aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2010-11-12ARM: GIC: don't disable software generated interruptsRussell King1-4/+24
Software generated interrupts (SGI) are used for IPIs by the kernel. While previous revisions of the GIC hardware were specified not to implement enable bits for SGIs, more recent hardware is now permitted to implement these bits in a per-CPU banked register. The priority registers for the PPI and SGIs are also per-CPU banked registers, so ensure that these are also appropriately initialized. Reported-by: Scott Valentine <[email protected]> Acked-by: Abhijeet Dharmapurikar <[email protected]> Acked-by: Catalin Marinas <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-11-10ARM: 6472/1: vexpress ct-ca9x4: only set twd_base if local timers are being usedWill Deacon1-0/+2
In commit bde28b84, I made the assumption that CONFIG_SMP is always set for the quad-core ct-ca9x4 platform. As it turns out, people who aren't using the SMP goodness are confronted with a build failure. This patch fixes this issue by ensure that twd_base is only set if local timers are being used (and therefore SMP support is configured). Reported-by: Nicolas Pitre <[email protected]> Signed-off-by: Will Deacon <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-11-07ARM: arch/arm/kernel/traps.c: Convert sprintf_symbol to %pSJoe Perches1-4/+1
Signed-off-by: Joe Perches <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-11-07ARM: arch/arm/kernel/hw_breakpoint.c: Convert WARN_ON to WARNJoe Perches1-2/+1
Message isn't printed by WARN_ON. Signed-off-by: Joe Perches <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-11-07ARM: 6462/1: EP93xx: Document DMA M2P APIRyan Mallon1-9/+102
Add kernel-doc documentation for the EP93xx DMA memory to peripheral/peripheral to memory API. Signed-off-by: Ryan Mallon <[email protected]> Acked-by: Mika Westerberg <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-11-07ARM: 6470/1: atomic64: use generic implementation for OABI configurationsWill Deacon1-1/+1
The old apcs-gnu ABI doesn't guarantee that double words are allocated to registers with even alignment, causing the 64-bit exclusive memory operations to be rejected by the assembler. This patch requires that CONFIG_AEABI is set in order to use the native atomic operations and falls back to the generic (spinlock) code otherwise. Acked-by: Nicolas Pitre <[email protected]> Signed-off-by: Will Deacon <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-11-07ARM: 6469/1: perf-events: squash compiler warningWill Deacon1-1/+1
armv7_pmnc_counter_has_overflowed can return uninitialised data if an invalid counter is specified. This patch fixes the code to return 0 in this case, which squashes the compiler warning from GCC 4.5. Signed-off-by: Will Deacon <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-11-07ARM: 6468/1: backtrace: fix calculation of thread stack baseWill Deacon2-2/+2
When unwinding stack frames we must take care not to unwind areas of memory that lie outside of the known extent of the stack. This patch fixes an incorrect calculation of the stack base where THREAD_SIZE is added to the stack pointer after it has already been aligned to this value. Since the ALIGN macro performs this addition internally, we end up overshooting the base by 8k. Acked-by: Catalin Marinas <[email protected]> Signed-off-by: Will Deacon <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-11-07Merge branch 'fix' of ↵Russell King4-5/+4
git://git.kernel.org/pub/scm/linux/kernel/git/ycmiao/pxa-linux-2.6
2010-11-07Merge git://git.kernel.org/pub/scm/linux/kernel/git/nico/orionRussell King13-42/+29
2010-11-07ARM: Fix DMA coherent allocator alignmentRussell King1-1/+1
An out by one bug meant that the DMA coherent allocator was aligning to one more bit than it should, causing it to run out of available memory quicker. Fix this. Reported-by: Petr Štetiar <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-11-05ipw2x00: remove the right /proc/net entryLinus Torvalds1-4/+5
Commit 27ae60f8f7aa ("ipw2x00: replace "ieee80211" with "libipw" where appropriate") changed DRV_NAME to be "libipw", but didn't properly fix up the places where it was used to specify the name for the /proc/net/ directory. For backwards compatibility reasons, that directory name remained "ieee80211", but due to the DRV_NAME change, the error case printouts and the cleanup functions now used "libipw" instead. Which made it all fail badly. For example, on module unload as reported by Randy: WARNING: at fs/proc/generic.c:816 remove_proc_entry+0x156/0x35e() name 'libipw' because it's trying to unregister a /proc directory that obviously doesn't even exist. Clean it all up to use DRV_PROCNAME for the actual /proc directory name. Reported-and-tested-by: Randy Dunlap <[email protected]> Cc: Pavel Roskin <[email protected]> Cc: John W. Linville <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-11-05Merge branch 'kvm-updates/2.6.37' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds7-13/+21
* 'kvm-updates/2.6.37' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: PPC: BookE: Load the lower half of MSR KVM: PPC: BookE: fix sleep with interrupts disabled KVM: PPC: e500: Call kvm_vcpu_uninit() before kvmppc_e500_tlb_uninit(). PPC: KVM: Book E doesn't have __end_interrupts. KVM: x86: Issue smp_call_function_many with preemption disabled KVM: x86: fix information leak to userland KVM: PPC: fix information leak to userland KVM: MMU: fix rmap_remove on non present sptes KVM: Write protect memory after slot swap
2010-11-05floppy: fix use-after-free in module load failure pathLinus Torvalds1-1/+1
Commit 488211844e0c ("floppy: switch to one queue per drive instead of sharing a queue") introduced a use-after-free. We do "put_disk()" on the disk device _before_ we then clean up the queue associated with that disk. Move the put_disk() down to avoid dereferencing a free'd data structure. Cc: Jens Axboe <[email protected]> Cc: Vivek Goyal <[email protected]> Reported-and-tested-by: Randy Dunlap <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-11-05watchdog: Fix section mismatch and potential undefined behavior.David Daney1-1/+1
Commit d9ca07a05ce1 ("watchdog: Avoid kernel crash when disabling watchdog") introduces a section mismatch. Now that we reference no_watchdog from non-__init code it can no longer be __initdata. Signed-off-by: David Daney <[email protected]> Cc: Stephane Eranian <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Ingo Molnar <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-11-05Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds46-153/+246
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (41 commits) inet_diag: Make sure we actually run the same bytecode we audited. netlink: Make nlmsg_find_attr take a const nlmsghdr*. fib: fib_result_assign() should not change fib refcounts netfilter: ip6_tables: fix information leak to userspace cls_cgroup: Fix crash on module unload memory corruption in X.25 facilities parsing net dst: fix percpu_counter list corruption and poison overwritten rds: Remove kfreed tcp conn from list rds: Lost locking in loop connection freeing de2104x: fix panic on load atl1 : fix panic on load netxen: remove unused firmware exports caif: Remove noisy printout when disconnecting caif socket caif: SPI-driver bugfix - incorrect padding. caif: Bugfix for socket priority, bindtodev and dbg channel. smsc911x: Set Ethernet EEPROM size to supported device's size ipv4: netfilter: ip_tables: fix information leak to userland ipv4: netfilter: arp_tables: fix information leak to userland cxgb4vf: remove call to stop TX queues at load time. cxgb4: remove call to stop TX queues at load time. ...
2010-11-05Merge branch 'fixes' of ↵Linus Torvalds1-23/+65
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: firewire: ohci: fix race when reading count in AR descriptor firewire: ohci: avoid reallocation of AR buffers firewire: ohci: fix race in AR split packet handling firewire: ohci: fix buffer overflow in AR split packet handling
2010-11-05Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6Linus Torvalds9-161/+152
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: cifs: make cifs_set_oplock_level() take a cifsInodeInfo pointer cifs: dereferencing first then checking cifs: trivial comment fix: tlink_tree is now a rbtree [CIFS] Cleanup unused variable build warning cifs: convert tlink_tree to a rbtree cifs: store pointer to master tlink in superblock (try #2) cifs: trivial doc fix: note setlease implemented CIFS: Add cifs_set_oplock_level FS: cifs, remove unneeded NULL tests
2010-11-05posix-cpu-timers: workaround to suppress the problems with mt execOleg Nesterov1-0/+8
posix-cpu-timers.c correctly assumes that the dying process does posix_cpu_timers_exit_group() and removes all !CPUCLOCK_PERTHREAD timers from signal->cpu_timers list. But, it also assumes that timer->it.cpu.task is always the group leader, and thus the dead ->task means the dead thread group. This is obviously not true after de_thread() changes the leader. After that almost every posix_cpu_timer_ method has problems. It is not simple to fix this bug correctly. First of all, I think that timer->it.cpu should use struct pid instead of task_struct. Also, the locking should be reworked completely. In particular, tasklist_lock should not be used at all. This all needs a lot of nontrivial and hard-to-test changes. Change __exit_signal() to do posix_cpu_timers_exit_group() when the old leader dies during exec. This is not the fix, just the temporary hack to hide the problem for 2.6.37 and stable. IOW, this is obviously wrong but this is what we currently have anyway: cpu timers do not work after mt exec. In theory this change adds another race. The exiting leader can detach the timers which were attached to the new leader. However, the window between de_thread() and release_task() is small, we can pretend that sys_timer_create() was called before de_thread(). Signed-off-by: Oleg Nesterov <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-11-05Merge branch 'hwmon-for-linus' of ↵Linus Torvalds1-3/+2
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: hwmon: (ltc4261) Fix error message format hwmon: (ltc4261) Add missing newline in debug message
2010-11-05cifs: make cifs_set_oplock_level() take a cifsInodeInfo pointerPavel Shilovsky4-14/+15
All the callers already have a pointer to struct cifsInodeInfo. Use it. Signed-off-by: Suresh Jayaraman <[email protected]> Signed-off-by: Pavel Shilovsky <[email protected]> Signed-off-by: Steve French <[email protected]>
2010-11-05ARM: orion5x/kirkwood/mv78xx0: fix MPP configuration corner casesMike Rapoport3-9/+3
Wrong MPP configuration would cause <cpu>_mpp_conf loop infinitely because the mpp list iterator would not be incremented. Signed-off-by: Mike Rapoport <[email protected]> Signed-off-by: Nicolas Pitre <[email protected]>
2010-11-05[ARM] TS-78xxx NAND resource type should be IORESOURCE_MEMMichael Spang1-1/+1
The type was IORESOURCE_IO which is not what is expected by plat_nand_probe(). This device has not worked since 2d098a72 ("mtd: plat_nand: request memory resource before doing ioremap"). Signed-off-by: Michael Spang <[email protected]> Signed-off-by: Nicolas Pitre <[email protected]>
2010-11-05hwmon: (ltc4261) Fix error message formatJean Delvare1-2/+1
adapter->id is deprecated and not set by any adapter driver, so this was certainly not what the author wanted to use. adapter->nr maybe, but as dev_err() already includes this value, as well as the client's address, there's no point repeating them. Better print a simple error message in plain English words. Signed-off-by: Jean Delvare <[email protected]> Cc: Guenter Roeck <[email protected]> Signed-off-by: Guenter Roeck <[email protected]>
2010-11-05hwmon: (ltc4261) Add missing newline in debug messageGuenter Roeck1-1/+1
Reported-by: Joe Perches <[email protected]> Signed-off-by: Guenter Roeck <[email protected]> Acked-by: Jean Delvare <[email protected]>
2010-11-05Merge git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tileLinus Torvalds22-76/+110
* git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: arch/tile: mark "hardwall" device as non-seekable asm-generic/stat.h: support 64-bit file time_t for stat() arch/tile: don't allow user code to set the PL via ptrace or signal return arch/tile: correct double syscall restart for nested signals arch/tile: avoid __must_check warning on one strict_strtol check arch/tile: bomb raw_local_irq_ to arch_local_irq_ arch/tile: complete migration to new kmap_atomic scheme
2010-11-05leds-net5501: taints kernel, add licenseRandy Dunlap1-0/+2
Add MODULE_LICENSE() that matches file comments so that kernel is not tainted. leds_net5501: module license 'unspecified' taints kernel. Signed-off-by: Randy Dunlap <[email protected]> Acked-by: Richard Purdie <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-11-05KVM: PPC: BookE: Load the lower half of MSRScott Wood1-1/+1
This was preventing the guest from setting any bits in the hardware MSR which aren't forced on, such as MSR[SPE]. Signed-off-by: Scott Wood <[email protected]> Signed-off-by: Alexander Graf <[email protected]>
2010-11-05KVM: PPC: BookE: fix sleep with interrupts disabledScott Wood1-2/+0
It is not legal to call mutex_lock() with interrupts disabled. This will assert with debug checks enabled. If there's a real need to disable interrupts here, it could be done after the mutex is acquired -- but I don't see why it's needed at all. Signed-off-by: Scott Wood <[email protected]> Reviewed-by: Christian Ehrhardt <[email protected]> Signed-off-by: Alexander Graf <[email protected]>
2010-11-05KVM: PPC: e500: Call kvm_vcpu_uninit() before kvmppc_e500_tlb_uninit().Scott Wood1-1/+1
The VCPU uninit calls some TLB functions, and the TLB uninit function frees the memory used by them. Signed-off-by: Scott Wood <[email protected]> Acked-by: Liu Yu <[email protected]> Signed-off-by: Alexander Graf <[email protected]>
2010-11-05PPC: KVM: Book E doesn't have __end_interrupts.Scott Wood1-1/+1
Fix an unresolved symbol with CONFIG_KVM_GUEST plus CONFIG_RELOCATABLE on Book E. Signed-off-by: Scott Wood <[email protected]> Signed-off-by: Alexander Graf <[email protected]>
2010-11-05KVM: x86: Issue smp_call_function_many with preemption disabledJan Kiszka1-0/+2
smp_call_function_many is specified to be called only with preemption disabled. Fulfill this requirement. Signed-off-by: Jan Kiszka <[email protected]> Signed-off-by: Marcelo Tosatti <[email protected]>
2010-11-05KVM: x86: fix information leak to userlandVasiliy Kulikov1-0/+6
Structures kvm_vcpu_events, kvm_debugregs, kvm_pit_state2 and kvm_clock_data are copied to userland with some padding and reserved fields unitialized. It leads to leaking of contents of kernel stack memory. We have to initialize them to zero. In patch v1 Jan Kiszka suggested to fill reserved fields with zeros instead of memset'ting the whole struct. It makes sense as these fields are explicitly marked as padding. No more fields need zeroing. KVM-Stable-Tag. Signed-off-by: Vasiliy Kulikov <[email protected]> Signed-off-by: Marcelo Tosatti <[email protected]>
2010-11-05KVM: PPC: fix information leak to userlandVasiliy Kulikov1-0/+1
Structure kvm_ppc_pvinfo is copied to userland with flags and pad fields unitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <[email protected]> Signed-off-by: Marcelo Tosatti <[email protected]>
2010-11-05KVM: MMU: fix rmap_remove on non present sptesMarcelo Tosatti1-4/+5
drop_spte should not attempt to rmap_remove a non present shadow pte. This fixes a BUG_ON seen on kvm-autotest. Signed-off-by: Marcelo Tosatti <[email protected]> Reported-by: Lucas Meneghel Rodrigues <[email protected]> Signed-off-by: Avi Kivity <[email protected]>
2010-11-05KVM: Write protect memory after slot swapMichael S. Tsirkin1-4/+4
I have observed the following bug trigger: 1. userspace calls GET_DIRTY_LOG 2. kvm_mmu_slot_remove_write_access is called and makes a page ro 3. page fault happens and makes the page writeable fault is logged in the bitmap appropriately 4. kvm_vm_ioctl_get_dirty_log swaps slot pointers a lot of time passes 5. guest writes into the page 6. userspace calls GET_DIRTY_LOG At point (5), bitmap is clean and page is writeable, thus, guest modification of memory is not logged and GET_DIRTY_LOG returns an empty bitmap. The rule is that all pages are either dirty in the current bitmap, or write-protected, which is violated here. It seems that just moving kvm_mmu_slot_remove_write_access down to after the slot pointer swap should fix this bug. KVM-Stable-Tag. Signed-off-by: Michael S. Tsirkin <[email protected]> Signed-off-by: Avi Kivity <[email protected]>
2010-11-05Clean up relay_alloc_page_array() slightly by using vzalloc rather than ↵Jesper Juhl1-11/+4
vmalloc and memset We can optimize kernel/relay.c::relay_alloc_page_array() slightly by using vzalloc. The patch makes these changes: - use vzalloc instead of vmalloc+memset. - remove redundant local variable 'array'. - declare local 'pa_size' as const. Cuts down nicely on both source and object-code size. Signed-off-by: Jesper Juhl <[email protected]> Acked-by: Pekka Enberg <[email protected]> Acked-by: Mathieu Desnoyers <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-11-05Merge branch 'for-linus-fixes' of ↵Linus Torvalds2-0/+3
git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu * 'for-linus-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k, m68knommu: Do not include linux/hardirq.h in asm/irqflags.h m68knommu: add back in declaration of do_IRQ
2010-11-04cifs: dereferencing first then checkingJeff Layton1-7/+3
This patch is based on Dan's original patch. His original description is below: Smatch complained about a couple checking for NULL after dereferencing bugs. I'm not super familiar with the code so I did the conservative thing and move the dereferences after the checks. The dereferences in cifs_lock() and cifs_fsync() were added in ba00ba64cf0 "cifs: make various routines use the cifsFileInfo->tcon pointer". The dereference in find_writable_file() was added in 6508d904e6f "cifs: have find_readable/writable_file filter by fsuid". The comments there say it's possible to trigger the NULL dereference under stress. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Steve French <[email protected]>
2010-11-04cifs: trivial comment fix: tlink_tree is now a rbtreeSuresh Jayaraman1-1/+1
Noticed while reviewing (late) the rbtree conversion patchset (which has been merged already). Cc: Jeff Layton <[email protected]> Signed-off-by: Suresh Jayaraman <[email protected]> Signed-off-by: Steve French <[email protected]>
2010-11-04inet_diag: Make sure we actually run the same bytecode we audited.Nelson Elhage1-11/+16
We were using nlmsg_find_attr() to look up the bytecode by attribute when auditing, but then just using the first attribute when actually running bytecode. So, if we received a message with two attribute elements, where only the second had type INET_DIAG_REQ_BYTECODE, we would validate and run different bytecode strings. Fix this by consistently using nlmsg_find_attr everywhere. Signed-off-by: Nelson Elhage <[email protected]> Signed-off-by: Thomas Graf <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-04netlink: Make nlmsg_find_attr take a const nlmsghdr*.Nelson Elhage1-1/+1
This will let us use it on a nlmsghdr stored inside a netlink_callback. Signed-off-by: Nelson Elhage <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-04fib: fib_result_assign() should not change fib refcountsEric Dumazet1-4/+1
After commit ebc0ffae5 (RCU conversion of fib_lookup()), fib_result_assign() should not change fib refcounts anymore. Thanks to Michael who did the bisection and bug report. Reported-by: Michael Ellerman <[email protected]> Tested-by: Michael Ellerman <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-03netfilter: ip6_tables: fix information leak to userspaceJan Engelhardt1-0/+1
Signed-off-by: Jan Engelhardt <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-03Merge branch 'master' of ↵David S. Miller5-21/+30
git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6
2010-11-03cls_cgroup: Fix crash on module unloadHerbert Xu1-2/+0
Somewhere along the lines net_cls_subsys_id became a macro when cls_cgroup is built as a module. Not only did it make cls_cgroup completely useless, it also causes it to crash on module unload. This patch fixes this by removing that macro. Thanks to Eric Dumazet for diagnosing this problem. Reported-by: Randy Dunlap <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Reviewed-by: Li Zefan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-03memory corruption in X.25 facilities parsingandrew hendry2-4/+6
Signed-of-by: Andrew Hendry <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-03net dst: fix percpu_counter list corruption and poison overwrittenXiaotian Feng1-0/+2
There're some percpu_counter list corruption and poison overwritten warnings in recent kernel, which is resulted by fc66f95c. commit fc66f95c switches to use percpu_counter, in ip6_route_net_init, kernel init the percpu_counter for dst entries, but, the percpu_counter is never destroyed in ip6_route_net_exit. So if the related data is freed by kernel, the freed percpu_counter is still on the list, then if we insert/remove other percpu_counter, list corruption resulted. Also, if the insert/remove option modifies the ->prev,->next pointer of the freed value, the poison overwritten is resulted then. With the following patch, the percpu_counter list corruption and poison overwritten warnings disappeared. Signed-off-by: Xiaotian Feng <[email protected]> Cc: "David S. Miller" <[email protected]> Cc: Alexey Kuznetsov <[email protected]> Cc: "Pekka Savola (ipv6)" <[email protected]> Cc: James Morris <[email protected]> Cc: Hideaki YOSHIFUJI <[email protected]> Cc: Patrick McHardy <[email protected]> Acked-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-03rds: Remove kfreed tcp conn from listPavel Emelyanov1-0/+6
All the rds_tcp_connection objects are stored list, but when being freed it should be removed from there. Signed-off-by: Pavel Emelyanov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-03rds: Lost locking in loop connection freeingPavel Emelyanov1-0/+4
The conn is removed from list in there and this requires proper lock protection. Signed-off-by: Pavel Emelyanov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.