| a67adb9 | Dmitry Kasatkin | 18 January 2013, 21:56:39 UTC | evm: checking if removexattr is not a NULL The following lines of code produce a kernel oops. fd = socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0); fchmod(fd, 0666); [ 139.922364] BUG: unable to handle kernel NULL pointer dereference at (null) [ 139.924982] IP: [< (null)>] (null) [ 139.924982] *pde = 00000000 [ 139.924982] Oops: 0000 [#5] SMP [ 139.924982] Modules linked in: fuse dm_crypt dm_mod i2c_piix4 serio_raw evdev binfmt_misc button [ 139.924982] Pid: 3070, comm: acpid Tainted: G D 3.8.0-rc2-kds+ #465 Bochs Bochs [ 139.924982] EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 0 [ 139.924982] EIP is at 0x0 [ 139.924982] EAX: cf5ef000 EBX: cf5ef000 ECX: c143d600 EDX: c15225f2 [ 139.924982] ESI: cf4d2a1c EDI: cf4d2a1c EBP: cc02df10 ESP: cc02dee4 [ 139.924982] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 [ 139.924982] CR0: 80050033 CR2: 00000000 CR3: 0c059000 CR4: 000006d0 [ 139.924982] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [ 139.924982] DR6: ffff0ff0 DR7: 00000400 [ 139.924982] Process acpid (pid: 3070, ti=cc02c000 task=d7705340 task.ti=cc02c000) [ 139.924982] Stack: [ 139.924982] c1203c88 00000000 cc02def4 cf4d2a1c ae21eefa 471b60d5 1083c1ba c26a5940 [ 139.924982] e891fb5e 00000041 00000004 cc02df1c c1203964 00000000 cc02df4c c10e20c3 [ 139.924982] 00000002 00000000 00000000 22222222 c1ff2222 cf5ef000 00000000 d76efb08 [ 139.924982] Call Trace: [ 139.924982] [<c1203c88>] ? evm_update_evmxattr+0x5b/0x62 [ 139.924982] [<c1203964>] evm_inode_post_setattr+0x22/0x26 [ 139.924982] [<c10e20c3>] notify_change+0x25f/0x281 [ 139.924982] [<c10cbf56>] chmod_common+0x59/0x76 [ 139.924982] [<c10e27a1>] ? put_unused_fd+0x33/0x33 [ 139.924982] [<c10cca09>] sys_fchmod+0x39/0x5c [ 139.924982] [<c13f4f30>] syscall_call+0x7/0xb [ 139.924982] Code: Bad EIP value. This happens because sockets do not define the removexattr operation. Before removing the xattr, verify the removexattr function pointer is not NULL. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: stable@vger.kernel.org Signed-off-by: James Morris <james.l.morris@oracle.com> | 21 January 2013, 13:27:50 UTC |
| 9a92841 | Linus Torvalds | 21 January 2013, 04:55:49 UTC | Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "A bunch of intel and radeon fixes, along with two fixes to TTM code. The correct fix for the Intel ironlake failure is in this, and should make things more stable, along with some misc radeon fixes." * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: ttm: on move memory failure don't leave a node dangling ttm: don't destroy old mm_node on memcpy failure Revert "drm/radeon: do not move bo to different placement at each cs" drm/i915: fix FORCEWAKE posting reads drm/i915: Invalidate the relocation presumed_offsets along the slow path drm/i915/eDP: do not write power sequence registers for ghost eDP drm/radeon: improve semaphore debugging on lockup drm/radeon: allow FP16 color clear registers on r500 drm/radeon: clear reset flags if engines are idle drm/i915: Record DERRMR, FORCEWAKE and RING_CTL in error-state | 21 January 2013, 04:55:49 UTC |
| ee61abb | Linus Torvalds | 21 January 2013, 04:22:58 UTC | module: fix missing module_mutex unlock Commit 1fb9341ac348 ("module: put modules in list much earlier") moved some of the module initialization code around, and in the process changed the exit paths too. But for the duplicate export symbol error case the change made the ddebug_cleanup path jump to after the module mutex unlock, even though it happens with the mutex held. Rusty has some patches to split this function up into some helper functions, hopefully the mess of complex goto targets will go away eventually. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 21 January 2013, 04:22:58 UTC |
| 014b344 | Dave Airlie | 16 January 2013, 05:58:34 UTC | ttm: on move memory failure don't leave a node dangling if we have a move notify callback, when moving fails, we call move notify the opposite way around, however this ends up with *mem containing the mm_node from the bo, which means we double free it. This is a follow on to the previous fix. Reviewed-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com> | 21 January 2013, 03:45:23 UTC |
| 6305418 | Dave Airlie | 16 January 2013, 04:25:44 UTC | ttm: don't destroy old mm_node on memcpy failure When we are using memcpy to move objects around, and we fail to memcpy due to lack of memory to populate or failure to finish the copy, we don't want to destroy the mm_node that has been copied into old_copy. While working on a new kms driver that uses memcpy, if I overallocated bo's up to the memory limits, and eviction failed, then machine would oops soon after due to having an active bo with an already freed drm_mm embedded in it, freeing it a second time didn't end well. Reviewed-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com> | 21 January 2013, 03:45:02 UTC |
| ffb5fd5 | Dave Airlie | 21 January 2013, 03:25:30 UTC | Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel into drm-next More important fixes for 3.9: - error_state improvements to help debug the new scanline wait code added for gen6+ - bug reports started popping up :( patch from Chris Wilson. - fix a panel power sequence confusion between the eDP and lvds detection code resulting in black screens - regression introduce in 3.8 (Jani Nikula) - Chris fixed the root-cause of the ilk relocation vs. evict bug. - Another piece of cargo-culted rc6 lore from Jani, fixes up a regression where a system refused to go into rc6 after suspend sometimes. * 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel: drm/i915: fix FORCEWAKE posting reads drm/i915: Invalidate the relocation presumed_offsets along the slow path drm/i915/eDP: do not write power sequence registers for ghost eDP drm/i915: Record DERRMR, FORCEWAKE and RING_CTL in error-state | 21 January 2013, 03:25:30 UTC |
| a3f5aed | Dave Airlie | 21 January 2013, 03:24:12 UTC | Merge branch 'drm-fixes-3.8' of git://people.freedesktop.org/~agd5f/linux into drm-next A number of fixes, and one revert for a patch having some wierd side effects. * 'drm-fixes-3.8' of git://people.freedesktop.org/~agd5f/linux: Revert "drm/radeon: do not move bo to different placement at each cs" drm/radeon: improve semaphore debugging on lockup drm/radeon: allow FP16 color clear registers on r500 drm/radeon: clear reset flags if engines are idle | 21 January 2013, 03:24:12 UTC |
| 2263647 | Linus Torvalds | 21 January 2013, 00:44:28 UTC | Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux Pull module fixes and a virtio block fix from Rusty Russell: "Various minor fixes, but a slightly more complex one to fix the per-cpu overload problem introduced recently by kvm id changes." * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: module: put modules in list much earlier. module: add new state MODULE_STATE_UNFORMED. module: prevent warning when finit_module a 0 sized file virtio-blk: Don't free ida when disk is in use | 21 January 2013, 00:44:28 UTC |
| 3a142ed | Linus Torvalds | 20 January 2013, 21:58:48 UTC | Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal Pull misc syscall fixes from Al Viro: - compat syscall fixes (discussed back in December) - a couple of "make life easier for sigaltstack stuff by reducing inter-tree dependencies" - fix up compiler/asmlinkage calling convention disagreement of sys_clone() - misc * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal: sys_clone() needs asmlinkage_protect make sure that /linuxrc has std{in,out,err} x32: fix sigtimedwait x32: fix waitid() switch compat_sys_wait4() and compat_sys_waitid() to COMPAT_SYSCALL_DEFINE switch compat_sys_sigaltstack() to COMPAT_SYSCALL_DEFINE CONFIG_GENERIC_SIGALTSTACK build breakage with asm-generic/syscalls.h Ensure that kernel_init_freeable() is not inlined into non __init code | 20 January 2013, 21:58:48 UTC |
| edea0d0 | Oleg Nesterov | 20 January 2013, 19:25:47 UTC | ia64: kill thread_matches(), unexport ptrace_check_attach() The ia64 function "thread_matches()" has no users since commit e868a55c2a8c ("[IA64] remove find_thread_for_addr()"). Remove it. This allows us to make ptrace_check_attach() static to kernel/ptrace.c, which is good since we'll need to change the semantics of it and fix up all the callers. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 20 January 2013, 20:26:05 UTC |
| b1e0318 | Al Viro | 20 January 2013, 03:13:34 UTC | sys_clone() needs asmlinkage_protect Cc: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> | 20 January 2013, 03:13:34 UTC |
| 43b1682 | Al Viro | 19 January 2013, 18:29:54 UTC | make sure that /linuxrc has std{in,out,err} Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> | 19 January 2013, 18:29:54 UTC |
| 5da1f88 | Linus Torvalds | 18 January 2013, 22:06:29 UTC | Merge tag 'usb-3.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg Kroah-Hartman: "Here are 3 USB patches for 3.8-rc4. Two of them are new device id patches, and the third fixes a reported oops in the io_ti USB serial driver" * tag 'usb-3.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: io_ti: Fix NULL dereference in chase_port() USB: option: add TP-LINK HSUPA Modem MA180 USB: option: blacklist network interface on ONDA MT8205 4G LTE | 18 January 2013, 22:06:29 UTC |
| 793388a | Linus Torvalds | 18 January 2013, 22:05:59 UTC | Merge tag 'tty-3.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg Kroah-Hartman: "Here are a few tty/serial driver fixes for 3.8-rc4 that resolve a number of problems that people have been having, including the ptys ioctl issue that is a regression fix" * tag 'tty-3.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: 8250/16?50: Add support for Broadcom TruManage redirected serial port pty: return EINVAL for TIOCGPTN for BSD ptys serial:ifx6x60:Keep word size accordance with SPI controller tty: 8250_dw: Fix inverted arguments to serial_out in IRQ handler serial: samsung: remove redundant setting of line config during port reset serial:ifx6x60:Delete SPI timer when shut down port tty/8250: The correct device id for this card is 0x0022 tty/8250: pbn_b0_8_1152000_200 is supposed to be an 8 port definition tty: serial: vt8500: fix return value check in vt8500_serial_probe() serial: mxs-auart: Index is unsigned mxs: uart: fix setting RTS from software | 18 January 2013, 22:05:59 UTC |
| abad21a | Linus Torvalds | 18 January 2013, 22:05:25 UTC | Merge tag 'staging-3.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver bugfixes from Greg Kroah-Hartman: "Here are some bugfixes for the drivers/staging tree for 3.8-rc4. Nothing major, just a number of small fixes for problems that people have reported, including finally tracking down the root of the 64/32 bit problem with the vt6656 that has been driving people crazy for a while" * tag 'staging-3.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging/sb105x: PARPORT config is not good enough must use PARPORT_PC staging: wlan-ng: Fix clamping of returned SSID length staging: vt6656: Fix inconsistent structure packing staging:iio:adis16080: Perform sign extension iio: mxs-lradc: indexes are unsigned | 18 January 2013, 22:05:25 UTC |
| 0d060d2 | Linus Torvalds | 18 January 2013, 22:04:50 UTC | Merge tag 'char-misc-3.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg Kroah-Hartman: "Here are two hyperv patches for 3.8-rc4 that fix some reported problems hv_balloon driver" * tag 'char-misc-3.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: Drivers: hv: balloon: Fix a memory leak Drivers: hv: balloon: Fix a bug in the definition of struct dm_info_msg | 18 January 2013, 22:04:50 UTC |
| 5c69bed | Linus Torvalds | 18 January 2013, 20:02:52 UTC | Merge tag 'stable/for-linus-3.8-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen Pull Xen fixes from Konrad Rzeszutek Wilk: - CVE-2013-0190/XSA-40 (or stack corruption for 32-bit PV kernels) - Fix racy vma access spotted by Al Viro - Fix mmap batch ioctl potentially resulting in large O(n) page allcations. - Fix vcpu online/offline BUG:scheduling while atomic.. - Fix unbound buffer scanning for more than 32 vCPUs. - Fix grant table being incorrectly initialized - Fix incorrect check in pciback - Allow privcmd in backend domains. Fix up whitespace conflict due to ugly merge resolution in Xen tree in arch/arm/xen/enlighten.c * tag 'stable/for-linus-3.8-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests. Revert "xen/smp: Fix CPU online/offline bug triggering a BUG: scheduling while atomic." xen/gntdev: remove erronous use of copy_to_user xen/gntdev: correctly unmap unlinked maps in mmu notifier xen/gntdev: fix unsafe vma access xen/privcmd: Fix mmap batch ioctl. Xen: properly bound buffer access when parsing cpu/*/availability xen/grant-table: correctly initialize grant table version 1 x86/xen : Fix the wrong check in pciback xen/privcmd: Relax access control in privcmd_ioctl_mmap | 18 January 2013, 20:02:52 UTC |
| b814469 | Linus Torvalds | 18 January 2013, 19:58:10 UTC | Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu arch fixes from Greg Ungerer: "This contains a couple of fixes, both affecting compilation of non-mmu m68k targets." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: fix conditional use of init_pointer_table m68knommu: add KMAP definitions for non-MMU definitions | 18 January 2013, 19:58:10 UTC |
| 2f91ec8 | Kirill A. Shutemov | 26 December 2012, 00:19:55 UTC | asm-generic, mm: pgtable: convert my_zero_pfn() to macros to fix build Commit 816422ad7647 ("asm-generic, mm: pgtable: consolidate zero page helpers") broke the compile on MIPS if SPARSEMEM is enabled. We get this: In file included from arch/mips/include/asm/pgtable.h:552, from include/linux/mm.h:44, from arch/mips/kernel/asm-offsets.c:14: include/asm-generic/pgtable.h: In function 'my_zero_pfn': include/asm-generic/pgtable.h:466: error: implicit declaration of function 'page_to_section' In file included from arch/mips/kernel/asm-offsets.c:14: include/linux/mm.h: At top level: include/linux/mm.h:738: error: conflicting types for 'page_to_section' include/asm-generic/pgtable.h:466: note: previous implicit declaration of 'page_to_section' was here Due header files inter-dependencies, the only way I see to fix it is convert my_zero_pfn() for __HAVE_COLOR_ZERO_PAGE to macros. Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name> Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi> Acked-by: David Daney <david.daney@cavium.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 18 January 2013, 19:23:26 UTC |
| 7d1f9ae | Linus Torvalds | 18 January 2013, 03:25:45 UTC | Linux 3.8-rc4 | 18 January 2013, 03:25:45 UTC |
| 1ee0a22 | Wolfgang Frisch | 17 January 2013, 00:07:02 UTC | USB: io_ti: Fix NULL dereference in chase_port() The tty is NULL when the port is hanging up. chase_port() needs to check for this. This patch is intended for stable series. The behavior was observed and tested in Linux 3.2 and 3.7.1. Johan Hovold submitted a more elaborate patch for the mainline kernel. [ 56.277883] usb 1-1: edge_bulk_in_callback - nonzero read bulk status received: -84 [ 56.278811] usb 1-1: USB disconnect, device number 3 [ 56.278856] usb 1-1: edge_bulk_in_callback - stopping read! [ 56.279562] BUG: unable to handle kernel NULL pointer dereference at 00000000000001c8 [ 56.280536] IP: [<ffffffff8144e62a>] _raw_spin_lock_irqsave+0x19/0x35 [ 56.281212] PGD 1dc1b067 PUD 1e0f7067 PMD 0 [ 56.282085] Oops: 0002 [#1] SMP [ 56.282744] Modules linked in: [ 56.283512] CPU 1 [ 56.283512] Pid: 25, comm: khubd Not tainted 3.7.1 #1 innotek GmbH VirtualBox/VirtualBox [ 56.283512] RIP: 0010:[<ffffffff8144e62a>] [<ffffffff8144e62a>] _raw_spin_lock_irqsave+0x19/0x35 [ 56.283512] RSP: 0018:ffff88001fa99ab0 EFLAGS: 00010046 [ 56.283512] RAX: 0000000000000046 RBX: 00000000000001c8 RCX: 0000000000640064 [ 56.283512] RDX: 0000000000010000 RSI: ffff88001fa99b20 RDI: 00000000000001c8 [ 56.283512] RBP: ffff88001fa99b20 R08: 0000000000000000 R09: 0000000000000000 [ 56.283512] R10: 0000000000000000 R11: ffffffff812fcb4c R12: ffff88001ddf53c0 [ 56.283512] R13: 0000000000000000 R14: 00000000000001c8 R15: ffff88001e19b9f4 [ 56.283512] FS: 0000000000000000(0000) GS:ffff88001fd00000(0000) knlGS:0000000000000000 [ 56.283512] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 56.283512] CR2: 00000000000001c8 CR3: 000000001dc51000 CR4: 00000000000006e0 [ 56.283512] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 56.283512] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 56.283512] Process khubd (pid: 25, threadinfo ffff88001fa98000, task ffff88001fa94f80) [ 56.283512] Stack: [ 56.283512] 0000000000000046 00000000000001c8 ffffffff810578ec ffffffff812fcb4c [ 56.283512] ffff88001e19b980 0000000000002710 ffffffff812ffe81 0000000000000001 [ 56.283512] ffff88001fa94f80 0000000000000202 ffffffff00000001 0000000000000296 [ 56.283512] Call Trace: [ 56.283512] [<ffffffff810578ec>] ? add_wait_queue+0x12/0x3c [ 56.283512] [<ffffffff812fcb4c>] ? usb_serial_port_work+0x28/0x28 [ 56.283512] [<ffffffff812ffe81>] ? chase_port+0x84/0x2d6 [ 56.283512] [<ffffffff81063f27>] ? try_to_wake_up+0x199/0x199 [ 56.283512] [<ffffffff81263a5c>] ? tty_ldisc_hangup+0x222/0x298 [ 56.283512] [<ffffffff81300171>] ? edge_close+0x64/0x129 [ 56.283512] [<ffffffff810612f7>] ? __wake_up+0x35/0x46 [ 56.283512] [<ffffffff8106135b>] ? should_resched+0x5/0x23 [ 56.283512] [<ffffffff81264916>] ? tty_port_shutdown+0x39/0x44 [ 56.283512] [<ffffffff812fcb4c>] ? usb_serial_port_work+0x28/0x28 [ 56.283512] [<ffffffff8125d38c>] ? __tty_hangup+0x307/0x351 [ 56.283512] [<ffffffff812e6ddc>] ? usb_hcd_flush_endpoint+0xde/0xed [ 56.283512] [<ffffffff8144e625>] ? _raw_spin_lock_irqsave+0x14/0x35 [ 56.283512] [<ffffffff812fd361>] ? usb_serial_disconnect+0x57/0xc2 [ 56.283512] [<ffffffff812ea99b>] ? usb_unbind_interface+0x5c/0x131 [ 56.283512] [<ffffffff8128d738>] ? __device_release_driver+0x7f/0xd5 [ 56.283512] [<ffffffff8128d9cd>] ? device_release_driver+0x1a/0x25 [ 56.283512] [<ffffffff8128d393>] ? bus_remove_device+0xd2/0xe7 [ 56.283512] [<ffffffff8128b7a3>] ? device_del+0x119/0x167 [ 56.283512] [<ffffffff812e8d9d>] ? usb_disable_device+0x6a/0x180 [ 56.283512] [<ffffffff812e2ae0>] ? usb_disconnect+0x81/0xe6 [ 56.283512] [<ffffffff812e4435>] ? hub_thread+0x577/0xe82 [ 56.283512] [<ffffffff8144daa7>] ? __schedule+0x490/0x4be [ 56.283512] [<ffffffff8105798f>] ? abort_exclusive_wait+0x79/0x79 [ 56.283512] [<ffffffff812e3ebe>] ? usb_remote_wakeup+0x2f/0x2f [ 56.283512] [<ffffffff812e3ebe>] ? usb_remote_wakeup+0x2f/0x2f [ 56.283512] [<ffffffff810570b4>] ? kthread+0x81/0x89 [ 56.283512] [<ffffffff81057033>] ? __kthread_parkme+0x5c/0x5c [ 56.283512] [<ffffffff8145387c>] ? ret_from_fork+0x7c/0xb0 [ 56.283512] [<ffffffff81057033>] ? __kthread_parkme+0x5c/0x5c [ 56.283512] Code: 8b 7c 24 08 e8 17 0b c3 ff 48 8b 04 24 48 83 c4 10 c3 53 48 89 fb 41 50 e8 e0 0a c3 ff 48 89 04 24 e8 e7 0a c3 ff ba 00 00 01 00 <f0> 0f c1 13 48 8b 04 24 89 d1 c1 ea 10 66 39 d1 74 07 f3 90 66 [ 56.283512] RIP [<ffffffff8144e62a>] _raw_spin_lock_irqsave+0x19/0x35 [ 56.283512] RSP <ffff88001fa99ab0> [ 56.283512] CR2: 00000000000001c8 [ 56.283512] ---[ end trace 49714df27e1679ce ]--- Signed-off-by: Wolfgang Frisch <wfpub@roembden.net> Cc: Johan Hovold <jhovold@gmail.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 18 January 2013, 01:34:39 UTC |
| 99beb2e | Bjørn Mork | 15 January 2013, 09:29:49 UTC | USB: option: add TP-LINK HSUPA Modem MA180 The driver description files gives these names to the vendor specific functions on this modem: Diagnostics VID_2357&PID_0201&MI_00 NMEA VID_2357&PID_0201&MI_01 Modem VID_2357&PID_0201&MI_03 Networkcard VID_2357&PID_0201&MI_04 Reported-by: Thomas Schäfer <tschaefer@t-online.de> Signed-off-by: Bjørn Mork <bjorn@mork.no> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 18 January 2013, 01:34:39 UTC |
| 2291dff | Bjørn Mork | 17 January 2013, 14:14:22 UTC | USB: option: blacklist network interface on ONDA MT8205 4G LTE The driver description files gives these names to the vendor specific functions on this modem: Diag VID_19D2&PID_0265&MI_00 NMEA VID_19D2&PID_0265&MI_01 AT cmd VID_19D2&PID_0265&MI_02 Modem VID_19D2&PID_0265&MI_03 Net VID_19D2&PID_0265&MI_04 Signed-off-by: Bjørn Mork <bjorn@mork.no> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 18 January 2013, 01:34:38 UTC |
| 7dfc833 | Steven Rostedt | 12 January 2013, 01:17:01 UTC | staging/sb105x: PARPORT config is not good enough must use PARPORT_PC The sb105x driver calls parport_pc_probe_port() which isn't defined if PARPORT_PC isn't enabled. Protecting it with CONFIG_PARPORT is not good enough, must protect it with CONFIG_PARPORT_PC. Reported-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 18 January 2013, 00:39:41 UTC |
| 811a37e | Tormod Volden | 09 January 2013, 21:23:32 UTC | staging: wlan-ng: Fix clamping of returned SSID length Commit 2e254212 broke listing of available network names, since it clamped the length of the returned SSID to WLAN_BSSID_LEN (6) instead of WLAN_SSID_MAXLEN (32). https://bugzilla.kernel.org/show_bug.cgi?id=52501 Signed-off-by: Tormod Volden <debian.tormod@gmail.com> Cc: stable <stable@vger.kernel.org> # 3.4+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 18 January 2013, 00:38:07 UTC |
| aec992f | Greg Kroah-Hartman | 18 January 2013, 00:34:33 UTC | Merge tag 'iio-fixes-for-3.8b' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: Second round of fixes for IIO post 3.8-rc1 Two tiny fixes * A build warning fix due to signed / unsigned comparison * Missing sign extension in adis16080 | 18 January 2013, 00:34:33 UTC |
| ebebd49 | Stephen Hurd | 17 January 2013, 22:14:53 UTC | 8250/16?50: Add support for Broadcom TruManage redirected serial port Add support for the UART device present in Broadcom TruManage capable NetXtreme chips (ie: 5761m 5762, and 5725). This implementation has a hidden transmit FIFO, so running in single-byte interrupt mode results in too many interrupts. The UART_CAP_HFIFO capability was added to track this. It continues to reload the THR as long as the THRE and TSRE bits are set in the LSR up to a specified limit (1024 is used here). Signed-off-by: Stephen Hurd <shurd@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 17 January 2013, 22:02:55 UTC |
| ded2f29 | Jiri Slaby | 11 January 2013, 11:06:27 UTC | pty: return EINVAL for TIOCGPTN for BSD ptys Commit bbb63c514a3464342967237a51a21ea8f61ab951 (drivers:tty:fix up ENOIOCTLCMD error handling) changed the default return value from tty ioctl to be ENOTTY and not EINVAL. This is appropriate. But in case of TIOCGPTN for the old BSD ptys glibc started failing because it expects EINVAL to be returned. Only then it continues to obtain the pts name the other way around. So fix this case by explicit return of EINVAL in this case. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Reported-by: Florian Westphal <fw@strlen.de> Cc: Alan Cox <alan@linux.intel.com> Cc: stable <stable@vger.kernel.org> # 3.7+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 17 January 2013, 21:56:57 UTC |
| 1ee4c55 | Ben Hutchings | 14 January 2013, 01:29:17 UTC | staging: vt6656: Fix inconsistent structure packing vt6656 has several headers that use the #pragma pack(1) directive to enable structure packing, but never disable it. The layout of structures defined in other headers can then depend on which order the various headers are included in, breaking the One Definition Rule. In practice this resulted in crashes on x86_64 until the order of header inclusion was changed for some files in commit 11d404cb56ecd ('staging: vt6656: fix headers and add cfg80211.'). But we need a proper fix that won't be affected by future changes to the order of inclusion. This removes the #pragma pack(1) directives and adds __packed to the structure definitions for which packing appears to have been intended. Reported-and-tested-by: Malcolm Priestley <tvboxspy@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 17 January 2013, 21:08:32 UTC |
| 33080c1 | K. Y. Srinivasan | 11 December 2012, 19:07:17 UTC | Drivers: hv: balloon: Fix a memory leak The send buffer was being leaked; fix it. Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Reported-by: Jason Wang <jasowang@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 17 January 2013, 19:58:00 UTC |
| 6427a0d | K. Y. Srinivasan | 06 December 2012, 19:06:54 UTC | Drivers: hv: balloon: Fix a bug in the definition of struct dm_info_msg There is bug in the definition of struct dm_info_msg. This patch fixes the definition of this structure and makes the corresponding adjustments. Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 17 January 2013, 19:58:00 UTC |
| 2070787 | Alex Deucher | 17 January 2013, 18:10:50 UTC | Revert "drm/radeon: do not move bo to different placement at each cs" This reverts commit d025e9e2b890db679f1246037bf65bd4be512627. This causes corruption for a number of users and needs further investigation in the next cycle. https://bugzilla.kernel.org/show_bug.cgi?id=52491 https://bugs.freedesktop.org/show_bug.cgi?id=58659 http://lists.freedesktop.org/archives/dri-devel/2013-January/032961.html Signed-off-by: Alex Deucher <alexander.deucher@amd.com> | 17 January 2013, 18:10:50 UTC |
| 72ffaa4 | Linus Torvalds | 17 January 2013, 16:56:30 UTC | Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 patches from Martin Schwidefsky: "A couple of bug fixes: one of the transparent huge page primitives is broken, the sched_clock function overflows after 417 days, the XFS module has grown too large for -fpic and the new pci code has broken normal channel subsystem notifications." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/chsc: fix SEI usage s390/time: fix sched_clock() overflow s390: use -fPIC for module compile s390/mm: fix pmd_pfn() for thp | 17 January 2013, 16:56:30 UTC |
| b514407 | Jani Nikula | 17 January 2013, 08:24:09 UTC | drm/i915: fix FORCEWAKE posting reads We stopped reading FORCEWAKE for posting reads in commit 8dee3eea3ccd3b6c00a8d3a08dd715d6adf737dd Author: Ben Widawsky <ben@bwidawsk.net> Date: Sat Sep 1 22:59:50 2012 -0700 drm/i915: Never read FORCEWAKE and started using something from the same cacheline instead. On the bug reporter's machine this broke entering rc6 states after a suspend/resume cycle. It turns out reading ECOBUS as posting read worked fine, while GTFIFODBG did not, preventing RC6 states after suspend/resume per the bug report referenced below. It's not entirely clear why, but clearly GTFIFODBG was nowhere near the same cacheline or address range as FORCEWAKE. Trying out various registers for posting reads showed that all tested registers for which NEEDS_FORCE_WAKE() (in i915_drv.c) returns true work. Conversely, most (but not quite all) registers for which NEEDS_FORCE_WAKE() returns false do not work. Details in the referenced bug. Based on the above, add posting reads on ECOBUS where GTFIFODBG was previously relied on. In true cargo cult spirit, add posting reads for FORCEWAKE_VLV writes as well, but instead of ECOBUS, use FORCEWAKE_ACK_VLV which is in the same address range as FORCEWAKE_VLV. v2: Add more details to the commit message. No functional changes. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=52411 Reported-and-tested-by: Alexander Bersenev <bay@hackerdom.ru> CC: Ben Widawsky <ben@bwidawsk.net> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: stable@vger.kernel.org [danvet: add cc: stable and make the commit message a bit clearer that this is a regression fix and what exactly broke.] Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> | 17 January 2013, 10:09:25 UTC |
| dfdebc2 | Linus Torvalds | 17 January 2013, 00:19:54 UTC | Merge tag 'for-linus-v3.8-rc4' of git://oss.sgi.com/xfs/xfs Pull xfs bugfixes from Ben Myers: - fix(es) for compound buffers - fix for dquot soft timer asserts due to overflow of d_blk_softlimit - fix for regression in dir v2 code introduced in commit 20f7e9f3726a ("xfs: factor dir2 block read operations") * tag 'for-linus-v3.8-rc4' of git://oss.sgi.com/xfs/xfs: xfs: recalculate leaf entry pointer after compacting a dir2 block xfs: remove int casts from debug dquot soft limit timer asserts xfs: fix the multi-segment log buffer format xfs: fix segment in xfs_buf_item_format_segment xfs: rename bli_format to avoid confusion with bli_formats xfs: use b_maps[] for discontiguous buffers | 17 January 2013, 00:19:54 UTC |
| 309b51e | Linus Torvalds | 16 January 2013, 22:34:52 UTC | Merge tag 'pm+acpi-for-3.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI and power management fixes from Rafael Wysocki: - cpuidle regression fix related to the initialization of state kobjects from Krzysztof Mazur. - cpuidle fix removing some not very useful code and making some user-visible problems go away at the same time. From Daniel Lezcano. - ACPI build fix from Yinghai Lu. * tag 'pm+acpi-for-3.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpuidle: remove the power_specified field in the driver ACPI / glue: Fix build with ACPI_GLUE_DEBUG set cpuidle: fix number of initialized/destroyed states | 16 January 2013, 22:34:52 UTC |
| 37f1356 | Eric Sandeen | 10 January 2013, 16:41:48 UTC | xfs: recalculate leaf entry pointer after compacting a dir2 block Dave Jones hit this assert when doing a compile on recent git, with CONFIG_XFS_DEBUG enabled: XFS: Assertion failed: (char *)dup - (char *)hdr == be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup)), file: fs/xfs/xfs_dir2_data.c, line: 828 Upon further digging, the tag found by xfs_dir2_data_unused_tag_p(dup) contained "2" and not the proper offset, and I found that this value was changed after the memmoves under "Use a stale leaf for our new entry." in xfs_dir2_block_addname(), i.e. memmove(&blp[mid + 1], &blp[mid], (highstale - mid) * sizeof(*blp)); overwrote it. What has happened is that the previous call to xfs_dir2_block_compact() has rearranged things; it changes btp->count as well as the blp array. So after we make that call, we must recalculate the proper pointer to the leaf entries by making another call to xfs_dir2_block_leaf_p(). Dave provided a metadump image which led to a simple reproducer (create a particular filename in the affected directory) and this resolves the testcase as well as the bug on his live system. Thanks also to dchinner for looking at this one with me. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Tested-by: Dave Jones <davej@redhat.com> Reviewed-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Mark Tinguely <tinguely@sgi.com> Signed-off-by: Ben Myers <bpm@sgi.com> | 16 January 2013, 22:08:55 UTC |
| ab7eac2 | Brian Foster | 21 December 2012, 15:45:17 UTC | xfs: remove int casts from debug dquot soft limit timer asserts The int casts here make it easy to trigger an assert with a large soft limit. For example, set a >4TB soft limit on an empty volume to reproduce a (0 > -x) comparison due to an overflow of d_blk_softlimit. Signed-off-by: Brian Foster <bfoster@redhat.com> Reviewed-by: Ben Myers <bpm@sgi.com> Signed-off-by: Ben Myers <bpm@sgi.com> | 16 January 2013, 22:08:40 UTC |
| 91e4bac | Mark Tinguely | 04 December 2012, 23:18:05 UTC | xfs: fix the multi-segment log buffer format Per Dave Chinner suggestion, this patch: 1) Corrects the detection of whether a multi-segment buffer is still tracking data. 2) Clears all the buffer log formats for a multi-segment buffer. Signed-off-by: Mark Tinguely <tinguely@sgi.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Ben Myers <bpm@sgi.com> | 16 January 2013, 22:08:08 UTC |
| 2d0e9df | Mark Tinguely | 04 December 2012, 23:18:04 UTC | xfs: fix segment in xfs_buf_item_format_segment Not every segment in a multi-segment buffer is dirty in a transaction and they will not be outputted. The assert in xfs_buf_item_format_segment() that checks for the at least one chunk of data in the segment to be used is not necessary true for multi-segmented buffers. Signed-off-by: Mark Tinguely <tinguely@sgi.com> Reviewed-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Ben Myers <bpm@sgi.com> | 16 January 2013, 22:07:56 UTC |
| 0f22f9d | Mark Tinguely | 04 December 2012, 23:18:03 UTC | xfs: rename bli_format to avoid confusion with bli_formats Rename the bli_format structure to __bli_format to avoid accidently confusing them with the bli_formats pointer. Signed-off-by: Mark Tinguely <tinguely@sgi.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Ben Myers <bpm@sgi.com> | 16 January 2013, 22:07:37 UTC |
| d44d9bc | Mark Tinguely | 04 December 2012, 23:18:02 UTC | xfs: use b_maps[] for discontiguous buffers Commits starting at 77c1a08 introduced a multiple segment support to xfs_buf. xfs_trans_buf_item_match() could not find a multi-segment buffer in the transaction because it was looking at the single segment block number rather than the multi-segment b_maps[0].bm.bn. This results on a recursive buffer lock that can never be satisfied. This patch: 1) Changed the remaining b_map accesses to be b_maps[0] accesses. 2) Renames the single segment b_map structure to __b_map to avoid future confusion. Signed-off-by: Mark Tinguely <tinguely@sgi.com> Reviewed-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Ben Myers <bpm@sgi.com> | 16 January 2013, 22:07:11 UTC |
| 9174adb | Andrew Cooper | 16 January 2013, 12:00:55 UTC | xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests. This fixes CVE-2013-0190 / XSA-40 There has been an error on the xen_failsafe_callback path for failed iret, which causes the stack pointer to be wrong when entering the iret_exc error path. This can result in the kernel crashing. In the classic kernel case, the relevant code looked a little like: popl %eax # Error code from hypervisor jz 5f addl $16,%esp jmp iret_exc # Hypervisor said iret fault 5: addl $16,%esp # Hypervisor said segment selector fault Here, there are two identical addls on either option of a branch which appears to have been optimised by hoisting it above the jz, and converting it to an lea, which leaves the flags register unaffected. In the PVOPS case, the code looks like: popl_cfi %eax # Error from the hypervisor lea 16(%esp),%esp # Add $16 before choosing fault path CFI_ADJUST_CFA_OFFSET -16 jz 5f addl $16,%esp # Incorrectly adjust %esp again jmp iret_exc It is possible unprivileged userspace applications to cause this behaviour, for example by loading an LDT code selector, then changing the code selector to be not-present. At this point, there is a race condition where it is possible for the hypervisor to return back to userspace from an interrupt, fault on its own iret, and inject a failsafe_callback into the kernel. This bug has been present since the introduction of Xen PVOPS support in commit 5ead97c84 (xen: Core Xen implementation), in 2.6.23. Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Cc: stable@vger.kernel.org Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 16 January 2013, 21:17:42 UTC |
| 3a55fb0 | Kirill Smelkov | 02 November 2012, 11:41:01 UTC | Tell the world we gave up on pushing CC_OPTIMIZE_FOR_SIZE In commit 281dc5c5ec0f ("Give up on pushing CC_OPTIMIZE_FOR_SIZE") we already changed the actual default value, but the help-text still suggested 'y'. Fix the help text too, for all the same reasons. Sadly, -Os keeps on generating some very suboptimal code for certain cases, to the point where any I$ miss upside is swamped by the downside. The main ones are: - using "rep movsb" for memcpy, even on CPU's where that is horrendously bad for performance. - not honoring branch prediction information, so any I$ footprint you win from smaller code, you lose from less code density in the I$. - using divide instructions when that is very expensive. Signed-off-by: Kirill Smelkov <kirr@mns.spb.ru> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 16 January 2013, 20:42:57 UTC |
| fbfc23e | Chuansheng Liu | 24 December 2012, 14:19:56 UTC | mfd, TWL4030: TWL4030 need select REGMAP_I2C Fix the build error: drivers/built-in.o: In function `twl_probe': drivers/mfd/twl-core.c:1256: undefined reference to `devm_regmap_init_i2c' make: *** [vmlinux] Error 1 Signed-off-by: liu chuansheng <chuansheng.liu@intel.com> Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com> [ Samuel is busy, taking it directly - Linus ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 16 January 2013, 20:36:22 UTC |
| 30a4840 | Ralf Baechle | 15 January 2013, 14:27:46 UTC | drivers/base/cpu.c: Fix typo in comment [ We should make fun of people who can't speel too, but then we'd have no time for any real work at all - Linus ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 16 January 2013, 20:34:34 UTC |
| e65b9ad | Jiri Kosina | 15 January 2013, 19:12:37 UTC | lockdep, rwsem: fix down_write_nest_lock() if !CONFIG_DEBUG_LOCK_ALLOC Commit 1b963c81b145 ("lockdep, rwsem: provide down_write_nest_lock()") contains a bug in a codepath when CONFIG_DEBUG_LOCK_ALLOC is disabled, which causes down_read() to be called instead of down_write() by mistake on such configurations. Fix that. Reported-and-tested-by: Andrew Clayton <andrew@digital-domain.net> Reported-and-tested-by: Zlatko Calusic <zlatko.calusic@iskon.hr> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Reviewed-by: Rik van Riel <riel@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 16 January 2013, 20:13:20 UTC |
| 36e7a96 | Linus Torvalds | 16 January 2013, 19:33:52 UTC | Merge tag 'sound-3.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull second round of sound fixes from Takashi Iwai: "Yet a few more fixes popped up in this week. The biggest change here is the addition of pinctrl support for Atmel, which turned out to be almost mandatory to make things working. The rest are a few fixes for M-Audio usb-audio device and a fix for regression of HD-audio HDMI codecs with alsactl in the recent kernel." * tag 'sound-3.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/hdmi - Work around "alsactl restore" errors ALSA: usb-audio: selector map for M-Audio FT C400 ALSA: usb-audio: M-Audio FT C400 skip packet quirk ALSA: usb-audio: correct M-Audio C400 clock source quirk ALSA: usb - fix race in creation of M-Audio Fast track pro driver ASoC: atmel-ssc: add pinctrl selection to driver ARM: at91/dts: add pinctrl support for SSC peripheral | 16 January 2013, 19:33:52 UTC |
| ce0f706 | Linus Torvalds | 16 January 2013, 19:13:39 UTC | Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending Pull scsi target fixes from Nicholas Bellinger: "This includes an important >= v3.6 regression bugfix for active I/O shutdown (Roland), some TMR related failure / corner cases fixes for long outstanding I/O (Roland), two FCoE target mode fabric fabric role fixes (MDR), a fix for an incorrect sense code during LUN communication failure (Dr. Hannes), plus a handful of other minor fixes. There are still some outstanding zero-length control CDB regression fixes that need to be addressed for v3.8, that will be coming in a follow-up PULL request." * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: iscsi-target: Fix CmdSN comparison (use cmd->cmd_sn instead of cmd->stat_sn) target: Release se_cmd when LUN lookup fails for TMR target: Fix use-after-free in LUN RESET handling target: Fix missing CMD_T_ACTIVE bit regression for pending WRITEs tcm_fc: Do not report target role when target is not defined tcm_fc: Do not indicate retry capability to initiators target: Use TCM_NO_SENSE for initialisation target: Introduce TCM_NO_SENSE target: use correct sense code for LUN communication failure | 16 January 2013, 19:13:39 UTC |
| 31db720 | Linus Torvalds | 16 January 2013, 18:55:10 UTC | Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext3 and udf fixes from Jan Kara: "One ext3 performance regression fix and one udf regression fix (oops on interrupted mount)." * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: UDF: Fix a null pointer dereference in udf_sb_free_partitions jbd: don't wake kjournald unnecessarily | 16 January 2013, 18:55:10 UTC |
| 56400b5 | Linus Torvalds | 16 January 2013, 18:17:09 UTC | Merge git://git.kernel.org/pub/scm/virt/kvm/kvm Pull s390 KVM fix from Gleb Natapov. * git://git.kernel.org/pub/scm/virt/kvm/kvm: s390/kvm: Fix BUG in include/linux/kvm_host.h:745 | 16 January 2013, 18:17:09 UTC |
| aa8b550 | Linus Torvalds | 16 January 2013, 18:13:04 UTC | Merge tag 'sh-for-linus' of git://github.com/pmundt/linux-sh Pull SuperH fixes from Paul Mundt. * tag 'sh-for-linus' of git://github.com/pmundt/linux-sh: sh: ecovec: add sample amixer settings sh: Fix up stack debugging build. sh: wire up finit_module syscall. sh: Fix FDPIC binary loader sh: clkfwk: bugfix: sh_clk_div_enable() care sh_clk_div_set_rate() if div6 sh: define TASK_UNMAPPED_BASE as a page aligned constant | 16 January 2013, 18:13:04 UTC |
| a6d3bd2 | Linus Torvalds | 16 January 2013, 17:44:40 UTC | Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64 Pull arm64 fixes from Catalin Marinas: - Page protection fixes, including proper PAGE_NONE handling - Timezone vdso sequence counting fix - Additional compat syscall wiring * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64: arm64: compat: add syscall table entries for new syscalls arm64: mm: introduce present, faulting entries for PAGE_NONE arm64: mm: only wrprotect clean ptes if they are present arm64: vdso: remove broken, redundant sequence counting for timezones | 16 January 2013, 17:44:40 UTC |
| 2409c87 | Linus Torvalds | 16 January 2013, 17:11:50 UTC | Merge branch 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Peter Anvin: "This is mainly a workaround for a bug in Sandy Bridge graphics which causes corruption of certain memory pages." * 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/Sandy Bridge: Sandy Bridge workaround depends on CONFIG_PCI x86/Sandy Bridge: mark arrays in __init functions as __initconst x86/Sandy Bridge: reserve pages when integrated graphics is present x86, efi: correct precedence of operators in setup_efi_pci | 16 January 2013, 17:11:50 UTC |
| c4ef9bc | Timur Tabi | 15 January 2013, 20:19:45 UTC | MAINTAINERS: update email address for Timur Tabi Timur Tabi no longer works for Freescale, so update the email address and status for all of his maintained projects. Also mark the QE library as orphaned, for lack of interest in maintaining it. The CS4270 driver is marked as "Odd Fixes" because appropriate hardware is no longer available. Signed-off-by: Timur Tabi <timur@freescale.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 16 January 2013, 17:11:09 UTC |
| 4adf07f | Luciano Coelho | 15 January 2013, 08:43:43 UTC | firmware: make sure the fw file size is not 0 If the requested firmware file size is 0 bytes in the filesytem, we will try to vmalloc(0), which causes a warning: vmalloc: allocation failure: 0 bytes kworker/1:1: page allocation failure: order:0, mode:0xd2 __vmalloc_node_range+0x164/0x208 __vmalloc_node+0x4c/0x58 vmalloc+0x38/0x44 _request_firmware_load+0x220/0x6b0 request_firmware+0x64/0xc8 wl18xx_setup+0xb4/0x570 [wl18xx] wlcore_nvs_cb+0x64/0x9f8 [wlcore] request_firmware_work_func+0x94/0x100 process_one_work+0x1d0/0x750 worker_thread+0x184/0x4ac kthread+0xb4/0xc0 To fix this, check whether the file size is less than or equal to zero in fw_read_file_contents(). Cc: stable <stable@vger.kernel.org> [3.7] Signed-off-by: Luciano Coelho <coelho@ti.com> Acked-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 16 January 2013, 17:09:53 UTC |
| 774a122 | Tejun Heo | 16 January 2013, 02:52:51 UTC | module, async: async_synchronize_full() on module init iff async is used If the default iosched is built as module, the kernel may deadlock while trying to load the iosched module on device probe if the probing was running off async. This is because async_synchronize_full() at the end of module init ends up waiting for the async job which initiated the module loading. async A modprobe 1. finds a device 2. registers the block device 3. request_module(default iosched) 4. modprobe in userland 5. load and init module 6. async_synchronize_full() Async A waits for modprobe to finish in request_module() and modprobe waits for async A to finish in async_synchronize_full(). Because there's no easy to track dependency once control goes out to userland, implementing properly nested flushing is difficult. For now, make module init perform async_synchronize_full() iff module init has queued async jobs as suggested by Linus. This avoids the described deadlock because iosched module doesn't use async and thus wouldn't invoke async_synchronize_full(). This is hacky and incomplete. It will deadlock if async module loading nests; however, this works around the known problem case and seems to be the best of bad options. For more details, please refer to the following thread. http://thread.gmane.org/gmane.linux.kernel/1420814 Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Alex Riesen <raa.lkml@gmail.com> Tested-by: Ming Lei <ming.lei@canonical.com> Tested-by: Alex Riesen <raa.lkml@gmail.com> Cc: Arjan van de Ven <arjan@linux.intel.com> Cc: Jens Axboe <axboe@kernel.dk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 16 January 2013, 17:05:33 UTC |
| 509d97b | Sebastian Ott | 15 January 2013, 18:02:01 UTC | s390/chsc: fix SEI usage cbc0dd1 "s390/pci: CHSC PCI support for error and availability events" introduced a new SEI notification type as part of pci support. The way SEI was called with nt2 and nt0 consecutive broke the nt0 stuff used for channel subsystem notifications. The reason why this was broken with the mentioned patch is that you cannot selectively disable type 0 notifications (so even when asked for type 2 only, type 0 could be presented). The way to do it is to tell SEI which types of notification you can process and -this is the important part- look at the SEI result which notification type you actually received. Reviewed-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com> Tested-by: Michael Holzheu <holzheu@linux.vnet.ibm.com> Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> | 16 January 2013, 14:57:54 UTC |
| ed4f209 | Heiko Carstens | 14 January 2013, 15:55:55 UTC | s390/time: fix sched_clock() overflow Converting a 64 Bit TOD format value to nanoseconds means that the value must be divided by 4.096. In order to achieve that we multiply with 125 and divide by 512. When used within sched_clock() this triggers an overflow after appr. 417 days. Resulting in a sched_clock() return value that is much smaller than previously and therefore may cause all sort of weird things in subsystems that rely on a monotonic sched_clock() behaviour. To fix this implement a tod_to_ns() helper function which converts TOD values without overflow and call this function from both places that open coded the conversion: sched_clock() and kvm_s390_handle_wait(). Cc: stable@kernel.org Reviewed-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> | 16 January 2013, 14:57:52 UTC |
| 262b6d3 | Chris Wilson | 15 January 2013, 16:17:54 UTC | drm/i915: Invalidate the relocation presumed_offsets along the slow path In the slow path, we are forced to copy the relocations prior to acquiring the struct mutex in order to handle pagefaults. We forgo copying the new offsets back into the relocation entries in order to prevent a recursive locking bug should we trigger a pagefault whilst holding the mutex for the reservations of the execbuffer. Therefore, we need to reset the presumed_offsets just in case the objects are rebound back into their old locations after relocating for this exexbuffer - if that were to happen we would assume the relocations were valid and leave the actual pointers to the kernels dangling, instant hang. Fixes regression from commit bcf50e2775bbc3101932d8e4ab8c7902aa4163b4 Author: Chris Wilson <chris@chris-wilson.co.uk> Date: Sun Nov 21 22:07:12 2010 +0000 drm/i915: Handle pagefaults in execbuffer user relocations Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=55984 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Daniel Vetter <daniel.vetter@fwll.ch> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> | 16 January 2013, 09:53:38 UTC |
| 035688d | Kuninori Morimoto | 25 December 2012, 04:04:20 UTC | sh: ecovec: add sample amixer settings FSI - DA7210 needs amixer settings to use it. This patch adds quick setting guide Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Paul Mundt <lethal@linux-sh.org> | 16 January 2013, 09:30:44 UTC |
| f30d26e | Jani Nikula | 16 January 2013, 08:53:40 UTC | drm/i915/eDP: do not write power sequence registers for ghost eDP Some machines detect an eDP port even if it's not really there, and eDP initialization has a fail path for this. Typically such machines have an LVDS display instead. A regression introduced in commit 82ed61fa1a4e08d5f9e86fb1b715b50ed678b6ac Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Sat Oct 20 20:57:41 2012 +0200 drm/i915: make edp panel power sequence setup more robust updated the power sequence registers PCH_PP_ON_DELAYS, PCH_PP_OFF_DELAYS, and PCH_PP_DIVISOR also in the ghost eDP case, messing up the LVDS display. Split the power sequencer initialization into two, delaying the register updates until after we know the eDP is real. Note: Keep the PP_CONTROL unlocking in the first part, even if it does not update registers, per the commit message of the above mentioned commit. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=52601 Reported-and-tested-by: Ryan Coe <ryan@rycomotorsports.com> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> | 16 January 2013, 09:23:01 UTC |
| 5dd070d | channing | 16 January 2013, 05:14:20 UTC | serial:ifx6x60:Keep word size accordance with SPI controller As protocol driver, IFX SPI driver initiate to setup SPI master with default SPI word size as 16 bit/word, however, SPI master may not adopt this default value due to SPI controller's capability, it might choose an available value by itself and set it to spi_device.bits_per_word. In order to keep align with Controller, IFX driver should make use of this value during SPI transfer, but the default one. Signed-off-by: Chen Jun <jun.d.chen@intel.com> Signed-off-by: channing <chao.bi@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 16 January 2013, 05:35:04 UTC |
| 68e56cb | Maxime Ripard | 14 January 2013, 19:09:26 UTC | tty: 8250_dw: Fix inverted arguments to serial_out in IRQ handler Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 16 January 2013, 05:35:04 UTC |
| 2eaa865 | Thomas Abraham | 31 December 2012, 21:42:45 UTC | serial: samsung: remove redundant setting of line config during port reset The setting of uart line control configuration in s3c24xx_serial_resetport is can be removed since the 'set_termios' call will overwrite any ULCON register setting which s3c24xx_serial_resetport does. Acked-by: Kukjin Kim <kgene.kim@samsung.com> Signed-off-by: Thomas Abraham <thomas.ab@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 16 January 2013, 05:35:03 UTC |
| d55bf53 | Konrad Rzeszutek Wilk | 16 January 2013, 03:40:26 UTC | Revert "xen/smp: Fix CPU online/offline bug triggering a BUG: scheduling while atomic." This reverts commit 41bd956de3dfdc3a43708fe2e0c8096c69064a1e. The fix is incorrect and not appropiate for the latest kernels. In fact it _causes_ the BUG: scheduling while atomic while doing vCPU hotplug. Suggested-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 16 January 2013, 03:41:27 UTC |
| 014b9b4 | chao bi | 12 December 2012, 03:40:56 UTC | serial:ifx6x60:Delete SPI timer when shut down port When shut down SPI port, it's possible that MRDY has been asserted and a SPI timer was activated waiting for SRDY assert, in the case, it needs to delete this timer. Signed-off-by: Chen Jun <jun.d.chen@intel.com> Signed-off-by: channing <chao.bi@intel.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 16 January 2013, 03:06:42 UTC |
| b7b9041 | Matt Schulte | 07 December 2012, 04:19:59 UTC | tty/8250: The correct device id for this card is 0x0022 The correct device id for this card is 0x0022 Signed-off-by: Matt Schulte <matts@commtech-fastcom.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 16 January 2013, 03:06:42 UTC |
| 4f7d67d | Matt Schulte | 07 December 2012, 04:19:58 UTC | tty/8250: pbn_b0_8_1152000_200 is supposed to be an 8 port definition tty/8250: pbn_b0_8_1152000_200 is supposed to be an 8 port definition Signed-off-by: Matt Schulte <matts@commtech-fastcom.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 16 January 2013, 03:06:42 UTC |
| a6dd114 | Wei Yongjun | 02 December 2012, 10:10:44 UTC | tty: serial: vt8500: fix return value check in vt8500_serial_probe() In case of error, function of_clk_get() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn> Acked-by: Tony Prisk <linux@prisktech.co.nz> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 16 January 2013, 03:06:42 UTC |
| 87b8bed | fabio.estevam@freescale.com | 08 January 2013, 01:11:06 UTC | serial: mxs-auart: Index is unsigned Fix the following warning when building with W=1 option: drivers/tty/serial/mxs-auart.c: In function 'mxs_auart_tx_chars': drivers/tty/serial/mxs-auart.c:272:10: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Acked-by: Marek Vasut <marex@denx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 16 January 2013, 03:06:41 UTC |
| a683321 | Steffen Trumtrar | 13 December 2012, 13:27:43 UTC | mxs: uart: fix setting RTS from software With the patch "serial: mxs-auart: fix the wrong RTS hardware flow control" the mainline mxs-uart driver now sets RTSEN only when hardware flow control is enabled via software. It is not possible any longer to set RTS manually via software. However, the manual modification is a valid operation. Regain the possibility to set RTS via software and only set RTSEN when hardware flow control is explicitly enabled via settermios cflag CRTSCTS. Signed-off-by: Steffen Trumtrar <s.trumtrar@pengutronix.de> Cc: stable <stable@vger.kernel.org> Reviewed-by: Huang Shijie <b32955@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 16 January 2013, 03:06:41 UTC |
| 1affa98 | Daniel De Graaf | 02 January 2013, 22:57:13 UTC | xen/gntdev: remove erronous use of copy_to_user Since there is now a mapping of granted pages in kernel address space in both PV and HVM, use it for UNMAP_NOTIFY_CLEAR_BYTE instead of accessing memory via copy_to_user and triggering sleep-in-atomic warnings. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 15 January 2013, 21:02:40 UTC |
| 16a1d02 | Daniel De Graaf | 02 January 2013, 22:57:12 UTC | xen/gntdev: correctly unmap unlinked maps in mmu notifier If gntdev_ioctl_unmap_grant_ref is called on a range before unmapping it, the entry is removed from priv->maps and the later call to mn_invl_range_start won't find it to do the unmapping. Fix this by creating another list of freeable maps that the mmu notifier can search and use to unmap grants. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 15 January 2013, 21:01:30 UTC |
| 2512f29 | Daniel De Graaf | 02 January 2013, 22:57:11 UTC | xen/gntdev: fix unsafe vma access In gntdev_ioctl_get_offset_for_vaddr, we need to hold mmap_sem while calling find_vma() to avoid potentially having the result freed out from under us. Similarly, the MMU notifier functions need to synchronize with gntdev_vma_close to avoid map->vma being freed during their iteration. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 15 January 2013, 21:01:06 UTC |
| 99beae6 | Andres Lagar-Cavilla | 15 January 2013, 03:35:40 UTC | xen/privcmd: Fix mmap batch ioctl. 1. If any individual mapping error happens, the V1 case will mark *all* operations as failed. Fixed. 2. The err_array was allocated with kcalloc, resulting in potentially O(n) page allocations. Refactor code to not use this array. Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 15 January 2013, 21:00:52 UTC |
| 7bcc1ec | Konrad Rzeszutek Wilk | 15 January 2013, 20:58:25 UTC | Merge tag 'v3.7' into stable/for-linus-3.8 Linux 3.7 * tag 'v3.7': (833 commits) Linux 3.7 Input: matrix-keymap - provide proper module license Revert "revert "Revert "mm: remove __GFP_NO_KSWAPD""" and associated damage ipv4: ip_check_defrag must not modify skb before unsharing Revert "mm: avoid waking kswapd for THP allocations when compaction is deferred or contended" inet_diag: validate port comparison byte code to prevent unsafe reads inet_diag: avoid unsafe and nonsensical prefix matches in inet_diag_bc_run() inet_diag: validate byte code to prevent oops in inet_diag_bc_run() inet_diag: fix oops for IPv4 AF_INET6 TCP SYN-RECV state mm: vmscan: fix inappropriate zone congestion clearing vfs: fix O_DIRECT read past end of block device net: gro: fix possible panic in skb_gro_receive() tcp: bug fix Fast Open client retransmission tmpfs: fix shared mempolicy leak mm: vmscan: do not keep kswapd looping forever due to individual uncompactable zones mm: compaction: validate pfn range passed to isolate_freepages_block mmc: sh-mmcif: avoid oops on spurious interrupts (second try) Revert misapplied "mmc: sh-mmcif: avoid oops on spurious interrupts" mmc: sdhci-s3c: fix missing clock for gpio card-detect lib/Makefile: Fix oid_registry build dependency ... Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Conflicts: arch/arm/xen/enlighten.c drivers/xen/Makefile [We need to have the v3.7 base as the 'for-3.8' was based off v3.7-rc3 and there are some patches in v3.7-rc6 that we to have in our branch] | 15 January 2013, 20:58:25 UTC |
| e5c702d | Jan Beulich | 15 January 2013, 13:31:43 UTC | Xen: properly bound buffer access when parsing cpu/*/availability At the same time reduce the local buffers to 16 bytes each. Signed-off-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 15 January 2013, 20:57:02 UTC |
| d0b4d64 | Matt Wilson | 15 January 2013, 13:21:27 UTC | xen/grant-table: correctly initialize grant table version 1 Commit 85ff6acb075a484780b3d763fdf41596d8fc0970 (xen/granttable: Grant tables V2 implementation) changed the GREFS_PER_GRANT_FRAME macro from a constant to a conditional expression. The expression depends on grant_table_version being appropriately set. Unfortunately, at init time grant_table_version will be 0. The GREFS_PER_GRANT_FRAME conditional expression checks for "grant_table_version == 1", and therefore returns the number of grant references per frame for v2. This causes gnttab_init() to allocate fewer pages for gnttab_list, as a frame can old half the number of v2 entries than v1 entries. After gnttab_resume() is called, grant_table_version is appropriately set. nr_init_grefs will then be miscalculated and gnttab_free_count will hold a value larger than the actual number of free gref entries. If a guest is heavily utilizing improperly initialized v1 grant tables, memory corruption can occur. One common manifestation is corruption of the vmalloc list, resulting in a poisoned pointer derefrence when accessing /proc/meminfo or /proc/vmallocinfo: [ 40.770064] BUG: unable to handle kernel paging request at 0000200200001407 [ 40.770083] IP: [<ffffffff811a6fb0>] get_vmalloc_info+0x70/0x110 [ 40.770102] PGD 0 [ 40.770107] Oops: 0000 [#1] SMP [ 40.770114] CPU 10 This patch introduces a static variable, grefs_per_grant_frame, to cache the calculated value. gnttab_init() now calls gnttab_request_version() early so that grant_table_version and grefs_per_grant_frame can be appropriately set. A few BUG_ON()s have been added to prevent this type of bug from reoccurring in the future. Signed-off-by: Matt Wilson <msw@amazon.com> Reviewed-and-Tested-by: Steven Noonan <snoonan@amazon.com> Acked-by: Ian Campbell <Ian.Campbell@citrix.com> Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Cc: Annie Li <annie.li@oracle.com> Cc: xen-devel@lists.xen.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # v3.3 and newer Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 15 January 2013, 20:56:55 UTC |
| 6337a23 | Yang Zhang | 22 November 2012, 02:20:23 UTC | x86/xen : Fix the wrong check in pciback Fix the wrong check in pciback. Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 15 January 2013, 20:56:48 UTC |
| 72d0ac0 | Will Deacon | 14 January 2013, 14:45:46 UTC | arm64: compat: add syscall table entries for new syscalls There have been a number of new syscalls introduced to arch/arm/ since the compat layer was implemented for arm64, so add pointers to the relevant functions to the compat syscall table. Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> | 15 January 2013, 17:15:16 UTC |
| 5f0839c | Jerome Glisse | 11 January 2013, 20:19:43 UTC | drm/radeon: improve semaphore debugging on lockup Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> | 15 January 2013, 14:07:13 UTC |
| c18b117 | Marek Olšák | 12 January 2013, 03:19:37 UTC | drm/radeon: allow FP16 color clear registers on r500 Probably not a candidate for stable kernels because of conflicts in DRM versioning. Signed-off-by: Marek Olšák <maraeo@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> | 15 January 2013, 14:07:12 UTC |
| 19fc42e | Alex Deucher | 14 January 2013, 16:04:39 UTC | drm/radeon: clear reset flags if engines are idle Fixes a hard lock in the gpu reset code after the rework for DMA support (0ecebb9e0d14e9948e0b1529883a776758117d6f "drm/radeon: switch to a finer grained reset for evergreen") due to not bailing before the MC shutdown if the relevant engines are idle. Discussion: http://lists.freedesktop.org/archives/dri-devel/2013-January/032985.html Reported-by: Eldad Zack <eldad@fogrefinery.com> Tested-by: Eldad Zack <eldad@fogrefinery.com> Acked-by: Paul Menzel <paulepanter@users.sourceforge.net> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> | 15 January 2013, 14:06:38 UTC |
| 6f54c36 | Takashi Iwai | 15 January 2013, 13:44:41 UTC | ALSA: hda/hdmi - Work around "alsactl restore" errors When "alsactl restore" is performed on HDMI codecs, it tries to restore the channel map value since the channel map controls are writable. But hdmi_chmap_ctl_put() returns -EBADFD when no PCM stream is assigned yet, and this results in an error message from alsactl. Although the error is harmless, it's certainly ugly and can be regarded as a regression. As a workaround, this patch changes the return code in such a case to be zero for making others happy. (A slight excuse is: when the chmap is changed through the proper alsa-lib API, the PCM status is checked there anyway, so we don't have to be too strict in the kernel side.) Cc: <stable@vger.kernel.org> [v3.7+] Signed-off-by: Takashi Iwai <tiwai@suse.de> | 15 January 2013, 13:55:16 UTC |
| 8aef33a | Daniel Lezcano | 15 January 2013, 13:18:04 UTC | cpuidle: remove the power_specified field in the driver We realized that the power usage field is never filled and when it is filled for tegra, the power_specified flag is not set causing all of these values to be reset when the driver is initialized with set_power_state(). However, the power_specified flag can be simply removed under the assumption that the states are always backward sorted, which is the case with the current code. This change allows the menu governor select function and the cpuidle_play_dead() to be simplified. Moreover, the set_power_states() function can removed as it does not make sense any more. Drop the power_specified flag from struct cpuidle_driver and make the related changes as described above. As a consequence, this also fixes the bug where on the dynamic C-states system, the power fields are not initialized. [rjw: Changelog] References: https://bugzilla.kernel.org/show_bug.cgi?id=42870 References: https://bugzilla.kernel.org/show_bug.cgi?id=43349 References: https://lkml.org/lkml/2012/10/16/518 Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 15 January 2013, 13:18:04 UTC |
| 0f3b684 | Chris Wilson | 15 January 2013, 12:05:55 UTC | drm/i915: Record DERRMR, FORCEWAKE and RING_CTL in error-state These are useful for investigating hangs involving WAIT_FOR_EVENT. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> [danvet: Apply a droplet of Future-Proof in the if-ladder.] Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> | 15 January 2013, 12:34:57 UTC |
| 2e4c4db | Takashi Iwai | 15 January 2013, 06:51:25 UTC | Merge tag 'asoc-atmel-pinctrl' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: atmel: Fixes for pinctrl Due to a series of problems with the handling of Atmel, a combination of making changes that make other branches instantly buggy and a general failure to deal with the resulting issues effectively, v3.8 Atmel audio currently won't work at all for DT boards without adding pinctrl definitions and a request for those. | 15 January 2013, 06:51:25 UTC |
| 406089d | Linus Torvalds | 15 January 2013, 04:22:16 UTC | Merge tag 'trace-3.8-rc3-regression-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing regression fixes from Steven Rostedt: "The clean up patch commit 0fb9656d957d "tracing: Make tracing_enabled be equal to tracing_on" caused two regressions. 1) The irqs off latency tracer no longer starts if tracing_on is off when the tracer is set, and then tracing_on is enabled. The tracing_on file needs the hook that tracing_enabled had to enable tracers if they request it (call the tracer's start() method). 2) That commit had a separate change that really should have been a separate patch, but it must have been added accidently with the -a option of git commit. But as the change is still related to the commit it wasn't noticed in review. That change, changed the way blocking is done by the trace_pipe file with respect to the tracing_on settings. I've been told that this change breaks current userspace, and this specific change is being reverted." * tag 'trace-3.8-rc3-regression-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Fix regression of trace_pipe tracing: Fix regression with irqsoff tracer and tracing_on file | 15 January 2013, 04:22:16 UTC |
| 7dea1ff | Linus Torvalds | 15 January 2013, 04:20:44 UTC | Merge tag 'regmap-debugfs-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap debugfs optimisation fixes from Mark Brown: "The debugfs optimisations merged in v3.8 weren't my finest hour, there were a number of cases that the more complex algorithm made worse especially around the error handling. This patch series should address those issues." * tag 'regmap-debugfs-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: debugfs: Make sure we store the last entry in the offset cache regmap: debugfs: Ensure a correct return value for empty caches regmap: debugfs: Discard the cache if we fail to allocate an entry regmap: debugfs: Fix check for block start in cached seeks regmap: debugfs: Fix attempts to read nonexistant register blocks | 15 January 2013, 04:20:44 UTC |
| 2ac1e66 | Linus Torvalds | 15 January 2013, 04:20:03 UTC | Merge tag 'regulator-3.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A few fixes for the regulator subsystems, a few driver specific things plus a fix for the interaction between regultor_can_change_voltage() and continuous voltage ranges both of which were added for this release." * tag 'regulator-3.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: max8998: Ensure enough delay time for max8998_set_voltage_buck_time_sel regulator: max8998: Use uV in voltage_map_desc regulator: max8997: Use uV in voltage_map_desc regulator: core: Fix comment for regulator_register() regulator: core: Fix continuous_voltage_range case in regulator_can_change_voltage regulator: s5m8767: Fix probe failure due to stack corruption | 15 January 2013, 04:20:03 UTC |
| e3d5b2f | Mark Brown | 15 January 2013, 00:38:59 UTC | Merge remote-tracking branch 'regulator/fix/s5m8767' into tmp | 15 January 2013, 00:38:59 UTC |
| 3ab91da | Mark Brown | 15 January 2013, 00:38:56 UTC | Merge remote-tracking branch 'regulator/fix/max8998' into tmp | 15 January 2013, 00:38:56 UTC |
| c631846 | Mark Brown | 15 January 2013, 00:38:51 UTC | Merge remote-tracking branch 'regulator/fix/max8997' into tmp | 15 January 2013, 00:38:51 UTC |
| a1ed63f | Mark Brown | 15 January 2013, 00:38:27 UTC | Merge remote-tracking branch 'regulator/fix/core' into tmp | 15 January 2013, 00:38:27 UTC |
| 1b1baff | Namjae Jeon | 14 January 2013, 21:53:47 UTC | UDF: Fix a null pointer dereference in udf_sb_free_partitions This patch fixes a regression caused by commit bff943af6fe "udf: Fix memory leak when mounting" due to which it was triggering a kernel null point dereference in case of interrupted mount OR when allocating memory to sbi->s_partmaps failed in function udf_sb_alloc_partition_maps. Reported-and-tested-by: James Hogan <james@albanarts.com> Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com> Signed-off-by: Ashish Sangwan <a.sangwan@samsung.com> Signed-off-by: Jan Kara <jack@suse.cz> | 14 January 2013, 21:53:47 UTC |
| 7e2fb2d | Eric Sandeen | 18 December 2012, 17:03:57 UTC | jbd: don't wake kjournald unnecessarily Don't send an extra wakeup to kjournald in the case where we already have the proper target in j_commit_request, i.e. that commit has already been requested for commit. commit d9b0193 "jbd: fix fsync() tid wraparound bug" changed the logic leading to a wakeup, but it caused some extra wakeups which were found to lead to a measurable performance regression. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Signed-off-by: Jan Kara <jack@suse.cz> | 14 January 2013, 21:50:45 UTC |
| 3152ba0 | Linus Torvalds | 14 January 2013, 21:19:08 UTC | Merge tag 'dt-fixes-for-3.8' of git://sources.calxeda.com/kernel/linux Pull devicetree fixes from Rob Herring: "Two fixes to prevent unconditional re-compile of dts files on arm and arm64." * tag 'dt-fixes-for-3.8' of git://sources.calxeda.com/kernel/linux: ARM: dts: prevent *.dtb from always being rebuilt arm64: dts: prevent *.dtb from always being rebuilt | 14 January 2013, 21:19:08 UTC |
| 6d283db | Linus Torvalds | 14 January 2013, 21:17:50 UTC | vfs: add missing virtual cache flush after editing partial pages Andrew Morton pointed this out a month ago, and then I completely forgot about it. If we read a partial last page of a block device, we will zero out the end of the page, but since that page can then be mapped into user space, we should also make sure to flush the cache on architectures that have virtual caches. We have the flush_dcache_page() function for this, so use it. Now, in practice this really never matters, because nobody sane uses virtual caches to begin with, and they largely exist on old broken RISC arhitectures. And even if you did run on one of those obsolete CPU's, the whole "mmap and access the last partial page of a block device" behavior probably doesn't actually exist. The normal IO functions (read/write) will never see the zeroed-out part of the page that migth not be coherent in the cache, because they honor the size of the device. So I'm marking this for stable (3.7 only), but I'm not sure anybody will ever care. Pointed-out-by: Andrew Morton <akpm@linux-foundation.org> Cc: stable@vger.kernel.org # 3.7 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 14 January 2013, 21:17:50 UTC |
| 9bbcbad | Linus Torvalds | 14 January 2013, 18:56:05 UTC | Merge tag 'sound-3.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Most of commits found here are for ASoC device specific fixes, arizona, cs4271, wm5102, wm2200, etc, in addition to a couple of memory leak fixes in ASoC core. Other than that, regression fixes in HD-audio and USB-audio, and a fix for new Realtek codecs." * tag 'sound-3.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (30 commits) ALSA: usb-audio: Fix NULL dereference by access to non-existing substream ALSA: hda - Add support of new codec ALC284 ALSA: usb-audio: Make ebox44_table static ALSA: hdspm - Fix wordclock status on AES32 Revert "ALSA: hda - Shut up pins at power-saving mode with Conexnat codecs" ALSA: hda - Disable runtime D3 for Intel CPT & co ALSA: pxa27x: fix ac97 warm reset ALSA: pxa27x: fix ac97 cold reset ASoC: wm_adsp: Ensure that block writes are from DMA aligned addresses ASoC: wm2000: Fix sense of speech clarity enable ASoC: wm5100: Remove DSP B and left justified formats ASoC: arizona: Remove DSP B and left justified AIF modes ASoC: wm2200: Remove DSP B and left justified AIF modes ASoC: wm5102: Improve speaker enable performance ASoC: core: fix the memory leak in case of remove_aux_dev() ASoC: core: fix the memory leak in case of device_add() failure ASoC: cs42l52: Catch no-match case in cs42l52_get_clk ASoC: lm49453: Update lm49453_reg_defs values as per LM49453 HW revision-B ASoC: lm49453: Fix adc, mic and sidetone volume ranges ASoC: arizona: Correct FLL source definitions ... | 14 January 2013, 18:56:05 UTC |
