9 years agoLinux 3.2.18 v3.2.18
Ben Hutchings [Sun, 20 May 2012 21:56:54 +0000 (22:56 +0100)]
Linux 3.2.18

9 years agopktgen: fix module unload for good
Eric Dumazet [Thu, 17 May 2012 23:52:26 +0000 (23:52 +0000)]
pktgen: fix module unload for good

commit d4b1133558e0d417342d5d2c49e4c35b428ff20d upstream.

commit c57b5468406 (pktgen: fix crash at module unload) did a very poor
job with list primitives.

1) list_splice() arguments were in the wrong order

2) list_splice(list, head) has undefined behavior if head is not

3) We should use the list_splice_init() variant to clear pktgen_threads

Signed-off-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agopktgen: fix crash at module unload
Eric Dumazet [Wed, 9 May 2012 13:29:51 +0000 (13:29 +0000)]
pktgen: fix crash at module unload

commit c57b54684060c8aced64a5b78ff69ff289af97b9 upstream.

commit 7d3d43dab4e9 (net: In unregister_netdevice_notifier unregister
the netdevices.) makes pktgen crashing at module unload.

[  296.820578] BUG: spinlock bad magic on CPU#6, rmmod/3267
[  296.820719]  lock: ffff880310c38000, .magic: ffff8803, .owner: <none>/-1, .owner_cpu: -1
[  296.820943] Pid: 3267, comm: rmmod Not tainted 3.4.0-rc5+ #254
[  296.821079] Call Trace:
[  296.821211]  [<ffffffff8168a715>] spin_dump+0x8a/0x8f
[  296.821345]  [<ffffffff8168a73b>] spin_bug+0x21/0x26
[  296.821507]  [<ffffffff812b4741>] do_raw_spin_lock+0x131/0x140
[  296.821648]  [<ffffffff8169188e>] _raw_spin_lock+0x1e/0x20
[  296.821786]  [<ffffffffa00cc0fd>] __pktgen_NN_threads+0x4d/0x140 [pktgen]
[  296.821928]  [<ffffffffa00ccf8d>] pktgen_device_event+0x10d/0x1e0 [pktgen]
[  296.822073]  [<ffffffff8154ed4f>] unregister_netdevice_notifier+0x7f/0x100
[  296.822216]  [<ffffffffa00d2a0b>] pg_cleanup+0x48/0x73 [pktgen]
[  296.822357]  [<ffffffff8109528e>] sys_delete_module+0x17e/0x2a0
[  296.822502]  [<ffffffff81699652>] system_call_fastpath+0x16/0x1b

Hold the pktgen_thread_lock while splicing pktgen_threads, and test
pktgen_exiting in pktgen_device_event() to make unload faster.

Signed-off-by: Eric Dumazet <>
Cc: Eric W. Biederman <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agostmmac: Fix compilation error in mmc_core.c
Stefan Roese [Tue, 10 Jan 2012 01:47:40 +0000 (01:47 +0000)]
stmmac: Fix compilation error in mmc_core.c

commit 1dd8117e3320fb42ec40ef2ace982871572d34ed upstream.

Fix this error:

  CC      drivers/net/ethernet/stmicro/stmmac/mmc_core.o
drivers/net/ethernet/stmicro/stmmac/mmc_core.c: In function 'dwmac_mmc_ctrl':
drivers/net/ethernet/stmicro/stmmac/mmc_core.c:143:2: error: implicit
  declaration of function 'pr_debug' [-Werror=implicit-function-declaration]

Signed-off-by: Stefan Roese <>
Cc: Giuseppe Cavallaro <>
Acked-by: Giuseppe Cavallaro <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agomtd: map.h: fix arm cross-build failure
Artem Bityutskiy [Fri, 30 Dec 2011 16:28:01 +0000 (18:28 +0200)]
mtd: map.h: fix arm cross-build failure

commit 4a42243886b87cd28a39b192161767c2af851a55 upstream.

This patch fixes the following build failure:
In file included from include/linux/mtd/qinfo.h:4:0,
                 from include/linux/mtd/pfow.h:7,
                 from drivers/mtd/lpddr/lpddr_cmds.c:27:
include/linux/mtd/map.h: In function 'inline_map_read':
include/linux/mtd/map.h:409:3: error: implicit declaration of function 'BUILD_BUG_ON' [-Werror=implicit-function-declaration]

Signed-off-by: Artem Bityutskiy <>
Signed-off-by: David Woodhouse <>
Signed-off-by: Ben Hutchings <>
9 years agoe1000: Prevent reset task killing itself.
Tushar Dave [Thu, 17 May 2012 01:04:50 +0000 (01:04 +0000)]
e1000: Prevent reset task killing itself.

commit 8ce6909f77ba1b7bcdea65cc2388fd1742b6d669 upstream.

Killing reset task while adapter is resetting causes deadlock.
Only kill reset task if adapter is not resetting.
Ref bug #43132 on

Signed-off-by: Tushar Dave <>
Tested-by: Aaron Brown <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agotcp: do_tcp_sendpages() must try to push data out on oom conditions
Willy Tarreau [Thu, 17 May 2012 11:14:14 +0000 (11:14 +0000)]
tcp: do_tcp_sendpages() must try to push data out on oom conditions

commit bad115cfe5b509043b684d3a007ab54b80090aa1 upstream.

Since recent changes on TCP splicing (starting with commits 2f533844
"tcp: allow splice() to build full TSO packets" and 35f9c09f "tcp:
tcp_sendpages() should call tcp_push() once"), I started seeing
massive stalls when forwarding traffic between two sockets using
splice() when pipe buffers were larger than socket buffers.

Latest changes (net: netdev_alloc_skb() use build_skb()) made the
problem even more apparent.

The reason seems to be that if do_tcp_sendpages() fails on out of memory
condition without being able to send at least one byte, tcp_push() is not
called and the buffers cannot be flushed.

After applying the attached patch, I cannot reproduce the stalls at all
and the data rate it perfectly stable and steady under any condition
which previously caused the problem to be permanent.

The issue seems to have been there since before the kernel migrated to
git, which makes me think that the stalls I occasionally experienced
with tux during stress-tests years ago were probably related to the
same issue.

This issue was first encountered on 3.0.31 and 3.2.17, so please backport
to -stable.

Signed-off-by: Willy Tarreau <>
Acked-by: Eric Dumazet <>
Signed-off-by: Ben Hutchings <>
9 years agotarget: Fix bug in handling of FILEIO + block_device resize ops
Nicholas Bellinger [Wed, 16 May 2012 23:05:26 +0000 (16:05 -0700)]
target: Fix bug in handling of FILEIO + block_device resize ops

commit cd9323fd68aee3c1c6b5b21e5746c9d1b586fb58 upstream.

This patch fixes a bug in the handling of FILEIO w/ underlying block_device
resize operations where the original fd_dev->fd_dev_size was incorrectly being
used in fd_get_blocks() for READ_CAPACITY response payloads.

This patch avoids using fd_dev->fd_dev_size for FILEIO devices with
an underlying block_device, and instead changes fd_get_blocks() to
get the sector count directly from i_size_read() as recommended by hch.

Reported-by: Christoph Hellwig <>
Signed-off-by: Nicholas Bellinger <>
Signed-off-by: Ben Hutchings <>
9 years agoMD: Add del_timer_sync to mddev_suspend (fix nasty panic)
Jonathan Brassow [Wed, 16 May 2012 09:06:14 +0000 (04:06 -0500)]
MD: Add del_timer_sync to mddev_suspend (fix nasty panic)

commit 0d9f4f135eb6dea06bdcb7065b1e4ff78274a5e9 upstream.

Use del_timer_sync to remove timer before mddev_suspend finishes.

We don't want a timer going off after an mddev_suspend is called.  This is
especially true with device-mapper, since it can call the destructor function
immediately following a suspend.  This results in the removal (kfree) of the
structures upon which the timer depends - resulting in a very ugly panic.
Therefore, we add a del_timer_sync to mddev_suspend to prevent this.

Signed-off-by: NeilBrown <>
Signed-off-by: Ben Hutchings <>
9 years agoarch/tile: apply commit 74fca9da0 to the compat signal handling as well
Chris Metcalf [Wed, 16 May 2012 18:54:20 +0000 (14:54 -0400)]
arch/tile: apply commit 74fca9da0 to the compat signal handling as well

commit a134d228298c6aa9007205c6b81cae0cac0acb5d upstream.

This passes siginfo and mcontext to tilegx32 signal handlers that
don't have SA_SIGINFO set just as we have been doing for tilegx64.

Signed-off-by: Chris Metcalf <>
Signed-off-by: Ben Hutchings <>
9 years agoARM: prevent VM_GROWSDOWN mmaps extending below FIRST_USER_ADDRESS
Russell King [Wed, 16 May 2012 14:19:20 +0000 (15:19 +0100)]
ARM: prevent VM_GROWSDOWN mmaps extending below FIRST_USER_ADDRESS

commit 9b61a4d1b2064dbd0c9e61754305ac852170509f upstream.

Reported-by: Al Viro <>
Signed-off-by: Russell King <>
Signed-off-by: Ben Hutchings <>
9 years agocdc_ether: add Novatel USB551L device IDs for FLAG_WWAN
Dan Williams [Mon, 7 May 2012 04:24:51 +0000 (04:24 +0000)]
cdc_ether: add Novatel USB551L device IDs for FLAG_WWAN

commit 4e6304b8420aba5311ba21fd68dab2924ae4d91a upstream.

Needs to be tagged with FLAG_WWAN, which since it has generic
descriptors, won't happen if we don't override the generic
driver info.

Cc: Oliver Neukum <>
Signed-off-by: Dan Williams <>
Acked-by: Oliver Neukum <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agousbnet: fix skb traversing races during unlink(v2)
Ming Lei [Thu, 26 Apr 2012 03:33:46 +0000 (11:33 +0800)]
usbnet: fix skb traversing races during unlink(v2)

commit 5b6e9bcdeb65634b4ad604eb4536404bbfc62cfa upstream.

Commit 4231d47e6fe69f061f96c98c30eaf9fb4c14b96d(net/usbnet: avoid
recursive locking in usbnet_stop()) fixes the recursive locking
problem by releasing the skb queue lock before unlink, but may
cause skb traversing races:
- after URB is unlinked and the queue lock is released,
the refered skb and skb->next may be moved to done queue,
even be released
- in skb_queue_walk_safe, the next skb is still obtained
by next pointer of the last skb
- so maybe trigger oops or other problems

This patch extends the usage of entry->state to describe 'start_unlink'
state, so always holding the queue(rx/tx) lock to change the state if
the referd skb is in rx or tx queue because we need to know if the
refered urb has been started unlinking in unlink_urbs.

The other part of this patch is based on Huajun's patch:
always traverse from head of the tx/rx queue to get skb which is
to be unlinked but not been started unlinking.

Signed-off-by: Huajun Li <>
Signed-off-by: Ming Lei <>
Cc: Oliver Neukum <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agoASoC: wm8994: Fix AIF2ADC power down
Mark Brown [Tue, 15 May 2012 17:13:00 +0000 (18:13 +0100)]
ASoC: wm8994: Fix AIF2ADC power down

commit c7f5f2389377b66028bc129890aa653deafe8d39 upstream.

Signed-off-by: Mark Brown <>
Signed-off-by: Ben Hutchings <>
9 years agoALSA: hda/idt - Fix power-map for speaker-pins with some HP laptops
Takashi Iwai [Tue, 15 May 2012 06:07:31 +0000 (08:07 +0200)]
ALSA: hda/idt - Fix power-map for speaker-pins with some HP laptops

commit b0791dda813c179e539b0fc1ecd3f5f30f2571e2 upstream.

BIOS on some HP laptops don't set the speaker-pins as fixed but expose
as jacks, and this confuses the driver as if these pins are
jack-detectable.  As a result, the machine doesn't get sounds from
speakers because the driver prepares the power-map update via jack
unsol events which never come up in reality.  The bug was introduced
in some time in 3.2 for enabling the power-mapping feature.

This patch fixes the problem by replacing the check of the persistent
power-map bits with a proper is_jack_detectable() call.


Signed-off-by: Takashi Iwai <>
Signed-off-by: Ben Hutchings <>
9 years agocrypto: mv_cesa requires on CRYPTO_HASH to build
Alexander Clouter [Sat, 12 May 2012 08:45:08 +0000 (09:45 +0100)]
crypto: mv_cesa requires on CRYPTO_HASH to build

commit 1ebfefcf37a6e308266a8d786e8cfea0a454058c upstream.

Without CRYPTO_HASH being selected, mv_cesa has a lot of hooks
into undefined exports.
  MODPOST 81 modules
  Kernel: arch/arm/boot/Image is ready
  AS      arch/arm/boot/compressed/head.o
  GZIP    arch/arm/boot/compressed/piggy.gzip
  CC      arch/arm/boot/compressed/misc.o
  CC      arch/arm/boot/compressed/decompress.o
ERROR: "crypto_ahash_type" [drivers/crypto/mv_cesa.ko] undefined!
ERROR: "crypto_shash_final" [drivers/crypto/mv_cesa.ko] undefined!
ERROR: "crypto_register_ahash" [drivers/crypto/mv_cesa.ko] undefined!
ERROR: "crypto_unregister_ahash" [drivers/crypto/mv_cesa.ko] undefined!
ERROR: "crypto_shash_update" [drivers/crypto/mv_cesa.ko] undefined!
ERROR: "crypto_shash_digest" [drivers/crypto/mv_cesa.ko] undefined!
ERROR: "crypto_shash_setkey" [drivers/crypto/mv_cesa.ko] undefined!
ERROR: "crypto_alloc_shash" [drivers/crypto/mv_cesa.ko] undefined!
make[1]: *** [__modpost] Error 1
make: *** [modules] Error 2
make: *** Waiting for unfinished jobs....

Signed-off-by: Alexander Clouter <>
Signed-off-by: Jason Cooper <>
Signed-off-by: Ben Hutchings <>
9 years agotarget: Fix SPC-2 RELEASE bug for multi-session iSCSI client setups
Bernhard Kohl [Sun, 13 May 2012 21:39:37 +0000 (23:39 +0200)]
target: Fix SPC-2 RELEASE bug for multi-session iSCSI client setups

commit edc318d9fea6854df752ec8c645b960b0d5a1d23 upstream.

This patch addresses a bug in a special case for target core SPC-2 RELEASE
logic where the same physical client (eg: iSCSI InitiatorName) with
differing iSCSI session identifiers (ISID) is allowed to incorrectly release
the same client's SPC-2 reservation from the non reservation holding path.

Note this bug is specific to iscsi-target w/ SPC-2 reservations, and
with the default enforce_pr_isids=1 device attr setting in target-core
controls if a InitiatorName + different ISID reservations are handled
the same as a single iSCSI client entity.

Signed-off-by: Bernhard Kohl <>
Signed-off-by: Nicholas Bellinger <>
Signed-off-by: Ben Hutchings <>
9 years agoARM: 7417/1: vfp: ensure preemption is disabled when enabling VFP access
Will Deacon [Fri, 11 May 2012 16:42:37 +0000 (17:42 +0100)]
ARM: 7417/1: vfp: ensure preemption is disabled when enabling VFP access

commit 998de4acb2ba188d20768d1065658377a2e7d29b upstream.

The vfp_enable function enables access to the VFP co-processor register
space (cp10 and cp11) on the current CPU and must be called with
preemption disabled. Unfortunately, the vfp_init late initcall does not
disable preemption and can lead to an oops during boot if thread
migration occurs at the wrong time and we end up attempting to access
the FPSID on a CPU with VFP access disabled.

This patch fixes the initcall to call vfp_enable from a non-preemptible
context on each CPU and adds a BUG_ON(preemptible) to ensure that any
similar problems are easily spotted in the future.

Reported-by: Hyungwoo Yang <>
Signed-off-by: Hyungwoo Yang <>
Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Ben Hutchings <>
9 years agobrcm80211: smac: fix endless retry of A-MPDU transmissions
Arend van Spriel [Thu, 9 Feb 2012 20:08:58 +0000 (21:08 +0100)]
brcm80211: smac: fix endless retry of A-MPDU transmissions

commit 5e379203c7788b7af01150bfadbc74d2797a2ef4 upstream.

The A-MPDU code checked against a retry limit, but it was using
the wrong variable to do so. This patch fixes this to assure
proper retry mechanism.

This problem had a side-effect causing the mac80211 flush callback
to remain waiting forever as well. That side effect has been fixed
by commit by Stanislaw Gruszka:

commit f96b08a7e6f69c0f0a576554df3df5b1b519c479
Date:   Tue Jan 17 12:38:50 2012 +0100

    brcmsmac: fix tx queue flush infinite loop


Cc: Stanislaw Gruszka <>
Reviewed-by: Pieter-Paul Giesberts <>
Reviewed-by: Alwin Beukers <>
Signed-off-by: Arend van Spriel <>
Signed-off-by: John W. Linville <>
Signed-off-by: Ben Hutchings <>
9 years agoia64: Add accept4() syscall
Émeric Maschino [Mon, 9 Jan 2012 20:55:10 +0000 (12:55 -0800)]
ia64: Add accept4() syscall

commit 65cc21b4523e94d5640542a818748cd3be8cd6b4 upstream.

While debugging udev > 170 failure on Debian Wheezy
(, it appears
that the issue was in fact due to missing accept4() in ia64.

This patch simply adds accept4() to ia64.

Signed-off-by: Émeric Maschino <>
Signed-off-by: Tony Luck <>
Signed-off-by: Ben Hutchings <>
9 years agoext4: avoid deadlock on sync-mounted FS w/o journal
Eric Sandeen [Tue, 21 Feb 2012 04:06:18 +0000 (23:06 -0500)]
ext4: avoid deadlock on sync-mounted FS w/o journal

commit c1bb05a657fb3d8c6179a4ef7980261fae4521d7 upstream.

Processes hang forever on a sync-mounted ext2 file system that
is mounted with the ext4 module (default in Fedora 16).

I can reproduce this reliably by mounting an ext2 partition with
"-o sync" and opening a new file an that partition with vim. vim
will hang in "D" state forever.  The same happens on ext4 without
a journal.

I am attaching a small patch here that solves this issue for me.
In the sync mounted case without a journal,
ext4_handle_dirty_metadata() may call sync_dirty_buffer(), which
can't be called with buffer lock held.

Also move mb_cache_entry_release inside lock to avoid race
fixed previously by 8a2bfdcb ext[34]: EA block reference count racing fix
Note too that ext2 fixed this same problem in 2006 with
b2f49033 [PATCH] fix deadlock in ext2

[ move mb_cache_entry_release before unlock, edit commit msg]
Signed-off-by: Eric Sandeen <>
Signed-off-by: "Theodore Ts'o" <>
Signed-off-by: Ben Hutchings <>
9 years agospi-topcliff-pch: add recovery processing in case wait-event timeout
Tomoya MORINAGA [Fri, 9 Dec 2011 04:13:29 +0000 (13:13 +0900)]
spi-topcliff-pch: add recovery processing in case wait-event timeout

commit 0f57e168aa109775430c76cc663fb64909813d84 upstream.

Currently, pch_spi_start_transfer failure is not anticipated.
This patch adds the processing.

Signed-off-by: Tomoya MORINAGA <>
Signed-off-by: Grant Likely <>
Signed-off-by: Ben Hutchings <>
9 years agospi-topcliff-pch: supports a spi mode setup and bit order setup by IO control
Tomoya MORINAGA [Fri, 9 Dec 2011 04:13:28 +0000 (13:13 +0900)]
spi-topcliff-pch: supports a spi mode setup and bit order setup by IO control

commit f258b44e22e07f5e98ac2260c70acff5784791b6 upstream.

This patch supports a spi mode setup and bit order setup by IO control.
    spi mode:     mode 0 to mode 3
    bit order:    LSB first, MSB first

Signed-off-by: Tomoya MORINAGA <>
Signed-off-by: Grant Likely <>
Signed-off-by: Ben Hutchings <>
9 years agospi-topcliff-pch: Fix issue for transmitting over 4KByte
Tomoya MORINAGA [Fri, 9 Dec 2011 04:13:27 +0000 (13:13 +0900)]
spi-topcliff-pch: Fix issue for transmitting over 4KByte

commit 7d05b3e868ee0f9231baf40cb77be3df5dd1f18c upstream.

Currently, when spi-topcliff-pch receives transmit request over 4KByte,
this driver can't process correctly. This driver needs to divide the data
into 4Kbyte unit.
This patch fixes the issue.

Signed-off-by: Tomoya MORINAGA <>
Signed-off-by: Grant Likely <>
Signed-off-by: Ben Hutchings <>
9 years agospi-topcliff-pch: Modify pci-bus number dynamically to get DMA device info
Tomoya MORINAGA [Fri, 9 Dec 2011 04:11:42 +0000 (13:11 +0900)]
spi-topcliff-pch: Modify pci-bus number dynamically to get DMA device info

commit ee2ece5261a639b89f194d141444b03b4c923179 upstream.

Signed-off-by: Tomoya MORINAGA <>
Signed-off-by: Grant Likely <>
Signed-off-by: Ben Hutchings <>
9 years agogpio: Add missing spin_lock_init in gpio-ml-ioh driver
Axel Lin [Wed, 1 Feb 2012 02:50:05 +0000 (10:50 +0800)]
gpio: Add missing spin_lock_init in gpio-ml-ioh driver

commit 7e3a70fb7bccada029c188c89bfbf3c0a63c1500 upstream.

This bug was introduced by commit 54be5663
"gpio-ml-ioh: Support interrupt function" which adds a spinlock to struct
ioh_gpio but never init the spinlock.

Signed-off-by: Axel Lin <>
Signed-off-by: Grant Likely <>
Signed-off-by: Ben Hutchings <>
9 years agosparc64: Do not clobber %g2 in xcall_fetch_glob_regs().
David S. Miller [Thu, 10 May 2012 18:00:46 +0000 (11:00 -0700)]
sparc64: Do not clobber %g2 in xcall_fetch_glob_regs().

[ Upstream commit a5a737e090e25981e99d69f01400e3a80356581c ]

%g2 is meant to hold the CPUID number throughout this routine, since
at the very beginning, and at the very end, we use %g2 to calculate
indexes into per-cpu arrays.

However we erroneously clobber it in order to hold the %cwp register
value mid-stream.

Fix this code to use %g3 for the %cwp read and related calulcations

Reported-by: Meelis Roos <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agodm mpath: check if scsi_dh module already loaded before trying to load
Mike Snitzer [Sat, 12 May 2012 00:43:21 +0000 (01:43 +0100)]
dm mpath: check if scsi_dh module already loaded before trying to load

commit 510193a2d3d2e03ae53b95c0ae4f33cdff02cbf8 upstream.

If the requested scsi_dh module is already loaded then skip

Multipath table loads can hang in an unnecessary __request_module.

Reported-by: Ben Marzinski <>
Signed-off-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Ben Hutchings <>
9 years agos5p-fimc: Fix locking in subdev set_crop op
Sylwester Nawrocki [Sat, 21 Apr 2012 21:46:30 +0000 (18:46 -0300)]
s5p-fimc: Fix locking in subdev set_crop op

commit e985dbf7d93e2a3e114b4525413e50f83613e0cb upstream.

When setting TRY crop on the sub-device the mutex was erroneously acquired
rather than released on exit path. This bug is present in kernels starting
from v3.2.

Signed-off-by: Sylwester Nawrocki <>
Signed-off-by: Kyungmin Park <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Ben Hutchings <>
9 years agojffs2: Fix lock acquisition order bug in gc path
Josh Cartwright [Thu, 29 Mar 2012 23:34:53 +0000 (19:34 -0400)]
jffs2: Fix lock acquisition order bug in gc path

commit 226bb7df3d22bcf4a1c0fe8206c80cc427498eae upstream.

The locking policy is such that the erase_complete_block spinlock is
nested within the alloc_sem mutex.  This fixes a case in which the
acquisition order was erroneously reversed.  This issue was caught by
the following lockdep splat:

   [ INFO: possible circular locking dependency detected ]
   3.0.5 #1
   jffs2_gcd_mtd6/299 is trying to acquire lock:
    (&c->alloc_sem){+.+.+.}, at: [<c01f7714>] jffs2_garbage_collect_pass+0x314/0x890

   but task is already holding lock:
    (&(&c->erase_completion_lock)->rlock){+.+...}, at: [<c01f7708>] jffs2_garbage_collect_pass+0x308/0x890

   which lock already depends on the new lock.

   the existing dependency chain (in reverse order) is:

   -> #1 (&(&c->erase_completion_lock)->rlock){+.+...}:
          [<c008bec4>] validate_chain+0xe6c/0x10bc
          [<c008c660>] __lock_acquire+0x54c/0xba4
          [<c008d240>] lock_acquire+0xa4/0x114
          [<c046780c>] _raw_spin_lock+0x3c/0x4c
          [<c01f744c>] jffs2_garbage_collect_pass+0x4c/0x890
          [<c01f937c>] jffs2_garbage_collect_thread+0x1b4/0x1cc
          [<c0071a68>] kthread+0x98/0xa0
          [<c000f264>] kernel_thread_exit+0x0/0x8

   -> #0 (&c->alloc_sem){+.+.+.}:
          [<c008ad2c>] print_circular_bug+0x70/0x2c4
          [<c008c08c>] validate_chain+0x1034/0x10bc
          [<c008c660>] __lock_acquire+0x54c/0xba4
          [<c008d240>] lock_acquire+0xa4/0x114
          [<c0466628>] mutex_lock_nested+0x74/0x33c
          [<c01f7714>] jffs2_garbage_collect_pass+0x314/0x890
          [<c01f937c>] jffs2_garbage_collect_thread+0x1b4/0x1cc
          [<c0071a68>] kthread+0x98/0xa0
          [<c000f264>] kernel_thread_exit+0x0/0x8

   other info that might help us debug this:

    Possible unsafe locking scenario:

          CPU0                    CPU1
          ----                    ----

    *** DEADLOCK ***

   1 lock held by jffs2_gcd_mtd6/299:
    #0:  (&(&c->erase_completion_lock)->rlock){+.+...}, at: [<c01f7708>] jffs2_garbage_collect_pass+0x308/0x890

   stack backtrace:
   [<c00155dc>] (unwind_backtrace+0x0/0x100) from [<c0463dc0>] (dump_stack+0x20/0x24)
   [<c0463dc0>] (dump_stack+0x20/0x24) from [<c008ae84>] (print_circular_bug+0x1c8/0x2c4)
   [<c008ae84>] (print_circular_bug+0x1c8/0x2c4) from [<c008c08c>] (validate_chain+0x1034/0x10bc)
   [<c008c08c>] (validate_chain+0x1034/0x10bc) from [<c008c660>] (__lock_acquire+0x54c/0xba4)
   [<c008c660>] (__lock_acquire+0x54c/0xba4) from [<c008d240>] (lock_acquire+0xa4/0x114)
   [<c008d240>] (lock_acquire+0xa4/0x114) from [<c0466628>] (mutex_lock_nested+0x74/0x33c)
   [<c0466628>] (mutex_lock_nested+0x74/0x33c) from [<c01f7714>] (jffs2_garbage_collect_pass+0x314/0x890)
   [<c01f7714>] (jffs2_garbage_collect_pass+0x314/0x890) from [<c01f937c>] (jffs2_garbage_collect_thread+0x1b4/0x1cc)
   [<c01f937c>] (jffs2_garbage_collect_thread+0x1b4/0x1cc) from [<c0071a68>] (kthread+0x98/0xa0)
   [<c0071a68>] (kthread+0x98/0xa0) from [<c000f264>] (kernel_thread_exit+0x0/0x8)

This was introduce in '81cfc9f jffs2: Fix serious write stall due to erase'.

Signed-off-by: Josh Cartwright <>
Signed-off-by: Artem Bityutskiy <>
Signed-off-by: David Woodhouse <>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <>
9 years agocdc_ether: Ignore bogus union descriptor for RNDIS devices
Bjørn Mork [Thu, 26 Apr 2012 02:35:10 +0000 (02:35 +0000)]
cdc_ether: Ignore bogus union descriptor for RNDIS devices

commit 6eddcb4c82883451aec3be1240f17793370fa62f upstream.

Some RNDIS devices include a bogus CDC Union descriptor pointing
to non-existing interfaces.  The RNDIS code is already prepared
to handle devices without a CDC Union descriptor by hardwiring
the driver to use interfaces 0 and 1, which is correct for the
devices with the bogus descriptor as well. So we can reuse the
existing workaround.

Cc: Markus Kolb <>
Cc: Iker Salmón San Millán <>
Cc: Jonathan Nieder <>
Cc: Oliver Neukum <>
Signed-off-by: Bjørn Mork <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agorc: Postpone ISR registration
Luis Henriques [Sat, 21 Apr 2012 15:25:21 +0000 (12:25 -0300)]
rc: Postpone ISR registration

commit 9ef449c6b31bb6a8e6dedc24de475a3b8c79be20 upstream.

An early registration of an ISR was causing a crash to several users (for
example, with the ite-cir driver:
The reason was that IRQs were being triggered before a driver
initialisation was completed.

This patch fixes this by moving the invocation to request_irq() and to
request_region() to a later stage on the driver probe function.

Signed-off-by: Luis Henriques <>
Acked-by: Jarod Wilson <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Ben Hutchings <>
9 years agomarvell-cam: fix an ARM build error
Jonathan Corbet [Fri, 20 Apr 2012 15:22:50 +0000 (12:22 -0300)]
marvell-cam: fix an ARM build error

commit 9967232f1be5bab10c7b7a8dcf51ff5c3c1a6d77 upstream.

One of the OLPC changes lost a little in its translation to mainline,
leading to build errors on the ARM architecture.  Remove the offending
line, and all will be well.

Reported-by: Mathieu Poirier <>
Signed-off-by: Jonathan Corbet <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Ben Hutchings <>
9 years agotarget: Drop incorrect se_lun_acl release for dynamic -> explict ACL conversion
Nicholas Bellinger [Fri, 11 May 2012 05:05:49 +0000 (22:05 -0700)]
target: Drop incorrect se_lun_acl release for dynamic -> explict ACL conversion

commit cfebf8f42f47327fa54cf05c19b98f4bd5236a26 upstream.

This patch removes some potentially problematic legacy code within
core_clear_initiator_node_from_tpg() that was originally intended to
release left over se_lun_acl setup during dynamic NodeACL+MappedLUN
generate when running with TPG demo-mode operation.

Since we now only ever expect to allocate and release se_lun_acl from
within target_core_fabric_configfs.c:target_fabric_make_mappedlun() and
target_fabric_drop_mappedlun() context respectively, this code for
demo-mode release is incorrect and needs to be removed.

Cc: Christoph Hellwig <>
Cc: Andy Grover <>
Signed-off-by: Nicholas Bellinger <>
Signed-off-by: Ben Hutchings <>
9 years agoNFSv4: Revalidate uid/gid after open
Jonathan Nieder [Fri, 11 May 2012 09:20:20 +0000 (04:20 -0500)]
NFSv4: Revalidate uid/gid after open

This is a shorter (and more appropriate for stable kernels) analog to
the following upstream commit:

commit 6926afd1925a54a13684ebe05987868890665e2b
Author: Trond Myklebust <>
Date:   Sat Jan 7 13:22:46 2012 -0500

    NFSv4: Save the owner/group name string when doing open that we can do the uid/gid mapping outside the asynchronous RPC
    This fixes a bug in the current NFSv4 atomic open code where the client
    isn't able to determine what the true uid/gid fields of the file are,
    (because the asynchronous nature of the OPEN call denies it the ability
    to do an upcall) and so fills them with default values, marking the
    inode as needing revalidation.
    Unfortunately, in some cases, the VFS will do some additional sanity
    checks on the file, and may override the server's decision to allow
    the open because it sees the wrong owner/group fields.

Signed-off-by: Trond Myklebust <>
Without this patch, logging into two different machines with home
directories mounted over NFS4 and then running "vim" and typing ":q"
in each reliably produces the following error on the second machine:

E137: Viminfo file is not writable: /users/system/rtheys/.viminfo

This regression was introduced by 80e52aced138 ("NFSv4: Don't do
idmapper upcalls for asynchronous RPC calls", merged during the 2.6.32
cycle) --- after the OPEN call, .viminfo has the default values for
st_uid and st_gid (0xfffffffe) cached because we do not want to let
rpciod wait for an idmapper upcall to fill them in.

The fix used in mainline is to save the owner and group as strings and
perform the upcall in _nfs4_proc_open outside the rpciod context,
which takes about 600 lines.  For stable, we can do something similar
with a one-liner: make open check for the stale fields and make a
(synchronous) GETATTR call to fill them when needed.

Trond dictated the patch, I typed it in, and Rik tested it.

Addresses and

Reported-by: Rik Theys <>
Explained-by: David Flyn <>
Signed-off-by: Jonathan Nieder <>
Tested-by: Rik Theys <>
Signed-off-by: Ben Hutchings <>
9 years agophy:icplus:fix Auto Power Saving in ip101a_config_init.
Srinivas Kandagatla [Mon, 2 Apr 2012 00:02:09 +0000 (00:02 +0000)]
phy:icplus:fix Auto Power Saving in ip101a_config_init.

[ Upstream commit b3300146aa8efc5d3937fd33f3cfdc580a3843bc ]

This patch fixes Auto Power Saving configuration in ip101a_config_init
which was broken as there is no phy register write followed after
setting IP101A_APS_ON flag.

This patch also fixes the return value of ip101a_config_init.

Without this patch ip101a_config_init returns 2 which is not an error
accroding to IS_ERR and the mac driver will continue accessing 2 as
valid pointer to phy_dev resulting in memory fault.

Signed-off-by: Srinivas Kandagatla <>
Signed-off-by: David S. Miller <>
Signed-off-by: Jonathan Nieder <>
Signed-off-by: Ben Hutchings <>
9 years agobrcm80211: smac: pass missing argument to 'brcms_b_mute'
Jonathan Nieder [Sat, 12 May 2012 00:35:33 +0000 (19:35 -0500)]
brcm80211: smac: pass missing argument to 'brcms_b_mute'

[Not needed upstream --- this bug is specific to 3.2.y.]

Commit c6c44893c864, which removes the flag argument from brcms_b_mute,
is not part of 3.2.y, and we forgot to adjust a new call accordingly
when applying commit badc4f07622f ("brcm80211: smac: resume transmit
fifo upon receiving frames").

 drivers/net/wireless/brcm80211/brcmsmac/main.c: In function 'brcms_c_recvctl':
 drivers/net/wireless/brcm80211/brcmsmac/main.c:7882:4: error: too few arguments to function 'brcms_b_mute'
 drivers/net/wireless/brcm80211/brcmsmac/main.c:2538:13: note: declared here

Earlier build tests missed this because they didn't include this driver
due to 'depends on BCMA=n'.

Reported-by: Ben Hutchings <>
Signed-off-by: Jonathan Nieder <>
Signed-off-by: Ben Hutchings <>
9 years agotcp: change tcp_adv_win_scale and tcp_rmem[2]
Eric Dumazet [Wed, 2 May 2012 02:28:41 +0000 (02:28 +0000)]
tcp: change tcp_adv_win_scale and tcp_rmem[2]

[ Upstream commit b49960a05e32121d29316cfdf653894b88ac9190 ]

tcp_adv_win_scale default value is 2, meaning we expect a good citizen
skb to have skb->len / skb->truesize ratio of 75% (3/4)

In 2.6 kernels we (mis)accounted for typical MSS=1460 frame :
1536 + 64 + 256 = 1856 'estimated truesize', and 1856 * 3/4 = 1392.
So these skbs were considered as not bloated.

With recent truesize fixes, a typical MSS=1460 frame truesize is now the
more precise :
2048 + 256 = 2304. But 2304 * 3/4 = 1728.
So these skb are not good citizen anymore, because 1460 < 1728

(GRO can escape this problem because it build skbs with a too low

This also means tcp advertises a too optimistic window for a given
allocated rcvspace : When receiving frames, sk_rmem_alloc can hit
sk_rcvbuf limit and we call tcp_prune_queue()/tcp_collapse() too often,
especially when application is slow to drain its receive queue or in
case of losses (netperf is fast, scp is slow). This is a major latency

We should adjust the len/truesize ratio to 50% instead of 75%

This patch :

1) changes tcp_adv_win_scale default to 1 instead of 2

2) increase tcp_rmem[2] limit from 4MB to 6MB to take into account
better truesize tracking and to allow autotuning tcp receive window to
reach same value than before. Note that same amount of kernel memory is
consumed compared to 2.6 kernels.

Signed-off-by: Eric Dumazet <>
Cc: Neal Cardwell <>
Cc: Tom Herbert <>
Cc: Yuchung Cheng <>
Acked-by: Neal Cardwell <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agotcp: fix infinite cwnd in tcp_complete_cwr()
Yuchung Cheng [Mon, 30 Apr 2012 06:00:18 +0000 (06:00 +0000)]
tcp: fix infinite cwnd in tcp_complete_cwr()

[ Upstream commit 1cebce36d660c83bd1353e41f3e66abd4686f215 ]

When the cwnd reduction is done, ssthresh may be infinite
if TCP enters CWR via ECN or F-RTO. If cwnd is not undone, i.e.,
undo_marker is set, tcp_complete_cwr() falsely set cwnd to the
infinite ssthresh value. The correct operation is to keep cwnd
intact because it has been updated in ECN or F-RTO.

Signed-off-by: Yuchung Cheng <>
Acked-by: Neal Cardwell <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agotg3: Avoid panic from reserved statblk field access
Matt Carlson [Tue, 24 Apr 2012 13:37:01 +0000 (13:37 +0000)]
tg3: Avoid panic from reserved statblk field access

[ Upstream commit f891ea1634ce41f5f47ae40d8594809f4cd2ca66 ]

When RSS is enabled, interrupt vector 0 does not receive any rx traffic.
The rx producer index fields for vector 0's status block should be
considered reserved in this case.  This patch changes the code to
respect these reserved fields, which avoids a kernel panic when these
fields take on non-zero values.

Signed-off-by: Matt Carlson <>
Signed-off-by: Michael Chan <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agosungem: Fix WakeOnLan
Gerard Lledo [Sat, 28 Apr 2012 08:52:37 +0000 (08:52 +0000)]
sungem: Fix WakeOnLan

[ Upstream commit 5a8887d39e1ba5ee2d4ccb94b14d6f2dce5ddfca ]

WakeOnLan was broken in this driver because gp->asleep_wol is a 1-bit
bitfield and it was being assigned WAKE_MAGIC, which is (1 << 5).
gp->asleep_wol remains 0 and the machine never wakes up.  Fixed by casting
gp->wake_on_lan to bool.  Tested on an iBook G4.

Signed-off-by: Gerard Lledo <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agosky2: fix receive length error in mixed non-VLAN/VLAN traffic
stephen hemminger [Mon, 30 Apr 2012 06:47:37 +0000 (06:47 +0000)]
sky2: fix receive length error in mixed non-VLAN/VLAN traffic

[ Upstream commit e072b3fad5f3915102c94628b4971f52ff99dd05 ]

Bug: The VLAN bit of the MAC RX Status Word is unreliable in several older
supported chips. Sometimes the VLAN bit is not set for valid VLAN packets
and also sometimes the VLAN bit is set for non-VLAN packets that came after
a VLAN packet. This results in a receive length error when VLAN hardware
tagging is enabled.

Fix: Variation on original fix proposed by Mirko.
The VLAN information is decoded in the status loop, and can be
applied to the received SKB there. This eliminates the need for the
separate tag field in the interface data structure. The tag has to
be copied and cleared if packet is copied. This version checked out
with vlan and normal traffic.

Note: vlan_tx_tag_present should be renamed vlan_tag_present, but that
is outside scope of this.

Reported-by: Mirko Lindner <>
Signed-off-by: Stephen Hemminger <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agosky2: propogate rx hash when packet is copied
stephen hemminger [Mon, 30 Apr 2012 05:49:45 +0000 (05:49 +0000)]
sky2: propogate rx hash when packet is copied

[ Upstream commit 3f42941b5d1d13542b1a755a9e4f633aa72e4d3e ]

When a small packet is received, the driver copies it to a new skb to allow
reusing the full size Rx buffer. The copy was propogating the checksum offload
but not the receive hash information. The bug is impact was mostly harmless
and therefore not observed until reviewing this area of code.

Signed-off-by: Stephen Hemminger <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agonet: l2tp: unlock socket lock before returning from l2tp_ip_sendmsg
Sasha Levin [Wed, 2 May 2012 03:58:43 +0000 (03:58 +0000)]
net: l2tp: unlock socket lock before returning from l2tp_ip_sendmsg

[ Upstream commit 84768edbb2721637620b2d84501bb0d5aed603f1 ]

l2tp_ip_sendmsg could return without releasing socket lock, making it all the
way to userspace, and generating the following warning:

[  130.891594] ================================================
[  130.894569] [ BUG: lock held when returning to user space! ]
[  130.897257] 3.4.0-rc5-next-20120501-sasha #104 Tainted: G        W
[  130.900336] ------------------------------------------------
[  130.902996] trinity/8384 is leaving the kernel with locks still held!
[  130.906106] 1 lock held by trinity/8384:
[  130.907924]  #0:  (sk_lock-AF_INET){+.+.+.}, at: [<ffffffff82b9503f>] l2tp_ip_sendmsg+0x2f/0x550

Introduced by commit 2f16270 ("l2tp: Fix locking in l2tp_ip.c").

Signed-off-by: Sasha Levin <>
Acked-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agonet: In unregister_netdevice_notifier unregister the netdevices.
Eric W. Biederman [Fri, 6 Apr 2012 15:33:35 +0000 (15:33 +0000)]
net: In unregister_netdevice_notifier unregister the netdevices.

[ Upstream commit 7d3d43dab4e978d8d9ad1acf8af15c9b1c4b0f0f ]

We already synthesize events in register_netdevice_notifier and synthesizing
events in unregister_netdevice_notifier allows to us remove the need for
special case cleanup code.

This change should be safe as it adds no new cases for existing callers
of unregiser_netdevice_notifier to handle.

Signed-off-by: Eric W. Biederman <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agonetem: fix possible skb leak
Eric Dumazet [Sun, 29 Apr 2012 09:08:22 +0000 (09:08 +0000)]
netem: fix possible skb leak

[ Upstream commit 116a0fc31c6c9b8fc821be5a96e5bf0b43260131 ]

skb_checksum_help(skb) can return an error, we must free skb in this
case. qdisc_drop(skb, sch) can also be feeded with a NULL skb (if
skb_unshare() failed), so lets use this generic helper.

Signed-off-by: Eric Dumazet <>
Cc: Stephen Hemminger <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agoasix: Fix tx transfer padding for full-speed USB
Ingo van Lil [Mon, 23 Apr 2012 22:05:38 +0000 (22:05 +0000)]
asix: Fix tx transfer padding for full-speed USB

[ Upstream commit 2a5809499e35b53a6044fd34e72b242688b7a862 ]

The asix.c USB Ethernet driver avoids ending a tx transfer with a zero-
length packet by appending a four-byte padding to transfers whose length
is a multiple of maxpacket. However, the hard-coded 512 byte maxpacket
length is valid for high-speed USB only; full-speed USB uses 64 byte

Signed-off-by: Ingo van Lil <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agomm: nobootmem: fix sign extend problem in __free_pages_memory()
Russ Anderson [Thu, 10 May 2012 20:01:46 +0000 (13:01 -0700)]
mm: nobootmem: fix sign extend problem in __free_pages_memory()

commit 6bc2e853c6b46a6041980d58200ad9b0a73a60ff upstream.

Systems with 8 TBytes of memory or greater can hit a problem where only
the the first 8 TB of memory shows up.  This is due to "int i" being
smaller than "unsigned long start_aligned", causing the high bits to be

The fix is to change `i' to unsigned long to match start_aligned
and end_aligned.

Thanks to Jack Steiner for assistance tracking this down.

Signed-off-by: Russ Anderson <>
Cc: Jack Steiner <>
Cc: Johannes Weiner <>
Cc: Tejun Heo <>
Cc: David S. Miller <>
Cc: Yinghai Lu <>
Cc: Gavin Shan <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Ben Hutchings <>
9 years agonamespaces, pid_ns: fix leakage on fork() failure
Mike Galbraith [Thu, 10 May 2012 20:01:45 +0000 (13:01 -0700)]
namespaces, pid_ns: fix leakage on fork() failure

commit 5e2bf0142231194d36fdc9596b36a261ed2b9fe7 upstream.

Fork() failure post namespace creation for a child cloned with
CLONE_NEWPID leaks pid_namespace/mnt_cache due to proc being mounted
during creation, but not unmounted during cleanup.  Call
pid_ns_release_proc() during cleanup.

Signed-off-by: Mike Galbraith <>
Acked-by: Oleg Nesterov <>
Reviewed-by: "Eric W. Biederman" <>
Cc: Pavel Emelyanov <>
Cc: Cyrill Gorcunov <>
Cc: Louis Rilling <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Ben Hutchings <>
9 years agohugetlb: prevent BUG_ON in hugetlb_fault() -> hugetlb_cow()
Chris Metcalf [Thu, 10 May 2012 20:01:44 +0000 (13:01 -0700)]
hugetlb: prevent BUG_ON in hugetlb_fault() -> hugetlb_cow()

commit 4998a6c0edce7fae9c0a5463f6ec3fa585258ee7 upstream.

Commit 66aebce747eaf ("hugetlb: fix race condition in hugetlb_fault()")
added code to avoid a race condition by elevating the page refcount in
hugetlb_fault() while calling hugetlb_cow().

However, one code path in hugetlb_cow() includes an assertion that the
page count is 1, whereas it may now also have the value 2 in this path.

The consensus is that this BUG_ON has served its purpose, so rather than
extending it to cover both cases, we just remove it.

Signed-off-by: Chris Metcalf <>
Acked-by: Mel Gorman <>
Acked-by: Hillf Danton <>
Acked-by: Hugh Dickins <>
Cc: Michal Hocko <>
Cc: KAMEZAWA Hiroyuki <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Ben Hutchings <>
9 years agopercpu: pcpu_embed_first_chunk() should free unused parts after all allocs are complete
Tejun Heo [Fri, 27 Apr 2012 15:42:53 +0000 (08:42 -0700)]
percpu: pcpu_embed_first_chunk() should free unused parts after all allocs are complete

commit 42b64281453249dac52861f9b97d18552a7ec62b upstream.

pcpu_embed_first_chunk() allocates memory for each node, copies percpu
data and frees unused portions of it before proceeding to the next
group.  This assumes that allocations for different nodes doesn't
overlap; however, depending on memory topology, the bootmem allocator
may end up allocating memory from a different node than the requested
one which may overlap with the portion freed from one of the previous
percpu areas.  This leads to percpu groups for different nodes
overlapping which is a serious bug.

This patch separates out copy & partial free from the allocation loop
such that all allocations are complete before partial frees happen.

This also fixes overlapping frees which could happen on allocation
failure path - out_free_areas path frees whole groups but the groups
could have portions freed at that point.

Signed-off-by: Tejun Heo <>
Reported-by: "Pavel V. Panteleev" <>
Tested-by: "Pavel V. Panteleev" <>
LKML-Reference: <>
Signed-off-by: Ben Hutchings <>
9 years agoALSA: HDA: Lessen CPU usage when waiting for chip to respond
David Henningsson [Fri, 4 May 2012 09:05:55 +0000 (11:05 +0200)]
ALSA: HDA: Lessen CPU usage when waiting for chip to respond

commit 32cf4023e689ad5b3a81a749d8cc99d7f184cb99 upstream.

When an IRQ for some reason gets lost, we wait up to a second using
udelay, which is CPU intensive. This patch improves the situation by
waiting about 30 ms in the CPU intensive mode, then stepping down to
using msleep(2) instead. In essence, we trade some granularity in
exchange for less CPU consumption when the waiting time is a bit longer.

As a result, PulseAudio should no longer be killed by the kernel
for taking up to much RT-prio CPU time. At least not for *this* reason.

Signed-off-by: David Henningsson <>
Tested-by: Arun Raghavan <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Ben Hutchings <>
9 years agoARM: orion5x: Fix GPIO enable bits for MPP9
Ben Hutchings [Sun, 8 Apr 2012 04:18:53 +0000 (05:18 +0100)]
ARM: orion5x: Fix GPIO enable bits for MPP9

commit 48d99f47a81a66bdd61a348c7fe8df5a7afdf5f3 upstream.

Commit 554cdaefd1cf7bb54b209c4e68c7cec87ce442a9 ('ARM: orion5x: Refactor
mpp code to use common orion platform mpp.') seems to have accidentally
inverted the GPIO valid bits for MPP9 (only).  For the mv2120 platform
which uses MPP9 as a GPIO LED device, this results in the error:

[   12.711476] leds-gpio: probe of leds-gpio failed with error -22

Reported-by: Henry von Tresckow <>
Signed-off-by: Ben Hutchings <>
Tested-by: Hans Henry von Tresckow <>
Signed-off-by: Jason Cooper <>
9 years agoALSA: echoaudio: Remove incorrect part of assertion
Mark Hills [Mon, 30 Apr 2012 18:39:22 +0000 (19:39 +0100)]
ALSA: echoaudio: Remove incorrect part of assertion

commit c914f55f7cdfafe9d7d5b248751902c7ab57691e upstream.

This assertion seems to imply that chip->dsp_code_to_load is a pointer.
It's actually an integer handle on the actual firmware, and 0 has no
special meaning.

The assertion prevents initialisation of a Darla20 card, but would also
affect other models. It seems it was introduced in commit dd7b254d.

ALSA sound/pci/echoaudio/echoaudio.c:2061 Echoaudio driver starting...
ALSA sound/pci/echoaudio/echoaudio.c:1969 chip=ebe4e000
ALSA sound/pci/echoaudio/echoaudio.c:2007 pci=ed568000 irq=19 subdev=0010 Init hardware...
ALSA sound/pci/echoaudio/darla20_dsp.c:36 init_hw() - Darla20
------------[ cut here ]------------
WARNING: at sound/pci/echoaudio/echoaudio_dsp.c:478 init_hw+0x1d1/0x86c [snd_darla20]()
Hardware name: Dell DM051
BUG? (!chip->dsp_code_to_load || !chip->comm_page)

Signed-off-by: Mark Hills <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Ben Hutchings <>
9 years agoARM: OMAP: Revert "ARM: OMAP: ctrl: Fix CONTROL_DSIPHY register fields"
Archit Taneja [Thu, 19 Apr 2012 12:09:16 +0000 (17:39 +0530)]
ARM: OMAP: Revert "ARM: OMAP: ctrl: Fix CONTROL_DSIPHY register fields"

commit 08ca7444f589bedf9ad5d82883e5d0754852d73b upstream.

This reverts commit 46f8c3c7e95c0d30d95911e7975ddc4f93b3e237.

The commit above swapped the DSI1_PPID and DSI2_PPID register fields in
CONTROL_DSIPHY to be in sync with the newer public OMAP TRMs(after version V).

With this commit, contention errors were reported on DSI lanes some OMAP4 SDPs.
After probing the DSI lanes on OMAP4 SDP, it was seen that setting bits in the
DSI2_PPID field was pulling up voltage on DSI1 lanes, and DSI1_PPID field was
pulling up voltage on DSI2 lanes.

This proves that the current version of OMAP4 TRM is incorrect, swap the
position of register fields according to the older TRM versions as they were

Acked-by: Tomi Valkeinen <>
Signed-off-by: Archit Taneja <>
Signed-off-by: Tony Lindgren <>
Signed-off-by: Ben Hutchings <>
9 years agoregulator: Fix the logic to ensure new voltage setting in valid range
Axel Lin [Wed, 11 Apr 2012 12:53:58 +0000 (20:53 +0800)]
regulator: Fix the logic to ensure new voltage setting in valid range

commit f55205f4d4a8823a11bb8b37ef2ecbd78fb09463 upstream.

I think this is a typo.
To ensure new voltage setting won't greater than desc->max,
the equation should be desc->min + desc->step * new_val <= desc->max.

Signed-off-by: Axel Lin <>
Signed-off-by: Mark Brown <>
Signed-off-by: Ben Hutchings <>
9 years agoLinux 3.2.17 v3.2.17
Ben Hutchings [Fri, 11 May 2012 12:15:38 +0000 (13:15 +0100)]
Linux 3.2.17

9 years agosmsc95xx: mark link down on startup and let PHY interrupt deal with carrier changes
Paolo Pisati [Mon, 23 Apr 2012 04:05:20 +0000 (04:05 +0000)]
smsc95xx: mark link down on startup and let PHY interrupt deal with carrier changes

commit 07d69d4238418746a7b85c5d05ec17c658a2a390 upstream.

Without this patch sysfs reports the cable as present

flag@flag-desktop:~$ cat /sys/class/net/eth0/carrier

while it's not:

flag@flag-desktop:~$ sudo mii-tool eth0
eth0: no link

Tested on my Beagle XM.

v2: added mantainer to the list of recipient

Signed-off-by: Paolo Pisati <>
Acked-by: Steve Glendinning <>
Signed-off-by: David S. Miller <>
Signed-off-by: Ben Hutchings <>
9 years agostaging: r8712u: Fix regression caused by commit 8c213fa
Larry Finger [Sun, 26 Feb 2012 00:10:21 +0000 (18:10 -0600)]
staging: r8712u: Fix regression caused by commit 8c213fa

commit 2080913e017ab9f88379d93fd09546ad95faf87b upstream.

In commit 8c213fa "staging: r8712u: Use asynchronous firmware loading",
the command to release the firmware was placed in the wrong routine.

In combination with the bug introduced in commit a5ee652 "staging: r8712u:
Interface-state not fully tracked", the driver attempts to upload firmware
that had already been released. This bug is the source of one of the
problems in

Tested-by: Alberto Lago Ballesteros <>
Tested-by: Adrian <>
Signed-off-by: Larry Finger <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Ben Hutchings <>
9 years agoexit_signal: fix the "parent has changed security domain" logic
Oleg Nesterov [Mon, 19 Mar 2012 16:03:41 +0000 (17:03 +0100)]
exit_signal: fix the "parent has changed security domain" logic

commit b6e238dceed36891cc633167afe7151f1f3d83c5 upstream.

exit_notify() changes ->exit_signal if the parent already did exec.
This doesn't really work, we are not going to send the signal now
if there is another live thread or the exiting task is traced. The
parent can exec before the last dies or the tracer detaches.

Move this check into do_notify_parent() which actually sends the

The user-visible change is that we do not change ->exit_signal,
and thus the exiting task is still "clone children" for
do_wait()->eligible_child(__WCLONE). Hopefully this is fine, the
current logic is racy anyway.

Signed-off-by: Oleg Nesterov <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Ben Hutchings <>
9 years agoexit_signal: simplify the "we have changed execution domain" logic
Oleg Nesterov [Mon, 19 Mar 2012 16:03:22 +0000 (17:03 +0100)]
exit_signal: simplify the "we have changed execution domain" logic

commit e636825346b36a07ccfc8e30946d52855e21f681 upstream.

exit_notify() checks "tsk->self_exec_id != tsk->parent_exec_id"
to handle the "we have changed execution domain" case.

We can change do_thread() to always set ->exit_signal = SIGCHLD
and remove this check to simplify the code.

We could change setup_new_exec() instead, this looks more logical
because it increments ->self_exec_id. But note that de_thread()
already resets ->exit_signal if it changes the leader, let's keep
both changes close to each other.

Note that we change ->exit_signal lockless, this changes the rules.
Thereafter ->exit_signal is not stable under tasklist but this is
fine, the only possible change is OLDSIG -> SIGCHLD. This can race
with eligible_child() but the race is harmless. We can race with
reparent_leader() which changes our ->exit_signal in parallel, but
it does the same change to SIGCHLD.

The noticeable user-visible change is that the execing task is not
"visible" to do_wait()->eligible_child(__WCLONE) right after exec.
To me this looks more logical, and this is consistent with mt case.

Signed-off-by: Oleg Nesterov <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Ben Hutchings <>
9 years agoiwlwifi: use 6000G2B for 6030 device series
Wey-Yi Guy [Wed, 25 Apr 2012 15:10:08 +0000 (08:10 -0700)]
iwlwifi: use 6000G2B for 6030 device series

commit 1ed2ec37b44e86eaa8e0a03b908a39c80f65ee45 upstream.

"iwlwifi: use correct released ucode version" change
the ucode api ok from 6000G2 to 6000G2B, but it shall belong
to 6030 device series, not the 6005 device series. Fix it

Signed-off-by: Wey-Yi Guy <>
Signed-off-by: John W. Linville <>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <>
9 years agoiwlwifi: use correct released ucode version
Meenakshi Venkataraman [Sun, 22 Apr 2012 14:55:27 +0000 (07:55 -0700)]
iwlwifi: use correct released ucode version

commit 78cbcf2b9dbe0565820dc7721316f9c401000a68 upstream.

Report correctly the latest released version
of the iwlwifi firmware for all
iwlwifi-supported devices.

Signed-off-by: Meenakshi Venkataraman <>
Signed-off-by: Wey-Yi Guy <>
Signed-off-by: John W. Linville <>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <>
9 years agoiwlagn: allow up to uCode API 6 for 6000 devices
Johannes Berg [Fri, 4 Nov 2011 14:22:37 +0000 (07:22 -0700)]
iwlagn: allow up to uCode API 6 for 6000 devices

commit b914811524fbe9e91fe50845f5d7bd4316b8a6ee upstream.

Since the uCode hasn't been released (yet?),
warn only if using older than API 4, but load
anything up to API 6.

Signed-off-by: Johannes Berg <>
Signed-off-by: Wey-Yi Guy <>
Signed-off-by: Ben Hutchings <>
9 years agopercpu, x86: don't use PMD_SIZE as embedded atom_size on 32bit
Tejun Heo [Fri, 27 Apr 2012 17:54:35 +0000 (10:54 -0700)]
percpu, x86: don't use PMD_SIZE as embedded atom_size on 32bit

commit d5e28005a1d2e67833852f4c9ea8ec206ea3ff85 upstream.

With the embed percpu first chunk allocator, x86 uses either PAGE_SIZE
or PMD_SIZE for atom_size.  PMD_SIZE is used when CPU supports PSE so
that percpu areas are aligned to PMD mappings and possibly allow using
PMD mappings in vmalloc areas in the future.  Using larger atom_size
doesn't waste actual memory; however, it does require larger vmalloc
space allocation later on for !first chunks.

With reasonably sized vmalloc area, PMD_SIZE shouldn't be a problem
but x86_32 at this point is anything but reasonable in terms of
address space and using larger atom_size reportedly leads to frequent
percpu allocation failures on certain setups.

As there is no reason to not use PMD_SIZE on x86_64 as vmalloc space
is aplenty and most x86_64 configurations support PSE, fix the issue
by always using PMD_SIZE on x86_64 and PAGE_SIZE on x86_32.

v2: drop cpu_has_pse test and make x86_64 always use PMD_SIZE and
    x86_32 PAGE_SIZE as suggested by hpa.

Signed-off-by: Tejun Heo <>
Reported-by: Yanmin Zhang <>
Reported-by: ShuoX Liu <>
Acked-by: H. Peter Anvin <>
LKML-Reference: <>
Signed-off-by: Ben Hutchings <>
9 years agoxen/pci: don't use PCI BIOS service for configuration space accesses
David Vrabel [Fri, 4 May 2012 13:29:46 +0000 (14:29 +0100)]
xen/pci: don't use PCI BIOS service for configuration space accesses

commit 76a8df7b49168509df02461f83fab117a4a86e08 upstream.

The accessing PCI configuration space with the PCI BIOS32 service does
not work in PV guests.

On systems without MMCONFIG or where the BIOS hasn't marked the
MMCONFIG region as reserved in the e820 map, the BIOS service is
probed (even though direct access is preferred) and this hangs.

Acked-by: Jan Beulich <>
Signed-off-by: David Vrabel <>
[v1: Fixed compile error when CONFIG_PCI is not set]
Signed-off-by: Konrad Rzeszutek Wilk <>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <>
9 years agoxen/pte: Fix crashes when trying to see non-existent PGD/PMD/PUD/PTEs
Konrad Rzeszutek Wilk [Thu, 3 May 2012 20:14:14 +0000 (16:14 -0400)]
xen/pte: Fix crashes when trying to see non-existent PGD/PMD/PUD/PTEs

commit b7e5ffe5d83fa40d702976d77452004abbe35791 upstream.

If I try to do "cat /sys/kernel/debug/kernel_page_tables"
I end up with:

BUG: unable to handle kernel paging request at ffffc7fffffff000
IP: [<ffffffff8106aa51>] ptdump_show+0x221/0x480
Oops: 0000 [#1] SMP
.. snip..
RAX: 0000000000000000 RBX: ffffc00000000fff RCX: 0000000000000000
RDX: 0000800000000000 RSI: 0000000000000000 RDI: ffffc7fffffff000

which is due to the fact we are trying to access a PFN that is not
accessible to us. The reason (at least in this case) was that
PGD[256] is set to __HYPERVISOR_VIRT_START which was setup (by the
hypervisor) to point to a read-only linear map of the MFN->PFN array.
During our parsing we would get the MFN (a valid one), try to look
it up in the MFN->PFN tree and find it invalid and return ~0 as PFN.
Then pte_mfn_to_pfn would happilly feed that in, attach the flags
and return it back to the caller. 'ptdump_show' bitshifts it and
gets and invalid value that it tries to dereference.

Instead of doing all of that, we detect the ~0 case and just
return !_PAGE_PRESENT.

This bug has been in existence .. at least until 2.6.37 (yikes!)

Signed-off-by: Konrad Rzeszutek Wilk <>
Signed-off-by: Ben Hutchings <>
9 years agodrm/i915: Do no set Stencil Cache eviction LRA w/a on gen7+
Daniel Vetter [Sun, 6 May 2012 14:50:24 +0000 (16:50 +0200)]
drm/i915: Do no set Stencil Cache eviction LRA w/a on gen7+

commit 2e7a44814d802c8ba479164b8924070cd908d6b5 upstream.

I've flagged this while reviewing the first version and Ken Graunke
fixed it up in v2, but unfortunately Dave Airlie picked up the wrong

Cc: Dave Airlie <>
Cc: Kenneth Graunke <>
Signed-Off-by: Daniel Vetter <>
Signed-off-by: Ben Hutchings <>
9 years agodrm/i915: disable sdvo hotplug on i945g/gm
Daniel Vetter [Fri, 4 May 2012 09:29:56 +0000 (11:29 +0200)]
drm/i915: disable sdvo hotplug on i945g/gm

commit 768b107e4b3be0acf6f58e914afe4f337c00932b upstream.

Chris Wilson dug out a hw erratum saying that there's noise on the
interrupt line on i945G chips. We also have a bug report from a i945GM
chip with an sdvo hotplug interrupt storm (and no apparent cause).

Play it safe and disable sdvo hotplug on all i945 variants.

Note that this is a regression that has been introduced in 3.1,
when we've enabled sdvo hotplug support with

commit cc68c81aed7d892deaf12d720d5455208e94cd0a
Author: Simon Farnsworth <>
Date:   Wed Sep 21 17:13:30 2011 +0100

    drm/i915: Enable SDVO hotplug interrupts for HDMI and DVI

Reported-and-tested-by: Dominik Köppl <>
Reviewed-by: Chris Wilson <>
Signed-Off-by: Daniel Vetter <>
Signed-off-by: Ben Hutchings <>
9 years agoARM: 7414/1: SMP: prevent use of the console when using idmap_pgd
Colin Cross [Sat, 5 May 2012 19:58:13 +0000 (20:58 +0100)]
ARM: 7414/1: SMP: prevent use of the console when using idmap_pgd

commit fde165b2a29673aabf18ceff14dea1f1cfb0daad upstream.

Commit 4e8ee7de227e3ab9a72040b448ad728c5428a042 (ARM: SMP: use
idmap_pgd for mapping MMU enable during secondary booting)
switched secondary boot to use idmap_pgd, which is initialized
during early_initcall, instead of a page table initialized during
__cpu_up.  This causes idmap_pgd to contain the static mappings
but be missing all dynamic mappings.

If a console is registered that creates a dynamic mapping, the
printk in secondary_start_kernel will trigger a data abort on
the missing mapping before the exception handlers have been
initialized, leading to a hang.  Initial boot is not affected
because no consoles have been registered, and resume is usually
not affected because the offending console is suspended.
Onlining a cpu with hotplug triggers the problem.

A workaround is to the printk in secondary_start_kernel until
after the page tables have been switched back to init_mm.

Signed-off-by: Colin Cross <>
Signed-off-by: Russell King <>
Signed-off-by: Ben Hutchings <>
9 years agoARM: 7410/1: Add extra clobber registers for assembly in kernel_execve
Tim Bird [Wed, 2 May 2012 21:55:39 +0000 (22:55 +0100)]
ARM: 7410/1: Add extra clobber registers for assembly in kernel_execve

commit e787ec1376e862fcea1bfd523feb7c5fb43ecdb9 upstream.

The inline assembly in kernel_execve() uses r8 and r9.  Since this
code sequence does not return, it usually doesn't matter if the
register clobber list is accurate.  However, I saw a case where a
particular version of gcc used r8 as an intermediate for the value
eventually passed to r9.  Because r8 is used in the inline
assembly, and not mentioned in the clobber list, r9 was set
to an incorrect value.

This resulted in a kernel panic on execution of the first user-space
program in the system.  r9 is used in ret_to_user as the thread_info
pointer, and if it's wrong, bad things happen.

Signed-off-by: Tim Bird <>
Signed-off-by: Russell King <>
Signed-off-by: Ben Hutchings <>
9 years agox86, relocs: Remove an unused variable
Kusanagi Kouichi [Sun, 1 Apr 2012 08:29:32 +0000 (17:29 +0900)]
x86, relocs: Remove an unused variable

commit 7c77cda0fe742ed07622827ce80963bbeebd1e3f upstream.

sh_symtab is set but not used.

[ hpa: putting this in urgent because of the sheer harmlessness of the patch:
  it quiets a build warning but does not change any generated code. ]

Signed-off-by: Kusanagi Kouichi <>
Signed-off-by: H. Peter Anvin <>
Signed-off-by: Ben Hutchings <>
9 years agoasm-generic: Use __BITS_PER_LONG in statfs.h
H. Peter Anvin [Thu, 26 Apr 2012 18:45:16 +0000 (11:45 -0700)]
asm-generic: Use __BITS_PER_LONG in statfs.h

commit f5c2347ee20a8d6964d6a6b1ad04f200f8d4dfa7 upstream.

<asm-generic/statfs.h> is exported to userspace, so using
BITS_PER_LONG is invalid.  We need to use __BITS_PER_LONG instead.

This is kernel bugzilla 43165.

Reported-by: H.J. Lu <>
Signed-off-by: H. Peter Anvin <>
Acked-by: Arnd Bergmann <>
Signed-off-by: Ben Hutchings <>
9 years agoASoC: tlv312aic23: unbreak resume
Eric Bénard [Sun, 29 Apr 2012 15:37:57 +0000 (17:37 +0200)]
ASoC: tlv312aic23: unbreak resume

commit e875c1e3e758447ba81ca450d89434b3b0496d37 upstream.

* commit f9dfbf9 "ASoC: tlv320aic23: convert to soc-cache" leads to
a bug preventing resumeof the codec as regmap expects a 9 bits data
register but 0xFFFF is passed in tlv320aic23_set_bias_level and this
values gets cached preventing any write to the TLV320AIC23_PWR
register as the final value produced by regmap is (register << 9) | value

* this patch solves the problem by only working on the 9 bits the
register contains.

Signed-off-by: Eric Bénard <>
Signed-off-by: Mark Brown <>
Signed-off-by: Ben Hutchings <>
9 years agohfsplus: Fix potential buffer overflows
Greg Kroah-Hartman [Fri, 4 May 2012 19:09:39 +0000 (12:09 -0700)]
hfsplus: Fix potential buffer overflows

commit 6f24f892871acc47b40dd594c63606a17c714f77 upstream.

Commit ec81aecb2966 ("hfs: fix a potential buffer overflow") fixed a few
potential buffer overflows in the hfs filesystem.  But as Timo Warns
pointed out, these changes also need to be made on the hfsplus
filesystem as well.

Reported-by: Timo Warns <>
Acked-by: WANG Cong <>
Cc: Alexey Khoroshilov <>
Cc: Miklos Szeredi <>
Cc: Sage Weil <>
Cc: Eugene Teo <>
Cc: Roman Zippel <>
Cc: Al Viro <>
Cc: Christoph Hellwig <>
Cc: Alexey Dobriyan <>
Cc: Dave Anderson <>
Cc: Andrew Morton <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Ben Hutchings <>
9 years agoiwlwifi: fix hardware queue programming
Johannes Berg [Mon, 23 Apr 2012 21:17:50 +0000 (14:17 -0700)]
iwlwifi: fix hardware queue programming

commit 5ef4acd58ab2abd0dd0c8e3cacd61a0dc5d73646 upstream.

Newer devices have 20 (5000 series) or 30 (6000 series)
hardware queues, rather than the 16 that 4965 had. This
was added to the driver a long time ago, but improperly:
the queue registers for the higher queues aren't just
continuations of the registers for the first 16 queues,
they are in other places. Therefore, the hardware would
lock up when trying to activate queue 16 or above and
the device would have to be restarted.

Thanks goes to Emmanuel who identified this and told me
how the queue programming should be done.

Note that we don't use queues 20 and higher today and
doing so needs more work than this.

Signed-off-by: Johannes Berg <>
Signed-off-by: Wey-Yi Guy <>
Signed-off-by: John W. Linville <>
Signed-off-by: Ben Hutchings <>
9 years agoiwlwifi: do not nulify ctx->vif on reset
Stanislaw Gruszka [Wed, 18 Apr 2012 15:01:15 +0000 (08:01 -0700)]
iwlwifi: do not nulify ctx->vif on reset

commit 8db4c7e25d153fb049e81715d72fa3be3a0c3b69 upstream.

ctx->vif is dereferenced in different part of iwlwifi code, so do not
nullify it.

This should address at least one of the possible reasons of WARNING at
iwlagn_mac_remove_interface, and perhaps some random crashes when
firmware reset is performed.

Signed-off-by: Stanislaw Gruszka <>
Signed-off-by: Wey-Yi Guy <>
Signed-off-by: John W. Linville <>
[bwh: Backported to 3.2:
 - Change filename iwl-mac80211.c to iwl-core.c
 - Change context in iwlagn_prepare_restart()]
Signed-off-by: Ben Hutchings <>
9 years agowl1251: fix crash on remove due to leftover work item
Grazvydas Ignotas [Thu, 26 Apr 2012 20:07:44 +0000 (23:07 +0300)]
wl1251: fix crash on remove due to leftover work item

commit 4c1bcdb5a3354b250b82a67549f57ac27a3bb85f upstream.

This driver currently leaves elp_work behind when stopping, which
occasionally results in data corruption because work function ends
up accessing freed memory, typical symptoms of this are various
worker_thread crashes. Fix it by cancelling elp_work.

Signed-off-by: Grazvydas Ignotas <>
Signed-off-by: John W. Linville <>
Signed-off-by: Ben Hutchings <>
9 years agowl1251: fix crash on remove due to premature kfree
Grazvydas Ignotas [Thu, 26 Apr 2012 20:07:43 +0000 (23:07 +0300)]
wl1251: fix crash on remove due to premature kfree

commit 328c32f0f85467af5a6c4c3289e168d9ad2555af upstream.

Currently SDIO glue frees it's own structure before calling
wl1251_free_hw(), which in turn calls ieee80211_unregister_hw().
The later call may result in a need to communicate with the chip
to stop it (as it happens now if the interface is still up before
rmmod), which means calls are made back to the glue, resulting in
freed memory access.

Fix this by freeing glue data last.

Signed-off-by: Grazvydas Ignotas <>
Signed-off-by: John W. Linville <>
Signed-off-by: Ben Hutchings <>
9 years agortlwifi: Fix oops on unload
Larry Finger [Fri, 20 Apr 2012 02:39:06 +0000 (21:39 -0500)]
rtlwifi: Fix oops on unload

commit 44eb65cfd8da4b9c231238998729e858e963a980 upstream.

Under some circumstances, a PCI-based driver reports the following OOPs:

Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Oops: 0000 [#1] SMP
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Pid: 19627, comm: rmmod
Not tainted 3.2.9-2.fc16.x86_64 #1 LENOVO 05962RU/05962RU
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] RIP:
0010:[<ffffffffa0418d39>]  [<ffffffffa0418d39>]
rtl92ce_get_desc+0x19/0xd0 [rtl8192ce]
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Process rmmod (pid:
19627, threadinfo ffff880050262000, task ffff8801156d5cc0)
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Stack:
Mar 19 08:14:35 kvothe kernel: [ 6584.626011]  0000000000000002
ffff8801176c2540 ffff880050263ca8 ffffffffa03348e7
Mar 19 08:14:35 kvothe kernel: [ 6584.626011]  0000000000000282
0000000180150014 ffff880050263fd8 ffff8801176c2810
Mar 19 08:14:35 kvothe kernel: [ 6584.626011]  ffff880050263bc8
ffffffff810550e2 00000000000002c0 ffff8801176c0d40
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Call Trace:
Mar 19 08:14:35 kvothe kernel: [ 6584.626011]  [<ffffffffa03348e7>]
_rtl_pci_rx_interrupt+0x187/0x650 [rtlwifi]
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Code: ff 09 d0 89 07 48
83 c4 08 5b 5d c3 66 0f 1f 44 00 00 55 48 89 e5 53 48 83 ec 08 66 66
66 66 90 40 84 f6 89 d3 74 13 84 d2 75 57 <8b> 07 48 83 c4 08 5b 5d c1
e8 1f c3 0f 1f 00 84 d2 74 ed 80 fa
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] RIP
[<ffffffffa0418d39>] rtl92ce_get_desc+0x19/0xd0 [rtl8192ce]
Mar 19 08:14:35 kvothe kernel: [ 6584.626011]  RSP <ffff880050263b58>
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] CR2: 00000000000006e0
Mar 19 08:14:35 kvothe kernel: [ 6584.646491] ---[ end trace
8636c766dcfbe0e6 ]---

This oops is due to interrupts not being disabled in this particular path.

Reported-by: Dave Airlie <>
Tested-by: Dave Airlie <>
Signed-off-by: Larry Finger <>
Signed-off-by: John W. Linville <>
Signed-off-by: Ben Hutchings <>
9 years agomac80211: fix AP mode EAP tx for VLAN stations
Felix Fietkau [Sun, 29 Apr 2012 13:44:16 +0000 (15:44 +0200)]
mac80211: fix AP mode EAP tx for VLAN stations

commit 66f2c99af3d6f2d0aa1120884cf1c60613ef61c0 upstream.

EAP frames for stations in an AP VLAN are sent on the main AP interface
to avoid race conditions wrt. moving stations.
For that to work properly, sta_info_get_bss must be used instead of
sta_info_get when sending EAP packets.
Previously this was only done for cooked monitor injected packets, so
this patch adds a check for tx->skb->protocol to the same place.

Signed-off-by: Felix Fietkau <>
Signed-off-by: John W. Linville <>
Signed-off-by: Ben Hutchings <>
9 years agoipw2200: Fix race condition in the command completion acknowledge
Stanislav Yakovlev [Thu, 19 Apr 2012 19:55:09 +0000 (15:55 -0400)]
ipw2200: Fix race condition in the command completion acknowledge

commit dd447319895d0c0af423e483d9b63f84f3f8869a upstream.

Driver incorrectly validates command completion: instead of waiting
for a command to be acknowledged it continues execution.  Most of the
time driver gets acknowledge of the command completion in a tasklet
before it executes the next one. But sometimes it sends the next
command before it gets acknowledge for the previous one. In such a
case one of the following error messages appear in the log:

Failed to send SYSTEM_CONFIG: Already sending a command.
Failed to send ASSOCIATE: Already sending a command.
Failed to send TX_POWER: Already sending a command.

After that you need to reload the driver to get it working again.

This bug occurs during roaming (reported by Sam Varshavchik)
and machine booting (reported by Tom Gundersen and Mads Kiilerich)

This patch doesn't fix the delay issue during firmware load.
But at least device now works as usual after boot.

Signed-off-by: Stanislav Yakovlev <>
Signed-off-by: John W. Linville <>
Signed-off-by: Ben Hutchings <>
9 years agoi2c: pnx: Disable clk in suspend
Roland Stigge [Wed, 4 Apr 2012 08:34:37 +0000 (10:34 +0200)]
i2c: pnx: Disable clk in suspend

commit 6c557cfee08751d22aed34840f389b846f0f4508 upstream.

In the driver's suspend function, clk_enable() was used instead of
clk_disable(). This is corrected with this patch.

Signed-off-by: Roland Stigge <>
Reviewed-by: Arnd Bergmann <>
[wsa: reworded commit header slightly]

Signed-off-by: Wolfram Sang <>
Signed-off-by: Ben Hutchings <>
9 years agob43: only reload config after successful initialization
Seth Forshee [Wed, 25 Apr 2012 22:28:00 +0000 (17:28 -0500)]
b43: only reload config after successful initialization

commit dbdedbdf4fbff3d4962a0786f37aa86dfdc48a7e upstream.

Commit 2a19032 (b43: reload phy and bss settings after core restarts)
introduced an unconditional call to b43_op_config() at the end of
b43_op_start(). When firmware fails to load this can wedge the system.
There's no need to reload the configuration after a failed
initialization anyway, so only make the call if initialization was

Cc: Felix Fietkau <>
Signed-off-by: Seth Forshee <>
Signed-off-by: John W. Linville <>
Signed-off-by: Ben Hutchings <>
9 years agolibata: skip old error history when counting probe trials
Lin Ming [Thu, 3 May 2012 14:15:07 +0000 (22:15 +0800)]
libata: skip old error history when counting probe trials

commit 6868225e3e92399068be9a5f1635752d91012ad5 upstream.

Commit d902747("[libata] Add ATA transport class") introduced
ATA_EFLAG_OLD_ER to mark entries in the error ring as cleared.

But ata_count_probe_trials_cb() didn't check this flag and it still
counts the old error history. So wrong probe trials count is returned
and it causes problem, for example, SATA link speed is slowed down from
3.0Gbps to 1.5Gbps.

Fix it by checking ATA_EFLAG_OLD_ER in ata_count_probe_trials_cb().

Signed-off-by: Lin Ming <>
Signed-off-by: Jeff Garzik <>
Signed-off-by: Ben Hutchings <>
9 years agohwmon: (coretemp) fix oops on cpu unplug
Kirill A. Shutemov [Mon, 30 Apr 2012 13:18:01 +0000 (09:18 -0400)]
hwmon: (coretemp) fix oops on cpu unplug

commit b704871124b477807966f06789c2b32f2de58bf7 upstream.

coretemp tries to access core_data array beyond bounds on cpu unplug if
core id of the cpu if more than NUM_REAL_CORES-1.

BUG: unable to handle kernel NULL pointer dereference at 000000000000013c
IP: [<ffffffffa00159af>] coretemp_cpu_callback+0x93/0x1ba [coretemp]
PGD 673e5a067 PUD 66e9b3067 PMD 0
Oops: 0000 [#1] SMP
CPU 79
Modules linked in: sunrpc cpufreq_ondemand acpi_cpufreq freq_table mperf bnep bluetooth rfkill ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter nf_conntrack_ipv4 nf_defrag_ipv4 ip6_tables xt_state nf_conntrack coretemp crc32c_intel asix tpm_tis pcspkr usbnet iTCO_wdt i2c_i801 microcode mii joydev tpm i2c_core iTCO_vendor_support tpm_bios i7core_edac igb ioatdma edac_core dca megaraid_sas [last unloaded: oprofile]

Pid: 3315, comm: set-cpus Tainted: G        W    3.4.0-rc5+ #2 QCI QSSC-S4R/QSSC-S4R
RIP: 0010:[<ffffffffa00159af>]  [<ffffffffa00159af>] coretemp_cpu_callback+0x93/0x1ba [coretemp]
RSP: 0018:ffff880472fb3d48  EFLAGS: 00010246
RAX: 0000000000000124 RBX: 0000000000000034 RCX: 00000000ffffffff
RDX: 0000000000000000 RSI: 0000000000000046 RDI: 0000000000000246
RBP: ffff880472fb3d88 R08: ffff88077fcd36c0 R09: 0000000000000001
R10: ffffffff8184bc48 R11: 0000000000000000 R12: ffff880273095800
R13: 0000000000000013 R14: ffff8802730a1810 R15: 0000000000000000
FS:  00007f694a20f720(0000) GS:ffff88077fcc0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 000000000000013c CR3: 000000067209b000 CR4: 00000000000007e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process set-cpus (pid: 3315, threadinfo ffff880472fb2000, task ffff880471fa0000)
 ffff880277b4c308 0000000000000003 ffff880472fb3d88 0000000000000005
 0000000000000034 00000000ffffffd1 ffffffff81cadc70 ffff880472fb3e14
 ffff880472fb3dc8 ffffffff8161f48d ffff880471fa0000 0000000000000034
Call Trace:
 [<ffffffff8161f48d>] notifier_call_chain+0x4d/0x70
 [<ffffffff8107f1be>] __raw_notifier_call_chain+0xe/0x10
 [<ffffffff81059d30>] __cpu_notify+0x20/0x40
 [<ffffffff815fa251>] _cpu_down+0x81/0x270
 [<ffffffff815fa477>] cpu_down+0x37/0x50
 [<ffffffff815fd6a3>] store_online+0x63/0xc0
 [<ffffffff813c7078>] dev_attr_store+0x18/0x30
 [<ffffffff811f02cf>] sysfs_write_file+0xef/0x170
 [<ffffffff81180443>] vfs_write+0xb3/0x180
 [<ffffffff8118076a>] sys_write+0x4a/0x90
 [<ffffffff816236a9>] system_call_fastpath+0x16/0x1b
Code: 48 c7 c7 94 60 01 a0 44 0f b7 ac 10 ac 00 00 00 31 c0 e8 41 b7 5f e1 41 83 c5 02 49 63 c5 49 8b 44 c4 10 48 85 c0 74 56 45 31 ff <39> 58 18 75 4e eb 1f 49 63 d7 4c 89 f7 48 89 45 c8 48 6b d2 28
RIP  [<ffffffffa00159af>] coretemp_cpu_callback+0x93/0x1ba [coretemp]
 RSP <ffff880472fb3d48>
CR2: 000000000000013c

Signed-off-by: Kirill A. Shutemov <>
Signed-off-by: Guenter Roeck <>
Signed-off-by: Ben Hutchings <>
9 years agonouveau: initialise has_optimus variable.
Dave Airlie [Wed, 2 May 2012 19:26:24 +0000 (20:26 +0100)]
nouveau: initialise has_optimus variable.

commit addde4ec31456c5f1e9b61aae3edcfeb0f338f87 upstream.

We should initialise this to 0 really to avoid getting false positives.

Signed-off-by: Dave Airlie <>
Signed-off-by: Ben Hutchings <>
9 years agohwmon: (coretemp) Increase CPU core limit
Guenter Roeck [Tue, 1 May 2012 15:15:42 +0000 (08:15 -0700)]
hwmon: (coretemp) Increase CPU core limit

commit bdc71c9a87b898e4c380c23b2e3e18071312ecde upstream.

CPU core ID is used to index the core_data[] array. The core ID is, however, not
sequential; 10-core CPUS can have a core ID as high as 25. Increase the limit to
32 to be able to deal with current CPUs.

Signed-off-by: Guenter Roeck <>
Acked-by: Jean Delvare <>
Acked-by: Durgadoss R <>
Signed-off-by: Ben Hutchings <>
9 years agoFix __read_seqcount_begin() to use ACCESS_ONCE for sequence value read
Linus Torvalds [Fri, 4 May 2012 21:46:02 +0000 (14:46 -0700)]
Fix __read_seqcount_begin() to use ACCESS_ONCE for sequence value read

commit 2f624278626677bfaf73fef97f86b37981621f5c upstream.

We really need to use a ACCESS_ONCE() on the sequence value read in
__read_seqcount_begin(), because otherwise the compiler might end up
reloading the value in between the test and the return of it.  As a
result, it might end up returning an odd value (which means that a write
is in progress).

If the reader is then fast enough that that odd value is still the
current one when the read_seqcount_retry() is done, we might end up with
a "successful" read sequence, even despite the concurrent write being

In practice this probably never really happens - there just isn't
anything else going on around the read of the sequence count, and the
common case is that we end up having a read barrier immediately

So the code sequence in which gcc might decide to reaload from memory is
small, and there's no reason to believe it would ever actually do the
reload.  But if the compiler ever were to decide to do so, it would be
incredibly annoying to debug.  Let's just make sure.

Signed-off-by: Linus Torvalds <>
Signed-off-by: Ben Hutchings <>
9 years agofs/cifs: fix parsing of dfs referrals
Stefan Metzmacher [Thu, 3 May 2012 22:19:28 +0000 (00:19 +0200)]
fs/cifs: fix parsing of dfs referrals

commit d8f2799b105a24bb0bbd3380a0d56e6348484058 upstream.

The problem was that the first referral was parsed more than once
and so the caller tried the same referrals multiple times.

The problem was introduced partly by commit
where 'ref += le16_to_cpu(ref->Size);' got lost,
but that was also wrong...

Signed-off-by: Stefan Metzmacher <>
Tested-by: Björn Jacke <>
Reviewed-by: Jeff Layton <>
Signed-off-by: Steve French <>
[bwh: Backport to 3.2: adjust context]
Signed-off-by: Ben Hutchings <>
9 years agoefivars: Improve variable validation
Matthew Garrett [Thu, 3 May 2012 20:50:46 +0000 (16:50 -0400)]
efivars: Improve variable validation

commit 54b3a4d311c98ad94b737802a8b5f2c8c6bfd627 upstream.

Ben Hutchings pointed out that the validation in efivars was inadequate -
most obviously, an entry with size 0 would server as a DoS against the
kernel. Improve this based on his suggestions.

Signed-off-by: Matthew Garrett <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Ben Hutchings <>
9 years agosched: Fix nohz load accounting -- again!
Peter Zijlstra [Thu, 1 Mar 2012 14:04:46 +0000 (15:04 +0100)]
sched: Fix nohz load accounting -- again!

commit c308b56b5398779cd3da0f62ab26b0453494c3d4 upstream.

Various people reported nohz load tracking still being wrecked, but Doug
spotted the actual problem. We fold the nohz remainder in too soon,
causing us to loose samples and under-account.

So instead of playing catch-up up-front, always do a single load-fold
with whatever state we encounter and only then fold the nohz remainder
and play catch-up.

Reported-by: Doug Smythies <>
Reported-by: LesÅ=82aw Kope=C4=87 <>
Reported-by: Aman Gupta <>
Signed-off-by: Peter Zijlstra <>
Signed-off-by: Ingo Molnar <>
[bwh: Backported to 3.2: change filename]
Signed-off-by: Ben Hutchings <>
9 years agodrm/i915: enable dip before writing data on gen4
Paulo Zanoni [Thu, 3 May 2012 01:55:43 +0000 (22:55 -0300)]
drm/i915: enable dip before writing data on gen4

commit c1230df7e19e0f27655c0eb9d966c7e03be7cc50 upstream.

While testing with the intel_infoframes tool on gen4, I see that when
video DIP is disabled, what we write to the DATA memory is not exactly
what we read back later.

This regression has been introduce in

commit 64a8fc0145a1d0fdc25fc9367c2e6c621955fb3b
Author: Jesse Barnes <>
Date:   Thu Sep 22 11:16:00 2011 +0530

    drm/i915: fix ILK+ infoframe support

That commit was setting VIDEO_DIP_CTL to 0 when initializing, which
caused the problem.

Tested-by: Yang Guang <>
Signed-off-by: Paulo Zanoni <>
Reviewed-by: Eugeni Dodonov <>
[danvet: Pimped commit message by using the usual commit citation
Signed-off-by: Daniel Vetter <>
Signed-off-by: Ben Hutchings <>
9 years agoPM / Hibernate: fix the number of pages used for hibernate/thaw buffering
Bojan Smojver [Tue, 24 Apr 2012 21:53:28 +0000 (23:53 +0200)]
PM / Hibernate: fix the number of pages used for hibernate/thaw buffering

commit f8262d476823a7ea1eb497ff9676d1eab2393c75 upstream.

Hibernation regression fix, since 3.2.

Calculate the number of required free pages based on non-high memory
pages only, because that is where the buffers will come from.

Commit 081a9d043c983f161b78fdc4671324d1342b86bc introduced a new buffer
page allocation logic during hibernation, in order to improve the
performance. The amount of pages allocated was calculated based on total
amount of pages available, although only non-high memory pages are
usable for this purpose. This caused hibernation code to attempt to over
allocate pages on platforms that have high memory, which led to hangs.

Signed-off-by: Bojan Smojver <>
Signed-off-by: Rafael J. Wysocki <>
Signed-off-by: Ben Hutchings <>
9 years agoefi: Validate UEFI boot variables
Matthew Garrett [Mon, 30 Apr 2012 20:11:30 +0000 (16:11 -0400)]
efi: Validate UEFI boot variables

commit fec6c20b570bcf541e581fc97f2e0cbdb9725b98 upstream.

A common flaw in UEFI systems is a refusal to POST triggered by a malformed
boot variable. Once in this state, machines may only be restored by
reflashing their firmware with an external hardware device. While this is
obviously a firmware bug, the serious nature of the outcome suggests that
operating systems should filter their variable writes in order to prevent
a malicious user from rendering the machine unusable.

Signed-off-by: Matthew Garrett <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Ben Hutchings <>
9 years agoefi: Add new variable attributes
Matthew Garrett [Mon, 30 Apr 2012 20:11:29 +0000 (16:11 -0400)]
efi: Add new variable attributes

commit 41b3254c93acc56adc3c4477fef7c9512d47659e upstream.

More recent versions of the UEFI spec have added new attributes for
variables. Add them.

Signed-off-by: Matthew Garrett <>
Signed-off-by: Linus Torvalds <>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <>
9 years agolibsas: fix false positive 'device attached' conditions
Dan Williams [Tue, 20 Mar 2012 17:50:27 +0000 (10:50 -0700)]
libsas: fix false positive 'device attached' conditions

commit 7d1d865181185bdf1316d236b1b4bd02c9020729 upstream.

Normalize phy->attached_sas_addr to return a zero-address in the case
when device-type == NO_DEVICE or the linkrate is invalid to handle
expanders that put non-zero sas addresses in the discovery response:

 sas: ex 5001b4da000f903f phy02:U:0 attached: 0100000000000000 (no device)
 sas: ex 5001b4da000f903f phy01:U:0 attached: 0100000000000000 (no device)
 sas: ex 5001b4da000f903f phy03:U:0 attached: 0100000000000000 (no device)
 sas: ex 5001b4da000f903f phy00:U:0 attached: 0100000000000000 (no device)

Reported-by: Andrzej Jakowski <>
Signed-off-by: Dan Williams <>
Signed-off-by: James Bottomley <>
Signed-off-by: Ben Hutchings <>
9 years agolibsas: fix sas_find_bcast_phy() in the presence of 'vacant' phys
Thomas Jackson [Sat, 18 Feb 2012 02:33:10 +0000 (18:33 -0800)]
libsas: fix sas_find_bcast_phy() in the presence of 'vacant' phys

commit 1699490db339e2c6b3037ea8e7dcd6b2755b688e upstream.

If an expander reports 'PHY VACANT' for a phy index prior to the one
that generated a BCN libsas fails rediscovery.  Since a vacant phy is
defined as a valid phy index that will never have an attached device
just continue the search.

Signed-off-by: Thomas Jackson <>
Signed-off-by: Dan Williams <>
Signed-off-by: James Bottomley <>
Signed-off-by: Ben Hutchings <>
9 years agoARM: 7406/1: hotplug: copy the affinity mask when forcefully migrating IRQs
Will Deacon [Fri, 27 Apr 2012 11:56:24 +0000 (12:56 +0100)]
ARM: 7406/1: hotplug: copy the affinity mask when forcefully migrating IRQs

commit 5e7371ded05adfcfcee44a8bc070bfc37979b8f2 upstream.

When a CPU is hotplugged off, we migrate any IRQs currently affine to it
away and onto another online CPU by calling the irq_set_affinity
function of the relevant interrupt controller chip. This function
returns either IRQ_SET_MASK_OK or IRQ_SET_MASK_OK_NOCOPY, to indicate
whether irq_data.affinity was updated.

If we are forcefully migrating an interrupt (because the affinity mask
no longer identifies any online CPUs) then we should update the IRQ
affinity mask to reflect the new CPU set. Failure to do so can
potentially leave /proc/irq/n/smp_affinity identifying only offline
CPUs, which may confuse userspace IRQ balancing daemons.

This patch updates migrate_one_irq to copy the affinity mask when
the interrupt chip returns IRQ_SET_MASK_OK after forcefully changing the
affinity of an interrupt.

Reported-by: Leif Lindholm <>
Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Ben Hutchings <>
9 years agoARM: 7403/1: tls: remove covert channel via TPIDRURW
Will Deacon [Fri, 27 Apr 2012 11:45:07 +0000 (12:45 +0100)]
ARM: 7403/1: tls: remove covert channel via TPIDRURW

commit 6a1c53124aa161eb624ce7b1e40ade728186d34c upstream.

TPIDRURW is a user read/write register forming part of the group of
thread registers in more recent versions of the ARM architecture (~v6+).

Currently, the kernel does not touch this register, which allows tasks
to communicate covertly by reading and writing to the register without
context-switching affecting its contents.

This patch clears TPIDRURW when TPIDRURO is updated via the set_tls
macro, which is called directly from __switch_to. Since the current
behaviour makes the register useless to userspace as far as thread
pointers are concerned, simply clearing the register (rather than saving
and restoring it) will not cause any problems to userspace.

Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Ben Hutchings <>