linux-toradex.git/drivers, branch v3.2.55

hwmon: (coretemp) Fix truncated name of alarm attributes

2014-02-15T19:20:17+00:00

commit 3f9aec7610b39521c7c69d754de7265f6994c194 upstream.

When the core number exceeds 9, the size of the buffer storing the
alarm attribute name is insufficient and the attribute name is
truncated. This causes libsensors to skip these attributes as the
truncated name is not recognized.

Reported-by: Andreas Hollmann 
Signed-off-by: Jean Delvare 
Signed-off-by: Guenter Roeck 
Signed-off-by: Ben Hutchings

md/raid10: fix bug when raid10 recovery fails to recover a block.

2014-02-15T19:20:17+00:00

commit e8b849158508565e0cd6bc80061124afc5879160 upstream.

commit e875ecea266a543e643b19e44cf472f1412708f9
    md/raid10 record bad blocks as needed during recovery.

added code to the "cannot recover this block" path to record a bad
block rather than fail the whole recovery.
Unfortunately this new case was placed *after* r10bio was freed rather
than *before*, yet it still uses r10bio.
This is will crash with a null dereference.

So move the freeing of r10bio down where it is safe.

Fixes: e875ecea266a543e643b19e44cf472f1412708f9
Reported-by: Damian Nowak 
URL: https://bugzilla.kernel.org/show_bug.cgi?id=68181
Signed-off-by: NeilBrown 
Signed-off-by: Ben Hutchings

md/raid10: fix two bugs in handling of known-bad-blocks.

2014-02-15T19:20:16+00:00

commit b50c259e25d9260b9108dc0c2964c26e5ecbe1c1 upstream.

If we discover a bad block when reading we split the request and
potentially read some of it from a different device.

The code path of this has two bugs in RAID10.
1/ we get a spin_lock with _irq, but unlock without _irq!!
2/ The calculation of 'sectors_handled' is wrong, as can be clearly
   seen by comparison with raid1.c

This leads to at least 2 warnings and a probable crash is a RAID10
ever had known bad blocks.

Fixes: 856e08e23762dfb92ffc68fd0a8d228f9e152160
Reported-by: Damian Nowak 
URL: https://bugzilla.kernel.org/show_bug.cgi?id=68181
Signed-off-by: NeilBrown 
Signed-off-by: Ben Hutchings

md/raid5: Fix possible confusion when multiple write errors occur.

2014-02-15T19:20:16+00:00

commit 1cc03eb93245e63b0b7a7832165efdc52e25b4e6 upstream.

commit 5d8c71f9e5fbdd95650be00294d238e27a363b5c
    md: raid5 crash during degradation

Fixed a crash in an overly simplistic way which could leave
R5_WriteError or R5_MadeGood set in the stripe cache for devices
for which it is no longer relevant.
When those devices are removed and spares added the flags are still
set and can cause incorrect behaviour.

commit 14a75d3e07c784c004b4b44b34af996b8e4ac453
    md/raid5: preferentially read from replacement device if possible.

Fixed the same bug if a more effective way, so we can now revert
the original commit.

Reported-and-tested-by: Alexander Lyakas 
Fixes: 5d8c71f9e5fbdd95650be00294d238e27a363b5c
Signed-off-by: NeilBrown 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

ahci: add PCI ID for Marvell 88SE9170 SATA controller

2014-02-15T19:20:16+00:00

commit e098f5cbe9d410e7878b50f524dce36cc83ec40e upstream.

This patch adds support for the PCI ID provided by the Marvell 88SE9170
SATA controller.

Signed-off-by: Simon Guinot 
Signed-off-by: Tejun Heo 
Signed-off-by: Ben Hutchings

ahci: add an observed PCI ID for Marvell 88se9172 SATA controller

2014-02-15T19:20:16+00:00

commit fcce9a35f8faaa1f52236c554ef1b15d99a7537e upstream.

A third possible PCI ID, as personally observed, and found in the
pci.ids list.

Signed-off-by: George Spelvin 
Signed-off-by: Tejun Heo 
Signed-off-by: Ben Hutchings

ahci: Use PCI_VENDOR_ID_MARVELL_EXT for 0x1b4b

2014-02-15T19:20:16+00:00

commit 69fd3157363935b1e052bd76b8f8ec65e494306e upstream.

With the 0x1b4b vendor ID #define in place, convert hard-coded ID
values.

Signed-off-by: Myron Stowe 
Signed-off-by: Bjorn Helgaas 
Acked-by: Jeff Garzik 
Signed-off-by: Ben Hutchings

dm9601: work around tx fifo sync issue on dm962x

2014-02-15T19:20:15+00:00

commit 4263c86dca5198da6bd3ad826d0b2304fbe25776 upstream.

Certain dm962x revisions contain an bug, where if a USB bulk transfer retry
(E.G. if bulk crc mismatch) happens right after a transfer with odd or
maxpacket length, the internal tx hardware fifo gets out of sync causing
the interface to stop working.

Work around it by adding up to 3 bytes of padding to ensure this situation
cannot trigger.

This workaround also means we never pass multiple-of-maxpacket size skb's
to usbnet, so the length adjustment to handle usbnet's padding of those can
be removed.

Reported-by: Joseph Chang 
Signed-off-by: Peter Korsgaard 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

dm9601: fix reception of full size ethernet frames on dm9620/dm9621a

2014-02-15T19:20:15+00:00

commit 407900cfb54bdb2cfa228010b6697305f66b2948 upstream.

dm9620/dm9621a require room for 4 byte padding even in dm9601 (3 byte
header) mode.

Signed-off-by: Peter Korsgaard 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

net_dma: mark broken

2014-02-15T19:20:14+00:00

commit 77873803363c9e831fc1d1e6895c084279090c22 upstream.

net_dma can cause data to be copied to a stale mapping if a
copy-on-write fault occurs during dma.  The application sees missing
data.

The following trace is triggered by modifying the kernel to WARN if it
ever triggers copy-on-write on a page that is undergoing dma:

 WARNING: CPU: 24 PID: 2529 at lib/dma-debug.c:485 debug_dma_assert_idle+0xd2/0x120()
 ioatdma 0000:00:04.0: DMA-API: cpu touching an active dma mapped page [pfn=0x16bcd9]
 Modules linked in: iTCO_wdt iTCO_vendor_support ioatdma lpc_ich pcspkr dca
 CPU: 24 PID: 2529 Comm: linbug Tainted: G        W    3.13.0-rc1+ #353
  00000000000001e5 ffff88016f45f688 ffffffff81751041 ffff88017ab0ef70
  ffff88016f45f6d8 ffff88016f45f6c8 ffffffff8104ed9c ffffffff810f3646
  ffff8801768f4840 0000000000000282 ffff88016f6cca10 00007fa2bb699349
 Call Trace:
  [] dump_stack+0x46/0x58
  [] warn_slowpath_common+0x8c/0xc0
  [] ? ftrace_pid_func+0x26/0x30
  [] warn_slowpath_fmt+0x46/0x50
  [] debug_dma_assert_idle+0xd2/0x120
  [] do_wp_page+0xd0/0x790
  [] handle_mm_fault+0x51c/0xde0
  [] ? copy_user_enhanced_fast_string+0x9/0x20
  [] __do_page_fault+0x19c/0x530
  [] ? _raw_spin_lock_bh+0x16/0x40
  [] ? trace_clock_local+0x9/0x10
  [] ? rb_reserve_next_event+0x64/0x310
  [] ? ioat2_dma_prep_memcpy_lock+0x60/0x130 [ioatdma]
  [] do_page_fault+0xe/0x10
  [] page_fault+0x22/0x30
  [] ? __kfree_skb+0x51/0xd0
  [] ? copy_user_enhanced_fast_string+0x9/0x20
  [] ? memcpy_toiovec+0x52/0xa0
  [] skb_copy_datagram_iovec+0x5f/0x2a0
  [] tcp_rcv_established+0x674/0x7f0
  [] tcp_v4_do_rcv+0x2e5/0x4a0
  [..]
 ---[ end trace e30e3b01191b7617 ]---
 Mapped at:
  [] debug_dma_map_page+0xb9/0x160
  [] dma_async_memcpy_pg_to_pg+0x127/0x210
  [] dma_memcpy_pg_to_iovec+0x119/0x1f0
  [] dma_skb_copy_datagram_iovec+0x11c/0x2b0
  [] tcp_rcv_established+0x74a/0x7f0:

...the problem is that the receive path falls back to cpu-copy in
several locations and this trace is just one of the areas.  A few
options were considered to fix this:

1/ sync all dma whenever a cpu copy branch is taken

2/ modify the page fault handler to hold off while dma is in-flight

Option 1 adds yet more cpu overhead to an "offload" that struggles to compete
with cpu-copy.  Option 2 adds checks for behavior that is already documented as
broken when using get_user_pages().  At a minimum a debug mode is warranted to
catch and flag these violations of the dma-api vs get_user_pages().

Thanks to David for his reproducer.

Cc: Dave Jiang 
Cc: Vinod Koul 
Cc: Alexander Duyck 
Reported-by: David Whipple 
Acked-by: David S. Miller 
Signed-off-by: Dan Williams 
Signed-off-by: Ben Hutchings