aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-12-02drm/radeon: program DCE2 audio dto just like DCE3Alex Deucher1-6/+2
Seems to work like the DCE3 version despite what the register spec says. bug: https://bugs.freedesktop.org/show_bug.cgi?id=71975 Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
2013-12-02drm/radeon: fix typo in fetching mpll paramsAlex Deucher1-1/+1
Copy-paste typo. Value should be 0-2, not 0-1. Noticed-by: Sylvain BERTRAND <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
2013-12-02Merge tag 'for-usb-linus-2013-12-02' of ↵Greg Kroah-Hartman2-2/+54
git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-linus Sarah writes: xhci: Regression fix for 3.13. Hi Greg, Here's one bug fix for 3.13. usb-net added support for bulk scatter-gather in 3.12, and it triggered a bug in the xHCI driver. This bug causes xHCI hosts to send an unexpected short transfer, which will cause the USB ethernet device to stop sending packets. The patch is marked for the 3.12 stable kernel. It's a long standing bug, but the usb-net drivers are the first to trigger it. The only other driver that does bulk scatter-gather (usb-storage) will not trigger this bug. I'm not sure what the effect of the no-op TRBs will be on various xHCI host controllers, so I would only like to be conservative and only queue it for 3.13 and 3.12 stable. Please queue this for 3.13. Sarah Sharp
2013-12-02Fix build failure for gp2ap020a00f.cRussell King - ARM Linux1-0/+1
drivers/built-in.o: In function `gp2ap020a00f_thresh_event_handler': powercap_sys.c:(.text+0x15f90c): undefined reference to `irq_work_queue' make[1]: *** [vmlinux] Error 1 make[1]: Target `uImage' not remade because of errors. make: *** [sub-make] Error 2 make: Target `uImage' not remade because of errors. You need the IRQ work support, but GP2AP020A00F is not selecting this symbol. Signed-off-by: Russell King <[email protected]> Signed-off-by: Jonathan Cameron <[email protected]>
2013-12-02iio: hid-sensors: Fix power and report stateSrinivas Pandruvada3-14/+27
In the original HID sensor hub firmwares all Named array enums were to 0-based. But the most recent hub implemented as 1-based, because of the implementation by one of the major OS vendor. Using logical minimum for the field as the base of enum. So we add logical minimum to the selector values before setting those fields. Some sensor hub FWs already changed logical minimum from 0 to 1 to reflect this and hope every other vendor will follow. There is no easy way to add a common HID quirk for NAry elements, even if the standard specifies these field as NAry, the collection used to describe selectors is still just "logical". Signed-off-by: Srinivas Pandruvada <[email protected]> Signed-off-by: Jonathan Cameron <[email protected]>
2013-12-02HID: hid-sensor-hub: Add logical min and maxSrinivas Pandruvada2-12/+10
Exporting logical minimum and maximum of HID fields as part of the hid sensor attribute info. This can be used for range checking and to calculate enumeration base for NAry fields of HID sensor hub. Signed-off-by: Srinivas Pandruvada <[email protected]> Signed-off-by: Jonathan Cameron <[email protected]>
2013-12-02PCI / tg3: Give up chip reset and carrier loss handling if PCI device is not ↵Rafael J. Wysocki3-7/+28
present Modify tg3_chip_reset() and tg3_close() to check if the PCI network adapter device is accessible at all in order to skip poking it or trying to handle a carrier loss in vain when that's not the case. Introduce a special PCI helper function pci_device_is_present() for this purpose. Of course, this uncovers the lack of the appropriate RTNL locking in tg3_suspend() and tg3_resume(), so add that locking in there too. These changes prevent tg3 from burning a CPU at 100% load level for solid several seconds after the Thunderbolt link is disconnected from a Matrox DS1 docking station. Signed-off-by: Rafael J. Wysocki <[email protected]> Acked-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-12-02ipv6: judge the accept_ra_defrtr before calling rt6_route_rcvDuan Jiong1-0/+3
when dealing with a RA message, if accept_ra_defrtr is false, the kernel will not add the default route, and then deal with the following route information options. Unfortunately, those options maybe contain default route, so let's judge the accept_ra_defrtr before calling rt6_route_rcv. Signed-off-by: Duan Jiong <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-12-02Merge branch 'leds-fixes-for-3.13' of ↵Linus Torvalds1-27/+26
git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds Pull LED subsystem bugfix from Bryan Wu. * 'leds-fixes-for-3.13' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds: leds: pwm: Fix for deferred probe in DT booted mode
2013-12-02usb: xhci: Link TRB must not occur within a USB payload burstDavid Laight2-2/+54
Section 4.11.7.1 of rev 1.0 of the xhci specification states that a link TRB can only occur at a boundary between underlying USB frames (512 bytes for high speed devices). If this isn't done the USB frames aren't formatted correctly and, for example, the USB3 ethernet ax88179_178a card will stop sending (while still receiving) when running a netperf tcp transmit test with (say) and 8k buffer. This should be a candidate for stable, the ax88179_178a driver defaults to gso and tso enabled so it passes a lot of fragmented skb to the USB stack. Notes from Sarah: Discussion: http://marc.info/?l=linux-usb&m=138384509604981&w=2 This patch fixes a long-standing xHCI driver bug that was revealed by a change in 3.12 in the usb-net driver. Commit 638c5115a794981441246fa8fa5d95c1875af5ba "USBNET: support DMA SG" added support to use bulk endpoint scatter-gather (urb->sg). Only the USB ethernet drivers trigger this bug, because the mass storage driver sends sg list entries in page-sized chunks. This patch only fixes the issue for bulk endpoint scatter-gather. The problem will still occur for periodic endpoints, because hosts will interpret no-op transfers as a request to skip a service interval, which is not what we want. Luckily, the USB core isn't set up for scatter-gather on isochronous endpoints, and no USB drivers use scatter-gather for interrupt endpoints. Document this known limitation so that developers won't try to use urb->sg for interrupt endpoints until this issue is fixed. The more comprehensive fix would be to allow link TRBs in the middle of the endpoint ring and revert this patch, but that fix would touch too much code to be allowed in for stable. This patch should be backported to kernels as old as 3.12, that contain the commit 638c5115a794981441246fa8fa5d95c1875af5ba "USBNET: support DMA SG". Without this patch, the USB network device gets wedged, and stops sending packets. Mark Lord confirms this patch fixes the regression: http://marc.info/?l=linux-netdev&m=138487107625966&w=2 Signed-off-by: David Laight <[email protected]> Signed-off-by: Sarah Sharp <[email protected]> Tested-by: Mark Lord <[email protected]> Cc: [email protected]
2013-12-02leds: pwm: Fix for deferred probe in DT booted modePeter Ujfalusi1-27/+26
We need to make sure that the error code from devm_of_pwm_get() is the one the module returns in case of failure. Restructure the code to make this possible for DT booted case. With this patch the driver can ask for deferred probing when the board is booted with DT. Fixes for example omap4-sdp board's keyboard backlight led. Signed-off-by: Peter Ujfalusi <[email protected]> Signed-off-by: Bryan Wu <[email protected]>
2013-12-02uio: we cannot mmap unaligned page contentsLinus Torvalds1-0/+2
In commit 7314e613d5ff ("Fix a few incorrectly checked [io_]remap_pfn_range() calls") the uio driver started more properly checking the passed-in user mapping arguments against the size of the actual uio driver data. That in turn exposed that some driver authors apparently didn't realize that mmap can only work on a page granularity, and had tried to use it with smaller mappings, with the new size check catching that out. So since it's not just the user mmap() arguments that can be confused, make the uio mmap code also verify that the uio driver has the memory allocated at page boundaries in order for mmap to work. If the device memory isn't properly aligned, we return [ENODEV] The fildes argument refers to a file whose type is not supported by mmap(). as per the open group documentation on mmap. Reported-by: Holger Brunck <[email protected]> Acked-by: Greg KH <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-12-02ARM: dts: Fix the name of supplies for smsc911x shared by OMAPFlorian Vaussard1-2/+2
drivers/net/ethernet/smsc/smsc911x.c is expecting supplies named "vdd33a" and "vddvario". Currently the shared DTS file provides "vmmc" and "vmmc_aux", and the supply lookup will fail: smsc911x 2c000000.ethernet: Looking up vdd33a-supply from device tree smsc911x 2c000000.ethernet: Looking up vdd33a-supply property in node /ocp/gpmc@6e000000/ethernet@gpmc failed smsc911x 2c000000.ethernet: Looking up vddvario-supply from device tree smsc911x 2c000000.ethernet: Looking up vddvario-supply property in node /ocp/gpmc@6e000000/ethernet@gpmc failed Fix it! Looks like commmit 6b2978ac40e4 (ARM: dts: Shared file for omap GPMC connected smsc911x) made the problem more visible by moving the smc911x configuration from the omap3-igep0020.dts file to the generic file. But it seems we've had this problem since commit d72b4415011e (ARM: dts: omap3-igep0020: Add SMSC911x LAN chip support). Tested on OMAP3 Overo platform. Signed-off-by: Florian Vaussard <[email protected]> [[email protected]: updated comments for the commits causing the problem] Signed-off-by: Tony Lindgren <[email protected]>
2013-12-02ARM: OMAP2+: Powerdomain: Fix unchecked dereference of arch_pwrdmRajendra Nayak1-1/+2
Commit 'cd8abed' "ARM: OMAP2+: Powerdomain: Remove the need to always have a voltdm associated to a pwrdm" leads to the following Smatch complaint: arch/arm/mach-omap2/powerdomain.c:131 _pwrdm_register() error: we previously assumed 'arch_pwrdm' could be null (see line 105) So, fix the unchecked dereference of arch_pwrdm. Reported-by: Dan Carpenter <[email protected]> Acked-by: Nishanth Menon <[email protected]> Signed-off-by: Rajendra Nayak <[email protected]> Signed-off-by: Tony Lindgren <[email protected]>
2013-12-02ARM: dts: omap3-beagle: Add omap-twl4030 audio supportJarkko Nikula1-0/+14
This adds typical McBSP2-TWL4030 audio description to the legacy Beagle Board. Signed-off-by: Jarkko Nikula <[email protected]> Signed-off-by: Tony Lindgren <[email protected]>
2013-12-02ARM: dts: omap4-sdp: Fix pin muxing for wl12xxBalaji T K1-6/+6
Mux mode for wlan/sdmmc5 should be MODE0 in pinmux_wl12xx_pins and Enable Pull up on sdmmc5_clk to detect SDIO card. This fixes WLAN on omap4-sdp that got broken in v3.10 when we moved omap4 to boot using device tree only as I did not have the WL12XX card in my omap4 SDP to test with. The commit that attempted to make WL12XX working on omap4 SDP was 775d2418f309 (ARM: dts: Fix muxing and regulator for wl12xx on the SDIO bus for blaze). Signed-off-by: Balaji T K <[email protected]> [[email protected]: updated comments for the regression] Signed-off-by: Tony Lindgren <[email protected]>
2013-12-02ARM: dts: omap4-panda-common: Fix pin muxing for wl12xxBalaji T K1-10/+10
pin mux wl12xx_gpio and wl12xx_pins should be part of omap4_pmx_core and not omap4_pmx_wkup. So, move wl12xx_* to omap4_pmx_core. Fix the following error message: pinctrl-single 4a31e040.pinmux: mux offset out of range: 0x38 (0x38) pinctrl-single 4a31e040.pinmux: could not add functions for pinmux_wl12xx_pins 56x SDIO card is not detected after moving pin mux to omap4_pmx_core since sdmmc5_clk pull is disabled. Enable Pull up on sdmmc5_clk to detect SDIO card. This fixes a regression where WLAN did not work after a warm reset or after one up/down cycle that happened when we move omap4 to boot using device tree only. For reference, the kernel bug is described at: https://bugzilla.kernel.org/show_bug.cgi?id=63821 Cc: [email protected] # v3.10+ Signed-off-by: Balaji T K <[email protected]> [[email protected]: update comments to describe the regression] Signed-off-by: Tony Lindgren <[email protected]>
2013-12-02[SCSI] enclosure: fix WARN_ON in dual path device removingJames Bottomley1-0/+7
Bug report from: [email protected] The issue is happened in dual controller configuration. We got the sysfs warnings when rmmod the ipr module. enclosure_unregister() in drivers/msic/enclosure.c, call device_unregister() for each componment deivce, device_unregister() ->device_del()->kobject_del() ->sysfs_remove_dir(). In sysfs_remove_dir(), set kobj->sd = NULL. For each componment device, enclosure_component_release()->enclosure_remove_links()->sysfs_remove_link() in which checking kobj->sd again, it has been set as NULL when doing device_unregister. So we saw all these sysfs WARNING. Tested-by: [email protected] Cc: [email protected] Signed-off-by: James Bottomley <[email protected]>
2013-12-02[SCSI] pm80xx: Tasklets synchronization fix.Nikith Ganigarakoppal2-41/+58
When multiple vectors are used, the vector variable is over written, resulting in unhandled operation for those vectors. This fix prevents the problem by maitaining HBA instance and vector values for each irq. [jejb: checkpatch fixes] Signed-off-by: [email protected] Signed-off-by: [email protected] Reviewed-by: Jack Wang <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2013-12-02[SCSI] pm80xx: Resetting the phy state.Nikith Ganigarakoppal4-0/+10
Setting the phy state for hard reset response. After sending hard reset for a device ,phy down event sets the phy state to zero but for phy up event it will not set the phy state again.This will cause problem to successive hard resets. Signed-off-by: [email protected] Signed-off-by: [email protected] Reviewed-by: Jack Wang <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2013-12-02[SCSI] pm80xx: Fix for direct attached device.Nikith Ganigarakoppal1-1/+3
In case of direct attached SATA device delay is not enough. It will give crash for set device state command response and wait_for_completion is the best solution for this. Signed-off-by: [email protected] Signed-off-by: [email protected] Reviewed-by: Jack Wang <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2013-12-02[SCSI] pm80xx: Module author additionNikith Ganigarakoppal1-0/+1
Signed-off-by: [email protected] Signed-off-by: [email protected] Reviewed-by: Jack Wang <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2013-12-02Merge branch 'for-john' of ↵John W. Linville2-0/+10
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
2013-12-02Merge branch 'irq-urgent-for-linus' of ↵Linus Torvalds3-6/+7
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: - Correction of fuzzy and fragile IRQ_RETVAL macro - IRQ related resume fix affecting only XEN - ARM/GIC fix for chained GIC controllers * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip: Gic: fix boot for chained gics irq: Enable all irqs unconditionally in irq_resume genirq: Correct fuzzy and fragile IRQ_RETVAL() definition
2013-12-02Merge branch 'sched-urgent-for-linus' of ↵Linus Torvalds4-11/+29
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "Various smaller fixlets, all over the place" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/doc: Fix generation of device-drivers sched: Expose preempt_schedule_irq() sched: Fix a trivial typo in comments sched: Remove unused variable in 'struct sched_domain' sched: Avoid NULL dereference on sd_busy sched: Check sched_domain before computing group power MAINTAINERS: Update file patterns in the lockdep and scheduler entries
2013-12-02Merge branch 'perf-urgent-for-linus' of ↵Linus Torvalds9-20/+76
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Misc kernel and tooling fixes" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tools lib traceevent: Fix conversion of pointer to integer of different size perf/trace: Properly use u64 to hold event_id perf: Remove fragile swevent hlist optimization ftrace, perf: Avoid infinite event generation loop tools lib traceevent: Fix use of multiple options in processing field perf header: Fix possible memory leaks in process_group_desc() perf header: Fix bogus group name perf tools: Tag thread comm as overriden
2013-12-02Merge tag 'stable/for-linus-3.13-rc2-tag' of ↵Linus Torvalds3-4/+12
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull Xen bug-fixes from Konrad Rzeszutek Wilk: "Fixes to patches that went in this merge window along with a latent bug: - Fix lazy flushing in case m2p override fails. - Fix module compile issues with ARM/Xen - Add missing call to DMA map page for Xen SWIOTLB for ARM" * tag 'stable/for-linus-3.13-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/gnttab: leave lazy MMU mode in the case of a m2p override failure xen/arm: p2m_init and p2m_lock should be static arm/xen: Export phys_to_mach to fix Xen module link errors swiotlb-xen: add missing xen_dma_map_page call
2013-12-02brcmfmac: fix uninitialized warningArend van Spriel1-0/+2
Building brcmfmac for sparc64 gave the following warning: CC [M] drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.o bcmsdh_sdmmc.c: In function 'brcmf_sdioh_request_byte': bcmsdh_sdmmc.c:89:6: warning: 'err_ret' may be used uninitialized in this function [-Wuninitialized] Inspecting the code it indeed had a path of execution in which the return value was used uninitialized. This patch fixes that code path. Reviewed-by: Hante Meuleman <[email protected]> Reviewed-by: Franky Lin <[email protected]> Reviewed-by: Pieter-Paul Giesberts <[email protected]> Signed-off-by: Arend van Spriel <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2013-12-02net: wireless: wcn36xx: fix potential NULL pointer dereferenceMichal Nazarewicz1-6/+13
If kmalloc fails wcn36xx_smd_rsp_process will attempt to dereference a NULL pointer. There might be a better error recovery then just printing an error, but printing an error message is better then the current behaviour. Signed-off-by: Michal Nazarewicz <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2013-12-02net: wireless: ath9k: avoid possible NULL pointer dereferenceMichal Nazarewicz1-4/+3
Code in ath9k_hw_set_clockrate function indicates that ah->curchan (and thus chan local variable) may be NULL. If that is indeed the case, IS_CHAN_HT40(chan) check has to be performed only in branch where chan is not NULL. Moving the code under already existing if condition fixes this issue. Signed-off-by: Michal Nazarewicz <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2013-12-02ath9k: Fix XLNA bias strengthSujith Manoharan1-1/+1
The EEPROM parameter to determine whether the bias strength values for XLNA have to be applied is part of the miscConfiguration field and not featureEnable. Cc: [email protected] Signed-off-by: Sujith Manoharan <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2013-12-02ath9k: Fix QuickDrop usageSujith Manoharan1-9/+11
Bit 5 in the miscConfiguration field of the base EEPROM header denotes whether QuickDrop is enabled or not. Fix the incorrect usage of BIT(1) and also make sure that this is done only for the required chips. Cc: [email protected] Signed-off-by: Sujith Manoharan <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2013-12-02Merge tag 'spi-v3.13-rc2' of ↵Linus Torvalds9-12/+31
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A smattering of driver specific fixes here, including a bunch for a long standing common pattern in the error handling paths, and a fix for an embarrassing thinko in the new devm master registration code" * tag 'spi-v3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi/pxa2xx: Restore private register bits. spi/qspi: Fix qspi remove path. spi/qspi: cleanup pm_runtime error check. spi/qspi: set correct platform drvdata in ti_qspi_probe() spi/pxa2xx: add new ACPI IDs spi: core: invert success test in devm_spi_register_master spi: spi-mxs: fix reference leak to master in mxs_spi_remove() spi: bcm63xx: fix reference leak to master in bcm63xx_spi_remove() spi: txx9: fix reference leak to master in txx9spi_remove() spi: mpc512x: fix reference leak to master in mpc512x_psc_spi_do_remove() spi: rspi: use platform drvdata correctly in rspi_remove() spi: bcm2835: fix reference leak to master in bcm2835_spi_remove()
2013-12-02Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds70-344/+491
Pull networking updates from David Miller: "Here is a pile of bug fixes that accumulated while I was in Europe" 1) In fixing kernel leaks to userspace during copying of socket addresses, we broke a case that used to work, namely the user providing a buffer larger than the in-kernel generic socket address structure. This broke Ruby amongst other things. Fix from Dan Carpenter. 2) Fix regression added by byte queue limit support in 8139cp driver, from Yang Yingliang. 3) The addition of MSG_SENDPAGE_NOTLAST buggered up a few sendpage implementations, they should just treat it the same as MSG_MORE. Fix from Richard Weinberger and Shawn Landden. 4) Handle icmpv4 errors received on ipv6 SIT tunnels correctly, from Oussama Ghorbel. In particular we should send an ICMPv6 unreachable in such situations. 5) Fix some regressions in the recent genetlink fixes, in particular get the pmcraid driver to use the new safer interfaces correctly. From Johannes Berg. 6) macvtap was converted to use a per-cpu set of statistics, but some code was still bumping tx_dropped elsewhere. From Jason Wang. 7) Fix build failure of xen-netback due to missing include on some architectures, from Andy Whitecroft. 8) macvtap double counts received packets in statistics, fix from Vlad Yasevich. 9) Fix various cases of using *_STATS_BH() when *_STATS() is more appropriate. From Eric Dumazet and Hannes Frederic Sowa. 10) Pktgen ipsec mode doesn't update the ipv4 header length and checksum properly after encapsulation. Fix from Fan Du. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (61 commits) net/mlx4_en: Remove selftest TX queues empty condition {pktgen, xfrm} Update IPv4 header total len and checksum after tranformation virtio_net: make all RX paths handle erors consistently virtio_net: fix error handling for mergeable buffers virtio_net: Fixed a trivial typo (fitler --> filter) netem: fix gemodel loss generator netem: fix loss 4 state model netem: missing break in ge loss generator net/hsr: Support iproute print_opt ('ip -details ...') net/hsr: Very small fix of comment style. MAINTAINERS: Added net/hsr/ maintainer ipv6: fix possible seqlock deadlock in ip6_finish_output2 ixgbe: Make ixgbe_identify_qsfp_module_generic static ixgbe: turn NETIF_F_HW_L2FW_DOFFLOAD off by default ixgbe: ixgbe_fwd_ring_down needs to be static e1000: fix possible reset_task running after adapter down e1000: fix lockdep warning in e1000_reset_task e1000: prevent oops when adapter is being closed and reset simultaneously igb: Fixed Wake On LAN support inet: fix possible seqlock deadlocks ...
2013-12-02regulator: as3722: set the correct current limitVince Hsu1-1/+1
Simple fix to set the correct current limit for SD0/1/6. Signed-off-by: Vince Hsu <[email protected]> Signed-off-by: Mark Brown <[email protected]> Fixes: bc407334e9a6 (regulator: as3722: add regulator driver for AMS AS3722) Cc: [email protected]
2013-12-02Merge branch 'master' of ↵John W. Linville12-18/+88
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes
2013-12-02vfs: fix subtle use-after-free of pipe_inode_infoLinus Torvalds1-20/+19
The pipe code was trying (and failing) to be very careful about freeing the pipe info only after the last access, with a pattern like: spin_lock(&inode->i_lock); if (!--pipe->files) { inode->i_pipe = NULL; kill = 1; } spin_unlock(&inode->i_lock); __pipe_unlock(pipe); if (kill) free_pipe_info(pipe); where the final freeing is done last. HOWEVER. The above is actually broken, because while the freeing is done at the end, if we have two racing processes releasing the pipe inode info, the one that *doesn't* free it will decrement the ->files count, and unlock the inode i_lock, but then still use the "pipe_inode_info" afterwards when it does the "__pipe_unlock(pipe)". This is *very* hard to trigger in practice, since the race window is very small, and adding debug options seems to just hide it by slowing things down. Simon originally reported this way back in July as an Oops in kmem_cache_allocate due to a single bit corruption (due to the final "spin_unlock(pipe->mutex.wait_lock)" incrementing a field in a different allocation that had re-used the free'd pipe-info), it's taken this long to figure out. Since the 'pipe->files' accesses aren't even protected by the pipe lock (we very much use the inode lock for that), the simple solution is to just drop the pipe lock early. And since there were two users of this pattern, create a helper function for it. Introduced commit ba5bb147330a ("pipe: take allocation and freeing of pipe_inode_info out of ->i_mutex"). Reported-by: Simon Kirby <[email protected]> Reported-by: Ian Applegate <[email protected]> Acked-by: Al Viro <[email protected]> Cc: [email protected] # v3.10+ Signed-off-by: Linus Torvalds <[email protected]>
2013-12-02s390/time,vdso: fix clock_gettime for CLOCK_MONOTONICMartin Schwidefsky2-11/+4
With git commit 79c74ecbebf76732f91b82a62ce7fc8a88326962 "s390/time,vdso: convert to the new update_vsyscall interface" the new update_vsyscall function already does the sum of xtime and wall_to_monotonic. The old update_vsyscall function only copied the wall_to_monotonic offset. The vdso code needs to be modified to take this into consideration. Signed-off-by: Martin Schwidefsky <[email protected]>
2013-12-02ALSA: hda - Use always amps for auto-mute on AD1986A codecTakashi Iwai1-0/+3
It seems that AD1986A cannot manage the dynamic pin on/off for auto-muting, but rather gets confused. Since each output has own amp, let's use it instead. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64971 Cc: <[email protected]> [v3.11+] Signed-off-by: Takashi Iwai <[email protected]>
2013-12-02ALSA: hda/analog - Handle inverted EAPD properly in vmaster hookTakashi Iwai1-0/+2
ad_vmaster_eapd_hook() needs to handle the inverted EAPD case properly, too. Otherwise the output gets broken on Lenovo N100 with AD1986A codec. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64971 Signed-off-by: Takashi Iwai <[email protected]>
2013-12-02s390/vdso: ectg gettime support for CLOCK_THREAD_CPUTIME_IDMartin Schwidefsky3-2/+7
The code to use the ECTG instruction to calculate the cputime for the current thread is currently used only for the per-thread CPU-clock with the clockid -2 (PID=0, VIRT=1). Use the same code for the clockid CLOCK_THREAD_CPUTIME_ID to speed up the more common clockid as well. Reported-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2013-12-02s390/vdso: fix access-list entry initializationHeiko Carstens1-1/+1
The access-list entry is supposed to have the fetch-only bit set, however a reserved bit got set instead. Userspace isn't able to write to the page anyway since the accessed page has the read-only bit set. So this saves us only for bad surprises in the future if the reserved bit gets used. Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2013-12-02s390: increase CONFIG_NR_CPUS limitXose Vazquez Perez1-3/+3
In current models, maximum number of active cores is 101. [[email protected]]: Xose's patch increased the maximum possible value of CONFIG_NR_CPUS to 101. I changed this to 256 instead. Signed-off-by: Xose Vazquez Perez <[email protected]> Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2013-12-02s390/smp,sclp: fix size of sclp_cpu_info structureHeiko Carstens1-1/+2
struct sclp_cpu_info contains entries only for 255 cpus, while the new smp fallback sigp detection code will fill up to 256 entries. Even though there is no machine available which has 256 cpus and where in addition the fallback sigp cpu detection code will be used we better fix this, to prevent out of bound accesses. Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2013-12-02s390/sclp: replace uninitialized early_event_mask_sccb variable with sccb_earlyHendrik Brueckner1-3/+2
Commit "s390/sclp: Consolidate early sclp init calls to sclp_early_detect()" (7b50da53f6ad2048241bef232bfc22a132a40283) replaced the sclp_event_mask_early() with sclp_set_event_mask(). The early_event_mask_sccb variable is no longer initialized but is still used in sclp_has_linemode() and sclp_has_vt220(). Replace early_event_mask_sccb with the sccb_early variable in both functions. Signed-off-by: Hendrik Brueckner <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2013-12-02s390/dasd: fix memory leak caused by dangling references to request_queueStefan Weinhuber1-1/+0
After the call to del_gendisk, the gendisk still holds a reference to its request_queue. We must not modify the gendisks queue pointer before the put_disk call, or the gendisk_release function cannot release the reference and the memory for the request_queue structure is lost. Signed-off-by: Stefan Weinhuber <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2013-12-02ALSA: hda - Another fixup for ASUS laptop with ALC660 codecTakashi Iwai1-0/+1
ASUS Z35HL laptop also needs the very same fix as the previous one that was applied to ASUS W7J. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66231 Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2013-12-02HID: kye: Fix missing break in kye_report_fixup()Ben Hutchings1-0/+1
The change to support Genius Manticore Keyboard also changed behaviour for Genius Gx Imperator Keyboard, as there is no break between the cases. This is presumably a mistake. Reported by Coverity as CID 1134029. Fixes: 4a2c94c9b6c0 ('HID: kye: Add report fixup for Genius Manticore Keyboard') Signed-off-by: Ben Hutchings <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
2013-12-02ALSA: atmel: Fix possible array overflowTakashi Iwai1-1/+2
The static checker found a possible array overflow in atmel/abdac.c: static checker warning: "sound/atmel/abdac.c:373 set_sample_rates() error: buffer overflow 'dac->rates' 6 <= 6" This patch papers over the buggy point, by ensuring that dac->rates[] update not overflowing the actual array size. Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2013-12-02drm/i915/lvds: don't restore hw state in the lid notifier for pch platformsDaniel Vetter1-3/+13
It's a pain for two reasons: - The vga plane redisablign requires actual legacy vgao i/o to pull of. The hw engineers really botched this one here :( - There seem to be some BIOS out there which send out lid events when unplugging. Together with our broken DP code, which disables the port when the cable is lost, this results in an immediate modeset call, which can hang on the wait for outstanding flips. - Also we don't want to force a modeset on machines where it's not really needed, see the referenced bug. We might want to extend this in general to also all machines that support opregion, since there the BIOS supposedly should manage the gfx hardware more cooperatively. v2: Pimp commit message a bit. Cc: Roland Dreier <[email protected]> References: https://bugs.freedesktop.org/show_bug.cgi?id=65486 Acked-by: Chris Wilson <[email protected]> Signed-off-by: Daniel Vetter <[email protected]>