Jesper Juhl [Fri, 17 Aug 2012 10:33:12 +0000 (10:33 +0000)]
caif: Do not dereference NULL in chnl_recv_cb()
In net/caif/chnl_net.c::chnl_recv_cb() we call skb_header_pointer()
which may return NULL, but we do not check for a NULL pointer before
dereferencing it.
This patch adds such a NULL check and properly free's allocated memory
and return an error (-EINVAL) on failure - much better than crashing..
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Mon, 20 Aug 2012 09:44:29 +0000 (02:44 -0700)]
Merge git://1984.lsi.us.es/nf
Pable Neira Ayuso says:
====================
The following five patches contain fixes for 3.6-rc, they are:
* Two fixes for message parsing in the SIP conntrack helper, from
Patrick McHardy.
* One fix for the SIP helper introduced in the user-space cthelper
infrastructure, from Patrick McHardy.
* fix missing appropriate locking while modifying one conntrack entry
from the nfqueue integration code, from myself.
* fix possible access to uninitiliazed timer in the nf_conntrack
expectation infrastructure, from myself.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Jiri Pirko [Fri, 17 Aug 2012 04:00:48 +0000 (04:00 +0000)]
team: add support for non-ethernet devices
This is resolved by two things:
1) allow dev_addr of different length than ETH_ALEN
2) during port add, check for dev->type and change it if necessary
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Takashi Iwai [Mon, 20 Aug 2012 09:38:31 +0000 (11:38 +0200)]
Merge branch 'topic/ca0132-fix' into for-linus
This is a series of fixes for CA0132, especially the missing SPDIF I/O
and the mixer build errors.
Eric Leblond [Thu, 16 Aug 2012 22:02:58 +0000 (22:02 +0000)]
af_packet: don't emit packet on orig fanout group
If a packet is emitted on one socket in one group of fanout sockets,
it is transmitted again. It is thus read again on one of the sockets
of the fanout group. This result in a loop for software which
generate packets when receiving one.
This retransmission is not the intended behavior: a fanout group
must behave like a single socket. The packet should not be
transmitted on a socket if it originates from a socket belonging
to the same fanout group.
This patch fixes the issue by changing the transmission check to
take fanout group info account.
Reported-by: Aleksandr Kotov <a1k@mail.ru>
Signed-off-by: Eric Leblond <eric@regit.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
David Henningsson [Mon, 20 Aug 2012 09:17:00 +0000 (11:17 +0200)]
ALSA: hda - don't create dysfunctional mixer controls for ca0132
It's possible that these amps are settable somehow, e g through
secret codec verbs, but for now, don't create the controls (as
they won't be working anyway, and cause errors in amixer).
Cc: stable@kernel.org
BugLink: https://bugs.launchpad.net/bugs/1038651
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Julia Lawall [Thu, 16 Aug 2012 21:46:58 +0000 (21:46 +0000)]
drivers/net/irda: fix error return code
Convert a nonnegative error return code to a negative one, as returned
elsewhere in the function.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
identifier ret;
expression e1,e2;
@@
if (ret < 0)
{ ... return ret; }
... when != ret = e1
when forall
*if(...)
{
... when != ret = e2
* return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Julia Lawall [Thu, 16 Aug 2012 21:46:57 +0000 (21:46 +0000)]
drivers/net/wan/dscc4.c: fix error return code
Move up the initialization of rc so that failure of pci_alloc_consistent
returns -ENOMEM as well.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
identifier ret;
expression e1,e2;
@@
if (ret < 0)
{ ... return ret; }
... when != ret = e1
when forall
*if(...)
{
... when != ret = e2
* return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Julia Lawall [Thu, 16 Aug 2012 21:46:56 +0000 (21:46 +0000)]
drivers/net/wimax/i2400m/fw.c: fix error return code
Convert a nonnegative error return code to a negative one, as returned
elsewhere in the function.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
identifier ret;
expression e1,e2;
@@
if (ret < 0)
{ ... return ret; }
... when != ret = e1
when forall
*if(...)
{
... when != ret = e2
* return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Mon, 20 Aug 2012 09:30:41 +0000 (02:30 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/ppwaskie/net-next
Peter P Waskiewicz Jr says:
====================
This series contains multiple updates to the ixgbe driver.
The following are changes since commit
02644a17457414f38e29f32d5c640b06d08fa092:
sctp: fix bogus if statement in sctp_auth_recv_cid()
and are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/ppwaskie/net-next master
Alexander Duyck (9):
ixgbe: Remove code that was initializing Rx page offset
ixgbe: combine ixgbe_add_rx_frag and ixgbe_can_reuse_page
ixgbe: Only use double buffering if page size is less than 8K
ixgbe: Have the CPU take ownership of the buffers sooner
ixgbe: Make pull tail function separate from rest of cleanup_headers
ixgbe: Copybreak sooner to avoid get_page/put_page and offset change
overhead
ixgbe: Make allocating skb and placing data in it a separate function
ixgbe: Roll RSC code into non-EOP code
ixgbe: Rewrite code related to configuring IFCS bit in Tx descriptor
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 16 Aug 2012 12:09:14 +0000 (12:09 +0000)]
tipc: eliminate configuration for maximum number of name publications
Gets rid of the need for users to specify the maximum number of
name publications supported by TIPC. TIPC now automatically provides
support for the maximum number of name publications to 65535.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 16 Aug 2012 12:09:13 +0000 (12:09 +0000)]
tipc: eliminate configuration for maximum number of name subscriptions
Gets rid of the need for users to specify the maximum number of
name subscriptions supported by TIPC. TIPC now automatically provides
support for the maximum number of name subscriptions to 65535.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 16 Aug 2012 12:09:12 +0000 (12:09 +0000)]
tipc: add __read_mostly annotations to several global variables
Added to the following:
- tipc_random
- tipc_own_addr
- tipc_max_ports
- tipc_net_id
- tipc_remote_management
- handler_enabled
The above global variables are read often, but written rarely. Use
__read_mostly to prevent them being on the same cacheline as another
variable which is written to often, which would cause cacheline
bouncing.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 16 Aug 2012 12:09:11 +0000 (12:09 +0000)]
tipc: convert tipc_nametbl_size type from variable to macro
There is nothing changing this variable dynamically, so change
it to a macro to make that more obvious when reading the code.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 16 Aug 2012 12:09:10 +0000 (12:09 +0000)]
tipc: change tipc_net_start routine return value type
Since now tipc_net_start() always returns a success code - 0, its
return value type should be changed from integer to void, which can
avoid unnecessary check for its return value.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 16 Aug 2012 12:09:09 +0000 (12:09 +0000)]
tipc: manually inline single use media_name_valid routine
After eliminating the mechanism which checks whether all letters
in media name string are within a given character set, the
media_name_valid routine becomes trivial. It is also only
used once, so it is unnecessary to keep it as a separate function.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 16 Aug 2012 12:09:08 +0000 (12:09 +0000)]
tipc: remove pointless name sanity check and tipc_alphabet array
There is no real reason to check whether all letters in the given
media name and network interface name are within the character set
defined in tipc_alphabet array. Even if we eliminate the checking,
the rest of checking conditions in tipc_enable_bearer() can ensure
we do not enable an invalid or illegal bearer.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 16 Aug 2012 12:09:07 +0000 (12:09 +0000)]
tipc: fix lockdep warning during bearer initialization
When the lockdep validator is enabled, it will report the below
warning when we enable a TIPC bearer:
[ INFO: possible irq lock inversion dependency detected ]
---------------------------------------------------------
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(ptype_lock);
local_irq_disable();
lock(tipc_net_lock);
lock(ptype_lock);
<Interrupt>
lock(tipc_net_lock);
*** DEADLOCK ***
the shortest dependencies between 2nd lock and 1st lock:
-> (ptype_lock){+.+...} ops: 10 {
[...]
SOFTIRQ-ON-W at:
[<
c1089418>] __lock_acquire+0x528/0x13e0
[<
c108a360>] lock_acquire+0x90/0x100
[<
c1553c38>] _raw_spin_lock+0x38/0x50
[<
c14651ca>] dev_add_pack+0x3a/0x60
[<
c182da75>] arp_init+0x1a/0x48
[<
c182dce5>] inet_init+0x181/0x27e
[<
c1001114>] do_one_initcall+0x34/0x170
[<
c17f7329>] kernel_init+0x110/0x1b2
[<
c155b6a2>] kernel_thread_helper+0x6/0x10
[...]
... key at: [<
c17e4b10>] ptype_lock+0x10/0x20
... acquired at:
[<
c108a360>] lock_acquire+0x90/0x100
[<
c1553c38>] _raw_spin_lock+0x38/0x50
[<
c14651ca>] dev_add_pack+0x3a/0x60
[<
c8bc18d2>] enable_bearer+0xf2/0x140 [tipc]
[<
c8bb283a>] tipc_enable_bearer+0x1ba/0x450 [tipc]
[<
c8bb3a04>] tipc_cfg_do_cmd+0x5c4/0x830 [tipc]
[<
c8bbc032>] handle_cmd+0x42/0xd0 [tipc]
[<
c148e802>] genl_rcv_msg+0x232/0x280
[<
c148d3f6>] netlink_rcv_skb+0x86/0xb0
[<
c148e5bc>] genl_rcv+0x1c/0x30
[<
c148d144>] netlink_unicast+0x174/0x1f0
[<
c148ddab>] netlink_sendmsg+0x1eb/0x2d0
[<
c1456bc1>] sock_aio_write+0x161/0x170
[<
c1135a7c>] do_sync_write+0xac/0xf0
[<
c11360f6>] vfs_write+0x156/0x170
[<
c11361e2>] sys_write+0x42/0x70
[<
c155b0df>] sysenter_do_call+0x12/0x38
[...]
}
-> (tipc_net_lock){+..-..} ops: 4 {
[...]
IN-SOFTIRQ-R at:
[<
c108953a>] __lock_acquire+0x64a/0x13e0
[<
c108a360>] lock_acquire+0x90/0x100
[<
c15541cd>] _raw_read_lock_bh+0x3d/0x50
[<
c8bb874d>] tipc_recv_msg+0x1d/0x830 [tipc]
[<
c8bc195f>] recv_msg+0x3f/0x50 [tipc]
[<
c146a5fa>] __netif_receive_skb+0x22a/0x590
[<
c146ab0b>] netif_receive_skb+0x2b/0xf0
[<
c13c43d2>] pcnet32_poll+0x292/0x780
[<
c146b00a>] net_rx_action+0xfa/0x1e0
[<
c103a4be>] __do_softirq+0xae/0x1e0
[...]
}
>From the log, we can see three different call chains between
CPU0 and CPU1:
Time 0 on CPU0:
kernel_init()->inet_init()->dev_add_pack()
At time 0, the ptype_lock is held by CPU0 in dev_add_pack();
Time 1 on CPU1:
tipc_enable_bearer()->enable_bearer()->dev_add_pack()
At time 1, tipc_enable_bearer() first holds tipc_net_lock, and then
wants to take ptype_lock to register TIPC protocol handler into the
networking stack. But the ptype_lock has been taken by dev_add_pack()
on CPU0, so at this time the dev_add_pack() running on CPU1 has to be
busy looping.
Time 2 on CPU0:
netif_receive_skb()->recv_msg()->tipc_recv_msg()
At time 2, an incoming TIPC packet arrives at CPU0, hence
tipc_recv_msg() will be invoked. In tipc_recv_msg(), it first wants
to hold tipc_net_lock. At the moment, below scenario happens:
On CPU0, below is our sequence of taking locks:
lock(ptype_lock)->lock(tipc_net_lock)
On CPU1, our sequence of taking locks looks like:
lock(tipc_net_lock)->lock(ptype_lock)
Obviously deadlock may happen in this case.
But please note the deadlock possibly doesn't occur at all when the
first TIPC bearer is enabled. Before enable_bearer() -- running on
CPU1 does not hold ptype_lock, so the TIPC receive handler (i.e.
recv_msg()) is not registered successfully via dev_add_pack(), so
the tipc_recv_msg() cannot be called by recv_msg() even if a TIPC
message comes to CPU0. But when the second TIPC bearer is
registered, the deadlock can perhaps really happen.
To fix it, we will push the work of registering TIPC protocol
handler into workqueue context. After the change, both paths taking
ptype_lock are always in process contexts, thus, the deadlock should
never occur.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ying Xue [Thu, 16 Aug 2012 12:09:06 +0000 (12:09 +0000)]
tipc: optimize the initialization of network device notifier
Ethernet media initialization is only done when TIPC is started or
switched to network mode. So the initialization of the network device
notifier structure can be moved out of this function and done
statically instead.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pavel Emelyanov [Thu, 16 Aug 2012 05:36:48 +0000 (05:36 +0000)]
packet: Report fanout status via diag engine
Reported value is the same reported by the FANOUT getsockoption, but
unlike it, the absent fanout setup results in absent nlattr, rather
than in nlattr with zero value. This is done so, since zero fanout
report may mean both -- no fanout, and fanout with both id and type zero.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pavel Emelyanov [Thu, 16 Aug 2012 05:34:22 +0000 (05:34 +0000)]
packet: Report rings cfg via diag engine
One extension bit may result in two nlattrs -- one per ring type.
If some ring type is not configured, then the respective nlatts
will be empty.
The structure reported contains the data, that is given to the
corresponding ring setup socket option.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dan Carpenter [Thu, 16 Aug 2012 03:14:04 +0000 (03:14 +0000)]
gre: information leak in ip6_tnl_ioctl()
There is a one byte hole between p->hop_limit and p->flowinfo where
stack memory is leaked to the user. This was introduced in
c12b395a46
"gre: Support GRE over IPv6".
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Steve Glendinning [Wed, 15 Aug 2012 21:53:38 +0000 (21:53 +0000)]
smsc75xx: add missing entry to MAINTAINERS
Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Bjørn Mork [Wed, 15 Aug 2012 03:42:57 +0000 (03:42 +0000)]
net: qmi_wwan: new devices: UML290 and K5006-Z
Newer firmware versions for the Pantech UML290 use a different
subclass ID. The Windows driver match on both IDs, so we do
that as well.
The ZTE (Vodafone) K5006-Z is a new device.
Cc: Dan Williams <dcbw@redhat.com>
Cc: Thomas Schäfer <tschaefer@t-online.de>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Phil Edworthy [Tue, 14 Aug 2012 20:33:29 +0000 (20:33 +0000)]
net: sh_eth: Add eth support for R8A7779 device
Signed-off-by: Phil Edworthy <phil.edworthy@renesas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Timur Tabi [Tue, 14 Aug 2012 13:20:24 +0000 (13:20 +0000)]
netdev/phy: skip disabled mdio-mux nodes
The mdio-mux driver scans all child mdio nodes, without regard to whether
the node is actually used. Some device trees include all possible
mdio-mux nodes and rely on the boot loader to disable those that are not
present, based on some run-time configuration. Those nodes need to be
skipped.
Signed-off-by: Timur Tabi <timur@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Timur Tabi [Tue, 14 Aug 2012 13:20:23 +0000 (13:20 +0000)]
dt: introduce for_each_available_child_of_node, of_get_next_available_child
Macro for_each_child_of_node() makes it easy to iterate over all of the
children for a given device tree node, including those nodes that are
marked as unavailable (i.e. status = "disabled").
Introduce for_each_available_child_of_node(), which is like
for_each_child_of_node(), but it automatically skips unavailable nodes.
This also requires the introduction of helper function
of_get_next_available_child(), which returns the next available child
node.
Signed-off-by: Timur Tabi <timur@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Julia Lawall [Sun, 19 Aug 2012 07:02:59 +0000 (09:02 +0200)]
ALSA: sound/ppc/snd_ps3.c: fix error return code
Initialize ret before returning on failure, as done elsewhere in the
function.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
{ ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
when != &ret
*if(...)
{
... when != ret = e2
when forall
return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Julia Lawall [Sun, 19 Aug 2012 07:02:54 +0000 (09:02 +0200)]
ALSA: sound/pci/rme9652/hdspm.c: fix error return code
Convert a nonnegative error return code to a negative one, as returned
elsewhere in the function.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
{ ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
when != &ret
*if(...)
{
... when != ret = e2
when forall
return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Julia Lawall [Sun, 19 Aug 2012 07:02:55 +0000 (09:02 +0200)]
ALSA: sound/pci/sis7019.c: fix error return code
Initialize rc before returning on failure, as done elsewhere in the
function.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
{ ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
when != &ret
*if(...)
{
... when != ret = e2
when forall
return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Julia Lawall [Sun, 19 Aug 2012 07:02:56 +0000 (09:02 +0200)]
ALSA: sound/pci/ctxfi/ctatc.c: fix error return code
Initialize err before returning on failure, as done elsewhere in the
function.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
{ ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
when != &ret
*if(...)
{
... when != ret = e2
when forall
return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Julia Lawall [Sun, 19 Aug 2012 07:02:57 +0000 (09:02 +0200)]
ALSA: sound/atmel/ac97c.c: fix error return code
In the first case, the second test of whether retval is negative is
redundant. It is dropped and the previous and subsequent tests are
combined.
In the second case, add an initialization of retval on failure of ioremap.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
{ ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
when != &ret
*if(...)
{
... when != ret = e2
when forall
return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Julia Lawall [Sun, 19 Aug 2012 07:02:58 +0000 (09:02 +0200)]
ALSA: sound/atmel/abdac.c: fix error return code
Initialize retval before returning from a failed call to ioremap.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
{ ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
when != &ret
*if(...)
{
... when != ret = e2
when forall
return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Randy Dunlap [Sun, 19 Aug 2012 00:43:05 +0000 (17:43 -0700)]
ALSA: fix pcm.h kernel-doc warning and notation
Fix kernel-doc warning in <sound/pcm.h> and add function name to make
the kernel-doc notation complete.
Warning(include/sound/pcm.h:1081): No description found for parameter 'substream'
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Dan Carpenter [Sat, 18 Aug 2012 15:55:15 +0000 (18:55 +0300)]
sound: oss/sb_audio: prevent divide by zero bug
Speed comes from get_user() in audio_ioctl(). We use it to set the "s"
variable before clamping it to valid values so it could lead to a divide
by zero bug.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Linus Torvalds [Sun, 19 Aug 2012 15:41:29 +0000 (08:41 -0700)]
Merge branch 'alpha' (alpha architecture patches)
Merge alpha architecture update from Michael Cree:
"The Alpha Maintainer, Matt Turner, is currently unavailable, so I have
collected up patches that have been posted to the linux-alpha mailing
list over the last couple of months, and are forwarding them to you in
the hope that you are prepared to accept them via me.
The patches by Al Viro and myself I have been running against kernels
for two months now so have had quite a bit of testing. All except one
patch were intended for the 3.5 kernel but because of Matt's
unavailability never got forwarded to you."
* emailed patches from Michael Cree <mcree@orcon.net.nz>: (9 commits)
alpha: Fix fall-out from disintegrating asm/system.h
Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
alpha: fix fpu.h usage in userspace
alpha/mm/fault.c: Port OOM changes to do_page_fault
alpha: take kernel_execve() out of entry.S
alpha: take a bunch of syscalls into osf_sys.c
alpha: Use new generic strncpy_from_user() and strnlen_user()
alpha: Wire up cross memory attach syscalls
alpha: Don't export SOCK_NONBLOCK to user space.
Michael Cree [Sun, 19 Aug 2012 02:41:04 +0000 (14:41 +1200)]
alpha: Fix fall-out from disintegrating asm/system.h
Commit
ec2212088c42 ("Disintegrate asm/system.h for Alpha") removed
asm/system.h however arch/alpha/oprofile/common.c requires definitions
that were shifted from asm/system.h to asm/special_insns.h. Include
that.
Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Mel Gorman [Sun, 19 Aug 2012 02:41:03 +0000 (14:41 +1200)]
Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
The following build error occurred during an alpha build:
net/core/sock.c:274:36: error: initializer element is not constant
Dave Anglin says:
> Here is the line in sock.i:
>
> struct static_key memalloc_socks = ((struct static_key) { .enabled =
> ((atomic_t) { (0) }) });
The above line contains two compound literals. It also uses a designated
initializer to initialize the field enabled. A compound literal is not a
constant expression.
The location of the above statement isn't fully clear, but if a compound
literal occurs outside the body of a function, the initializer list must
consist of constant expressions.
Cc: <stable@vger.kernel.org>
Signed-off-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Mike Frysinger [Sun, 19 Aug 2012 02:41:02 +0000 (14:41 +1200)]
alpha: fix fpu.h usage in userspace
After commit
ec2212088c42 ("Disintegrate asm/system.h for Alpha"), the
fpu.h header which we install for userland started depending on
special_insns.h which is not installed.
However, fpu.h only uses that for __KERNEL__ code, so protect the
inclusion the same way to avoid build breakage in glibc:
/usr/include/asm/fpu.h:4:31: fatal error: asm/special_insns.h: No such file or directory
Cc: stable@vger.kernel.org
Reported-by: Matt Turner <mattst88@gentoo.org>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Kautuk Consul [Sun, 19 Aug 2012 02:41:01 +0000 (14:41 +1200)]
alpha/mm/fault.c: Port OOM changes to do_page_fault
Commit
d065bd810b6d ("mm: retry page fault when blocking on disk
transfer") and
37b23e0525d3 ("x86,mm: make pagefault killable")
introduced changes into the x86 pagefault handler for making the page
fault handler retryable as well as killable.
These changes reduce the mmap_sem hold time, which is crucial during OOM
killer invocation.
Port these changes to ALPHA.
Signed-off-by: Mohd. Faris <mohdfarisq2010@gmail.com>
Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
Acked-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Sun, 19 Aug 2012 02:41:00 +0000 (14:41 +1200)]
alpha: take kernel_execve() out of entry.S
Signed-off-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Sun, 19 Aug 2012 02:40:59 +0000 (14:40 +1200)]
alpha: take a bunch of syscalls into osf_sys.c
New helper: current_thread_info(). Allows to do a bunch of odd syscalls
in C. While we are at it, there had never been a reason to do
osf_getpriority() in assembler. We also get "namespace"-aware (read:
consistent with getuid(2), etc.) behaviour from getx?id() syscalls now.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Michael Cree [Sun, 19 Aug 2012 02:40:58 +0000 (14:40 +1200)]
alpha: Use new generic strncpy_from_user() and strnlen_user()
Similar to x86/sparc/powerpc implementations except:
1) we implement an extremely efficient has_zero()/find_zero()
sequence with both prep_zero_mask() and create_zero_mask()
no-operations.
2) Our output from prep_zero_mask() differs in that only the
lowest eight bits are used to represent the zero bytes
nevertheless it can be safely ORed with other similar masks
from prep_zero_mask() and forms input to create_zero_mask(),
the two fundamental properties prep_zero_mask() must satisfy.
Tests on EV67 and EV68 CPUs revealed that the generic code is
essentially as fast (to within 0.5% of CPU cycles) of the old
Alpha specific code for large quadword-aligned strings, despite
the 30% extra CPU instructions executed. In contrast, the
generic code for unaligned strings is substantially slower (by
more than a factor of 3) than the old Alpha specific code.
Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Michael Cree [Sun, 19 Aug 2012 02:40:57 +0000 (14:40 +1200)]
alpha: Wire up cross memory attach syscalls
Add sys_process_vm_readv and sys_process_vm_writev to Alpha.
Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Michael Cree [Sun, 19 Aug 2012 02:40:56 +0000 (14:40 +1200)]
alpha: Don't export SOCK_NONBLOCK to user space.
Currently we export SOCK_NONBLOCK to user space but that conflicts with
the definition from glibc leading to compilation errors in user programs
(e.g. see Debian bug #658460).
The generic socket.h restricts the definition of SOCK_NONBLOCK to the
kernel, as does the MIPS specific socket.h, so let's do the same on
Alpha.
Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Matt Turner <mattst88@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Markus Trippelsdorf [Sun, 19 Aug 2012 00:35:51 +0000 (18:35 -0600)]
dyndbg: fix for SOH in logging messages
commit
af7f2158fde was done against master, and clashed with structured
logging's change of KERN_LEVEL to SOH.
Bisected and fixed by Markus Trippelsdorf.
Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Jason Baron <jbaron@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linus Torvalds [Sat, 18 Aug 2012 23:20:05 +0000 (16:20 -0700)]
Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm
Pull ARM fixes from Russell King:
"The largest thing in this set of changes is bringing back some of the
ARMv3 code to fix a compile problem noticed on RiscPC, which we still
support, even though we only support ARMv4 there.
(The reason is that the system bus doesn't support ARMv4 half-word
accesses, so we need the ARMv3 library code for this platform.)
The rest are all quite minor fixes."
* 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
ARM: 7490/1: Drop duplicate select for GENERIC_IRQ_PROBE
ARM: Bring back ARMv3 IO and user access code
ARM: 7489/1: errata: fix workaround for erratum #720789 on UP systems
ARM: 7488/1: mm: use 5 bits for swapfile type encoding
ARM: 7487/1: mm: avoid setting nG bit for user mappings that aren't present
ARM: 7486/1: sched_clock: update epoch_cyc on resume
ARM: 7484/1: Don't enable GENERIC_LOCKBREAK with ticket spinlocks
ARM: 7483/1: vfp: only advertise VFPv4 in hwcaps if CONFIG_VFPv3 is enabled
ARM: 7482/1: topology: fix section mismatch warning for init_cpu_topology
Andi Kleen [Sat, 18 Aug 2012 17:30:05 +0000 (10:30 -0700)]
sections: Fix section conflicts in drivers/hwmon
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Linus Torvalds [Sat, 18 Aug 2012 21:39:19 +0000 (14:39 -0700)]
Merge tag 'pm-for-3.6-rc3' of git://git./linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael J. Wysocki:
- Fixes for three obscure problems in the runtime PM core code found
recently.
- Two fixes for the new "coupled" cpuidle code from Colin Cross and Jon
Medhurst.
- intel_idle driver fix from Konrad Rzeszutek Wilk.
* tag 'pm-for-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
intel_idle: Check cpu_idle_get_driver() for NULL before dereferencing it.
cpuidle: Prevent null pointer dereference in cpuidle_coupled_cpu_notify
cpuidle: coupled: fix sleeping while atomic in cpu notifier
PM / Runtime: Check device PM QoS setting before "no callbacks" check
PM / Runtime: Clear power.deferred_resume on success in rpm_suspend()
PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set
Mike Frysinger [Sat, 18 Aug 2012 20:11:37 +0000 (16:11 -0400)]
x32: Use compat shims for {g,s}etsockopt
Some of the arguments to {g,s}etsockopt are passed in userland pointers.
If we try to use the 64bit entry point, we end up sometimes failing.
For example, dhcpcd doesn't run in x32:
# dhcpcd eth0
dhcpcd[1979]: version 5.5.6 starting
dhcpcd[1979]: eth0: broadcasting for a lease
dhcpcd[1979]: eth0: open_socket: Invalid argument
dhcpcd[1979]: eth0: send_raw_packet: Bad file descriptor
The code in particular is getting back EINVAL when doing:
struct sock_fprog pf;
setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER, &pf, sizeof(pf));
Diving into the kernel code, we can see:
include/linux/filter.h:
struct sock_fprog {
unsigned short len;
struct sock_filter __user *filter;
};
net/core/sock.c:
case SO_ATTACH_FILTER:
ret = -EINVAL;
if (optlen == sizeof(struct sock_fprog)) {
struct sock_fprog fprog;
ret = -EFAULT;
if (copy_from_user(&fprog, optval, sizeof(fprog)))
break;
ret = sk_attach_filter(&fprog, sk);
}
break;
arch/x86/syscalls/syscall_64.tbl:
54 common setsockopt sys_setsockopt
55 common getsockopt sys_getsockopt
So for x64, sizeof(sock_fprog) is 16 bytes. For x86/x32, it's 8 bytes.
This comes down to the pointer being 32bit for x32, which means we need
to do structure size translation. But since x32 comes in directly to
sys_setsockopt, it doesn't get translated like x86.
After changing the syscall table and rebuilding glibc with the new kernel
headers, dhcp runs fine in an x32 userland.
Oddly, it seems like Linus noted the same thing during the initial port,
but I guess that was missed/lost along the way:
https://lkml.org/lkml/2011/8/26/452
[ hpa: tagging for -stable since this is an ABI fix. ]
Bugzilla: https://bugs.gentoo.org/423649
Reported-by: Mads <mads@ab3.no>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Link: http://lkml.kernel.org/r/1345320697-15713-1-git-send-email-vapier@gentoo.org
Cc: H. J. Lu <hjl.tools@gmail.com>
Cc: <stable@vger.kernel.org> v3.4..v3.5
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Linus Torvalds [Sat, 18 Aug 2012 17:02:17 +0000 (10:02 -0700)]
Merge branch 'vfs-fixes' of git://git./linux/kernel/git/mszeredi/vfs
Pull vfs fixes from Miklos Szeredi.
This mainly fixes some confusion about whether the open 'mode' variable
passed around should contain the full file type (S_IFREG etc)
information or just the permission mode. In particular, the lack of
proper file type information had confused fuse.
* 'vfs-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
vfs: fix propagation of atomic_open create error on negative dentry
fuse: check create mode in atomic open
vfs: pass right create mode to may_o_create()
vfs: atomic_open(): fix create mode usage
vfs: canonicalize create mode in build_open_flags()
Sven Schnelle [Fri, 17 Aug 2012 19:43:43 +0000 (21:43 +0200)]
USB: CDC ACM: Fix NULL pointer dereference
If a device specifies zero endpoints in its interface descriptor,
the kernel oopses in acm_probe(). Even though that's clearly an
invalid descriptor, we should test wether we have all endpoints.
This is especially bad as this oops can be triggered by just
plugging a USB device in.
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Greg Kroah-Hartman [Sat, 18 Aug 2012 00:48:41 +0000 (17:48 -0700)]
USB: emi62: remove __devinit* from the struct usb_device_id table
This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.
Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Bjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
CC: Paul Gortmaker <paul.gortmaker@windriver.com>
CC: Andrew Morton <akpm@linux-foundation.org>
CC: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Greg Kroah-Hartman [Sat, 18 Aug 2012 00:48:37 +0000 (17:48 -0700)]
USB: winbond: remove __devinit* from the struct usb_device_id table
This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.
Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Bjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
CC: Pavel Machek <pavel@ucw.cz>
CC: Paul Gortmaker <paul.gortmaker@windriver.com>
CC: "John W. Linville" <linville@tuxdriver.com>
CC: Eliad Peller <eliad@wizery.com>
CC: Devendra Naga <devendra.aaru@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Greg Kroah-Hartman [Sat, 18 Aug 2012 00:48:33 +0000 (17:48 -0700)]
USB: vt6656: remove __devinit* from the struct usb_device_id table
This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.
Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Bjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
CC: Forest Bond <forest@alittletooquiet.net>
CC: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
CC: "David S. Miller" <davem@davemloft.net>
CC: Jesper Juhl <jj@chaosbits.net>
CC: Jiri Pirko <jpirko@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Greg Kroah-Hartman [Sat, 18 Aug 2012 00:48:29 +0000 (17:48 -0700)]
USB: rtl8187: remove __devinit* from the struct usb_device_id table
This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.
Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Bjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
CC: Herton Ronaldo Krzesinski <herton@canonical.com>
CC: Hin-Tak Leung <htl10@users.sourceforge.net>
CC: Larry Finger <Larry.Finger@lwfinger.net>
CC: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Greg Kroah-Hartman [Sat, 18 Aug 2012 00:48:28 +0000 (17:48 -0700)]
USB: p54usb: remove __devinit* from the struct usb_device_id table
This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.
Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Bjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
CC: Christian Lamparter <chunkeey@googlemail.com>
CC: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Greg Kroah-Hartman [Sat, 18 Aug 2012 00:48:27 +0000 (17:48 -0700)]
USB: spca506: remove __devinit* from the struct usb_device_id table
This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.
Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Bjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
CC: Hans de Goede <hdegoede@redhat.com>
CC: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Greg Kroah-Hartman [Sat, 18 Aug 2012 00:48:27 +0000 (17:48 -0700)]
USB: jl2005bcd: remove __devinit* from the struct usb_device_id table
This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.
Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Bjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
CC: Hans de Goede <hdegoede@redhat.com>
CC: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Greg Kroah-Hartman [Sat, 18 Aug 2012 00:48:26 +0000 (17:48 -0700)]
USB: smsusb: remove __devinit* from the struct usb_device_id table
This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.
Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Bjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
CC: Mauro Carvalho Chehab <mchehab@infradead.org>
CC: Michael Krufky <mkrufky@linuxtv.org>
CC: Paul Gortmaker <paul.gortmaker@windriver.com>
CC: Doron Cohen <doronc@siano-ms.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linus Torvalds [Sat, 18 Aug 2012 00:47:32 +0000 (17:47 -0700)]
Merge tag 'md-3.6-fixes' of git://neil.brown.name/md
Pull md fixes from NeilBrown:
"2 fixes for md, tagged for -stable"
* tag 'md-3.6-fixes' of git://neil.brown.name/md:
md/raid10: fix problem with on-stack allocation of r10bio structure.
md: Don't truncate size at 4TB for RAID0 and Linear
NeilBrown [Fri, 17 Aug 2012 23:51:42 +0000 (09:51 +1000)]
md/raid10: fix problem with on-stack allocation of r10bio structure.
A 'struct r10bio' has an array of per-copy information at the end.
This array is declared with size [0] and r10bio_pool_alloc allocates
enough extra space to store the per-copy information depending on the
number of copies needed.
So declaring a 'struct r10bio on the stack isn't going to work. It
won't allocate enough space, and memory corruption will ensue.
So in the two places where this is done, declare a sufficiently large
structure and use that instead.
The two call-sites of this bug were introduced in 3.4 and 3.5
so this is suitable for both those kernels. The patch will have to
be modified for 3.4 as it only has one bug.
Cc: stable@vger.kernel.org
Reported-by: Ivan Vasilyev <ivan.vasilyev@gmail.com>
Tested-by: Ivan Vasilyev <ivan.vasilyev@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Guenter Roeck [Fri, 17 Aug 2012 03:26:00 +0000 (20:26 -0700)]
spi/coldfire-qspi: Drop extra calls to spi_master_get in suspend/resume functions
Suspend and resume functions call spi_master_get() without matching
spi_master_put(). The extra references are unnecessary and cause
subsequent module unload attempts to fail, so drop the calls.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Guenter Roeck [Fri, 17 Aug 2012 03:25:59 +0000 (20:25 -0700)]
spi: spi-coldfire-qspi: Drop extra spi_master_put in device remove function
The call sequence spi_alloc_master/spi_register_master/spi_unregister_master is
complete; it reduces the device reference count to zero, which and results in
device memory being freed. The subsequent call to spi_master_put is unnecessary
and results in an access to free memory. Drop it.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Michel JAOUEN [Fri, 17 Aug 2012 15:28:41 +0000 (17:28 +0200)]
spi/pl022: fix spi-pl022 pm enable at probe
amba drivers does not need to enable pm runtime at probe.
amba_probe already enables pm runtime.
This rids this warning in the ux500 boot log:
ssp-pl022 ssp0: Unbalanced pm_runtime_enable!
Signed-off-by: Michel JAOUEN <michel.jaouen@stericsson.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Mark Brown [Tue, 31 Jul 2012 17:37:28 +0000 (18:37 +0100)]
ASoC: wm9712: Fix inverted capture volume
The capture volume increases with the register value so it shouldn't be
flagged as inverted.
Reported-by: Christoph Fritz <chf.fritz@googlemail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Mark Brown [Thu, 16 Aug 2012 21:36:04 +0000 (22:36 +0100)]
ASoC: wm9712: Fix microphone source selection
Currently the microphone input source is not selectable as while there is
a DAPM widget it's not connected to anything so it won't be properly
instantiated. Add something more correct for the input structure to get
things going, even though it's not hooked into the rest of the routing
map and so won't actually achieve anything except allowing the relevant
register bits to be written.
Reported-by: Christop Fritz <chf.fritz@googlemail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@vger.kernel.org
Mark Brown [Thu, 16 Aug 2012 12:08:23 +0000 (13:08 +0100)]
ASoC: wm5102: Remove DRC2
It will be removed from future device revisions.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Carlos Alberto Lopez Perez [Thu, 2 Aug 2012 17:50:21 +0000 (19:50 +0200)]
classmate-laptop: always call input_sync() after input_report_switch()
Due to commit
cdda911c34006f1089f3c87b1a1f31ab3a4722f2 evdev only
becomes readable when the buffer contains an EV_SYN/SYN_REPORT event.
So in order to read the tablet sensor data as it happens we need to
ensure that we always call input_sync() after input_report_switch()
Signed-off-by: Carlos Alberto Lopez Perez <clopez@igalia.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Manoj Iyer [Mon, 6 Aug 2012 23:15:37 +0000 (18:15 -0500)]
thinkpad-acpi: recognize latest V-Series using DMI_BIOS_VENDOR
In the latest V-series bios DMI_PRODUCT_VERSION does not contain
the string Lenovo or Thinkpad, but is set to the model number, this
causes the thinkpad_acpi module to fail to load. Recognize laptop
as Lenovo using DMI_BIOS_VENDOR instead, which is set to Lenovo.
Test on V490u
=============
== After the patch ==
[ 1350.295757] thinkpad_acpi: ThinkPad ACPI Extras v0.24
[ 1350.295760] thinkpad_acpi: http://ibm-acpi.sf.net/
[ 1350.295761] thinkpad_acpi: ThinkPad BIOS H7ET21WW (1.00 ), EC unknown
[ 1350.295763] thinkpad_acpi: Lenovo LENOVO, model LV5DXXX
[ 1350.296086] thinkpad_acpi: detected a 8-level brightness capable ThinkPad
[ 1350.296694] thinkpad_acpi: radio switch found; radios are enabled
[ 1350.296703] thinkpad_acpi: possible tablet mode switch found; ThinkPad in laptop mode
[ 1350.306466] thinkpad_acpi: rfkill switch tpacpi_bluetooth_sw: radio is unblocked
[ 1350.307082] Registered led device: tpacpi::thinklight
[ 1350.307215] Registered led device: tpacpi::power
[ 1350.307255] Registered led device: tpacpi::standby
[ 1350.307294] Registered led device: tpacpi::thinkvantage
[ 1350.308160] thinkpad_acpi: Standard ACPI backlight interface available, not loading native one
[ 1350.308333] thinkpad_acpi: Console audio control enabled, mode: monitor (read only)
[ 1350.312287] input: ThinkPad Extra Buttons as /devices/platform/thinkpad_acpi/input/input14
== Before the patch ==
sudo modprobe thinkpad_acpi
FATAL: Error inserting thinkpad_acpi (/lib/modules/3.2.0-27-generic/kernel/drivers/platform/x86/thinkpad_acpi.ko): No such device
Test on B485
=============
This patch was also test in a B485 where the thinkpad_acpi module does not
have any issues loading. But, I tested it to make sure this patch does not
break on already functioning models of Lenovo products.
[13486.746359] thinkpad_acpi: ThinkPad ACPI Extras v0.24
[13486.746364] thinkpad_acpi: http://ibm-acpi.sf.net/
[13486.746368] thinkpad_acpi: ThinkPad BIOS HJET15WW(1.01), EC unknown
[13486.746373] thinkpad_acpi: Lenovo Lenovo LB485, model 814TR01
[13486.747300] thinkpad_acpi: detected a 8-level brightness capable ThinkPad
[13486.752435] thinkpad_acpi: rfkill switch tpacpi_bluetooth_sw: radio is unblocked
[13486.752883] Registered led device: tpacpi::thinklight
[13486.752915] thinkpad_acpi: Standard ACPI backlight interface available, not loading native one
[13486.753216] thinkpad_acpi: Console audio control enabled, mode: monitor (read only)
[13486.757147] input: ThinkPad Extra Buttons as /devices/platform/thinkpad_acpi/input/input15
Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
AceLan Kao [Mon, 6 Aug 2012 01:48:58 +0000 (09:48 +0800)]
dell-laptop: Fixed typo in touchpad LED quirk
Fixed the typo introduced from the below commit
5f1e88f dell-laptop: Add 6 machines to touchpad led quirk
Reported-by: Carlos Alberto Lopez Perez <clopez@igalia.com>
Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Seth Forshee [Fri, 17 Aug 2012 16:17:02 +0000 (11:17 -0500)]
vga_switcheroo: Don't require handler init callback
This callback is a no-op in nouveau, and the upcoming apple-gmux
switcheroo support won't require it either. Rather than forcing drivers
to stub it out, just make it optional and remove the callback from
nouveau.
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Seth Forshee [Fri, 17 Aug 2012 16:17:03 +0000 (11:17 -0500)]
vga_switcheroo: Remove assumptions about registration/unregistration ordering
vga_switcheroo assumes that the handler will be registered before the
last client, otherwise switching will not be enabled. Likewise it's
assumed that the handler will not be unregistered without at least one
client also being unregistered, otherwise switching will remain enabled
despite no longer having a handler. These assumptions cannot be enforced
if the handler is in a separate driver from both clients, as with the
gmux found in Apple laptops. Remove this assumption.
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Andreas Heider [Fri, 17 Aug 2012 16:17:04 +0000 (11:17 -0500)]
apple-gmux: Add display mux support
Add support for the gmux display muxing functionality and register a mux
handler with vga_switcheroo.
Signed-off-by: Andreas Heider <andreas@meetr.de>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Seth Forshee [Thu, 2 Aug 2012 17:15:14 +0000 (12:15 -0500)]
apple-gmux: Fix kconfig dependencies
Fix the dependencies of apple-gmux to prevent it from being built-in
when one or more of its dependencies is built as a module. Otherwise it
can fail to build due to missing symbols.
v2: Add dependency on ACPI to fix build failure when ACPI=n
Reported-by: Arun Raghavan <arun.raghavan@collabora.co.uk>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
AceLan Kao [Thu, 26 Jul 2012 09:13:31 +0000 (17:13 +0800)]
asus-wmi: record wlan status while controlled by userapp
If the user bit is set, that mean BIOS can't set and record the wlan
status, it will report the value read from id ASUS_WMI_DEVID_WLAN_LED
(0x00010012) while we query the wlan status by id ASUS_WMI_DEVID_WLAN
(0x00010011) through WMI.
So, we have to record wlan status in id ASUS_WMI_DEVID_WLAN_LED
(0x00010012) while setting the wlan status through WMI.
This is also the behavior that windows app will do.
Quote from ASUS application engineer
===
When you call WMIMethod(DSTS, 0x00010011) to get WLAN status, it may return
(1) 0x00050001 (On)
(2) 0x00050000 (Off)
(3) 0x00030001 (On)
(4) 0x00030000 (Off)
(5) 0x00000002 (Unknown)
(1), (2) means that the model has hardware GPIO for WLAN, you can call
WMIMethod(DEVS, 0x00010011, 1 or 0) to turn WLAN on/off.
(3), (4) means that the model doesn’t have hardware GPIO, you need to use
API or driver library to turn WLAN on/off, and call
WMIMethod(DEVS, 0x00010012, 1 or 0) to set WLAN LED status.
After you set WLAN LED status, you can see the WLAN status is changed with
WMIMethod(DSTS, 0x00010011). Because the status is recorded lastly
(ex: Windows), you can use it for synchronization.
(5) means that the model doesn’t have WLAN device.
WLAN is the ONLY special case with upper rule.
For other device, like Bluetooth, you just need use
WMIMethod(DSTS, 0x00010013) to get, and WMIMethod(DEVS, 0x00010013, 1 or 0)
to set.
===
Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Matthew Garrett [Fri, 17 Aug 2012 20:57:20 +0000 (16:57 -0400)]
apple_gmux: Fix ACPI video unregister
We were only calling acpi_video_unregister() if ACPI video support was built
in, not if it was a module.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Matthew Garrett [Thu, 9 Aug 2012 17:45:01 +0000 (13:45 -0400)]
apple_gmux: Add support for newer hardware
New gmux devices have a different method for accessing the registers.
Update the driver to cope. Incorporates feedback from Bernhard Froemel.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Cc: Bernhard Froemel <froemel@vmars.tuwien.ac.at>
Cc: Seth Forshee <seth.forshee@canonical.com>
Matthew Garrett [Thu, 9 Aug 2012 16:47:00 +0000 (12:47 -0400)]
gmux: Add generic write32 function
Move the special-cased backlight update function to a generic gmux_write32
function.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Cc: Seth Forshee <seth.forshee@canonical.com>
Linus Torvalds [Fri, 17 Aug 2012 18:45:58 +0000 (11:45 -0700)]
Merge tag 'rdma-for-linus' of git://git./linux/kernel/git/roland/infiniband
Pull infiniband/rdma fixes from Roland Dreier:
"Grab bag of InfiniBand/RDMA fixes:
- IPoIB fixes for regressions introduced by path database conversion
- mlx4 fixes for bugs with large memory systems and regressions from
SR-IOV patches
- RDMA CM fix for passing bad event up to userspace
- Other minor fixes"
* tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
IB/mlx4: Check iboe netdev pointer before dereferencing it
mlx4_core: Clean up buddy bitmap allocation
mlx4_core: Fix integer overflow issues around MTT table
mlx4_core: Allow large mlx4_buddy bitmaps
IB/srp: Fix a race condition
IB/qib: Fix error return code in qib_init_7322_variables()
IB: Fix typos in infiniband drivers
IB/ipoib: Fix RCU pointer dereference of wrong object
IB/ipoib: Add missing locking when CM object is deleted
RDMA/ucma.c: Fix for events with wrong context on iWARP
RDMA/ocrdma: Don't call vlan_dev_real_dev() for non-VLAN netdevs
IB/mlx4: Fix possible deadlock on sm_lock spinlock
Linus Torvalds [Fri, 17 Aug 2012 18:12:28 +0000 (11:12 -0700)]
Merge tag 'tty-3.6-rc3' of git://git./linux/kernel/git/gregkh/tty
Pull TTY fixes from Greg Kroah-Hartman:
"Here are 4 tiny patches, each fixing a serial driver problem that
people have reported.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"
* tag 'tty-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
pmac_zilog,kdb: Fix console poll hook to return instead of loop
serial: mxs-auart: fix the wrong RTS hardware flow control
serial: ifx6x60: fix paging fault on spi_register_driver
serial: Change Kconfig entry for CLPS711X-target
Konrad Rzeszutek Wilk [Thu, 16 Aug 2012 20:06:55 +0000 (22:06 +0200)]
intel_idle: Check cpu_idle_get_driver() for NULL before dereferencing it.
If the machine is booted without any cpu_idle driver set
(b/c disable_cpuidle() has been called) we should follow
other users of cpu_idle API and check the return value
for NULL before using it.
Reported-and-tested-by: Mark van Dijk <mark@internecto.net>
Suggested-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Jon Medhurst (Tixy) [Wed, 15 Aug 2012 20:11:00 +0000 (22:11 +0200)]
cpuidle: Prevent null pointer dereference in cpuidle_coupled_cpu_notify
When a kernel is built to support multiple hardware types it's possible
that CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED is set but the hardware the
kernel is run on doesn't support cpuidle and therefore doesn't load a
driver for it. In this case, when the system is shut down,
cpuidle_coupled_cpu_notify() gets called with cpuidle_devices set to
NULL. There are quite possibly other circumstances where this
situation can also occur and we should check for it.
Signed-off-by: Jon Medhurst <tixy@linaro.org>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Colin Cross [Wed, 15 Aug 2012 20:10:50 +0000 (22:10 +0200)]
cpuidle: coupled: fix sleeping while atomic in cpu notifier
The cpu hotplug notifier gets called in both atomic and non-atomic
contexts, it is not always safe to lock a mutex. Filter out all events
except the six necessary ones, which are all sleepable, before taking
the mutex.
Signed-off-by: Colin Cross <ccross@android.com>
Reviewed-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Rafael J. Wysocki [Wed, 15 Aug 2012 19:32:04 +0000 (21:32 +0200)]
PM / Runtime: Check device PM QoS setting before "no callbacks" check
If __dev_pm_qos_read_value(dev) returns a negative value,
rpm_suspend() should return -EPERM for dev even if its
power.no_callbacks flag is set. For this to happen, the device's
power.no_callbacks flag has to be checked after the PM QoS check,
so move the PM QoS check to rpm_check_suspend_allowed() (this will
make it cover idle notifications as well as runtime suspend too).
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable@vger.kernel.org
Rafael J. Wysocki [Wed, 15 Aug 2012 19:31:55 +0000 (21:31 +0200)]
PM / Runtime: Clear power.deferred_resume on success in rpm_suspend()
The power.deferred_resume can only be set if the runtime PM status
of device is RPM_SUSPENDING and it should be cleared after its
status has been changed, regardless of whether or not the runtime
suspend has been successful. However, it only is cleared on
suspend failure, while it may remain set on successful suspend and
is happily leaked to rpm_resume() executed in that case.
That shouldn't happen, so if power.deferred_resume is set in
rpm_suspend() after the status has been changed to RPM_SUSPENDED,
clear it before calling rpm_resume(). Then, it doesn't need to be
cleared before changing the status to RPM_SUSPENDING any more,
because it's always cleared after the status has been changed to
either RPM_SUSPENDED (on success) or RPM_ACTIVE (on failure).
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable@vger.kernel.org
Rafael J. Wysocki [Wed, 15 Aug 2012 19:31:45 +0000 (21:31 +0200)]
PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set
For devices whose power.no_callbacks flag is set, rpm_resume()
should return 1 if the device's parent is already active, so that
the callers of pm_runtime_get() don't think that they have to wait
for the device to resume (asynchronously) in that case (the core
won't queue up an asynchronous resume in that case, so there's
nothing to wait for anyway).
Modify the code accordingly (and make sure that an idle notification
will be queued up on success, even if 1 is to be returned).
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable@vger.kernel.org
Linus Torvalds [Fri, 17 Aug 2012 17:17:03 +0000 (10:17 -0700)]
Merge tag 'staging-3.6-rc3' of git://git./linux/kernel/git/gregkh/staging
Pull staging fixes from Greg Kroah-Hartman:
"Here are some staging driver fixes (and iio driver fixes, they get
lumped in with the staging stuff due to dependancies) for your 3.6-rc3
tree.
Nothing major, just a bunch of fixes that people have reported.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"
* tag 'staging-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (26 commits)
iio: lm3533-als: Fix build warnings
staging:iio:ad7780: Mark channels as unsigned
staging:iio:ad7192: Report offset and scale for temperature channel
staging:iio:ad7192: Report channel offset
staging:iio:ad7192: Mark channels as unsigned
staging:iio:ad7192: Fix setting ACX
staging:iio:ad7192: Add missing break in switch statement
staging:iio:ad7793: Fix internal reference value
staging:iio:ad7793: Follow new IIO naming spec
staging:iio:ad7793: Fix temperature scale and offset
staging:iio:ad7793: Report channel offset
staging:iio:ad7793: Mark channels as unsigned
staging:iio:ad7793: Add missing break in switch statement
iio/adjd_s311: Fix potential memory leak in adjd_s311_update_scan_mode()
iio: frequency:
ADF4350: Fix potential reference div factor overflow.
iio: staging: ad7298_ring: Fix maybe-uninitialized warning
staging: comedi: usbduxfast: Declare MODULE_FIRMWARE usage
staging: comedi: usbdux: Declare MODULE_FIRMWARE usage
staging: comedi: usbduxsigma: Declare MODULE_FIRMWARE usage
staging: csr: add INET dependancy
...
Linus Torvalds [Fri, 17 Aug 2012 17:16:30 +0000 (10:16 -0700)]
Merge tag 'driver-core-3.6-rc3' of git://git./linux/kernel/git/gregkh/driver-core
Pull driver core fixes from Greg Kroah-Hartman:
"Here are two tiny patches, one fixing a dynamic debug problem that the
printk rework turned up, and the other one fixing an extcon problem
that people reported.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"
* tag 'driver-core-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
extcon: extcon_gpio: Replace gpio_request_one by devm_gpio_request_one
drivers-core: make structured logging play nice with dynamic-debug
Linus Torvalds [Fri, 17 Aug 2012 17:15:57 +0000 (10:15 -0700)]
Merge tag 'char-misc-3.6-rc3' of git://git./linux/kernel/git/gregkh/char-misc
Pull Char / Misc driver fixes from Greg Kroah-Hartman:
"Here are some small misc and w1 driver fixes for 3.6-rc3. Nothing
major, just some some bugfixes and a new device id for a w1 driver.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"
* tag 'char-misc-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
1-Wire: Add support for the maxim ds1825 temperature sensor
ti-st: Fix check for pdata->chip_awake function pointer
mei: add mei_quirk_probe function
mei: fix device stall after wd is stopped
Linus Torvalds [Fri, 17 Aug 2012 17:14:53 +0000 (10:14 -0700)]
Merge tag 'usb-3.6-rc3' of git://git./linux/kernel/git/gregkh/usb
Pull USB patches from Greg Kroah-Hartman:
"Here are a number of small USB patches for 3.6-rc3.
The "large" one is just a number of device id updates to the option
driver, done by the manufacturer, properly fixing up the device ids
based on shipping devices.
Other than that, some gadget driver fixes, the obligitary XHCI
patches, and some other device ids and bugs fixed.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"
* tag 'usb-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (26 commits)
USB: qcserial: fix port handling on Gobi 1K and 2K+
USB: serial: Fix mos7840 timeout
USB: option: add ZTE K5006-Z
usb: gadget: u_ether: fix kworker 100% CPU issue with still used interfaces in eth_stop
usb: host: tegra: fix warning messages in ehci_remove
usb: host: mips: sead3: Update for EHCI register structure.
usb: renesas_usbhs: fixup resume method for autonomy mode
usb: renesas_usbhs: mod_host: add missing .bus_suspend/resume
update MAINTAINERS for Oliver Neukum
usb: usb_wwan: resume/suspend can be called after port is gone
usb: serial: prevent suspend/resume from racing against probe/remove
usb: usb_wwan: replace release and disconnect with a port_remove hook
usb: serial: mos7840: Fixup mos7840_chars_in_buffer()
USB: isp1362-hcd.c: usb message always saved in case of underrun
OMAP: USB : Fix the EHCI enumeration and core retention issue
usb: chipidea: fix and improve dependencies if usb host or gadget support is built as module
USB: support the new interfaces of Huawei Data Card devices in option driver
USB: ftdi_sio: Add VID/PID for Kondo Serial USB
xhci: Switch PPT ports to EHCI on shutdown.
xhci: Fix bug after deq ptr set to link TRB.
...
Randy Dunlap [Thu, 16 Aug 2012 23:23:20 +0000 (16:23 -0700)]
scripts/kernel-doc: fix fatal script error
Fix fatal error in scripts/kernel-doc by ignoring the "__weak" attribute:
Error(drivers/pci/pci.c:2820): cannot understand prototype: 'char * __weak pcibios_setup(char *str) '
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Fri, 17 Aug 2012 16:17:11 +0000 (09:17 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/linux-security
Pull a Yama bugfix from James Morris.
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
Yama: access task_struct->comm directly
Linus Torvalds [Fri, 17 Aug 2012 15:10:12 +0000 (08:10 -0700)]
Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming
Pull C6X atomic64 support from Mark Salter:
"Enable atomic64 ops in C6X
- define L1_CACHE_SHIFT
- select GENERIC_ATOMIC64"
* tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
C6X: select GENERIC_ATOMIC64
C6X: add Lx_CACHE_SHIFT defines
Linus Torvalds [Fri, 17 Aug 2012 15:04:47 +0000 (08:04 -0700)]
Merge tag 'ext4_for_linus_stable' of git://git./linux/kernel/git/tytso/ext4
Pull ext4 bug fixes from Ted Ts'o:
"The following are all bug fixes and regressions. The most notable are
the ones which cause problems for ext4 on RAID --- a performance
problem when mounting very large filesystems, and a kernel OOPS when
doing an rm -rf on large directory hierarchies on fast devices."
* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
ext4: fix kernel BUG on large-scale rm -rf commands
ext4: fix long mount times on very big file systems
ext4: don't call ext4_error while block group is locked
ext4: avoid kmemcheck complaint from reading uninitialized memory
ext4: make sure the journal sb is written in ext4_clear_journal_err()
Ian Kent [Fri, 17 Aug 2012 03:09:04 +0000 (11:09 +0800)]
autofs4 - fix expire check
In some cases when an autofs indirect mount is contained in a file
system that is marked as shared (such as when systemd does the
equivalent of "mount --make-rshared /" early in the boot), mounts
stop expiring.
When this happens the first expiry check on a mountpoint dentry in
autofs_expire_indirect() sees a mountpoint dentry with a higher
than minimal reference count. Consequently the dentry is condidered
busy and the actual expiry check is never done.
This particular check was originally meant as an optimisation to
detect a path walk in progress but with the addition of rcu-walk
it can be ineffective anyway.
Removing the test allows automounts to expire again since the
actual expire check doesn't rely on the dentry reference count.
Signed-off-by: Ian Kent <raven@themaw.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Theodore Ts'o [Fri, 17 Aug 2012 12:54:52 +0000 (08:54 -0400)]
ext4: fix kernel BUG on large-scale rm -rf commands
Commit
968dee7722: "ext4: fix hole punch failure when depth is greater
than 0" introduced a regression in v3.5.1/v3.6-rc1 which caused kernel
crashes when users ran run "rm -rf" on large directory hierarchy on
ext4 filesystems on RAID devices:
BUG: unable to handle kernel NULL pointer dereference at
0000000000000028
Process rm (pid: 18229, threadinfo
ffff8801276bc000, task
ffff880123631710)
Call Trace:
[<
ffffffff81236483>] ? __ext4_handle_dirty_metadata+0x83/0x110
[<
ffffffff812353d3>] ext4_ext_truncate+0x193/0x1d0
[<
ffffffff8120a8cf>] ? ext4_mark_inode_dirty+0x7f/0x1f0
[<
ffffffff81207e05>] ext4_truncate+0xf5/0x100
[<
ffffffff8120cd51>] ext4_evict_inode+0x461/0x490
[<
ffffffff811a1312>] evict+0xa2/0x1a0
[<
ffffffff811a1513>] iput+0x103/0x1f0
[<
ffffffff81196d84>] do_unlinkat+0x154/0x1c0
[<
ffffffff8118cc3a>] ? sys_newfstatat+0x2a/0x40
[<
ffffffff81197b0b>] sys_unlinkat+0x1b/0x50
[<
ffffffff816135e9>] system_call_fastpath+0x16/0x1b
Code: 8b 4d 20 0f b7 41 02 48 8d 04 40 48 8d 04 81 49 89 45 18 0f b7 49 02 48 83 c1 01 49 89 4d 00 e9 ae f8 ff ff 0f 1f 00 49 8b 45 28 <48> 8b 40 28 49 89 45 20 e9 85 f8 ff ff 0f 1f 80 00 00 00
RIP [<
ffffffff81233164>] ext4_ext_remove_space+0xa34/0xdf0
This could be reproduced as follows:
The problem in commit
968dee7722 was that caused the variable 'i' to
be left uninitialized if the truncate required more space than was
available in the journal. This resulted in the function
ext4_ext_truncate_extend_restart() returning -EAGAIN, which caused
ext4_ext_remove_space() to restart the truncate operation after
starting a new jbd2 handle.
Reported-by: Maciej Żenczykowski <maze@google.com>
Reported-by: Marti Raudsepp <marti@juffo.org>
Tested-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org
Theodore Ts'o [Thu, 16 Aug 2012 15:59:04 +0000 (11:59 -0400)]
ext4: fix long mount times on very big file systems
Commit
8aeb00ff85a: "ext4: fix overhead calculation used by
ext4_statfs()" introduced a O(n**2) calculation which makes very large
file systems take forever to mount. Fix this with an optimization for
non-bigalloc file systems. (For bigalloc file systems the overhead
needs to be set in the the superblock.)
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org
Theodore Ts'o [Fri, 10 Aug 2012 17:57:52 +0000 (13:57 -0400)]
ext4: don't call ext4_error while block group is locked
While in ext4_validate_block_bitmap(), if an block allocation bitmap
is found to be invalid, we call ext4_error() while the block group is
still locked. This causes ext4_commit_super() to call a function
which might sleep while in an atomic context.
There's no need to keep the block group locked at this point, so hoist
the ext4_error() call up to ext4_validate_block_bitmap() and release
the block group spinlock before calling ext4_error().
The reported stack trace can be found at:
http://article.gmane.org/gmane.comp.file-systems.ext4/33731
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org
Kees Cook [Wed, 15 Aug 2012 18:41:55 +0000 (11:41 -0700)]
Yama: access task_struct->comm directly
The core ptrace access checking routine holds a task lock, and when
reporting a failure, Yama takes a separate task lock. To avoid a
potential deadlock with two ptracers taking the opposite locks, do not
use get_task_comm() and just use ->comm directly since accuracy is not
important for the report.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Suggested-by: Oleg Nesterov <oleg@redhat.com>
CC: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>