aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2012-03-14perf tools: Use scnprintf where applicableArnaldo Carvalho de Melo
Several places were expecting that the value returned was the number of characters printed, not what would be printed if there was space. Fix it by using the scnprintf and vscnprintf variants we inherited from the kernel sources. Some corner cases where the number of printed characters were not accounted were fixed too. Reported-by: Anton Blanchard <anton@samba.org> Cc: Anton Blanchard <anton@samba.org> Cc: Eric B Munson <emunson@mgebm.net> Cc: David Ahern <dsahern@gmail.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Mike Galbraith <efault@gmx.de> Cc: Paul Mackerras <paulus@samba.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Yanmin Zhang <yanmin_zhang@linux.intel.com> Cc: stable@kernel.org Link: http://lkml.kernel.org/n/tip-kwxo2eh29cxmd8ilixi2005x@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2012-03-14perf tools: Incorrect use of snprintf results in SEGVAnton Blanchard
I have a workload where perf top scribbles over the stack and we SEGV. What makes it interesting is that an snprintf is causing this. The workload is a c++ gem that has method names over 3000 characters long, but snprintf is designed to avoid overrunning buffers. So what went wrong? The problem is we assume snprintf returns the number of characters written: ret += repsep_snprintf(bf + ret, size - ret, "[%c] ", self->level); ... ret += repsep_snprintf(bf + ret, size - ret, "%s", self->ms.sym->name); Unfortunately this is not how snprintf works. snprintf returns the number of characters that would have been written if there was enough space. In the above case, if the first snprintf returns a value larger than size, we pass a negative size into the second snprintf and happily scribble over the stack. If you have 3000 character c++ methods thats a lot of stack to trample. This patch fixes repsep_snprintf by clamping the value at size - 1 which is the maximum snprintf can write before adding the NULL terminator. I get the sinking feeling that there are a lot of other uses of snprintf that have this same bug, we should audit them all. Cc: David Ahern <dsahern@gmail.com> Cc: Eric B Munson <emunson@mgebm.net> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Paul Mackerras <paulus@samba.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Yanmin Zhang <yanmin_zhang@linux.intel.com> Cc: stable@kernel.org Link: http://lkml.kernel.org/r/20120307114249.44275ca3@kryten Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2012-03-14block: fix ioc leak in put_io_contextXiaotian Feng
When put_io_context is called, if ioc->icq_list is empty and refcount is 1, kernel will not free the ioc. This is caught by following kmemleak: unreferenced object 0xffff880036349fe0 (size 216): comm "sh", pid 2137, jiffies 4294931140 (age 290579.412s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01 00 01 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... backtrace: [<ffffffff8169f926>] kmemleak_alloc+0x26/0x50 [<ffffffff81195a9c>] kmem_cache_alloc_node+0x1cc/0x2a0 [<ffffffff81356b67>] create_io_context_slowpath+0x27/0x130 [<ffffffff81356d2b>] get_task_io_context+0xbb/0xf0 [<ffffffff81055f0e>] copy_process+0x188e/0x18b0 [<ffffffff8105609b>] do_fork+0x11b/0x420 [<ffffffff810247f8>] sys_clone+0x28/0x30 [<ffffffff816d3373>] stub_clone+0x13/0x20 [<ffffffffffffffff>] 0xffffffffffffffff ioc should be freed if ioc->icq_list is empty. Signed-off-by: Xiaotian Feng <dannyfeng@tencent.com> Acked-by: Vivek Goyal <vgoyal@redhat.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-03-13iscsi-target: Fix reservation conflict -EBUSY response handling bugNicholas Bellinger
This patch addresses a iscsi-target specific bug related to reservation conflict handling in iscsit_handle_scsi_cmd() that has been causing reservation conflicts to complete and not fail as expected due to incorrect errno checking. The problem occured with the change to return -EBUSY from transport_generic_cmd_sequencer() -> transport_generic_allocate_tasks() failures, that broke iscsit_handle_scsi_cmd() checking for -EINVAL in order to invoke a non GOOD status response. This was manifesting itself as data corruption with legacy SPC-2 reservations, but also effects iscsi-target LUNs with SPC-3 persistent reservations. This bug was originally introduced in lio-core commit: commit 03e98c9eb916f3f0868c1dc344dde2a60287ff72 Author: Nicholas Bellinger <nab@linux-iscsi.org> Date: Fri Nov 4 02:36:16 2011 -0700 target: Address legacy PYX_TRANSPORT_* return code breakage Reported-by: Martin Svec <martin.svec@zoner.cz> Cc: Martin Svec <martin.svec@zoner.cz> Cc: Christoph Hellwig <hch@lst.de> Cc: stable@vger.kernel.org Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2012-03-13target: Fix compatible reservation handling (CRH=1) with legacy RESERVE/RELEASENicholas Bellinger
This patch addresses a bug with target_check_scsi2_reservation_conflict() return checking in target_scsi2_reservation_[reserve,release]() that was preventing CRH=1 operation from silently succeeding in the two special cases defined by SPC-3, and not failing with reservation conflict status when dealing with legacy RESERVE/RELEASE + active SPC-3 PR logic. Also explictly set cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT during the early non reservation holder failure from pr_ops->t10_seq_non_holder() check in transport_generic_cmd_sequencer() for fabrics that already expect it to be set. This bug was originally introduced in mainline commit: commit eacac00ce5bfde8086cd0615fb53c986f7f970fe Author: Christoph Hellwig <hch@infradead.org> Date: Thu Nov 3 17:50:40 2011 -0400 target: split core_scsi2_emulate_crh Reported-by: Martin Svec <martin.svec@zoner.cz> Cc: Martin Svec <martin.svec@zoner.cz> Cc: Christoph Hellwig <hch@lst.de> Cc: stable@vger.kernel.org Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2012-03-13Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparcLinus Torvalds
Pull sparc updates from David Miller: "Please pull to get this fix for the sparc32 build when using a more recent binutils." * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc32: Add -Av8 to assembler command line.
2012-03-13sparc32: Add -Av8 to assembler command line.David S. Miller
Newer version of binutils are more strict about specifying the correct options to enable certain classes of instructions. The sparc32 build is done for v7 in order to support sun4c systems which lack hardware integer multiply and divide instructions. So we have to pass -Av8 when building the assembler routines that use these instructions and get patched into the kernel when we find out that we have a v8 capable cpu. Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-13Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds
Pull networking changes from David Miller: "The most important bit here is the TCP syncookies issue, which seems to have been busted for some time. That fix has been verified in production by the reporter. 1) Persistent TUN devices erroneously hold on to the network namespace in such a way that it cannot be shutdown. Fix from Stanislav Kinsbursky with help from Eric Dumazet. 2) TCP SYN cookies have been broken for a while due to how the route lookup flow key is managed, connections can be delayed by as much as 20 seconds due to this bug. Fix from Eric Dumazet. 3) Missing jiffies.h include in lib/dynamic_queue_limits.c can break the build, from Tom Herbert. 4) Add USB device ID for Sitecom LN-031, from Joerg Neikes. 5) Fix OOPS in delayed workqueue in iwlegacy, from Stanislaw Gruszka. 6) rt2x00 TX queue can be disabled forever due to races, fix by synchronizing pause/unpause with a lock. Also from Stanislaw Gruszka. 7) Statistics and endian fix in bnx2x driver from Yuval Mintz, Eilon Greenstein, and Ariel Elior." * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: tun: don't hold network namespace by tun sockets bnx2x: FCoE statistics id fixed bnx2x: dcb bit indices flags used as bits bnx2x: added cpu_to_le16 when preparing ramrod's data bnx2x: pfc statistics counts pfc events twice rt2x00: fix random stalls iwl3945: fix possible il->txq NULL pointer dereference in delayed works dql: Fix undefined jiffies tcp: fix syncookie regression usb: asix: Patch for Sitecom LN-031
2012-03-13Merge branch 'stable' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile Pull arch/tile update from Chris Metcalf "These include a couple of queued-up minor bug fixes from the community, a fix to unbreak the sysfs hooks in tile, and syncing up the defconfigs." Ugh. defconfigs updates without "make minconfig". Tons of ugly pointless lines there, I suspect. * 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: tile: Use set_current_blocked() and block_sigmask() arch/tile: misplaced parens near likely arch/tile: sync up the defconfig files to the tip arch/tile: Fix up from commit 8a25a2fd126c621f44f3aeaef80d51f00fc11639
2012-03-13Merge branch 'perf-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar. * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf record: Fix buffer overrun bug in tracepoint_id_to_path() perf/x86: Fix local vs remote memory events for NHM/WSM
2012-03-13Merge git://git.samba.org/sfrench/cifs-2.6Linus Torvalds
Pull CIFS fixes from Steve French. * git://git.samba.org/sfrench/cifs-2.6: CIFS: Do not kmalloc under the flocks spinlock cifs: possible memory leak in xattr.
2012-03-13Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "A bunch of assorted fixes; Jan's freezing stuff still _not_ in there and neither is mm fun ;-/" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: restore smp_mb() in unlock_new_inode() vfs: fix return value from do_last() vfs: fix double put after complete_walk() udf: Fix deadlock in udf_release_file() vfs: Correctly set the dir i_mutex lockdep class
2012-03-13tile: Use set_current_blocked() and block_sigmask()Matt Fleming
As described in e6fa16ab ("signal: sigprocmask() should do retarget_shared_pending()") the modification of current->blocked is incorrect as we need to check whether the signal we're about to block is pending in the shared queue. Also, use the new helper function introduced in commit 5e6292c0f28f ("signal: add block_sigmask() for adding sigmask to current->blocked") which centralises the code for updating current->blocked after successfully delivering a signal and reduces the amount of duplicate code across architectures. In the past some architectures got this code wrong, so using this helper function should stop that from happening again. Cc: Arnd Bergmann <arnd@arndb.de> Acked-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Matt Fleming <matt.fleming@intel.com> Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
2012-03-13Merge branch 'master' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2012-03-13perf record: Fix buffer overrun bug in tracepoint_id_to_path()Stephane Eranian
This patch fixes a buffer overrun bug in tracepoint_id_to_path(). The bug manisfested itself as a memory error reported by perf record. I ran into it with perf sched: $ perf sched rec noploop 2 noploop for 2 seconds [ perf record: Woken up 14 times to write data ] [ perf record: Captured and wrote 42.701 MB perf.data (~1865622 samples) ] Fatal: No memory to alloc tracepoints list It turned out that tracepoint_id_to_path() was reading the tracepoint id using read() but the buffer was not large enough to include the \n terminator for id with 4 digits or more. The patch fixes the problem by extending the buffer to a more reasonable size covering all possible id length include \n terminator. Note that atoll() stops at the first non digit character, thus it is not necessary to clear the buffer between each read. Signed-off-by: Stephane Eranian <eranian@google.com> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: fweisbec@gmail.com Cc: dsahern@gmail.com Link: http://lkml.kernel.org/r/20120313155102.GA6465@quad Signed-off-by: Ingo Molnar <mingo@elte.hu>
2012-03-13hwmon: (w83627ehf) Describe undocumented pwm attributesGuenter Roeck
Add description of pwm[1-4]_start_output, pwm[1-4]_step_output, pwm[1-4]_stop_output, and pwm[1-4]_max_output attributes to driver documentation. Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> Acked-by: Jean Delvare <khali@linux-fr.org>
2012-03-13hwmon: (w83627ehf) Fix temp2 source for W83627UHGJean Delvare
Properly set the source of temp2 for the W83627UHG. Also fix a comment right before that, and document the W83627UHG as reporting up to 3 temperatures. Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: Guenter Roeck <guenter.roeck@ericsson.com> Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
2012-03-12Merge branch 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86Linus Torvalds
Pull x86 platfrm driver fixes from Matthew Garrett: "Some trivial patches that fix wifi on some Lenovos and avoid a potential memory corruption issue on some Panasonics, plus two straightforward new drivers that touch no existing code." * 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86: panasonic-laptop: avoid overflow in acpi_pcc_hotkey_add() acer-wmi: No wifi rfkill on Lenovo machines Fujitsu tablet extras driver x86: Add amilo-rfkill driver for some Fujitsu-Siemens Amilo laptops
2012-03-12Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci Pull PCI changes from Jesse Barnes: "A single fix for a regression that affects some people who try to disable ASPM for whatever reason." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci: PCI: ignore pre-1.1 ASPM quirking when ASPM is disabled
2012-03-12Merge tag 'sh-for-linus' of git://github.com/pmundt/linux-shLinus Torvalds
Pull SuperH fixes from Paul Mundt. * tag 'sh-for-linus' of git://github.com/pmundt/linux-sh: sh-sci / PM: Avoid deadlocking runtime PM sh: fix up the ubc clock definition for sh7785. sh: add parameter for RSPI in clock-sh7757 sh: Fix sh2a vbr table for more than 255 irqs
2012-03-12Merge tag 'rmobile-for-linus' of git://github.com/pmundt/linux-shLinus Torvalds
Pull SH/R-Mobile fixes from Paul Mundt. * tag 'rmobile-for-linus' of git://github.com/pmundt/linux-sh: ARM: mach-shmobile: ap4evb: fixup fsi2_ak4643_info typo ARM: mach-shmobile: mackerel: Reserve DMA memory for the frame buffer ARM: mach-shmobile: Fix ag5evm compilation by including linux/videodev2.h ARM: mach-shmobile: Fix bonito compile breakage
2012-03-12tun: don't hold network namespace by tun socketsStanislav Kinsbursky
v3: added previously removed sock_put() to the tun_release() callback, because sk_release_kernel() doesn't drop the socket reference. v2: sk_release_kernel() used for socket release. Dummy tun_release() is required for sk_release_kernel() ---> sock_release() ---> sock->ops->release() call. TUN was designed to destroy it's socket on network namesapce shutdown. But this will never happen for persistent device, because it's socket holds network namespace. This patch removes of holding network namespace by TUN socket and replaces it by creating socket in init_net and then changing it's net it to desired one. On shutdown socket is moved back to init_net prior to final put. Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-12bnx2x: FCoE statistics id fixedYuval Mintz
FCoE statistics ids were distinguished from the L2's statistics ids. However, not all of the change was committed. This causes a possible collision of indices when FCoE is present. This patch fixes the issue. Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-12bnx2x: dcb bit indices flags used as bitsYuval Mintz
DCB flags were updated using the flags' bit offsets instead of the actual bits. This is now fixed. Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-12bnx2x: added cpu_to_le16 when preparing ramrod's dataAriel Elior
Fixed endianess issue when passing arguments to FW. Signed-off-by: Ariel Elior <ariele@broadcom.com> Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-12bnx2x: pfc statistics counts pfc events twiceYuval Mintz
When pfc statistics were counted, the delta change from last count was summed twice. This fixes the issue. Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-12perf/x86: Fix local vs remote memory events for NHM/WSMPeter Zijlstra
Verified using the below proglet.. before: [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0 remote write Performance counter stats for './numa 0': 2,101,554 node-stores 2,096,931 node-store-misses 5.021546079 seconds time elapsed [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1 local write Performance counter stats for './numa 1': 501,137 node-stores 199 node-store-misses 5.124451068 seconds time elapsed After: [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0 remote write Performance counter stats for './numa 0': 2,107,516 node-stores 2,097,187 node-store-misses 5.012755149 seconds time elapsed [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1 local write Performance counter stats for './numa 1': 2,063,355 node-stores 165 node-store-misses 5.082091494 seconds time elapsed #define _GNU_SOURCE #include <sched.h> #include <stdio.h> #include <errno.h> #include <sys/mman.h> #include <sys/types.h> #include <dirent.h> #include <signal.h> #include <unistd.h> #include <numaif.h> #include <stdlib.h> #define SIZE (32*1024*1024) volatile int done; void sig_done(int sig) { done = 1; } int main(int argc, char **argv) { cpu_set_t *mask, *mask2; size_t size; int i, err, t; int nrcpus = 1024; char *mem; unsigned long nodemask = 0x01; /* node 0 */ DIR *node; struct dirent *de; int read = 0; int local = 0; if (argc < 2) { printf("usage: %s [0-3]\n", argv[0]); printf(" bit0 - local/remote\n"); printf(" bit1 - read/write\n"); exit(0); } switch (atoi(argv[1])) { case 0: printf("remote write\n"); break; case 1: printf("local write\n"); local = 1; break; case 2: printf("remote read\n"); read = 1; break; case 3: printf("local read\n"); local = 1; read = 1; break; } mask = CPU_ALLOC(nrcpus); size = CPU_ALLOC_SIZE(nrcpus); CPU_ZERO_S(size, mask); node = opendir("/sys/devices/system/node/node0/"); if (!node) perror("opendir"); while ((de = readdir(node))) { int cpu; if (sscanf(de->d_name, "cpu%d", &cpu) == 1) CPU_SET_S(cpu, size, mask); } closedir(node); mask2 = CPU_ALLOC(nrcpus); CPU_ZERO_S(size, mask2); for (i = 0; i < size; i++) CPU_SET_S(i, size, mask2); CPU_XOR_S(size, mask2, mask2, mask); // invert if (!local) mask = mask2; err = sched_setaffinity(0, size, mask); if (err) perror("sched_setaffinity"); mem = mmap(0, SIZE, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); err = mbind(mem, SIZE, MPOL_BIND, &nodemask, 8*sizeof(nodemask), MPOL_MF_MOVE); if (err) perror("mbind"); signal(SIGALRM, sig_done); alarm(5); if (!read) { while (!done) { for (i = 0; i < SIZE; i++) mem[i] = 0x01; } } else { while (!done) { for (i = 0; i < SIZE; i++) t += *(volatile char *)(mem + i); } } return 0; } Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Stephane Eranian <eranian@google.com> Cc: <stable@kernel.org> Link: http://lkml.kernel.org/n/tip-tq73sxus35xmqpojf7ootxgs@git.kernel.org Signed-off-by: Ingo Molnar <mingo@elte.hu>
2012-03-12hwmon: (w83627ehf) Fix memory leak in probe functionGuenter Roeck
The driver probe function leaked memory if creating the cpu0_vid attribute file failed. Fix by converting the driver to use devm_kzalloc. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Cc: stable@vger.kernel.org # 2.6.32+ Acked-by: Jean Delvare <khali@linux-fr.org>
2012-03-12arch/tile: misplaced parens near likelyroel
Parentheses were missing. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
2012-03-12arch/tile: sync up the defconfig files to the tipChris Metcalf
This was inspired by mchehab@redhat.com's observation that we didn't have EDAC configured on by default in both files. In addition, we were setting INITRAMFS_SOURCE to a non-empty string, which isn't a very common default and required editing to do test builds. Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
2012-03-12arch/tile: Fix up from commit 8a25a2fd126c621f44f3aeaef80d51f00fc11639Chris Metcalf
This was Kay Siever's bombing to convert 'cpu' to a regular subsystem. The change left a bogus second argument to sysfs_create_file(). Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
2012-03-12rt2x00: fix random stallsStanislaw Gruszka
Is possible that we stop queue and then do not wake up it again, especially when packets are transmitted fast. That can be easily reproduced with modified tx queue entry_num to some small value e.g. 16. If mac80211 already hold local->queue_stop_reason_lock, then we can wait on that lock in both rt2x00queue_pause_queue() and rt2x00queue_unpause_queue(). After drooping ->queue_stop_reason_lock is possible that __ieee80211_wake_queue() will be performed before __ieee80211_stop_queue(), hence we stop queue and newer wake up it again. Another race condition is possible when between rt2x00queue_threshold() check and rt2x00queue_pause_queue() we will process all pending tx buffers on different cpu. This might happen if for example interrupt will be triggered on cpu performing rt2x00mac_tx(). To prevent race conditions serialize pause/unpause by queue->tx_lock. Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Acked-by: Gertjan van Wingerde <gwingerde@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-03-12iwl3945: fix possible il->txq NULL pointer dereference in delayed worksStanislaw Gruszka
On il3945_down procedure we free tx queue data and nullify il->txq pointer. After that we drop mutex and then cancel delayed works. There is possibility, that after drooping mutex and before the cancel, some delayed work will start and crash while trying to send commands to the device. For example, here is reported crash in il3945_bg_reg_txpower_periodic(): https://bugzilla.kernel.org/show_bug.cgi?id=42766#c10 Patch fix problem by adding il->txq check on works that send commands, hence utilize tx queue. Reported-by: Clemens Eisserer <linuxhippy@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-03-12hwmon: (w83627ehf) Fix writing into fan_stop_time for NCT6775F/NCT6776FGuenter Roeck
NCT6775F and NCT6776F have their own set of registers for FAN_STOP_TIME. The correct registers were used to read FAN_STOP_TIME, but writes used the wrong registers. Fix it. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Cc: stable@vger.kernel.org # 3.0+ Acked-by: Jean Delvare <khali@linux-fr.org>
2012-03-12panasonic-laptop: avoid overflow in acpi_pcc_hotkey_add()Xi Wang
num_sifr could go negative since acpi_pcc_get_sqty() returns -EINVAL on error. Then it could bypass the sanity check (num_sifr > 255). The subsequent call to kzalloc() would allocate a small buffer, leading to a memory corruption. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Matthew Garrett <mjg@redhat.com>
2012-03-12acer-wmi: No wifi rfkill on Lenovo machinesIke Panhc
We have several reports which says acer-wmi is loaded on ideapads and register rfkill for wifi which can not be unblocked. Since ideapad-laptop also register rfkill for wifi and it works reliably, it will be fine acer-wmi is not going to register rfkill for wifi once VPC2004 is found. Also put IBM0068/LEN0068 in the list. Though thinkpad_acpi has no wifi rfkill capability, there are reports which says acer-wmi also block wireless on Thinkpad E520/E420. Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Matthew Garrett <mjg@redhat.com>
2012-03-12Fujitsu tablet extras driverRobert Gerlach
This patch adds support for some of the devices within a wide variety of Fujitsu Tablet Computers, both convertibles and slates. Primarily it allows for the automatic detection of the tablet/notebook mode for convertible tablet pc's, and orientation for docked slates. It also adds support for the application panel buttons usually found next to the tablet screen, and docking station detection for slates. Signed-off-by: Robert Gerlach <khnz@gmx.de> Signed-off-by: Matthew Garrett <mjg@redhat.com>
2012-03-12x86: Add amilo-rfkill driver for some Fujitsu-Siemens Amilo laptopsBen Hutchings
An rfkill driver based on the fsaa1655g and fsam7440 drivers for Fujitsu-Siemens Amilo A1655 and M7440 models found at: http://sourceforge.net/projects/fsaa1655g/ http://sourceforge.net/projects/fsam7440/ This adds DMI matching, replaces the procfs files with rfkill devices, and uses the proper functions to write to the i8042 safely. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Matthew Garrett <mjg@redhat.com>
2012-03-11dql: Fix undefined jiffiesTom Herbert
In some configurations, jiffies may be undefined in lib/dynamic_queue_limits.c. Adding include of jiffies.h to avoid this. Signed-off-by: Tom Herbert <therbert@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-11tcp: fix syncookie regressionEric Dumazet
commit ea4fc0d619 (ipv4: Don't use rt->rt_{src,dst} in ip_queue_xmit()) added a serious regression on synflood handling. Simon Kirby discovered a successful connection was delayed by 20 seconds before being responsive. In my tests, I discovered that xmit frames were lost, and needed ~4 retransmits and a socket dst rebuild before being really sent. In case of syncookie initiated connection, we use a different path to initialize the socket dst, and inet->cork.fl.u.ip4 is left cleared. As ip_queue_xmit() now depends on inet flow being setup, fix this by copying the temp flowi4 we use in cookie_v4_check(). Reported-by: Simon Kirby <sim@netnation.com> Bisected-by: Simon Kirby <sim@netnation.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-11usb: asix: Patch for Sitecom LN-031Joerg Neikes
This patch adds support for the Sitecom LN-031 USB adapter with a AX88178 chip. Added USB id to find correct driver for AX88178 1000 Ethernet adapter. Signed-off-by: Joerg Neikes <j.neikes@midlandgate.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-11regulator: da9052: Ensure the selected voltage falls within the specified rangeAxel Lin
Integer division may truncate the result, use DIV_ROUND_UP to ensure the selected voltage falls within the specified range. Signed-off-by: Axel Lin <axel.lin@gmail.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2012-03-11regulator: Set n_voltages for da9052 regulatorsAxel Lin
The n_voltages setting for all LDOs and DCDCs are missing in current code. Signed-off-by: Axel Lin <axel.lin@gmail.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2012-03-11regulator: Fix setting selector in tps6524x set_voltage functionAxel Lin
Don't assign the voltage to selector. Signed-off-by: Axel Lin <axel.lin@gmail.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Cc: stable@vger.kernel.org
2012-03-10restore smp_mb() in unlock_new_inode()Al Viro
wait_on_inode() doesn't have ->i_lock Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-03-10vfs: fix return value from do_last()Miklos Szeredi
complete_walk() returns either ECHILD or ESTALE. do_last() turns this into ECHILD unconditionally. If not in RCU mode, this error will reach userspace which is complete nonsense. Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> CC: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-03-10vfs: fix double put after complete_walk()Miklos Szeredi
complete_walk() already puts nd->path, no need to do it again at cleanup time. This would result in Oopses if triggered, apparently the codepath is not too well exercised. Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> CC: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-03-10Linux 3.3-rc7v3.3-rc7Linus Torvalds
2012-03-10udf: Fix deadlock in udf_release_file()Jan Kara
udf_release_file() can be called from munmap() path with mmap_sem held. Thus we cannot take i_mutex there because that ranks above mmap_sem. Luckily, i_mutex is not needed in udf_release_file() anymore since protection by i_data_sem is enough to protect from races with write and truncate. Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Reviewed-by: Namjae Jeon <linkinjeon@gmail.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-03-10vfs: Correctly set the dir i_mutex lockdep classTyler Hicks
9a7aa12f3911853a introduced additional logic around setting the i_mutex lockdep class for directory inodes. The idea was that some filesystems may want their own special lockdep class for different directory inodes and calling unlock_new_inode() should not clobber one of those special classes. I believe that the added conditional, around the *negated* return value of lockdep_match_class(), caused directory inodes to be placed in the wrong lockdep class. inode_init_always() sets the i_mutex lockdep class with i_mutex_key for all inodes. If the filesystem did not change the class during inode initialization, then the conditional mentioned above was false and the directory inode was incorrectly left in the non-directory lockdep class. If the filesystem did set a special lockdep class, then the conditional mentioned above was true and that class was clobbered with i_mutex_dir_key. This patch removes the negation from the conditional so that the i_mutex lockdep class is properly set for directory inodes. Special classes are preserved and directory inodes with unmodified classes are set with i_mutex_dir_key. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-24 05:03:52 +0000