Nelson Elhage [Thu, 2 Dec 2010 22:31:21 +0000 (14:31 -0800)]
do_exit(): make sure that we run with get_fs() == USER_DS
If a user manages to trigger an oops with fs set to KERNEL_DS, fs is not
otherwise reset before do_exit(). do_exit may later (via mm_release in
fork.c) do a put_user to a user-controlled address, potentially allowing
a user to leverage an oops into a controlled write into kernel memory.
This is only triggerable in the presence of another bug, but this
potentially turns a lot of DoS bugs into privilege escalations, so it's
worth fixing. I have proof-of-concept code which uses this bug along
with CVE-2010-3849 to write a zero to an arbitrary kernel address, so
I've tested that this is not theoretical.
A more logical place to put this fix might be when we know an oops has
occurred, before we call do_exit(), but that would involve changing
every architecture, in multiple places.
Let's just stick it in do_exit instead.
[akpm@linux-foundation.org: update code comment]
Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
KOSAKI Motohiro [Thu, 2 Dec 2010 22:31:20 +0000 (14:31 -0800)]
ksm: annotate ksm_thread_mutex is no deadlock source
commit
62b61f611e ("ksm: memory hotremove migration only") caused the
following new lockdep warning.
=======================================================
[ INFO: possible circular locking dependency detected ]
-------------------------------------------------------
bash/1621 is trying to acquire lock:
((memory_chain).rwsem){.+.+.+}, at: [<
ffffffff81079339>]
__blocking_notifier_call_chain+0x69/0xc0
but task is already holding lock:
(ksm_thread_mutex){+.+.+.}, at: [<
ffffffff8113a3aa>]
ksm_memory_callback+0x3a/0xc0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (ksm_thread_mutex){+.+.+.}:
[<
ffffffff8108b70a>] lock_acquire+0xaa/0x140
[<
ffffffff81505d74>] __mutex_lock_common+0x44/0x3f0
[<
ffffffff81506228>] mutex_lock_nested+0x48/0x60
[<
ffffffff8113a3aa>] ksm_memory_callback+0x3a/0xc0
[<
ffffffff8150c21c>] notifier_call_chain+0x8c/0xe0
[<
ffffffff8107934e>] __blocking_notifier_call_chain+0x7e/0xc0
[<
ffffffff810793a6>] blocking_notifier_call_chain+0x16/0x20
[<
ffffffff813afbfb>] memory_notify+0x1b/0x20
[<
ffffffff81141b7c>] remove_memory+0x1cc/0x5f0
[<
ffffffff813af53d>] memory_block_change_state+0xfd/0x1a0
[<
ffffffff813afd62>] store_mem_state+0xe2/0xf0
[<
ffffffff813a0bb0>] sysdev_store+0x20/0x30
[<
ffffffff811bc116>] sysfs_write_file+0xe6/0x170
[<
ffffffff8114f398>] vfs_write+0xc8/0x190
[<
ffffffff8114fc14>] sys_write+0x54/0x90
[<
ffffffff810028b2>] system_call_fastpath+0x16/0x1b
-> #0 ((memory_chain).rwsem){.+.+.+}:
[<
ffffffff8108b5ba>] __lock_acquire+0x155a/0x1600
[<
ffffffff8108b70a>] lock_acquire+0xaa/0x140
[<
ffffffff81506601>] down_read+0x51/0xa0
[<
ffffffff81079339>] __blocking_notifier_call_chain+0x69/0xc0
[<
ffffffff810793a6>] blocking_notifier_call_chain+0x16/0x20
[<
ffffffff813afbfb>] memory_notify+0x1b/0x20
[<
ffffffff81141f1e>] remove_memory+0x56e/0x5f0
[<
ffffffff813af53d>] memory_block_change_state+0xfd/0x1a0
[<
ffffffff813afd62>] store_mem_state+0xe2/0xf0
[<
ffffffff813a0bb0>] sysdev_store+0x20/0x30
[<
ffffffff811bc116>] sysfs_write_file+0xe6/0x170
[<
ffffffff8114f398>] vfs_write+0xc8/0x190
[<
ffffffff8114fc14>] sys_write+0x54/0x90
[<
ffffffff810028b2>] system_call_fastpath+0x16/0x1b
But it's a false positive. Both memory_chain.rwsem and ksm_thread_mutex
have an outer lock (mem_hotplug_mutex). So they cannot deadlock.
Thus, This patch annotate ksm_thread_mutex is not deadlock source.
[akpm@linux-foundation.org: update comment, from Hugh]
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
KOSAKI Motohiro [Thu, 2 Dec 2010 22:31:19 +0000 (14:31 -0800)]
mem-hotplug: introduce {un}lock_memory_hotplug()
Presently hwpoison is using lock_system_sleep() to prevent a race with
memory hotplug. However lock_system_sleep() is a no-op if
CONFIG_HIBERNATION=n. Therefore we need a new lock.
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Kamezawa Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Suggested-by: Hugh Dickins <hughd@google.com>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Andrew Morton [Thu, 2 Dec 2010 22:31:19 +0000 (14:31 -0800)]
Documentation/filesystems/vfs.txt: fix ->repeasepage() description
->releasepage() does not remove the page from the mapping.
Acked-by: Neil Brown <neilb@suse.de>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Jeremy Fitzhardinge [Thu, 2 Dec 2010 22:31:18 +0000 (14:31 -0800)]
vmalloc: eagerly clear ptes on vunmap
On stock 2.6.37-rc4, running:
# mount lilith:/export /mnt/lilith
# find /mnt/lilith/ -type f -print0 | xargs -0 file
crashes the machine fairly quickly under Xen. Often it results in oops
messages, but the couple of times I tried just now, it just hung quietly
and made Xen print some rude messages:
(XEN) mm.c:2389:d80 Bad type (saw
7400000000000001 != exp
3000000000000000) for mfn 1d7058 (pfn 18fa7)
(XEN) mm.c:964:d80 Attempt to create linear p.t. with write perms
(XEN) mm.c:2389:d80 Bad type (saw
7400000000000010 != exp
1000000000000000) for mfn 1d2e04 (pfn 1d1fb)
(XEN) mm.c:2965:d80 Error while pinning mfn 1d2e04
Which means the domain tried to map a pagetable page RW, which would
allow it to map arbitrary memory, so Xen stopped it. This is because
vm_unmap_ram() left some pages mapped in the vmalloc area after NFS had
finished with them, and those pages got recycled as pagetable pages
while still having these RW aliases.
Removing those mappings immediately removes the Xen-visible aliases, and
so it has no problem with those pages being reused as pagetable pages.
Deferring the TLB flush doesn't upset Xen because it can flush the TLB
itself as needed to maintain its invariants.
When unmapping a region in the vmalloc space, clear the ptes
immediately. There's no point in deferring this because there's no
amortization benefit.
The TLBs are left dirty, and they are flushed lazily to amortize the
cost of the IPIs.
This specific motivation for this patch is an oops-causing regression
since 2.6.36 when using NFS under Xen, triggered by the NFS client's use
of vm_map_ram() introduced in
56e4ebf877b60 ("NFS: readdir with vmapped
pages") . XFS also uses vm_map_ram() and could cause similar problems.
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Cc: Nick Piggin <npiggin@kernel.dk>
Cc: Bryan Schumaker <bjschuma@netapp.com>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Alex Elder <aelder@sgi.com>
Cc: Dave Chinner <david@fromorbit.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Andres Salomon [Thu, 2 Dec 2010 22:31:17 +0000 (14:31 -0800)]
cs5535-gpio: apply CS5536 errata workaround for GPIOs
The AMD Geode CS5536 Companion Device Silicon Revision B1 Specification
Update mentions the follow as issue #36:
"Atomic write transactions to the atomic GPIO High Bank Feature Bit
registers should only affect the bits selected [...]"
"after Suspend, an atomic write transaction [...] will clear all
non-selected bits of the accessed register."
In other words, writing to the high bank for a single GPIO bit will
clear every other GPIO bit (but only sometimes after a suspend).
The workaround described is obvious and simple; do a read-modify-write.
This patch does that, and documents why we're doing it.
Signed-off-by: Andres Salomon <dilinger@queued.net>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Frederic Weisbecker [Thu, 2 Dec 2010 22:31:16 +0000 (14:31 -0800)]
reiserfs: don't acquire lock recursively in reiserfs_acl_chmod
reiserfs_acl_chmod() can be called by reiserfs_set_attr() and then take
the reiserfs lock a second time. Thereafter it may call journal_begin()
that definitely requires the lock not to be nested in order to release
it before taking the journal mutex because the reiserfs lock depends on
the journal mutex already.
So, aviod nesting the lock in reiserfs_acl_chmod().
Reported-by: Pawel Zawora <pzawora@gmail.com>
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
Tested-by: Pawel Zawora <pzawora@gmail.com>
Cc: Jeff Mahoney <jeffm@suse.com>
Cc: <stable@kernel.org> [2.6.32.x+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Johannes Berg [Thu, 2 Dec 2010 22:31:14 +0000 (14:31 -0800)]
leds: fix up dependencies
It's not useful to build LED triggers when there's no LEDs that can be
triggered by them. Therefore, fix up the dependencies so that this
cannot happen, and fix a few users that select triggers to depend on
LEDS_CLASS as well (there is also one user that also selects LEDS_CLASS,
which is OK).
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reported-by: Randy Dunlap <randy.dunlap@oracle.com>
Acked-by: Randy Dunlap <randy.dunlap@oracle.com>
Tested-by: Ingo Molnar <mingo@elte.hu>
Cc: Arnd Hannemann <arnd@arndnet.de>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Richard Purdie <rpurdie@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Wu Fengguang [Thu, 2 Dec 2010 22:31:13 +0000 (14:31 -0800)]
vmstat: fix dirty threshold ordering
The nr_dirty_[background_]threshold fields are misplaced before the
numa_* fields, and users will read strange values.
This is the right order. Before patch, nr_dirty_background_threshold
will read as 0 (the value from numa_miss).
numa_hit 128501
numa_miss 0
numa_foreign 0
numa_interleave 7388
numa_local 128501
numa_other 0
nr_dirty_threshold 144291
nr_dirty_background_threshold 72145
Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
Cc: Michael Rubin <mrubin@google.com>
Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Reviewed-by: Minchan Kim <minchan.kim@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Zeng Zhaoming [Thu, 2 Dec 2010 22:31:13 +0000 (14:31 -0800)]
mm/mempolicy.c: add rcu read lock to protect pid structure
find_task_by_vpid() should be protected by rcu_read_lock(), to prevent
free_pid() reclaiming pid.
Signed-off-by: Zeng Zhaoming <zengzm.kernel@gmail.com>
Cc: "Paul E. McKenney" <paulmck@us.ibm.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Christoph Lameter <cl@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Dean Nelson [Thu, 2 Dec 2010 22:31:12 +0000 (14:31 -0800)]
mm/hugetlb.c: avoid double unlock_page() in hugetlb_fault()
Have hugetlb_fault() call unlock_page(page) only if it had previously
called lock_page(page).
Setting CONFIG_DEBUG_VM=y and then running the libhugetlbfs test suite,
resulted in the tripping of VM_BUG_ON(!PageLocked(page)) in
unlock_page() having been called by hugetlb_fault() when page ==
pagecache_page. This patch remedied the problem.
Signed-off-by: Dean Nelson <dnelson@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Thu, 2 Dec 2010 20:59:11 +0000 (12:59 -0800)]
Merge branch 'staging-linus' of git://git./linux/kernel/git/gregkh/staging-2.6
* 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: (27 commits)
Staging: rt2870: Add USB ID for Buffalo Airstation WLI-UC-GN
staging: easycap needs smp_lock.h, fixes build error
Staging: batman-adv: ensure that eth_type_trans gets linear memory
Staging: batman-adv: Don't remove interface with spinlock held
staging: brcm80211: updated maintainers contact information
staging: fix winbond build, needs delay.h
Staging: line6: fix up my fixup for some sysfs attribute permissions
Staging: zram: fix up my fixup for some sysfs attribute permissions
Staging: udlfb: fix up my fixup for some sysfs attribute permissions
Staging: samsung-laptop: fix up my fixup for some sysfs attribute permissions
Staging: iio: adis16220: fix up my fixup for some sysfs attribute permissions
Staging: frontier: fix up my fixup for some sysfs attribute permissions
Staging: asus_oled: fix up my fixup for some sysfs attribute permissions
staging: spectra: fix build error
Staging: intel_sst: fix memory leak
Staging: rtl8712: signedness bug in init
staging: rtl8187se: Change panic to warn when RF switch turned off
staging: comedi: fix memory leak
Staging: quickstart: free after input_unregister_device()
Staging: speakup: free after input_unregister_device()
...
Linus Torvalds [Thu, 2 Dec 2010 20:58:36 +0000 (12:58 -0800)]
Merge branch 'driver-core-linus' of git://git./linux/kernel/git/gregkh/driver-core-2.6
* 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6:
uio: Change mail address of Hans J. Koch
driver core: prune docs about device_interface
driver core: the development tree has switched to git
Linus Torvalds [Thu, 2 Dec 2010 20:58:16 +0000 (12:58 -0800)]
Merge branch 'tty-linus' of git://git./linux/kernel/git/gregkh/tty-2.6
* 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
serial: mfd: adjust the baud rate setting
TTY: open/hangup race fixup
TTY: don't allow reopen when ldisc is changing
NET: wan/x25, fix ldisc->open retval
TTY: ldisc, fix open flag handling
serial8250: Mark console as CON_ANYTIME
Linus Torvalds [Thu, 2 Dec 2010 20:57:35 +0000 (12:57 -0800)]
Merge branch 'usb-linus' of git://git./linux/kernel/git/gregkh/usb-2.6
* 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
USB: fix autosuspend bug in usb-serial
USB: ehci: disable LPM and PPCD for nVidia MCP89 chips
USB: serial: ftdi_sio: Vardaan USB RS422/485 converter PID added
USB: yurex: add .llseek fop to file_operations
USB: ftdi_sio: Add ID for RT Systems USB-29B radio cable
usb: musb: do not use dma for control transfers
usb: musb: gadget: fix compilation warning
usb: musb: clear RXCSR_AUTOCLEAR before PIO read
usb: musb: unmap dma buffer when switching to PIO
xhci: Don't let the USB core disable SuperSpeed ports.
xhci: Setup array of USB 2.0 and USB 3.0 ports.
xhci: Fix reset-device and configure-endpoint commands
Linus Torvalds [Thu, 2 Dec 2010 20:11:31 +0000 (12:11 -0800)]
Merge git://git./linux/kernel/git/wim/linux-2.6-watchdog
* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
watchdog: it8712f_wdt: add note to Kconfig
watchdog: gef_wdt: include fs.h
watchdog: bcm63xx_wdt: improve platform part.
watchdog: iTCO_wdt: TCO Watchdog patch for Intel Patsburg PCH
Linus Torvalds [Thu, 2 Dec 2010 20:10:56 +0000 (12:10 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/roland/infiniband
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
IB: Fix information leak in marshalling code
IB/pack: Remove some unused code added by the IBoE patches
IB/mlx4: Fix IBoE link state
IB/mlx4: Fix IBoE reported link rate
mlx4_core: Workaround firmware bug in query dev cap
IB/mlx4: Fix memory ordering of VLAN insertion control bits
MAINTAINERS: Update NetEffect entry
Linus Torvalds [Thu, 2 Dec 2010 17:13:36 +0000 (09:13 -0800)]
Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
* 'for-linus' of git://oss.sgi.com/xfs/xfs:
xfs: only run xfs_error_test if error injection is active
xfs: avoid moving stale inodes in the AIL
xfs: delayed alloc blocks beyond EOF are valid after writeback
xfs: push stale, pinned buffers on trylock failures
xfs: fix failed write truncation handling.
Linus Torvalds [Thu, 2 Dec 2010 16:06:16 +0000 (08:06 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/lrg/voltage-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6:
regulator: fix kernel-doc for set_consumer_device_supply
regulator: enable supply regulator only when use count is zero
regulator: twl-regulator - fix twlreg_set_mode
regulator: lock supply in regulator enable
regulator: Return proper error for regulator_register()
regulator: Ensure enough delay time for enabling regulator
regulator: Remove a redundant device_remove_file call in create_regulator
regulator: Staticise mc13783_powermisc_rmw()
regulator: regulator disable supply fix
Linus Torvalds [Thu, 2 Dec 2010 16:05:56 +0000 (08:05 -0800)]
Merge branch 'v4l_for_linus' of git://git./linux/kernel/git/mchehab/linux-2.6
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6:
[media] v4l: Remove module_name argument to the v4l2_i2c_new_subdev* functions
[media] v4l: Remove hardcoded module names passed to v4l2_i2c_new_subdev* (2)
Linus Torvalds [Thu, 2 Dec 2010 16:05:22 +0000 (08:05 -0800)]
Merge branch 'rbd-sysfs' of git://git./linux/kernel/git/sage/ceph-client
* 'rbd-sysfs' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
rbd: replace the rbd sysfs interface
Linus Torvalds [Thu, 2 Dec 2010 16:04:21 +0000 (08:04 -0800)]
Merge git://git./linux/kernel/git/sfrench/cifs-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
cifs: fix parsing of hostname in dfs referrals
cifs: display fsc in /proc/mounts
cifs: enable fscache iff fsc mount option is used explicitly
cifs: allow fsc mount option only if CONFIG_CIFS_FSCACHE is set
cifs: Handle extended attribute name cifs_acl to generate cifs acl blob (try #4)
cifs: Misc. cleanup in cifsacl handling [try #4]
cifs: trivial comment fix for cifs_invalidate_mapping
[CIFS] fs/cifs/Kconfig: CIFS depends on CRYPTO_HMAC
cifs: don't take extra tlink reference in initiate_cifs_search
cifs: Percolate error up to the caller during get/set acls [try #4]
cifs: fix another memleak, in cifs_root_iget
cifs: fix potential use-after-free in cifs_oplock_break_put
Wim Van Sebroeck [Thu, 2 Dec 2010 14:03:29 +0000 (14:03 +0000)]
watchdog: it8712f_wdt: add note to Kconfig
On some motherboards the it8712f watchdog does not work unless
the game port was enabled. see Bug 13140. We therefor add a note
to Kconfig.
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Wolfram Sang & Martyn Welch [Wed, 1 Dec 2010 23:11:16 +0000 (00:11 +0100)]
watchdog: gef_wdt: include fs.h
Add missing include "linux/fs.h".
This fixes compile failure.
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Signed-off-by: Martyn Welch <martyn.welch@ge.com>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Wim Van Sebroeck [Sat, 23 Oct 2010 20:59:42 +0000 (20:59 +0000)]
watchdog: bcm63xx_wdt: improve platform part.
* fix devinit and devexit sections
* fix platform removal code so that the iounmap happens after the removal of the timer.
* changes the reboot_notifier by a platform shutdown method.
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Seth Heasley [Wed, 17 Nov 2010 19:15:08 +0000 (12:15 -0700)]
watchdog: iTCO_wdt: TCO Watchdog patch for Intel Patsburg PCH
This patch adds an additional LPC Controller DeviceID for the Intel Patsburg PCH for TCO Watchdog.
Signed-off-by: Seth Heasley <seth.heasley@intel.com>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Roland Dreier [Thu, 2 Dec 2010 00:33:47 +0000 (16:33 -0800)]
Merge branches 'misc', 'mlx4' and 'nes' into for-next
Vasiliy Kulikov [Sun, 14 Nov 2010 09:22:52 +0000 (09:22 +0000)]
IB: Fix information leak in marshalling code
ib_ucm_init_qp_attr() and ucma_init_qp_attr() pass struct ib_uverbs_qp_attr
with reserved, qp_state, {ah_attr,alt_ah_attr}{reserved,->grh.reserved}
fields uninitialized to copy_to_user(). This leads to leaking of
contents of kernel stack memory to userspace.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Or Gerlitz [Mon, 29 Nov 2010 07:20:50 +0000 (07:20 +0000)]
IB/pack: Remove some unused code added by the IBoE patches
Remove unused functions added by commit
ff7f5aab354d ("IB/pack: IBoE UD
packet packing support").
Signed-off-by: Or Gerlitz <ogerlitz@voltaire.com>
Eli Cohen [Thu, 11 Nov 2010 21:05:58 +0000 (21:05 +0000)]
IB/mlx4: Fix IBoE link state
Use netif_running() and netif_carrier_ok() to report link state,
exactly as is done to report Ethernet link state in sysfs.
Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Eli Cohen [Mon, 15 Nov 2010 14:04:39 +0000 (14:04 +0000)]
IB/mlx4: Fix IBoE reported link rate
The link rate is the product of the link speed in the link width. For
Etherent ports the rate is 10G, so we use 1 for the width and 4 for
speed to get the correct rate.
Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Eli Cohen [Wed, 10 Nov 2010 12:52:37 +0000 (12:52 +0000)]
mlx4_core: Workaround firmware bug in query dev cap
ConnectX firmware is supposed to report the number blue flame
registers per page as log2 of the value. However, due to a firmware
bug, it reports actual number. This patch works around this by
checking if the number of registers calculated fits within a page. If
it does not, we use 8 registers per page.
Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Yehuda Sadeh [Fri, 19 Nov 2010 22:51:04 +0000 (14:51 -0800)]
rbd: replace the rbd sysfs interface
The new interface creates directories per mapped image
and under each it creates a subdir per available snapshot.
This allows keeping a cleaner interface within the sysfs
guidelines. The ABI documentation was updated too.
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Yehuda Sadeh <yehuda@hq.newdream.net>
Signed-off-by: Sage Weil <sage@newdream.net>
Eli Cohen [Wed, 17 Nov 2010 13:39:43 +0000 (13:39 +0000)]
IB/mlx4: Fix memory ordering of VLAN insertion control bits
We must fully update the control segment before marking it as valid,
so that hardware doesn't start executing it before we're ready.
Signed-off-by: Eli Cohen <eli@mellanox.co.il>
[ Move VLAN control bit setting to before wmb(). - Roland ]
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Chien Tung [Tue, 2 Nov 2010 16:29:54 +0000 (16:29 +0000)]
MAINTAINERS: Update NetEffect entry
Correct web link as www.neteffect.com is no longer valid. Remove
Chien Tung as maintainer. I am moving on to other responsibilities at
Intel. Thanks for all the fish.
Signed-off-by: Chien Tung <chien.tin.tung@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Dave Chinner [Tue, 30 Nov 2010 04:15:31 +0000 (15:15 +1100)]
xfs: only run xfs_error_test if error injection is active
Recent tests writing lots of small files showed the flusher thread
being CPU bound and taking a long time to do allocations on a debug
kernel. perf showed this as the prime reason:
samples pcnt function DSO
_______ _____ ___________________________ _________________
224648.00 36.8% xfs_error_test [kernel.kallsyms]
86045.00 14.1% xfs_btree_check_sblock [kernel.kallsyms]
39778.00 6.5% prandom32 [kernel.kallsyms]
37436.00 6.1% xfs_btree_increment [kernel.kallsyms]
29278.00 4.8% xfs_btree_get_rec [kernel.kallsyms]
27717.00 4.5% random32 [kernel.kallsyms]
Walking btree blocks during allocation checking them requires each
block (a cache hit, so no I/O) call xfs_error_test(), which then
does a random32() call as the first operation. IOWs, ~50% of the
CPU is being consumed just testing whether we need to inject an
error, even though error injection is not active.
Kill this overhead when error injection is not active by adding a
global counter of active error traps and only calling into
xfs_error_test when fault injection is active.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Dave Chinner [Tue, 30 Nov 2010 04:15:46 +0000 (15:15 +1100)]
xfs: avoid moving stale inodes in the AIL
When an inode has been marked stale because the cluster is being
freed, we don't want to (re-)insert this inode into the AIL. There
is a race condition where the cluster buffer may be unpinned before
the inode is inserted into the AIL during transaction committed
processing. If the buffer is unpinned before the inode item has been
committed and inserted, then it is possible for the buffer to be
released and hence processthe stale inode callbacks before the inode
is inserted into the AIL.
In this case, we then insert a clean, stale inode into the AIL which
will never get removed by an IO completion. It will, however, get
reclaimed and that triggers an assert in xfs_inode_free()
complaining about freeing an inode still in the AIL.
This race can be avoided by not moving stale inodes forward in the AIL
during transaction commit completion processing. This closes the
race condition by ensuring we never insert clean stale inodes into
the AIL. It is safe to do this because a dirty stale inode, by
definition, must already be in the AIL.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Dave Chinner [Tue, 30 Nov 2010 04:16:02 +0000 (15:16 +1100)]
xfs: delayed alloc blocks beyond EOF are valid after writeback
There is an assumption in the parts of XFS that flushing a dirty
file will make all the delayed allocation blocks disappear from an
inode. That is, that after calling xfs_flush_pages() then
ip->i_delayed_blks will be zero.
This is an invalid assumption as we may have specualtive
preallocation beyond EOF and they are recorded in
ip->i_delayed_blks. A flush of the dirty pages of an inode will not
change the state of these blocks beyond EOF, so a non-zero
deeelalloc block count after a flush is valid.
The bmap code has an invalid ASSERT() that needs to be removed, and
the swapext code has a bug in that while it swaps the data forks
around, it fails to swap the i_delayed_blks counter associated with
the fork and hence can get the block accounting wrong.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Dave Chinner [Tue, 30 Nov 2010 04:16:16 +0000 (15:16 +1100)]
xfs: push stale, pinned buffers on trylock failures
As reported by Nick Piggin, XFS is suffering from long pauses under
highly concurrent workloads when hosted on ramdisks. The problem is
that an inode buffer is stuck in the pinned state in memory and as a
result either the inode buffer or one of the inodes within the
buffer is stopping the tail of the log from being moved forward.
The system remains in this state until a periodic log force issued
by xfssyncd causes the buffer to be unpinned. The main problem is
that these are stale buffers, and are hence held locked until the
transaction/checkpoint that marked them state has been committed to
disk. When the filesystem gets into this state, only the xfssyncd
can cause the async transactions to be committed to disk and hence
unpin the inode buffer.
This problem was encountered when scaling the busy extent list, but
only the blocking lock interface was fixed to solve the problem.
Extend the same fix to the buffer trylock operations - if we fail to
lock a pinned, stale buffer, then force the log immediately so that
when the next attempt to lock it comes around, it will have been
unpinned.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Dave Chinner [Tue, 30 Nov 2010 04:14:39 +0000 (15:14 +1100)]
xfs: fix failed write truncation handling.
Since the move to the new truncate sequence we call xfs_setattr to
truncate down excessively instanciated blocks. As shown by the testcase
in kernel.org BZ #22452 that doesn't work too well. Due to the confusion
of the internal inode size, and the VFS inode i_size it zeroes data that
it shouldn't.
But full blown truncate seems like overkill here. We only instanciate
delayed allocations in the write path, and given that we never released
the iolock we can't have converted them to real allocations yet either.
The only nasty case is pre-existing preallocation which we need to skip.
We already do this for page discard during writeback, so make the delayed
allocation block punching a generic function and call it from the failed
write path as well as xfs_aops_discard_page. The callers are
responsible for ensuring that partial blocks are not truncated away,
and that they hold the ilock.
Based on a fix originally from Christoph Hellwig. This version used
filesystem blocks as the range unit.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Linus Torvalds [Wed, 1 Dec 2010 04:13:35 +0000 (20:13 -0800)]
Merge branch 'drm-fixes' of git://git./linux/kernel/git/airlied/drm-2.6
* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
drm/radeon/kms: add workaround for dce3 ddc line vbios bug
drm/radeon/kms: fix interlaced and doublescan handling
drm/radeon/kms: fix typos in disabled vbios code
Revert "drm/i915/dp: use VBT provided eDP params if available"
drm/i915: Clear pfit registers when not used by any outputs
drm: record monitor status in output_poll_execute
drm: Set connector DPMS status to ON in drm_crtc_helper_set_config
drm/i915: fix regression due to
ba3d8d749b01548b9
Revert "drm/radeon/kms: fix typo in r600 cs checker"
drm/i915/sdvo: Always add a 30ms delay to make SDVO TV detection reliable
MAINTAINERS: INTEL DRM DRIVERS list (intel-gfx) is subscribers-only
drm/i915/sdvo: Always fallback to querying the shared DDC line
drm/i915: Handle pagefaults in execbuffer user relocations
drm/i915/sdvo: Only enable HDMI encodings only if the commandset is supported
drm/radeon/kms: fix resume regression for some r5xx laptops
drm/radeon/kms: fix regression in rs4xx i2c setup
drm/i915: Only save/restore cursor regs if !KMS
drm/i915: Prevent integer overflow when validating the execbuffer
Alex Deucher [Tue, 30 Nov 2010 05:15:10 +0000 (00:15 -0500)]
drm/radeon/kms: add workaround for dce3 ddc line vbios bug
fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=23752
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc:stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Tue, 30 Nov 2010 20:46:47 +0000 (15:46 -0500)]
drm/radeon/kms: fix interlaced and doublescan handling
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Wed, 1 Dec 2010 00:11:45 +0000 (19:11 -0500)]
drm/radeon/kms: fix typos in disabled vbios code
6xx/7xx was hitting the wrong BUS_CNTL reg and bits.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Wed, 1 Dec 2010 02:10:34 +0000 (12:10 +1000)]
Merge remote branch 'intel/drm-intel-fixes' of /ssd/git/drm-next into drm-fixes
* 'intel/drm-intel-fixes' of /ssd/git/drm-next:
Revert "drm/i915/dp: use VBT provided eDP params if available"
drm/i915: Clear pfit registers when not used by any outputs
drm/i915: fix regression due to
ba3d8d749b01548b9
Linus Torvalds [Wed, 1 Dec 2010 01:57:57 +0000 (17:57 -0800)]
Merge branch 'for_linus' of git://github.com/at91linux/linux-2.6-at91
* 'for_linus' of git://github.com/at91linux/linux-2.6-at91:
at91/board-yl-9200: fix typo in video support
atmel_spi: fix warning In function 'atmel_spi_dma_map_xfer'
at91/picotux200: remove commenting usb device and dataflash support
at91: rename rm9200ek and rm9200dk board file name
at91rm9200ek: fix warning: 'ek_mmc_data' defined but not used
at91rm9200dk: fix warning: 'dk_mmc_data' defined but not used
at91: Convert remaining boards to new-style UART initialization
at91: merge all at91rm9200 defconfig in one single file
Oleg Nesterov [Tue, 30 Nov 2010 19:56:02 +0000 (20:56 +0100)]
exec: copy-and-paste the fixes into compat_do_execve() paths
Note: this patch targets 2.6.37 and tries to be as simple as possible.
That is why it adds more copy-and-paste horror into fs/compat.c and
uglifies fs/exec.c, this will be cleanuped later.
compat_copy_strings() plays with bprm->vma/mm directly and thus has
two problems: it lacks the RLIMIT_STACK check and argv/envp memory
is not visible to oom killer.
Export acct_arg_size() and get_arg_page(), change compat_copy_strings()
to use get_arg_page(), change compat_do_execve() to do acct_arg_size(0)
as do_execve() does.
Add the fatal_signal_pending/cond_resched checks into compat_count() and
compat_copy_strings(), this matches the code in fs/exec.c and certainly
makes sense.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Oleg Nesterov [Tue, 30 Nov 2010 19:55:34 +0000 (20:55 +0100)]
exec: make argv/envp memory visible to oom-killer
Brad Spengler published a local memory-allocation DoS that
evades the OOM-killer (though not the virtual memory RLIMIT):
http://www.grsecurity.net/~spender/64bit_dos.c
execve()->copy_strings() can allocate a lot of memory, but
this is not visible to oom-killer, nobody can see the nascent
bprm->mm and take it into account.
With this patch get_arg_page() increments current's MM_ANONPAGES
counter every time we allocate the new page for argv/envp. When
do_execve() succeds or fails, we change this counter back.
Technically this is not 100% correct, we can't know if the new
page is swapped out and turn MM_ANONPAGES into MM_SWAPENTS, but
I don't think this really matters and everything becomes correct
once exec changes ->mm or fails.
Reported-by: Brad Spengler <spender@grsecurity.net>
Reviewed-and-discussed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Feng Tang [Fri, 19 Nov 2010 03:01:48 +0000 (11:01 +0800)]
serial: mfd: adjust the baud rate setting
Previous baud rate setting code only has been tested with 3.5M/9600/
115200/230400/460800 bps, and recently we got a 3M bps device to test,
which needs to modify current MUL register setting, and with this
patch 2.5M/2M/1.5M/1M/0.5M should also work as they just use a MUL
value scale down from 3M's.
Also got some reference register setting from silicon guys for
different baud rates, which tries to keep the pre-scalar register value
to 16.
Signed-off-by: Feng Tang <feng.tang@intel.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Greg Kroah-Hartman [Tue, 30 Nov 2010 23:52:04 +0000 (15:52 -0800)]
Merge branch 'for-greg' of git://gitorious.org/usb/usb into work
Greg Kroah-Hartman [Tue, 30 Nov 2010 23:38:41 +0000 (15:38 -0800)]
Merge branch 'for-usb-linus' of git://git./linux/kernel/git/sarah/xhci into work
Jeff Layton [Tue, 30 Nov 2010 20:14:48 +0000 (15:14 -0500)]
cifs: fix parsing of hostname in dfs referrals
The DFS referral parsing code does a memchr() call to find the '\\'
delimiter that separates the hostname in the referral UNC from the
sharename. It then uses that value to set the length of the hostname via
pointer subtraction. Instead of subtracting the start of the hostname
however, it subtracts the start of the UNC, which causes the code to
pass in a hostname length that is 2 bytes too long.
Regression introduced in commit
1a4240f4.
Reported-and-Tested-by: Robbert Kouprie <robbert@exx.nl>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Cc: Wang Lei <wang840925@gmail.com>
Cc: David Howells <dhowells@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Steve French <sfrench@us.ibm.com>
Alan Stern [Mon, 29 Nov 2010 15:17:22 +0000 (10:17 -0500)]
USB: fix autosuspend bug in usb-serial
This patch (as1437) fixes a bug in the usb-serial autosuspend
handling. Since the usb-serial core now has autosuspend support, it
must set the .supports_autosuspend member in every serial driver it
registers. Otherwise the usb_autopm_get_interface() call won't work.
This fixes Bugzilla #23012.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: stable@kernel.org
Reported-by: Kevin Smith <thirdwiggin@gmail.com>
Reported-and-tested-by: Simon Gerber <gesimu@gmail.com>
Reported-and-tested-by: Matteo Croce <matteo@openwrt.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Brian J. Tarricone [Mon, 22 Nov 2010 05:15:52 +0000 (21:15 -0800)]
USB: ehci: disable LPM and PPCD for nVidia MCP89 chips
Tested on MacBookAir3,1. Without this, we get EPROTO errors when
fetching device config descriptors.
Signed-off-by: Brian Tarricone <brian@tarricone.org>
Reported-by: Benoit Gschwind <gschwind@gnu-log.net>
Tested-by: Edgar Hucek <gimli@dark-green.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Jacques Viviers [Wed, 24 Nov 2010 09:56:38 +0000 (11:56 +0200)]
USB: serial: ftdi_sio: Vardaan USB RS422/485 converter PID added
Add the PID for the Vardaan Enterprises VEUSB422R3 USB to RS422/485
converter. It uses the same chip as the FTDI_8U232AM_PID 0x6001.
This should also work with the stable branches for:
2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36
Signed-off-by: Jacques Viviers <jacques.viviers@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Tomoki Sekiyama [Mon, 22 Nov 2010 10:29:23 +0000 (19:29 +0900)]
USB: yurex: add .llseek fop to file_operations
Default llseek operation behavior was changed by the patch named
"vfs: make no_llseek the default" after the yurex driver had been merged,
so the llseek to yurex is now ignored.
This patch add llseek fop with default_llseek to yurex driver
to catch up to the change.
Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Michael Stuermer [Wed, 17 Nov 2010 23:45:43 +0000 (00:45 +0100)]
USB: ftdi_sio: Add ID for RT Systems USB-29B radio cable
Another variant of the RT Systems programming cable for ham radios.
Signed-off-by: Michael Stuermer <ms@mallorn.de>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Trond Myklebust [Tue, 30 Nov 2010 17:42:34 +0000 (12:42 -0500)]
NFS: Fix a readdirplus bug
When comparing filehandles in the helper nfs_same_file(), we should not be
using 'strncmp()': filehandles are not null terminated strings.
Instead, we should just use the existing helper nfs_compare_fh().
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Jean-Christophe PLAGNIOL-VILLARD [Sun, 21 Nov 2010 03:24:07 +0000 (11:24 +0800)]
at91/board-yl-9200: fix typo in video support
for the epson frambuffer support it's CONFIG_FB_S1D13XXX
not CONFIG_FB_S1D135XX
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Jean-Christophe PLAGNIOL-VILLARD [Sat, 20 Nov 2010 06:52:53 +0000 (14:52 +0800)]
atmel_spi: fix warning In function 'atmel_spi_dma_map_xfer'
passing argument 2 of 'dma_map_single' discards qualifiers from pointer target type
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Jean-Christophe PLAGNIOL-VILLARD [Sun, 21 Nov 2010 02:31:19 +0000 (10:31 +0800)]
at91/picotux200: remove commenting usb device and dataflash support
as based on http://www.picotux.com/pt200/picotux200.pdf
these board does not have such I/O
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Jean-Christophe PLAGNIOL-VILLARD [Fri, 19 Nov 2010 14:34:38 +0000 (22:34 +0800)]
at91: rename rm9200ek and rm9200dk board file name
to be a few more concistant with the other boards
as ek is for evaluation kit and dk for development kit
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Andrew Victor <linux@maxim.org.za>
Jean-Christophe PLAGNIOL-VILLARD [Fri, 19 Nov 2010 14:31:35 +0000 (22:31 +0800)]
at91rm9200ek: fix warning: 'ek_mmc_data' defined but not used
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Andrew Victor <linux@maxim.org.za>
Jean-Christophe PLAGNIOL-VILLARD [Fri, 19 Nov 2010 14:31:03 +0000 (22:31 +0800)]
at91rm9200dk: fix warning: 'dk_mmc_data' defined but not used
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Andrew Victor <linux@maxim.org.za>
Jean-Christophe PLAGNIOL-VILLARD [Fri, 19 Nov 2010 14:23:28 +0000 (22:23 +0800)]
at91: Convert remaining boards to new-style UART initialization
Convert the following AT91RM9200-based boards to the new-style UART
initialization:
- Ajeco 1ARM Single Board Computer
- Sperry-Sun KAFA board
- picotux 200
Remove the deprecated at91_init_serial
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Andrew Victor <linux@maxim.org.za>
Randy Dunlap [Thu, 18 Nov 2010 23:02:26 +0000 (15:02 -0800)]
regulator: fix kernel-doc for set_consumer_device_supply
Fix kernel-doc warning for set_consumer_device_supply():
Warning(drivers/regulator/core.c:912): missing initial short description on line:
* set_consumer_device_supply: Bind a regulator to a symbolic supply
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: Liam Girdwood <lrg@slimlogic.co.uk>
Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Bengt Jonsson [Wed, 10 Nov 2010 10:06:22 +0000 (11:06 +0100)]
regulator: enable supply regulator only when use count is zero
Supply regulators are disabled only when the last
reference count is removed on the child regulator
(the use count goes from 1 to 0). This patch changes
the behaviour of enable so the supply regulator is
enabled only when the use count of the child
regulator goes from 0 to 1.
Signed-off-by: Bengt Jonsson <bengt.g.jonsson@stericsson.com>
Acked-by: Linus Walleij <linus.walleij@stericsson.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Axel Lin [Fri, 22 Oct 2010 08:38:22 +0000 (16:38 +0800)]
regulator: twl-regulator - fix twlreg_set_mode
The Singular Message is 16 bits:
DEV_GRP[15:13] MT[12] RES_ID[11:4] RES_STATE[3:0]
Current implementation return immedially after sucessfuly write MSB part.
To properly set mode, we need to write the complete message ( MSB and LSB ).
In twl.h, now we have defines for PM Master module register offsets,
use it instead of hard coded 0x15/0x16.
Use "message & 0xff" to ensure we send correct value for LSB.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Tested-by: Lesly Arackal Manuel <leslyam@ti.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Mattias Wallin [Thu, 4 Nov 2010 10:01:31 +0000 (11:01 +0100)]
regulator: lock supply in regulator enable
This patch add locks around regulator supply enable.
Signed-off-by: Mattias Wallin <mattias.wallin@stericsson.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Axel Lin [Fri, 5 Nov 2010 07:27:17 +0000 (15:27 +0800)]
regulator: Return proper error for regulator_register()
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Axel Lin [Fri, 5 Nov 2010 13:51:32 +0000 (21:51 +0800)]
regulator: Ensure enough delay time for enabling regulator
Integer division will truncate the result, this patch ensures we have
enough delay time for enabling regulator.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Axel Lin [Fri, 5 Nov 2010 07:25:12 +0000 (15:25 +0800)]
regulator: Remove a redundant device_remove_file call in create_regulator
We already have device_remove_file() in error path,
no need to call it before goto link_name_err.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Mark Brown [Wed, 3 Nov 2010 04:08:04 +0000 (00:08 -0400)]
regulator: Staticise mc13783_powermisc_rmw()
It is not used outside this driver so no need to make the symbol global.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Alberto Panizzo <maramaopercheseimorto@gmail.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Mattias Wallin [Tue, 2 Nov 2010 13:55:34 +0000 (14:55 +0100)]
regulator: regulator disable supply fix
This patch fixes a disable failure when regulator supply is used.
A while loop in regulator disable checks for supply pointer != NULL
but the pointer is not always updated, resulting in the while loop
running too many times causing a disable failure.
Signed-off-by: Mattias Wallin <mattias.wallin@stericsson.com>
Acked-by: Linus Walleij <linus.walleij@stericsson.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Eric Benard [Fri, 15 Oct 2010 09:27:17 +0000 (11:27 +0200)]
at91: merge all at91rm9200 defconfig in one single file
About all options present in each file are activated
in the single file.
Signed-off-by: Eric Benard <eric@eukrea.com>
Tested-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Chris Wilson [Mon, 29 Nov 2010 10:09:55 +0000 (10:09 +0000)]
Revert "drm/i915/dp: use VBT provided eDP params if available"
This reverts commit
869184a675662bddcdf76c5b95665272facff2b8.
This is required for the Sony Vaio Jesse was working on at the time, but
breaks most other eDP machines - machines that were working in earlier
kernels.
Reported-and-tested-by: Dave Airlie <airlied@redhat.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=31188
Tested-by: Zhao Jian <jian.j.zhao@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Suresh Jayaraman [Wed, 24 Nov 2010 12:19:07 +0000 (17:49 +0530)]
cifs: display fsc in /proc/mounts
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Suresh Jayaraman [Wed, 24 Nov 2010 12:19:06 +0000 (17:49 +0530)]
cifs: enable fscache iff fsc mount option is used explicitly
Currently, if CONFIG_CIFS_FSCACHE is set, fscache is enabled on files opened
as read-only irrespective of the 'fsc' mount option. Fix this by enabling
fscache only if 'fsc' mount option is specified explicitly.
Remove an extraneous cFYI debug message and fix a typo while at it.
Reported-by: Jeff Layton <jlayton@redhat.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Suresh Jayaraman [Wed, 24 Nov 2010 12:19:05 +0000 (17:49 +0530)]
cifs: allow fsc mount option only if CONFIG_CIFS_FSCACHE is set
Currently, it is possible to specify 'fsc' mount option even if
CONFIG_CIFS_FSCACHE has not been set. The option is being ignored silently
while the user fscache functionality to work. Fix this by raising error when
the CONFIG option is not set.
Reported-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Shirish Pargaonkar [Sat, 27 Nov 2010 17:37:54 +0000 (11:37 -0600)]
cifs: Handle extended attribute name cifs_acl to generate cifs acl blob (try #4)
Add extended attribute name system.cifs_acl
Get/generate cifs/ntfs acl blob and hand over to the invoker however
it wants to parse/process it under experimental configurable option CIFS_ACL.
Do not get CIFS/NTFS ACL for xattr for attribute system.posix_acl_access
Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Shirish Pargaonkar [Sat, 27 Nov 2010 17:37:26 +0000 (11:37 -0600)]
cifs: Misc. cleanup in cifsacl handling [try #4]
Change the name of function mode_to_acl to mode_to_cifs_acl.
Handle return code in functions mode_to_cifs_acl and
cifs_acl_to_fattr.
Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Linus Torvalds [Tue, 30 Nov 2010 04:42:04 +0000 (20:42 -0800)]
Linux 2.6.37-rc4
Linus Torvalds [Tue, 30 Nov 2010 04:41:39 +0000 (20:41 -0800)]
Merge branch 'merge' of git://git./linux/kernel/git/benh/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc: Use call_rcu_sched() for pagetables
Peter Zijlstra [Fri, 26 Nov 2010 14:38:45 +0000 (15:38 +0100)]
powerpc: Use call_rcu_sched() for pagetables
PowerPC relies on IRQ-disable to guard against RCU quiecent states,
use the appropriate RCU call version.
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Dave Airlie [Mon, 29 Nov 2010 23:15:46 +0000 (09:15 +1000)]
Revert "debug_locks: set oops_in_progress if we will log messages."
This reverts commit
e0fdace10e75dac67d906213b780ff1b1a4cc360.
On-list discussion seems to suggest that the robustness fixes for printk
make this unnecessary and DaveM has also agreed in person at Kernel Summit
and on list.
The main problem with this code is once we hit a lockdep splat we always
keep oops_in_progress set, the console layer uses oops_in_progress with KMS
to decide when it should be showing the oops and not showing X, so it causes
problems around suspend/resume time when a userspace resume can cause a console
switch away from X, only if oops_in_progress is set (which is what we want
if an oops actually is in progress, but not because we had a lockdep splat
2 days prior).
Cc: David S Miller <davem@davemloft.net>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Jiri Slaby [Mon, 29 Nov 2010 09:16:54 +0000 (10:16 +0100)]
TTY: open/hangup race fixup
Like in the "TTY: don't allow reopen when ldisc is changing" patch,
this one fixes a TTY WARNING as described in the option 1) there:
1) __tty_hangup from tty_ldisc_hangup to tty_ldisc_enable. During this
section tty_lock is held. However tty_lock is temporarily dropped in
the middle of the function by tty_ldisc_hangup.
The fix is to introduce a new flag which we set during the unlocked
window and check it in tty_reopen too. The flag is TTY_HUPPING and is
cleared after TTY_HUPPED is set.
While at it, remove duplicate TTY_HUPPED set_bit. The one after
calling ops->hangup seems to be more correct. But anyway, we hold
tty_lock, so there should be no difference.
Also document the function it does that kind of crap.
Nicely reproducible with two forked children:
static void do_work(const char *tty)
{
if (signal(SIGHUP, SIG_IGN) == SIG_ERR) exit(1);
setsid();
while (1) {
int fd = open(tty, O_RDWR|O_NOCTTY);
if (fd < 0) continue;
if (ioctl(fd, TIOCSCTTY)) continue;
if (vhangup()) continue;
close(fd);
}
exit(0);
}
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-by: <Valdis.Kletnieks@vt.edu>
Reported-by: Kyle McMartin <kyle@mcmartin.ca>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Jiri Slaby [Mon, 29 Nov 2010 09:16:53 +0000 (10:16 +0100)]
TTY: don't allow reopen when ldisc is changing
There are many WARNINGs like the following reported nowadays:
WARNING: at drivers/tty/tty_io.c:1331 tty_open+0x2a2/0x49a()
Hardware name: Latitude E6500
Modules linked in:
Pid: 1207, comm: plymouthd Not tainted 2.6.37-rc3-mmotm1123 #3
Call Trace:
[<
ffffffff8103b189>] warn_slowpath_common+0x80/0x98
[<
ffffffff8103b1b6>] warn_slowpath_null+0x15/0x17
[<
ffffffff8128a3ab>] tty_open+0x2a2/0x49a
[<
ffffffff810fd53f>] chrdev_open+0x11d/0x146
...
This means tty_reopen is called without TTY_LDISC set. For further
considerations, note tty_lock is held in tty_open. TTY_LDISC is cleared in:
1) __tty_hangup from tty_ldisc_hangup to tty_ldisc_enable. During this
section tty_lock is held. However tty_lock is temporarily dropped in
the middle of the function by tty_ldisc_hangup.
2) tty_release via tty_ldisc_release till the end of tty existence. If
tty->count <= 1, tty_lock is taken, TTY_CLOSING bit set and then
tty_ldisc_release called. tty_reopen checks TTY_CLOSING before checking
TTY_LDISC.
3) tty_set_ldisc from tty_ldisc_halt to tty_ldisc_enable. We:
* take tty_lock, set TTY_LDISC_CHANGING, put tty_lock
* call tty_ldisc_halt (clear TTY_LDISC), tty_lock is _not_ held
* do some other work
* take tty_lock, call tty_ldisc_enable (set TTY_LDISC), put
tty_lock
I cannot see how 2) can be a problem, as there I see no race. OTOH, 1)
and 3) can happen without problems. This patch the case 3) by checking
TTY_LDISC_CHANGING along with TTY_CLOSING in tty_reopen. 1) will be
fixed in the following patch.
Nicely reproducible with two processes:
while (1) {
fd = open("/dev/ttyS1", O_RDWR);
if (fd < 0) {
warn("open");
continue;
}
close(fd);
}
--------
while (1) {
fd = open("/dev/ttyS1", O_RDWR);
ld1 = 0; ld2 = 2;
while (1) {
ioctl(fd, TIOCSETD, &ld1);
ioctl(fd, TIOCSETD, &ld2);
}
close(fd);
}
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-by: <Valdis.Kletnieks@vt.edu>
Cc: Kyle McMartin <kyle@mcmartin.ca>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Jiri Slaby [Wed, 24 Nov 2010 23:27:55 +0000 (00:27 +0100)]
NET: wan/x25, fix ldisc->open retval
We should never return positive values from ldisc->open, tty layer
doesn't (and never did) expect that.
If we do that, weird things like warnings in tty_ldisc_close happen.
Not sure if dev->base_addr is used somehow now.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Cc: Andrew Hendry <andrew.hendry@gmail.com>
Cc: linux-x25@vger.kernel.org
Tested-by: Sergey Lapin <slapin@ossfans.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Jiri Slaby [Wed, 24 Nov 2010 23:27:54 +0000 (00:27 +0100)]
TTY: ldisc, fix open flag handling
When a concrete ldisc open fails in tty_ldisc_open, we forget to clear
TTY_LDISC_OPEN. This causes a false warning on the next ldisc open:
WARNING: at drivers/char/tty_ldisc.c:445 tty_ldisc_open+0x26/0x38()
Hardware name: System Product Name
Modules linked in: ...
Pid: 5251, comm: a.out Tainted: G W 2.6.32-5-686 #1
Call Trace:
[<
c1030321>] ? warn_slowpath_common+0x5e/0x8a
[<
c1030357>] ? warn_slowpath_null+0xa/0xc
[<
c119311c>] ? tty_ldisc_open+0x26/0x38
[<
c11936c5>] ? tty_set_ldisc+0x218/0x304
...
So clear the bit when failing...
Introduced in
c65c9bc3efa (tty: rewrite the ldisc locking) back in
2.6.31-rc1.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Reported-by: Sergey Lapin <slapin@ossfans.org>
Tested-by: Sergey Lapin <slapin@ossfans.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Linus Torvalds [Mon, 29 Nov 2010 22:38:06 +0000 (14:38 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/security-testing-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
tpm: Autodetect itpm devices
Linus Torvalds [Mon, 29 Nov 2010 22:36:33 +0000 (14:36 -0800)]
Merge git://git./linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits)
af_unix: limit recursion level
pch_gbe driver: The wrong of initializer entry
pch_gbe dreiver: chang author
ucc_geth: fix ucc halt problem in half duplex mode
inet: Fix __inet_inherit_port() to correctly increment bsockets and num_owners
ehea: Add some info messages and fix an issue
hso: fix disable_net
NET: wan/x25_asy, move lapb_unregister to x25_asy_close_tty
cxgb4vf: fix setting unicast/multicast addresses ...
net, ppp: Report correct error code if unit allocation failed
DECnet: don't leak uninitialized stack byte
au1000_eth: fix invalid address accessing the MAC enable register
dccp: fix error in updating the GAR
tcp: restrict net.ipv4.tcp_adv_win_scale (#20312)
netns: Don't leak others' openreq-s in proc
Net: ceph: Makefile: Remove unnessary code
vhost/net: fix rcu check usage
econet: fix CVE-2010-3848
econet: fix CVE-2010-3850
econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849
...
Linus Torvalds [Mon, 29 Nov 2010 22:36:07 +0000 (14:36 -0800)]
Merge branch 'omap-fixes-for-linus' of git://git./linux/kernel/git/tmlind/linux-omap-2.6
* 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6:
OMAP2+: PM/serial: hold console semaphore while OMAP UARTs are disabled
OMAP: UART: don't resume UARTs that are not enabled.
Matthew Garrett [Thu, 21 Oct 2010 21:42:40 +0000 (17:42 -0400)]
tpm: Autodetect itpm devices
Some Lenovos have TPMs that require a quirk to function correctly. This can
be autodetected by checking whether the device has a _HID of INTC0102. This
is an invalid PNPid, and as such is discarded by the pnp layer - however
it's still present in the ACPI code, so we can pull it out that way. This
means that the quirk won't be automatically applied on non-ACPI systems,
but without ACPI we don't have any way to identify the chip anyway so I
don't think that's a great concern.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Acked-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Tested-by: Andy Isaacson <adi@hexapodia.org>
Signed-off-by: James Morris <jmorris@namei.org>
Linus Torvalds [Mon, 29 Nov 2010 22:11:08 +0000 (14:11 -0800)]
Merge git://git./linux/kernel/git/mason/btrfs-unstable
* git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable: (24 commits)
Btrfs: don't use migrate page without CONFIG_MIGRATION
Btrfs: deal with DIO bios that span more than one ordered extent
Btrfs: setup blank root and fs_info for mount time
Btrfs: fix fiemap
Btrfs - fix race between btrfs_get_sb() and umount
Btrfs: update inode ctime when using links
Btrfs: make sure new inode size is ok in fallocate
Btrfs: fix typo in fallocate to make it honor actual size
Btrfs: avoid NULL pointer deref in try_release_extent_buffer
Btrfs: make btrfs_add_nondir take parent inode as an argument
Btrfs: hold i_mutex when calling btrfs_log_dentry_safe
Btrfs: use dget_parent where we can UPDATED
Btrfs: fix more ESTALE problems with NFS
Btrfs: handle NFS lookups properly
btrfs: make 1-bit signed fileds unsigned
btrfs: Show device attr correctly for symlinks
btrfs: Set file size correctly in file clone
btrfs: Check if dest_offset is block-size aligned before cloning file
Btrfs: handle the space_cache option properly
btrfs: Fix early enospc because 'unused' calculated with wrong sign.
...
Linus Torvalds [Mon, 29 Nov 2010 22:10:44 +0000 (14:10 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/bp/bp
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
EDAC: Fix typos in Documentation/edac.txt
EDAC, MCE: Fix edac_init_mce_inject error handling
EDAC: Remove deprecated kbuild goal definitions
Linus Torvalds [Mon, 29 Nov 2010 22:10:22 +0000 (14:10 -0800)]
Merge git://git./linux/kernel/git/steve/gfs2-2.6-fixes
* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes:
GFS2: Userland expects quota limit/warn/usage in 512b blocks
John Tapsell [Thu, 25 Mar 2010 13:30:45 +0000 (13:30 +0000)]
Staging: rt2870: Add USB ID for Buffalo Airstation WLI-UC-GN
BugLink: http://bugs.launchpad.net/bugs/441990
This was tested to successfully enable the hardware.
Signed-off-by: John Tapsell <johnflux@gmail.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
CC: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Randy Dunlap [Mon, 22 Nov 2010 20:12:37 +0000 (12:12 -0800)]
staging: easycap needs smp_lock.h, fixes build error
Add header file to fix build error:
drivers/staging/easycap/easycap_main.c:4251: error: implicit declaration of function 'lock_kernel'
drivers/staging/easycap/easycap_main.c:4254: error: implicit declaration of function 'unlock_kernel'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Marek Lindner [Mon, 22 Nov 2010 11:34:49 +0000 (12:34 +0100)]
Staging: batman-adv: ensure that eth_type_trans gets linear memory
eth_type_trans tries to pull data with the length of the ethernet header
from the skb. We only ensured that enough data for the first ethernet
header and the batman header is available in non-paged memory of the skb
and not for the ethernet after the batman header.
eth_type_trans would fail sometimes with drivers which don't ensure that
all there data is perfectly linearised.
The failure was noticed through a kernel bug Oops generated by the
skb_pull inside eth_type_trans.
Reported-by: Rafal Lesniak <lesniak@eresi-project.org>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Sven Eckelmann [Mon, 22 Nov 2010 11:34:50 +0000 (12:34 +0100)]
Staging: batman-adv: Don't remove interface with spinlock held
We call a lot of the netdevice code when holding if_list_lock which will
spin the whole time. This is not necessary because we only want to
protect the access to the list to be serialized. An extra queue can be
used which hold all interfaces which should be removed and then use that
queue without any locks for netdevice cleanup.
We create a "scheduling while atomic" Oops when calling different
netdevice related functions inside a spinlock protected area on a
preemtible kernel.
Reported-by: Rafal Lesniak <lesniak@eresi-project.org>
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
git.openpandora.org / pandora-kernel.git / log