aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2012-07-09drivers/isdn/mISDN/stack.c: remove invalid reference to list iterator variableJulia Lawall1-2/+2
If list_for_each_entry, etc complete a traversal of the list, the iterator variable ends up pointing to an address at an offset from the list head, and not a meaningful structure. Thus this value should not be used after the end of the iterator. The dereferences are just deleted from the debugging statement. This problem was found using Coccinelle (http://coccinelle.lip6.fr/). Signed-off-by: Julia Lawall <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09net: cgroup: fix out of bounds accessesEric Dumazet2-4/+8
dev->priomap is allocated by extend_netdev_table() called from update_netdev_tables(). And this is only called if write_priomap() is called. But if write_priomap() is not called, it seems we can have out of bounds accesses in cgrp_destroy(), read_priomap() & skb_update_prio() With help from Gao Feng Signed-off-by: Eric Dumazet <[email protected]> Cc: Neil Horman <[email protected]> Cc: Gao feng <[email protected]> Acked-by: Gao feng <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09bonding: debugfs and network namespaces are incompatibleEric W. Biederman1-1/+1
The bonding debugfs support has been broken in the presence of network namespaces since it has been added. The debugfs support does not handle multiple bonding devices with the same name in different network namespaces. I haven't had any bug reports, and I'm not interested in getting any. Disable the debugfs support when network namespaces are enabled. Signed-off-by: "Eric W. Biederman" <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09bonding: Manage /proc/net/bonding/ entries from the netdev eventsEric W. Biederman1-3/+6
It was recently reported that moving a bonding device between network namespaces causes warnings from /proc. It turns out after the move we were trying to add and to remove the /proc/net/bonding entries from the wrong network namespace. Move the bonding /proc registration code into the NETDEV_REGISTER and NETDEV_UNREGISTER events where the proc registration and unregistration will always happen at the right time. Signed-off-by: "Eric W. Biederman" <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09stmmac: Fix for higher mtu size handlingDeepak Sikri1-1/+2
For the higher mtu sizes requiring the buffer size greater than 8192, the buffers are sent or received using multiple dma descriptors/ same descriptor with option of multi buffer handling. It was observed during tests that the driver was missing on data packets during the normal ping operations if the data buffers being used catered to jumbo frame handling. The memory barrriers are added in between preparation of dma descriptors in the jumbo frame handling path to ensure all instructions before enabling the dma are complete. Signed-off-by: Deepak Sikri <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09stmmac: Fix for nfs hang on multiple rebootDeepak Sikri1-0/+3
It was observed that during multiple reboots nfs hangs. The status of receive descriptors shows that all the descriptors were in control of CPU, and none were assigned to DMA. Also the DMA status register confirmed that the Rx buffer is unavailable. This patch adds the fix for the same by adding the memory barriers to ascertain that the all instructions before enabling the Rx or Tx DMA are completed which involves the proper setting of the ownership bit in DMA descriptors. Signed-off-by: Deepak Sikri <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09Merge tag 'regulator-3.5' of ↵Linus Torvalds1-5/+5
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A smallish fix for a lock dependency issue which affects a bunch of Qualcomm boards that do unusually complicated things with their regulators, the API is unlikely to be called by any other system." * tag 'regulator-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: Fix recursive mutex lockdep warning
2012-07-09gspca_sn9c20x: Fix NULL pointer dereferenceHans de Goede1-5/+8
Don't call v4l2_ctrl_g_ctrl on ctrls which the model cam in question does not have. Reported-by: Frank Schäfer <[email protected]> Signed-off-by: Hans de Goede <[email protected]> [ Taken directly, since Mauro is on vacation ] Signed-off-by: Linus Torvalds <[email protected]>
2012-07-09Merge tag 'virtio-for-linus' of ↵Linus Torvalds1-14/+10
git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus Pull minor virtio-balloon fix from Rusty Russell: "Theoretical fix, which greatly simplifies upcoming balloon patches which will go in via some vm tree." * tag 'virtio-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus: virtio-balloon: fix add/get API use
2012-07-09Merge tag 'rpmsg-3.5-fixes' of ↵Linus Torvalds2-5/+56
git://git.kernel.org/pub/scm/linux/kernel/git/ohad/rpmsg Pull rpmsg fixes from Ohad Ben-Cohen: "Fixing two (somewhat rare) endpoint-related race issues, both of which were reported by Fernando Guzman Lugo." * tag 'rpmsg-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/rpmsg: rpmsg: make sure inflight messages don't invoke just-removed callbacks rpmsg: avoid premature deallocation of endpoints
2012-07-09Merge tag 'remoteproc-3.5-fixes' of ↵Linus Torvalds1-0/+2
git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc Pull remoteproc fixes from Ohad Ben-Cohen: "Two build-related remoteproc fixes for 3.5." * tag 'remoteproc-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc: remoteproc: fix missing CONFIG_FW_LOADER configurations remoteproc/omap: fix randconfig unmet direct dependencies
2012-07-09Merge tag 'hwspinlock-3.5-fixes' of ↵Linus Torvalds1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/ohad/hwspinlock Pull hwspinlock fix from Ohad Ben-Cohen: "A single hwspinlock core fix for multiple hwspinlock devices scenarios, from Shinya Kuribayashi." * tag 'hwspinlock-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/hwspinlock: hwspinlock/core: use global ID to register hwspinlocks on multiple devices
2012-07-09kmsg: merge continuation records while printingKay Sievers1-42/+78
In (the unlikely) case our continuation merge buffer is busy, we unfortunately can not merge further continuation printk()s into a single record and have to store them separately, which leads to split-up output of these lines when they are printed. Add some flags about newlines and prefix existence to these records and try to reconstruct the full line again, when the separated records are printed. Reported-By: Michael Neuling <[email protected]> Cc: Dave Jones <[email protected]> Cc: Linus Torvalds <[email protected]> Tested-By: Michael Neuling <[email protected]> Signed-off-by: Kay Sievers <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2012-07-09Merge branch 'master' of ↵John W. Linville7-17/+14
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2012-07-09iwlegacy: don't mess up the SCD when removing a keyEmmanuel Grumbach1-2/+2
When we remove a key, we put a key index which was supposed to tell the fw that we are actually removing the key. But instead the fw took that index as a valid index and messed up the SRAM of the device. This memory corruption on the device mangled the data of the SCD. The impact on the user is that SCD queue 2 got stuck after having removed keys. Reported-by: Paul Bolle <[email protected]> Cc: [email protected] Signed-off-by: Emmanuel Grumbach <[email protected]> Signed-off-by: Stanislaw Gruszka <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2012-07-09iwlegacy: always monitor for stuck queuesStanislaw Gruszka1-8/+6
This is iwlegacy version of: commit 342bbf3fee2fa9a18147e74b2e3c4229a4564912 Author: Johannes Berg <[email protected]> Date: Sun Mar 4 08:50:46 2012 -0800 iwlwifi: always monitor for stuck queues If we only monitor while associated, the following can happen: - we're associated, and the queue stuck check runs, setting the queue "touch" time to X - we disassociate, stopping the monitoring, which leaves the time set to X - almost 2s later, we associate, and enqueue a frame - before the frame is transmitted, we monitor for stuck queues, and find the time set to X, although it is now later than X + 2000ms, so we decide that the queue is stuck and erroneously restart the device Cc: [email protected] Signed-off-by: Stanislaw Gruszka <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2012-07-09rt2x00usb: fix indexes ordering on RX queue kickStanislaw Gruszka1-1/+1
On rt2x00_dmastart() we increase index specified by Q_INDEX and on rt2x00_dmadone() we increase index specified by Q_INDEX_DONE. So entries between Q_INDEX_DONE and Q_INDEX are those we currently process in the hardware. Entries between Q_INDEX and Q_INDEX_DONE are those we can submit to the hardware. According to that fix rt2x00usb_kick_queue(), as we need to submit RX entries that are not processed by the hardware. It worked before only for empty queue, otherwise was broken. Note that for TX queues indexes ordering are ok. We need to kick entries that have filled skb, but was not submitted to the hardware, i.e. started from Q_INDEX_DONE and have ENTRY_DATA_PENDING bit set. From practical standpoint this fixes RX queue stall, usually reproducible in AP mode, like for example reported here: https://bugzilla.redhat.com/show_bug.cgi?id=828824 Reported-and-tested-by: Franco Miceli <[email protected]> Reported-and-tested-by: Tom Horsley <[email protected]> Cc: [email protected] Signed-off-by: Stanislaw Gruszka <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2012-07-09mwifiex: fix Coverity SCAN CID 709078: Resource leak (RESOURCE_LEAK)Bing Zhao1-0/+1
> *. CID 709078: Resource leak (RESOURCE_LEAK) > - drivers/net/wireless/mwifiex/cfg80211.c, line: 935 > Assigning: "bss_cfg" = storage returned from "kzalloc(132UL, 208U)" > - but was not free > drivers/net/wireless/mwifiex/cfg80211.c:935 Signed-off-by: Bing Zhao <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2012-07-09mac80211: destroy assoc_data correctly if assoc failsEliad Peller1-4/+2
If association failed due to internal error (e.g. no supported rates IE), we call ieee80211_destroy_assoc_data() with assoc=true, while we actually reject the association. This results in the BSSID not being zeroed out. After passing assoc=false, we no longer have to call sta_info_destroy_addr() explicitly. While on it, move the "associated" message after the assoc_success check. Cc: [email protected] [3.4+] Signed-off-by: Eliad Peller <[email protected]> Reviewed-by: Johannes Berg <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2012-07-09NFC: Prevent NULL deref when getting socket nameSasha Levin1-1/+1
llcp_sock_getname can be called without a device attached to the nfc_llcp_sock. This would lead to the following BUG: [ 362.341807] BUG: unable to handle kernel NULL pointer dereference at (null) [ 362.341815] IP: [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0 [ 362.341818] PGD 31b35067 PUD 30631067 PMD 0 [ 362.341821] Oops: 0000 [#627] PREEMPT SMP DEBUG_PAGEALLOC [ 362.341826] CPU 3 [ 362.341827] Pid: 7816, comm: trinity-child55 Tainted: G D W 3.5.0-rc4-next-20120628-sasha-00005-g9f23eb7 #479 [ 362.341831] RIP: 0010:[<ffffffff836258e5>] [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0 [ 362.341832] RSP: 0018:ffff8800304fde88 EFLAGS: 00010286 [ 362.341834] RAX: 0000000000000000 RBX: ffff880033cb8000 RCX: 0000000000000001 [ 362.341835] RDX: ffff8800304fdec4 RSI: ffff8800304fdec8 RDI: ffff8800304fdeda [ 362.341836] RBP: ffff8800304fdea8 R08: 7ebcebcb772b7ffb R09: 5fbfcb9c35bdfd53 [ 362.341838] R10: 4220020c54326244 R11: 0000000000000246 R12: ffff8800304fdec8 [ 362.341839] R13: ffff8800304fdec4 R14: ffff8800304fdec8 R15: 0000000000000044 [ 362.341841] FS: 00007effa376e700(0000) GS:ffff880035a00000(0000) knlGS:0000000000000000 [ 362.341843] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 362.341844] CR2: 0000000000000000 CR3: 0000000030438000 CR4: 00000000000406e0 [ 362.341851] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 362.341856] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 362.341858] Process trinity-child55 (pid: 7816, threadinfo ffff8800304fc000, task ffff880031270000) [ 362.341858] Stack: [ 362.341862] ffff8800304fdea8 ffff880035156780 0000000000000000 0000000000001000 [ 362.341865] ffff8800304fdf78 ffffffff83183b40 00000000304fdec8 0000006000000000 [ 362.341868] ffff8800304f0027 ffffffff83729649 ffff8800304fdee8 ffff8800304fdf48 [ 362.341869] Call Trace: [ 362.341874] [<ffffffff83183b40>] sys_getpeername+0xa0/0x110 [ 362.341877] [<ffffffff83729649>] ? _raw_spin_unlock_irq+0x59/0x80 [ 362.341882] [<ffffffff810f342b>] ? do_setitimer+0x23b/0x290 [ 362.341886] [<ffffffff81985ede>] ? trace_hardirqs_on_thunk+0x3a/0x3f [ 362.341889] [<ffffffff8372a539>] system_call_fastpath+0x16/0x1b [ 362.341921] Code: 84 00 00 00 00 00 b8 b3 ff ff ff 48 85 db 74 54 66 41 c7 04 24 27 00 49 8d 7c 24 12 41 c7 45 00 60 00 00 00 48 8b 83 28 05 00 00 <8b> 00 41 89 44 24 04 0f b6 83 41 05 00 00 41 88 44 24 10 0f b6 [ 362.341924] RIP [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0 [ 362.341925] RSP <ffff8800304fde88> [ 362.341926] CR2: 0000000000000000 [ 362.341928] ---[ end trace 6d450e935ee18bf3 ]--- Signed-off-by: Sasha Levin <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2012-07-09mac80211: correct size the argument to kzalloc in minstrel_htThomas Huehn1-1/+1
msp has type struct minstrel_ht_sta_priv not struct minstrel_ht_sta. (This incorporates the fixup originally posted as "mac80211: fix kzalloc memory corruption introduced in minstrel_ht". -- JWL) Reported-by: Fengguang Wu <[email protected]> Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Thomas Huehn <[email protected]> Acked-by: Johannes Berg <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2012-07-09Merge branch 'kevin' into fixesLinus Walleij1-1/+13
2012-07-09Merge tag 'iommu-fixes-v3.5-rc5' of ↵Linus Torvalds5-9/+18
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: "The patches fix several issues in the AMD IOMMU driver, the NVidia SMMU driver, and the DMA debug code. The most important fix for the AMD IOMMU solves a problem with SR-IOV devices where virtual functions did not work with IOMMU enabled. The NVidia SMMU patch fixes a possible sleep while spin-lock situation (queued the small fix for v3.5, a better but more intrusive fix is coming for v3.6). The DMA debug patches fix a possible data corruption issue due to bool vs u32 usage." * tag 'iommu-fixes-v3.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/amd: fix type bug in flush code dma-debug: debugfs_create_bool() takes a u32 pointer iommu/tegra: smmu: Fix unsleepable memory allocation iommu/amd: Initialize dma_ops for hotplug and sriov devices iommu/amd: Fix missing iommu_shutdown initialization in passthrough mode
2012-07-09kmsg: /proc/kmsg - support reading of partial log recordsKay Sievers1-8/+20
Restore support for partial reads of any size on /proc/kmsg, in case the supplied read buffer is smaller than the record size. Some people seem to think is is ia good idea to run: $ dd if=/proc/kmsg bs=1 of=... as a klog bridge. Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=44211 Reported-by: Jukka Ollila <[email protected]> Signed-off-by: Kay Sievers <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2012-07-09HID: add Sennheiser BTD500USB device supportFrank Kunz2-0/+4
The Sennheiser BTD500USB composit device requires the HID_QUIRK_NOGET flag to be set for working proper. Without the flag the device crashes during hid intialization. Signed-off-by: Frank Kunz <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
2012-07-09Merge branch 'master' of git://1984.lsi.us.es/nfDavid S. Miller2-2/+4
Pablo Neira Ayuso says: ==================== * One to get the timeout special parameter for the SET target back working (this was introduced while trying to fix another bug in 3.4) from Jozsef Kadlecsik. * One crash fix if containers and nf_conntrack are used reported by Hans Schillstrom by myself. ==================== Signed-off-by: David S. Miller <[email protected]>
2012-07-09netfilter: nf_ct_ecache: fix crash with multiple containers, one shutting downPablo Neira Ayuso1-1/+1
Hans reports that he's still hitting: BUG: unable to handle kernel NULL pointer dereference at 000000000000027c IP: [<ffffffff813615db>] netlink_has_listeners+0xb/0x60 PGD 0 Oops: 0000 [#3] PREEMPT SMP CPU 0 It happens when adding a number of containers with do: nfct_query(h, NFCT_Q_CREATE, ct); and most likely one namespace shuts down. this problem was supposed to be fixed by: 70e9942 netfilter: nf_conntrack: make event callback registration per-netns Still, it was missing one rcu_access_pointer to check if the callback is set or not. Reported-by: Hans Schillstrom <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2012-07-09netfilter: ipset: timeout fixing bug broke SET target special timeout valueJozsef Kadlecsik1-1/+3
The patch "127f559 netfilter: ipset: fix timeout value overflow bug" broke the SET target when no timeout was specified. Reported-by: Jean-Philippe Menil <[email protected]> Signed-off-by: Jozsef Kadlecsik <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2012-07-09ARM: OMAP2+: omap2plus_defconfig: EHCI driver is not stable, disable itKevin Hilman1-1/+0
The EHCI driver is not stable enough to be enabled by default. In v3.5, it has at least the following problems: - warning dump during bootup - hang during suspend - prevents CORE powerdomain from entering retention during idle (even when no USB devices connected.) This demonstrates that this driver has not been thoroughly tested and therfore should not be enabled in the default defconfig. In addition, the problems above cause new PM regressions which need be addressed before this driver should be enabled in the default defconfig. Signed-off-by: Kevin Hilman <[email protected]> Signed-off-by: Tony Lindgren <[email protected]>
2012-07-09cnic: Don't use netdev->base_addrMichael Chan1-2/+5
commit c0357e975afdbbedab5c662d19bef865f02adc17 bnx2: stop using net_device.{base_addr, irq}. removed netdev->base_addr so we need to update cnic to get the MMIO base address from pci_resource_start(). Otherwise, mmap of the uio device will fail. Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09net: qmi_wwan: add ZTE MF60Bjørn Mork1-0/+18
Adding a device with limited QMI support. It does not support normal QMI_WDS commands for connection management. Instead, sending a QMI_CTL SET_INSTANCE_ID command is required to enable the network interface: 01 0f 00 00 00 00 00 00 20 00 04 00 01 01 00 00 A number of QMI_DMS and QMI_NAS commands are also supported for optional device management. Signed-off-by: Bjørn Mork <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09cgroup: fix panic in netprio_cgroupGao feng1-1/+2
we set max_prioidx to the first zero bit index of prioidx_map in function get_prioidx. So when we delete the low index netprio cgroup and adding a new netprio cgroup again,the max_prioidx will be set to the low index. when we set the high index cgroup's net_prio.ifpriomap,the function write_priomap will call update_netdev_tables to alloc memory which size is sizeof(struct netprio_map) + sizeof(u32) * (max_prioidx + 1), so the size of array that map->priomap point to is max_prioidx +1, which is low than what we actually need. fix this by adding check in get_prioidx,only set max_prioidx when max_prioidx low than the new prioidx. Signed-off-by: Gao feng <[email protected]> Acked-by: Neil Horman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09netdev/phy: Fixup lockdep warnings in mdio-mux.cDavid Daney1-2/+8
With lockdep enabled we get: ============================================= [ INFO: possible recursive locking detected ] 3.4.4-Cavium-Octeon+ #313 Not tainted --------------------------------------------- kworker/u:1/36 is trying to acquire lock: (&bus->mdio_lock){+.+...}, at: [<ffffffff813da7e8>] mdio_mux_read+0x38/0xa0 but task is already holding lock: (&bus->mdio_lock){+.+...}, at: [<ffffffff813d79e4>] mdiobus_read+0x44/0x88 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&bus->mdio_lock); lock(&bus->mdio_lock); *** DEADLOCK *** May be due to missing lock nesting notation . . . This is a false positive, since we are indeed using 'nested' locking, we need to use mutex_lock_nested(). Now in theory we can stack multiple MDIO multiplexers, but that would require passing the nesting level (which is difficult to know) to mutex_lock_nested(). Instead we assume the simple case of a single level of nesting. Since these are only warning messages, it isn't so important to solve the general case. Signed-off-by: David Daney <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09ixgbe: DCB and SR-IOV can not co-exist and will cause hangsAlexander Duyck1-0/+5
DCB and SR-IOV cannot currently be enabled at the same time as the queueing schemes are incompatible. If they are both enabled it will result in Tx hangs since only the first Tx queue will be able to transmit any traffic. This simple fix for this is to block us from enabling TCs in ixgbe_setup_tc if SR-IOV is enabled. This change will be reverted once we can support SR-IOV and DCB coexistence. Signed-off-by: Alexander Duyck <[email protected]> Acked-by: John Fastabend <[email protected]> Tested-by: Phil Schmitt <[email protected]> Tested-by: Ross Brattain <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09netem: add limitation to reordered packetsEric Dumazet1-27/+15
Fix two netem bugs : 1) When a frame was dropped by tfifo_enqueue(), drop counter was incremented twice. 2) When reordering is triggered, we enqueue a packet without checking queue limit. This can OOM pretty fast when this is repeated enough, since skbs are orphaned, no socket limit can help in this situation. Signed-off-by: Eric Dumazet <[email protected]> Cc: Mark Gordon <[email protected]> Cc: Andreas Terzis <[email protected]> Cc: Yuchung Cheng <[email protected]> Cc: Hagen Paul Pfeifer <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-08atl1c: fix issue of transmit queue 0 timed outCloud Ren1-1/+0
some people report atl1c could cause system hang with following kernel trace info: --------------------------------------- WARNING: at.../net/sched/sch_generic.c:258 dev_watchdog+0x1db/0x1d0() ... NETDEV WATCHDOG: eth0 (atl1c): transmit queue 0 timed out ... --------------------------------------- This is caused by netif_stop_queue calling when cable Link is down. So remove netif_stop_queue, because link_watch will take it over. Signed-off-by: xiong <[email protected]> Cc: stable <[email protected]> Signed-off-by: Cloud Ren <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-08net: dont use __netdev_alloc_skb for bounce bufferEric Dumazet2-3/+3
commit a1c7fff7e1 (net: netdev_alloc_skb() use build_skb()) broke b44 on some 64bit machines. It appears b44 and b43 use __netdev_alloc_skb() instead of alloc_skb() for their bounce buffers. There is no need to add an extra NET_SKB_PAD reservation for bounce buffers : - In TX path, NET_SKB_PAD is useless - In RX path in b44, we force a copy of incoming frames if GFP_DMA allocations were needed. Reported-and-bisected-by: Stefan Bader <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-08ieee802154: verify packet size before trying to allocate itSasha Levin1-6/+6
Currently when sending data over datagram, the send function will attempt to allocate any size passed on from the userspace. We should make sure that this size is checked and limited. We'll limit it to the MTU of the device, which is checked later anyway. Signed-off-by: Sasha Levin <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2012-07-09md/raid1: fix use-after-free bug in RAID1 data-check code.NeilBrown1-1/+2
This bug has been present ever since data-check was introduce in 2.6.16. However it would only fire if a data-check were done on a degraded array, which was only possible if the array has 3 or more devices. This is certainly possible, but is quite uncommon. Since hot-replace was added in 3.3 it can happen more often as the same condition can arise if not all possible replacements are present. The problem is that as soon as we submit the last read request, the 'r1_bio' structure could be freed at any time, so we really should stop looking at it. If the last device is being read from we will stop looking at it. However if the last device is not due to be read from, we will still check the bio pointer in the r1_bio, but the r1_bio might already be free. So use the read_targets counter to make sure we stop looking for bios to submit as soon as we have submitted them all. This fix is suitable for any -stable kernel since 2.6.16. Cc: [email protected] Reported-by: Arnold Schulz <[email protected]> Signed-off-by: NeilBrown <[email protected]>
2012-07-09virtio-balloon: fix add/get API useMichael S. Tsirkin1-14/+10
Since ee7cd8981e15bcb365fc762afe3fc47b8242f630 'virtio: expose added descriptors immediately.', in virtio balloon virtqueue_get_buf might now run concurrently with virtqueue_kick. I audited both and this seems safe in practice but this is not guaranteed by the API. Additionally, a spurious interrupt might in theory make virtqueue_get_buf run in parallel with virtqueue_add_buf, which is racy. While we might try to protect against spurious callbacks it's easier to fix the driver: balloon seems to be the only one (mis)using the API like this, so let's just fix balloon. Signed-off-by: Michael S. Tsirkin <[email protected]> Signed-off-by: Rusty Russell <[email protected]> (removed unused var)
2012-07-09mfd: Add missing hunk to change palmas irq to clear on readGraeme Gregory1-1/+8
During conversion to regmap_irq this hunk was missing being moved to MFD driver to put the chip into clear on read mode. Also as slave is now set use it to determine which slave for the register call. Signed-off-by: Graeme Gregory <[email protected]> Signed-off-by: Samuel Ortiz <[email protected]>
2012-07-09mfd: Fix palmas regulator pdata missingGraeme Gregory1-0/+3
Due to a merge error the section of code passing the pdata for the regulator driver to the mfd_add_devices via the children structure was missing. This corrects this problem. Signed-off-by: Graeme Gregory <[email protected]> Signed-off-by: Samuel Ortiz <[email protected]>
2012-07-09mfd: USB: Fix the omap-usb EHCI ULPI PHY reset fix issues.Russ Dill2-11/+55
'ARM: OMAP3: USB: Fix the EHCI ULPI PHY reset issue' (1fcb57d0) fixes an issue where the ULPI PHYs were not held in reset while initializing the EHCI controller. However, it also changes behavior in omap-usb-host.c omap_usbhs_init by releasing reset while the configuration in that function was done. This change caused a regression on BB-xM where USB would not function if 'usb start' had been run from u-boot before booting. A change was made to release reset a little bit earlier which fixed the issue on BB-xM and did not cause any regressions on 3430 sdp, the board for which the fix was originally made. This new fix, 'USB: EHCI: OMAP: Finish ehci omap phy reset cycle before adding hcd.', (3aa2ae74) caused a regression on OMAP5. The original fix to hold the EHCI controller in reset during initialization was correct, however it appears that changing omap_usbhs_init to not hold the PHYs in reset during it's configuration was incorrect. This patch first reverts both fixes, and then changes ehci_hcd_omap_probe in ehci-omap.c to hold the PHYs in reset as the original patch had done. It also is sure to incorporate the _cansleep change that has been made in the meantime. I've tested this on Beagleboard xM, I'd really like to get an ack from the 3430 sdp and OMAP5 guys before getting this merged. v3 - Brown paper bag its too early in the morning actually run git commit amend fix v2 - Put cansleep gpiolib call outside of spinlock Acked-by: Mantesh Sarashetti <[email protected]> Tested-by: Mantesh Sarashetti <[email protected]> Acked-by: Keshava Munegowda <[email protected]> Tested-by: Keshava Munegowda <[email protected]> Signed-off-by: Russ Dill <[email protected]> Signed-off-by: Samuel Ortiz <[email protected]>
2012-07-09mfd: Update twl6040 Kconfig to avoid build breakagePeter Ujfalusi1-0/+1
twl6040 needs CONFIG_IRQ_DOMAIN to compile, without this we have: drivers/mfd/twl6040-irq.c: In function 'twl6040_irq_init': drivers/mfd/twl6040-irq.c:164:2: error: implicit declaration of function 'irq_domain_add_legacy' drivers/mfd/twl6040-irq.c:165:11: error: 'irq_domain_simple_ops' undeclared (first use in this function) drivers/mfd/twl6040-irq.c:165:11: note: each undeclared identifier is reported only once for each function it appears in Reported-by: Randy Dunlap <[email protected]> Signed-off-by: Peter Ujfalusi <[email protected]> Signed-off-by: Samuel Ortiz <[email protected]>
2012-07-09mfd: Delete ab5500-core.hPaul Bolle1-87/+0
Commit 72fb92200d6c31b9982c06784e4bcff2f5b7d8b6 ("mfd/ab5500: delete AB5500 support") deleted all files that used ab5500-core.h. That file apparently was simply overlooked. Delete it too. Acked-by: Linus Walleij <[email protected]> Signed-off-by: Paul Bolle <[email protected]> Signed-off-by: Samuel Ortiz <[email protected]>
2012-07-09mfd: mc13xxx workaround SPI hardware bug on i.MxPhilippe Rétornaz1-1/+64
The MC13xxx PMIC is mainly used on i.Mx SoC. On those SoC the SPI hardware will deassert CS line as soon as the SPI FIFO is empty. The MC13xxx hardware is very sensitive to CS line change as it corrupts the transfer if CS is deasserted in the middle of a register read or write. It is not possible to use the CS line as a GPIO on some SoC, so we need to workaround this by implementing a single SPI transfer to access the PMIC. Reviewed-by: Mark Brown <[email protected]> Acked-by: Marc Reilly <[email protected]> Signed-off-by: Philippe Rétornaz <[email protected]> Signed-off-by: Samuel Ortiz <[email protected]>
2012-07-09mfd: Fix mc13xxx SPI regmapPhilippe Rétornaz1-1/+1
This fix the SPI regmap configuration, the wrong write flag was used. Also, bits_per_word should not be set as the regmap spi implementation uses a 8bits transfert granularity. Signed-off-by: Philippe Rétornaz <[email protected]> Tested-by: Fabio Estevam <[email protected]> Signed-off-by: Samuel Ortiz <[email protected]>
2012-07-09mfd: Add terminating entry for i2c_device_id palmas tableAxel Lin1-0/+1
The i2c_device_id table is supposed to be zero-terminated. Signed-off-by: Axel Lin <[email protected]> Signed-off-by: Samuel Ortiz <[email protected]>
2012-07-08Merge branch 'for-3.5-fixes' of ↵Linus Torvalds1-15/+8
git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "The previous cgroup pull request contained a patch to fix a race condition during cgroup hierarchy umount. Unfortunately, while the patch reduced the race window such that the test case I and Sasha were using didn't trigger it anymore, it wasn't complete - Shyju and Li could reliably trigger the race condition using a different test case. The problem wasn't the gap between dentry deletion and release which the previous patch tried to fix. The window was between the last dput() of a root's child and the resulting dput() of the root. For cgroup dentries, the deletion and release always happen synchronously. As this releases the s_active ref, the refcnt of the root dentry, which doesn't hold s_active, stays above zero without the corresponding s_active. If umount was in progress, the last deactivate_super() proceeds to destory the superblock and triggers BUG() on the non-zero root dentry refcnt after shrinking. This issue surfaced because cgroup dentries are now allowed to linger after rmdir(2) since 3.5-rc1. Before, rmdir synchronously drained the dentry refcnt and the s_active acquired by rmdir from vfs layer protected the whole thing. After 3.5-rc1, cgroup may internally hold and put dentry refs after rmdir finishes and the delayed dput() doesn't have surrounding s_active ref exposing this issue. This pull request contains two patches - one reverting the previous incorrect fix and the other adding the surrounding s_active ref around the delayed dput(). This is quite late in the release cycle but the change is on the safer side and fixes the test cases reliably, so I don't think it's too crazy." * 'for-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: fix cgroup hierarchy umount race Revert "cgroup: superblock can't be released with active dentries"
2012-07-08NFS: Fix list manipulation snafus in fs/nfs/direct.cTrond Myklebust1-1/+5
Fix 2 bugs in nfs_direct_write_reschedule: - The request needs to be removed from the 'reqs' list before it can be added to 'failed'. - Fix an infinite loop if the 'failed' list is non-empty. Reported-by: Julia Lawall <[email protected]> Signed-off-by: Trond Myklebust <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.