aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-07-25usb: gadget: ether: put_usb_function on unbindAndrzej Pietrasiewicz1-4/+10
Fix bugs introduced in 9c62ce83e4258bacc459faf57bf2ed83cce6be08 usb: gadget: ether: convert to new interface of f_ecm 94b5573e97729f0e1496d23b69cbe2c6b24ec0c3 usb: gadget: ether: convert to new interface of f_eem 8af5232d6f48896b151898ccb2e9e155481bb785 usb: gadget: ether: convert to new interface of f_subset 9bd4a10e1bf881af0b0a7c117c7092b558447047 usb: gadget: ether: convert to new interface of f_rndis Acked-by: Michal Nazarewicz <[email protected]> Signed-off-by: Andrzej Pietrasiewicz <[email protected]> Signed-off-by: Kyungmin Park <[email protected]> Signed-off-by: Felipe Balbi <[email protected]>
2013-07-25Merge tag 'for-usb-linus-2013-07-25' of ↵Greg Kroah-Hartman4-7/+14
git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-linus Sarah writes: xhci: Bug fixes, now with more tags! Hi Greg, Here's five bug fixes for 3.12. The three patches are marked for stable. Two fix NULL pointer dereferences. The third marked for stable suppresses some serious log spam from unnecessary xHCI driver warnings, whenever an isochronous short packet happens on an xHCI 1.0 host. The other two patches fix build warnings. Sarah Sharp
2013-07-25xfs: di_flushiter considered harmfulDave Chinner3-11/+36
When we made all inode updates transactional, we no longer needed the log recovery detection for inodes being newer on disk than the transaction being replayed - it was redundant as replay of the log would always result in the latest version of the inode would be on disk. It was redundant, but left in place because it wasn't considered to be a problem. However, with the new "don't read inodes on create" optimisation, flushiter has come back to bite us. Essentially, the optimisation made always initialises flushiter to zero in the create transaction, and so if we then crash and run recovery and the inode already on disk has a non-zero flushiter it will skip recovery of that inode. As a result, log recovery does the wrong thing and we end up with a corrupt filesystem. Because we have to support old kernel to new kernel upgrades, we can't just get rid of the flushiter support in log recovery as we might be upgrading from a kernel that doesn't have fully transactional inode updates. Unfortunately, for v4 superblocks there is no way to guarantee that log recovery knows about this fact. We cannot add a new inode format flag to say it's a "special inode create" because it won't be understood by older kernels and so recovery could do the wrong thing on downgrade. We cannot specially detect the combination of zero mode/non-zero flushiter on disk to non-zero mode, zero flushiter in the log item during recovery because wrapping of the flushiter can result in false detection. Hence that makes this "don't use flushiter" optimisation limited to a disk format that guarantees that we don't need it. And that means the only fix here is to limit the "no read IO on create" optimisation to version 5 superblocks.... Reported-by: Markus Trippelsdorf <[email protected]> Signed-off-by: Dave Chinner <[email protected]> Reviewed-by: Mark Tinguely <[email protected]> Signed-off-by: Ben Myers <[email protected]> (cherry picked from commit e60896d8f2b81412421953e14d3feb14177edb56)
2013-07-25pinctrl: fix a memleak when freeing mapsLinus Walleij1-0/+1
We forgot to free the node itself when free:ing a map. Reported-by: xulinuxkernel <[email protected]> Reviewed-by: Stephen Warren <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2013-07-25xhci: fix null pointer dereference on ring_doorbell_for_active_ringsOleksij Rempel1-1/+1
in some cases where device is attched to xhci port and do not responding, for example ath9k_htc with stalled firmware, kernel will crash on ring_doorbell_for_active_rings. This patch check if pointer exist before it is used. This patch should be backported to kernels as old as 2.6.35, that contain the commit e9df17eb1408cfafa3d1844bfc7f22c7237b31b8 "USB: xhci: Correct assumptions about number of rings per endpoint" Signed-off-by: Oleksij Rempel <[email protected]> Signed-off-by: Sarah Sharp <[email protected]> Cc: [email protected]
2013-07-25usb: host: xhci: Enable XHCI_SPURIOUS_SUCCESS for all controllers with xhci 1.0George Cherian2-1/+7
Xhci controllers with hci_version > 0.96 gives spurious success events on short packet completion. During webcam capture the "ERROR Transfer event TRB DMA ptr not part of current TD" was observed. The same application works fine with synopsis controllers hci_version 0.96. The same issue is seen with Intel Pantherpoint xhci controller. So enabling this quirk in xhci_gen_setup if controller verion is greater than 0.96. For xhci-pci move the quirk to much generic place xhci_gen_setup. Note from Sarah: The xHCI 1.0 spec changed how hardware handles short packets. The HW will notify SW of the TRB where the short packet occurred, and it will also give a successful status for the last TRB in a TD (the one with the IOC flag set). On the second successful status, that warning will be triggered in the driver. Software is now supposed to not assume the TD is not completed until it gets that last successful status. That means we have a slight race condition, although it should have little practical impact. This patch papers over that issue. It's on my long-term to-do list to fix this race condition, but it is a much more involved patch that will probably be too big for stable. This patch is needed for stable to avoid serious log spam. This patch should be backported to kernels as old as 3.0, that contain the commit ad808333d8201d53075a11bc8dd83b81f3d68f0b "Intel xhci: Ignore spurious successful event." The patch will have to be modified for kernels older than 3.2, since that kernel added the xhci_gen_setup function for xhci platform devices. The correct conflict resolution for kernels older than 3.2 is to set XHCI_SPURIOUS_SUCCESS in xhci_pci_quirks for all xHCI 1.0 hosts. Signed-off-by: George Cherian <[email protected]> Signed-off-by: Sarah Sharp <[email protected]> Cc: [email protected]
2013-07-25usb: fix build warning in pci-quirks.h when CONFIG_PCI is not enabledRandy Dunlap1-0/+1
Fix warning when CONFIG_PCI is not enabled (from commit 296365781903226a3fb8758901eaeec09d2798e4). drivers/usb/host/pci-quirks.h: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default] Signed-off-by: Randy Dunlap <[email protected]> Reported-by: Geert Uytterhoeven <[email protected]> Cc: Moiz Sonasath <[email protected]> Signed-off-by: Sarah Sharp <[email protected]>
2013-07-25usb: xhci: Mark two functions __maybe_unusedOlof Johansson1-2/+2
Resolves the following build warnings: drivers/usb/host/xhci.c:332:13: warning: 'xhci_msix_sync_irqs' defined but not used [-Wunused-function] drivers/usb/host/xhci.c:3901:12: warning: 'xhci_change_max_exit_latency' defined but not used [-Wunused-function] These functions are not always used, and since they're marked static they will produce build warnings: - xhci_msix_sync_irqs is only used with CONFIG_PCI. - xhci_change_max_exit_latency is a little more complicated with dependencies on CONFIG_PM and CONFIG_PM_RUNTIME. Instead of building a bigger maze of ifdefs in this code, I've just marked both with __maybe_unused. Signed-off-by: Olof Johansson <[email protected]> Signed-off-by: Sarah Sharp <[email protected]>
2013-07-25xhci: Avoid NULL pointer deref when host dies.Sarah Sharp1-3/+3
When the host controller fails to respond to an Enable Slot command, and the host fails to respond to the register write to abort the command ring, the xHCI driver will assume the host is dead, and call usb_hc_died(). The USB device's slot_id is still set to zero, and the pointer stored at xhci->devs[0] will always be NULL. The call to xhci_check_args in xhci_free_dev should have caught the NULL virt_dev pointer. However, xhci_free_dev is designed to free the xhci_virt_device structures, even if the host is dead, so that we don't leak kernel memory. xhci_free_dev checks the return value from the generic xhci_check_args function. If the return value is -ENODEV, it carries on trying to free the virtual device. The issue is that xhci_check_args looks at the host controller state before it looks at the xhci_virt_device pointer. It will return -ENIVAL because the host is dead, and xhci_free_dev will ignore the return value, and happily dereference the NULL xhci_virt_device pointer. The fix is to make sure that xhci_check_args checks the xhci_virt_device pointer before it checks the host state. See https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1203453 for further details. This patch doesn't solve the underlying issue, but will ensure we don't see any more NULL pointer dereferences because of the issue. This patch should be backported to kernels as old as 3.1, that contain the commit 7bd89b4017f46a9b92853940fd9771319acb578a "xhci: Don't submit commands or URBs to halted hosts." Signed-off-by: Sarah Sharp <[email protected]> Reported-by: Vincent Thiele <[email protected]> Cc: [email protected]
2013-07-25drm/i915: initialize gt_lock early with other spin locksJani Nikula2-2/+1
commit 181d1b9e31c668259d3798c521672afb8edd355c Author: Daniel Vetter <[email protected]> Date: Sun Jul 21 13:16:24 2013 +0200 drm/i915: fix up gt init sequence fallout moved dev_priv->gt_lock initialization after use. Do the initialization much earlier with other spin lock initializations. Reported-by: Sedat Dilek <[email protected]> Signed-off-by: Jani Nikula <[email protected]> Tested-by: Sedat Dilek <[email protected]> Cc: [email protected] (since the regressing patch is also cc: stable) Signed-off-by: Daniel Vetter <[email protected]>
2013-07-25regulatory: use correct regulatory initiator on wiphy registerArik Nemtsov1-1/+4
The current regdomain was not always set by the core. This causes cards with a custom regulatory domain to ignore user initiated changes if done before the card was registered. Signed-off-by: Arik Nemtsov <[email protected]> Acked-by: Luis R. Rodriguez <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2013-07-25Merge branch 'for-davem' of ↵David S. Miller24-87/+184
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless John W. Linville says: ==================== This is another batch of fixes intended for the 3.11 stream. FWIW, this is the first request with fixes from the mac80211 and iwlwifi trees as well. Regarding the mac80211 bits, Johannes says: "Here I have a fix for RSSI thresholds in mesh, two minstrel fixes from Felix, an nl80211 fix from Michal and four various fixes I did myself." As for the iwlwifi bits, Johannes says: "Here I have a fix for debugfs directory creation (causing a spurious error message), two scanning fixes from David Spinadel, an LED fix and two patches related to a BA session problem that eventually caused firmware crashes from Emmanuel and a small BT fix for older devices as well as a workaround for a firmware problem with APs with very small beacon intervals from myself." Along with those: Arend van Spriel addresses a lock-up and a NULL pointer dereference in brcmfmac. Daniel Drake fixes an unhandled interrupt during device tear down in mwifiex. Larry Finger corrects a wil6210 build error. Oleksij Rempel fixes two ath9k_htc problems related to keeping the driver and firmware in sync. Solomon Peachy gives us a cw1200 fix to avoid an oops in monitor mode. ==================== Signed-off-by: David S. Miller <[email protected]>
2013-07-25md/raid5: fix interaction of 'replace' and 'recovery'.NeilBrown2-5/+11
If a device in a RAID4/5/6 is being replaced while another is being recovered, then the writes to the replacement device currently don't happen, resulting in corruption when the replacement completes and the new drive takes over. This is because the replacement writes are only triggered when 's.replacing' is set and not when the similar 's.sync' is set (which is the case during resync and recovery - it means all devices need to be read). So schedule those writes when s.replacing is set as well. In this case we cannot use "STRIPE_INSYNC" to record that the replacement has happened as that is needed for recording that any parity calculation is complete. So introduce STRIPE_REPLACED to record if the replacement has happened. For safety we should also check that STRIPE_COMPUTE_RUN is not set. This has a similar effect to the "s.locked == 0" test. The latter ensure that now IO has been flagged but not started. The former checks if any parity calculation has been flagged by not started. We must wait for both of these to complete before triggering the 'replace'. Add a similar test to the subsequent check for "are we finished yet". This possibly isn't needed (is subsumed in the STRIPE_INSYNC test), but it makes it more obvious that the REPLACE will happen before we think we are finished. Finally if a NeedReplace device is not UPTODATE then that is an error. We really must trigger a warning. This bug was introduced in commit 9a3e1101b827a59ac9036a672f5fa8d5279d0fe2 (md/raid5: detect and handle replacements during recovery.) which introduced replacement for raid5. That was in 3.3-rc3, so any stable kernel since then would benefit from this fix. Cc: [email protected] (3.3+) Reported-by: qindehua <[email protected]> Tested-by: qindehua <[email protected]> Signed-off-by: NeilBrown <[email protected]>
2013-07-25md/raid10: remove use-after-free bug.NeilBrown1-1/+7
We always need to be careful when calling generic_make_request, as it can start a chain of events which might free something that we are using. Here is one place I wasn't careful enough. If the wbio2 is not in use, then it might get freed at the first generic_make_request call. So perform all necessary tests first. This bug was introduced in 3.3-rc3 (24afd80d99) and can cause an oops, so fix is suitable for any -stable since then. Cc: [email protected] (3.3+) Signed-off-by: NeilBrown <[email protected]>
2013-07-24HOWTO ja_JP syncTsugikazu Shibata1-22/+22
Attached is Documentation/ja_JP/HOWTO sync patch for 3.10. This patch was reviewed by Japanese translation community called JF. Signed-off-by: Tsugikazu Shibata <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-07-24usb: serial: option: Add ONYX 3G device supportEnrico Mioso1-0/+1
This patch adds support for the ONYX 3G device (version 1) from ALFA NETWORK. Signed-off-by: Enrico Mioso <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-07-24net: fix comment above build_skb()Florian Fainelli1-1/+2
build_skb() specifies that the data parameter must come from a kmalloc'd area, this is only true if frag_size equals 0, because then build_skb() will use kzsize(data) to figure out the actual data size. Update the comment to reflect that special condition. Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-07-24Merge tag 'samsung-fixes-1' of ↵Olof Johansson15-109/+136
git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes From Kukjin Kim: Samsung fixes for v3.11 - fix kernel booting on exynos5440 skip pm which is not supported update regarding LPAE features - fix s3c2440 uart with adding clkdev entries - fix compilatioin for Samsung SoCs with selecting pm - update ARCH_NR_GPIO to support exynos4412 has more gpios * tag 'samsung-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: EXYNOS: Update CONFIG_ARCH_NR_GPIO for Exynos ARM: EXYNOS: Fix low level debug support ARM: SAMSUNG: Save/restore only selected uart's registers ARM: SAMSUNG: Add SAMSUNG_PM config option to select pm ARM: S3C24XX: Add missing clkdev entries for s3c2440 UART ARM: EXYNOS: Enable 64-bit DMA for EXYNOS5440 if LPAE is enabled ARM: EXYNOS: change the PHYSMEM_BITS and SECTION_SIZE ARM: EXYNOS: skip pm support on exynos5440 Signed-off-by: Olof Johansson <[email protected]>
2013-07-24ARM: omap5: Only select errata 798181 if SMPOlof Johansson1-1/+1
Avoids the following warning when SMP is off: warning: (ARCH_KEYSTONE && SOC_OMAP5) selects ARM_ERRATA_798181 which has unmet direct dependencies (CPU_V7 && SMP) Reported-by: Emilio López <[email protected]> Cc: Tony Lindgren <[email protected]> Cc: Santosh Shilimkar <[email protected]> Signed-off-by: Olof Johansson <[email protected]>
2013-07-24net: sun4i: fix timeout checkEmilio López1-8/+6
The current timeout check is comparing two constant values, so it won't ever detect a timeout. This patch reworks the affected code a bit so it has a chance at detecting timeouts correctly. Signed-off-by: Emilio López <[email protected]> Acked-by: Maxime Ripard <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-07-24ipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanupHannes Frederic Sowa1-0/+5
Otherwise we end up dereferencing the already freed net->ipv6.mrt pointer which leads to a panic (from Srivatsa S. Bhat): BUG: unable to handle kernel paging request at ffff882018552020 IP: [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6] PGD 290a067 PUD 207ffe0067 PMD 207ff1d067 PTE 8000002018552060 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC Modules linked in: ebtable_nat ebtables nfs fscache nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables nfsd lockd nfs_acl exportfs auth_rpcgss autofs4 sunrpc 8021q garp bridge stp llc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter +ip6_tables ipv6 vfat fat vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support cdc_ether usbnet mii microcode i2c_i801 i2c_core lpc_ich mfd_core shpchp ioatdma dca mlx4_core be2net wmi acpi_cpufreq mperf ext4 jbd2 mbcache dm_mirror dm_region_hash dm_log dm_mod CPU: 0 PID: 7 Comm: kworker/u33:0 Not tainted 3.11.0-rc1-ea45e-a #4 Hardware name: IBM -[8737R2A]-/00Y2738, BIOS -[B2E120RUS-1.20]- 11/30/2012 Workqueue: netns cleanup_net task: ffff8810393641c0 ti: ffff881039366000 task.ti: ffff881039366000 RIP: 0010:[<ffffffffa0366b02>] [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6] RSP: 0018:ffff881039367bd8 EFLAGS: 00010286 RAX: ffff881039367fd8 RBX: ffff882018552000 RCX: dead000000200200 RDX: 0000000000000000 RSI: ffff881039367b68 RDI: ffff881039367b68 RBP: ffff881039367bf8 R08: ffff881039367b68 R09: 2222222222222222 R10: 2222222222222222 R11: 2222222222222222 R12: ffff882015a7a040 R13: ffff882014eb89c0 R14: ffff8820289e2800 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88103fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff882018552020 CR3: 0000000001c0b000 CR4: 00000000000407f0 Stack: ffff881039367c18 ffff882014eb89c0 ffff882015e28c00 0000000000000000 ffff881039367c18 ffffffffa034d9d1 ffff8820289e2800 ffff882014eb89c0 ffff881039367c58 ffffffff815bdecb ffffffff815bddf2 ffff882014eb89c0 Call Trace: [<ffffffffa034d9d1>] rawv6_close+0x21/0x40 [ipv6] [<ffffffff815bdecb>] inet_release+0xfb/0x220 [<ffffffff815bddf2>] ? inet_release+0x22/0x220 [<ffffffffa032686f>] inet6_release+0x3f/0x50 [ipv6] [<ffffffff8151c1d9>] sock_release+0x29/0xa0 [<ffffffff81525520>] sk_release_kernel+0x30/0x70 [<ffffffffa034f14b>] icmpv6_sk_exit+0x3b/0x80 [ipv6] [<ffffffff8152fff9>] ops_exit_list+0x39/0x60 [<ffffffff815306fb>] cleanup_net+0xfb/0x1a0 [<ffffffff81075e3a>] process_one_work+0x1da/0x610 [<ffffffff81075dc9>] ? process_one_work+0x169/0x610 [<ffffffff81076390>] worker_thread+0x120/0x3a0 [<ffffffff81076270>] ? process_one_work+0x610/0x610 [<ffffffff8107da2e>] kthread+0xee/0x100 [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70 [<ffffffff8162a99c>] ret_from_fork+0x7c/0xb0 [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70 Code: 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 66 66 66 66 90 4c 8b 67 30 49 89 fd e8 db 3c 1e e1 49 8b 9c 24 90 08 00 00 48 85 db 74 06 <4c> 39 6b 20 74 20 bb f3 ff ff ff e8 8e 3c 1e e1 89 d8 4c 8b 65 RIP [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6] RSP <ffff881039367bd8> CR2: ffff882018552020 Reported-by: Srivatsa S. Bhat <[email protected]> Tested-by: Srivatsa S. Bhat <[email protected]> Signed-off-by: Hannes Frederic Sowa <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-07-24fib_trie: potential out of bounds access in trie_show_stats()Jerry Snitselaar1-1/+1
With the <= max condition in the for loop, it will be always go 1 element further than needed. If the condition for the while loop is never met, then max is MAX_STAT_DEPTH, and for loop will walk off the end of nodesizes[]. Signed-off-by: Jerry Snitselaar <[email protected]> Acked-by: Hannes Frederic Sowa <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-07-24USB: ti_usb_3410_5052: fix dynamic-id matchingJohan Hovold1-1/+1
The driver failed to take the dynamic ids into account when determining the device type and therefore all devices were detected as 2-port devices when using the dynamic-id interface. Match on the usb-serial-driver field instead of doing redundant id-table searches. Reported-by: Anders Hammarquist <[email protected]> Cc: stable <[email protected]> Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-07-24mlx5: use after free in mlx5_cmd_comp_handler()Dan Carpenter1-4/+7
We can't dereference "ent" after passing it to free_cmd(). Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-07-24r8169: fix lockdep warning when removing interfaceLekensteyn1-2/+2
The work queue is initialised in rtl_open (when the interface goes up), but canceled in rtl_remove_one (when the PCI device gets removed). If the network interface is not brought up, then the work queue struct is not initialised. When the device is removed, the attempt to cancel the uninitialised work queue causes a lockdep warning. This patch fixes the issue by moving cancel_work_sync to rtl_close (to match rtl_open). (Note that rtl_close is also called via unregister_netdev in rtl_remove_one.) Signed-off-by: Peter Wu <[email protected]> Acked-by: Francois Romieu <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-07-24serial: tegra: correct help message in Kconfig from 'ttyHS' to 'ttyTHS'Richard Zhao1-1/+1
ttyTHS is consistent with the name used in driver. Signed-off-by: Richard Zhao <[email protected]> Acked-by: Stephen Warren <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-07-24tty/8250_early: Don't truncate last character of optionsHenrik Nordström1-1/+2
The earlier change to use strlcpy uncovered a bug in the options argument length calculation causing last character to be truncated. This makes the actual console to be configured with incorrect baudrate when specifying the console using console=uart,... syntax. Bug symptom seen in kernel log output: Kernel command line: console=uart,mmio,0x90000000,115200 Early serial console at MMIO 0x90000000 (options '11520') which then results in a invalid baud rate 11520 instead of the expected 115200 when the console is switched to ttyS0 later in the boot process. Signed-off-by: Henrik Nordstrom <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-07-24TTY: snyclinkmp: calculating wrong addressesDan Carpenter1-1/+1
This is a static checker fix and I don't have a way to test it. But from the context it looks like this is a typo where SCABUFSIZE was intended instead of sizeof(SCABUFSIZE). SCABUFSIZE is 1024 and sizeof(int) is 4. I would suspect this is a bad bug. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-07-24[SCSI] isci: fix breakage caused by >16byte CDB patchJames Bottomley1-1/+1
Oops, apparently no-one I cc'd at intel actually bothered to check this patch for the isci driver: commit e73823f7a2c921dcf068d34ea03bd682498d9e42 Author: James Bottomley <[email protected]> Date: Tue May 7 15:38:18 2013 -0700 [SCSI] libsas: implement > 16 byte CDB support sci_swab32_cpy needs multiples of four, so for commands that aren't that, it's rounding the wrong way. fix by doing (len+3)/4 instead of len/4. Reported-by: Tony Luck <[email protected]> Tested-by: Tony Luck <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2013-07-24Merge branch 'merge' of ↵Linus Torvalds26-169/+390
git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc Pull powerpc fixes from Ben Herrenschmidt: "Here is a series of powerpc fixes. It's a bit big, mostly because of the series of 11 "EEH" patches from Gavin. The EEH (Our IBM specific PCI/PCIe Enhanced Error Handling) code had been rotting for a while and this merge window saw a significant rework & fixing of it by Gavin Shan. However, that wasn't complete and left some open issues. There were still a few corner cases that didn't work properly, for example in relation to hotplug and devices without explicit error handlers. We had some patches but they weren't quite good enough yet so I left them off the 3.11 merge window. Gavin since then fixed it all up, we ran quite a few rounds of testing and it seems fairly solid (at least probably more than it has ever been). This should probably have made -rc1 but both Gavin and I took some vacation so it had to wait for -rc2. The rest is more bug fixes, mostly to new features recently added, for example, we missed the cpu table entry for one of the two models of P8 (we didn't realize they had different PVR [Processor Version Register] values), some module CRC issues, etc..." * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: (23 commits) powerpc/perf: BHRB filter configuration should follow the task powerpc/perf: Ignore separate BHRB privilege state filter request powerpc/powernv: Mark pnv_pci_init_ioda2_phb() as __init powerpc/mm: Use the correct SLB(LLP) encoding in tlbie instruction powerpc/mm: Fix fallthrough bug in hpte_decode powerpc/pseries: Fix a typo in pSeries_lpar_hpte_insert() powerpc/eeh: Introdce flag to protect sysfs powerpc/eeh: Fix unbalanced enable for IRQ powerpc/eeh: Don't use pci_dev during BAR restore powerpc/eeh: Use partial hotplug for EEH unaware drivers powerpc/pci: Partial tree hotplug support powerpc/eeh: Use safe list traversal when walking EEH devices powerpc/eeh: Keep PE during hotplug powerpc/pci/hotplug: Don't need to remove from EEH cache twice powerpc/pci: Override pcibios_release_device() powerpc/eeh: Export functions for hotplug powerpc/eeh: Remove reference to PCI device powerpc: Fix the corrupt r3 error during MCE handling. powerpc/perf: Set PPC_FEATURE2_EBB when we register the power8 PMU powerpc/pseries: Drop "select HOTPLUG" ...
2013-07-24Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds13-1082/+44
Pull crypto fixes from Herbert Xu: "This push fixes a memory corruption issue in caam, as well as reverting the new optimised crct10dif implementation as it breaks boot on initrd systems. Hopefully crct10dif will be reinstated once the supporting code is added so that it doesn't break boot" * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: Revert "crypto: crct10dif - Wrap crc_t10dif function all to use crypto transform framework" crypto: caam - Fixed the memory out of bound overwrite issue
2013-07-24MAINTAINERS: Update the list of maintainers for staging/comedi driver.Lidza Louina2-2/+2
This patch updates the list of maintainers for the staging/comedi driver. Signed-off-by: Lidza Louina <[email protected]> Acked-by: H Hartley Sweeten <[email protected]> Acked-by: Ian Abbott <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-07-24staging: tidspbridge: replace strict_strtol() with kstrtos32()Jingoo Han1-2/+5
The usage of strict_strtol() is not preferred, because strict_strtol() is obsolete. Thus, kstrtos32() should be used in order to convert a string to s32. Also, error handling is added to get rid of a __must_check warning. This fixes a memory corruption bug as well. Signed-off-by: Jingoo Han <[email protected]> Reviewed-by: Dan Carpenter <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-07-24ahci_imx: add ahci sata support on imx platformsRichard Zhu3-0/+246
imx6q contains one Synopsys AHCI SATA controller, But it can't share ahci_platform driver with other controllers because there are some misalignments of the generic AHCI controller - the bits definitions of the HBA registers, the Vendor Specific registers, the AHCI PHY clock and the AHCI signals adjustment window(GPR13 register). - CAP_SSS(bit20) of the HOST_CAP is writable, default value is '0', should be configured to be '1' - bit0 (only one AHCI SATA port on imx6q) of the HOST_PORTS_IMPL should be set to be '1'.(default 0) - One Vendor Specific register HOST_TIMER1MS(offset:0xe0) should be configured regarding to the frequency of AHB bus clock. - Configurations of the AHCI PHY clock, and the signal parameters of the GPR13 Setup its own ahci sata driver, contained the imx6q specific initialized codes, re-use the generic ahci_platform driver, and keep the generic ahci_platform driver clean as much as possible. tj: patch description reformatted Signed-off-by: Richard Zhu <[email protected]> Reviewed-by: Shawn Guo <[email protected]> Signed-off-by: Tejun Heo <[email protected]>
2013-07-24ARM: imx6q: update the sata bits definitions of gpr13Richard Zhu1-37/+84
Replace the SATA_PHY_# by the more readable definitons. tj: Being routed through libata branch to enable implementation of ahci_imx. Signed-off-by: Richard Zhu <[email protected]> Acked-by: Shawn Guo <[email protected]> Signed-off-by: Tejun Heo <[email protected]>
2013-07-24Merge branch 'master' of ↵John W. Linville24-87/+184
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2013-07-24ftrace: Add check for NULL regs if ops has SAVE_REGS setSteven Rostedt (Red Hat)1-4/+14
If a ftrace ops is registered with the SAVE_REGS flag set, and there's already a ops registered to one of its functions but without the SAVE_REGS flag, there's a small race window where the SAVE_REGS ops gets added to the list of callbacks to call for that function before the callback trampoline gets set to save the regs. The problem is, the function is not currently saving regs, which opens a small race window where the ops that is expecting regs to be passed to it, wont. This can cause a crash if the callback were to reference the regs, as the SAVE_REGS guarantees that regs will be set. To fix this, we add a check in the loop case where it checks if the ops has the SAVE_REGS flag set, and if so, it will ignore it if regs is not set. Signed-off-by: Steven Rostedt <[email protected]>
2013-07-24tracing: Kill trace_cpu struct/membersOleg Nesterov2-29/+0
After the previous changes trace_array_cpu->trace_cpu and trace_array->trace_cpu becomes write-only. Remove these members and kill "struct trace_cpu" as well. As a side effect this also removes memset(per_cpu_memory, 0). It was not needed, alloc_percpu() returns zero-filled memory. Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Oleg Nesterov <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>
2013-07-24tracing: Change tracing_fops/snapshot_fops to rely on tracing_get_cpu()Oleg Nesterov1-28/+22
tracing_open() and tracing_snapshot_open() are racy, the memory inode->i_private points to can be already freed. Convert these last users of "inode->i_private == trace_cpu" to use "i_private = trace_array" and rely on tracing_get_cpu(). v2: incorporate the fix from Steven, tracing_release() must not blindly dereference file->private_data unless we know that the file was opened for reading. Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Oleg Nesterov <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>
2013-07-24tracing: Change tracing_entries_fops to rely on tracing_get_cpu()Oleg Nesterov1-37/+12
tracing_open_generic_tc() is racy, the memory inode->i_private points to can be already freed. 1. Change its last user, tracing_entries_fops, to use tracing_*_generic_tr() instead. 2. Change debugfs_create_file("buffer_size_kb", data) callers to pass "data = tr". 3. Change tracing_entries_read() and tracing_entries_write() to use tracing_get_cpu(). 4. Kill the no longer used tracing_open_generic_tc() and tracing_release_generic_tc(). Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Oleg Nesterov <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>
2013-07-24tracing: Change tracing_stats_fops to rely on tracing_get_cpu()Oleg Nesterov1-7/+6
tracing_open_generic_tc() is racy, the memory inode->i_private points to can be already freed. 1. Change one of its users, tracing_stats_fops, to use tracing_*_generic_tr() instead. 2. Change trace_create_cpu_file("stats", data) to pass "data = tr". 3. Change tracing_stats_read() to use tracing_get_cpu(). Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Oleg Nesterov <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>
2013-07-24tracing: Change tracing_buffers_fops to rely on tracing_get_cpu()Oleg Nesterov1-5/+4
tracing_buffers_open() is racy, the memory inode->i_private points to can be already freed. Change debugfs_create_file("trace_pipe_raw", data) caller to pass "data = tr", tracing_buffers_open() can use tracing_get_cpu(). Change debugfs_create_file("snapshot_raw_fops", data) caller too, this file uses tracing_buffers_open/release. Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Oleg Nesterov <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>
2013-07-24tracing: Change tracing_pipe_fops() to rely on tracing_get_cpu()Oleg Nesterov1-9/+7
tracing_open_pipe() is racy, the memory inode->i_private points to can be already freed. Change debugfs_create_file("trace_pipe", data) callers to to pass "data = tr", tracing_open_pipe() can use tracing_get_cpu(). Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Oleg Nesterov <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>
2013-07-24tracing: Introduce trace_create_cpu_file() and tracing_get_cpu()Oleg Nesterov1-14/+36
Every "file_operations" used by tracing_init_debugfs_percpu is buggy. f_op->open/etc does: 1. struct trace_cpu *tc = inode->i_private; struct trace_array *tr = tc->tr; 2. trace_array_get(tr) or fail; 3. do_something(tc); But tc (and tr) can be already freed before trace_array_get() is called. And it doesn't matter whether this file is per-cpu or it was created by init_tracer_debugfs(), free_percpu() or kfree() are equally bad. Note that even 1. is not safe, the freed memory can be unmapped. But even if it was safe trace_array_get() can wrongly succeed if we also race with the next new_instance_create() which can re-allocate the same tr, or tc was overwritten and ->tr points to the valid tr. In this case 3. uses the freed/reused memory. Add the new trivial helper, trace_create_cpu_file() which simply calls trace_create_file() and encodes "cpu" in "struct inode". Another helper, tracing_get_cpu() will be used to read cpu_nr-or-RING_BUFFER_ALL_CPUS. The patch abuses ->i_cdev to encode the number, it is never used unless the file is S_ISCHR(). But we could use something else, say, i_bytes or even ->d_fsdata. In any case this hack is hidden inside these 2 helpers, it would be trivial to change them if needed. This patch only changes tracing_init_debugfs_percpu() to use the new trace_create_cpu_file(), the next patches will change file_operations. Note: tracing_get_cpu(inode) is always safe but you can't trust the result unless trace_array_get() was called, without trace_types_lock which acts as a barrier it can wrongly return RING_BUFFER_ALL_CPUS. Link: http://lkml.kernel.org/r/[email protected] Cc: Al Viro <[email protected]> Signed-off-by: Oleg Nesterov <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>
2013-07-24ARM: EXYNOS: Update CONFIG_ARCH_NR_GPIO for ExynosSachin Kamat1-2/+1
With the recent cleanup in Exynos platform code notably commits 17859bec ("ARM: EXYNOS: Do not select legacy Kconfig symbols any more") and b9222210 ("ARM: EXYNOS: Remove mach/gpio.h"), the definition of ARCH_NR_GPIOS got removed. This started causing problems on SoCs like Exynos4412 which have more than the default number of GPIOs. Thus define this number in KConfig file which takes care of current SoC requirements and provides scope for GPIO expanders. Without this patch we get the following errors during boot: gpiochip_add: gpios 251..258 (gpv0) failed to register samsung-pinctrl 106e0000.pinctrl: failed to register gpio_chip gpv0, error code: -22 samsung-pinctrl: probe of 106e0000.pinctrl failed with error -22 Signed-off-by: Sachin Kamat <[email protected]> Cc: Tomasz Figa <[email protected]> Signed-off-by: Kukjin Kim <[email protected]>
2013-07-24Merge tag 'asoc-v3.11-rc2' of ↵Takashi Iwai645-93788/+3498
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v3.11 A few small updates again, the sgtl5000 one fixes some newly triggered issues due to some probe ordering changes which were introduced in the last merge window.
2013-07-24ALSA: hiface: return correct XRUN indicationEldad Zack1-1/+1
Return SNDRV_PCM_POS_XRUN (snd_pcm_uframes_t) instead of SNDRV_PCM_STATE_XRUN (snd_pcm_state_t) from the pointer function of hiface, as expected by snd_pcm_update_hw_ptr0(). Caught by sparse. Cc: Antonio Ospite <[email protected]> Signed-off-by: Eldad Zack <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2013-07-24ARM: EXYNOS: Fix low level debug supportYadwinder Singh Brar1-26/+0
Presently, using exynos_defconfig with CONFIG_DEBUG_LL and CONFIG_EARLY_PRIN on, kernel is not booting, we are getting following: [ 0.000000] ------------[ cut here ]------------ [ 0.000000] kernel BUG at mm/vmalloc.c:1134! [ 0.000000] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 3.11.0-rc1 #633 [ 0.000000] task: c052ec48 ti: c0524000 task.ti: c0524000 [ 0.000000] PC is at vm_area_add_early+0x54/0x94 [ 0.000000] LR is at add_static_vm_early+0xc/0x60 Its because exynos[4/5]_map_io() function ioremaps a single 512KB memory size for all the four uart ports which envelopes the mapping created by debug_ll_io_init(), called earlier in exynos_init_io(). This patch removes iodesc entries for UART controller for all Samsung SoC's, since now the Samsung uart driver does a ioremap during probe and any needed iomapping for earlyprintk will be handled by debug_ll_io_init(). Tested on smdk4412 and smdk5250. Signed-off-by: Yadwinder Singh Brar <[email protected]> Signed-off-by: Kukjin Kim <[email protected]>
2013-07-24ARM: SAMSUNG: Save/restore only selected uart's registersYadwinder Singh Brar1-11/+3
Basically this code gets executed only during debugging i.e when DEBUG_LL & SAMSUNG_PM_DEBUG is on, so required only for UART used for debugging. Since we are removing static iodesc entries for UARTs, so now only the selected (CONFIG_DEBUG_S3C_UART) UART will be ioremapped by the debug_ll_io_init() for DEBUG_LL, so save/restore uart registers only for selected uart. Signed-off-by: Yadwinder Singh Brar <[email protected]> Signed-off-by: Kukjin Kim <[email protected]>
2013-07-24iwlwifi: mvm: set SSID bits for passive channelsDavid Spinadel2-10/+2
Set SSID bitmap for direct scan even on passive channels, for the passive-to-active feature. Without this patch only the SSID from probe request template is sent on passive channels, after passive-to-active switching, causing us to not find all desired networks. Remove the unused passive scan mask constant. Cc: [email protected] Reviewed-by: Emmanuel Grumbach <[email protected]> Signed-off-by: David Spinadel <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.