aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-02-18mei: set client's read_cb to NULL when flow control failsChao Bi1-1/+3
In mei_cl_read_start(), if it fails to send flow control request, it will release "cl->read_cb" but forget to set pointer to NULL, leaving "cl->read_cb" still pointing to random memory, next time this client is operated like mei_release(), it has chance to refer to this wrong pointer. Fixes: PANIC at kfree in mei_release() [228781.826904] Call Trace: [228781.829737] [<c16249b8>] ? mei_cl_unlink+0x48/0xa0 [228781.835283] [<c1624487>] mei_io_cb_free+0x17/0x30 [228781.840733] [<c16265d8>] mei_release+0xa8/0x180 [228781.845989] [<c135c610>] ? __fsnotify_parent+0xa0/0xf0 [228781.851925] [<c1325a69>] __fput+0xd9/0x200 [228781.856696] [<c1325b9d>] ____fput+0xd/0x10 [228781.861467] [<c125cae1>] task_work_run+0x81/0xb0 [228781.866821] [<c1242e53>] do_exit+0x283/0xa00 [228781.871786] [<c1a82b36>] ? kprobe_flush_task+0x66/0xc0 [228781.877722] [<c124eeb8>] ? __dequeue_signal+0x18/0x1a0 [228781.883657] [<c124f072>] ? dequeue_signal+0x32/0x190 [228781.889397] [<c1243744>] do_group_exit+0x34/0xa0 [228781.894750] [<c12517b6>] get_signal_to_deliver+0x206/0x610 [228781.901075] [<c12018d8>] do_signal+0x38/0x100 [228781.906136] [<c1626d1c>] ? mei_read+0x42c/0x4e0 [228781.911393] [<c12600a0>] ? wake_up_bit+0x30/0x30 [228781.916745] [<c16268f0>] ? mei_poll+0x120/0x120 [228781.922001] [<c1324be9>] ? vfs_read+0x89/0x160 [228781.927158] [<c16268f0>] ? mei_poll+0x120/0x120 [228781.932414] [<c133ca34>] ? fget_light+0x44/0xe0 [228781.937670] [<c1324e58>] ? SyS_read+0x68/0x80 [228781.942730] [<c12019f5>] do_notify_resume+0x55/0x70 [228781.948376] [<c1a7de5d>] work_notifysig+0x29/0x30 [228781.953827] [<c1a70000>] ? bad_area+0x5/0x3e Cc: stable <[email protected]> # 3.9+ Signed-off-by: Chao Bi <[email protected]> Signed-off-by: Tomas Winkler <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-18Merge tag 'ext4_for_linus_stable' of ↵Linus Torvalds6-23/+43
git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Miscellaneous ext4 bug fixes for v3.14" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: jbd2: fix use after free in jbd2_journal_start_reserved() ext4: don't leave i_crtime.tv_sec uninitialized ext4: fix online resize with a non-standard blocks per group setting ext4: fix online resize with very large inode tables ext4: don't try to modify s_flags if the the file system is read-only ext4: fix error paths in swap_inode_boot_loader() ext4: fix xfstest generic/299 block validity failures
2014-02-18usb: gadget: bcm63xx_udc: fix build failure on DMA channel codeFlorian Fainelli1-26/+32
Commit 3dc6475 ("bcm63xx_enet: add support Broadcom BCM6345 Ethernet") changed the ENETDMA[CS] macros such that they are no longer macros, but actual register offset definitions. The bcm63xx_udc driver was not updated, and as a result, causes the following build error to pop up: CC drivers/usb/gadget/u_ether.o drivers/usb/gadget/bcm63xx_udc.c: In function 'iudma_write': drivers/usb/gadget/bcm63xx_udc.c:642:24: error: called object '0' is not a function drivers/usb/gadget/bcm63xx_udc.c: In function 'iudma_reset_channel': drivers/usb/gadget/bcm63xx_udc.c:698:46: error: called object '0' is not a function drivers/usb/gadget/bcm63xx_udc.c:700:49: error: called object '0' is not a function Fix this by updating usb_dmac_{read,write}l and usb_dmas_{read,write}l to take an extra channel argument, and use the channel width (ENETDMA_CHAN_WIDTH) to offset the register we want to access, hence doing again what the macro implicitely did for us. Cc: Kevin Cernekee <[email protected]> Cc: Jonas Gorski <[email protected]> Cc: <[email protected]> Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: Felipe Balbi <[email protected]>
2014-02-18usb: musb: do not sleep in atomic contextDaniel Mack2-5/+17
musb_port_reset() is called from musb_hub_control() which in turn holds a spinlock, so musb_port_reset() is not allowed to call msleep(). With the asynchronous work helpers in place, this is fortunately easy to fix by rescheduling the reset deassertion function to after the time when the wait period is finished. Note, however, that the MUSB_POWER_RESUME bit is only set on AM33xx processors under rare conditions such as when to another driver reporting an error during suspend. Hence, this didn't hit me yet in normal operation. Signed-off-by: Daniel Mack <[email protected]> Signed-off-by: Felipe Balbi <[email protected]>
2014-02-18usb: gadget: s3c2410_udc: Fix build errorSachin Kamat1-1/+1
Pass value instead of address as expected by 'usb_ep_set_maxpacket_limit'. Fixes the following compilation error introduced by commit e117e742d310 ("usb: gadget: add "maxpacket_limit" field to struct usb_ep"): drivers/usb/gadget/s3c2410_udc.c: In function ‘s3c2410_udc_reinit’: drivers/usb/gadget/s3c2410_udc.c:1632:3: error: cannot take address of bit-field ‘maxpacket’ usb_ep_set_maxpacket_limit(&ep->ep, &ep->ep.maxpacket); Signed-off-by: Sachin Kamat <[email protected]> Reviewed-by: Robert Baldyga <[email protected]> Signed-off-by: Felipe Balbi <[email protected]>
2014-02-18usb: musb: core: Fix remote-wakeup resumeRoger Quadros1-1/+9
During resume don't touch SUSPENDM/RESUME bits of POWER register while restoring controller context. These bits might be changed by the controller during resume operation and so will be different than what they were during suspend. e.g. SUSPENDM bit is set by software during USB global suspend but automatically cleared by the controller during remote wakeup or during resume. Setting this bit back while restoring context causes undesired behaviour. i.e. Babble interrupt is generated and USB is broken. Signed-off-by: Roger Quadros <[email protected]> Signed-off-by: Felipe Balbi <[email protected]>
2014-02-18usb: musb: host: Fix SuperSpeed hub enumerationAjay Kumar Gupta1-0/+3
Disables PING on status phase of control transfer. PING token is not mandatory in status phase of control transfer and so some high speed USB devices don't support it. If such devices are connected to MUSB then they would not respond to PING token causing delayed or failed enumeration. [Roger Q] Fixes enumeration issues with some Super-Speed USB hubs e.g. Dlink DUB-1340 Signed-off-by: Ajay Kumar Gupta <[email protected]> Signed-off-by: Roger Quadros <[email protected]> Signed-off-by: Felipe Balbi <[email protected]>
2014-02-18ARM: dove: dt: revert PMU interrupt controller nodeJason Cooper1-11/+0
The corresponding driver didn't make it into v3.14, so we need to remove the node. Dove systems fail to boot with the node present and no driver. This node will be re-added when the driver makes it to mainline. Reported-by: Jean-Francois Moine <[email protected]> Tested-by: Jean-Francois Moine <[email protected]> Signed-off-by: Jason Cooper <[email protected]>
2014-02-18usb: musb: fix obex in g_nokia.ko causing kernel panicFelipe Balbi1-2/+0
phy_power_off() can, depending on the PHY being used, start I2C transactions which shouldn't happen in atomic context. Current call to phy_power_off() inside omap2430_runtime callbacks causes the following dump, as a fix, just don't power off the PHY in runtime. [ 18.606414] [<c037eac0>] (__schedule+0x5c/0x50c) from [<c037d3bc>] (schedule_timeout+0x1f4/0x25c) [ 18.623809] [<c037d3bc>] (schedule_timeout+0x1f4/0x25c) from [<c037f12c>] (wait_for_common+0xc8/0x1ac) [ 18.649291] [<c037f12c>] (wait_for_common+0xc8/0x1ac) from [<c028c1c0>] (omap_i2c_xfer+0x338/0x488) [ 18.674499] [<c028c1c0>] (omap_i2c_xfer+0x338/0x488) from [<c0288144>] (__i2c_transfer+0x40/0x74) [ 18.692047] [<c0288144>] (__i2c_transfer+0x40/0x74) from [<c0288a2c>] (i2c_transfer+0x6c/0x90) [ 18.709320] [<c0288a2c>] (i2c_transfer+0x6c/0x90) from [<c02351c8>] (regmap_i2c_read+0x48/0x68) [ 18.726715] [<c02351c8>] (regmap_i2c_read+0x48/0x68) from [<c023161c>] (_regmap_raw_read+0x128/0x220) [ 18.752685] [<c023161c>] (_regmap_raw_read+0x128/0x220) from [<c02317b4>] (regmap_raw_read+0xa0/0x130) [ 18.779052] [<c02317b4>] (regmap_raw_read+0xa0/0x130) from [<c023193c>] (regmap_bulk_read+0xf8/0x16c) [ 18.805694] [<c023193c>] (regmap_bulk_read+0xf8/0x16c) from [<c0238ea8>] (twl_i2c_read+0xa4/0xe0) [ 18.823730] [<c0238ea8>] (twl_i2c_read+0xa4/0xe0) from [<c0274d34>] (__twl4030_phy_power.isra.12+0x1c/0x58) [ 18.850921] [<c0274d34>] (__twl4030_phy_power.isra.12+0x1c/0x58) from [<c0274df0>] (twl4030_phy_power.part.14+0x80/0xc8) [ 18.879699] [<c0274df0>] (twl4030_phy_power.part.14+0x80/0xc8) from [<c0274f9c>] (twl4030_set_suspend+0x54/0x1e8) [ 18.908325] [<c0274f9c>] (twl4030_set_suspend+0x54/0x1e8) from [<c027c8c4>] (omap2430_runtime_resume+0x5c/0x64) [ 18.937042] [<c027c8c4>] (omap2430_runtime_resume+0x5c/0x64) from [<c0225dd0>] (pm_generic_runtime_resume+0x2c/0x38) [ 18.966461] [<c0225dd0>] (pm_generic_runtime_resume+0x2c/0x38) from [<c0229fe0>] (__rpm_callback+0x54/0x80) [ 18.995117] [<c0229fe0>] (__rpm_callback+0x54/0x80) from [<c022a04c>] (rpm_callback+0x40/0x74) [ 19.013610] [<c022a04c>] (rpm_callback+0x40/0x74) from [<c022b3c8>] (rpm_resume+0x448/0x63c) [ 19.031921] [<c022b3c8>] (rpm_resume+0x448/0x63c) from [<c022b2e4>] (rpm_resume+0x364/0x63c) [ 19.050140] [<c022b2e4>] (rpm_resume+0x364/0x63c) from [<c022b874>] (__pm_runtime_resume+0x48/0x74) [ 19.077728] [<c022b874>] (__pm_runtime_resume+0x48/0x74) from [<c027b4fc>] (musb_gadget_pullup+0x1c/0xb4) [ 19.105895] [<c027b4fc>] (musb_gadget_pullup+0x1c/0xb4) from [<bf025c14>] (usb_function_deactivate+0x54/0xa4 [libcomposite]) [ 19.135955] [<bf025c14>] (usb_function_deactivate+0x54/0xa4 [libcomposite]) from [<bf05b3b8>] (obex_bind+0x124/0x1d8 [usb_f_obex]) [ 19.166870] [<bf05b3b8>] (obex_bind+0x124/0x1d8 [usb_f_obex]) from [<bf025794>] (usb_add_function+0x58/0xf4 [libcomposite]) [ 19.197143] [<bf025794>] (usb_add_function+0x58/0xf4 [libcomposite]) from [<bf037420>] (nokia_bind_config+0x204/0x250 [g_nokia]) [ 19.227905] [<bf037420>] (nokia_bind_config+0x204/0x250 [g_nokia]) from [<bf0263fc>] (usb_add_config+0x28/0xc0 [libcomposite]) [ 19.258483] [<bf0263fc>] (usb_add_config+0x28/0xc0 [libcomposite]) from [<bf03709c>] (nokia_bind+0x9c/0x21c [g_nokia]) [ 19.288421] [<bf03709c>] (nokia_bind+0x9c/0x21c [g_nokia]) from [<bf0275bc>] (composite_bind+0x74/0x180 [libcomposite]) [ 19.318420] [<bf0275bc>] (composite_bind+0x74/0x180 [libcomposite]) from [<c027d658>] (udc_bind_to_driver+0x2c/0xc4) [ 19.348114] [<c027d658>] (udc_bind_to_driver+0x2c/0xc4) from [<c027d764>] (usb_gadget_probe_driver+0x74/0x94) [ 19.377166] [<c027d764>] (usb_gadget_probe_driver+0x74/0x94) from [<c00086f8>] (do_one_initcall+0x94/0x138) [ 19.406005] [<c00086f8>] (do_one_initcall+0x94/0x138) from [<c007a460>] (load_module+0x113c/0x13c4) [ 19.434051] [<c007a460>] (load_module+0x113c/0x13c4) from [<c007a7b4>] (SyS_init_module+0xcc/0xec) [ 19.462127] [<c007a7b4>] (SyS_init_module+0xcc/0xec) from [<c000dd40>] (ret_fast_syscall+0x0/0x30) [ 19.490753] Code: 0a00002e e1a00004 eb001438 e598300c (e5d3202c) [ 19.506805] ---[ end trace 060b62ec0d68a78b ]--- [ 19.523132] Kernel panic - not syncing: Fatal exception in interrupt dump is from 3.12-rc5 kernel Reported-by: Pali Rohár <[email protected]> Signed-off-by: Ivaylo Dimitrov <[email protected]> Signed-off-by: Felipe Balbi <[email protected]>
2014-02-18ahci: disable NCQ on Samsung pci-e SSDs on macbooksLevente Kurusa1-0/+14
Samsung's pci-e SSDs with device ID 0x1600 which are found on some macbooks time out on NCQ commands. Blacklist NCQ on the device so that the affected machines can at least boot. Original-patch-by: Levente Kurusa <[email protected]> Signed-off-by: Tejun Heo <[email protected]> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=60731 Cc: [email protected]
2014-02-18ACPI / PCI: Fix memory leak in acpi_pci_irq_enable()Tomasz Nowicki1-0/+1
acpi_pci_link_allocate_irq() can return negative gsi even if entry != NULL. For that case we have a memory leak, so free entry before returning from acpi_pci_irq_enable() for gsi < 0. Signed-off-by: Tomasz Nowicki <[email protected]> Cc: All applicable <[email protected]> [rjw: Subject and changelog] Signed-off-by: Rafael J. Wysocki <[email protected]>
2014-02-18drm/ttm: Fix memory leak in ttm_agp_backend.cMasanari Iida1-0/+1
This patch fix a memory leak found by cppcheck. [drivers/gpu/drm/ttm/ttm_agp_backend.c:129]: (error) Memory leak: agp_be Signed-off-by: Masanari Iida <[email protected]> Reviewed-by: Thomas Hellstrom <[email protected]>
2014-02-18drm/ttm: declare 'struct device' in ttm_page_alloc.hAlexandre Courbot1-0/+2
Declare 'struct device' explicitly in ttm_page_alloc.h as this file does not include any file declaring it. This removes the following warning: warning: 'struct device' declared inside parameter list Signed-off-by: Alexandre Courbot <[email protected]> Reviewed-by: Thierry Reding <[email protected]>
2014-02-18Merge branch 'for-joerg/arm-smmu/fixes' of ↵Joerg Roedel1-42/+61
git://git.kernel.org/pub/scm/linux/kernel/git/will/linux into iommu/fixes
2014-02-18ALSA: hda - add headset mic detect quirks for two Dell laptopsHui Wang1-0/+2
When we plug a 3-ring headset on the Dell machines (Vendor ID: 0x10ec0255, Subsystem ID: 0x10280657; Vendor ID: 0x10ec0255, Subsystem ID: 0x1028065f), the headset mic can't be detected, after apply this patch, the headset mic can work well. BugLink: https://bugs.launchpad.net/bugs/1260303 Cc: David Henningsson <[email protected]> Tested-by: Cyrus Lien <[email protected]> Cc: [email protected] Signed-off-by: Hui Wang <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2014-02-18Merge branch 'drm-nouveau-next' of ↵Dave Airlie14-12/+69
git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes Nothing too exciting, mostly fixes for ancient boards, but a pretty important fix for DP on some systems. Thanks, * 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6: drm/nouveau: fix TTM_PL_TT memtype on pre-nv50 drm/nv50/disp: use correct register to determine DP display bpp drm/nouveau/fb: use correct ram oclass for nv1a hardware drm/nv50/gr: add missing nv_error parameter priv drm/nouveau: fix ENG_RUNLIST register address drm/nv4c/bios: disallow retrieving from prom on nv4x igp's drm/nv4c/vga: decode register is in a different place on nv4x igp's drm/nv4c/mc: nv4x igp's have a different msi rearm register drm/nouveau: set irq_enabled manually
2014-02-18Merge tag 'drm-intel-fixes-2014-02-14' of ↵Dave Airlie4-6/+49
ssh://git.freedesktop.org/git/drm-intel into drm-fixes 3 fixes plus 1 prep patch, all four cc: stable. Jani will take over from here and the plan is that he'll do 3.14-fixes for the entire release just to work things out a bit. * tag 'drm-intel-fixes-2014-02-14' of ssh://git.freedesktop.org/git/drm-intel: drm/i915/dp: add native aux defer retry limit drm/i915/dp: increase native aux defer retry timeout drm/i915: Prevent MI_DISPLAY_FLIP straddling two cachelines on IVB drm/i915: Add intel_ring_cachline_align()
2014-02-18Merge branch 'tda998x-fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-cubox ↵Dave Airlie1-1/+3
into drm-fixes fix for leak in tda998x * 'tda998x-fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-cubox: drm/i2c: tda998x: Fix memory leak in tda998x_encoder_init error path.
2014-02-17jbd2: fix use after free in jbd2_journal_start_reserved()Dan Carpenter1-2/+4
If start_this_handle() fails then it leads to a use after free of "handle". Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: "Theodore Ts'o" <[email protected]> Cc: [email protected]
2014-02-18drm/nouveau: fix TTM_PL_TT memtype on pre-nv50Ilia Mirkin1-1/+1
Commit a55409066 ("drm/nv50-: map TTM_PL_SYSTEM through a BAR for CPU access") made it possible to work with tiled memory. However mem->mm_node is not a nouveau_mem for AGP-using pre-NV50 cards, but a drm_mm_node, as created by the ttm_bo_manager_func. As such, extend the untiled check to explicitly include all pre-nv50 cards. Reported-by: Ronald <[email protected]> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74613 Signed-off-by: Ilia Mirkin <[email protected]> Tested-by: Ronald Uitermark <[email protected]> Acked-by: Maarten Lankhorst <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nv50/disp: use correct register to determine DP display bppIlia Mirkin1-1/+1
Commit 0a0afd282f ("drm/nv50-/disp: move DP link training to core and train from supervisor") added code that uses the wrong register for computing the display bpp, used for bandwidth calculation. Adjust to use the same register as used by exec_clkcmp and nv50_disp_intr_unk20_2_dp. Reported-by: Torsten Wagner <[email protected]> Reported-by: Michael Gulick <[email protected]> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=67628 Cc: [email protected] # 3.9+ Signed-off-by: Ilia Mirkin <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nouveau/fb: use correct ram oclass for nv1a hardwareEmil Velikov1-1/+1
commit 8613e7314ac254fdd67ed46192f021d76141e4c9 Author: Ben Skeggs <[email protected]> Date: Mon Oct 21 08:50:25 2013 +1000 drm/nouveau/fb: remove ram oclass argument from base fb constructor Introduced a unfortunate regression by using nv10 ram oclass for nv1a hardware, causing corruption and eventually system lockup. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74866 Reported-by: John F. Godfrey <[email protected]> Signed-off-by: Emil Velikov <[email protected]> Cc: [email protected] # 3.13+ Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nv50/gr: add missing nv_error parameter privIlia Mirkin1-1/+1
Commit ea7dce901 ("drm/nv50/gr: print mpc trap name when it's not an mp trap") added an nv_error call that was missing the priv parameter. This causes GPFs if the error is ever hit. Signed-off-by: Ilia Mirkin <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nouveau: fix ENG_RUNLIST register addressAlexandre Courbot1-1/+1
Address of the ENG_RUNLIST register should be 0x002284 + (engine * 8), not 0x002284 + (engine * 4). Signed-off-by: Alexandre Courbot <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nv4c/bios: disallow retrieving from prom on nv4x igp'sIlia Mirkin1-0/+4
Suggested-by: Marcin Kościelnicki <[email protected]> Signed-off-by: Ilia Mirkin <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nv4c/vga: decode register is in a different place on nv4x igp'sIlia Mirkin1-1/+3
Suggested-by: Marcin Kościelnicki <[email protected]> Signed-off-by: Ilia Mirkin <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nv4c/mc: nv4x igp's have a different msi rearm registerIlia Mirkin6-6/+54
See https://bugs.freedesktop.org/show_bug.cgi?id=74492 Reported-by: Ronald <[email protected]> Suggested-by: Marcin Kościelnicki <[email protected]> Signed-off-by: Ilia Mirkin <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nouveau: set irq_enabled manuallyIlia Mirkin1-0/+3
Since commit 0fa9061ae8c ("drm/nouveau/mc: handle irq-related setup ourselves"), drm_device->irq_enabled remained unset. This is needed in order to properly wait for a vblank event in the generic drm code. See https://bugs.freedesktop.org/show_bug.cgi?id=74195 Reported-by: Jan Janecek <[email protected]> Signed-off-by: Ilia Mirkin <[email protected]> Cc: [email protected] # 3.10+ Signed-off-by: Ben Skeggs <[email protected]>
2014-02-17ARM: 7957/1: add DSB after icache flush in __flush_icache_all()Vinayak Kale1-0/+1
Add DSB after icache flush to complete the cache maintenance operation. Signed-off-by: Vinayak Kale <[email protected]> Acked-by: Catalin Marinas <[email protected]> Cc: <[email protected]> Signed-off-by: Russell King <[email protected]>
2014-02-17Fix uses of dma_max_pfn() when converting to a limiting addressRussell King2-2/+2
We must use a 64-bit for this, otherwise overflowed bits get lost, and that can result in a lower than intended value set. Fixes: 8e0cb8a1f6ac ("ARM: 7797/1: mmc: Use dma_max_pfn(dev) helper for bounce_limit calculations") Fixes: 7d35496dd982 ("ARM: 7796/1: scsi: Use dma_max_pfn(dev) helper for bounce_limit calculations") Tested-Acked-by: Santosh Shilimkar <[email protected]> Reviewed-by: Ulf Hansson <[email protected]> Signed-off-by: Russell King <[email protected]>
2014-02-17ipv4: fix counter in_slow_totDuan Jiong1-2/+2
since commit 89aef8921bf("ipv4: Delete routing cache."), the counter in_slow_tot can't work correctly. The counter in_slow_tot increase by one when fib_lookup() return successfully in ip_route_input_slow(), but actually the dst struct maybe not be created and cached, so we can increase in_slow_tot after the dst struct is created. Signed-off-by: Duan Jiong <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-02-17Merge branch 'for-linus' of ↵Linus Torvalds7-37/+96
git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client Pull Ceph fixes from Sage Weil: "We have some patches fixing up ACL support issues from Zheng and Guangliang and a mount option to enable/disable this support. (These fixes were somewhat delayed by the Chinese holiday.) There is also a small fix for cached readdir handling when directories are fragmented" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: fix __dcache_readdir() ceph: add acl, noacl options for cephfs mount ceph: make ceph_forget_all_cached_acls() static inline ceph: add missing init_acl() for mkdir() and atomic_open() ceph: fix ceph_set_acl() ceph: fix ceph_removexattr() ceph: remove xattr when null value is given to setxattr() ceph: properly handle XATTR_CREATE and XATTR_REPLACE
2014-02-17Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds10-28/+78
Pull CIFS fixes from Steve French: "Three cifs fixes, the most important fixing the problem with passing bogus pointers with writev (CVE-2014-0069). Two additional cifs fixes are still in review (including the fix for an append problem which Al also discovered)" * 'for-linus' of git://git.samba.org/sfrench/cifs-2.6: CIFS: Fix too big maxBuf size for SMB3 mounts cifs: ensure that uncached writes handle unmapped areas correctly [CIFS] Fix cifsacl mounts over smb2 to not call cifs
2014-02-17FS-Cache: Handle removal of unadded object to the fscache_object_list rb treeDavid Howells2-0/+8
When FS-Cache allocates an object, the following sequence of events can occur: -->fscache_alloc_object() -->cachefiles_alloc_object() [via cache->ops->alloc_object] <--[returns new object] -->fscache_attach_object() <--[failed] -->cachefiles_put_object() [via cache->ops->put_object] -->fscache_object_destroy() -->fscache_objlist_remove() -->rb_erase() to remove the object from fscache_object_list. resulting in a crash in the rbtree code. The problem is that the object is only added to fscache_object_list on the success path of fscache_attach_object() where it calls fscache_objlist_add(). So if fscache_attach_object() fails, the object won't have been added to the objlist rbtree. We do, however, unconditionally try to remove the object from the tree. Thanks to NeilBrown for finding this and suggesting this solution. Reported-by: NeilBrown <[email protected]> Signed-off-by: David Howells <[email protected]> Tested-by: (a customer of) NeilBrown <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2014-02-17reiserfs: fix utterly brain-damaged indentation.Dave Jones1-700/+195
This has been this way for years, and every time I stumble across it I lose my lunch. After coming across it for the nth time in the Coverity results, I had to overcome the bystander effect and do something about it. This ignores the 79 column limit in favor of making it look like C instead of gibberish. The correct thing to do here would be to lose some of the indentation by breaking this function up into several smaller ones. I might do that at some point if I have the stomach to look at this again. (Also some of those overlong ternary operations would likely be more readable as regular if's) Signed-off-by: Dave Jones <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2014-02-17irtty-sir.c: Do not set_termios() on irtty_close()Tommie Gannert1-1/+0
Issuing set_termios() from irtty_close() causes kernel Oops for unplugged usb-serial devices. Since no other tty_ldisc calls set_termios() on close and no tty driver seem to check if tty->device_data is NULL or not on entry to set_termios(), the only solution I can come up with is to remove the irtty_stop_receiver() call, which only updates termios. Signed-off-by: Tommie Gannert <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-02-17Merge branch 'master' of ↵John W. Linville9-16/+75
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2014-02-17Merge tag 'dma-buf-for-3.14' of ↵Linus Torvalds2-14/+13
git://git.kernel.org/pub/scm/linux/kernel/git/sumits/dma-buf Pull dma-buf fix from Sumit Semwal: "Just some debugfs output updates. There's another patch related to dma-buf, but it'll get upstreamed via Greg KH's pull request" * tag 'dma-buf-for-3.14' of git://git.kernel.org/pub/scm/linux/kernel/git/sumits/dma-buf: dma-buf: update debugfs output
2014-02-17Merge branch 'for-linus' of ↵Linus Torvalds4-1/+5
git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32 Pull AVR32 fixes from Hans-Christian Egtvedt. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32: avr32: add generic vga.h to Kbuild avr32: add generic ioremap_wc() definition in io.h avr32: Makefile: add '-D__linux__' flag for gcc-4.4.7 use avr32: fix missing module.h causing build failure in mimc200/fram.c
2014-02-17ceph: fix __dcache_readdir()Yan, Zheng1-1/+9
If directory is fragmented, readdir() read its dirfrags one by one. After reading all dirfrags, the corresponding dentries are sorted in (frag_t, off) order in the dcache. If dentries of a directory are all cached, __dcache_readdir() can use the cached dentries to satisfy readdir syscall. But when checking if a given dentry is after the position of readdir, __dcache_readdir() compares numerical value of frag_t directly. This is wrong, it should use ceph_frag_compare(). Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17ceph: add acl, noacl options for cephfs mountSage Weil1-4/+28
Make the 'acl' option dependent on having ACL support compiled in. Make the 'noacl' option work even without it so that one can always ask it to be off and not error out on mount when it is not supported. Signed-off-by: Guangliang Zhao <[email protected]> Signed-off-by: Sage Weil <[email protected]>
2014-02-17ceph: make ceph_forget_all_cached_acls() static inlineGuangliang Zhao2-6/+6
Signed-off-by: Guangliang Zhao <[email protected]> Reviewed-by: Alex Elder <[email protected]> Signed-off-by: Sage Weil <[email protected]>
2014-02-17ceph: add missing init_acl() for mkdir() and atomic_open()Yan, Zheng2-5/+9
Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17ceph: fix ceph_set_acl()Yan, Zheng1-5/+1
If acl is equivalent to file mode permission bits, ceph_set_acl() needs to remove any existing acl xattr. Use __ceph_setxattr() to handle both setting and removing acl xattr cases, it doesn't return -ENODATA when there is no acl xattr. Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17ceph: fix ceph_removexattr()Yan, Zheng1-1/+1
Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17ceph: remove xattr when null value is given to setxattr()Yan, Zheng2-4/+17
For the setxattr request, introduce a new flag CEPH_XATTR_REMOVE to distinguish null value case from the zero-length value case. Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17ceph: properly handle XATTR_CREATE and XATTR_REPLACEYan, Zheng1-12/+26
return -EEXIST if XATTR_CREATE is set and xattr alread exists. return -ENODATA if XATTR_REPLACE is set but xattr does not exist. Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17Merge branch 'merge' of ↵Linus Torvalds18-91/+172
git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc Pull powerpc fixes from Ben Herrenschmidt: "Here are some more powerpc fixes for 3.14 The main one is a nasty issue with the NUMA balancing support which requires a small generic change and the addition of a new accessor to set _PAGE_NUMA. Both have been reviewed and acked by Mel and Rik. The changelog should have plenty of details but basically, without this fix, we get random user segfaults and/or corruptions due to missing TLB/hash flushes. Aneesh series of 3 patches fixes it. We have some vDSO vs. perf fixes from Anton, some small EEH fixes from Gavin, a ppc32 regression vs the stack overflow detector, and a fix for the way we handle PCIe host bridge speed settings on pseries (which is needed for proper operations of AMD graphics cards on Power8)" * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/eeh: Disable EEH on reboot powerpc/eeh: Cleanup on eeh_subsystem_enabled powerpc/powernv: Rework EEH reset powerpc: Use unstripped VDSO image for more accurate profiling data powerpc: Link VDSOs at 0x0 mm: Use ptep/pmdp_set_numa() for updating _PAGE_NUMA bit mm: Dirty accountable change only apply to non prot numa case powerpc/mm: Add new "set" flag argument to pte/pmd update function powerpc/pseries: Add Gen3 definitions for PCIE link speed powerpc/pseries: Fix regression on PCI link speed powerpc: Set the correct ksp_limit on ppc32 when switching to irq stack
2014-02-17printk: fix syslog() overflowing user bufferLinus Torvalds1-2/+0
This is not a buffer overflow in the traditional sense: we don't overflow any *kernel* buffers, but we do mis-count the amount of data we copy back to user space for the SYSLOG_ACTION_READ_ALL case. In particular, if the user buffer is too small to hold everything, and *if* there is a continuation line at just the right place, we can end up giving the user more data than he asked for. The reason is that we first count up the number of bytes all the log records contains, then we walk the records again until we've skipped the records at the beginning that won't fit, and then we walk the rest of the records and copy them to the user space buffer. And in between that "skip the initial records that won't fit" and the "copy the records that *will* fit to user space", we reset the 'prev' variable that contained the record information for the last record not copied. That meant that when we started copying to user space, we now had a different character count than what we had originally calculated in the first record walk-through. The fix is to simply not clear the 'prev' flags value (in both cases where we had the same logic: syslog_print_all and kmsg_dump_get_buffer: the latter is used for pstore-like dumping) Reported-and-tested-by: Debabrata Banerjee <[email protected]> Acked-by: Kay Sievers <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: Jeff Mahoney <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2014-02-17HID: hyperv: make sure input buffer is big enoughDavid Herrmann1-3/+8
We need at least HID_MAX_BUFFER_SIZE (4096) bytes as input buffer. HID core depends on this as it requires every input report to be at least as big as advertised. Signed-off-by: David Herrmann <[email protected]> Signed-off-by: K. Y. Srinivasan <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.