aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-11-21block/partitions/efi.c: fix bound checkAntti P Miettinen1-2/+3
Use ARRAY_SIZE instead of sizeof to get proper max for label length. Since this is just a read out of bounds it's not that bad, but the problem becomes user-visible eg if one tries to use DEBUG_PAGEALLOC and DEBUG_RODATA, at least with some enhancements from Hiroshi. Of course the destination array can contain garbage when we read beyond the end of source array so that would be another user-visible problem. Signed-off-by: Antti P Miettinen <[email protected]> Reviewed-by: Hiroshi Doyu <[email protected]> Tested-by: Hiroshi Doyu <[email protected]> Cc: Will Drewry <[email protected]> Cc: Matt Fleming <[email protected]> Acked-by: Davidlohr Bueso <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-11-21ARM: drivers/rtc/rtc-at91rm9200.c: disable interrupts at shutdownJohan Hovold1-0/+9
Make sure RTC-interrupts are disabled at shutdown. As the RTC is generally powered by backup power (VDDBU), its interrupts are not disabled on wake-up, user, watchdog or software reset. This could cause troubles on other systems (e.g. older kernels) if an interrupt occurs before a handler has been installed at next boot. Let us be well-behaved and disable them on clean shutdowns at least (as do the RTT-based rtc-at91sam9 driver). Signed-off-by: Johan Hovold <[email protected]> Acked-by: Nicolas Ferre <[email protected]> Cc: Jean-Christophe Plagniol-Villard <[email protected]> Cc: Andrew Victor <[email protected]> Cc: Alessandro Zummo <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-11-21mm: hugetlbfs: fix hugetlbfs optimizationAndrea Arcangeli3-60/+106
Commit 7cb2ef56e6a8 ("mm: fix aio performance regression for database caused by THP") can cause dereference of a dangling pointer if split_huge_page runs during PageHuge() if there are updates to the tail_page->private field. Also it is repeating compound_head twice for hugetlbfs and it is running compound_head+compound_trans_head for THP when a single one is needed in both cases. The new code within the PageSlab() check doesn't need to verify that the THP page size is never bigger than the smallest hugetlbfs page size, to avoid memory corruption. A longstanding theoretical race condition was found while fixing the above (see the change right after the skip_unlock label, that is relevant for the compound_lock path too). By re-establishing the _mapcount tail refcounting for all compound pages, this also fixes the below problem: echo 0 >/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages BUG: Bad page state in process bash pfn:59a01 page:ffffea000139b038 count:0 mapcount:10 mapping: (null) index:0x0 page flags: 0x1c00000000008000(tail) Modules linked in: CPU: 6 PID: 2018 Comm: bash Not tainted 3.12.0+ #25 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack+0x55/0x76 bad_page+0xd5/0x130 free_pages_prepare+0x213/0x280 __free_pages+0x36/0x80 update_and_free_page+0xc1/0xd0 free_pool_huge_page+0xc2/0xe0 set_max_huge_pages.part.58+0x14c/0x220 nr_hugepages_store_common.isra.60+0xd0/0xf0 nr_hugepages_store+0x13/0x20 kobj_attr_store+0xf/0x20 sysfs_write_file+0x189/0x1e0 vfs_write+0xc5/0x1f0 SyS_write+0x55/0xb0 system_call_fastpath+0x16/0x1b Signed-off-by: Khalid Aziz <[email protected]> Signed-off-by: Andrea Arcangeli <[email protected]> Tested-by: Khalid Aziz <[email protected]> Cc: Pravin Shelar <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: Ben Hutchings <[email protected]> Cc: Christoph Lameter <[email protected]> Cc: Johannes Weiner <[email protected]> Cc: Mel Gorman <[email protected]> Cc: Rik van Riel <[email protected]> Cc: Andi Kleen <[email protected]> Cc: Minchan Kim <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-11-21kernel: remove CONFIG_USE_GENERIC_SMP_HELPERS cleanlyYuanhan Liu2-6/+6
Remove CONFIG_USE_GENERIC_SMP_HELPERS left by commit 0a06ff068f12 ("kernel: remove CONFIG_USE_GENERIC_SMP_HELPERS"). Signed-off-by: Yuanhan Liu <[email protected]> Cc: Christoph Hellwig <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-11-21ipc,shm: fix shm_file deletion racesGreg Thelen1-5/+23
When IPC_RMID races with other shm operations there's potential for use-after-free of the shm object's associated file (shm_file). Here's the race before this patch: TASK 1 TASK 2 ------ ------ shm_rmid() ipc_lock_object() shmctl() shp = shm_obtain_object_check() shm_destroy() shum_unlock() fput(shp->shm_file) ipc_lock_object() shmem_lock(shp->shm_file) <OOPS> The oops is caused because shm_destroy() calls fput() after dropping the ipc_lock. fput() clears the file's f_inode, f_path.dentry, and f_path.mnt, which causes various NULL pointer references in task 2. I reliably see the oops in task 2 if with shmlock, shmu This patch fixes the races by: 1) set shm_file=NULL in shm_destroy() while holding ipc_object_lock(). 2) modify at risk operations to check shm_file while holding ipc_object_lock(). Example workloads, which each trigger oops... Workload 1: while true; do id=$(shmget 1 4096) shm_rmid $id & shmlock $id & wait done The oops stack shows accessing NULL f_inode due to racing fput: _raw_spin_lock shmem_lock SyS_shmctl Workload 2: while true; do id=$(shmget 1 4096) shmat $id 4096 & shm_rmid $id & wait done The oops stack is similar to workload 1 due to NULL f_inode: touch_atime shmem_mmap shm_mmap mmap_region do_mmap_pgoff do_shmat SyS_shmat Workload 3: while true; do id=$(shmget 1 4096) shmlock $id shm_rmid $id & shmunlock $id & wait done The oops stack shows second fput tripping on an NULL f_inode. The first fput() completed via from shm_destroy(), but a racing thread did a get_file() and queued this fput(): locks_remove_flock __fput ____fput task_work_run do_notify_resume int_signal Fixes: c2c737a0461e ("ipc,shm: shorten critical region for shmat") Fixes: 2caacaa82a51 ("ipc,shm: shorten critical region for shmctl") Signed-off-by: Greg Thelen <[email protected]> Cc: Davidlohr Bueso <[email protected]> Cc: Rik van Riel <[email protected]> Cc: Manfred Spraul <[email protected]> Cc: <[email protected]> # 3.10.17+ 3.11.6+ Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-11-21mm: thp: give transparent hugepage code a separate copy_pageDave Hansen3-38/+48
Right now, the migration code in migrate_page_copy() uses copy_huge_page() for hugetlbfs and thp pages: if (PageHuge(page) || PageTransHuge(page)) copy_huge_page(newpage, page); So, yay for code reuse. But: void copy_huge_page(struct page *dst, struct page *src) { struct hstate *h = page_hstate(src); and a non-hugetlbfs page has no page_hstate(). This works 99% of the time because page_hstate() determines the hstate from the page order alone. Since the page order of a THP page matches the default hugetlbfs page order, it works. But, if you change the default huge page size on the boot command-line (say default_hugepagesz=1G), then we might not even *have* a 2MB hstate so page_hstate() returns null and copy_huge_page() oopses pretty fast since copy_huge_page() dereferences the hstate: void copy_huge_page(struct page *dst, struct page *src) { struct hstate *h = page_hstate(src); if (unlikely(pages_per_huge_page(h) > MAX_ORDER_NR_PAGES)) { ... Mel noticed that the migration code is really the only user of these functions. This moves all the copy code over to migrate.c and makes copy_huge_page() work for THP by checking for it explicitly. I believe the bug was introduced in commit b32967ff101a ("mm: numa: Add THP migration for the NUMA working set scanning fault case") [[email protected]: fix coding-style and comment text, per Naoya Horiguchi] Signed-off-by: Dave Hansen <[email protected]> Acked-by: Mel Gorman <[email protected]> Reviewed-by: Naoya Horiguchi <[email protected]> Cc: Hillf Danton <[email protected]> Cc: Andrea Arcangeli <[email protected]> Tested-by: Dave Jiang <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-11-21checkpatch: fix "Use of uninitialized value" warningsJoe Perches1-0/+1
checkpatch is currently confused about some complex macros and references undefined variables $stat and $cond. Make sure these are defined before using them. Signed-off-by: Joe Perches <[email protected]> Reported-by: Gerhard Sittig <[email protected]> Acked-by: Andy Whitcroft <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-11-21configfs: fix race between dentry put and lookupJunxiao Bi1-2/+14
A race window in configfs, it starts from one dentry is UNHASHED and end before configfs_d_iput is called. In this window, if a lookup happen, since the original dentry was UNHASHED, so a new dentry will be allocated, and then in configfs_attach_attr(), sd->s_dentry will be updated to the new dentry. Then in configfs_d_iput(), BUG_ON(sd->s_dentry != dentry) will be triggered and system panic. sys_open: sys_close: ... fput dput dentry_kill __d_drop <--- dentry unhashed here, but sd->dentry still point to this dentry. lookup_real configfs_lookup configfs_attach_attr---> update sd->s_dentry to new allocated dentry here. d_kill configfs_d_iput <--- BUG_ON(sd->s_dentry != dentry) triggered here. To fix it, change configfs_d_iput to not update sd->s_dentry if sd->s_count > 2, that means there are another dentry is using the sd beside the one that is going to be put. Use configfs_dirent_lock in configfs_attach_attr to sync with configfs_d_iput. With the following steps, you can reproduce the bug. 1. enable ocfs2, this will mount configfs at /sys/kernel/config and fill configure in it. 2. run the following script. while [ 1 ]; do cat /sys/kernel/config/cluster/$your_cluster_name/idle_timeout_ms > /dev/null; done & while [ 1 ]; do cat /sys/kernel/config/cluster/$your_cluster_name/idle_timeout_ms > /dev/null; done & Signed-off-by: Junxiao Bi <[email protected]> Cc: Joel Becker <[email protected]> Cc: Al Viro <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-11-21gso: handle new frag_list of frags GRO packetsHerbert Xu1-25/+50
Recently GRO started generating packets with frag_lists of frags. This was not handled by GSO, thus leading to a crash. Thankfully these packets are of a regular form and are easy to handle. This patch handles them in two ways. For completely non-linear frag_list entries, we simply continue to iterate over the frag_list frags once we exhaust the normal frags. For frag_list entries with linear parts, we call pskb_trim on the first part of the frag_list skb, and then process the rest of the frags in the usual way. This patch also kills a chunk of dead frag_list code that has obviously never ever been run since it ends up generating a bogus GSO-segmented packet with a frag_list entry. Future work is planned to split super big packets into TSO ones. Fixes: 8a29111c7ca6 ("net: gro: allow to build full sized skb") Reported-by: Christoph Paasch <[email protected]> Reported-by: Jerry Chu <[email protected]> Reported-by: Sander Eikelenboom <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Tested-by: Sander Eikelenboom <[email protected]> Tested-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-11-21GFS2: Fix ref count bug relating to atomic_openSteven Whitehouse1-1/+4
In the case that atomic_open calls finish_no_open() with the dentry that was supplied to gfs2_atomic_open() an extra reference count is required. This patch fixes that issue preventing a bug trap triggering at umount time. Signed-off-by: Steven Whitehouse <[email protected]>
2013-11-21genetlink: fix genl_set_err() group IDJohannes Berg1-0/+3
Fix another really stupid bug - I introduced genl_set_err() precisely to be able to adjust the group and reject invalid ones, but then forgot to do so. Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-11-21genetlink: fix genlmsg_multicast() bugJohannes Berg2-6/+3
Unfortunately, I introduced a tremendously stupid bug into genlmsg_multicast() when doing all those multicast group changes: it adjusts the group number, but then passes it to genlmsg_multicast_netns() which does that again. Somehow, my tests failed to catch this, so add a warning into genlmsg_multicast_netns() and remove the offending group ID adjustment. Also add a warning to the similar code in other functions so people who misuse them are more loudly warned. Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-11-21packet: fix use after free race in send path when dev is releasedDaniel Borkmann2-23/+37
Salam reported a use after free bug in PF_PACKET that occurs when we're sending out frames on a socket bound device and suddenly the net device is being unregistered. It appears that commit 827d9780 introduced a possible race condition between {t,}packet_snd() and packet_notifier(). In the case of a bound socket, packet_notifier() can drop the last reference to the net_device and {t,}packet_snd() might end up suddenly sending a packet over a freed net_device. To avoid reverting 827d9780 and thus introducing a performance regression compared to the current state of things, we decided to hold a cached RCU protected pointer to the net device and maintain it on write side via bind spin_lock protected register_prot_hook() and __unregister_prot_hook() calls. In {t,}packet_snd() path, we access this pointer under rcu_read_lock through packet_cached_dev_get() that holds reference to the device to prevent it from being freed through packet_notifier() while we're in send path. This is okay to do as dev_put()/dev_hold() are per-cpu counters, so this should not be a performance issue. Also, the code simplifies a bit as we don't need need_rls_dev anymore. Fixes: 827d978037d7 ("af-packet: Use existing netdev reference for bound sockets.") Reported-by: Salam Noureddine <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Signed-off-by: Salam Noureddine <[email protected]> Cc: Ben Greear <[email protected]> Cc: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-11-21xen-netback: stop the VIF thread before unbinding IRQsDavid Vrabel1-3/+3
If the VIF thread is still running after unbinding the Tx and Rx IRQs in xenvif_disconnect(), the thread may attempt to raise an event which will BUG (as the irq is unbound). Signed-off-by: David Vrabel <[email protected]> Acked-by: Wei Liu <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-11-21wimax: remove dead codeMichael Opdenacker1-1/+0
This removes a code line that is between a "return 0;" and an error label. This code line can never be reached. Found by Coverity (CID: 1130529) Signed-off-by: Michael Opdenacker <[email protected]> Acked-by: Johannes Berg <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-11-21Merge branch 'for-davem' of ↵David S. Miller17-53/+135
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless John W. Linville says: ==================== pull request: wireless 2013-11-21 Please pull this batch of fixes intended for the 3.13 stream! For the Bluetooth bits, Gustavo says: "A few fixes for 3.13. There is 3 fixes to the RFCOMM protocol. One crash fix to L2CAP. A simple fix to a bad behaviour in the SMP protocol." On top of that... Amitkumar Karwar sends a quintet of mwifiex fixes -- two fixes related to failure handling, two memory leak fixes, and a NULL pointer fix. Felix Fietkau corrects and earlier rt2x00 HT descriptor handling fix to address a crash. Geyslan G. Bem fixes a memory leak in brcmfmac. Larry Finger address more pointer arithmetic errors in rtlwifi. Luis R. Rodriguez provides a regulatory fix in the shared ath code. Sujith Manoharan brings a couple ath9k initialization fixes. Ujjal Roy offers one more mwifiex fix to avoid invalid memory accesses when unloading the USB driver. ==================== Signed-off-by: David S. Miller <[email protected]>
2013-11-21Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nfDavid S. Miller8-16/+29
Pablo Neira Ayuso says: ==================== netfilter fixes for net The following patchset contains fixes for your net tree, they are: * Remove extra quote from connlimit configuration in Kconfig, from Randy Dunlap. * Fix missing mss option in syn packets sent to the backend in our new synproxy target, from Martin Topholm. * Use window scale announced by client when sending the forged syn to the backend, from Martin Topholm. * Fix IPv6 address comparison in ebtables, from Luís Fernando Cornachioni Estrozi. * Fix wrong endianess in sequence adjustment which breaks helpers in NAT configurations, from Phil Oester. * Fix the error path handling of nft_compat, from me. * Make sure the global conntrack counter is decremented after the object has been released, also from me. ==================== Signed-off-by: David S. Miller <[email protected]>
2013-11-21Documentation: filesystems: update btrfs tools sectionDavid Sterba1-16/+6
The tools mentioned have been obsoleted long ago, replace with the current ones. CC: [email protected] Signed-off-by: David Sterba <[email protected]> Signed-off-by: Chris Mason <[email protected]>
2013-11-21Documentation: filesystems: add new btrfs mount optionsDavid Sterba1-1/+11
Two new options were added in 3.12: commit and rescan_uuid_tree CC: [email protected] Signed-off-by: David Sterba <[email protected]> Signed-off-by: Chris Mason <[email protected]>
2013-11-21Merge branch 'master' of ↵John W. Linville17-53/+135
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2013-11-21Merge tag 'asoc-v3.13-5' of ↵Takashi Iwai5-42/+86
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v3.13 A bunch of device specific fixes, nothing with a general impact here.
2013-11-21ACPI / sysfs: Fix incorrect ACPI tables walk in acpi_tables_sysfs_init()Jeremy Compostella1-25/+27
When executing on an ACPI Hardware Reduced hardware, all the ACPI tables are not exposed in sysfs due to the fact that FACS is silently ignored by the kernel in the ACPI hardware reduced mode and, moreover, the acpi_tables_sysfs_init() ACPI table walk is buggy and stops too soon. The acpi_tables_sysfs_init() function should rely on the acpi_status return value from acpi_get_table_by_index() to decide whether or not to stop the iteration (the walk should only be terminated when that value is AE_BAD_PARAMETER). This way, when running in an ACPI Harware Reduced environment (where the FACS table is silently ignored by the kernel) or if some ACPI tables are not correctly memory mapped or have bad checksums, it will still walk through the remaining tables that may be correct. [rjw: Changelog] Signed-off-by: Jeremy Compostella <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2013-11-21ALSA: hda - Add headset quirk for Dell Inspiron 3135David Henningsson1-0/+1
Cc: [email protected] (3.10+) BugLink: https://bugs.launchpad.net/bugs/1253636 Signed-off-by: David Henningsson <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2013-11-21ACPI / sysfs: Set file size for each exposed ACPI tableDaisuke HATAYAMA1-1/+1
Currently, each of the ACPI tables exported from /sys/firmware/acpi/tables is of zero size: $ LANG=C ls -ld /sys/firmware/acpi/tables/* -r-------- 1 root root 0 Nov 19 09:48 /sys/firmware/acpi/tables/APIC -r-------- 1 root root 0 Nov 19 09:48 /sys/firmware/acpi/tables/BOOT -r-------- 1 root root 0 Nov 19 14:25 /sys/firmware/acpi/tables/DSDT -r-------- 1 root root 0 Nov 19 14:25 /sys/firmware/acpi/tables/FACP -r-------- 1 root root 0 Nov 19 14:25 /sys/firmware/acpi/tables/FACS -r-------- 1 root root 0 Nov 19 14:25 /sys/firmware/acpi/tables/MCFG -r-------- 1 root root 0 Nov 19 14:25 /sys/firmware/acpi/tables/SRAT drwxr-xr-x 2 root root 0 Nov 19 09:48 /sys/firmware/acpi/tables/dynamic/ due to which, user-land tools fail reading each table. For example: $ acpidump -f /sys/firmware/acpi/tables/SRAT Could not get input file size: /sys/firmware/acpi/tables/SRAT To deal with the issue, this patch assigns size of each ACPI table to the corresponding sysfs file. $ LANG=C ls -hld /sys/firmware/acpi/tables/* -r-------- 1 root root 94 Nov 19 16:45 /sys/firmware/acpi/tables/APIC -r-------- 1 root root 40 Nov 19 16:45 /sys/firmware/acpi/tables/BOOT -r-------- 1 root root 58K Nov 19 16:55 /sys/firmware/acpi/tables/DSDT -r-------- 1 root root 244 Nov 19 16:55 /sys/firmware/acpi/tables/FACP -r-------- 1 root root 64 Nov 19 16:55 /sys/firmware/acpi/tables/FACS -r-------- 1 root root 60 Nov 19 16:55 /sys/firmware/acpi/tables/MCFG -r-------- 1 root root 168 Nov 19 16:45 /sys/firmware/acpi/tables/SRAT drwxr-xr-x 2 root root 0 Nov 19 16:55 /sys/firmware/acpi/tables/dynamic/ Then, user-land tools work well like: $ acpidump -f /sys/firmware/acpi/tables/SRAT SRAT @ 0x0000000000000000 0000: 53 52 41 54 A8 00 00 00 02 65 56 4D 57 41 52 45 SRAT.....eVMWARE 0010: 4D 45 4D 50 4C 55 47 20 00 00 04 06 56 4D 57 20 MEMPLUG ....VMW 0020: 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 0030: 01 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .(.............. 0040: 00 00 0A 00 00 00 00 00 00 00 00 00 01 00 00 00 ................ 0050: 00 00 00 00 00 00 00 00 01 28 00 00 00 00 00 00 .........(...... 0060: 00 00 10 00 00 00 00 00 00 00 F0 BF 00 00 00 00 ................ 0070: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 0080: 01 28 00 00 00 00 00 00 00 00 00 00 01 00 00 00 .(.............. 0090: 00 00 00 40 00 00 00 00 00 00 00 00 01 00 00 00 ...@............ 00A0: 00 00 00 00 00 00 00 00 ........ Signed-off-by: HATAYAMA Daisuke <[email protected]> Acked-by: Toshi Kani <[email protected]> Acked-by: Zhang Rui <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2013-11-21ACPICA: Update version to 20131115.Bob Moore1-1/+1
Version 20131115. Signed-off-by: Bob Moore <[email protected]> Signed-off-by: Lv Zheng <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2013-11-21ACPICA: Add support to delete all objects attached to the root namespace node.Bob Moore2-8/+16
This fix deletes any and all objects that have been attached to the root node (via acpi_attach_data). Reported by Tomasz Nowicki. ACPICA BZ 1026. Signed-off-by: Bob Moore <[email protected]> Signed-off-by: Lv Zheng <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2013-11-21ACPICA: Delete all attached data objects during namespace node deletion.Tomasz Nowicki1-4/+8
This fix updates namespace node deletion to delete the entire list of attached objects (attached via acpi_attach_data) instead of just one of the attached items. ACPICA BZ 1024. Tomasz Nowicki ([email protected]). Signed-off-by: Tomasz Nowicki <[email protected]> Signed-off-by: Bob Moore <[email protected]> Signed-off-by: Lv Zheng <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2013-11-21ACPICA: Resources: Fix loop termination for the get AML length function.Lv Zheng4-25/+28
The loop terminates on a NULL resource pointer, which can never happen since the loop simply increments a valid resource pointer. This fix changes the loop to terminate on an end-of-buffer condition. Problem can be seen by callers to AcpiSetCurrentResources with an invalid or corrupted resource descriptor; or a resource descriptor without an END_TAG descriptor. (refined by Bob Moore) Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Lv Zheng <[email protected]> Signed-off-by: Bob Moore <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2013-11-21ACPICA: Tests: Add CHECKSUM_ABORT protection for test utilities.Lv Zheng1-0/+2
This patch adds protection around ACPI_CHECKSUM_ABORT so that ACPI user space test utilities can re-define it for their own purposes (currently used by ASLTS build environment). This patch doesn't affect Linux kernel behavior. Lv Zheng. Signed-off-by: Lv Zheng <[email protected]> Signed-off-by: Bob Moore <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2013-11-21ACPICA: Debug output: Do not emit function nesting level for kernel build.Bob Moore1-7/+24
The nesting level is really only useful during a single-thread execution. Therefore, only enable this output for the AcpiExec utility. Also, only emit the thread ID when executing under AcpiExec. (Context switches are still detected and a message is emitted.) ACPICA BZ 972. Signed-off-by: Bob Moore <[email protected]> Signed-off-by: Lv Zheng <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2013-11-21drm/sysfs: fix hotplug regression since lifetime changesDavid Herrmann1-7/+33
airlied: The lifetime changes introduced in 5bdebb183c9702a8c57a01dff09337be3de337a6 tried to use device_create, however that led to the regression where dev->type wasn't getting set correctly. First attempt at fixing it would have led to a race, so this undoes the device_createa work and does it all manually making sure the dev->type is setup before we register the device. Signed-off-by: David Herrmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-21GFS2: fix potential NULL pointer dereferenceMichal Nazarewicz1-1/+2
Commit [e66cf1610: GFS2: Use lockref for glocks] replaced call: atomic_read(&gi->gl->gl_ref) == 0 with: __lockref_is_dead(&gl->gl_lockref) therefore changing how gl is accessed, from gi->gl to plan gl. However, gl can be a NULL pointer, and so gi->gl needs to be used instead (which is guaranteed not to be NULL because fo the while loop checking that condition). Signed-off-by: Michal Nazarewicz <[email protected]> Signed-off-by: Steven Whitehouse <[email protected]>
2013-11-21HID: kye: fix unresponsive keyboardBenjamin Tissoires1-0/+8
The manticore keyboard requires that all usb EP are opened at least once to be fully functional. The third EP forwards to the user space some vendor specific information about the keyboard state, but are useless currently for the kernel. Opening them and closing them makes the keyboard responsive again. Reported-and-tested-by: Adam Kulagowski <[email protected]> Signed-off-by: Benjamin Tissoires <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
2013-11-21HID: kye: Add report fixup for Genius Manticore KeyboardBenjamin Tissoires3-0/+7
Genius Manticore Keyboard presents the same problem in its report descriptors than Genius Gila Gaming Mouse and Genius Imperator Keyboard. Use the same fixup. Reported-and-tested-by: Adam Kulagowski <[email protected]> Signed-off-by: Benjamin Tissoires <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
2013-11-21KVM: kvm_clear_guest_page(): fix empty_zero_page usageHeiko Carstens1-2/+3
Using the address of 'empty_zero_page' as source address in order to clear a page is wrong. On some architectures empty_zero_page is only the pointer to the struct page of the empty_zero_page. Therefore the clear page operation would copy the contents of a couple of struct pages instead of clearing a page. For kvm only arm/arm64 are affected by this bug. To fix this use the ZERO_PAGE macro instead which will return the struct page address of the empty_zero_page on all architectures. Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Gleb Natapov <[email protected]>
2013-11-21HID: multicouh: add PID VID to support 1 new Wistron optical touch deviceKaiChung Cheng3-0/+10
This patch adds PID VID to support for the Wistron Inc. Optical touch panel. Signed-off-by: KaiChung Cheng <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
2013-11-21HID: appleir: force input to be setBenjamin Tissoires1-0/+3
Some weird remotes are not correctly creating the input device. Their report descriptor starts with: 0x06, 0x00, 0xff, // Usage Page (Vendor Defined Page 1) 0 0xa1, 0x01, // Collection (Application) 3 whereas others (which are correctly handled) start with: 0x05, 0x0c, // Usage Page (Consumer Devices) 0 0x09, 0x01, // Usage (Consumer Control) 2 0xa1, 0x01, // Collection (Application) 4 The rest of the report descriptor is the same. Adding the quirk HID_QUIRK_HIDINPUT_FORCE forces hid-input to allocate the inputs, and everything should be ok. Signed-off-by: Benjamin Tissoires <[email protected]> Tested-by: James Henstridge <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
2013-11-21drm/exynos: g2d: fix memory leak to userptrInki Dae1-0/+2
This patch releases a vma object when cleaning up userptr resources. A new vma object was allocated and copied when getting userptr pages so the new vma object should be freed properly if the userptr pages aren't used anymore. Signed-off-by: Inki Dae <[email protected]> Signed-off-by: Kyungmin Park <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-11-21Merge branch 'ttm-fixes-3.13' of git://people.freedesktop.org/~thomash/linux ↵Dave Airlie4-10/+62
into drm-fixes The set_need_resched() removal fix and yet another fix in ttm_bo_move_memcpy(). * 'ttm-fixes-3.13' of git://people.freedesktop.org/~thomash/linux: drm/ttm: Remove set_need_resched from the ttm fault handler drm/ttm: Don't move non-existing data
2013-11-21Merge branch 'vmwgfx-fixes-3.13' of ↵Dave Airlie10-70/+533
git://people.freedesktop.org/~thomash/linux into drm-fixes Below is a fix for a false lockep warning, and the vmwgfx prime implementation. * 'vmwgfx-fixes-3.13' of git://people.freedesktop.org/~thomash/linux: drm/vmwgfx: Make vmwgfx dma buffers prime aware drm/vmwgfx: Make surfaces prime-aware drm/vmwgfx: Hook up the prime ioctls drm/ttm: Add a minimal prime implementation for ttm base objects drm/vmwgfx: Fix false lockdep warning drm/ttm: Allow execbuf util reserves without ticket
2013-11-21Merge tag 'drm-intel-fixes-2013-11-20' of ↵Dave Airlie9-24/+81
git://people.freedesktop.org/~danvet/drm-intel into drm-fixes Just a small pile of fixes for bugs and a few regressions. I'm still trying to track down a driver load hang on my g33 (which infuriatingly doesn't happen when loading the module manually after boot), somehow bisecting loves to go astray on this one :( And there's a (harmless) locking WARN in the suspend code due to one of Jesse's vlv backlight rework patches. Otherwise nothing outstanding afaik. * tag 'drm-intel-fixes-2013-11-20' of git://people.freedesktop.org/~danvet/drm-intel: drm/i915: Fix gen3 self-refresh watermarks drm/i915: Replicate BIOS eDP bpp clamping hack for hsw drm/i915: Do not enable package C8 on unsupported hardware drm/i915: Hold pc8 lock around toggling pc8.gpu_idle drm/i915: encoder->get_config is no longer optional drm/i915/tv: add ->get_config callback drm/i915: restore the early forcewake cleanup Partially revert "drm/i915: tune the RC6 threshold for stability" drm/i915: flush cursors harder i915: Use 120MHz LVDS SSC clock for gen5/gen6/gen7 x86/early quirk: use gen6 stolen detection for VLV drm/i915/dp: set sink to power down mode on dp disable
2013-11-21Merge branch 'drm-next-3.13' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie29-213/+346
into drm-fixes More fixes for radeon. This adds new queries for tiling on CIK, and fixes a crash in handling acpi atif backlight events on CIK. Some fixes for radeon for 3.13. Mostly CI stability fixes. I think I've tracked down the stability problems with dpm on Trinity/Richland, so I'm going to enable that by default now. * 'drm-next-3.13' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: hook up backlight functions for CI and KV family. drm/radeon/cik: Add macrotile mode array query drm/radeon/cik: Return backend map information to userspace drm/radeon: enable DPM by default in TN asics drm/radeon: adjust TN dpm parameters for stability (v2) drm/radeon: use a single doorbell for cik kms compute drm/radeon/vm: don't attempt to update ptes if ib allocation fails drm/radeon: disable CIK CP semaphores for now drm/radeon: allow semaphore emission to fail drm/radeon: add semaphore trace point radeon: workaround pinning failure on low ram gpu radeon/i2c: do not count reg index in number of i2c byte we are writing. drm/radeon: cypress_dpm: Fix unused variable warning when CONFIG_ACPI=n drm: radeon: ni_dpm: Fix unused variable warning when CONFIG_ACPI=n
2013-11-21ALSA: hda - Fix the headphone jack detection on Sony VAIO TXTakashi Iwai1-0/+1
BIOS sets MISC_NO_PRESENCE bit wrongly to the pin config on NID 0x0f. Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2013-11-21ALSA: hda - Fix missing bass speaker on ASUS N550Takashi Iwai1-0/+16
The laptop has a built-in speaker on NID 0x1a. It's an LFE only on the right channel, so we need to provide an explicit chmap, too. There might be other surround speakers, but they can fixed in addition at later point, so let's fix the easier bass speaker at first. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=65091 Signed-off-by: Takashi Iwai <[email protected]>
2013-11-20iscsi-target: chap auth shouldn't match username with trailing garbageEric Seppanen1-1/+4
In iSCSI negotiations with initiator CHAP enabled, usernames with trailing garbage are permitted, because the string comparison only checks the strlen of the configured username. e.g. "usernameXXXXX" will be permitted to match "username". Just check one more byte so the trailing null char is also matched. Signed-off-by: Eric Seppanen <[email protected]> Cc: <[email protected]> #3.1+ Signed-off-by: Nicholas Bellinger <[email protected]>
2013-11-20iscsi-target: fix extract_param to handle buffer length corner caseEric Seppanen1-1/+1
extract_param() is called with max_length set to the total size of the output buffer. It's not safe to allow a parameter length equal to the buffer size as the terminating null would be written one byte past the end of the output buffer. Signed-off-by: Eric Seppanen <[email protected]> Cc: <[email protected]> #3.1+ Signed-off-by: Nicholas Bellinger <[email protected]>
2013-11-20MAINTAINERS - add keyboard driver to Hyper-V file listHaiyang Zhang1-0/+1
Signed-off-by: Haiyang Zhang <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2013-11-20Input: atmel-wm97xx - fix compile errorDmitry Torokhov1-1/+1
Reported-by: Fengguang Wu <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2013-11-20Input: hp_sdc_rtc - unlock on error in hp_sdc_rtc_read_i8042timer()Dan Carpenter1-1/+4
The transaction task here is hp_sdc_tasklet() and it releases the lock. The problem is if we aren't able to queue the transaction then we need to release the lock ourselves. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2013-11-20Input: cyttsp4 - remove unnecessary work pending testXie XiuQi1-2/+1
Remove unnecessary work pending test before calling schedule_work(). It has been tested in queue_work_on() already. Signed-off-by: Xie XiuQi <[email protected]> Reviewed-by: Tejun Heo <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.