https://github.com/torvalds/linux

sort by:
Revision Author Date Message Commit Date
e4fbce7 r8169: Fix runtime power management I noticed that one of the post-2.6.36 patches broke runtime PM of the r8169 on my MSI Wind test machine in such a way that the link was not brought up after reconnecting the network cable. In the process of debugging the issue I realized that we only should invoke the runtime PM functions in rtl8169_check_link_status() when link change is reported and if we do so, the problem goes away. Moreover, this allows rtl8169_runtime_idle() to be simplified quite a bit. Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> Acked-by: Francois Romieu <romieu@fr.zoreil.com> Signed-off-by: David S. Miller <davem@davemloft.net> 10 December 2010, 19:09:18 UTC
5b362ac NFS: Fix panic after nfs_umount() After a few unsuccessful NFS mount attempts in which the client and server cannot agree on an authentication flavor both support, the client panics. nfs_umount() is invoked in the kernel in this case. Turns out nfs_umount()'s UMNT RPC invocation causes the RPC client to write off the end of the rpc_clnt's iostat array. This is because the mount client's nrprocs field is initialized with the count of defined procedures (two: MNT and UMNT), rather than the size of the client's proc array (four). The fix is to use the same initialization technique used by most other upper layer clients in the kernel. Introduced by commit 0b524123, which failed to update nrprocs when support was added for UMNT in the kernel. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=24302 BugLink: http://bugs.launchpad.net/bugs/683938 Reported-by: Stefan Bader <stefan.bader@canonical.com> Tested-by: Stefan Bader <stefan.bader@canonical.com> Cc: stable@kernel.org # >= 2.6.32 Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> 10 December 2010, 18:01:50 UTC
6934d33 hso: IP checksuming doesn't work on GE0301 option cards There is definitly a problem, that some option cards send up broken IP pakets leading to corrupted IP packets. These corruptions aren't detected, because the driver claims that the packets are already checksummed. This change removes the CHECKSUM_UNNECESSARY option and let IP detect broken data. Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: David S. Miller <davem@davemloft.net> 10 December 2010, 04:42:24 UTC
78347c8 xfrm: Fix xfrm_state_migrate leak xfrm_state_migrate calls kfree instead of xfrm_state_put to free a failed state. According to git commit 553f9118 this can cause memory leaks. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> 10 December 2010, 04:35:27 UTC
fb4fa76 net: Convert netpoll blocking api in bonding driver to be a counter A while back I made some changes to enable netpoll in the bonding driver. Among them was a per-cpu flag that indicated we were in a path that held locks which could cause the netpoll path to block in during tx, and as such the tx path should queue the frame for later use. This appears to have given rise to a regression. If one of those paths on which we hold the per-cpu flag yields the cpu, its possible for us to come back on a different cpu, leading to us clearing a different flag than we set. This results in odd netpoll drops, and BUG backtraces appearing in the log, as we check to make sure that we only clear set bits, and only set clear bits. I had though briefly about changing the offending paths so that they wouldn't sleep, but looking at my origional work more closely, it doesn't appear that a per-cpu flag is warranted. We alrady gate the checking of this flag on IFF_IN_NETPOLL, so we don't hit this in the normal tx case anyway. And practically speaking, the normal use case for netpoll is to only have one client anyway, so we're not going to erroneously queue netpoll frames when its actually safe to do so. As such, lets just convert that per-cpu flag to an atomic counter. It fixes the rescheduling bugs, is equivalent from a performance perspective and actually eliminates some code in the process. Tested by the reporter and myself, successfully Reported-by: Liang Zheng <lzheng@redhat.com> CC: Jay Vosburgh <fubar@us.ibm.com> CC: Andy Gospodarek <andy@greyhouse.net> CC: David S. Miller <davem@davemloft.net> Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net> 10 December 2010, 04:33:46 UTC
e83df17 OMAP2+: PM/serial: fix console semaphore acquire during suspend commit 0d8e2d0dad98a693bad88aea6876ac8b94ad95c6 (OMAP2+: PM/serial: hold console semaphore while OMAP UARTs are disabled) added use of the console semaphore to protect UARTs from being accessed after disabled during idle, but this causes problems in suspend. During suspend, the console semaphore is acquired by the console suspend method (console_suspend()) so the try_acquire_console_sem() will always fail and suspend will be aborted. To fix, introduce a check so the console semaphore is only attempted during idle, and not during suspend. Also use the same check so that the console semaphore is not prematurely released during resume. Thanks to Paul Walmsley for suggesting adding the same check during resume. Cc: Paul Walmsley <paul@pwsan.com> Tested-by: Jean Pihet <j-pihet@ti.com> Tested-by: Paul Walmsley <paul@pwsan.com> Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com> Signed-off-by: Tony Lindgren <tony@atomide.com> 10 December 2010, 00:41:29 UTC
28dd319 OMAP1: SRAM: fix size for OMAP1611 SoCs Kernel was failing to boot on omap1611 based OSK boards due to mis-configured SRAM size. Existing code was using a hard-coded value for 250k, which was then rounded down by PAGE_SIZE. Increasing this to 256k allows kernel to boot on omap1611 SoCs. Problem reported by and initial fix suggested by Tim Bird. Thanks to Tony Lindgren for helping diagnose the problem to being specific to OMAP1611 and not affecting OMAP1610/OMAP1623. Reported-by: Tim Bird <tim.bird@am.sony.com> Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com> Signed-off-by: Tony Lindgren <tony@atomide.com> 10 December 2010, 00:29:21 UTC
05340d4 xfs: log timestamp changes to the source inode in rename Now that we don't mark VFS inodes dirty anymore for internal timestamp changes, but rely on the transaction subsystem to push them out, we need to explicitly log the source inode in rename after updating it's timestamps to make sure the changes actually get forced out by sync/fsync or an AIL push. We already account for the fourth inode in the log reservation, as a rename of directories needs to update the nlink field, so just adding the xfs_trans_log_inode call is enough. This fixes the xfsqa 065 regression introduced by: "xfs: don't use vfs writeback for pure metadata modifications" Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Alex Elder <aelder@sgi.com> 09 December 2010, 23:07:02 UTC
a5dc4f8 ACPI: EC: Add another dmi match entry for MSI hardware http://bugzilla.kernel.org/show_bug.cgi?id=15418 Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de> cc: stable@kernel.org Signed-off-by: Len Brown <len.brown@intel.com> 09 December 2010, 22:08:46 UTC
7c03b87 [SCSI] hpsa: fix redefinition of PCI_DEVICE_ID_CISSF PCI_DEVICE_ID_CISSF is defined as 323b in pci_ids.h but redefined as 3fff in hpsa.c. The ID of 3fff will _never_ ship as a standalone controller. It is intended only as part a complete storage solution. As such, this patch removes the redefinition and the StorageWorks P1210m from the product table. It also removes a duplicate line for the "unknown" controller support. Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 21:06:50 UTC
3138b32 ACPI battery: update status upon sysfs query Sometimes the Battery driver doesn't get notifications when it's plugged/unplugged. And this results in the incorrect Battery status reported by the power supply sysfs I/F. Update Battery status first when querying from sysfs. http://marc.info/?l=linux-acpi&m=128855015826728&w=2 Tested_by: Seblu <seblu@seblu.net> Signed-off-by: Zhang Rui <rui.zhang@intel.com> Signed-off-by: Len Brown <len.brown@intel.com> 09 December 2010, 20:34:57 UTC
3151dbb ACPI ac: update AC status upon sysfs query http://marc.info/?l=linux-acpi&m=128855015826728&w=2 https://bugzilla.kernel.org/show_bug.cgi?id=21722 Tested_by: Seblu <seblu@seblu.net> Signed-off-by: Zhang Rui <rui.zhang@intel.com> Signed-off-by: Len Brown <len.brown@intel.com> 09 December 2010, 20:33:08 UTC
13d38d9 [SCSI] qla2xxx: Update version number to 8.03.05-k0. Signed-off-by: Madhuranath Iyengar <Madhu.Iyengar@qlogic.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 19:25:51 UTC
69abf61 [SCSI] qla2xxx: Properly set the return value in qla2xxx_eh_abort function. A return value is not set for the successful case and it has a garbage value. This fix will set the default value to SUCCESS and in case of any failures it is changed. Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com> Signed-off-by: Madhuranath Iyengar <Madhu.Iyengar@qlogic.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 19:25:47 UTC
087c621 [SCSI] qla2xxx: Correct issue where NPIV-config data was not being allocated for 82xx parts. This would cause a panic while reading the NPIV-config data. Cc: stable@kernel.org Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com> Signed-off-by: Madhuranath Iyengar <Madhu.Iyengar@qlogic.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 19:25:21 UTC
7992abf [SCSI] qla2xxx: Change MSI initialization from using incorrect request_irq parameter. IRQF_SHARED flag should not be set when calling request_irq for MSI since this interrupt mechanism cannot be shared like standard INTx. Signed-off-by: Mike Hernandez <michael.hernandez@qlogic.com> Signed-off-by: Madhuranath Iyengar <Madhu.Iyengar@qlogic.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 19:25:03 UTC
85727e1 [SCSI] qla2xxx: Populate Command Type 6 LUN field properly. Use the host_to_fcp_swap call to correctly populate the LUN field in the Command Type 6 path. This field is used during LUN reset cleanup and must match the field used in the FCP command. Cc: stable@kernel.org Signed-off-by: Mike Hernandez <michael.hernandez@qlogic.com> Signed-off-by: Madhuranath Iyengar <Madhu.Iyengar@qlogic.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 19:24:11 UTC
7e1fea7 Btrfs: fixup return code for btrfs_del_orphan_item If the orphan item doesn't exist, we return 1, which doesn't make any sense to the callers. Instead return -ENOENT if we didn't find the item. Thanks, Signed-off-by: Josef Bacik <josef@redhat.com> 09 December 2010, 18:57:15 UTC
b8399de Btrfs: do not do fast caching if we are allocating blocks for tree_root Since the fast caching uses normal tree locking, we can possibly deadlock if we get to the caching via a btrfs_search_slot() on the tree_root. So just check to see if the root we are on is the tree root, and just don't do the fast caching. Reported-by: Sage Weil <sage@newdream.net> Signed-off-by: Josef Bacik <josef@redhat.com> 09 December 2010, 18:57:13 UTC
2b20982 Btrfs: deal with space cache errors better Currently if the space cache inode generation number doesn't match the generation number in the space cache header we will just fail to load the space cache, but we won't mark the space cache as an error, so we'll keep getting that error each time somebody tries to cache that block group until we actually clear the thing. Fix this by marking the space cache as having an error so we only get the message once. This patch also makes it so that we don't try and setup space cache for a block group that isn't cached, since we won't be able to write it out anyway. None of these problems are actual problems, they are just annoying and sub-optimal. Thanks, Signed-off-by: Josef Bacik <josef@redhat.com> 09 December 2010, 18:57:12 UTC
955256f Btrfs: fix use after free in O_DIRECT This fixes a bug where we use dip after we have freed it. Instead just use the file_offset that was passed to the function. Thanks, Signed-off-by: Josef Bacik <josef@redhat.com> 09 December 2010, 18:57:10 UTC
e55f875 [SCSI] zfcp: Issue FCP command without holding SCSI host_lock Interrupting the connection to the FCP channel while I/O requests are being issued can lead to this deadlock. scsi_dispatch_cmd already holds the host_lock while the recovery trigger tries to acquire the host_lock again when iterating through the scsi_devices. INFO: lockdep is turned off. BUG: spinlock lockup on CPU#1, blast/9660, 0000000078f38878 CPU: 1 Not tainted 2.6.35.7SWEN2 #2 Process blast (pid: 9660, task: 0000000071f75940, ksp: 0000000074393ac0) 0000000074393640 00000000743935c0 0000000000000002 0000000000000000 0000000074393660 00000000743935d8 00000000743935d8 00000000005590c2 0000000000000000 0000000078f38878 0000000026ede800 0000000078f38878 000000000000000d 040000000000000c 0000000074393628 0000000000000000 0000000000000000 0000000000100b2a 00000000743935c0 0000000074393600 Call Trace: ([<0000000000100a32>] show_trace+0xee/0x144) [<00000000003be202>] do_raw_spin_lock+0x112/0x178 [<000000000055d408>] _raw_spin_lock_irqsave+0x90/0xb0 [<00000000003f1514>] __scsi_iterate_devices+0x38/0xbc [<00000000004849b0>] zfcp_erp_clear_adapter_status+0xd0/0x16c [<000000000048587a>] zfcp_erp_adapter_reopen+0x3a/0xb4 [<0000000000489812>] zfcp_fsf_req_send+0x166/0x180 [<000000000048c8d6>] zfcp_fsf_fcp_cmnd+0x272/0x408 [<000000000048f864>] zfcp_scsi_queuecommand+0x11c/0x1e0 [<00000000003f1f2a>] scsi_dispatch_cmd+0x1d6/0x324 [<00000000003f9910>] scsi_request_fn+0x42c/0x56c [<00000000003828ae>] __blk_run_queue+0x86/0x140 [<000000000037f742>] elv_insert+0x11a/0x208 [<000000000038104c>] blk_insert_cloned_request+0x84/0xe4 [<000003c0032b7c64>] dm_dispatch_request+0x6c/0x94 [dm_mod] [<000003c0032b7d5c>] map_request+0xd0/0x100 [dm_mod] [<000003c0032b9a78>] dm_request_fn+0xec/0x1bc [dm_mod] [<0000000000382c0e>] generic_unplug_device+0x5a/0x6c [<000003c0032b7f98>] dm_unplug_all+0x74/0x9c [dm_mod] [<00000000001d1272>] sync_page+0x76/0x9c [<00000000001d12ba>] sync_page_killable+0x22/0x60 [<000000000055a768>] __wait_on_bit_lock+0xc0/0x124 [<00000000001d1140>] __lock_page_killable+0x78/0x84 [<00000000001d351c>] generic_file_aio_read+0x5a4/0x7e8 [<0000000000228ec0>] do_sync_read+0xc8/0x12c [<0000000000229edc>] vfs_read+0xac/0x1ac [<000000000022a0d8>] SyS_read+0x58/0xa8 [<00000000001146de>] sysc_noemu+0x10/0x16 [<00000200000493c4>] 0x200000493c4 INFO: lockdep is turned off. Call zfcp_fsf_fcp_cmnd without the host_lock and disable the interrupts when acquiring the req_q_lock. According to the patch description in "[PATCH] Eliminate error handler overload of the SCSI serial number", the serial_number is not used, so simply drop the queuecommand wrapper function and run zfcp_scsi_queuecommand without holding the host_lock. Reviewed-by: Swen Schillig <swen@vnet.ibm.com> Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 15:41:23 UTC
14718e3 [SCSI] zfcp: Prevent usage w/o holding a reference The ERP got values assigned for which no reference was taken. This can lead to an unpredictable race condition. Fix this by only assigning the values which are required and for which a reference was pulled or is held implicitly. Signed-off-by: Swen Schillig <swen@vnet.ibm.com> Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 15:41:21 UTC
d3e1088 [SCSI] zfcp: No ERP escalation on gpn_ft eval If the evaluation of GPN_FT requests wants to remove an invalid port from the system the zfcp_erp_port_shutdown function is triggered. Depending on the system status a superior action (e.g. adapter reopen) is required. This can lead to an invalid mem access of the port struct which might be freed at the time since the superior action is not holding a reference of the port which triggered this ERP action. Signed-off-by: Swen Schillig <swen@vnet.ibm.com> Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 15:41:19 UTC
6fbf25e [SCSI] zfcp: Correct false abort data assignment. The request data assignment between the fsf abort initiator and its corresponding handler is not consistent and leads to an unpredictable behaviour, e.g. kernel panic. This patch fixes this issue and assigns the correct value. Signed-off-by: Swen Schillig <swen@vnet.ibm.com> Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 15:41:18 UTC
5bfb2c3 [SCSI] zfcp: Fix common FCP request reception The reception of a common FCP request should only be evaluated if the corresponding SCSI request data is available. Therefore put the information under the lock protection and verify the existence before processing. This fixes the following kernel panic. Unable to handle kernel pointer dereference at virtual kernel address 0000000180000000 Oops: 003b [#1] PREEMPT SMP DEBUG_PAGEALLOC CPU: 0 Not tainted 2.6.35.7-45.x.20101007-s390xdefault #1 Process blast (pid: 9711, task: 00000000a3be8e40, ksp: 00000000b221bac0) Krnl PSW : 0704300180000000 0000000000489878 (zfcp_fsf_fcp_handler_common+0x4c/0x3a0) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:3 PM:0 EA:3 Krnl GPRS: 00000000b663c1b8 0000000180000000 000000007ab5bdf0 0000000000000000 00000000b0ccd800 0000000000000018 07000000a3be8e78 00000000b5d3e600 000000007ab5bdf0 0000000000000066 00000000b72137f0 00000000b72137f0 0000000000000000 00000000005a8178 00000000bdf37a60 00000000bdf379f0 Krnl Code: 0000000000489866: e3c030000004 lg %r12,0(%r3) 000000000048986c: e310c0000004 lg %r1,0(%r12) 0000000000489872: e31011e00004 lg %r1,480(%r1) >0000000000489878: 581011ec l %r1,492(%r1) 000000000048987c: a774001c brc 7,4898b4 0000000000489880: b91400b1 lgfr %r11,%r1 0000000000489884: 5810405c l %r1,92(%r4) 0000000000489888: 5510d00c cl %r1,12(%r13) Call Trace: ([<000000000010d344>] debug_event_common+0x22c/0x244) [<000000000048a0b4>] zfcp_fsf_fcp_cmnd_handler+0x2c/0x3b4 [<000000000048b5b6>] zfcp_fsf_req_complete+0x1b6/0x9dc [<000000000048bede>] zfcp_fsf_reqid_check+0x102/0x138 [<000000000048e478>] zfcp_qdio_int_resp+0x70/0x110 [<000000000044a1ec>] qdio_kick_handler+0xb0/0x19c [<000000000044c228>] __tiqdio_inbound_processing+0x30c/0xebc [<000000000014a5fc>] tasklet_action+0x1b4/0x1e8 [<000000000014b676>] __do_softirq+0x106/0x1cc [<000000000010d91a>] do_softirq+0xe6/0xec [<000000000014b0c8>] irq_exit+0xd4/0xd8 [<00000000004307ec>] do_IRQ+0x7c0/0xf54 [<0000000000114d28>] io_return+0x0/0x16 [<000000000055fef0>] sub_preempt_count+0x50/0xe4 ([<00000000b1f873c0>] 0xb1f873c0) [<000000000055e25a>] _raw_spin_unlock+0x46/0x74 [<0000000000241c40>] __d_lookup+0x288/0x2c8 [<000000000023502c>] do_lookup+0x7c/0x25c [<0000000000237fa8>] link_path_walk+0x5e4/0xe2c [<0000000000238a00>] path_walk+0x98/0x148 [<0000000000238c98>] do_path_lookup+0x74/0xc0 [<000000000023989c>] user_path_at+0x64/0xa4 [<000000000022e366>] vfs_fstatat+0x4e/0xb0 [<000000000022e4d6>] SyS_newstat+0x2e/0x54 [<00000000001146de>] sysc_noemu+0x10/0x16 [<0000020000153456>] 0x20000153456 INFO: lockdep is turned off. Last Breaking-Event-Address: [<000000000048a0ae>] zfcp_fsf_fcp_cmnd_handler+0x26/0x3b4 Signed-off-by: Swen Schillig <swen@vnet.ibm.com> Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 15:41:17 UTC
459dbf7 [SCSI] Eliminate error handler overload of the SCSI serial number The error handler is using the test cmd->serial_number == 0 in the abort routines to signal that the command to be aborted has already completed normally. This design was to close a race window in the original error handler where a command could go through the normal completion routines after it timed out but before error handling was started. Mike Anderson pointed out that when we converted our timeout and softirq completions, we picked up atomicity here because the block layer now mediates this with the REQ_ATOM_COMPLETE flag and guarantees that *either* the command times out or our done routine is called, but ensures we can't get both occurring. That makes the serial number zero check redundant and it can be removed. Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 15:41:16 UTC
5da6141 [SCSI] pmcraid: disable msix and expand device config entry Firmware requires a larger configuration entry size than the driver currently allows, and MSI-X pretty much doesn't work with current FW, so disable it for now. Signed-off-by: Anil Ravindranath <anil_ravindranath@pmc-sierra.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 15:41:15 UTC
c7a841f [SCSI] bsg: correct fault if queue object removed while dev_t open This patch corrects an issue in bsg that results in a general protection fault if an LLD is removed while an application is using an open file handle to a bsg device, and the application issues an ioctl. The fault occurs because the class_dev is NULL, having been cleared in bsg_unregister_queue() when the driver was removed. With this patch, a check is made for the class_dev, and the application will receive ENXIO if the related object is gone. Signed-off-by: Carl Lajeunesse <carl.lajeunesse@emulex.com> Signed-off-by: James Smart <james.smart@emulex.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 15:41:14 UTC
057f02a [SCSI] osd: checking NULL instead of ERR_PTR() bio_map_kern() returns ERR_PTRs on failure and never returns NULL. [jejb: remove redundant unlikely spotted by Tobias Klauser] Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Boaz Harrosh <bharrosh@panasas.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> 09 December 2010, 15:24:13 UTC
1b39ed0 regulator: tps6586x: correct register table Correct the register table for SM2, LDO8, RTC Change-Id: I45348cec5ffbb7da9bd7523764fb611b537236b8 Signed-off-by: Danny Huang <dahuang@nvidia.com> Signed-off-by: Olof Johansson <olofj@chromium.org> Signed-off-by: Stephen Warren <swarren@nvidia.com> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk> 09 December 2010, 09:23:43 UTC
1dbcf35 regulator: tps6586x: Handle both enable reg/bits being the same Change-Id: I40400bb65eab496bb1becd26b37a9653b99d4f41 Signed-off-by: Danny Huang <dahuang@nvidia.com> Signed-off-by: Olof Johansson <olofj@chromium.org> Signed-off-by: Stephen Warren <swarren@nvidia.com> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> (Split into separate patches) Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk> 09 December 2010, 09:23:43 UTC
64db657 regulator: tps6586x: Fix TPS6586X_DVM to store goreg/bit Change-Id: Idacf5e1e51dbbbcd5ea93f310a4e907977e7359e Signed-off-by: Danny Huang <dahuang@nvidia.com> Signed-off-by: Olof Johansson <olofj@chromium.org> Signed-off-by: Stephen Warren <swarren@nvidia.com> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> (Split into separate patches) (Minor formatting fixes) Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk> 09 December 2010, 09:23:43 UTC
4f58670 regulator: tps6586x: Add missing bit mask generation Change-Id: I76eaceb31b56264f6978af15db1e6fc7e2e01b5a Signed-off-by: Danny Huang <dahuang@nvidia.com> Signed-off-by: Olof Johansson <olofj@chromium.org> Signed-off-by: Stephen Warren <swarren@nvidia.com> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> (Split into separate patches) Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk> 09 December 2010, 09:23:43 UTC
f3886f8 drm/radeon/kms: don't apply 7xx HDP flush workaround on AGP It should be required for all 7xx asics, but seems to cause problems on some AGP 7xx chips. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=19002 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Reported-and-Tested-by: Duncan <1i5t5.duncan@cox.net> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com> 09 December 2010, 07:59:24 UTC
6f33162 drm: use after free in drm_queue_vblank_event() The "e" pointer is either NULL or freed when we call drm_vblank_put(dev, e->pipe) on the error path. Just pass the "pipe" variable directly instead. I changed another caller to use "pipe" as well for consistency. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> 09 December 2010, 07:27:25 UTC
d70ab7f Merge branch 'fix/asoc' into for-linus 09 December 2010, 07:24:32 UTC
58936b2 Merge branch 'fix/hda' into for-linus 09 December 2010, 07:24:25 UTC
8a96b1e ALSA: HDA: Quirk for Dell Vostro 320 to make microphone work BugLink: http://launchpad.net/497546 Confirmed that the ideapad model works better than the current quirk for Dell Vostro 320. Cc: stable@kernel.org (2.6.35+) Signed-off-by: David Henningsson <david.henningsson@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> 09 December 2010, 07:23:31 UTC
e76116c drm/kms: remove spaces from connector names (v2) Grub doesn't parse spaces in parameters correctly, so this makes it impossible to force video= parameters for kms on the grub kernel command line. v2: shorten the names to make them easier to type. Reported-by: Sergej Pupykin <ml@sergej.pp.ru> Cc: Sergej Pupykin <ml@sergej.pp.ru> Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com> 09 December 2010, 07:19:12 UTC
589a594 md: protect against NULL reference when waiting to start a raid10. When we fail to start a raid10 for some reason, we call md_unregister_thread to kill the thread that was created. Unfortunately md_thread() will then make one call into the handler (raid10d) even though md_wakeup_thread has not been called. This is not safe and as md_unregister_thread is called after mddev->private has been set to NULL, it will definitely cause a NULL dereference. So fix this at both ends: - md_thread should only call the handler if THREAD_WAKEUP has been set. - raid10 should call md_unregister_thread before setting things to NULL just like all the other raid modules do. This is applicable to 2.6.35 and later. Cc: stable@kernel.org Reported-by: "Citizen" <citizen_lee@thecus.com> Signed-off-by: NeilBrown <neilb@suse.de> 09 December 2010, 06:02:14 UTC
1a855a0 md: fix bug with re-adding of partially recovered device. With v0.90 metadata, a hot-spare does not become a full member of the array until recovery is complete. So if we re-add such a device to the array, we know that all of it is as up-to-date as the event count would suggest, and so it a bitmap-based recovery is possible. However with v1.x metadata, the hot-spare immediately becomes a full member of the array, but it record how much of the device has been recovered. If the array is stopped and re-assembled recovery starts from this point. When such a device is hot-added to an array we currently lose the 'how much is recovered' information and incorrectly included it as a full in-sync member (after bitmap-based fixup). This is wrong and unsafe and could corrupt data. So be more careful about setting saved_raid_disk - which is what guides the re-adding of devices back into an array. The new code matches the code in slot_store which does a similar thing, which is encouraging. This is suitable for any -stable kernel. Reported-by: "Dailey, Nate" <Nate.Dailey@stratus.com> Cc: stable@kernel.org Signed-off-by: NeilBrown <neilb@suse.de> 09 December 2010, 05:36:28 UTC
a035fc3 md: fix possible deadlock in handling flush requests. As recorded in https://bugzilla.kernel.org/show_bug.cgi?id=24012 it is possible for a flush request through md to hang. This is due to an interaction between the recursion avoidance in generic_make_request, the insistence in md of only having one flush active at a time, and the possibility of dm (or md) submitting two flush requests to a device from the one generic_make_request. If a generic_make_request call into dm causes two flush requests to be queued (as happens if the dm table has two targets - they get one each), these two will be queued inside generic_make_request. Assume they are for the same md device. The first is processed and causes 1 or more flush requests to be sent to lower devices. These get queued within generic_make_request too. Then the second flush to the md device gets handled and it blocks waiting for the first flush to complete. But it won't complete until the two lower-device requests complete, and they haven't even been submitted yet as they are on the generic_make_request queue. The deadlock can be broken by using a separate thread to submit the requests to lower devices. md has such a thread readily available: md_wq. So use it to submit these requests. Reported-by: Giacomo Catenazzi <cate@cateee.net> Tested-by: Giacomo Catenazzi <cate@cateee.net> Signed-off-by: NeilBrown <neilb@suse.de> 09 December 2010, 05:17:51 UTC
a7a07e6 md: move code in to submit_flushes. submit_flushes is called from exactly one place. Move the code that is before and after that call into submit_flushes. This has not functional change, but will make the next patch smaller and easier to follow. Signed-off-by: NeilBrown <neilb@suse.de> 09 December 2010, 05:04:25 UTC
2b74e12 md: remove handling of flush_pending in md_submit_flush_data None of the functions called between setting flush_pending to 1, and atomic_dec_and_test can change flush_pending, or will anything running in any other thread (as ->flush_bio is not NULL). So the atomic_dec_and_test will always succeed. So remove the atomic_sec and the atomic_dec_and_test. Signed-off-by: NeilBrown <neilb@suse.de> 09 December 2010, 04:59:01 UTC
4e085e7 econet: Fix crash in aun_incoming(). Unconditional use of skb->dev won't work here, try to fetch the econet device via skb_dst()->dev instead. Suggested by Eric Dumazet. Reported-by: Nelson Elhage <nelhage@ksplice.com> Tested-by: Nelson Elhage <nelhage@ksplice.com> Signed-off-by: David S. Miller <davem@davemloft.net> 09 December 2010, 04:51:15 UTC
7182afe IB/uverbs: Handle large number of entries in poll CQ In ib_uverbs_poll_cq() code there is a potential integer overflow if userspace passes in a large cmd.ne. The calls to kmalloc() would allocate smaller buffers than intended, leading to memory corruption. There iss also an information leak if resp wasn't all used. Unprivileged userspace may call this function, although only if an RDMA device that uses this function is present. Fix this by copying CQ entries one at a time, which avoids the allocation entirely, and also by moving this copying into a function that makes sure to initialize all memory copied to userspace. Special thanks to Jason Gunthorpe <jgunthorpe@obsidianresearch.com> for his help and advice. Cc: <stable@kernel.org> Signed-off-by: Dan Carpenter <error27@gmail.com> [ Monkey around with things a bit to avoid bad code generation by gcc when designated initializers are used. - Roland ] Signed-off-by: Roland Dreier <rolandd@cisco.com> 08 December 2010, 23:23:49 UTC
f198725 tcp: protect sysctl_tcp_cookie_size reads Make sure sysctl_tcp_cookie_size is read once in tcp_cookie_size_check(), or we might return an illegal value to caller if sysctl_tcp_cookie_size is changed by another cpu. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Ben Hutchings <bhutchings@solarflare.com> Cc: William Allen Simpson <william.allen.simpson@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 20:34:09 UTC
ad9f4f5 tcp: avoid a possible divide by zero sysctl_tcp_tso_win_divisor might be set to zero while one cpu runs in tcp_tso_should_defer(). Make sure we dont allow a divide by zero by reading sysctl_tcp_tso_win_divisor exactly once. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 20:34:08 UTC
0a54917 orinoco: fix TKIP countermeasure behaviour Enable the port when disabling countermeasures, and disable it on enabling countermeasures. This bug causes the response of the system to certain attacks to be ineffective. It also prevents wpa_supplicant from getting scan results, as wpa_supplicant disables countermeasures on startup - preventing the hardware from scanning. wpa_supplicant works with ap_mode=2 despite this bug because the commit handler re-enables the port. The log tends to look like: State: DISCONNECTED -> SCANNING Starting AP scan for wildcard SSID Scan requested (ret=0) - scan timeout 5 seconds EAPOL: disable timer tick EAPOL: Supplicant port status: Unauthorized Scan timeout - try to get results Failed to get scan results Failed to get scan results - try scanning again Setting scan request: 1 sec 0 usec Starting AP scan for wildcard SSID Scan requested (ret=-1) - scan timeout 5 seconds Failed to initiate AP scan. Reported by: Giacomo Comes <comes@naic.edu> Signed-off by: David Kilroy <kilroyd@googlemail.com> Cc: stable@kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com> 08 December 2010, 20:24:06 UTC
ba34fce orinoco: clear countermeasure setting on commit ... and interface up. In these situations, you are usually trying to connect to a new AP, so keeping TKIP countermeasures active is confusing. This is already how the driver behaves (inadvertently). However, querying SIOCGIWAUTH may tell userspace that countermeasures are active when they aren't. Clear the setting so that the reporting matches what the driver has done.. Signed-off by: David Kilroy <kilroyd@googlemail.com> Cc: stable@kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com> 08 December 2010, 20:23:52 UTC
7e24470 mac80211: Fix BUG in pskb_expand_head when transmitting shared skbs mac80211 doesn't handle shared skbs correctly at the moment. As a result a possible resize can trigger a BUG in pskb_expand_head. [ 676.030000] Kernel bug detected[#1]: [ 676.030000] Cpu 0 [ 676.030000] $ 0 : 00000000 00000000 819662ff 00000002 [ 676.030000] $ 4 : 81966200 00000020 00000000 00000020 [ 676.030000] $ 8 : 819662e0 800043c0 00000002 00020000 [ 676.030000] $12 : 3b9aca00 00000000 00000000 00470000 [ 676.030000] $16 : 80ea2000 00000000 00000000 00000000 [ 676.030000] $20 : 818aa200 80ea2018 80ea2000 00000008 [ 676.030000] $24 : 00000002 800ace5c [ 676.030000] $28 : 8199a000 8199bd20 81938f88 80f180d4 [ 676.030000] Hi : 0000026e [ 676.030000] Lo : 0000757e [ 676.030000] epc : 801245e4 pskb_expand_head+0x44/0x1d8 [ 676.030000] Not tainted [ 676.030000] ra : 80f180d4 ieee80211_skb_resize+0xb0/0x114 [mac80211] [ 676.030000] Status: 1000a403 KERNEL EXL IE [ 676.030000] Cause : 10800024 [ 676.030000] PrId : 0001964c (MIPS 24Kc) [ 676.030000] Modules linked in: mac80211_hwsim rt2800lib rt2x00soc rt2x00pci rt2x00lib mac80211 crc_itu_t crc_ccitt cfg80211 compat arc4 aes_generic deflate ecb cbc [last unloaded: rt2800pci] [ 676.030000] Process kpktgend_0 (pid: 97, threadinfo=8199a000, task=81879f48, tls=00000000) [ 676.030000] Stack : ffffffff 00000000 00000000 00000014 00000004 80ea2000 00000000 00000000 [ 676.030000] 818aa200 80f180d4 ffffffff 0000000a 81879f78 81879f48 81879f48 00000018 [ 676.030000] 81966246 80ea2000 818432e0 80f1a420 80203050 81814d98 00000001 81879f48 [ 676.030000] 81879f48 00000018 81966246 818432e0 0000001a 8199bdd4 0000001c 80f1b72c [ 676.030000] 80203020 8001292c 80ef4aa2 7f10b55d 801ab5b8 81879f48 00000188 80005c90 [ 676.030000] ... [ 676.030000] Call Trace: [ 676.030000] [<801245e4>] pskb_expand_head+0x44/0x1d8 [ 676.030000] [<80f180d4>] ieee80211_skb_resize+0xb0/0x114 [mac80211] [ 676.030000] [<80f1a420>] ieee80211_xmit+0x150/0x22c [mac80211] [ 676.030000] [<80f1b72c>] ieee80211_subif_start_xmit+0x6f4/0x73c [mac80211] [ 676.030000] [<8014361c>] pktgen_thread_worker+0xfac/0x16f8 [ 676.030000] [<8002ebe8>] kthread+0x7c/0x88 [ 676.030000] [<80008e0c>] kernel_thread_helper+0x10/0x18 [ 676.030000] [ 676.030000] [ 676.030000] Code: 24020001 10620005 2502001f <0200000d> 0804917a 00000000 2502001f 00441023 00531021 Fix this by making a local copy of shared skbs prior to mangeling them. To avoid copying the skb unnecessarily move the skb_copy call below the checks that don't need write access to the skb. Also, move the assignment of nh_pos and h_pos below the skb_copy to point to the correct skb. It would be possible to avoid another resize of the copied skb by using skb_copy_expand instead of skb_copy but that would make the patch more complex. Also, shared skbs are a corner case right now, so the resize shouldn't matter much. Cc: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com> Cc: stable@kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com> 08 December 2010, 20:23:48 UTC
f933ebe ath9k_htc: Fix suspend/resume The HW has to be set to FULLSLEEP mode during suspend, when no interface has been brought up. Not doing this would break resume, as the chip won't be powered up at all. Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 08 December 2010, 20:23:47 UTC
b93996c ath5k: Put the right tsf value in mesh beacons Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 08 December 2010, 20:23:46 UTC
c26d533 ath5k: Prevent mesh interfaces from being counted as ad-hoc This results in an erroneus num_adhoc_vifs count, as the this counter was incremented but not decremented for mesh interfaces. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 08 December 2010, 20:23:45 UTC
d82b577 ath5k: Fix beaconing in mesh mode This patch fixes the oops below when attempting to bring up a mesh interface on ath5k hardware. [ 128.933099] kernel BUG at drivers/net/wireless/ath/ath5k/base.c:197! [ 128.933099] invalid opcode: 0000 [#1] (...) [ 128.933099] Call Trace: [ 128.933099] [<c83b77fa>] ? ath5k_beacon_update+0x57/0x1f8 [ath5k] [ 128.933099] [<c02d9a40>] ? __sysfs_add_one+0x28/0x76 [ 128.933099] [<c83b830e>] ? ath5k_bss_info_changed+0x13f/0x173 [ath5k] [ 128.933099] [<c82ff629>] ? ieee80211_config_beacon+0xc0/0x17e [mac80211] [ 128.933099] [<c82f073e>] ? ieee80211_bss_info_change_notify+0x182/0x18b [mac80211] [ 128.933099] [<c83b81cf>] ? ath5k_bss_info_changed+0x0/0x173 [ath5k] [ 128.933099] [<c82ff6d6>] ? ieee80211_config_beacon+0x16d/0x17e [mac80211] [ 128.933099] [<c82ff753>] ? ieee80211_add_beacon+0x34/0x39 [mac80211] [ 128.933099] [<c830a4ed>] ? ieee80211s_init+0xf8/0x10f [mac80211] [ 128.933099] [<c830a5df>] ? ieee80211_mesh_init_sdata+0xdb/0x154 [mac80211] Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 08 December 2010, 20:23:44 UTC
229bd79 orinoco: initialise priv->hw before assigning the interrupt The interrupt handler takes a lock - but since commit bcad6e80f3f this lock goes through an indirection specified in the hermes_t structure. We must therefore initialise the structure before setting up the interrupt handler. Fix orinoco_cs and spectrum_cs <https://bugzilla.kernel.org/show_bug.cgi?id=23932> Bisected by: Matt Domsch <Matt_Domsch@dell.com> Signed-off by: David Kilroy <kilroyd@googlemail.com> Cc: stable@kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com> 08 December 2010, 20:23:31 UTC
c7757fd ehea: Fixing LRO configuration In order to set LRO on ehea, the user must set a module parameter, which is not the standard way to do so. This patch adds a way to set LRO using the ethtool tool. Signed-off-by: Breno Leitao <leitao@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 20:19:14 UTC
6763151 tcp: Replace time wait bucket msg by counter Rather than printing the message to the log, use a mib counter to keep track of the count of occurences of time wait bucket overflow. Reduces spam in logs. Signed-off-by: Tom Herbert <therbert@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 20:16:33 UTC
171995e x25: decrement netdev reference counts on unload x25 does not decrement the network device reference counts on module unload. Thus unregistering any pre-existing interface after unloading the x25 module hangs and results in unregister_netdevice: waiting for tap0 to become free. Usage count = 1 This patch decrements the reference counts of all interfaces in x25_link_free, the way it is already done in x25_link_device_down for NETDEV_DOWN events. Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 20:13:44 UTC
408cc29 driver/net/benet: fix be_cmd_multicast_set() memcpy bug Regarding benet be_cmd_multicast_set() function, now using netdev_for_each_mc_addr() helper for mac address copy, but when copying to req->mac[] did not increase of the index. Cc: Sathya Perla <sathyap@serverengines.com> Cc: Subbu Seetharaman <subbus@serverengines.com> Cc: Sarveshwar Bandi <sarveshwarb@serverengines.com> Cc: Ajit Khaparde <ajitk@serverengines.com> Signed-off-by: Joe Jin <joe.jin@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 20:13:43 UTC
e8d34a8 l2tp: Fix modalias of l2tp_ip Using the SOCK_DGRAM enum results in "net-pf-2-proto-SOCK_DGRAM-type-115", so use the numeric value like it is done in net/dccp. Signed-off-by: Michal Marek <mmarek@suse.cz> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 20:13:43 UTC
0c62fc6 econet: Do the correct cleanup after an unprivileged SIOCSIFADDR. We need to drop the mutex and do a dev_put, so set an error code and break like the other paths, instead of returning directly. Signed-off-by: Nelson Elhage <nelhage@ksplice.com> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 20:13:42 UTC
0833847 Merge branch 'sfc-2.6.37' of git://git.kernel.org/pub/scm/linux/kernel/git/bwh/sfc-2.6 08 December 2010, 20:13:23 UTC
e726f3c amd64_edac: Fix interleaving check When matching error address to the range contained by one memory node, we're in valid range when node interleaving 1. is disabled, or 2. enabled and when the address bits we interleave on match the interleave selector on this node (see the "Node Interleaving" section in the BKDG for an enlightening example). Thus, when we early-exit, we need to reverse the compound logic statement properly. Cc: <stable@kernel.org> Signed-off-by: Borislav Petkov <borislav.petkov@amd.com> 08 December 2010, 18:52:54 UTC
76f04f2 EDAC: Correct MiB_TO_PAGES() macro This corrects the misprint introduced when moving '#if PAGE_SHIFT' from i7core_edac.c to edac_core.h (commit e9144601d364d5b81f3e63949337f8507eb58dca) Cc: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Andrei Konovalov <akonovalov@mvista.com> Signed-off-by: Borislav Petkov <borislav.petkov@amd.com> 08 December 2010, 18:52:53 UTC
bb31b31 EDAC: Fix workqueue-related crashes 00740c58541b6087d78418cebca1fcb86dc6077d changed edac_core to un-/register a workqueue item only if a lowlevel driver supplies a polling routine. Normally, when we remove a polling low-level driver, we go and cancel all the queued work. However, the workqueue unreg happens based on the ->op_state setting, and edac_mc_del_mc() sets this to OP_OFFLINE _before_ we cancel the work item, leading to NULL ptr oops on the workqueue list. Fix it by putting the unreg stuff in proper order. Cc: <stable@kernel.org> #36.x Reported-and-tested-by: Tobias Karnat <tobias.karnat@googlemail.com> LKML-Reference: <1291201307.3029.21.camel@Tobias-Karnat> Signed-off-by: Borislav Petkov <borislav.petkov@amd.com> 08 December 2010, 18:52:27 UTC
545c988 cifs: remove bogus remapping of error in cifs_filldir() As the FIXME points out correctly, now filldir() itself returns -EOVERFLOW if it not possible to represent the inode number supplied by the filesystem in the field provided by userspace. Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de> Reviewed-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve French <sfrench@us.ibm.com> 08 December 2010, 18:47:54 UTC
35d9b0c llc: fix a device refcount imbalance Le dimanche 05 décembre 2010 à 12:23 +0100, Eric Dumazet a écrit : > Le dimanche 05 décembre 2010 à 09:19 +0100, Eric Dumazet a écrit : > > > Hmm.. > > > > If somebody can explain why RTNL is held in arp_ioctl() (and therefore > > in arp_req_delete()), we might first remove RTNL use in arp_ioctl() so > > that your patch can be applied. > > > > Right now it is not good, because RTNL wont be necessarly held when you > > are going to call arp_invalidate() ? > > While doing this analysis, I found a refcount bug in llc, I'll send a > patch for net-2.6 Oh well, of course I must first fix the bug in net-2.6, and wait David pull the fix in net-next-2.6 before sending this rcu conversion. Note: this patch should be sent to stable teams (2.6.34 and up) [PATCH net-2.6] llc: fix a device refcount imbalance commit abf9d537fea225 (llc: add support for SO_BINDTODEVICE) added one refcount imbalance in llc_ui_bind(), because dev_getbyhwaddr() doesnt take a reference on device, while dev_get_by_index() does. Fix this using RCU locking. And since an RCU conversion will be done for 2.6.38 for dev_getbyhwaddr(), put the rcu_read_lock/unlock exactly at their final place. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: stable@kernel.org Cc: Octavian Purdila <opurdila@ixiacom.com> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 17:58:44 UTC
75c1c82 ifb: goto resched directly if error happens and dp->tq isn't empty If we break the loop when there are still skbs in tq and no skb in rq, the skbs will be left in txq until new skbs are enqueued into rq. In rare cases, no new skb is queued, then these skbs will stay in rq forever. After this patch, if tq isn't empty when we break the loop, we goto resched directly. Signed-off-by: Changli Gao <xiaosuo@gmail.com> Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 17:45:34 UTC
b1afde6 tcp: Bug fix in initialization of receive window. The bug has to do with boundary checks on the initial receive window. If the initial receive window falls between init_cwnd and the receive window specified by the user, the initial window is incorrectly brought down to init_cwnd. The correct behavior is to allow it to remain unchanged. Signed-off-by: Nandita Dukkipati <nanditad@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 17:38:37 UTC
ce9aeb5 cxgb4: fix MAC address hash filter Fix the calculation of the inexact hash-based MAC address filter. It's 64 bits but current code is missing a ULL. Results in filtering out some legitimate packets. Signed-off-by: Dimitris Michailidis <dm@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 17:36:22 UTC
c1ac3ff nfsd: Fix possible BUG_ON firing in set_change_info If vfs_getattr in fill_post_wcc returns an error, we don't set fh_post_change. For NFSv4, this can result in set_change_info triggering a BUG_ON. i.e. fh_post_saved being zero isn't really a bug. So: - instead of BUGging when fh_post_saved is zero, just clear ->atomic. - if vfs_getattr fails in fill_post_wcc, take a copy of i_ctime anyway. This will be used i seg_change_info, but not overly trusted. - While we are there, remove the pointless 'if' statements in set_change_info. There is no harm setting all the values. Signed-off-by: NeilBrown <neilb@suse.de> Cc: stable@kernel.org Signed-off-by: J. Bruce Fields <bfields@redhat.com> 08 December 2010, 16:44:04 UTC
e832932 CAIF: Fix U5500 compile error for shared memory driver Rearrange pr_fmt so it compiles. Signed-off-by: Sjur Braendeland <sjur.brandeland@stericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net> 08 December 2010, 16:35:29 UTC
4f58605 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 08 December 2010, 16:13:01 UTC
8b0f184 hwmon: (adm1026) Allow 1 as a valid divider value Allow 1 as a valid div value as specified in the ADM1026 datasheet. Signed-off-by: Gabriele Gorla <gorlik@penguintown.net> Cc: stable@kernel.org Signed-off-by: Jean Delvare <khali@linux-fr.org> 08 December 2010, 15:27:22 UTC
52bc980 hwmon: (adm1026) Fix setting fan_div Prevent setting fan_div from stomping on other fans that share the same I2C register. Signed-off-by: Gabriele Gorla <gorlik@penguintown.net> Cc: stable@kernel.org Signed-off-by: Jean Delvare <khali@linux-fr.org> 08 December 2010, 15:27:22 UTC
6229cdb hwmon: (it87) Fix manual fan speed control on IT8721F The manual fan speed control logic of the IT8721F is much different from what older devices had. Update the code to properly support that. Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <guenter.roeck@ericsson.com> 08 December 2010, 15:27:22 UTC
6313e3c Merge branches 'x86-fixes-for-linus', 'perf-fixes-for-linus' and 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86/pvclock: Zero last_value on resume * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf record: Fix eternal wait for stillborn child perf header: Don't assume there's no attr info if no sample ids is provided perf symbols: Figure out start address of kernel map from kallsyms perf symbols: Fix kallsyms kernel/module map splitting * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: nohz: Fix printk_needs_cpu() return value on offline cpus printk: Fix wake_up_klogd() vs cpu hotplug 08 December 2010, 14:40:59 UTC
6dde39b Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/i915: i915 cannot provide switcher services. drm/radeon/kms: fix vram base calculation on rs780/rs880 drm/radeon/kms: fix formatting of vram and gtt info drm/radeon/kms: forbid big bo allocation (fdo 31708) v3 drm: Don't try and disable an encoder that was never enabled drm: Add missing drm_vblank_put() along queue vblank error path drm/i915/dp: Only apply the workaround if the select is still active drm/i915: Emit a request to clear a flushed and idle ring for unbusy bo drm/i915/lvds: Always restore panel-fitter when enabling the LVDS drm/i915/ringbuffer: Only print an error on the second attempt to reset head drm/i915: announce to userspace that the bsd ring is coherent agp/intel: Fix wrong kunmap in i830_cleanup() drm/i915: Factor in pixel-repeat in FDI M/N calculation drm/i915: Death to the unnecessary 64bit divide drm/i915: Clean conflicting modesetting registers upon init drm/i915: Apply a workaround for transitioning from DP on pipe B to HDMI. drm/i915: Always set the DP transcoder config to 8BPC. 08 December 2010, 14:34:39 UTC
f8f5d4f Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: wacom - add new Bamboo PT (0xdb) Input: add input driver for polled GPIO buttons Input: turbografx - fix reference counting Input: synaptics - fix handling of 2-button ClickPads Input: wacom - add IDs for two new Bamboo PTs Input: document struct input_absinfo Input: add keycodes for touchpad on/off keys Input: usbtouchscreen - add support for LG Flatron T1710B 08 December 2010, 14:34:02 UTC
0bbaee3 ALSA: hda - Reset sample sizes and max bitrates when reading ELD When a new HDMI/DP device is plugged in, hdmi_update_short_audio_desc() is called for every SAD (Short Audio Descriptor) in the ELD data. For LPCM coding type SAD defines the supported sample sizes. For several other coding types (such as AC-3), a maximum bitrate is defined. The maximum bitrate and sample size fields are not always cleared. Therefore, if a device is unplugged and a different one is plugged in, and the coding types of some SAD positions differ between the devices, the old max_bitrate or sample_bits values will persist if the new SADs do not define those values. The leftover max_bitrate and sample_bits do not cause any issues other than wrongly showing up in eld#X.Y procfs file and kernel log. Fix that by always clearing sample_bits and max_bitrate when reading SADs. Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi> Signed-off-by: Takashi Iwai <tiwai@suse.de> 08 December 2010, 07:36:20 UTC
599bbb9 drm/i915: i915 cannot provide switcher services. it has a DSM but the switcher is done via WMI. Signed-off-by: Dave Airlie <airlied@redhat.com> 08 December 2010, 05:40:44 UTC
47d0923 Input: wacom - add new Bamboo PT (0xdb) Adds new Bamboo Pen & Touch model - Bamboo P & T Special Edition Medium (CTH661/L; Product ID = 0xdb). Tested-by: Tobias Verbeke <tobias.verbeke@gmail.com> Signed-off-by: David Foley <favux.is@gmail.com> Acked-by: Ping Cheng <pingc@wacom.com> Signed-off-by: Dmitry Torokhov <dtor@mail.ru> 08 December 2010, 05:09:38 UTC
2df485a nfs: remove extraneous and problematic calls to nfs_clear_request When a nfs_page is freed, nfs_free_request is called which also calls nfs_clear_request to clean out the lock and open contexts and free the pagecache page. However, a couple of places in the nfs code call nfs_clear_request themselves. What happens here if the refcount on the request is still high? We'll be releasing contexts and freeing pointers while the request is possibly still in use. Remove those bare calls to nfs_clear_context. That should only be done when the request is being freed. Note that when doing this, we need to watch out for tests of req->wb_page. Previously, nfs_set_page_tag_locked() and nfs_clear_page_tag_locked() would check the value of req->wb_page to figure out if the page is mapped into the nfsi->nfs_page_tree. We now indicate the page is mapped using the new bit PG_MAPPED in req->wb_flags . Reported-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> 08 December 2010, 04:02:44 UTC
e281f7e arm: omap2: io: fix clk_get() error check clk_get() return value should be checked with IS_ERR(). Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com> Acked-by: Kevin Hilman <khilman@deeprootsystems.com> Signed-off-by: Tony Lindgren <tony@atomide.com> 08 December 2010, 02:12:56 UTC
ed2849d sunrpc: prevent use-after-free on clearing XPT_BUSY When an xprt is created, it has a refcount of 1, and XPT_BUSY is set. The refcount is *not* owned by the thread that created the xprt (as is clear from the fact that creators never put the reference). Rather, it is owned by the absence of XPT_DEAD. Once XPT_DEAD is set, (And XPT_BUSY is clear) that initial reference is dropped and the xprt can be freed. So when a creator clears XPT_BUSY it is dropping its only reference and so must not touch the xprt again. However svc_recv, after calling ->xpo_accept (and so getting an XPT_BUSY reference on a new xprt), calls svc_xprt_recieved. This clears XPT_BUSY and then svc_xprt_enqueue - this last without owning a reference. This is dangerous and has been seen to leave svc_xprt_enqueue working with an xprt containing garbage. So we need to hold an extra counted reference over that call to svc_xprt_received. For safety, any time we clear XPT_BUSY and then use the xprt again, we first get a reference, and the put it again afterwards. Note that svc_close_all does not need this extra protection as there are no threads running, and the final free can only be called asynchronously from such a thread. Signed-off-by: NeilBrown <neilb@suse.de> Cc: stable@kernel.org Signed-off-by: J. Bruce Fields <bfields@redhat.com> 08 December 2010, 01:39:55 UTC
2cedcc4 Merge branch 'fixes/2637-rc5/s3c24xx' of git://git.fluff.org/bjdooks/linux * 'fixes/2637-rc5/s3c24xx' of git://git.fluff.org/bjdooks/linux: ARM: S3C24XX: Fix mess with gpio {set,get}_pull callbacks ARM: mini2440: Fix Kconfig to allow kernel to build ARM: S3C2412: Fix typo in CONFIG_CPU_S3C2412_ONLY definition ARM: S3C2443: Select properly ARM core type ARM: SMDK2416: Select MACH_SMDK, S3C_DEV_NAND, S3C_DEV_USB_HOST 08 December 2010, 01:13:50 UTC
812c4e4 ARM: S3C24XX: Fix mess with gpio {set,get}_pull callbacks Currently the {set,get}_pull callbacks of the s3c24xx_gpiocfg_default structure are initalized via s3c_gpio_{get,set}pull_1up. This results in a linker error when only CONFIG_CPU_S3C2442 is selected: arch/arm/plat-s3c24xx/built-in.o:(.data+0x13f4): undefined reference to `s3c_gpio_getpull_1up' arch/arm/plat-s3c24xx/built-in.o:(.data+0x13f8): undefined reference to `s3c_gpio_setpull_1up' The s3c2442 has pulldowns instead of pullups compared to the s3c2440. The method of controlling them is the same though. So this patch modifies the existing s3c_gpio_{get,set}pull_1up helper functions to take an additional parameter deciding whether the pin has a pullup or pulldown. The s3c_gpio_{get,set}pull_1{down,up} functions then wrap that functions passing either S3C_GPIO_PULL_UP or S3C_GPIO_PULL_DOWN. Furthermore this patch sets up the s3c24xx_gpiocfg_default.{get,set}_pull fields in the s3c244{0,2}_map_io function to the new pulldown helper functions. Based on patch from "Lars-Peter Clausen" <lars@metafoo.de> Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com> Signed-off-by: Ben Dooks <ben-linux@fluff.org> 08 December 2010, 01:04:56 UTC
0de1b7e nfs: kernel should return EPROTONOSUPPORT when not support NFSv4 When nfs client(kernel) don't support NFSv4, maybe user build kernel without NFSv4, there is a problem. Using command "mount SERVER-IP:/nfsv3 /mnt/" to mount NFSv3 filesystem, mount should should success, but fail and get error: "mount.nfs: an incorrect mount option was specified" System call mount "nfs"(not "nfs4") with "vers=4", if CONFIG_NFS_V4 is not defined, the "vers=4" will be parsed as invalid argument and kernel return EINVAL to nfs-utils. About that, we really want get EPROTONOSUPPORT rather than EINVAL. This path make sure kernel parses argument success, and return EPROTONOSUPPORT at nfs_validate_mount_data(). Signed-off-by: Mi Jinlong <mijinlong@cn.fujitsu.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> 08 December 2010, 00:30:44 UTC
21ac19d NFS: Fix fcntl F_GETLK not reporting some conflicts The commit 129a84de2347002f09721cda3155ccfd19fade40 (locks: fix F_GETLK regression (failure to find conflicts)) fixed the posix_test_lock() function by itself, however, its usage in NFS changed by the commit 9d6a8c5c213e34c475e72b245a8eb709258e968c (locks: give posix_test_lock same interface as ->lock) remained broken - subsequent NFS-specific locking code received F_UNLCK instead of the user-specified lock type. To fix the problem, fl->fl_type needs to be saved before the posix_test_lock() call and restored if no local conflicts were reported. Reference: https://bugzilla.kernel.org/show_bug.cgi?id=23892 Tested-by: Alexander Morozov <amorozov@etersoft.ru> Signed-off-by: Sergey Vlasov <vsu@altlinux.ru> Cc: <stable@kernel.org> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> 08 December 2010, 00:30:43 UTC
08a22b3 nfs: Discard ACL cache on mode update An update of mode bits can result in ACL value being changed. We need to mark the acl cache invalid when we update mode. Similarly we need to update file attribute when we change ACL value Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> 08 December 2010, 00:30:42 UTC
c989a7f dmaengine i.MX SDMA: initialize on module_init The firmware framework gets initialized during fs_initcall time, so we are not allowed to call request_firmware earlier. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com> 07 December 2010, 23:38:07 UTC
8961d52 drm/radeon/kms: fix vram base calculation on rs780/rs880 Avoid overflowing a 32 bit value. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com> 07 December 2010, 23:35:05 UTC
dd7cc55 drm/radeon/kms: fix formatting of vram and gtt info print the full 64 bit values. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> 07 December 2010, 23:34:32 UTC
93225b0 drm/radeon/kms: forbid big bo allocation (fdo 31708) v3 Forbid allocating buffer bigger than visible VRAM or GTT, also properly set lpfn field. v2 - use max macro - silence warning v3 - don't explicitly set range limit - use min macro Cc: stable <stable@kernel.org> Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com> 07 December 2010, 23:33:41 UTC
541cc96 drm: Don't try and disable an encoder that was never enabled Prevents code that assumes that the encoder is active when asked to be disabled from dying a horrible death. Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com> 07 December 2010, 23:33:02 UTC
ea5d552 drm: Add missing drm_vblank_put() along queue vblank error path Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Kristian Høgsberg <krh@bitplanet.net> Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Dave Airlie <airlied@redhat.com> 07 December 2010, 23:31:52 UTC
e516c7d Merge branch 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel into drm-fixes 07 December 2010, 23:30:59 UTC
943d8d8 dma : EG20T PCH: Fix miss-setting DMA descriptor Currently, in case of using scatter/gather mode, head of data is not sent to destination. The cause is second descriptor address is set to NEXT. The NEXT must have head of descriptor address. This patch sets head of descriptor address to the NEXT. Acked-by: Yong Wang <youg.y.wang@intel.com> Signed-off-by: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com> [dan.j.williams@intel.com: fixed up usage of virt_to_phys()] Signed-off-by: Dan Williams <dan.j.williams@intel.com> 07 December 2010, 23:07:08 UTC
back to top