https://github.com/torvalds/linux

sort by:
Revision Author Date Message Commit Date
c16fa4f Linux 3.3 18 March 2012, 23:15:34 UTC
93dc610 Don't limit non-nested epoll paths Commit 28d82dc1c4ed ("epoll: limit paths") that I did to limit the number of possible wakeup paths in epoll is causing a few applications to longer work (dovecot for one). The original patch is really about limiting the amount of epoll nesting (since epoll fds can be attached to other fds). Thus, we probably can allow an unlimited number of paths of depth 1. My current patch limits it at 1000. And enforce the limits on paths that have a greater depth. This is captured in: https://bugzilla.redhat.com/show_bug.cgi?id=681578 Signed-off-by: Jason Baron <jbaron@redhat.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 18 March 2012, 19:25:04 UTC
c579bc7 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking changes from David Miller: "1) icmp6_dst_alloc() returns NULL instead of ERR_PTR() leading to crashes, particularly during shutdown. Reported by Dave Jones and fixed by Eric Dumazet. 2) hyperv and wimax/i2400m return NETDEV_TX_BUSY when they have already freed the SKB, which causes crashes as to the caller this means requeue the packet. Fixes from Eric Dumazet. 3) usbnet driver doesn't allocate the right amount of headroom on fresh RX SKBs, fix from Eric Dumazet. 4) Fix regression in ip6_mc_find_dev_rcu(), as an RCU lookup it abolutely should not take a reference to 'dev', this leads to leaks. Fix from RonQing Li. 5) Fix netfilter ctnetlink race between delete and timeout expiration. From Pablo Neira Ayuso. 6) Revert SFQ change which causes regressions, specifically queueing to tail can lead to unavoidable flow starvation. From Eric Dumazet. 7) Fix a memory leak and a crash on corrupt firmware files in bnx2x, from Michal Schmidt." * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: netfilter: ctnetlink: fix race between delete and timeout expiration ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu. wimax/i2400m: fix erroneous NETDEV_TX_BUSY use net/hyperv: fix erroneous NETDEV_TX_BUSY use net/usbnet: reserve headroom on rx skbs bnx2x: fix memory leak in bnx2x_init_firmware() bnx2x: fix a crash on corrupt firmware file sch_sfq: revert dont put new flow at the end of flows ipv6: fix icmp6_dst_alloc() 18 March 2012, 02:22:24 UTC
96ee049 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar. * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf tools, x86: Build perf on older user-space as well perf tools: Use scnprintf where applicable perf tools: Incorrect use of snprintf results in SEGV 17 March 2012, 16:54:16 UTC
a16a164 netfilter: ctnetlink: fix race between delete and timeout expiration Kerin Millar reported hardlockups while running `conntrackd -c' in a busy firewall. That system (with several processors) was acting as backup in a primary-backup setup. After several tries, I found a race condition between the deletion operation of ctnetlink and timeout expiration. This patch fixes this problem. Tested-by: Kerin Millar <kerframil@gmail.com> Reported-by: Kerin Millar <kerframil@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net> 17 March 2012, 08:47:08 UTC
c577923 ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu. ip6_mc_find_dev_rcu() is called with rcu_read_lock(), so don't need to dev_hold(). With dev_hold(), not corresponding dev_put(), will lead to leak. [ bug introduced in 96b52e61be1 (ipv6: mcast: RCU conversions) ] Signed-off-by: RongQing.Li <roy.qing.li@gmail.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> 17 March 2012, 04:56:42 UTC
cb1ecf2 Merge branch 'akpm' (more patches from Andrew) Merge some more email patches from Andrew Morton: "A couple of nilfs fixes" * emailed from Andrew Morton <akpm@linux-foundation.org>: nilfs2: fix NULL pointer dereference in nilfs_load_super_block() nilfs2: clamp ns_r_segments_percentage to [1, 99] 17 March 2012, 00:14:55 UTC
d7178c7 nilfs2: fix NULL pointer dereference in nilfs_load_super_block() According to the report from Slicky Devil, nilfs caused kernel oops at nilfs_load_super_block function during mount after he shrank the partition without resizing the filesystem: BUG: unable to handle kernel NULL pointer dereference at 00000048 IP: [<d0d7a08e>] nilfs_load_super_block+0x17e/0x280 [nilfs2] *pde = 00000000 Oops: 0000 [#1] PREEMPT SMP ... Call Trace: [<d0d7a87b>] init_nilfs+0x4b/0x2e0 [nilfs2] [<d0d6f707>] nilfs_mount+0x447/0x5b0 [nilfs2] [<c0226636>] mount_fs+0x36/0x180 [<c023d961>] vfs_kern_mount+0x51/0xa0 [<c023ddae>] do_kern_mount+0x3e/0xe0 [<c023f189>] do_mount+0x169/0x700 [<c023fa9b>] sys_mount+0x6b/0xa0 [<c04abd1f>] sysenter_do_call+0x12/0x28 Code: 53 18 8b 43 20 89 4b 18 8b 4b 24 89 53 1c 89 43 24 89 4b 20 8b 43 20 c7 43 2c 00 00 00 00 23 75 e8 8b 50 68 89 53 28 8b 54 b3 20 <8b> 72 48 8b 7a 4c 8b 55 08 89 b3 84 00 00 00 89 bb 88 00 00 00 EIP: [<d0d7a08e>] nilfs_load_super_block+0x17e/0x280 [nilfs2] SS:ESP 0068:ca9bbdcc CR2: 0000000000000048 This turned out due to a defect in an error path which runs if the calculated location of the secondary super block was invalid. This patch fixes it and eliminates the reported oops. Reported-by: Slicky Devil <slicky.dvl@gmail.com> Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> Tested-by: Slicky Devil <slicky.dvl@gmail.com> Cc: <stable@vger.kernel.org> [2.6.30+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 March 2012, 00:14:44 UTC
3d777a6 nilfs2: clamp ns_r_segments_percentage to [1, 99] ns_r_segments_percentage is read from the disk. Bogus or malicious value could cause integer overflow and malfunction due to meaningless disk usage calculation. This patch reports error when mounting such bogus volumes. Signed-off-by: Haogang Chen <haogangchen@gmail.com> Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 March 2012, 00:14:44 UTC
33e9ee8 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull maintainer update from James Morris: "Please pull this patch which adds Serge as maintainer of the capabilities code, as discussed on lwn and the lsm list. New capabilities must be signed off by the maintainer, and new uses of any capabilities should at be cc'd to the maintainer." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: MAINTAINERS: Add Serge as maintainer of capabilities 17 March 2012, 00:04:02 UTC
9fc005c Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming Pull c6x bugfix from Mark Salter: "Remove dead code from entry.S which causes a build failure when using a newer assembler (v2.22 complains about it, v2.20 ignores it)." * tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming: C6X: remove dead code from entry.S 17 March 2012, 00:03:15 UTC
c017386 afs: Remote abort can cause BUG in rxrpc code When writing files to afs I sometimes hit a BUG: kernel BUG at fs/afs/rxrpc.c:179! With a backtrace of: afs_free_call afs_make_call afs_fs_store_data afs_vnode_store_data afs_write_back_from_locked_page afs_writepages_region afs_writepages The cause is: ASSERT(skb_queue_empty(&call->rx_queue)); Looking at a tcpdump of the session the abort happens because we are exceeding our disk quota: rx abort fs reply store-data error diskquota exceeded (32) So the abort error is valid. We hit the BUG because we haven't freed all the resources for the call. By freeing any skbs in call->rx_queue before calling afs_free_call we avoid hitting leaking memory and avoid hitting the BUG. Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: David Howells <dhowells@redhat.com> Cc: <stable@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 March 2012, 00:01:41 UTC
2c724fb afs: Read of file returns EBADMSG A read of a large file on an afs mount failed: # cat junk.file > /dev/null cat: junk.file: Bad message Looking at the trace, call->offset wrapped since it is only an unsigned short. In afs_extract_data: _enter("{%u},{%zu},%d,,%zu", call->offset, len, last, count); ... if (call->offset < count) { if (last) { _leave(" = -EBADMSG [%d < %zu]", call->offset, count); return -EBADMSG; } Which matches the trace: [cat ] ==> afs_extract_data({65132},{524},1,,65536) [cat ] <== afs_extract_data() = -EBADMSG [0 < 65536] call->offset went from 65132 to 0. Fix this by making call->offset an unsigned int. Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: David Howells <dhowells@redhat.com> Cc: <stable@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 March 2012, 00:01:41 UTC
6e780cf C6X: remove dead code from entry.S The ENDPROC() on sys_fadvise64_c6x() in arch/c6x/kernel/entry.S is outside of the conditional block with the matching ENTRY() macro. This leads a newer (v2.22 vs. v2.20) assembler to complain: /tmp/ccGZBaPT.s: Assembler messages: /tmp/ccGZBaPT.s: Error: .size expression for sys_fadvise64_c6x does not evaluate to a constant The conditional block became dead code when c6x switched to generic unistd.h and should be removed along with the offending ENDPROC(). Signed-off-by: Mark Salter <msalter@redhat.com> Acked-by: David Howells <dhowells@redhat.com> 16 March 2012, 13:27:57 UTC
b8fbaef wimax/i2400m: fix erroneous NETDEV_TX_BUSY use A driver start_xmit() method cannot free skb and return NETDEV_TX_BUSY, since caller is going to reuse freed skb. In fact netif_tx_stop_queue() / netif_stop_queue() is needed before returning NETDEV_TX_BUSY or you can trigger a ksoftirqd fatal loop. In case of memory allocation error, only safe way is to drop the packet and return NETDEV_TX_OK Also increments tx_dropped counter Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> 16 March 2012, 09:01:41 UTC
bb6d5e7 net/hyperv: fix erroneous NETDEV_TX_BUSY use A driver start_xmit() method cannot free skb and return NETDEV_TX_BUSY, since caller is going to reuse freed skb. This is mostly a revert of commit bf769375c (staging: hv: fix the return status of netvsc_start_xmit()) In fact netif_tx_stop_queue() / netif_stop_queue() is needed before returning NETDEV_TX_BUSY or you can trigger a ksoftirqd fatal loop. In case of memory allocation error, only safe way is to drop the packet and return NETDEV_TX_OK Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: "K. Y. Srinivasan" <kys@microsoft.com> Cc: Haiyang Zhang <haiyangz@microsoft.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net> 16 March 2012, 09:01:17 UTC
7bdd402 net/usbnet: reserve headroom on rx skbs network drivers should reserve some headroom on incoming skbs so that we dont need expensive reallocations, eg forwarding packets in tunnels. This NET_SKB_PAD padding is done in various helpers, like __netdev_alloc_skb_ip_align() in this patch, combining NET_SKB_PAD and NET_IP_ALIGN magic. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Oliver Neukum <oneukum@suse.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: David S. Miller <davem@davemloft.net> 16 March 2012, 09:01:05 UTC
c0ea452 bnx2x: fix memory leak in bnx2x_init_firmware() When cycling the interface down and up, bnx2x_init_firmware() knows that the firmware is already loaded, but nevertheless it allocates certain arrays anew (init_data, init_ops, init_ops_offsets, iro_arr). The old arrays are leaked. Fix the leaks by returning early if the firmware was already loaded. Because if the firmware is loaded, so are the arrays. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Acked-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net> 16 March 2012, 08:57:26 UTC
127d0a1 bnx2x: fix a crash on corrupt firmware file If the requested firmware is deemed corrupt and then released, reset the pointer to NULL in order to avoid double-freeing it in bnx2x_release_firmware() or dereferencing it in bnx2x_init_firmware(). Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Acked-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net> 16 March 2012, 08:57:26 UTC
cc34eb6 sch_sfq: revert dont put new flow at the end of flows This reverts commit d47a0ac7b6 (sch_sfq: dont put new flow at the end of flows) As Jesper found out, patch sounded great but has bad side effects. In stress situation, pushing new flows in front of the queue can prevent old flows doing any progress. Packets can stay in SFQ queue for unlimited amount of time. It's possible to add heuristics to limit this problem, but this would add complexity outside of SFQ scope. A more sensible answer to Dave Taht concerns (who reported the issued I tried to solve in original commit) is probably to use a qdisc hierarchy so that high prio packets dont enter a potentially crowded SFQ qdisc. Reported-by: Jesper Dangaard Brouer <jdb@comx.dk> Cc: Dave Taht <dave.taht@gmail.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> 16 March 2012, 08:55:25 UTC
122bdf6 ipv6: fix icmp6_dst_alloc() commit 87a115783 ( ipv6: Move xfrm_lookup() call down into icmp6_dst_alloc().) forgot to convert one error path, leading to crashes in mld_sendpack() Many thanks to Dave Jones for providing a very complete bug report. Reported-by: Dave Jones <davej@redhat.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> 16 March 2012, 08:53:42 UTC
95d16c7 MAINTAINERS: Add Serge as maintainer of capabilities Add Serge as maintainer of capabilities, per suggestion on LWN: http://lwn.net/Articles/486306/ Signed-off-by: James Morris <james.l.morris@oracle.com> 16 March 2012, 01:05:48 UTC
0c4d067 Merge branch 'akpm' (Andrew's patch-bomb) Merge patches from Andrew Morton: "Nine patches - some bug fixes and some MAINTAINERS fiddling." * emailed from Andrew Morton <akpm@linux-foundation.org>: drivers/video/backlight/s6e63m0.c: fix corruption storing gamma mode MAINTAINERS: add entry for exynos mipi display drivers MAINTAINERS: fix link to Gustavo Padovans tree MAINTAINERS: add Johan to Bluetooth maintainers MAINTAINERS: Gustavo has moved prctl: use CAP_SYS_RESOURCE for PR_SET_MM option rapidio/tsi721: fix bug in register offset definitions MAINTAINERS: update ST's Mailing list for SPEAr memcg: free mem_cgroup by RCU to fix oops 16 March 2012, 00:16:22 UTC
7c32442 Merge branch 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging Pull i2c subsystem fixes from Jean Delvare. * 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: i2c-algo-bit: Fix spurious SCL timeouts under heavy load i2c-core: Comment says "transmitted" but means "received" 16 March 2012, 00:14:35 UTC
538e7e9 Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck. * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (zl6100) Enable interval between chip accesses for all chips hwmon: (w83627ehf) Describe undocumented pwm attributes hwmon: (w83627ehf) Fix temp2 source for W83627UHG hwmon: (w83627ehf) Fix memory leak in probe function hwmon: (w83627ehf) Fix writing into fan_stop_time for NCT6775F/NCT6776F 16 March 2012, 00:13:39 UTC
0c48ca8 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm exynos/intel updates from Dave Airlie: "Two minor updates from Jesse for Intel SNB fixes, and a few fixes from Samsung for exynos. The pull req has Alan's commit in it since Intel based their tree on my tree at that time, but it all seems fine wrt merging." * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm exynos: use drm_fb_helper_set_par directly drm/exynos: Fix fb_videomode <-> drm_mode_modeinfo conversion drm/exynos: fix runtime_pm fimd device state on probe drm/exynos: use correct 'exynos-drm' name for platform device drm/i915: support 32 bit BGR formats in sprite planes drm/i915: fix color order for BGR formats on SNB drm/gma500: Fix Cedarview boot failures in 3.3-rc 16 March 2012, 00:07:25 UTC
72c79bd Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "For 4 fixes for 3.3 (all trivial): - uvc video driver: fixes a division by zero; - davinci: add module.h to fix compilation; - smsusb: fix the delivery system setting; - smsdvb: the get_frontend implementation there is broken. The smsdvb patch has 127 lines, but it is trivial: instead of returning a cache of the set_frontend (with is wrong, as it doesn't have the updated values for the data, and the implementation there is buggy), it copies the information of the detected DVB parameters from the smsdvb private structures into the corresponding DVBv5 struct fields." * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] smsdvb: fix get_frontend [media] smsusb: fix the default delivery system setting [media] media: davinci: added module.h to resolve unresolved macros [media] [FOR,v3.3] uvcvideo: Avoid division by 0 in timestamp calculation 16 March 2012, 00:06:05 UTC
fe83558 Merge branch '3.3-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending Pull target fixes from Nicholas Bellinger: "This series addresses two recently reported regression bugs related to legacy SCSI reservation usage in target core, and iscsi-target reservation conflict handling. The second patch in particular addresses possible data-corruption with SCSI reservations that is specific to iscsi-target fabric LUNs with multiple client writers. Both patches need to go into v3.2 stable ASAP, and the branch based on the last target-pending/3.3-rc-fixes HEAD. Again, thanks to Martin Svec for his help to identify and address this regression bug with iscsi-target." * '3.3-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: iscsi-target: Fix reservation conflict -EBUSY response handling bug target: Fix compatible reservation handling (CRH=1) with legacy RESERVE/RELEASE 16 March 2012, 00:04:56 UTC
cf2b94d drivers/video/backlight/s6e63m0.c: fix corruption storing gamma mode strict_strtoul() writes a long but ->gamma_mode only has space to store an int, so on 64 bit systems we end up scribbling over ->gamma_table_count as well. I've changed it to use kstrtouint() instead. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 16 March 2012, 00:03:04 UTC
5eb1eb4 MAINTAINERS: add entry for exynos mipi display drivers I'd like to add Inki Dae, Donghwa Lee and Kyungmin Park as maintainers who developers for exynos mipi display drivers for video/driver/exynos/exynos_mipi* and include/video/exynos_mipi*. Signed-off-by: Donghwa Lee <dh09.lee@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de> Cc: Richard Purdie <rpurdie@rpsys.net> Cc: Kukjin Kim <kgene.kim@samsung.com> Cc: Jingoo Han <jg1.han@samsung.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 16 March 2012, 00:03:04 UTC
4c57c7e MAINTAINERS: fix link to Gustavo Padovans tree Gustavo's tree is called just bluetooth.git and not bluetooth-2.6.git anymore. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: "Gustavo F. Padovan" <padovan@profusion.mobi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 16 March 2012, 00:03:03 UTC
eb491ec MAINTAINERS: add Johan to Bluetooth maintainers I've been coordinating Bluetooth patches in my tree for some time and it's possible I'll do it in the future too, so add myself to the Bluetooth sections as well as mention my tree there. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: "Gustavo F. Padovan" <padovan@profusion.mobi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 16 March 2012, 00:03:03 UTC
960d4d1 MAINTAINERS: Gustavo has moved This is going to be the primary e-mail for kernel development. Signed-off-by: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Cc: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 16 March 2012, 00:03:03 UTC
79f0713 prctl: use CAP_SYS_RESOURCE for PR_SET_MM option CAP_SYS_ADMIN is already overloaded left and right, so to have more fine-grained access control use CAP_SYS_RESOURCE here. The CAP_SYS_RESOUCE is chosen because this prctl option allows a current process to adjust some fields of memory map descriptor which rather represents what the process owns: pointers to code, data, stack segments, command line, auxiliary vector data and etc. Suggested-by: Michael Kerrisk <mtk.manpages@gmail.com> Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Michael Kerrisk <mtk.manpages@gmail.com> Cc: Pavel Emelyanov <xemul@parallels.com> Cc: Tejun Heo <tj@kernel.org> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Paul Bolle <pebolle@tiscali.nl> Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 16 March 2012, 00:03:03 UTC
9bbad7d rapidio/tsi721: fix bug in register offset definitions Fix indexed register offset definitions that use decimal (wrong) instead of hexadecimal (correct) notation for indexing multipliers. Incorrect definitions do not affect Tsi721 driver in its current default configuration because it uses only IDB queue 0. Loss of inbound doorbell functionality should be observed if queue other than 0 is used. Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com> Cc: Matt Porter <mporter@kernel.crashing.org> Cc: Chul Kim <chul.kim@idt.com> Cc: <stable@vger.kernel.org> [3.2+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 16 March 2012, 00:03:03 UTC
fbfa074 MAINTAINERS: update ST's Mailing list for SPEAr We have created a ST's Mailing list for SPEAr. This can be accessed from non-st email ids. I want people to cc this list, when they have changes specific to SPEAr. So, its better to get this updated in MAINTAINERS file. linux-arm-kernel@lists.infradead.org is also added for SPEAr. Signed-off-by: Viresh Kumar <viresh.kumar@st.com> Cc: Russell King <rmk@arm.linux.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 16 March 2012, 00:03:03 UTC
59927fb memcg: free mem_cgroup by RCU to fix oops After fixing the GPF in mem_cgroup_lru_del_list(), three times one machine running a similar load (moving and removing memcgs while swapping) has oopsed in mem_cgroup_zone_nr_lru_pages(), when retrieving memcg zone numbers for get_scan_count() for shrink_mem_cgroup_zone(): this is where a struct mem_cgroup is first accessed after being chosen by mem_cgroup_iter(). Just what protects a struct mem_cgroup from being freed, in between mem_cgroup_iter()'s css_get_next() and its css_tryget()? css_tryget() fails once css->refcnt is zero with CSS_REMOVED set in flags, yes: but what if that memory is freed and reused for something else, which sets "refcnt" non-zero? Hmm, and scope for an indefinite freeze if refcnt is left at zero but flags are cleared. It's tempting to move the css_tryget() into css_get_next(), to make it really "get" the css, but I don't think that actually solves anything: the same difficulty in moving from css_id found to stable css remains. But we already have rcu_read_lock() around the two, so it's easily fixed if __mem_cgroup_free() just uses kfree_rcu() to free mem_cgroup. However, a big struct mem_cgroup is allocated with vzalloc() instead of kzalloc(), and we're not allowed to vfree() at interrupt time: there doesn't appear to be a general vfree_rcu() to help with this, so roll our own using schedule_work(). The compiler decently removes vfree_work() and vfree_rcu() when the config doesn't need them. Signed-off-by: Hugh Dickins <hughd@google.com> Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Konstantin Khlebnikov <khlebnikov@openvz.org> Cc: Tejun Heo <tj@kernel.org> Cc: Ying Han <yinghan@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 16 March 2012, 00:03:03 UTC
8ee161c i2c-algo-bit: Fix spurious SCL timeouts under heavy load When the system is under heavy load, there can be a significant delay between the getscl() and time_after() calls inside sclhi(). That delay may cause the time_after() check to trigger after SCL has gone high, causing sclhi() to return -ETIMEDOUT. To fix the problem, double check that SCL is still low after the timeout has been reached, before deciding to return -ETIMEDOUT. Signed-off-by: Ville Syrjala <syrjala@sci.fi> Cc: stable@vger.kernel.org Signed-off-by: Jean Delvare <khali@linux-fr.org> 15 March 2012, 17:11:05 UTC
834aa6f i2c-core: Comment says "transmitted" but means "received" Fix that. Also convert this and the related comment to proper commenting style. Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Jean Delvare <khali@linux-fr.org> 15 March 2012, 17:11:05 UTC
bb2551d Merge branch 'exynos-drm-fixes' of git://git.infradead.org/users/kmpark/linux-samsung into drm-fixes * 'exynos-drm-fixes' of git://git.infradead.org/users/kmpark/linux-samsung: drm exynos: use drm_fb_helper_set_par directly drm/exynos: Fix fb_videomode <-> drm_mode_modeinfo conversion drm/exynos: fix runtime_pm fimd device state on probe drm/exynos: use correct 'exynos-drm' name for platform device 15 March 2012, 09:41:26 UTC
34418c2 drm exynos: use drm_fb_helper_set_par directly info->fix.visual already is correctly set from drm_fb_helper_fill_fix. info->fix.line_length is also set from drm_fb_helper_fill_fix, so drm_fb_helper_set_par directly instead of a custom exynos_drm_fbdev_set_par. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> 15 March 2012, 02:39:00 UTC
f7d8607 drm/exynos: Fix fb_videomode <-> drm_mode_modeinfo conversion The fb_videomode structure stores the front porch and back porch in the right_margin and left_margin fields respectively. right_margin should thus be computed with hsync_start - hdisplay, and left_margin with htotal - hsync_end. The same holds for the vertical direction. Active Front Sync Back Region Porch Porch <-------------------><----------------><-------------><----------------> //////////////////| ////////////////// | ////////////////// |.................. .................. _______________ <------ xres -------><- right_margin -><- hsync_len -><- left_margin --> <---- hdisplay -----> <------------ hsync_start ------------> <--------------------- hsync_end --------------------> <--------------------------------- htotal -----------------------------> Fix the fb_videomode <-> drm_mode_modeinfo conversion functions accordingly. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Joonyoung Shim <jy0922.shim@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> 15 March 2012, 02:39:00 UTC
0d8ce3a drm/exynos: fix runtime_pm fimd device state on probe A call to pm_runtime_set_active() forces device to be at the active state and skips calling its runtime suspend/resume callbacks. This results in a freeze with a new power domain code based on gen_pd. Fimd driver does all required runtime power management calls, so this pm_runtime_set_active call is buggy. This patch removes it and corrects clock management in probe function (clocks are now enabled by pm_runtime_get_sync() call). Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> 15 March 2012, 02:38:59 UTC
9866b6c drm/exynos: use correct 'exynos-drm' name for platform device Currently Exynos DRM driver uses DRIVER_NAME ('exynos') name for the core platform device. This is confusing, because it doesn't refer to the function the platform device is performing. This patch renames the platform device to the 'exynos-drm', which matches the convention for naming the platform devices. The name used inside DRM subsystem has not been changed. Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> 15 March 2012, 02:38:59 UTC
f1cbd03 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Been sitting on this for a while, but lets get this out the door. This fixes various important bugs for 3.3 final, along with a few more trivial ones. Please pull!" * 'for-linus' of git://git.kernel.dk/linux-block: block: fix ioc leak in put_io_context block, sx8: fix pointer math issue getting fw version Block: use a freezable workqueue for disk-event polling drivers/block/DAC960: fix -Wuninitialized warning drivers/block/DAC960: fix DAC960_V2_IOCTL_Opcode_T -Wenum-compare warning block: fix __blkdev_get and add_disk race condition block: Fix setting bio flags in drivers (sd_dif/floppy) block: Fix NULL pointer dereference in sd_revalidate_disk block: exit_io_context() should call elevator_exit_icq_fn() block: simplify ioc_release_fn() block: replace icq->changed with icq->flags 15 March 2012, 00:16:45 UTC
ff398c4 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "Another small batch of driver specific bug fixes, a couple more errors in the da9052 driver and a bad return value in the tps6524x driver." * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: da9052: Ensure the selected voltage falls within the specified range regulator: Set n_voltages for da9052 regulators regulator: Fix setting selector in tps6524x set_voltage function 15 March 2012, 00:16:02 UTC
cc19812 Merge branch 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile Pull arch/tile update to run "make minconfig" on the tile defconfigs from Chris Metcalf. This removes almost three thousand lines of inane defconfig chatter. * 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: arch/tile/configs: convert to minimal configs via "make savedefconfig" 15 March 2012, 00:13:49 UTC
ce06b0f arch/tile/configs: convert to minimal configs via "make savedefconfig" Signed-off-by: Chris Metcalf <cmetcalf@tilera.com> 14 March 2012, 18:33:16 UTC
5738717 Merge branch 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux into drm-fixes * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux: drm/i915: support 32 bit BGR formats in sprite planes drm/i915: fix color order for BGR formats on SNB drm/gma500: Fix Cedarview boot failures in 3.3-rc 14 March 2012, 18:32:27 UTC
89c5bd0 Merge tag 'perf-urgent-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Some corner case fixes. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> 14 March 2012, 17:49:05 UTC
fecfb64 hwmon: (zl6100) Enable interval between chip accesses for all chips Intersil reports that all chips supported by the zl6100 driver require an interval between chip accesses, even ZL2004 and ZL6105 which were thought to be safe. Reported-by: Vivek Gani <vgani@intersil.com> Cc: stable@vger.kernel.org # 3.2+ Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> 14 March 2012, 16:17:03 UTC
eae7a75 perf tools, x86: Build perf on older user-space as well On ancient systems I get this build failure: util/../../../arch/x86/include/asm/unistd.h:67:29: error: asm/unistd_64.h: No such file or directory In file included from util/cache.h:7, from builtin-test.c:8: util/../perf.h: In function ‘sys_perf_event_open’:In file included from util/../perf.h:16 perf.h:170: error: ‘__NR_perf_event_open’ undeclared (first use in this function) The reason is that this old system does not have the split unistd.h headers yet, from which to pick up the syscall definitions. Add the syscall numbers to the already existing i386 and x86_64 blocks in perf.h, and also provide empty include file stubs. With this patch perf builds and works fine on 5 years old user-space as well. Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Link: http://lkml.kernel.org/n/tip-jctwg64le1w47tuaoeyftsg9@git.kernel.org Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> 14 March 2012, 15:42:34 UTC
e7f01d1 perf tools: Use scnprintf where applicable Several places were expecting that the value returned was the number of characters printed, not what would be printed if there was space. Fix it by using the scnprintf and vscnprintf variants we inherited from the kernel sources. Some corner cases where the number of printed characters were not accounted were fixed too. Reported-by: Anton Blanchard <anton@samba.org> Cc: Anton Blanchard <anton@samba.org> Cc: Eric B Munson <emunson@mgebm.net> Cc: David Ahern <dsahern@gmail.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Mike Galbraith <efault@gmx.de> Cc: Paul Mackerras <paulus@samba.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Yanmin Zhang <yanmin_zhang@linux.intel.com> Cc: stable@kernel.org Link: http://lkml.kernel.org/n/tip-kwxo2eh29cxmd8ilixi2005x@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> 14 March 2012, 15:36:19 UTC
b832796 perf tools: Incorrect use of snprintf results in SEGV I have a workload where perf top scribbles over the stack and we SEGV. What makes it interesting is that an snprintf is causing this. The workload is a c++ gem that has method names over 3000 characters long, but snprintf is designed to avoid overrunning buffers. So what went wrong? The problem is we assume snprintf returns the number of characters written: ret += repsep_snprintf(bf + ret, size - ret, "[%c] ", self->level); ... ret += repsep_snprintf(bf + ret, size - ret, "%s", self->ms.sym->name); Unfortunately this is not how snprintf works. snprintf returns the number of characters that would have been written if there was enough space. In the above case, if the first snprintf returns a value larger than size, we pass a negative size into the second snprintf and happily scribble over the stack. If you have 3000 character c++ methods thats a lot of stack to trample. This patch fixes repsep_snprintf by clamping the value at size - 1 which is the maximum snprintf can write before adding the NULL terminator. I get the sinking feeling that there are a lot of other uses of snprintf that have this same bug, we should audit them all. Cc: David Ahern <dsahern@gmail.com> Cc: Eric B Munson <emunson@mgebm.net> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Paul Mackerras <paulus@samba.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Yanmin Zhang <yanmin_zhang@linux.intel.com> Cc: stable@kernel.org Link: http://lkml.kernel.org/r/20120307114249.44275ca3@kryten Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> 14 March 2012, 15:36:19 UTC
ff8c147 block: fix ioc leak in put_io_context When put_io_context is called, if ioc->icq_list is empty and refcount is 1, kernel will not free the ioc. This is caught by following kmemleak: unreferenced object 0xffff880036349fe0 (size 216): comm "sh", pid 2137, jiffies 4294931140 (age 290579.412s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01 00 01 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... backtrace: [<ffffffff8169f926>] kmemleak_alloc+0x26/0x50 [<ffffffff81195a9c>] kmem_cache_alloc_node+0x1cc/0x2a0 [<ffffffff81356b67>] create_io_context_slowpath+0x27/0x130 [<ffffffff81356d2b>] get_task_io_context+0xbb/0xf0 [<ffffffff81055f0e>] copy_process+0x188e/0x18b0 [<ffffffff8105609b>] do_fork+0x11b/0x420 [<ffffffff810247f8>] sys_clone+0x28/0x30 [<ffffffff816d3373>] stub_clone+0x13/0x20 [<ffffffffffffffff>] 0xffffffffffffffff ioc should be freed if ioc->icq_list is empty. Signed-off-by: Xiaotian Feng <dannyfeng@tencent.com> Acked-by: Vivek Goyal <vgoyal@redhat.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> 14 March 2012, 14:34:48 UTC
00fdc6b iscsi-target: Fix reservation conflict -EBUSY response handling bug This patch addresses a iscsi-target specific bug related to reservation conflict handling in iscsit_handle_scsi_cmd() that has been causing reservation conflicts to complete and not fail as expected due to incorrect errno checking. The problem occured with the change to return -EBUSY from transport_generic_cmd_sequencer() -> transport_generic_allocate_tasks() failures, that broke iscsit_handle_scsi_cmd() checking for -EINVAL in order to invoke a non GOOD status response. This was manifesting itself as data corruption with legacy SPC-2 reservations, but also effects iscsi-target LUNs with SPC-3 persistent reservations. This bug was originally introduced in lio-core commit: commit 03e98c9eb916f3f0868c1dc344dde2a60287ff72 Author: Nicholas Bellinger <nab@linux-iscsi.org> Date: Fri Nov 4 02:36:16 2011 -0700 target: Address legacy PYX_TRANSPORT_* return code breakage Reported-by: Martin Svec <martin.svec@zoner.cz> Cc: Martin Svec <martin.svec@zoner.cz> Cc: Christoph Hellwig <hch@lst.de> Cc: stable@vger.kernel.org Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> 14 March 2012, 04:43:58 UTC
087a03b target: Fix compatible reservation handling (CRH=1) with legacy RESERVE/RELEASE This patch addresses a bug with target_check_scsi2_reservation_conflict() return checking in target_scsi2_reservation_[reserve,release]() that was preventing CRH=1 operation from silently succeeding in the two special cases defined by SPC-3, and not failing with reservation conflict status when dealing with legacy RESERVE/RELEASE + active SPC-3 PR logic. Also explictly set cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT during the early non reservation holder failure from pr_ops->t10_seq_non_holder() check in transport_generic_cmd_sequencer() for fabrics that already expect it to be set. This bug was originally introduced in mainline commit: commit eacac00ce5bfde8086cd0615fb53c986f7f970fe Author: Christoph Hellwig <hch@infradead.org> Date: Thu Nov 3 17:50:40 2011 -0400 target: split core_scsi2_emulate_crh Reported-by: Martin Svec <martin.svec@zoner.cz> Cc: Martin Svec <martin.svec@zoner.cz> Cc: Christoph Hellwig <hch@lst.de> Cc: stable@vger.kernel.org Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> 14 March 2012, 04:43:43 UTC
762ad8a Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc updates from David Miller: "Please pull to get this fix for the sparc32 build when using a more recent binutils." * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc32: Add -Av8 to assembler command line. 14 March 2012, 01:39:28 UTC
e0adb99 sparc32: Add -Av8 to assembler command line. Newer version of binutils are more strict about specifying the correct options to enable certain classes of instructions. The sparc32 build is done for v7 in order to support sun4c systems which lack hardware integer multiply and divide instructions. So we have to pass -Av8 when building the assembler routines that use these instructions and get patched into the kernel when we find out that we have a v8 capable cpu. Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net> 14 March 2012, 01:19:51 UTC
b8fa7d4 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking changes from David Miller: "The most important bit here is the TCP syncookies issue, which seems to have been busted for some time. That fix has been verified in production by the reporter. 1) Persistent TUN devices erroneously hold on to the network namespace in such a way that it cannot be shutdown. Fix from Stanislav Kinsbursky with help from Eric Dumazet. 2) TCP SYN cookies have been broken for a while due to how the route lookup flow key is managed, connections can be delayed by as much as 20 seconds due to this bug. Fix from Eric Dumazet. 3) Missing jiffies.h include in lib/dynamic_queue_limits.c can break the build, from Tom Herbert. 4) Add USB device ID for Sitecom LN-031, from Joerg Neikes. 5) Fix OOPS in delayed workqueue in iwlegacy, from Stanislaw Gruszka. 6) rt2x00 TX queue can be disabled forever due to races, fix by synchronizing pause/unpause with a lock. Also from Stanislaw Gruszka. 7) Statistics and endian fix in bnx2x driver from Yuval Mintz, Eilon Greenstein, and Ariel Elior." * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: tun: don't hold network namespace by tun sockets bnx2x: FCoE statistics id fixed bnx2x: dcb bit indices flags used as bits bnx2x: added cpu_to_le16 when preparing ramrod's data bnx2x: pfc statistics counts pfc events twice rt2x00: fix random stalls iwl3945: fix possible il->txq NULL pointer dereference in delayed works dql: Fix undefined jiffies tcp: fix syncookie regression usb: asix: Patch for Sitecom LN-031 14 March 2012, 00:57:07 UTC
69539ab Merge branch 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile Pull arch/tile update from Chris Metcalf "These include a couple of queued-up minor bug fixes from the community, a fix to unbreak the sysfs hooks in tile, and syncing up the defconfigs." Ugh. defconfigs updates without "make minconfig". Tons of ugly pointless lines there, I suspect. * 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: tile: Use set_current_blocked() and block_sigmask() arch/tile: misplaced parens near likely arch/tile: sync up the defconfig files to the tip arch/tile: Fix up from commit 8a25a2fd126c621f44f3aeaef80d51f00fc11639 14 March 2012, 00:06:02 UTC
0a49aec Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar. * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf record: Fix buffer overrun bug in tracepoint_id_to_path() perf/x86: Fix local vs remote memory events for NHM/WSM 14 March 2012, 00:04:50 UTC
8e8bb96 Merge git://git.samba.org/sfrench/cifs-2.6 Pull CIFS fixes from Steve French. * git://git.samba.org/sfrench/cifs-2.6: CIFS: Do not kmalloc under the flocks spinlock cifs: possible memory leak in xattr. 14 March 2012, 00:03:53 UTC
cd79453 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "A bunch of assorted fixes; Jan's freezing stuff still _not_ in there and neither is mm fun ;-/" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: restore smp_mb() in unlock_new_inode() vfs: fix return value from do_last() vfs: fix double put after complete_walk() udf: Fix deadlock in udf_release_file() vfs: Correctly set the dir i_mutex lockdep class 14 March 2012, 00:00:50 UTC
ad09233 tile: Use set_current_blocked() and block_sigmask() As described in e6fa16ab ("signal: sigprocmask() should do retarget_shared_pending()") the modification of current->blocked is incorrect as we need to check whether the signal we're about to block is pending in the shared queue. Also, use the new helper function introduced in commit 5e6292c0f28f ("signal: add block_sigmask() for adding sigmask to current->blocked") which centralises the code for updating current->blocked after successfully delivering a signal and reduces the amount of duplicate code across architectures. In the past some architectures got this code wrong, so using this helper function should stop that from happening again. Cc: Arnd Bergmann <arnd@arndb.de> Acked-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Matt Fleming <matt.fleming@intel.com> Signed-off-by: Chris Metcalf <cmetcalf@tilera.com> 13 March 2012, 20:42:05 UTC
750084b Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem 13 March 2012, 18:38:51 UTC
8aa8a7c perf record: Fix buffer overrun bug in tracepoint_id_to_path() This patch fixes a buffer overrun bug in tracepoint_id_to_path(). The bug manisfested itself as a memory error reported by perf record. I ran into it with perf sched: $ perf sched rec noploop 2 noploop for 2 seconds [ perf record: Woken up 14 times to write data ] [ perf record: Captured and wrote 42.701 MB perf.data (~1865622 samples) ] Fatal: No memory to alloc tracepoints list It turned out that tracepoint_id_to_path() was reading the tracepoint id using read() but the buffer was not large enough to include the \n terminator for id with 4 digits or more. The patch fixes the problem by extending the buffer to a more reasonable size covering all possible id length include \n terminator. Note that atoll() stops at the first non digit character, thus it is not necessary to clear the buffer between each read. Signed-off-by: Stephane Eranian <eranian@google.com> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: fweisbec@gmail.com Cc: dsahern@gmail.com Link: http://lkml.kernel.org/r/20120313155102.GA6465@quad Signed-off-by: Ingo Molnar <mingo@elte.hu> 13 March 2012, 16:01:28 UTC
c43524b hwmon: (w83627ehf) Describe undocumented pwm attributes Add description of pwm[1-4]_start_output, pwm[1-4]_step_output, pwm[1-4]_stop_output, and pwm[1-4]_max_output attributes to driver documentation. Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> Acked-by: Jean Delvare <khali@linux-fr.org> 13 March 2012, 10:48:07 UTC
aacb6b0 hwmon: (w83627ehf) Fix temp2 source for W83627UHG Properly set the source of temp2 for the W83627UHG. Also fix a comment right before that, and document the W83627UHG as reporting up to 3 temperatures. Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: Guenter Roeck <guenter.roeck@ericsson.com> Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> 13 March 2012, 10:30:56 UTC
2f1c2b8 Merge branch 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86 Pull x86 platfrm driver fixes from Matthew Garrett: "Some trivial patches that fix wifi on some Lenovos and avoid a potential memory corruption issue on some Panasonics, plus two straightforward new drivers that touch no existing code." * 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86: panasonic-laptop: avoid overflow in acpi_pcc_hotkey_add() acer-wmi: No wifi rfkill on Lenovo machines Fujitsu tablet extras driver x86: Add amilo-rfkill driver for some Fujitsu-Siemens Amilo laptops 13 March 2012, 05:59:34 UTC
0ae5eaf Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci Pull PCI changes from Jesse Barnes: "A single fix for a regression that affects some people who try to disable ASPM for whatever reason." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci: PCI: ignore pre-1.1 ASPM quirking when ASPM is disabled 13 March 2012, 05:53:37 UTC
212ad2f Merge tag 'sh-for-linus' of git://github.com/pmundt/linux-sh Pull SuperH fixes from Paul Mundt. * tag 'sh-for-linus' of git://github.com/pmundt/linux-sh: sh-sci / PM: Avoid deadlocking runtime PM sh: fix up the ubc clock definition for sh7785. sh: add parameter for RSPI in clock-sh7757 sh: Fix sh2a vbr table for more than 255 irqs 13 March 2012, 05:50:20 UTC
a10a854 Merge tag 'rmobile-for-linus' of git://github.com/pmundt/linux-sh Pull SH/R-Mobile fixes from Paul Mundt. * tag 'rmobile-for-linus' of git://github.com/pmundt/linux-sh: ARM: mach-shmobile: ap4evb: fixup fsi2_ak4643_info typo ARM: mach-shmobile: mackerel: Reserve DMA memory for the frame buffer ARM: mach-shmobile: Fix ag5evm compilation by including linux/videodev2.h ARM: mach-shmobile: Fix bonito compile breakage 13 March 2012, 05:47:20 UTC
1ab5ecb tun: don't hold network namespace by tun sockets v3: added previously removed sock_put() to the tun_release() callback, because sk_release_kernel() doesn't drop the socket reference. v2: sk_release_kernel() used for socket release. Dummy tun_release() is required for sk_release_kernel() ---> sock_release() ---> sock->ops->release() call. TUN was designed to destroy it's socket on network namesapce shutdown. But this will never happen for persistent device, because it's socket holds network namespace. This patch removes of holding network namespace by TUN socket and replaces it by creating socket in init_net and then changing it's net it to desired one. On shutdown socket is moved back to init_net prior to final put. Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com> Signed-off-by: David S. Miller <davem@davemloft.net> 13 March 2012, 00:14:00 UTC
de5c374 bnx2x: FCoE statistics id fixed FCoE statistics ids were distinguished from the L2's statistics ids. However, not all of the change was committed. This causes a possible collision of indices when FCoE is present. This patch fixes the issue. Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net> 13 March 2012, 00:01:25 UTC
e695a2d bnx2x: dcb bit indices flags used as bits DCB flags were updated using the flags' bit offsets instead of the actual bits. This is now fixed. Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net> 13 March 2012, 00:01:25 UTC
ab4a713 bnx2x: added cpu_to_le16 when preparing ramrod's data Fixed endianess issue when passing arguments to FW. Signed-off-by: Ariel Elior <ariele@broadcom.com> Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net> 13 March 2012, 00:01:25 UTC
db0ea84 bnx2x: pfc statistics counts pfc events twice When pfc statistics were counted, the delta change from last count was summed twice. This fixes the issue. Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net> 13 March 2012, 00:01:25 UTC
87e24f4 perf/x86: Fix local vs remote memory events for NHM/WSM Verified using the below proglet.. before: [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0 remote write Performance counter stats for './numa 0': 2,101,554 node-stores 2,096,931 node-store-misses 5.021546079 seconds time elapsed [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1 local write Performance counter stats for './numa 1': 501,137 node-stores 199 node-store-misses 5.124451068 seconds time elapsed After: [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0 remote write Performance counter stats for './numa 0': 2,107,516 node-stores 2,097,187 node-store-misses 5.012755149 seconds time elapsed [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1 local write Performance counter stats for './numa 1': 2,063,355 node-stores 165 node-store-misses 5.082091494 seconds time elapsed #define _GNU_SOURCE #include <sched.h> #include <stdio.h> #include <errno.h> #include <sys/mman.h> #include <sys/types.h> #include <dirent.h> #include <signal.h> #include <unistd.h> #include <numaif.h> #include <stdlib.h> #define SIZE (32*1024*1024) volatile int done; void sig_done(int sig) { done = 1; } int main(int argc, char **argv) { cpu_set_t *mask, *mask2; size_t size; int i, err, t; int nrcpus = 1024; char *mem; unsigned long nodemask = 0x01; /* node 0 */ DIR *node; struct dirent *de; int read = 0; int local = 0; if (argc < 2) { printf("usage: %s [0-3]\n", argv[0]); printf(" bit0 - local/remote\n"); printf(" bit1 - read/write\n"); exit(0); } switch (atoi(argv[1])) { case 0: printf("remote write\n"); break; case 1: printf("local write\n"); local = 1; break; case 2: printf("remote read\n"); read = 1; break; case 3: printf("local read\n"); local = 1; read = 1; break; } mask = CPU_ALLOC(nrcpus); size = CPU_ALLOC_SIZE(nrcpus); CPU_ZERO_S(size, mask); node = opendir("/sys/devices/system/node/node0/"); if (!node) perror("opendir"); while ((de = readdir(node))) { int cpu; if (sscanf(de->d_name, "cpu%d", &cpu) == 1) CPU_SET_S(cpu, size, mask); } closedir(node); mask2 = CPU_ALLOC(nrcpus); CPU_ZERO_S(size, mask2); for (i = 0; i < size; i++) CPU_SET_S(i, size, mask2); CPU_XOR_S(size, mask2, mask2, mask); // invert if (!local) mask = mask2; err = sched_setaffinity(0, size, mask); if (err) perror("sched_setaffinity"); mem = mmap(0, SIZE, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); err = mbind(mem, SIZE, MPOL_BIND, &nodemask, 8*sizeof(nodemask), MPOL_MF_MOVE); if (err) perror("mbind"); signal(SIGALRM, sig_done); alarm(5); if (!read) { while (!done) { for (i = 0; i < SIZE; i++) mem[i] = 0x01; } } else { while (!done) { for (i = 0; i < SIZE; i++) t += *(volatile char *)(mem + i); } } return 0; } Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Stephane Eranian <eranian@google.com> Cc: <stable@kernel.org> Link: http://lkml.kernel.org/n/tip-tq73sxus35xmqpojf7ootxgs@git.kernel.org Signed-off-by: Ingo Molnar <mingo@elte.hu> 12 March 2012, 19:43:41 UTC
32260d9 hwmon: (w83627ehf) Fix memory leak in probe function The driver probe function leaked memory if creating the cpu0_vid attribute file failed. Fix by converting the driver to use devm_kzalloc. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Cc: stable@vger.kernel.org # 2.6.32+ Acked-by: Jean Delvare <khali@linux-fr.org> 12 March 2012, 19:41:44 UTC
cf8c1da arch/tile: misplaced parens near likely Parentheses were missing. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Chris Metcalf <cmetcalf@tilera.com> 12 March 2012, 19:32:18 UTC
7ed725c arch/tile: sync up the defconfig files to the tip This was inspired by mchehab@redhat.com's observation that we didn't have EDAC configured on by default in both files. In addition, we were setting INITRAMFS_SOURCE to a non-empty string, which isn't a very common default and required editing to do test builds. Signed-off-by: Chris Metcalf <cmetcalf@tilera.com> 12 March 2012, 19:32:12 UTC
688b4db arch/tile: Fix up from commit 8a25a2fd126c621f44f3aeaef80d51f00fc11639 This was Kay Siever's bombing to convert 'cpu' to a regular subsystem. The change left a bogus second argument to sysfs_create_file(). Signed-off-by: Chris Metcalf <cmetcalf@tilera.com> 12 March 2012, 19:31:37 UTC
3780d03 rt2x00: fix random stalls Is possible that we stop queue and then do not wake up it again, especially when packets are transmitted fast. That can be easily reproduced with modified tx queue entry_num to some small value e.g. 16. If mac80211 already hold local->queue_stop_reason_lock, then we can wait on that lock in both rt2x00queue_pause_queue() and rt2x00queue_unpause_queue(). After drooping ->queue_stop_reason_lock is possible that __ieee80211_wake_queue() will be performed before __ieee80211_stop_queue(), hence we stop queue and newer wake up it again. Another race condition is possible when between rt2x00queue_threshold() check and rt2x00queue_pause_queue() we will process all pending tx buffers on different cpu. This might happen if for example interrupt will be triggered on cpu performing rt2x00mac_tx(). To prevent race conditions serialize pause/unpause by queue->tx_lock. Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Acked-by: Gertjan van Wingerde <gwingerde@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 12 March 2012, 18:00:17 UTC
210787e iwl3945: fix possible il->txq NULL pointer dereference in delayed works On il3945_down procedure we free tx queue data and nullify il->txq pointer. After that we drop mutex and then cancel delayed works. There is possibility, that after drooping mutex and before the cancel, some delayed work will start and crash while trying to send commands to the device. For example, here is reported crash in il3945_bg_reg_txpower_periodic(): https://bugzilla.kernel.org/show_bug.cgi?id=42766#c10 Patch fix problem by adding il->txq check on works that send commands, hence utilize tx queue. Reported-by: Clemens Eisserer <linuxhippy@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 12 March 2012, 18:00:16 UTC
33fa9b6 hwmon: (w83627ehf) Fix writing into fan_stop_time for NCT6775F/NCT6776F NCT6775F and NCT6776F have their own set of registers for FAN_STOP_TIME. The correct registers were used to read FAN_STOP_TIME, but writes used the wrong registers. Fix it. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Cc: stable@vger.kernel.org # 3.0+ Acked-by: Jean Delvare <khali@linux-fr.org> 12 March 2012, 17:40:30 UTC
e424fb8 panasonic-laptop: avoid overflow in acpi_pcc_hotkey_add() num_sifr could go negative since acpi_pcc_get_sqty() returns -EINVAL on error. Then it could bypass the sanity check (num_sifr > 255). The subsequent call to kzalloc() would allocate a small buffer, leading to a memory corruption. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Matthew Garrett <mjg@redhat.com> 12 March 2012, 14:25:51 UTC
461e743 acer-wmi: No wifi rfkill on Lenovo machines We have several reports which says acer-wmi is loaded on ideapads and register rfkill for wifi which can not be unblocked. Since ideapad-laptop also register rfkill for wifi and it works reliably, it will be fine acer-wmi is not going to register rfkill for wifi once VPC2004 is found. Also put IBM0068/LEN0068 in the list. Though thinkpad_acpi has no wifi rfkill capability, there are reports which says acer-wmi also block wireless on Thinkpad E520/E420. Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Matthew Garrett <mjg@redhat.com> 12 March 2012, 13:58:02 UTC
2d24c49 Fujitsu tablet extras driver This patch adds support for some of the devices within a wide variety of Fujitsu Tablet Computers, both convertibles and slates. Primarily it allows for the automatic detection of the tablet/notebook mode for convertible tablet pc's, and orientation for docked slates. It also adds support for the application panel buttons usually found next to the tablet screen, and docking station detection for slates. Signed-off-by: Robert Gerlach <khnz@gmx.de> Signed-off-by: Matthew Garrett <mjg@redhat.com> 12 March 2012, 13:57:52 UTC
c215ab9 x86: Add amilo-rfkill driver for some Fujitsu-Siemens Amilo laptops An rfkill driver based on the fsaa1655g and fsam7440 drivers for Fujitsu-Siemens Amilo A1655 and M7440 models found at: http://sourceforge.net/projects/fsaa1655g/ http://sourceforge.net/projects/fsam7440/ This adds DMI matching, replaces the procfs files with rfkill devices, and uses the proper functions to write to the i8042 safely. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Matthew Garrett <mjg@redhat.com> 12 March 2012, 13:56:47 UTC
930c514 dql: Fix undefined jiffies In some configurations, jiffies may be undefined in lib/dynamic_queue_limits.c. Adding include of jiffies.h to avoid this. Signed-off-by: Tom Herbert <therbert@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> 12 March 2012, 02:59:43 UTC
dfd25ff tcp: fix syncookie regression commit ea4fc0d619 (ipv4: Don't use rt->rt_{src,dst} in ip_queue_xmit()) added a serious regression on synflood handling. Simon Kirby discovered a successful connection was delayed by 20 seconds before being responsive. In my tests, I discovered that xmit frames were lost, and needed ~4 retransmits and a socket dst rebuild before being really sent. In case of syncookie initiated connection, we use a different path to initialize the socket dst, and inet->cork.fl.u.ip4 is left cleared. As ip_queue_xmit() now depends on inet flow being setup, fix this by copying the temp flowi4 we use in cookie_v4_check(). Reported-by: Simon Kirby <sim@netnation.com> Bisected-by: Simon Kirby <sim@netnation.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> 11 March 2012, 22:52:12 UTC
4e50391 usb: asix: Patch for Sitecom LN-031 This patch adds support for the Sitecom LN-031 USB adapter with a AX88178 chip. Added USB id to find correct driver for AX88178 1000 Ethernet adapter. Signed-off-by: Joerg Neikes <j.neikes@midlandgate.de> Signed-off-by: David S. Miller <davem@davemloft.net> 11 March 2012, 22:52:12 UTC
9365121 regulator: da9052: Ensure the selected voltage falls within the specified range Integer division may truncate the result, use DIV_ROUND_UP to ensure the selected voltage falls within the specified range. Signed-off-by: Axel Lin <axel.lin@gmail.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> 11 March 2012, 20:39:10 UTC
7b95765 regulator: Set n_voltages for da9052 regulators The n_voltages setting for all LDOs and DCDCs are missing in current code. Signed-off-by: Axel Lin <axel.lin@gmail.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> 11 March 2012, 20:39:04 UTC
f03570c regulator: Fix setting selector in tps6524x set_voltage function Don't assign the voltage to selector. Signed-off-by: Axel Lin <axel.lin@gmail.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Cc: stable@vger.kernel.org 11 March 2012, 20:38:10 UTC
310fa7a restore smp_mb() in unlock_new_inode() wait_on_inode() doesn't have ->i_lock Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> 10 March 2012, 22:07:28 UTC
7f6c7e6 vfs: fix return value from do_last() complete_walk() returns either ECHILD or ESTALE. do_last() turns this into ECHILD unconditionally. If not in RCU mode, this error will reach userspace which is complete nonsense. Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> CC: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> 10 March 2012, 22:05:30 UTC
097b180 vfs: fix double put after complete_walk() complete_walk() already puts nd->path, no need to do it again at cleanup time. This would result in Oopses if triggered, apparently the codepath is not too well exercised. Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> CC: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> 10 March 2012, 22:05:30 UTC
fde7d90 Linux 3.3-rc7 10 March 2012, 21:49:52 UTC
back to top