aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-02-07usbip/userspace/libsrc/names.c: memory leakHeinrich Schuchardt1-4/+4
revised patch p is freed if NULL. p is leaked if second calloc fails. Signed-off-by: Heinrich Schuchardt <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07gpu: ion: dereferencing an ERR_PTRDan Carpenter1-1/+1
We dereference "heap->task" before checking if it's an ERR_PTR. Fixes: ea313b5f88ed ('gpu: ion: Also shrink memory cached in the deferred free list') Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: comedi: usbduxsigma: fix unaligned dereferencesIan Abbott1-2/+4
There are a couple of dereferences such as `*(uint32_t *)(devpriv->insn_buf + 1)` that are unaligned as `devpriv->insn_buf` is of type `uint8_t *`. This works on x86 architecture but may not be supported on other architectures. Call `get_unalign()` to perform the unaligned dereferences. Signed-off-by: Ian Abbott <[email protected]> Cc: Bernd Porr <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: comedi: fix too early cleanup in comedi_auto_config()Ian Abbott1-2/+0
`comedi_auto_config()` is usually called from the probe routine of a low-level comedi driver to allocate and auto-configure a comedi device. Part of this involves calling the low-level driver's `auto_attach()` handler, and if that is successful, `comedi_device_postconfig()` tries to complete the configuration of the comedi device. If either of those fail, `comedi_device_detach()` is called to clean up, and `comedi_release_hardware_device()` is called to remove the dynamically allocated comedi device. Unfortunately, `comedi_device_detach()` clears the `hw_dev` member of the `struct comedi_device` (indirectly via `comedi_clear_hw_dev()`), and that stops `comedi_release_hardware_device()` finding the comedi device associated with the hardware device, so the comedi device won't be removed properly. Since `comedi_release_hardware_device()` also calls `comedi_device_detach()` (assuming it finds the comedi device associated with the hardware device), the fix is to remove the direct call to `comedi_device_detach()` from `comedi_auto_config()` and let the call to `comedi_release_hardware_device()` take care of it. Signed-off-by: Ian Abbott <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: android: ion: dummy: fix an error codeDan Carpenter1-1/+1
We should be returning -ENOMEM here instead of zero. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07blk-mq: initialize sg_reserved_sizeChristoph Hellwig1-0/+2
To behave the same way as the old request path. Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07blk-mq: handle dma_drain_sizeChristoph Hellwig1-0/+10
Make blk-mq handle the dma_drain_size field the same way as the old request path. Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07blk-mq: divert __blk_put_request for MQ opsChristoph Hellwig1-0/+5
__blk_put_request needs to call into the blk-mq code just like blk_put_request. As we don't have the queue lock in this case both end up calling the same function. Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07blk-mq: support at_head inserations for blk_execute_rqChristoph Hellwig3-9/+13
This is neede for proper SG_IO operation as well as various uses of blk_execute_rq from the SCSI midlayer. Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07libceph: take map_sem for read in handle_reply()Ilya Dryomov1-6/+11
Handling redirect replies requires both map_sem and request_mutex. Taking map_sem unconditionally near the top of handle_reply() avoids possible race conditions that arise from releasing request_mutex to be able to acquire map_sem in redirect reply case. (Lock ordering is: map_sem, request_mutex, crush_mutex.) Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Sage Weil <[email protected]>
2014-02-07libceph: factor out logic from ceph_osdc_start_request()Ilya Dryomov1-23/+39
Factor out logic from ceph_osdc_start_request() into a new helper, __ceph_osdc_start_request(). ceph_osdc_start_request() now amounts to taking locks and calling __ceph_osdc_start_request(). Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Sage Weil <[email protected]>
2014-02-07Merge branch 'master' of ↵John W. Linville30-159/+256
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2014-02-07xen-blkfront: handle backend CLOSED without CLOSINGDavid Vrabel1-1/+4
Backend drivers shouldn't transistion to CLOSED unless the frontend is CLOSED. If a backend does transition to CLOSED too soon then the frontend may not see the CLOSING state and will not properly shutdown. So, treat an unexpected backend CLOSED state the same as CLOSING. Signed-off-by: David Vrabel <[email protected]> Acked-by: Konrad Rzeszutek Wilk <[email protected]> Cc: [email protected] Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2014-02-07xen-blkif: drop struct blkif_request_segment_alignedRoger Pau Monne4-25/+19
This was wrongly introduced in commit 402b27f9, the only difference between blkif_request_segment_aligned and blkif_request_segment is that the former has a named padding, while both share the same memory layout. Also correct a few minor glitches in the description, including for it to no longer assume PAGE_SIZE == 4096. Signed-off-by: Roger Pau Monné <[email protected]> [Description fix by Jan Beulich] Signed-off-by: Jan Beulich <[email protected]> Reported-by: Jan Beulich <[email protected]> Cc: Konrad Rzeszutek Wilk <[email protected]> Cc: David Vrabel <[email protected]> Cc: Boris Ostrovsky <[email protected]> Tested-by: Matt Rushton <[email protected]> Cc: Matt Wilson <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2014-02-07xen-blkback: fix shutdown raceRoger Pau Monne3-10/+24
Introduce a new variable to keep track of the number of in-flight requests. We need to make sure that when xen_blkif_put is called the request has already been freed and we can safely free xen_blkif, which was not the case before. Signed-off-by: Roger Pau Monné <[email protected]> Cc: Konrad Rzeszutek Wilk <[email protected]> Cc: David Vrabel <[email protected]> Reviewed-by: Boris Ostrovsky <[email protected]> Tested-by: Matt Rushton <[email protected]> Reviewed-by: Matt Rushton <[email protected]> Cc: Matt Wilson <[email protected]> Cc: Ian Campbell <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2014-02-07xen-blkback: fix memory leaksRoger Pau Monne3-9/+31
I've at least identified two possible memory leaks in blkback, both related to the shutdown path of a VBD: - blkback doesn't wait for any pending purge work to finish before cleaning the list of free_pages. The purge work will call put_free_pages and thus we might end up with pages being added to the free_pages list after we have emptied it. Fix this by making sure there's no pending purge work before exiting xen_blkif_schedule, and moving the free_page cleanup code to xen_blkif_free. - blkback doesn't wait for pending requests to end before cleaning persistent grants and the list of free_pages. Again this can add pages to the free_pages list or persistent grants to the persistent_gnts red-black tree. Fixed by moving the persistent grants and free_pages cleanup code to xen_blkif_free. Also, add some checks in xen_blkif_free to make sure we are cleaning everything. Signed-off-by: Roger Pau Monné <[email protected]> Cc: Konrad Rzeszutek Wilk <[email protected]> Reviewed-by: David Vrabel <[email protected]> Cc: Boris Ostrovsky <[email protected]> Tested-by: Matt Rushton <[email protected]> Reviewed-by: Matt Rushton <[email protected]> Cc: Matt Wilson <[email protected]> Cc: Ian Campbell <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2014-02-07xen-blkback: fix memory leak when persistent grants are usedMatt Rushton1-3/+3
Currently shrink_free_pagepool() is called before the pages used for persistent grants are released via free_persistent_gnts(). This results in a memory leak when a VBD that uses persistent grants is torn down. Cc: Konrad Rzeszutek Wilk <[email protected]> Cc: "Roger Pau Monné" <[email protected]> Cc: Ian Campbell <[email protected]> Reviewed-by: David Vrabel <[email protected]> Cc: [email protected] Cc: [email protected] Cc: Anthony Liguori <[email protected]> Signed-off-by: Matt Rushton <[email protected]> Signed-off-by: Matt Wilson <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2014-02-07staging: lustre: fix quotactl permission denied (LU-4530)Cédric Dufour - Idiap Research Institute1-1/+1
The changes introduced in commit 4b1a25f06b30b203 ("fix build when CONFIG_UIDGID_STRICT_TYPE_CHECKS is on") got the UID check the wrong way around, leading to "Permission denied" when a regular user attempts to retrieve his quota (lfs quota -u ...) but allowing him to retrieve other users quota. Full details at: https://jira.hpdd.intel.com/browse/LU-4530 Cc: Peng Tao <[email protected]> Cc: <[email protected]> # 3.12.x Cc: <[email protected]> # 3.13.x Signed-off-by: Cédric Dufour <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: android: sync: Signal pt before sync_timeline object gets destroyedPrakash Kamliya1-4/+4
There is a race condition Assume we have *one* sync_fence object, with *one* sync_pt which belongs to *one* sync_timeline, given this condition, sync_timeline->kref will have two counts, one for sync_timeline (implicit) and another for sync_pt. Assume following is the situation on CPU Theead-1 : (Thread which calls sync_timeline_destroy()) -> (some function calls) -> sync_timeline_destory() -> sync_timeline_signal() (CPU is inside this function after putting reference to sync_timeline) At this time Thread-2 comes and does following Thread-2 : (fclose on fence fd) > sync_fence_release() -> because of fclose() on fence object -> sync_fence_free() -> sync_pt_free() -> kref_put(&pt->parent->kref, sync_timeline_free); -> sync_timeline_free() (CPU is inside this because this time kref will be zero after _put) Thread-2 will free sync_timeline object before Thread-1 has finished its work inside sync_timeline_signal. With this change we signals all sync_pt before putting reference to sync_timeline object. Cc: Colin Cross <[email protected]> Cc: Android Kernel Team <[email protected]> Signed-off-by: Prakash Kamliya <[email protected]> [jstultz: minor commit subject tweak] Signed-off-by: John Stultz <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: comedi: adv_pci1710: fix analog output readback valueH Hartley Sweeten1-5/+12
The last value written to a analog output channel is cached in the private data of this driver for readback. Currently, the wrong value is cached in the (*insn_write) functions. The current code stores the data[n] value for readback afer the loop has written all the values. At this time 'n' points past the end of the data array. Fix the functions by using a local variable to hold the data being written to the analog output channel. This variable is then used after the loop is complete to store the readback value. The current value is retrieved before the loop in case no values are actually written.. Signed-off-by: H Hartley Sweeten <[email protected]> Reviewed-by: Ian Abbott <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: r8188eu: memory corruption handling long ssidsDan Carpenter1-14/+8
We should cap the SSID length at NDIS_802_11_LENGTH_SSID (32) characters to avoid memory corruption. If the SSID is too long then I have opted to ignore it instead of truncating it. We don't need to clear bssid->Ssid.Ssid[0] because this struct is allocated with rtw_zmalloc() Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Larry Finger <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: gdm72xx: fix leaks at failure path in gdm_usb_probe()Alexey Khoroshilov1-0/+3
Error handling code in gdm_usb_probe() misses to deallocate tx_ and rx_structs and to do usb_put_dev(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07arm64: defconfig: Expand default enabled featuresMark Rutland2-4/+15
FPGA implementations of the Cortex-A57 and Cortex-A53 are now available in the form of the SMM-A57 and SMM-A53 Soft Macrocell Models (SMMs) for Versatile Express. As these attach to a Motherboard Express V2M-P1 it would be useful to have support for some V2M-P1 peripherals enabled by default. Additionally a couple of of features have been introduced since the last defconfig update (CMA, jump labels) that would be good to have enabled by default to ensure they are build and boot tested. This patch updates the arm64 defconfig to enable support for these devices and features. The arm64 Kconfig is modified to select HAVE_PATA_PLATFORM, which is required to enable support for the CompactFlash controller on the V2M-P1. A few options which don't need to appear in defconfig are trimmed: * BLK_DEV - selected by default * EXPERIMENTAL - otherwise gone from the kernel * MII - selected by drivers which require it * USB_SUPPORT - selected by default Signed-off-by: Mark Rutland <[email protected]> Signed-off-by: Catalin Marinas <[email protected]>
2014-02-07Revert "Staging: dgrp: Refactor the function dgrp_receive() in drrp_net_ops.c"Greg Kroah-Hartman1-175/+155
This reverts commit b73db54750482cf3910046c82a84ce8c1684dfbe. Reported-by: Geert Uytterhoeven <[email protected]> Reported-by: Chen Gang <[email protected]> Cc: Rashika Kheria <[email protected]> Cc: James Hogan <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07Staging: ozwpan: Fix null dereferenceSalym Senyonga1-1/+2
If net_dev is NULL memcpy() will Oops. Signed-off-by: Salym Senyonga <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging/usbip: Fix vhci_hcd attach failure error message to be informativeShuah Khan1-1/+2
When attach fails due to unsupported and/or invalid bus speed, the message vhci_hcd prints out doesn't include any useful information as to what caused the failure. Change the message to be informative and use usb_speed_string() to get the right speed string from usb common. Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: rtl8821ae: Fixed the size of array to macro as discussed by LinusSurendra Patil1-1/+1
Linus Torvalds writes: It causes an interesting warning for me: drivers/staging/rtl8821ae/rtl8821ae/dm.c: In function ‘rtl8821ae_dm_clear_txpower_tracking_state’: drivers/staging/rtl8821ae/rtl8821ae/dm.c:487:31: warning: iteration 2u invokes undefined behavior [-Waggressive-loop-optimizations] rtldm->bb_swing_idx_ofdm[p] = rtldm->default_ofdm_index; ^ drivers/staging/rtl8821ae/rtl8821ae/dm.c:485:2: note: containing loop for (p = RF90_PATH_A; p < MAX_RF_PATH; ++p) { ^ and gcc is entirely correct: that loop iterates from 0 to 3, and does this: rtldm->bb_swing_idx_ofdm[p] = rtldm->default_ofdm_index; but the bb_swing_idx_ofdm[] array only has two members. So the last two iterations will overwrite bb_swing_idx_ofdm_current and the first entry in bb_swing_idx_ofdm_base[]. Now, the bug does seem to be benign: bb_swing_idx_ofdm_current isn't actually ever *used* as far as I can tell, and the first entry of bb_swing_idx_ofdm_base[] will have been written with that same "rtldm->default_ofdm_index" value. But gcc is absolutely correct, and that driver needs fixing. I've pulled it and will let it be because it doesn't seem to be an issue in practice, but please fix it. The obvious fix would seem to change the size of "2" to be "MAX_RF_PATH", but I'll abstain from doing those kinds of changes in the merge when it doesn't seem to affect the build or functionality). Reported-By: Linus Torvalds <[email protected]> Signed-off-by: Surendra Patil <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: octeon-usb: Probe via device tree populated platform device.David Daney1-157/+116
Extract clocking parameters from the device tree, and remove now dead code and types. Signed-off-by: David Daney <[email protected]> Tested-by: Aaro Koskinen <[email protected]> Signed-off-by: Aaro Koskinen <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07lustre: add myself to list of people to CC on lustre patchesOleg Drokin1-2/+3
Signed-off-by: Oleg Drokin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07lustre: Correct KUC code max changelog msg sizeOleg Drokin2-3/+5
The kernel to userspace communication routines (KUC) allocate and limit the maximum cs_buf size to CR_MAXSIZE. However this fails to account for the fact that the buffer is assumed to begin with a struct kuc_hdr. To allocate and account for that space, we introduce a new define, KUC_CHANGELOG_MSG_MAXSIZE. Signed-off-by: Christopher J. Morrone <[email protected]> Reviewed-on: http://review.whamcloud.com/7406 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3587 Reviewed-by: Andreas Dilger <[email protected]> Reviewed-by: jacques-Charles Lafoucriere <[email protected]> Reviewed-by: Oleg Drokin <[email protected]> Signed-off-by: Oleg Drokin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07lustre: Account for changelog_ext_rec in CR_MAXSIZEOleg Drokin1-1/+2
CR_MAXSIZE needs to account for an llog_changelog_rec that actually contains a changelog_ext_rec structure rather than a changelog_rec. With out doing so, a file size approaching the Linux kernel NAME_MAX length that is renamed to a size also close to, or at, NAME_MAX will exceed CR_MAXSIZE and trip an assertion. Signed-off-by: Christopher J. Morrone <[email protected]> Reviewed-on: http://review.whamcloud.com/6993 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3587 Reviewed-by: Niu Yawei <[email protected]> Reviewed-by: Lai Siyao <[email protected]> Reviewed-by: Oleg Drokin <[email protected]> Signed-off-by: Oleg Drokin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging/lustre/lnet: Fix use after free in ksocknal_sendOleg Drokin1-2/+3
Call to ksocknal_launch_packet might schedule a callback that might free the just sent message, and so subsequent access to it via lntmsg->msg_vmflush goes to freed memory. Instead we'll just remember if we are in the vmflush thread and only restore if we happened to set mempressure flag. Signed-off-by: Oleg Drokin <[email protected]> Reviewed-on: http://review.whamcloud.com/8667 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4360 Reviewed-by: Liang Zhen <[email protected]> Reviewed-by: Amir Shehata <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07retrieving CIFS ACLs when mounted with SMB2 fails dropping sessionSteve French4-8/+43
The get/set ACL xattr support for CIFS ACLs attempts to send old cifs dialect protocol requests even when mounted with SMB2 or later dialects. Sending cifs requests on an smb2 session causes problems - the server drops the session due to the illegal request. This patch makes CIFS ACL operations protocol specific to fix that. Attempting to query/set CIFS ACLs for SMB2 will now return EOPNOTSUPP (until we add worker routines for sending query ACL requests via SMB2) instead of sending invalid (cifs) requests. A separate followon patch will be needed to fix cifs_acl_to_fattr (which takes a cifs specific u16 fid so can't be abstracted to work with SMB2 until that is changed) and will be needed to fix mount problems when "cifsacl" is specified on mount with e.g. vers=2.1 Signed-off-by: Steve French <[email protected]> Reviewed-by: Shirish Pargaonkar <[email protected]> CC: Stable <[email protected]>
2014-02-07Add protocol specific operation for CIFS xattrsSteve French2-4/+13
Changeset 666753c3ef8fc88b0ddd5be4865d0aa66428ac35 added protocol operations for get/setxattr to avoid calling cifs operations on smb2/smb3 mounts for xattr operations and this changeset adds the calls to cifs specific protocol operations for xattrs (in order to reenable cifs support for xattrs which was temporarily disabled by the previous changeset. We do not have SMB2/SMB3 worker function for setting xattrs yet so this only enables it for cifs. CCing stable since without these two small changsets (its small coreq 666753c3ef8fc88b0ddd5be4865d0aa66428ac35 is also needed) calling getfattr/setfattr on smb2/smb3 mounts causes problems. Signed-off-by: Steve French <[email protected]> Reviewed-by: Shirish Pargaonkar <[email protected]> CC: Stable <[email protected]>
2014-02-07staging/lustre: fix compile warning with is_vmalloc_addrOleg Drokin1-1/+1
Recent commit 175f5475fb9c5800319da4e3c4204413d7280f5c introduced this compile warning (because vaddr is unsigned long), so add a cast: drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c: In function ‘kiblnd_kvaddr_to_page’: drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c:532:2: warning: passing argument 1 of ‘is_vmalloc_addr’ makes pointer from integer without a cast [enabled by default] if (is_vmalloc_addr(vaddr)) { ^ In file included from drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.h:43:0, from drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c:41: include/linux/mm.h:336:59: note: expected ‘const void *’ but argument is of type ‘long unsigned int’ static inline int is_vmalloc_addr(const void *x) Signed-off-by: Oleg Drokin <[email protected]> CC: Laura Abbott <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: lustre: fix GFP_ATOMIC macro usageMarek Szyprowski1-1/+1
GFP_ATOMIC is not a single gfp flag, but a macro which expands to the other flags and LACK of __GFP_WAIT flag. To check if caller wanted to perform an atomic allocation, the code must test __GFP_WAIT flag presence. Signed-off-by: Marek Szyprowski <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: ion: Fix build warningJohn Stultz1-0/+1
Add #include <linux/device.h> to fix the following warning seen with gcc 4.7.3: In file included from drivers/staging/android/ion/ion_heap.c:26:0: drivers/staging/android/ion/ion_priv.h:358:21: warning: ‘struct device’ declared inside parameter list [enabled by default] drivers/staging/android/ion/ion_priv.h:358:21: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default] Cc: Colin Cross <[email protected]> Cc: Android Kernel Team <[email protected]> Signed-off-by: John Stultz <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: ion: Fix ION_IOC_FREE compat ioctlLaura Abbott1-4/+22
The compat ioctl for ION_IOC_FREE currently passes allocation data instead of the free data. Correct this. Cc: Colin Cross <[email protected]> Cc: Android Kernel Team <[email protected]> Signed-off-by: Laura Abbott <[email protected]> [jstultz: Folded in a small build fix] Signed-off-by: John Stultz <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: ion: Fix overflow and list bugs in system heapColin Cross1-1/+5
Fix a few bugs in ion_system_heap: Initialize the list node in the info block. Don't store size_remaining in a signed long, allocating >2GB could overflow, resulting in a call to sg_alloc_table with nents=0 which panics. alloc_largest_available will never return a block larger than size_remanining, so it can never go negative. Limit a single allocation to half of all memory. Prevents a large allocation from taking down the whole system. Cc: Colin Cross <[email protected]> Cc: Android Kernel Team <[email protected]> Signed-off-by: Colin Cross <[email protected]> [jstultz: Minor commit subject tweak] Signed-off-by: John Stultz <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: ashmem: Avoid deadlock between read and mmap callsTodd Poynor1-19/+26
Avoid holding ashmem_mutex across code that can page fault. Page faults grab the mmap_sem for the process, which are also held by mmap calls prior to calling ashmem_mmap, which locks ashmem_mutex. The reversed order of locking between the two can deadlock. The calls that can page fault are read() and the ASHMEM_SET_NAME and ASHMEM_GET_NAME ioctls. Move the code that accesses userspace pages outside the ashmem_mutex. Cc: Colin Cross <[email protected]> Cc: Android Kernel Team <[email protected]> Signed-off-by: Todd Poynor <[email protected]> [jstultz: minor commit message tweaks] Signed-off-by: John Stultz <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: sync: Fix a race condition between release_obj and print_objAlistair Strachan1-3/+3
Before this change, a timeline would only be removed from the timeline list *after* the sync driver had its release_obj() called. However, the driver's release_obj() may free resources needed by print_obj(). Although the timeline list is locked when print_obj() is called, it is not locked when release_obj() is called. If one CPU was in print_obj() when another was in release_obj(), the print_obj() may make unsafe accesses. It is not actually necessary to hold the timeline list lock when calling release_obj() if the call is made after the timeline is unlinked from the list, since there is no possibility another thread could be in -- or enter -- print_obj() for that timeline. This change moves the release_obj() call to after the timeline is unlinked, preventing the above race from occurring. Cc: Colin Cross <[email protected]> Cc: Android Kernel Team <[email protected]> Signed-off-by: Alistair Strachan <[email protected]> [jstultz: minor commit subject tweak] Signed-off-by: John Stultz <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: sw_sync: Add stubs for kernels without CONFIG_SW_SYNCGreg Hackmann1-0/+17
Add stubs for kernels without CONFIG_SW_SYNC Cc: Colin Cross <[email protected]> Cc: Android Kernel Team <[email protected]> Signed-off-by: Greg Hackmann <[email protected]> [jstultz: resolved minor conflict, tweaked commit message] Signed-off-by: John Stultz <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: don't use module_init in non-modular ion_dummy_driver.cPaul Gortmaker1-4/+3
The ION_DUMMY option is bool, and hence this code is either present or absent. It will never be modular, so using module_init as an alias for __initcall is rather misleading. Fix this up now, so that we can relocate module_init from init.h into module.h in the future. If we don't do this, we'd have to add module.h to obviously non-modular code, and that would be a worse thing. Note that direct use of __initcall is discouraged, vs. one of the priority categorized subgroups. As __initcall gets mapped onto device_initcall, our use of device_initcall directly in this change means that the runtime impact is zero -- it will remain at level 6 in initcall ordering. Cc: Colin Cross <[email protected]> Cc: Jesse Barker <[email protected]> Cc: Android Kernel Team <[email protected]> Cc: John Stultz <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Signed-off-by: Paul Gortmaker <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07ion: dummy driver: use ARRAY_SIZE for nr of heapsTomas Winkler1-1/+1
use ARRAY_SIZE to count number of heaps in static array Signed-off-by: Tomas Winkler <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07drivers: staging: android: ion: ion_dummy_driver: include "linux/io.h"Chen Gang1-0/+1
Need add "linux/io.h" to pass compiling under metag architecture with allmodconfig (which use the default 'virt_to_phys'), the related error: CC drivers/staging/android/ion/ion_dummy_driver.o drivers/staging/android/ion/ion_dummy_driver.c: In function 'ion_dummy_init': drivers/staging/android/ion/ion_dummy_driver.c:81: error: implicit declaration of function 'virt_to_phys' Signed-off-by: Chen Gang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07Merge tag 'iio-fixes-for-3.14a' of ↵Greg Kroah-Hartman4-12/+23
git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: First set of IIO fixes for the 3.14 cycle. Included is the patch previously set as the fourth round for 3.13 which was to late to be appropriate. * Another endian fix (ad799x adc) due to missuse of the IIO_ST macro (which is going away very shortly) * A reversed error check in ad5933 which will make the probe fail. * A buffer overflow in the example code in the documentation. * ad799x was freeing an irq that might or might not have been requested. * tsl2563 was checking the wrong element of chan_spec for modifiers. Thus some sysfs reads would give the wrong values. * A missing dependency on HAS_IOMEM in spear_adc and lpc32xx was causing some test build failures (on s390 and perhaps elsewhere). I also have a few fixes queued up for things that went in during the 3.14 merge window which will follow as a separate pull request (to avoid rebasing my tree).
2014-02-07netfilter: nf_tables: unininline nft_trace_packet()Patrick McHardy1-3/+3
It makes no sense to inline a rarely used function meant for debugging only that is called a total of five times in the main evaluation loop. Signed-off-by: Patrick McHardy <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2014-02-07arm64: asm: remove redundant "cc" clobbersWill Deacon4-25/+21
cbnz/tbnz don't update the condition flags, so remove the "cc" clobbers from inline asm blocks that only use these instructions to implement conditional branches. Signed-off-by: Will Deacon <[email protected]> Signed-off-by: Catalin Marinas <[email protected]>
2014-02-07arm64: atomics: fix use of acquire + release for full barrier semanticsWill Deacon5-18/+35
Linux requires a number of atomic operations to provide full barrier semantics, that is no memory accesses after the operation can be observed before any accesses up to and including the operation in program order. On arm64, these operations have been incorrectly implemented as follows: // A, B, C are independent memory locations <Access [A]> // atomic_op (B) 1: ldaxr x0, [B] // Exclusive load with acquire <op(B)> stlxr w1, x0, [B] // Exclusive store with release cbnz w1, 1b <Access [C]> The assumption here being that two half barriers are equivalent to a full barrier, so the only permitted ordering would be A -> B -> C (where B is the atomic operation involving both a load and a store). Unfortunately, this is not the case by the letter of the architecture and, in fact, the accesses to A and C are permitted to pass their nearest half barrier resulting in orderings such as Bl -> A -> C -> Bs or Bl -> C -> A -> Bs (where Bl is the load-acquire on B and Bs is the store-release on B). This is a clear violation of the full barrier requirement. The simple way to fix this is to implement the same algorithm as ARMv7 using explicit barriers: <Access [A]> // atomic_op (B) dmb ish // Full barrier 1: ldxr x0, [B] // Exclusive load <op(B)> stxr w1, x0, [B] // Exclusive store cbnz w1, 1b dmb ish // Full barrier <Access [C]> but this has the undesirable effect of introducing *two* full barrier instructions. A better approach is actually the following, non-intuitive sequence: <Access [A]> // atomic_op (B) 1: ldxr x0, [B] // Exclusive load <op(B)> stlxr w1, x0, [B] // Exclusive store with release cbnz w1, 1b dmb ish // Full barrier <Access [C]> The simple observations here are: - The dmb ensures that no subsequent accesses (e.g. the access to C) can enter or pass the atomic sequence. - The dmb also ensures that no prior accesses (e.g. the access to A) can pass the atomic sequence. - Therefore, no prior access can pass a subsequent access, or vice-versa (i.e. A is strictly ordered before C). - The stlxr ensures that no prior access can pass the store component of the atomic operation. The only tricky part remaining is the ordering between the ldxr and the access to A, since the absence of the first dmb means that we're now permitting re-ordering between the ldxr and any prior accesses. From an (arbitrary) observer's point of view, there are two scenarios: 1. We have observed the ldxr. This means that if we perform a store to [B], the ldxr will still return older data. If we can observe the ldxr, then we can potentially observe the permitted re-ordering with the access to A, which is clearly an issue when compared to the dmb variant of the code. Thankfully, the exclusive monitor will save us here since it will be cleared as a result of the store and the ldxr will retry. Notice that any use of a later memory observation to imply observation of the ldxr will also imply observation of the access to A, since the stlxr/dmb ensure strict ordering. 2. We have not observed the ldxr. This means we can perform a store and influence the later ldxr. However, that doesn't actually tell us anything about the access to [A], so we've not lost anything here either when compared to the dmb variant. This patch implements this solution for our barriered atomic operations, ensuring that we satisfy the full barrier requirements where they are needed. Cc: <[email protected]> Cc: Peter Zijlstra <[email protected]> Signed-off-by: Will Deacon <[email protected]> Signed-off-by: Catalin Marinas <[email protected]>
2014-02-07tty: Set correct tty name in 'active' sysfs attributeHannes Reinecke2-8/+20
The 'active' sysfs attribute should refer to the currently active tty devices the console is running on, not the currently active console. The console structure doesn't refer to any device in sysfs, only the tty the console is running on has. So we need to print out the tty names in 'active', not the console names. This resolves an issue on s390 platforms in determining the correct console device to use. Cc: Lennart Poettering <[email protected]> Cc: Kay Sievers <[email protected]> Cc: Jiri Slaby <[email protected]> Cc: David Herrmann <[email protected]> Signed-off-by: Werner Fink <[email protected]> Signed-off-by: Hannes Reinecke <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.