AgeCommit message (Collapse)AuthorFilesLines
2016-02-16mm/gup: Switch all callers of get_user_pages() to not pass tsk/mmDave Hansen29-64/+44
We will soon modify the vanilla get_user_pages() so it can no longer be used on mm/tasks other than 'current/current->mm', which is by far the most common way it is called. For now, we allow the old-style calls, but warn when they are used. (implemented in previous patch) This patch switches all callers of: get_user_pages() get_user_pages_unlocked() get_user_pages_locked() to stop passing tsk/mm so they will no longer see the warnings. Signed-off-by: Dave Hansen <> Reviewed-by: Thomas Gleixner <> Cc: Andrea Arcangeli <> Cc: Andrew Morton <> Cc: Andy Lutomirski <> Cc: Borislav Petkov <> Cc: Brian Gerst <> Cc: Dave Hansen <> Cc: Denys Vlasenko <> Cc: H. Peter Anvin <> Cc: Kirill A. Shutemov <> Cc: Linus Torvalds <> Cc: Naoya Horiguchi <> Cc: Peter Zijlstra <> Cc: Rik van Riel <> Cc: Srikar Dronamraju <> Cc: Vlastimil Babka <> Cc: Cc: Link: Signed-off-by: Ingo Molnar <>
2016-02-16mm/gup: Overload get_user_pages() functionsDave Hansen4-46/+158
The concept here was a suggestion from Ingo. The implementation horrors are all mine. This allows get_user_pages(), get_user_pages_unlocked(), and get_user_pages_locked() to be called with or without the leading tsk/mm arguments. We will give a compile-time warning about the old style being __deprecated and we will also WARN_ON() if the non-remote version is used for a remote-style access. Doing this, folks will get nice warnings and will not break the build. This should be nice for -next and will hopefully let developers fix up their own code instead of maintainers needing to do it at merge time. The way we do this is hideous. It uses the __VA_ARGS__ macro functionality to call different functions based on the number of arguments passed to the macro. There's an additional hack to ensure that our EXPORT_SYMBOL() of the deprecated symbols doesn't trigger a warning. We should be able to remove this mess as soon as -rc1 hits in the release after this is merged. Signed-off-by: Dave Hansen <> Cc: Al Viro <> Cc: Alexander Kuleshov <> Cc: Andrea Arcangeli <> Cc: Andrew Morton <> Cc: Dan Williams <> Cc: Dave Hansen <> Cc: Dominik Dingel <> Cc: Geliang Tang <> Cc: Jan Kara <> Cc: Johannes Weiner <> Cc: Kirill A. Shutemov <> Cc: Konstantin Khlebnikov <> Cc: Leon Romanovsky <> Cc: Linus Torvalds <> Cc: Masahiro Yamada <> Cc: Mateusz Guzik <> Cc: Maxime Coquelin <> Cc: Michal Hocko <> Cc: Naoya Horiguchi <> Cc: Oleg Nesterov <> Cc: Paul Gortmaker <> Cc: Peter Zijlstra <> Cc: Srikar Dronamraju <> Cc: Thomas Gleixner <> Cc: Vladimir Davydov <> Cc: Vlastimil Babka <> Cc: Xie XiuQi <> Cc: Cc: Link: Signed-off-by: Ingo Molnar <>
2016-02-16mm/gup: Introduce get_user_pages_remote()Dave Hansen11-27/+77
For protection keys, we need to understand whether protections should be enforced in software or not. In general, we enforce protections when working on our own task, but not when on others. We call these "current" and "remote" operations. This patch introduces a new get_user_pages() variant: get_user_pages_remote() Which is a replacement for when get_user_pages() is called on non-current tsk/mm. We also introduce a new gup flag: FOLL_REMOTE which can be used for the "__" gup variants to get this new behavior. The uprobes is_trap_at_addr() location holds mmap_sem and calls get_user_pages(current->mm) on an instruction address. This makes it a pretty unique gup caller. Being an instruction access and also really originating from the kernel (vs. the app), I opted to consider this a 'remote' access where protection keys will not be enforced. Without protection keys, this patch should not change any behavior. Signed-off-by: Dave Hansen <> Reviewed-by: Thomas Gleixner <> Cc: Andrea Arcangeli <> Cc: Andrew Morton <> Cc: Andy Lutomirski <> Cc: Borislav Petkov <> Cc: Brian Gerst <> Cc: Dave Hansen <> Cc: Denys Vlasenko <> Cc: H. Peter Anvin <> Cc: Kirill A. Shutemov <> Cc: Linus Torvalds <> Cc: Naoya Horiguchi <> Cc: Peter Zijlstra <> Cc: Rik van Riel <> Cc: Srikar Dronamraju <> Cc: Vlastimil Babka <> Cc: Cc: Link: Signed-off-by: Ingo Molnar <>
2016-02-16Merge branches 'x86/fpu', 'x86/mm' and 'x86/asm' into x86/pkeysIngo Molnar94-1001/+1129
Provide a stable basis for the pkeys patches, which touches various x86 details. Signed-off-by: Ingo Molnar <>
2016-02-16x86/cpufeature: Speed up cpu_feature_enabled()Borislav Petkov1-2/+1
When GCC cannot do constant folding for this macro, it falls back to cpu_has(). But static_cpu_has() is optimal and it works at all times now. So use it and speedup the fallback case. Before we had this: mov 0x99d674(%rip),%rdx # ffffffff81b0d9f4 <boot_cpu_data+0x34> shr $0x2e,%rdx and $0x1,%edx jne ffffffff811704e9 <do_munmap+0x3f9> After alternatives patching, it turns into: jmp 0xffffffff81170390 nopl (%rax) ... callq ffffffff81056e00 <mpx_notify_unmap> ffffffff81170390: mov 0x170(%r12),%rdi Signed-off-by: Borislav Petkov <> Cc: Joerg Roedel <> Cc: Linus Torvalds <> Cc: Peter Zijlstra <> Cc: Thomas Gleixner <> Link: Signed-off-by: Ingo Molnar <>
2016-02-14MAINTAINERS: Update mailing list for Renesas ARM64 SoC DevelopmentSimon Horman1-2/+2
Update the mailing list used for development of support for ARM64 Renesas SoCs. This is a follow-up for a similar change for other Renesas SoCs and drivers uses by Renesas SoCs. The ARM64 SoC entry was not updated in that patch as it was not yet present in mainline. The motivation for the mailing list update is that Renesas SoCs are now much wider than the SH architecture and there is some desire from some for the linux-sh list to refocus on discussion of the work on the SH architecture. Acked-by: Magnus Damm <> Acked-by: Geert Uytterhoeven <> Signed-off-by: Simon Horman <> Signed-off-by: Linus Torvalds <>
2016-02-14Merge branch 'drm-fixes' of git:// Torvalds10-26/+75
Pull i915 drm fixes from Dave Airlie: "Jani sent a bunch of i915 display fixes as my weekend started, but hopefully you can fit them in" * 'drm-fixes' of git:// drm/i915: fix error path in intel_setup_gmbus() drm/i915/skl: Fix typo in DPLL_CFGCR1 definition drm/i915/skl: Don't skip mst encoders in skl_ddi_pll_select() drm/i915: Pretend cursor is always on for ILK-style WM calculations (v2) drm/i915/dp: reduce missing TPS3 support errors to debug logging drm/i915/dp: abstract training pattern selection drm/i915/dsi: skip gpio element execution when not supported drm/i915/dsi: don't pass arbitrary data to sideband drm/i915/dsi: defend gpio table against out of bounds access drm/i915/bxt: Don't save/restore eDP panel power during suspend (v3) drm/i915: Allow i915_gem_object_get_page() on userptr as well
2016-02-14Linux 4.5-rc4Linus Torvalds1-1/+1
2016-02-15Merge tag 'drm-intel-fixes-2016-02-12' of ↵Dave Airlie10-26/+75
git:// into drm-fixes i915 display fixes mostly. * tag 'drm-intel-fixes-2016-02-12' of git:// drm/i915: fix error path in intel_setup_gmbus() drm/i915/skl: Fix typo in DPLL_CFGCR1 definition drm/i915/skl: Don't skip mst encoders in skl_ddi_pll_select() drm/i915: Pretend cursor is always on for ILK-style WM calculations (v2) drm/i915/dp: reduce missing TPS3 support errors to debug logging drm/i915/dp: abstract training pattern selection drm/i915/dsi: skip gpio element execution when not supported drm/i915/dsi: don't pass arbitrary data to sideband drm/i915/dsi: defend gpio table against out of bounds access drm/i915/bxt: Don't save/restore eDP panel power during suspend (v3) drm/i915: Allow i915_gem_object_get_page() on userptr as well
2016-02-14Merge tag 'char-misc-4.5-rc4' of ↵Linus Torvalds3-1/+12
git:// Pull char/misc driver fixes from Greg KH: "Here are 3 fixes for some reported issues. Two nvmem driver fixes, and one mei fix. All have been in linux-next just fine" * tag 'char-misc-4.5-rc4' of git:// nvmem: qfprom: Specify LE device endianness nvmem: core: return error for non word aligned access mei: validate request value in client notify request ioctl
2016-02-14Merge tag 'driver-core-4.5-rc4' of ↵Linus Torvalds1-3/+3
git:// Pull driver core fix from Greg KH: "Here is one driver core, well klist, fix for 4.5-rc4. It fixes a problem found in the scsi device list traversal that probably also could be triggered by other subsystems. The fix has been in linux-next for a while with no reported problems" * tag 'driver-core-4.5-rc4' of git:// klist: fix starting point removed bug in klist iterators
2016-02-14Merge tag 'tty-4.5-rc4' of ↵Linus Torvalds7-7/+79
git:// Pull tty/serial fixes from Greg KH: "Here are a number of small tty and serial driver fixes for 4.5-rc4 that resolve some reported issues. One of them got reverted as it wasn't correct based on testing, and all have been in linux-next for a while" * tag 'tty-4.5-rc4' of git:// Revert "8250: uniphier: allow modular build with 8250 console" pty: make sure super_block is still valid in final /dev/tty close pty: fix possible use after free of tty->driver_data tty: Add support for PCIe WCH382 2S multi-IO card serial/omap: mark wait_for_xmitr as __maybe_unused serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485) 8250: uniphier: allow modular build with 8250 console tty: Drop krefs for interrupted tty lock
2016-02-14Merge tag 'usb-4.5-rc4' of ↵Linus Torvalds3-12/+19
git:// Pull PHY fixes from Greg KH: "Here are a couple of PHY driver fixes for 4.5-rc4. A few small phy issues. All have been in linux-next with no reported issues" * tag 'usb-4.5-rc4' of git:// phy: twl4030-usb: Fix unbalanced pm_runtime_enable on module reload phy: twl4030-usb: Relase usb phy on unload phy: core: fix wrong err handle for phy_power_on phy: Restrict phy-hi6220-usb to HiSilicon arm64
2016-02-14Merge branch 'perf-urgent-for-linus' of ↵Linus Torvalds5-26/+63
git:// Pull perf tooling fixes from Thomas Gleixner: "Another round of fixes for the perf tooling side: - Prevent a NULL pointer dereference in tracepoint error handling - Fix a thread handling bug in the intel_pt error handling code - Search both .eh_frame and .debug_frame sections as toolchains seem to have random choices of storing the CFI information - Fix the perf state interval output values, which got broken when fixing the overall output" * 'perf-urgent-for-linus' of git:// perf stat: Fix interval output values perf probe: Search both .eh_frame and .debug_frame sections for probe location perf tools: Fix thread lifetime related segfaut in intel_pt perf tools: tracepoint_error() can receive e=NULL, robustify it
2016-02-14Merge branch 'locking-urgent-for-linus' of ↵Linus Torvalds1-6/+10
git:// Pull lockdep fix from Thomas Gleixner: "A single fix for the stack trace caching logic in lockdep, where the duplicate avoidance managed to store no back trace at all" * 'locking-urgent-for-linus' of git:// locking/lockdep: Fix stack trace caching logic
2016-02-14Merge branch 'timers-urgent-for-linus' of ↵Linus Torvalds1-2/+3
git:// Pull timer fix from Thomas Gleixner: "A single fix preventing a 32bit overflow in timespec/val to cputime conversions on 32bit machines" * 'timers-urgent-for-linus' of git:// cputime: Prevent 32bit overflow in time[val|spec]_to_cputime()
2016-02-14Merge branch 'irq-urgent-for-linus' of ↵Linus Torvalds4-14/+18
git:// Pull irqchip fixes from Thomas Gleixner: "Another set of ARM SoC related irqchip fixes: - Plug a memory leak in gicv3-its - Limit features to the root gic interrupt controller - Add a missing barrier in the gic-v3 IAR access - Another compile test fix for sun4i" * 'irq-urgent-for-linus' of git:// irqchip/gic-v3: Make sure read from ICC_IAR1_EL1 is visible on redestributor irqchip/gic: Only set the EOImodeNS bit for the root controller irqchip/gic: Only populate set_affinity for the root controller irqchip/gicv3-its: Fix memory leak in its_free_tables() irqchip/sun4i: Fix compilation outside of arch/arm
2016-02-14Merge branch 'x86-urgent-for-linus' of ↵Linus Torvalds2-2/+2
git:// Pull x86 fixes from Thomas Gleixner: "Two small fixlets for x86: - Prevent a KASAN false positive in thread_saved_pc() - Fix a 32-bit truncation problem in the x86 numa code" * 'x86-urgent-for-linus' of git:// x86/mm/numa: Fix 32-bit memblock range truncation bug on 32-bit NUMA kernels x86: Fix KASAN false positives in thread_saved_pc()
2016-02-14Merge branch 'upstream' of git:// Torvalds21-71/+46
Pull MIPS fixes from Ralf Baechle: "Here's the first round of MIPS fixes after the merge window: - Detect Octeon III's PCI correctly. - Fix return value of the MT7620 probing function. - Wire up the copy_file_range syscall. - Fix 64k page support on 32 bit kernels. - Fix the early Coherency Manager probe. - Allow only hardware-supported page sizes to be selected for R6000. - Fix corner cases for the RDHWR nstruction emulation on old hardware. - Fix FPU handling corner cases. - Remove stale entry for BCM33xx from the MAINTAINERS file. - 32 and 64 bit ELF headers are different, handle them correctly" * 'upstream' of git:// mips: Differentiate between 32 and 64 bit ELF header MIPS: Octeon: Update OCTEON_FEATURE_PCIE for Octeon III MIPS: pci-mt7620: Fix return value check in mt7620_pci_probe() MIPS: Fix early CM probing MIPS: Wire up copy_file_range syscall. MIPS: Fix 64k page support for 32 bit kernels. MIPS: R6000: Don't allow 64k pages for R6000. MIPS: traps.c: Correct microMIPS RDHWR emulation MIPS: traps.c: Don't emulate RDHWR in the CpU #0 exception handler MAINTAINERS: Remove stale entry for BCM33xx chips MIPS: Fix FPU disable with preemption MIPS: Properly disable FPU in start_thread() MIPS: Fix buffer overflow in syscall_get_arguments()
2016-02-14Merge branch 'fixes' of git:// Torvalds1-2/+7
Pull ARM fixes from Russell King: "A couple of ARM fixes from Linus for the ICST clock generator code" [ "Linus" here is Linus Walleij. Name-stealer. Linus "there can be only one" Torvalds ] * 'fixes' of git:// ARM: 8519/1: ICST: try other dividends than 1 ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz()
2016-02-14Merge branch 'component' of git:// Torvalds1-21/+28
Pull component helper fixes from Russell King: "A few fixes for problems people have encountered with the recent update to the component helpers" * 'component' of git:// component: remove device from master match list on failed add component: Detach components when deleting master struct component: fix crash on x86_64 with hda audio drivers
2016-02-14x86/mm: Fix INVPCID asm constraintBorislav Petkov1-2/+2
So we want to specify the dependency on both @pcid and @addr so that the compiler doesn't reorder accesses to them *before* the TLB flush. But for that to work, we need to express this properly in the inline asm and deref the whole desc array, not the pointer to it. See clwb() for an example. This fixes the build error on 32-bit: arch/x86/include/asm/tlbflush.h: In function ‘__invpcid’: arch/x86/include/asm/tlbflush.h:26:18: error: memory input 0 is not directly addressable which gcc4.7 caught but 5.x didn't. Which is strange. :-\ Signed-off-by: Borislav Petkov <> Cc: Andrew Morton <> Cc: Andrey Ryabinin <> Cc: Andy Lutomirski <> Cc: Borislav Petkov <> Cc: Brian Gerst <> Cc: Dave Hansen <> Cc: Denys Vlasenko <> Cc: H. Peter Anvin <> Cc: Linus Torvalds <> Cc: Luis R. Rodriguez <> Cc: Michael Matz <> Cc: Oleg Nesterov <> Cc: Peter Zijlstra <> Cc: Thomas Gleixner <> Cc: Toshi Kani <> Cc: Signed-off-by: Ingo Molnar <>
2016-02-13Merge tag 'for-linus' of ↵Linus Torvalds4-16/+27
git:// Pull more rdma fixes from Doug Ledford: "I think we are getting pretty close to done now. There are four one-off fixes in this update: - fix ipoib multicast joins - fix mlx4 error handling - fix mlx5 size computation - fix a thinko in core code" * tag 'for-linus' of git:// IB/mlx5: Fix RC transport send queue overhead computation IB/ipoib: fix for rare multicast join race condition IB/core: Fix reading capability mask of the port info class net/mlx4: fix some error handling in mlx4_multi_func_init()
2016-02-13Merge git:// Torvalds18-290/+567
Pull SCSI target fixes from Nicholas Bellinger: "This includes the long awaited series to address a set of bugs around active I/O remote-port LUN_RESET, as well as properly handling this same case with concurrent fabric driver session disconnect -> reconnect. Note this set of LUN_RESET bug-fixes has been surviving extended testing on both v4.5-rc1 and v3.14.y code over the last weeks, and is CC'ed for stable as it's something folks using multiple ESX connected hosts with slow backends can certainly trigger. The highlights also include: - Fix WRITE_SAME/DISCARD emulation 4k sector conversion in target/iblock (Mike Christie) - Fix TMR abort interaction and AIO type TMR response in qla2xxx target (Quinn Tran + Swapnil Nagle) - Fix >= v3.17 stale descriptor pointer regression in qla2xxx target (Quinn Tran) - Fix >= v4.5-rc1 return regression with unmap_zeros_data_store new configfs store handler (nab) - Add CPU affinity flag + convert qla2xxx to use bit (Quinn + HCH + Bart)" * git:// qla2xxx: use TARGET_SCF_USE_CPUID flag to indiate CPU Affinity target/transport: add flag to indicate CPU Affinity is observed target: Fix incorrect unmap_zeroes_data_store return qla2xxx: Use ATIO type to send correct tmr response qla2xxx: Fix stale pointer access. target/user: Fix cast from pointer to phys_addr_t target: Drop legacy se_cmd->task_stop_comp + REQUEST_STOP usage target: Fix race with SCF_SEND_DELAYED_TAS handling target: Fix remote-port TMR ABORT + se_cmd fabric stop target: Fix TAS handling for multi-session se_node_acls target: Fix LUN_RESET active TMR descriptor handling target: Fix LUN_RESET active I/O handling for ACK_KREF qla2xxx: Fix TMR ABORT interaction issue between qla2xxx and TCM qla2xxx: Fix warning reported by static checker target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors
2016-02-13Merge branch 'fixes' of ↵Linus Torvalds7-35/+94
git:// Pull thermal management fixes from Eduardo Valentin: "Specifics in this pull request: - Compilation fixes on SPEAR, and U8500 thermal drivers. - RCAR thermal driver now recognizes OF-thermal based thermal zones. - Small code rework on OF-thermal. - These change have been CI tested using KernelCI bot [1,2]. \o/ I am taking over on Rui's behalf while he is out. Happy New Chinese Year! [1] - [2] -" * 'fixes' of git:// thermal: cpu_cooling: fix out of bounds access in time_in_idle thermal: allow u8500-thermal driver to be a module thermal: allow spear-thermal driver to be a module thermal: spear: use __maybe_unused for PM functions thermal: rcar: enable to use thermal-zone on DT thermal: of: use for_each_available_child_of_node for child iterator
2016-02-13Merge tag 'sound-fix-4.5-rc4' of ↵Linus Torvalds1-1/+0
git:// Pull another sound fix from Takashi Iwai: "This contains a fix for the double-free of usb-audio MIDI device at probe failure" * tag 'sound-fix-4.5-rc4' of git:// ALSA: usb-audio: avoid freeing umidi object twice
2016-02-13Merge tag 'arc-4.5-fixes' of ↵Linus Torvalds11-61/+119
git:// Pull ARC fixes from Vineet Gupta: "I've been sitting on some of these fixes for a while. - Corner case of returning to delay slot from interrupt - Changing default interrupt prioiry level - Kconfig'ize support for super pages - Other minor fixes" * tag 'arc-4.5-fixes' of git:// ARC: mm: Introduce explicit super page size support ARCv2: intc: Allow interruption by lowest priority interrupt ARCv2: Check for LL-SC livelock only if LLSC is enabled ARC: shrink cpuinfo by not saving full timer BCR ARCv2: clocksource: Rename GRTC -> GFRC ... ARCv2: STAR 9000950267: Handle return from intr to Delay Slot #2
2016-02-13ALSA: usb-audio: avoid freeing umidi object twiceAndrey Konovalov1-1/+0
The 'umidi' object will be free'd on the error path by snd_usbmidi_free() when tearing down the rawmidi interface. So we shouldn't try to free it in snd_usbmidi_create() after having registered the rawmidi interface. Found by KASAN. Signed-off-by: Andrey Konovalov <> Acked-by: Clemens Ladisch <> Cc: <> Signed-off-by: Takashi Iwai <>
2016-02-12Merge tag 'pci-v4.5-fixes-1' of ↵Linus Torvalds6-24/+14
git:// Pull PCI fixes from Bjorn Helgaas: "These are some Renesas binding updates for PCI host controllers, a Broadcom fix for a regression we added in v4.5-rc1, and a fix for an AER use-after-free problem that can cause memory corruption. Summary: AER: Flush workqueue on device remove to avoid use-after-free (Sebastian Andrzej Siewior) Broadcom iProc host bridge driver: Allow multiple devices except on PAXC (Ray Jui) Renesas R-Car host bridge driver: Add gen2 device tree support for r8a7793 (Simon Horman) Add device tree support for r8a7793 (Simon Horman)" * tag 'pci-v4.5-fixes-1' of git:// PCI: rcar: Add device tree support for r8a7793 PCI: rcar: Add gen2 device tree support for r8a7793 PCI: iproc: Allow multiple devices except on PAXC PCI/AER: Flush workqueue on device remove to avoid use-after-free
2016-02-12Merge branch 'akpm'(patches from Andrew)Linus Torvalds13-57/+62
Merge fixes from Andrew Morton: "10 fixes" The lockdep hlist conversion is in the locking tree too, waiting for the next merge window. Andrew thought it should go in now. I'll take it, since it fixes a real problem and looks trivially correct (famous last words). * emailed patches from Andrew Morton <>: arch/x86/Kconfig: CONFIG_X86_UV should depend on CONFIG_EFI mm: fix pfn_t vs highmem kernel/locking/lockdep.c: convert hash tables to hlists mm,thp: fix spellos in describing __HAVE_ARCH_FLUSH_PMD_TLB_RANGE mm,thp: khugepaged: call pte flush at the time of collapse mm/backing-dev.c: fix error path in wb_init() mm, dax: check for pmd_none() after split_huge_pmd() vsprintf: kptr_restrict is okay in IRQ when 2 mm: fix filemap.c kernel doc warning ubsan: cosmetic fix to Kconfig text
2016-02-12IB/mlx5: Fix RC transport send queue overhead computationLeon Romanovsky1-5/+7
Fix the RC QPs send queue overhead computation to take into account two additional segments in the WQE which are needed for registration operations. The ATOMIC and UMR segments can't coexist together, so chose maximum out of them. The commit 9e65dc371b5c ("IB/mlx5: Fix RC transport send queue overhead computation") was intended to update RC transport as commit messages states, but added the code to UC transport. Fixes: 9e65dc371b5c ("IB/mlx5: Fix RC transport send queue overhead computation") Signed-off-by: Kamal Heib <> Signed-off-by: Leon Romanovsky <> Reviewed-by: Sagi Grimberg <> Signed-off-by: Doug Ledford <>
2016-02-12IB/ipoib: fix for rare multicast join race conditionAlex Estrin1-7/+17
A narrow window for race condition still exist between multicast join thread and *dev_flush workers. A kernel crash caused by prolong erratic link state changes was observed (most likely a faulty cabling): [167275.656270] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 [167275.665973] IP: [<ffffffffa05f8f2e>] ipoib_mcast_join+0xae/0x1d0 [ib_ipoib] [167275.674443] PGD 0 [167275.677373] Oops: 0000 [#1] SMP ... [167275.977530] Call Trace: [167275.982225] [<ffffffffa05f92f0>] ? ipoib_mcast_free+0x200/0x200 [ib_ipoib] [167275.992024] [<ffffffffa05fa1b7>] ipoib_mcast_join_task+0x2a7/0x490 [ib_ipoib] [167276.002149] [<ffffffff8109d5fb>] process_one_work+0x17b/0x470 [167276.010754] [<ffffffff8109e3cb>] worker_thread+0x11b/0x400 [167276.019088] [<ffffffff8109e2b0>] ? rescuer_thread+0x400/0x400 [167276.027737] [<ffffffff810a5aef>] kthread+0xcf/0xe0 Here was a hit spot: ipoib_mcast_join() { .............. rec.qkey = priv->broadcast->mcmember.qkey; ^^^^^^^ ..... } Proposed patch should prevent multicast join task to continue if link state change is detected. Signed-off-by: Alex Estrin <> Changes from v4: - as suggested by Doug Ledford, optimized spinlock usage, i.e. ipoib_mcast_join() is called with lock held. Changes from v3: - sync with priv->lock before flag check. Chages from v2: - Move check for OPER_UP flag state to mcast_join() to ensure no event worker is in progress. - minor style fixes. Changes from v1: - No need to lock again if error detected. Signed-off-by: Doug Ledford <>
2016-02-12Merge tag 'mmc-v4.5-rc2' of git:// Torvalds9-36/+93
Pull MMC fixes from Ulf Hansson: "Here are some mmc fixes intended for v4.5 rc4. MMC core: - Fix an sysfs ABI regression - Return an error in a specific error path dealing with mmc ioctls MMC host: - sdhci-pci|acpi: Fix card detect race for Intel BXT/APL - sh_mmcif: Correct TX DMA channel allocation - mmc_spi: Fix error handling for dma mapping errors - sdhci-of-at91: Fix an unbalance issue for the runtime PM usage count - pxamci: Fix the device-tree probe deferral path - pxamci: Fix read-only GPIO polarity" * tag 'mmc-v4.5-rc2' of git:// Revert "mmc: block: don't use parameter prefix if built as module" mmc: sdhci-acpi: Fix card detect race for Intel BXT/APL mmc: sdhci-pci: Fix card detect race for Intel BXT/APL mmc: sdhci: Allow override of get_cd() called from sdhci_request() mmc: sdhci: Allow override of mmc host operations mmc: sh_mmcif: Correct TX DMA channel allocation mmc: block: return error on failed mmc_blk_get() mmc: pxamci: fix the device-tree probe deferral path mmc: mmc_spi: add checks for dma mapping error mmc: sdhci-of-at91: fix pm runtime unbalanced issue in error path mmc: pxamci: fix again read-only gpio detection polarity
2016-02-12Merge tag 'sound-4.5-rc4' of ↵Linus Torvalds42-209/+292
git:// Pull sound fixes from Takashi Iwai: "In this rc, we've got more volume than previous rc, unsurprisingly; the majority of updates in ASoC are about Intel drivers, and another major changes are the continued plumbing of ALSA timer bugs revealed by syzkaller fuzzer. Hopefully both settle down now. Other than that, HD-audio received a couple of code fixes as well as the usual quirks, and various small fixes are found for FireWire devices, ASoC codecs and drivers" * tag 'sound-4.5-rc4' of git:// (50 commits) ASoC: arizona: fref must be limited in pseudo-fractional mode ASoC: sigmadsp: Fix missleading return value ALSA: timer: Fix race at concurrent reads ALSA: firewire-digi00x: Drop bogus const type qualifier on dot_scrt() ALSA: hda - Fix bad dereference of jack object ALSA: timer: Fix race between stop and interrupt ALSA: timer: Fix wrong instance passed to slave callbacks ASoC: Intel: Add module tags for common match module ASoC: Intel: Load the atom DPCM driver only ASoC: Intel: Create independent acpi match module ASoC: Intel: Revert "ASoC: Intel: fix ACPI probe regression with Atom DPCM driver" ALSA: dummy: Implement timer backend switching more safely ALSA: hda - Fix speaker output from VAIO AiO machines Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo" ALSA: firewire-tascam: remove needless member for control and status message ALSA: firewire-tascam: remove a flag for controller ALSA: firewire-tascam: add support for FW-1804 ALSA: firewire-tascam: fix NULL pointer dereference when model identification fails ALSA: hda - Fix static checker warning in patch_hdmi.c ASoC: Intel: Skylake: Remove autosuspend delay ...
2016-02-12Merge tag 'fbdev-fixes-4.5' of ↵Linus Torvalds6-33/+41
git:// Pull fbdev fixes from Tomi Valkeinen: - fix omap2plus_defconfig to enable omapfb as it was in v4.4 - ocfb: fix timings for margins - s6e8ax0, da8xx-fb: fix compile warnings - mmp: fix build failure caused by bad printk parameters - imxfb: fix clock issue which kept the display off * tag 'fbdev-fixes-4.5' of git:// video: fbdev: imxfb: Provide a reset mechanism fbdev: mmp: print IRQ resource using %pR format string fbdev: da8xx-fb: remove incorrect type cast fbdev: s6e8ax0: avoid unused function warnings ocfb: fix tgdel and tvdel timing parameters ARM: omap2plus_defconfig: update display configs
2016-02-12Merge tag 'scsi-fixes' of ↵Linus Torvalds8-20/+31
git:// Pull SCSI fixes from James Bottomley: "A set of seven fixes: Two regressions in the new hisi_sas arm driver, a blacklist entry for the marvell console which was causing a reset cascade without it, a race fix in the WRITE_SAME/DISCARD routines, a retry fix for the rdac driver, without which, it would prematurely return EIO and a couple of fixes for the hyper-v storvsc driver" * tag 'scsi-fixes' of git:// block/sd: Return -EREMOTEIO when WRITE SAME and DISCARD are disabled SCSI: Add Marvell Console to VPD blacklist scsi_dh_rdac: always retry MODE SELECT on command lock violation storvsc: Use the specified target ID in device lookup storvsc: Install the storvsc specific timeout handler for FC devices hisi_sas: fix v1 hw check for slot error hisi_sas: add dependency for HAS_IOMEM
2016-02-12Merge branch 'drm-fixes' of git:// Torvalds25-257/+373
Pull drm amd fixes from Dave Airlie: "Been pretty quiet. This is an amdgpu fixes pull from AMD, a bunch of powerplay stability fixes, race fix, hibernate fix, and a possible circular locking fix" * 'drm-fixes' of git:// (21 commits) drm/amdgpu: fix issue with overlapping userptrs drm/radeon: hold reference to fences in radeon_sa_bo_new drm/amdgpu: remove unnecessary forward declaration drm/amdgpu: hold reference to fences in amdgpu_sa_bo_new (v2) drm/amdgpu: fix s4 resume drm/amdgpu/cz: plumb pg flags through to powerplay drm/amdgpu/tonga: plumb pg flags through to powerplay drma/dmgpu: move cg and pg flags into shared headers drm/amdgpu: remove unused cg defines drm/amdgpu: add a cgs interface to fetch cg and pg flags drm/amd/powerplay/tonga: disable vce pg drm/amd/powerplay/tonga: disable uvd pg drm/amd/powerplay/cz: disable vce pg drm/amd/powerplay/cz: disable uvd pg drm/amdgpu: be consistent with uvd cg flags drm/amdgpu: clean up vce pg flags for cz/st drm/amdgpu: handle vce pg flags properly drm/amdgpu: handle uvd pg flags properly drm/amdgpu/dpm/ci: switch over to the common pcie caps interface drm/amdgpu/cik: don't mess with aspm if gpu is root bus ...
2016-02-12Merge branch 'for-linus' of ↵Linus Torvalds1-1/+2
git:// Pull crypto fix from James Morris. * 'for-linus' of git:// EVM: Use crypto_memneq() for digest comparisons
2016-02-12Merge branch 'for-linus-4.5' of ↵Linus Torvalds8-71/+131
git:// Pull btrfs fixes from Chris Mason: "This has a few fixes from Filipe, along with a readdir fix from Dave that we've been testing for some time" * 'for-linus-4.5' of git:// btrfs: properly set the termination value of ctx->pos in readdir Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Btrfs: remove no longer used function extent_read_full_page_nolock() Btrfs: fix page reading in extent_same ioctl leading to csum errors Btrfs: fix invalid page accesses in extent_same (dedup) ioctl
2016-02-12Merge tag 'xfs-fixes-for-linus-4.5' of ↵Linus Torvalds1-2/+2
git:// Pull xfs fix from Dve Chinner: "This contains a fix for an endian conversion issue in new CRC validation in log recovery that was discovered on a ppc64 platform" * tag 'xfs-fixes-for-linus-4.5' of git:// xfs: fix endianness error when checking log block crc on big endian platforms
2016-02-12Merge tag 'asoc-fix-v4.5-rc4' of ↵Takashi Iwai29-144/+221
git:// into for-linus ASoC: Fixes for v4.5 A rather large batch of fixes here, almost all in the Intel driver. The changes that got merged in this merge window for Skylake were rather large and as well as issues that you'd expect in a large block of new code there were some problems created for older processors which needed fixing up. Things are largely settling down now hopefully.
2016-02-12EVM: Use crypto_memneq() for digest comparisonsRyan Ware1-1/+2
This patch fixes vulnerability CVE-2016-2085. The problem exists because the vm_verify_hmac() function includes a use of memcmp(). Unfortunately, this allows timing side channel attacks; specifically a MAC forgery complexity drop from 2^128 to 2^12. This patch changes the memcmp() to the cryptographically safe crypto_memneq(). Reported-by: Xiaofei Rex Guo <> Signed-off-by: Ryan Ware <> Cc: Signed-off-by: Mimi Zohar <> Signed-off-by: James Morris <>
2016-02-12ARC: mm: Introduce explicit super page size supportVineet Gupta2-19/+45
MMUv4 supports 2 concurrent page sizes: Normal and Super [4K to 16M] So far Linux supported a single super page size for a given Normal page, depending on the software page walking address split. e.g. we had 11:8:13 address split for 8K page, which meant super page was 2 ^(8+13) = 2M (given that THP size has to be PMD_SHIFT) Now we turn this around, by allowing multiple Super Pages in Kconfig (currently 2M and 16M only) and forcing page walker address split to PGDIR_SHIFT and PAGE_SHIFT For configs without Super page, things are same as before and PGDIR_SHIFT can be hacked to get non default address split The motivation for this change is a customer who needs 16M super page and a 8K Normal page combo. Signed-off-by: Vineet Gupta <>
2016-02-11Merge tag 'phy-for-4.5-rc' of ↵Greg Kroah-Hartman3-12/+19
git:// into usb-linus Kishon writes: phy: for 4.5-rc *) Fix error handling code in phy core [phy_power_on()] *) phy-twl4030-usb fixes for unloading the module *) Restrict phy-hi6220-usb to HiSilicon arm64 Signed-off-by: Kishon Vijay Abraham I <>
2016-02-11arch/x86/Kconfig: CONFIG_X86_UV should depend on CONFIG_EFIAndrew Morton1-0/+1
arch/x86/built-in.o: In function `uv_bios_call': (.text+0xeba00): undefined reference to `efi_call' Reported-by: kbuild test robot <> Suggested-by: "H. Peter Anvin" <> Cc: Ingo Molnar <> Reviewed-by: Matt Fleming <> Acked-by: Alex Thorlton <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2016-02-11mm: fix pfn_t vs highmemDan Williams3-12/+11
The pfn_t type uses an unsigned long to store a pfn + flags value. On a 64-bit platform the upper 12 bits of an unsigned long are never used for storing the value of a pfn. However, this is not true on highmem platforms, all 32-bits of a pfn value are used to address a 44-bit physical address space. A pfn_t needs to store a 64-bit value. Link: Fixes: 01c8f1c44b83 ("mm, dax, gpu: convert vm_insert_mixed to pfn_t") Signed-off-by: Dan Williams <> Reported-by: Stuart Foster <> Reported-by: Julian Margetson <> Tested-by: Julian Margetson <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2016-02-11kernel/locking/lockdep.c: convert hash tables to hlistsAndrew Morton2-25/+21
Mike said: : CONFIG_UBSAN_ALIGNMENT breaks x86-64 kernel with lockdep enabled, i. e : kernel with CONFIG_UBSAN_ALIGNMENT fails to load without even any error : message. : : The problem is that ubsan callbacks use spinlocks and might be called : before lockdep is initialized. Particularly this line in the : reserve_ebda_region function causes problem: : : lowmem = *(unsigned short *)__va(BIOS_LOWMEM_KILOBYTES); : : If i put lockdep_init() before reserve_ebda_region call in : x86_64_start_reservations kernel loads well. Fix this ordering issue permanently: change lockdep so that it uses hlists for the hash tables. Unlike a list_head, an hlist_head is in its initialized state when it is all-zeroes, so lockdep is ready for operation immediately upon boot - lockdep_init() need not have run. The patch will also save some memory. lockdep_init() and lockdep_initialized can be done away with now - a 4.6 patch has been prepared to do this. Reported-by: Mike Krinkin <> Suggested-by: Mike Krinkin <> Cc: Andrey Ryabinin <> Cc: Ingo Molnar <> Cc: Peter Zijlstra <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2016-02-11mm,thp: fix spellos in describing __HAVE_ARCH_FLUSH_PMD_TLB_RANGEVineet Gupta1-2/+2
[ s/threshhold/threshold/] Signed-off-by: Vineet Gupta <> Cc: Kirill A. Shutemov <> Cc: Aneesh Kumar K.V <> Cc: Andrea Arcangeli <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2016-02-11mm,thp: khugepaged: call pte flush at the time of collapseVineet Gupta1-1/+3
This showed up on ARC when running LMBench bw_mem tests as Overlapping TLB Machine Check Exception triggered due to STLB entry (2M pages) overlapping some NTLB entry (regular 8K page). bw_mem 2m touches a large chunk of vaddr creating NTLB entries. In the interim khugepaged kicks in, collapsing the contiguous ptes into a single pmd. pmdp_collapse_flush()->flush_pmd_tlb_range() is called to flush out NTLB entries for the ptes. This for ARC (by design) can only shootdown STLB entries (for pmd). The stray NTLB entries cause the overlap with the subsequent STLB entry for collapsed page. So make pmdp_collapse_flush() call pte flush interface not pmd flush. Note that originally all thp flush call sites in generic code called flush_tlb_range() leaving it to architecture to implement the flush for pte and/or pmd. Commit 12ebc1581ad11454 changed this by calling a new opt-in API flush_pmd_tlb_range() which made the semantics more explicit but failed to distinguish the pte vs pmd flush in generic code, which is what this patch fixes. Note that ARC can fixed w/o touching the generic pmdp_collapse_flush() by defining a ARC version, but that defeats the purpose of generic version, plus sementically this is the right thing to do. Fixes STAR 9000961194: LMBench on AXS103 triggering duplicate TLB exceptions with super pages Fixes: 12ebc1581ad11454 ("mm,thp: introduce flush_pmd_tlb_range") Signed-off-by: Vineet Gupta <> Reviewed-by: Aneesh Kumar K.V <> Acked-by: Kirill A. Shutemov <> Cc: Andrea Arcangeli <> Cc: <> [4.4] Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2016-02-11mm/backing-dev.c: fix error path in wb_init()Rasmus Villemoes1-1/+1
We need to use post-decrement to get percpu_counter_destroy() called on &wb->stat[0]. Moreover, the pre-decremebt would cause infinite out-of-bounds accesses if the setup code failed at i==0. Signed-off-by: Rasmus Villemoes <> Cc: Johannes Weiner <> Cc: Michal Hocko <> Cc: Vladimir Davydov <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>