wunreachable-code-return to HOSTCFLAGS. Fixes: 2473238eac95 ("ihex: add support for CS:IP/EIP records") Signed-off-by: Nicolas Iooss Cc: Mark Brown Cc: David Woodhouse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin commit 50657ec35a942cd5db110c642395b99a5aeb557e Author: Honggang LI Date: Wed Apr 15 16:36:15 2015 +0800 mlx5: wrong page mask if CONFIG_ARCH_DMA_ADDR_T_64BIT enabled for 32Bit architectures [ Upstream commit 59d2d18cc4e9ba30b370db18d0e02d792699da96 ] If CONFIG_ARCH_DMA_ADDR_T_64BIT enabled for x86 systems and physical memory is more than 4GB, dma_map_page may return a valid memory address which greater than 0xffffffff. As a result, the mlx5 device page allocator RB tree will be initialized with valid addresses greater than 0xfffffff. However, (addr & PAGE_MASK) set the high four bytes to zeros. So, it's impossible for the function, free_4k, to release the pages whose addresses greater than 4GB. Memory leaks. And mlx5_ib module can't release the pages when user try to remove the module, as a result, system hang. [root@rdma05 root]# dmesg | grep addr | head addr = 3fe384000 addr & PAGE_MASK = fe384000 [root@rdma05 root]# rmmod mlx5_ib <---- hang on ---------------------- cosnole log ----------------- mlx5_ib 0000:04:00.0: irq 138 for MSI/MSI-X alloc irq_desc for 139 on node -1 alloc kstat_irqs on node -1 mlx5_ib 0000:04:00.0: irq 139 for MSI/MSI-X 0000:04:00.0:free_4k:221:(pid 1519): page not found 0000:04:00.0:free_4k:221:(pid 1519): page not found 0000:04:00.0:free_4k:221:(pid 1519): page not found 0000:04:00.0:free_4k:221:(pid 1519): page not found ---------------------- cosnole log ----------------- Fixes: bf0bf77f6519 ('mlx5: Support communicating arbitrary host page size to firmware') Signed-off-by: Honggang Li Signed-off-by: Doug Ledford Signed-off-by: Sasha Levin commit 8db8f8f39c21d93bb50de6a4e12ad1aea21411ef Author: Nicolas Dichtel Date: Fri Apr 10 16:24:28 2015 +0200 selinux/nlmsg: add XFRM_MSG_MAPPING [ Upstream commit bd2cba07381a6dba60bc1c87ed8b37931d244da1 ] This command is missing. Fixes: 3a2dfbe8acb1 ("xfrm: Notify changes in UDP encapsulation via netlink") CC: Martin Willi Reported-by: Stephen Smalley Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit d4c2dc5980c149689974c3c4761f4f33978d20c4 Author: Nicolas Dichtel Date: Fri Apr 10 16:24:27 2015 +0200 selinux/nlmsg: add XFRM_MSG_MIGRATE [ Upstream commit 8d465bb777179c4bea731b828ec484088cc9fbc1 ] This command is missing. Fixes: 5c79de6e79cd ("[XFRM]: User interface for handling XFRM_MSG_MIGRATE") Reported-by: Stephen Smalley Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 9829c06108276253371439db20497efbbf0115a5 Author: Nicolas Dichtel Date: Fri Apr 10 16:24:26 2015 +0200 selinux/nlmsg: add XFRM_MSG_REPORT [ Upstream commit b0b59b0056acd6f157a04cc895f7e24692fb08aa ] This command is missing. Fixes: 97a64b4577ae ("[XFRM]: Introduce XFRM_MSG_REPORT.") Reported-by: Stephen Smalley Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 5d4bafa7be0843b63b6368ae49aaf0f5a941fc9f Author: Eric W. Biederman Date: Mon Jan 19 11:48:45 2015 -0600 mnt: Fix the error check in __detach_mounts [ Upstream commit f53e57975151f54ad8caa1b0ac8a78091cd5700a ] lookup_mountpoint can return either NULL or an error value. Update the test in __detach_mounts to test for an error value to avoid pathological cases causing a NULL pointer dereferences. The callers of __detach_mounts should prevent it from ever being called on an unlinked dentry but don't take any chances. Cc: stable@vger.kernel.org Signed-off-by: "Eric W. Biederman" Signed-off-by: Sasha Levin commit f9c3700bef5c3f09ac0935e2f831ee182c23d9e8 Author: Aravind Gopalakrishnan Date: Thu Apr 9 10:51:48 2015 +0200 x86/iommu: Fix header comments regarding standard and _FINISH macros [ Upstream commit b44915927ca88084a7292e4ddd4cf91036f365e1 ] The comment line regarding IOMMU_INIT and IOMMU_INIT_FINISH macros is incorrect: "The standard vs the _FINISH differs in that the _FINISH variant will continue detecting other IOMMUs in the call list..." It should be "..the *standard* variant will continue detecting..." Fix that. Also, make it readable while at it. Signed-off-by: Aravind Gopalakrishnan Signed-off-by: Borislav Petkov Cc: H. Peter Anvin Cc: Thomas Gleixner Cc: konrad.wilk@oracle.com Fixes: 6e9636693373 ("x86, iommu: Update header comments with appropriate naming") Link: http://lkml.kernel.org/r/1428508017-5316-1-git-send-email-Aravind.Gopalakrishnan@amd.com Signed-off-by: Ingo Molnar Signed-off-by: Sasha Levin commit 3d5df8d994d3711eeed211cf6897435467ba0442 Author: Nicolas Dichtel Date: Wed Apr 8 18:36:42 2015 +0200 selinux/nlmsg: add XFRM_MSG_[NEW|GET]SADINFO [ Upstream commit 5b5800fad072133e4a9c2efbf735baaac83dec86 ] These commands are missing. Fixes: 28d8909bc790 ("[XFRM]: Export SAD info.") Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 97cd3676ab52cc5943a19af63c6698639d532b8a Author: Nicolas Dichtel Date: Wed Apr 8 18:36:41 2015 +0200 selinux/nlmsg: add XFRM_MSG_GETSPDINFO [ Upstream commit 5e6deebafb45fb271ae6939d48832e920b8fb74e ] This command is missing. Fixes: ecfd6b183780 ("[XFRM]: Export SPD info") Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit a8de6e18a4c53455c9bae9938c7078a55bb9bbe2 Author: Nicolas Dichtel Date: Wed Apr 8 18:36:40 2015 +0200 selinux/nlmsg: add XFRM_MSG_NEWSPDINFO [ Upstream commit 2b7834d3e1b828429faa5dc41a480919e52d3f31 ] This new command is missing. Fixes: 880a6fab8f6b ("xfrm: configure policy hash table thresholds by netlink") Reported-by: Christophe Gouault Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 266073ce00eca585de344bdb2a33d4e3d3503c1b Author: Sowmini Varadhan Date: Wed Apr 8 12:33:45 2015 -0400 RDS: Documentation: Document AF_RDS, PF_RDS and SOL_RDS correctly. [ Upstream commit ebe96e641dee2cbd135ee802ae7e40c361640088 ] AF_RDS, PF_RDS and SOL_RDS are available in header files, and there is no need to get their values from /proc. Document this correctly. Fixes: 0c5f9b8830aa ("RDS: Documentation") Signed-off-by: Sowmini Varadhan Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit ea0a522aef212afc09cd84503cfea58942b9404a Author: Arnd Bergmann Date: Wed Feb 18 14:12:42 2015 -0300 [media] Add and use IS_REACHABLE macro [ Upstream commit 9b174527e7b756cda9f5d9e541f87b7fec9cfdf0 ] In the media drivers, the v4l2 core knows about all submodules and calls into them from a common function. However this cannot work if the modules that get called are loadable and the core is built-in. In that case we get drivers/built-in.o: In function `set_type': drivers/media/v4l2-core/tuner-core.c:301: undefined reference to `tea5767_attach' drivers/media/v4l2-core/tuner-core.c:307: undefined reference to `tea5761_attach' drivers/media/v4l2-core/tuner-core.c:349: undefined reference to `tda9887_attach' drivers/media/v4l2-core/tuner-core.c:405: undefined reference to `xc4000_attach' This was working previously, until the IS_ENABLED() macro was used to replace the construct like #if defined(CONFIG_DVB_CX24110) || (defined(CONFIG_DVB_CX24110_MODULE) && defined(MODULE)) with the difference that the new code no longer checks whether it is being built as a loadable module itself. To fix this, this new patch adds an 'IS_REACHABLE' macro, which evaluates true in exactly the condition that was used previously. The downside of this is that this trades an obvious link error for a more subtle runtime failure, but it is clear that the change that introduced the link error was unintentional and it seems better to revert it for now. Also, a similar change was originally created by Trent Piepho and then reverted by teh change to the IS_ENABLED macro. Ideally Kconfig would be used to avoid the case of a broken dependency, or the code restructured in a way to turn around the dependency, but either way would require much larger changes here. Fixes: 7b34be71db53 ("[media] use IS_ENABLED() macro") See-also: c5dec9fb248e ("V4L/DVB (4751): Fix DBV_FE_CUSTOMISE for card drivers compiled into kernel") Signed-off-by: Arnd Bergmann Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin commit be29be6583683e6e125920cd837141775dde3726 Author: Felipe Balbi Date: Fri Feb 13 15:03:13 2015 -0600 usb: dwc2: hcd: use new USB_RESUME_TIMEOUT [ Upstream commit 74bd7b69801819707713b88e9d0bc074efa2f5e7 ] Make sure we're using the new macro, so our resume signaling will always pass certification. Cc: # v3.10+ Signed-off-by: Felipe Balbi Signed-off-by: Sasha Levin commit 8c8e709d1b1b76b2dcd54b47fe087fd5e622ea3b Author: Yao Xiwei Date: Thu Apr 2 17:31:17 2015 +0200 vti6: fix uninit when using x-netns [ Upstream commit 092a29a40bab8bb4530bb3e58a0597001cdecdef ] When the kernel deleted a vti6 interface, this interface was not removed from the tunnels list. Thus, when the ip6_vti module was removed, this old interface was found and the kernel tried to delete it again. This was leading to a kernel panic. Fixes: 61220ab34948 ("vti6: Enable namespace changing") Signed-off-by: Yao Xiwei Signed-off-by: Nicolas Dichtel Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin commit a8371616145ec2798825a1a3053f9b7c07e42064 Author: Alexander Duyck Date: Tue Mar 31 14:19:10 2015 -0700 jhash: Update jhash_[321]words functions to use correct initval [ Upstream commit 2e7056c433216f406b90a003aa0ba42e19d3bdcf ] Looking over the implementation for jhash2 and comparing it to jhash_3words I realized that the two hashes were in fact very different. Doing a bit of digging led me to "The new jhash implementation" in which lookup2 was supposed to have been replaced with lookup3. In reviewing the patch I noticed that jhash2 had originally initialized a and b to JHASH_GOLDENRATIO and c to initval, but after the patch a, b, and c were initialized to initval + (length << 2) + JHASH_INITVAL. However the changes in jhash_3words simply replaced the initialization of a and b with JHASH_INITVAL. This change corrects what I believe was an oversight so that a, b, and c in jhash_3words all have the same value added consisting of initval + (length << 2) + JHASH_INITVAL so that jhash2 and jhash_3words will now produce the same hash result given the same inputs. Fixes: 60d509c823cca ("The new jhash implementation") Signed-off-by: Alexander Duyck Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit b233a8cbeabd950be93864624cb1741333eea8f4 Author: Konstantin Khlebnikov Date: Thu Apr 2 16:32:15 2015 -0400 ext4: fix bh leak on error paths in ext4_rename() and ext4_cross_rename() [ Upstream commit 7071b715873a66b69a9c0c5839963bb51aeae41b ] Release references to buffer-heads if ext4_journal_start() fails. Fixes: 5b61de757535 ("ext4: start handle at least possible moment when renaming files") Signed-off-by: Konstantin Khlebnikov Signed-off-by: Theodore Ts'o Reviewed-by: Jan Kara Signed-off-by: Sasha Levin commit 405ef57147cc24325ed64f32139eb20e4294f9c5 Author: Daniel Borkmann Date: Fri Mar 27 19:37:41 2015 +0100 netfilter: x_tables: fix cgroup matching on non-full sks [ Upstream commit afb7718016fcb0370ac29a83b2839c78b76c2960 ] While originally only being intended for outgoing traffic, commit a00e76349f35 ("netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks") enabled xt_cgroups for the NF_INET_LOCAL_IN hook as well, in order to allow for nfacct accounting. Besides being currently limited to early demuxes only, commit a00e76349f35 forgot to add a check if we deal with full sockets, i.e. in this case not with time wait sockets. TCP time wait sockets do not have the same memory layout as full sockets, a lower memory footprint and consequently also don't have a sk_classid member; probing for sk_classid member there could potentially lead to a crash. Fixes: a00e76349f35 ("netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks") Cc: Alexey Perevalov Signed-off-by: Daniel Borkmann Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin commit 2ed8cb3d22b59eda73c203412d02add4d0901255 Author: Eric Dumazet Date: Sun Mar 15 21:12:12 2015 -0700 net: add sk_fullsock() helper [ Upstream commit 1d0ab253872cdd3d8e7913f59c266c7fd01771d0 ] We have many places where we want to check if a socket is not a timewait or request socket. Use a helper to avoid hard coding this. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit bb5d5cc637187c20c0e1acadb472078363d83d84 Author: Eric Dumazet Date: Thu Mar 12 16:44:04 2015 -0700 inet: add TCP_NEW_SYN_RECV state [ Upstream commit 10feb428a5045d5eb18a5d755fbb8f0cc9645626 ] TCP_SYN_RECV state is currently used by fast open sockets. Initial TCP requests (the pseudo sockets created when a SYN is received) are not yet associated to a state. They are attached to their parent, and the parent is in TCP_LISTEN state. This commit adds TCP_NEW_SYN_RECV state, so that we can convert TCP stack to a different schem gradually. This state is not exported to user space. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 20cf09ef6745cb91f63cffecce67ab69703a130c Author: Chuck Lever Date: Mon Mar 30 14:34:12 2015 -0400 xprtrdma: Prevent infinite loop in rpcrdma_ep_create() [ Upstream commit 41f97028969e4c88efa5fcf58bc6125210413a6d ] If a provider advertizes a zero max_fast_reg_page_list_len, FRWR depth detection loops forever. Instead of just failing the mount, try other memory registration modes. Fixes: 0fc6c4e7bb28 ("xprtrdma: mind the device's max fast . . .") Reported-by: Devesh Sharma Signed-off-by: Chuck Lever Tested-by: Devesh Sharma Tested-by: Meghana Cheripady Tested-by: Veeresh U. Kokatnur Signed-off-by: Anna Schumaker Signed-off-by: Sasha Levin commit 1b681a5e195f9a75e32b043dc561af3ec68e35da Author: Chuck Lever Date: Wed Jan 21 11:03:27 2015 -0500 xprtrdma: Take struct ib_device_attr off the stack [ Upstream commit 7bc7972cdd1f137552ca979caa11c8acbe119ae8 ] Device attributes are large, and are used in more than one place. Stash a copy in dynamically allocated memory. Signed-off-by: Chuck Lever Reviewed-by: Steve Wise Signed-off-by: Anna Schumaker Signed-off-by: Sasha Levin commit ecac1344fd85f250200a985da208d7d20f54cd3c Author: David Daney Date: Thu Mar 26 10:09:08 2015 -0700 stable_kernel_rules: Add clause about specification of kernel versions to patch. [ Upstream commit fdc81b7910ad5153bf257e5f7861be71f75a02ef ] Signed-off-by: David Daney Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin commit e479bdcf6cd952ee6b54d428d31a027d1c66d7ac Author: Ken Xue Date: Mon Mar 9 17:10:13 2015 +0800 serial: 8250_dw: add support for AMD SOC Carrizo [ Upstream commit 5ef86b74209db33c133b5f18738dd8f3189b63a1 ] Add ACPI identifier for UART on AMD SOC Carrizo. Signed-off-by: Ken Xue Cc: stable Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin commit 7e01b1bacfe148f0d51fc9bc7bfa76ebe2e194dc Author: Feng Kan Date: Fri Dec 5 17:45:57 2014 -0800 serial: 8250: add support for ACPI-probed serial port for X-Gene platform [ Upstream commit 5e1aeea52f6a0763e79473b1767401fda88eb7e1 ] Enable APM X-Gene SoC serial port functionality when using ACPI table to initialize serial port. Signed-off-by: Feng Kan Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin commit 780841321b71d5fc13167260a482ac98ebccd200 Author: Rafael J. Wysocki Date: Tue Nov 4 01:28:56 2014 +0100 Driver core: Unified device properties interface for platform firmware [ Upstream commit b31384fa5de37a100507751dfb5c0a49d06cee67 ] Add a uniform interface by which device drivers can request device properties from the platform firmware by providing a property name and the corresponding data type. The purpose of it is to help to write portable code that won't depend on any particular platform firmware interface. The following general helper functions are added: device_property_present() device_property_read_u8() device_property_read_u16() device_property_read_u32() device_property_read_u64() device_property_read_string() device_property_read_u8_array() device_property_read_u16_array() device_property_read_u32_array() device_property_read_u64_array() device_property_read_string_array() The first one allows the caller to check if the given property is present. The next 5 of them allow single-valued properties of various types to be retrieved in a uniform way. The remaining 5 are for reading properties with multiple values (arrays of either numbers or strings). The interface covers both ACPI and Device Trees. This change set includes material from Mika Westerberg and Aaron Lu. Signed-off-by: Aaron Lu Signed-off-by: Mika Westerberg Acked-by: Greg Kroah-Hartman Acked-by: Grant Likely Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin commit d077c9c398e32a45d94f260c4072917f356c5c4f Author: Mika Westerberg Date: Tue Oct 21 13:33:55 2014 +0200 ACPI: Add support for device specific properties [ Upstream commit ffdcd955c3078af3ce117edcfce80fde1a512bed ] Device Tree is used in many embedded systems to describe the system configuration to the OS. It supports attaching properties or name-value pairs to the devices it describe. With these properties one can pass additional information to the drivers that would not be available otherwise. ACPI is another configuration mechanism (among other things) typically seen, but not limited to, x86 machines. ACPI allows passing arbitrary data from methods but there has not been mechanism equivalent to Device Tree until the introduction of _DSD in the recent publication of the ACPI 5.1 specification. In order to facilitate ACPI usage in systems where Device Tree is typically used, it would be beneficial to standardize a way to retrieve Device Tree style properties from ACPI devices, which is what we do in this patch. If a given device described in ACPI namespace wants to export properties it must implement _DSD method (Device Specific Data, introduced with ACPI 5.1) that returns the properties in a package of packages. For example: Name (_DSD, Package () { ToUUID("daffd814-6eba-4d8c-8a91-bc9bbf4aa301"), Package () { Package () {"name1", }, Package () {"name2", }, ... } }) The UUID reserved for properties is daffd814-6eba-4d8c-8a91-bc9bbf4aa301 and is documented in the ACPI 5.1 companion document called "_DSD Implementation Guide" [1], [2]. We add several helper functions that can be used to extract these properties and convert them to different Linux data types. The ultimate goal is that we only have one device property API that retrieves the requested properties from Device Tree or from ACPI transparent to the caller. [1] http://www.uefi.org/sites/default/files/resources/_DSD-implementation-guide-toplevel.htm [2] http://www.uefi.org/sites/default/files/resources/_DSD-device-properties-UUID.pdf Reviewed-by: Hanjun Guo Reviewed-by: Josh Triplett Reviewed-by: Grant Likely Signed-off-by: Darren Hart Signed-off-by: Rafael J. Wysocki Signed-off-by: Mika Westerberg Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin commit e7bc7f46a93328ef222eb39c4bd645fa028e7c57 Author: David Woodhouse Date: Wed Mar 25 15:05:47 2015 +0000 iommu/vt-d: Allow RMRR on graphics devices too [ Upstream commit 18436afdc11a00ac881990b454cfb2eae81d6003 ] Commit c875d2c1 ("iommu/vt-d: Exclude devices using RMRRs from IOMMU API domains") prevents certain options for devices with RMRRs. This even prevents those devices from getting a 1:1 mapping with 'iommu=pt', because we don't have the code to handle *preserving* the RMRR regions when moving the device between domains. There's already an exclusion for USB devices, because we know the only reason for RMRRs there is a misguided desire to keep legacy keyboard/mouse emulation running in some theoretical OS which doesn't have support for USB in its own right... but which *does* enable the IOMMU. Add an exclusion for graphics devices too, so that 'iommu=pt' works there. We should be able to successfully assign graphics devices to guests too, as long as the initial handling of stolen memory is reconfigured appropriately. This has certainly worked in the past. Signed-off-by: David Woodhouse Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin commit 02211504ffc837f265ab64de5e7b8fb1cf706838 Author: Laura Abbott Date: Tue May 12 10:00:00 2015 -0700 HID: usbhid: Add HID_QUIRK_NOGET for Aten DVI KVM switch [ Upstream commit 849eca7b9dae0364e2fbe8afdf0fb610d12c9c8f ] Like other KVM switches, the Aten DVI KVM switch needs a quirk to avoid spewing errors: [791759.606542] usb 1-5.4: input irq status -75 received [791759.614537] usb 1-5.4: input irq status -75 received [791759.622542] usb 1-5.4: input irq status -75 received Add it. Signed-off-by: Laura Abbott Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit 4ca234a883fdbcbc20e9b6813127c0a5c3aa8b7f Author: Sean Young Date: Wed May 6 21:38:42 2015 +0100 HID: sjoy: support Super Joy Box 4 [ Upstream commit 6e5e9a06a206010eabd19b523fd0833c51afc0b0 ] This device supports force feedback and has two ports. Signed-off-by: Sean Young Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit 7f184d52edad5f06d8bfa1647462c3500ae44755 Author: Raphael Assenat Date: Sat Apr 25 16:30:32 2015 -0400 HID: usbhid: Add a quirk for raphnet multi-gamepad adapters [ Upstream commit d6ea2f88ac3659b799d8079a4fbda4f8faf6ff90 ] The raphnet.net 4nes4snes and 2nes2snes multi-joystick adapters use a single HID report descriptor with one report ID per controller. This has the effect that the inputs of otherwise independent game controllers get packed in one large joystick device. With this patch each controller gets its own /dev/input/jsX device, which is more natural and less confusing than having all inputs going to the same place. Signed-off-by: Raphael Assenat Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit d6a71d132d7d63cc72e00a443174d0bb5e0ba6cf Author: Oliver Neukum Date: Mon Mar 30 12:36:36 2015 +0200 HID: usbhid: yet another mouse with ALWAYS_POLL [ Upstream commit 43faadfe96d3f049f4ae2c4090d2e57b9aafb995 ] The device exists with two device IDs instead of one as previously believed. Signed-off-by: Oliver Neukum Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit 6ec16957394dec27288a2e3ba1bb29486a5a4392 Author: Oliver Neukum Date: Mon Mar 30 12:36:35 2015 +0200 HID: usbhid: more mice with ALWAYS_POLL [ Upstream commit 003e817a9ecf6cfded59630858bbf04056d71e9a ] During a stress test these mice kept dropping and reappearing in runlevel 1 as opposed to 5. Signed-off-by: Oliver Neukum Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit 24bfda0a1aa94793dc27af223daa360e70addbc8 Author: Oliver Neukum Date: Wed Mar 25 15:38:31 2015 +0100 HID: add quirk for PIXART OEM mouse used by HP [ Upstream commit b70b82580248b5393241c986082842ec05a2b7d7 ] This mouse is also known under other IDs. It needs the quirk or will disconnect in runlevel 1 or 3. Signed-off-by: Oliver Neukum CC: stable@vger.kernel.org Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit 1e8b704104c70759fcf5e0c43c500f78e6f99d62 Author: Oliver Neukum Date: Wed Mar 25 15:13:36 2015 +0100 HID: add HP OEM mouse to quirk ALWAYS_POLL [ Upstream commit 7a8e53c414c8183e8735e3b08d9a776200e6e665 ] This mouse needs QUIRK_ALWAYS_POLL. Signed-off-by: Oliver Neukum CC: stable@vger.kernel.org Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit 78a8d61e2f322854b94abc9129baa023f296be3c Author: oliver@neukum.org Date: Tue Mar 10 16:36:22 2015 +0100 HID: add ALWAYS_POLL quirk for a Logitech 0xc007 [ Upstream commit a415457733b5fa40bc996bf1f4df471cd98d3608 ] This device disconnects every 60s without X Signed-off-by: Oliver Neukum Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit bd28e66ce1fb42696c351aad8f736570938a2712 Author: Benjamin Tissoires Date: Tue Sep 30 13:18:27 2014 -0400 HID: Introduce hidpp, a module to handle Logitech hid++ devices [ Upstream commit 2f31c52529103d8f0e1485272064f982d14ce54a ] Logitech devices use a vendor protocol to communicate various information with the device. This protocol is called HID++, and an exerpt can be found here: https://drive.google.com/folderview?id=0BxbRzx7vEV7eWmgwazJ3NUFfQ28&usp=shar The main difficulty which is related to this protocol is that it is a synchronous protocol using the input reports. So when we want to get some information from the device, we need to wait for a matching input report. This driver introduce this capabilities to be able to support the multitouch mode of the Logitech Wireless Touchpad T651 (the bluetooth one). The multitouch data is available directly from the mouse input reports, and we just need to query the device on connect about its caracteristics. HID++ and the touchpad features has a specific reporting mode which uses pure HID++ reports, but Logitech told us not to use it for this specific device. During QA, they detected that some bluetooth input reports where lost, and so the only supported mode is the pointer mode. Signed-off-by: Benjamin Tissoires Tested-by: Andrew de los Reyes Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit e3ca720d51a59952ee762aec150fad77bdf94814 Author: Jakub Sitnicki Date: Sat Feb 21 20:51:08 2015 +0100 HID: microsoft: Add ID for NE7K wireless keyboard [ Upstream commit ef567cf9ddb682dbfa840bf4a2600931299f9555 ] Microsoft Natural Wireless Ergonomic Keyboard 7000 has special My Favorites 1..5 keys which are handled through a vendor-defined usage page (0xff05). Apply MS_ERGONOMY quirks handling to USB PID 0x071d (Microsoft Microsoft 2.4GHz Transceiver V1.0) so that the My Favorites 1..5 keys are reported as KEY_F14..18 events. Link: https://bugzilla.kernel.org/show_bug.cgi?id=52841 Signed-off-by: Jakub Sitnicki Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit 9de88fc607f186c3275d07dbcc52eb49c92671fe Author: Darren Salt Date: Thu Jan 29 13:58:09 2015 +0000 HID: saitek: add USB ID for older R.A.T. 7 [ Upstream commit afe98939b37933ee8c3d0b5c42199d624d0408a6 ] Signed-off-by: Darren Salt Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit b60d62a88aefff1d6768ae065343a4deea10289a Author: Benjamin Tissoires Date: Tue Mar 3 12:44:00 2015 -0500 HID: uclogic: Set quirks from inside the driver [ Upstream commit 70b69cfb88467988116c4863056495fa3615271a ] Based on a patch from: Nikolai Kondrashov Most of the tablets handled by hid-uclogic already use MULTI_INPUT. For the ones which are not quirked in usbhid/hidquirks, they have a custom report descriptor which contains only one report per HID interface. For those tablets HID_QUIRK_MULTI_INPUT is transparent. According to https://github.com/DIGImend/tablets, the only problematic tablet currently handled by hid-uclogic is the TWHA60 v3. This tablet presents different report descriptors from the ones currently quirked. This is not a problem per se, given that this tablet is not supported currently in this version (it needs the same command as a Huion to start forwarding events). Reviewed-by: Nikolai Kondrashov Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit 1b9aa6328cac6f9dfb89d599f924804728c730e4 Author: Milan Plzik Date: Sat Feb 14 09:48:44 2015 +0100 HID: kye: Fix report descriptor for Genius PenSketch M912 [ Upstream commit feb6faf1e5d46276c5430e36ffb4a6f62bf8d55b ] Genius PenSketch M912 digitizer tablet sends incorrect report descriptor by default. This patch replaces it with a corrected one. Signed-off-by: Milan Plzik Reviewed-by: Nikolai Kondrashov Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin commit 30d9579a8d247be45451e88c191f6a086c67558e Author: Baruch Siach Date: Mon Mar 9 19:20:30 2015 +0200 pinctrl: fix example .get_group_pins implementation signature [ Upstream commit 838d030bda9e2da5f9dcf7251f4e117c6258cb2f ] The callback function signature has changed in commit a5818a8bd0 (pinctrl: get_group_pins() const fixes) Fixes: a5818a8bd0 ('pinctrl: get_group_pins() const fixes') Cc: Stephen Warren Signed-off-by: Baruch Siach Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin commit 0c78a3bb18e5d04af72de773db15651f37a99977 Author: Baruch Siach Date: Sun Mar 8 10:51:46 2015 +0200 pinctrl: remove doc mention of the enable/disable API [ Upstream commit b18104c00089c73f2b70790765d40424a4f9b65f ] This API has changed in commit 6e5e959dde0 (pinctrl: API changes to support multiple states per device). Fixes: 6e5e959dde0 ('pinctrl: API changes to support multiple states per device') Cc: Stephen Warren Signed-off-by: Baruch Siach Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin commit 66533089f5d7858271cfd260d6e47a2fee5692ff Author: Baruch Siach Date: Sun Mar 8 10:51:45 2015 +0200 pinctrl: remove enable/disable callbacks from documentation [ Upstream commit 260463d4921468b9c0c018695ab09b3c2d15345b ] Commit 03e9f0cac5d (pinctrl: clean up after enable refactoring) updated the documentation to remove mention of disable(), and rename enable() to set_mux(). One in-text mention was forgotten. Fix this. Fixes: 03e9f0cac5d ('pinctrl: clean up after enable refactoring') Signed-off-by: Baruch Siach Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin commit 82401a7cd34576cdeb6a8351389026001e2c5e05 Author: Simon Horman Date: Thu Mar 12 12:55:37 2015 +0900 ARM: shmobile: r8a7791: Correct SYSCIER value [ Upstream commit 78420b5dca18f2034f18925f5608cda2c960c3f3 ] Set the SYSCIER as per the values indicated in the documentation. The value previously used appears to been copied from the r8a7779 implementation but on closer inspection is not correct for the r8a7791. Fixes: 5f6108bb9643 ("ARM: shmobile: r8a7791 SYSC setup code") Reported-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Signed-off-by: Simon Horman Signed-off-by: Sasha Levin commit 0c278fb4d7f7e6081f1727a0be8a0837472a6780 Author: Simon Horman Date: Thu Mar 12 12:55:36 2015 +0900 ARM: shmobile: r8a7790: Correct SYSCIER value [ Upstream commit ee72f6adfdd95b53432eb60b6944c6fe2790dd13 ] Set the SYSCIER as per the values indicated in the documentation. The value previously used appears to been copied from the r8a7779 implementation but on closer inspection is not correct for the r8a7790. Fixes: a48f165509c1 ("ARM: shmobile: r8a7790 SYSC setup code") Reported-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Signed-off-by: Simon Horman Signed-off-by: Sasha Levin commit 6b33b647b311e987e9469b559f9d75fcf1ffb1c8 Author: Baruch Siach Date: Mon Mar 2 16:55:02 2015 +0200 pinctrl: remove maxpin from documentation [ Upstream commit 939417bd8b909ae34a3b2106531594f5115eaea5 ] struct pinctrl_desc does not contain the maxpin member since commit 0d2006bbf0 (pinctrl: remove unnecessary max pin number). Fixes: 0d2006bbf0 ('pinctrl: remove unnecessary max pin number') Signed-off-by: Baruch Siach Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin commit 0fd122c0ee983f587ead3d9455328e7daf4686b4 Author: Uwe Kleine-König Date: Tue Feb 24 11:17:05 2015 +0100 serial: imx: Fix clearing of receiver overrun flag [ Upstream commit 91555ce9012557b2d621d7b0b6ec694218a2a9bc ] The writeable bits in the USR2 register are all "write 1 to clear" so only write the bits that actually should be cleared. Fixes: f1f836e4209e ("serial: imx: Add Rx Fifo overrun error message") Signed-off-by: Uwe Kleine-König Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin commit d96fc14e0db21d293b0a7599f9741d68fae59812 Author: Jiada Wang Date: Tue Dec 9 18:11:34 2014 +0900 serial: imx: Enable UCR4_OREN in startup interface [ Upstream commit 6f026d6b7cb6e019b6352ed7fb71497c787fd6d7 ] Other than enable Receiver Overrun Interrupt Enable (UCR4_OREN) in start_tx interface, UCR4_OREN should be enabled before enable of Receiver. Signed-off-by: Jiada Wang Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin commit 3d96a48ac855e5491fbd54b23664e2b2b9ce64b5 Author: Max Filippov Date: Fri Feb 27 06:28:00 2015 +0300 xtensa: xtfpga: fix hardware lockup caused by LCD driver [ Upstream commit 4949009eb8d40a441dcddcd96e101e77d31cf1b2 ] LCD driver is always built for the XTFPGA platform, but its base address is not configurable, and is wrong for ML605/KC705. Its initialization locks up KC705 board hardware. Make the whole driver optional, and its base address and bus width configurable. Implement 4-bit bus access method. Cc: stable@vger.kernel.org Signed-off-by: Max Filippov Signed-off-by: Sasha Levin commit 5c849cf547bc4042adf48d5297d4db31ce7af6d1 Author: Simon Horman Date: Thu Jan 29 10:41:24 2015 +0900 ARM: shmobile: r8a7791: Correct SDHI clock labels and output-names [ Upstream commit 2ea0d4ec39ac837e34c07b4783a7c900940e6eaf ] There appears to have been some inconsistency and confusion here as on the r8a7790 these clocks are referred to as SD(HI)1 and SD(HI)2 while on the r8a7791 and r8a7794 they are referred to as SD(HI)2 and SD(HI)3. Fixes: 59e79895b95892863 ("ARM: shmobile: r8a7791: Add clocks") Reported-by: Geert Uytterhoeven Signed-off-by: Simon Horman Acked-by: Geert Uytterhoeven Signed-off-by: Sasha Levin commit 4a46458b79c1db093ee7c61b634e5bef0e75f10e Author: Yoshihiro Shimoda Date: Mon Nov 17 18:25:25 2014 +0900 ARM: shmobile: r8a7791: add USBDMAC{0,1} clocks to device tree [ Upstream commit b9473d9f621b68327776b66d4b9a8ba5e0b8b4cb ] Signed-off-by: Yoshihiro Shimoda Acked-by: Geert Uytterhoeven Signed-off-by: Simon Horman Signed-off-by: Sasha Levin commit 90b934b19c15a1f1a8140e93af719cb741e4cf40 Author: Mel Gorman Date: Thu Jun 18 16:54:44 2015 -0700 sched, numa: Do not hint for NUMA balancing on VM_MIXEDMAP mappings commit 8e76d4eecf7afeec9328e21cd5880e281838d0d6 upstream. Jovi Zhangwei reported the following problem Below kernel vm bug can be triggered by tcpdump which mmaped a lot of pages with GFP_COMP flag. [Mon May 25 05:29:33 2015] page:ffffea0015414000 count:66 mapcount:1 mapping: (null) index:0x0 [Mon May 25 05:29:33 2015] flags: 0x20047580004000(head) [Mon May 25 05:29:33 2015] page dumped because: VM_BUG_ON_PAGE(compound_order(page) && !PageTransHuge(page)) [Mon May 25 05:29:33 2015] ------------[ cut here ]------------ [Mon May 25 05:29:33 2015] kernel BUG at mm/migrate.c:1661! [Mon May 25 05:29:33 2015] invalid opcode: 0000 [#1] SMP In this case it was triggered by running tcpdump but it's not necessary reproducible on all systems. sudo tcpdump -i bond0.100 'tcp port 4242' -c 100000000000 -w 4242.pcap Compound pages cannot be migrated and it was not expected that such pages be marked for NUMA balancing. This did not take into account that drivers such as net/packet/af_packet.c may insert compound pages into userspace with vm_insert_page. This patch tells the NUMA balancing protection scanner to skip all VM_MIXEDMAP mappings which avoids the possibility that compound pages are marked for migration. Signed-off-by: Mel Gorman Reported-by: Jovi Zhangwei Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds [jovi: Backported to 3.18: adjust context] Signed-off-by: Jovi Zhangwei Signed-off-by: Sasha Levin commit 3ca9f5f9f498a7db78949c9573d95de24fcfde73 Author: Ilya Dryomov Date: Tue Apr 14 16:04:23 2015 +0300 crush: ensuring at most num-rep osds are selected [ Upstream commit 45002267e8d2699bf9b022315bee3dd13b044843 ] Crush temporary buffers are allocated as per replica size configured by the user. When there are more final osds (to be selected as per rule) than the replicas, buffer overlaps and it causes crash. Now, it ensures that at most num-rep osds are selected even if more number of osds are allowed by the rule. Reflects ceph.git commits 6b4d1aa99718e3b367496326c1e64551330fabc0, 234b066ba04976783d15ff2abc3e81b6cc06fb10. Signed-off-by: Ilya Dryomov Signed-off-by: Sasha Levin commit b824a7f09eb82df2f54774e95c284a0d72eb58af Author: Nikolay Aleksandrov Date: Sat Jun 6 06:49:00 2015 -0700 bridge: disable softirqs around br_fdb_update to avoid lockup [ Upstream commit c4c832f89dc468cf11dc0dd17206bace44526651 ] br_fdb_update() can be called in process context in the following way: br_fdb_add() -> __br_fdb_add() -> br_fdb_update() (if NTF_USE flag is set) so we need to disable softirqs because there are softirq users of the hash_lock. One easy way to reproduce this is to modify the bridge utility to set NTF_USE, enable stp and then set maxageing to a low value so br_fdb_cleanup() is called frequently and then just add new entries in a loop. This happens because br_fdb_cleanup() is called from timer/softirq context. The spin locks in br_fdb_update were _bh before commit f8ae737deea1 ("[BRIDGE]: forwarding remove unneeded preempt and bh diasables") and at the time that commit was correct because br_fdb_update() couldn't be called from process context, but that changed after commit: 292d1398983f ("bridge: add NTF_USE support") Using local_bh_disable/enable around br_fdb_update() allows us to keep using the spin_lock/unlock in br_fdb_update for the fast-path. Signed-off-by: Nikolay Aleksandrov Fixes: 292d1398983f ("bridge: add NTF_USE support") Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit f938f18c8c6babf8200ea1007b20ea784aae243f Author: Sriharsha Basavapatna Date: Fri Jun 5 15:33:59 2015 +0530 be2net: Replace dma/pci_alloc_coherent() calls with dma_zalloc_coherent() [ Upstream commit e51000db4c880165eab06ec0990605f24e75203f ] There are several places in the driver (all in control paths) where coherent dma memory is being allocated using either dma_alloc_coherent() or the deprecated pci_alloc_consistent(). All these calls should be changed to use dma_zalloc_coherent() to avoid uninitialized fields in data structures backed by this memory. Reported-by: Joerg Roedel Tested-by: Joerg Roedel Signed-off-by: Sriharsha Basavapatna Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit eee3f32977fe915c59a5abf5e312d66ac387d389 Author: Shawn Bohrer Date: Wed Jun 3 16:27:38 2015 -0500 ipv4/udp: Verify multicast group is ours in upd_v4_early_demux() [ Upstream commit 6e540309326188f769e03bb4c6dd8ff6752930c2 ] 421b3885bf6d56391297844f43fb7154a6396e12 "udp: ipv4: Add udp early demux" introduced a regression that allowed sockets bound to INADDR_ANY to receive packets from multicast groups that the socket had not joined. For example a socket that had joined 224.168.2.9 could also receive packets from 225.168.2.9 despite not having joined that group if ip_early_demux is enabled. Fix this by calling ip_check_mc_rcu() in udp_v4_early_demux() to verify that the multicast packet is indeed ours. Signed-off-by: Shawn Bohrer Reported-by: Yurij M. Plotnikov Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit fe38ed618ce5e0f8c7f7e9f47497c3637a0ffbd2 Author: Ian Campbell Date: Mon Jun 1 11:30:24 2015 +0100 xen: netback: read hotplug script once at start of day. [ Upstream commit 31a418986a5852034d520a5bab546821ff1ccf3d ] When we come to tear things down in netback_remove() and generate the uevent it is possible that the xenstore directory has already been removed (details below). In such cases netback_uevent() won't be able to read the hotplug script and will write a xenstore error node. A recent change to the hypervisor exposed this race such that we now sometimes lose it (where apparently we didn't ever before). Instead read the hotplug script configuration during setup and use it for the lifetime of the backend device. The apparently more obvious fix of moving the transition to state=Closed in netback_remove() to after the uevent does not work because it is possible that we are already in state=Closed (in reaction to the guest having disconnected as it shutdown). Being already in Closed means the toolstack is at liberty to start tearing down the xenstore directories. In principal it might be possible to arrange to unregister the device sooner (e.g on transition to Closing) such that xenstore would still be there but this state machine is fragile and prone to anger... A modern Xen system only relies on the hotplug uevent for driver domains, when the backend is in the same domain as the toolstack it will run the necessary setup/teardown directly in the correct sequence wrt xenstore changes. Signed-off-by: Ian Campbell Acked-by: Wei Liu Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 189debb56afd572f29cbd35abea68b4391185627 Author: Neal Cardwell Date: Fri May 29 13:47:07 2015 -0400 tcp: fix child sockets to use system default congestion control if not set [ Upstream commit 9f950415e4e28e7cfae2e416b43e862e8101d996 ] Linux 3.17 and earlier are explicitly engineered so that if the app doesn't specifically request a CC module on a listener before the SYN arrives, then the child gets the system default CC when the connection is established. See tcp_init_congestion_control() in 3.17 or earlier, which says "if no choice made yet assign the current value set as default". The change ("net: tcp: assign tcp cong_ops when tcp sk is created") altered these semantics, so that children got their parent listener's congestion control even if the system default had changed after the listener was created. This commit returns to those original semantics from 3.17 and earlier, since they are the original semantics from 2007 in 4d4d3d1e8 ("[TCP]: Congestion control initialization."), and some Linux congestion control workflows depend on that. In summary, if a listener socket specifically sets TCP_CONGESTION to "x", or the route locks the CC module to "x", then the child gets "x". Otherwise the child gets current system default from net.ipv4.tcp_congestion_control. That's the behavior in 3.17 and earlier, and this commit restores that. Fixes: 55d8694fa82c ("net: tcp: assign tcp cong_ops when tcp sk is created") Cc: Florian Westphal Cc: Daniel Borkmann Cc: Glenn Judd Cc: Stephen Hemminger Signed-off-by: Neal Cardwell Signed-off-by: Eric Dumazet Signed-off-by: Yuchung Cheng Acked-by: Daniel Borkmann Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit ee4ab7d8328b0a505d376b6c08d569778c8689af Author: Eric Dumazet Date: Sat May 30 09:16:53 2015 -0700 udp: fix behavior of wrong checksums [ Upstream commit beb39db59d14990e401e235faf66a6b9b31240b0 ] We have two problems in UDP stack related to bogus checksums : 1) We return -EAGAIN to application even if receive queue is not empty. This breaks applications using edge trigger epoll() 2) Under UDP flood, we can loop forever without yielding to other processes, potentially hanging the host, especially on non SMP. This patch is an attempt to make things better. We might in the future add extra support for rt applications wanting to better control time spent doing a recv() in a hostile environment. For example we could validate checksums before queuing packets in socket receive queue. Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit f1394a1d369b927534929c08f209c0237a89420d Author: Eric Dumazet Date: Thu May 28 04:42:54 2015 -0700 bridge: fix br_multicast_query_expired() bug [ Upstream commit 71d9f6149cac8fc6646adfb2a6f3b0de6ddd23f6 ] br_multicast_query_expired() querier argument is a pointer to a struct bridge_mcast_querier : struct bridge_mcast_querier { struct br_ip addr; struct net_bridge_port __rcu *port; }; Intent of the code was to clear port field, not the pointer to querier. Fixes: 2cd4143192e8 ("bridge: memorize and export selected IGMP/MLD querier port") Signed-off-by: Eric Dumazet Acked-by: Thadeu Lima de Souza Cascardo Acked-by: Linus Lüssing Cc: Linus Lüssing Cc: Steinar H. Gunderson Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit a36102b2bb069c858a4be3457ba288208b4662b0 Author: Jason Gunthorpe Date: Tue May 26 17:30:17 2015 -0600 sctp: Fix mangled IPv4 addresses on a IPv6 listening socket [ Upstream commit 9302d7bb0c5cd46be5706859301f18c137b2439f ] sctp_v4_map_v6 was subtly writing and reading from members of a union in a way the clobbered data it needed to read before it read it. Zeroing the v6 flowinfo overwrites the v4 sin_addr with 0, meaning that every place that calls sctp_v4_map_v6 gets ::ffff:0.0.0.0 as the result. Reorder things to guarantee correct behaviour no matter what the union layout is. This impacts user space clients that open an IPv6 SCTP socket and receive IPv4 connections. Prior to 299ee user space would see a sockaddr with AF_INET and a correct address, after 299ee the sockaddr is AF_INET6, but the address is wrong. Fixes: 299ee123e198 (sctp: Fixup v4mapped behaviour to comply with Sock API) Signed-off-by: Jason Gunthorpe Acked-by: Daniel Borkmann Acked-by: Neil Horman Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 4b72bd1886b316b05349331d62ae0886b78cedd9 Author: WANG Cong Date: Tue May 26 16:08:48 2015 -0700 net_sched: invoke ->attach() after setting dev->qdisc [ Upstream commit 86e363dc3b50bfd50a1f315934583fbda673ab8d ] For mq qdisc, we add per tx queue qdisc to root qdisc for display purpose, however, that happens too early, before the new dev->qdisc is finally set, this causes q->list points to an old root qdisc which is going to be freed right before assigning with a new one. Fix this by moving ->attach() after setting dev->qdisc. For the record, this fixes the following crash: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 975 at lib/list_debug.c:59 __list_del_entry+0x5a/0x98() list_del corruption. prev->next should be ffff8800d1998ae8, but was 6b6b6b6b6b6b6b6b CPU: 1 PID: 975 Comm: tc Not tainted 4.1.0-rc4+ #1019 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 0000000000000009 ffff8800d73fb928 ffffffff81a44e7f 0000000047574756 ffff8800d73fb978 ffff8800d73fb968 ffffffff810790da ffff8800cfc4cd20 ffffffff814e725b ffff8800d1998ae8 ffffffff82381250 0000000000000000 Call Trace: [] dump_stack+0x4c/0x65 [] warn_slowpath_common+0x9c/0xb6 [] ? __list_del_entry+0x5a/0x98 [] warn_slowpath_fmt+0x46/0x48 [] ? dev_graft_qdisc+0x5e/0x6a [] __list_del_entry+0x5a/0x98 [] list_del+0xe/0x2d [] qdisc_list_del+0x1e/0x20 [] qdisc_destroy+0x30/0xd6 [] qdisc_graft+0x11d/0x243 [] tc_get_qdisc+0x1a6/0x1d4 [] ? mark_lock+0x2e/0x226 [] rtnetlink_rcv_msg+0x181/0x194 [] ? rtnl_lock+0x17/0x19 [] ? rtnl_lock+0x17/0x19 [] ? __rtnl_unlock+0x17/0x17 [] netlink_rcv_skb+0x4d/0x93 [] rtnetlink_rcv+0x26/0x2d [] netlink_unicast+0xcb/0x150 [] ? might_fault+0x59/0xa9 [] netlink_sendmsg+0x4fa/0x51c [] sock_sendmsg_nosec+0x12/0x1d [] sock_sendmsg+0x29/0x2e [] ___sys_sendmsg+0x1b4/0x23a [] ? native_sched_clock+0x35/0x37 [] ? sched_clock_local+0x12/0x72 [] ? sched_clock_cpu+0x9e/0xb7 [] ? current_kernel_time+0xe/0x32 [] ? lock_release_holdtime.part.29+0x71/0x7f [] ? read_seqcount_begin.constprop.27+0x5f/0x76 [] ? trace_hardirqs_on_caller+0x17d/0x199 [] ? __fget_light+0x50/0x78 [] __sys_sendmsg+0x42/0x60 [] SyS_sendmsg+0x12/0x1c [] system_call_fastpath+0x12/0x6f ---[ end trace ef29d3fb28e97ae7 ]--- For long term, we probably need to clean up the qdisc_graft() code in case it hides other bugs like this. Fixes: 95dc19299f74 ("pkt_sched: give visibility to mq slave qdiscs") Cc: Jamal Hadi Salim Signed-off-by: Cong Wang Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 688497a2e8db77d26d4944cead7d87dc719c3fa1 Author: Ross Lagerwall Date: Wed May 27 11:44:32 2015 +0100 xen/netback: Properly initialize credit_bytes [ Upstream commit ce0e5c522d3924090c20e774359809a7aa08c44c ] Commit e9ce7cb6b107 ("xen-netback: Factor queue-specific data into queue struct") introduced a regression when moving queue-specific data into the queue struct by failing to set the credit_bytes field. This prevented bandwidth limiting from working. Initialize the field as it was done before multiqueue support was added. Signed-off-by: Ross Lagerwall Acked-by: Wei Liu Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit b991285c5f73cef701c9e81418af4b6eaa322567 Author: Mark Salyzyn Date: Tue May 26 08:22:19 2015 -0700 unix/caif: sk_socket can disappear when state is unlocked [ Upstream commit b48732e4a48d80ed4a14812f0bab09560846514e ] got a rare NULL pointer dereference in clear_bit Signed-off-by: Mark Salyzyn Acked-by: Hannes Frederic Sowa ---- v2: switch to sock_flag(sk, SOCK_DEAD) and added net/caif/caif_socket.c v3: return -ECONNRESET in upstream caller of wait function for SOCK_DEAD Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 21efd84e1033d65507096025e3867f7385e95ef5 Author: Richard Cochran Date: Mon May 25 11:55:45 2015 +0200 net: dp83640: fix improper double spin locking. [ Upstream commit adbe088f6f8b0b7701fe07f51fe6f2bd602a6665 ] A pair of nested spin locks was introduced in commit 63502b8d0 "dp83640: Fix receive timestamp race condition". Unfortunately the 'flags' parameter was reused for the inner lock, clobbering the originally saved IRQ state. This patch fixes the issue by changing the inner lock to plain spin_lock without irqsave. Signed-off-by: Richard Cochran Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit adbea7ba29a526964bd5f5e1186f198f47f540a5 Author: Richard Cochran Date: Mon May 25 11:55:44 2015 +0200 net: dp83640: reinforce locking rules. [ Upstream commit a935865c828c8cd20501f618c69f659a5b6d6a5f ] Callers of the ext_write function are supposed to hold a mutex that protects the state of the dialed page, but one caller was missing the lock from the very start, and over time the code has been changed without following the rule. This patch cleans up the call sites in violation of the rule. Signed-off-by: Richard Cochran Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 33f099e8721a9a0c8b5640da81f4163bdb78f597 Author: Richard Cochran Date: Mon May 25 11:55:43 2015 +0200 net: dp83640: fix broken calibration routine. [ Upstream commit 397a253af5031de4a4612210055935309af4472c ] Currently, the calibration function that corrects the initial offsets among multiple devices only works the first time. If the function is called more than once, the calibration fails and bogus offsets will be programmed into the devices. In a well hidden spot, the device documentation tells that trigger indexes 0 and 1 are special in allowing the TRIG_IF_LATE flag to actually work. This patch fixes the issue by using one of the special triggers during the recalibration method. Signed-off-by: Richard Cochran Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit b1c6cc17a1faac52b22e7597a1cc16d41a9381f4 Author: Thadeu Lima de Souza Cascardo Date: Fri May 22 12:18:59 2015 -0300 bridge: fix parsing of MLDv2 reports [ Upstream commit 47cc84ce0c2fe75c99ea5963c4b5704dd78ead54 ] When more than a multicast address is present in a MLDv2 report, all but the first address is ignored, because the code breaks out of the loop if there has not been an error adding that address. This has caused failures when two guests connected through the bridge tried to communicate using IPv6. Neighbor discoveries would not be transmitted to the other guest when both used a link-local address and a static address. This only happens when there is a MLDv2 querier in the network. The fix will only break out of the loop when there is a failure adding a multicast address. The mdb before the patch: dev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp dev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp dev ovirtmgmt port bond0.86 grp ff02::2 temp After the patch: dev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp dev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp dev ovirtmgmt port bond0.86 grp ff02::fb temp dev ovirtmgmt port bond0.86 grp ff02::2 temp dev ovirtmgmt port bond0.86 grp ff02::d temp dev ovirtmgmt port vnet0 grp ff02::1:ff00:76 temp dev ovirtmgmt port bond0.86 grp ff02::16 temp dev ovirtmgmt port vnet1 grp ff02::1:ff00:77 temp dev ovirtmgmt port bond0.86 grp ff02::1:ff00:def temp dev ovirtmgmt port bond0.86 grp ff02::1:ffa1:40bf temp Fixes: 08b202b67264 ("bridge br_multicast: IPv6 MLD support.") Reported-by: Rik Theys Signed-off-by: Thadeu Lima de Souza Cascardo Tested-by: Rik Theys Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 842e6e8fe4c5e2fb62abe3a4ba5b213999d39eb3 Author: Bjørn Mork Date: Fri May 22 13:15:22 2015 +0200 cdc_ncm: Fix tx_bytes statistics [ Upstream commit 44f6731d8b68fa02f5ed65eaceac41f8c3c9279e ] The tx_curr_frame_payload field is u32. When we try to calculate a small negative delta based on it, we end up with a positive integer close to 2^32 instead. So the tx_bytes pointer increases by about 2^32 for every transmitted frame. Fix by calculating the delta as a signed long. Cc: Ben Hutchings Reported-by: Florian Bruhin Fixes: 7a1e890e2168 ("usbnet: Fix tx_bytes statistic running backward in cdc_ncm") Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit fd92b07cb49f8d64efbf25bd344ab1855100b3ad Author: Eric W. Biederman Date: Fri May 22 04:58:12 2015 -0500 ipv4: Avoid crashing in ip_error [ Upstream commit 381c759d9916c42959515ad34a6d467e24a88e93 ] ip_error does not check if in_dev is NULL before dereferencing it. IThe following sequence of calls is possible: CPU A CPU B ip_rcv_finish ip_route_input_noref() ip_route_input_slow() inetdev_destroy() dst_input() With the result that a network device can be destroyed while processing an input packet. A crash was triggered with only unicast packets in flight, and forwarding enabled on the only network device. The error condition was created by the removal of the network device. As such it is likely the that error code was -EHOSTUNREACH, and the action taken by ip_error (if in_dev had been accessible) would have been to not increment any counters and to have tried and likely failed to send an icmp error as the network device is going away. Therefore handle this weird case by just dropping the packet if !in_dev. It will result in dropping the packet sooner, and will not result in an actual change of behavior. Fixes: 251da4130115b ("ipv4: Cache ip_error() routes even when not forwarding.") Reported-by: Vittorio Gambaletta Tested-by: Vittorio Gambaletta Signed-off-by: Vittorio Gambaletta Signed-off-by: "Eric W. Biederman" Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit f9a17e86e8f0cf87ca42ccf7dced3e34cc4d699f Author: Daniel Borkmann Date: Wed May 20 17:13:33 2015 +0200 net: sched: fix call_rcu() race on classifier module unloads [ Upstream commit c78e1746d3ad7d548bdf3fe491898cc453911a49 ] Vijay reported that a loop as simple as ... while true; do tc qdisc add dev foo root handle 1: prio tc filter add dev foo parent 1: u32 match u32 0 0 flowid 1 tc qdisc del dev foo root rmmod cls_u32 done ... will panic the kernel. Moreover, he bisected the change apparently introducing it to 78fd1d0ab072 ("netlink: Re-add locking to netlink_lookup() and seq walker"). The removal of synchronize_net() from the netlink socket triggering the qdisc to be removed, seems to have uncovered an RCU resp. module reference count race from the tc API. Given that RCU conversion was done after e341694e3eb5 ("netlink: Convert netlink_lookup() to use RCU protected hash table") which added the synchronize_net() originally, occasion of hitting the bug was less likely (not impossible though): When qdiscs that i) support attaching classifiers and, ii) have at least one of them attached, get deleted, they invoke tcf_destroy_chain(), and thus call into ->destroy() handler from a classifier module. After RCU conversion, all classifier that have an internal prio list, unlink them and initiate freeing via call_rcu() deferral. Meanhile, tcf_destroy() releases already reference to the tp->ops->owner module before the queued RCU callback handler has been invoked. Subsequent rmmod on the classifier module is then not prevented since all module references are already dropped. By the time, the kernel invokes the RCU callback handler from the module, that function address is then invalid. One way to fix it would be to add an rcu_barrier() to unregister_tcf_proto_ops() to wait for all pending call_rcu()s to complete. synchronize_rcu() is not appropriate as under heavy RCU callback load, registered call_rcu()s could be deferred longer than a grace period. In case we don't have any pending call_rcu()s, the barrier is allowed to return immediately. Since we came here via unregister_tcf_proto_ops(), there are no users of a given classifier anymore. Further nested call_rcu()s pointing into the module space are not being done anywhere. Only cls_bpf_delete_prog() may schedule a work item, to unlock pages eventually, but that is not in the range/context of cls_bpf anymore. Fixes: 25d8c0d55f24 ("net: rcu-ify tcf_proto") Fixes: 9888faefe132 ("net: sched: cls_basic use RCU") Reported-by: Vijay Subramanian Signed-off-by: Daniel Borkmann Cc: John Fastabend Cc: Eric Dumazet Cc: Thomas Graf Cc: Jamal Hadi Salim Cc: Alexei Starovoitov Tested-by: Vijay Subramanian Acked-by: Alexei Starovoitov Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 359aeb0ae4a0e461368d7859ceb79086901dea7e Author: Henning Rogge Date: Mon May 18 21:08:49 2015 +0200 net/ipv6/udp: Fix ipv6 multicast socket filter regression [ Upstream commit 33b4b015e1a1ca7a8fdce40af5e71642a8ea355c ] Commit <5cf3d46192fc> ("udp: Simplify__udp*_lib_mcast_deliver") simplified the filter for incoming IPv6 multicast but removed the check of the local socket address and the UDP destination address. This patch restores the filter to prevent sockets bound to a IPv6 multicast IP to receive other UDP traffic link unicast. Signed-off-by: Henning Rogge Fixes: 5cf3d46192fc ("udp: Simplify__udp*_lib_mcast_deliver") Cc: "David S. Miller" Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit dc3c6cb6eb811e8e27ff0acefb2cc7d16b1b976b Author: Florent Fourcot Date: Sat May 16 00:24:59 2015 +0200 tcp/ipv6: fix flow label setting in TIME_WAIT state [ Upstream commit 21858cd02dabcf290564cbf4769b101eba54d7bb ] commit 1d13a96c74fc ("ipv6: tcp: fix flowlabel value in ACK messages send from TIME_WAIT") added the flow label in the last TCP packets. Unfortunately, it was not casted properly. This patch replace the buggy shift with be32_to_cpu/cpu_to_be32. Fixes: 1d13a96c74fc ("ipv6: tcp: fix flowlabel value in ACK messages") Reported-by: Eric Dumazet Signed-off-by: Florent Fourcot Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 984ff7a3e0603d4bc472ad09f4f119089085d8ca Author: Nicolas Dichtel Date: Wed May 13 14:19:42 2015 +0200 rtnl/bond: don't send rtnl msg for unregistered iface [ Upstream commit ed2a80ab7b76f11af0b2c6255709c4ebf164b667 ] Before the patch, the command 'ip link add bond2 type bond mode 802.3ad' causes the kernel to send a rtnl message for the bond2 interface, with an ifindex 0. 'ip monitor' shows: 0: bond2: mtu 1500 state DOWN group default link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff 9: bond2@NONE: mtu 1500 qdisc noop state DOWN group default link/ether ea:3e:1f:53:92:7b brd ff:ff:ff:ff:ff:ff [snip] The patch fixes the spotted bug by checking in bond driver if the interface is registered before calling the notifier chain. It also adds a check in rtmsg_ifinfo() to prevent this kind of bug in the future. Fixes: d4261e565000 ("bonding: create netlink event when bonding option is changed") CC: Jiri Pirko Reported-by: Julien Meunier Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit b23b97ca70a9fe03bb3e3e74bc8d120b0e15e4fb Author: Florian Fainelli Date: Fri May 15 16:30:41 2015 -0700 net: phy: Allow EEE for all RGMII variants [ Upstream commit 7e14069651591c81046ffaec13c3dac8cb70f5fb ] RGMII interfaces come in multiple flavors: RGMII with transmit or receive internal delay, no delays at all, or delays in both direction. This change extends the initial check for PHY_INTERFACE_MODE_RGMII to cover all of these variants since EEE should be allowed for any of these modes, since it is a property of the RGMII, hence Gigabit PHY capability more than the RGMII electrical interface and its delays. Fixes: a59a4d192166 ("phy: add the EEE support and the way to access to the MMD registers") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 645995e2934706449c4214a3f0f881d6c7fbc5fe Author: Alexei Starovoitov Date: Fri May 22 15:42:55 2015 -0700 x86: bpf_jit: fix compilation of large bpf programs [ Upstream commit 3f7352bf21f8fd7ba3e2fcef9488756f188e12be ] x86 has variable length encoding. x86 JIT compiler is trying to pick the shortest encoding for given bpf instruction. While doing so the jump targets are changing, so JIT is doing multiple passes over the program. Typical program needs 3 passes. Some very short programs converge with 2 passes. Large programs may need 4 or 5. But specially crafted bpf programs may hit the pass limit and if the program converges on the last iteration the JIT compiler will be producing an image full of 'int 3' insns. Fix this corner case by doing final iteration over bpf program. Fixes: 0a14842f5a3c ("net: filter: Just In Time compiler for x86-64") Reported-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Tested-by: Daniel Borkmann Acked-by: Daniel Borkmann Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 8cf633a242cb01b9cea77604337bc9801c3eb5ae Author: Alexei Starovoitov Date: Mon May 11 23:25:16 2015 -0700 x86: bpf_jit: fix FROM_BE16 and FROM_LE16/32 instructions [ Upstream commit 343f845b375989f1753f605902931fa939aa2223 ] FROM_BE16: 'ror %reg, 8' doesn't clear upper bits of the register, so use additional 'movzwl' insn to zero extend 16 bits into 64 FROM_LE16: should zero extend lower 16 bits into 64 bit FROM_LE32: should zero extend lower 32 bits into 64 bit Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets") Signed-off-by: Alexei Starovoitov Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit 5d2ed1cd21b16a83059eeb217a562de52239d003 Author: Vlad Yasevich Date: Sat May 2 21:33:44 2015 -0400 net: core: Correct an over-stringent device loop detection. [ Upstream commit d66bf7dd27573ee5ea90484899ee952c19ccb194 ] The code in __netdev_upper_dev_link() has an over-stringent loop detection logic that actually prevents valid configurations from working correctly. In particular, the logic returns an error if an upper device is already in the list of all upper devices for a given dev. This particular check seems to be a overzealous as it disallows perfectly valid configurations. For example: # ip l a link eth0 name eth0.10 type vlan id 10 # ip l a dev br0 typ bridge # ip l s eth0.10 master br0 # ip l s eth0 master br0 <--- Will fail If you switch the last two commands (add eth0 first), then both will succeed. If after that, you remove eth0 and try to re-add it, it will fail! It appears to be enough to simply check adj_list to keeps things safe. I've tried stacking multiple devices multiple times in all different combinations, and either rx_handler registration prevented the stacking of the device linking cought the error. Signed-off-by: Vladislav Yasevich Acked-by: Jiri Pirko Acked-by: Veaceslav Falico Signed-off-by: David S. Miller Signed-off-by: Sasha Levin commit a2a3d75bc59265924869f15741cce2a8bcce398c Author: Andrew Morton Date: Thu May 28 15:44:24 2015 -0700 fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings [ Upstream commit 073aba98f6a2235e2ac4a8402b1a131ab032876e ] commit 2b1d3ae940acd11be44c6eced5873d47c2e00ffa upstream. load_elf_binary() returns `retval', not `error'. Fixes: a87938b2e246b81b4fb ("fs/binfmt_elf.c: fix bug in loading of PIE binaries") Reported-by: James Hogan Cc: Michael Davidson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin commit 0096d0ccb701079017f2ad698d56b89838251724 Author: Ard Biesheuvel Date: Thu May 28 16:31:28 2015 -0700 ARM: 8221/1: PJ4: allow building in Thumb-2 mode Two files that get included when building the multi_v7_defconfig target fail to build when selecting THUMB2_KERNEL for this configuration. In both cases, we can just build the file as ARM code, as none of its symbols are exported to modules, so there are no interworking concerns. In the iwmmxt.S case, add ENDPROC() declarations so the symbols are annotated as functions, resulting in the linker to emit the appropriate mode switches. Acked-by: Nicolas Pitre Tested-by: Olof Johansson Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (cherry picked from commit 13d1b9575ac2c2da143cd2236b6cf0fc314570f8) Cc: # v3.18+ Signed-off-by: Kevin Hilman Signed-off-by: Sasha Levin commit 48ab2783948137231b276b2173ca23dae759af78 Author: Sasha Levin Date: Mon Jun 15 13:44:18 2015 -0400 Revert "tools/vm: fix page-flags build" This reverts commit a821ac4c66382f9d6387c8311608f13c6749fea9. That patch is not suitable for 3.18. Reported-by: Konstantin Khlebnikov Signed-off-by: Sasha Levin