Robert Love [Mon, 12 May 2008 21:08:29 +0000 (17:08 -0400)]
net: socket ioctl to reset connections matching local address
Introduce a new socket ioctl, SIOCKILLADDR, that nukes all sockets
bound to the same local address. This is useful in situations with
dynamic IPs, to kill stuck connections.
Signed-off-by: Brian Swetland <swetland@google.com>
net: fix tcp_v4_nuke_addr
Signed-off-by: Dima Zavin <dima@android.com>
net: ipv4: Fix a spinlock recursion bug in tcp_v4_nuke.
We can't hold the lock while calling to tcp_done(), so we drop
it before calling. We then have to start at the top of the chain again.
Signed-off-by: Dima Zavin <dima@android.com>
net: ipv4: Fix race in tcp_v4_nuke_addr().
To fix a recursive deadlock in 2.6.29, we stopped holding the hash table lock
across tcp_done() calls. This fixed the deadlock, but introduced a race where
the socket could die or change state.
Fix: Before unlocking the hash table, we grab a reference to the socket. We
can then unlock the hash table without risk of the socket going away. We then
lock the socket, which is safe because it is pinned. We can then call
tcp_done() without recursive deadlock and without race. Upon return, we unlock
the socket and then unpin it, killing it.
Change-Id: Idcdae072b48238b01bdbc8823b60310f1976e045
Signed-off-by: Robert Love <rlove@google.com>
Acked-by: Dima Zavin <dima@android.com>
ipv4: disable bottom halves around call to tcp_done().
Signed-off-by: Robert Love <rlove@google.com>
Signed-off-by: Colin Cross <ccross@android.com>
ipv4: Move sk_error_report inside bh_lock_sock in tcp_v4_nuke_addr
When sk_error_report is called, it wakes up the user-space thread, which then
calls tcp_close. When the tcp_close is interrupted by the tcp_v4_nuke_addr
ioctl thread running tcp_done, it leaks 392 bytes and triggers a WARN_ON.
This patch moves the call to sk_error_report inside the bh_lock_sock, which
matches the locking used in tcp_v4_err.
Signed-off-by: Colin Cross <ccross@android.com>
Robert Love [Thu, 31 Jul 2008 15:12:44 +0000 (11:12 -0400)]
sysfs_net_ipv4: Add sysfs-based knobs for controlling TCP window size
Add a family of knobs to /sys/kernel/ipv4 for controlling the TCP window size:
tcp_wmem_min
tcp_wmem_def
tcp_wmem_max
tcp_rmem_min
tcp_rmem_def
tcp_rmem_max
This six values mirror the sysctl knobs in /proc/sys/net/ipv4/tcp_wmem and
/proc/sys/net/ipv4/tcp_rmem.
Sysfs, unlike sysctl, allows us to set and manage the files' permissions and
owners.
Signed-off-by: Robert Love <rlove@google.com>
Chia-chi Yeh [Fri, 15 Jul 2011 22:32:57 +0000 (15:32 -0700)]
net: Only NET_ADMIN is allowed to fully control TUN interfaces.
Signed-off-by: Chia-chi Yeh <chiachi@android.com>
Chia-chi Yeh [Tue, 30 Jun 2009 03:23:04 +0000 (11:23 +0800)]
net: Replace AID_NET_RAW checks with capable(CAP_NET_RAW).
Signed-off-by: Chia-chi Yeh <chiachi@android.com>
Chia-chi Yeh [Thu, 18 Jun 2009 23:15:05 +0000 (07:15 +0800)]
security: Add AID_NET_RAW and AID_NET_ADMIN capability check in cap_capable().
Signed-off-by: Chia-chi Yeh <chiachi@android.com>
Robert Love [Wed, 15 Oct 2008 19:35:44 +0000 (15:35 -0400)]
Paranoid network.
With CONFIG_ANDROID_PARANOID_NETWORK, require specific uids/gids to instantiate
network sockets.
Signed-off-by: Robert Love <rlove@google.com>
paranoid networking: Use in_egroup_p() to check group membership
The previous group_search() caused trouble for partners with module builds.
in_egroup_p() is also cleaner.
Signed-off-by: Nick Pelly <npelly@google.com>
Fix 2.6.29 build.
Signed-off-by: Arve Hjønnevåg <arve@android.com>
net: Fix compilation of the IPv6 module
Fix compilation of the IPv6 module -- current->euid does not exist anymore,
current_euid() is what needs to be used.
Signed-off-by: Steinar H. Gunderson <sesse@google.com>
net: bluetooth: Remove the AID_NET_BT* gid numbers
Removed bluetooth checks for AID_NET_BT and AID_NET_BT_ADMIN
which are not useful anymore.
This is in preparation for getting rid of all the AID_* gids.
Signed-off-by: JP Abgrall <jpa@google.com>
Robert Love [Wed, 15 Oct 2008 19:34:49 +0000 (15:34 -0400)]
Add android_aid.h
Add <linux/android_aid.h>, our mapping of AID defines to gid numbers.
Change-Id: I3a02eb2b5c7e336e3de0cb45d8e04ec82f7281b4
Signed-off-by: Robert Love <rlove@google.com>
San Mehat [Sat, 10 Oct 2009 16:35:24 +0000 (09:35 -0700)]
block: genhd: Add disk/partition specific uevent callbacks for partition info
For disk devices, a new uevent parameter 'NPARTS' specifies the number
of partitions detected by the kernel. Partition devices get 'PARTN' which
specifies the partitions index in the table, and 'PARTNAME', which
specifies PARTNAME specifices the partition name of a partition device
Signed-off-by: Dima Zavin <dima@android.com>
San Mehat [Sun, 22 Mar 2009 01:48:54 +0000 (18:48 -0700)]
fs: block_dump: Don't display inode changes if block_dump < 2
Signed-off-by: San Mehat <san@android.com>
Ulf Hansson [Thu, 11 Feb 2016 15:54:11 +0000 (16:54 +0100)]
Revert "mmc: block: don't use parameter prefix if built as module"
This reverts commit
829b6962f7e3cfc06f7c5c26269fd47ad48cf503.
Revert this change as it causes a sysfs path to change and therefore
introduces and ABI regression. More precisely Android's vold is not being
able to access /sys/module/mmcblk/parameters/perdev_minors any more, since
the path becomes changed to: "/sys/module/mmc_block/..."
Fixes: 829b6962f7e3 ("mmc: block: don't use parameter prefix if built as
module")
Reported-by: John Stultz <john.stultz@linaro.org>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
John Stultz [Mon, 18 Mar 2013 18:57:28 +0000 (11:57 -0700)]
mmc: core: Remove stray CONFIG_EXPERIMENTAL dependencies
CONFIG_EXPERIMENTAL has been removed from the kernel, so clean
up its use in MMC_EMBEDDED_SDIO and MMC_PARANOID_SD_INIT options.
Change-Id: If414c265134b36740a84564274a631803c8e81b4
Cc: Arve Hjønnevåg <arve@android.com>
Cc: San Mehat <san@google.com>
Cc: Android Kernel Team <kernel-team@android.com>
Reported-by: Jon Medhurst (Tixy) <tixy@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Ken Sumrall [Wed, 26 Oct 2011 01:16:58 +0000 (18:16 -0700)]
mmc: block: Improve logging of handling emmc timeouts
Add some logging to make it clear just how the emmc timeout
was handled.
Change-Id: Id33fd28d8b9778dc4e85db829e2637a328eddab4
Signed-off-by: Ken Sumrall <ksumrall@android.com>
Dmitry Shmidt [Tue, 3 May 2011 18:05:04 +0000 (11:05 -0700)]
ARM: Add 'card_present' state to mmc_platfrom_data
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Colin Cross [Sat, 9 Apr 2011 05:20:53 +0000 (22:20 -0700)]
Recreate asm/mach/mmc.h include file
Change-Id: I9f10244b0603f7842b8504a16124d40dc4a71ed2
Signed-off-by: Colin Cross <ccross@android.com>
Dmitry Shmidt [Thu, 7 Oct 2010 21:39:16 +0000 (14:39 -0700)]
mmc: Add "ignore mmc pm notify" functionality
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Hosung Kim [Mon, 23 Jul 2012 08:33:17 +0000 (17:33 +0900)]
mmc: sdio: Fix sdio_reset_comm for sync
mmc_sdio_init_card function is doing necessary initialization
Change-Id: I7d2e432b2af8a76267378acba07e3e4e8fd1e6bc
Signed-off-by: Hosung Kim <hosung0.kim@samsung.com>
Colin Cross [Wed, 19 Mar 2014 19:46:49 +0000 (12:46 -0700)]
mmc: sdio: fix sdio_reset_comm() voltage selection
Change-Id: I2fa35ee9291c4c60e55fc11d923ae686a8f81920
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Dmitry Shmidt [Thu, 7 Oct 2010 00:25:02 +0000 (17:25 -0700)]
mmc: sdio: Fix enable_hs and enable_wide in sdio_reset_comm()
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Daniel Chen [Wed, 9 Dec 2009 17:45:36 +0000 (09:45 -0800)]
mmc: sdio: Add high speed support to sdio_reset_comm()
Signed-off-by: San Mehat <san@google.com>
Dmitry Shmidt [Wed, 29 Jul 2009 17:22:03 +0000 (10:22 -0700)]
mmc: sdio: Claim host in sdio_reset_comm()
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
San Mehat [Thu, 15 May 2008 16:15:37 +0000 (09:15 -0700)]
mmc: Add new API call 'sdio_reset_comm' for resetting communication with an SDIO device
Signed-off-by: San Mehat <san@android.com>
Dmitry Shmidt [Tue, 11 Nov 2008 19:22:38 +0000 (11:22 -0800)]
mmc: Add sdio_readb_ext() function
Change-Id: I9b410c8a13724795b23764012fd3be8f53747299
John Stultz [Fri, 4 Dec 2015 20:13:13 +0000 (12:13 -0800)]
mmc: Extend wakelock if bus is dead
This patch sets extend_wakelock if the host's
bus is marked dead due to card removal.
This change was originally made in
bc4dc52f178828
(mmc: mmcblk: Add support for deferred SD bus resume),
which was reverted due to the majority of the patch
no longer building or making sense. However one small
part of that patch ought to be saved.
Signed-off-by: John Stultz <john.stultz@linaro.org>
San Mehat [Mon, 23 Mar 2009 19:20:37 +0000 (12:20 -0700)]
mmc: core: Hold a wake lock accross delayed work + mmc rescan
Signed-off-by: San Mehat <san@android.com>
mmc: core: Rework mmc_delayed_work wakelock so that the wakelock is only extended if a card is added or removed.
Signed-off-by: San Mehat <san@google.com>
San Mehat [Mon, 14 Apr 2008 22:22:49 +0000 (15:22 -0700)]
mmc: Add concept of an 'embedded' SDIO device.
This is required to support chips which use SDIO for signaling/
communication but do not implement the various card enumeration registers
as required for full SD / SDIO cards.
mmc: sdio: Fix bug where we're freeing the CIS tables we never allocated when using EMBEDDED_SDIO
mmc: Add max_blksize to embedded SDIO data
Change-Id: Ibff2e3e991e5522f55ec8c6edc25ed09f2553736
Signed-off-by: San Mehat <san@google.com>
San Mehat [Thu, 4 Dec 2008 19:18:00 +0000 (11:18 -0800)]
mmc: sd: Add retries in re-detection
Signed-off-by: San Mehat <san@android.com>
mmc: sd: Remove debugging printk
Signed-off-by: Dima Zavin <dima@android.com>
San Mehat [Mon, 1 Dec 2008 16:52:34 +0000 (08:52 -0800)]
mmc: sd: When resuming, try a little harder to init the card
Signed-off-by: San Mehat <san@android.com>
San Mehat [Tue, 11 Nov 2008 17:35:36 +0000 (09:35 -0800)]
mmc: sd: Add new CONFIG_MMC_PARANOID_SD_INIT for enabling retries during SD detection
Signed-off-by: San Mehat <san@google.com>
San Mehat [Tue, 11 Nov 2008 00:29:50 +0000 (16:29 -0800)]
mmc: Add status IRQ and status callback function to mmc platform data
Signed-off-by: San Mehat <san@google.com>
Colin Cross [Fri, 3 Sep 2010 19:41:21 +0000 (12:41 -0700)]
mmc_block: Allow more than 8 partitions per card
Set the GENHD_FL_EXT_DEVT flag, which will allocate minor numbers
in major 259 for partitions past disk->minors.
Also remove the use of disk_devt to determine devidx from md->disk.
md->disk->first_minor is always initialized from devidx and can
always be used to recover it.
Signed-off-by: Colin Cross <ccross@android.com>
Dima Zavin [Thu, 4 Dec 2008 20:19:57 +0000 (12:19 -0800)]
mtd: nand: Allow NAND chip ids to be included standalone.
Lets non-standard NAND drivers take advantage of known NAND
chip information.
Change-Id: I87e2fcb40b07b2ec91e102f1fa7f419a4b4af0a3
Signed-off-by: Dima Zavin <dima@android.com>
Qiao Zhou [Thu, 31 Oct 2013 01:36:50 +0000 (09:36 +0800)]
drivers: switch: remove S_IWUSR from dev_attr
it doesn't need S_IWUSR attribute since xxx_store API is un-needed.
otherwise the WARN check in device_create_file will alert.
Change-Id: I6360bf022dcd659bfb3f41c84624f954d5d15ea5
Signed-off-by: Qiao Zhou <zhouqiao@marvell.com>
Todd Poynor [Wed, 20 Jun 2012 04:06:47 +0000 (21:06 -0700)]
gpio_input: convert from wakelocks to wakeup sources
And add device names to wakeup source names
Change-Id: Ia5f2723319a2e749f00d6ec7d846edff6af6d5c2
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Jeff Brown [Sun, 24 Jul 2011 21:31:14 +0000 (14:31 -0700)]
hid-multitouch: Filter collections by application usage.
This change fixes two problems.
First, it ensures that the hid-multitouch driver does not incorrectly
map GenericDesktop usages that are intended for other applications,
such as a Mouse.
Second, it sets the appropriate input properties so that user-space
can distinguish TouchScreen devices (INPUT_PROP_DIRECT) from
TouchPad devices (INPUT_PROP_POINTER) and configure them accordingly.
Change-Id: I8c2d947929186ffe7cf04b37c76e29b9abecf8cb
Signed-off-by: jeffbrown@android.com
Kees Cook [Wed, 11 Sep 2013 19:56:53 +0000 (21:56 +0200)]
HID: steelseries: validate output report details
A HID device could send a malicious output report that would cause the
steelseries HID driver to write beyond the output report allocation
during initialization, causing a heap overflow:
[ 167.981534] usb 1-1: New USB device found, idVendor=1038, idProduct=1410
...
[ 182.050547] BUG kmalloc-256 (Tainted: G W ): Redzone overwritten
CVE-2013-2891
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Daniel Rosenberg [Fri, 27 Jun 2014 23:39:35 +0000 (16:39 -0700)]
input: Made keyreset more robust
Switched do_restart to run in a seperate workqueue to handle
cases where kernel_restart hangs.
Change-Id: I1ecd61f8d0859f1a86d37c692351d644b5db9c69
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Daniel Rosenberg [Wed, 7 May 2014 21:17:47 +0000 (14:17 -0700)]
input: Changed keyreset to act as a wrapper for keycombo.
keyreset now registers a keycombo driver that acts as the old
keyreset driver acted.
Change-Id: I08f5279e3a33b267571b699697f9f54508868983
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Daniel Rosenberg [Wed, 7 May 2014 23:52:10 +0000 (16:52 -0700)]
input: add keycombo, a general key combo driver.
Keycombo lets you provide a key up and key down function, and an
optional time delay for key down. The driver will call the key
down function after the specified key combo has been held for the
speicified time delay. After you release the combo, if the key down
has happened, it calls key up.
Change-Id: I6a9a94e96a8f58fadd908fd1dc7944b9102a089f
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Colin Cross [Thu, 7 Nov 2013 20:46:33 +0000 (12:46 -0800)]
input: misc: keychord: move header to uapi
Move the entire contents of linux/keychord.h header to uapi, it only
contains a userspace interface.
Change-Id: If94f83328b19efb58c66391dce3bd8e927788d8d
Signed-off-by: Colin Cross <ccross@android.com>
JP Abgrall [Tue, 5 Mar 2013 22:25:36 +0000 (14:25 -0800)]
input: misc: keychord: log when keychord triggered
log keychord id at info level just before waking up processes.
Signed-off-by: JP Abgrall <jpa@google.com>
Mike Lockwood [Mon, 15 Dec 2008 19:51:56 +0000 (14:51 -0500)]
input: keychord: Add keychord driver
This driver allows userspace to receive notification when client
specified key combinations are pressed.
The client opens /dev/keychord and writes a list of keychords
for the driver to monitor.
The client then reads or polls /dev/keychord for notifications.
A client specified ID for the keychord is returned from read()
when a keychord press is detected.
Signed-off-by: Mike Lockwood <lockwood@android.com>
keychord: fix to build without CONFIG_PREEMPT
Change-Id: I911f13aeda4224b6fa57863bc7e8972fec8837fb
Arve Hjønnevåg [Sat, 22 Nov 2008 05:47:23 +0000 (21:47 -0800)]
input: Add keyreset driver.
Add a platform device in the board file to specify a reset key-combo.
The first time the key-combo is detected a work function that syncs
the filesystems is scheduled. If all the keys are released and then
pressed again, it calls panic. Reboot on panic should be set for
this to work.
Change-Id: I9d54283ca1fba45e4b1ae1a407524cdda8171143
Signed-off-by: Arve Hjønnevåg <arve@android.com>
Colin Cross [Thu, 2 Feb 2012 04:26:28 +0000 (20:26 -0800)]
input: misc: gpio_event: remove early suspend
Remove the early suspend handler. Leave the suspend functions
for now, they should eventually get called through a userspace
interface.x
Change-Id: I67f9dafe32fe32577bab93c42b95824db96c215c
Signed-off-by: Colin Cross <ccross@android.com>
Arve Hjønnevåg [Thu, 16 Oct 2008 01:23:47 +0000 (18:23 -0700)]
Input: Generic GPIO Input device.
Supports keyboard matrixces, direct inputs, direct outputs and axes connected to gpios.
Change-Id: I5e921e6e3a1cc169316ee3b665f4cc21b5735114
Signed-off-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Nick Pelly <npelly@google.com>
Mike Lockwood [Tue, 14 Oct 2008 16:50:16 +0000 (12:50 -0400)]
switch: switch class and GPIO drivers.
switch: Export symbol switch_set_state.
Signed-off-by: Mike Lockwood <lockwood@android.com>
switch: gpio: Don't call request_irq with interrupts disabled
Signed-off-by: Arve Hjønnevåg <arve@android.com>
switch: Use device_create instead of device_create_drvdata.
device_create_drvdata is obsolete.
Signed-off-by: Arve Hjønnevåg <arve@android.com>
switch_gpio: Add missing #include <linux/interrupt.h>
Change-Id: I6c397e41bbe1457162cc69e31a29db5d9f76fccb
Signed-off-by: Mike Lockwood <lockwood@android.com>
Amit Pundir [Thu, 29 Oct 2015 19:46:29 +0000 (01:16 +0530)]
lowmemorykiller: use module_param_cb instead of __module_param_call
Use module_param_cb helper routine instead of
__module_param_call otherwise we run into following
build error:
CC drivers/staging/android/lowmemorykiller.o
drivers/staging/android/lowmemorykiller.c:293:28: error: macro "__module_param_call" requires 7 arguments, but only 6 given
S_IRUGO | S_IWUSR, -1);
^
drivers/staging/android/lowmemorykiller.c:290:1: warning: data definition has no type or storage class [enabled by default]
__module_param_call(MODULE_PARAM_PREFIX, adj,
^
drivers/staging/android/lowmemorykiller.c:290:1: error: type defaults to ‘int’ in declaration of ‘__module_param_call’ [-Werror=implicit-int]
drivers/staging/android/lowmemorykiller.c:273:32: warning: ‘lowmem_adj_array_ops’ defined but not used [-Wunused-variable]
static struct kernel_param_ops lowmem_adj_array_ops = {
^
cc1: some warnings being treated as errors
make[3]: *** [drivers/staging/android/lowmemorykiller.o] Error 1
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Martijn Coenen [Tue, 26 May 2015 09:28:47 +0000 (11:28 +0200)]
lowmemorykiller: trace kill events.
Allows for capturing lmk kill events and
their rationale.
Change-Id: Ibe215db5bb9806fc550c72c0b9832c85cbd56bf6
Signed-off-by: Martijn Coenen <maco@google.com>
Colin Cross [Fri, 3 May 2013 21:57:29 +0000 (14:57 -0700)]
lowmemorykiller: make default lowmemorykiller debug message useful
lowmemorykiller debug messages are inscrutable and mostly useful
for debugging the lowmemorykiller, not explaining why a process
was killed. Make the messages more useful by prefixing them
with "lowmemorykiller: " and explaining in more readable terms
what was killed, who it was killed for, and why it was killed.
The messages now look like:
[ 76.997631] lowmemorykiller: Killing 'droid.gallery3d' (2172), adj 1000,
[ 76.997635] to free 27436kB on behalf of 'kswapd0' (29) because
[ 76.997638] cache 122624kB is below limit 122880kB for oom_score_adj 1000
[ 76.997641] Free memory is -53356kB above reserved
A negative number for free memory above reserved means some of the
reserved memory has been used and is being regenerated by kswapd,
which is likely what called the shrinkers.
Change-Id: I1fe983381e73e124b90aa5d91cb66e55eaca390f
Signed-off-by: Colin Cross <ccross@android.com>
Arve Hjønnevåg [Wed, 26 Sep 2012 00:37:14 +0000 (17:37 -0700)]
staging: android: lowmemorykiller: Add config option to support oom_adj values
The conversion to use oom_score_adj instead of the deprecated oom_adj
values breaks existing user-space code. Add a config option to convert
oom_adj values written to oom_score_adj values if they appear to be
valid oom_adj values.
Change-Id: I68308125059b802ee2991feefb07e9703bc48549
Signed-off-by: Arve Hjønnevåg <arve@android.com>
Tobias Lindskog [Mon, 9 Feb 2015 07:10:39 +0000 (08:10 +0100)]
Shrink ashmem directly through shmem_fallocate
When ashmem_shrink is called from direct reclaim on a user thread, a
call to do_fallocate will check for permissions against the security
policy of that user thread. It can thus fail by chance if called on a
thread that isn't permitted to modify the relevant ashmem areas.
Because we know that we have a shmem file underneath, call the shmem
implementation of fallocate directly instead of going through the
user-space interface for fallocate.
FIX=DMS06243560
Area: Kernel/Linux Kernel
Bug:
21951515
Change-Id: Ie98fff18a2bdeb535cd24d4fbdd13677e12681a7
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Rom Lemarchand [Sat, 24 Jan 2015 23:08:42 +0000 (15:08 -0800)]
staging: android: ashmem: add missing include
Include <linux/types.h> into ashmem.h to ensure referenced types are defined
Signed-off-by: Rom Lemarchand <romlem@android.com>
Change-Id: Iac18ed86dd47296d02a269607b1514724aaa9958
(cherry picked from commit
0d7c7ba9f6428e694130a40e270516618f27ce14)
Laura Abbott [Fri, 24 Jan 2014 23:19:49 +0000 (15:19 -0800)]
staging: android: ashmem: Avoid deadlock with mmap/shrink
Both ashmem_mmap and ashmem_shrink take the ashmem_lock. It may
be possible for ashmem_mmap to invoke ashmem_shrink:
-000|mutex_lock(lock = 0x0)
-001|ashmem_shrink(?, sc = 0x0) <--- try to take ashmem_mutex again
-002|shrink_slab(shrink = 0xDA5F1CC0, nr_pages_scanned = 0, lru_pages
-002|=
-002|124)
-003|try_to_free_pages(zonelist = 0x0, ?, ?, ?)
-004|__alloc_pages_nodemask(gfp_mask = 21200, order = 1, zonelist =
-004|0xC11D0940,
-005|new_slab(s = 0xE4841E80, ?, node = -1)
-006|__slab_alloc.isra.43.constprop.50(s = 0xE4841E80, gfpflags =
-006|
2148925462, ad
-007|kmem_cache_alloc(s = 0xE4841E80, gfpflags = 208)
-008|shmem_alloc_inode(?)
-009|alloc_inode(sb = 0xE480E800)
-010|new_inode_pseudo(?)
-011|new_inode(?)
-012|shmem_get_inode(sb = 0xE480E800, dir = 0x0, ?, dev = 0, flags =
-012|187)
-013|shmem_file_setup(?, ?, flags = 187)
-014|ashmem_mmap(?, vma = 0xC5D64210) <---- Acquire ashmem_mutex
-015|mmap_region(file = 0xDF8E2C00, addr =
1772974080, len = 233472,
-015|flags = 57,
-016|sys_mmap_pgoff(addr = 0, len = 230400, prot = 3, flags = 1, fd =
-016|157, pgoff
-017|ret_fast_syscall(asm)
-->|exception
-018|NUR:0x40097508(asm)
---|end of frame
Avoid this deadlock by using mutex_trylock in ashmem_shrink; if the mutex
is already held, do not attempt to shrink.
Change-Id: I222bbf55856d5849da813b730de0636c80966c8e
Reported-by: Matt Wagantall <mattw@codeaurora.org>
Reported-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Reported-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
Reported-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
John Stultz [Fri, 16 Dec 2011 02:51:04 +0000 (18:51 -0800)]
ashmem: Add shmem_set_file to mm/shmem.c
NOT FOR STAGING
This patch re-adds the original shmem_set_file to mm/shmem.c
and converts ashmem.c back to using it.
CC: Brian Swetland <swetland@google.com>
CC: Colin Cross <ccross@android.com>
CC: Arve Hjønnevåg <arve@android.com>
CC: Dima Zavin <dima@android.com>
CC: Robert Love <rlove@google.com>
CC: Greg KH <greg@kroah.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Arve Hjønnevåg [Sat, 17 Mar 2012 00:44:42 +0000 (17:44 -0700)]
PM / Sleep: Add wake lock api wrapper on top of wakeup sources
Change-Id: Icaad02fe1e8856fdc2e4215f380594a5dde8e002
Signed-off-by: Arve Hjønnevåg <arve@android.com>
Mike Chan [Thu, 22 Jan 2009 20:23:32 +0000 (12:23 -0800)]
android: Add android config documentation to boot framework.
Signed-off-by: Mike Chan <mike@android.com>
Linus Torvalds [Sun, 10 Jan 2016 23:01:32 +0000 (15:01 -0800)]
Linux 4.4
Linus Torvalds [Sat, 9 Jan 2016 22:53:48 +0000 (14:53 -0800)]
Merge tag 'scsi-fixes' of git://git./linux/kernel/git/jejb/scsi
Pull SCSI fix from James Bottomley:
"A single fix for machines with pages > 4k (PPC mostly).
There's a bug in our optimal transfer size code where we don't account
for pages > 4k and can set the transfer size to be less than the page
size causing nasty failures"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
sd: Reject optimal transfer length smaller than page size
Linus Torvalds [Sat, 9 Jan 2016 22:44:44 +0000 (14:44 -0800)]
Merge tag 'pci-v4.4-fixes-4' of git://git./linux/kernel/git/helgaas/pci
Pull PCI fixlet from Bjorn Helgaas:
"This marks the TI DRA7xx host bridge driver as broken. Apparently it
has never worked without some additional out-of-tree code, so I'm
going to mark it broken now and remove it completely next cycle unless
it's fixed"
* tag 'pci-v4.4-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
PCI: dra7xx: Mark driver as broken
Michal Hocko [Fri, 8 Jan 2016 10:18:29 +0000 (11:18 +0100)]
vmstat: allocate vmstat_wq before it is used
kernel test robot has reported the following crash:
BUG: unable to handle kernel NULL pointer dereference at
00000100
IP: [<
c1074df6>] __queue_work+0x26/0x390
*pdpt =
0000000000000000 *pde =
f000ff53f000ff53 *pde =
f000ff53f000ff53
Oops: 0000 [#1] PREEMPT PREEMPT SMP SMP
CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted
4.4.0-rc4-00139-g373ccbe #1
Workqueue: events vmstat_shepherd
task:
cb684600 ti:
cb7ba000 task.ti:
cb7ba000
EIP: 0060:[<
c1074df6>] EFLAGS:
00010046 CPU: 0
EIP is at __queue_work+0x26/0x390
EAX:
00000046 EBX:
cbb37800 ECX:
cbb37800 EDX:
00000000
ESI:
00000000 EDI:
00000000 EBP:
cb7bbe68 ESP:
cb7bbe38
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
CR0:
8005003b CR2:
00000100 CR3:
01fd5000 CR4:
000006b0
Stack:
Call Trace:
__queue_delayed_work+0xa1/0x160
queue_delayed_work_on+0x36/0x60
vmstat_shepherd+0xad/0xf0
process_one_work+0x1aa/0x4c0
worker_thread+0x41/0x440
kthread+0xb0/0xd0
ret_from_kernel_thread+0x21/0x40
The reason is that start_shepherd_timer schedules the shepherd work item
which uses vmstat_wq (vmstat_shepherd) before setup_vmstat allocates
that workqueue so if the further initialization takes more than HZ we
might end up scheduling on a NULL vmstat_wq. This is really unlikely
but not impossible.
Fixes: 373ccbe59270 ("mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress")
Reported-by: kernel test robot <ying.huang@linux.intel.com>
Signed-off-by: Michal Hocko <mhocko@suse.com>
Tested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: stable@vger.kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sat, 9 Jan 2016 00:11:05 +0000 (16:11 -0800)]
Merge tag 'fixes-for-linus' of git://git./linux/kernel/git/arm/arm-soc
Pull ARM SoC fixes from Arnd Bergmann:
"This is the final small set of ARM SoC bug fixes for linux-4.4, almost
all regressions:
OMAP:
- data corruption on the Nokia N900 flash
Allwinner:
- Two defconfig change to get USB working again
ARM Versatile:
- Interrupt numbers gone bad after an older bug fix
Nomadik:
- Crashes from incorrect L2 cache settings
VIA vt8500:
- SD/MMC support on WM8650 never worked"
* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
dts: vt8500: Add SDHC node to DTS file for WM8650
ARM: Fix broken USB support in multi_v7_defconfig for sunxi devices
ARM: versatile: fix MMC/SD interrupt assignment
ARM: nomadik: set latencies to 8 cycles
ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
ARM: Fix broken USB support in sunxi_defconfig
Linus Torvalds [Fri, 8 Jan 2016 23:58:14 +0000 (15:58 -0800)]
Merge tag 'for-linus' of git://git./virt/kvm/kvm
Pull KVM fix from Paolo Bonzini:
"A simple fix. I'm sending it before the merge window, because it
refines a patch found in your master branch but not yet in the
kvm/next branch that is destined for 4.5"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
kvm: x86: only channel 0 of the i8254 is linked to the HPET
Linus Torvalds [Fri, 8 Jan 2016 23:50:59 +0000 (15:50 -0800)]
Merge tag 'pm+acpi-4.4-final' of git://git./linux/kernel/git/rafael/linux-pm
Pull ACPI fix from Rafael Wysocki:
"Just one obvious fix that adds a missing function argument in ACPI
code introduced recently (Kees Cook)"
* tag 'pm+acpi-4.4-final' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPI / property: avoid leaking format string into kobject name
Linus Torvalds [Fri, 8 Jan 2016 23:21:48 +0000 (15:21 -0800)]
Merge branch 'x86-urgent-for-linus' of git://git./linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
"A handful of x86 fixes:
- a syscall ABI fix, fixing an Android breakage
- a Xen PV guest fix relating to the RTC device, causing a
non-working console
- a Xen guest syscall stack frame fix
- an MCE hotplug CPU crash fix"
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/numachip: Fix NumaConnect2 MMCFG PCI access
x86/entry: Restore traditional SYSENTER calling convention
x86/entry: Fix some comments
x86/paravirt: Prevent rtc_cmos platform device init on PV guests
x86/xen: Avoid fast syscall path for Xen PV guests
x86/mce: Ensure offline CPUs don't participate in rendezvous process
Linus Torvalds [Fri, 8 Jan 2016 21:57:13 +0000 (13:57 -0800)]
Merge branch 'sched-urgent-for-linus' of git://git./linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
"Misc scheduler fixes"
* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/core: Reset task's lockless wake-queues on fork()
sched/core: Fix unserialized r-m-w scribbling stuff
sched/core: Check tgid in is_global_init()
sched/fair: Fix multiplication overflow on 32-bit systems
Linus Torvalds [Fri, 8 Jan 2016 21:52:59 +0000 (13:52 -0800)]
Merge branch 'perf-urgent-for-linus' of git://git./linux/kernel/git/tip/tip
Pull perf fixes from Ingo Molnar:
"Two core subsystem fixes, plus a handful of tooling fixes"
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Fix race in swevent hash
perf: Fix race in perf_event_exec()
perf list: Robustify event printing routine
perf list: Add support for PERF_COUNT_SW_BPF_OUT
perf hists browser: Fix segfault if use symbol filter in cmdline
perf hists browser: Reset selection when refresh
perf hists browser: Add NULL pointer check to prevent crash
perf buildid-list: Fix return value of perf buildid-list -k
perf buildid-list: Show running kernel build id fix
Linus Torvalds [Fri, 8 Jan 2016 21:46:59 +0000 (13:46 -0800)]
Merge branch 'irq-urgent-for-linus' of git://git./linux/kernel/git/tip/tip
Pull irq fix from Ingo Molnar:
"Fixes a core IRQ subsystem deadlock"
* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
genirq: Prevent chip buslock deadlock
Linus Torvalds [Fri, 8 Jan 2016 21:39:09 +0000 (13:39 -0800)]
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
Pull block revert from Jens Axboe:
"The previous pull request had a split fix for NVMe, however there are
corner cases where that ends up blowing up.
So let's revert it for 4.4. The regression isn't introduced in this
cycle, and it's "just" a performance regression, not a
stability/integrity issue"
* 'for-linus' of git://git.kernel.dk/linux-block:
Revert "block: Split bios on chunk boundaries"
Linus Torvalds [Fri, 8 Jan 2016 20:23:00 +0000 (12:23 -0800)]
Merge tag 'dmaengine-fix-4.4' of git://git.infradead.org/users/vkoul/slave-dma
Pull dmaengine fixes from Vinod Koul:
"Late fixes for 4.4 are three fixes for drivers which include a revert
of mic-x100 fix which is causing regression, xgene fix for double IRQ
and async_tx fix to use GFP_NOWAIT"
* tag 'dmaengine-fix-4.4' of git://git.infradead.org/users/vkoul/slave-dma:
dmaengine: xgene-dma: Fix double IRQ issue by setting IRQ_DISABLE_UNLAZY flag
async_tx: use GFP_NOWAIT rather than GFP_IO
dmaengine: Revert "dmaengine: mic_x100: add missing spin_unlock"
Linus Torvalds [Fri, 8 Jan 2016 20:18:45 +0000 (12:18 -0800)]
Merge branch 'dmi-for-linus' of git://git./linux/kernel/git/jdelvare/staging
Pull dmi fix from Jean Delvare.
* 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
Linus Torvalds [Fri, 8 Jan 2016 19:52:18 +0000 (11:52 -0800)]
Merge tag 'sound-4.4' of git://git./linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A slightly higher volume than a new year's wish, but not too
worrisome: a large LOC is only for HD-audio device-specific quirks, so
fairly safe to apply. The rest ASoC fixes are all trivial and small;
a simple replacement of mutex call with nested lock version, a few
Arizona and Realtek codec fixes, and a regression fix for Skylake
firmware handling"
* tag 'sound-4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: Intel: Skylake: Fix the memory leak
ASoC: Intel: Skylake: Revert previous broken fix memory leak fix
ASoC: Use nested lock for snd_soc_dapm_mutex_lock
ASoC: rt5645: add sys clk detection
ALSA: hda - Add keycode map for alc input device
ALSA: hda - Add mic mute hotkey quirk for Lenovo ThinkCentre AIO
ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz
Arnd Bergmann [Fri, 8 Jan 2016 16:46:45 +0000 (17:46 +0100)]
Merge tag 'omap-for-v4.4/onenand-corruption' of git://git./linux/kernel/git/tmlind/linux-omap into fixes
Pull "urgent onenand file system corruption fix for n900" from Tony Lindgren:
Last minute urgent pull request to prevent file system corruption
on Nokia N900.
Looks like we have a GPMC bus timing bug that has gone unnoticed
because of bootloader configured registers until few days ago. We
are not detecting the onenand clock rate properly unless we have
CONFIG_OMAP_GPMC_DEBUG set and this causes onenand corruption
that can be easily be reproduced.
There seems to be also an additional bug still lurking around for
onenand corruption. But that is still being investigated and
it does not seem to be GPMC timings related.
Meanwhile, it would be good to get this fix into v4.4 to prevent
wrong timings from corrupting onenand.
* tag 'omap-for-v4.4/onenand-corruption' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
Jens Axboe [Fri, 8 Jan 2016 16:00:29 +0000 (09:00 -0700)]
Revert "block: Split bios on chunk boundaries"
This reverts commit
d3805611130af9b911e908af9f67a3f64f4f0914.
If we end up splitting on the first segment, we don't adjust
the sector count. That results in hitting a BUG() with attempting
to split 0 sectors.
As this is just a performance issue and not a regression since
4.3 release, let's just rever this change. That gives us more
time to test a real fix for 4.5, which would be marked for
stable anyway.
Richard Cochran [Fri, 8 Jan 2016 15:58:31 +0000 (09:58 -0600)]
PCI: dra7xx: Mark driver as broken
Mark the dra7xx PCI host driver as broken. This driver was first merged in
v3.17 and has never worked. Although the driver compiles just fine, it is
missing an essential device reset. If the driver is included, the kernel
locks up hard shortly after booting, before any console output appears.
Signed-off-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Andrea Arcangeli [Fri, 8 Jan 2016 08:00:54 +0000 (09:00 +0100)]
firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
The dmi_ver wasn't updated correctly before the dmi_decode method run
to save the uuid.
That resulted in "dmidecode -s system-uuid" and
/sys/class/dmi/id/product_uuid disagreeing. The latter was buggy and
this fixes it.
Reported-by: Federico Simoncelli <fsimonce@redhat.com>
Fixes: 9f9c9cbb6057 ("drivers/firmware/dmi_scan.c: fetch dmi version from SMBIOS if it exists")
Fixes: 79bae42d51a5 ("dmi_scan: refactor dmi_scan_machine(), {smbios,dmi}_present()")
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Kees Cook [Thu, 7 Jan 2016 19:24:29 +0000 (11:24 -0800)]
ACPI / property: avoid leaking format string into kobject name
The dn->name is expected to be used as a literal, so add the missing
"%s".
Fixes: 263b4c1a64bc (ACPI / property: Expose data-only subnodes via sysfs)
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Linus Torvalds [Thu, 7 Jan 2016 21:06:35 +0000 (13:06 -0800)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm nouveau fix from Dave Airlie:
"Still not back to work, but I decided to forward this fix"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/nouveau/gr/nv40: fix oops in interrupt handler
Linus Torvalds [Thu, 7 Jan 2016 20:56:23 +0000 (12:56 -0800)]
Merge tag 'iommu-fixes-v4.4-rc8' of git://git./linux/kernel/git/joro/iommu
Pull IOMMU fixes from Joerg Roedel:
- Two build issues, one in the ipmmu-vmsa driver and one for the new
generic dma-api implemention used on arm64
- A performance fix for said dma-api implemention
- An issue caused by a wrong offset in map_sg in the same code as above
* tag 'iommu-fixes-v4.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
iommu/dma: Use correct offset in map_sg
iommu/ipmmu-vmsa: Don't truncate ttbr if LPAE is not enabled
iommu/dma: Avoid unlikely high-order allocations
iommu/dma: Add some missing #includes
Linus Torvalds [Thu, 7 Jan 2016 20:42:22 +0000 (12:42 -0800)]
Merge tag 'trace-v4.4-rc4-4' of git://git./linux/kernel/git/rostedt/linux-trace
Pull ftrace fix from Steven Rostedt:
"PeiyangX Qiu reported that if a module fails to load between calling
ftrace_module_init() and do_init_module() that the allocations made in
ftrace_module_init() will not be freed, resulting in a memory leak.
The solution is to call ftrace_release_mod() on the failing module in
the fail path befor do_init_module() is called. This will remove any
allocations made for that module, and nothing if ftrace_module_init()
wasn't called yet for that module.
Note, once do_init_module() is called, the MODULE_GOING notifiers are
called for the failed module, which calls into the ftrace code to do
the proper clean up (basically calling ftrace_release_mod())"
* tag 'trace-v4.4-rc4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
ftrace/module: Call clean up function when module init fails early
Steven Rostedt (Red Hat) [Wed, 6 Jan 2016 01:32:47 +0000 (20:32 -0500)]
ftrace/module: Call clean up function when module init fails early
If the module init code fails after calling ftrace_module_init() and before
calling do_init_module(), we can suffer from a memory leak. This is because
ftrace_module_init() allocates pages to store the locations that ftrace
hooks are placed in the module text. If do_init_module() fails, it still
calls the MODULE_GOING notifiers which will tell ftrace to do a clean up of
the pages it allocated for the module. But if load_module() fails before
then, the pages allocated by ftrace_module_init() will never be freed.
Call ftrace_release_mod() on the module if load_module() fails before
getting to do_init_module().
Link: http://lkml.kernel.org/r/567CEA31.1070507@intel.com
Reported-by: "Qiu, PeiyangX" <peiyangx.qiu@intel.com>
Fixes: a949ae560a511 "ftrace/module: Hardcode ftrace_module_init() call into load_module()"
Cc: stable@vger.kernel.org # v2.6.38+
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Roman Volkov [Fri, 1 Jan 2016 13:38:11 +0000 (16:38 +0300)]
dts: vt8500: Add SDHC node to DTS file for WM8650
Since WM8650 has the same 'WMT' SDHC controller as WM8505, and the driver
is already in the kernel, this node enables the controller support for
WM8650
Signed-off-by: Roman Volkov <rvolkov@v1ros.org>
Reviewed-by: Alexey Charkov <alchark@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Timo Sigurdsson [Fri, 1 Jan 2016 13:38:22 +0000 (14:38 +0100)]
ARM: Fix broken USB support in multi_v7_defconfig for sunxi devices
Commit
69fb4dcada77 ("power: Add an axp20x-usb-power driver") introduced a
new driver for the USB power supply used on various Allwinner based SBCs.
However, the driver was not added to multi_v7_defconfig which breaks USB
support for some boards (e.g. LeMaker BananaPi) as the kernel will now
turn off the USB power supply during boot by default if the driver isn't
present. (This was not the case in linux 4.3 or lower where the USB power
was always left on.)
Hence, add the driver to multi_v7_defconfig in order to keep USB support
working on those boards that require it.
Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
Tested-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Paolo Bonzini [Thu, 7 Jan 2016 12:50:38 +0000 (13:50 +0100)]
kvm: x86: only channel 0 of the i8254 is linked to the HPET
While setting the KVM PIT counters in 'kvm_pit_load_count', if
'hpet_legacy_start' is set, the function disables the timer on
channel[0], instead of the respective index 'channel'. This is
because channels 1-3 are not linked to the HPET. Fix the caller
to only activate the special HPET processing for channel 0.
Reported-by: P J P <pjp@fedoraproject.org>
Fixes: 0185604c2d82c560dab2f2933a18f797e74ab5a8
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Robin Murphy [Mon, 4 Jan 2016 16:19:42 +0000 (16:19 +0000)]
iommu/dma: Use correct offset in map_sg
When mapping a non-page-aligned scatterlist entry, we copy the original
offset to the output DMA address before aligning it to hand off to
iommu_map_sg(), then later adding the IOVA page address portion to get
the final mapped address. However, when the IOVA page size is smaller
than the CPU page size, it is the offset within the IOVA page we want,
not that within the CPU page, which can easily be larger than an IOVA
page and thus result in an incorrect final address.
Fix the bug by taking only the IOVA-aligned part of the offset as the
basis of the DMA address, not the whole thing.
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Dave Airlie [Thu, 7 Jan 2016 07:18:45 +0000 (17:18 +1000)]
Merge branch 'linux-4.4' of git://github.com/skeggsb/linux into drm-fixes
single nv40 oops fix.
* 'linux-4.4' of git://github.com/skeggsb/linux:
drm/nouveau/gr/nv40: fix oops in interrupt handler
Rameshwar Prasad Sahu [Wed, 23 Dec 2015 12:58:15 +0000 (18:28 +0530)]
dmaengine: xgene-dma: Fix double IRQ issue by setting IRQ_DISABLE_UNLAZY flag
For interrupt controller that doesn't support irq_disable and hardware
with level interrupt, an extra interrupt can be pending. This patch fixes
the issue by setting IRQ_DISABLE_UNLAZY flag for the interrupt line.
Reference: http://git.kernel.org/tip/
e9849777d0e27cdd2902805be51da73e7c79578c
Signed-off-by: Rameshwar Prasad Sahu <rsahu@apm.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
NeilBrown [Thu, 7 Jan 2016 00:02:34 +0000 (11:02 +1100)]
async_tx: use GFP_NOWAIT rather than GFP_IO
These async_XX functions are called from md/raid5 in an atomic
section, between get_cpu() and put_cpu(), so they must not sleep.
So use GFP_NOWAIT rather than GFP_IO.
Dan Williams writes: Longer term async_tx needs to be merged into md
directly as we can allocate this unmap data statically per-stripe
rather than per request.
Fixed:
7476bd79fc01 ("async_pq: convert to dmaengine_unmap_data")
Cc: stable@vger.kernel.org (v3.13+)
Reported-and-tested-by: Stanislav Samsonov <slava@annapurnalabs.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Linus Walleij [Tue, 5 Jan 2016 08:59:30 +0000 (09:59 +0100)]
ARM: versatile: fix MMC/SD interrupt assignment
Commit
0976c946a610d06e907335b7a3afa6db046f8e1b
"arm/versatile: Fix versatile irq specifications"
has an off-by-one error on the Versatile AB that has
been regressing the Versatile AB hardware for some time.
However it seems like the interrupt assignments have
never been correct and I have now adjusted them according
to the specification. The masks for the valid interrupts
made it impossible to assign the right SIC interrupt
for the MMCI, so I went in and fixed these to correspond
to the specifications, and added references if anyone
wants to double-check.
Due to the Versatile PB including the Versatile AB
as a base DTS file, we need to override and correct
some values to correspond to the actual changes in the
hardware.
For the Versatile PB I don't think the IRQ line
assignment for MMCI has ever been correct for either of
the two MMCI blocks. It would be nice if someone with the
physical PB board could test this.
Patch tested on the Versatile AB, QEMU for Versatile AB
and QEMU for Versatile PB.
Cc: Rob Herring <robh@kernel.org>
Cc: Grant Likely <grant.likely@linaro.org>
Cc: stable@vger.kernel.org
Fixes: 0976c946a610 ("arm/versatile: Fix versatile irq specifications")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
Linus Walleij [Mon, 4 Jan 2016 01:18:28 +0000 (02:18 +0100)]
ARM: nomadik: set latencies to 8 cycles
The Nomadik has sporadic crashes because of these latencies, setting
them to max makes the platform work nicely, so use this values for
now.
These latencies were set to 2 since the Nomadik platform was merged,
but I suspect they never took effect until the right size and
associativity for the cache was specified in the device tree and
that is why the crash comes now.
Cc: stable@vger.kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
Linus Torvalds [Thu, 7 Jan 2016 04:32:08 +0000 (20:32 -0800)]
Merge tag 'for-linus-
20160106' of git://git.infradead.org/linux-mtd
Pull MTD fixes from Brian Norris:
"Three last MTD fixes for v4.4. These are all fixes for regressions
and bugs reported mid cycle. Unfortunately, some of them took a bit
long to get proper testing and feedback.
- Assign the default MTD name earlier in the registration process, so
partition parsers (like cmdlinepart) see the right name. Without
this, some systems may come up with unpartitioned flash. This was
a v4.4-rc1 regression.
- Revert some new Winbond SPI NOR flash unlocking/locking support;
new code in v4.4 caused regressions on some Spansion flash.
- Fix mis-typed parameter ordering in SPI NOR unlock function; this
bug was introduced in v4.4-rc1"
* tag 'for-linus-
20160106' of git://git.infradead.org/linux-mtd:
mtd: spi-nor: fix stm_is_locked_sr() parameters
mtd: spi-nor: fix Spansion regressions (aliased with Winbond)
mtd: fix cmdlinepart parser, early naming for auto-filled MTD
Linus Torvalds [Thu, 7 Jan 2016 00:15:03 +0000 (16:15 -0800)]
Merge git://git./linux/kernel/git/davem/net
Pull networking fixes from David Miller:
"As usual, there are a couple straggler bug fixes:
1) qlcnic_alloc_mbx_args() error returns are not checked in qlcnic
driver. Fix from Insu Yun.
2) SKB refcounting bug in connector, from Florian Westphal.
3) vrf_get_saddr() has to propagate fib_lookup() errors to it's
callers, from David Ahern.
4) Fix AF_UNIX splice/bind deadlock, from Rainer Weikusat.
5) qdisc_rcu_free() fails to free the per-cpu qstats. Fix from John
Fastabend.
6) vmxnet3 driver passes wrong page to dma_map_page(), fix from
Shrikrishna Khare.
7) Don't allow zero cwnd in tcp_cwnd_reduction(), from Yuchung Cheng"
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
tcp: fix zero cwnd in tcp_cwnd_reduction
Driver: Vmxnet3: Fix regression caused by
5738a09
net: qmi_wwan: Add WeTelecom-WPD600N
mkiss: fix scribble on freed memory
net: possible use after free in dst_release
net: sched: fix missing free per cpu on qstats
ARM: net: bpf: fix zero right shift
6pack: fix free memory scribbles
net: filter: make JITs zero A for SKF_AD_ALU_XOR_X
bridge: Only call /sbin/bridge-stp for the initial network namespace
af_unix: Fix splice-bind deadlock
net: Propagate lookup failure in l3mdev_get_saddr to caller
r8152: add reset_resume function
connector: bump skb->users before callback invocation
cxgb4: correctly handling failed allocation
qlcnic: correctly handle qlcnic_alloc_mbx_args
Yuchung Cheng [Wed, 6 Jan 2016 20:42:38 +0000 (12:42 -0800)]
tcp: fix zero cwnd in tcp_cwnd_reduction
Patch
3759824da87b ("tcp: PRR uses CRB mode by default and SS mode
conditionally") introduced a bug that cwnd may become 0 when both
inflight and sndcnt are 0 (cwnd = inflight + sndcnt). This may lead
to a div-by-zero if the connection starts another cwnd reduction
phase by setting tp->prior_cwnd to the current cwnd (0) in
tcp_init_cwnd_reduction().
To prevent this we skip PRR operation when nothing is acked or
sacked. Then cwnd must be positive in all cases as long as ssthresh
is positive:
1) The proportional reduction mode
inflight > ssthresh > 0
2) The reduction bound mode
a) inflight == ssthresh > 0
b) inflight < ssthresh
sndcnt > 0 since newly_acked_sacked > 0 and inflight < ssthresh
Therefore in all cases inflight and sndcnt can not both be 0.
We check invalid tp->prior_cwnd to avoid potential div0 bugs.
In reality this bug is triggered only with a sequence of less common
events. For example, the connection is terminating an ECN-triggered
cwnd reduction with an inflight 0, then it receives reordered/old
ACKs or DSACKs from prior transmission (which acks nothing). Or the
connection is in fast recovery stage that marks everything lost,
but fails to retransmit due to local issues, then receives data
packets from other end which acks nothing.
Fixes: 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode conditionally")
Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Shrikrishna Khare [Wed, 6 Jan 2016 18:44:27 +0000 (10:44 -0800)]
Driver: Vmxnet3: Fix regression caused by
5738a09
Reported-by: Bingkuo Liu <bingkuol@vmware.com>
Signed-off-by: Shrikrishna Khare <skhare@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Kristian Evensen [Wed, 6 Jan 2016 13:15:50 +0000 (14:15 +0100)]
net: qmi_wwan: Add WeTelecom-WPD600N
The WeTelecom-WPD600N is an LTE module that, in addition to supporting most
"normal" bands, also supports LTE over 450MHz. Manual testing showed that
only interface number three replies to QMI messages.
Cc: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alan [Wed, 6 Jan 2016 14:55:02 +0000 (14:55 +0000)]
mkiss: fix scribble on freed memory
commit
d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable
scribble on free memory but added a new one which allows the user to
scribble even more and user controlled data into freed space.
As with 6pack we need to halt the queue before we free the buffers, because
the transmit logic is not protected by the semaphore.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Francesco Ruggeri [Wed, 6 Jan 2016 08:18:48 +0000 (00:18 -0800)]
net: possible use after free in dst_release
dst_release should not access dst->flags after decrementing
__refcnt to 0. The dst_entry may be in dst_busy_list and
dst_gc_task may dst_destroy it before dst_release gets a chance
to access dst->flags.
Fixes: d69bbf88c8d0 ("net: fix a race in dst_release()")
Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst")
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Takashi Iwai [Wed, 6 Jan 2016 19:53:28 +0000 (20:53 +0100)]
Merge tag 'asoc-fix-v4.4-rc8' of git://git./linux/kernel/git/broonie/sound into for-linus
ASoC: Last minute fixes for v4.4
A few final fixes for v4.4, the main one being the two patches to the
new Sky Lake drivers which fix a previous incorrect fix that went in
during an earlier -rc.
Tony Lindgren [Tue, 5 Jan 2016 20:04:20 +0000 (12:04 -0800)]
ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
Commit
63aa945b1013 ("memory: omap-gpmc: Add Kconfig option for debug")
unified the GPMC debug for the SoCs with GPMC. The commit also left out
the option for HWMOD_INIT_NO_RESET as we now require proper timings for
GPMC to be able to remap GPMC devices out of address 0.
Unfortunately on Nokia N900, onenand now only partially works with the
device tree provided timings. It works enough to get detected but the
clock rate supported by the onenand chip gets misdetected. This in turn
causes the GPMC timings to be miscalculated and this leads into file
system corruption on N900.
Looks like onenand needs CS_CONFIG1 bit 27 WRITETYPE set for for sync
write. This is needed also for async timings when we write to onenand
with omap2_onenand_set_async_mode(). Without sync write bit set, the
async read for the onenand ONENAND_REG_VERSION_ID will return 0xfff.
Let's exit with an error if onenand rate is not detected. And let's
remove the extra call to omap2_onenand_set_async_mode() as we only need
to do this once at the end of omap2_onenand_setup_async().
Fixes: 63aa945b1013 ("memory: omap-gpmc: Add Kconfig option for debug")
Cc: stable@vger.kernel.org # v4.2+
Reported-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Tested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Sebastian Andrzej Siewior [Mon, 21 Dec 2015 17:17:10 +0000 (18:17 +0100)]
sched/core: Reset task's lockless wake-queues on fork()
In the following commit:
7675104990ed ("sched: Implement lockless wake-queues")
we gained lockless wake-queues.
The -RT kernel managed to lockup itself with those. There could be multiple
attempts for task X to enqueue it for a wakeup _even_ if task X is already
running.
The reason is that task X could be runnable but not yet on CPU. The the
task performing the wakeup did not leave the CPU it could performe
multiple wakeups.
With the proper timming task X could be running and enqueued for a
wakeup. If this happens while X is performing a fork() then its its
child will have a !NULL `wake_q` member copied.
This is not a problem as long as the child task does not participate in
lockless wakeups :)
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Davidlohr Bueso <dbueso@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 7675104990ed ("sched: Implement lockless wake-queues")
Link: http://lkml.kernel.org/r/20151221171710.GA5499@linutronix.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Peter Zijlstra [Wed, 25 Nov 2015 15:02:07 +0000 (16:02 +0100)]
sched/core: Fix unserialized r-m-w scribbling stuff
Some of the sched bitfieds (notably sched_reset_on_fork) can be set
on other than current, this can cause the r-m-w to race with other
updates.
Since all the sched bits are serialized by scheduler locks, pull them
in a separate word.
Reported-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: akpm@linux-foundation.org
Cc: hannes@cmpxchg.org
Cc: mhocko@kernel.org
Cc: vdavydov@parallels.com
Link: http://lkml.kernel.org/r/20151125150207.GM11639@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Sergey Senozhatsky [Fri, 1 Jan 2016 14:03:01 +0000 (23:03 +0900)]
sched/core: Check tgid in is_global_init()
Our global init task can have sub-threads, so ->pid check is not reliable
enough for is_global_init(), we need to check tgid instead. This has been
spotted by Oleg and a fix was proposed by Richard a long time ago (see the
link below).
Oleg wrote:
: Because is_global_init() is only true for the main thread of /sbin/init.
:
: Just look at oom_unkillable_task(). It tries to not kill init. But, say,
: select_bad_process() can happily find a sub-thread of is_global_init()
: and still kill it.
I recently hit the problem in question; re-sending the patch (to the
best of my knowledge it has never been submitted) with updated function
comment. Credit goes to Oleg and Richard.
Suggested-by: Richard Guy Briggs <rgb@redhat.com>
Reported-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Eric W . Biederman <ebiederm@xmission.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Serge E . Hallyn <serge.hallyn@ubuntu.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: https://www.redhat.com/archives/linux-audit/2013-December/msg00086.html
Signed-off-by: Ingo Molnar <mingo@kernel.org>