aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2011-04-20iwl4965: fix skb usage after freeStanislaw Gruszka1-3/+7
Since commit a120e912eb51e347f36c71b60a1d13af74d30e83 Author: Stanislaw Gruszka <[email protected]> Date: Fri Feb 19 15:47:33 2010 -0800 iwlwifi: sanity check before counting number of tfds can be free we use skb->data after calling ieee80211_tx_status_irqsafe(), which could free skb instantly. On current kernels I do not observe practical problems related with bug, but on 2.6.35.y it cause random system hangs when stressing wireless link, making bisection of other problems impossible. Signed-off-by: Stanislaw Gruszka <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-04-20iwlwifi: fix skb usage after freeStanislaw Gruszka1-3/+7
Since commit a120e912eb51e347f36c71b60a1d13af74d30e83 Author: Stanislaw Gruszka <[email protected]> Date: Fri Feb 19 15:47:33 2010 -0800 iwlwifi: sanity check before counting number of tfds can be free we use skb->data after calling ieee80211_tx_status_irqsafe(), which could free skb instantly. On current kernels I do not observe practical problems related with bug, but on 2.6.35.y it cause random system hangs when stressing wireless link. Cc: [email protected] # 2.6.32+ Signed-off-by: Stanislaw Gruszka <[email protected]> Acked-by: Wey-Yi Guy <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-04-20mac80211: fix SMPS debugfs lockingJohannes Berg2-2/+4
The locking with SMPS requests means that the debugs file should lock the mgd mutex, not the iflist mutex. Calls to __ieee80211_request_smps() need to hold that mutex, so add an assertion. This has always been wrong, but for some reason never been noticed, probably because the locking error only happens while unassociated. Cc: [email protected] [2.6.34+] Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-04-20Merge branch 'master' of ↵John W. Linville4-5/+12
git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6
2011-04-20can: add missing socket check in can/raw releaseOliver Hartkopp1-1/+6
v2: added space after 'if' according code style. We can get here with a NULL socket argument passed from userspace, so we need to handle it accordingly. Thanks to Dave Jones pointing at this issue in net/can/bcm.c Signed-off-by: Oliver Hartkopp <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-04-20ALSA: hda - Fix unused warnings when !SND_HDA_NEEDS_RESUMEMike Waychison1-0/+4
When SND_HDA_NEEDS_RESUME is not defined, the compiler identifies that the following symbols are static but not used: restore_shutup_pins hda_cleanup_all_streams Fix warnings by adding SND_HDA_NEEDS_RESUME guards. Signed-off-by: Mike Waychison <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2011-04-20OMAP2/3: hwmod: fix gpio-reset timeouts seen during bootup.Avinash.H.M3-0/+15
GPIO module expects the debounce clocks to be enabled during reset. It doesn't reset properly and timeouts are seen, if this clock isn't enabled during reset. Add the HWMOD_CONTROL_OPT_CLKS_IN_RESET flags to the GPIO HWMODs, with which the debounce clocks are enabled during reset. Cc: Rajendra Nayak <[email protected]> Cc: Paul Walmsley <[email protected]> Cc: Benoit Cousson <[email protected]> Cc: Kevin Hilman <[email protected]> Signed-off-by: Avinash.H.M <[email protected]> Signed-off-by: Paul Walmsley <[email protected]>
2011-04-20OMAP3: PM: Do not rely on ROM code to restore CM_AUTOIDLE_PLL.AUTO_PERIPH_DPLLEduardo Valentin2-1/+24
As per OMAP3 erratum (i671), ROM code adds extra latencies while restoring CM_AUTOIDLE_PLL register, if AUTO_PERIPH_DPLL is equal to 1. This patch stores 0's in scratchpad content area corresponding to AUTO_PERIPH_DPLL, to prevent ROM code to try to lock per DPLL, since it won't respect proper programing scheme. This register is then stored in prcm context. The saving and restore is now done by kernel side. Here follow the erratum description DESCRIPTION After OFF mode transition, among many restorations, the ROM Code restores the CM_AUTOIDLE_PLL register, and after that, it tries to relock the PER DPLL. In case the restoration data stored in scratchpad memory contains a field CM_AUTOIDLE_PLL.AUTO_PERIPH_DPLL = 1, then the way the ROM Code restores and locks the PER DPLL does not respect the PER DPLL programming scheme. In that case, the DPLL might not lock. Meanwhile, when trying to lock the PER DPLL, the ROM Code does not hang. Only extra latencies are introduced at wake-up. WORKAROUND When saving the context-restore structure in scratchpad memory, in order to respect the PER DPLL programming scheme, it is advised to store 0 in the CM_AUTOIDLE_PLL.AUTO_PERIPH_DPLL field of the saved structure. After wake-up, the application should store in CM_AUTOIDLE_PLL register the right desired value. Signed-off-by: Eduardo Valentin <[email protected]> Signed-off-by: Paul Walmsley <[email protected]>
2011-04-20OMAP2+: PM: Fix the saving of CM_AUTOIDLE_PLL register on scratchpad areaEduardo Valentin1-1/+1
The saving of CCR.CM_AUTOIDLE_PLL is done in scratchpad area. However, in current code, the saving is done for CM_AUTOIDLE2_PLL (offset 0x34) instead of CM_AUTOIDLE_PLL (offset 0x30). This patch changes the code to save the correct register. Signed-off-by: Eduardo Valentin <[email protected]> Signed-off-by: Paul Walmsley <[email protected]>
2011-04-20OMAP4: clock data: Change DSS clock aliasesTomi Valkeinen1-7/+2
DSS driver has used fck and ick clocks on OMAP2/3 to get DSS HW up and running, and also to get the pixel clock's source clock rate from the fck. On OMAP4 the clock data is set up in a different way, as there's no ick, dss_fck points to a fake clock which just affects DSS's MODULEMODE, and dss_dss_clk if the DSS_FCK. >From DSS driver's point of view the dss_fck sounds like an ick, and dss_dss_clk is the fck. While this is not entirely correct from HW point of view, especially for the ick, configuring the clock aliases that way makes DSS "just work" with OMAP4's clock setup. In the (hopefully near) future DSS driver will be reworked to use pm_runtime support which should clean up the clock code. Signed-off-by: Tomi Valkeinen <[email protected]> Cc: Benoît Cousson <[email protected]> Signed-off-by: Paul Walmsley <[email protected]>
2011-04-20Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-blockLinus Torvalds7-73/+31
* 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: Remove the extra check in queue_requests_store block, blk-sysfs: Fix an err return path in blk_register_queue() block: remove stale kerneldoc member from __blk_run_queue() block: get rid of QUEUE_FLAG_REENTER cfq-iosched: read_lock() does not always imply rcu_read_lock() block: kill blk_flush_plug_list() export
2011-04-20rtc: fix coh901331 startup crashLinus Walleij1-2/+2
The rtc_device_register() call has changed semantics so that it will immediately call out to rtc_read_alarm() and since the callbacks require the drvdata to be set, we need to set it before the registration call to avoid NULL dereference. Signed-off-by: Linus Walleij <[email protected]>
2011-04-20mach-ux500: fix i2c0 device setup regressionLinus Walleij1-9/+10
Adding two sets of I2C devices to the same bus doesn't quite work, atleast not anymore. Stash one array and determine how much of it shall be added instead. Signed-off-by: Linus Walleij <[email protected]>
2011-04-20xfs: fix duplicate message outputDave Chinner1-1/+3
Commit 957935dc ("xfs: fix xfs_debug warnings" broke the logic in __xfs_printk(). Instead of only printing one of two possible output strings based on whether the fs has a name or not, it outputs both. Fix it to only output one message again. Signed-off-by: Dave Chinner <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Alex Elder <[email protected]>
2011-04-20UBIFS: fix false space checking failureArtem Bityutskiy1-4/+15
This patch fixes UBIFS mount failure when the debugging support is enabled, we are recovering from a power cut, we were first mounter R/O and we are re-mounting R/W. In this case we should not assume that the amount of free space before we have re-mounted R/W and after are equivalent, because when we have mounted R/O the file-system is in a non-committed state so the amount of free space is slightly smaller, due to the fact that we cannot predict the amount of free space precisely before we commit. This patch fixes the issue by skipping the debugging check in case of recovery. This issue was reported by Caizhiyong <[email protected]> here: http://thread.gmane.org/gmane.linux.drivers.mtd/34350/focus=34387 Signed-off-by: Artem Bityutskiy <[email protected]> Reported-by: Caizhiyong <[email protected]> Cc: [email protected] [2.6.30+]
2011-04-20Open with O_CREAT flag set fails to open existing files on non writable ↵Sachin Prabhu1-1/+8
directories An open on a NFS4 share using the O_CREAT flag on an existing file for which we have permissions to open but contained in a directory with no write permissions will fail with EACCES. A tcpdump shows that the client had set the open mode to UNCHECKED which indicates that the file should be created if it doesn't exist and encountering an existing flag is not an error. Since in this case the file exists and can be opened by the user, the NFS server is wrong in attempting to check create permissions on the parent directory. The patch adds a conditional statement to check for create permissions only if the file doesn't exist. Signed-off-by: Sachin S. Prabhu <[email protected]> Signed-off-by: J. Bruce Fields <[email protected]>
2011-04-20xen: mask_rw_pte: do not apply the early_ioremap checks on x86_32Stefano Stabellini1-4/+9
The two "is_early_ioremap_ptep" checks in mask_rw_pte are only used on x86_64, in fact early_ioremap is not used at all to setup the initial pagetable on x86_32. Moreover on x86_32 the two checks are wrong because the range pgt_buf_start..pgt_buf_end initially should be mapped RW because the pages in the range are not pagetable pages yet and haven't been cleared yet. Afterwards considering the pgt_buf_start..pgt_buf_end is part of the initial mapping, xen_alloc_pte is capable of turning the ptes RO when they become pagetable pages. Fix the issue and improve the readability of the code providing two different implementation of mask_rw_pte for x86_32 and x86_64. Signed-off-by: Stefano Stabellini <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2011-04-20xen: do not create the extra e820 region at an addr lower than 4GStefano Stabellini1-1/+1
Do not add the extra e820 region at a physical address lower than 4G because it breaks e820_end_of_low_ram_pfn(). It is OK for us to move the xen_extra_mem_start up and down because this is the index of the memory that can be ballooned in/out - it is memory not available to the kernel during bootup. Signed-off-by: Stefano Stabellini <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2011-04-20bonding: 802.3ad - fix agg_device_upJiri Bohac1-2/+5
The slave member of struct aggregator does not necessarily point to a slave which is part of the aggregator. It points to the slave structure containing the aggregator structure, while completely different slaves (or no slaves at all) may be part of the aggregator. The agg_device_up() function wrongly uses agg->slave to find the state of the aggregator. Use agg->lag_ports->slave instead. The bug has been introduced by commit 4cd6fe1c6483cde93e2ec91f58b7af9c9eea51ad ("bonding: fix link down handling in 802.3ad mode"). Signed-off-by: Jiri Bohac <[email protected]> Signed-off-by: Jay Vosburgh <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-04-20ehea: Fix a DLPAR bug on ehea_rereg_mrs().Breno Leitao1-3/+6
We are currently continuing if ehea_restart_qps() fails, when we do a memory DLPAR (remove or add more memory to the system). This patch just let the NAPI disabled if the ehea_restart_qps() fails. Signed-off-by: Breno Leitao <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-04-20[S390] kvm-390: Let kernel exit SIE instruction on workCarsten Otte1-2/+2
From: Christian Borntraeger <[email protected]> This patch fixes the sie exit on interrupts. The low level interrupt handler returns to the PSW address in pt_regs and not to the PSW address in the lowcore. Without this fix a cpu bound guest might never leave guest state since the host interrupt handler would blindly return to the SIE instruction, even on need_resched and friends. Cc: [email protected] Signed-off-by: Carsten Otte <[email protected]> Signed-off-by: Christian Borntraeger <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] dasd: check sense type in device change handlerStefan Weinhuber1-2/+3
When evaluating sense data in dasd_eckd_check_for_device_change, we must always check for the type of sense data in byte 27, bit 0, to make sure that the rest of the sense data is interpreted correctly. Signed-off-by: Stefan Weinhuber <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] pfault: fix token handlingHeiko Carstens1-2/+2
f6649a7e "[S390] cleanup lowcore access from external interrupts" changed handling of external interrupts. Instead of letting the external interrupt handlers accessing the per cpu lowcore the entry code of the kernel reads already all fields that are necessary and passes them to the handlers. The pfault interrupt handler was incorrectly converted. It tries to dereference a value which used to be a pointer to a lowcore field. After the conversion however it is not anymore the pointer to the field but its content. So instead of a dereference only a cast is needed to get the task pointer that caused the pfault. Fixes a NULL pointer dereference and a subsequent kernel crash: Unable to handle kernel pointer dereference at virtual kernel address (null) Oops: 0004 [#1] SMP Modules linked in: nfsd exportfs nfs lockd fscache nfs_acl auth_rpcgss sunrpc loop qeth_l3 qeth vmur ccwgroup ext3 jbd mbcache dm_mod dasd_eckd_mod dasd_diag_mod dasd_mod CPU: 0 Not tainted 2.6.38-2-s390x #1 Process cron (pid: 1106, task: 000000001f962f78, ksp: 000000001fa0f9d0) Krnl PSW : 0404200180000000 000000000002c03e (pfault_interrupt+0xa2/0x138) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:0 CC:2 PM:0 EA:3 Krnl GPRS: 0000000000000000 0000000000000001 0000000000000000 0000000000000001 000000001f962f78 0000000000518968 0000000090000002 000000001ff03280 0000000000000000 000000000064f000 000000001f962f78 0000000000002603 0000000006002603 0000000000000000 000000001ff7fe68 000000001ff7fe48 Krnl Code: 000000000002c036: 5820d010 l %r2,16(%r13) 000000000002c03a: 1832 lr %r3,%r2 000000000002c03c: 1a31 ar %r3,%r1 >000000000002c03e: ba23d010 cs %r2,%r3,16(%r13) 000000000002c042: a744fffc brc 4,2c03a 000000000002c046: a7290002 lghi %r2,2 000000000002c04a: e320d0000024 stg %r2,0(%r13) 000000000002c050: 07f0 bcr 15,%r0 Call Trace: ([<000000001f962f78>] 0x1f962f78) [<000000000001acda>] do_extint+0xf6/0x138 [<000000000039b6ca>] ext_no_vtime+0x30/0x34 [<000000007d706e04>] 0x7d706e04 Last Breaking-Event-Address: [<0000000000000000>] 0x0 For stable maintainers: the first kernel which contains this bug is 2.6.37. Reported-by: Stephen Powell <[email protected]> Cc: Jonathan Nieder <[email protected]> Cc: [email protected] Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] qdio: reset error states immediatelyJan Glauber1-5/+12
The qdio hardware may surpress further interrupts as long as a SBAL is in the error state. That can lead to unnotified data in the SBALs following the error state. To prevent this behaviour change the SBAL[s] in error state immediately to another program owned state so interrupts are again received for further traffic on the device. Signed-off-by: Jan Glauber <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] fix page table walk for changing page attributesJan Glauber1-2/+3
The page table walk for changing page attributes used the wrong address for pgd/pud/pmd lookups if the range was bigger than a pmd entry. Fix the lookup by using the correct address. Signed-off-by: Jan Glauber <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] prng: prevent access beyond end of stackJan Glauber1-1/+1
While initializing the state of the prng only the first 8 bytes of random data where used, the second 8 bytes were read from the memory after the stack. If only 64 bytes of the kernel stack are used and CONFIG_DEBUG_PAGEALLOC is enabled a kernel panic may occur because of the invalid page access. Use the correct multiplicator to stay within the random data buffer. Signed-off-by: Jan Glauber <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] dasd: fix race between open and offlineStefan Weinhuber5-60/+143
The dasd_open function uses the private_data pointer of the gendisk to find the dasd_block structure that matches the gendisk. When a DASD device is set offline, we set the private_data pointer of the gendisk to NULL and later remove the dasd_block structure, but there is still a small race window, in which dasd_open could first read a pointer from the private_data field and then try to use it, after the structure has already been freed. To close this race window, we will store a pointer to the dasd_devmap structure of the base device in the private_data field. The devmap entries are not deleted, and we already have proper locking and reference counting in place, so that we can safely get from a devmap pointer to the dasd_device and dasd_block structures of the device. Signed-off-by: Stefan Weinhuber <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20md: Update documentation for sync_min and sync_max entriesCoolCold1-0/+10
linux/Documentation/md.txt is missing description for sync_min and sync_max entries. This patch adds description for sync_min and sync_max entries. Signed-off-by: Roman Ovchinnikov <[email protected]> Signed-off-by: NeilBrown <[email protected]>
2011-04-20md: Cleanup after raid45->raid0 takeoverKrzysztof Wojcik1-0/+1
Problem: After raid4->raid0 takeover operation, another takeover operation (e.g raid0->raid10) results "kernel oops". Root cause: Variables 'degraded' in mddev structure is not cleared on raid45->raid0 takeover. This patch reset this variable. Signed-off-by: Krzysztof Wojcik <[email protected]> Signed-off-by: NeilBrown <[email protected]>
2011-04-20md: Fix dev_sectors on takeover from raid0 to raid4/5NeilBrown1-0/+4
A raid0 array doesn't set 'dev_sectors' as each device might contribute a different number of sectors. So when converting to a RAID4 or RAID5 we need to set dev_sectors as they need the number. We have already verified that in fact all devices do contribute the same number of sectors, so use that number. Signed-off-by: NeilBrown <[email protected]>
2011-04-20md/raid5: remove setting of ->queue_lockNeilBrown1-1/+0
We previously needed to set ->queue_lock to match the raid5 device_lock so we could safely use queue_flag_* operations (e.g. for plugging). which test the ->queue_lock is in fact locked. However that need has completely gone away and is unlikely to come back to remove this now-pointless setting. Signed-off-by: NeilBrown <[email protected]>
2011-04-19can: Add missing socket check in can/bcm release.Dave Jones1-1/+6
We can get here with a NULL socket argument passed from userspace, so we need to handle it accordingly. Signed-off-by: Dave Jones <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-04-19Merge branch 'drm-fixes' of ↵Linus Torvalds16-92/+102
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: pll tweaks for r7xx drm/nouveau: fix allocation of notifier object drm/nouveau: fix notifier memory corruption bug drm/nouveau: fix pinning of notifier block drm/nouveau: populate ttm_alloced with false, when it's not drm/nouveau: fix nv30 pcie boards drm/nouveau: split ramin_lock into two locks, one hardirq safe drm/radeon/kms: adjust evergreen display watermark setup drm/radeon/kms: add connectors even if i2c fails drm/radeon/kms: fix bad shift in atom iio table parser
2011-04-20drm/radeon/kms: fix IH writeback on r6xx+ on big endian machinesCédric Cano2-2/+2
agd5f: fix commit message. Signed-off-by: Cedric Cano <[email protected]> Reviewed-by: Michel Dänzer <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2011-04-19Btrfs: do some plugging in the submit_bio threadsChris Mason1-0/+10
The Btrfs submit bio threads have a small number of threads responsible for pushing down bios we've collected for a large number of devices. Since we do all the bios for a single device at once, we want to make sure we unplug and send down the bios for each device as we're done processing them. The new plugging API removed the btrfs code to unplug while processing bios, this adds it back with the new API. Signed-off-by: Chris Mason <[email protected]>
2011-04-19davinci: fix DEBUG_LL code for p2v changesKevin Hilman2-6/+9
Fixup davinci UART low-level debug code for new ARM generic p2v changes. Based on OMAP changes by Tony Lindgren Cc: Tony Lindgren <[email protected]> Signed-off-by: Kevin Hilman <[email protected]>
2011-04-20drm/radeon/kms: pll tweaks for r7xxAlex Deucher1-5/+1
Prefer min m to max p only on pre-r7xx asics. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=36197 Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected] Signed-off-by: Dave Airlie <[email protected]>
2011-04-19tty/n_gsm: fix bug in CRC calculation for gsm1 modeMikhail Kshevetskiy1-2/+6
Problem description: gsm_queue() calculate a CRC for arrived frames. As a last step of CRC calculation it call gsm->fcs = gsm_fcs_add(gsm->fcs, gsm->received_fcs); This work perfectly for the case of GSM0 mode as gsm->received_fcs contain the last piece of data required to generate final CRC. gsm->received_fcs is not used for GSM1 mode. Thus we put an additional byte to CRC calculation. As result we get a wrong CRC and reject incoming frame. Signed-off-by: Mikhail Kshevetskiy <[email protected]> Acked-by: Alan Cox <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2011-04-19serial/imx: read cts state only after acking cts change irqUwe Kleine-König1-1/+2
If cts changes between reading the level at the cts input (USR1_RTSS) and acking the irq (USR1_RTSD) the last edge doesn't generate an irq and uart_handle_cts_change is called with a outdated value for cts. The race was introduced by commit ceca629 ([ARM] 2971/1: i.MX uart handle rts irq) Reported-by: Arwed Springer <[email protected]> Tested-by: Arwed Springer <[email protected]> Cc: [email protected] # 2.6.14+ Signed-off-by: Uwe Kleine-König <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2011-04-19parport_pc.c: correctly release the requested region for the IT887xNiels de Vos1-5/+3
Replace release_resource() by release_region() and also fix the inconsistency in the size of the requested/released region. The size of the resource should be 32, not 0x8 like it was corrected in commit e7c310c36e5fdf1b83a459e5db167bfbd86137db already. CC: [email protected] Reported-by: Julia Lawall <[email protected]> Signed-off-by: Niels de Vos <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2011-04-20Merge remote branch 'nouveau/drm-nouveau-fixes' of /ssd/git/drm-nouveau-next ↵Dave Airlie11-22/+36
into drm-fixes * 'nouveau/drm-nouveau-fixes' of /ssd/git/drm-nouveau-next: drm/nouveau: fix allocation of notifier object drm/nouveau: fix notifier memory corruption bug drm/nouveau: fix pinning of notifier block drm/nouveau: populate ttm_alloced with false, when it's not drm/nouveau: fix nv30 pcie boards drm/nouveau: split ramin_lock into two locks, one hardirq safe
2011-04-20drm/nouveau: fix allocation of notifier objectMarcin Slusarz1-1/+1
Commit 73412c3854c877e5f37ad944ee8977addde4d35a ("drm/nouveau: allocate kernel's notifier object at end of block") intended to align end of notifier block to page boundary, but start of block was miscalculated to be off by -16 bytes. Fix it. Signed-off-by: Marcin Slusarz <[email protected]> Cc: Ben Skeggs <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2011-04-20drm/nouveau: fix notifier memory corruption bugMarcin Slusarz1-2/+2
nouveau_bo_wr32 expects offset to be in words, but we pass value in bytes, so after commit 73412c3854c877e5f37ad944ee8977addde4d35a ("drm/nouveau: allocate kernel's notifier object at end of block") we started to overwrite some memory after notifier buffer object (previously m2mf_ntfy was always 0, so it didn't matter it was a value in bytes). Reported-by: Dominik Brodowski <[email protected]> Reported-by: Nigel Cunningham <[email protected]> Signed-off-by: Marcin Slusarz <[email protected]> Cc: Ben Skeggs <[email protected]> Cc: Pekka Paalanen <[email protected]> Cc: [email protected] [2.6.38] Signed-off-by: Ben Skeggs <[email protected]>
2011-04-20drm/nouveau: fix pinning of notifier blockBen Skeggs1-4/+7
Problem introduced with commit 6ba9a68317781537d6184d3fdb2d0f20c97da3a4 Reported-by: Bob Gleitsmann <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2011-04-20drm/nouveau: populate ttm_alloced with false, when it's notBen Skeggs1-0/+1
Caught with kmemcheck on unrelated business. Signed-off-by: Ben Skeggs <[email protected]>
2011-04-20drm/nouveau: fix nv30 pcie boardsBen Skeggs2-3/+3
Wasn't aware they even existed, apparently they do! They're actually AGP chips with a bridge as far as I can tell, which puts them in the same boat as nv40/nv45. Signed-off-by: Ben Skeggs <[email protected]>
2011-04-20drm/nouveau: split ramin_lock into two locks, one hardirq safeBen Skeggs6-12/+22
Fixes a possible lock ordering reversal between context_switch_lock and ramin_lock. Signed-off-by: Ben Skeggs <[email protected]> Reviewed-by: Francisco Jerez <[email protected]>
2011-04-20PM: Add missing syscore_suspend() and syscore_resume() callsRafael J. Wysocki4-1/+22
Device suspend/resume infrastructure is used not only by the suspend and hibernate code in kernel/power, but also by APM, Xen and the kexec jump feature. However, commit 40dc166cb5dddbd36aa4ad11c03915ea (PM / Core: Introduce struct syscore_ops for core subsystems PM) failed to add syscore_suspend() and syscore_resume() calls to that code, which generally leads to breakage when the features in question are used. To fix this problem, add the missing syscore_suspend() and syscore_resume() calls to arch/x86/kernel/apm_32.c, kernel/kexec.c and drivers/xen/manage.c. Signed-off-by: Rafael J. Wysocki <[email protected]> Acked-by: Greg Kroah-Hartman <[email protected]> Acked-by: Ian Campbell <[email protected]>
2011-04-20xtensa: Fixup irq conversion fallout and nmi_countThomas Gleixner1-12/+6
Some unnamed moron fatfingered the arguments of the irq chip callbacks to irq_chip instead of irq_data. While at it remove the nmi_count() print in arch_show_interrupts() which has been broken before the irq conversion already. Signed-off-by: Thomas Gleixner <[email protected]>
2011-04-19Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds64-203/+330
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (51 commits) netfilter: ipset: Fix the order of listing of sets ip6_pol_route panic: Do not allow VLAN on loopback bnx2x: Fix port identification problem r8169: add Realtek as maintainer. ip: ip_options_compile() resilient to NULL skb route bna: fix memory leak during RX path cleanup bna: fix for clean fw re-initialization usbnet: Fix up 'FLAG_POINTTOPOINT' and 'FLAG_MULTI_PACKET' overlaps. iwlegacy: fix tx_power initialization Revert "tcp: disallow bind() to reuse addr/port" qlcnic: limit skb frags for non tso packet net: can: mscan: fix build breakage in mpc5xxx_can netfilter: ipset: set match and SET target fixes netfilter: ipset: bitmap:ip,mac type requires "src" for MAC sctp: fix oops while removed transport still using as retran path sctp: fix oops when updating retransmit path with DEBUG on net: Disable NETIF_F_TSO_ECN when TSO is disabled net: Disable all TSO features when SG is disabled sfc: Use rmb() to ensure reads occur in order ieee802154: Remove hacked CFLAGS in net/ieee802154/Makefile ...
Powered by cgit, Gruvboxed by Blaster4385.