d9e179e | Paulius Zaleckas | 06 March 2012, 22:25:14 UTC | bridge: br_log_state() s/entering/entered/ When br_log_state() is reporting state it should say "entered" istead of "entering" since state at this point is already changed. Signed-off-by: Paulius Zaleckas <paulius.zaleckas@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 March 2012, 08:25:25 UTC |
09c1d44 | Eric Dumazet | 06 March 2012, 19:46:41 UTC | ehea: restore multicast and rx_errors fields Commit 239c562c94d (ehea: Add 64bit statistics) added a regression, since we no longer report multicast & rx_errors fields, taken from port->stats structure. These fields are updated in ehea_update_stats() every second. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Anton Blanchard <anton@samba.org> Cc: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com> Acked-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com> Tested-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 March 2012, 08:23:04 UTC |
9259c48 | David S. Miller | 08 March 2012, 06:49:01 UTC | Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jesse/openvswitch | 08 March 2012, 06:49:01 UTC |
81e5d41 | Jesse Gross | 06 March 2012, 23:05:46 UTC | openvswitch: Fix checksum update for actions on UDP packets. When modifying IP addresses or ports on a UDP packet we don't correctly follow the rules for unchecksummed packets. This meant that packets without a checksum can be given a incorrect new checksum and packets with a checksum can become marked as being unchecksummed. This fixes it to handle those requirements. Signed-off-by: Jesse Gross <jesse@nicira.com> | 07 March 2012, 22:36:57 UTC |
d47775c | David S. Miller | 07 March 2012, 20:34:42 UTC | Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless | 07 March 2012, 20:34:42 UTC |
4f262ac | Linus Torvalds | 07 March 2012, 16:33:03 UTC | Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm Pull ARM updates from Russell King. * 'fixes' of git://git.linaro.org/people/rmk/linux-arm: ARM: 7358/1: perf: add PMU hotplug notifier ARM: 7357/1: perf: fix overflow handling for xscale2 PMUs ARM: 7356/1: perf: check that we have an event in the PMU IRQ handlers ARM: 7355/1: perf: clear overflow flag when disabling counter on ARMv7 PMU ARM: 7354/1: perf: limit sample_period to half max_period in non-sampling mode ARM: ecard: ensure fake vma vm_flags is setup ARM: 7346/1: errata: fix PL310 erratum #753970 workaround selection ARM: 7345/1: errata: update workaround for A9 erratum #743622 ARM: 7348/1: arm/spear600: fix one-shot timer ARM: 7339/1: amba/serial.h: Include types.h for resolving dependency of type bool | 07 March 2012, 16:33:03 UTC |
d09b3c9 | Linus Torvalds | 07 March 2012, 16:31:31 UTC | Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "Just a few driver fixups, nothing exciting." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: wacom - fix 3rd-gen Bamboo MT when 4+ fingers are in use Input: twl4030-vibra - use proper guard for PM methods Input: evdev - fix variable initialisation Input: wacom - add missing LEDS_CLASS to Kconfig Input: ALPS - fix touchpad detection when buttons are pressed | 07 March 2012, 16:31:31 UTC |
4293f20 | Linus Torvalds | 07 March 2012, 16:21:19 UTC | Revert "CPU hotplug, cpusets, suspend: Don't touch cpusets during suspend/resume" This reverts commit 8f2f748b0656257153bcf0941df8d6060acc5ca6. It causes some odd regression that we have not figured out, and it's too late in the -rc series to try to figure it out now. As reported by Konstantin Khlebnikov, it causes consistent hangs on his laptop (Thinkpad x220: 2x cores + HT). They can be avoided by adding calls to "rebuild_sched_domains();" in cpuset_cpu_[in]active() for the CPU_{ONLINE/DOWN_FAILED/DOWN_PREPARE}_FROZEN cases, but it's not at all clear why, and it makes no sense. Konstantin's config doesn't even have CONFIG_CPUSETS enabled, just to make things even more interesting. So it's not the cpusets, it's just the scheduling domains. So until this is understood, revert. Bisected-reported-and-tested-by: Konstantin Khlebnikov <khlebnikov@openvz.org> Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Acked-by: Ingo Molnar <mingo@elte.hu> Acked-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 07 March 2012, 16:21:19 UTC |
a0feb6d | Lorenzo Pieralisi | 06 March 2012, 16:37:45 UTC | ARM: 7358/1: perf: add PMU hotplug notifier When a CPU is taken out of reset, either cold booted or hotplugged in, some of its PMU registers can contain UNKNOWN values. This patch adds a hotplug notifier to ARM core perf code so that upon CPU restart the PMU unit is reset and becomes ready to use again. Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> | 07 March 2012, 09:40:50 UTC |
3f31ae1 | Will Deacon | 06 March 2012, 16:35:55 UTC | ARM: 7357/1: perf: fix overflow handling for xscale2 PMUs xscale2 PMUs indicate overflow not via the PMU control register, but by a separate overflow FLAG register instead. This patch fixes the xscale2 PMU code to use this register to detect to overflow and ensures that we clear any pending overflow when disabling a counter. Cc: <stable@vger.kernel.org> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> | 07 March 2012, 09:40:49 UTC |
f6f5a30 | Will Deacon | 06 March 2012, 16:34:50 UTC | ARM: 7356/1: perf: check that we have an event in the PMU IRQ handlers The PMU IRQ handlers in perf assume that if a counter has overflowed then perf must be responsible. In the paranoid world of crazy hardware, this could be false, so check that we do have a valid event before attempting to dereference NULL in the interrupt path. Cc: <stable@vger.kernel.org> Signed-off-by: Ming Lei <tom.leiming@gmail.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> | 07 March 2012, 09:40:49 UTC |
99c1745 | Will Deacon | 06 March 2012, 16:34:22 UTC | ARM: 7355/1: perf: clear overflow flag when disabling counter on ARMv7 PMU When disabling a counter on an ARMv7 PMU, we should also clear the overflow flag in case an overflow occurred whilst stopping the counter. This prevents a spurious overflow being picked up later and leading to either false accounting or a NULL dereference. Cc: <stable@vger.kernel.org> Reported-by: Ming Lei <tom.leiming@gmail.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> | 07 March 2012, 09:40:49 UTC |
5727347 | Will Deacon | 06 March 2012, 16:33:17 UTC | ARM: 7354/1: perf: limit sample_period to half max_period in non-sampling mode On ARM, the PMU does not stop counting after an overflow and therefore IRQ latency affects the new counter value read by the kernel. This is significant for non-sampling runs where it is possible for the new value to overtake the previous one, causing the delta to be out by up to max_period events. Commit a737823d ("ARM: 6835/1: perf: ensure overflows aren't missed due to IRQ latency") attempted to fix this problem by allowing interrupt handlers to pass an overflow flag to the event update function, causing the overflow calculation to assume that the counter passed through zero when going from prev to new. Unfortunately, this doesn't work when overflow occurs on the perf_task_tick path because we have the flag cleared and end up computing a large negative delta. This patch removes the overflow flag from armpmu_event_update and instead limits the sample_period to half of the max_period for non-sampling profiling runs. Cc: <stable@vger.kernel.org> Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> | 07 March 2012, 09:40:48 UTC |
19d57d3 | Jason Gerecke | 06 March 2012, 18:19:19 UTC | Input: wacom - fix 3rd-gen Bamboo MT when 4+ fingers are in use The message count field uses three bits of storage, not two. Signed-off-by: Jason Gerecke <killertofu@gmail.com> Acked-by: Chris Bagwell <chris@cnpbagwell.com> Signed-off-by: Dmitry Torokhov <dtor@mail.ru> | 07 March 2012, 08:45:26 UTC |
dac12d1 | Linus Torvalds | 07 March 2012, 06:31:08 UTC | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) TCP can chop up SACK'd SKBs below below the unacked send sequence and that breaks lots of stuff. Fix from Neal Cardwell. 2) There is code in ipv6 to properly join and leave the all-routers multicast code when the forwarding setting is changed, but once forwarding is turned on, we don't do the join for newly registered devices. Fix from Li Wei. 3) Netfilter's NAT module autoload in ctnetlink drops a spinlock around a sleeping call, problem is this code path doesn't actually hold that lock. Fix from Pablo Neira Ayuso. 4) TG3 uses the wrong interfaces to hook into the new byte queue limit support. It uses the device level interfaces, which is fine for single queue devices, but on more recent chips this driver supports multiqueue so we have to use the multiqueue BQL APIs. Fix from Tom Herbert. 5) r8169 resume fix from Francois Romieu. 6) Add some cxgb4 device IDs, from Vipul Pandya. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: IPv6: Fix not join all-router mcast group when forwarding set. caif-hsi: Set default MTU to 4096 cxgb4vf: Add support for Chelsio's T480-CR and T440-LP-CR adapters cxgb4: Add support for Chelsio's T480-CR and T440-LP-CR adapters mlx4_core: remove buggy sched_queue masking netfilter: nf_conntrack: fix early_drop with reliable event delivery bridge: netfilter: don't call iptables on vlan packets if sysctl is off netfilter: bridge: fix wrong pointer dereference netfilter: ctnetlink: remove incorrect spin_[un]lock_bh on NAT module autoload netfilter: ebtables: fix wrong name length while copying to user-space r8169: runtime resume before shutdown. tcp: fix tcp_shift_skb_data() to not shift SACKed data below snd_una tg3: Fix to use multi queue BQL interfaces | 07 March 2012, 06:31:08 UTC |
55062d0 | Linus Torvalds | 07 March 2012, 02:48:13 UTC | x86: fix typo in recent find_vma_prev purge It turns out that test-compiling this file on x86-64 doesn't really help, because much of it is x86-32-specific. And so I hadn't noticed the slightly over-eager removal of the 'r' from 'addr' variable despite thinking I had tested it. Signed-off-by: Linus "oopsie" Torvalds <torvalds@linux-foundation.org> | 07 March 2012, 02:48:13 UTC |
097d591 | Linus Torvalds | 07 March 2012, 02:23:36 UTC | vm: avoid using find_vma_prev() unnecessarily Several users of "find_vma_prev()" were not in fact interested in the previous vma if there was no primary vma to be found either. And in those cases, we're much better off just using the regular "find_vma()", and then "prev" can be looked up by just checking vma->vm_prev. The find_vma_prev() semantics are fairly subtle (see Mikulas' recent commit 83cd904d271b: "mm: fix find_vma_prev"), and the whole "return prev by reference" means that it generates worse code too. Thus this "let's avoid using this inconvenient and clearly too subtle interface when we don't really have to" patch. Cc: Mikulas Patocka <mpatocka@redhat.com> Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 07 March 2012, 02:23:36 UTC |
71fece9 | Linus Torvalds | 07 March 2012, 00:55:50 UTC | Merge git://git.samba.org/sfrench/cifs-2.6 Pull CIFS fixes from Steve French * git://git.samba.org/sfrench/cifs-2.6: cifs: fix dentry refcount leak when opening a FIFO on lookup CIFS: Fix mkdir/rmdir bug for the non-POSIX case | 07 March 2012, 00:55:50 UTC |
83cd904 | Mikulas Patocka | 05 March 2012, 00:52:03 UTC | mm: fix find_vma_prev Commit 6bd4837de96e ("mm: simplify find_vma_prev()") broke memory management on PA-RISC. After application of the patch, programs that allocate big arrays on the stack crash with segfault, for example, this will crash if compiled without optimization: int main() { char array[200000]; array[199999] = 0; return 0; } The reason is that PA-RISC has up-growing stack and the stack is usually the last memory area. In the above example, a page fault happens above the stack. Previously, if we passed too high address to find_vma_prev, it returned NULL and stored the last VMA in *pprev. After "simplify find_vma_prev" change, it stores NULL in *pprev. Consequently, the stack area is not found and it is not expanded, as it used to be before the change. This patch restores the old behavior and makes it return the last VMA in *pprev if the requested address is higher than address of any other VMA. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 07 March 2012, 00:48:03 UTC |
52abb70 | Thomas Gleixner | 06 March 2012, 22:18:54 UTC | genirq: Clear action->thread_mask if IRQ_ONESHOT is not set Xommit ac5637611(genirq: Unmask oneshot irqs when thread was not woken) fails to unmask when a !IRQ_ONESHOT threaded handler is handled by handle_level_irq. This happens because thread_mask is or'ed unconditionally in irq_wake_thread(), but for !IRQ_ONESHOT interrupts never cleared. So the check for !desc->thread_active fails and keeps the interrupt disabled. Keep the thread_mask zero for !IRQ_ONESHOT interrupts. Document the thread_mask magic while at it. Reported-and-tested-by: Sven Joachim <svenjoac@gmx.de> Reported-and-tested-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> Cc: stable@vger.kernel.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 07 March 2012, 00:46:39 UTC |
651a68e | Ben Pfaff | 06 March 2012, 23:04:04 UTC | openvswitch: Honor dp_ifindex, when specified, for vport lookup by name. When OVS_VPORT_ATTR_NAME is specified and dp_ifindex is nonzero, the logical behavior would be for the vport name lookup scope to be limited to the specified datapath, but in fact the dp_ifindex value was ignored. This commit causes the search scope to be honored. Signed-off-by: Ben Pfaff <blp@nicira.com> Signed-off-by: Jesse Gross <jesse@nicira.com> | 06 March 2012, 23:04:04 UTC |
d6ddef9 | Li Wei | 05 March 2012, 14:45:17 UTC | IPv6: Fix not join all-router mcast group when forwarding set. When forwarding was set and a new net device is register, we need add this device to the all-router mcast group. Signed-off-by: Li Wei <lw@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 21:58:47 UTC |
ce8fea7 | Hugh Dickins | 06 March 2012, 20:28:52 UTC | mmap: EINVAL not ENOMEM when rejecting VM_GROWS Currently error is -ENOMEM when rejecting VM_GROWSDOWN|VM_GROWSUP from shared anonymous: hoist the file case's -EINVAL up for both. Signed-off-by: Hugh Dickins <hughd@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 06 March 2012, 21:49:08 UTC |
34efc28 | Sjur Brændeland | 04 March 2012, 08:38:58 UTC | caif-hsi: Set default MTU to 4096 Default MTU for CAIF HSI was wrongly set to 15 * 4092 bytes. The patch sets default MTU size to 4096. Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 21:27:45 UTC |
79421b4 | Vipul Pandya | 05 March 2012, 22:56:37 UTC | cxgb4vf: Add support for Chelsio's T480-CR and T440-LP-CR adapters This patch adds PCI device ids for Chelsio's T480-CR and T440-LP-CR adapters. Signed-off-by: Vipul Pandya <vipul@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 21:21:17 UTC |
f637d57 | Vipul Pandya | 05 March 2012, 22:56:36 UTC | cxgb4: Add support for Chelsio's T480-CR and T440-LP-CR adapters This patch adds PCI device ids for Chelsio's T480-CR and T440-LP-CR adapters. Signed-off-by: Vipul Pandya <vipul@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 21:21:17 UTC |
1d4526e | Yevgeny Petrilin | 06 March 2012, 03:05:14 UTC | mlx4_core: remove buggy sched_queue masking Fixes a bug introduced by commit fe9a2603c, where the priority bits in the schedule queue field were masked out. Signed-off-by: Amir Vadai <amirv@mellanox.co.il> Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 19:43:50 UTC |
7413851 | Pablo Neira Ayuso | 06 March 2012, 01:22:55 UTC | netfilter: nf_conntrack: fix early_drop with reliable event delivery If reliable event delivery is enabled and ctnetlink fails to deliver the destroy event in early_drop, the conntrack subsystem cannot drop any the candidate flow that was planned to be evicted. Reported-by: Kerin Millar <kerframil@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 19:43:50 UTC |
739e450 | Florian Westphal | 06 March 2012, 01:22:54 UTC | bridge: netfilter: don't call iptables on vlan packets if sysctl is off When net.bridge.bridge-nf-filter-vlan-tagged is 0 (default), vlan packets arriving should not be sent to ip(6)tables by bridge netfilter. However, it turns out that we currently always send VLAN packets to netfilter, if .. a), CONFIG_VLAN_8021Q is enabled ; or b), CONFIG_VLAN_8021Q is not set but rx vlan offload is enabled on the bridge port. This is because bridge netfilter treats skb with skb->protocol == ETH_P_IP{V6} as "non-vlan packet". With rx vlan offload on or CONFIG_VLAN_8021Q=y, the vlan header has already been removed here, and we cannot rely on skb->protocol alone. Fix this by only using skb->protocol if the skb has no vlan tag, or if a vlan tag is present and filter-vlan-tagged bridge netfilter sysctl is enabled. We cannot remove the skb->protocol == htons(ETH_P_8021Q) test because the vlan tag is still around in the CONFIG_VLAN_8021Q=n && "ethtool -K $itf rxvlan off" case. reproducer: iptables -t raw -I PREROUTING -i br0 iptables -t raw -I PREROUTING -i br0.1 Then send packets to an ip address configured on br0.1 interface. Even with net.bridge.bridge-nf-filter-vlan-tagged=0, the 1st rule will match instead of the 2nd one. With this patch applied, the 2nd rule will match instead. In the non-local address case, netfilter won't be consulted after this patch unless the sysctl is switched on. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 19:43:49 UTC |
a157b9d | Pablo Neira Ayuso | 06 March 2012, 01:22:53 UTC | netfilter: bridge: fix wrong pointer dereference In adf7ff8, a invalid dereference was added in ebt_make_names. CC [M] net/bridge/netfilter/ebtables.o net/bridge/netfilter/ebtables.c: In function `ebt_make_names': net/bridge/netfilter/ebtables.c:1371:20: warning: `t' may be used uninitialized in this function [-Wuninitialized] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 19:43:49 UTC |
8be619d | Pablo Neira Ayuso | 06 March 2012, 01:22:51 UTC | netfilter: ctnetlink: remove incorrect spin_[un]lock_bh on NAT module autoload Since 7d367e0, ctnetlink_new_conntrack is called without holding the nf_conntrack_lock spinlock. Thus, ctnetlink_parse_nat_setup does not require to release that spinlock anymore in the NAT module autoload case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 19:43:49 UTC |
848edc6 | Santosh Nayak | 06 March 2012, 01:22:50 UTC | netfilter: ebtables: fix wrong name length while copying to user-space user-space ebtables expects 32 bytes-long names, but xt_match names use 29 bytes. We have to copy less 29 bytes and then, make sure we fill the remaining bytes with zeroes. Signed-off-by: Santosh Nayak <santoshprasadnayak@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 19:43:49 UTC |
2a15cd2 | françois romieu | 06 March 2012, 01:14:12 UTC | r8169: runtime resume before shutdown. With runtime PM, if the ethernet cable is disconnected, the device is transitioned to D3 state to conserve energy. If the system is shutdown in this state, any register accesses in rtl_shutdown are dropped on the floor. As the device was programmed by .runtime_suspend() to wake on link changes, it is thus brought back up as soon as the link recovers. Resuming every suspended device through the driver core would slow things down and it is not clear how many devices really need it now. Original report and D0 transition patch by Sameer Nanda. Patch has been changed to comply with advices by Rafael J. Wysocki and the PM folks. Reported-by: Sameer Nanda <snanda@chromium.org> Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: Rafael J. Wysocki <rjw@sisk.pl> Cc: Hayes Wang <hayeswang@realtek.com> Cc: Alan Stern <stern@rowland.harvard.edu> Acked-by: Rafael J. Wysocki <rjw@sisk.pl> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 19:43:49 UTC |
4648dc9 | Neal Cardwell | 05 March 2012, 19:35:04 UTC | tcp: fix tcp_shift_skb_data() to not shift SACKed data below snd_una This commit fixes tcp_shift_skb_data() so that it does not shift SACKed data below snd_una. This fixes an issue whose symptoms exactly match reports showing tp->sacked_out going negative since 3.3.0-rc4 (see "WARNING: at net/ipv4/tcp_input.c:3418" thread on netdev). Since 2008 (832d11c5cd076abc0aa1eaf7be96c81d1a59ce41) tcp_shift_skb_data() had been shifting SACKed ranges that were below snd_una. It checked that the *end* of the skb it was about to shift from was above snd_una, but did not check that the end of the actual shifted range was above snd_una; this commit adds that check. Shifting SACKed ranges below snd_una is problematic because for such ranges tcp_sacktag_one() short-circuits: it does not declare anything as SACKed and does not increase sacked_out. Before the fixes in commits cc9a672ee522d4805495b98680f4a3db5d0a0af9 and daef52bab1fd26e24e8e9578f8fb33ba1d0cb412, shifting SACKed ranges below snd_una happened to work because tcp_shifted_skb() was always (incorrectly) passing in to tcp_sacktag_one() an skb whose end_seq tcp_shift_skb_data() had already guaranteed was beyond snd_una. Hence tcp_sacktag_one() never short-circuited and always increased tp->sacked_out in this case. After those two fixes, my testing has verified that shifting SACKed ranges below snd_una could cause tp->sacked_out to go negative with the following sequence of events: (1) tcp_shift_skb_data() sees an skb whose end_seq is beyond snd_una, then shifts a prefix of that skb that is below snd_una (2) tcp_shifted_skb() increments the packet count of the already-SACKed prev sk_buff (3) tcp_sacktag_one() sees the end of the new SACKed range is below snd_una, so it short-circuits and doesn't increase tp->sacked_out (5) tcp_clean_rtx_queue() sees the SACKed skb has been ACKed, decrements tp->sacked_out by this "inflated" pcount that was missing a matching increase in tp->sacked_out, and hence tp->sacked_out underflows to a u32 like 0xFFFFFFFF, which casted to s32 is negative. (6) this leads to the warnings seen in the recent "WARNING: at net/ipv4/tcp_input.c:3418" thread on the netdev list; e.g.: tcp_input.c:3418 WARN_ON((int)tp->sacked_out < 0); More generally, I think this bug can be tickled in some cases where two or more ACKs from the receiver are lost and then a DSACK arrives that is immediately above an existing SACKed skb in the write queue. This fix changes tcp_shift_skb_data() to abort this sequence at step (1) in the scenario above by noticing that the bytes are below snd_una and not shifting them. Signed-off-by: Neal Cardwell <ncardwell@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 19:43:49 UTC |
7f466cf | John W. Linville | 06 March 2012, 19:16:48 UTC | Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem | 06 March 2012, 19:16:48 UTC |
917ec63 | Linus Torvalds | 06 March 2012, 17:10:31 UTC | Merge tag 'fixes-3.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull arm-soc bug fixes from Arnd Bergmann: "Here are all the fixes I got after sending the last pull request. These fix mostly regressions on exynos, at91, pxa and ep93xx. Signed-off-by: Arnd Bergmann <arnd@arndb.de>" * tag 'fixes-3.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: ep93xx: convert vision_ep9307 to MULTI_IRQ_HANDLER ARM: EXYNOS: fix touchscreen IRQ setup on Universal C210 board ARM: pxa: fix invalid mfp pin issue ARM: pxa: remove duplicated registeration on pxa-gpio ARM: pxa: add dummy clock for pxa25x and pxa27x ARM: S3C24XX: DMA resume regression fix ARM: S3C24XX: Fix restart on S3C2442 ARM: SAMSUNG: Fix memory size for hsotg ARM: at91/dma: DMA controller registering with DT support ARM: at91/dma: remove platform data from DMA controller | 06 March 2012, 17:10:31 UTC |
4704fe6 | Linus Torvalds | 06 March 2012, 16:24:15 UTC | Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 regression fix from Martin Schwidefsky: "It is a fix for a regression that has been introduced with git commit 25f269f17316 - "[S390] qdio: EQBS retry after CCQ 96" - and if possible we would like to have working code for the fcp data router in 3.3." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: [S390] qdio: fix handler function arguments for zfcp data router | 06 March 2012, 16:24:15 UTC |
1de9d14 | Linus Torvalds | 06 March 2012, 16:23:30 UTC | Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "A simple fix that's obvious from inspection. There's no mainline users of this driver yet (there's some i.MX platforms which will use it)." * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: Fix mask parameter in da9052_reg_update calls | 06 March 2012, 16:23:30 UTC |
5756b76 | Jan Beulich | 05 March 2012, 16:49:24 UTC | vsprintf: make %pV handling compatible with kasprintf() kasprintf() (and potentially other functions that I didn't run across so far) want to evaluate argument lists twice. Caring to do so for the primary list is obviously their job, but they can't reasonably be expected to check the format string for instances of %pV, which however need special handling too: On architectures like x86-64 (as opposed to e.g. ix86), using the same argument list twice doesn't produce the expected results, as an internally managed cursor gets updated during the first run. Fix the problem by always acting on a copy of the original list when handling %pV. Signed-off-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 06 March 2012, 16:22:26 UTC |
c09ff08 | Hugh Dickins | 06 March 2012, 04:52:55 UTC | page_cgroup: fix horrid swap accounting regression Why is memcg's swap accounting so broken? Insane counts, wrong ownership, unfreeable structures, which later get freed and then accessed after free. Turns out to be a tiny a little 3.3-rc1 regression in 9fb4b7cc0724 "page_cgroup: add helper function to get swap_cgroup": the helper function (actually named lookup_swap_cgroup()) returns an address using void* arithmetic, but the structure in question is a short. Signed-off-by: Hugh Dickins <hughd@google.com> Reviewed-by: Bob Liu <lliubbo@gmail.com> Cc: Michal Hocko <mhocko@suse.cz> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Johannes Weiner <jweiner@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 06 March 2012, 16:18:23 UTC |
6b60805 | Arnd Bergmann | 06 March 2012, 16:12:13 UTC | Merge branch 'fixes' of git://github.com/hzhuang1/linux into fixes * 'fixes' of git://github.com/hzhuang1/linux: (3 commits) ARM: pxa: fix invalid mfp pin issue ARM: pxa: remove duplicated registeration on pxa-gpio ARM: pxa: add dummy clock for pxa25x and pxa27x Includes an update to v3.3-rc6 | 06 March 2012, 16:12:26 UTC |
4c75aab | Arnd Bergmann | 06 March 2012, 16:11:56 UTC | Merge branch 'v3.3-samsung-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes * 'v3.3-samsung-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: EXYNOS: fix touchscreen IRQ setup on Universal C210 board ARM: S3C24XX: DMA resume regression fix ARM: S3C24XX: Fix restart on S3C2442 ARM: SAMSUNG: Fix memory size for hsotg | 06 March 2012, 16:11:56 UTC |
1dbd02e | H Hartley Sweeten | 02 March 2012, 00:13:59 UTC | ARM: ep93xx: convert vision_ep9307 to MULTI_IRQ_HANDLER As done for the other ep93xx machines in: commit 9a6879bd902e2ec605fff4d9fb3247b440a1f66a ARM: ep93xx: convert to MULTI_IRQ_HANDLER Now that there is a generic IRQ handler for multiple VIC devices use it for vision_ep9307 to help building multi platform kernels. Signed-off-by: Hartley Sweeten <hsweeten@visionengravers.com> Acked-by: Ryan Mallon <rmallon@gmail.com> Reviewed-by: Jamie Iles <jamie@jamieiles.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de> | 06 March 2012, 15:57:56 UTC |
63f32b3 | Bartlomiej Zolnierkiewicz | 06 March 2012, 10:25:15 UTC | ARM: EXYNOS: fix touchscreen IRQ setup on Universal C210 board Fixes atmel_mxt_ts freeze on Universal C210. Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Kukjin Kim <kgene.kim@samsung.com> | 06 March 2012, 10:25:15 UTC |
af82931 | Haojian Zhuang | 06 March 2012, 06:57:16 UTC | ARM: pxa: fix invalid mfp pin issue Failure is reported on hx4700 with kernel v3.3-rc1. __mfp_validate: GPIO20 is invalid pin __mfp_validate: GPIO21 is invalid pin __mfp_validate: GPIO15 is invalid pin __mfp_validate: GPIO78 is invalid pin __mfp_validate: GPIO79 is invalid pin __mfp_validate: GPIO80 is invalid pin __mfp_validate: GPIO33 is invalid pin __mfp_validate: GPIO48 is invalid pin __mfp_validate: GPIO49 is invalid pin __mfp_validate: GPIO50 is invalid pin Since pxa_last_gpio is used in mfp-pxa2xx driver. But it's only updated in pxa-gpio driver that run after mfp-pxa2xx driver. So update the pxa_last_gpio first in mfp-pxa2xx driver. Reported-by: Paul Parsons <lost.distance@yahoo.com> Signed-off-by: Haojian Zhuang <haojian.zhuang@gmail.com> | 06 March 2012, 06:57:16 UTC |
0c7de34 | Haojian Zhuang | 06 March 2012, 06:37:04 UTC | ARM: pxa: remove duplicated registeration on pxa-gpio Both reboot (via reboot(RB_AUTOBOOT)) and suspend freeze on hx4700. Registration of pxa_gpio_syscore_ops is moved into pxa-gpio driver, but it still exists in arch-pxa directory. It resulsts failure on reboot and suspend. Now remove the registration code in arch-pxa. Reported-by: Paul Parsons <lost.distance@yahoo.com> Signed-off-by: Haojian Zhuang <haojian.zhuang@gmail.com> | 06 March 2012, 06:40:59 UTC |
bbdc818 | Haojian Zhuang | 28 February 2012, 02:57:48 UTC | ARM: pxa: add dummy clock for pxa25x and pxa27x gpio-pxa driver is shared among arch-pxa and arch-mmp. Clock is the essential component on pxa3xx/pxa95x and arch-mmp. So we need to define dummy clock in pxa25x/pxa27x instead. This regression was introduced by the commit "ARM: pxa: add dummy clock for sa1100-rtc", id a55b5adaf403c4d032e0871ad4ee3367782f4db6. Reported-by: Jonathan Cameron <jic23@cam.ac.uk> Signed-off-by: Paul Parsons <lost.distance@yahoo.com> Tested-by: Robert Jarzmik <robert.jarzmik@free.fr> Signed-off-by: Haojian Zhuang <haojian.zhuang@marvell.com> | 06 March 2012, 06:24:59 UTC |
5cb917b | Tom Herbert | 05 March 2012, 19:53:50 UTC | tg3: Fix to use multi queue BQL interfaces Fix tg3 to use BQL multi queue related netdev interfaces since the device supports multi queue. Signed-off-by: Tom Herbert <therbert@google.com> Reported-by: Christoph Lameter <cl@gentwo.org> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 March 2012, 06:19:08 UTC |
f3969bf | Linus Torvalds | 06 March 2012, 00:23:12 UTC | Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "It contains three cherry-picked fixes from perf/core, which turned out to be more urgent than we originally thought." * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf tools: Handle kernels that don't support attr.exclude_{guest,host} perf tools: Change perf_guest default back to false perf record: No build id option fails | 06 March 2012, 00:23:12 UTC |
98e990a | Linus Torvalds | 06 March 2012, 00:10:44 UTC | Merge tag 'usb-3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb USB: revert a powerpc EHCI patch There is just one patch in here, a revert of a powerpc EHCI driver patch that was reported to cause problems. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> * tag 'usb-3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: Revert "powerpc/usb: fix issue of CPU halt when missing USB PHY clock" | 06 March 2012, 00:10:44 UTC |
75d7b39 | Linus Torvalds | 06 March 2012, 00:10:27 UTC | Merge tag 'tty-3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty tty: build fix for 3.3-rc6 This contains one build fix for the powerpc udbg driver that was reported. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> * tag 'tty-3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty/powerpc: early udbg consoles can't be modules | 06 March 2012, 00:10:27 UTC |
a2e5f13 | Linus Torvalds | 06 March 2012, 00:01:25 UTC | Merge tag 'md-3.3-fixes' of git://neil.brown.name/md Pull md fixes from Neil Brown: "Three fixes for md in 3.3-rc: Two relate to the recently added drive replacement. One fixes the problem where a read error in RAID10 would sometimes be retried indefinitely." * tag 'md-3.3-fixes' of git://neil.brown.name/md: md/raid10: fix assembling of arrays with replacement devices. md/raid10: fix handling of error on last working device in array. md/raid1: fix buglet in md_raid1_contested. | 06 March 2012, 00:01:25 UTC |
3e85fb9 | Linus Torvalds | 05 March 2012, 23:50:25 UTC | Merge branch 'akpm' (Andrew's patch bomb) Merge the emailed seties of 19 patches from Andrew Morton * akpm: rapidio/tsi721: fix queue wrapping bug in inbound doorbell handler memcg: fix mapcount check in move charge code for anonymous page mm: thp: fix BUG on mm->nr_ptes alpha: fix 32/64-bit bug in futex support memcg: fix GPF when cgroup removal races with last exit debugobjects: Fix selftest for static warnings floppy/scsi: fix setting of BIO flags memcg: fix deadlock by inverting lrucare nesting drivers/rtc/rtc-r9701.c: fix crash in r9701_remove() c2port: class_create() returns an ERR_PTR pps: class_create() returns an ERR_PTR, not NULL hung_task: fix the broken rcu_lock_break() logic vfork: kill PF_STARTING coredump_wait: don't call complete_vfork_done() vfork: make it killable vfork: introduce complete_vfork_done() aio: wake up waiters when freeing unused kiocbs kprobes: return proper error code from register_kprobe() kmsg_dump: don't run on non-error paths by default | 05 March 2012, 23:50:25 UTC |
b24823e | Alexandre Bounine | 05 March 2012, 22:59:21 UTC | rapidio/tsi721: fix queue wrapping bug in inbound doorbell handler Fix a bug that causes a kernel panic when the number of received doorbells is larger than number of entries in the inbound doorbell queue (current default value = 512). Another possible indication for this bug is large number of spurious doorbells reported by tsi721 driver after reaching the queue size maximum. Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com> Cc: Chul Kim <chul.kim@idt.com> Cc: Matt Porter <mporter@kernel.crashing.org> Cc: <stable@vger.kernel.org> [3.2.x+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:43 UTC |
e6ca7b8 | Naoya Horiguchi | 05 March 2012, 22:59:20 UTC | memcg: fix mapcount check in move charge code for anonymous page Currently the charge on shared anonyous pages is supposed not to moved in task migration. To implement this, we need to check that mapcount > 1, instread of > 2. So this patch fixes it. Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Reviewed-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Hillf Danton <dhillf@gmail.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:43 UTC |
1c641e8 | Andrea Arcangeli | 05 March 2012, 22:59:20 UTC | mm: thp: fix BUG on mm->nr_ptes Dave Jones reports a few Fedora users hitting the BUG_ON(mm->nr_ptes...) in exit_mmap() recently. Quoting Hugh's discovery and explanation of the SMP race condition: "mm->nr_ptes had unusual locking: down_read mmap_sem plus page_table_lock when incrementing, down_write mmap_sem (or mm_users 0) when decrementing; whereas THP is careful to increment and decrement it under page_table_lock. Now most of those paths in THP also hold mmap_sem for read or write (with appropriate checks on mm_users), but two do not: when split_huge_page() is called by hwpoison_user_mappings(), and when called by add_to_swap(). It's conceivable that the latter case is responsible for the exit_mmap() BUG_ON mm->nr_ptes that has been reported on Fedora." The simplest way to fix it without having to alter the locking is to make split_huge_page() a noop in nr_ptes terms, so by counting the preallocated pagetables that exists for every mapped hugepage. It was an arbitrary choice not to count them and either way is not wrong or right, because they are not used but they're still allocated. Reported-by: Dave Jones <davej@redhat.com> Reported-by: Hugh Dickins <hughd@google.com> Signed-off-by: Andrea Arcangeli <aarcange@redhat.com> Acked-by: Hugh Dickins <hughd@google.com> Cc: David Rientjes <rientjes@google.com> Cc: Josh Boyer <jwboyer@redhat.com> Cc: <stable@vger.kernel.org> [3.0.x, 3.1.x, 3.2.x] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:43 UTC |
62aca40 | Andrew Morton | 05 March 2012, 22:59:19 UTC | alpha: fix 32/64-bit bug in futex support Michael Cree said: : : I have noticed some user space problems (pulseaudio crashes in pthread : : code, glibc/nptl test suite failures, java compiler freezes on SMP alpha : : systems) that arise when using a 2.6.39 or later kernel on Alpha. : : Bisecting between 2.6.38 and 2.6.39 (using glibc/nptl test suite as : : criterion for good/bad kernel) eventually leads to: : : : : 8d7718aa082aaf30a0b4989e1f04858952f941bc is the first bad commit : : commit 8d7718aa082aaf30a0b4989e1f04858952f941bc : : Author: Michel Lespinasse <walken@google.com> : : Date: Thu Mar 10 18:50:58 2011 -0800 : : : : futex: Sanitize futex ops argument types : : : : Change futex_atomic_op_inuser and futex_atomic_cmpxchg_inatomic : : prototypes to use u32 types for the futex as this is the data type the : : futex core code uses all over the place. : : : : Looking at the commit I see there is a change of the uaddr argument in : : the Alpha architecture specific code for futexes from int to u32, but I : : don't see why this should cause a problem. Richard Henderson said: : futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, : u32 oldval, u32 newval) : ... : : "r"(uaddr), "r"((long)oldval), "r"(newval) : : : There is no 32-bit compare instruction. These are implemented by : consistently extending the values to a 64-bit type. Since the : load instruction sign-extends, we want to sign-extend the other : quantity as well (despite the fact it's logically unsigned). : : So: : : - : "r"(uaddr), "r"((long)oldval), "r"(newval) : + : "r"(uaddr), "r"((long)(int)oldval), "r"(newval) : : should do the trick. Michael said: : This fixes the glibc test suite failures and the pulseaudio related : crashes, but it does not fix the java compiiler lockups that I was (and : are still) observing. That is some other problem. Reported-by: Michael Cree <mcree@orcon.net.nz> Tested-by: Michael Cree <mcree@orcon.net.nz> Acked-by: Phil Carmody <ext-phil.2.carmody@nokia.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Michel Lespinasse <walken@google.com> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Reviewed-by: Matt Turner <mattst88@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:43 UTC |
7512102 | Hugh Dickins | 05 March 2012, 22:59:18 UTC | memcg: fix GPF when cgroup removal races with last exit When moving tasks from old memcg (with move_charge_at_immigrate on new memcg), followed by removal of old memcg, hit General Protection Fault in mem_cgroup_lru_del_list() (called from release_pages called from free_pages_and_swap_cache from tlb_flush_mmu from tlb_finish_mmu from exit_mmap from mmput from exit_mm from do_exit). Somewhat reproducible, takes a few hours: the old struct mem_cgroup has been freed and poisoned by SLAB_DEBUG, but mem_cgroup_lru_del_list() is still trying to update its stats, and take page off lru before freeing. A task, or a charge, or a page on lru: each secures a memcg against removal. In this case, the last task has been moved out of the old memcg, and it is exiting: anonymous pages are uncharged one by one from the memcg, as they are zapped from its pagetables, so the charge gets down to 0; but the pages themselves are queued in an mmu_gather for freeing. Most of those pages will be on lru (and force_empty is careful to lru_add_drain_all, to add pages from pagevec to lru first), but not necessarily all: perhaps some have been isolated for page reclaim, perhaps some isolated for other reasons. So, force_empty may find no task, no charge and no page on lru, and let the removal proceed. There would still be no problem if these pages were immediately freed; but typically (and the put_page_testzero protocol demands it) they have to be added back to lru before they are found freeable, then removed from lru and freed. We don't see the issue when adding, because the mem_cgroup_iter() loops keep their own reference to the memcg being scanned; but when it comes to mem_cgroup_lru_del_list(). I believe this was not an issue in v3.2: there, PageCgroupAcctLRU and PageCgroupUsed flags were used (like a trick with mirrors) to deflect view of pc->mem_cgroup to the stable root_mem_cgroup when neither set. 38c5d72f3ebe ("memcg: simplify LRU handling by new rule") mercifully removed those convolutions, but left this General Protection Fault. But it's surprisingly easy to restore the old behaviour: just check PageCgroupUsed in mem_cgroup_lru_add_list() (which decides on which lruvec to add), and reset pc to root_mem_cgroup if page is uncharged. A risky change? just going back to how it worked before; testing, and an audit of uses of pc->mem_cgroup, show no problem. And there's a nice bonus: with mem_cgroup_lru_add_list() itself making sure that an uncharged page goes to root lru, mem_cgroup_reset_owner() no longer has any purpose, and we can safely revert 4e5f01c2b9b9 ("memcg: clear pc->mem_cgroup if necessary"). Calling update_page_reclaim_stat() after add_page_to_lru_list() in swap.c is not strictly necessary: the lru_lock there, with RCU before memcg structures are freed, makes mem_cgroup_get_reclaim_stat_from_page safe without that; but it seems cleaner to rely on one dependency less. Signed-off-by: Hugh Dickins <hughd@google.com> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Konstantin Khlebnikov <khlebnikov@openvz.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:43 UTC |
9f78ff0 | Stephen Boyd | 05 March 2012, 22:59:17 UTC | debugobjects: Fix selftest for static warnings debugobjects is now printing a warning when a fixup for a NOTAVAILABLE object is run. This causes the selftest to fail like: ODEBUG: selftest warnings failed 4 != 5 We could just increase the number of warnings that the selftest is expecting to see because that is actually what has changed. But, it turns out that fixup_activate() was written with inverted logic and thus a fixup for a static object returned 1 indicating the object had been fixed, and 0 otherwise. Fix the logic to be correct and update the counts to reflect that nothing needed fixing for a static object. Signed-off-by: Stephen Boyd <sboyd@codeaurora.org> Reported-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:43 UTC |
9354f1b | Muthu Kumar | 05 March 2012, 22:59:16 UTC | floppy/scsi: fix setting of BIO flags Fix setting bio flags in drivers (sd_dif/floppy). Signed-off-by: Muthukumar R <muthur@gmail.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:43 UTC |
9ce70c0 | Hugh Dickins | 05 March 2012, 22:59:16 UTC | memcg: fix deadlock by inverting lrucare nesting We have forgotten the rules of lock nesting: the irq-safe ones must be taken inside the non-irq-safe ones, otherwise we are open to deadlock: CPU0 CPU1 ---- ---- lock(&(&pc->lock)->rlock); local_irq_disable(); lock(&(&zone->lru_lock)->rlock); lock(&(&pc->lock)->rlock); <Interrupt> lock(&(&zone->lru_lock)->rlock); To check a different locking issue, I happened to add a spin_lock to memcg's bit_spin_lock in lock_page_cgroup(), and lockdep very quickly complained about __mem_cgroup_commit_charge_lrucare() (on CPU1 above). So delete __mem_cgroup_commit_charge_lrucare(), passing a bool lrucare to __mem_cgroup_commit_charge() instead, taking zone->lru_lock under lock_page_cgroup() in the lrucare case. The original was using spin_lock_irqsave, but we'd be in more trouble if it were ever called at interrupt time: unconditional _irq is enough. And ClearPageLRU before del from lru, SetPageLRU before add to lru: no strong reason, but that is the ordering used consistently elsewhere. Fixes 36b62ad539498d00c2d280a151a ("memcg: simplify corner case handling of LRU"). Signed-off-by: Hugh Dickins <hughd@google.com> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Konstantin Khlebnikov <khlebnikov@openvz.org> Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:43 UTC |
73737b8 | Anatolij Gustschin | 05 March 2012, 22:59:16 UTC | drivers/rtc/rtc-r9701.c: fix crash in r9701_remove() If probing the RTC didn't succeed due to failed RTC register access, the RTC device will be unregistered. Then, when removing the module r9701_remove() causes a kernel crash while trying to unregister a not registered RTC device. Fix this by doing RTC register access test before RTC device registration. Signed-off-by: Anatolij Gustschin <agust@denx.de> Cc: Alessandro Zummo <a.zummo@towertech.it> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:43 UTC |
22ea71d | Dan Carpenter | 05 March 2012, 22:59:15 UTC | c2port: class_create() returns an ERR_PTR class_create() doesn't return a NULL, it only returns ERR_PTRs. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:43 UTC |
7ad1256 | Dan Carpenter | 05 March 2012, 22:59:15 UTC | pps: class_create() returns an ERR_PTR, not NULL class_create() never returns NULLs only ERR_PTRs. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Rodolfo Giometti <giometti@enneenne.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:43 UTC |
6027ce4 | Oleg Nesterov | 05 March 2012, 22:59:14 UTC | hung_task: fix the broken rcu_lock_break() logic check_hung_uninterruptible_tasks()->rcu_lock_break() introduced by "softlockup: check all tasks in hung_task" commit ce9dbe24 looks absolutely wrong. - rcu_lock_break() does put_task_struct(). If the task has exited it is not safe to even read its ->state, nothing protects this task_struct. - The TASK_DEAD checks are wrong too. Contrary to the comment, we can't use it to check if the task was unhashed. It can be unhashed without TASK_DEAD, or it can be valid with TASK_DEAD. For example, an autoreaping task can do release_task(current) long before it sets TASK_DEAD in do_exit(). Or, a zombie task can have ->state == TASK_DEAD but release_task() was not called, and in this case we must not break the loop. Change this code to check pid_alive() instead, and do this before we drop the reference to the task_struct. Note: while_each_thread() under rcu_read_lock() is not really safe, it can livelock. This will be fixed later, but fortunately in this case the "max_count" logic saves us anyway. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Frederic Weisbecker <fweisbec@gmail.com> Acked-by: Mandeep Singh Baines <msb@google.com> Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:42 UTC |
6e27f63 | Oleg Nesterov | 05 March 2012, 22:59:14 UTC | vfork: kill PF_STARTING Previously it was (ab)used by utrace. Then it was wrongly used by the scheduler code. Currently it is not used, kill it before it finds the new erroneous user. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:42 UTC |
57b59c4 | Oleg Nesterov | 05 March 2012, 22:59:13 UTC | coredump_wait: don't call complete_vfork_done() Now that CLONE_VFORK is killable, coredump_wait() no longer needs complete_vfork_done(). zap_threads() should find and kill all tasks with the same ->mm, this includes our parent if ->vfork_done is set. mm_release() becomes the only caller, unexport complete_vfork_done(). Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:42 UTC |
d68b46f | Oleg Nesterov | 05 March 2012, 22:59:13 UTC | vfork: make it killable Make vfork() killable. Change do_fork(CLONE_VFORK) to do wait_for_completion_killable(). If it fails we do not return to the user-mode and never touch the memory shared with our child. However, in this case we should clear child->vfork_done before return, we use task_lock() in do_fork()->wait_for_vfork_done() and complete_vfork_done() to serialize with each other. Note: now that we use task_lock() we don't really need completion, we could turn task->vfork_done into "task_struct *wake_up_me" but this needs some complications. NOTE: this and the next patches do not affect in-kernel users of CLONE_VFORK, kernel threads run with all signals ignored including SIGKILL/SIGSTOP. However this is obviously the user-visible change. Not only a fatal signal can kill the vforking parent, a sub-thread can do execve or exit_group() and kill the thread sleeping in vfork(). Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:42 UTC |
c415c3b | Oleg Nesterov | 05 March 2012, 22:59:13 UTC | vfork: introduce complete_vfork_done() No functional changes. Move the clear-and-complete-vfork_done code into the new trivial helper, complete_vfork_done(). Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:42 UTC |
880641b | Jeff Moyer | 05 March 2012, 22:59:12 UTC | aio: wake up waiters when freeing unused kiocbs Bart Van Assche reported a hung fio process when either hot-removing storage or when interrupting the fio process itself. The (pruned) call trace for the latter looks like so: fio D 0000000000000001 0 6849 6848 0x00000004 ffff880092541b88 0000000000000046 ffff880000000000 ffff88012fa11dc0 ffff88012404be70 ffff880092541fd8 ffff880092541fd8 ffff880092541fd8 ffff880128b894d0 ffff88012404be70 ffff880092541b88 000000018106f24d Call Trace: schedule+0x3f/0x60 io_schedule+0x8f/0xd0 wait_for_all_aios+0xc0/0x100 exit_aio+0x55/0xc0 mmput+0x2d/0x110 exit_mm+0x10d/0x130 do_exit+0x671/0x860 do_group_exit+0x44/0xb0 get_signal_to_deliver+0x218/0x5a0 do_signal+0x65/0x700 do_notify_resume+0x65/0x80 int_signal+0x12/0x17 The problem lies with the allocation batching code. It will opportunistically allocate kiocbs, and then trim back the list of iocbs when there is not enough room in the completion ring to hold all of the events. In the case above, what happens is that the pruning back of events ends up freeing up the last active request and the context is marked as dead, so it is thus responsible for waking up waiters. Unfortunately, the code does not check for this condition, so we end up with a hung task. Signed-off-by: Jeff Moyer <jmoyer@redhat.com> Reported-by: Bart Van Assche <bvanassche@acm.org> Tested-by: Bart Van Assche <bvanassche@acm.org> Cc: <stable@kernel.org> [3.2.x only] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:42 UTC |
f986a49 | Prashanth Nageshappa | 05 March 2012, 22:59:12 UTC | kprobes: return proper error code from register_kprobe() register_kprobe() aborts if the address of the new request falls in a prohibited area (such as ftrace pouch, __kprobes annotated functions, non-kernel text addresses, jump label text). We however don't return the right error on this abort, resulting in a silent failure - incorrect adding/reporting of kprobes ('perf probe do_fork+18' or 'perf probe mcount' for instance). In V2 we are incorporating Masami Hiramatsu's feedback. This patch fixes it by returning -EINVAL upon failure. While we are here, rename the label used for exit to be more appropriate. Signed-off-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com> Signed-off-by: Prashanth K Nageshappa <prashanth@linux.vnet.ibm.com> Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com> Cc: Jason Baron <jbaron@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:42 UTC |
c22ab33 | Matthew Garrett | 05 March 2012, 22:59:10 UTC | kmsg_dump: don't run on non-error paths by default Since commit 04c6862c055f ("kmsg_dump: add kmsg_dump() calls to the reboot, halt, poweroff and emergency_restart paths"), kmsg_dump() gets run on normal paths including poweroff and reboot. This is less than ideal given pstore implementations that can only represent single backtraces, since a reboot may overwrite a stored oops before it's been picked up by userspace. In addition, some pstore backends may have low performance and provide a significant delay in reboot as a result. This patch adds a printk.always_kmsg_dump kernel parameter (which can also be changed from userspace). Without it, the code will only be run on failure paths rather than on normal paths. The option can be enabled in environments where there's a desire to attempt to audit whether or not a reboot was cleanly requested or not. Signed-off-by: Matthew Garrett <mjg@redhat.com> Acked-by: Seiji Aguchi <seiji.aguchi@hds.com> Cc: Seiji Aguchi <seiji.aguchi@hds.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Marco Stornelli <marco.stornelli@gmail.com> Cc: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Cc: Vivek Goyal <vgoyal@redhat.com> Cc: Don Zickus <dzickus@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 23:49:42 UTC |
81caaf2 | Russell King | 05 March 2012, 23:29:51 UTC | ARM: ecard: ensure fake vma vm_flags is setup Our TLB ops want to check the vma vm_flags to find out whether the mapping is executable. However, we leave this uninitialized in ecard.c. Initialize it with an appropriate value. Reported-by: Al Viro <viro@ftp.linux.org.uk> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> | 05 March 2012, 23:29:51 UTC |
7a90484 | NeilBrown | 05 March 2012, 06:48:12 UTC | md/raid10: fix assembling of arrays with replacement devices. commit 56a2559bb654a (md/raid10: recognise replacements ...) changed 'run' to set ->replacement or ->rdev depending on the 'Replacement' status if the device, but it didn't remove the old unconditional setting of 'rdev'. So it was largely ineffective. So remove that now. Signed-off-by: NeilBrown <neilb@suse.de> | 05 March 2012, 23:12:45 UTC |
055bf38 | Alan Cox | 05 March 2012, 14:22:16 UTC | drm, gma500: Fix Cedarview boot failures in 3.3-rc Production GMA3600/3650 hardware turns out to be subtly different to the development platforms. This combined with a minor driver bug is causing the kernel to hang on these platforms. This patch does the following - turn down a couple of messages that were meant to be debug and are causing much confusion - ensure the hotplug interrupt is disabled on Cedartrail systems. - fix a bug where gtt roll mode called psbfb_sync, which tries to sync the 2D engine. On other devices it is harmless as the 2D engine is present but not in use when in gtt roll mode, on Cedartrail it causes a hang Without these changes 3.3-rc hangs on boot on Cedartrail based systems. Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 22:53:01 UTC |
aa13909 | Linus Torvalds | 05 March 2012, 22:30:54 UTC | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) TCP SACK processing can calculate an incorrect reordering value in some cases, fix from Neal Cardwell. 2) tcp_mark_head_lost() can split SKBs in situations where it should not, violating send queue invariants expected by other pieces of code and thus resulting (eventually) in corrupted retransmit state counters. Also from Neal Cardwell. 3) qla3xxx erroneously calls spin_lock_irqrestore() with constant hw_flags of zero. Fix from Santosh Nayak. 4) Fix NULL deref in rt2x00, from Gabor Juhos. 5) pch_gbe passes address of wrong typed object to pch_gbe_validate_option thus corrupting part of the value. From Dan Carpenter. 6) We must check the return value of nlmsg_parse() before trying to use the results. From Eric Dumazet. 7) Bridging code fails to check return value of ipv6_dev_get_saddr() thus potentially leaving uninitialized garbage in the outgoing ipv6 header. From Ulrich Weber. 8) Due to rounding and a reversed operation on jiffies, bridge message ages can go backwards instead of forwards, thus breaking STP. Fixes from Joakim Tjernlund. 9) r8169 modifies Config* registers without properly holding the Config9346 lock, resulting in corrupted IP fragments on some chips. Fix from Francois Romieu. 10) NET_PACKET_ENGINE default wan't set properly during the network driver mega-move. Fix from Stephen Hemminger. 11) vmxnet3 uses TCP header size where it actually should use the UDP header size, fix from Shreyas Bhatewara. 12) Netfilter bridge module autoload is busted in the compat case, fix from Florian Westphal. 13) Wireless Key removal was not setting multicast bits correctly thus accidently killing the unicast key 0 and thus all traffic stops. Fix from Johannes Berg. 14) Fix endless retries of A-MPDU transmissions in brcm80211 driver. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (22 commits) qla3xxx: ethernet: Fix bogus interrupt state flag. bridge: check return value of ipv6_dev_get_saddr() rtnetlink: fix rtnl_calcit() and rtnl_dump_ifinfo() bridge: message age needs to increase, not decrease. bridge: Adjust min age inc for HZ > 256 tcp: don't fragment SACKed skbs in tcp_mark_head_lost() r8169: corrupted IP fragments fix for large mtu. packetengines: fix config default vmxnet3: Fix transport header size enic: fix an endian bug in enic_probe() pch_gbe: memory corruption calling pch_gbe_validate_option() tg3: Fix tg3_get_stats64 for 5700 / 5701 devs tcp: fix false reordering signal in tcp_shifted_skb tcp: fix comment for tp->highest_sack netfilter: bridge: fix module autoload in compat case brcm80211: smac: only print block-ack timeout message at trace level brcm80211: smac: fix endless retry of A-MPDU transmissions mac80211: Fix a warning on changing to monitor mode from STA mac80211: zero initialize count field in ieee80211_tx_rate iwlwifi: fix key removal ... | 05 March 2012, 22:30:54 UTC |
4f0449e | Linus Torvalds | 05 March 2012, 22:30:12 UTC | Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci Pull PCI fixes from Jesse Barnes: "A couple of fixes for booting specific machines, and one for a minor memory leak on pre-_CRS platforms." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci: x86/PCI: do not tie MSI MS-7253 use_crs quirk to BIOS version x86/PCI: use host bridge _CRS info on MSI MS-7253 PCI: fix memleak when ACPI _CRS is not used. | 05 March 2012, 22:30:12 UTC |
789ce9b | Linus Torvalds | 05 March 2012, 22:28:36 UTC | Merge branch 'for-3.3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu Pull per-cpu patches from Tejun Heo: "This pull request contains four patches. One replaces manual clearing with bitmap_clear(), two fix generic definition of __this_cpu ops so that they don't choose unnecessarily strict arch version. One makes _this_cpu definition use raw_local_irq_*() so that it doesn't end up wrecking irq on/off state tracking when used from inside lockdep. Of the four patches, the raw_local_irq_*() update is the most important, so please feel free to cherry pick only that one patch and ignore the rest if you want to - commit e920d5971d 'percpu: use raw_local_irq_* in _this_cpu op'." * 'for-3.3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu: percpu: fix __this_cpu_{sub,inc,dec}_return() definition percpu: use raw_local_irq_* in _this_cpu op percpu: fix generic definition of __this_cpu_add_and_return() percpu: use bitmap_clear | 05 March 2012, 22:28:36 UTC |
3a81a6e | Linus Torvalds | 05 March 2012, 22:27:34 UTC | Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus Pull MIPS fixes from Ralf Baechle: "What's in there: a number of MIPS fixes and touchups. The most important change in this pull request is Kautuk Consul's port of changes to do_page_fault which fix a hang that affects some configurations. Still not quite ready for a release, there are problems with 64-bit platforms." * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: MIPS: traps.c: Fix typo MIPS: PowerTV: Fix defconfigs for coverage builds MIPS: Netlogic: Fix defconfigs for coverage builds MIPS: ATH79: Avoid a kernel bug on AR913X MIPS: PCI: use list_for_each_entry() for bus->devices traversal MIPS: fault.c: Port OOM changes to do_page_fault MIPS: vmlinux.lds.S: remove duplicate _sdata symbol MIPS: Alchemy: Increase minimum timeout for 32kHz timer. MIPS: txx9 7segled fix struct device has no member MIPS: Alchemy: Update Au1300 inlined GPIO macros MIPS: Remove temporary kludge from <asm/page.h> MIPS: BMIPS: smp-bmips.c does not need to include version.h | 05 March 2012, 22:27:34 UTC |
cd2934a | Al Viro | 05 March 2012, 06:40:29 UTC | flush_tlb_range() needs ->page_table_lock when ->mmap_sem is not held All other callers already hold either ->mmap_sem (exclusive) or ->page_table_lock. And we need it because some page table flushing instanced do work explicitly with ge tables. See e.g. arch/powerpc/mm/tlb_hash32.c, flush_tlb_range() and flush_range() in there. The same goes for uml, with a lot more extensive playing with page tables. Almost all callers are actually fine - flush_tlb_range() may have no need to bother playing with page tables, but it can do so safely; again, this caller is the sole exception - everything else either has exclusive ->mmap_sem on the mm in question, or mm->page_table_lock is held. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 21:51:32 UTC |
835ee79 | Al Viro | 05 March 2012, 06:39:47 UTC | VM_GROWS{UP,DOWN} shouldn't be set on shmem VMAs Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 21:51:32 UTC |
6414fa6 | Al Viro | 05 March 2012, 06:38:42 UTC | aout: move setup_arg_pages() prior to reading/mapping the binary Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 05 March 2012, 21:51:32 UTC |
9d1dfc0 | Santosh Nayak | 02 March 2012, 05:09:05 UTC | qla3xxx: ethernet: Fix bogus interrupt state flag. In 'ql_adapter_initialize' the first call for 'spin_unlock_irqrestore()' is with hw_flags = 0, which is as good as 'spin_unlock_irq()' (unconditional interrupt enabling). If this is intended, then for better performance 'spin_unlock_irqrestore()' can be replaced with 'spin_unlock_irq()' and 'spin_lock_irqsave()' can be replaced by 'spin_lock_irq() Signed-off-by: Santosh Nayak <santoshprasadnayak@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 05 March 2012, 21:50:52 UTC |
d1d81d4 | Ulrich Weber | 05 March 2012, 04:52:44 UTC | bridge: check return value of ipv6_dev_get_saddr() otherwise source IPv6 address of ICMPV6_MGM_QUERY packet might be random junk if IPv6 is disabled on interface or link-local address is not yet ready (DAD). Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 05 March 2012, 21:45:34 UTC |
182ada1 | Johannes Berg | 04 March 2012, 16:31:35 UTC | iwlwifi: fix wowlan suspend This was broken by the commit 023ca58f1 "iwlwifi: Move the core suspend function to iwl-agn-lib" where for some reason the code changed while moving, from .len[0] = sizeof(*key_data.rsc_tsc), to .len[0] = sizeof(key_data.rsc_tsc), Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> | 05 March 2012, 19:44:39 UTC |
550cf00 | Linus Torvalds | 05 March 2012, 16:51:10 UTC | Merge tag 'mmc-fixes-for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc MMC fixes from Chris Ball for 3.3: - atmel-mci: oops fix against regression introduced in 3.2 - core: power saving regression fix against 3.3-rc1 - core: suspend/resume fix for UHS-I cards - esdhc-imx: MMC card regression fix against 3.0 - mmci: oops fix for ARM systems with large (64k) pages - MAINTAINERS update for atmel-mci. * tag 'mmc-fixes-for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: mmc: core: Fixup suspend/resume issues for UHS-I cards mmc: mmci: reduce max_blk_count to avoid overflowing max_req_size mmc: sdhci-esdhc-imx: fix for mmc cards on i.MX5 mmc: core: fix regression: set default clock gating delay to 0 MAINTAINERS: hand over atmel-mci (sd/mmc interface) mmc: atmel-mci: don't use dma features when using DMA with no chan available | 05 March 2012, 16:51:10 UTC |
5d329e2 | Linus Torvalds | 05 March 2012, 16:48:24 UTC | Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull from Jiri Kosina: "Please pull to receive updates for HID layer. Nikolai's patch is rather important and should still go in for 3.3, as it's a regression fix for commit b4b583d." * 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: hid-input: allow array fields out of range HID: usbhid: Add NOGET quirk for the AIREN Slim+ keyboard | 05 March 2012, 16:48:24 UTC |
4adf9be | Axel Lin | 02 March 2012, 10:07:21 UTC | regulator: Fix mask parameter in da9052_reg_update calls If the mask parameter is 0, info->activate_bit bit won't be set by calling da9052_reg_update. Signed-off-by: Axel Lin <axel.lin@gmail.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> | 05 March 2012, 12:28:58 UTC |
883e0e3 | Nikolai Kondrashov | 02 March 2012, 20:13:58 UTC | HID: hid-input: allow array fields out of range Allow array field values out of range as per HID 1.11 specification, section 6.2.25: Rather than returning a single bit for each button in the group, an array returns an index in each field that corresponds to the pressed button (like keyboard scan codes). An out-of range value in and array field is considered no controls asserted. Apparently, "and" above is a typo and should be "an". This fixes at least Waltop tablet pen clicks - otherwise BTN_TOUCH is never released. The relevant part of Waltop tablet report descriptors is this: 0x09, 0x42, /* Usage (Tip Switch), */ 0x09, 0x44, /* Usage (Barrel Switch), */ 0x09, 0x46, /* Usage (Tablet Pick), */ 0x15, 0x01, /* Logical Minimum (1), */ 0x25, 0x03, /* Logical Maximum (3), */ 0x75, 0x04, /* Report Size (4), */ 0x95, 0x01, /* Report Count (1), */ 0x80, /* Input, */ This is a regression fix for commit b4b583d ("HID: be more strict when ignoring out-of-range fields"). Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> | 05 March 2012, 09:28:58 UTC |
b7c9242 | Ingo Molnar | 05 March 2012, 08:05:44 UTC | Merge tag 'perf-urgent-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Cherry picked fixes from perf/core, together with the kernel fix (1018faa), the sampling tools (top, record) are back working on AMD systems. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> | 05 March 2012, 08:05:44 UTC |
a4b64fb | Eric Dumazet | 04 March 2012, 12:32:10 UTC | rtnetlink: fix rtnl_calcit() and rtnl_dump_ifinfo() nlmsg_parse() might return an error, so test its return value before potential random memory accesses. Errors introduced in commit 115c9b81928 (rtnetlink: Fix problem with buffer allocation) Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Greg Rose <gregory.v.rose@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 05 March 2012, 03:02:55 UTC |
709e1b5 | Joakim Tjernlund | 01 March 2012, 08:12:19 UTC | bridge: message age needs to increase, not decrease. commit bridge: send proper message_age in config BPDU added this gem: bpdu.message_age = (jiffies - root->designated_age) p->designated_age = jiffies + bpdu->message_age; Notice how bpdu->message_age is negated when reassigned to bpdu.message_age. This causes message age to decrease breaking the STP protocol. Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se> Signed-off-by: David S. Miller <davem@davemloft.net> | 05 March 2012, 02:57:40 UTC |
aaca735 | Joakim Tjernlund | 01 March 2012, 08:12:18 UTC | bridge: Adjust min age inc for HZ > 256 min age increment needs to round up its min age tick for all HZ values to guarantee message age is increasing. Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se> Signed-off-by: David S. Miller <davem@davemloft.net> | 05 March 2012, 02:57:39 UTC |
a5939ee | Linus Torvalds | 05 March 2012, 01:10:06 UTC | Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6 MFD fixes from Samuel Ortiz: "This is the pull request for the MFD fixes for 3.3. We have a few NULL pointer dereferences fixes, an ACPI conflict check fix, and a couple of wm8994 fixes." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6: mfd: Correct readability of WM8994 DC servo 4E register mfd: Initialize tps65912 irq platform data properly mfd: Fix ACPI conflict check mfd: Fix ab8500 error path bug mfd: Test for jack detection when deciding if wm8994 should suspend mfd: Initialize tps65910 irq platform data properly mfd: Fix possible s5m null pointer dereference mfd: wm8350 variable dereferenced before check | 05 March 2012, 01:10:06 UTC |
5483f18 | Linus Torvalds | 04 March 2012, 23:51:42 UTC | vfs: move dentry_cmp from <linux/dcache.h> to fs/dcache.c It's only used inside fs/dcache.c, and we're going to play games with it for the word-at-a-time patches. This time we really don't even want to export it, because it really is an internal function to fs/dcache.c, and has been since it was introduced. Having it in that extremely hot header file (it's included in pretty much everything, thanks to <linux/fs.h>) is a disaster for testing different versions, and is utterly pointless. We really should have some kind of header file diet thing, where we figure out which parts of header files are really better off private and only result in more expensive compiles. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 04 March 2012, 23:51:42 UTC |
adb7950 | Konstantin Khlebnikov | 28 February 2012, 20:41:12 UTC | percpu: fix __this_cpu_{sub,inc,dec}_return() definition This patch adds missed "__" prefixes, otherwise these functions works as irq/preemption safe. Reported-by: Torsten Kaiser <just.for.lkml@googlemail.com> Signed-off-by: Konstantin Khlebnikov <khlebnikov@openvz.org> Signed-off-by: Tejun Heo <tj@kernel.org> | 04 March 2012, 17:34:15 UTC |
e774747 | Ulf Hansson | 01 March 2012, 12:18:05 UTC | mmc: core: Fixup suspend/resume issues for UHS-I cards Even if cards supports 1.8V I/O voltage those should anyway be initialized at 3.3V I/O according to (e)MMC, SD and SDIO specs. Some eMMC and embedded SDIO devices are able to be initialized at 1.8V as well, but it is better to be safe. Do note that initialization in this context means that the card has been completely powered off, otherwise the card will remain at the last I/O voltage level that were negotitiated. Due to the above being taken care of the suspend/resume issues for UHS-I SD-cards has been fixed. Signed-off-by: Ulf Hansson <ulf.hansson@stericsson.com> Acked-by: Philip Rakity <prakity@marvell.com> Acked-by: Linus Walleij <linus.walleij@linaro.org> Tested-by: Subhash Jadavani <subhashj@codeaurora.org> Signed-off-by: Chris Ball <cjb@laptop.org> | 04 March 2012, 17:25:15 UTC |
8f7f6b7 | Will Deacon | 24 February 2012, 11:25:21 UTC | mmc: mmci: reduce max_blk_count to avoid overflowing max_req_size On a system with large pages (64k in my case), the following BUG is triggered in MMC core: [ 2.338023] BUG: failure at drivers/mmc/core/core.c:221/mmc_start_request()! [ 2.338102] Kernel panic - not syncing: BUG! [ 2.338155] Call trace: [ 2.338228] [<ffffffc00008635c>] dump_backtrace+0x0/0x120 [ 2.338317] [<ffffffc0003365ec>] dump_stack+0x14/0x1c [ 2.338403] [<ffffffc000336990>] panic+0xbc/0x1f0 [ 2.338498] [<ffffffc00027a494>] mmc_start_request+0x154/0x184 [ 2.338600] [<ffffffc00027abdc>] mmc_start_req+0x110/0x140 [ 2.338701] [<ffffffc00028604c>] mmc_blk_issue_rw_rq+0x7c/0x39c [ 2.338804] [<ffffffc00028652c>] mmc_blk_issue_rq+0x1c0/0x468 [ 2.338905] [<ffffffc000287564>] mmc_queue_thread+0x68/0x118 [ 2.338995] [<ffffffc0000bc308>] kthread+0x84/0x8c This is because of a 64k request with a max_req_size of 64k-1 bytes. The following patch fixes the problem by limiting the max_blk_count such that max_blk_count * max_blk_size == max_req_size. I couldn't pursuade the compiler to emit a shift instead of a div without encoding the shift explicitly. Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Chris Ball <cjb@laptop.org> | 04 March 2012, 17:25:14 UTC |
5b6b0ad | Sascha Hauer | 17 February 2012, 10:51:49 UTC | mmc: sdhci-esdhc-imx: fix for mmc cards on i.MX5 On i.MX53 we have to write a special SDHCI_CMD_ABORTCMD to the SDHCI_TRANSFER_MODE register during a MMC_STOP_TRANSMISSION command. This works for SD cards. However, with MMC cards the MMC_SET_BLOCK_COUNT command is used instead, but this needs the same handling. Fix MMC cards by testing for the MMC_SET_BLOCK_COUNT command aswell. Tested on a custom i.MX53 board with a Transcend MMC+ card and eMMC. The kernel started used MMC_SET_BLOCK_COUNT in 3.0, so this is a regression for these boards introduced in 3.0; it should go to 3.0/3.1/3.2-stable. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Acked-by: Shawn Guo <shawn.guo@linaro.org> Cc: <stable@vger.kernel.org> Signed-off-by: Chris Ball <cjb@laptop.org> | 04 March 2012, 17:25:02 UTC |
c84f15a | Guennadi Liakhovetski | 23 February 2012, 10:22:29 UTC | mmc: core: fix regression: set default clock gating delay to 0 A recent commit "mmc: core: Use delayed work in clock gating framework" (597dd9d79cfbbb1) introduced a default 200ms delay before clock gating actually takes place. This means that every time an MMC interface becomes idle it first stays on for 200ms before gating its clock. This leads to increased power consumption and is therefore a clear regression. This patch restores the original behaviour by setting the default delay to 0. Users prioritising throughput over power efficiency can still modify the delay via sysfs. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Chris Ball <cjb@laptop.org> | 04 March 2012, 17:18:40 UTC |