aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-09-27NFS: Use i_writecount to control whether to get an fscache cookie in nfs_open()David Howells7-160/+79
Use i_writecount to control whether to get an fscache cookie in nfs_open() as NFS does not do write caching yet. I *think* this is the cause of a problem encountered by Mark Moseley whereby __fscache_uncache_page() gets a NULL pointer dereference because cookie->def is NULL: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [<ffffffff812a1903>] __fscache_uncache_page+0x23/0x160 PGD 0 Thread overran stack, or stack corrupted Oops: 0000 [#1] SMP Modules linked in: ... CPU: 7 PID: 18993 Comm: php Not tainted 3.11.1 #1 Hardware name: Dell Inc. PowerEdge R420/072XWF, BIOS 1.3.5 08/21/2012 task: ffff8804203460c0 ti: ffff880420346640 RIP: 0010:[<ffffffff812a1903>] __fscache_uncache_page+0x23/0x160 RSP: 0018:ffff8801053af878 EFLAGS: 00210286 RAX: 0000000000000000 RBX: ffff8800be2f8780 RCX: ffff88022ffae5e8 RDX: 0000000000004c66 RSI: ffffea00055ff440 RDI: ffff8800be2f8780 RBP: ffff8801053af898 R08: 0000000000000001 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00055ff440 R13: 0000000000001000 R14: ffff8800c50be538 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88042fc60000(0063) knlGS:00000000e439c700 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000000000010 CR3: 0000000001d8f000 CR4: 00000000000607f0 Stack: ... Call Trace: [<ffffffff81365a72>] __nfs_fscache_invalidate_page+0x42/0x70 [<ffffffff813553d5>] nfs_invalidate_page+0x75/0x90 [<ffffffff811b8f5e>] truncate_inode_page+0x8e/0x90 [<ffffffff811b90ad>] truncate_inode_pages_range.part.12+0x14d/0x620 [<ffffffff81d6387d>] ? __mutex_lock_slowpath+0x1fd/0x2e0 [<ffffffff811b95d3>] truncate_inode_pages_range+0x53/0x70 [<ffffffff811b969d>] truncate_inode_pages+0x2d/0x40 [<ffffffff811b96ff>] truncate_pagecache+0x4f/0x70 [<ffffffff81356840>] nfs_setattr_update_inode+0xa0/0x120 [<ffffffff81368de4>] nfs3_proc_setattr+0xc4/0xe0 [<ffffffff81357f78>] nfs_setattr+0xc8/0x150 [<ffffffff8122d95b>] notify_change+0x1cb/0x390 [<ffffffff8120a55b>] do_truncate+0x7b/0xc0 [<ffffffff8121f96c>] do_last+0xa4c/0xfd0 [<ffffffff8121ffbc>] path_openat+0xcc/0x670 [<ffffffff81220a0e>] do_filp_open+0x4e/0xb0 [<ffffffff8120ba1f>] do_sys_open+0x13f/0x2b0 [<ffffffff8126aaf6>] compat_SyS_open+0x36/0x50 [<ffffffff81d7204c>] sysenter_dispatch+0x7/0x24 The code at the instruction pointer was disassembled: > (gdb) disas __fscache_uncache_page > Dump of assembler code for function __fscache_uncache_page: > ... > 0xffffffff812a18ff <+31>: mov 0x48(%rbx),%rax > 0xffffffff812a1903 <+35>: cmpb $0x0,0x10(%rax) > 0xffffffff812a1907 <+39>: je 0xffffffff812a19cd <__fscache_uncache_page+237> These instructions make up: ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX); That cmpb is the faulting instruction (%rax is 0). So cookie->def is NULL - which presumably means that the cookie has already been at least partway through __fscache_relinquish_cookie(). What I think may be happening is something like a three-way race on the same file: PROCESS 1 PROCESS 2 PROCESS 3 =============== =============== =============== open(O_TRUNC|O_WRONLY) open(O_RDONLY) open(O_WRONLY) -->nfs_open() -->nfs_fscache_set_inode_cookie() nfs_fscache_inode_lock() nfs_fscache_disable_inode_cookie() __fscache_relinquish_cookie() nfs_inode->fscache = NULL <--nfs_fscache_set_inode_cookie() -->nfs_open() -->nfs_fscache_set_inode_cookie() nfs_fscache_inode_lock() nfs_fscache_enable_inode_cookie() __fscache_acquire_cookie() nfs_inode->fscache = cookie <--nfs_fscache_set_inode_cookie() <--nfs_open() -->nfs_setattr() ... ... -->nfs_invalidate_page() -->__nfs_fscache_invalidate_page() cookie = nfsi->fscache -->nfs_open() -->nfs_fscache_set_inode_cookie() nfs_fscache_inode_lock() nfs_fscache_disable_inode_cookie() -->__fscache_relinquish_cookie() -->__fscache_uncache_page(cookie) <crash> <--__fscache_relinquish_cookie() nfs_inode->fscache = NULL <--nfs_fscache_set_inode_cookie() What is needed is something to prevent process #2 from reacquiring the cookie - and I think checking i_writecount should do the trick. It's also possible to have a two-way race on this if the file is opened O_TRUNC|O_RDONLY instead. Reported-by: Mark Moseley <[email protected]> Signed-off-by: David Howells <[email protected]>
2013-09-27FS-Cache: Provide the ability to enable/disable cookiesDavid Howells17-132/+334
Provide the ability to enable and disable fscache cookies. A disabled cookie will reject or ignore further requests to: Acquire a child cookie Invalidate and update backing objects Check the consistency of a backing object Allocate storage for backing page Read backing pages Write to backing pages but still allows: Checks/waits on the completion of already in-progress objects Uncaching of pages Relinquishment of cookies Two new operations are provided: (1) Disable a cookie: void fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate); If the cookie is not already disabled, this locks the cookie against other dis/enablement ops, marks the cookie as being disabled, discards or invalidates any backing objects and waits for cessation of activity on any associated object. This is a wrapper around a chunk split out of fscache_relinquish_cookie(), but it reinitialises the cookie such that it can be reenabled. All possible failures are handled internally. The caller should consider calling fscache_uncache_all_inode_pages() afterwards to make sure all page markings are cleared up. (2) Enable a cookie: void fscache_enable_cookie(struct fscache_cookie *cookie, bool (*can_enable)(void *data), void *data) If the cookie is not already enabled, this locks the cookie against other dis/enablement ops, invokes can_enable() and, if the cookie is not an index cookie, will begin the procedure of acquiring backing objects. The optional can_enable() function is passed the data argument and returns a ruling as to whether or not enablement should actually be permitted to begin. All possible failures are handled internally. The cookie will only be marked as enabled if provisional backing objects are allocated. A later patch will introduce these to NFS. Cookie enablement during nfs_open() is then contingent on i_writecount <= 0. can_enable() checks for a race between open(O_RDONLY) and open(O_WRONLY/O_RDWR). This simplifies NFS's cookie handling and allows us to get rid of open(O_RDONLY) accidentally introducing caching to an inode that's open for writing already. One operation has its API modified: (3) Acquire a cookie. struct fscache_cookie *fscache_acquire_cookie( struct fscache_cookie *parent, const struct fscache_cookie_def *def, void *netfs_data, bool enable); This now has an additional argument that indicates whether the requested cookie should be enabled by default. It doesn't need the can_enable() function because the caller must prevent multiple calls for the same netfs object and it doesn't need to take the enablement lock because no one else can get at the cookie before this returns. Signed-off-by: David Howells <[email protected]
2013-09-27FS-Cache: Add use/unuse/wake cookie wrappersDavid Howells3-15/+53
Add wrapper functions for dealing with cookie->n_active: (*) __fscache_use_cookie() to increment it. (*) __fscache_unuse_cookie() to decrement and test against zero. (*) __fscache_wake_unused_cookie() to wake up anyone waiting for it to reach zero. The second and third are split so that the third can be done after cookie->lock has been released in case the waiter wakes up whilst we're still holding it and tries to get it. We will need to wake-on-zero once the cookie disablement patch is applied because it will then be possible to see n_active become zero without the cookie being relinquished. Also move the cookie usement out of fscache_attr_changed_op() and into fscache_attr_changed() and the operation struct so that cookie disablement will be able to track it. Whilst we're at it, only increment n_active if we're about to do fscache_submit_op() so that we don't have to deal with undoing it if anything earlier fails. Possibly this should be moved into fscache_submit_op() which could look at FSCACHE_OP_UNUSE_COOKIE. Signed-off-by: David Howells <[email protected]>
2013-09-27Merge tag 'hwmon-for-linus' of ↵Linus Torvalds1-1/+10
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fix from Guenter Roeck: "Fix potential crash condition in applesmc driver" * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (applesmc) Check key count before proceeding
2013-09-27Merge tag 'sound-3.12' of ↵Linus Torvalds5-25/+131
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Nothing too serious here: a couple of compress-offload core fixes, Haswell HDMI audio fix, a fixup for new MacBook Airs and a few COEF setups for ALC283 mic problems" * tag 'sound-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Enable internal mic on a Thinkpad machine with ALC283 ALSA: hda - Fix Internal Mic boost can't control with ALC283 ALSA: hda - Add documentation for CS4208 fixups ALSA: hda - Add fixup for MacBook Air 6,1 and 6,2 with CS4208 codec ALSA : hda - not use assigned converters for all unused pins ALSA: compress: Make sure we trigger STOP before closing the stream. ALSA: compress: Fix compress device unregister.
2013-09-27Merge tag 'fbdev-fixes-3.12' of ↵Linus Torvalds10-30/+15
git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux Pull fbdev fixes from Tomi Valkeinen: "Small fbdev fixes for various fb drivers" * tag 'fbdev-fixes-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: video: mxsfb: Add missing break video: of: display_timing: correct display-timings node finding neofb: fix error return code in neofb_probe() s3fb: fix error return code in s3_pci_probe() video: mmp: drop needless devm cleanup OMAPDSS: Add missing dependency on backlight for DSI-CM panel drier OMAPDSS: DISPC: set irq_safe for runtime PM OMAPDSS: Return right error during connector probe
2013-09-27Merge branch 'for_linus' of ↵Linus Torvalds4-97/+52
git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull reiserfs and UDF fixes from Jan Kara: "The contains fix of an UDF oops when mounting corrupted media and a fix of a race in reiserfs leading to oops" * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: reiserfs: fix race with flush_used_journal_lists and flush_journal_list reiserfs: remove useless flush_old_journal_lists udf: Fortify LVID loading
2013-09-27sysfs: Allow mounting without CONFIG_NETEric W. Biederman1-4/+1
In kobj_ns_current_may_mount the default should be to allow the mount. The test is only for a single kobj_ns_type at a time, and unless there is a reason to prevent it the mounting sysfs should be allowed. Subsystems that are not registered can't have are not involved so can't have a reason to prevent mounting sysfs. This is a bug-fix to commit 7dc5dbc879bd ("sysfs: Restrict mounting sysfs") that came in via the userns tree during the 3.12 merge window. Reported-and-tested-by: James Hogan <[email protected]> Signed-off-by: "Eric W. Biederman" <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-09-27lockref: allow relaxed cmpxchg64 variant for lockless updatesWill Deacon1-2/+11
The 64-bit cmpxchg operation on the lockref is ordered by virtue of hazarding between the cmpxchg operation and the reference count manipulation. On weakly ordered memory architectures (such as ARM), it can be of great benefit to omit the barrier instructions where they are not needed. This patch moves the lockless lockref code over to a cmpxchg64_relaxed operation, which doesn't provide barrier semantics. If the operation isn't defined, we simply #define it as the usual 64-bit cmpxchg macro. Cc: Waiman Long <[email protected]> Signed-off-by: Will Deacon <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-09-27i2c: designware: 10-bit addressing mode enabling if I2C_DYNAMIC_TAR_UPDATE ↵Chew, Chiau Ee1-6/+20
is set According to Designware I2C spec, if I2C_DYNAMIC_TAR_UPDATE is set to 1, the 10-bit addressing mode is controlled by IC_10BITADDR_MASTER bit of IC_TAR register instead of IC_CON register. The IC_10BITADDR_MASTER in IC_CON register becomes read-only copy. Since I2C_DYNAMIC_TAR_UPDATE value can't be detected from hardware register, so we will always set the IC_10BITADDR_MASTER bit in both IC_CON and IC_TAR register whenever 10-bit addresing mode is requested by user application. Signed-off-by: Chew, Chiau Ee <[email protected]> Reviewed-by: Mika Westerberg <[email protected]> Signed-off-by: Wolfram Sang <[email protected]>
2013-09-27i2c: mv64xxx: Do not use writel_relaxed()Thierry Reding1-2/+2
The driver is used on PowerPC which don't provide writel_relaxed(). This breaks the c2k and prpmc2800 default configurations. To fix the build, turn the calls to writel_relaxed() into writel(). The impacts for ARM should be minimal. Signed-off-by: Thierry Reding <[email protected]> Signed-off-by: Wolfram Sang <[email protected]>
2013-09-27i2c: mv64xxx: Fix some build warningsThierry Reding1-5/+7
Some functions and variables are only used if the configuration selects HAVE_CLK. Protect them with a corresponding #ifdef CONFIG_HAVE_CLK block to avoid compiler warnings. Signed-off-by: Thierry Reding <[email protected]> [wsa: added marker to #endif] Signed-off-by: Wolfram Sang <[email protected]>
2013-09-27i2c: s3c2410: fix clk_disable/clk_unprepare WARNingsKim Phillips1-2/+0
commit d16933b33914a6dff38a4ecbe8edce44a17898e8 "i2c: s3c2410: Move location of clk_prepare_enable() call in probe function" refactored clk_enable and clk_disable calls yet neglected to remove the clk_disable_unprepare call in the module's remove(). It helps remove warnings on an arndale during unbind: echo 12c90000.i2c > /sys/bus/platform/devices/12c90000.i2c/driver/unbind ------------[ cut here ]------------ WARNING: CPU: 0 PID: 2548 at drivers/clk/clk.c:842 clk_disable+0x18/0x24() Modules linked in: CPU: 0 PID: 2548 Comm: bash Not tainted 3.11.0-next-20130916-00003-gf4bddbc #6 [<c0014d48>] (unwind_backtrace+0x0/0xf8) from [<c00117d0>] (show_stack+0x10/0x14) [<c00117d0>] (show_stack+0x10/0x14) from [<c0361be8>] (dump_stack+0x6c/0xac) [<c0361be8>] (dump_stack+0x6c/0xac) from [<c001d864>] (warn_slowpath_common+0x64/0x88) [<c001d864>] (warn_slowpath_common+0x64/0x88) from [<c001d8a4>] (warn_slowpath_null+0x1c/0x24) [<c001d8a4>] (warn_slowpath_null+0x1c/0x24) from [<c02c4a64>] (clk_disable+0x18/0x24) [<c02c4a64>] (clk_disable+0x18/0x24) from [<c028d0b0>] (s3c24xx_i2c_remove+0x28/0x70) [<c028d0b0>] (s3c24xx_i2c_remove+0x28/0x70) from [<c0217a10>] (platform_drv_remove+0x18/0x1c) [<c0217a10>] (platform_drv_remove+0x18/0x1c) from [<c0216358>] (__device_release_driver+0x58/0xb4) [<c0216358>] (__device_release_driver+0x58/0xb4) from [<c02163d0>] (device_release_driver+0x1c/0x28) [<c02163d0>] (device_release_driver+0x1c/0x28) from [<c02153c0>] (unbind_store+0x58/0x90) [<c02153c0>] (unbind_store+0x58/0x90) from [<c0214c90>] (drv_attr_store+0x20/0x2c) [<c0214c90>] (drv_attr_store+0x20/0x2c) from [<c01032c0>] (sysfs_write_file+0x168/0x198) [<c01032c0>] (sysfs_write_file+0x168/0x198) from [<c00ae1c0>] (vfs_write+0xb0/0x194) [<c00ae1c0>] (vfs_write+0xb0/0x194) from [<c00ae594>] (SyS_write+0x3c/0x70) [<c00ae594>] (SyS_write+0x3c/0x70) from [<c000e3e0>] (ret_fast_syscall+0x0/0x30) ---[ end trace 4c9f9403066f57a6 ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 2548 at drivers/clk/clk.c:751 clk_unprepare+0x14/0x1c() Modules linked in: CPU: 0 PID: 2548 Comm: bash Tainted: G W 3.11.0-next-20130916-00003-gf4bddbc #6 [<c0014d48>] (unwind_backtrace+0x0/0xf8) from [<c00117d0>] (show_stack+0x10/0x14) [<c00117d0>] (show_stack+0x10/0x14) from [<c0361be8>] (dump_stack+0x6c/0xac) [<c0361be8>] (dump_stack+0x6c/0xac) from [<c001d864>] (warn_slowpath_common+0x64/0x88) [<c001d864>] (warn_slowpath_common+0x64/0x88) from [<c001d8a4>] (warn_slowpath_null+0x1c/0x24) [<c001d8a4>] (warn_slowpath_null+0x1c/0x24) from [<c02c5834>] (clk_unprepare+0x14/0x1c) [<c02c5834>] (clk_unprepare+0x14/0x1c) from [<c028d0b8>] (s3c24xx_i2c_remove+0x30/0x70) [<c028d0b8>] (s3c24xx_i2c_remove+0x30/0x70) from [<c0217a10>] (platform_drv_remove+0x18/0x1c) [<c0217a10>] (platform_drv_remove+0x18/0x1c) from [<c0216358>] (__device_release_driver+0x58/0xb4) [<c0216358>] (__device_release_driver+0x58/0xb4) from [<c02163d0>] (device_release_driver+0x1c/0x28) [<c02163d0>] (device_release_driver+0x1c/0x28) from [<c02153c0>] (unbind_store+0x58/0x90) [<c02153c0>] (unbind_store+0x58/0x90) from [<c0214c90>] (drv_attr_store+0x20/0x2c) [<c0214c90>] (drv_attr_store+0x20/0x2c) from [<c01032c0>] (sysfs_write_file+0x168/0x198) [<c01032c0>] (sysfs_write_file+0x168/0x198) from [<c00ae1c0>] (vfs_write+0xb0/0x194) [<c00ae1c0>] (vfs_write+0xb0/0x194) from [<c00ae594>] (SyS_write+0x3c/0x70) [<c00ae594>] (SyS_write+0x3c/0x70) from [<c000e3e0>] (ret_fast_syscall+0x0/0x30) ---[ end trace 4c9f9403066f57a7 ]--- Signed-off-by: Kim Phillips <[email protected]> Signed-off-by: Wolfram Sang <[email protected]>
2013-09-27arm: Fix build error with context tracking callsFrederic Weisbecker2-4/+16
ad65782fba50 (context_tracking: Optimize main APIs off case with static key) converted context tracking main APIs to inline function and left ARM asm callers behind. This can be easily fixed by making ARM calling the post static keys context tracking function. We just need to replicate the static key checks there. We'll remove these later when ARM will support the context tracking static keys. Reported-by: Guenter Roeck <[email protected]> Reported-by: Russell King <[email protected]> Signed-off-by: Frederic Weisbecker <[email protected]> Tested-by: Kevin Hilman <[email protected]> Cc: Nicolas Pitre <[email protected]> Cc: Anil Kumar <[email protected]> Cc: Tony Lindgren <[email protected]> Cc: Benoit Cousson <[email protected]> Cc: Guenter Roeck <[email protected]> Cc: Russell King <[email protected]> Cc: Kevin Hilman <[email protected]>
2013-09-27regulator: ti-abb: Fix bias voltage glitch in transition to bypass modeNishanth Menon1-2/+14
As documented in Application Note SWPA117 v2.1(NDA), LDO override has a requirement that when switching from Bias active + override active mode(FBB/RBB) to Bypass(nominal) mode, LDO reset must be performed *after* LDO transitions to Bypass(nominal) mode. The same rule in reverse applies when switching from a ABB bypass mode to ABB enabled - LDO override *must* be performed prior to transition to required ABB mode, if we do not do that, the same glitch takes place. Currently while transitioning to ABB bypass, we reset the LDO overide prior to the transition which causes a few milliseconds where ABB LDO voltage could go all the way to 800mV(based on SoC process node), during this period, the delta voltage between VDD rail and VBB rail could cause the system to improperly function. Signed-off-by: Nishanth Menon <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: [email protected]
2013-09-27ALSA: hda - Enable internal mic on a Thinkpad machine with ALC283Kailang Yang1-1/+12
More thorough testing showed that these verbs were necessary to improve quality of the internal mic. Patch originally from Realtek. BugLink: https://bugs.launchpad.net/bugs/1231931 Signed-off-by: David Henningsson <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2013-09-27ALSA: hda - Fix Internal Mic boost can't control with ALC283Kailang Yang1-0/+3
ALC283 pin control for Line1 default control by hidden register. Use line1 as internal Mic will not get sound when boost value up. Set control by verb for hidden register will solve this issue. Signed-off-by: Kailang Yang <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2013-09-27ARC: Use clockevents_config_and_register over clockevents_register_deviceUwe Kleine-König1-5/+2
clockevents_config_and_register is more clever and correct than doing it by hand; so use it. [vgupta: fixed build failure due to missing ; in patch] Signed-off-by: Uwe Kleine-König <[email protected]> Signed-off-by: Vineet Gupta <[email protected]>
2013-09-27ARC: Workaround spinlock livelock in SMP SystemC simulationVineet Gupta1-1/+8
Some ARC SMP systems lack native atomic R-M-W (LLOCK/SCOND) insns and can only use atomic EX insn (reg with mem) to build higher level R-M-W primitives. This includes a SystemC based SMP simulation model. So rwlocks need to use a protecting spinlock for atomic cmp-n-exchange operation to update reader(s)/writer count. The spinlock operation itself looks as follows: mov reg, 1 ; 1=locked, 0=unlocked retry: EX reg, [lock] ; load existing, store 1, atomically BREQ reg, 1, rety ; if already locked, retry In single-threaded simulation, SystemC alternates between the 2 cores with "N" insn each based scheduling. Additionally for insn with global side effect, such as EX writing to shared mem, a core switch is enforced too. Given that, 2 cores doing a repeated EX on same location, Linux often got into a livelock e.g. when both cores were fiddling with tasklist lock (gdbserver / hackbench) for read/write respectively as the sequence diagram below shows: core1 core2 -------- -------- 1. spin lock [EX r=0, w=1] - LOCKED 2. rwlock(Read) - LOCKED 3. spin unlock [ST 0] - UNLOCKED spin lock [EX r=0,w=1] - LOCKED -- resched core 1---- 5. spin lock [EX r=1] - ALREADY-LOCKED -- resched core 2---- 6. rwlock(Write) - READER-LOCKED 7. spin unlock [ST 0] 8. rwlock failed, retry again 9. spin lock [EX r=0, w=1] -- resched core 1---- 10 spinlock locked in #9, retry #5 11. spin lock [EX gets 1] -- resched core 2---- ... ... The fix was to unlock using the EX insn too (step 7), to trigger another SystemC scheduling pass which would let core1 proceed, eliding the livelock. Signed-off-by: Vineet Gupta <[email protected]>
2013-09-27ARC: Fix 32-bit wrap around in access_ok()Vineet Gupta1-2/+2
Anton reported | LTP tests syscalls/process_vm_readv01 and process_vm_writev01 fail | similarly in one testcase test_iov_invalid -> lvec->iov_base. | Testcase expects errno EFAULT and return code -1, | but it gets return code 1 and ERRNO is 0 what means success. Essentially test case was passing a pointer of -1 which access_ok() was not catching. It was doing [@addr + @sz <= TASK_SIZE] which would pass for @addr == -1 Fixed that by rewriting as [@addr <= TASK_SIZE - @sz] Reported-by: Anton Kolesov <[email protected]> Signed-off-by: Vineet Gupta <[email protected]>
2013-09-27ARC: Handle zero-overhead-loop in unaligned access handlerMischa Jonker1-0/+6
If a load or store is the last instruction in a zero-overhead-loop, and it's misaligned, the loop would execute only once. This fixes that problem. Signed-off-by: Mischa Jonker <[email protected]> Signed-off-by: Vineet Gupta <[email protected]>
2013-09-27ALSA: hda - Add documentation for CS4208 fixupsTakashi Iwai1-0/+6
Signed-off-by: Takashi Iwai <[email protected]>
2013-09-27ALSA: hda - Add fixup for MacBook Air 6,1 and 6,2 with CS4208 codecBen Whitten1-5/+67
This patch adds the default pin configuration and some init verbs for setting COEFs, in addition to the correction of input pin AMP caps for MacBook Air 6,1 and 6,2. With these changes, the headphone jack detection starts working properly. [trivial space fixes by tiwai] Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=60811 Signed-off-by: Ben Whitten <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2013-09-27x86/microcode/AMD: Fix patch level reporting for family 15hSuravee Suthikulpanit1-0/+1
On AMD family 14h, applying microcode patch on the a core (core0) would also affect the other core (core1) in the same compute unit. The driver would skip applying the patch on core1, but it still need to update kernel structures to reflect the proper patch level. The current logic is not updating the struct ucode_cpu_info.cpu_sig.rev of the skipped core. This causes the /sys/devices/system/cpu/cpu1/microcode/version to report incorrect patch level as shown below: $ grep . cpu?/microcode/version cpu0/microcode/version:0x600063d cpu1/microcode/version:0x6000626 cpu2/microcode/version:0x600063d cpu3/microcode/version:0x6000626 cpu4/microcode/version:0x600063d Signed-off-by: Suravee Suthikulpanit <[email protected]> Acked-by: Borislav Petkov <[email protected]> Cc: <[email protected]> Cc: <[email protected]> Cc: <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
2013-09-27Merge branch 'pm-cpufreq-fixes'Rafael J. Wysocki3-1/+8
* pm-cpufreq-fixes: cpufreq: exynos5440: Fix potential NULL pointer dereference cpufreq: check cpufreq driver is valid and cpufreq isn't disabled in cpufreq_get() acpi-cpufreq: skip loading acpi_cpufreq after intel_pstate
2013-09-27Merge branch 'acpi-fixes'Rafael J. Wysocki2-11/+15
* acpi-fixes: ACPI / scan: fix typo in comments of acpi_bus_unregister_driver() ACPI / IPMI: Fix atomic context requirement of ipmi_msg_handler()
2013-09-26staging: r8188eu: Add new device IDLarry Finger1-0/+1
The DLink DWA-125 Rev D1 also uses this driver. Signed-off-by: Larry Finger <[email protected]> Reported-by: Sergey Kostanbaev <[email protected]> Tested-by: Sergey Kostanbaev <[email protected]> Cc: Sergey Kostanbaev <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26usb: dwc3: add support for MerrifieldDavid Cohen1-0/+2
Add PCI id for Intel Merrifield Signed-off-by: David Cohen <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26USB: fsl/ehci: fix failure of checking PHY_CLK_VALID during reinitializationShengzhou Liu1-2/+3
In case of usb phy reinitialization: e.g. insmod usb-module(usb works well) -> rmmod usb-module -> insmod usb-module It found the PHY_CLK_VALID bit didn't work if it's not with the power-on reset. So we just check PHY_CLK_VALID bit during the stage with POR, this can be met by the tricky of checking FSL_SOC_USB_PRICTRL register. Signed-off-by: Shengzhou Liu <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26USB: Fix breakage in ffs_fs_mount()Al Viro1-34/+26
There's a bunch of failure exits in ffs_fs_mount() with seriously broken recovery logics. Most of that appears to stem from misunderstanding of the ->kill_sb() semantics; unlike ->put_super() it is called for *all* superblocks of given type, no matter how (in)complete the setup had been. ->put_super() is called only if ->s_root is not NULL; any failure prior to setting ->s_root will have the call of ->put_super() skipped. ->kill_sb(), OTOH, awaits every superblock that has come from sget(). Current behaviour of ffs_fs_mount(): We have struct ffs_sb_fill_data data on stack there. We do ffs_dev = functionfs_acquire_dev_callback(dev_name); and store that in data.private_data. Then we call mount_nodev(), passing it ffs_sb_fill() as a callback. That will either fail outright, or manage to call ffs_sb_fill(). There we allocate an instance of struct ffs_data, slap the value of ffs_dev (picked from data.private_data) into ffs->private_data and overwrite data.private_data by storing ffs into an overlapping member (data.ffs_data). Then we store ffs into sb->s_fs_info and attempt to set the rest of the things up (root inode, root dentry, then create /ep0 there). Any of those might fail. Should that happen, we get ffs_fs_kill_sb() called before mount_nodev() returns. If mount_nodev() fails for any reason whatsoever, we proceed to functionfs_release_dev_callback(data.ffs_data); That's broken in a lot of ways. Suppose the thing has failed in allocation of e.g. root inode or dentry. We have functionfs_release_dev_callback(ffs); ffs_data_put(ffs); done by ffs_fs_kill_sb() (ffs accessed via sb->s_fs_info), followed by functionfs_release_dev_callback(ffs); from ffs_fs_mount() (via data.ffs_data). Note that the second functionfs_release_dev_callback() has every chance to be done to freed memory. Suppose we fail *before* root inode allocation. What happens then? ffs_fs_kill_sb() doesn't do anything to ffs (it's either not called at all, or it doesn't have a pointer to ffs stored in sb->s_fs_info). And functionfs_release_dev_callback(data.ffs_data); is called by ffs_fs_mount(), but here we are in nasal daemon country - we are reading from a member of union we'd never stored into. In practice, we'll get what we used to store into the overlapping field, i.e. ffs_dev. And then we get screwed, since we treat it (struct gfs_ffs_obj * in disguise, returned by functionfs_acquire_dev_callback()) as struct ffs_data *, pick what would've been ffs_data ->private_data from it (*well* past the actual end of the struct gfs_ffs_obj - struct ffs_data is much bigger) and poke in whatever it points to. FWIW, there's a minor leak on top of all that in case if ffs_sb_fill() fails on kstrdup() - ffs is obviously forgotten. The thing is, there is no point in playing all those games with union. Just allocate and initialize ffs_data *before* calling mount_nodev() and pass a pointer to it via data.ffs_data. And once it's stored in sb->s_fs_info, clear data.ffs_data, so that ffs_fs_mount() knows that it doesn't need to kill the sucker manually - from that point on we'll have it done by ->kill_sb(). Signed-off-by: Al Viro <[email protected]> Acked-by: Michal Nazarewicz <[email protected]> Cc: stable <[email protected]> # 3.3+ Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26driver core : Fix use after free of dev->parent in device_shutdownBenson Leung1-7/+7
The put_device(dev) at the bottom of the loop of device_shutdown may result in the dev being cleaned up. In device_create_release, the dev is kfreed. However, device_shutdown attempts to use the dev pointer again after put_device by referring to dev->parent. Copy the parent pointer instead to avoid this condition. This bug was found on Chromium OS's chromeos-3.8, which is based on v3.8.11. See bug report : https://code.google.com/p/chromium/issues/detail?id=297842 This can easily be reproduced when shutting down with hidraw devices that report battery condition. Two examples are the HP Bluetooth Mouse X4000b and the Apple Magic Mouse. For example, with the magic mouse : The dev in question is "hidraw0" dev->parent is "magicmouse" In the course of the shutdown for this device, the input event cleanup calls a put on hidraw0, decrementing its reference count. When we finally get to put_device(dev) in device_shutdown, kobject_cleanup is called and device_create_release does kfree(dev). dev->parent is no longer valid, and we may crash in put_device(dev->parent). This change should be applied on any kernel with this change : d1c6c030fcec6f860d9bb6c632a3ebe62e28440b Cc: [email protected] Signed-off-by: Benson Leung <[email protected]> Reviewed-by: Ming Lei <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26sysfs: Allow mounting without CONFIG_NETEric W. Biederman1-4/+1
In kobj_ns_current_may_mount the default should be to allow the mount. The test is only for a single kobj_ns_type at a time, and unless there is a reason to prevent it the mounting sysfs should be allowed. Subsystems that are not registered can't have are not involved so can't have a reason to prevent mounting sysfs. This is a bug-fix to: commit 7dc5dbc879bd0779924b5132a48b731a0bc04a1e Author: Eric W. Biederman <[email protected]> Date: Mon Mar 25 20:07:01 2013 -0700 sysfs: Restrict mounting sysfs Don't allow mounting sysfs unless the caller has CAP_SYS_ADMIN rights over the net namespace. The principle here is if you create or have capabilities over it you can mount it, otherwise you get to live with what other people have mounted. Instead of testing this with a straight forward ns_capable call, perform this check the long and torturous way with kobject helpers, this keeps direct knowledge of namespaces out of sysfs, and preserves the existing sysfs abstractions. Acked-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: "Eric W. Biederman" <[email protected]> That came in via the userns tree during the 3.12 merge window. Reported-by: James Hogan <[email protected]> Signed-off-by: "Eric W. Biederman" <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26Drivers: hv: vmbus: Terminate vmbus version negotiation on timeoutK. Y. Srinivasan1-1/+1
commit 666b9adc801ef012612c4e43e0f44b2cdc1979cf terminated vmbus version negotiation incorrectly. We need to terminate the version negotiation only if the current negotiation were to timeout. Signed-off-by: K. Y. Srinivasan <[email protected]> Cc: Olaf Hering <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26Drivers: hv: util: Correctly support ws2008R2 and earlierK. Y. Srinivasan4-34/+88
The current code does not correctly negotiate the version numbers for the util driver when hosted on earlier hosts. The version numbers presented by this driver were not compatible with the version numbers supported by Windows Server 2008. Fix this problem. I would like to thank Olaf Hering ([email protected]) for identifying the problem. Reported-by: Olaf Hering <[email protected]> Signed-off-by: K. Y. Srinivasan <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26mei: cancel stall timers in mei_resetAlexander Usyskin2-0/+4
Unset init_clients_timer and amthif_stall_timers in mei_reset in order to cancel timer ticking and hence avoid recursive reset calls. Cc: <[email protected]> # 3.9+ Signed-off-by: Alexander Usyskin <[email protected]> Signed-off-by: Tomas Winkler <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26mei: bus: stop wait for read during cl state transitionTomas Winkler3-8/+14
Bus layer omitted check for client state transition while waiting for read completion The client state transition may occur for example as result of firmware initiated reset Add mei_cl_is_transitioning wrapper to reduce the code repetition.: Cc: <[email protected]> # 3.9+ Signed-off-by: Tomas Winkler <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26mei: make me client counters less error proneTomas Winkler2-7/+9
1. u8 counters are prone to hard to detect overflow: make them unsigned long to match bit_ functions argument type 2. don't check me_clients_num for negativity, it is unsigned. 3. init all the me client counters from one place Cc: <[email protected]> # 3.9+ Signed-off-by: Tomas Winkler <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26tty: ar933x_uart: move devicetree binding documentationGabor Juhos1-0/+0
Commit 'tty: ar933x_uart: add device tree support and binding documentation' introduced a new doc in bindins/tty/serial. According to a recent thread [1] on the linux-serial list, the binding documentation of serial drivers should be added into bindings/serial. Move the documentation of qca,ar9330-uart to the correct place. 1. http://marc.info/?l=linux-serial&m=137771295411517 Cc: [email protected] Signed-off-by: Gabor Juhos <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26fsl/usb: Resolve PHY_CLK_VLD instability issue for ULPI phyRamneek Mehresh1-9/+3
For controller versions greater than 1.6, setting ULPI_PHY_CLK_SEL bit when USB_EN bit is already set causes instability issues with PHY_CLK_VLD bit. So USB_EN is set only for IP controller version below 1.6 before setting ULPI_PHY_CLK_SEL bit Signed-off-by: Ramneek Mehresh <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-09-26xfs: fix node forward in xfs_node_toosmallMark Tinguely1-2/+3
Commit f5ea1100 cleans up the disk to host conversions for node directory entries, but because a variable is reused in xfs_node_toosmall() the next node is not correctly found. If the original node is small enough (<= 3/8 of the node size), this change may incorrectly cause a node collapse when it should not. That will cause an assert in xfstest generic/319: Assertion failed: first <= last && last < BBTOB(bp->b_length), file: /root/newest/xfs/fs/xfs/xfs_trans_buf.c, line: 569 Keep the original node header to get the correct forward node. (When a node is considered for a merge with a sibling, it overwrites the sibling pointers of the original incore nodehdr with the sibling's pointers. This leads to loop considering the original node as a merge candidate with itself in the second pass, and so it incorrectly determines a merge should occur.) Signed-off-by: Mark Tinguely <[email protected]> Reviewed-by: Ben Myers <[email protected]> Signed-off-by: Ben Myers <[email protected]> [v3: added Dave Chinner's (slightly modified) suggestion to the commit header, cleaned up whitespace. -bpm]
2013-09-26NFSv4: Honour the 'opened' parameter in the atomic_open() filesystem methodTrond Myklebust4-10/+24
Determine if we've created a new file by examining the directory change attribute and/or the O_EXCL flag. This fixes a regression when doing a non-exclusive create of a new file. If the FILE_CREATED flag is not set, the atomic_open() command will perform full file access permissions checks instead of just checking for MAY_OPEN. Signed-off-by: Trond Myklebust <[email protected]>
2013-09-26video: mxsfb: Add missing breakMarek Vasut1-0/+1
Add missing break into the restore function. Signed-off-by: Marek Vasut <[email protected]> Cc: Fabio Estevam <[email protected]> Cc: Shawn Guo <[email protected]> Cc: Tomi Valkeinen <[email protected]> Signed-off-by: Tomi Valkeinen <[email protected]>
2013-09-26hwmon: (applesmc) Check key count before proceedingHenrik Rydberg1-1/+10
After reports from Chris and Josh Boyer of a rare crash in applesmc, Guenter pointed at the initialization problem fixed below. The patch has not been verified to fix the crash, but should be applied regardless. Reported-by: <[email protected]> Suggested-by: Guenter Roeck <[email protected]> Signed-off-by: Henrik Rydberg <[email protected]> Cc: [email protected] Signed-off-by: Guenter Roeck <[email protected]>
2013-09-26video: of: display_timing: correct display-timings node findingAndrzej Hajda1-3/+3
of_get_display_timing(s) use of_find_node_by_name to get child node, this is incorrect, of_get_child_by_name should be used instead. The patch fixes it. Small typo is also corrected. Signed-off-by: Andrzej Hajda <[email protected]> Signed-off-by: Kyungmin Park <[email protected]> Signed-off-by: Tomi Valkeinen <[email protected]>
2013-09-26neofb: fix error return code in neofb_probe()Wei Yongjun1-1/+3
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: Tomi Valkeinen <[email protected]>
2013-09-26s3fb: fix error return code in s3_pci_probe()Wei Yongjun1-8/+1
Fix to return -EINVAL when virtual vertical size smaller than real instead of 0, as done elsewhere in this function. Also remove dup code. Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: Tomi Valkeinen <[email protected]>
2013-09-26video: mmp: drop needless devm cleanupUwe Kleine-König1-15/+2
The nice thing about devm_* is that the driver doesn't need to free the resources but the driver core takes care about that. This also simplifies the error path quite a bit and removes the wrong check for a clock pointer being NULL. Russell King - ARM Linux <[email protected]>: "And this patch also fixes the above: disabling/unpreparing _after_ putting the thing - which was quite silly... :)" Signed-off-by: Uwe Kleine-König <[email protected]> Signed-off-by: Tomi Valkeinen <[email protected]>
2013-09-26OMAPDSS: Add missing dependency on backlight for DSI-CM panel drierMark Brown1-0/+1
The DSI-CM driver uses the backlight class so needs to build depend on it. Signed-off-by: Mark Brown <[email protected]> Reviewed-by: Jingoo Han <[email protected]> Signed-off-by: Tomi Valkeinen <[email protected]>
2013-09-26ALSA : hda - not use assigned converters for all unused pinsMengdong Lin1-18/+29
BIOS can mark a pin as "no physical connection" if the port is used by an integrated display which is not audio capable. And audio driver will overlook such pins. On Haswell, such a disconneted pin will keep muted and connected to the 1st converter by default. But if the 1st convertor is assigned to a connected pin for audio streaming. The muted disconnected pin can make the connected pin no sound output. So this patch avoids using assigned converters for all unused pins for Haswell, including the disconected pins. Signed-off-by: Mengdong Lin <[email protected]> Reviewed-by: David Henningsson <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2013-09-26ALSA: compress: Make sure we trigger STOP before closing the stream.Liam Girdwood1-0/+12
Currently we assume that userspace will shut down the compressed stream correctly. However, if userspcae dies (e.g. cplay & ctrl-C) we dont stop the stream before freeing it. This now checks that the stream is stopped before freeing. Signed-off-by: Liam Girdwood <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.