aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2012-05-08KVM: PPC: Book3S HV: Fix refcounting of hugepagesDavid Gibson2-11/+13
The H_REGISTER_VPA hcall implementation in HV Power KVM needs to pin some guest memory pages into host memory so that they can be safely accessed from usermode. It does this used get_user_pages_fast(). When the VPA is unregistered, or the VCPUs are cleaned up, these pages are released using put_page(). However, the get_user_pages() is invoked on the specific memory are of the VPA which could lie within hugepages. In case the pinned page is huge, we explicitly find the head page of the compound page before calling put_page() on it. At least with the latest kernel, this is not correct. put_page() already handles finding the correct head page of a compound, and also deals with various counts on the individual tail page which are important for transparent huge pages. We don't support transparent hugepages on Power, but even so, bypassing this count maintenance can lead (when the VM ends) to a hugepage being released back to the pool with a non-zero mapcount on one of the tail pages. This can then lead to a bad_page() when the page is released from the hugepage pool. This removes the explicit compound_head() call to correct this bug. Signed-off-by: David Gibson <[email protected]> Signed-off-by: Paul Mackerras <[email protected]> Acked-by: Alexander Graf <[email protected]> Signed-off-by: Avi Kivity <[email protected]>
2012-05-08Revert "ALSA: hda - Set codec to D3 forcibly even if not used"Takashi Iwai2-5/+13
This reverts commit 785f857d1cb0856b612b46a0545b74aa2596e44a. The commit causes a problem with the wrong D3 state after suspend because the call of hda_set_power_state() involves with the power-up sequence, which changes the power_count, and this confuses the resume sequence that checks the power_count as well. Originally, this go-to-D3 sequence should be a simple task without the power-up sequence. But, it'd need some proper sanity checks in the case of power-saved state, so it's not too easy to write now in the 3.4-rc cycle. In short, the safest option now is to revert this affecting commit. Of course, we need to clean up and robustify the power-saving code better for 3.5 kernel. Reported-by: Konstantin Khlebnikov <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2012-05-08ALSA: hda/realtek - Call alc_auto_parse_customize_define() always after fixupTakashi Iwai1-6/+7
The call for alc_auto_parse_customize_define() must be done after the fixup pre-probe initialization. Otherwise SKU_IGNORE fixup won't work properly (e.g. HP RP5800 with ALC662 codec). Signed-off-by: Takashi Iwai <[email protected]>
2012-05-08ALSA: hdsp - Provide ioctl_compatAndre Schramm1-0/+1
snd_hdsp uses its own ioctls to acquire config- and status information. Expose the corresponding ioctl handler via ioctl_compat, so that 32bit applications can use it on 64bit kernels. Signed-off-by: Andre Schramm <[email protected]> Reviewed-by: Adrian Knoth <[email protected]> Signed-off-by: Adrian Knoth <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2012-05-08m68knommu: enable qspi support when SPI_COLDFIRE_QSPI = mSteven King7-21/+21
Enable Coldfire QSPI support when SPI_COLDFIRE_QSPI is built as a module. This version of the patch combines changes to the config files and device.c and uses IF_ENABLED (thanks to Sam Ravnborg for the suggestion). Signed-off-by: Steven King <[email protected]> Signed-off-by: Greg Ungerer <[email protected]>
2012-05-07openvswitch: Validation of IPv6 set port action uses IPv4 headerPravin B Shelar1-7/+15
When the kernel validates set TCP/UDP port actions, it looks at the ports in the existing flow to make sure that the L4 header exists. However, these actions always use the IPv4 version of the struct. Following patch fixes this by checking for flow ip protocol first. Signed-off-by: Pravin B Shelar <[email protected]> Signed-off-by: Jesse Gross <[email protected]>
2012-05-07net: compare_ether_addr[_64bits]() has no orderingJohannes Berg1-5/+6
Neither compare_ether_addr() nor compare_ether_addr_64bits() (as it can fall back to the former) have comparison semantics like memcmp() where the sign of the return value indicates sort order. We had a bug in the wireless code due to a blind memcmp replacement because of this. A cursory look suggests that the wireless bug was the only one due to this semantic difference. Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-05-07xen/Kconfig: fix Kconfig layoutAndrew Morton1-10/+12
Fit it into 80 columns so that it is readable in menuconfig. Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2012-05-07xen/pci: don't use PCI BIOS service for configuration space accessesDavid Vrabel1-2/+5
The accessing PCI configuration space with the PCI BIOS32 service does not work in PV guests. On systems without MMCONFIG or where the BIOS hasn't marked the MMCONFIG region as reserved in the e820 map, the BIOS service is probed (even though direct access is preferred) and this hangs. CC: [email protected] Acked-by: Jan Beulich <[email protected]> Signed-off-by: David Vrabel <[email protected]> [v1: Fixed compile error when CONFIG_PCI is not set] Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2012-05-07xen/pte: Fix crashes when trying to see non-existent PGD/PMD/PUD/PTEsKonrad Rzeszutek Wilk1-1/+6
If I try to do "cat /sys/kernel/debug/kernel_page_tables" I end up with: BUG: unable to handle kernel paging request at ffffc7fffffff000 IP: [<ffffffff8106aa51>] ptdump_show+0x221/0x480 PGD 0 Oops: 0000 [#1] SMP CPU 0 .. snip.. RAX: 0000000000000000 RBX: ffffc00000000fff RCX: 0000000000000000 RDX: 0000800000000000 RSI: 0000000000000000 RDI: ffffc7fffffff000 which is due to the fact we are trying to access a PFN that is not accessible to us. The reason (at least in this case) was that PGD[256] is set to __HYPERVISOR_VIRT_START which was setup (by the hypervisor) to point to a read-only linear map of the MFN->PFN array. During our parsing we would get the MFN (a valid one), try to look it up in the MFN->PFN tree and find it invalid and return ~0 as PFN. Then pte_mfn_to_pfn would happilly feed that in, attach the flags and return it back to the caller. 'ptdump_show' bitshifts it and gets and invalid value that it tries to dereference. Instead of doing all of that, we detect the ~0 case and just return !_PAGE_PRESENT. This bug has been in existence .. at least until 2.6.37 (yikes!) CC: [email protected] Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2012-05-07xen/apic: Return the APIC ID (and version) for CPU 0.Konrad Rzeszutek Wilk1-1/+34
On x86_64 on AMD machines where the first APIC_ID is not zero, we get: ACPI: LAPIC (acpi_id[0x01] lapic_id[0x10] enabled) BIOS bug: APIC version is 0 for CPU 1/0x10, fixing up to 0x10 BIOS bug: APIC version mismatch, boot CPU: 0, CPU 1: version 10 which means that when the ACPI processor driver loads and tries to parse the _Pxx states it fails to do as, as it ends up calling acpi_get_cpuid which does this: for_each_possible_cpu(i) { if (cpu_physical_id(i) == apic_id) return i; } And the bootup CPU, has not been found so it fails and returns -1 for the first CPU - which then subsequently in the loop that "acpi_processor_get_info" does results in returning an error, which means that "acpi_processor_add" failing and per_cpu(processor) is never set (and is NULL). That means that when xen-acpi-processor tries to load (much much later on) and parse the P-states it gets -ENODEV from acpi_processor_register_performance() (which tries to read the per_cpu(processor)) and fails to parse the data. Reported-by-and-Tested-by: Stefan Bader <[email protected]> Suggested-by: Boris Ostrovsky <[email protected]> [v2: Bit-shift APIC ID by 24 bits] Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2012-05-07regulator: Actually free the regulator in devm_regulator_put()Mark Brown1-1/+4
It turns out that (quite surprisingly) devres_destroy() only undoes the devres mapping, it doesn't destroy the underlying resource, meaning that anything using devm_regulator_put() would leak. While we wait for the new devres_release() which does what we want to get merged open code it in devm_regulator_put(). Signed-off-by: Mark Brown <[email protected]> Acked-by: Liam Girdwood <[email protected]>
2012-05-07drivers/video/xen-fbfront.c: add missing cleanup codeJulia Lawall1-11/+16
The operations in the subsequent error-handling code appear to be also useful here. Acked-by: Florian Tobias Schandinat <[email protected]> Signed-off-by: Julia Lawall <[email protected]> [v1: Collapse some of the error handling functions] [v2: Fix compile warning] Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2012-05-07drm/nouveau/i2c: resume use of i2c-algo-bit, rather than custom stackBen Skeggs2-178/+22
Previous issues with i2c-algo-bit have now been resolved. This is a revert of f553b79c03f0dbd52f6f03abe8233a2bef8cbd0d mostly, due to fixes in the i2c core repairing the original issue, this code isn't required and was causing regressions. Signed-off-by: Ben Skeggs <[email protected]> Reported-by: Nick Bowler <[email protected]> Tested-by: Nick Bowler <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2012-05-07Merge branch 'drm-intel-fixes' of ↵Dave Airlie2-3/+12
git://people.freedesktop.org/~danvet/drm-intel into drm-fixes Daniel wrote: 2 little patches: - One regression fix to disable sdvo hotplug on broken hw. - One patch to upconvert the snb hang workaround from patch v1 to patch v2. * 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel: drm/i915: Do no set Stencil Cache eviction LRA w/a on gen7+ drm/i915: disable sdvo hotplug on i945g/gm
2012-05-07ALSA: hda/realtek - Add missing CD-input pin for MSI-7350 moboTakashi Iwai1-0/+1
Reported-by: Philipp Matthias Hahn <[email protected]> Cc: <[email protected]> [v3.3+] Signed-off-by: Takashi Iwai <[email protected]>
2012-05-07drm/i915: Do no set Stencil Cache eviction LRA w/a on gen7+Daniel Vetter1-3/+6
I've flagged this while reviewing the first version and Ken Graunke fixed it up in v2, but unfortunately Dave Airlie picked up the wrong version. Cc: Dave Airlie <[email protected]> Cc: Kenneth Graunke <[email protected]> Cc: [email protected] Signed-Off-by: Daniel Vetter <[email protected]>
2012-05-07drm/i915: disable sdvo hotplug on i945g/gmDaniel Vetter1-0/+6
Chris Wilson dug out a hw erratum saying that there's noise on the interrupt line on i945G chips. We also have a bug report from a i945GM chip with an sdvo hotplug interrupt storm (and no apparent cause). Play it safe and disable sdvo hotplug on all i945 variants. Note that this is a regression that has been introduced in 3.1, when we've enabled sdvo hotplug support with commit cc68c81aed7d892deaf12d720d5455208e94cd0a Author: Simon Farnsworth <[email protected]> Date: Wed Sep 21 17:13:30 2011 +0100 drm/i915: Enable SDVO hotplug interrupts for HDMI and DVI Cc: [email protected] Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=38442 Reported-and-tested-by: Dominik Köppl <[email protected]> Reviewed-by: Chris Wilson <[email protected]> Signed-Off-by: Daniel Vetter <[email protected]>
2012-05-07ALSA: hda/realtek - Add a fixup for Acer Aspire 5739GTakashi Iwai1-0/+2
Acer Aspire 5739G requires the same fix-up for 4930G to support the surround / bass speakers. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=43180 Signed-off-by: Takashi Iwai <[email protected]>
2012-05-06IA32 emulation: Fix build problem for modular ia32 a.out supportLarry Finger1-0/+1
Commit ce7e5d2d19bc ("x86: fix broken TASK_SIZE for ia32_aout") breaks kernel builds when "CONFIG_IA32_AOUT=m" with ERROR: "set_personality_ia32" [arch/x86/ia32/ia32_aout.ko] undefined! make[1]: *** [__modpost] Error 1 The entry point needs to be exported. Signed-off-by: Larry Finger <[email protected]> Acked-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-05-06Linux 3.4-rc6Linus Torvalds1-1/+1
2012-05-06Merge branch 'x86-urgent-for-linus' of ↵Linus Torvalds5-5/+21
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes form Peter Anvin * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: intel_mid_powerbtn: mark irq as IRQF_NO_SUSPEND arch/x86/platform/geode/net5501.c: change active_low to 0 for LED driver x86, relocs: Remove an unused variable asm-generic: Use __BITS_PER_LONG in statfs.h x86/amd: Re-enable CPU topology extensions in case BIOS has disabled it
2012-05-06Merge branch 'for-linus' of ↵Linus Torvalds8-21/+47
git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs Pull btrfs fixes from Chris Mason: "The big ones here are a memory leak we introduced in rc1, and a scheduling while atomic if the transid on disk doesn't match the transid we expected. This happens for corrupt blocks, or out of date disks. It also fixes up the ioctl definition for our ioctl to resolve logical inode numbers. The __u32 was a merging error and doesn't match what we ship in the progs." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: Btrfs: avoid sleeping in verify_parent_transid while atomic Btrfs: fix crash in scrub repair code when device is missing btrfs: Fix mismatching struct members in ioctl.h Btrfs: fix page leak when allocing extent buffers Btrfs: Add properly locking around add_root_to_dirty_list
2012-05-06x86: fix broken TASK_SIZE for ia32_aoutAl Viro1-2/+1
Setting TIF_IA32 in load_aout_binary() used to be enough; these days TASK_SIZE is controlled by TIF_ADDR32 and that one doesn't get set there. Switch to use of set_personality_ia32()... Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-05-06cdc_ether: Ignore bogus union descriptor for RNDIS devicesBjørn Mork1-2/+12
Some RNDIS devices include a bogus CDC Union descriptor pointing to non-existing interfaces. The RNDIS code is already prepared to handle devices without a CDC Union descriptor by hardwiring the driver to use interfaces 0 and 1, which is correct for the devices with the bogus descriptor as well. So we can reuse the existing workaround. Cc: Markus Kolb <[email protected]> Cc: Iker Salmón San Millán <[email protected]> Cc: Jonathan Nieder <[email protected]> Cc: Oliver Neukum <[email protected]> Cc: [email protected] Cc: [email protected] Signed-off-by: Bjørn Mork <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-05-06bnx2x: bug fix when loading after SAN bootAriel Elior1-1/+22
This is a bug fix for an "interface fails to load" issue. The issue occurs when bnx2x driver loads after UNDI driver was previously loaded over the chip. In such a scenario the UNDI driver is loaded and operates in the pre-boot kernel, within its own specific host memory address range. When the pre-boot stage is complete, the real kernel is loaded, in a new and distinct host memory address range. The transition from pre-boot stage to boot is asynchronous from UNDI point of view. A race condition occurs when UNDI driver triggers a DMAE transaction to valid host addresses in the pre-boot stage, when control is diverted to the real kernel. This results in access to illegal addresses by our HW as the addresses which were valid in the preboot stage are no longer considered valid. Specifically, the 'was_error' bit in the pci glue of our device is set. This causes all following pci transactions from chip to host to timeout (in accordance to the pci spec). Signed-off-by: Ariel Elior <[email protected]> Signed-off-by: Eilon Greenstein <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-05-06KVM: Do not take reference to mm during async #PFGleb Natapov1-8/+1
It turned to be totally unneeded. The reason the code was introduced is so that KVM can prefault swapped in page, but prefault can fail even if mm is pinned since page table can change anyway. KVM handles this situation correctly though and does not inject spurious page faults. Fixes: "INFO: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected" warning while running LTP inside a KVM guest using the recent -next kernel. Reported-by: Sasha Levin <[email protected]> Signed-off-by: Gleb Natapov <[email protected]> Signed-off-by: Avi Kivity <[email protected]>
2012-05-06KVM: ensure async PF event wakes up vcpu from haltGleb Natapov1-0/+1
If vcpu executes hlt instruction while async PF is waiting to be delivered vcpu can block and deliver async PF only after another even wakes it up. This happens because kvm_check_async_pf_completion() will remove completion event from vcpu->async_pf.done before entering kvm_vcpu_block() and this will make kvm_arch_vcpu_runnable() return false. The solution is to make vcpu runnable when processing completion. Signed-off-by: Gleb Natapov <[email protected]> Signed-off-by: Avi Kivity <[email protected]>
2012-05-06Btrfs: avoid sleeping in verify_parent_transid while atomicChris Mason5-17/+34
verify_parent_transid needs to lock the extent range to make sure no IO is underway, and so it can safely clear the uptodate bits if our checks fail. But, a few callers are using it with spinlocks held. Most of the time, the generation numbers are going to match, and we don't want to switch to a blocking lock just for the error case. This adds an atomic flag to verify_parent_transid, and changes it to return EAGAIN if it needs to block to properly verifiy things. Signed-off-by: Chris Mason <[email protected]>
2012-05-06ALSA: echoaudio: Remove incorrect part of assertionMark Hills1-1/+1
This assertion seems to imply that chip->dsp_code_to_load is a pointer. It's actually an integer handle on the actual firmware, and 0 has no special meaning. The assertion prevents initialisation of a Darla20 card, but would also affect other models. It seems it was introduced in commit dd7b254d. ALSA sound/pci/echoaudio/echoaudio.c:2061 Echoaudio driver starting... ALSA sound/pci/echoaudio/echoaudio.c:1969 chip=ebe4e000 ALSA sound/pci/echoaudio/echoaudio.c:2007 pci=ed568000 irq=19 subdev=0010 Init hardware... ALSA sound/pci/echoaudio/darla20_dsp.c:36 init_hw() - Darla20 ------------[ cut here ]------------ WARNING: at sound/pci/echoaudio/echoaudio_dsp.c:478 init_hw+0x1d1/0x86c [snd_darla20]() Hardware name: Dell DM051 BUG? (!chip->dsp_code_to_load || !chip->comm_page) Signed-off-by: Mark Hills <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2012-05-06ARM: 7414/1: SMP: prevent use of the console when using idmap_pgdColin Cross1-2/+2
Commit 4e8ee7de227e3ab9a72040b448ad728c5428a042 (ARM: SMP: use idmap_pgd for mapping MMU enable during secondary booting) switched secondary boot to use idmap_pgd, which is initialized during early_initcall, instead of a page table initialized during __cpu_up. This causes idmap_pgd to contain the static mappings but be missing all dynamic mappings. If a console is registered that creates a dynamic mapping, the printk in secondary_start_kernel will trigger a data abort on the missing mapping before the exception handlers have been initialized, leading to a hang. Initial boot is not affected because no consoles have been registered, and resume is usually not affected because the offending console is suspended. Onlining a cpu with hotplug triggers the problem. A workaround is to the printk in secondary_start_kernel until after the page tables have been switched back to init_mm. Cc: <[email protected]> Signed-off-by: Colin Cross <[email protected]> Signed-off-by: Russell King <[email protected]>
2012-05-05Merge branch 'for-linus' of ↵Linus Torvalds4-8/+5
git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha Pull alpha fixes from Matt Turner: "My alpha tree is back up (after taking quite some time to get my GPG key signed). It contains just some simple fixes." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha: alpha: silence 'const' warning in sys_marvel.c alpha: include module.h to fix modpost on Tsunami alpha: properly define get/set_rtc_time on Marvel/SMP alpha: VGA_HOSE depends on VGA_CONSOLE
2012-05-05TTY: pdc_cons, fix regression in closeJiri Slaby1-1/+1
The test in pdc_console_tty_close '!tty->count' was always wrong because tty->count is decremented after tty->ops->close is called and thus can never be zero. Hence the 'then' branch was never executed and the timer never deleted. This did not matter until commit 5dd5bc40f3b6 ("TTY: pdc_cons, use tty_port"). There we needed to set TTY in tty_port to NULL, but this never happened due to the bug above. So change the test to really trigger at the last close by changing the condition to 'tty->count == 1'. Well, the driver should not touch tty->count at all. It should use tty_port->count and count open count there itself. Signed-off-by: Jiri Slaby <[email protected]> Reported-and-tested-by: Mikulas Patocka <[email protected]> Cc: Kyle McMartin <[email protected]> Cc: Helge Deller <[email protected]> Cc: "James E.J. Bottomley" <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-05-05Merge tag 'sound-3.4' of ↵Linus Torvalds8-17/+29
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound sound fixes from Takashi Iwai: "As good as nothing exciting here; just a few trivial fixes for various ASoC stuff." * tag 'sound-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: omap-pcm: Free dma buffers in case of error. ASoC: s3c2412-i2s: Fix dai registration ASoC: wm8350: Don't use locally allocated codec struct ASoC: tlv312aic23: unbreak resume ASoC: bf5xx-ssm2602: Set DAI format ASoC: core: check of_property_count_strings failure ASoC: dt: sgtl5000.txt: Add description for 'reg' field ASoC: wm_hubs: Make sure we don't disable differential line outputs
2012-05-05Merge branch 'release' of ↵Linus Torvalds4-16/+14
git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull an ACPI patch from Len Brown: "It fixes a D3 issue new in 3.4-rc1." By Lin Ming via Len Brown: * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: ACPI: Fix D3hot v D3cold confusion
2012-05-05init: don't try mounting device as nfs root unless type fully matchesSasha Levin1-1/+1
Currently, we'll try mounting any device who's major device number is UNNAMED_MAJOR as NFS root. This would happen for non-NFS devices as well (such as 9p devices) but it wouldn't cause any issues since mounting the device as NFS would fail quickly and the code proceeded to doing the proper mount: [ 101.522716] VFS: Unable to mount root fs via NFS, trying floppy. [ 101.534499] VFS: Mounted root (9p filesystem) on device 0:18. Commit 6829a048102a ("NFS: Retry mounting NFSROOT") introduced retries when mounting NFS root, which means that now we don't immediately fail and instead it takes an additional 90+ seconds until we stop retrying, which has revealed the issue this patch fixes. This meant that it would take an additional 90 seconds to boot when we're not using a device type which gets detected in order before NFS. This patch modifies the NFS type check to require device type to be 'Root_NFS' instead of requiring the device to have an UNNAMED_MAJOR major. This makes boot process cleaner since we now won't go through the NFS mounting code at all when the device isn't an NFS root ("/dev/nfs"). Signed-off-by: Sasha Levin <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-05-05ARM: 7412/1: audit: use only AUDIT_ARCH_ARM regardless of endiannessWill Deacon1-7/+1
The machine endianness has no direct correspondence to the syscall ABI, so use only AUDIT_ARCH_ARM when identifying the ABI to the audit tools in userspace. Cc: [email protected] Signed-off-by: Will Deacon <[email protected]> Signed-off-by: Russell King <[email protected]>
2012-05-05ARM: 7411/1: audit: fix treatment of saved ip register during syscall tracingWill Deacon1-8/+8
The ARM audit code incorrectly uses the saved application ip register value to infer syscall entry or exit. Additionally, the saved value will be clobbered if the current task is not being traced, which can lead to libc corruption if ip is live (apparently glibc uses it for the TLS pointer). This patch fixes the syscall tracing code so that the why parameter is used to infer the syscall direction and the saved ip is only updated if we know that we will be signalling a ptrace trap. Reported-and-Tested-by: Jon Masters <[email protected]> Cc: [email protected] Cc: Eric Paris <[email protected]> Signed-off-by: Will Deacon <[email protected]> Signed-off-by: Russell King <[email protected]>
2012-05-05ARM: 7410/1: Add extra clobber registers for assembly in kernel_execveTim Bird1-1/+1
The inline assembly in kernel_execve() uses r8 and r9. Since this code sequence does not return, it usually doesn't matter if the register clobber list is accurate. However, I saw a case where a particular version of gcc used r8 as an intermediate for the value eventually passed to r9. Because r8 is used in the inline assembly, and not mentioned in the clobber list, r9 was set to an incorrect value. This resulted in a kernel panic on execution of the first user-space program in the system. r9 is used in ret_to_user as the thread_info pointer, and if it's wrong, bad things happen. Cc: <[email protected]> Signed-off-by: Tim Bird <[email protected]> Signed-off-by: Russell King <[email protected]>
2012-05-05Merge branch 'fix/asoc' into for-linusTakashi Iwai1-0/+4
2012-05-05Merge branch 'for-3.4' of ↵Takashi Iwai1-0/+4
git://git.kernel.org/pub/scm/linux/kernel/git/lrg/asoc into fix/asoc
2012-05-05Merge tag 'asoc-3.4' of ↵Takashi Iwai7-17/+25
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for 3.4 Nothing terribly exciting here, a bunch of small and simple fixes scattered around the place.
2012-05-05ACPI: Fix D3hot v D3cold confusionLin Ming4-16/+14
Before this patch, ACPI_STATE_D3 incorrectly referenced D3hot in some places, but D3cold in other places. After this patch, ACPI_STATE_D3 always means ACPI_STATE_D3_COLD; and all references to D3hot use ACPI_STATE_D3_HOT. ACPI's _PR3 method is used to enter both D3hot and D3cold states. What distinguishes D3hot from D3cold is the presence _PR3 (Power Resources for D3hot) If these resources are all ON, then the state is D3hot. If _PR3 is not present, or all _PR0 resources for the devices are OFF, then the state is D3cold. This patch applies after Linux-3.4-rc1. A future syntax cleanup may remove ACPI_STATE_D3 to emphasize that it always means ACPI_STATE_D3_COLD. Signed-off-by: Lin Ming <[email protected]> Acked-by: Rafael J. Wysocki <[email protected]> Reviewed-by: Aaron Lu <[email protected]> Signed-off-by: Len Brown <[email protected]>
2012-05-04hfsplus: Fix potential buffer overflowsGreg Kroah-Hartman2-0/+15
Commit ec81aecb2966 ("hfs: fix a potential buffer overflow") fixed a few potential buffer overflows in the hfs filesystem. But as Timo Warns pointed out, these changes also need to be made on the hfsplus filesystem as well. Reported-by: Timo Warns <[email protected]> Acked-by: WANG Cong <[email protected]> Cc: Alexey Khoroshilov <[email protected]> Cc: Miklos Szeredi <[email protected]> Cc: Sage Weil <[email protected]> Cc: Eugene Teo <[email protected]> Cc: Roman Zippel <[email protected]> Cc: Al Viro <[email protected]> Cc: Christoph Hellwig <[email protected]> Cc: Alexey Dobriyan <[email protected]> Cc: Dave Anderson <[email protected]> Cc: stable <[email protected]> Cc: Andrew Morton <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-05-04Merge branch 'timers-urgent-for-linus' of ↵Linus Torvalds1-2/+1
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner. * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rtc: Fix possible null pointer dereference in rtc-mpc5121.c
2012-05-04Merge git://git.samba.org/sfrench/cifs-2.6Linus Torvalds5-25/+23
Pull CIFS fixes from Steve French. * git://git.samba.org/sfrench/cifs-2.6: fs/cifs: fix parsing of dfs referrals cifs: make sure we ignore the credentials= and cred= options [CIFS] Update cifs version to 1.78 cifs - check S_AUTOMOUNT in revalidate cifs: add missing initialization of server->req_lock cifs: don't cap ra_pages at the same level as default_backing_dev_info CIFS: Fix indentation in cifs_show_options
2012-05-04CPU frequency drivers MAINTAINERS updateDave Jones1-3/+0
Remove myself as cpufreq maintainer. x86 driver changes can go through the regular x86/ACPI trees. ARM driver changes through the ARM trees. cpufreq core changes are rare these days, and can just go to lkml/direct. Signed-off-by: Dave Jones <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-05-04seqlock: add 'raw_seqcount_begin()' functionLinus Torvalds1-0/+21
The normal read_seqcount_begin() function will wait for any current writers to exit their critical region by looping until the sequence count is even. That "wait for sequence count to stabilize" is the right thing to do if the read-locker will just retry the whole operation on contention: no point in doing a potentially expensive reader sequence if we know at the beginning that we'll just end up re-doing it all. HOWEVER. Some users don't actually retry the operation, but instead will abort and do the operation with proper locking. So the sequence count case may be the optimistic quick case, but in the presense of writers you may want to do full locking in order to guarantee forward progress. The prime example of this would be the RCU name lookup. And in that case, you may well be better off without the "retry early", and are in a rush to instead get to the failure handling. Thus this "raw" interface that just returns the sequence number without testing it - it just forces the low bit to zero so that read_seqcount_retry() will always fail such a "active concurrent writer" scenario. Signed-off-by: Linus Torvalds <[email protected]>
2012-05-04Fix __read_seqcount_begin() to use ACCESS_ONCE for sequence value readLinus Torvalds1-1/+1
We really need to use a ACCESS_ONCE() on the sequence value read in __read_seqcount_begin(), because otherwise the compiler might end up reloading the value in between the test and the return of it. As a result, it might end up returning an odd value (which means that a write is in progress). If the reader is then fast enough that that odd value is still the current one when the read_seqcount_retry() is done, we might end up with a "successful" read sequence, even despite the concurrent write being active. In practice this probably never really happens - there just isn't anything else going on around the read of the sequence count, and the common case is that we end up having a read barrier immediately afterwards. So the code sequence in which gcc might decide to reaload from memory is small, and there's no reason to believe it would ever actually do the reload. But if the compiler ever were to decide to do so, it would be incredibly annoying to debug. Let's just make sure. Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]>
2012-05-04intel_mid_powerbtn: mark irq as IRQF_NO_SUSPENDYong Wang1-1/+1
So that the power button still wakes up the platform. Signed-off-by: Pierre Tardy <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Tested-by: Kangkai Yin <[email protected]> Tested-by: Yong Wang <[email protected]> Signed-off-by: Kirill A. Shutemov <[email protected]> Signed-off-by: Alan Cox <[email protected]> Cc: Matthew Garrett <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: H. Peter Anvin <[email protected]>