aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2012-08-26Merge tag 'hwmon-for-linus' of ↵HEADmasterLinus Torvalds1-0/+6
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull a hwmon fix from Guenter Roeck: "Fix sensor readings for Asus M5A78L in asus_atk0110 driver." * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (asus_atk0110) Add quirk for Asus M5A78L
2012-08-26Merge tag 'for-linus' of git://github.com/prasad-joshi/logfs_upstreamLinus Torvalds5-12/+26
Pull LogFS bugfixes from Prasad Joshi: - "logfs: query block device for number of pages to send with bio" This BUG was found when LogFS was used on KVM. The patch fixes the problem by asking for underlaying block device the number of pages to send with each BIO. - "logfs: maintain the ordering of meta-inode destruction" LogFS maintains file system meta-data in special inodes. These inodes are releated to each other, therefore they must be destroyed in a proper order. - "logfs: initialize the number of iovecs in bio" LogFS used to panic when it was created on an encrypted LVM volume. The patch fixes the problem by properly initializing the BIO. Plus a couple more: - logfs: create a pagecache page if it is not present - logfs: destroy the reserved inodes while unmounting * tag 'for-linus' of git://github.com/prasad-joshi/logfs_upstream: logfs: query block device for number of pages to send with bio logfs: maintain the ordering of meta-inode destruction logfs: create a pagecache page if it is not present logfs: initialize the number of iovecs in bio logfs: destroy the reserved inodes while unmounting
2012-08-25Merge tag 'fixes-3.6-rc3' of ↵Linus Torvalds49-101/+174
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull arm-soc fixes from Arnd Bergmann: "Bug fixes for various ARM platforms. About half of these are for OMAP and submitted before but did not make it into v3.6-rc2." * tag 'fixes-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (39 commits) ARM: ux500: don't select LEDS_GPIO for snowball ARM: imx: build i.MX6 functions only when needed ARM: imx: select CPU_FREQ_TABLE when needed ARM: imx: fix ksz9021rn_phy_fixup ARM: imx: build pm-imx5 code only when PM is enabled ARM: omap: allow building omap44xx without SMP ARM: dts: imx51-babbage: fix esdhc cd/wp properties ARM: imx6: spin the cpu until hardware takes it down ARM: ux500: Ensure probing of Audio devices when Device Tree is enabled ARM: ux500: Fix merge error, no matching driver name for 'snd_soc_u8500' ARM i.MX6q: Add virtual 1/3.5 dividers in the LDB clock path ARM: Kirkwood: fix Makefile.boot ARM: Kirkwood: Fix iconnect leds ARM: Orion: Set eth packet size csum offload limit ARM: mv78xx0: fix win_cfg_base prototype ARM: OMAP: dmtimers: Fix locking issue in omap_dm_timer_request*() ARM: mmp: fix potential NULL dereference ARM: OMAP4: Register the OPP table only for 4430 device cpufreq: OMAP: Handle missing frequency table on SMP systems ARM: OMAP4: sleep: Save the complete used register stack frame ...
2012-08-25Merge tag 'stable/for-linus-3.6-rc3-tag' of ↵Linus Torvalds7-130/+113
git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen Pull three xen bug-fixes from Konrad Rzeszutek Wilk: - Revert the kexec fix which caused on non-kexec shutdowns a race. - Reuse existing P2M leafs - instead of requiring to allocate a large area of bootup virtual address estate. - Fix a one-off error when adding PFNs for balloon pages. * tag 'stable/for-linus-3.6-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: xen/setup: Fix one-off error when adding for-balloon PFNs to the P2M. xen/p2m: Reuse existing P2M leafs if they are filled with 1:1 PFNs or INVALID. Revert "xen PVonHVM: move shared_info to MMIO before kexec"
2012-08-25Merge branch 'merge' of ↵Linus Torvalds21-242/+209
git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc Pull powerpc fixes from Benjamin Herrenschmidt: "I meant to sent that earlier but got swamped with other things, so here are some powerpc fixes for 3.6. A few regression fixes and some bug fixes that I deemed should still make it. There's a FSL update from Kumar with a bunch of defconfig updates along with a few embedded fixes. I also reverted my g5_defconfig update that I merged earlier as it was completely busted, not too sure what happened there, I'll do a new one later." * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: Revert "powerpc: Update g5_defconfig" powerpc/perf: Use pmc_overflow() to detect rolled back events powerpc: Fix VMX in interrupt check in POWER7 copy loops powerpc: POWER7 copy_to_user/copy_from_user patch applied twice powerpc: Fix personality handling in ppc64_personality() powerpc/dma-iommu: Fix IOMMU window check powerpc: Remove unnecessary ifdefs powerpc/kgdb: Restore current_thread_info properly powerpc/kgdb: Bail out of KGDB when we've been triggered powerpc/kgdb: Do not set kgdb_single_step on ppc powerpc/mpic_msgr: Add missing includes powerpc: Fix null pointer deref in perf hardware breakpoints powerpc: Fixup whitespace in xmon powerpc: Fix xmon dl command for new printk implementation powerpc/fsl: fix "Failed to mount /dev: No such device" errors powerpc/fsl: update defconfigs booke/wdt: some ioctls do not return values properly powerpc/p4080ds: dts - add usb controller version info and port0 powerpc/85xx: mpc85xx_defconfig - add VIA PATA support for MPC85xxCDS powerpc/fsl-pci: Only scan PCI bus if configured as a host
2012-08-25Merge git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds10-23/+64
Pull kvm fixes from Marcelo Tosatti. * git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86 emulator: use stack size attribute to mask rsp in stack ops KVM: MMU: Fix mmu_shrink() so that it can free mmu pages as intended ppc: e500_tlb memset clears nothing KVM: PPC: Add cache flush on page map KVM: PPC: Book3S HV: Fix incorrect branch in H_CEDE code KVM: x86: update KVM_SAVE_MSRS_BEGIN to correct value
2012-08-25Merge tag 'for-linus-v3.6-rc4' of git://oss.sgi.com/xfs/xfsLinus Torvalds3-11/+14
Pull xfs bugfixes from Ben Myers: - fix uninitialised variable in xfs_rtbuf_get() - unlock the AGI buffer when looping in xfs_dialloc - check for possible overflow in xfs_ioc_trim * tag 'for-linus-v3.6-rc4' of git://oss.sgi.com/xfs/xfs: xfs: check for possible overflow in xfs_ioc_trim xfs: unlock the AGI buffer when looping in xfs_dialloc xfs: fix uninitialised variable in xfs_rtbuf_get()
2012-08-25Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linusLinus Torvalds19-110/+171
Pull MIPS fixes from Ralf Baechle: "Random fixes across the MIPS tree. The two hotspots are several bugs in the module loader and the ath79 SOC support; also noteworthy is the restructuring of the code to synchronize CPU timers across CPUs on startup; the old code recently ceased to work due to unrelated changes. All except one of these patches have sat for a significant time in linux-next for testing." * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: MIPS: pci-ar724x: avoid data bus error due to a missing PCIe module MIPS: Malta: Delete duplicate PCI fixup. MIPS: ath79: don't hardcode the unavailability of the DSP ASE MIPS: Synchronize MIPS count one CPU at a time MIPS: BCM63xx: Fix SPI message control register handling for BCM6338/6348. MIPS: Module: Deal with malformed HI16/LO16 relocation sequences. MIPS: Fix race condition in module relocation code. MIPS: Fix memory leak in error path of HI16/LO16 relocation handling. MIPS: MTX-1: Add udelay to mtx1_pci_idsel MIPS: ath79: select HAVE_CLK MIPS: ath79: Use correct IRQ number for the OHCI controller on AR7240 MIPS: ath79: Fix number of GPIO lines for AR724[12] MIPS: Octeon: Fix broken interrupt controller code.
2012-08-25Merge branch 'for-3.6' of git://linux-nfs.org/~bfields/linuxLinus Torvalds4-10/+7
Pull nfsd bugfixes from J. Bruce Fields: "Particular thanks to Michael Tokarev, Malahal Naineni, and Jamie Heilman for their testing and debugging help." * 'for-3.6' of git://linux-nfs.org/~bfields/linux: svcrpc: fix svc_xprt_enqueue/svc_recv busy-looping svcrpc: sends on closed socket should stop immediately svcrpc: fix BUG() in svc_tcp_clear_pages nfsd4: fix security flavor of NFSv4.0 callback
2012-08-25Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds17-123/+378
Pull block-related fixes from Jens Axboe: - Improvements to the buffered and direct write IO plugging from Fengguang. - Abstract out the mapping of a bio in a request, and use that to provide a blk_bio_map_sg() helper. Useful for mapping just a bio instead of a full request. - Regression fix from Hugh, fixing up a patch that went into the previous release cycle (and marked stable, too) attempting to prevent a loop in __getblk_slow(). - Updates to discard requests, fixing up the sizing and how we align them. Also a change to disallow merging of discard requests, since that doesn't really work properly yet. - A few drbd fixes. - Documentation updates. * 'for-linus' of git://git.kernel.dk/linux-block: block: replace __getblk_slow misfix by grow_dev_page fix drbd: Write all pages of the bitmap after an online resize drbd: Finish requests that completed while IO was frozen drbd: fix drbd wire compatibility for empty flushes Documentation: update tunable options in block/cfq-iosched.txt Documentation: update tunable options in block/cfq-iosched.txt Documentation: update missing index files in block/00-INDEX block: move down direct IO plugging block: remove plugging at buffered write time block: disable discard request merge temporarily bio: Fix potential memory leak in bio_find_or_create_slab() block: Don't use static to define "void *p" in show_partition_start() block: Add blk_bio_map_sg() helper block: Introduce __blk_segment_map_sg() helper fs/block-dev.c:fix performance regression in O_DIRECT writes to md block devices block: split discard into aligned requests block: reorganize rounding of max_discard_sectors
2012-08-25Merge tag 'upstream-linus' of ↵Linus Torvalds8-14/+42
git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev Pull libata fixes from Jeff Garzik: - libata-acpi regression fix - additional or corrected drive quirks for ata_blacklist - Kconfig text tweaking - new PCI IDs - pata_atiixp: quirk for MSI motherboard - export ahci_dev_classify for an ahci_platform driver * tag 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: libata: Add a space to " 2GB ATA Flash Disk" DMA blacklist entry [libata] new quirk, lift bridge limits for Buffalo DriveStation Quattro [libata] Kconfig: Elaborate that SFF is meant for legacy and PATA stuff [libata] acpi: call ata_acpi_gtm during ata port init time ata_piix: Add Device IDs for Intel Lynx Point-LP PCH ahci: Add Device IDs for Intel Lynx Point-LP PCH pata_atiixp: override cable detection on MSI E350DM-E33 ahci: un-staticize ahci_dev_classify
2012-08-25libata: Add a space to " 2GB ATA Flash Disk" DMA blacklist entryPrarit Bhargava1-1/+1
commit d70e551c8e1ecb6f20422f8db6bfe6a0049edcb8, Add " 2GB ATA Flash Disk"/"ADMA428M" to DMA blacklist, should have added a space before 2GB. Signed-off-by: Prarit Bhargava <prarit@redhat.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2012-08-24Revert "powerpc: Update g5_defconfig"Benjamin Herrenschmidt1-30/+73
This reverts commit b1acf1bb544cf28c1f4be0a45620fa899c74b7e9. Something went horribly wrong when I did savedefconfig, not sure what, but what's in there is busted so let's revert it. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc/perf: Use pmc_overflow() to detect rolled back eventsSukadev Bhattiprolu1-1/+1
For certain speculative events on Power7, 'perf stat' reports far higher event count than 'perf record' for the same event. As described in following commit, a performance monitor exception is raised even when the the performance events are rolled back. commit 0837e3242c73566fc1c0196b4ec61779c25ffc93 Author: Anton Blanchard <anton@samba.org> Date: Wed Mar 9 14:38:42 2011 +1100 perf_event_interrupt() records an event only when an overflow occurs. But this check for overflow is a simple 'if (val < 0)'. Because the events are rolled back, this check for overflow fails and the event is not recorded. perf_event_interrupt() later uses pmc_overflow() to detect the overflow and resets the counters and the events are lost completely. To properly detect the overflow of rolled back events, use pmc_overflow() even when recording events. To reproduce: $ cat strcpy.c #include <stdio.h> #include <string.h> main() { char buf[256]; alarm(5); while(1) strcpy(buf, "string1"); } $ perf record -e r20014 ./strcpy $ perf report -n > report.1 $ perf stat -e r20014 > report.2 # Compare report.1 and report.2 Reported-by: Maynard Johnson <mpjohn@us.ibm.com> Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc: Fix VMX in interrupt check in POWER7 copy loopsAnton Blanchard2-4/+4
The enhanced prefetch hint patches corrupt the condition register that was used to check if we are in interrupt. Fix this by using cr1. Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc: POWER7 copy_to_user/copy_from_user patch applied twiceAnton Blanchard1-31/+0
"powerpc: Use enhanced touch instructions in POWER7 copy_to_user/copy_from_user" was applied twice. Remove one. Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc: Fix personality handling in ppc64_personality()Jiri Kosina1-4/+4
Directly comparing current->personality against PER_LINUX32 doesn't work in cases when any of the personality flags stored in the top three bytes are used. Directly forcefully setting personality to PER_LINUX32 or PER_LINUX discards any flags stored in the top three bytes Use personality() macro to compare only PER_MASK bytes and make sure that we are setting only the bits that should be set, instead of overwriting the whole value. Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc/dma-iommu: Fix IOMMU window checkAaro Koskinen1-5/+4
Checking for device mask to cover the whole IOMMU table is too strict. IOMMU allocators should handle mask constraint properly for each allocation. The patch enables to use old AirPort Extreme cards on PowerMacs with more than 1GB of memory; without the patch the driver init fails with: b43-pci-bridge 0001:01:01.0: Warning: IOMMU window too big for device mask b43-pci-bridge 0001:01:01.0: mask: 0x3fffffff, table end: 0x80000000 b43-phy0 ERROR: The machine/kernel does not support the required 30-bit DMA mask Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc: Remove unnecessary ifdefsMichael Neuling1-2/+0
Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc/kgdb: Restore current_thread_info properlyTiejun Chen1-2/+9
For powerpc BooKE and e200, singlestep is handled on the critical/dbg exception stack. This causes current_thread_info() to fail for kgdb internal, so previously We work around this issue by copying the thread_info from the kernel stack before calling kgdb_handle_exception, and copying it back afterwards. But actually we don't do this properly. We should backup current_thread_info then restore that when exit. Signed-off-by: Tiejun Chen <tiejun.chen@windriver.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc/kgdb: Bail out of KGDB when we've been triggeredTiejun Chen1-0/+15
We need to skip a breakpoint exception when it occurs after a breakpoint has already been removed. Signed-off-by: Tiejun Chen <tiejun.chen@windriver.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc/kgdb: Do not set kgdb_single_step on ppcTiejun Chen1-1/+0
The kgdb_single_step flag has the possibility to indefinitely hang the system on an SMP system. The x86 arch have the same problem, and that problem was fixed by commit 8097551d9ab9b9e3630(kgdb,x86: do not set kgdb_single_step on x86). This patch does the same behaviors as x86's patch. Signed-off-by: Dongdong Deng <dongdong.deng@windriver.com> Signed-off-by: Jason Wessel <jason.wessel@windriver.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc/mpic_msgr: Add missing includesScott Wood2-0/+4
Add several #includes that mpic_msgr relies on being pulled implicitly, which only happens on certain configs. Signed-off-by: Scott Wood <scottwood@freescale.com> Cc: Meador Inge <meador_inge@mentor.com> Cc: Jia Hongtao <B38951@freescale.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc: Fix null pointer deref in perf hardware breakpointsMichael Neuling1-1/+1
Currently if you are doing a global perf recording with hardware breakpoints (ie perf record -e mem:0xdeadbeef -a), you can oops with: Faulting instruction address: 0xc000000000738890 cpu 0xc: Vector: 300 (Data Access) at [c0000003f76af8d0] pc: c000000000738890: .hw_breakpoint_handler+0xa0/0x1e0 lr: c000000000738830: .hw_breakpoint_handler+0x40/0x1e0 sp: c0000003f76afb50 msr: 8000000000001032 dar: 6f0 dsisr: 42000000 current = 0xc0000003f765ac00 paca = 0xc00000000f262a00 softe: 0 irq_happened: 0x01 pid = 6810, comm = loop-read enter ? for help [c0000003f76afbe0] c00000000073cd04 .notifier_call_chain.isra.0+0x84/0xe0 [c0000003f76afc80] c00000000073cdbc .notify_die+0x3c/0x60 [c0000003f76afd20] c0000000000139f0 .do_dabr+0x40/0xf0 [c0000003f76afe30] c000000000005a9c handle_dabr_fault+0x14/0x48 --- Exception: 300 (Data Access) at 0000000010000480 SP (ff8679e0) is in userspace This is because we don't check to see if the break point is associated with task before we deference the task_struct pointer. This changes the update to use current. Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc: Fixup whitespace in xmonMichael Ellerman1-20/+20
There are a few whitespace goolies in xmon.c, some of them appear to be my fault. Fix them all in one go. Signed-off-by: Michael Ellerman <michael@ellerman.id.au> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-24powerpc: Fix xmon dl command for new printk implementationMichael Ellerman1-26/+10
Since the printk internals were reworked the xmon 'dl' command which dumps the content of __log_buf has stopped working. It is now a structured buffer, so just dumping it doesn't really work. Use the helpers added for kgdb to print out the content. Signed-off-by: Michael Ellerman <michael@ellerman.id.au> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-08-23Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds2-7/+7
Pull crypto fixes from Herbert Xu: "This push fixes a build error on 32-bit archs in the hifn driver as well as a potential deadlock in the caam driver." * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: caam - fix possible deadlock condition crypto: hifn_795x - fix 64bit division and undefined __divdi3 on 32bit archs
2012-08-23Merge branch 'for_linus' of ↵Linus Torvalds6-6/+17
git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull UDF, ext3 & reiserfs fixes from Jan Kara: "A couple of fixes (udf, reiserfs, ext3) that accumulated over my vacation." * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: fix retun value on error path in udf_load_logicalvol jbd: don't write superblock when unmounting an ro filesystem reiserfs: fix deadlocks with quotas quota: Move down dqptr_sem read after initializing default warn[] type at __dquot_alloc_space(). UDF: During mount free lvid_bh before rescanning with different blocksize udf: fix udf_setsize() for file data in ICB
2012-08-23Merge tag 'upstream-3.6-rc3' of git://git.infradead.org/linux-ubifsLinus Torvalds5-8/+7
Pull UBIFS fixes from Artem Bityutskiy: - Fix crash on error which prevents emulated power-cut testing. - Fix log reply regression introduced in 3.6-rc1. - Fix UBIFS complaints about too small debug buffer size which. - Fix error message spelling, and remove incorrect commentary. * tag 'upstream-3.6-rc3' of git://git.infradead.org/linux-ubifs: UBIFS: fix error messages spelling UBIFS: fix complaints about too small debug buffer size UBIFS: fix replay regression UBIFS: fix crash on error path UBIFS: remove stale commentary
2012-08-23Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ideLinus Torvalds1-2/+2
Pull IDE power management bugfix from David S. Miller. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide: ide: fix generic_ide_suspend/resume Oops
2012-08-23Merge branch 'perf-urgent-for-linus' of ↵Linus Torvalds4-5/+10
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "This tree contains misc fixlets: a perf script python binding fix, a uprobes fix and a syscall tracing fix." * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf tools: Add missing files to build the python binding uprobes: Fix mmap_region()'s mm->mm_rb corruption if uprobe_mmap() fails tracing/syscalls: Fix perf syscall tracing when syscall_nr == -1
2012-08-23Merge branch 'x86-urgent-for-linus' of ↵Linus Torvalds4-7/+7
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "This tree contains assorted fixlets: an alternatives patching crash fix, an irq migration/hotplug interaction fix, a fix for large AMD microcode images and a comment fixlet." * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86, microcode, AMD: Fix broken ucode patch size check x86/alternatives: Fix p6 nops on non-modular kernels x86/fixup_irq: Use cpu_online_mask instead of cpu_all_mask x86/spinlocks: Fix comment in spinlock.h
2012-08-23Merge branch 'timers-urgent-for-linus' of ↵Linus Torvalds3-14/+52
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Thomas Gleixner: "Mostly small fixes for the fallout of the timekeeping overhaul in 3.6 along with stable fixes to address an accumulation problem and missing sanity checks for RTC readouts and user space provided values." * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: time: Avoid making adjustments if we haven't accumulated anything time: Avoid potential shift overflow with large shift values time: Fix casting issue in timekeeping_forward_now time: Ensure we normalize the timekeeper in tk_xtime_add time: Improve sanity checking of timekeeping inputs
2012-08-23Merge branch 'upstream-fixes' of ↵Linus Torvalds1-1/+0
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fix from Jiri Kosina: "Fix for one particular device not being properly claimed by hid-multitouch driver" * 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: Remove QUANTA from special drivers list
2012-08-23xfs: check for possible overflow in xfs_ioc_trimTomas Racek1-2/+4
If range.start or range.minlen is bigger than filesystem size, return invalid value error. This fixes possible overflow in BTOBB macro when passed value was nearly ULLONG_MAX. Signed-off-by: Tomas Racek <tracek@redhat.com> Reviewed-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Ben Myers <bpm@sgi.com>
2012-08-23xfs: unlock the AGI buffer when looping in xfs_diallocChristoph Hellwig1-8/+9
Also update some commens in the area to make the code easier to read. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Mark Tinguely <tinguely@sgi.com> Reviewed-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Ben Myers <bpm@sgi.com>
2012-08-23xfs: fix uninitialised variable in xfs_rtbuf_get()Dave Chinner1-1/+1
Results in this assert failure in generic/090: XFS: Assertion failed: *nmap >= 1, file: fs/xfs/xfs_bmap.c, line: 4363 ..... Call Trace: [<ffffffff814680db>] xfs_bmapi_read+0x6b/0x370 [<ffffffff814b64b2>] xfs_rtbuf_get+0x42/0x130 [<ffffffff814b6f09>] xfs_rtget_summary+0x89/0x120 [<ffffffff814b7bfe>] xfs_rtallocate_extent_size+0xce/0x340 [<ffffffff814b89f0>] xfs_rtallocate_extent+0x240/0x290 [<ffffffff81462c1a>] xfs_bmap_rtalloc+0x1ba/0x340 [<ffffffff81463a65>] xfs_bmap_alloc+0x35/0x40 [<ffffffff8146f111>] xfs_bmapi_allocate+0xf1/0x350 [<ffffffff8146f9de>] xfs_bmapi_write+0x66e/0xa60 [<ffffffff8144538a>] xfs_iomap_write_direct+0x22a/0x3f0 [<ffffffff8143707b>] __xfs_get_blocks+0x38b/0x5d0 [<ffffffff814372d4>] xfs_get_blocks_direct+0x14/0x20 [<ffffffff811b0081>] do_blockdev_direct_IO+0xf71/0x1eb0 [<ffffffff811b1015>] __blockdev_direct_IO+0x55/0x60 [<ffffffff814355ca>] xfs_vm_direct_IO+0x11a/0x1e0 [<ffffffff8112d617>] generic_file_direct_write+0xd7/0x1b0 [<ffffffff8143e16c>] xfs_file_dio_aio_write+0x13c/0x320 [<ffffffff8143e6f2>] xfs_file_aio_write+0x1c2/0x1d0 [<ffffffff81174a07>] do_sync_write+0xa7/0xe0 [<ffffffff81175288>] vfs_write+0xa8/0x160 [<ffffffff81175702>] sys_pwrite64+0x92/0xb0 [<ffffffff81b68f69>] system_call_fastpath+0x16/0x1b Signed-off-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Ben Myers <bpm@sgi.com>
2012-08-23powerpc/fsl: fix "Failed to mount /dev: No such device" errorsKim Phillips6-0/+6
Yocto (Built by Poky 7.0) 1.2 root filesystems fail to boot, at least over nfs, with: Failed to mount /dev: No such device Configuring DEVTMPFS fixes it. Signed-off-by: Kim Phillips <kim.phillips@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2012-08-23powerpc/fsl: update defconfigsKim Phillips5-102/+35
run make savedefconfig on fsl defconfigs. Signed-off-by: Kim Phillips <kim.phillips@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2012-08-23Merge branch 'randconfig/mach' into fixesArnd Bergmann9-10/+16
Small platform specific bug fixes for problems found in randconfig builds. * randconfig/mach: ARM: ux500: don't select LEDS_GPIO for snowball ARM: imx: build i.MX6 functions only when needed ARM: imx: select CPU_FREQ_TABLE when needed ARM: imx: fix ksz9021rn_phy_fixup ARM: imx: build pm-imx5 code only when PM is enabled ARM: omap: allow building omap44xx without SMP Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2012-08-23ARM: ux500: don't select LEDS_GPIO for snowballArnd Bergmann2-1/+1
Using 'select' in Kconfig is hard, a platform cannot just enable a driver without also making sure that its subsystem is there. Also, there is no actual code dependency between the platform and the gpio leds driver. Without this patch, building without LEDS_CLASS esults in: drivers/built-in.o: In function `create_gpio_led.part.2': governor_userspace.c:(.devinit.text+0x5a58): undefined reference to `led_classdev_register' drivers/built-in.o: In function `gpio_led_remove': governor_userspace.c:(.devexit.text+0x6b8): undefined reference to `led_classdev_unregister' This reverts 8733f53c6 "ARM: ux500: Kconfig: Compile in leds-gpio support for Snowball" that introduced the regression and did not provide a helpful explanation. In order to leave the GPIO LED code still present in normal builds, this also enables the symbol in u8500_defconfig, in addition to the other LED drivers that are already selected there. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Cc: Linus Walleij <linus.walleij@linaro.org> Cc: Lee Jones <lee.jones@linaro.org>
2012-08-23ARM: imx: build i.MX6 functions only when neededArnd Bergmann2-4/+3
The head-v7.S contains a call to the generic cpu_suspend function, which is only available when selected by the i.MX6 code. As pointed out by Shawn Guo, i.MX5 does not actually use any functions defined in head-v7.S. It is also needed only for the i.MX6 power management code and for the SMP code, so we can restrict building this file to situations in which at least one of those two is present. Finally, other platforms with a similar file call it headsmp.S, so we can rename it to the same for consistency. Without this patch, building imx5 standalone results in: arch/arm/mach-imx/built-in.o: In function `v7_cpu_resume': arch/arm/mach-imx/head-v7.S:104: undefined reference to `cpu_resume' Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Shawn Guo <shawn.guo@linaro.org> Cc: Eric Miao <eric.miao@linaro.org> Cc: stable@vger.kernel.org
2012-08-23ARM: imx: select CPU_FREQ_TABLE when neededArnd Bergmann1-0/+1
The i.MX cpufreq implementation uses the CPU_FREQ_TABLE helpers, so it needs to select that code to be built. This problem has apparently existed since the i.MX cpufreq code was first merged in v2.6.37. Building IMX without CPU_FREQ_TABLE results in: arch/arm/plat-mxc/built-in.o: In function `mxc_cpufreq_exit': arch/arm/plat-mxc/cpufreq.c:173: undefined reference to `cpufreq_frequency_table_put_attr' arch/arm/plat-mxc/built-in.o: In function `mxc_set_target': arch/arm/plat-mxc/cpufreq.c:84: undefined reference to `cpufreq_frequency_table_target' arch/arm/plat-mxc/built-in.o: In function `mxc_verify_speed': arch/arm/plat-mxc/cpufreq.c:65: undefined reference to `cpufreq_frequency_table_verify' arch/arm/plat-mxc/built-in.o: In function `mxc_cpufreq_init': arch/arm/plat-mxc/cpufreq.c:154: undefined reference to `cpufreq_frequency_table_cpuinfo' arch/arm/plat-mxc/cpufreq.c:162: undefined reference to `cpufreq_frequency_table_get_attr' Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Shawn Guo <shawn.guo@linaro.org> Cc: Sascha Hauer <s.hauer@pengutronix.de> Cc: Yong Shen <yong.shen@linaro.org> Cc: stable@vger.kernel.org
2012-08-23ARM: imx: fix ksz9021rn_phy_fixupArnd Bergmann1-2/+2
The ksz9021rn_phy_fixup and mx6q_sabrelite functions try to set up an ethernet phy if they can. They do check whether phylib is enabled, but unfortunately the functions can only be called from platform code if phylib is builtin, not if it is a module Without this patch, building with a modular phylib results in: arch/arm/mach-imx/mach-imx6q.c: In function 'imx6q_sabrelite_init': arch/arm/mach-imx/mach-imx6q.c:120:5: error: 'ksz9021rn_phy_fixup' undeclared (first use in this function) arch/arm/mach-imx/mach-imx6q.c:120:5: note: each undeclared identifier is reported only once for each function it appears in The bug was originally reported by Artem Bityutskiy but only partially fixed in ef441806 "ARM: imx6q: register phy fixup only when CONFIG_PHYLIB is enabled". Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Shawn Guo <shawn.guo@linaro.org> Cc: Artem Bityutskiy <dedekind1@gmail.com> Cc: Sascha Hauer <s.hauer@pengutronix.de>
2012-08-23ARM: imx: build pm-imx5 code only when PM is enabledArnd Bergmann1-1/+2
This moves the imx5 pm code out of the list of unconditionally compiled files for imx5, mirroring what we already do for imx6 and how it was done before the code was move from mach-mx5 to mach-imx in v3.3. Without this patch, building with CONFIG_PM disabled results in: arch/arm/mach-imx/pm-imx5.c:202:116: error: redefinition of 'imx51_pm_init' arch/arm/mach-imx/include/mach-imx/common.h:154:91: note: previous definition of 'imx51_pm_init' was here arch/arm/mach-imx/pm-imx5.c:209:116: error: redefinition of 'imx53_pm_init' arch/arm/mach-imx/include/mach-imx/common.h:155:91: note: previous definition of 'imx53_pm_init' was here Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Shawn Guo <shawn.guo@linaro.org> Cc: Sascha Hauer <s.hauer@pengutronix.de> Cc: stable@vger.kernel.org
2012-08-23ARM: omap: allow building omap44xx without SMPArnd Bergmann3-2/+7
The new omap4 cpuidle implementation currently requires ARCH_NEEDS_CPU_IDLE_COUPLED, which only works on SMP. This patch makes it possible to build a non-SMP kernel for that platform. This is not normally desired for end-users but can be useful for testing. Without this patch, building rand-0y2jSKT results in: drivers/cpuidle/coupled.c: In function 'cpuidle_coupled_poke': drivers/cpuidle/coupled.c:317:3: error: implicit declaration of function '__smp_call_function_single' [-Werror=implicit-function-declaration] It's not clear if this patch is the best solution for the problem at hand. I have made sure that we can now build the kernel in all configurations, but that does not mean it will actually work on an OMAP44xx. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com> Tested-by: Santosh Shilimkar <santosh.shilimkar@ti.com> Cc: Kevin Hilman <khilman@ti.com> Cc: Tony Lindgren <tony@atomide.com>
2012-08-23Merge tag 'ux500-fixes-v3.6-rc2' of ↵Arnd Bergmann2-5/+9
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson into fixes From Linus Walleij <linus.walleij@linaro.org>: Here are two audio fixes for the ux500 found by Lee Jones. * tag 'ux500-fixes-v3.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson: ARM: ux500: Ensure probing of Audio devices when Device Tree is enabled ARM: ux500: Fix merge error, no matching driver name for 'snd_soc_u8500' Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2012-08-23Merge branch 'v3.6-samsung-fixes-1' of ↵Arnd Bergmann7-4/+62
git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes From Kukjin Kim <kgene.kim@samsung.com>: For HDMI, already HDMI support for EXYNOS in mainline kernel is broken because its configuration moved to platform data but regarding platform data didn't support yet. And others are for fix warnings. * 'v3.6-samsung-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: EXYNOS: Set HDMI platform data in Origen board ARM: EXYNOS: Set HDMI platform data in SMDKV310 ARM: SAMSUNG: Add API to set platform data for s5p-tv driver ARM: SAMSUNG: Set HDMI platform data for Exynos4x12 SoCs ARM: Samsung: Make uart_save static in pm.c file ARM: S3C24XX: Fix s3c2410_dma_enqueue parameters ARM: S3C24XX: Add missing DMACH_DT_PROP Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2012-08-23Merge branch 'imx/fixes-for-3.6' of ↵Arnd Bergmann455-2722/+4960
git://git.linaro.org/people/shawnguo/linux-2.6 into fixes * 'imx/fixes-for-3.6' of git://git.linaro.org/people/shawnguo/linux-2.6: ARM: dts: imx51-babbage: fix esdhc cd/wp properties ARM: imx6: spin the cpu until hardware takes it down ARM i.MX6q: Add virtual 1/3.5 dividers in the LDB clock path Also updates to Linux 3.6-rc2 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2012-08-23xen/setup: Fix one-off error when adding for-balloon PFNs to the P2M.Konrad Rzeszutek Wilk1-1/+8
When we are finished with return PFNs to the hypervisor, then populate it back, and also mark the E820 MMIO and E820 gaps as IDENTITY_FRAMEs, we then call P2M to set areas that can be used for ballooning. We were off by one, and ended up over-writting a P2M entry that most likely was an IDENTITY_FRAME. For example: 1-1 mapping on 40000->40200 1-1 mapping on bc558->bc5ac 1-1 mapping on bc5b4->bc8c5 1-1 mapping on bc8c6->bcb7c 1-1 mapping on bcd00->100000 Released 614 pages of unused memory Set 277889 page(s) to 1-1 mapping Populating 40200-40466 pfn range: 614 pages added => here we set from 40466 up to bc559 P2M tree to be INVALID_P2M_ENTRY. We should have done it up to bc558. The end result is that if anybody is trying to construct a PTE for PFN bc558 they end up with ~PAGE_PRESENT. CC: stable@vger.kernel.org Reported-by-and-Tested-by: Andre Przywara <andre.przywara@amd.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2012-08-23MIPS: pci-ar724x: avoid data bus error due to a missing PCIe moduleGabor Juhos1-0/+22
If the controller has no PCIe module attached, accessing of the device configuration space causes a data bus error. Avoid this by checking the status of the PCIe link in advance, and indicate an error if the link is down. Signed-off-by: Gabor Juhos <juhosg@openwrt.org> Cc: stable@vger.kernel.org Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/4293/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-08-23ARM: dts: imx51-babbage: fix esdhc cd/wp propertiesShawn Guo2-6/+6
The binding doc and dts use properties "fsl,{cd,wp}-internal" while esdhc driver uses "fsl,{cd,wp}-controller". Fix binding doc and dts to get them match driver code. Reported-by: Chris Ball <cjb@laptop.org> Signed-off-by: Shawn Guo <shawn.guo@linaro.org> Cc: <stable@vger.kernel.org> Acked-by: Chris Ball <cjb@laptop.org>
2012-08-23ARM: imx6: spin the cpu until hardware takes it downShawn Guo1-20/+3
Though commit 602bf40 (ARM: imx6: exit coherency when shutting down a cpu) improves the stability of imx6q cpu hotplug a lot, there are still hangs seen with a more stressful hotplug testing. It's expected that once imx_enable_cpu(cpu, false) is called, the cpu will be taken down by hardware immediately, and the code after that will not get any chance to execute. However, this is not always the case from the testing. The cpu could possibly be alive for a few cycles before hardware actually takes it down. So rather than letting cpu execute some code that could cause a hang in these cycles, let's make the cpu spin there and wait for hardware to take it down. Cc: <stable@vger.kernel.org> Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
2012-08-23block: replace __getblk_slow misfix by grow_dev_page fixHugh Dickins1-36/+30
Commit 91f68c89d8f3 ("block: fix infinite loop in __getblk_slow") is not good: a successful call to grow_buffers() cannot guarantee that the page won't be reclaimed before the immediate next call to __find_get_block(), which is why there was always a loop there. Yesterday I got "EXT4-fs error (device loop0): __ext4_get_inode_loc:3595: inode #19278: block 664: comm cc1: unable to read itable block" on console, which pointed to this commit. I've been trying to bisect for weeks, why kbuild-on-ext4-on-loop-on-tmpfs sometimes fails from a missing header file, under memory pressure on ppc G5. I've never seen this on x86, and I've never seen it on 3.5-rc7 itself, despite that commit being in there: bisection pointed to an irrelevant pinctrl merge, but hard to tell when failure takes between 18 minutes and 38 hours (but so far it's happened quicker on 3.6-rc2). (I've since found such __ext4_get_inode_loc errors in /var/log/messages from previous weeks: why the message never appeared on console until yesterday morning is a mystery for another day.) Revert 91f68c89d8f3, restoring __getblk_slow() to how it was (plus a checkpatch nitfix). Simplify the interface between grow_buffers() and grow_dev_page(), and avoid the infinite loop beyond end of device by instead checking init_page_buffers()'s end_block there (I presume that's more efficient than a repeated call to blkdev_max_block()), returning -ENXIO to __getblk_slow() in that case. And remove akpm's ten-year-old "__getblk() cannot fail ... weird" comment, but that is worrying: are all users of __getblk() really now prepared for a NULL bh beyond end of device, or will some oops?? Signed-off-by: Hugh Dickins <hughd@google.com> Cc: stable@vger.kernel.org # 3.0 3.2 3.4 3.5 Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-08-22hwmon: (asus_atk0110) Add quirk for Asus M5A78LLuca Tettamanti1-0/+6
The old interface is bugged and reads the wrong sensor when retrieving the reading for the chassis fan (it reads the CPU sensor); the new interface works fine. Reported-by: Göran Uddeborg <goeran@uddeborg.se> Cc: stable@vger.kernel.org Tested-by: Göran Uddeborg <goeran@uddeborg.se> Signed-off-by: Luca Tettamanti <kronos.it@gmail.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2012-08-22x86, microcode, AMD: Fix broken ucode patch size checkAndreas Herrmann1-3/+4
This issue was recently observed on an AMD C-50 CPU where a patch of maximum size was applied. Commit be62adb49294 ("x86, microcode, AMD: Simplify ucode verification") added current_size in get_matching_microcode(). This is calculated as size of the ucode patch + 8 (ie. size of the header). Later this is compared against the maximum possible ucode patch size for a CPU family. And of course this fails if the patch has already maximum size. Cc: <stable@vger.kernel.org> [3.3+] Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com> Signed-off-by: Borislav Petkov <borislav.petkov@amd.com> Link: http://lkml.kernel.org/r/1344361461-10076-1-git-send-email-bp@amd64.org Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
2012-08-22KVM: x86 emulator: use stack size attribute to mask rsp in stack opsAvi Kivity1-9/+21
The sub-register used to access the stack (sp, esp, or rsp) is not determined by the address size attribute like other memory references, but by the stack segment's B bit (if not in x86_64 mode). Fix by using the existing stack_mask() to figure out the correct mask. This long-existing bug was exposed by a combination of a27685c33acccce (emulate invalid guest state by default), which causes many more instructions to be emulated, and a seabios change (possibly a bug) which causes the high 16 bits of esp to become polluted across calls to real mode software interrupts. Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2012-08-22Linux 3.6-rc3v3.6-rc3Linus Torvalds1-1/+1
2012-08-22Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds28-181/+419
Pull drm fixes from Dave Airlie: "Intel: edid fixes, power consumption fix, s/r fix, haswell fix Radeon: BIOS loading fixes for UEFI and Thunderbolt machines, better MSAA validation, lockup timeout fixes, modesetting fixes One udl dpms fix, one vmwgfx fix, a couple of trivial core changes. There is an export added to ACPI as part of the radeon bios fixes. I've also included the fbcon flashing cursor vs deinit race fix, that seems the simplest place to start" Trivial conflict in drivers/video/console/fbcon.c due to me having already applied the fbcon flashing cursor vs deinit race fix, and Dave had added a comment in there too. * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (22 commits) fbcon: fix race condition between console lock and cursor timer (v1.1) drm: Add missing static storage class specifiers in drm_proc.c file drm/udl: dpms off the crtc when disabled. drm: Remove two unused fields from struct drm_display_mode drm: stop vmgfx driver explosion drm/radeon/ss: use num_crtc rather than hardcoded 6 Revert "drm/radeon: fix bo creation retry path" drm/i915: use hsw rps tuning values everywhere on gen6+ drm/radeon: split ATRM support out from the ATPX handler (v3) drm/radeon: convert radeon vfct code to use acpi_get_table_with_size ACPI: export symbol acpi_get_table_with_size drm/radeon: implement ACPI VFCT vbios fetch (v3) drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping drm/radeon: fix checking of MSAA renderbuffers on r600-r700 drm/radeon: allow CMASK and FMASK in the CS checker on r600-r700 drm/radeon: init lockup timeout on ring init drm/radeon: avoid turning off spread spectrum for used pll drm/i915: fall back to bit-banging if GMBUS fails in CRT EDID reads drm/i915: extract connector update from intel_ddc_get_modes() for reuse drm/i915: fix hsw uncached pte ...
2012-08-22Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pendingLinus Torvalds8-108/+146
Pull SCSI target fixes from Nicholas Bellinger: "The executive summary includes: - Post-merge review comments for tcm_vhost (MST + nab) - Avoid debugging overhead when not debugging for tcm-fc(FCoE) (MDR) - Fix NULL pointer dereference bug on alloc_page failulre (Yi Zou) - Fix REPORT_LUNs regression bug with pSCSI export (AlexE + nab) - Fix regression bug with handling of zero-length data CDBs (nab) - Fix vhost_scsi_target structure alignment (MST) Thanks again to everyone who contributed a bugfix patch, gave review feedback on tcm_vhost code, and/or reported a bug during their own testing over the last weeks. There is one other outstanding bug reported by Roland recently related to SCSI transfer length overflow handling, for which the current proposed bugfix has been left in queue pending further testing with other non iscsi-target based fabric drivers. As the patch is verified with loopback (local SGL memory from SCSI LLD) + tcm_qla2xxx (TCM allocated SGL memory mapped to PCI HW) fabric ports, it will be included into the next 3.6-rc-fixes PULL request." * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: target: Remove unused se_cmd.cmd_spdtl tcm_fc: rcu_deref outside rcu lock/unlock section tcm_vhost: Fix vhost_scsi_target structure alignment target: Fix regression bug with handling of zero-length data CDBs target/pscsi: Fix bug with REPORT_LUNs handling for SCSI passthrough tcm_vhost: Change vhost_scsi_target->vhost_wwpn to char * target: fix NULL pointer dereference bug alloc_page() fails to get memory tcm_fc: Avoid debug overhead when not debugging tcm_vhost: Post-merge review changes requested by MST tcm_vhost: Fix incorrect IS_ERR() usage in vhost_scsi_map_iov_to_sgl
2012-08-22Merge branch 'i2c-embedded/for-current' of ↵Linus Torvalds4-12/+21
git://git.pengutronix.de/git/wsa/linux Pull i2c-embedded fixes from Wolfram Sang: "Some bugfixes for the "embedded" part of the I2C subsystem. The fixes affect mostly drivers which have been largely reworked lately and where regressions appeared." * 'i2c-embedded/for-current' of git://git.pengutronix.de/git/wsa/linux: i2c: tegra: protect suspend/resume callbacks with CONFIG_PM_SLEEP i2c: diolan-u2c: Fix master_xfer return code I2C: OMAP: xfer: fix runtime PM get/put balance on error i2c: nomadik: Add default configuration into the Nomadik I2C driver
2012-08-22Merge tag 'for-3.6-rc3' of git://gitorious.org/linux-pwm/linux-pwmLinus Torvalds7-22/+36
Pull pwm fixes from Thierry Reding: "These patches fix the Samsung PWM driver and perform some minor cleanups like fixing checkpatch and sparse warnings. Two redundant error messages are removed and the Kconfig help text for the PWM subsystem is made more descriptive." * tag 'for-3.6-rc3' of git://gitorious.org/linux-pwm/linux-pwm: pwm: Improve Kconfig help text pwm: core: Fix coding style issues pwm: vt8500: Fix coding style issue pwm: Remove a redundant error message when devm_request_and_ioremap fails pwm: samsung: add missing device pointer to struct pwm_chip pwm: Add missing static storage class specifiers in core.c file
2012-08-22Merge branch 'for-linus' of ↵Linus Torvalds7-14/+72
git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client Pull ceph fixes from Sage Weil: "Jim's fix closes a narrow race introduced with the msgr changes. One fix resolves problems with debugfs initialization that Yan found when multiple client instances are created (e.g., two clusters mounted, or rbd + cephfs), another one fixes problems with mounting a nonexistent server subdirectory, and the last one fixes a divide by zero error from unsanitized ioctl input that Dan Carpenter found." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: avoid divide by zero in __validate_layout() libceph: avoid truncation due to racing banners ceph: tolerate (and warn on) extraneous dentry from mds libceph: delay debugfs initialization until we learn global_id
2012-08-22Merge tag 'nfs-for-3.6-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfsLinus Torvalds17-119/+241
Pull NFS client bugfixes from Trond Myklebust: - NFSv3 mounts need to fail if the FSINFO rpc call fails - Ensure that the NFS commit cache gets torn down when we unload the NFS module. - Fix memory scribble issues when interrupting a LAYOUTGET rpc call - Fix NFSv4 legacy idmapper regressions - Fix issues with the NFSv4 getacl command - Fix a regression when using the legacy "mount -t nfs4" * tag 'nfs-for-3.6-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFSv3: Ensure that do_proc_get_root() reports errors correctly NFSv4: Ensure that nfs4_alloc_client cleans up on error. NFS: return -ENOKEY when the upcall fails to map the name NFS: Clear key construction data if the idmap upcall fails NFSv4: Don't use private xdr_stream fields in decode_getacl NFSv4: Fix the acl cache size calculation NFSv4: Fix pointer arithmetic in decode_getacl NFS: Alias the nfs module to nfs4 NFS: Fix a regression when loading the NFS v4 module NFSv4.1: Remove a bogus BUG_ON() in nfs4_layoutreturn_done pnfs-obj: Better IO pattern in case of unaligned offset NFS41: add pg_layout_private to nfs_pageio_descriptor pnfs: nfs4_proc_layoutget returns void pnfs: defer release of pages in layoutget nfs: tear down caches in nfs_init_writepagecache when allocation fails
2012-08-22Merge branch 'for-linus' of ↵Linus Torvalds5-46/+56
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull assorted fixes - mostly vfs - from Al Viro: "Assorted fixes, with an unexpected detour into vfio refcounting logics (fell out when digging in an analog of eventpoll race in there)." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: task_work: add a scheduling point in task_work_run() fs: fix fs/namei.c kernel-doc warnings eventpoll: use-after-possible-free in epoll_create1() vfio: grab vfio_device reference *before* exposing the sucker via fd_install() vfio: get rid of vfio_device_put()/vfio_group_get_device* races vfio: get rid of open-coding kref_put_mutex introduce kref_put_mutex() vfio: don't dereference after kfree... mqueue: lift mnt_want_write() outside ->i_mutex, clean up a bit
2012-08-22HID: Remove QUANTA from special drivers listSimon Farnsworth1-1/+0
This QUANTA device is driven by the generic hid-multitouch.ko driver, and therefore shouldn't be in the special drivers list. This has been an oversight in 4fa3a58 ("HID: hid-multitouch: Switch to device groups"). Signed-off-by: Simon Farnsworth <simon.farnsworth@onelan.co.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2012-08-22UBIFS: fix error messages spellingArtem Bityutskiy1-1/+1
Corruptio -> corruption. Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
2012-08-22task_work: add a scheduling point in task_work_run()Eric Dumazet1-0/+1
It seems commit 4a9d4b02 (switch fput to task_work_add) reintroduced the problem addressed in commit 944be0b2 (close_files(): add scheduling point) If a server process with a lot of files (say 2 million tcp sockets) is killed, we can spend a lot of time in task_work_run() and trigger a soft lockup. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-08-22fs: fix fs/namei.c kernel-doc warningsRandy Dunlap1-0/+2
Fix kernel-doc warnings in fs/namei.c: Warning(fs/namei.c:360): No description found for parameter 'inode' Warning(fs/namei.c:672): No description found for parameter 'nd' Signed-off-by: Randy Dunlap <rdunlap@xenotime.net> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-08-22eventpoll: use-after-possible-free in epoll_create1()Al Viro1-1/+1
As soon as we'd installed the file into descriptor table, it can get closed by another thread. Freeing ep in process... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-08-22vfio: grab vfio_device reference *before* exposing the sucker via fd_install()Al Viro1-2/+2
It's not critical (anymore) since another thread closing the file will block on ->device_lock before it gets to dropping the final reference, but it's definitely cleaner that way... Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-08-22vfio: get rid of vfio_device_put()/vfio_group_get_device* racesAl Viro1-2/+1
we really need to make sure that dropping the last reference happens under the group->device_lock; otherwise a loop (under device_lock) might find vfio_device instance that is being freed right now, has already dropped the last reference and waits on device_lock to exclude the sucker from the list. Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-08-22vfio: get rid of open-coding kref_put_mutexAl Viro1-7/+2
Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-08-22introduce kref_put_mutex()Al Viro1-0/+18
equivalent of mutex_lock(mutex); if (!kref_put(kref, release)) mutex_unlock(mutex); Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-08-22vfio: don't dereference after kfree...Al Viro1-1/+2
Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-08-22KVM: MMU: Fix mmu_shrink() so that it can free mmu pages as intendedTakuya Yoshikawa1-4/+9
Although the possible race described in commit 85b7059169e128c57a3a8a3e588fb89cb2031da1 KVM: MMU: fix shrinking page from the empty mmu was correct, the real cause of that issue was a more trivial bug of mmu_shrink() introduced by commit 1952639665e92481c34c34c3e2a71bf3e66ba362 KVM: MMU: do not iterate over all VMs in mmu_shrink() Here is the bug: if (kvm->arch.n_used_mmu_pages > 0) { if (!nr_to_scan--) break; continue; } We skip VMs whose n_used_mmu_pages is not zero and try to shrink others: in other words we try to shrink empty ones by mistake. This patch reverses the logic so that mmu_shrink() can free pages from the first VM whose n_used_mmu_pages is not zero. Note that we also add comments explaining the role of nr_to_scan which is not practically important now, hoping this will be improved in the future. Signed-off-by: Takuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp> Cc: Gleb Natapov <gleb@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com>
2012-08-22x86/alternatives: Fix p6 nops on non-modular kernelsAvi Kivity1-1/+1
Probably a leftover from the early days of self-patching, p6nops are marked __initconst_or_module, which causes them to be discarded in a non-modular kernel. If something later triggers patching, it will overwrite kernel code with garbage. Reported-by: Tomas Racek <tracek@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com> Cc: Michael Tokarev <mjt@tls.msk.ru> Cc: Borislav Petkov <borislav.petkov@amd.com> Cc: Marcelo Tosatti <mtosatti@redhat.com> Cc: qemu-devel@nongnu.org Cc: Anthony Liguori <anthony@codemonkey.ws> Cc: H. Peter Anvin <hpa@linux.intel.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: Alan Cox <alan@linux.intel.com> Link: http://lkml.kernel.org/r/5034AE84.90708@redhat.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
2012-08-22UBIFS: fix complaints about too small debug buffer sizeArtem Bityutskiy1-1/+1
When debugging is enabled, we use a temporary on-stack buffer for formatting the key strings like "(11368871, direntry, 0xcd0750)". The buffer size is 32 bytes and sometimes it is not enough to fit the key string - e.g., when inode numbers are high. This is not fatal, but the key strings are incomplete and UBIFS complains like this: UBIFS assert failed in dbg_snprintf_key at 137 (pid 1) This is a regression caused by "515315a UBIFS: fix key printing". Fix the issue by increasing the buffer to 48 bytes. Reported-by: Michael Hench <michaelhench@gmail.com> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Tested-by: Michael Hench <michaelhench@gmail.com> Cc: stable@vger.kernel.org [v3.3+]
2012-08-22time: Avoid making adjustments if we haven't accumulated anythingJohn Stultz1-0/+4
If update_wall_time() is called and the current offset isn't large enough to accumulate, avoid re-calling timekeeping_adjust which may change the clock freq and can cause 1ns inconsistencies with CLOCK_REALTIME_COARSE/CLOCK_MONOTONIC_COARSE. Signed-off-by: John Stultz <john.stultz@linaro.org> Cc: Prarit Bhargava <prarit@redhat.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1345595449-34965-5-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2012-08-22time: Avoid potential shift overflow with large shift valuesJohn Stultz1-2/+2
Andreas Schwab noticed that the 1 << tk->shift could overflow if the shift value was greater than 30, since 1 would be a 32bit long on 32bit architectures. This issue was introduced by 1e75fa8be (time: Condense timekeeper.xtime into xtime_sec) Use 1ULL instead to ensure we don't overflow on the shift. Reported-by: Andreas Schwab <schwab@linux-m68k.org> Signed-off-by: John Stultz <john.stultz@linaro.org> Cc: Prarit Bhargava <prarit@redhat.com> Cc: Ingo Molnar <mingo@kernel.org> Link: http://lkml.kernel.org/r/1345595449-34965-4-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2012-08-22time: Fix casting issue in timekeeping_forward_nowAndreas Schwab1-1/+1
arch_gettimeoffset returns a u32 value which when shifted by tk->shift can overflow. This issue was introduced with 1e75fa8be (time: Condense timekeeper.xtime into xtime_sec) Cast it to u64 first. Signed-off-by: Andreas Schwab <schwab@linux-m68k.org> Signed-off-by: John Stultz <john.stultz@linaro.org> Cc: Prarit Bhargava <prarit@redhat.com> Cc: Ingo Molnar <mingo@kernel.org> Link: http://lkml.kernel.org/r/1345595449-34965-3-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2012-08-22time: Ensure we normalize the timekeeper in tk_xtime_addJohn Stultz1-0/+1
Andreas noticed problems with resume on specific hardware after commit 1e75fa8b (time: Condense timekeeper.xtime into xtime_sec) combined with commit b44d50dca (time: Fix casting issue in tk_set_xtime and tk_xtime_add) After some digging I realized we aren't normalizing the timekeeper after the add. Add the missing normalize call. Reported-by: Andreas Schwab <schwab@linux-m68k.org> Tested-by: Andreas Schwab <schwab@linux-m68k.org> Signed-off-by: John Stultz <john.stultz@linaro.org> Cc: Prarit Bhargava <prarit@redhat.com> Cc: Ingo Molnar <mingo@kernel.org> Link: http://lkml.kernel.org/r/1345595449-34965-2-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2012-08-22x86/fixup_irq: Use cpu_online_mask instead of cpu_all_maskLiu, Chuansheng1-1/+1
When one CPU is going down and this CPU is the last one in irq affinity, current code is setting cpu_all_mask as the new affinity for that irq. But for some systems (such as in Medfield Android mobile) the firmware sends the interrupt to each CPU in the irq affinity mask, averaged, and cpu_all_mask includes all potential CPUs, i.e. offline ones as well. So replace cpu_all_mask with cpu_online_mask. Signed-off-by: liu chuansheng <chuansheng.liu@intel.com> Acked-by: Yanmin Zhang <yanmin_zhang@linux.intel.com> Acked-by: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/27240C0AC20F114CBF8149A2696CBE4A137286@SHSMSX101.ccr.corp.intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
2012-08-22x86/spinlocks: Fix comment in spinlock.hRichard Weinberger1-2/+1
This comment is no longer true. We support up to 2^16 CPUs because __ticket_t is an u16 if NR_CPUS is larger than 256. Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Ingo Molnar <mingo@kernel.org>
2012-08-22fbcon: fix race condition between console lock and cursor timer (v1.1)Dave Airlie1-1/+8
So we've had a fair few reports of fbcon handover breakage between efi/vesafb and i915 surface recently, so I dedicated a couple of days to finding the problem. Essentially the last thing we saw was the conflicting framebuffer message and that was all. So after much tracing with direct netconsole writes (printks under console_lock not so useful), I think I found the race. Thread A (driver load) Thread B (timer thread) unbind_con_driver -> | bind_con_driver -> | vc->vc_sw->con_deinit -> | fbcon_deinit -> | console_lock() | | | | fbcon_flashcursor timer fires | console_lock() <- blocked for A | | fbcon_del_cursor_timer -> del_timer_sync (BOOM) Of course because all of this is under the console lock, we never see anything, also since we also just unbound the active console guess what we never see anything. Hopefully this fixes the problem for anyone seeing vesafb->kms driver handoff. v1.1: add comment suggestion from Alan. Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2012-08-21Merge branch 'akpm' (Andrew's patch-bomb)Linus Torvalds16-110/+258
Merge fixes from Andrew Morton. Random drivers and some VM fixes. * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (17 commits) mm: compaction: Abort async compaction if locks are contended or taking too long mm: have order > 0 compaction start near a pageblock with free pages rapidio/tsi721: fix unused variable compiler warning rapidio/tsi721: fix inbound doorbell interrupt handling drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode mm: correct page->pfmemalloc to fix deactivate_slab regression drivers/rtc/rtc-pcf2123.c: initialize dynamic sysfs attributes mm/compaction.c: fix deferring compaction mistake drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources string: do not export memweight() to userspace hugetlb: update hugetlbpage.txt checkpatch: add control statement test to SINGLE_STATEMENT_DO_WHILE_MACRO mm: hugetlbfs: correctly populate shared pmd cciss: fix incorrect scsi status reporting Documentation: update mount option in filesystem/vfat.txt mm: change nr_ptes BUG_ON to WARN_ON cs5535-clockevt: typo, it's MFGPT, not MFPGT
2012-08-21Merge branch 'v4l_for_linus' of ↵Linus Torvalds15-179/+217
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "For bug fixes, at soc_camera, si470x, uvcvideo, iguanaworks IR driver, radio_shark Kbuild fixes, and at the V4L2 core (radio fixes)." * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] media: soc_camera: don't clear pix->sizeimage in JPEG mode [media] media: mx2_camera: Fix clock handling for i.MX27 [media] video: mx2_camera: Use clk_prepare_enable/clk_disable_unprepare [media] video: mx1_camera: Use clk_prepare_enable/clk_disable_unprepare [media] media: mx3_camera: buf_init() add buffer state check [media] radio-shark2: Only compile led support when CONFIG_LED_CLASS is set [media] radio-shark: Only compile led support when CONFIG_LED_CLASS is set [media] radio-shark*: Call cancel_work_sync from disconnect rather then release [media] radio-shark*: Remove work-around for dangling pointer in usb intfdata [media] Add USB dependency for IguanaWorks USB IR Transceiver [media] Add missing logging for rangelow/high of hwseek [media] VIDIOC_ENUM_FREQ_BANDS fix [media] mem2mem_testdev: fix querycap regression [media] si470x: v4l2-compliance fixes [media] DocBook: Remove a spurious character [media] uvcvideo: Reset the bytesused field when recycling an erroneous buffer
2012-08-21Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds88-575/+637
Pull networking update from David Miller: "A couple weeks of bug fixing in there. The largest chunk is all the broken crap Amerigo Wang found in the netpoll layer." 1) netpoll and it's users has several serious bugs: a) uses GFP_KERNEL with locks held b) interfaces requiring interrupts disabled are called with them enabled c) and vice versa d) VLAN tag demuxing, as per all other RX packet input paths, is not applied All from Amerigo Wang. 2) Hopefully cure the ipv4 mapped ipv6 address TCP early demux bugs for good, from Neal Cardwell. 3) Unlike AF_UNIX, AF_PACKET sockets don't set a default credentials when the user doesn't specify one explicitly during sendmsg(). Instead we attach an empty (zero) SCM credential block which is definitely not what we want. Fix from Eric Dumazet. 4) IPv6 illegally invokes netdevice notifiers with RCU lock held, fix from Ben Hutchings. 5) inet_csk_route_child_sock() checks wrong inet options pointer, fix from Christoph Paasch. 6) When AF_PACKET is used for transmit, packet loopback doesn't behave properly when a socket fanout is enabled, from Eric Leblond. 7) On bluetooth l2cap channel create failure, we leak the socket, from Jaganath Kanakkassery. 8) Fix all the netprio file handling bugs found by Al Viro, from John Fastabend. 9) Several error return and NULL deref bug fixes in networking drivers from Julia Lawall. 10) A large smattering of struct padding et al. kernel memory leaks to userspace found of Mathias Krause. 11) Conntrack expections in netfilter can access an uninitialized timer, fix from Pablo Neira Ayuso. 12) Several netfilter SIP tracker bug fixes from Patrick McHardy. 13) IPSEC ipv6 routes are not initialized correctly all the time, resulting in an OOPS in inet_putpeer(). Also from Patrick McHardy. 14) Bridging does rcu_dereference() outside of RCU protected area, from Stephen Hemminger. 15) Fix routing cache removal performance regression when looking up output routes that have a local destination. From Zheng Yan. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (87 commits) af_netlink: force credentials passing [CVE-2012-3520] ipv4: fix ip header ident selection in __ip_make_skb() ipv4: Use newinet->inet_opt in inet_csk_route_child_sock() tcp: fix possible socket refcount problem net: tcp: move sk_rx_dst_set call after tcp_create_openreq_child() net/core/dev.c: fix kernel-doc warning netconsole: remove a redundant netconsole_target_put() net: ipv6: fix oops in inet_putpeer() net/stmmac: fix issue of clk_get for Loongson1B. caif: Do not dereference NULL in chnl_recv_cb() af_packet: don't emit packet on orig fanout group drivers/net/irda: fix error return code drivers/net/wan/dscc4.c: fix error return code drivers/net/wimax/i2400m/fw.c: fix error return code smsc75xx: add missing entry to MAINTAINERS net: qmi_wwan: new devices: UML290 and K5006-Z net: sh_eth: Add eth support for R8A7779 device netdev/phy: skip disabled mdio-mux nodes dt: introduce for_each_available_child_of_node, of_get_next_available_child net: netprio: fix cgrp create and write priomap race ...
2012-08-21mm: compaction: Abort async compaction if locks are contended or taking too longMel Gorman4-29/+93
Jim Schutt reported a problem that pointed at compaction contending heavily on locks. The workload is straight-forward and in his own words; The systems in question have 24 SAS drives spread across 3 HBAs, running 24 Ceph OSD instances, one per drive. FWIW these servers are dual-socket Intel 5675 Xeons w/48 GB memory. I've got ~160 Ceph Linux clients doing dd simultaneously to a Ceph file system backed by 12 of these servers. Early in the test everything looks fine procs -------------------memory------------------ ---swap-- -----io---- --system-- -----cpu------- r b swpd free buff cache si so bi bo in cs us sy id wa st 31 15 0 287216 576 38606628 0 0 2 1158 2 14 1 3 95 0 0 27 15 0 225288 576 38583384 0 0 18 2222016 203357 134876 11 56 17 15 0 28 17 0 219256 576 38544736 0 0 11 2305932 203141 146296 11 49 23 17 0 6 18 0 215596 576 38552872 0 0 7 2363207 215264 166502 12 45 22 20 0 22 18 0 226984 576 38596404 0 0 3 2445741 223114 179527 12 43 23 22 0 and then it goes to pot procs -------------------memory------------------ ---swap-- -----io---- --system-- -----cpu------- r b swpd free buff cache si so bi bo in cs us sy id wa st 163 8 0 464308 576 36791368 0 0 11 22210 866 536 3 13 79 4 0 207 14 0 917752 576 36181928 0 0 712 1345376 134598 47367 7 90 1 2 0 123 12 0 685516 576 36296148 0 0 429 1386615 158494 60077 8 84 5 3 0 123 12 0 598572 576 36333728 0 0 1107 1233281 147542 62351 7 84 5 4 0 622 7 0 660768 576 36118264 0 0 557 1345548 151394 59353 7 85 4 3 0 223 11 0 283960 576 36463868 0 0 46 1107160 121846 33006 6 93 1 1 0 Note that system CPU usage is very high blocks being written out has dropped by 42%. He analysed this with perf and found perf record -g -a sleep 10 perf report --sort symbol --call-graph fractal,5 34.63% [k] _raw_spin_lock_irqsave | |--97.30%-- isolate_freepages | compaction_alloc | unmap_and_move | migrate_pages | compact_zone | compact_zone_order | try_to_compact_pages | __alloc_pages_direct_compact | __alloc_pages_slowpath | __alloc_pages_nodemask | alloc_pages_vma | do_huge_pmd_anonymous_page | handle_mm_fault | do_page_fault | page_fault | | | |--87.39%-- skb_copy_datagram_iovec | | tcp_recvmsg | | inet_recvmsg | | sock_recvmsg | | sys_recvfrom | | system_call | | __recv | | | | | --100.00%-- (nil) | | | --12.61%-- memcpy --2.70%-- [...] There was other data but primarily it is all showing that compaction is contended heavily on the zone->lock and zone->lru_lock. commit [b2eef8c0: mm: compaction: minimise the time IRQs are disabled while isolating pages for migration] noted that it was possible for migration to hold the lru_lock for an excessive amount of time. Very broadly speaking this patch expands the concept. This patch introduces compact_checklock_irqsave() to check if a lock is contended or the process needs to be scheduled. If either condition is true then async compaction is aborted and the caller is informed. The page allocator will fail a THP allocation if compaction failed due to contention. This patch also introduces compact_trylock_irqsave() which will acquire the lock only if it is not contended and the process does not need to schedule. Reported-by: Jim Schutt <jaschut@sandia.gov> Tested-by: Jim Schutt <jaschut@sandia.gov> Signed-off-by: Mel Gorman <mgorman@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21mm: have order > 0 compaction start near a pageblock with free pagesMel Gorman1-26/+28
Commit 7db8889ab05b ("mm: have order > 0 compaction start off where it left") introduced a caching mechanism to reduce the amount work the free page scanner does in compaction. However, it has a problem. Consider two process simultaneously scanning free pages C Process A M S F |---------------------------------------| Process B M FS C is zone->compact_cached_free_pfn S is cc->start_pfree_pfn M is cc->migrate_pfn F is cc->free_pfn In this diagram, Process A has just reached its migrate scanner, wrapped around and updated compact_cached_free_pfn accordingly. Simultaneously, Process B finishes isolating in a block and updates compact_cached_free_pfn again to the location of its free scanner. Process A moves to "end_of_zone - one_pageblock" and runs this check if (cc->order > 0 && (!cc->wrapped || zone->compact_cached_free_pfn > cc->start_free_pfn)) pfn = min(pfn, zone->compact_cached_free_pfn); compact_cached_free_pfn is above where it started so the free scanner skips almost the entire space it should have scanned. When there are multiple processes compacting it can end in a situation where the entire zone is not being scanned at all. Further, it is possible for two processes to ping-pong update to compact_cached_free_pfn which is just random. Overall, the end result wrecks allocation success rates. There is not an obvious way around this problem without introducing new locking and state so this patch takes a different approach. First, it gets rid of the skip logic because it's not clear that it matters if two free scanners happen to be in the same block but with racing updates it's too easy for it to skip over blocks it should not. Second, it updates compact_cached_free_pfn in a more limited set of circumstances. If a scanner has wrapped, it updates compact_cached_free_pfn to the end of the zone. When a wrapped scanner isolates a page, it updates compact_cached_free_pfn to point to the highest pageblock it can isolate pages from. If a scanner has not wrapped when it has finished isolated pages it checks if compact_cached_free_pfn is pointing to the end of the zone. If so, the value is updated to point to the highest pageblock that pages were isolated from. This value will not be updated again until a free page scanner wraps and resets compact_cached_free_pfn. This is not optimal and it can still race but the compact_cached_free_pfn will be pointing to or very near a pageblock with free pages. Signed-off-by: Mel Gorman <mgorman@suse.de> Reviewed-by: Rik van Riel <riel@redhat.com> Reviewed-by: Minchan Kim <minchan@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21rapidio/tsi721: fix unused variable compiler warningAlexandre Bounine1-1/+4
Fix unused variable compiler warning when built with CONFIG_RAPIDIO_DEBUG option off. This patch is applicable to kernel versions starting from v3.2 Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com> Cc: Matt Porter <mporter@kernel.crashing.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21rapidio/tsi721: fix inbound doorbell interrupt handlingAlexandre Bounine1-0/+7
Make sure that there is no doorbell messages left behind due to disabled interrupts during inbound doorbell processing. The most common case for this bug is loss of rionet JOIN messages in systems with three or more rionet participants and MSI or MSI-X enabled. As result, requests for packet transfers may finish with "destination unreachable" error message. This patch is applicable to kernel versions starting from v3.2. Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com> Cc: Matt Porter <mporter@kernel.crashing.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour modeAtsushi Nemoto1-2/+5
Correct the offset by subtracting 20 from tm_hour before taking the modulo 12. [ "Why 20?" I hear you ask. Or at least I did. Here's the reason why: RS5C348_BIT_PM is 32, and is - stupidly - included in the RS5C348_HOURS_MASK define. So it's really subtracting out that bit to get "hour+12". But then because it does things modulo 12, it needs to add the 12 in again afterwards anyway. This code is confused. It would be much clearer if RS5C348_HOURS_MASK just didn't include the RS5C348_BIT_PM bit at all, then it wouldn't need to do the silly subtract either. Whatever. It's all just math, the end result is the same. - Linus ] Reported-by: James Nute <newten82@gmail.com> Tested-by: James Nute <newten82@gmail.com> Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21mm: correct page->pfmemalloc to fix deactivate_slab regressionAlex Shi1-10/+11
Commit cfd19c5a9ecf ("mm: only set page->pfmemalloc when ALLOC_NO_WATERMARKS was used") tried to narrow down page->pfmemalloc setting, but it missed some places the pfmemalloc should be set. So, in __slab_alloc, the unalignment pfmemalloc and ALLOC_NO_WATERMARKS cause incorrect deactivate_slab() on our core2 server: 64.73% fio [kernel.kallsyms] [k] _raw_spin_lock | --- _raw_spin_lock | |---0.34%-- deactivate_slab | __slab_alloc | kmem_cache_alloc | | That causes our fio sync write performance to have a 40% regression. Move the checking in get_page_from_freelist() which resolves this issue. Signed-off-by: Alex Shi <alex.shi@intel.com> Acked-by: Mel Gorman <mgorman@suse.de> Cc: David Miller <davem@davemloft.net Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Tested-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Sage Weil <sage@inktank.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21drivers/rtc/rtc-pcf2123.c: initialize dynamic sysfs attributesIlya Shchepetkov1-0/+2
Dynamically allocated sysfs attributes must be initialized using sysfs_attr_init(), otherwise lockdep complains: BUG: key <address> not in .data! Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Ilya Shchepetkov <shchepetkov@ispras.ru> Cc: Chris Verges <chrisv@cyberswitching.com> Cc: Christian Pellegrin <chripell@fsfe.org> Cc: Alessandro Zummo <a.zummo@towertech.it> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21mm/compaction.c: fix deferring compaction mistakeMinchan Kim1-1/+1
Commit aff622495c9a ("vmscan: only defer compaction for failed order and higher") fixed bad deferring policy but made mistake about checking compact_order_failed in __compact_pgdat(). So it can't update compact_order_failed with the new order. This ends up preventing correct operation of policy deferral. This patch fixes it. Signed-off-by: Minchan Kim <minchan@kernel.org> Reviewed-by: Rik van Riel <riel@redhat.com> Acked-by: Mel Gorman <mel@csn.ul.ie> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ ↵Robin Holt1-19/+65
resources On many of our larger systems, CPU 0 has had all of its IRQ resources consumed before XPC loads. Worst cases on machines with multiple 10 GigE cards and multiple IB cards have depleted the entire first socket of IRQs. This patch makes selecting the node upon which IRQs are allocated (as well as all the other GRU Message Queue structures) specifiable as a module load param and has a default behavior of searching all nodes/cpus for an available resources. [akpm@linux-foundation.org: fix build: include cpu.h and module.h] Signed-off-by: Robin Holt <holt@sgi.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21string: do not export memweight() to userspaceWANG Cong1-1/+1
Fix the following warning: usr/include/linux/string.h:8: userspace cannot reference function or variable defined in the kernel Signed-off-by: WANG Cong <xiyou.wangcong@gmail.com> Acked-by: Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21hugetlb: update hugetlbpage.txtZhouping Liu1-2/+8
Commit f0f57b2b1488 ("mm: move hugepage test examples to tools/testing/selftests/vm") moved map_hugetlb.c, hugepage-shm.c and hugepage-mmap.c tests into tools/testing/selftests/vm/ directory, but it didn't update hugetlbpage.txt Signed-off-by: Zhouping Liu <sanweidaying@gmail.com> Acked-by: Dave Young <dyoung@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21checkpatch: add control statement test to SINGLE_STATEMENT_DO_WHILE_MACROJoe Perches1-1/+2
Commit b13edf7ff2dd ("checkpatch: add checks for do {} while (0) macro misuses") added a test that is overly simplistic for single statement macros. Macros that start with control tests should be enclosed in a do {} while (0) loop. Add the necessary control tests to the check. Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Andy Whitcroft <apw@canonical.com> Tested-by: Franz Schrober <franzschrober@yahoo.de> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21mm: hugetlbfs: correctly populate shared pmdMichal Hocko1-5/+16
Each page mapped in a process's address space must be correctly accounted for in _mapcount. Normally the rules for this are straightforward but hugetlbfs page table sharing is different. The page table pages at the PMD level are reference counted while the mapcount remains the same. If this accounting is wrong, it causes bugs like this one reported by Larry Woodman: kernel BUG at mm/filemap.c:135! invalid opcode: 0000 [#1] SMP CPU 22 Modules linked in: bridge stp llc sunrpc binfmt_misc dcdbas microcode pcspkr acpi_pad acpi] Pid: 18001, comm: mpitest Tainted: G W 3.3.0+ #4 Dell Inc. PowerEdge R620/07NDJ2 RIP: 0010:[<ffffffff8112cfed>] [<ffffffff8112cfed>] __delete_from_page_cache+0x15d/0x170 Process mpitest (pid: 18001, threadinfo ffff880428972000, task ffff880428b5cc20) Call Trace: delete_from_page_cache+0x40/0x80 truncate_hugepages+0x115/0x1f0 hugetlbfs_evict_inode+0x18/0x30 evict+0x9f/0x1b0 iput_final+0xe3/0x1e0 iput+0x3e/0x50 d_kill+0xf8/0x110 dput+0xe2/0x1b0 __fput+0x162/0x240 During fork(), copy_hugetlb_page_range() detects if huge_pte_alloc() shared page tables with the check dst_pte == src_pte. The logic is if the PMD page is the same, they must be shared. This assumes that the sharing is between the parent and child. However, if the sharing is with a different process entirely then this check fails as in this diagram: parent | ------------>pmd src_pte----------> data page ^ other--------->pmd--------------------| ^ child-----------| dst_pte For this situation to occur, it must be possible for Parent and Other to have faulted and failed to share page tables with each other. This is possible due to the following style of race. PROC A PROC B copy_hugetlb_page_range copy_hugetlb_page_range src_pte == huge_pte_offset src_pte == huge_pte_offset !src_pte so no sharing !src_pte so no sharing (time passes) hugetlb_fault hugetlb_fault huge_pte_alloc huge_pte_alloc huge_pmd_share huge_pmd_share LOCK(i_mmap_mutex) find nothing, no sharing UNLOCK(i_mmap_mutex) LOCK(i_mmap_mutex) find nothing, no sharing UNLOCK(i_mmap_mutex) pmd_alloc pmd_alloc LOCK(instantiation_mutex) fault UNLOCK(instantiation_mutex) LOCK(instantiation_mutex) fault UNLOCK(instantiation_mutex) These two processes are not poing to the same data page but are not sharing page tables because the opportunity was missed. When either process later forks, the src_pte == dst pte is potentially insufficient. As the check falls through, the wrong PTE information is copied in (harmless but wrong) and the mapcount is bumped for a page mapped by a shared page table leading to the BUG_ON. This patch addresses the issue by moving pmd_alloc into huge_pmd_share which guarantees that the shared pud is populated in the same critical section as pmd. This also means that huge_pte_offset test in huge_pmd_share is serialized correctly now which in turn means that the success of the sharing will be higher as the racing tasks see the pud and pmd populated together. Race identified and changelog written mostly by Mel Gorman. {akpm@linux-foundation.org: attempt to make the huge_pmd_share() comment comprehensible, clean up coding style] Reported-by: Larry Woodman <lwoodman@redhat.com> Tested-by: Larry Woodman <lwoodman@redhat.com> Reviewed-by: Mel Gorman <mgorman@suse.de> Signed-off-by: Michal Hocko <mhocko@suse.cz> Reviewed-by: Rik van Riel <riel@redhat.com> Cc: David Gibson <david@gibson.dropbear.id.au> Cc: Ken Chen <kenchen@google.com> Cc: Cong Wang <xiyou.wangcong@gmail.com> Cc: Hillf Danton <dhillf@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21cciss: fix incorrect scsi status reportingStephen M. Cameron1-10/+1
Delete code which sets SCSI status incorrectly as it's already been set correctly above this incorrect code. The bug was introduced in 2009 by commit b0e15f6db111 ("cciss: fix typo that causes scsi status to be lost.") Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Reported-by: Roel van Meer <roel.vanmeer@bokxing.nl> Tested-by: Roel van Meer <roel.vanmeer@bokxing.nl> Cc: Jens Axboe <axboe@kernel.dk> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21Documentation: update mount option in filesystem/vfat.txtNamjae Jeon1-0/+11
Update two mount options(discard, nfs) in vfat.txt. Signed-off-by: Namjae Jeon <linkinjeon@gmail.com> Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21mm: change nr_ptes BUG_ON to WARN_ONHugh Dickins1-1/+1
Occasionally an isolated BUG_ON(mm->nr_ptes) gets reported, indicating that not all the page tables allocated could be found and freed when exit_mmap() tore down the user address space. There's usually nothing we can say about it, beyond that it's probably a sign of some bad memory or memory corruption; though it might still indicate a bug in vma or page table management (and did recently reveal a race in THP, fixed a few months ago). But one overdue change we can make is from BUG_ON to WARN_ON. It's fairly likely that the system will crash shortly afterwards in some other way (for example, the BUG_ON(page_mapped(page)) in __delete_from_page_cache(), once an inode mapped into the lost page tables gets evicted); but might tell us more before that. Change the BUG_ON(page_mapped) to WARN_ON too? Later perhaps: I'm less eager, since that one has several times led to fixes. Signed-off-by: Hugh Dickins <hughd@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21cs5535-clockevt: typo, it's MFGPT, not MFPGTJens Rottmann1-2/+2
Signed-off-by: Jens Rottmann <JRottmann@LiPPERTEmbedded.de> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: John Stultz <john.stultz@linaro.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-22drm: Add missing static storage class specifiers in drm_proc.c fileSachin Kamat1-2/+2
Fixes the following sparse warning: drivers/gpu/drm/drm_proc.c:92:5: warning: symbol 'drm_proc_create_files' was not declared. Should it be static? drivers/gpu/drm/drm_proc.c:175:5: warning: symbol 'drm_proc_remove_files' was not declared. Should it be static? Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
2012-08-22drm/udl: dpms off the crtc when disabled.Dave Airlie1-2/+1
This turns off the crtc when its been disabled, fixes it not turning off properly the whole time. Signed-off-by: Dave Airlie <airlied@redhat.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
2012-08-22drm: Remove two unused fields from struct drm_display_modeDamien Lespiau2-5/+0
Signed-off-by: Damien Lespiau <damien.lespiau@intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2012-08-22drm: stop vmgfx driver explosionAlan Cox1-1/+5
If you do a page flip with no flags set then event is NULL. If event is NULL then the vmw_gfx driver likes to go digging into NULL and extracts NULL->base.file_priv. On a modern kernel with NULL mapping protection it's just another oops, without it there are some "intriguing" possibilities. What it should do is an open question but that for the driver owners to sort out. Signed-off-by: Alan Cox <alan@linux.intel.com> Reviewed-by: Jakob Bornecrantz <jakob@vmware.com> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2012-08-22Merge branch 'drm-intel-fixes' of ↵Dave Airlie10-64/+141
git://people.freedesktop.org/~danvet/drm-intel into drm-fixes Daniel writes: " Nothing too major: - A few fixes around the edid handling from Jani, also fixing a regression in 3.5 due to us using gmbus by default. - Fixup hsw uncached pte flags. - Fix suspend/resume crash when using hw contexts, from Ben. - Try to tune gpu turbo a bit better, seems to help with some oddball power regressions." * 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel: drm/i915: use hsw rps tuning values everywhere on gen6+ drm/i915: fall back to bit-banging if GMBUS fails in CRT EDID reads drm/i915: extract connector update from intel_ddc_get_modes() for reuse drm/i915: fix hsw uncached pte drm/i915/contexts: fix list corruption drm/i915: fix EDID memory leak in SDVO
2012-08-22Merge branch 'drm-fixes-3.6' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie12-107/+267
into drm-fixes Alex writes: "This is the current set of radeon fixes for 3.6. Nothing too major. Highlights: - fix vbios fetch on pure uefi systems - fix vbios fetch on thunderbolt systems - MSAA fixes - lockup timeout fix - modesetting fix" * 'drm-fixes-3.6' of git://people.freedesktop.org/~agd5f/linux: drm/radeon/ss: use num_crtc rather than hardcoded 6 Revert "drm/radeon: fix bo creation retry path" drm/radeon: split ATRM support out from the ATPX handler (v3) drm/radeon: convert radeon vfct code to use acpi_get_table_with_size ACPI: export symbol acpi_get_table_with_size drm/radeon: implement ACPI VFCT vbios fetch (v3) drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping drm/radeon: fix checking of MSAA renderbuffers on r600-r700 drm/radeon: allow CMASK and FMASK in the CS checker on r600-r700 drm/radeon: init lockup timeout on ring init drm/radeon: avoid turning off spread spectrum for used pll
2012-08-21ceph: avoid divide by zero in __validate_layout()Sage Weil1-1/+2
If "l->stripe_unit" is zero the the mod on the next line will cause a divide by zero bug. This comes from the copy_from_user() in ceph_ioctl_set_layout_policy(). Passing 0 is valid, though (it means "do not change") so avoid the % check in that case. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Sage Weil <sage@inktank.com> Reviewed-by: Alex Elder <elder@inktank.com>
2012-08-21libceph: avoid truncation due to racing bannersJim Schutt1-2/+9
Because the Ceph client messenger uses a non-blocking connect, it is possible for the sending of the client banner to race with the arrival of the banner sent by the peer. When ceph_sock_state_change() notices the connect has completed, it schedules work to process the socket via con_work(). During this time the peer is writing its banner, and arrival of the peer banner races with con_work(). If con_work() calls try_read() before the peer banner arrives, there is nothing for it to do, after which con_work() calls try_write() to send the client's banner. In this case Ceph's protocol negotiation can complete succesfully. The server-side messenger immediately sends its banner and addresses after accepting a connect request, *before* actually attempting to read or verify the banner from the client. As a result, it is possible for the banner from the server to arrive before con_work() calls try_read(). If that happens, try_read() will read the banner and prepare protocol negotiation info via prepare_write_connect(). prepare_write_connect() calls con_out_kvec_reset(), which discards the as-yet-unsent client banner. Next, con_work() calls try_write(), which sends the protocol negotiation info rather than the banner that the peer is expecting. The result is that the peer sees an invalid banner, and the client reports "negotiation failed". Fix this by moving con_out_kvec_reset() out of prepare_write_connect() to its callers at all locations except the one where the banner might still need to be sent. [elder@inktak.com: added note about server-side behavior] Signed-off-by: Jim Schutt <jaschut@sandia.gov> Reviewed-by: Alex Elder <elder@inktank.com>
2012-08-21ceph: tolerate (and warn on) extraneous dentry from mdsSage Weil1-5/+10
If the MDS gives us a dentry and we weren't prepared to handle it, WARN_ON_ONCE instead of crashing. Reported-by: Yan, Zheng <zheng.z.yan@intel.com> Signed-off-by: Sage Weil <sage@inktank.com> Reviewed-by: Alex Elder <elder@inktank.com>
2012-08-21drm/radeon/ss: use num_crtc rather than hardcoded 6Alex Deucher1-1/+1
When checking if a pll is in use. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2012-08-21ide: fix generic_ide_suspend/resume OopsMiklos Szeredi1-2/+2
This patch fixes a regresion introduced by commit 0998d063 (device-core: Ensure drvdata = NULL when no driver is bound). Suspend oopses in generic_ide_suspend() because dev_get_drvdata() returns NULL (dev->p->driver_data == NULL) and this function is not prepared for this. Fix is based on Alan Stern's suggestion. Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> Acked-by: Rafael J. Wysocki <rjw@sisk.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-21af_netlink: force credentials passing [CVE-2012-3520]Eric Dumazet3-4/+6
Pablo Neira Ayuso discovered that avahi and potentially NetworkManager accept spoofed Netlink messages because of a kernel bug. The kernel passes all-zero SCM_CREDENTIALS ancillary data to the receiver if the sender did not provide such data, instead of not including any such data at all or including the correct data from the peer (as it is the case with AF_UNIX). This bug was introduced in commit 16e572626961 (af_unix: dont send SCM_CREDENTIALS by default) This patch forces passing credentials for netlink, as before the regression. Another fix would be to not add SCM_CREDENTIALS in netlink messages if not provided by the sender, but it might break some programs. With help from Florian Weimer & Petr Matousek This issue is designated as CVE-2012-3520 Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Petr Matousek <pmatouse@redhat.com> Cc: Florian Weimer <fweimer@redhat.com> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-21ipv4: fix ip header ident selection in __ip_make_skb()Eric Dumazet1-1/+1
Christian Casteyde reported a kmemcheck 32-bit read from uninitialized memory in __ip_select_ident(). It turns out that __ip_make_skb() called ip_select_ident() before properly initializing iph->daddr. This is a bug uncovered by commit 1d861aa4b3fb (inet: Minimize use of cached route inetpeer.) Addresses https://bugzilla.kernel.org/show_bug.cgi?id=46131 Reported-by: Christian Casteyde <casteyde.christian@free.fr> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-21ipv4: Use newinet->inet_opt in inet_csk_route_child_sock()Christoph Paasch1-1/+6
Since 0e734419923bd ("ipv4: Use inet_csk_route_child_sock() in DCCP and TCP."), inet_csk_route_child_sock() is called instead of inet_csk_route_req(). However, after creating the child-sock in tcp/dccp_v4_syn_recv_sock(), ireq->opt is set to NULL, before calling inet_csk_route_child_sock(). Thus, inside inet_csk_route_child_sock() opt is always NULL and the SRR-options are not respected anymore. Packets sent by the server won't have the correct destination-IP. This patch fixes it by accessing newinet->inet_opt instead of ireq->opt inside inet_csk_route_child_sock(). Reported-by: Luca Boccassi <luca.boccassi@gmail.com> Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-21tcp: fix possible socket refcount problemEric Dumazet3-10/+18
Commit 6f458dfb40 (tcp: improve latencies of timer triggered events) added bug leading to following trace : [ 2866.131281] IPv4: Attempt to release TCP socket in state 1 ffff880019ec0000 [ 2866.131726] [ 2866.132188] ========================= [ 2866.132281] [ BUG: held lock freed! ] [ 2866.132281] 3.6.0-rc1+ #622 Not tainted [ 2866.132281] ------------------------- [ 2866.132281] kworker/0:1/652 is freeing memory ffff880019ec0000-ffff880019ec0a1f, with a lock still held there! [ 2866.132281] (sk_lock-AF_INET-RPC){+.+...}, at: [<ffffffff81903619>] tcp_sendmsg+0x29/0xcc6 [ 2866.132281] 4 locks held by kworker/0:1/652: [ 2866.132281] #0: (rpciod){.+.+.+}, at: [<ffffffff81083567>] process_one_work+0x1de/0x47f [ 2866.132281] #1: ((&task->u.tk_work)){+.+.+.}, at: [<ffffffff81083567>] process_one_work+0x1de/0x47f [ 2866.132281] #2: (sk_lock-AF_INET-RPC){+.+...}, at: [<ffffffff81903619>] tcp_sendmsg+0x29/0xcc6 [ 2866.132281] #3: (&icsk->icsk_retransmit_timer){+.-...}, at: [<ffffffff81078017>] run_timer_softirq+0x1ad/0x35f [ 2866.132281] [ 2866.132281] stack backtrace: [ 2866.132281] Pid: 652, comm: kworker/0:1 Not tainted 3.6.0-rc1+ #622 [ 2866.132281] Call Trace: [ 2866.132281] <IRQ> [<ffffffff810bc527>] debug_check_no_locks_freed+0x112/0x159 [ 2866.132281] [<ffffffff818a0839>] ? __sk_free+0xfd/0x114 [ 2866.132281] [<ffffffff811549fa>] kmem_cache_free+0x6b/0x13a [ 2866.132281] [<ffffffff818a0839>] __sk_free+0xfd/0x114 [ 2866.132281] [<ffffffff818a08c0>] sk_free+0x1c/0x1e [ 2866.132281] [<ffffffff81911e1c>] tcp_write_timer+0x51/0x56 [ 2866.132281] [<ffffffff81078082>] run_timer_softirq+0x218/0x35f [ 2866.132281] [<ffffffff81078017>] ? run_timer_softirq+0x1ad/0x35f [ 2866.132281] [<ffffffff810f5831>] ? rb_commit+0x58/0x85 [ 2866.132281] [<ffffffff81911dcb>] ? tcp_write_timer_handler+0x148/0x148 [ 2866.132281] [<ffffffff81070bd6>] __do_softirq+0xcb/0x1f9 [ 2866.132281] [<ffffffff81a0a00c>] ? _raw_spin_unlock+0x29/0x2e [ 2866.132281] [<ffffffff81a1227c>] call_softirq+0x1c/0x30 [ 2866.132281] [<ffffffff81039f38>] do_softirq+0x4a/0xa6 [ 2866.132281] [<ffffffff81070f2b>] irq_exit+0x51/0xad [ 2866.132281] [<ffffffff81a129cd>] do_IRQ+0x9d/0xb4 [ 2866.132281] [<ffffffff81a0a3ef>] common_interrupt+0x6f/0x6f [ 2866.132281] <EOI> [<ffffffff8109d006>] ? sched_clock_cpu+0x58/0xd1 [ 2866.132281] [<ffffffff81a0a172>] ? _raw_spin_unlock_irqrestore+0x4c/0x56 [ 2866.132281] [<ffffffff81078692>] mod_timer+0x178/0x1a9 [ 2866.132281] [<ffffffff818a00aa>] sk_reset_timer+0x19/0x26 [ 2866.132281] [<ffffffff8190b2cc>] tcp_rearm_rto+0x99/0xa4 [ 2866.132281] [<ffffffff8190dfba>] tcp_event_new_data_sent+0x6e/0x70 [ 2866.132281] [<ffffffff8190f7ea>] tcp_write_xmit+0x7de/0x8e4 [ 2866.132281] [<ffffffff818a565d>] ? __alloc_skb+0xa0/0x1a1 [ 2866.132281] [<ffffffff8190f952>] __tcp_push_pending_frames+0x2e/0x8a [ 2866.132281] [<ffffffff81904122>] tcp_sendmsg+0xb32/0xcc6 [ 2866.132281] [<ffffffff819229c2>] inet_sendmsg+0xaa/0xd5 [ 2866.132281] [<ffffffff81922918>] ? inet_autobind+0x5f/0x5f [ 2866.132281] [<ffffffff810ee7f1>] ? trace_clock_local+0x9/0xb [ 2866.132281] [<ffffffff8189adab>] sock_sendmsg+0xa3/0xc4 [ 2866.132281] [<ffffffff810f5de6>] ? rb_reserve_next_event+0x26f/0x2d5 [ 2866.132281] [<ffffffff8103e6a9>] ? native_sched_clock+0x29/0x6f [ 2866.132281] [<ffffffff8103e6f8>] ? sched_clock+0x9/0xd [ 2866.132281] [<ffffffff810ee7f1>] ? trace_clock_local+0x9/0xb [ 2866.132281] [<ffffffff8189ae03>] kernel_sendmsg+0x37/0x43 [ 2866.132281] [<ffffffff8199ce49>] xs_send_kvec+0x77/0x80 [ 2866.132281] [<ffffffff8199cec1>] xs_sendpages+0x6f/0x1a0 [ 2866.132281] [<ffffffff8107826d>] ? try_to_del_timer_sync+0x55/0x61 [ 2866.132281] [<ffffffff8199d0d2>] xs_tcp_send_request+0x55/0xf1 [ 2866.132281] [<ffffffff8199bb90>] xprt_transmit+0x89/0x1db [ 2866.132281] [<ffffffff81999bcd>] ? call_connect+0x3c/0x3c [ 2866.132281] [<ffffffff81999d92>] call_transmit+0x1c5/0x20e [ 2866.132281] [<ffffffff819a0d55>] __rpc_execute+0x6f/0x225 [ 2866.132281] [<ffffffff81999bcd>] ? call_connect+0x3c/0x3c [ 2866.132281] [<ffffffff819a0f33>] rpc_async_schedule+0x28/0x34 [ 2866.132281] [<ffffffff810835d6>] process_one_work+0x24d/0x47f [ 2866.132281] [<ffffffff81083567>] ? process_one_work+0x1de/0x47f [ 2866.132281] [<ffffffff819a0f0b>] ? __rpc_execute+0x225/0x225 [ 2866.132281] [<ffffffff81083a6d>] worker_thread+0x236/0x317 [ 2866.132281] [<ffffffff81083837>] ? process_scheduled_works+0x2f/0x2f [ 2866.132281] [<ffffffff8108b7b8>] kthread+0x9a/0xa2 [ 2866.132281] [<ffffffff81a12184>] kernel_thread_helper+0x4/0x10 [ 2866.132281] [<ffffffff81a0a4b0>] ? retint_restore_args+0x13/0x13 [ 2866.132281] [<ffffffff8108b71e>] ? __init_kthread_worker+0x5a/0x5a [ 2866.132281] [<ffffffff81a12180>] ? gs_change+0x13/0x13 [ 2866.308506] IPv4: Attempt to release TCP socket in state 1 ffff880019ec0000 [ 2866.309689] ============================================================================= [ 2866.310254] BUG TCP (Not tainted): Object already free [ 2866.310254] ----------------------------------------------------------------------------- [ 2866.310254] The bug comes from the fact that timer set in sk_reset_timer() can run before we actually do the sock_hold(). socket refcount reaches zero and we free the socket too soon. timer handler is not allowed to reduce socket refcnt if socket is owned by the user, or we need to change sk_reset_timer() implementation. We should take a reference on the socket in case TCP_DELACK_TIMER_DEFERRED or TCP_DELACK_TIMER_DEFERRED bit are set in tsq_flags Also fix a typo in tcp_delack_timer(), where TCP_WRITE_TIMER_DEFERRED was used instead of TCP_DELACK_TIMER_DEFERRED. For consistency, use same socket refcount change for TCP_MTU_REDUCED_DEFERRED, even if not fired from a timer. Reported-by: Fengguang Wu <fengguang.wu@intel.com> Tested-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-21target: Remove unused se_cmd.cmd_spdtlRoland Dreier2-4/+0
This was originally for helping fabrics to determine overflow/underflow status, and has been superceeded by SCF_OVERFLOW_BIT + SCF_UNDERFLOW_BIT. Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2012-08-21Merge branch 'audit-fixes' of ↵Linus Torvalds1-7/+12
git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull audit-tree fixes from Miklos Szeredi: "The audit subsystem maintainers (Al and Eric) are not responding to repeated resends. Eric did ack them a while ago, but no response since then. So I'm sending these directly to you." * 'audit-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: audit: clean up refcounting in audit-tree audit: fix refcounting in audit-tree audit: don't free_chunk() after fsnotify_add_mark()
2012-08-21Merge branch 'for-linus' of ↵Linus Torvalds2-4/+2
git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu arch fixes from Greg Ungerer: "This contains 2 fixes. One fixes compilation of ColdFire clk code, the other makes sure we use the generic atomic64 support on all m68k targets." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: select CONFIG_GENERIC_ATOMIC64 for all m68k CPU types m68knommu: select CONFIG_HAVE_CLK for ColdFire CPU types
2012-08-21Merge tag 'pinctrl-fixes-v3.6-rc3' of ↵Linus Torvalds6-16/+13
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Fixed Nomadik errorpath - Fixed documentation spelling errors - Forward-declare struct device in a header file - Remove some extraneous code lines when getting pinctrl states - Correct the i.MX51 configure register number - Fix the Nomadik keypad function group list * tag 'pinctrl-fixes-v3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl/nomadik: add kp_b_2 keyboard function group list pinctrl: imx51: fix .conf_reg of MX51_PAD_SD2_CMD__CSPI_MOSI trivial: pinctrl core: remove extraneous code lines pinctrl: header: trivial: declare struct device Documentation/pinctrl.txt: Fix some misspelled macros pinctrl/nomadik: fix null in irqdomain errorpath
2012-08-21Merge tag 'sound-3.6' of ↵Linus Torvalds40-233/+257
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This update became slightly bigger than usual for rc3, but most of the commits are small and trivial. A large chunk is found for HD-audio ca0132 codec, which is mostly a clean up of the specific code, to make SPDIF working properly, and also in the new ASoC Arizona driver. One important fix is for usb-audio Oops fix since 3.5. We still see some EHCI related bandwidth problem, but usb-audio should be more stabilized now. Other than that, a Kconfig fix is spread over files, and various HD-audio and ASoC fixes as usual, in addition to Julia's error path fixes." * tag 'sound-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (42 commits) ALSA: snd-als100: fix suspend/resume ALSA: hda - Fix leftover codec->power_transition ALSA: hda - don't create dysfunctional mixer controls for ca0132 ALSA: sound/ppc/snd_ps3.c: fix error return code ALSA: sound/pci/rme9652/hdspm.c: fix error return code ALSA: sound/pci/sis7019.c: fix error return code ALSA: sound/pci/ctxfi/ctatc.c: fix error return code ALSA: sound/atmel/ac97c.c: fix error return code ALSA: sound/atmel/abdac.c: fix error return code ALSA: fix pcm.h kernel-doc warning and notation sound: oss/sb_audio: prevent divide by zero bug ASoC: wm9712: Fix inverted capture volume ASoC: wm9712: Fix microphone source selection ASoC: wm5102: Remove DRC2 ALSA: hda - Don't send invalid volume knob command on IDT 92hd75bxx ALSA: usb-audio: Fix scheduling-while-atomic bug in PCM capture stream ALSA: lx6464es: Add a missing error check ALSA: hda - Fix 'Beep Playback Switch' with no underlying mute switch ASoC: jack: Always notify full jack status ASoC: wm5110: Add missing input PGA routes ...
2012-08-21task_work: add a scheduling point in task_work_run()Eric Dumazet1-0/+1
It seems commit 4a9d4b024a31 ("switch fput to task_work_add") re- introduced the problem addressed in 944be0b22472 ("close_files(): add scheduling point") If a server process with a lot of files (say 2 million tcp sockets) is killed, we can spend a lot of time in task_work_run() and trigger a soft lockup. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21fbcon: fix race condition between console lock and cursor timerDave Airlie1-1/+5
So we've had a fair few reports of fbcon handover breakage between efi/vesafb and i915 surface recently, so I dedicated a couple of days to finding the problem. Essentially the last thing we saw was the conflicting framebuffer message and that was all. So after much tracing with direct netconsole writes (printks under console_lock not so useful), I think I found the race. Thread A (driver load) Thread B (timer thread) unbind_con_driver -> | bind_con_driver -> | vc->vc_sw->con_deinit -> | fbcon_deinit -> | console_lock() | | | | fbcon_flashcursor timer fires | console_lock() <- blocked for A | | fbcon_del_cursor_timer -> del_timer_sync (BOOM) Of course because all of this is under the console lock, we never see anything, also since we also just unbound the active console guess what we never see anything. Hopefully this fixes the problem for anyone seeing vesafb->kms driver handoff. Signed-off-by: David Airlie <airlied@redhat.com> Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: stable@vger.kernel.org Tested-by: Josh Boyer <jwboyer@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-21Merge tag 'perf-urgent-for-mingo' of ↵Ingo Molnar1-0/+2
git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fix from Arnaldo Carvalho de Melo: * Add missing object files needed to use the python binding, cherry-picked from perf/core, got a report it affects Linus's tree too, fix it. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ingo Molnar <mingo@kernel.org>
2012-08-21Revert "drm/radeon: fix bo creation retry path"Alex Deucher1-2/+1
This reverts commit d1c7871ddb1f588b8eb35affd9ee1a3d5e11cd0c. ttm_bo_init() destroys the BO on failure. So this patch makes the retry path work with freed memory. This ends up causing kernel panics when this path is hit. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2012-08-21perf tools: Add missing files to build the python bindingArnaldo Carvalho de Melo1-0/+2
Changeset 0f6a3015: "perf tools: Support user regs and stack in sample parsing" uses hweight_long in evsel.c, so we need to drag util/hweight.c to the python binding. Ditto for ee8dd3c: "perf tools: Change strlist to use the new rblist" where we need to add util/rblist.c. Now twatch.py works again: # export PYTHONPATH=~acme/git/build/perf/python/ # ~acme/git/linux/tools/perf/python/twatch.py cpu: 4, pid: 23639, tid: 23639 { type: fork, pid: 30659, ppid: 23639, tid: 30659, ptid: 23639, time: 36287872076780} cpu: 5, pid: 30659, tid: 30659 { type: comm, pid: 30659, tid: 30659, comm: ls } cpu: 5, pid: 30659, tid: 30659 { type: exit, pid: 30659, ppid: 30659, tid: 30659, ptid: 30659, time: 36287873681539} cpu: 4, pid: 23639, tid: 23639 { type: fork, pid: 30660, ppid: 23639, tid: 30660, ptid: 23639, time: 36291720420480} cpu: 5, pid: 30659, tid: 30659 { type: exit, pid: 30659, ppid: 30659, tid: 30659, ptid: 30659, time: 36287873685714} cpu: 5, pid: 30660, tid: 30660 { type: comm, pid: 30660, tid: 30660, comm: git } ^C KeyboardInterrupt Reported-by: Jérôme Carretero <cJ-ko@zougloub.eu> Cc: David Ahern <dsahern@gmail.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Mike Galbraith <efault@gmx.de> Cc: Namhyung Kim <namhyung@gmail.com> Cc: Paul Mackerras <paulus@samba.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Link: http://lkml.kernel.org/n/tip-gmq82zp5blin9aml9g5tzokr@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2012-08-21UBIFS: fix replay regressionArtem Bityutskiy1-2/+1
Commit "d51f17e UBIFS: simplify reply code a bit" introduces a bug with the following symptoms: UBIFS error (pid 1): replay_log_leb: first CS node at LEB 3:0 has wrong commit number 0 expected 1 The issue is that we start replaying the log from UBIFS_LOG_LNUM instead of c->lhead_lnum. This patch fixes that. Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
2012-08-21UBIFS: fix crash on error pathArtem Bityutskiy1-1/+4
This patch fixes a regression introduced by "4994297 UBIFS: make ubifs_lpt_init clean-up in case of failure" which I've hit while running the 'integck -p' test. When remount the file-system from R/O mode to R/W mode and 'lpt_init_wr()' fails, we free _all_ LPT resources by calling 'ubifs_lpt_free(c, 0)', even those needed for R/O mode. This leads to subsequent crashes, e.g., if we try to unmount the file-system. Cc: stable@vger.kernel.org [v3.5+] Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
2012-08-21UBIFS: remove stale commentaryArtem Bityutskiy1-3/+0
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
2012-08-21Merge branch 'tip/perf/urgent' of ↵Ingo Molnar1-0/+4
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace into perf/urgent Pull syscall tracing fix from Steve Rostedt. Signed-off-by: Ingo Molnar <mingo@kernel.org>
2012-08-21uprobes: Fix mmap_region()'s mm->mm_rb corruption if uprobe_mmap() failsOleg Nesterov2-5/+4
This patch fixes: https://bugzilla.redhat.com/show_bug.cgi?id=843640 If mmap_region()->uprobe_mmap() fails, unmap_and_free_vma path does unmap_region() but does not remove the soon-to-be-freed vma from rb tree. Actually there are more problems but this is how William noticed this bug. Perhaps we could do do_munmap() + return in this case, but in fact it is simply wrong to abort if uprobe_mmap() fails. Until at least we move the !UPROBE_COPY_INSN code from install_breakpoint() to uprobe_register(). For example, uprobe_mmap()->install_breakpoint() can fail if the probed insn is not supported (remember, uprobe_register() succeeds if nobody mmaps inode/offset), mmap() should not fail in this case. dup_mmap()->uprobe_mmap() is wrong too by the same reason, fork() can race with uprobe_register() and fail for no reason if it wins the race and does install_breakpoint() first. And, if nothing else, both mmap_region() and dup_mmap() return success if uprobe_mmap() fails. Change them to ignore the error code from uprobe_mmap(). Reported-and-tested-by: William Cohen <wcohen@redhat.com> Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com> Cc: <stable@vger.kernel.org> # v3.5 Cc: Anton Arapov <anton@redhat.com> Cc: William Cohen <wcohen@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Link: http://lkml.kernel.org/r/20120819171042.GB26957@redhat.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
2012-08-21ALSA: snd-als100: fix suspend/resumeOndrej Zary1-1/+1
snd_card_als100_probe() does not set pcm field in struct snd_sb. As a result, PCM is not suspended and applications don't know that they need to resume the playback. Tested with Labway A381-F20 card (ALS120). Signed-off-by: Ondrej Zary <linux@rainbow-software.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-08-20Merge branch 'for-linus' of ↵Linus Torvalds2-2/+9
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: "Here are two patches from Rafael Wysocki. One fixes an EHCI-related hibernation crash on ASUS boxes. We fixed a similar suspend issue in v3.6-rc1, and this applies the same fix to the hibernate path. The other fixes D3/D3cold/D4 messages related to the D3cold support we merged in v3.6-rc1." (Removed redundant top non-fast-forward merge commit from pulled branch) * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: EHCI: Fix crash during hibernation on ASUS computers PCI / PM: Fix D3/D3cold/D4 messages printed by acpi_pci_set_power_state()
2012-08-20svcrpc: fix svc_xprt_enqueue/svc_recv busy-loopingJ. Bruce Fields1-5/+2
The rpc server tries to ensure that there will be room to send a reply before it receives a request. It does this by tracking, in xpt_reserved, an upper bound on the total size of the replies that is has already committed to for the socket. Currently it is adding in the estimate for a new reply *before* it checks whether there is space available. If it finds that there is not space, it then subtracts the estimate back out. This may lead the subsequent svc_xprt_enqueue to decide that there is space after all. The results is a svc_recv() that will repeatedly return -EAGAIN, causing server threads to loop without doing any actual work. Cc: stable@vger.kernel.org Reported-by: Michael Tokarev <mjt@tls.msk.ru> Tested-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2012-08-20svcrpc: sends on closed socket should stop immediatelyJ. Bruce Fields1-1/+2
svc_tcp_sendto sets XPT_CLOSE if we fail to transmit the entire reply. However, the XPT_CLOSE won't be acted on immediately. Meanwhile other threads could send further replies before the socket is really shut down. This can manifest as data corruption: for example, if a truncated read reply is followed by another rpc reply, that second reply will look to the client like further read data. Symptoms were data corruption preceded by svc_tcp_sendto logging something like kernel: rpc-srv/tcp: nfsd: sent only 963696 when sending 1048708 bytes - shutting down socket Cc: stable@vger.kernel.org Reported-by: Malahal Naineni <malahal@us.ibm.com> Tested-by: Malahal Naineni <malahal@us.ibm.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2012-08-20svcrpc: fix BUG() in svc_tcp_clear_pagesJ. Bruce Fields1-1/+1
Examination of svc_tcp_clear_pages shows that it assumes sk_tcplen is consistent with sk_pages[] (in particular, sk_pages[n] can't be NULL if sk_tcplen would lead us to expect n pages of data). svc_tcp_restore_pages zeroes out sk_pages[] while leaving sk_tcplen. This is OK, since both functions are serialized by XPT_BUSY. However, that means the inconsistency must be repaired before dropping XPT_BUSY. Therefore we should be ensuring that svc_tcp_save_pages repairs the problem before exiting svc_tcp_recv_record on error. Symptoms were a BUG() in svc_tcp_clear_pages. Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2012-08-20nfsd4: fix security flavor of NFSv4.0 callbackJ. Bruce Fields2-3/+2
Commit d5497fc693a446ce9100fcf4117c3f795ddfd0d2 "nfsd4: move rq_flavor into svc_cred" forgot to remove cl_flavor from the client, leaving two places (cl_flavor and cl_cred.cr_flavor) for the flavor to be stored. After that patch, the latter was the one that was updated, but the former was the one that the callback used. Symptoms were a long delay on utime(). This is because the utime() generated a setattr which recalled a delegation, but the cb_recall was ignored by the client because it had the wrong security flavor. Cc: stable@vger.kernel.org Tested-by: Jamie Heilman <jamie@audible.transient.net> Reported-by: Jamie Heilman <jamie@audible.transient.net> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2012-08-20Merge tag 'please-pull-ia64-fixes' of ↵Linus Torvalds2-2/+0
git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux Pull config cleanup for ia64 from Tony Luck: "Clean out references to dead CONFIG_MISC_DEVICES option" * tag 'please-pull-ia64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux: [IA64] defconfig: Remove CONFIG_MISC_DEVICES
2012-08-20tcm_fc: rcu_deref outside rcu lock/unlock sectionDenis Efremov1-1/+3
Use rcu_dereference_protected in order to prevent lockdep complaint. Sequel of the patch 863555be Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Denis Efremov <yefremov.denis@gmail.com> Acked-by: Mark D. Rustad <mark.d.rustad@intel.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2012-08-20tcm_vhost: Fix vhost_scsi_target structure alignmentMichael S. Tsirkin2-0/+5
Here TRANSPORT_IQN_LEN is 224, which is a multiple of 4. Since vhost_tpgt is 2 bytes and abi_version is 4, the total size would be 230. But gcc needs struct size be aligned to first field size, which is 4 bytes, so it pads the structure by extra 2 bytes to the total of 232. This padding is very undesirable in an ABI: - it can not be initialized easily - it can not be checked easily - it can leak information between kernel and userspace Simplest solution is probably just to make the padding explicit. (v2: Add check for zero'ed backend->reserved field for VHOST_SCSI_SET_ENDPOINT and VHOST_SCSI_CLEAR_ENDPOINT ops as requested by MST) Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2012-08-20Merge tag 'usb-3.6-rc3' of ↵Linus Torvalds13-11/+15
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull more USB patches from Greg Kroah-Hartman: "Here are 10 more USB patches for 3.6-rc3. They all fix reported problems (build problems for one of them, and easily repeatable oopses for the others.) Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>" * tag 'usb-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: gpu/mfd/usb: Fix USB randconfig problems USB: CDC ACM: Fix NULL pointer dereference USB: emi62: remove __devinit* from the struct usb_device_id table USB: winbond: remove __devinit* from the struct usb_device_id table USB: vt6656: remove __devinit* from the struct usb_device_id table USB: rtl8187: remove __devinit* from the struct usb_device_id table USB: p54usb: remove __devinit* from the struct usb_device_id table USB: spca506: remove __devinit* from the struct usb_device_id table USB: jl2005bcd: remove __devinit* from the struct usb_device_id table USB: smsusb: remove __devinit* from the struct usb_device_id table
2012-08-20Merge tag 'driver-core-3.6-rc3' of ↵Linus Torvalds1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull one more driver core fix from Greg Kroah-Hartman: "Here is one fix for the dmesg line corruption problem that the previous set of patches caused. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>" * tag 'driver-core-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: dyndbg: fix for SOH in logging messages
2012-08-20Merge branch 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86Linus Torvalds11-67/+606
Pull x86 platform driver update from Matthew Garrett: "Some small updates for a few drivers, and some hardware enablement for new Ideapads and the gmux hardware in the latest Macs. This code won't run on older devices and has been well tested on new ones, so low risk of regressions." * 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86: ideapad: add Lenovo IdeaPad Z570 support (part 3) ideapad: add Lenovo IdeaPad Z570 support (part 2) ideapad: add Lenovo IdeaPad Z570 support (part 1) classmate-laptop: always call input_sync() after input_report_switch() thinkpad-acpi: recognize latest V-Series using DMI_BIOS_VENDOR dell-laptop: Fixed typo in touchpad LED quirk vga_switcheroo: Don't require handler init callback vga_switcheroo: Remove assumptions about registration/unregistration ordering apple-gmux: Add display mux support apple-gmux: Fix kconfig dependencies asus-wmi: record wlan status while controlled by userapp apple_gmux: Fix ACPI video unregister apple_gmux: Add support for newer hardware gmux: Add generic write32 function
2012-08-20Merge tag 'hwmon-for-linus' of ↵Linus Torvalds2-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull a hwmon fix from Guenter Roeck: "One patch with section conflict fixes." * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: sections: Fix section conflicts in drivers/hwmon
2012-08-20Merge tag 'spi-3.6' of ↵Linus Torvalds5-15/+13
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/misc Pull spi fixes from Mark Brown: "Grant is still away so another pull request with some fairly minor fixes, the most notable of which are several fixes for some common error patterns with the reference counting spi_master_get/put do." * tag 'spi-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/misc: spi/coldfire-qspi: Drop extra calls to spi_master_get in suspend/resume functions spi: spi-coldfire-qspi: Drop extra spi_master_put in device remove function spi/pl022: fix spi-pl022 pm enable at probe spi/bcm63xx: Ensure that memory is freed only after it is no longer used spi: omap2-mcspi: Fix the error handling in probe spi/s3c64xx: Add missing static storage class specifiers
2012-08-20[IA64] defconfig: Remove CONFIG_MISC_DEVICESFabio Estevam2-2/+0
commit 7c5763b845 (drivers:misc: Remove MISC_DEVICES config option) removed CONFIG_MISC_DEVICES option, so remove the occurrences from the config files as well. Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: Tony Luck <tony.luck@intel.com>
2012-08-20Merge tag 'regulator-3.6' of ↵Linus Torvalds8-35/+59
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A bunch of fixes which are a combination of minor fixes that have been shaken down due to greater testing exposure, the biggest block of which are for the Palmas driver which hadn't had all the changes required for mainline properly tested when it was merged." * tag 'regulator-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: twl-regulator: fix up VINTANA1/VINTANA2 regulator: core: request only valid gpio pins for regulator enable regulator: twl: Remove references to the twl4030 regulator regulator: gpio-regulator: Split setting of voltages and currents regulator: ab3100: add missing voltage table regulator: anatop: Fix wrong mask used in anatop_get_voltage_sel regulator: tps6586x: correct vin pin for sm0/sm1/sm2 regulator: palmas: Fix palmas_probe error handling regulator: palmas: Call palmas_ldo_[read|write] in palmas_ldo_init regulator: palmas: Fix regmap offsets for PALMAS_REG_SMPS10 vsel_reg regulator: palmas: Fix calculating selector in palmas_map_voltage_ldo
2012-08-20Merge tag 'iommu-fixes-v3.6-rc2' of ↵Linus Torvalds2-6/+14
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: "Two fixes are necessary. One patch fixes a boot crash on MacBook Air with interrupt remapping enabled and the other patch fixes a regression (which causes a boot crash on AMD IOMMUv2 systems too) in the init code of the AMD IOMMU driver." * tag 'iommu-fixes-v3.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/amd: Fix wrong check for ARRAY_SIZE() irq_remap: disable IRQ remapping if any IOAPIC lacks an IOMMU
2012-08-20ALSA: hda - Fix leftover codec->power_transitionTakashi Iwai1-0/+2
When the codec turn-on operation is canceled by the immediate power-on, the driver left the power_transition flag as is. This caused the persistent avoidance of power-save behavior. Cc: <stable@vger.kernel.org> [v3.5+] Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-08-20Merge tag 'asoc-3.6' of ↵Takashi Iwai7553-192130/+442821
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Additional updates for 3.6 A batch more bugfixes, all driver-specific and fairly small and unremarkable in a global context. The biggest batch are for the newly added Arizona drivers.
2012-08-20gpu/mfd/usb: Fix USB randconfig problemsGuenter Roeck4-2/+5
Fix config warning: warning: ( ... && DRM_USB) selects USB which has unmet direct dependencies (USB_SUPPORT && USB_ARCH_HAS_HCD) and build error: ERROR: "usb_speed_string" [drivers/usb/core/usbcore.ko] undefined! by adding the missing dependency on USB_ARCH_HAS_HCD to DRM_UDL and DRM_USB. This exposes: drivers/video/Kconfig:36:error: recursive dependency detected! drivers/video/Kconfig:36: symbol FB is selected by DRM_KMS_HELPER drivers/gpu/drm/Kconfig:28: symbol DRM_KMS_HELPER is selected by DRM_UDL drivers/gpu/drm/udl/Kconfig:1: symbol DRM_UDL depends on USB_ARCH_HAS_HCD drivers/usb/Kconfig:78: symbol USB_ARCH_HAS_HCD depends on USB_ARCH_HAS_OHCI drivers/usb/Kconfig:16: symbol USB_ARCH_HAS_OHCI depends on I2C drivers/i2c/Kconfig:5: symbol I2C is selected by FB_DDC drivers/video/Kconfig:86: symbol FB_DDC is selected by FB_CYBER2000_DDC drivers/video/Kconfig:385: symbol FB_CYBER2000_DDC depends on FB_CYBER2000 drivers/video/Kconfig:373: symbol FB_CYBER2000 depends on FB which is due to drivers/usb/Kconfig: config USB_ARCH_HAS_OHCI ... default y if ARCH_PNX4008 && I2C Fix by dropping I2C from the above dependency; logic is that this is not a platform dependency but a configuration dependency: the _architecture_ still supports USB even is I2C is not selected. This exposes: drivers/video/Kconfig:36:error: recursive dependency detected! drivers/video/Kconfig:36: symbol FB is selected by DRM_KMS_HELPER drivers/gpu/drm/Kconfig:28: symbol DRM_KMS_HELPER is selected by DRM_UDL drivers/gpu/drm/udl/Kconfig:1: symbol DRM_UDL depends on USB_ARCH_HAS_HCD drivers/usb/Kconfig:78: symbol USB_ARCH_HAS_HCD depends on USB_ARCH_HAS_OHCI drivers/usb/Kconfig:17: symbol USB_ARCH_HAS_OHCI depends on MFD_TC6393XB drivers/mfd/Kconfig:396: symbol MFD_TC6393XB depends on GPIOLIB drivers/gpio/Kconfig:35: symbol GPIOLIB is selected by FB_VIA drivers/video/Kconfig:1560: symbol FB_VIA depends on FB which can be fixed by having MFD_TC6393XB select GPIOLIB instead of depending on it. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-08-20drm/i915: use hsw rps tuning values everywhere on gen6+Daniel Vetter1-11/+4
James Bottomley reported [1] a massive power regression, due to the enabling of semaphores by default in 3.5. A workaround for him is to again disable semaphores. And indeed, his system has a very hard time to enter rc6 with semaphores enabled. Ben Widawsky run around with a kill-a-watt a lot and noticed: - There are indeed a few rare systems that seem to have a hard time entering rc6 when desktop-idle. - One machine, The Indestructible Toshiba regressed in this behaviour between 3.5 and 3.6 in a merge commit! So rc6 behaviour with the current setting seems to be highly timing dependent and not robust at all. - The behaviour James reported wrt semaphores seems to be a freak timing thing that only happens on his specific machine, confirming that enabling semaphores shouldn't reduce rc6 residency. Now furthermore the Google ChromeOS guys reported [2] a while ago that at least on some machines a simply a blinking cursor can keep the gpu turbo at the highest frequency. This is because the current rps limits used on snb/ivb are highly asymmetric. On the theory that gpu turbo and rc6 tuning values are related, we've tried whether the much saner looking (since much less asymmetric) rps tuning values used for hsw would also help entering rc6 more robustly. And it seems to mostly work, and we don't really have the resources to through-roughly tune things in any better way: The values from the ChromeOS ppl seem to fare a bit worse for James' machine, so I guess we better stick with something vpg (the gpu hw/windows group) provided, hoping that they've done their jobs. Reference[1]: http://lists.freedesktop.org/archives/dri-devel/2012-July/025675.html Reference[2]: http://lists.freedesktop.org/archives/intel-gfx/2012-July/018692.html Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=53393 Tested-by: Ben Widawsky <ben@bwidawsk.net> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-08-20Merge branch 'x86-urgent-for-linus' of ↵Linus Torvalds10-18/+58
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar. A x32 socket ABI fix with a -stable backport tag among other fixes. * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x32: Use compat shims for {g,s}etsockopt Revert "x86-64/efi: Use EFI to deal with platform wall clock" x86, apic: fix broken legacy interrupts in the logical apic mode x86, build: Globally set -fno-pic x86, avx: don't use avx instructions with "noxsave" boot param
2012-08-20Merge branch 'sched-urgent-for-linus' of ↵Linus Torvalds5-19/+70
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar. * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Fix migration thread runtime bogosity sched,rt: fix isolated CPUs leaving root_task_group indefinitely throttled sched,cgroup: Fix up task_groups list sched: fix divide by zero at {thread_group,task}_times sched, cgroup: Reduce rq->lock hold times for large cgroup hierarchies
2012-08-20Merge branch 'perf-urgent-for-linus' of ↵Linus Torvalds3-144/+165
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 perf fixes from Ingo Molnar. * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86: disable PEBS on a guest entry. perf/x86: Add Intel Westmere-EX uncore support perf/x86: Fixes for Nehalem-EX uncore driver perf, x86: Fix uncore_types_exit section mismatch
2012-08-20Merge branch 'core-urgent-for-linus' of ↵Linus Torvalds1-2/+9
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull a mutex fix from Ingo Molnar. Fix the fastpath_lock failure contention flag for xchg-based mutexes. * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: mutex: Place lock in contended state after fastpath_lock failure
2012-08-20vfs: missed source of ->f_pos racesAl Viro1-2/+8
compat_sys_{read,write}v() need the same "pass a copy of file->f_pos" thing as sys_{read,write}{,v}(). Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-08-20libceph: delay debugfs initialization until we learn global_idSage Weil4-6/+51
The debugfs directory includes the cluster fsid and our unique global_id. We need to delay the initialization of the debug entry until we have learned both the fsid and our global_id from the monitor or else the second client can't create its debugfs entry and will fail (and multiple client instances aren't properly reflected in debugfs). Reported by: Yan, Zheng <zheng.z.yan@intel.com> Signed-off-by: Sage Weil <sage@inktank.com> Reviewed-by: Yehuda Sadeh <yehuda@inktank.com>
2012-08-20NFSv3: Ensure that do_proc_get_root() reports errors correctlyTrond Myklebust1-1/+1
If the rpc call to NFS3PROC_FSINFO fails, then we need to report that error so that the mount fails. Otherwise we can end up with a superblock with completely unusable values for block sizes, maxfilesize, etc. Reported-by: Yuanming Chen <hikvision_linux@163.com> Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
2012-08-20ideapad: add Lenovo IdeaPad Z570 support (part 3)Maxim Mikityanskiy2-3/+51
The patch adds support for Lenovo IdeaPad Z570 laptop. It makes all special keys working, adds possibility to control fan like Windows does, controls Touchpad Disabled LED, toggles touchpad state via keyboard controller and corrects touchpad behavior on resume from suspend. It is new, modified version of patch. Now it does not depend on psmouse and does not need patching of input subsystem. Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com> This is the part 3 for fan control Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Matthew Garrett <mjg@redhat.com>
2012-08-20ideapad: add Lenovo IdeaPad Z570 support (part 2)Maxim Mikityanskiy2-0/+36
The patch adds support for Lenovo IdeaPad Z570 laptop. It makes all special keys working, adds possibility to control fan like Windows does, controls Touchpad Disabled LED, toggles touchpad state via keyboard controller and corrects touchpad behavior on resume from suspend. It is new, modified version of patch. Now it does not depend on psmouse and does not need patching of input subsystem. Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com> This is part 2 for touchpad toggle Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Matthew Garrett <mjg@redhat.com>
2012-08-20ideapad: add Lenovo IdeaPad Z570 support (part 1)Maxim Mikityanskiy1-0/+32
The patch adds support for Lenovo IdeaPad Z570 laptop. It makes all special keys working, adds possibility to control fan like Windows does, controls Touchpad Disabled LED, toggles touchpad state via keyboard controller and corrects touchpad behavior on resume from suspend. It is new, modified version of patch. Now it does not depend on psmouse and does not need patching of input subsystem. Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com> This is part 1 for special button handling. Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Matthew Garrett <mjg@redhat.com>
2012-08-20NFSv4: Ensure that nfs4_alloc_client cleans up on error.Trond Myklebust1-1/+1
Any pointer that was allocated through nfs_alloc_client() needs to be freed via a call to nfs_free_client(). Reported-by: Stanislav Kinsbursky <skinsbursky@parallels.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
2012-08-20drm/radeon: split ATRM support out from the ATPX handler (v3)Alex Deucher3-74/+77
There are systems that use ATRM, but not ATPX. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=41265 V2: fix #ifdefs as per Greg's comments V3: fix it harder Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2012-08-20drm/radeon: convert radeon vfct code to use acpi_get_table_with_sizeAlex Deucher1-4/+2
Allows us to verify the table size. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2012-08-20ACPI: export symbol acpi_get_table_with_sizeAlex Deucher1-0/+1
We need it in the radeon drm module to fetch and verify the vbios image on UEFI systems. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2012-08-20drm/radeon: implement ACPI VFCT vbios fetch (v3)David Lamparter1-0/+60
This is required for pure UEFI systems. The vbios is stored in ACPI rather than at the legacy vga location. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=26891 V2: fix #ifdefs as per Greg's comments V3: fix it harder Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Jerome Glisse <jglisse@redhat.com> Cc: stable@vger.kernel.org
2012-08-20drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover ↵Tvrtko Ursulin1-1/+1
later silicon stepping There is a more recent APU stepping with a new PCI ID shipping in the same board by Fujitsu which needs the same quirk to correctly mark the back plane connectors. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@onelan.co.uk> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2012-08-20drm/radeon: fix checking of MSAA renderbuffers on r600-r700Marek Olšák1-5/+6
The MSAA checking was mostly unimplemented on r600-r700. The userspace submits GPU commands and the kernel driver computes how much memory the GPU will access and checks if it's all within buffer bounds the userspace allocated. This patch fixes the computations of the size of MSAA surfaces in memory. Signed-off-by: Marek Olšák <maraeo@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2012-08-20drm/radeon: allow CMASK and FMASK in the CS checker on r600-r700Marek Olšák4-21/+101
MSAA is impossible without them. Signed-off-by: Marek Olšák <maraeo@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Jerome Glisse <jglisse@redhat.com>
2012-08-20drm/radeon: init lockup timeout on ring initChristian König1-0/+1
Reset the lockup timeout on ring (re-)initialisation. Otherwise we get error messages like this on gpu resets: [ 1559.949177] radeon 0000:01:00.0: GPU lockup CP stall for more than 1482270msec Signed-off-by: Christian König <deathsimple@vodafone.de> cc: stable@vger.kernel.org Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
2012-08-20drm/radeon: avoid turning off spread spectrum for used pllJerome Glisse1-4/+21
If spread spectrum is enabled and in use for a given pll we should not turn it off as it will lead to turning off display for crtc that use the pll (this behavior was observed on chelsea edp). Signed-off-by: Jerome Glisse <jglisse@redhat.com> Cc: stable@vger.kernel.org Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
2012-08-20net: tcp: move sk_rx_dst_set call after tcp_create_openreq_child()Neal Cardwell3-14/+14
This commit removes the sk_rx_dst_set calls from tcp_create_openreq_child(), because at that point the icsk_af_ops field of ipv6_mapped TCP sockets has not been set to its proper final value. Instead, to make sure we get the right sk_rx_dst_set variant appropriate for the address family of the new connection, we have tcp_v{4,6}_syn_recv_sock() directly call the appropriate function shortly after the call to tcp_create_openreq_child() returns. This also moves inet6_sk_rx_dst_set() to avoid a forward declaration with the new approach. Signed-off-by: Neal Cardwell <ncardwell@google.com> Reported-by: Artem Savkov <artem.savkov@gmail.com> Cc: Eric Dumazet <edumazet@google.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20net/core/dev.c: fix kernel-doc warningRandy Dunlap1-0/+1
Fix kernel-doc warning: Warning(net/core/dev.c:5745): No description found for parameter 'dev' Signed-off-by: Randy Dunlap <rdunlap@xenotime.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: netdev@vger.kernel.org Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20netconsole: remove a redundant netconsole_target_put()Amerigo Wang1-1/+0
This netconsole_target_put() is obviously redundant, and it causes a kernel segfault when removing a bridge device which has netconsole running on it. This is caused by: commit 8d8fc29d02a33e4bd5f4fa47823c1fd386346093 Author: Amerigo Wang <amwang@redhat.com> Date: Thu May 19 21:39:10 2011 +0000 netpoll: disable netpoll when enslave a device Cc: David Miller <davem@davemloft.net> (for all 3.x stable releases) Cc: stable@vger.kernel.org Signed-off-by: Cong Wang <amwang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20pwm: Improve Kconfig help textThierry Reding1-6/+25
The Kconfig help text should help the user understand what functionality is provided by an option. This is especially true for new subsystems. An improved help text is provided by this commit in the hopes of clarifying the usefulness of the PWM framework. Signed-off-by: Thierry Reding <thierry.reding@avionic-design.de> Acked-by: Borislav Petkov <bp@alien8.de>
2012-08-20net: ipv6: fix oops in inet_putpeer()Patrick McHardy3-0/+12
Commit 97bab73f (inet: Hide route peer accesses behind helpers.) introduced a bug in xfrm6_policy_destroy(). The xfrm_dst's _rt6i_peer member is not initialized, causing a false positive result from inetpeer_ptr_is_peer(), which in turn causes a NULL pointer dereference in inet_putpeer(). Pid: 314, comm: kworker/0:1 Not tainted 3.6.0-rc1+ #17 To Be Filled By O.E.M. To Be Filled By O.E.M./P4S800D-X EIP: 0060:[<c03abf93>] EFLAGS: 00010246 CPU: 0 EIP is at inet_putpeer+0xe/0x16 EAX: 00000000 EBX: f3481700 ECX: 00000000 EDX: 000dd641 ESI: f3481700 EDI: c05e949c EBP: f551def4 ESP: f551def4 DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068 CR0: 8005003b CR2: 00000070 CR3: 3243d000 CR4: 00000750 DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 DR6: ffff0ff0 DR7: 00000400 f551df04 c0423de1 00000000 f3481700 f551df18 c038d5f7 f254b9f8 f551df28 f34f85d8 f551df20 c03ef48d f551df3c c0396870 f30697e8 f24e1738 c05e98f4 f5509540 c05cd2b4 f551df7c c0142d2b c043feb5 f5509540 00000000 c05cd2e8 [<c0423de1>] xfrm6_dst_destroy+0x42/0xdb [<c038d5f7>] dst_destroy+0x1d/0xa4 [<c03ef48d>] xfrm_bundle_flo_delete+0x2b/0x36 [<c0396870>] flow_cache_gc_task+0x85/0x9f [<c0142d2b>] process_one_work+0x122/0x441 [<c043feb5>] ? apic_timer_interrupt+0x31/0x38 [<c03967eb>] ? flow_cache_new_hashrnd+0x2b/0x2b [<c0143e2d>] worker_thread+0x113/0x3cc Fix by adding a init_dst() callback to struct xfrm_policy_afinfo to properly initialize the dst's peer pointer. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20net/stmmac: fix issue of clk_get for Loongson1B.Kelvin Cheung1-1/+1
When getting clock, give a chance to the CPUs without DT support, which use Common Clock Framework, such as Loongson1B. Signed-off-by: Kelvin Cheung <keguang.zhang@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20caif: Do not dereference NULL in chnl_recv_cb()Jesper Juhl1-0/+4
In net/caif/chnl_net.c::chnl_recv_cb() we call skb_header_pointer() which may return NULL, but we do not check for a NULL pointer before dereferencing it. This patch adds such a NULL check and properly free's allocated memory and return an error (-EINVAL) on failure - much better than crashing.. Signed-off-by: Jesper Juhl <jj@chaosbits.net> Acked-by: Sjur Brændeland <sjur.brandeland@stericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20Merge git://1984.lsi.us.es/nfDavid S. Miller5-49/+90
Pable Neira Ayuso says: ==================== The following five patches contain fixes for 3.6-rc, they are: * Two fixes for message parsing in the SIP conntrack helper, from Patrick McHardy. * One fix for the SIP helper introduced in the user-space cthelper infrastructure, from Patrick McHardy. * fix missing appropriate locking while modifying one conntrack entry from the nfqueue integration code, from myself. * fix possible access to uninitiliazed timer in the nf_conntrack expectation infrastructure, from myself. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20Merge branch 'topic/ca0132-fix' into for-linusTakashi Iwai3-145/+99
This is a series of fixes for CA0132, especially the missing SPDIF I/O and the mixer build errors.
2012-08-20af_packet: don't emit packet on orig fanout groupEric Leblond3-2/+25
If a packet is emitted on one socket in one group of fanout sockets, it is transmitted again. It is thus read again on one of the sockets of the fanout group. This result in a loop for software which generate packets when receiving one. This retransmission is not the intended behavior: a fanout group must behave like a single socket. The packet should not be transmitted on a socket if it originates from a socket belonging to the same fanout group. This patch fixes the issue by changing the transmission check to take fanout group info account. Reported-by: Aleksandr Kotov <a1k@mail.ru> Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20ALSA: hda - don't create dysfunctional mixer controls for ca0132David Henningsson1-0/+8
It's possible that these amps are settable somehow, e g through secret codec verbs, but for now, don't create the controls (as they won't be working anyway, and cause errors in amixer). Cc: stable@kernel.org BugLink: https://bugs.launchpad.net/bugs/1038651 Signed-off-by: David Henningsson <david.henningsson@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-08-20drivers/net/irda: fix error return codeJulia Lawall2-0/+2
Convert a nonnegative error return code to a negative one, as returned elsewhere in the function. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ identifier ret; expression e1,e2; @@ if (ret < 0) { ... return ret; } ... when != ret = e1 when forall *if(...) { ... when != ret = e2 * return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20drivers/net/wan/dscc4.c: fix error return codeJulia Lawall1-2/+3
Move up the initialization of rc so that failure of pci_alloc_consistent returns -ENOMEM as well. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ identifier ret; expression e1,e2; @@ if (ret < 0) { ... return ret; } ... when != ret = e1 when forall *if(...) { ... when != ret = e2 * return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20drivers/net/wimax/i2400m/fw.c: fix error return codeJulia Lawall1-1/+3
Convert a nonnegative error return code to a negative one, as returned elsewhere in the function. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ identifier ret; expression e1,e2; @@ if (ret < 0) { ... return ret; } ... when != ret = e1 when forall *if(...) { ... when != ret = e2 * return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20smsc75xx: add missing entry to MAINTAINERSSteve Glendinning1-0/+6
Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20net: qmi_wwan: new devices: UML290 and K5006-ZBjørn Mork1-0/+5
Newer firmware versions for the Pantech UML290 use a different subclass ID. The Windows driver match on both IDs, so we do that as well. The ZTE (Vodafone) K5006-Z is a new device. Cc: Dan Williams <dcbw@redhat.com> Cc: Thomas Schäfer <tschaefer@t-online.de> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20net: sh_eth: Add eth support for R8A7779 devicePhil Edworthy2-5/+10
Signed-off-by: Phil Edworthy <phil.edworthy@renesas.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20netdev/phy: skip disabled mdio-mux nodesTimur Tabi1-1/+1
The mdio-mux driver scans all child mdio nodes, without regard to whether the node is actually used. Some device trees include all possible mdio-mux nodes and rely on the boot loader to disable those that are not present, based on some run-time configuration. Those nodes need to be skipped. Signed-off-by: Timur Tabi <timur@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20dt: introduce for_each_available_child_of_node, of_get_next_available_childTimur Tabi2-0/+34
Macro for_each_child_of_node() makes it easy to iterate over all of the children for a given device tree node, including those nodes that are marked as unavailable (i.e. status = "disabled"). Introduce for_each_available_child_of_node(), which is like for_each_child_of_node(), but it automatically skips unavailable nodes. This also requires the introduction of helper function of_get_next_available_child(), which returns the next available child node. Signed-off-by: Timur Tabi <timur@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-20ALSA: sound/ppc/snd_ps3.c: fix error return codeJulia Lawall1-0/+1
Initialize ret before returning on failure, as done elsewhere in the function. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> ( if@p1 (\(ret < 0\|ret != 0\)) { ... return ret; } | ret@p1 = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-08-20ALSA: sound/pci/rme9652/hdspm.c: fix error return codeJulia Lawall1-1/+1
Convert a nonnegative error return code to a negative one, as returned elsewhere in the function. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> ( if@p1 (\(ret < 0\|ret != 0\)) { ... return ret; } | ret@p1 = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-08-20ALSA: sound/pci/sis7019.c: fix error return codeJulia Lawall1-2/+3
Initialize rc before returning on failure, as done elsewhere in the function. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> ( if@p1 (\(ret < 0\|ret != 0\)) { ... return ret; } | ret@p1 = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-08-20ALSA: sound/pci/ctxfi/ctatc.c: fix error return codeJulia Lawall1-1/+3
Initialize err before returning on failure, as done elsewhere in the function. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> ( if@p1 (\(ret < 0\|ret != 0\)) { ... return ret; } | ret@p1 = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-08-20ALSA: sound/atmel/ac97c.c: fix error return codeJulia Lawall1-8/+4
In the first case, the second test of whether retval is negative is redundant. It is dropped and the previous and subsequent tests are combined. In the second case, add an initialization of retval on failure of ioremap. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> ( if@p1 (\(ret < 0\|ret != 0\)) { ... return ret; } | ret@p1 = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Takashi Iwai <tiwai@suse.de>