xen-netback: clear vif->task on disconnect

xenvif_start_xmit() relies on checking vif->task for NULL to determine
whether the vif is ready to accept packets. The task thread is stopped in
xenvif_disconnect() but task is not set to NULL. Thus, on a re-connect the
check will give a false positive.

Also since commit ea732dff5cfa10789007bf4a5b935388a0bb2a8f (Handle backend
state transitions in a more robust way) it should not be possible for
xenvif_connect() to be called if the vif is already connected so change the
check of vif->tx_irq to a BUG_ON() and also add a BUG_ON(vif->task).

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Cc: Wei Liu <wei.liu2@citrix.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: David Vrabel <david.vrabel@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
sparc64: Fix build regression

This patch fixes build error which was introduced by commit

812cb83a56a908729c453a7db3fb2c262119bc9d (Implement HAVE_CONTEXT_TRACKING).

[*]https://lkml.org/lkml/2013/11/23/103

Signed-off-by: Kirill Tkhai <tkhai@yandex.ru>
CC: David Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
rds: prevent BUG_ON triggered on congestion update to loopback

After congestion update on a local connection, when rds_ib_xmit returns
less bytes than that are there in the message, rds_send_xmit calls
back rds_ib_xmit with an offset that causes BUG_ON(off & RDS_FRAG_SIZE)
to trigger.

For a 4Kb PAGE_SIZE rds_ib_xmit returns min(8240,4096)=4096 when actually
the message contains 8240 bytes. rds_send_xmit thinks there is more to send
and calls rds_ib_xmit again with a data offset "off" of 4096-48(rds header)
=4048 bytes thus hitting the BUG_ON(off & RDS_FRAG_SIZE) [RDS_FRAG_SIZE=4k].

The commit 6094628bfd94323fc1cea05ec2c6affd98c18f7f
"rds: prevent BUG_ON triggering on congestion map updates" introduced
this regression. That change was addressing the triggering of a different
BUG_ON in rds_send_xmit() on PowerPC architecture with 64Kbytes PAGE_SIZE:
 	BUG_ON(ret != 0 &&
    		 conn->c_xmit_sg == rm->data.op_nents);
This was the sequence it was going through:
(rds_ib_xmit)
/* Do not send cong updates to IB loopback */
if (conn->c_loopback
   && rm->m_inc.i_hdr.h_flags & RDS_FLAG_CONG_BITMAP) {
  	rds_cong_map_updated(conn->c_fcong, ~(u64) 0);
    	return sizeof(struct rds_header) + RDS_CONG_MAP_BYTES;
}
rds_ib_xmit returns 8240
rds_send_xmit:
  c_xmit_data_off = 0 + 8240 - 48 (rds header accounted only the first time)
   		 = 8192
  c_xmit_data_off < 65536 (sg->length), so calls rds_ib_xmit again
rds_ib_xmit returns 8240
rds_send_xmit:
  c_xmit_data_off = 8192 + 8240 = 16432, calls rds_ib_xmit again
  and so on (c_xmit_data_off 24672,32912,41152,49392,57632)
rds_ib_xmit returns 8240
On this iteration this sequence causes the BUG_ON in rds_send_xmit:
    while (ret) {
    	tmp = min_t(int, ret, sg->length - conn->c_xmit_data_off);
    	[tmp = 65536 - 57632 = 7904]
    	conn->c_xmit_data_off += tmp;
    	[c_xmit_data_off = 57632 + 7904 = 65536]
    	ret -= tmp;
    	[ret = 8240 - 7904 = 336]
    	if (conn->c_xmit_data_off == sg->length) {
    		conn->c_xmit_data_off = 0;
    		sg++;
    		conn->c_xmit_sg++;
    		BUG_ON(ret != 0 &&
    			conn->c_xmit_sg == rm->data.op_nents);
    		[c_xmit_sg = 1, rm->data.op_nents = 1]

What the current fix does:
Since the congestion update over loopback is not actually transmitted
as a message, all that rds_ib_xmit needs to do is let the caller think
the full message has been transmitted and not return partial bytes.
It will return 8240 (RDS_CONG_MAP_BYTES+48) when PAGE_SIZE is 4Kb.
And 64Kb+48 when page size is 64Kb.

Reported-by: Josh Hunt <joshhunt00@gmail.com>
Tested-by: Honggang Li <honli@redhat.com>
Acked-by: Bang Nguyen <bang.nguyen@oracle.com>
Signed-off-by: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/mlx4_core: destroy workqueue when driver fails to register

When driver registration fails, we need to clean up the resources allocated
before. mlx4_core missed destroying the workqueue allocated.

This patch destroys the workqueue when registration fails.

Signed-off-by: Wei Yang <weiyang@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Staging: TIDSPBRIDGE: Use vm_iomap_memory for mmap-ing instead of remap_pfn_range

This fixes the following bug:

----  Bug Report ----

source file: drivers/staging/tidspbridge/rmgr/drv_interface.c
issue      : mapping of physical memory without address range checks

259 static int bridge_mmap(struct file *filp, struct vm_area_struct *vma)
260 {
261         u32 status;
262
263         /* VM_IO | VM_DONTEXPAND | VM_DONTDUMP are set by remap_pfn_range() */
264         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
265
266         dev_dbg(bridge, "%s: vm filp %p start %lx end %lx page_prot %ulx "
267                 "flags %lx\n", __func__, filp,
268                 vma->vm_start, vma->vm_end, vma->vm_page_prot,
269                 vma->vm_flags);
270
271         status = remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
272                                  vma->vm_end - vma->vm_start,
273                                  vma->vm_page_prot);
274         if (status != 0)
275                 status = -EAGAIN;
276
277         return status;
278 }

The function provides an interface to remap physical memory to user space, but
does not provide any checks to ensure that the memory is within the region that
should be accessible.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Ivaylo Dimitrov <freemangordon@abv.bg>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: switch maintainership of chipidea to Peter

Alexander isn't able to maintain the Chipidea code anymore, and as Peter
has been acting as the de-facto maintainer anyway, make it official.

Acked-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Acked-by: Peter Chen <Peter.Chen@freescale.com>
Acked-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge remote-tracking branch 'asoc/fix/core' into asoc-linus
Merge remote-tracking branch 'asoc/fix/dapm' into asoc-linus
Merge remote-tracking branches 'asoc/fix/arizona', 'asoc/fix/atmel', 'asoc/fix/fsl', 'asoc/fix/kirkwood', 'asoc/fix/omap', 'asoc/fix/rcar', 'asoc/fix/wm8731' and 'asoc/fix/wm8990' into asoc-linus
Merge tag 'omap-for-v3.13/fixes-against-rc1-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

From Tony Lindgren:

Some omap related fixes that have come up with people moving to device
tree only based booting for omap2+.

The series contains a handful of fixes for the igep boards as they were
one of the first omap3 boards to jump over completely to device tree
based booting. So these can be considered regressions compared to
booting igep in legacy mode with board files in v3.12.

Also included are few other device tree vs legacy booting regressions:

- yet more missing omap3 .dtsi entries that have showed up booting
  various boards with device tree only

- n900 eMMC device tree fix

- fixes for beagle USB EHCI

- two fixes to make omap2420 MMC work

As we're moving omap2+ to be device tree only for v3.14, I'd like to
have v3.13 work equally well for legacy based booting and device tree
based booting. So there will be likely few more device tree related
booting patches trickling in.

This series also includes a regression fix for the omap timer posted
mode that may wrongly stay on from the bootloader for some SoCs.

* tag 'omap-for-v3.13/fixes-against-rc1-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  mmc: omap: Fix I2C dependency and make driver usable with device tree
  mmc: omap: Fix DMA configuration to not rely on device id
  ARM: dts: omap3-beagle: Fix USB host on beagle boards (for 3.13)
  ARM: dts: omap3-igep0020: name twl4030 VPLL2 regulator as vdds_dsi
  ARM: dts: AM33XX IGEP0033: add USB support
  ARM: dts: AM33XX BASE0033: add 32KBit EEPROM support
  ARM: dts: AM33XX BASE0033: add pinmux and user led support
  ARM: dts: AM33XX BASE0033: add pinmux and hdmi node to enable display
  ARM: dts: omap3-igep0020: Add pinmuxing for DVI output
  ARM: dts: omap3-igep0020: Add pinmux setup for i2c devices
  ARM: dts: omap3-igep: Update to use the TI AM/DM37x processor
  ARM: dts: omap3-igep: Add support for LBEE1USJYC WiFi connected to SDIO
  ARM: dts: omap3-igep: Fix bus-width for mmc1
  ARM: OMAP2+: dss-common: change IGEP's DVI DDC i2c bus
  ARM: OMAP2+: Disable POSTED mode for errata i103 and i767
  ARM: OMAP2+: Fix eMMC on n900 with device tree
  ARM: OMAP2+: Add fixed regulator to omap2plus_defconfig
  ARM: OMAP2+: Fix more missing data for omap3.dtsi file

Signed-off-by: Olof Johansson <olof@lixom.net>
Merge tag 'mvebu-dt-fixes-3.13' of git://git.infradead.org/linux-mvebu into fixes

From Jason Cooper, mvebu DT fixes for v3.13:
 - mvebu
    - PCIe fixes now that we have test devices with more ports.
    - fix access to coherency registers

* tag 'mvebu-dt-fixes-3.13' of git://git.infradead.org/linux-mvebu:
  ARM: mvebu: re-enable PCIe on Armada 370 DB
  ARM: mvebu: use the virtual CPU registers to access coherency registers
  ARM: mvebu: fix second and third PCIe unit of Armada XP mv78260
  ARM: mvebu: second PCIe unit of Armada XP mv78230 is only x1 capable
Merge tag 'at91-fixes' of git://github.com/at91linux/linux-at91 into fixes

From Nicolas Ferre:
AT91: second round of fixes for 3.13
- reduce IP frequency for I2C on sama5d3
- missing aliases directive for USART3 on 9x5 family
- a PM symbol is missing if !CONFIG_PM

* tag 'at91-fixes' of git://github.com/at91linux/linux-at91:
  ARM: at91: fixed unresolved symbol "at91_pm_set_standby" when built without CONFIG_PM
  ARM: at91: add usart3 alias to dtsi
  ARM: at91: sama5d3: reduce TWI internal clock frequency
ARM: multi_v7_defconfig: enable network for BeagleBone Black

BeagleBone Black uses the TI CPSW ethernet controller, enable it in the
multi_v7_defconfig for testing coverage purposes.

Signed-off-by: Olof Johansson <olof@lixom.net>
Acked-by: Tony Lindgren <tony@atomide.com>
Cc: stable@vger.kernel.org # v3.12
Merge tag 'omap-for-v3.13/more-dt-regressions' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

From Tony Lindgren:

Few more legacy booting vs device tree booting fixes that people
have noticed while booting things with device tree for things like
omap4 WLAN, smsc911x, and beagle audio. Hopefully this will be it
for the legacy booting vs device tree fixes for this -rc cycle.

* tag 'omap-for-v3.13/more-dt-regressions' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: dts: Fix the name of supplies for smsc911x shared by OMAP
  ARM: OMAP2+: Powerdomain: Fix unchecked dereference of arch_pwrdm
  ARM: dts: omap3-beagle: Add omap-twl4030 audio support
  ARM: dts: omap4-sdp: Fix pin muxing for wl12xx
  ARM: dts: omap4-panda-common: Fix pin muxing for wl12xx
ARM: sunxi_defconfig: enable NFS, TMPFS, PRINTK_TIME and nfsroot support

This enables a few more options on the sunxi defconfigs such that I can
use nfsroot to boot them (there is no local storage support yet). It
also enables PRINTK_TIME and tmpfs since it's a common distro requirement.

Signed-off-by: Olof Johansson <olof@lixom.net>
ARM: multi_v7_defconfig: enable SDHCI_BCM_KONA and MMC_BLOCK_MINORS=16

Enable MMC/SD on the Broadcom mobile platforms, and increase the block
minors from the default 8 to 16 (since the Broadcom board by default
has root on the 8th partition).

Signed-off-by: Olof Johansson <olof@lixom.net>
Cc: stable@vger.kernel.org # v3.12
cpuidle: Check for dev before deregistering it.

If not, we could end up in the unfortunate situation where
we dereference a NULL pointer b/c we have cpuidle disabled.

This is the case when booting under Xen (which uses the
ACPI P/C states but disables the CPU idle driver) - and can
be easily reproduced when booting with cpuidle.off=1.

BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [<ffffffff8156db4a>] cpuidle_unregister_device+0x2a/0x90
.. snip..
Call Trace:
 [<ffffffff813b15b4>] acpi_processor_power_exit+0x3c/0x5c
 [<ffffffff813af0a9>] acpi_processor_stop+0x61/0xb6
 [<ffffffff814215bf>] __device_release_driver+0fffff81421653>] device_release_driver+0x23/0x30
 [<ffffffff81420ed8>] bus_remove_device+0x108/0x180
 [<ffffffff8141d9d9>] device_del+0x129/0x1c0
 [<ffffffff813cb4b0>] ? unregister_xenbus_watch+0x1f0/0x1f0
 [<ffffffff8141da8e>] device_unregister+0x1e/0x60
 [<ffffffff814243e9>] unregister_cpu+0x39/0x60
 [<ffffffff81019e03>] arch_unregister_cpu+0x23/0x30
 [<ffffffff813c3c51>] handle_vcpu_hotplug_event+0xc1/0xe0
 [<ffffffff813cb4f5>] xenwatch_thread+0x45/0x120
 [<ffffffff810af010>] ? abort_exclusive_wait+0xb0/0xb0
 [<ffffffff8108ec42>] kthread+0xd2/0xf0
 [<ffffffff8108eb70>] ? kthread_create_on_node+0x180/0x180
 [<ffffffff816ce17c>] ret_from_fork+0x7c/0xb0
 [<ffffffff8108eb70>] ? kthread_create_on_node+0x180/0x180

This problem also appears in 3.12 and could be a candidate for backport.

Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
blk-mq: fix dereference of rq->mq_ctx if allocation fails

If __GFP_WAIT isn't set and we fail allocating, when we go
to drop the reference on the ctx, we will attempt to dereference
the NULL rq. Fix that.

Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Merge tag 'iio-fixes-for-3.13b' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus

Jonathan writes:

Second round of IIO fixes for the 3.13 cycle.

2 fixes here.

* The gp2ap020a00f is a simple missing kconfig dependency.

* The hid sensors hub fix is a work around for an issue introduced by hardware
changes due to a certain large software vendor having an 'interesting'
interpretation of the specification and hence indexing some arrays from 1
rather than 0.  The fix takes advantage of the logical min and max reading
facilities introduced by the precursor patch to figure out whether we have
a 0 indexed or 1 indexed device and to adjust appropriately.  It also
drops a previous kconfig option that allowed this issue to be worked around
at build time.
cxgb4: Much cleaner implementation of is_t4()/is_t5()

Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>