Skip to main content

Browse the archive

swh:1:snp:c2847dfd741eae21606027cf29250d1ebcd63fb4
sort by:
Revision Author Date Message Commit Date
e488921 Michal Schmidt 13 September 2012, 12:59:44 UTC bnx2x: fix rx checksum validation for IPv6 Commit d6cb3e41 "bnx2x: fix checksum validation" caused a performance regression for IPv6. Rx checksum offload does not work. IPv6 packets are passed to the stack with CHECKSUM_NONE. The hardware obviously cannot perform IP checksum validation for IPv6, because there is no checksum in the IPv6 header. This should not prevent us from setting CHECKSUM_UNNECESSARY. Tested on BCM57711. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Acked-by: Eric Dumazet <edumazet@google.com> Acked-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net> 18 September 2012, 20:13:46 UTC
c254637 Mathias Krause 14 September 2012, 09:58:32 UTC xfrm_user: return error pointer instead of NULL #2 When dump_one_policy() returns an error, e.g. because of a too small buffer to dump the whole xfrm policy, xfrm_policy_netlink() returns NULL instead of an error pointer. But its caller expects an error pointer and therefore continues to operate on a NULL skbuff. Signed-off-by: Mathias Krause <minipli@googlemail.com> Acked-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net> 18 September 2012, 20:13:46 UTC
864745d Mathias Krause 13 September 2012, 11:41:26 UTC xfrm_user: return error pointer instead of NULL When dump_one_state() returns an error, e.g. because of a too small buffer to dump the whole xfrm state, xfrm_state_netlink() returns NULL instead of an error pointer. But its callers expect an error pointer and therefore continue to operate on a NULL skbuff. This could lead to a privilege escalation (execution of user code in kernel context) if the attacker has CAP_NET_ADMIN and is able to map address 0. Signed-off-by: Mathias Krause <minipli@googlemail.com> Acked-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net> 18 September 2012, 20:13:45 UTC
2c20cbd Nicolas Dichtel 10 September 2012, 22:09:47 UTC ipv6: use DST_* macro to set obselete field Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> 18 September 2012, 19:57:04 UTC
6f3118b Nicolas Dichtel 10 September 2012, 22:09:46 UTC ipv6: use net->rt_genid to check dst validity IPv6 dst should take care of rt_genid too. When a xfrm policy is inserted or deleted, all dst should be invalidated. To force the validation, dst entries should be created with ->obsolete set to DST_OBSOLETE_FORCE_CHK. This was already the case for all functions calling ip6_dst_alloc(), except for ip6_rt_copy(). As a consequence, we can remove the specific code in inet6_connection_sock. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net> 18 September 2012, 19:57:03 UTC
ee8372d Nicolas Dichtel 10 September 2012, 22:09:45 UTC xfrm: invalidate dst on policy insertion/deletion When a policy is inserted or deleted, all dst should be recalculated. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net> 18 September 2012, 19:57:03 UTC
b42664f Nicolas Dichtel 10 September 2012, 22:09:44 UTC netns: move net->ipv4.rt_genid to net->rt_genid This commit prepares the use of rt_genid by both IPv4 and IPv6. Initialization is left in IPv4 part. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net> 18 September 2012, 19:57:03 UTC
2885da7 Eric Dumazet 07 September 2012, 20:27:11 UTC net: rt_cache_flush() cleanup We dont use jhash anymore since route cache removal, so we can get rid of get_random_bytes() calls for rt_genid changes. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> 18 September 2012, 19:54:19 UTC
bafa6d9 Nicolas Dichtel 07 September 2012, 00:45:29 UTC ipv4/route: arg delay is useless in rt_cache_flush() Since route cache deletion (89aef8921bfbac22f), delay is no more used. Remove it. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> 18 September 2012, 19:44:34 UTC
925a6f0 Linus Torvalds 18 September 2012, 18:58:54 UTC Merge tag 'hwspinlock-3.6-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/hwspinlock Pull hwspinlock fix from Ohad Ben-Cohen: "A single hwspinlock fix by Wei Yongjun, which prevents potential NULL dereferences" * tag 'hwspinlock-3.6-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/hwspinlock: hwspinlock/core: move the dereference below the NULL test 18 September 2012, 18:58:54 UTC
b161dfa Miklos Szeredi 17 September 2012, 20:31:38 UTC vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill() IBM reported a soft lockup after applying the fix for the rename_lock deadlock. Commit c83ce989cb5f ("VFS: Fix the nfs sillyrename regression in kernel 2.6.38") was found to be the culprit. The nfs sillyrename fix used DCACHE_DISCONNECTED to indicate that the dentry was killed. This flag can be set on non-killed dentries too, which results in infinite retries when trying to traverse the dentry tree. This patch introduces a separate flag: DCACHE_DENTRY_KILLED, which is only set in d_kill() and makes try_to_ascend() test only this flag. IBM reported successful test results with this patch. Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> Cc: Trond Myklebust <Trond.Myklebust@netapp.com> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 18 September 2012, 18:23:51 UTC
23f3f06 Olof Johansson 18 September 2012, 17:16:44 UTC Merge tag 'imx-fixes' of git://git.pengutronix.de/git/imx/linux-2.6 into fixes From Sascha Hauer: ARM i.MX: Two fixes for i.MX - armadillo5x0 board broken since v3.5 (stable material) - i.MX25 Architecture broken since v3.6-rc1 * tag 'imx-fixes' of git://git.pengutronix.de/git/imx/linux-2.6: ARM i.MX25: Make timer irq work again ARM: imx: armadillo5x0: Fix illegal register access 18 September 2012, 17:16:44 UTC
42a3f89 Sascha Hauer 18 September 2012, 08:05:31 UTC ARM i.MX25: Make timer irq work again Since i.MX has SPARSE_IRQ enabled the i.MX25 timer is broken. This is because the internal irqs now start at an offset of NR_IRQS_LEGACY. The patch fixed this up, but missed the i.MX25 timer which used a hardcoded value instead of a define. This patch introduces a define for the timer irq and uses it. This is broken since introduced with 3.6-rc1: | commit 8842a9e2869cae14bbb8184004a42fc3070587fb | Author: Shawn Guo <shawn.guo@linaro.org> | Date: Thu Jun 14 11:16:14 2012 +0800 | | ARM: imx: enable SPARSE_IRQ for imx platform Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Acked-by: Shawn Guo <shawn.guo@linaro.org> 18 September 2012, 14:46:50 UTC
3549517 Fabio Estevam 17 September 2012, 01:28:35 UTC ARM: imx: armadillo5x0: Fix illegal register access Since commit eb92044eb (ARM i.MX3: Make ccm base address a variable ) it is necessary to pass the CCM register base as a variable. Fix the CCM register access in mach-armadillo5x0 by passing mx3_ccm_base and avoid illegal accesses. Also applies to v3.5 Reported-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Cc: stable@vger.kernel.org 18 September 2012, 14:46:24 UTC
652f5b5 Olof Johansson 18 September 2012, 14:43:16 UTC Merge tag 'at91-fixes' of git://github.com/at91linux/linux-at91 into fixes From Nicolas Ferre: Modify AT91 device tree files for making the GPIO interrupts work. * tag 'at91-fixes' of git://github.com/at91linux/linux-at91: ARM: at91: fix missing #interrupt-cells on gpio-controller 18 September 2012, 14:43:16 UTC
0921dce Olof Johansson 18 September 2012, 14:41:25 UTC Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: ARM: shmobile: kzm9g: bugfix: correct mmcif interrupt settings 18 September 2012, 14:41:25 UTC
d7235b8 Olof Johansson 18 September 2012, 14:40:02 UTC Merge branch 'v3.6-samsung-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes * 'v3.6-samsung-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: SAMSUNG: Use spin_lock_{irqsave,irqrestore} in clk_set_rate ARM: SAMSUNG: use spin_lock_irqsave() in clk_set_parent 18 September 2012, 14:40:02 UTC
256d0ea Stephen M. Cameron 14 September 2012, 21:34:25 UTC [SCSI] hpsa: fix handling of protocol error If a command status of CMD_PROTOCOL_ERR is received, this information should be conveyed to the SCSI mid layer, not dropped on the floor. CMD_PROTOCOL_ERR may be received from the Smart Array for any commands destined for an external RAID controller such as a P2000, or commands destined for tape drives or CD/DVD-ROM drives, if for instance a cable is disconnected. This mostly affects multipath configurations, as disconnecting a cable on a non-multipath configuration is not going to do anything good regardless of whether CMD_PROTOCOL_ERR is handled correctly or not. Not handling CMD_PROTOCOL_ERR correctly in a multipath configaration involving external RAID controllers may cause data corruption, so this is quite a serious bug. This bug should not normally cause a problem for direct attached disk storage. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Cc: stable@vger.kernel.org Signed-off-by: James Bottomley <JBottomley@Parallels.com> 18 September 2012, 11:29:30 UTC
2453f5f Stephen M. Cameron 14 September 2012, 21:35:10 UTC cciss: fix handling of protocol error If a command completes with a status of CMD_PROTOCOL_ERR, this information should be conveyed to the SCSI mid layer, not dropped on the floor. Unlike a similar bug in the hpsa driver, this bug only affects tape drives and CD and DVD ROM drives in the cciss driver, and to induce it, you have to disconnect (or damage) a cable, so it is not a very likely scenario (which would explain why the bug has gone undetected for the last 10 years.) Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Cc: stable@vger.kernel.org Signed-off-by: Jens Axboe <axboe@kernel.dk> 18 September 2012, 09:57:08 UTC
2bd6efa Alan Cox 17 September 2012, 10:47:13 UTC blk: add an upper sanity check on partition adding 65536 should be ludicrous anyway but without it we overflow the memory computation doing the allocation and badness occurs. Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> 18 September 2012, 09:56:29 UTC
5e071e2 Al Viro 18 September 2012, 08:04:37 UTC sh: Fix up TIF_NOTIFY_RESUME sans TIF_SIGPENDING handling. As Al notes, we missed a TIF_NOTIFY_RESUME check which caused any handlers without TIF_SIGPENDING also set to skip the notification: Looks like while it is in the relevant masks *and* checked in do_notify_resume() both on 32bit and 64bit variants since commit ab99c733ae73cce31f2a2434f7099564e5a73d95 ("sh: Make syscall tracer use tracehook notifiers, add TIF_NOTIFY_RESUME.") they are actually *not* reached without simulataneous SIGPENDING, since the actual glue in the callers had not been updated back then and still checks for _TIF_SIGPENDING alone when deciding whether to hit do_notify_resume() or not. Reported-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Tested-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com> Signed-off-by: Paul Mundt <lethal@linux-sh.org> 18 September 2012, 08:04:37 UTC
077664a Laurent Pinchart 14 September 2012, 18:25:48 UTC sh: pfc: Release spinlock in sh_pfc_gpio_request_enable() error path The sh_pfc_gpio_request_enable() function acquires a spinlock but fails to release it before returning if the requested mux type is not supported. Fix this. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Paul Mundt <lethal@linux-sh.org> 18 September 2012, 07:54:46 UTC
61c6e75 Sachin Kamat 17 September 2012, 09:50:23 UTC DMA: PL330: Check the pointer returned by kzalloc kzalloc could return NULL. Hence add a check to avoid NULL pointer dereference. Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Acked-by: Jassi Brar <jassisinghbrar@gmail.com> Cc: Stable <stable@vger.kernel.org> Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com> 18 September 2012, 03:34:52 UTC
2e2c682 Sachin Kamat 17 September 2012, 09:50:22 UTC DMA: PL330: Fix potential NULL pointer dereference in pl330_submit_req() 'r->cfg' is being checked for NULL. However, it is dereferenced in the previous statements. Thus moving those statements within the check. Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Acked-by: Jassi Brar <jassisinghbrar@gmail.com> Cc: Stable <stable@vger.kernel.org> Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com> 18 September 2012, 03:34:52 UTC
a704835 Tetsuyuki Kobayashi 06 September 2012, 07:19:36 UTC ARM: shmobile: kzm9g: bugfix: correct mmcif interrupt settings Correct interrupt settings of sh_mmc:int and sh_mmc:error in board-kzm9g.c. Signed-off-by: Tetsuyuki Kobayashi <koba@kmckk.co.jp> Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Simon Horman <horms@verge.net.au> 18 September 2012, 02:19:44 UTC
d6838a6 Tushar Behera 18 September 2012, 01:05:34 UTC ARM: SAMSUNG: Use spin_lock_{irqsave,irqrestore} in clk_set_rate The spinlock clocks_lock can be held during ISR, hence it is not safe to hold that lock with disabling interrupts. It fixes following potential deadlock. ========================================================= [ INFO: possible irq lock inversion dependency detected ] 3.6.0-rc4+ #2 Not tainted --------------------------------------------------------- swapper/0/1 just changed the state of lock: (&(&host->lock)->rlock){-.....}, at: [<c027fb0d>] sdhci_irq+0x15/0x564 but this lock took another, HARDIRQ-unsafe lock in the past: (clocks_lock){+.+...} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(clocks_lock); local_irq_disable(); lock(&(&host->lock)->rlock); lock(clocks_lock); <Interrupt> lock(&(&host->lock)->rlock); *** DEADLOCK *** Signed-off-by: Tushar Behera <tushar.behera@linaro.org> Signed-off-by: Kukjin Kim <kgene.kim@samsung.com> 18 September 2012, 01:05:34 UTC
4651afb Linus Torvalds 17 September 2012, 23:05:23 UTC Merge branch 'for-3.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull another workqueue fix from Tejun Heo: "Unfortunately, yet another late fix. This too is discovered and fixed by Lai. This bug was introduced during this merge window by commit 25511a477657 ("workqueue: reimplement CPU online rebinding to handle idle workers") which started using WORKER_REBIND flag for idle rebind too. The bug is relatively easy to trigger if the CPU rapidly goes through off, on and then off (and stay off). The fix is on the safer side. This hasn't been on linux-next yet but I'm pushing early so that it can get more exposure before v3.6 release." * 'for-3.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: always clear WORKER_REBIND in busy_worker_rebind_fn() 17 September 2012, 23:05:23 UTC
960bd11 Lai Jiangshan 17 September 2012, 22:42:31 UTC workqueue: always clear WORKER_REBIND in busy_worker_rebind_fn() busy_worker_rebind_fn() didn't clear WORKER_REBIND if rebinding failed (CPU is down again). This used to be okay because the flag wasn't used for anything else. However, after 25511a477 "workqueue: reimplement CPU online rebinding to handle idle workers", WORKER_REBIND is also used to command idle workers to rebind. If not cleared, the worker may confuse the next CPU_UP cycle by having REBIND spuriously set or oops / get stuck by prematurely calling idle_worker_rebind(). WARNING: at /work/os/wq/kernel/workqueue.c:1323 worker_thread+0x4cd/0x5 00() Hardware name: Bochs Modules linked in: test_wq(O-) Pid: 33, comm: kworker/1:1 Tainted: G O 3.6.0-rc1-work+ #3 Call Trace: [<ffffffff8109039f>] warn_slowpath_common+0x7f/0xc0 [<ffffffff810903fa>] warn_slowpath_null+0x1a/0x20 [<ffffffff810b3f1d>] worker_thread+0x4cd/0x500 [<ffffffff810bc16e>] kthread+0xbe/0xd0 [<ffffffff81bd2664>] kernel_thread_helper+0x4/0x10 ---[ end trace e977cf20f4661968 ]--- BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff810b3db0>] worker_thread+0x360/0x500 PGD 0 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC Modules linked in: test_wq(O-) CPU 0 Pid: 33, comm: kworker/1:1 Tainted: G W O 3.6.0-rc1-work+ #3 Bochs Bochs RIP: 0010:[<ffffffff810b3db0>] [<ffffffff810b3db0>] worker_thread+0x360/0x500 RSP: 0018:ffff88001e1c9de0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff88001e633e00 RCX: 0000000000004140 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009 RBP: ffff88001e1c9ea0 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000002 R11: 0000000000000000 R12: ffff88001fc8d580 R13: ffff88001fc8d590 R14: ffff88001e633e20 R15: ffff88001e1c6900 FS: 0000000000000000(0000) GS:ffff88001fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000000 CR3: 00000000130e8000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process kworker/1:1 (pid: 33, threadinfo ffff88001e1c8000, task ffff88001e1c6900) Stack: ffff880000000000 ffff88001e1c9e40 0000000000000001 ffff88001e1c8010 ffff88001e519c78 ffff88001e1c9e58 ffff88001e1c6900 ffff88001e1c6900 ffff88001e1c6900 ffff88001e1c6900 ffff88001fc8d340 ffff88001fc8d340 Call Trace: [<ffffffff810bc16e>] kthread+0xbe/0xd0 [<ffffffff81bd2664>] kernel_thread_helper+0x4/0x10 Code: b1 00 f6 43 48 02 0f 85 91 01 00 00 48 8b 43 38 48 89 df 48 8b 00 48 89 45 90 e8 ac f0 ff ff 3c 01 0f 85 60 01 00 00 48 8b 53 50 <8b> 02 83 e8 01 85 c0 89 02 0f 84 3b 01 00 00 48 8b 43 38 48 8b RIP [<ffffffff810b3db0>] worker_thread+0x360/0x500 RSP <ffff88001e1c9de0> CR2: 0000000000000000 There was no reason to keep WORKER_REBIND on failure in the first place - WORKER_UNBOUND is guaranteed to be set in such cases preventing incorrectly activating concurrency management. Always clear WORKER_REBIND. tj: Updated comment and description. Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com> Signed-off-by: Tejun Heo <tj@kernel.org> 17 September 2012, 22:42:31 UTC
08077ca Linus Torvalds 17 September 2012, 22:01:14 UTC Merge branch 'akpm' (Andrew's patch-bomb) Merge fixes from Andrew Morton: "13 patches. 12 are fixes and one is a little preparatory thing for Andi." * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (13 commits) memory hotplug: fix section info double registration bug mm/page_alloc: fix the page address of higher page's buddy calculation drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe compiler.h: add __visible pid-namespace: limit value of ns_last_pid to (0, max_pid) include/net/sock.h: squelch compiler warning in sk_rmem_schedule() slub: consider pfmemalloc_match() in get_partial_node() slab: fix starting index for finding another object slab: do ClearSlabPfmemalloc() for all pages of slab nbd: clear waiting_queue on shutdown MAINTAINERS: fix TXT maintainer list and source repo path mm/ia64: fix a memory block size bug memory hotplug: reset pgdat->kswapd to NULL if creating kernel thread fails 17 September 2012, 22:01:14 UTC
f14851a qiuxishi 17 September 2012, 21:09:24 UTC memory hotplug: fix section info double registration bug There may be a bug when registering section info. For example, on my Itanium platform, the pfn range of node0 includes the other nodes, so other nodes' section info will be double registered, and memmap's page count will equal to 3. node0: start_pfn=0x100, spanned_pfn=0x20fb00, present_pfn=0x7f8a3, => 0x000100-0x20fc00 node1: start_pfn=0x80000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x080000-0x100000 node2: start_pfn=0x100000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x100000-0x180000 node3: start_pfn=0x180000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x180000-0x200000 free_all_bootmem_node() register_page_bootmem_info_node() register_page_bootmem_info_section() When hot remove memory, we can't free the memmap's page because page_count() is 2 after put_page_bootmem(). sparse_remove_one_section() free_section_usemap() free_map_bootmem() put_page_bootmem() [akpm@linux-foundation.org: add code comment] Signed-off-by: Xishi Qiu <qiuxishi@huawei.com> Signed-off-by: Jiang Liu <jiang.liu@huawei.com> Acked-by: Mel Gorman <mgorman@suse.de> Cc: "Luck, Tony" <tony.luck@intel.com> Cc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:38 UTC
0ba8f2d Li Haifeng 17 September 2012, 21:09:21 UTC mm/page_alloc: fix the page address of higher page's buddy calculation The heuristic method for buddy has been introduced since commit 43506fad21ca ("mm/page_alloc.c: simplify calculation of combined index of adjacent buddy lists"). But the page address of higher page's buddy was wrongly calculated, which will lead page_is_buddy to fail for ever. IOW, the heuristic method would be disabled with the wrong page address of higher page's buddy. Calculating the page address of higher page's buddy should be based higher_page with the offset between index of higher page and index of higher page's buddy. Signed-off-by: Haifeng Li <omycle@gmail.com> Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com> Reviewed-by: Michal Hocko <mhocko@suse.cz> Cc: KyongHo Cho <pullip.cho@samsung.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Minchan Kim <minchan.kim@gmail.com> Cc: Johannes Weiner <jweiner@redhat.com> Cc: <stable@vger.kernel.org> [2.6.38+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:38 UTC
8dcebaa Kevin Hilman 17 September 2012, 21:09:17 UTC drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe On some platforms, bootloaders are known to do some interesting RTC programming. Without going into the obscurities as to why this may be the case, suffice it to say the the driver should not make any assumptions about the state of the RTC when the driver loads. In particular, the driver probe should be sure that all interrupts are disabled until otherwise programmed. This was discovered when finding bursty I2C traffic every second on Overo platforms. This I2C overhead was keeping the SoC from hitting deep power states. The cause was found to be the RTC firing every second on the I2C-connected TWL PMIC. Special thanks to Felipe Balbi for suggesting to look for a rogue driver as the source of the I2C traffic rather than the I2C driver itself. Special thanks to Steve Sakoman for helping track down the source of the continuous RTC interrups on the Overo boards. Signed-off-by: Kevin Hilman <khilman@ti.com> Cc: Felipe Balbi <balbi@ti.com> Tested-by: Steve Sakoman <steve@sakoman.com> Cc: Alessandro Zummo <a.zummo@towertech.it> Tested-by: Shubhrajyoti Datta <omaplinuxkernel@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:38 UTC
9a858dc Andi Kleen 17 September 2012, 21:09:15 UTC compiler.h: add __visible gcc 4.6+ has support for a externally_visible attribute that prevents the optimizer from optimizing unused symbols away. Add a __visible macro to use it with that compiler version or later. This is used (at least) by the "Link Time Optimization" patchset. Signed-off-by: Andi Kleen <ak@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:38 UTC
579035d Andrew Vagin 17 September 2012, 21:09:12 UTC pid-namespace: limit value of ns_last_pid to (0, max_pid) The kernel doesn't check the pid for negative values, so if you try to write -2 to /proc/sys/kernel/ns_last_pid, you will get a kernel panic. The crash happens because the next pid is -1, and alloc_pidmap() will try to access to a nonexistent pidmap. map = &pid_ns->pidmap[pid/BITS_PER_PAGE]; Signed-off-by: Andrew Vagin <avagin@openvz.org> Acked-by: Cyrill Gorcunov <gorcunov@openvz.org> Acked-by: Oleg Nesterov <oleg@redhat.com> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Pavel Emelyanov <xemul@parallels.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:38 UTC
35c448a Chuck Lever 17 September 2012, 21:09:11 UTC include/net/sock.h: squelch compiler warning in sk_rmem_schedule() This warning: In file included from linux/include/linux/tcp.h:227:0, from linux/include/linux/ipv6.h:221, from linux/include/net/ipv6.h:16, from linux/include/linux/sunrpc/clnt.h:26, from linux/net/sunrpc/stats.c:22: linux/include/net/sock.h: In function `sk_rmem_schedule': linux/nfs-2.6/include/net/sock.h:1339:13: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] is seen with gcc (GCC) 4.6.3 20120306 (Red Hat 4.6.3-2) using the -Wextra option. Commit c76562b6709f ("netvm: prevent a stream-specific deadlock") accidentally replaced the "size" parameter of sk_rmem_schedule() with an unsigned int. This changes the semantics of the comparison in the return statement. In sk_wmem_schedule we have syntactically the same comparison, but "size" is a signed integer. In addition, __sk_mem_schedule() takes a signed integer for its "size" parameter, so there is an implicit type conversion in sk_rmem_schedule() anyway. Revert the "size" parameter back to a signed integer so that the semantics of the expressions in both sk_[rw]mem_schedule() are exactly the same. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Mel Gorman <mgorman@suse.de> Cc: David Miller <davem@davemloft.net> Cc: Joonsoo Kim <js1304@gmail.com> Cc: David Rientjes <rientjes@google.com> Cc: Pekka Enberg <penberg@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:38 UTC
8ba00bb Joonsoo Kim 17 September 2012, 21:09:09 UTC slub: consider pfmemalloc_match() in get_partial_node() get_partial() is currently not checking pfmemalloc_match() meaning that it is possible for pfmemalloc pages to leak to non-pfmemalloc users. This is a problem in the following situation. Assume that there is a request from normal allocation and there are no objects in the per-cpu cache and no node-partial slab. In this case, slab_alloc enters the slow path and new_slab_objects() is called which may return a PFMEMALLOC page. As the current user is not allowed to access PFMEMALLOC page, deactivate_slab() is called ([5091b74a: mm: slub: optimise the SLUB fast path to avoid pfmemalloc checks]) and returns an object from PFMEMALLOC page. Next time, when we get another request from normal allocation, slab_alloc() enters the slow-path and calls new_slab_objects(). In new_slab_objects(), we call get_partial() and get a partial slab which was just deactivated but is a pfmemalloc page. We extract one object from it and re-deactivate. "deactivate -> re-get in get_partial -> re-deactivate" occures repeatedly. As a result, access to PFMEMALLOC page is not properly restricted and it can cause a performance degradation due to frequent deactivation. deactivation frequently. This patch changes get_partial_node() to take pfmemalloc_match() into account and prevents the "deactivate -> re-get in get_partial() scenario. Instead, new_slab() is called. Signed-off-by: Joonsoo Kim <js1304@gmail.com> Acked-by: David Rientjes <rientjes@google.com> Signed-off-by: Mel Gorman <mgorman@suse.de> Cc: David Miller <davem@davemloft.net> Cc: Chuck Lever <chuck.lever@oracle.com> Cc: Pekka Enberg <penberg@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:38 UTC
d014dc2 Joonsoo Kim 17 September 2012, 21:09:06 UTC slab: fix starting index for finding another object In array cache, there is a object at index 0, check it. Signed-off-by: Joonsoo Kim <js1304@gmail.com> Signed-off-by: Mel Gorman <mgorman@suse.de> Cc: David Miller <davem@davemloft.net> Cc: Chuck Lever <chuck.lever@oracle.com> Cc: David Rientjes <rientjes@google.com> Cc: Pekka Enberg <penberg@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:38 UTC
30c29be Mel Gorman 17 September 2012, 21:09:03 UTC slab: do ClearSlabPfmemalloc() for all pages of slab Right now, we call ClearSlabPfmemalloc() for first page of slab when we clear SlabPfmemalloc flag. This is fine for most swap-over-network use cases as it is expected that order-0 pages are in use. Unfortunately it is possible that that __ac_put_obj() checks SlabPfmemalloc on a tail page and while this is harmless, it is sloppy. This patch ensures that the head page is always used. This problem was originally identified by Joonsoo Kim. [js1304@gmail.com: Original implementation and problem identification] Signed-off-by: Mel Gorman <mgorman@suse.de> Cc: David Miller <davem@davemloft.net> Cc: Chuck Lever <chuck.lever@oracle.com> Cc: Joonsoo Kim <js1304@gmail.com> Cc: David Rientjes <rientjes@google.com> Cc: Pekka Enberg <penberg@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:38 UTC
fded4e0 Paul Clements 17 September 2012, 21:09:02 UTC nbd: clear waiting_queue on shutdown Fix a serious but uncommon bug in nbd which occurs when there is heavy I/O going to the nbd device while, at the same time, a failure (server, network) or manual disconnect of the nbd connection occurs. There is a small window between the time that the nbd_thread is stopped and the socket is shutdown where requests can continue to be queued to nbd's internal waiting_queue. When this happens, those requests are never completed or freed. The fix is to clear the waiting_queue on shutdown of the nbd device, in the same way that the nbd request queue (queue_head) is already being cleared. Signed-off-by: Paul Clements <paul.clements@steeleye.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:37 UTC
e9b7d7c Gang Wei 17 September 2012, 21:08:59 UTC MAINTAINERS: fix TXT maintainer list and source repo path Signed-off-by: Gang Wei <gang.wei@intel.com> Cc: Richard L Maliszewski <richard.l.maliszewski@intel.com> Cc: Gang Wei <gang.wei@intel.com> Cc: Shane Wang <shane.wang@intel.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:37 UTC
05cf963 Jianguo Wu 17 September 2012, 21:08:56 UTC mm/ia64: fix a memory block size bug I found following definition in include/linux/memory.h, in my IA64 platform, SECTION_SIZE_BITS is equal to 32, and MIN_MEMORY_BLOCK_SIZE will be 0. #define MIN_MEMORY_BLOCK_SIZE (1 << SECTION_SIZE_BITS) Because MIN_MEMORY_BLOCK_SIZE is int type and length of 32bits, so MIN_MEMORY_BLOCK_SIZE(1 << 32) will will equal to 0. Actually when SECTION_SIZE_BITS >= 31, MIN_MEMORY_BLOCK_SIZE will be wrong. This will cause wrong system memory infomation in sysfs. I think it should be: #define MIN_MEMORY_BLOCK_SIZE (1UL << SECTION_SIZE_BITS) And "echo offline > memory0/state" will cause following call trace: kernel BUG at mm/memory_hotplug.c:885! sh[6455]: bugcheck! 0 [1] Pid: 6455, CPU 0, comm: sh psr : 0000101008526030 ifs : 8000000000000fa4 ip : [<a0000001008c40f0>] Not tainted (3.6.0-rc1) ip is at offline_pages+0x210/0xee0 Call Trace: show_stack+0x80/0xa0 show_regs+0x640/0x920 die+0x190/0x2c0 die_if_kernel+0x50/0x80 ia64_bad_break+0x3d0/0x6e0 ia64_native_leave_kernel+0x0/0x270 offline_pages+0x210/0xee0 alloc_pages_current+0x180/0x2a0 Signed-off-by: Jianguo Wu <wujianguo@huawei.com> Signed-off-by: Jiang Liu <jiang.liu@huawei.com> Cc: "Luck, Tony" <tony.luck@intel.com> Reviewed-by: Michal Hocko <mhocko@suse.cz> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:37 UTC
18b48d5 Wen Congyang 17 September 2012, 21:08:55 UTC memory hotplug: reset pgdat->kswapd to NULL if creating kernel thread fails If kthread_run() fails, pgdat->kswapd contains errno. When we stop this thread, we only check whether pgdat->kswapd is NULL and access it. If it contains errno, it will cause page fault. Reset pgdat->kswapd to NULL when creating kernel thread fails can avoid this problem. Signed-off-by: Wen Congyang <wency@cn.fujitsu.com> Reviewed-by: Minchan Kim <minchan@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 22:00:37 UTC
4e21f4e Guenter Roeck 11 September 2012, 20:39:08 UTC hwmon: (ads7871) Add 'name' sysfs attribute The 'name' sysfs attribute is mandatory for hwmon devices, but was missing in this driver. Cc: Paul Thomas <pthomas8589@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck <linux@roeck-us.net> Acked-by: Jean Delvare <khali@linux-fr.org> Acked-by: Paul Thomas <pthomas8589@gmail.com> 17 September 2012, 21:29:20 UTC
2f1f4d9 Alex Deucher 17 September 2012, 21:26:24 UTC Revert "drm/radeon: rework pll selection (v3)" This reverts commit 985f61f7ee647ad570c05eab0b74915da2ac8e19. This commit fixed certain cases, but ended up regressing others due to limitations in the current KMS API. A proper fix is too invasive for 3.6. Push it back to 3.7. Reported-by: Andres Freund <andres@anarazel.de> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 17 September 2012, 21:26:24 UTC
2ade0b7 Linus Torvalds 17 September 2012, 20:21:02 UTC Merge tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband Pull InfiniBand/RDMA fixes from Roland Dreier: - A couple more IPoIB fixes for regressions introduced by path database conversion - Minor other fixes to low-level drivers (cxgb4, mlx4, qib, ocrdma) * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IB/qib: Fix failure of compliance test C14-024#06_LocalPortNum RDMA/ocrdma: Fix CQE expansion of unsignaled WQE mlx4_core: Fix integer overflows so 8TBs of memory registration works IPoIB: Fix AB-BA deadlock when deleting neighbours IPoIB: Fix memory leak in the neigh table deletion flow RDMA/cxgb4: Move dereference below NULL test 17 September 2012, 20:21:02 UTC
6bf6104 Francesco Ruggeri 13 September 2012, 22:03:37 UTC fs/proc: fix potential unregister_sysctl_table hang The unregister_sysctl_table() function hangs if all references to its ctl_table_header structure are not dropped. This can happen sometimes because of a leak in proc_sys_lookup(): proc_sys_lookup() gets a reference to the table via lookup_entry(), but it does not release it when a subsequent call to sysctl_follow_link() fails. This patch fixes this leak by making sure the reference is always dropped on return. See also commit 076c3eed2c31 ("sysctl: Rewrite proc_sys_lookup introducing find_entry and lookup_entry") which reorganized this code in 3.4. Tested in Linux 3.4.4. Signed-off-by: Francesco Ruggeri <fruggeri@aristanetworks.com> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 17 September 2012, 17:32:03 UTC
10cce6d sreekanth.reddy@lsi.com 22 August 2012, 11:25:13 UTC [SCSI] mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA This patch checks whether HBA is SAS2008 B0 controller. if it is a SAS2008 B0 controller then it use IO-APIC interrupt instead of MSIX, as SAS2008 B0 controller doesn't support MSIX interrupts. [jejb: fix whitespace problems] Signed-off-by: Sreekanth Reddy <sreekanth.reddy@lsi.com> Cc: <stable@vger.kernel.org> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 17 September 2012, 12:49:47 UTC
d653220 Eddie Wai 21 August 2012, 17:35:53 UTC [SCSI] bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload This patch fixes the following kernel panic invoked by uninitialized fields in the chip initialization for the 1G bnx2 iSCSI offload. One of the bits in the chip initialization is being used by the latest firmware to control overflow packets. When this control bit gets enabled erroneously, it would ultimately result in a bad packet placement which would cause the bnx2 driver to dereference a NULL ptr in the placement handler. This can happen under certain stress I/O environment under the Linux iSCSI offload operation. This change only affects Broadcom's 5709 chipset. Unable to handle kernel NULL pointer dereference at 0000000000000008 RIP: [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5 Pid: 0, comm: swapper Tainted: G ---- 2.6.18-333.el5debug #2 RIP: 0010:[<ffffffff881f0e7d>] [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5 RSP: 0018:ffff8101b575bd50 EFLAGS: 00010216 RAX: 0000000000000005 RBX: ffff81007c5fb180 RCX: 0000000000000000 RDX: 0000000000000ffc RSI: 00000000817e8000 RDI: 0000000000000220 RBP: ffff81015bbd7ec0 R08: ffff8100817e9000 R09: 0000000000000000 R10: ffff81007c5fb180 R11: 00000000000000c8 R12: 000000007a25a010 R13: 0000000000000000 R14: 0000000000000005 R15: ffff810159f80558 FS: 0000000000000000(0000) GS:ffff8101afebc240(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 0000000000000008 CR3: 0000000000201000 CR4: 00000000000006a0 Process swapper (pid: 0, threadinfo ffff8101b5754000, task ffff8101afebd820) Stack: 000000000000000b ffff810159f80000 0000000000000040 ffff810159f80520 ffff810159f80500 00cf00cf8008e84b ffffc200100939e0 ffff810009035b20 0000502900000000 000000be00000001 ffff8100817e7810 00d08101b575bea8 Call Trace: <IRQ> [<ffffffff8008e0d0>] show_schedstat+0x1c2/0x25b [<ffffffff881f1886>] :bnx2:bnx2_poll+0xf6/0x231 [<ffffffff8000c9b9>] net_rx_action+0xac/0x1b1 [<ffffffff800125a0>] __do_softirq+0x89/0x133 [<ffffffff8005e30c>] call_softirq+0x1c/0x28 [<ffffffff8006d5de>] do_softirq+0x2c/0x7d [<ffffffff8006d46e>] do_IRQ+0xee/0xf7 [<ffffffff8005d625>] ret_from_intr+0x0/0xa <EOI> [<ffffffff801a5780>] acpi_processor_idle_simple+0x1c5/0x341 [<ffffffff801a573d>] acpi_processor_idle_simple+0x182/0x341 [<ffffffff801a55bb>] acpi_processor_idle_simple+0x0/0x341 [<ffffffff80049560>] cpu_idle+0x95/0xb8 [<ffffffff80078b1c>] start_secondary+0x479/0x488 Signed-off-by: Eddie Wai <eddie.wai@broadcom.com> Cc: stable@vger.kernel.org Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 17 September 2012, 12:40:32 UTC
51ac51a Jean-Christophe PLAGNIOL-VILLARD 13 September 2012, 10:40:26 UTC ARM: at91: fix missing #interrupt-cells on gpio-controller Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Tested-by: Bo Shen <voice.shen@atmel.com> Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com> 17 September 2012, 08:25:01 UTC
b98b601 Wang Xingchao 12 September 2012, 23:43:22 UTC drm/i915: HDMI - Clear Audio Enable bit for Hot Plug Clear Audio Enable bit to trigger unsolicated event to notify Audio Driver part the HDMI hot plug change. The patch fixed the bug when remove HDMI cable the bit was not cleared correctly. In intel_hdmi_dpms(), if intel_hdmi->has_audio been true, the "Audio enable bit" will be set to trigger unsolicated event to notify Alsa driver the change. intel_hdmi->has_audio will be reset to false from intel_hdmi_detect() after remove the hdmi cable, here's debug log: [ 187.494153] [drm:output_poll_execute], [CONNECTOR:17:HDMI-A-1] status updated from 1 to 2 [ 187.525349] [drm:intel_hdmi_detect], HDMI: has_audio = 0 so when comes back to intel_hdmi_dpms(), the "Audio enable bit" will not be cleared. And this cause the eld infomation and pin presence doesnot update accordingly in alsa driver side. This patch will also trigger unsolicated event to alsa driver to notify the hot plug event: [ 187.853159] ALSA sound/pci/hda/patch_hdmi.c:772 HDMI hot plug event: Codec=3 Pin=5 Presence_Detect=0 ELD_Valid=1 [ 187.853268] ALSA sound/pci/hda/patch_hdmi.c:990 HDMI status: Codec=3 Pin=5 Presence_Detect=0 ELD_Valid=0 Signed-off-by: Wang Xingchao <xingchao.wang@intel.com> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> 17 September 2012, 08:13:02 UTC
7e81a42 Chris Wilson 15 September 2012, 08:41:57 UTC drm/i915: Reduce a pin-leak BUG into a WARN Pin-leaks persist and we get the perennial bug reports of machine lockups to the BUG_ON(pin_count==MAX). If we instead loudly report that the object cannot be pinned at that time it should prevent the driver from locking up, and hopefully restore a semblance of working whilst still leaving us a OOPS to debug. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> 17 September 2012, 08:12:57 UTC
5b5896e Daniel Vetter 11 September 2012, 10:37:55 UTC drm/i915: enable lvds pin pairs before dpll on gen2 Otherwise things migt not work too well. Breakage introduced in commit eb1cbe4848b01f9f073064377875bc7d71eb401b Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Wed Mar 28 23:12:16 2012 +0200 drm/i915: split PLL update code out of i9xx_crtc_mode_set Cc: Jesse Barnes <jbarnes@virtuousgeek.org> Cc: stable@vger.kernel.org (for 3.5 only) Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> 17 September 2012, 08:04:39 UTC
03429f3 Stefan Haberland 11 September 2012, 15:19:12 UTC s390/dasd: fix read unit address configuration loop Read unit address is done for all devices during online processing to read out LCU features. This is also done after disconnect/connect a LCU. Some older storage hardware does not provide the capability to read unit address configuration. This leads to a loop trying to read unit address configuration every 30 seconds. The device is still operational but logs are flooded with error messages. Fix the loop by recognizing a command reject saying that the suborder for ruac is not supported. Signed-off-by: Stefan Haberland <stefan.haberland@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> 17 September 2012, 07:58:21 UTC
12d7b10 Stefan Haberland 11 September 2012, 13:10:58 UTC s390/dasd: fix pathgroup race If a new path is available we need to verify the path data. If it is the first path for a device the stop bits are removed after path verification. If a pathgroup is established we need to set system characteristics for the lcu. Therefore I/O has to be started. If the device is stopped the set system characteristics worker may block the path verification worker and the device is blocked. Turn on failfast for set system characteristics CQR to prevent a deadlock with the path verification worker. If a pathgroup is established on a device that is not in use trigger path verification. Maybe we were not informed about a working path. Signed-off-by: Stefan Haberland <stefan.haberland@de.ibm.com> Reviewed-by: Stefan Weinhuber <wein@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> 17 September 2012, 07:58:18 UTC
4db84d4 Gerald Schaefer 10 September 2012, 14:43:26 UTC s390/mm: fix user access page-table walk code The s390 page-table walk code, used for user copy and futex, currently cannot handle huge pages. As far as user copy is concerned, that is not really a problem because those functions will only be used on old hardware that has no huge page support. But the futex code will also use pagetable walk functions on current hardware when user space runs in primary space mode. So, if a futex sits in a huge page, the futex operation on it will result in a page fault loop or even data corruption. This patch adds the code for resolving huge page mappings in the user access pagetable walk code on s390. Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> 17 September 2012, 07:44:24 UTC
a1f6d8f David S. Miller 17 September 2012, 05:28:58 UTC Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless John W. Linville says: ==================== This is a batch of fixes intended for the 3.6 stream. Arend van Spriel sends a simple thinko fix to correct a constant, preventing the setting of an invalid power level. Colin Ian King gives us a simple allocation failure check to avoid a NULL pointer dereference. Felix Fietkau sends another ath9k tx power patch, this time disabling a feature that has been reported to cause rx problems. Hante Meuleman provides a pair of endian fixes for brcmfmac. Larry Finger offers an rtlwifi fix that avoids a system lockup related to loading the wrong firmware for RTL8188CE devices. These have been in linux-next for a few days and I think they should be included in the final 3.6 kernel if possible. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 17 September 2012, 05:28:58 UTC
dbc5e1e Mandeep Singh Baines 27 August 2012, 16:42:37 UTC ARM: SAMSUNG: use spin_lock_irqsave() in clk_set_parent From 0cdf3aff, "ARM: SAMSUNG: use spin_lock_irqsave() in clk_{enable,disable}": The clk_enable()and clk_disable() can be used process and ISR either. And actually it is used for real product and other platforms use it now. So spin_lock_irqsave() should be used instead. We need to make a similar change in clk_set_parent(). Otherwise, you can potentially get spinlock recursion: BUG: spinlock recursion on CPU#0, kinteractive/68 lock: 807832a8, .magic: dead4ead, .owner: kinteractive/68, .owner_cpu: 0 [<80015f54>] (unwind_backtrace+0x0/0x128) from [<804f2914>] (dump_stack+0x20/0x24) [<804f2914>] (dump_stack+0x20/0x24) from [<804f57b8>] (spin_dump+0x80/0x94) [<804f57b8>] (spin_dump+0x80/0x94) from [<804f57f8>] (spin_bug+0x2c/0x30) [<804f57f8>] (spin_bug+0x2c/0x30) from [<80222730>] (do_raw_spin_lock+0x54/0x150) [<80222730>] (do_raw_spin_lock+0x54/0x150) from [<804f96ec>] (_raw_spin_lock_irqsave+0x20/0x28) [<804f96ec>] (_raw_spin_lock_irqsave+0x20/0x28) from [<80022ea4>] (clk_enable+0x3c/0x84) [<80022ea4>] (clk_enable+0x3c/0x84) from [<8038336c>] (s5p_mfc_clock_on+0x60/0x74) [<8038336c>] (s5p_mfc_clock_on+0x60/0x74) from [<8038645c>] (s5p_mfc_read_info+0x20/0x38) [<8038645c>] (s5p_mfc_read_info+0x20/0x38) from [<8037ca3c>] (s5p_mfc_handle_frame+0x2e4/0x4bc) [<8037ca3c>] (s5p_mfc_handle_frame+0x2e4/0x4bc) from [<8037d420>] (s5p_mfc_irq+0x1ec/0x6cc) [<8037d420>] (s5p_mfc_irq+0x1ec/0x6cc) from [<8007fc74>] (handle_irq_event_percpu+0x8c/0x244) [<8007fc74>] (handle_irq_event_percpu+0x8c/0x244) from [<8007fe78>] (handle_irq_event+0x4c/0x6c) [<8007fe78>] (handle_irq_event+0x4c/0x6c) from [<80082dd8>] (handle_fasteoi_irq+0xe4/0x150) [<80082dd8>] (handle_fasteoi_irq+0xe4/0x150) from [<8007f424>] (generic_handle_irq+0x3c/0x50) [<8007f424>] (generic_handle_irq+0x3c/0x50) from [<8000f7c4>] (handle_IRQ+0x88/0xc8) [<8000f7c4>] (handle_IRQ+0x88/0xc8) from [<80008564>] (gic_handle_irq+0x44/0x68) [<80008564>] (gic_handle_irq+0x44/0x68) from [<8000e400>] (__irq_svc+0x40/0x60) Exception stack(0xef3cbe68 to 0xef3cbeb0) [<8000e400>] (__irq_svc+0x40/0x60) from [<80022cfc>] (clk_set_parent+0x30/0x74) [<80022cfc>] (clk_set_parent+0x30/0x74) from [<803ac7f8>] (set_apll.isra.0+0x28/0xb0) [<803ac7f8>] (set_apll.isra.0+0x28/0xb0) from [<803ac8e4>] (exynos5250_set_frequency+0x64/0xb8) [<803ac8e4>] (exynos5250_set_frequency+0x64/0xb8) from [<803ac280>] (exynos_target+0x1b0/0x220) [<803ac280>] (exynos_target+0x1b0/0x220) from [<803a4a0c>] (__cpufreq_driver_target+0xb0/0xd4) [<803a4a0c>] (__cpufreq_driver_target+0xb0/0xd4) from [<803aab80>] (cpufreq_interactive_updown_task+0x214/0x264) [<803aab80>] (cpufreq_interactive_updown_task+0x214/0x264) from [<80047d04>] (kthread+0x9c/0xa8) [<80047d04>] (kthread+0x9c/0xa8) from [<8000fa48>] (kernel_thread_exit+0x0/0x8) Signed-off-by: Mandeep Singh Baines <msb@chromium.org> Suggested-by: Sunil Mazhavanchery <sunilm@samsung.com> Cc: linux-arm-kernel@lists.infradead.org Cc: linux-samsung-soc@vger.kernel.org Cc: Ben Dooks <ben-linux@fluff.org> Cc: Russell King <linux@arm.linux.org.uk> Cc: Minho Ban <mhban@samsung.com> Cc: Jaecheol Lee <jc.lee@samsung.com> Cc: Sunyoung Kang <sy0816.kang@samsung.com> Cc: Olof Johansson <olofj@chromium.org> Signed-off-by: Kukjin Kim <kgene.kim@samsung.com> 17 September 2012, 04:13:42 UTC
e376fdf Ralf Baechle 16 September 2012, 23:23:21 UTC MIPS: Malta: Don't crash on spurious interrupt. 48d480b0bde794781fcae9501fb043c1bac0e523 [[MIPS] Malta: Fix off by one bug in interrupt handler.] did not take in account that irq_ffs() will also return 0 if for some reason the set of pending interrupts happens to be empty. This is trivial to trigger with a RM5261 CPU module running a 64-bit kernel and results in something like the following: CPU 0 Unable to handle kernel paging request at virtual address 0000000000000000, epc == ffffffff801772d0, ra == ffffffff8017ad24 Oops[#1]: Cpu 0 $ 0 : 0000000000000000 ffffffff9000a4e0 ffffffff9000a4e0 ffffffff9000a4e0 $ 4 : ffffffff80592be0 0000000000000000 00000000000000d6 ffffffff80322ed0 $ 8 : ffffffff805fe538 0000000000000000 ffffffff9000a4e0 ffffffff80590000 $12 : 00000000000000d6 0000000000000000 ffffffff80600000 ffffffff805fe538 $16 : 0000000000000000 0000000000000010 ffffffff80592be0 0000000000000010 $20 : 0000000000000000 0000000000500001 0000000000000000 ffffffff8051e078 $24 : 0000000000000028 ffffffff803226e8 $28 : 9800000003828000 980000000382b900 ffffffff8051e060 ffffffff8017ad24 Hi : 0000000000000000 Lo : 0000006388974000 epc : ffffffff801772d0 handle_irq_event_percpu+0x70/0x2f0 Not tainted ra : ffffffff8017ad24 handle_percpu_irq+0x54/0x88 Status: 9000a4e2 KX SX UX KERNEL EXL Cause : 00808008 BadVA : 0000000000000000 PrId : 000028a0 (Nevada) Modules linked in: Process init (pid: 1, threadinfo=9800000003828000, task=9800000003827968, tls=0000000077087490) Stack : ffffffff80592be0 ffffffff8058d248 0000000000000040 0000000000000000 ffffffff80613340 0000000000500001 ffffffff805a0000 0000000000000882 9800000003b89000 ffffffff8017ad24 00000000000000d5 0000000000000010 ffffffff9000a4e1 ffffffff801769f4 ffffffff9000a4e0 ffffffff801037f8 0000000000000000 ffffffff80101c44 0000000000000000 ffffffff9000a4e0 0000000000000000 9000000018000000 90000000180003f9 0000000000000001 0000000000000000 00000000000000ff 0000000000000018 0000000000000001 0000000000000001 00000000003fffff 0000000000000020 ffffffff802cf7ac ffffffff80208918 000000007fdadf08 ffffffff80612d88 ffffffff9000a4e1 0000000000000040 0000000000000000 ffffffff80613340 0000000000500001 ... Call Trace: [<ffffffff801772d0>] handle_irq_event_percpu+0x70/0x2f0 [<ffffffff8017ad24>] handle_percpu_irq+0x54/0x88 [<ffffffff801769f4>] generic_handle_irq+0x44/0x60 [<ffffffff801037f8>] do_IRQ+0x48/0x70 [<ffffffff80101c44>] ret_from_irq+0x0/0x4 [<ffffffff80326170>] serial8250_startup+0x310/0x870 [<ffffffff8032175c>] uart_startup.part.7+0x9c/0x330 [<ffffffff80321b4c>] uart_open+0x15c/0x1b0 [<ffffffff80302034>] tty_open+0x1fc/0x720 [<ffffffff801bffac>] chrdev_open+0x7c/0x180 [<ffffffff801b9ab8>] do_dentry_open.isra.14+0x288/0x390 [<ffffffff801bac5c>] nameidata_to_filp+0x5c/0xc0 [<ffffffff801ca700>] do_last.isra.33+0x330/0x8f0 [<ffffffff801caf3c>] path_openat+0xbc/0x440 [<ffffffff801cb3c8>] do_filp_open+0x38/0xa8 [<ffffffff801bade4>] do_sys_open+0x124/0x218 [<ffffffff80110538>] handle_sys+0x118/0x13c Code: 02d5a825 12800012 02a0b02d <de820000> de850008 0040f809 0220202d 0040a82d 40026000 ---[ end trace 5d8e7b9a86badd2d ]--- Kernel panic - not syncing: Fatal exception in interrupt Signed-off-by: Ralf Baechle <ralf@linux-mips.org> 17 September 2012, 00:04:29 UTC
5698bd7 Linus Torvalds 16 September 2012, 21:58:51 UTC Linux 3.6-rc6 16 September 2012, 21:58:51 UTC
73f8be2 Linus Torvalds 16 September 2012, 20:22:21 UTC Merge tag 'mfd-for-linus-3.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6 Pull mfd fixes from Samuel Ortiz: "This is the remaining MFD fixes for 3.6, with 5 pending fixes: - A tps65217 build error fix. - A lcp_ich regression fix caused by the MFD driver failing to initialize the watchdog sub device due to ACPI conflicts. - 2 MAX77693 interrupt handling bug fixes. - An MFD core fix, adding an IRQ domain argument to the MFD device addition API in order to prevent silent and potentially harmful remapping behaviour changes for drivers supporting non-DT platforms." * tag 'mfd-for-linus-3.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6: mfd: MAX77693: Fix NULL pointer error when initializing irqs mfd: MAX77693: Fix interrupt handling bug mfd: core: Push irqdomain mapping out into devices mfd: lpc_ich: Fix a 3.5 kernel regression for iTCO_wdt driver mfd: Move tps65217 regulator plat data handling to regulator 16 September 2012, 20:22:21 UTC
c500ce3 Linus Torvalds 16 September 2012, 20:20:43 UTC Merge tag 'for-3.6-rc6' of git://gitorious.org/linux-pwm/linux-pwm Pull pwm fixes from Thierry Reding: "While this comes a bit later than I had wished, both patches are rather minor and touch only new drivers so I think these are still safe for merging." * tag 'for-3.6-rc6' of git://gitorious.org/linux-pwm/linux-pwm: pwm: pwm-tiehrpwm: Fix conflicting channel period setting pwm: pwm-tiecap: Disable APWM mode after configure 16 September 2012, 20:20:43 UTC
76e77da Linus Torvalds 16 September 2012, 20:00:36 UTC Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending Pull scsi target fixes from Nicholas Bellinger: "Here is the current set of target-pending fixes headed for v3.6-final The main parts of this series include bug-fixes from Paolo Bonzini to address an use-after-free bug in pSCSI sense exception handling, along with addressing some long-standing bugs wrt the handling of zero- length SCSI CDB payloads also specific to pSCSI pass-through device backends." * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: target: go through normal processing for zero-length REQUEST_SENSE target: support zero allocation length in REQUEST SENSE target: support zero-size allocation lengths in transport_kmap_data_sg target: fail REPORT LUNS with less than 16 bytes of payload target: report too-small parameter lists everywhere target: go through normal processing for zero-length PSCSI commands target: fix use-after-free with PSCSI sense data target: simplify code around transport_get_sense_data target: move transport_get_sense_data target: Check idr_get_new return value in iscsi_login_zero_tsih_s1 target: Fix ->data_length re-assignment bug with SCSI overflow 16 September 2012, 20:00:36 UTC
9bc6759 Linus Torvalds 16 September 2012, 19:59:42 UTC Merge tag 'pm-for-3.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael J. Wysocki: "Three ACPI device power management fixes related to checking and setting device power states." * tag 'pm-for-3.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / PM: Use KERN_DEBUG when no power resources are found ACPI / PM: Fix resource_lock dead lock in acpi_power_on_device ACPI / PM: Infer parent power state from child if unknown, v2 16 September 2012, 19:59:42 UTC
6167f81 Linus Torvalds 16 September 2012, 19:58:44 UTC Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs Pull a btrfs revert from Chris Mason: "My for-linus branch has one revert in the new quota code. We're building up more fixes at etc for the next merge window, but I'm keeping them out unless they are bigger regressions or have a huge impact." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: Revert "Btrfs: fix some error codes in btrfs_qgroup_inherit()" 16 September 2012, 19:58:44 UTC
a34689d Linus Torvalds 16 September 2012, 19:57:59 UTC Merge tag 'sound-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull more sound fixes from Takashi Iwai: "Yet more (a bunch of) small fixes that slipped from the previous pull request. Most of commits are pending ASoC fixes, all of which are fairly trivial commits." * tag 'sound-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: wm8904: correct the index ALSA: hda - Yet another position_fix quirk for ASUS machines ASoC: tegra: fix maxburst settings in dmaengine code ASoC: samsung dma - Don't indicate support for pause/resume. ASoC: mc13783: Remove mono support ASoC: arizona: Fix typo in 44.1kHz rates ASoC: spear: correct the check for NULL dma_buffer pointer sound: tegra_alc5632: remove HP detect GPIO inversion ASoC: atmel-ssc: include linux/io.h for raw io ASoC: dapm: Don't force card bias level to be updated ASoC: dapm: Make sure we update the bias level for CODECs with no op ASoC: am3517evm: fix error return code ASoC: ux500_msp_i2s: better use devm functions and fix error return code ASoC: imx-sgtl5000: fix error return code 16 September 2012, 19:57:59 UTC
37407ea Linus Torvalds 16 September 2012, 19:29:43 UTC Revert "sched: Improve scalability via 'CPU buddies', which withstand random perturbations" This reverts commit 970e178985cadbca660feb02f4d2ee3a09f7fdda. Nikolay Ulyanitsky reported thatthe 3.6-rc5 kernel has a 15-20% performance drop on PostgreSQL 9.2 on his machine (running "pgbench"). Borislav Petkov was able to reproduce this, and bisected it to this commit 970e178985ca ("sched: Improve scalability via 'CPU buddies' ...") apparently because the new single-idle-buddy model simply doesn't find idle CPU's to reschedule on aggressively enough. Mike Galbraith suspects that it is likely due to the user-mode spinlocks in PostgreSQL not reacting well to preemption, but we don't really know the details - I'll just revert the commit for now. There are hopefully other approaches to improve scheduler scalability without it causing these kinds of downsides. Reported-by: Nikolay Ulyanitsky <lystor@gmail.com> Bisected-by: Borislav Petkov <bp@alien8.de> Acked-by: Mike Galbraith <efault@gmx.de> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 16 September 2012, 19:29:43 UTC
e1e5b7e Matthew Leach 11 September 2012, 16:56:57 UTC ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores This patch zeroes the SCTLR.TRE bit prior to setting the mapping as cacheable for ARMv7 cores in the decompressor, ensuring that the memory region attributes are obtained from the C and B bits, not from the page tables. Cc: Nicolas Pitre <nico@fluxnic.net> Reviewed-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Matthew Leach <matthew.leach@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Cc: <stable@vger.kernel.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> 15 September 2012, 23:16:16 UTC
b186b12 Chanwoo Choi 21 August 2012, 06:16:23 UTC mfd: MAX77693: Fix NULL pointer error when initializing irqs This patch initialize register map of MUIC device because mfd driver of Maxim MAX77693 use regmap-muic instance of MUIC device when irqs of Maxim MAX77693 is initialized before call max77693-muic probe() function. Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Myungjoo Ham <myungjoo.ham@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Reported-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> 15 September 2012, 22:33:09 UTC
d51f42d Chanwoo Choi 21 August 2012, 06:15:52 UTC mfd: MAX77693: Fix interrupt handling bug This patch fix bug related to interrupt handling for MAX77693 devices. - Unmask interrupt masking bit for charger/flash/muic to revolve that interrupt isn't happened when external connector is attached. - Fix wrong regmap instance when muic interrupt is happened. This patch were discussed and confirm discussion about this patch on below url: http://lkml.org/lkml/2012/7/16/118 Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Myungjoo Ham <myungjoo.ham@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> 15 September 2012, 22:32:57 UTC
0848c94 Mark Brown 11 September 2012, 07:16:36 UTC mfd: core: Push irqdomain mapping out into devices Currently the MFD core supports remapping MFD cell interrupts using an irqdomain but only if the MFD is being instantiated using device tree and only if the device tree bindings use the pattern of registering IPs in the device tree with compatible properties. This will be actively harmful for drivers which support non-DT platforms and use this pattern for their DT bindings as it will mean that the core will silently change remapping behaviour and it is also limiting for drivers which don't do DT with this particular pattern. There is also a potential fragility if there are interrupts not associated with MFD cells and all the cells are omitted from the device tree for some reason. Instead change the code to take an IRQ domain as an optional argument, allowing drivers to take the decision about the parent domain for their interrupts. The one current user of this feature is ab8500-core, it has the domain lookup pushed out into the driver. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> 15 September 2012, 21:22:04 UTC
8ef997b Lars-Peter Clausen 11 September 2012, 18:56:23 UTC ARM: 7534/1: clk: Make the managed clk functions generically available The managed clk functions are currently only available when the generic clk lookup framework is build. But the managed clk functions are merely wrappers around clk_get and clk_put and do not depend on any specifics of the generic lookup functions and there are still quite a few custom implementations of the clk API. So make the managed functions available whenever the clk API is implemented. The patch also removes the custom implementation of devm_clk_get for the coldfire platform. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Acked-by: Greg Ungerer <gerg@uclinux.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> 15 September 2012, 20:55:27 UTC
5d037f9 Takashi Iwai 15 September 2012, 06:24:42 UTC Merge tag 'asoc-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for 3.6 A bigger set of updates than I'm entirely comfortable with - things backed up a bit due to travel. As ever the majority of these are small, focused updates for specific drivers though there are a couple of core changes. There's been good exposure in -next. The AT91 patch fixes a build break. 15 September 2012, 06:24:42 UTC
3f0c3c8 Linus Torvalds 15 September 2012, 01:05:14 UTC Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-fixes Pull GFS2 fixes from Steven Whitehouse: "Here are three GFS2 fixes for the current kernel tree. These are all related to the block reservation code which was added at the merge window. That code will be getting an update at the forthcoming merge window too. In the mean time though there are a few smaller issues which should be fixed. The first patch resolves an issue with write sizes of greater than 32 bits with the size hinting code. The second ensures that the allocation data structure is initialised when using xattrs and the third takes into account allocations which may have been made by other nodes which affect a reservation on the local node." * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-fixes: GFS2: Take account of blockages when using reserved blocks GFS2: Fix missing allocation data for set/remove xattr GFS2: Make write size hinting code common 15 September 2012, 01:05:14 UTC
9cb0ee8 Linus Torvalds 15 September 2012, 00:59:35 UTC Merge branch 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86 Pull x86 platform driver updates from Matthew Garrett: "A few small updates for 3.6 - a trivial regression fix and a couple of conformance updates for the gmux driver, plus some tiny fixes for asus-wmi, eeepc-laptop and thinkpad_acpi." * 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86: thinkpad_acpi: buffer overflow in fan_get_status() eeepc-laptop: fix device reference count leakage in eeepc_rfkill_hotplug() platform/x86: fix asus_laptop.wled_type description asus-laptop: HRWS/HWRS typo drivers-platform-x86: remove useless #ifdef CONFIG_ACPI_VIDEO apple-gmux: Fix port address calculation in gmux_pio_write32() apple-gmux: Fix index read functions apple-gmux: Obtain version info from indexed gmux 15 September 2012, 00:59:35 UTC
5b799dd Linus Torvalds 15 September 2012, 00:55:57 UTC Merge branch 'i2c-embedded/for-current' of git://git.pengutronix.de/git/wsa/linux Pull i2c embedded fixes from Wolfram Sang: "The last bunch of (typical) i2c-embedded driver fixes for 3.6. Also update the MAINTAINERS file to point to my tree since people keep asking where to find their patches." * 'i2c-embedded/for-current' of git://git.pengutronix.de/git/wsa/linux: i2c: algo: pca: Fix mode selection for PCA9665 MAINTAINERS: fix tree for current i2c-embedded development i2c: mxs: correctly setup speed for non devicetree i2c: pnx: Fix read transactions of >= 2 bytes i2c: pnx: Fix bit definitions 15 September 2012, 00:55:57 UTC
1547cb8 Linus Torvalds 15 September 2012, 00:53:55 UTC Merge tag 'ecryptfs-3.6-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs Pull ecryptfs fixes from Tyler Hicks: - Fixes a regression, introduced in 3.6-rc1, when a file is closed before its shared memory mapping is dirtied and unmapped. The lower file was being released when the eCryptfs file was closed and the dirtied pages could not be written out. - Adds a call to the lower filesystem's ->flush() from ecryptfs_flush(). - Fixes a regression, introduced in 2.6.39, when a file is renamed on top of another file. The target file's inode was not being evicted and the space taken by the file was not reclaimed until eCryptfs was unmounted. * tag 'ecryptfs-3.6-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs: eCryptfs: Copy up attributes of the lower target inode after rename eCryptfs: Call lower ->flush() from ecryptfs_flush() eCryptfs: Write out all dirty pages just before releasing the lower file 15 September 2012, 00:53:55 UTC
1568d9f Linus Torvalds 15 September 2012, 00:53:11 UTC Merge branch 'fixes-for-3.6' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping Pull one more DMA-mapping fix from Marek Szyprowski: "This patch fixes very subtle bug (typical off-by-one error) which might appear in very rare circumstances." * 'fixes-for-3.6' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping: arm: mm: fix DMA pool affiliation check 15 September 2012, 00:53:11 UTC
1c23ce7 Linus Torvalds 15 September 2012, 00:52:29 UTC Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Fix word size register read and write operations in ina2xx driver, and initialize uninitialized structure elements in twl4030-madc-hwmon driver." * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ina2xx) Fix word size register read and write operations hwmon: (twl4030-madc-hwmon) Initialize uninitialized structure elements 15 September 2012, 00:52:29 UTC
dd383af Linus Torvalds 15 September 2012, 00:51:10 UTC Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "I realise this a bit bigger than I would want at this point. Exynos is a large chunk, I got them to half what they wanted already, and hey its ARM based, so not going to hurt many people. Radeon has only two fixes, but the PLL fixes were a bit bigger, but required for a lot of scenarios, the fence fix is really urgent. vmwgfx: I've pulled in a dumb ioctl support patch that I was going to shove in later and cc stable, but we need it asap, its mainly to stop mesa growing a really ugly dependency in userspace to run stuff on vmware, and if I don't stick it in the kernel now, everyone will have to ship ugly userspace libs to workaround it. nouveau: single urgent fix found in F18 testing, causes X to not start properly when f18 plymouth is used i915: smattering of fixes and debug quieting gma500: single regression fix So as I said a bit large, but its fairly well scattered and its all stuff I'll be shipping in F18's 3.6 kernel." * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (26 commits) drm/nouveau: fix booting with plymouth + dumb support drm/radeon: make 64bit fences more robust v3 drm/radeon: rework pll selection (v3) drm: Drop the NV12M and YUV420M formats drm/exynos: remove DRM_FORMAT_NV12M from plane module drm/exynos: fix double call of drm_prime_(init/destroy)_file_private drm/exynos: add dummy support for dmabuf-mmap drm/exynos: Add missing braces around sizeof in exynos_mixer.c drm/exynos: Add missing braces around sizeof in exynos_hdmi.c drm/exynos: Make g2d_pm_ops static drm/exynos: Add dependency for G2D in Kconfig drm/exynos: fixed page align bug. drm/exynos: Use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(.. [1] drm/exynos: Use devm_* functions in exynos_drm_g2d.c file drm/exynos: Use devm_kzalloc in exynos_drm_hdmi.c file drm/exynos: Use devm_kzalloc in exynos_drm_vidi.c file drm/exynos: Remove redundant check in exynos_drm_fimd.c file drm/exynos: Remove redundant check in exynos_hdmi.c file vmwgfx: add dumb ioctl support gma500: Fix regression on Oaktrail devices ... 15 September 2012, 00:51:10 UTC
889cb3b Linus Torvalds 15 September 2012, 00:44:52 UTC Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "Smaller fixlets" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Fix kernel-doc warnings in kernel/sched/fair.c sched: Unthrottle rt runqueues in __disable_runtime() sched: Add missing call to calc_load_exit_idle() sched: Fix load avg vs cpu-hotplug 15 September 2012, 00:44:52 UTC
7ef6e97 Linus Torvalds 15 September 2012, 00:43:45 UTC Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "This tree includes various fixes" Ingo really needs to improve on the whole "explain git pull" part. "Various fixes" indeed. * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/hwpb: Invoke __perf_event_disable() if interrupts are already disabled perf/x86: Enable Intel Cedarview Atom suppport perf_event: Switch to internal refcount, fix race with close() oprofile, s390: Fix uninitialized memory access when writing to oprofilefs perf/x86: Fix microcode revision check for SNB-PEBS 15 September 2012, 00:43:45 UTC
7076cca Linus Torvalds 15 September 2012, 00:43:14 UTC Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull a core sparse warning fix from Ingo Molnar * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: mm/memblock: Use NULL instead of 0 for pointers 15 September 2012, 00:43:14 UTC
f3a87f1 Chris Mason 15 September 2012, 00:06:30 UTC Revert "Btrfs: fix some error codes in btrfs_qgroup_inherit()" This reverts commit 5986802c2fcc754040bb7ed95f30bb16c4a843b7. Both paths are not error paths but regular cases where non-qgroup subvols are involved. Signed-off-by: Chris Mason <chris.mason@fusionio.com> 15 September 2012, 00:06:30 UTC
a1362d5 Linus Torvalds 14 September 2012, 22:34:07 UTC Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Use after free and new device IDs in bluetooth from Andre Guedes, Yevgeniy Melnichuk, Gustavo Padovan, and Henrik Rydberg. 2) Fix crashes with short packet lengths and VLAN in pktgen, from Nishank Trivedi. 3) mISDN calls flush_work_sync() with locks held, fix from Karsten Keil. 4) Packet scheduler gred parameters are reported to userspace improperly scaled, and WRED idling is not performed correctly. All from David Ward. 5) Fix TCP socket refcount problem in ipv6, from Julian Anastasov. 6) ibmveth device has RX queue alignment requirements which are not being explicitly met resulting in sporadic failures, fix from Santiago Leon. 7) Netfilter needs to take care when interpreting sockets attached to socket buffers, they could be time-wait minisockets. Fix from Eric Dumazet. 8) sock_edemux() has the same issue as netfilter did in #7 above, fix from Eric Dumazet. 9) Avoid infinite loops in CBQ scheduler with some configurations, from Eric Dumazet. 10) Deal with "Reflection scan: an Off-Path Attack on TCP", from Jozsef Kadlecsik. 11) SCTP overcharges socket for TX packets, fix from Thomas Graf. 12) CODEL packet scheduler should not reset it's state every time it builds a new flow, fix from Eric Dumazet. 13) Fix memory leak in nl80211, from Wei Yongjun. 14) NETROM doesn't check skb_copy_datagram_iovec() return values, from Alan Cox. 15) l2tp ethernet was using sizeof(ETH_HLEN) instead of plain ETH_HLEN, oops. From Eric Dumazet. 16) Fix selection of ath9k chips on which PA linearization and AM2PM predistoration are used, from Felix Fietkau. 17) Flow steering settings in mlx4 driver need to be validated properly, from Hadar Hen Zion. 18) bnx2x doesn't show the correct link duplex setting, from Yaniv Rosner. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (75 commits) pktgen: fix crash with vlan and packet size less than 46 bnx2x: Add missing afex code bnx2x: fix registers dumped bnx2x: correct advertisement of pause capabilities bnx2x: display the correct duplex value bnx2x: prevent timeouts when using PFC bnx2x: fix stats copying logic bnx2x: Avoid sending multiple statistics queries net: qmi_wwan: call subdriver with control intf only net_sched: gred: actually perform idling in WRED mode net_sched: gred: fix qave reporting via netlink net_sched: gred: eliminate redundant DP prio comparisons net_sched: gred: correct comment about qavg calculation in RIO mode mISDN: Fix wrong usage of flush_work_sync while holding locks netfilter: log: Fix log-level processing net-sched: sch_cbq: avoid infinite loop net: qmi_wwan: fix Gobi device probing for un2430 net: fix net/core/sock.c build error ixp4xx_hss: fix build failure due to missing linux/module.h inclusion caif: move the dereference below the NULL test ... 14 September 2012, 22:34:07 UTC
4bca55d Linus Torvalds 14 September 2012, 21:54:57 UTC Merge tag 'usb-3.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB patches from Greg Kroah-Hartman: "Here are a number of USB patches, a bit more than I normally like this late in the -rc series, but given people's vacations (myself included), and the kernel summit, it seems to have happened this way. All are tiny, but they add up. A number of gadget and xhci fixes, and a few new device ids. All have been tested in linux-next. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>" * tag 'usb-3.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (33 commits) usb: chipidea: udc: don't stall endpoint if request list is empty in isr_tr_complete_low usb: chipidea: cleanup dma_pool if udc_start() fails usb: chipidea: udc: fix error path in udc_start() usb: chipidea: udc: add pullup fuction, needed by the uvc gadget usb: chipidea: udc: fix setup of endpoint maxpacket size USB: option: replace ZTE K5006-Z entry with vendor class rule EHCI: Update qTD next pointer in QH overlay region during unlink USB: cdc-wdm: fix wdm_find_device* return value USB: ftdi_sio: do not claim CDC ACM function usb: dwc3: gadget: fix pending isoc handling usb: renesas_usbhs: fixup DMA transport data alignment usb: gadget: at91udc: Don't check for ep->ep.desc usb: gadget: at91udc: don't overwrite driver data usb: dwc3: core: fix incorrect usage of resource pointer usb: musb: musbhsdma: fix IRQ check usb: musb: tusb6010: fix error path in tusb_probe() usb: musb: host: fix for musb_start_urb Oops usb: gadget: dummy_hcd: add support for USB_DT_BOS on rh usb: gadget: dummy_hcd: fixup error probe path usb: gadget: s3c-hsotg.c: fix error return code ... 14 September 2012, 21:54:57 UTC
fe59d29 Linus Torvalds 14 September 2012, 21:54:29 UTC Merge tag 'tty-3.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull TTY fixes from Greg Kroah-Hartman: "Here are 2 tiny patches for a serial driver to resolve issues that people have reported with the 3.6-rc tree. Both of these have been in the linux-next tree for a while now. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>" * tag 'tty-3.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: serial: imx: don't reinit clock in imx_setup_ufcr() tty: serial: imx: console write routing is unsafe on SMP 14 September 2012, 21:54:29 UTC
f2378e3 Linus Torvalds 14 September 2012, 21:53:51 UTC Merge tag 'staging-3.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging tree fixes from Greg Kroah-Hartman: "Here are a few staging tree fixes for problems that have been reported. Nothing major, just a number of tiny driver fixes. All of these have been in the linux-next tree for a while. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>" * tag 'staging-3.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: drm/omap: add more new timings fields drm/omap: update for interlaced staging: r8712u: fix bug in r8712_recv_indicatepkt() staging: zcache: fix cleancache race condition with shrinker Staging: Android alarm: IOCTL command encoding fix staging: vt6656: [BUG] - Failed connection, incorrect endian. staging: ozwpan: fix memcmp() test in oz_set_active_pd() staging: wlan-ng: Fix problem with wrong arguments staging: comedi: das08: Correct AO output for das08jr-16-ao staging: comedi: das08: Correct AI encoding for das08jr-16-ao staging: comedi: das08: Fix PCI ref count staging: comedi: amplc_pci230: Fix PCI ref count staging: comedi: amplc_pc263: Fix PCI ref count staging: comedi: amplc_pc236: Fix PCI ref count staging: comedi: amplc_dio200: Fix PCI ref count staging: comedi: amplc_pci224: Fix PCI ref count drivers/iio/adc/at91_adc.c: adjust inconsistent IS_ERR and PTR_ERR staging iio: fix potential memory leak in lis3l02dq_ring.c staging:iio: prevent divide by zero bugs 14 September 2012, 21:53:51 UTC
0462bfc Linus Torvalds 14 September 2012, 21:53:22 UTC Merge tag 'driver-core-3.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fix from Greg Kroah-Hartman: "Here is one fix for 3.6-rc6 for the kobject.h file. It fixes a reported oops if CONFIG_HOTPLUG is disabled. It's been in the linux-next tree for a while now. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>" * tag 'driver-core-3.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: kobject: fix oops with "input0: bad kobj_uevent_env content in show_uevent()" 14 September 2012, 21:53:22 UTC
55815f7 Linus Torvalds 14 September 2012, 21:48:21 UTC vfs: make O_PATH file descriptors usable for 'fstat()' We already use them for openat() and friends, but fstat() also wants to be able to use O_PATH file descriptors. This should make it more directly comparable to the O_SEARCH of Solaris. Note that you could already do the same thing with "fstatat()" and an empty path, but just doing "fstat()" directly is simpler and faster, so there is no reason not to just allow it directly. See also commit 332a2e1244bd, which did the same thing for fchdir, for the same reasons. Reported-by: ольга крыжановская <olga.kryzhanovska@gmail.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: stable@kernel.org # O_PATH introduced in 3.0+ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 14 September 2012, 21:48:21 UTC
f25b706 Aaron Lu 14 September 2012, 18:54:44 UTC ACPI / PM: Use KERN_DEBUG when no power resources are found commit a606dac368eed5696fb38e16b1394f1d049c09e9 adds support to link devices which have _PRx, if a device does not have _PRx, a warning message will be printed. This commit is for ZPODD on Intel ZPODD capable platforms, on other platforms, it has no problem if there is no power resource for this device, so a warning here is not appropriate, change it to debug. Reported-by: Borislav Petkov <bp@amd64.org> Signed-off-by: Aaron Lu <aaron.lu@intel.com> Cc: stable@vger.kernel.org Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> 14 September 2012, 18:54:44 UTC
2116fe4 Roland Dreier 14 September 2012, 17:42:52 UTC Merge branches 'cxgb4', 'ipoib', 'mlx4', 'ocrdma' and 'qib' into for-next 14 September 2012, 17:42:52 UTC
4c35500 Mike Marciniszyn 12 September 2012, 13:01:29 UTC IB/qib: Fix failure of compliance test C14-024#06_LocalPortNum Commit 3236b2d469db ("IB/qib: MADs with misset M_Keys should return failure") introduced a return code assignment that unfortunately introduced an unconditional exit for the routine due to missing braces. This patch adds the braces to correct the original patch. Reviewed-by: Dean Luick <dean.luick@intel.com> Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Roland Dreier <roland@purestorage.com> 14 September 2012, 17:42:32 UTC
ae3bca9 Parav Pandit 17 August 2012, 14:45:33 UTC RDMA/ocrdma: Fix CQE expansion of unsignaled WQE Fix CQE expansion of unsignaled WQE -- don't expand the CQE when the WQE index of the completed CQE matches with last pending WQE (tail) in the queue. Signed-off-by: Parav Pandit <parav.pandit@emulex.com> Signed-off-by: Roland Dreier <roland@purestorage.com> 14 September 2012, 17:40:58 UTC
985b11f Bo Shen 14 September 2012, 08:09:09 UTC ASoC: wm8904: correct the index Signed-off-by: Bo Shen <voice.shen@atmel.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> 14 September 2012, 17:02:38 UTC
8335eaf Tyler Hicks 13 September 2012, 19:00:56 UTC eCryptfs: Copy up attributes of the lower target inode after rename After calling into the lower filesystem to do a rename, the lower target inode's attributes were not copied up to the eCryptfs target inode. This resulted in the eCryptfs target inode staying around, rather than being evicted, because i_nlink was not updated for the eCryptfs inode. This also meant that eCryptfs didn't do the final iput() on the lower target inode so it stayed around, as well. This would result in a failure to free up space occupied by the target file in the rename() operation. Both target inodes would eventually be evicted when the eCryptfs filesystem was unmounted. This patch calls fsstack_copy_attr_all() after the lower filesystem does its ->rename() so that important inode attributes, such as i_nlink, are updated at the eCryptfs layer. ecryptfs_evict_inode() is now called and eCryptfs can drop its final reference on the lower inode. http://launchpad.net/bugs/561129 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Tested-by: Colin Ian King <colin.king@canonical.com> Cc: <stable@vger.kernel.org> [2.6.39+] 14 September 2012, 16:36:03 UTC
64e6651 Tyler Hicks 13 September 2012, 01:38:00 UTC eCryptfs: Call lower ->flush() from ecryptfs_flush() Since eCryptfs only calls fput() on the lower file in ecryptfs_release(), eCryptfs should call the lower filesystem's ->flush() from ecryptfs_flush(). If the lower filesystem implements ->flush(), then eCryptfs should try to flush out any dirty pages prior to calling the lower ->flush(). If the lower filesystem does not implement ->flush(), then eCryptfs has no need to do anything in ecryptfs_flush() since dirty pages are now written out to the lower filesystem in ecryptfs_release(). Signed-off-by: Tyler Hicks <tyhicks@canonical.com> 14 September 2012, 16:35:54 UTC
7149f25 Tyler Hicks 13 September 2012, 01:02:46 UTC eCryptfs: Write out all dirty pages just before releasing the lower file Fixes a regression caused by: 821f749 eCryptfs: Revert to a writethrough cache model That patch reverted some code (specifically, 32001d6f) that was necessary to properly handle open() -> mmap() -> close() -> dirty pages -> munmap(), because the lower file could be closed before the dirty pages are written out. Rather than reapplying 32001d6f, this approach is a better way of ensuring that the lower file is still open in order to handle writing out the dirty pages. It is called from ecryptfs_release(), while we have a lock on the lower file pointer, just before the lower file gets the final fput() and we overwrite the pointer. https://launchpad.net/bugs/1047261 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reported-by: Artemy Tregubenko <me@arty.name> Tested-by: Artemy Tregubenko <me@arty.name> Tested-by: Colin Ian King <colin.king@canonical.com> 14 September 2012, 16:11:29 UTC
636221b Maciej W. Rozycki 13 September 2012, 20:23:25 UTC MIPS: Malta: Remove RTC Data Mode bootstrap breakage YAMON requires and enforces the RTC Data Mode (Register B, DM bit) to binary, that is the bit is set every time the board goes through the firmware bootstrap sequence. Likewise its calendar manipulation commands interpret or set the RTC registers unconditionally as binary, never actually checking what the value of the DM bit is, under the (correct) assumption that it has been previously set, to indicate the binary mode. A change to Linux a while ago however introduced a platform-specific tweak that clears that bit and therefore forces the data mode to BCD. This causes clock corruption and misinterpretation that has to be fixed up by user-mode tools in system startup scripts as the initial clock is often incorrect according to the BCD interpretation forced. This change removes the hack; a comment included refers to alarm code, but even if it was broken at one point by requiring the BCD mode, it should have been trivially corrected and even if not, given how rarely the alarm feature is used, that was not really a reasonable justification to break the system clock that is indeed used by virtually everything. And either way the alarm code has been since fixed anyway. Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/4336/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> 14 September 2012, 15:54:33 UTC
7a253c2 John W. Linville 14 September 2012, 15:39:39 UTC Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem 14 September 2012, 15:39:39 UTC
27e99ad Wang Sen 30 July 2012, 06:25:06 UTC [SCSI] scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list When using the commands below to write some data to a virtio-scsi LUN of the QEMU guest(32-bit) with 1G physical memory(qemu -m 1024), the qemu will crash. # sudo mkfs.ext4 /dev/sdb (/dev/sdb is the virtio-scsi LUN.) # sudo mount /dev/sdb /mnt # dd if=/dev/zero of=/mnt/file bs=1M count=1024 In current implementation, sg_set_buf is called to add buffers to sg list which is put into the virtqueue eventually. But if there are some HighMem pages in table->sgl you can not get virtual address by sg_virt. So, sg_virt(sg_elem) may return NULL value. This will cause QEMU exit when virtqueue_map_sg is called in QEMU because an invalid GPA is passed by virtqueue. Two solutions are discussed here: http://lkml.indiana.edu/hypermail/linux/kernel/1207.3/00675.html Finally, value assignment approach was adopted because: Value assignment creates a well-formed scatterlist, because the termination marker in source sg_list has been set in blk_rq_map_sg(). The last entry of the source sg_list is just copied to the the last entry in destination list. Note that, for now, virtio_ring does not care about the form of the scatterlist and simply processes the first out_num + in_num consecutive elements of the sg[] array. I have tested the patch on my workstation. QEMU would not crash any more. Cc: <stable@vger.kernel.org> # 3.4: 4fe74b1: [SCSI] virtio-scsi: SCSI driver Signed-off-by: Wang Sen <senwang@linux.vnet.ibm.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 14 September 2012, 14:47:01 UTC
back to top