| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
This patch fixes following warning:
arch/arm/mm/init.c:606: warning: format '%08lx' expects type 'long unsigned int', but argument 12 has type 'unsigned int'
by appending UL to VMALLOC_END's Number.
Reviewed-by: Stanley Miao <[email protected]>
Signed-off-by: Viresh Kumar <[email protected]>
Signed-off-by: Russell King <[email protected]>
|
|
The dependency is already expressed by the Makefiles, storing it in the
.cmd file breaks build if a .c file is replaced by .S or vice versa,
because the .cmd file contains
foo/bar.o: foo/bar.c ...
foo/bar.c ... :
so the foo/bar.c -> foo/bar.o rule triggers even if there is no
foo/bar.c anymore.
Acked-by: Stephen Rothwell <[email protected]>
Signed-off-by: Michal Marek <[email protected]>
|
|
Signed-off-by: Lu Guanqun <[email protected]>
Reviewed-by: Wu Fengguang <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
|
|
VersaLogic Menlow based boards hang on reboot unless reboot=bios
is used. Add quirk to reboot through the BIOS.
Tested on at least four boards.
Signed-off-by: Kushal Koolwal <[email protected]>
LKML-Reference: <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
|
|
blk_throtl_exit assumes that ->queue_lock still exists,
so make sure that it does.
To do this, we stop redirecting ->queue_lock to conf->device_lock
and leave it pointing where it is initialised - __queue_lock.
As the blk_plug functions check the ->queue_lock is held, we now
take that spin_lock explicitly around the plug functions. We don't
need the locking, just the warning removal.
This is needed for any kernel with the blk_throtl code, which is
which is 2.6.37 and later.
Cc: [email protected]
Signed-off-by: NeilBrown <[email protected]>
|
|
From: Eric W. Biederman <[email protected]>
In the beginning with batching unreg_list was a list that was used only
once in the lifetime of a network device (I think). Now we have calls
using the unreg_list that can happen multiple times in the life of a
network device like dev_deactivate and dev_close that are also using the
unreg_list. In addition in unregister_netdevice_queue we also do a
list_move because for devices like veth pairs it is possible that
unregister_netdevice_queue will be called multiple times.
So I think the change below to fix dev_deactivate which Eric D. missed
will fix this problem. Now to go test that.
Signed-off-by: David S. Miller <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ALSA: HDA: Do not announce false surround in Conexant auto
ALSA: HDA: Conexant auto: Handle multiple connections to ADC node
ALSA: HDA: Add position_fix quirk for an Asus device
ALSA: caiaq - Fix possible string-buffer overflow
ALSA: au88x0 - Modify pointer callback to give accurate playback position
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging
* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging:
hwmon: (lm85) extend to support EMC6D103 chips
MAINTAINERS: Remove stale hwmon quilt tree
hwmon: (k10temp) add support for AMD Family 12h/14h CPUs
hwmon: (jc42) do not allow writing to locked registers
hwmon: (jc42) more helpful documentation
hwmon: (jc42) fix type mismatch
|
|
This reverts commit 9b29050f8f75916f974a2d231ae5d3cd59792296.
It has caused hibernate regressions, for example Juri Sladby's report:
"I'm unable to hibernate 2.6.37.1 unless I rmmod tpm_tis:
[10974.074587] Suspending console(s) (use no_console_suspend to debug)
[10974.103073] tpm_tis 00:0c: Operation Timed out
[10974.103089] legacy_suspend(): pnp_bus_suspend+0x0/0xa0 returns -62
[10974.103095] PM: Device 00:0c failed to freeze: error -62"
and Rafael points out that some of the new conditionals in that commit
seem to make no sense. This commit needs more work and testing, let's
revert it for now.
Reported-by: Norbert Preining <[email protected]>
Reported-and-requested-by: Jiri Slaby <[email protected]>
Cc: Stefan Berger <[email protected]>
Cc: Guillaume Chazarain <[email protected]>
Cc: Rajiv Andrade <[email protected]>
Acked-by: Rafael J. Wysocki <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
|
|
There is no point in casting to (void *) when setting up xhci->ir_set
as it only makes us lose __iomem annotation and makes sparse unhappy.
OTOH we do need to cast to (void *) when calculating xhci->dba from
offset, but since it is IO memory we need to annotate it as such.
Signed-off-by: Dmitry Torokhov <[email protected]>
Signed-off-by: Sarah Sharp <[email protected]>
|
|
xhci->ir_set points to __iomem region, but xhci_print_ir_set accepts
plain struct xhci_intr_reg * causing multiple sparse warning at call
sites and inside the fucntion when we try to read that memory.
Instead of adding __iomem qualifier to the argument let's rework the
function so it itself gets needed register set from xhci and prints
it.
Signed-off-by: Dmitry Torokhov <[email protected]>
Signed-off-by: Sarah Sharp <[email protected]>
|
|
If the device isn't reset, the XHCI HCD sends
SET ADDRESS to address 0 while the device is
already in Addressed state, and the request is
dropped on the floor as it is addressed to the
default address. This sequence of events, which this
patch fixes looks like this:
usb_reset_and_verify_device()
hub_port_init()
hub_set_address()
SET_ADDRESS to 0 with 1
usb_get_device_descriptor(udev, 8)
usb_get_device_descriptor(udev, 18)
descriptors_changed() --> goto re_enumerate:
hub_port_logical_disconnect()
kick_khubd()
And then:
hub_events()
hub_port_connect_change()
usb_disconnect()
usb_disable_device()
new device struct
sets device state to Powered
choose_address()
hub_port_init() <-- no reset, but SET ADDRESS to 0 with 1, timeout!
The solution is to always reset the device in
hub_port_init() to put it in a known state.
Note from Sarah Sharp:
This patch should be queued for stable trees all the way back to 2.6.34,
since that was the first kernel that supported configured device reset.
The code this patch touches has been there since 2.6.32, but the bug
would never be hit before 2.6.34 because the xHCI driver would
completely reject an attempt to reset a configured device under xHCI.
Signed-off-by: Luben Tuikov <[email protected]>
Signed-off-by: Sarah Sharp <[email protected]>
Cc: [email protected]
|
|
The expression
while (running_total < sg_dma_len(sg))
does not take into account that the remaining data length can be less
than sg_dma_len(sg). In that case, running_total can end up being
greater than the total data length, so an extra TRB is counted.
Changing the expression to
while (running_total < sg_dma_len(sg) && running_total < temp)
fixes that.
This patch should be queued for stable kernels back to 2.6.31.
Signed-off-by: Paul Zimmerman <[email protected]>
Signed-off-by: Sarah Sharp <[email protected]>
Cc: [email protected]
|
|
Calculations like
running_total = TRB_MAX_BUFF_SIZE -
(sg_dma_address(sg) & (TRB_MAX_BUFF_SIZE - 1));
if (running_total != 0)
num_trbs++;
are incorrect, because running_total can never be zero, so the if()
expression will never be true. I think the intention was that
running_total be in the range of 0 to TRB_MAX_BUFF_SIZE-1, not 1
to TRB_MAX_BUFF_SIZE. So adding a
running_total &= TRB_MAX_BUFF_SIZE - 1;
fixes the problem.
This patch should be queued for stable kernels back to 2.6.31.
Signed-off-by: Paul Zimmerman <[email protected]>
Signed-off-by: Sarah Sharp <[email protected]>
Cc: [email protected]
|
|
This makes it easier to spot some problems, which will be fixed by the
next patch in the series. Also change dev_dbg to dev_err in
check_trb_math(), so any math errors will be visible even when running
with debug disabled.
Note: This patch changes the expressions containing
"((1 << TRB_MAX_BUFF_SHIFT) - 1)" to use the equivalent
"(TRB_MAX_BUFF_SIZE - 1)". No change in behavior is intended for
those expressions.
This patch should be queued for stable kernels back to 2.6.31.
Signed-off-by: Paul Zimmerman <[email protected]>
Signed-off-by: Sarah Sharp <[email protected]>
Cc: [email protected]
|
|
Change the BUGs in xhci_find_new_dequeue_state() to WARN_ONs, to avoid
bringing down the box if one of them is hit
This patch should be queued for stable kernels back to 2.6.31.
Signed-off-by: Paul Zimmerman <[email protected]>
Signed-off-by: Sarah Sharp <[email protected]>
Cc: [email protected]
|
|
Allow drivers to enable Zoomed Video support. Currently, this is only
used by out-of-tree drivers (L64020 DVB driver in particular).
CC: <[email protected]> [for 2.6.37]
Signed-off-by: Dominik Brodowski <[email protected]>
|
|
Commit 2c442719e90a44a6982c033d69df4aae4b167cfa added some checks for proper
heartbeat mode when the o2cb stack is running. Unfortunately, it didn't
take into account that a userpsace stack could be running. Fix this by only
doing the check if o2cb is in use. This patch allows userspace stacks to
mount the fs again.
Cc: [email protected]
Signed-off-by: Mark Fasheh <[email protected]>
Signed-off-by: Joel Becker <[email protected]>
|
|
right number.
Current refcounttree codes actually didn't writeback the new pages out in
write-back mode, due to a bug of always passing a ZERO number of clusters
to 'ocfs2_cow_sync_writeback', the patch tries to pass a proper one in.
Signed-off-by: Tristan Ye <[email protected]>
Cc: [email protected]
Signed-off-by: Joel Becker <[email protected]>
|
|
In the rare case that INLINE_DATA, INDEX_DIR, QUOTA, XATTR features are
disabled and both the allocation of the directory inode and the allocation
of the first directory block need to relink allocation group, there need
not be enough credits reserved in a transaction. Fix the estimate.
CC: Mark Fasheh <[email protected]>
Signed-off-by: Jan Kara <[email protected]>
Signed-off-by: Joel Becker <[email protected]>
|
|
When creating a new dentry we now hold a reference to the parent
inode in the ceph_dentry. This is required due to the new RCU
changes from 949854d0, which set dentry->d_parent to NULL in d_kill before
calling the ->release() callback. If/when that behavior is changed, we can
revert this hack.
Signed-off-by: Yehuda Sadeh <[email protected]>
Signed-off-by: Sage Weil <[email protected]>
|
|
commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809 re-worked the
handling of unknown parameters. sctp_init_cause_fixed() can now
return -ENOSPC if there is not enough tailroom in the error
chunk skb. When this happens, the error header is not appended to
the error chunk. In that case, the payload of the unknown parameter
should not be appended either.
Signed-off-by: Jiri Bohac <[email protected]>
Acked-by: Vlad Yasevich <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
The dcb_app protocol field is a __u32 however the 802.1Qaz
specification defines it as a 16 bit field. This patch brings
the structure inline with the spec making it a __u16.
CC: Shmulik Ravid <[email protected]>
Signed-off-by: John Fastabend <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Eric W. Biederman reported a lockdep splat in inet_twsk_deschedule()
This is caused by inet_twsk_purge(), run from process context,
and commit 575f4cd5a5b6394577 (net: Use rcu lookups in inet_twsk_purge.)
removed the BH disabling that was necessary.
Add the BH disabling but fine grained, right before calling
inet_twsk_deschedule(), instead of whole function.
With help from Linus Torvalds and Eric W. Biederman
Reported-by: Eric W. Biederman <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
CC: Daniel Lezcano <[email protected]>
CC: Pavel Emelyanov <[email protected]>
CC: Arnaldo Carvalho de Melo <[email protected]>
CC: stable <[email protected]> (# 2.6.33+)
Signed-off-by: David S. Miller <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6
|
|
Without this patch, one line-out and one speaker and
Conexant's auto parser would announce (non-working) surround
capabilities.
BugLink: http://bugs.launchpad.net/bugs/721126
Cc: [email protected]
Signed-off-by: David Henningsson <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
|
|
Conexant 20641 has several inputs to its ADC node, with one selector
and individual amps for all inputs. This patch adds support in the
Conexant auto parser to handle that case.
It also means that the pin node's volume is being renamed to "Boost"
to avoid name clash with the new volume controls on the ADC node.
BugLink: http://bugs.launchpad.net/bugs/719524
Signed-off-by: David Henningsson <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
|
|
If ID_MMFR0[3:0] >= 3, the architecture version is ARMv7. The code was
currently only testing for ID_MMFR0[3:0] == 3.
Signed-off-by: Catalin Marinas <[email protected]>
Signed-off-by: Russell King <[email protected]>
|
|
Signed-off-by: Nicolas Pitre <[email protected]>
Signed-off-by: Russell King <[email protected]>
|
|
broadcasted operation
On versions of the Cortex-A9 prior to r3p0, an interrupted ICIALLUIS
operation may prevent the completion of a following broadcasted
operation if the second operation is received by a CPU before the
ICIALLUIS has completed, potentially leading to corrupted entries in
the cache or TLB.
This workaround sets a bit in the diagnostic register of the Cortex-A9,
causing CP15 maintenance operations to be uninterruptible.
Acked-by: Catalin Marinas <[email protected]>
Signed-off-by: Will Deacon <[email protected]>
Signed-off-by: Russell King <[email protected]>
|
|
Now that we can execute a CONFIG_SMP kernel on a uniprocessor system,
extra care has to be taken in the PMU IRQ affinity setting code to
ensure that we don't always fail to initialise.
This patch changes the CPU PMU initialisation code so that when we
only have a single IRQ, whose affinity can not be changed at the
controller, we report success (0) rather than -EINVAL.
Reported-by: Avik Sil <[email protected]>
Acked-by: Jamie Iles <[email protected]>
Signed-off-by: Will Deacon <[email protected]>
Signed-off-by: Russell King <[email protected]>
|
|
The effect of cache sync operation is to drain the store buffer and
wait for all internal buffers to be empty. In normal conditions, store
buffer is able to merge the normal memory writes within its 32-byte
data buffers. Due to this erratum present in r3p0, the effect of cache
sync operation on the store buffer still remains when the operation
completes. This means that the store buffer is always asked to drain
and this prevents it from merging any further writes.
This can severely affect performance on the write traffic esp. on
Normal memory NC one.
The proposed workaround is to replace the normal offset of cache sync
operation(0x730) by another offset targeting an unmapped PL310
register 0x740.
Signed-off-by: srinidhi kasagar <[email protected]>
Acked-by: Linus Walleij <[email protected]>
Acked-by: Catalin Marinas <[email protected]>
Signed-off-by: Russell King <[email protected]>
|
|
Signed-off-by: Alan Cox <[email protected]>
Signed-off-by: Dominik Brodowski <[email protected]>
|
|
After 2.6.34 changes, __pxa2xx_drv_pcmcia_probe() was replaced by
sa1111_pcmcia_add(). That unfortunately means that configure_sockets()
is not called, leading to MECR not being set properly, leading to
strange crashes.
Tested on pxa255+sa1111, I do not have lubbock board nearby. Perhaps
cleaner solution exists?
Signed-off-by: Pavel Machek <[email protected]>
Signed-off-by: Dominik Brodowski <[email protected]>
|
|
release_region/release_mem_region
Request_region should be used with release_region, not release_resource.
This patch contains a number of changes, related to calls to request_region,
request_mem_region, and the associated error handling code.
1. For the call to request_region, the variable io_resource storing the
result is dropped. The call to release_resource at the end of the function
is changed to a call to release_region with the first two arguments of
request_region as its arguments. The same call to release_region is also
added to release_ipwireless.
2. The first call to request_mem_region is now tested and ret is set to
-EBUSY if the the call has failed. This call was associated with the
initialization of ipw->attr_memory. But the error handling code was
testing ipw->common_memory. The definition of release_ipwireless also
suggests that this call should be associated with ipw->common_memory, not
ipw->attr_memory.
3. The second call to request_mem_region is now tested and ret is
set to -EBUSY if the the call has failed.
4. The various gotos to the error handling code is adjusted so that there
is no need for ifs.
5. Return the value stored in the ret variable rather than -1.
The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@@
expression x,E;
@@
(
*x = request_region(...)
|
*x = request_mem_region(...)
)
... when != release_region(x)
when != x = E
* release_resource(x);
// </smpl>
Signed-off-by: Julia Lawall <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Signed-off-by: Dominik Brodowski <[email protected]>
|
|
With CONFIG_SHIRQ_DEBUG=y we call a newly installed interrupt handler
in request_threaded_irq().
The original implementation (commit a304e1b8) called the handler
_BEFORE_ it was installed, but that caused problems with handlers
calling disable_irq_nosync(). See commit 377bf1e4.
It's braindead in the first place to call disable_irq_nosync in shared
handlers, but ....
Moving this call after we installed the handler looks innocent, but it
is very subtle broken on SMP.
Interrupt handlers rely on the fact, that the irq core prevents
reentrancy.
Now this debug call violates that promise because we run the handler
w/o the IRQ_INPROGRESS protection - which we cannot apply here because
that would result in a possibly forever masked interrupt line.
A concurrent real hardware interrupt on a different CPU results in
handler reentrancy and can lead to complete wreckage, which was
unfortunately observed in reality and took a fricking long time to
debug.
Leave the code here for now. We want this debug feature, but that's
not easy to fix. We really should get rid of those
disable_irq_nosync() abusers and remove that function completely.
Signed-off-by: Thomas Gleixner <[email protected]>
Cc: Anton Vorontsov <[email protected]>
Cc: David Woodhouse <[email protected]>
Cc: Arjan van de Ven <[email protected]>
Cc: [email protected] # .28 -> .37
|
|
Lars-Peter Clausen pointed out:
I stumbled upon this while looking through the existing archs using
SPARSE_IRQ. Even with SPARSE_IRQ the NR_IRQS is still the upper
limit for the number of IRQs.
Both PXA and MMP set NR_IRQS to IRQ_BOARD_START, with
IRQ_BOARD_START being the number of IRQs used by the core.
In various machine files the nr_irqs field of the ARM machine
defintion struct is then set to "IRQ_BOARD_START + NR_BOARD_IRQS".
As a result "nr_irqs" will greater then NR_IRQS which then again
causes the "allocated_irqs" bitmap in the core irq code to be
accessed beyond its size overwriting unrelated data.
The core code really misses a sanity check there.
This went unnoticed so far as by chance the compiler/linker places
data behind that bitmap which gets initialized later on those affected
platforms.
So the obvious fix would be to add a sanity check in early_irq_init()
and break all affected platforms. Though that check wants to be
backported to stable as well, which will require to fix all known
problematic platforms and probably some more yet not known ones as
well. Lots of churn.
A way simpler solution is to allocate a slightly larger bitmap and
avoid the whole churn w/o breaking anything. Add a few warnings when
an arch returns utter crap.
Reported-by: Lars-Peter Clausen <[email protected]>
Signed-off-by: Thomas Gleixner <[email protected]>
Cc: [email protected] # .37
Cc: Haojian Zhuang <[email protected]>
Cc: Eric Miao <[email protected]>
Cc: Peter Zijlstra <[email protected]>
|
|
Change my email address to my main account.
Signed-off-by: Daniel Walker <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
|
|
The interface is identical EMC6D102, so all that needs to be added are
some definitions and their uses.
Registers apparently missing in EMC6D103S/EMC6D103:A2 compared to EMC6D103:A0,
EMC6D103:A1, and EMC6D102 (according to the data sheets), but used
unconditionally in the driver: 62[5:7], 6D[0:7], and 6E[0:7]. For that
reason, EMC6D103S chips don't get enabled for the time being.
Signed-off-by: Jan Beulich <[email protected]>
(Guenter Roeck: Replaced EMC6D103_A2 with EMC6D103S per EMC6D103S datasheet)
Signed-off-by: Guenter Roeck <[email protected]>
Cc: [email protected]
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
* 'rtc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
RTC: Re-enable UIE timer/polling emulation
RTC: Revert UIE emulation removal
RTC: Release mutex in error path of rtc_alarm_irq_enable
|
|
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (37 commits)
net: deinit automatic LIST_HEAD
net: dont leave active on stack LIST_HEAD
net: provide default_advmss() methods to blackhole dst_ops
tg3: Restrict phy ioctl access
drivers/net: Call netif_carrier_off at the end of the probe
ixgbe: work around for DDP last buffer size
ixgbe: fix panic due to uninitialised pointer
e1000e: flush all writebacks before unload
e1000e: check down flag in tasks
isdn: hisax: Use l2headersize() instead of dup (and buggy) func.
arp_notify: unconditionally send gratuitous ARP for NETDEV_NOTIFY_PEERS.
cxgb4vf: Use defined Mailbox Timeout
cxgb4vf: Quiesce Virtual Interfaces on shutdown ...
cxgb4vf: Behave properly when CONFIG_DEBUG_FS isn't defined ...
cxgb4vf: Check driver parameters in the right place ...
pch_gbe: Fix the MAC Address load issue.
iwlwifi: Delete iwl3945_good_plcp_health.
net/can/softing: make CAN_SOFTING_CS depend on CAN_SOFTING
netfilter: nf_iterate: fix incorrect RCU usage
pch_gbe: Fix the issue that the receiving data is not normal.
...
|
|
Correct channel setting function must be used for AR2317.
When I tested ahb patch on bullet2 all seemed to work fine,
but it couldn't connect another host (using ibss for example).
During an analysis I observed that it's transmitting on another
channel. I looked into madwifi code and understood that
the problem is in channel setting function. So atheros RF2317 not
fully handled in the current ath5k version and must be patched.
Signed-off-by: Nikolay Ledovskikh <[email protected]>
Acked-by: Bob Copeland <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
|
|
taken two RT35XX EDIMAX from DPO_RT3562_3592_3062_LinuxSTA_V2.4.1.1_20101217
Signed-off-by: Xose Vazquez Perez <[email protected]>
Acked-by: Ivo van Doorn <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
|
|
Low level driver could pass rx frames to us after disassociate, what
can lead to run conn_mon_timer by ieee80211_sta_rx_notify(). That
is obviously wrong, but nothing happens until we unload modules and
resources are used after free. If kernel debugging is enabled following
warning could be observed:
WARNING: at lib/debugobjects.c:259 debug_print_object+0x65/0x70()
Hardware name: HP xw8600 Workstation
ODEBUG: free active (active state 0) object type: timer_list
Modules linked in: iwlagn(-) iwlcore mac80211 cfg80211 aes_x86_64 aes_generic fuse cpufreq_ondemand acpi_cpufreq freq_table mperf xt_physdev ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 ext3 jbd dm_mirror dm_region_hash dm_log dm_mod uinput hp_wmi sparse_keymap sg wmi arc4 microcode serio_raw ecb tg3 shpchp rfkill ext4 mbcache jbd2 sr_mod cdrom sd_mod crc_t10dif firewire_ohci firewire_core crc_itu_t mptsas mptscsih mptbase scsi_transport_sas ahci libahci pata_acpi ata_generic ata_piix floppy nouveau ttm drm_kms_helper drm i2c_algo_bit i2c_core video [last unloaded: cfg80211]
Pid: 13827, comm: rmmod Tainted: G W 2.6.38-rc4-wl+ #22
Call Trace:
[<ffffffff810649cf>] ? warn_slowpath_common+0x7f/0xc0
[<ffffffff81064ac6>] ? warn_slowpath_fmt+0x46/0x50
[<ffffffff81226fc5>] ? debug_print_object+0x65/0x70
[<ffffffff81227625>] ? debug_check_no_obj_freed+0x125/0x210
[<ffffffff8109ebd7>] ? debug_check_no_locks_freed+0xf7/0x170
[<ffffffff81156092>] ? kfree+0xc2/0x2f0
[<ffffffff813ec5c5>] ? netdev_release+0x45/0x60
[<ffffffff812f1067>] ? device_release+0x27/0xa0
[<ffffffff81216ddd>] ? kobject_release+0x8d/0x1a0
[<ffffffff81216d50>] ? kobject_release+0x0/0x1a0
[<ffffffff812183b7>] ? kref_put+0x37/0x70
[<ffffffff81216c57>] ? kobject_put+0x27/0x60
[<ffffffff813d5d1b>] ? netdev_run_todo+0x1ab/0x270
[<ffffffff813e771e>] ? rtnl_unlock+0xe/0x10
[<ffffffffa0581188>] ? ieee80211_unregister_hw+0x58/0x120 [mac80211]
[<ffffffffa0377ed7>] ? iwl_pci_remove+0xdb/0x22a [iwlagn]
[<ffffffff8123cde2>] ? pci_device_remove+0x52/0x120
[<ffffffff812f5205>] ? __device_release_driver+0x75/0xe0
[<ffffffff812f5348>] ? driver_detach+0xd8/0xe0
[<ffffffff812f4111>] ? bus_remove_driver+0x91/0x100
[<ffffffff812f5b62>] ? driver_unregister+0x62/0xa0
[<ffffffff8123d194>] ? pci_unregister_driver+0x44/0xa0
[<ffffffffa0377df5>] ? iwl_exit+0x15/0x1c [iwlagn]
[<ffffffff810ab492>] ? sys_delete_module+0x1a2/0x270
[<ffffffff81498889>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[<ffffffff8100bf42>] ? system_call_fastpath+0x16/0x1b
Acked-by: Johannes Berg <[email protected]>
Signed-off-by: Stanislaw Gruszka <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6
|
|
* 'for-linus/bugfixes' of git://xenbits.xen.org/people/ianc/linux-2.6:
xen: suspend and resume system devices when running PVHVM
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
* 'fixes-2.6.38' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
workqueue: make sure MAYDAY_INITIAL_TIMEOUT is at least 2 jiffies long
workqueue, freezer: unify spelling of 'freeze' + 'able' to 'freezable'
workqueue: wake up a worker when a rescuer is leaving a gcwq
|
|
commit 9b5e383c11b08784 (net: Introduce
unregister_netdevice_many()) left an active LIST_HEAD() in
rollback_registered(), with possible memory corruption.
Even if device is freed without touching its unreg_list (and therefore
touching the previous memory location holding LISTE_HEAD(single), better
close the bug for good, since its really subtle.
(Same fix for default_device_exit_batch() for completeness)
Reported-by: Michal Hocko <[email protected]>
Tested-by: Michal Hocko <[email protected]>
Reported-by: Eric W. Biderman <[email protected]>
Tested-by: Eric W. Biderman <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
CC: Ingo Molnar <[email protected]>
CC: Octavian Purdila <[email protected]>
CC: stable <[email protected]> [.33+]
Signed-off-by: David S. Miller <[email protected]>
|
|
Eric W. Biderman and Michal Hocko reported various memory corruptions
that we suspected to be related to a LIST head located on stack, that
was manipulated after thread left function frame (and eventually exited,
so its stack was freed and reused).
Eric Dumazet suggested the problem was probably coming from commit
443457242beb (net: factorize
sync-rcu call in unregister_netdevice_many)
This patch fixes __dev_close() and dev_close() to properly deinit their
respective LIST_HEAD(single) before exiting.
References: https://lkml.org/lkml/2011/2/16/304
References: https://lkml.org/lkml/2011/2/14/223
Reported-by: Michal Hocko <[email protected]>
Tested-by: Michal Hocko <[email protected]>
Reported-by: Eric W. Biderman <[email protected]>
Tested-by: Eric W. Biderman <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
CC: Ingo Molnar <[email protected]>
CC: Octavian Purdila <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Commit 0dbaee3b37e118a (net: Abstract default ADVMSS behind an
accessor.) introduced a possible crash in tcp_connect_init(), when
dst->default_advmss() is called from dst_metric_advmss()
Reported-by: George Spelvin <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|