aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-04-13Btrfs: make sure nbytes are right after log replayJosef Bacik1-6/+42
While trying to track down a tree log replay bug I noticed that fsck was always complaining about nbytes not being right for our fsynced file. That is because the new fsync stuff doesn't wait for ordered extents to complete, so the inodes nbytes are not necessarily updated properly when we log it. So to fix this we need to set nbytes to whatever it is on the inode that is on disk, so when we replay the extents we can just add the bytes that are being added as we replay the extent. This makes it work for the case that we have the wrong nbytes or the case that we logged everything and nbytes is actually correct. With this I'm no longer getting nbytes errors out of btrfsck. Cc: [email protected] Signed-off-by: Josef Bacik <[email protected]> Signed-off-by: Chris Mason <[email protected]>
2013-04-12x86-32: Fix possible incomplete TLB invalidate with PAE pagetablesDave Hansen4-2/+15
This patch attempts to fix: https://bugzilla.kernel.org/show_bug.cgi?id=56461 The symptom is a crash and messages like this: chrome: Corrupted page table at address 34a03000 *pdpt = 0000000000000000 *pde = 0000000000000000 Bad pagetable: 000f [#1] PREEMPT SMP Ingo guesses this got introduced by commit 611ae8e3f520 ("x86/tlb: enable tlb flush range support for x86") since that code started to free unused pagetables. On x86-32 PAE kernels, that new code has the potential to free an entire PMD page and will clear one of the four page-directory-pointer-table (aka pgd_t entries). The hardware aggressively "caches" these top-level entries and invlpg does not actually affect the CPU's copy. If we clear one we *HAVE* to do a full TLB flush, otherwise we might continue using a freed pmd page. (note, we do this properly on the population side in pud_populate()). This patch tracks whenever we clear one of these entries in the 'struct mmu_gather', and ensures that we follow up with a full tlb flush. BTW, I disassembled and checked that: if (tlb->fullmm == 0) and if (!tlb->fullmm && !tlb->need_flush_all) generate essentially the same code, so there should be zero impact there to the !PAE case. Signed-off-by: Dave Hansen <[email protected]> Cc: Peter Anvin <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Artem S Tashkinov <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-04-12Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pendingLinus Torvalds2-68/+133
Pull SCSI target fixes from Nicholas Bellinger: "Here are remaining target-pending items for v3.9-rc7 code. The tcm_vhost patches are more than I'd usually include in a -rc7 pull, but are changes required for v3.9 to work correctly with the pending vhost-scsi-pci QEMU upstream series merge. (Paolo CC'ed) Plus Asias's conversion to use vhost_virtqueue->private_data + RCU for managing vhost-scsi endpoints has gotten alot of review + testing over the past weeks, and MST has ACKed the full series. Also, there is a target patch to fix a long-standing bug within control CDB handling with Standby/Offline/Transition ALUA port access states, that had been incorrectly rejecting the control CDBs required for LUN scan to work during these port group states. CC'ing to stable." * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: target: Fix incorrect fallthrough of ALUA Standby/Offline/Transition CDBs tcm_vhost: Send bad target to guest when cmd fails tcm_vhost: Add vhost_scsi_send_bad_target() helper tcm_vhost: Fix tv_cmd leak in vhost_scsi_handle_vq tcm_vhost: Remove double check of response tcm_vhost: Initialize vq->last_used_idx when set endpoint tcm_vhost: Use vq->private_data to indicate if the endpoint is setup tcm_vhost: Use ACCESS_ONCE for vs->vs_tpg[target] access
2013-04-12Merge tag 'scsi-fixes' of ↵Linus Torvalds13-80/+38
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is a set of ten bug fixes (and two consisting of copyright year update and version number change) pretty much all of which involve either a crash or a hang except the removal of the random sleep from the qla2xxx driver (which is a coding error so bad, we want it gone before anyone has a chance to copy it)." * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: [SCSI] lpfc: fix potential NULL pointer dereference in lpfc_sli4_rq_put() [SCSI] libsas: fix handling vacant phy in sas_set_ex_phy() [SCSI] ibmvscsi: Fix slave_configure deadlock [SCSI] qla2xxx: Update the driver version to 8.04.00.13-k. [SCSI] qla2xxx: Remove debug code that msleeps for random duration. [SCSI] qla2xxx: Update copyright dates information in LICENSE.qla2xxx file. [SCSI] qla2xxx: Fix crash during firmware dump procedure. [SCSI] Revert "qla2xxx: Add setting of driver version string for vendor application." [SCSI] ipr: dlpar failed when adding an adapter back [SCSI] ipr: fix addition of abort command to HRRQ free queue [SCSI] st: Take additional queue ref in st_probe [SCSI] libsas: use right function to alloc smp response [SCSI] ipr: ipr_test_msi() fails when running with msi-x enabled adapter
2013-04-12Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds1-3/+13
Pull CIFS fix from Steve French: "Fixes a regression in cifs in which a password which begins with a comma is parsed incorrectly as a blank password" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: cifs: Allow passwords which begin with a delimitor
2013-04-12ftrace: Move ftrace_filter_lseek out of CONFIG_DYNAMIC_FTRACE sectionSteven Rostedt (Red Hat)2-15/+16
As ftrace_filter_lseek is now used with ftrace_pid_fops, it needs to be moved out of the #ifdef CONFIG_DYNAMIC_FTRACE section as the ftrace_pid_fops is defined when DYNAMIC_FTRACE is not. Cc: [email protected] Cc: Namhyung Kim <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>
2013-04-12net/802/mrp: fix possible race condition when calling mrp_pdu_queue()David Ward1-0/+4
(Adapted from a very similar change to net/802/garp.c by Cong Wang.) mrp_pdu_queue() should ways be called with the applicant spin lock. mrp_uninit_applicant() only holds the rtnl lock which is not enough; a race is possible because mrp_rcv() is called in BH context: mrp_rcv() |->mrp_pdu_parse_msg() |->mrp_pdu_parse_vecattr() |->mrp_pdu_parse_vecattr_event() |-> mrp_attr_event() |-> mrp_pdu_append_vecattr_event() |-> mrp_pdu_queue() Cc: Cong Wang <[email protected]> Cc: Eric Dumazet <[email protected]> Signed-off-by: David Ward <[email protected]> Acked-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-04-12tuntap: fix error return code in tun_set_iff()Wei Yongjun1-1/+1
Fix to return a negative error code from the error handling case instead of 0, as returned elsewhere in this function. [ Bug added in linux-3.8 , commit 4008e97f866db665 ("tuntap: fix ambigious multiqueue API") ] Signed-off-by: Wei Yongjun <[email protected]> Acked-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-04-12be2net: take care of __vlan_put_tag return valueIvan Vecera1-2/+3
The driver should use return value of __vlan_put_tag with appropriate NULL-check instead of old skb pointer. Signed-off-by: Ivan Vecera <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-04-12tracing: Fix possible NULL pointer dereferencesNamhyung Kim3-7/+7
Currently set_ftrace_pid and set_graph_function files use seq_lseek for their fops. However seq_open() is called only for FMODE_READ in the fops->open() so that if an user tries to seek one of those file when she open it for writing, it sees NULL seq_file and then panic. It can be easily reproduced with following command: $ cd /sys/kernel/debug/tracing $ echo 1234 | sudo tee -a set_ftrace_pid In this example, GNU coreutils' tee opens the file with fopen(, "a") and then the fopen() internally calls lseek(). Link: http://lkml.kernel.org/r/[email protected] Cc: Frederic Weisbecker <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Namhyung Kim <[email protected]> Cc: [email protected] Signed-off-by: Namhyung Kim <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>
2013-04-12Merge branch 'fixes-for-3.9' of git://gitorious.org/linux-can/linux-canDavid S. Miller2-18/+23
Marc Kleine-Budde says: ==================== here's another fix for the v3.9 release cycle, if not too late: Christoph Fritz fixed the device tree property handling on little endian systems in the sja1000 device tree driver. It was Mylene Josserand who noticed that the mcp251x spi CAN driver cannot request its interrupt anymore, as the driver is using a threaded interrupt handler without a primary one and without specifying IRQF_ONESHOT (which is needed since v3.5). A patch by me fixes this problem. ==================== Signed-off-by: David S. Miller <[email protected]>
2013-04-12Merge branch 'master' of ↵David S. Miller8-51/+115
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf into netfilter Pablo Neira Ayuso says: ==================== The following patchset contains late netfilter fixes for your net tree, they are: * Don't drop segmented TCP packets in the SIP helper, we've got reports from users that this was breaking communications when the SIP phone messages are larger than the MTU, from Patrick McHardy. * Fix refcount leak in the ipset list set, from Jozsef Kadlecsik. * On hash set resizing, the nomatch flag was lost, thus entirely inverting the logic of the set matching, from Jozsef Kadlecsik. * Fix crash on NAT modules removal. Timer expiration may race with the module cleanup exit path while deleting conntracks, from Florian Westphal. ==================== Signed-off-by: David S. Miller <[email protected]>
2013-04-12ath9k_hw: change AR9580 initvals to fix a stability issueFelix Fietkau1-1/+1
The hardware parsing of Control Wrapper Frames needs to be disabled, as it has been causing spurious decryption error reports. The initvals for other chips have been updated to disable it, but AR9580 was left out for some reason. Cc: [email protected] Signed-off-by: Felix Fietkau <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2013-04-12Merge branch 'for-john' of ↵John W. Linville1-4/+20
git://x-git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
2013-04-12Merge tag 'sound-3.9' of ↵Linus Torvalds9-40/+35
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This contains a few small ASoC fixes (wm8903, wm5102, samsung-i2s, tegra, and soc-compress) and an endian fix for NI USB-audio devices, update for Mark's e-mail address. No scary changes, AFAIS." * tag 'sound-3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: MAINTAINERS: Update e-mail address ASoC: wm5102: Correct lookup of arizona struct in SYSCLK event ASoC: wm8903: Fix the bypass to HP/LINEOUT when no DAC or ADC is running ALSA: usb-audio: fix endianness bug in snd_nativeinstruments_* ASoC: tegra: Don't claim to support PCM pause and resume ASoC: Samsung: set drvdata before adding secondary device ASoC: Samsung: return error if drvdata is not set ASoC: compress: Cancel delayed power down if needed ASoC: core: Fix to check return value of snd_soc_update_bits_locked()
2013-04-12kthread: Prevent unpark race which puts threads on the wrong cpuThomas Gleixner5-29/+45
The smpboot threads rely on the park/unpark mechanism which binds per cpu threads on a particular core. Though the functionality is racy: CPU0 CPU1 CPU2 unpark(T) wake_up_process(T) clear(SHOULD_PARK) T runs leave parkme() due to !SHOULD_PARK bind_to(CPU2) BUG_ON(wrong CPU) We cannot let the tasks move themself to the target CPU as one of those tasks is actually the migration thread itself, which requires that it starts running on the target cpu right away. The solution to this problem is to prevent wakeups in park mode which are not from unpark(). That way we can guarantee that the association of the task to the target cpu is working correctly. Add a new task state (TASK_PARKED) which prevents other wakeups and use this state explicitly for the unpark wakeup. Peter noticed: Also, since the task state is visible to userspace and all the parked tasks are still in the PID space, its a good hint in ps and friends that these tasks aren't really there for the moment. The migration thread has another related issue. CPU0 CPU1 Bring up CPU2 create_thread(T) park(T) wait_for_completion() parkme() complete() sched_set_stop_task() schedule(TASK_PARKED) The sched_set_stop_task() call is issued while the task is on the runqueue of CPU1 and that confuses the hell out of the stop_task class on that cpu. So we need the same synchronizaion before sched_set_stop_task(). Reported-by: Dave Jones <[email protected]> Reported-and-tested-by: Dave Hansen <[email protected]> Reported-and-tested-by: Borislav Petkov <[email protected]> Acked-by: Peter Ziljstra <[email protected]> Cc: Srivatsa S. Bhat <[email protected]> Cc: [email protected] Cc: Ingo Molnar <[email protected]> Cc: [email protected] Link: http://lkml.kernel.org/r/alpine.LFD.2.02.1304091635430.21884@ionos Signed-off-by: Thomas Gleixner <[email protected]>
2013-04-12Merge tag 'asoc-maintainers-v3.9-rc6' of ↵Takashi Iwai1-4/+4
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus MAINTAINERS: Update e-mail address Update the e-mail address I use for subsystems.
2013-04-12can: sja1000: fix handling on dt properties on little endian systemsChristoph Fritz1-16/+15
To get correct endianes on little endian cpus (like arm) while reading device tree properties, this patch replaces of_get_property() with of_property_read_u32(). While there use of_property_read_bool() for the handling of the boolean "nxp,no-comparator-bypass" property. Cc: linux-stable <[email protected]> Signed-off-by: Christoph Fritz <[email protected]> Signed-off-by: Marc Kleine-Budde <[email protected]>
2013-04-12MAINTAINERS: Update e-mail addressMark Brown1-4/+4
Update the e-mail address I use for subsystems. Signed-off-by: Mark Brown <[email protected]>
2013-04-12can: mcp251x: add missing IRQF_ONESHOT to request_threaded_irqMarc Kleine-Budde1-2/+8
Since commit: 1c6c695 genirq: Reject bogus threaded irq requests threaded irqs must provide a primary handler or set the IRQF_ONESHOT flag. Since the mcp251x driver doesn't make use of a primary handler set the IRQF_ONESHOT flag. Cc: linux-stable <[email protected]> # >= v3.5 Reported-by: Mylene Josserand <[email protected]> Tested-by: Mylene Josserand <[email protected]> Signed-off-by: Marc Kleine-Budde <[email protected]>
2013-04-12netfilter: nf_nat: fix race when unloading protocol modulesFlorian Westphal1-33/+7
following oops was reported: RIP: 0010:[<ffffffffa03227f2>] [<ffffffffa03227f2>] nf_nat_cleanup_conntrack+0x42/0x70 [nf_nat] RSP: 0018:ffff880202c63d40 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8801ac7bec28 RCX: ffff8801d0eedbe0 RDX: dead000000200200 RSI: 0000000000000011 RDI: ffffffffa03265b8 [..] Call Trace: [..] [<ffffffffa02febed>] destroy_conntrack+0xbd/0x110 [nf_conntrack] Happens when a conntrack timeout expires right after first part of the nat cleanup has completed (bysrc hash removal), but before part 2 has completed (re-initialization of nat area). [ destroy callback tries to delete bysrc again ] Patrick suggested to just remove the affected conntracks -- the connections won't work properly anyway without nat transformation. So, lets do that. Reported-by: CAI Qian <[email protected]> Cc: Patrick McHardy <[email protected]> Signed-off-by: Florian Westphal <[email protected]> Acked-by: Patrick McHardy <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2013-04-12Merge tag 'asoc-v3.9-rc6' of ↵Takashi Iwai501-3000/+5512
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v3.9 A few updates, more than I'd like, fixing some relatively small issues but mostly driver specific ones. Nothing wildly exciting so if it doesn't make v3.9 it won't be the end of the world but it'd be nice.
2013-04-12x86/mm: Flush lazy MMU when DEBUG_PAGEALLOC is setBoris Ostrovsky1-0/+2
When CONFIG_DEBUG_PAGEALLOC is set page table updates made by kernel_map_pages() are not made visible (via TLB flush) immediately if lazy MMU is on. In environments that support lazy MMU (e.g. Xen) this may lead to fatal page faults, for example, when zap_pte_range() needs to allocate pages in __tlb_remove_page() -> tlb_next_batch(). Signed-off-by: Boris Ostrovsky <[email protected]> Cc: [email protected] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
2013-04-12x86/mm/cpa/selftest: Fix false positive in CPA self testAndrea Arcangeli1-1/+1
If the pmd is not present, _PAGE_PSE will not be set anymore. Fix the false positive. Reported-by: Ingo Molnar <[email protected]> Signed-off-by: Andrea Arcangeli <[email protected]> Cc: Stefan Bader <[email protected]> Cc: Andy Whitcroft <[email protected]> Cc: Mel Gorman <[email protected]> Cc: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
2013-04-12perf: Fix error return codeWei Yongjun1-0/+1
Fix to return -ENOMEM in the allocation error case instead of 0 (if pmu_bus_running == 1), as done elsewhere in this function. Signed-off-by: Wei Yongjun <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Link: http://lkml.kernel.org/r/CAPgLHd8j_fWcgqe%3DKLWjpBj%2B%3Do0Pw6Z-SEq%[email protected] [ Tweaked the error code setting placement and the changelog. ] Signed-off-by: Ingo Molnar <[email protected]>
2013-04-12drm/fb-helper: Fix locking in drm_fb_helper_hotplug_eventDaniel Vetter1-3/+5
Driver's and ->fill_modes functions are allowed to grab crtc mutexes (for e.g. load detect). Hence we need to first only grab the general kms mutex, and only in a second step grab all locks to do the modesets. This prevents a deadlock on my gm45 in the tv load detect code called by drm_helper_probe_single_connector_modes. Signed-off-by: Daniel Vetter <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2013-04-12udl: handle EDID failure properly.Dave Airlie1-0/+4
Don't oops seems proper. Cc: [email protected] Signed-off-by: Dave Airlie <[email protected]>
2013-04-11Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dmaLinus Torvalds2-17/+41
Pull slave-dmaengine fixes from Vinod Koul: "The first one fixes issue in pl330 to check for DT compatible and the second one fixes omap-dma to start without delay" * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: omap-dma: Start DMA without delay for cyclic channels DMA: PL330: Add check if device tree compatible
2013-04-11Merge tag 'pm-3.9-rc7' of ↵Linus Torvalds2-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: - System reboot/halt fix related to CPU offline ordering from Huacai Chen. - intel_pstate driver fix for a delay time computation error occasionally crashing systems using it from Dirk Brandewie. * tag 'pm-3.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM / reboot: call syscore_shutdown() after disable_nonboot_cpus() cpufreq / intel_pstate: Set timer timeout correctly
2013-04-11Merge tag 'regmap-v3.9-rc6' of ↵Linus Torvalds1-1/+2
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap revert from Mark Brown: "regmap: Back out work buffer fix This reverts commit bc8ce4 (regmap: don't corrupt work buffer in _regmap_raw_write()) since it turns out that it can cause issues when taken in isolation from the other changes in -next that lead to its discovery. On the basis that nobody noticed the problems for quite some time without that subsequent work let's drop it from v3.9." * tag 'regmap-v3.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: Back out work buffer fix
2013-04-11Merge tag 'gpio-fixes-v3.9-rc6' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fix from Linus Walleij: "Oneliner fix for the PCA 953x driver." * tag 'gpio-fixes-v3.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: pca953x: fix irq_domain_add_simple usage
2013-04-11Merge tag 'arm-soc-fixes' of ↵Linus Torvalds11-27/+30
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC bug fixes from Arnd Bergmann: "A little later during the week than the last few pull requests, since there was very little that came in before 3.9-rc6. At least things have calmed down again here. Some important bug fixes that came in over the last 10 days, mostly mvebu and imx: - Multiple regressions on i.mx following the conversion of the clock code, hopefully the last we are seeing of those. - a regression in the mvebu irq handling code - An incorrect register offset in the rewritten s3c24xx irq code. - Two bugs in setting up the iomega_ix2_200 machine - Turning on an extra bus clock on imx - A MAINTAINERS file entry for Roland Stigge" * tag 'arm-soc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: arm: mvebu: Fix the irq map function in SMP mode Fix GE0/GE1 init on ix2-200 as GE0 has no PHY ARM: S3C24XX: Fix interrupt pending register offset of the EINT controller ARM: S3C24XX: Correct NR_IRQS definition for s3c2440 ARM i.MX6: Fix ldb_di clock selection ARM: imx: provide twd clock lookup from device tree ARM: imx35 Bugfix admux clock ARM: clk-imx35: Bugfix iomux clock ARM: mxs: Slow down the I2C clock speed MAINTAINERS: Add maintainer for LPC32xx ARM: Kirkwood: Fix typo in the definition of ix2-200 rebuild LED
2013-04-11tcp: Reallocate headroom if it would overflow csum_startThomas Graf1-2/+6
If a TCP retransmission gets partially ACKed and collapsed multiple times it is possible for the headroom to grow beyond 64K which will overflow the 16bit skb->csum_start which is based on the start of the headroom. It has been observed rarely in the wild with IPoIB due to the 64K MTU. Verify if the acking and collapsing resulted in a headroom exceeding what csum_start can cover and reallocate the headroom if so. A big thank you to Jim Foraker <[email protected]> and the team at LLNL for helping out with the investigation and testing. Reported-by: Jim Foraker <[email protected]> Signed-off-by: Thomas Graf <[email protected]> Acked-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-04-11[SCSI] lpfc: fix potential NULL pointer dereference in lpfc_sli4_rq_put()Wei Yongjun1-1/+2
The dereference to 'put_index' should be moved below the NULL test. Signed-off-by: Wei Yongjun <[email protected]> Acked-by: James Smart <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2013-04-11stmmac: prevent interrupt loop with MMC RX IPC CounterChristian Ruppert1-0/+1
If the DesignWare MAC is synthesised with MMC RX IPC Counter, an unmanaged and unacknowledged interrupt is generated after some time of operation. This patch masks the undesired interrupts. Signed-off-by: Christian Ruppert <[email protected]> Acked-by: Giuseppe Cavallaro <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-04-11bonding: IFF_BONDING is not stripped on enslave failure[email protected]1-0/+1
While enslaving a new device and after IFF_BONDING flag is set, in case of failure it is not stripped from the device's priv_flags while cleaning up, which could lead to other problems. Cleaning at err_close because the flag is set after dev_open(). v2: no change Signed-off-by: Nikolay Aleksandrov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-04-11bonding: fix netdev event NULL pointer dereference[email protected]1-2/+11
In commit 471cb5a33dcbd7c529684a2ac7ba4451414ee4a7 ("bonding: remove usage of dev->master") a bug was introduced which causes a NULL pointer dereference. If a bond device is in mode 6 (ALB) and a slave is added it will dereference a NULL pointer in bond_slave_netdev_event(). This is because in bond_enslave we have bond_alb_init_slave() which changes the MAC address of the slave and causes a NETDEV_CHANGEADDR. Then we have in bond_slave_netdev_event(): struct slave *slave = bond_slave_get_rtnl(slave_dev); struct bonding *bond = slave->bond; bond_slave_get_rtnl() dereferences slave_dev->rx_handler_data which at that time is NULL since netdev_rx_handler_register() is called later. This is fixed by checking if slave is NULL before dereferencing it. v2: Comment style changed. Signed-off-by: Nikolay Aleksandrov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-04-11tcp: incoming connections might use wrong route under synfloodDmitry Popov1-2/+2
There is a bug in cookie_v4_check (net/ipv4/syncookies.c): flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP, inet_sk_flowi_flags(sk), (opt && opt->srr) ? opt->faddr : ireq->rmt_addr, ireq->loc_addr, th->source, th->dest); Here we do not respect sk->sk_bound_dev_if, therefore wrong dst_entry may be taken. This dst_entry is used by new socket (get_cookie_sock -> tcp_v4_syn_recv_sock), so its packets may take the wrong path. Signed-off-by: Dmitry Popov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-04-11gpio: pca953x: fix irq_domain_add_simple usageAlexandre Belloni1-1/+1
We actually have to pass chip as the host_data parameter of irq_domain_add_simple() as later on, it is used to initialize chip_data in pca953x_gpio_irq_map(). Failing to do so is leading to a NULL pointer dereference after calling irq_data_get_irq_chip_data() in pca953x_irq_mask(), pca953x_irq_unmask(), pca953x_irq_bus_lock(), pca953x_irq_bus_sync_unlock() and pca953x_irq_set_type(). Fixes regression introduced by commit 0e8f2fdacf1d44651aa7e57063c76142d1f4988b (gpio: pca953x: use simple irqdomain) Signed-off-by: Alexandre Belloni <[email protected]> Acked-by: Maxime Ripard <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2013-04-11Merge remote-tracking branch 'asoc/fix/wm8903' into tmpMark Brown1-0/+2
2013-04-11Merge remote-tracking branch 'asoc/fix/tegra' into tmpMark Brown1-23/+1
2013-04-11Merge remote-tracking branch 'asoc/fix/samsung' into tmpMark Brown1-5/+12
2013-04-11Merge remote-tracking branch 'asoc/fix/core' into tmpMark Brown1-1/+1
2013-04-11Merge remote-tracking branch 'asoc/fix/compress' into tmpMark Brown1-3/+11
2013-04-11Merge tag 'mvebu_fixes_for_v3.9_round3' of ↵Arnd Bergmann3-19/+18
git://git.infradead.org/users/jcooper/linux into fixes From Jason Cooper <[email protected]>: mvebu fixes for v3.9 round 3 - Kirkwood - a couple of small fixes for the Iomega ix2-200 board (ether and led) - mvebu - allow GPIO button to work on Mirabox when running SMP * tag 'mvebu_fixes_for_v3.9_round3' of git://git.infradead.org/users/jcooper/linux: arm: mvebu: Fix the irq map function in SMP mode Fix GE0/GE1 init on ix2-200 as GE0 has no PHY ARM: Kirkwood: Fix typo in the definition of ix2-200 rebuild LED Signed-off-by: Arnd Bergmann <[email protected]>
2013-04-11x86,efi: Check max_size only if it is non-zero.Richard Weinberger1-1/+6
Some EFI implementations return always a MaximumVariableSize of 0, check against max_size only if it is non-zero. My Intel DQ67SW desktop board has such an implementation. Signed-off-by: Richard Weinberger <[email protected]> Signed-off-by: Matt Fleming <[email protected]>
2013-04-11kvm/ppc/e500: eliminate tlb_refsScott Wood2-69/+30
Commit 523f0e5421c12610527c620b983b443f329e3a32 ("KVM: PPC: E500: Explicitly mark shadow maps invalid") began using E500_TLB_VALID for guest TLB1 entries, and skipping invalidations if it's not set. However, when E500_TLB_VALID was set for such entries, it was on a fake local ref, and so the invalidations never happen. gtlb_privs is documented as being only for guest TLB0, though we already violate that with E500_TLB_BITMAP. Now that we have MMU notifiers, and thus don't need to actually retain a reference to the mapped pages, get rid of tlb_refs, and use gtlb_privs for E500_TLB_VALID in TLB1. Since we can have more than one host TLB entry for a given tlbe_ref, be careful not to clear existing flags that are relevant to other host TLB entries when preparing a new host TLB entry. Signed-off-by: Scott Wood <[email protected]> Signed-off-by: Alexander Graf <[email protected]>
2013-04-11kvm/ppc/e500: g2h_tlb1_map: clear old bit before setting new bitScott Wood1-3/+4
It's possible that we're using the same host TLB1 slot to map (a presumably different portion of) the same guest TLB1 entry. Clear the bit in the map before setting it, so that if the esels are the same the bit will remain set. Signed-off-by: Scott Wood <[email protected]> Signed-off-by: Alexander Graf <[email protected]>
2013-04-11kvm/ppc/e500: h2g_tlb1_rmap: esel 0 is validScott Wood1-2/+2
Add one to esel values in h2g_tlb1_rmap, so that "no mapping" can be distinguished from "esel 0". Note that we're not saved by the fact that host esel 0 is reserved for non-KVM use, because KVM host esel numbering is not the raw host numbering (see to_htlb1_esel). Signed-off-by: Scott Wood <[email protected]> Signed-off-by: Alexander Graf <[email protected]>
2013-04-11target: Fix incorrect fallthrough of ALUA Standby/Offline/Transition CDBsNicholas Bellinger1-0/+3
This patch fixes a bug where a handful of informational / control CDBs that should be allowed during ALUA access state Standby/Offline/Transition where incorrectly returning CHECK_CONDITION + ASCQ_04H_ALUA_TG_PT_*. This includes INQUIRY + REPORT_LUNS, which would end up preventing LUN registration when LUN scanning occured during these ALUA access states. Cc: Hannes Reinecke <[email protected]> Cc: <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]>