9 years agobuilddeb: Don't create files in /tmp with predictable names
Ben Hutchings [Wed, 15 Feb 2012 14:17:29 +0000 (14:17 +0000)]
builddeb: Don't create files in /tmp with predictable names

commit 6c635224602d760c1208ada337562f40d8ae93a5 upstream.

The current use of /tmp for file lists is insecure.  Put them under
$objtree/debian instead.

Signed-off-by: Ben Hutchings <>
Acked-by: maximilian attems <>
Signed-off-by: Michal Marek <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodavinci_emac: Do not free all rx dma descriptors during init
Christian Riesch [Thu, 23 Feb 2012 01:14:17 +0000 (01:14 +0000)]
davinci_emac: Do not free all rx dma descriptors during init

commit 5d69703263d588dbb03f4e57091afd8942d96e6d upstream.

This patch fixes a regression that was introduced by

commit 0a5f38467765ee15478db90d81e40c269c8dda20
davinci_emac: Add Carrier Link OK check in Davinci RX Handler

Said commit adds a check whether the carrier link is ok. If the link is
not ok, the skb is freed and no new dma descriptor added to the rx dma
channel. This causes trouble during initialization when the carrier
status has not yet been updated. If a lot of packets are received while
netif_carrier_ok returns false, all dma descriptors are freed and the
rx dma transfer is stopped.

The bug occurs when the board is connected to a network with lots of
traffic and the ifconfig down/up is done, e.g., when reconfiguring
the interface with DHCP.

The bug can be reproduced by flood pinging the davinci board while doing
ifconfig eth0 down
ifconfig eth0 up
on the board.

After that, the rx path stops working and the overrun value reported
by ifconfig is counting up.

This patch reverts commit 0a5f38467765ee15478db90d81e40c269c8dda20
and instead issues warnings only if cpdma_chan_submit returns -ENOMEM.

Signed-off-by: Christian Riesch <>
Cc: Cyril Chemparathy <>
Cc: Sascha Hauer <>
Tested-by: Rajashekhara, Sudhakar <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agojme: Fix FIFO flush issue
Guo-Fu Tseng [Wed, 22 Feb 2012 08:58:10 +0000 (08:58 +0000)]
jme: Fix FIFO flush issue

commit ba9adbe67e288823ac1deb7f11576ab5653f833e upstream.

Set the RX FIFO flush watermark lower.
According to Federico and JMicron's reply,
setting it to 16QW would be stable on most platforms.
Otherwise, user might experience packet drop issue.

Reported-by: Federico Quagliata <>
Fixed-by: Federico Quagliata <>
Signed-off-by: Guo-Fu Tseng <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoipvs: fix matching of fwmark templates during scheduling
Simon Horman [Fri, 27 Jan 2012 01:45:27 +0000 (10:45 +0900)]
ipvs: fix matching of fwmark templates during scheduling

commit e0aac52e17a3db68fe2ceae281780a70fc69957f upstream.

Commit f11017ec2d1859c661f4e2b12c4a8d250e1f47cf (2.6.37)
moved the fwmark variable in subcontext that is invalidated before
reaching the ip_vs_ct_in_get call. As vaddr is provided as pointer
in the param structure make sure the fwmark variable is in
same context. As the fwmark templates can not be matched,
more and more template connections are created and the
controlled connections can not go to single real server.

Signed-off-by: Julian Anastasov <>
Signed-off-by: Simon Horman <>
Signed-off-by: Pablo Neira Ayuso <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoscsi_pm: Fix bug in the SCSI power management handler
Alan Stern [Fri, 17 Feb 2012 21:25:08 +0000 (16:25 -0500)]
scsi_pm: Fix bug in the SCSI power management handler

commit fea6d607e154cf96ab22254ccb48addfd43d4cb5 upstream.

This patch (as1520) fixes a bug in the SCSI layer's power management

LUN scanning can be carried out asynchronously in do_scan_async(), and
sd uses an asynchronous thread for the time-consuming parts of disk
probing in sd_probe_async().  Currently nothing coordinates these
async threads with system sleep transitions; they can and do attempt
to continue scanning/probing SCSI devices even after the host adapter
has been suspended.  As one might expect, the outcome is not ideal.

This is what the "prepare" stage of system suspend was created for.
After the prepare callback has been called for a host, target, or
device, drivers are not allowed to register any children underneath
them.  Currently the SCSI prepare callback is not implemented; this
patch rectifies that omission.

For SCSI hosts, the prepare routine calls scsi_complete_async_scans()
to wait until async scanning is finished.  It might be slightly more
efficient to wait only until the host in question has been scanned,
but there's currently no way to do that.  Besides, during a sleep
transition we will ultimately have to wait until all the host scanning
has finished anyway.

For SCSI devices, the prepare routine calls async_synchronize_full()
to wait until sd probing is finished.  The routine does nothing for
SCSI targets, because asynchronous target scanning is done only as
part of host scanning.

Signed-off-by: Alan Stern <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoscsi_scan: Fix 'Poison overwritten' warning caused by using freed 'shost'
Huajun Li [Sun, 12 Feb 2012 11:59:14 +0000 (19:59 +0800)]
scsi_scan: Fix 'Poison overwritten' warning caused by using freed 'shost'

commit 267a6ad4aefaafbde607804c60945bcf97f91c1b upstream.

In do_scan_async(), calling scsi_autopm_put_host(shost) may reference
freed shost, and cause Posison overwitten warning.
Yes, this case can happen, for example, an USB is disconnected just
when do_scan_async() thread starts to run, then scsi_host_put() called
in scsi_finish_async_scan() will lead to shost be freed(because the
refcount of shost->shost_gendev decreases to 1 after USB disconnects),
at this point, if references shost again, system will show following
warning msg.

To make scsi_autopm_put_host(shost) always reference a valid shost,
put it just before scsi_host_put() in function

[  299.281565] =============================================================================
[  299.281634] BUG kmalloc-4096 (Tainted: G          I ): Poison overwritten
[  299.281682] -----------------------------------------------------------------------------
[  299.281684]
[  299.281752] INFO: 0xffff880056c305d0-0xffff880056c305d0. First byte
0x6a instead of 0x6b
[  299.281816] INFO: Allocated in scsi_host_alloc+0x4a/0x490 age=1688
cpu=1 pid=2004
[  299.281870]  __slab_alloc+0x617/0x6c1
[  299.281901]  __kmalloc+0x28c/0x2e0
[  299.281931]  scsi_host_alloc+0x4a/0x490
[  299.281966]  usb_stor_probe1+0x5b/0xc40 [usb_storage]
[  299.282010]  storage_probe+0xa4/0xe0 [usb_storage]
[  299.282062]  usb_probe_interface+0x172/0x330 [usbcore]
[  299.282105]  driver_probe_device+0x257/0x3b0
[  299.282138]  __driver_attach+0x103/0x110
[  299.282171]  bus_for_each_dev+0x8e/0xe0
[  299.282201]  driver_attach+0x26/0x30
[  299.282230]  bus_add_driver+0x1c4/0x430
[  299.282260]  driver_register+0xb6/0x230
[  299.282298]  usb_register_driver+0xe5/0x270 [usbcore]
[  299.282337]  0xffffffffa04ab03d
[  299.282364]  do_one_initcall+0x47/0x230
[  299.282396]  sys_init_module+0xa0f/0x1fe0
[  299.282429] INFO: Freed in scsi_host_dev_release+0x18a/0x1d0 age=85
cpu=0 pid=2008
[  299.282482]  __slab_free+0x3c/0x2a1
[  299.282510]  kfree+0x296/0x310
[  299.282536]  scsi_host_dev_release+0x18a/0x1d0
[  299.282574]  device_release+0x74/0x100
[  299.282606]  kobject_release+0xc7/0x2a0
[  299.282637]  kobject_put+0x54/0xa0
[  299.282668]  put_device+0x27/0x40
[  299.282694]  scsi_host_put+0x1d/0x30
[  299.282723]  do_scan_async+0x1fc/0x2b0
[  299.282753]  kthread+0xdf/0xf0
[  299.282782]  kernel_thread_helper+0x4/0x10
[  299.282817] INFO: Slab 0xffffea00015b0c00 objects=7 used=7 fp=0x
      (null) flags=0x100000000004080
[  299.282882] INFO: Object 0xffff880056c30000 @offset=0 fp=0x          (null)
[  299.282884]

Signed-off-by: Huajun Li <>
Acked-by: Alan Stern <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agogenirq: Handle pending irqs in irq_startup()
Thomas Gleixner [Wed, 8 Feb 2012 10:57:52 +0000 (11:57 +0100)]
genirq: Handle pending irqs in irq_startup()

commit b4bc724e82e80478cba5fe9825b62e71ddf78757 upstream.

An interrupt might be pending when irq_startup() is called, but the
startup code does not invoke the resend logic. In some cases this
prevents the device from issuing another interrupt which renders the
device non functional.

Call the resend function in irq_startup() to keep things going.

Reported-and-tested-by: Russell King <>
Signed-off-by: Thomas Gleixner <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agogenirq: Unmask oneshot irqs when thread was not woken
Thomas Gleixner [Tue, 7 Feb 2012 16:58:03 +0000 (17:58 +0100)]
genirq: Unmask oneshot irqs when thread was not woken

commit ac5637611150281f398bb7a47e3fcb69a09e7803 upstream.

When the primary handler of an interrupt which is marked IRQ_ONESHOT
returns IRQ_HANDLED or IRQ_NONE, then the interrupt thread is not
woken and the unmask logic of the interrupt line is never
invoked. This keeps the interrupt masked forever.

This was not noticed as most IRQ_ONESHOT users wake the thread
unconditionally (usually because they cannot access the underlying
device from hard interrupt context). Though this behaviour was nowhere
documented and not necessarily intentional. Some drivers can avoid the
thread wakeup in certain cases and run into the situation where the
interrupt line s kept masked.

Handle it gracefully.

Reported-and-tested-by: Lothar Wassmann <>
Signed-off-by: Thomas Gleixner <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoath9k: stop on rates with idx -1 in ath9k rate control's .tx_status
Pavel Roskin [Sat, 11 Feb 2012 15:01:53 +0000 (10:01 -0500)]
ath9k: stop on rates with idx -1 in ath9k rate control's .tx_status

commit 2504a6423b9ab4c36df78227055995644de19edb upstream.

Rate control algorithms are supposed to stop processing when they
encounter a rate with the index -1.  Checking for rate->count not being
zero is not enough.

Allowing a rate with negative index leads to memory corruption in

One consequence of the bug is discussed at

Signed-off-by: Pavel Roskin <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agox86/amd: Fix L1i and L2 cache sharing information for AMD family 15h processors
Andreas Herrmann [Wed, 8 Feb 2012 19:52:29 +0000 (20:52 +0100)]
x86/amd: Fix L1i and L2 cache sharing information for AMD family 15h processors

commit 32c3233885eb10ac9cb9410f2f8cd64b8df2b2a1 upstream.

For L1 instruction cache and L2 cache the shared CPU information
is wrong. On current AMD family 15h CPUs those caches are shared
between both cores of a compute unit.

This fixes

Signed-off-by: Andreas Herrmann <>
Cc: Petkov Borislav <>
Cc: Dave Jones <>
Signed-off-by: Ingo Molnar <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: omap: fix oops in arch/arm/mach-omap2/vp.c when pmic is not found
Russell King [Tue, 7 Feb 2012 09:42:11 +0000 (09:42 +0000)]
ARM: omap: fix oops in arch/arm/mach-omap2/vp.c when pmic is not found

commit d980e0f8d858c6963d676013e976ff00ab7acb2b upstream.

When the PMIC is not found, voltdm->pmic will be NULL.  vp.c's
initialization function tries to dereferences this, which causes an

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT
Modules linked in:
CPU: 0    Not tainted  (3.3.0-rc2+ #204)
PC is at omap_vp_init+0x5c/0x15c
LR is at omap_vp_init+0x58/0x15c
pc : [<c03db880>]    lr : [<c03db87c>]    psr: 60000013
sp : c181ff30  ip : c181ff68  fp : c181ff64
r10: c0407808  r9 : c040786c  r8 : c0407814
r7 : c0026868  r6 : c00264fc  r5 : c040ad6c  r4 : 00000000
r3 : 00000040  r2 : 000032c8  r1 : 0000fa00  r0 : 000032c8
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 80004019  DAC: 00000015
Process swapper (pid: 1, stack limit = 0xc181e2e8)
Stack: (0xc181ff30 to 0xc1820000)
ff20:                                     c0381d00 c02e9c6d c0383582 c040786c
ff40: c040ad6c c00264fc c0026868 c0407814 00000000 c03d9de4 c181ff8c c181ff68
ff60: c03db448 c03db830 c02e982c c03fdfb8 c03fe004 c0039988 00000013 00000000
ff80: c181ff9c c181ff90 c03d9df8 c03db390 c181ffdc c181ffa0 c0008798 c03d9df0
ffa0: c181ffc4 c181ffb0 c0055a44 c0187050 c0039988 c03fdfb8 c03fe004 c0039988
ffc0: 00000013 00000000 00000000 00000000 c181fff4 c181ffe0 c03d1284 c0008708
ffe0: 00000000 c03d1208 00000000 c181fff8 c0039988 c03d1214 1077ce40 01f7ee08
[<c03db824>] (omap_vp_init+0x0/0x15c) from [<c03db448>] (omap_voltage_late_init+0xc4/0xfc)
[<c03db384>] (omap_voltage_late_init+0x0/0xfc) from [<c03d9df8>] (omap2_common_pm_late_init+0x14/0x54)
 r8:00000000 r7:00000013 r6:c0039988 r5:c03fe004 r4:c03fdfb8
[<c03d9de4>] (omap2_common_pm_late_init+0x0/0x54) from [<c0008798>] (do_one_initcall+0x9c/0x164)
[<c00086fc>] (do_one_initcall+0x0/0x164) from [<c03d1284>] (kernel_init+0x7c/0x120)
[<c03d1208>] (kernel_init+0x0/0x120) from [<c0039988>] (do_exit+0x0/0x2cc)
 r5:c03d1208 r4:00000000
Code: e5ca300b e5900034 ebf69027 e5994024 (e5941000)
---[ end trace aed617dddaf32c3d ]---
Kernel panic - not syncing: Attempted to kill init!

Signed-off-by: Russell King <>
Cc: Igor Grinberg <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: omap: fix oops in drivers/video/omap2/dss/dpi.c
Russell King [Tue, 7 Feb 2012 09:44:55 +0000 (09:44 +0000)]
ARM: omap: fix oops in drivers/video/omap2/dss/dpi.c

commit 40410715715178ec196314dd0c19150c06901f80 upstream.

When a PMIC is not found, this driver is unable to obtain its
'vdds_dsi_reg' regulator.  Even through its initialization function
fails, other code still calls its enable function, which fails to
check whether it has this regulator before asking for it to be enabled.

This fixes the oops, however a better fix would be to sort out the
upper layers to prevent them calling into a module which failed to

Unable to handle kernel NULL pointer dereference at virtual address 00000038
pgd = c0004000
[00000038] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT
Modules linked in:
CPU: 0    Not tainted  (3.3.0-rc2+ #228)
PC is at regulator_enable+0x10/0x70
LR is at omapdss_dpi_display_enable+0x54/0x15c
pc : [<c01b9a08>]    lr : [<c01af994>]    psr: 60000013
sp : c181fd90  ip : c181fdb0  fp : c181fdac
r10: c042eff0  r9 : 00000060  r8 : c044a164
r7 : c042c0e4  r6 : c042bd60  r5 : 00000000  r4 : c042bd60
r3 : c084de48  r2 : c181e000  r1 : c042bd60  r0 : 00000000
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 80004019  DAC: 00000015
Process swapper (pid: 1, stack limit = 0xc181e2e8)
Stack: (0xc181fd90 to 0xc1820000)
fd80:                                     c001754c c042bd60 00000000 c042bd60
fda0: c181fdcc c181fdb0 c01af994 c01b9a04 c0016104 c042bd60 c042bd60 c044a338
fdc0: c181fdec c181fdd0 c01b5ed0 c01af94c c042bd60 c042bd60 c1aa8000 c1aa8a0c
fde0: c181fe04 c181fdf0 c01b5f54 c01b5ea8 c02fc18c c042bd60 c181fe3c c181fe08
fe00: c01b2a18 c01b5f48 c01aed14 c02fc160 c01df8ec 00000002 c042bd60 00000003
fe20: c042bd60 c1aa8000 c1aa8a0c c042eff8 c181fe84 c181fe40 c01b3874 c01b29fc
fe40: c042eff8 00000000 c042f000 c0449db8 c044ed78 00000000 c181fe74 c042eff8
fe60: c042eff8 c0449db8 c0449db8 c044ed78 00000000 00000000 c181fe94 c181fe88
fe80: c01e452c c01b35e8 c181feb4 c181fe98 c01e2fdc c01e4518 c042eff8 c0449db8
fea0: c0449db8 c181fef0 c181fecc c181feb8 c01e3104 c01e2f48 c042eff8 c042f02c
fec0: c181feec c181fed0 c01e3190 c01e30c0 c01e311c 00000000 c01e311c c0449db8
fee0: c181ff14 c181fef0 c01e1998 c01e3128 c18330a8 c1892290 c04165e8 c0449db8
ff00: c0449db8 c1ab60c0 c181ff24 c181ff18 c01e2e28 c01e194c c181ff54 c181ff28
ff20: c01e2218 c01e2e14 c039afed c181ff38 c04165e8 c041660c c0449db8 00000013
ff40: 00000000 c03ffdb8 c181ff7c c181ff58 c01e384c c01e217c c181ff7c c04165e8
ff60: c041660c c003a37c 00000013 00000000 c181ff8c c181ff80 c01e488c c01e3790
ff80: c181ff9c c181ff90 c03ffdcc c01e484c c181ffdc c181ffa0 c0008798 c03ffdc4
ffa0: c181ffc4 c181ffb0 c0056440 c0187810 c003a37c c04165e8 c041660c c003a37c
ffc0: 00000013 00000000 00000000 00000000 c181fff4 c181ffe0 c03ea284 c0008708
ffe0: 00000000 c03ea208 00000000 c181fff8 c003a37c c03ea214 1073cec0 01f7ee08
[<c01b99f8>] (regulator_enable+0x0/0x70) from [<c01af994>] (omapdss_dpi_display_enable+0x54/0x15c)
 r6:c042bd60 r5:00000000 r4:c042bd60
[<c01af940>] (omapdss_dpi_display_enable+0x0/0x15c) from [<c01b5ed0>] (generic_dpi_panel_power_on+0x34/0x78)
 r6:c044a338 r5:c042bd60 r4:c042bd60
[<c01b5e9c>] (generic_dpi_panel_power_on+0x0/0x78) from [<c01b5f54>] (generic_dpi_panel_enable+0x18/0x28)
 r7:c1aa8a0c r6:c1aa8000 r5:c042bd60 r4:c042bd60
[<c01b5f3c>] (generic_dpi_panel_enable+0x0/0x28) from [<c01b2a18>] (omapfb_init_display+0x28/0x150)
[<c01b29f0>] (omapfb_init_display+0x0/0x150) from [<c01b3874>] (omapfb_probe+0x298/0x318)
 r8:c042eff8 r7:c1aa8a0c r6:c1aa8000 r5:c042bd60 r4:00000003
[<c01b35dc>] (omapfb_probe+0x0/0x318) from [<c01e452c>] (platform_drv_probe+0x20/0x24)
[<c01e450c>] (platform_drv_probe+0x0/0x24) from [<c01e2fdc>] (really_probe+0xa0/0x178)
[<c01e2f3c>] (really_probe+0x0/0x178) from [<c01e3104>] (driver_probe_device+0x50/0x68)
 r7:c181fef0 r6:c0449db8 r5:c0449db8 r4:c042eff8
[<c01e30b4>] (driver_probe_device+0x0/0x68) from [<c01e3190>] (__driver_attach+0x74/0x98)
 r5:c042f02c r4:c042eff8
[<c01e311c>] (__driver_attach+0x0/0x98) from [<c01e1998>] (bus_for_each_dev+0x58/0x98)
 r6:c0449db8 r5:c01e311c r4:00000000
[<c01e1940>] (bus_for_each_dev+0x0/0x98) from [<c01e2e28>] (driver_attach+0x20/0x28)
 r7:c1ab60c0 r6:c0449db8 r5:c0449db8 r4:c04165e8
[<c01e2e08>] (driver_attach+0x0/0x28) from [<c01e2218>] (bus_add_driver+0xa8/0x22c)
[<c01e2170>] (bus_add_driver+0x0/0x22c) from [<c01e384c>] (driver_register+0xc8/0x154)
[<c01e3784>] (driver_register+0x0/0x154) from [<c01e488c>] (platform_driver_register+0x4c/0x60)
 r8:00000000 r7:00000013 r6:c003a37c r5:c041660c r4:c04165e8
[<c01e4840>] (platform_driver_register+0x0/0x60) from [<c03ffdcc>] (omapfb_init+0x14/0x34)
[<c03ffdb8>] (omapfb_init+0x0/0x34) from [<c0008798>] (do_one_initcall+0x9c/0x164)
[<c00086fc>] (do_one_initcall+0x0/0x164) from [<c03ea284>] (kernel_init+0x7c/0x120)
[<c03ea208>] (kernel_init+0x0/0x120) from [<c003a37c>] (do_exit+0x0/0x2d8)
 r5:c03ea208 r4:00000000
Code: e1a0c00d e92dd870 e24cb004 e24dd004 (e5906038)
---[ end trace 9e2474c2e193b223 ]---

Acked-by: Tony Lindgren <>
Signed-off-by: Russell King <>
Cc: Igor Grinberg <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (ads1015) Fix file leak in probe function
Guenter Roeck [Wed, 22 Feb 2012 16:13:52 +0000 (08:13 -0800)]
hwmon: (ads1015) Fix file leak in probe function

commit 363434b5dc352464ac7601547891e5fc9105f124 upstream.

An error while creating sysfs attribute files in the driver's probe function
results in an error abort, but already created files are not removed. This patch
fixes the problem.

Signed-off-by: Guenter Roeck <>
Cc: Dirk Eibach <>
Acked-by: Jean Delvare <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (max6639) Fix PPR register initialization to set both channels
Chris D Schimp [Mon, 20 Feb 2012 22:44:59 +0000 (17:44 -0500)]
hwmon: (max6639) Fix PPR register initialization to set both channels

commit 2f2da1ac0ba5b6cc6e1957c4da5ff20e67d8442b upstream.

Initialize PPR register for both channels, and set correct PPR register bits.
Also remove unnecessary variable initializations.

Signed-off-by: Chris D Schimp <>
[ Merged two patches into one]
Signed-off-by: Guenter Roeck <>
Acked-by: Roland Stigge <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (max6639) Fix FAN_FROM_REG calculation
Chris D Schimp [Mon, 20 Feb 2012 21:59:24 +0000 (16:59 -0500)]
hwmon: (max6639) Fix FAN_FROM_REG calculation

commit b63d97a36edb1aecf8c13e5f5783feff4d64c24b upstream.

RPM calculation from tachometer value does not depend on PPR.
Also, do not report negative RPM values.

Signed-off-by: Chris D Schimp <>
[ do not report negative RPM values]
Signed-off-by: Guenter Roeck <>
Acked-by: Roland Stigge <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoNOMMU: Lock i_mmap_mutex for access to the VMA prio list
David Howells [Thu, 23 Feb 2012 13:50:35 +0000 (13:50 +0000)]
NOMMU: Lock i_mmap_mutex for access to the VMA prio list

commit 918e556ec214ed2f584e4cac56d7b29e4bb6bf27 upstream.

Lock i_mmap_mutex for access to the VMA prio list to prevent concurrent
access.  Currently, certain parts of the mmap handling are protected by
the region mutex, but not all.

Reported-by: Al Viro <>
Signed-off-by: David Howells <>
Acked-by: Al Viro <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoALSA: hda/realtek - Fix surround output regression on Acer Aspire 5935
Takashi Iwai [Fri, 17 Feb 2012 09:12:38 +0000 (10:12 +0100)]
ALSA: hda/realtek - Fix surround output regression on Acer Aspire 5935

commit ef8d60fb79614a86a82720dc2402631dbcafb315 upstream.

The previous fix for the speaker on Acer Aspire 59135 introduced
another problem for surround outputs.  It changed the connections on
the line-in/mic pins for limiting the routes, but it left the modified
connections.  Thus wrong connection indices were written when set to
4ch or 6ch mode.

This patch fixes it by restoring the right connections just after
parsing the tree but before the initialization.


Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoALSA: hda/realtek - Fix overflow of vol/sw check bitmap
Takashi Iwai [Thu, 16 Feb 2012 15:38:07 +0000 (16:38 +0100)]
ALSA: hda/realtek - Fix overflow of vol/sw check bitmap

commit c14c95f62ecb8710af14ae0d48e01991b70bb6f4 upstream.

The bitmap introduced in the commit [527e4d73: ALSA: hda/realtek - Fix
missing volume controls with ALC260] is too narrow for some codecs,
which may have more NIDs than 0x20, thus it may overflow the bitmap
array on them.

Just double the number to cover all and also add a sanity-check code
to be safer.

Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoASoC: wm8962: Fix sidetone enumeration texts
Mark Brown [Tue, 14 Feb 2012 06:00:47 +0000 (22:00 -0800)]
ASoC: wm8962: Fix sidetone enumeration texts

commit 31794bc37bf2db84f085da52b72bfba65739b2d2 upstream.

The sidetone enumeration texts have left and right swapped.

Signed-off-by: Mark Brown <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agotarget: Allow control CDBs with data > 1 page
Andy Grover [Tue, 17 Jan 2012 00:57:08 +0000 (16:57 -0800)]
target: Allow control CDBs with data > 1 page

commit 4949314c7283ea4f9ade182ca599583b89f7edd6 upstream.

We need to handle >1 page control cdbs, so extend the code to do a vmap
if bigger than 1 page. It seems like kmap() is still preferable if just
a page, fewer TLB shootdowns(?), so keep using that when possible.

Rename function pair for their new scope.

Signed-off-by: Andy Grover <>
Signed-off-by: Nicholas Bellinger <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agousb-storage: fix freezing of the scanning thread
Alan Stern [Tue, 21 Feb 2012 18:16:32 +0000 (13:16 -0500)]
usb-storage: fix freezing of the scanning thread

commit bb94a406682770a35305daaa241ccdb7cab399de upstream.

This patch (as1521b) fixes the interaction between usb-storage's
scanning thread and the freezer.  The current implementation has a
race: If the device is unplugged shortly after being plugged in and
just as a system sleep begins, the scanning thread may get frozen
before the khubd task.  Khubd won't be able to freeze until the
disconnect processing is complete, and the disconnect processing can't
proceed until the scanning thread finishes, so the sleep transition
will fail.

The implementation in the 3.2 kernel suffers from an additional
problem.  There the scanning thread calls set_freezable_with_signal(),
and the signals sent by the freezer will mess up the thread's I/O
delays, which are all interruptible.

The solution to both problems is the same: Replace the kernel thread
used for scanning with a delayed-work routine on the system freezable
work queue.  Freezable work queues have the nice property that you can
cancel a work item even while the work queue is frozen, and no signals
are needed.

The 3.2 version of this patch solves the problem in Bugzilla #42730.

Signed-off-by: Alan Stern <>
Acked-by: Seth Forshee <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoUSB: Set hub depth after USB3 hub reset
Elric Fu [Sat, 18 Feb 2012 05:32:27 +0000 (13:32 +0800)]
USB: Set hub depth after USB3 hub reset

commit a45aa3b30583e7d54e7cf4fbcd0aa699348a6e5c upstream.

The superspeed device attached to a USB 3.0 hub(such as VIA's)
doesn't respond the address device command after resume. The
root cause is the superspeed hub will miss the Hub Depth value
that is used as an offset into the route string to locate the
bits it uses to determine the downstream port number after
reset, and all packets can't be routed to the device attached
to the superspeed hub.

Hub driver sends a Set Hub Depth request to the superspeed hub
except for USB 3.0 root hub when the hub is initialized and
doesn't send the request again after reset due to the resume
process. So moving the code that sends the Set Hub Depth request
to the superspeed hub from hub_configure() to hub_activate()
is to cover those situations include initialization and reset.

The patch should be backported to kernels as old as 2.6.39.

Signed-off-by: Elric Fu <>
Signed-off-by: Sarah Sharp <>
Acked-by: Alan Stern <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoUSB: Don't fail USB3 probe on missing legacy PCI IRQ.
Sarah Sharp [Tue, 14 Feb 2012 00:25:57 +0000 (16:25 -0800)]
USB: Don't fail USB3 probe on missing legacy PCI IRQ.

commit 68d07f64b8a11a852d48d1b05b724c3e20c0d94b upstream.

Intel has a PCI USB xhci host controller on a new platform. It doesn't
have a line IRQ definition in BIOS.  The Linux driver refuses to
initialize this controller, but Windows works well because it only depends
on MSI.

Actually, Linux also can work for MSI.  This patch avoids the line IRQ
checking for USB3 HCDs in usb core PCI probe.  It allows the xHCI driver
to try to enable MSI or MSI-X first.  It will fail the probe if MSI
enabling failed and there's no legacy PCI IRQ.

This patch should be backported to kernels as old as 2.6.32.

Signed-off-by: Alex Shi <>
Signed-off-by: Sarah Sharp <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoxhci: Fix encoding for HS bulk/control NAK rate.
Sarah Sharp [Mon, 13 Feb 2012 22:42:11 +0000 (14:42 -0800)]
xhci: Fix encoding for HS bulk/control NAK rate.

commit 340a3504fd39dad753ba908fb6f894ee81fc3ae2 upstream.

The xHCI 0.96 spec says that HS bulk and control endpoint NAK rate must
be encoded as an exponent of two number of microframes.  The endpoint
descriptor has the NAK rate encoded in number of microframes.  We were
just copying the value from the endpoint descriptor into the endpoint
context interval field, which was not correct.  This lead to the VIA
host rejecting the add of a bulk OUT endpoint from any USB 2.0 mass
storage device.

The fix is to use the correct encoding.  Refactor the code to convert
number of frames to an exponential number of microframes, and make sure
we convert the number of microframes in HS bulk and control endpoints to
an exponent.

This should be back ported to kernels as old as 2.6.31, that contain the
commit dfa49c4ad120a784ef1ff0717168aa79f55a483a "USB: xhci - fix math
in xhci_get_endpoint_interval"

Signed-off-by: Sarah Sharp <>
Tested-by: Felipe Contreras <>
Suggested-by: Andiry Xu <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoxhci: Fix oops caused by more USB2 ports than USB3 ports.
Sarah Sharp [Thu, 9 Feb 2012 22:43:44 +0000 (14:43 -0800)]
xhci: Fix oops caused by more USB2 ports than USB3 ports.

commit 3278a55a1aebe2bbd47fbb5196209e5326a88b56 upstream.

The code to set the device removable bits in the USB 2.0 roothub
descriptor was accidentally looking at the USB 3.0 port registers
instead of the USB 2.0 registers.  This can cause an oops if there are
more USB 2.0 registers than USB 3.0 registers.

This should be backported to kernels as old as 2.6.39, that contain the
commit 4bbb0ace9a3de8392527e3c87926309d541d3b00 "xhci: Return a USB 3.0
hub descriptor for USB3 roothub."

Signed-off-by: Sarah Sharp <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoUSB: Fix handoff when BIOS disables host PCI device.
Sarah Sharp [Tue, 7 Feb 2012 23:11:46 +0000 (15:11 -0800)]
USB: Fix handoff when BIOS disables host PCI device.

commit cab928ee1f221c9cc48d6615070fefe2e444384a upstream.

On some systems with an Intel Panther Point xHCI host controller, the
BIOS disables the xHCI PCI device during boot, and switches the xHCI
ports over to EHCI.  This allows the BIOS to access USB devices without
having xHCI support.

The downside is that the xHCI BIOS handoff mechanism will fail because
memory mapped I/O is not enabled for the disabled PCI device.
Jesse Barnes says this is expected behavior.  The PCI core will enable
BARs before quirks run, but it will leave it in an undefined state, and
it may not have memory mapped I/O enabled.

Make the generic USB quirk handler call pci_enable_device() to re-enable
MMIO, and call pci_disable_device() once the host-specific BIOS handoff
is finished.  This will balance the ref counts in the PCI core.  When
the PCI probe function is called, usb_hcd_pci_probe() will call
pci_enable_device() again.

This should be back ported to kernels as old as 2.6.31.  That was the
first kernel with xHCI support, and no one has complained about BIOS
handoffs failing due to memory mapped I/O being disabled on other hosts

Signed-off-by: Sarah Sharp <>
Acked-by: Oliver Neukum <>
Cc: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoUSB: Remove duplicate USB 3.0 hub feature #defines.
Sarah Sharp [Fri, 6 Jan 2012 00:28:54 +0000 (16:28 -0800)]
USB: Remove duplicate USB 3.0 hub feature #defines.

commit d9f5343e35d9138432657202afa8e3ddb2ade360 upstream.

Somehow we ended up with duplicate hub feature #defines in ch11.h.
Tatyana Brokhman first created the USB 3.0 hub feature macros in 2.6.38
with commit 0eadcc09203349b11ca477ec367079b23d32ab91 "usb: USB3.0 ch11
definitions".  In 2.6.39, I modified a patch from John Youn that added
similar macros in a different place in the same file, and committed
dbe79bbe9dcb22cb3651c46f18943477141ca452 "USB 3.0 Hub Changes".

Some of the #defines used different names for the same values.  Others
used exactly the same names with the same values, like these gems:

 #define USB_PORT_FEAT_BH_PORT_RESET            28

According to my very geeky husband (who looked it up in the C99 spec),
it is allowed to have object-like macros with duplicate names as long as
the replacement list is exactly the same.  However, he recalled that
some compilers will give warnings when they find duplicate macros.  It's
probably best to remove the duplicates in the stable tree, so that the
code compiles for everyone.

The macros are now fixed to move the feature requests that are specific
to USB 3.0 hubs into a new section (out of the USB 2.0 hub feature
section), and use the most common macro name.

This patch should be backported to 2.6.39.

Signed-off-by: Sarah Sharp <>
Cc: Tatyana Brokhman <>
Cc: John Youn <>
Cc: Jamey Sharp <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoUSB: Serial: ti_usb_3410_5052: Add Abbot Diabetes Care cable id
Andrew Lunn [Mon, 20 Feb 2012 08:31:57 +0000 (09:31 +0100)]
USB: Serial: ti_usb_3410_5052: Add Abbot Diabetes Care cable id

commit 7fd25702ba616d9ba56e2a625472f29e5aff25ee upstream.

This USB-serial cable with mini stereo jack enumerates as:
Bus 001 Device 004: ID 1a61:3410 Abbott Diabetes Care

It is a TI3410 inside.

Signed-off-by: Andrew Lunn <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoUSB: option: cleanup zte 3g-dongle's pid in option.c
Rui li [Tue, 14 Feb 2012 02:35:01 +0000 (10:35 +0800)]
USB: option: cleanup zte 3g-dongle's pid in option.c

commit b9e44fe5ecda4158c22bc1ea4bffa378a4f83f65 upstream.

  1. Remove all old mass-storage ids's pid:
  2. As the pid from 0x1401 to 0x1510 which have not surely assigned to
     use for serial-port or mass-storage port,so i think it should be
     removed now, and will re-add after it have assigned in future;
  3. sort the pid to WCDMA and CDMA.

Signed-off-by: Rui li <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoUSB: Added Kamstrup VID/PIDs to cp210x serial driver.
Bruno Thomsen [Tue, 21 Feb 2012 22:41:37 +0000 (23:41 +0100)]
USB: Added Kamstrup VID/PIDs to cp210x serial driver.

commit c6c1e4491dc8d1ed2509fa6aacffa7f34614fc38 upstream.

Signed-off-by: Bruno Thomsen <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agotcp: fix tcp_shifted_skb() adjustment of lost_cnt_hint for FACK
Neal Cardwell [Mon, 13 Feb 2012 20:22:08 +0000 (20:22 +0000)]
tcp: fix tcp_shifted_skb() adjustment of lost_cnt_hint for FACK

[ Upstream commit 0af2a0d0576205dda778d25c6c344fc6508fc81d ]

This commit ensures that lost_cnt_hint is correctly updated in
tcp_shifted_skb() for FACK TCP senders. The lost_cnt_hint adjustment
in tcp_sacktag_one() only applies to non-FACK senders, so FACK senders
need their own adjustment.

This applies the spirit of 1e5289e121372a3494402b1b131b41bfe1cf9b7f -
except now that the sequence range passed into tcp_sacktag_one() is
correct we need only have a special case adjustment for FACK.

Signed-off-by: Neal Cardwell <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agotcp: fix range tcp_shifted_skb() passes to tcp_sacktag_one()
Neal Cardwell [Sun, 12 Feb 2012 18:37:10 +0000 (18:37 +0000)]
tcp: fix range tcp_shifted_skb() passes to tcp_sacktag_one()

[ Upstream commit daef52bab1fd26e24e8e9578f8fb33ba1d0cb412 ]

Fix the newly-SACKed range to be the range of newly-shifted bytes.

Previously - since 832d11c5cd076abc0aa1eaf7be96c81d1a59ce41 -
tcp_shifted_skb() incorrectly called tcp_sacktag_one() with the start
and end sequence numbers of the skb it passes in set to the range just
beyond the range that is newly-SACKed.

This commit also removes a special-case adjustment to lost_cnt_hint in
tcp_shifted_skb() since the pre-existing adjustment of lost_cnt_hint
in tcp_sacktag_one() now properly handles this things now that the
correct start sequence number is passed in.

Signed-off-by: Neal Cardwell <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agotcp: allow tcp_sacktag_one() to tag ranges not aligned with skbs
Neal Cardwell [Sun, 12 Feb 2012 18:37:09 +0000 (18:37 +0000)]
tcp: allow tcp_sacktag_one() to tag ranges not aligned with skbs

[ Upstream commit cc9a672ee522d4805495b98680f4a3db5d0a0af9 ]

This commit allows callers of tcp_sacktag_one() to pass in sequence
ranges that do not align with skb boundaries, as tcp_shifted_skb()
needs to do in an upcoming fix in this patch series.

In fact, now tcp_sacktag_one() does not need to depend on an input skb
at all, which makes its semantics and dependencies more clear.

Signed-off-by: Neal Cardwell <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agogro: more generic L2 header check
Eric Dumazet [Wed, 8 Feb 2012 08:51:50 +0000 (08:51 +0000)]
gro: more generic L2 header check

[ Upstream commit 5ca3b72c5da47d95b83857b768def6172fbc080a ]

Shlomo Pongratz reported GRO L2 header check was suited for Ethernet
only, and failed on IB/ipoib traffic.

He provided a patch faking a zeroed header to let GRO aggregates frames.

Roland Dreier, Herbert Xu, and others suggested we change GRO L2 header
check to be more generic, ie not assuming L2 header is 14 bytes, but
taking into account hard_header_len.

__napi_gro_receive() has special handling for the common case (Ethernet)
to avoid a memcmp() call and use an inline optimized function instead.

Signed-off-by: Eric Dumazet <>
Reported-by: Shlomo Pongratz <>
Cc: Roland Dreier <>
Cc: Or Gerlitz <>
Cc: Herbert Xu <>
Tested-by: Sean Hefty <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoIPoIB: Stop lying about hard_header_len and use skb->cb to stash LL addresses
Roland Dreier [Tue, 7 Feb 2012 14:51:21 +0000 (14:51 +0000)]
IPoIB: Stop lying about hard_header_len and use skb->cb to stash LL addresses

[ Upstream commit 936d7de3d736e0737542641269436f4b5968e9ef ]

Commit a0417fa3a18a ("net: Make qdisc_skb_cb upper size bound
explicit.") made it possible for a netdev driver to use skb->cb
between its header_ops.create method and its .ndo_start_xmit
method.  Use this in ipoib_hard_header() to stash away the LL address
(GID + QPN), instead of the "ipoib_pseudoheader" hack.  This allows
IPoIB to stop lying about its hard_header_len, which will let us fix
the L2 check for GRO.

Signed-off-by: Roland Dreier <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agonet: Make qdisc_skb_cb upper size bound explicit.
David S. Miller [Mon, 6 Feb 2012 20:14:37 +0000 (15:14 -0500)]
net: Make qdisc_skb_cb upper size bound explicit.

[ Upstream commit 16bda13d90c8d5da243e2cfa1677e62ecce26860 ]

Just like skb->cb[], so that qdisc_skb_cb can be encapsulated inside
of other data structures.

This is intended to be used by IPoIB so that it can remember
addressing information stored at hard_header_ops->create() time that
it can fetch when the packet gets to the transmit routine.

Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoipv4: Fix wrong order of ip_rt_get_source() and update iph->daddr.
Li Wei [Thu, 9 Feb 2012 21:15:25 +0000 (21:15 +0000)]
ipv4: Fix wrong order of ip_rt_get_source() and update iph->daddr.

[ Upstream commit 5dc7883f2a7c25f8df40d7479687153558cd531b ]

This patch fix a bug which introduced by commit ac8a4810 (ipv4: Save
nexthop address of LSRR/SSRR option to IPCB.).In that patch, we saved
the nexthop of SRR in ip_option->nexthop and update iph->daddr until
we get to ip_forward_options(), but we need to update it before
ip_rt_get_source(), otherwise we may get a wrong src.

Signed-off-by: Li Wei <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agotcp_v4_send_reset: binding oif to iif in no sock case
Shawn Lu [Sat, 4 Feb 2012 12:38:09 +0000 (12:38 +0000)]
tcp_v4_send_reset: binding oif to iif in no sock case

[ Upstream commit e2446eaab5585555a38ea0df4e01ff313dbb4ac9 ]

Binding RST packet outgoing interface to incoming interface
for tcp v4 when there is no socket associate with it.
when sk is not NULL, using sk->sk_bound_dev_if instead.
(suggested by Eric Dumazet).

This has few benefits:
1. tcp_v6_send_reset already did that.
2. This helps tcp connect with SO_BINDTODEVICE set. When
connection is lost, we still able to sending out RST using
same interface.
3. we are sending reply, it is most likely to be succeed
if iif is used

Signed-off-by: Shawn Lu <>
Acked-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoipv4: reset flowi parameters on route connect
Julian Anastasov [Sat, 4 Feb 2012 13:04:46 +0000 (13:04 +0000)]
ipv4: reset flowi parameters on route connect

[ Upstream commit e6b45241c57a83197e5de9166b3b0d32ac562609 ]

Eric Dumazet found that commit 813b3b5db83
(ipv4: Use caller's on-stack flowi as-is in output
route lookups.) that comes in 3.0 added a regression.
The problem appears to be that resulting flowi4_oif is
used incorrectly as input parameter to some routing lookups.
The result is that when connecting to local port without
listener if the IP address that is used is not on a loopback
interface we incorrectly assign RTN_UNICAST to the output
route because no route is matched by oif=lo. The RST packet
can not be sent immediately by tcp_v4_send_reset because
it expects RTN_LOCAL.

So, change ip_route_connect and ip_route_newports to
update the flowi4 fields that are input parameters because
we do not want unnecessary binding to oif.

To make it clear what are the input parameters that
can be modified during lookup and to show which fields of
floiw4 are reused add a new function to update the flowi4
structure: flowi4_update_output.

Thanks to Yurij M. Plotnikov for providing a bug report including a
program to reproduce the problem.

Thanks to Eric Dumazet for tracking the problem down to
tcp_v4_send_reset and providing initial fix.

Reported-by: Yurij M. Plotnikov <>
Signed-off-by: Julian Anastasov <>
Acked-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agovia-velocity: S3 resume fix.
David Lv [Sat, 4 Feb 2012 23:22:26 +0000 (23:22 +0000)]
via-velocity: S3 resume fix.

[ Upstream commit b530b1930bbd9d005345133f0ff0c556d2a52b19 ]

Initially diagnosed on Ubuntu 11.04 with kernel 2.6.38.

velocity_close is not called during a suspend / resume cycle in this
driver and it has no business playing directly with power states.

Signed-off-by: David Lv <>
Acked-by: Francois Romieu <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoveth: Enforce minimum size of VETH_INFO_PEER
Hagen Paul Pfeifer [Wed, 15 Feb 2012 04:09:46 +0000 (04:09 +0000)]
veth: Enforce minimum size of VETH_INFO_PEER

[ Upstream commit 237114384ab22c174ec4641e809f8e6cbcfce774 ]

VETH_INFO_PEER carries struct ifinfomsg plus optional IFLA
attributes. A minimal size of sizeof(struct ifinfomsg) must be
enforced or we may risk accessing that struct beyond the limits
of the netlink message.

Signed-off-by: Thomas Graf <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agonet_sched: Bug in netem reordering
Hagen Paul Pfeifer [Wed, 4 Jan 2012 17:35:26 +0000 (17:35 +0000)]
net_sched: Bug in netem reordering

[ Upstream commit eb10192447370f19a215a8c2749332afa1199d46 ]

Not now, but it looks you are correct. q->qdisc is NULL until another
additional qdisc is attached (beside tfifo). See 50612537e9ab2969312.
The following patch should work.

From: Hagen Paul Pfeifer <>

netem: catch NULL pointer by updating the real qdisc statistic

Reported-by: Vijay Subramanian <>
Signed-off-by: Hagen Paul Pfeifer <>
Acked-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agonetpoll: netpoll_poll_dev() should access dev->flags
Eric Dumazet [Tue, 14 Feb 2012 10:11:59 +0000 (10:11 +0000)]
netpoll: netpoll_poll_dev() should access dev->flags

[ Upstream commit 58e05f357a039a94aa36475f8c110256f693a239 ]

commit 5a698af53f (bond: service netpoll arp queue on master device)
tested IFF_SLAVE flag against dev->priv_flags instead of dev->flags

Signed-off-by: Eric Dumazet <>
Cc: WANG Cong <>
Acked-by: Neil Horman <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agonet: Don't proxy arp respond if iif == rt-> if private VLAN is disabled
Thomas Graf [Fri, 10 Feb 2012 04:07:11 +0000 (04:07 +0000)]
net: Don't proxy arp respond if iif == rt-> if private VLAN is disabled

[ Upstream commit 70620c46ac2b45c24b0f22002fdf5ddd1f7daf81 ]

Commit 653241 (net: RFC3069, private VLAN proxy arp support) changed
the behavior of arp proxy to send arp replies back out on the interface
the request came in even if the private VLAN feature is disabled.

Previously we checked rt-> != skb->dev for in scenarios, when
proxy arp is enabled on for the netdevice and also when individual proxy
neighbour entries have been added.

This patch adds the check back for the pneigh_lookup() scenario.

Signed-off-by: Thomas Graf <>
Acked-by: Jesper Dangaard Brouer <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years ago3c59x: shorten timer period for slave devices
Eric Dumazet [Tue, 14 Feb 2012 10:27:09 +0000 (10:27 +0000)]
3c59x: shorten timer period for slave devices

[ Upstream commit 3013dc0cceb9baaf25d5624034eeaa259bf99004 ]

Jean Delvare reported bonding on top of 3c59x adapters was not detecting
network cable removal fast enough.

3c59x indeed uses a 60 seconds timer to check link status if carrier is
on, and 5 seconds if carrier is off.

This patch reduces timer period to 5 seconds if device is a bonding

Reported-by: Jean Delvare <>
Acked-by: Jean Delvare <>
Acked-by: Steffen Klassert <>
Signed-off-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7325/1: fix v7 boot with lockdep enabled
Rabin Vincent [Wed, 15 Feb 2012 15:01:42 +0000 (16:01 +0100)]
ARM: 7325/1: fix v7 boot with lockdep enabled

commit 8e43a905dd574f54c5715d978318290ceafbe275 upstream.

Bootup with lockdep enabled has been broken on v7 since b46c0f74657d
("ARM: 7321/1: cache-v7: Disable preemption when reading CCSIDR").

This is because v7_setup (which is called very early during boot) calls
v7_flush_dcache_all, and the save_and_disable_irqs added by that patch
ends up attempting to call into lockdep C code (trace_hardirqs_off())
when we are in no position to execute it (no stack, MMU off).

Fix this by using a notrace variant of save_and_disable_irqs.  The code
already uses the notrace variant of restore_irqs.

Reviewed-by: Nicolas Pitre <>
Acked-by: Stephen Boyd <>
Cc: Catalin Marinas <>
Signed-off-by: Rabin Vincent <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7321/1: cache-v7: Disable preemption when reading CCSIDR
Stephen Boyd [Tue, 7 Feb 2012 18:42:07 +0000 (19:42 +0100)]
ARM: 7321/1: cache-v7: Disable preemption when reading CCSIDR

commit b46c0f74657d1fe1c1b0c1452631cc38a9e6987f upstream.

armv7's flush_cache_all() flushes caches via set/way. To
determine the cache attributes (line size, number of sets,
etc.) the assembly first writes the CSSELR register to select a
cache level and then reads the CCSIDR register. The CSSELR register
is banked per-cpu and is used to determine which cache level CCSIDR
reads. If the task is migrated between when the CSSELR is written and
the CCSIDR is read the CCSIDR value may be for an unexpected cache
level (for example L1 instead of L2) and incorrect cache flushing
could occur.

Disable interrupts across the write and read so that the correct
cache attributes are read and used for the cache flushing
routine. We disable interrupts instead of disabling preemption
because the critical section is only 3 instructions and we want
to call v7_dcache_flush_all from __v7_setup which doesn't have a
full kernel stack with a struct thread_info.

This fixes a problem we see in scm_call() when flush_cache_all()
is called from preemptible context and sometimes the L2 cache is
not properly flushed out.

Signed-off-by: Stephen Boyd <>
Acked-by: Catalin Marinas <>
Reviewed-by: Nicolas Pitre <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoNFSv4: fix server_scope memory leak
Weston Andros Adamson [Thu, 16 Feb 2012 16:17:05 +0000 (11:17 -0500)]
NFSv4: fix server_scope memory leak

commit abe9a6d57b4544ac208401f9c0a4262814db2be4 upstream.

server_scope would never be freed if nfs4_check_cl_exchange_flags() returned

Signed-off-by: Weston Andros Adamson <>
Signed-off-by: Trond Myklebust <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoNFSv4: Ensure we throw out bad delegation stateids on NFS4ERR_BAD_STATEID
Trond Myklebust [Thu, 9 Feb 2012 20:31:36 +0000 (15:31 -0500)]
NFSv4: Ensure we throw out bad delegation stateids on NFS4ERR_BAD_STATEID

commit b9f9a03150969e4bd9967c20bce67c4de769058f upstream.

To ensure that we don't just reuse the bad delegation when we attempt to
recover the nfs4_state that received the bad stateid error.

Signed-off-by: Trond Myklebust <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoNFSv4: Fix an Oops in the NFSv4 getacl code
Trond Myklebust [Fri, 3 Feb 2012 23:30:53 +0000 (18:30 -0500)]
NFSv4: Fix an Oops in the NFSv4 getacl code

commit 331818f1c468a24e581aedcbe52af799366a9dfe upstream.

Commit bf118a342f10dafe44b14451a1392c3254629a1f (NFSv4: include bitmap
in nfsv4 get acl data) introduces the 'acl_scratch' page for the case
where we may need to decode multi-page data. However it fails to take
into account the fact that the variable may be NULL (for the case where
we're not doing multi-page decode), and it also attaches it to the
encoding xdr_stream rather than the decoding one.

The immediate result is an Oops in nfs4_xdr_enc_getacl due to the
call to page_address() with a NULL page pointer.

Signed-off-by: Trond Myklebust <>
Cc: Andy Adamson <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agommc: core: check for zero length ioctl data
Johan Rudholm [Wed, 23 Nov 2011 08:05:58 +0000 (09:05 +0100)]
mmc: core: check for zero length ioctl data

commit 4d6144de8ba263eb3691a737c547e5b2fdc45287 upstream.

If the read or write buffer size associated with the command sent
through the mmc_blk_ioctl is zero, do not prepare data buffer.

This enables a ioctl(2) call to for instance send a MMC_SWITCH to set
a byte in the ext_csd.

Signed-off-by: Johan Rudholm <>
Signed-off-by: Chris Ball <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoALSA: hda - Fix redundant jack creations for cx5051
Takashi Iwai [Wed, 22 Feb 2012 16:02:38 +0000 (17:02 +0100)]
ALSA: hda - Fix redundant jack creations for cx5051

[Note that since the patch isn't applicable (and unnecessary) to
3.3-rc, there is no corresponding upstream fix.]

The cx5051 parser calls snd_hda_input_jack_add() in the init callback
to create and initialize the jack detection instances.  Since the init
callback is called at each time when the device gets woken up after
suspend or power-saving mode, the duplicated instances are accumulated
at each call.  This ends up with the kernel warnings with the too
large array size.

The fix is simply to move the calls of snd_hda_input_jack_add() into
the parser section instead of the init callback.

The fix is needed only up to 3.2 kernel, since the HD-audio jack layer
was redesigned in the 3.3 kernel.

Reported-by: Russell King <>
Tested-by: Russell King <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7326/2: PL330: fix null pointer dereference in pl330_chan_ctrl()
Javi Merino [Wed, 15 Feb 2012 16:36:39 +0000 (17:36 +0100)]
ARM: 7326/2: PL330: fix null pointer dereference in pl330_chan_ctrl()

commit 46e33c606af8e0caeeca374103189663d877c0d6 upstream.

This fixes the thrd->req_running field being accessed before thrd
is checked for null. The error was introduced in

   abb959f: ARM: 7237/1: PL330: Fix driver freeze

Reference: <>

Signed-off-by: Mans Rullgard <>
Acked-by: Javi Merino <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agovfs: fix d_inode_lookup() dentry ref leak
Miklos Szeredi [Fri, 3 Feb 2012 13:25:18 +0000 (14:25 +0100)]
vfs: fix d_inode_lookup() dentry ref leak

commit e188dc02d3a9c911be56eca5aa114fe7e9822d53 upstream.

d_inode_lookup() leaks a dentry reference on IS_DEADDIR().

Signed-off-by: Miklos Szeredi <>
Signed-off-by: Al Viro <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoS390: correct ktime to tod clock comparator conversion
Martin Schwidefsky [Fri, 17 Feb 2012 09:29:23 +0000 (10:29 +0100)]
S390: correct ktime to tod clock comparator conversion

commit cf1eb40f8f5ea12c9e569e7282161fc7f194fd62 upstream.

The conversion of the ktime to a value suitable for the clock comparator
does not take changes to wall_to_monotonic into account. In fact the
conversion just needs the boot clock (sched_clock_base_cc) and the

This is applicable to 3.2+ kernels.

Signed-off-by: Martin Schwidefsky <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoeCryptfs: Copy up lower inode attrs after setting lower xattr
Tyler Hicks [Tue, 7 Feb 2012 23:55:40 +0000 (17:55 -0600)]
eCryptfs: Copy up lower inode attrs after setting lower xattr

commit 545d680938be1e86a6c5250701ce9abaf360c495 upstream.

After passing through a ->setxattr() call, eCryptfs needs to copy the
inode attributes from the lower inode to the eCryptfs inode, as they
may have changed in the lower filesystem's ->setxattr() path.

One example is if an extended attribute containing a POSIX Access
Control List is being set. The new ACL may cause the lower filesystem to
modify the mode of the lower inode and the eCryptfs inode would need to
be updated to reflect the new mode.

Signed-off-by: Tyler Hicks <>
Reported-by: Sebastien Bacher <>
Cc: John Johansen <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoregmap: Fix cache defaults initialization from raw cache defaults
Lars-Peter Clausen [Wed, 15 Feb 2012 09:23:25 +0000 (10:23 +0100)]
regmap: Fix cache defaults initialization from raw cache defaults

commit 61cddc57dc14a5dffa0921d9a24fd68edbb374ac upstream.

Currently registers with a value of 0 are ignored when initializing the register
defaults from raw defaults. This worked in the past, because registers without a
explicit default were assumed to have a default value of 0. This was changed in
commit b03622a8 ("regmap: Ensure rbtree syncs registers set to zero properly").
As a result registers, which have a raw default value of 0 are now assumed to
have no default. This again can result in unnecessary writes when syncing the
cache. It will also result in unnecessary reads for e.g. the first update
operation. In the case where readback is not possible this will even let the
update operation fail, if the register has not been written to before.

So this patch removes the check. Instead it adds a check to ignore raw defaults
for registers which are volatile, since those registers are not cached.

Signed-off-by: Lars-Peter Clausen <>
Signed-off-by: Mark Brown <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoipheth: Add iPhone 4S
Tim Gardner [Wed, 15 Feb 2012 07:50:15 +0000 (07:50 +0000)]
ipheth: Add iPhone 4S

commit 72ba009b8a159e995e40d3b4e5d7d265acead983 upstream.

Signed-off-by: Till Kamppeter <>
Signed-off-by: Tim Gardner <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomac80211: Fix a rwlock bad magic bug
Mohammed Shafi Shajakhan [Thu, 9 Feb 2012 14:29:43 +0000 (19:59 +0530)]
mac80211: Fix a rwlock bad magic bug

commit b57e6b560fc2a2742910ac5ca0eb2c46e45aeac2 upstream.

read_lock(&tpt_trig->trig.leddev_list_lock) is accessed via the path
ieee80211_open (->) ieee80211_do_open (->) ieee80211_mod_tpt_led_trig
(->) ieee80211_start_tpt_led_trig (->) tpt_trig_timer before initializing
the intilization of this read/write lock happens via the path
ieee80211_led_init (->) led_trigger_register, but we are doing
'ieee80211_led_init'  after 'ieeee80211_if_add' where we
register netdev_ops.
so we access leddev_list_lock before initializing it and causes the
following bug in chrome laptops with AR928X cards with the following

while true
sudo modprobe -v ath9k
sleep 3
sudo modprobe -r ath9k
sleep 3

BUG: rwlock bad magic on CPU#1, wpa_supplicant/358, f5b9eccc
Pid: 358, comm: wpa_supplicant Not tainted 3.0.13 #1
Call Trace:

[<8137b9df>] rwlock_bug+0x3d/0x47
[<81179830>] do_raw_read_lock+0x19/0x29
[<8137f063>] _raw_read_lock+0xd/0xf
[<f9081957>] tpt_trig_timer+0xc3/0x145 [mac80211]
[<f9081f3a>] ieee80211_mod_tpt_led_trig+0x152/0x174 [mac80211]
[<f9076a3f>] ieee80211_do_open+0x11e/0x42e [mac80211]
[<f9075390>] ? ieee80211_check_concurrent_iface+0x26/0x13c [mac80211]
[<f9076d97>] ieee80211_open+0x48/0x4c [mac80211]
[<812dbed8>] __dev_open+0x82/0xab
[<812dc0c9>] __dev_change_flags+0x9c/0x113
[<812dc1ae>] dev_change_flags+0x18/0x44
[<8132144f>] devinet_ioctl+0x243/0x51a
[<81321ba9>] inet_ioctl+0x93/0xac
[<812cc951>] sock_ioctl+0x1c6/0x1ea
[<812cc78b>] ? might_fault+0x20/0x20
[<810b1ebb>] do_vfs_ioctl+0x46e/0x4a2
[<810a6ebb>] ? fget_light+0x2f/0x70
[<812ce549>] ? sys_recvmsg+0x3e/0x48
[<810b1f35>] sys_ioctl+0x46/0x69
[<8137fa77>] sysenter_do_call+0x12/0x2

Cc: Gary Morain <>
Cc: Paul Stewart <>
Cc: Abhijit Pradhan <>
Cc: Vasanthakumar Thiagarajan <>
Cc: Rajkumar Manoharan <>
Acked-by: Johannes Berg <>
Tested-by: Mohammed Shafi Shajakhan <>
Signed-off-by: Mohammed Shafi Shajakhan <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoPCI: workaround hard-wired bus number V2
Yinghai Lu [Mon, 30 Jan 2012 11:25:24 +0000 (12:25 +0100)]
PCI: workaround hard-wired bus number V2

commit 71f6bd4a23130cd2f4b036010c5790b1295290b9 upstream.

Fixes PCI device detection on IBM xSeries IBM 3850 M2 / x3950 M2
when using ACPI resources (_CRS).
This is default, a manual workaround (without this patch)
would be pci=nocrs boot param.

V2: Add dev_warn if the workaround is hit. This should reveal
how common such setups are (via google) and point to possible
problems if things are still not working as expected.
-> Suggested by Jan Beulich.

Signed-off-by: Yinghai Lu <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/radeon/kms: fix MSI re-arm on rv370+
Alex Deucher [Mon, 13 Feb 2012 21:36:34 +0000 (16:36 -0500)]
drm/radeon/kms: fix MSI re-arm on rv370+

commit b7f5b7dec3d539a84734f2bcb7e53fbb1532a40b upstream.

MSI_REARM_EN register is a write only trigger register.
There is no need RMW when re-arming.

May fix:

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: at91: USB AT91 gadget registration for module
Nicolas Ferre [Fri, 27 Jan 2012 10:14:44 +0000 (11:14 +0100)]
ARM: at91: USB AT91 gadget registration for module

commit e8c9dc93e27d891636defbc269f182a83e6abba8 upstream.

Registration of at91_udc as a module will enable SoC
related code.

Fix following an idea from Karel Znamenacek.

Signed-off-by: Nicolas Ferre <>
Acked-by: Karel Znamenacek <>
Acked-by: Jean-Christophe PLAGNIOL-VILLARD <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agopowerpc/perf: power_pmu_start restores incorrect values, breaking frequency events
Anton Blanchard [Wed, 15 Feb 2012 18:48:22 +0000 (18:48 +0000)]
powerpc/perf: power_pmu_start restores incorrect values, breaking frequency events

commit 9a45a9407c69d068500923480884661e2b9cc421 upstream.

perf on POWER stopped working after commit e050e3f0a71b (perf: Fix
broken interrupt rate throttling). That patch exposed a bug in
the POWER perf_events code.

Since the PMCs count upwards and take an exception when the top bit
is set, we want to write 0x80000000 - left in power_pmu_start. We were
instead programming in left which effectively disables the counter
until we eventually hit 0x80000000. This could take seconds or longer.

With the patch applied I get the expected number of samples:

          SAMPLE events:       9948

Signed-off-by: Anton Blanchard <>
Acked-by: Paul Mackerras <>
Signed-off-by: Benjamin Herrenschmidt <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoSecurity: tomoyo: add .gitignore file
Greg Kroah-Hartman [Fri, 9 Dec 2011 19:23:46 +0000 (11:23 -0800)]
Security: tomoyo: add .gitignore file

commit 735e93c70434614bffac4a914ca1da72e37d43c0 upstream.

This adds the .gitignore file for the autogenerated TOMOYO files to keep
git from complaining after building things.

Cc: Kentaro Takeda <>
Cc: Tetsuo Handa <>
Cc: James Morris <>
Acked-by: Tetsuo Handa <>
Signed-off-by: James Morris <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoLinux 3.2.8 v3.2.8
Greg Kroah-Hartman [Mon, 27 Feb 2012 18:26:22 +0000 (10:26 -0800)]
Linux 3.2.8

9 years agoi387: re-introduce FPU state preloading at context switch time
Linus Torvalds [Sat, 18 Feb 2012 20:56:35 +0000 (12:56 -0800)]
i387: re-introduce FPU state preloading at context switch time

commit 34ddc81a230b15c0e345b6b253049db731499f7e upstream.

After all the FPU state cleanups and finally finding the problem that
caused all our FPU save/restore problems, this re-introduces the
preloading of FPU state that was removed in commit b3b0870ef3ff ("i387:
do not preload FPU state at task switch time").

However, instead of simply reverting the removal, this reimplements
preloading with several fixes, most notably

 - properly abstracted as a true FPU state switch, rather than as
   open-coded save and restore with various hacks.

   In particular, implementing it as a proper FPU state switch allows us
   to optimize the CR0.TS flag accesses: there is no reason to set the
   TS bit only to then almost immediately clear it again.  CR0 accesses
   are quite slow and expensive, don't flip the bit back and forth for
   no good reason.

 - Make sure that the same model works for both x86-32 and x86-64, so
   that there are no gratuitous differences between the two due to the
   way they save and restore segment state differently due to
   architectural differences that really don't matter to the FPU state.

 - Avoid exposing the "preload" state to the context switch routines,
   and in particular allow the concept of lazy state restore: if nothing
   else has used the FPU in the meantime, and the process is still on
   the same CPU, we can avoid restoring state from memory entirely, just
   re-expose the state that is still in the FPU unit.

   That optimized lazy restore isn't actually implemented here, but the
   infrastructure is set up for it.  Of course, older CPU's that use
   'fnsave' to save the state cannot take advantage of this, since the
   state saving also trashes the state.

In other words, there is now an actual _design_ to the FPU state saving,
rather than just random historical baggage.  Hopefully it's easier to
follow as a result.

Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoi387: move TS_USEDFPU flag from thread_info to task_struct
Linus Torvalds [Sat, 18 Feb 2012 05:48:54 +0000 (21:48 -0800)]
i387: move TS_USEDFPU flag from thread_info to task_struct

commit f94edacf998516ac9d849f7bc6949a703977a7f3 upstream.

This moves the bit that indicates whether a thread has ownership of the
FPU from the TS_USEDFPU bit in thread_info->status to a word of its own
(called 'has_fpu') in task_struct->thread.has_fpu.

This fixes two independent bugs at the same time:

 - changing 'thread_info->status' from the scheduler causes nasty
   problems for the other users of that variable, since it is defined to
   be thread-synchronous (that's what the "TS_" part of the naming was
   supposed to indicate).

   So perfectly valid code could (and did) do

ti->status |= TS_RESTORE_SIGMASK;

   and the compiler was free to do that as separate load, or and store
   instructions.  Which can cause problems with preemption, since a task
   switch could happen in between, and change the TS_USEDFPU bit. The
   change to TS_USEDFPU would be overwritten by the final store.

   In practice, this seldom happened, though, because the 'status' field
   was seldom used more than once, so gcc would generally tend to
   generate code that used a read-modify-write instruction and thus
   happened to avoid this problem - RMW instructions are naturally low
   fat and preemption-safe.

 - On x86-32, the current_thread_info() pointer would, during interrupts
   and softirqs, point to a *copy* of the real thread_info, because
   x86-32 uses %esp to calculate the thread_info address, and thus the
   separate irq (and softirq) stacks would cause these kinds of odd
   thread_info copy aliases.

   This is normally not a problem, since interrupts aren't supposed to
   look at thread information anyway (what thread is running at
   interrupt time really isn't very well-defined), but it confused the
   heck out of irq_fpu_usable() and the code that tried to squirrel
   away the FPU state.

   (It also caused untold confusion for us poor kernel developers).

It also turns out that using 'task_struct' is actually much more natural
for most of the call sites that care about the FPU state, since they
tend to work with the task struct for other reasons anyway (ie
scheduling).  And the FPU data that we are going to save/restore is
found there too.

Thanks to Arjan Van De Ven <> for pointing us to
the %esp issue.

Cc: Arjan van de Ven <>
Reported-and-tested-by: Raphael Prevost <>
Acked-and-tested-by: Suresh Siddha <>
Tested-by: Peter Anvin <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoi387: move AMD K7/K8 fpu fxsave/fxrstor workaround from save to restore
Linus Torvalds [Fri, 17 Feb 2012 03:11:15 +0000 (19:11 -0800)]
i387: move AMD K7/K8 fpu fxsave/fxrstor workaround from save to restore

commit 4903062b5485f0e2c286a23b44c9b59d9b017d53 upstream.

The AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception is
pending.  In order to not leak FIP state from one process to another, we
need to do a floating point load after the fxsave of the old process,
and before the fxrstor of the new FPU state.  That resets the state to
the (uninteresting) kernel load, rather than some potentially sensitive
user information.

We used to do this directly after the FPU state save, but that is
actually very inconvenient, since it

 (a) corrupts what is potentially perfectly good FPU state that we might
     want to lazy avoid restoring later and

 (b) on x86-64 it resulted in a very annoying ordering constraint, where
     "__unlazy_fpu()" in the task switch needs to be delayed until after
     the DS segment has been reloaded just to get the new DS value.

Coupling it to the fxrstor instead of the fxsave automatically avoids
both of these issues, and also ensures that we only do it when actually
necessary (the FP state after a save may never actually get used).  It's
simply a much more natural place for the leaked state cleanup.

Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoi387: do not preload FPU state at task switch time
Linus Torvalds [Thu, 16 Feb 2012 23:45:23 +0000 (15:45 -0800)]
i387: do not preload FPU state at task switch time

commit b3b0870ef3ffed72b92415423da864f440f57ad6 upstream.

Yes, taking the trap to re-load the FPU/MMX state is expensive, but so
is spending several days looking for a bug in the state save/restore
code.  And the preload code has some rather subtle interactions with
both paravirtualization support and segment state restore, so it's not
nearly as simple as it should be.

Also, now that we no longer necessarily depend on a single bit (ie
TS_USEDFPU) for keeping track of the state of the FPU, we migth be able
to do better.  If we are really switching between two processes that
keep touching the FP state, save/restore is inevitable, but in the case
of having one process that does most of the FPU usage, we may actually
be able to do much better than the preloading.

In particular, we may be able to keep track of which CPU the process ran
on last, and also per CPU keep track of which process' FP state that CPU
has.  For modern CPU's that don't destroy the FPU contents on save time,
that would allow us to do a lazy restore by just re-enabling the
existing FPU state - with no restore cost at all!

Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoi387: don't ever touch TS_USEDFPU directly, use helper functions
Linus Torvalds [Thu, 16 Feb 2012 21:33:12 +0000 (13:33 -0800)]
i387: don't ever touch TS_USEDFPU directly, use helper functions

commit 6d59d7a9f5b723a7ac1925c136e93ec83c0c3043 upstream.

This creates three helper functions that do the TS_USEDFPU accesses, and
makes everybody that used to do it by hand use those helpers instead.

In addition, there's a couple of helper functions for the "change both
CR0.TS and TS_USEDFPU at the same time" case, and the places that do
that together have been changed to use those.  That means that we have
fewer random places that open-code this situation.

The intent is partly to clarify the code without actually changing any
semantics yet (since we clearly still have some hard to reproduce bug in
this area), but also to make it much easier to use another approach
entirely to caching the CR0.TS bit for software accesses.

Right now we use a bit in the thread-info 'status' variable (this patch
does not change that), but we might want to make it a full field of its
own or even make it a per-cpu variable.

Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoi387: move TS_USEDFPU clearing out of __save_init_fpu and into callers
Linus Torvalds [Thu, 16 Feb 2012 20:22:48 +0000 (12:22 -0800)]
i387: move TS_USEDFPU clearing out of __save_init_fpu and into callers

commit b6c66418dcad0fcf83cd1d0a39482db37bf4fc41 upstream.

Touching TS_USEDFPU without touching CR0.TS is confusing, so don't do
it.  By moving it into the callers, we always do the TS_USEDFPU next to
the CR0.TS accesses in the source code, and it's much easier to see how
the two go hand in hand.

Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoi387: fix x86-64 preemption-unsafe user stack save/restore
Linus Torvalds [Thu, 16 Feb 2012 17:15:04 +0000 (09:15 -0800)]
i387: fix x86-64 preemption-unsafe user stack save/restore

commit 15d8791cae75dca27bfda8ecfe87dca9379d6bb0 upstream.

Commit 5b1cbac37798 ("i387: make irq_fpu_usable() tests more robust")
added a sanity check to the #NM handler to verify that we never cause
the "Device Not Available" exception in kernel mode.

However, that check actually pinpointed a (fundamental) race where we do
cause that exception as part of the signal stack FPU state save/restore

Because we use the floating point instructions themselves to save and
restore state directly from user mode, we cannot do that atomically with
testing the TS_USEDFPU bit: the user mode access itself may cause a page
fault, which causes a task switch, which saves and restores the FP/MMX
state from the kernel buffers.

This kind of "recursive" FP state save is fine per se, but it means that
when the signal stack save/restore gets restarted, it will now take the
'#NM' exception we originally tried to avoid.  With preemption this can
happen even without the page fault - but because of the user access, we
cannot just disable preemption around the save/restore instruction.

There are various ways to solve this, including using the
"enable/disable_page_fault()" helpers to not allow page faults at all
during the sequence, and fall back to copying things by hand without the
use of the native FP state save/restore instructions.

However, the simplest thing to do is to just allow the #NM from kernel
space, but fix the race in setting and clearing CR0.TS that this all
exposed: the TS bit changes and the TS_USEDFPU bit absolutely have to be
atomic wrt scheduling, so while the actual state save/restore can be
interrupted and restarted, the act of actually clearing/setting CR0.TS
and the TS_USEDFPU bit together must not.

Instead of just adding random "preempt_disable/enable()" calls to what
is already excessively ugly code, this introduces some helper functions
that mostly mirror the "kernel_fpu_begin/end()" functionality, just for
the user state instead.

Those helper functions should probably eventually replace the other
ad-hoc CR0.TS and TS_USEDFPU tests too, but I'll need to think about it
some more: the task switching functionality in particular needs to
expose the difference between the 'prev' and 'next' threads, while the
new helper functions intentionally were written to only work with

Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoi387: fix sense of sanity check
Linus Torvalds [Wed, 15 Feb 2012 16:05:18 +0000 (08:05 -0800)]
i387: fix sense of sanity check

commit c38e23456278e967f094b08247ffc3711b1029b2 upstream.

The check for save_init_fpu() (introduced in commit 5b1cbac37798: "i387:
make irq_fpu_usable() tests more robust") was the wrong way around, but
I hadn't noticed, because my "tests" were bogus: the FPU exceptions are
disabled by default, so even doing a divide by zero never actually
triggers this code at all unless you do extra work to enable them.

So if anybody did enable them, they'd get one spurious warning.

Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoi387: make irq_fpu_usable() tests more robust
Linus Torvalds [Mon, 13 Feb 2012 21:56:14 +0000 (13:56 -0800)]
i387: make irq_fpu_usable() tests more robust

commit 5b1cbac37798805c1fee18c8cebe5c0a13975b17 upstream.

Some code - especially the crypto layer - wants to use the x86
FP/MMX/AVX register set in what may be interrupt (typically softirq)

That *can* be ok, but the tests for when it was ok were somewhat
suspect.  We cannot touch the thread-specific status bits either, so
we'd better check that we're not going to try to save FP state or
anything like that.

Now, it may be that the TS bit is always cleared *before* we set the
USEDFPU bit (and only set when we had already cleared the USEDFP
before), so the TS bit test may actually have been sufficient, but it
certainly was not obviously so.

So this explicitly verifies that we will not touch the TS_USEDFPU bit,
and adds a few related sanity-checks.  Because it seems that somehow
AES-NI is corrupting user FP state.  The cause is not clear, and this
patch doesn't fix it, but while debugging it I really wanted the code to
be more obviously correct and robust.

Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoi387: math_state_restore() isn't called from asm
Linus Torvalds [Mon, 13 Feb 2012 21:47:25 +0000 (13:47 -0800)]
i387: math_state_restore() isn't called from asm

commit be98c2cdb15ba26148cd2bd58a857d4f7759ed38 upstream.

It was marked asmlinkage for some really old and stale legacy reasons.
Fix that and the equally stale comment.

Noticed when debugging the irq_fpu_usable() bugs.

Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoLinux 3.2.7 v3.2.7
Greg Kroah-Hartman [Mon, 20 Feb 2012 21:42:16 +0000 (13:42 -0800)]
Linux 3.2.7

9 years agocrypto: sha512 - use standard ror64()
Alexey Dobriyan [Sat, 14 Jan 2012 18:44:49 +0000 (21:44 +0300)]
crypto: sha512 - use standard ror64()

commit f2ea0f5f04c97b48c88edccba52b0682fbe45087 upstream.

Use standard ror64() instead of hand-written.
There is no standard ror64, so create it.

The difference is shift value being "unsigned int" instead of uint64_t
(for which there is no reason). gcc starts to emit native ROR instructions
which it doesn't do for some reason currently. This should make the code

Patch survives in-tree crypto test and ping flood with hmac(sha512) on.

Signed-off-by: Alexey Dobriyan <>
Signed-off-by: Herbert Xu <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoxen pvhvm: do not remap pirqs onto evtchns if !xen_have_vector_callback
Stefano Stabellini [Mon, 30 Jan 2012 14:31:46 +0000 (14:31 +0000)]
xen pvhvm: do not remap pirqs onto evtchns if !xen_have_vector_callback

commit 207d543f472c1ac9552df79838dc807cbcaa9740 upstream.

Signed-off-by: Stefano Stabellini <>
Signed-off-by: Konrad Rzeszutek Wilk <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agommc: dw_mmc: Fix PIO mode with support of highmem
Seungwon Jeon [Thu, 9 Feb 2012 05:32:43 +0000 (14:32 +0900)]
mmc: dw_mmc: Fix PIO mode with support of highmem

commit f9c2a0dc42a6938ff2a80e55ca2bbd1d5581c72e upstream.

Current PIO mode makes a kernel crash with CONFIG_HIGHMEM.
Highmem pages have a NULL from sg_virt(sg).
This patch fixes the following problem.

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 817 [#1] PREEMPT SMP
Modules linked in:
CPU: 0    Not tainted  (3.0.15-01423-gdbf465f #589)
PC is at dw_mci_pull_data32+0x4c/0x9c
LR is at dw_mci_read_data_pio+0x54/0x1f0
pc : [<c0358824>]    lr : [<c035988c>]    psr: 20000193
sp : c0619d48  ip : c0619d70  fp : c0619d6c
r10: 00000000  r9 : 00000002  r8 : 00001000
r7 : 00000200  r6 : 00000000  r5 : e1dd3100  r4 : 00000000
r3 : 65622023  r2 : 0000007f  r1 : eeb96000  r0 : e1dd3100
Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment
Control: 10c5387d  Table: 61e2004a  DAC: 00000015
Process swapper (pid: 0, stack limit = 0xc06182f0)
Stack: (0xc0619d48 to 0xc061a000)
9d40:                   e1dd3100 e1a4f000 00000000 e1dd3100 e1a4f000 00000200
9d60: c0619da4 c0619d70 c035988c c03587e4 c0619d9c e18158f4 e1dd3100 e1dd3100
9d80: 00000020 00000000 00000000 00000020 c06e8a84 00000000 c0619e04 c0619da8
9da0: c0359b24 c0359844 e18158f4 e1dd3164 e1dd3168 e1dd3150 3d02fc79 e1dd3154
9dc0: e1dd3178 00000000 00000020 00000000 e1dd3150 00000000 c10dd7e8 e1a84900
9de0: c061e7cc 00000000 00000000 0000008d c06e8a84 c061e780 c0619e4c c0619e08
9e00: c00c4738 c0359a34 3d02fc79 00000000 c0619e4c c05a1698 c05a1670 c05a165c
9e20: c04de8b0 c061e780 c061e7cc e1a84900 ffffed68 0000008d c0618000 00000000
9e40: c0619e6c c0619e50 c00c48b4 c00c46c8 c061e780 c00423ac c061e7cc ffffed68
9e60: c0619e8c c0619e70 c00c7358 c00c487c 0000008d ffffee38 c0618000 ffffed68
9e80: c0619ea4 c0619e90 c00c4258 c00c72b0 c00423ac ffffee38 c0619ecc c0619ea8
9ea0: c004241c c00c4234 ffffffff f8810000 0000006d 00000002 00000001 7fffffff
9ec0: c0619f44 c0619ed0 c0048bc0 c00423c4 220ae7a9 00000000 386f0d30 0005d3a4
9ee0: c00423ac c10dd0b8 c06f2cd8 c0618000 c0594778 c003a674 7fffffff c0619f44
9f00: 386f0d30 c0619f18 c00a6f94 c005be3c 80000013 ffffffff 386f0d30 0005d3a4
9f20: 386f0d30 0005d2d1 c10dd0a8 c10dd0b8 c06f2cd8 c0618000 c0619f74 c0619f48
9f40: c0345858 c005be00 c00a2440 c0618000 c0618000 c00410d8 c06c1944 c00410fc
9f60: c0594778 c003a674 c0619f9c c0619f78 c004a7e8 c03457b4 c0618000 c06c18f8
9f80: 00000000 c0039c70 c06c18d4 c003a674 c0619fb4 c0619fa0 c04ceafc c004a714
9fa0: c06287b4 c06c18f8 c0619ff4 c0619fb8 c0008b68 c04cea68 c0008578 00000000
9fc0: 00000000 c003a674 00000000 10c5387d c0628658 c003aa78 c062f1c4 4000406a
9fe0: 413fc090 00000000 00000000 c0619ff8 40008044 c0008858 00000000 00000000
[<c03587d8>] (dw_mci_pull_data32+0x0/0x9c) from [<c035988c>] (dw_mci_read_data_pio+0x54/0x1f0)
 r6:00000200 r5:e1a4f000 r4:e1dd3100
 [<c0359838>] (dw_mci_read_data_pio+0x0/0x1f0) from [<c0359b24>] (dw_mci_interrupt+0xfc/0x4a4)
[<c0359a28>] (dw_mci_interrupt+0x0/0x4a4) from [<c00c4738>] (handle_irq_event_percpu+0x7c/0x1b4)
[<c00c46bc>] (handle_irq_event_percpu+0x0/0x1b4) from [<c00c48b4>] (handle_irq_event+0x44/0x64)
[<c00c4870>] (handle_irq_event+0x0/0x64) from [<c00c7358>] (handle_fasteoi_irq+0xb4/0x124)
 r7:ffffed68 r6:c061e7cc r5:c00423ac r4:c061e780
 [<c00c72a4>] (handle_fasteoi_irq+0x0/0x124) from [<c00c4258>] (generic_handle_irq+0x30/0x38)
 r7:ffffed68 r6:c0618000 r5:ffffee38 r4:0000008d
 [<c00c4228>] (generic_handle_irq+0x0/0x38) from [<c004241c>] (asm_do_IRQ+0x64/0xe0)
 r5:ffffee38 r4:c00423ac
 [<c00423b8>] (asm_do_IRQ+0x0/0xe0) from [<c0048bc0>] (__irq_svc+0x80/0x14c)
Exception stack(0xc0619ed0 to 0xc0619f18)

Signed-off-by: Seungwon Jeon <>
Acked-by: Will Newton <>
Signed-off-by: Chris Ball <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agommc: atmel-mci: save and restore sdioirq when soft reset is performed
Ludovic Desroches [Thu, 9 Feb 2012 10:55:29 +0000 (11:55 +0100)]
mmc: atmel-mci: save and restore sdioirq when soft reset is performed

commit 18ee684b8ab666329e0a0a72d8b70f16fb0e2243 upstream.

Sometimes a software reset is needed. Then some registers are saved and
restored but the interrupt mask register is missing. It causes issues
with sdio devices whose interrupts are masked after reset.

Signed-off-by: Ludovic Desroches <>
Signed-off-by: Nicolas Ferre <>
Signed-off-by: Chris Ball <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoALSA: hda - Fix silent speaker output on Acer Aspire 6935
Takashi Iwai [Mon, 13 Feb 2012 14:25:07 +0000 (15:25 +0100)]
ALSA: hda - Fix silent speaker output on Acer Aspire 6935

commit 02a237b24d57e2e2d5402c92549e9e792aa24359 upstream.

Since 3.2 kernel, the driver starts trying to assign the multi-io DACs
before the speaker, thus it assigns DAC2/3 for multi-io and DAC4 for
the speaker for a standard laptop setup like a HP, a speaker, a mic-in
and a line-in.  However, on Acer Aspire 6935, it seems that the
speaker pin 0x14 must be connected with either DAC1 or 2; otherwise it
results in silence by some reason, although the codec itself allows
the routing to DAC3/4.

As a workaround, the connection list of each pin is reduced to be
mapped to either only DAC1/2 or DAC3/4, so that the compatible
assignment as in kernel 3.1 is achieved.


Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoALSA: hda - Fix initialization of secondary capture source on VT1705
Takashi Iwai [Mon, 13 Feb 2012 14:04:06 +0000 (15:04 +0100)]
ALSA: hda - Fix initialization of secondary capture source on VT1705

commit fc1156c0b0f7ad45ec03d919866349eeca2bf18c upstream.

VT1705 codec has two ADCs where the secondary ADC has no MUX but only
a fixed connection to the mic pin.  This confused the driver and it
tries always overriding the input-source selection by assumption of
the existing MUX for the secondary ADC, resulted in resetting the
input-source at each time PM (including power-saving) occurs.

The fix is simply to check the existence of MUX for secondary ADCs in
the initialization code.

Tested-by: Anisse Astier <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoALSA: intel8x0: Fix default inaudible sound on Gateway M520
Daniel T Chen [Tue, 14 Feb 2012 04:44:22 +0000 (23:44 -0500)]
ALSA: intel8x0: Fix default inaudible sound on Gateway M520

commit 27c3afe6e1cf129faac90405121203962da08ff4 upstream.

The reporter states that audio is inaudible by default without muting
'External Amplifier'. Add a quirk to handle his SSID so that changing
the control is not necessary.

Reported-and-tested-by: Benjamin Carlson <>
Signed-off-by: Daniel T Chen <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agobacking-dev: fix wakeup timer races with bdi_unregister()
Rabin Vincent [Sun, 29 Jan 2012 18:17:33 +0000 (12:17 -0600)]
backing-dev: fix wakeup timer races with bdi_unregister()

commit 2673b4cf5d59c3ee5e0c12f6d734d38770324dc4 upstream.

While 7a401a972df8e18 ("backing-dev: ensure wakeup_timer is deleted")
addressed the problem of the bdi being freed with a queued wakeup
timer, there are other races that could happen if the wakeup timer
expires after/during bdi_unregister(), before bdi_destroy() is called.

wakeup_timer_fn() could attempt to wakeup a task which has already has
been freed, or could access a NULL bdi->dev via the wake_forker_thread

Cc: Jens Axboe <>
Reported-by: Chanho Min <>
Reviewed-by: Namjae Jeon <>
Signed-off-by: Rabin Vincent <>
Signed-off-by: Wu Fengguang <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocrypto: sha512 - Avoid stack bloat on i386
Herbert Xu [Sun, 5 Feb 2012 04:09:28 +0000 (15:09 +1100)]
crypto: sha512 - Avoid stack bloat on i386

commit 3a92d687c8015860a19213e3c102cad6b722f83c upstream.

Unfortunately in reducing W from 80 to 16 we ended up unrolling
the loop twice.  As gcc has issues dealing with 64-bit ops on
i386 this means that we end up using even more stack space (>1K).

This patch solves the W reduction by moving LOAD_OP/BLEND_OP
into the loop itself, thus avoiding the need to duplicate it.

While the stack space still isn't great (>0.5K) it is at least
in the same ball park as the amount of stack used for our C sha1

Note that this patch basically reverts to the original code so
the diff looks bigger than it really is.

Signed-off-by: Herbert Xu <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocrypto: sha512 - Use binary and instead of modulus
Herbert Xu [Thu, 26 Jan 2012 04:03:16 +0000 (15:03 +1100)]
crypto: sha512 - Use binary and instead of modulus

commit 58d7d18b5268febb8b1391c6dffc8e2aaa751fcd upstream.

The previous patch used the modulus operator over a power of 2
unnecessarily which may produce suboptimal binary code.  This
patch changes changes them to binary ands instead.

Signed-off-by: Herbert Xu <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocifs: don't return error from standard_receive3 after marking response malformed
Jeff Layton [Tue, 7 Feb 2012 11:31:05 +0000 (06:31 -0500)]
cifs: don't return error from standard_receive3 after marking response malformed

commit ff4fa4a25a33f92b5653bb43add0c63bea98d464 upstream.

standard_receive3 will check the validity of the response from the
server (via checkSMB). It'll pass the result of that check to handle_mid
which will dequeue it and mark it with a status of
MID_RESPONSE_MALFORMED if checkSMB returned an error. At that point,
standard_receive3 will also return an error, which will make the
demultiplex thread skip doing the callback for the mid.

This is wrong -- if we were able to identify the request and the
response is marked malformed, then we want the demultiplex thread to do
the callback. Fix this by making standard_receive3 return 0 in this

Reported-and-Tested-by: Mark Moseley <>
Signed-off-by: Jeff Layton <>
Signed-off-by: Steve French <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocifs: request oplock when doing open on lookup
Jeff Layton [Tue, 7 Feb 2012 11:30:52 +0000 (06:30 -0500)]
cifs: request oplock when doing open on lookup

commit 8b0192a5f478da1c1ae906bf3ffff53f26204f56 upstream.

Currently, it's always set to 0 (no oplock requested).

Signed-off-by: Jeff Layton <>
Signed-off-by: Steve French <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (f75375s) Fix automatic pwm mode setting for F75373 & F75375
Nikolaus Schulz [Wed, 8 Feb 2012 17:56:08 +0000 (18:56 +0100)]
hwmon: (f75375s) Fix automatic pwm mode setting for F75373 & F75375

commit 09e87e5c4f9af656af2a8a3afc03487c5d9287c3 upstream.

In order to enable temperature mode aka automatic mode for the F75373 and
F75375 chips, the two FANx_MODE bits in the fan configuration register
need be set to 01, not 10.

Signed-off-by: Nikolaus Schulz <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agowriteback: fix dereferencing NULL bdi->dev on trace_writeback_queue
Wu Fengguang [Sun, 5 Feb 2012 02:54:03 +0000 (20:54 -0600)]
writeback: fix dereferencing NULL bdi->dev on trace_writeback_queue

commit 977b7e3a52a7421ad33a393a38ece59f3d41c2fa upstream.

When a SD card is hot removed without umount, del_gendisk() will call
bdi_unregister() without destroying/freeing it. This leaves the bdi in
the bdi->dev = NULL, bdi->wb.task = NULL, bdi->bdi_list removed state.

When sync(2) gets the bdi before bdi_unregister() and calls
bdi_queue_work() after the unregister, trace_writeback_queue will be
dereferencing the NULL bdi->dev. Fix it with a simple test for NULL.

Reported-by: Rabin Vincent <>
Tested-by: Namjae Jeon <>
Signed-off-by: Wu Fengguang <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agowriteback: fix NULL bdi->dev in trace writeback_single_inode
Wu Fengguang [Tue, 17 Jan 2012 17:18:56 +0000 (11:18 -0600)]
writeback: fix NULL bdi->dev in trace writeback_single_inode

commit 15eb77a07c714ac80201abd0a9568888bcee6276 upstream.

bdi_prune_sb() resets sb->s_bdi to default_backing_dev_info when the
tearing down the original bdi. Fix trace_writeback_single_inode to
use sb->s_bdi=default_backing_dev_info rather than bdi->dev=NULL for a
teared down bdi.

Reported-by: Rabin Vincent <>
Tested-by: Rabin Vincent <>
Signed-off-by: Wu Fengguang <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomac80211: timeout a single frame in the rx reorder buffer
Eliad Peller [Wed, 1 Feb 2012 16:48:09 +0000 (18:48 +0200)]
mac80211: timeout a single frame in the rx reorder buffer

commit 07ae2dfcf4f7143ce191c6436da1c33f179af0d6 upstream.

The current code checks for stored_mpdu_num > 1, causing
the reorder_timer to be triggered indefinitely, but the
frame is never timed-out (until the next packet is received)

Signed-off-by: Eliad Peller <>
Acked-by: Johannes Berg <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agorelay: prevent integer overflow in relay_open()
Dan Carpenter [Fri, 10 Feb 2012 08:03:58 +0000 (09:03 +0100)]
relay: prevent integer overflow in relay_open()

commit f6302f1bcd75a042df69866d98b8d775a668f8f1 upstream.

"subbuf_size" and "n_subbufs" come from the user and they need to be
capped to prevent an integer overflow.

Signed-off-by: Dan Carpenter <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agolib: proportion: lower PROP_MAX_SHIFT to 32 on 64-bit kernel
Wu Fengguang [Mon, 9 Jan 2012 17:53:50 +0000 (11:53 -0600)]
lib: proportion: lower PROP_MAX_SHIFT to 32 on 64-bit kernel

commit 3310225dfc71a35a2cc9340c15c0e08b14b3c754 upstream.

PROP_MAX_SHIFT should be set to <=32 on 64-bit box. This fixes two bugs
in the below lines of bdi_dirty_limit():

bdi_dirty *= numerator;
do_div(bdi_dirty, denominator);

1) divide error: do_div() only uses the lower 32 bit of the denominator,
   which may trimmed to be 0 when PROP_MAX_SHIFT > 32.

2) overflow: (bdi_dirty * numerator) could easily overflow if numerator
   used up to 48 bits, leaving only 16 bits to bdi_dirty

Cc: Peter Zijlstra <>
Reported-by: Ilya Tumaykin <>
Tested-by: Ilya Tumaykin <>
Signed-off-by: Wu Fengguang <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agonet: enable TC35815 for MIPS again
Atsushi Nemoto [Mon, 6 Feb 2012 14:51:03 +0000 (14:51 +0000)]
net: enable TC35815 for MIPS again

commit a1728800bed3b93b231d99e97c756f622b9991c2 upstream.

From: Ralf Roesch <>
Date: Wed, 16 Nov 2011 09:33:50 +0100
Subject: net: enable TC35815 for MIPS again

TX493[8,9] MIPS SoCs support 2 Ethernet channels of type TC35815
which are connected to the internal PCI controller.
And JMR3927 MIPS board has a TC35815 chip on board.
These dependencies were lost on movement to drivers/net/ethernet/toshiba.

Signed-off-by: Ralf Roesch <>
Signed-off-by: Atsushi Nemoto <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (f75375s) Fix bit shifting in f75375_write16
Nikolaus Schulz [Wed, 8 Feb 2012 17:56:10 +0000 (18:56 +0100)]
hwmon: (f75375s) Fix bit shifting in f75375_write16

commit eb2f255b2d360df3f500042a2258dcf2fcbe89a2 upstream.

In order to extract the high byte of the 16-bit word, shift the word to
the right, not to the left.

Signed-off-by: Nikolaus Schulz <>
Signed-off-by: Guenter Roeck <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoath9k_hw: fix a RTS/CTS timeout regression
Felix Fietkau [Sun, 5 Feb 2012 20:15:18 +0000 (21:15 +0100)]
ath9k_hw: fix a RTS/CTS timeout regression

commit 55a2bb4a6d5e8c7b324d003e130fd9aaf33be4e6 upstream.

commit adb5066 "ath9k_hw: do not apply the 2.4 ghz ack timeout
workaround to cts" reduced the hardware CTS timeout to the normal
values specified by the standard, but it turns out while it doesn't
need the same extra time that it needs for the ACK timeout, it
does need more than the value specified in the standard, but only
for 2.4 GHz.

This patch brings the CTS timeout value in sync with the initialization
values, while still allowing adjustment for bigger distances.

Signed-off-by: Felix Fietkau <>
Reported-by: Seth Forshee <>
Reported-by: Marek Lindner <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoath9k: fix a WEP crypto related regression
Felix Fietkau [Sun, 5 Feb 2012 20:15:17 +0000 (21:15 +0100)]
ath9k: fix a WEP crypto related regression

commit f88373fa47f3ce6590fdfaa742d0ddacc2ae017f upstream.

commit b4a82a0 "ath9k_hw: fix interpretation of the rx KeyMiss flag"
fixed the interpretation of the KeyMiss flag for keycache based lookups,
however WEP encryption uses a static index, so KeyMiss is always asserted
for it, even though frames are decrypted properly.
Fix this by clearing the ATH9K_RXERR_KEYMISS flag if no keycache based
lookup was performed.

Signed-off-by: Felix Fietkau <>
Reported-by: Laurent Bonnans <>
Reported-by: Jurica Vukadin <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoath9k: Fix kernel panic during driver initilization
Mohammed Shafi Shajakhan [Thu, 2 Feb 2012 10:59:05 +0000 (16:29 +0530)]
ath9k: Fix kernel panic during driver initilization

commit 07445f688218a48bde72316aed9de4fdcc173131 upstream.

all works need to be initialized before ieee80211_register_hw
to prevent mac80211 call backs such as drv_start, drv_config
getting started. otherwise we would queue/cancel works before
initializing them and it leads to kernel panic.
this issue can be recreated with the following script
in Chrome laptops with AR928X cards, with background scan
running (or) Network manager is running

while true
sudo modprobe -v ath9k
sleep 3
sudo modprobe -r ath9k
sleep 3

 EIP: [<81040a47>] __cancel_work_timer+0xb8/0xe1 SS:ESP 0068:f6be9d70
 ---[ end trace 4f86d6139a9900ef ]---
 Registered led device: ath9k-phy0
 ieee80211 phy0: Atheros AR9280 Rev:2 mem=0xf88a0000,
 Kernel panic - not syncing: Fatal exception
 Pid: 456, comm: wpa_supplicant Tainted: G      D
 3.0.13 #1
Call Trace:
 [<81379e21>] panic+0x53/0x14a
 [<81004a30>] oops_end+0x73/0x81
 [<81004b53>] die+0x4c/0x55
 [<81002710>] do_trap+0x7c/0x83
 [<81002855>] ? do_bounds+0x58/0x58
 [<810028cc>] do_invalid_op+0x77/0x81
 [<81040a47>] ? __cancel_work_timer+0xb8/0xe1
 [<810489ec>] ? sched_clock_cpu+0x81/0x11f
 [<8103f809>] ? wait_on_work+0xe2/0xf7
 [<8137f807>] error_code+0x67/0x6c
 [<810300d8>] ? wait_consider_task+0x4ba/0x84c
 [<81040a47>] ? __cancel_work_timer+0xb8/0xe1
 [<810380c9>] ? try_to_del_timer_sync+0x5f/0x67
 [<81040a91>] cancel_work_sync+0xf/0x11
 [<f88d7b7c>] ath_set_channel+0x62/0x25c [ath9k]
 [<f88d67d1>] ? ath9k_tx_last_beacon+0x26a/0x85c [ath9k]
 [<f88d8899>] ath_radio_disable+0x3f1/0x68e [ath9k]
 [<f90d0edb>] ieee80211_hw_config+0x111/0x116 [mac80211]
 [<f90dd95c>] __ieee80211_recalc_idle+0x919/0xa37 [mac80211]
 [<f90dda76>] __ieee80211_recalc_idle+0xa33/0xa37 [mac80211]
 [<812dbed8>] __dev_open+0x82/0xab

Cc: Gary Morain <>
Cc: Paul Stewart <>
Cc: Vasanthakumar Thiagarajan <>
Tested-by: Mohammed Shafi Shajakhan <>
Signed-off-by: Rajkumar Manoharan <>
Signed-off-by: Mohammed Shafi Shajakhan <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: no lvds quirk for AOpen MP45
Daniel Vetter [Wed, 8 Feb 2012 15:42:52 +0000 (16:42 +0100)]
drm/i915: no lvds quirk for AOpen MP45

commit e57b6886f555ab57f40a01713304e2053efe51ec upstream.

According to a bug report, it doesn't have one.

Acked-by: Chris Wilson <>
Signed-Off-by: Daniel Vetter <>
Signed-off-by: Keith Packard <>
Signed-off-by: Greg Kroah-Hartman <>