linux-stable.git/drivers, branch v3.18.37

sfc: on MC reset, clear PIO buffer linkage in TXQs

2016-07-12T12:48:22+00:00

[ Upstream commit c0795bf64cba4d1b796fdc5b74b33772841ed1bb ]

Otherwise, if we fail to allocate new PIO buffers, our TXQs will try to
use the old ones, which aren't there any more.

Fixes: 183233bec810 "sfc: Allocate and link PIO buffers; map them with write-combining"
Signed-off-by: Edward Cree 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

tuntap: correctly wake up process during uninit

2016-07-12T12:48:21+00:00

[ Upstream commit addf8fc4acb1cf79492ac64966f07178793cb3d7 ]

We used to check dev->reg_state against NETREG_REGISTERED after each
time we are woke up. But after commit 9e641bdcfa4e ("net-tun:
restructure tun_do_read for better sleep/wakeup efficiency"), it uses
skb_recv_datagram() which does not check dev->reg_state. This will
result if we delete a tun/tap device after a process is blocked in the
reading. The device will wait for the reference count which was held
by that process for ever.

Fixes this by using RCV_SHUTDOWN which will be checked during
sk_recv_datagram() before trying to wake up the process during uninit.

Fixes: 9e641bdcfa4e ("net-tun: restructure tun_do_read for better
sleep/wakeup efficiency")
Cc: Eric Dumazet 
Cc: Xi Wang 
Cc: Michael S. Tsirkin 
Signed-off-by: Jason Wang 
Acked-by: Eric Dumazet 
Acked-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller 

Signed-off-by: Sasha Levin

serial: samsung: Reorder the sequence of clock control when call s3c24xx_serial_set_termios()

2016-07-12T12:48:18+00:00

[ Upstream commit b8995f527aac143e83d3900ff39357651ea4e0f6 ]

This patch fixes the broken serial log when changing the clock source
of uart device. Before disabling the original clock source, this patch
enables the new clock source to protect the clock off state for a split second.

Signed-off-by: Chanwoo Choi 
Reviewed-by: Marek Szyprowski 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

tty: vt, return error when con_startup fails

2016-07-12T12:48:18+00:00

[ Upstream commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 ]

When csw->con_startup() fails in do_register_con_driver, we return no
error (i.e. 0). This was changed back in 2006 by commit 3e795de763.
Before that we used to return -ENODEV.

So fix the return value to be -ENODEV in that case again.

Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console")
Signed-off-by: Jiri Slaby 
Reported-by: "Dan Carpenter" 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

drm/radeon: fix PLL sharing on DCE6.1 (v2)

2016-07-12T12:48:17+00:00

[ Upstream commit e3c00d87845ab375f90fa6e10a5e72a3a5778cd3 ]

On DCE6.1 PPLL2 is exclusively available to UNIPHYA, so it should not
be taken into consideration when looking for an already enabled PLL
to be shared with other outputs.

This fixes the broken VGA port (TRAVIS DP->VGA bridge) on my Richland
based laptop, where the internal display is connected to UNIPHYA through
a TRAVIS DP->LVDS bridge.

Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=78987

v2: agd: add check in radeon_get_shared_nondp_ppll as well, drop
    extra parameter.

Signed-off-by: Lucas Stach 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin

net: fec: only clear a queue's work bit if the queue was emptied

2016-07-12T12:48:13+00:00

[ Upstream commit 1c021bb717a70aaeaa4b25c91f43c2aeddd922de ]

In the receive path a queue's work bit was cleared unconditionally even
if fec_enet_rx_queue only read out a part of the available packets from
the hardware. This resulted in not reading any packets in the next napi
turn and so packets were delayed or lost.

The obvious fix is to only clear a queue's bit when the queue was
emptied.

Fixes: 4d494cdc92b3 ("net: fec: change data structure to support multiqueue")
Signed-off-by: Uwe Kleine-König 
Reviewed-by: Lucas Stach 
Tested-by: Fugang Duan 
Acked-by: Fugang Duan 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net/mlx4_en: fix spurious timestamping callbacks

2016-07-12T12:48:09+00:00

[ Upstream commit fc96256c906362e845d848d0f6a6354450059e81 ]

When multiple skb are TX-completed in a row, we might incorrectly keep
a timestamp of a prior skb and cause extra work.

Fixes: ec693d47010e8 ("net/mlx4_en: Add HW timestamping (TS) support")
Signed-off-by: Eric Dumazet 
Cc: Willem de Bruijn 
Reviewed-by: Eran Ben Elisha 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

atl2: Disable unimplemented scatter/gather feature

2016-07-12T12:48:09+00:00

[ Upstream commit f43bfaeddc79effbf3d0fcb53ca477cca66f3db8 ]

atl2 includes NETIF_F_SG in hw_features even though it has no support
for non-linear skbs.  This bug was originally harmless since the
driver does not claim to implement checksum offload and that used to
be a requirement for SG.

Now that SG and checksum offload are independent features, if you
explicitly enable SG *and* use one of the rare protocols that can use
SG without checkusm offload, this potentially leaks sensitive
information (before you notice that it just isn't working).  Therefore
this obscure bug has been designated CVE-2016-2117.

Reported-by: Justin Yackoski 
Signed-off-by: Ben Hutchings 
Fixes: ec5f06156423 ("net: Kill link between CSUM and SG features.")
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

Input: zforce_ts - fix dual touch recognition

2016-07-12T12:48:03+00:00

[ Upstream commit 6984ab1ab35f422292b7781c65284038bcc0f6a6 ]

A wrong decoding of the touch coordinate message causes a wrong touch
ID. Touch ID for dual touch must be 0 or 1.

According to the actual Neonode nine byte touch coordinate coding,
the state is transported in the lower nibble and the touch ID in
the higher nibble of payload byte five.

Signed-off-by: Knut Wohlrab 
Signed-off-by: Oleksij Rempel 
Signed-off-by: Dirk Behme 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

lpfc: fix misleading indentation

2016-07-12T12:48:03+00:00

[ Upstream commit aeb6641f8ebdd61939f462a8255b316f9bfab707 ]

gcc-6 complains about the indentation of the lpfc_destroy_vport_work_array()
call in lpfc_online(), which clearly doesn't look right:

drivers/scsi/lpfc/lpfc_init.c: In function 'lpfc_online':
drivers/scsi/lpfc/lpfc_init.c:2880:3: warning: statement is indented as if it were guarded by... [-Wmisleading-indentation]
   lpfc_destroy_vport_work_array(phba, vports);
   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/lpfc/lpfc_init.c:2863:2: note: ...this 'if' clause, but it is not
  if (vports != NULL)
  ^~

Looking at the patch that introduced this code, it's clear that the
behavior is correct and the indentation is wrong.

This fixes the indentation and adds curly braces around the previous
if() block for clarity, as that is most likely what caused the code
to be misindented in the first place.

Signed-off-by: Arnd Bergmann 
Fixes: 549e55cd2a1b ("[SCSI] lpfc 8.2.2 : Fix locking around HBA's port_list")
Reviewed-by: Sebastian Herbszt 
Reviewed-by: Hannes Reinecke 
Reviewed-by: Ewan D. Milne 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin