3.2.31-stable review
Subsystems (76)
cover 3.2.31-stable review
This is the start of the stable review cycle for the 3.2.31 release. There are 108 patches in this series, which will be posted as responses to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Oct 10 00:00:00 UTC 2012. Anything received after that time might be too late.
A combined patch relative to 3.2.30 will be posted as an additional response to this, and the diffstat can be found below.
I have only scanned for 'cc: stable' in commits up to 3.6, so don't be surprised that fixes that went upstream in the last week don't appear here. I'll get to them in the next round.
Ben.
-------------
Makefile | 4 +- arch/arm/boot/compressed/head.S | 1 + arch/arm/mach-imx/mach-armadillo5x0.c | 3 +- arch/x86/kernel/alternative.c | 2 +- arch/x86/xen/enlighten.c | 4 + arch/x86/xen/setup.c | 4 + drivers/ata/libata-core.c | 1 + drivers/block/aoe/aoecmd.c | 1 + drivers/block/cciss_scsi.c | 1 + drivers/block/nbd.c | 9 ++ drivers/bluetooth/ath3k.c | 7 ++ drivers/bluetooth/btusb.c | 14 ++- drivers/cpufreq/powernow-k8.c | 63 +++++----- drivers/dma/at_hdmac.c | 13 +- drivers/dma/pl330.c | 5 + drivers/edac/sb_edac.c | 7 +- drivers/gpio/gpio-lpc32xx.c | 5 + drivers/gpu/drm/i915/i915_gem.c | 3 +- drivers/gpu/drm/i915/intel_hdmi.c | 2 +- drivers/gpu/drm/radeon/atombios_crtc.c | 126 ++++---------------- drivers/hid/hid-core.c | 16 ++- drivers/hid/hid-logitech-dj.c | 83 ++++++++++--- drivers/hid/hid-logitech-dj.h | 1 + drivers/hid/hidraw.c | 107 +++++++++-------- drivers/hwmon/ad7314.c | 8 ++ drivers/hwmon/ads7871.c | 9 ++ drivers/hwmon/fam15h_power.c | 15 ++- drivers/input/serio/i8042-x86ia64io.h | 6 + drivers/iommu/intr_remapping.c | 18 ++- drivers/md/dm-table.c | 26 +++- drivers/md/dm.c | 56 ++++++--- drivers/md/raid10.c | 8 +- drivers/mmc/host/sdhci.c | 5 +- drivers/net/can/janz-ican3.c | 4 +- drivers/net/can/ti_hecc.c | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 12 +- drivers/net/ethernet/broadcom/tg3.c | 14 ++- .../net/ethernet/qlogic/netxen/netxen_nic_main.c | 4 + drivers/net/ethernet/ti/davinci_cpdma.c | 1 + drivers/net/ppp/pppoe.c | 2 +- drivers/net/usb/asix.c | 4 + drivers/net/usb/sierra_net.c | 2 +- drivers/net/wan/ixp4xx_hss.c | 1 + .../net/wireless/brcm80211/brcmfmac/dhd_common.c | 26 ++-- .../net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 6 +- drivers/net/wireless/rtlwifi/rtl8192ce/def.h | 1 + drivers/net/wireless/rtlwifi/rtl8192ce/hw.c | 12 +- drivers/net/wireless/rtlwifi/rtl8192ce/sw.c | 8 +- drivers/pci/hotplug/acpiphp_glue.c | 13 +- drivers/platform/x86/asus-laptop.c | 8 +- drivers/rtc/rtc-twl.c | 5 + drivers/scsi/bnx2i/bnx2i_hwi.c | 3 + drivers/scsi/hpsa.c | 3 +- drivers/scsi/mpt2sas/mpt2sas_base.c | 7 ++ drivers/target/target_core_transport.c | 9 +- drivers/tty/serial/pch_uart.c | 19 ++- drivers/usb/core/devices.c | 2 +- drivers/usb/core/hcd.c | 6 +- drivers/usb/gadget/dummy_hcd.c | 8 +- drivers/watchdog/hpwdt.c | 3 + fs/cifs/cifs_unicode.c | 2 +- fs/dcache.c | 10 +- fs/proc/proc_sysctl.c | 5 +- include/linux/dcache.h | 2 + include/linux/hid.h | 2 +- include/linux/hidraw.h | 4 +- include/linux/memory.h | 2 +- include/linux/xfrm.h | 2 + include/net/bluetooth/smp.h | 2 +- include/net/xfrm.h | 3 + include/trace/events/kmem.h | 4 +- kernel/async.c | 13 +- kernel/cpuset.c | 3 + kernel/exit.c | 16 +++ kernel/sched.c | 40 ++++++- kernel/workqueue.c | 25 ++-- mm/memory_hotplug.c | 16 ++- mm/page_alloc.c | 2 +- net/8021q/vlan_core.c | 3 +- net/bluetooth/hci_conn.c | 4 + net/bluetooth/l2cap_core.c | 11 +- net/bluetooth/l2cap_sock.c | 2 +- net/bluetooth/smp.c | 4 +- net/core/dev.c | 15 ++- net/core/net_namespace.c | 4 +- net/core/sock.c | 3 +- net/ipv4/raw.c | 14 ++- net/ipv4/tcp.c | 10 +- net/ipv6/mip6.c | 20 ++-- net/ipv6/raw.c | 21 ++-- net/ipv6/route.c | 11 +- net/l2tp/l2tp_eth.c | 2 +- net/netrom/af_netrom.c | 7 +- net/rds/recv.c | 3 + net/sched/sch_cbq.c | 5 +- net/sched/sch_qfq.c | 5 +- net/sctp/output.c | 21 +++- net/wireless/reg.c | 12 +- net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_policy.c | 2 +- net/xfrm/xfrm_replay.c | 15 +++ net/xfrm/xfrm_user.c | 57 ++++++--- sound/soc/samsung/dma.c | 8 +- 103 files changed, 796 insertions(+), 436 deletions(-)
Signature · 2 lines
Ben Hutchings Who are all these weirdos? - David Bowie, about L-Space IRC channel #afp
PATCH 1/108 target: Fix ->data_length re-assignment bug with SCSI overflow
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 4c054ba63ad47ef244cfcfa1cea38134620a5bae upstream.
This patch fixes a long-standing bug with SCSI overflow handling where se_cmd->data_length was incorrectly being re-assigned to the larger CDB extracted allocation length, resulting in a number of fabric level errors that would end up causing a session reset in most cases. So instead now:
- Only re-assign se_cmd->data_length durining UNDERFLOW (to use the smaller value)
- Use existing se_cmd->data_length for OVERFLOW (to use the smaller value)
This fix has been tested with the following CDB to generate an SCSI overflow:
sg_raw -r512 /dev/sdc 28 0 0 0 0 0 0 0 9 0
Tested using iscsi-target, tcm_qla2xxx, loopback and tcm_vhost fabric ports. Here is a bit more detail on each case:
- iscsi-target: Bug with open-iscsi with overflow, sg_raw returns
-3584 bytes of data.
- tcm_qla2xxx: Working as expected, returnins 512 bytes of data
- loopback: sg_raw returns CHECK_CONDITION, from overflow rejection in transport_generic_map_mem_to_cmd()
- tcm_vhost: Same as loopback
--- drivers/target/target_core_transport.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/target/target_core_transport.c +7 -2
@@ -3039,15 +3039,20 @@ static int transport_generic_cmd_sequenc/* Returns CHECK_CONDITION + INVALID_CDB_FIELD */ goto out_invalid_cdb_field; } - +/* +* For the overflow case keep the existing fabric provided +* ->data_length. Otherwise for the underflow case, reset +* ->data_length to the smaller SCSI expected data transfer +* length. +*/ if (size > cmd->data_length) { cmd->se_cmd_flags |=SCF_OVERFLOW_BIT ; cmd->residual_count = (size - cmd->data_length); }else { cmd->se_cmd_flags |=SCF_UNDERFLOW_BIT ; cmd->residual_count = (cmd->data_length - size); + cmd->data_length = size; } - cmd->data_length = size; }/* reject any command that we don't have a handler for */
PATCH 2/108 ASoC: samsung dma - Dont indicate support for pause/resume.
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dylan Reid <[email protected]>
commit 57b2d68863f281737d8596cb3d76d89d9cc54fd8 upstream.
The pause and resume operations indicate that the stream can be un-paused/resumed from the exact location they were paused/suspended. This is not true for this driver, the pause and suspend triggers share the same code path with stop, they flush all pending DMA transfers. This drops all pending samples. The pause_release/resume triggers are the same as start, except that prepare won't be called beforehand, nothing will be enqueued to the DMA engine and nothing will happen (no audio). Removing the pause flag will let apps know that it isn't supported. Removing the resume flag will cause user space to call prepare and start instead of resume, so audio will continue playing when the system wakes up.
Before removing the pause and resume flags, I tested this on an exynos 5250, using 'aplay -i'. Pause/un-pause leads to silence followed by a write error. Suspend/resume testing led to the same result. Removing the two flags fixes suspend/resume (since snd_pcm_prepare is called again). And leads to a proper reporting of pause not supported.
--- sound/soc/samsung/dma.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
sound/soc/samsung/dma.c +1 -7
@@ -34,9 +34,7 @@ static const struct snd_pcm_hardware dma_hardware = { .info = SNDRV_PCM_INFO_INTERLEAVED |SNDRV_PCM_INFO_BLOCK_TRANSFER |SNDRV_PCM_INFO_MMAP | -SNDRV_PCM_INFO_MMAP_VALID | -SNDRV_PCM_INFO_PAUSE | - SNDRV_PCM_INFO_RESUME, + SNDRV_PCM_INFO_MMAP_VALID, .formats =SNDRV_PCM_FMTBIT_S16_LE |SNDRV_PCM_FMTBIT_U16_LE | SNDRV_PCM_FMTBIT_U8 |
@@ -248,15 +246,11 @@ static int dma_trigger(struct snd_pcm_substream *substream, int cmd)switch (cmd) {case SNDRV_PCM_TRIGGER_START : -case SNDRV_PCM_TRIGGER_RESUME : -case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : prtd->state |=ST_RUNNING ; prtd->params->ops->trigger (prtd->params->ch);break ;case SNDRV_PCM_TRIGGER_STOP : -case SNDRV_PCM_TRIGGER_SUSPEND : -case SNDRV_PCM_TRIGGER_PAUSE_PUSH : prtd->state &= ~ST_RUNNING ; prtd->params->ops->stop (prtd->params->ch);break ;
PATCH 3/108 fs/proc: fix potential unregister_sysctl_table hang
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Ruggeri <[email protected]>
commit 6bf6104573482570f7103d3e5ddf9574db43a363 upstream.
The unregister_sysctl_table() function hangs if all references to its ctl_table_header structure are not dropped.
This can happen sometimes because of a leak in proc_sys_lookup():proc_sys_lookup() gets a reference to the table via lookup_entry(), but it does not release it when a subsequent call to sysctl_follow_link() fails.
This patch fixes this leak by making sure the reference is always dropped on return.
See also commit 076c3eed2c31 ("sysctl: Rewrite proc_sys_lookup introducing find_entry and lookup_entry") which reorganized this code in 3.4.
Tested in Linux 3.4.4.
--- fs/proc/proc_sysctl.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
fs/proc/proc_sysctl.c +2 -3
@@ -462,9 +462,6 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry, err =ERR_PTR (-ENOMEM ); inode =proc_sys_make_inode (dir->i_sb, h ? h : head, p); -if (h) -sysctl_head_finish (h); -if (!inode) goto out;
@@ -473,6 +470,8 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,d_add (dentry, inode); out: +if (h) +sysctl_head_finish (h);sysctl_head_finish (head);return err; }
PATCH 4/108 mm/ia64: fix a memory block size bug
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianguo Wu <[email protected]>
commit 05cf96398e1b6502f9e191291b715c7463c9d5dd upstream.
I found following definition in include/linux/memory.h, in my IA64 platform, SECTION_SIZE_BITS is equal to 32, and MIN_MEMORY_BLOCK_SIZE will be 0.
#define MIN_MEMORY_BLOCK_SIZE (1 << SECTION_SIZE_BITS)
Because MIN_MEMORY_BLOCK_SIZE is int type and length of 32bits, so MIN_MEMORY_BLOCK_SIZE(1 << 32) will will equal to 0. Actually when SECTION_SIZE_BITS >= 31, MIN_MEMORY_BLOCK_SIZE will be wrong. This will cause wrong system memory infomation in sysfs.
I think it should be:
#define MIN_MEMORY_BLOCK_SIZE (1UL << SECTION_SIZE_BITS)
And "echo offline > memory0/state" will cause following call trace:
kernel BUG at mm/memory_hotplug.c:885!
sh[6455]: bugcheck! 0 [1]
Pid: 6455, CPU 0, comm: sh
psr : 0000101008526030 ifs : 8000000000000fa4 ip : [<a0000001008c40f0>] Not tainted (3.6.0-rc1)
ip is at offline_pages+0x210/0xee0
Call Trace:
show_stack+0x80/0xa0
show_regs+0x640/0x920
die+0x190/0x2c0
die_if_kernel+0x50/0x80
ia64_bad_break+0x3d0/0x6e0
ia64_native_leave_kernel+0x0/0x270
offline_pages+0x210/0xee0
alloc_pages_current+0x180/0x2a0--- include/linux/memory.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/memory.h +1 -1
@@ -19,7 +19,7 @@#include <linux/compiler.h> #include <linux/mutex.h> -#define MIN_MEMORY_BLOCK_SIZE (1 << SECTION_SIZE_BITS) +#define MIN_MEMORY_BLOCK_SIZE (1UL << SECTION_SIZE_BITS)struct memory_block {unsigned long start_section_nr;
PATCH 5/108 nbd: clear waiting_queue on shutdown
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Clements <[email protected]>
commit fded4e090c60100d709318896c79816d68d5b47d upstream.
Fix a serious but uncommon bug in nbd which occurs when there is heavy I/O going to the nbd device while, at the same time, a failure (server, network) or manual disconnect of the nbd connection occurs.
There is a small window between the time that the nbd_thread is stopped and the socket is shutdown where requests can continue to be queued to nbd's internal waiting_queue. When this happens, those requests are never completed or freed.
The fix is to clear the waiting_queue on shutdown of the nbd device, in the same way that the nbd request queue (queue_head) is already being cleared.
--- drivers/block/nbd.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/block/nbd.c +9 -0
@@ -445,6 +445,14 @@ static void nbd_clear_que(struct nbd_dev req->errors++;nbd_end_request (req); } + +while (!list_empty (&lo->waiting_queue)) { + req = list_entry(lo->waiting_queue.next, struct request, + queuelist); +list_del_init (&req->queuelist); + req->errors++; +nbd_end_request (req); + } }
@@ -594,6 +602,7 @@ static int __nbd_ioctl(struct block_devi lo->file =NULL ;nbd_clear_que (lo);BUG_ON (!list_empty (&lo->queue_head)); +BUG_ON (!list_empty (&lo->waiting_queue));if (file)fput (file);return 0 ;
PATCH 6/108 drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Hilman <[email protected]>
commit 8dcebaa9a0ae8a0487f4342f3d56d2cb1c980860 upstream.
On some platforms, bootloaders are known to do some interesting RTC programming. Without going into the obscurities as to why this may be the case, suffice it to say the the driver should not make any assumptions about the state of the RTC when the driver loads. In particular, the driver probe should be sure that all interrupts are disabled until otherwise programmed.
This was discovered when finding bursty I2C traffic every second on Overo platforms. This I2C overhead was keeping the SoC from hitting deep power states. The cause was found to be the RTC firing every second on the I2C-connected TWL PMIC.
Special thanks to Felipe Balbi for suggesting to look for a rogue driver as the source of the I2C traffic rather than the I2C driver itself.
Special thanks to Steve Sakoman for helping track down the source of the continuous RTC interrups on the Overo boards.
--- drivers/rtc/rtc-twl.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/rtc/rtc-twl.c +5 -0
@@ -462,6 +462,11 @@ static int __devinit twl_rtc_probe(struc goto out1; } +/* ensure interrupts are disabled, bootloaders can be strange */ + ret =twl_rtc_write_u8 (0 ,REG_RTC_INTERRUPTS_REG ); +if (ret <0 ) +dev_warn (&pdev->dev,"unable to disable interrupt\n" ); +/* init cached IRQ enable bits */ ret =twl_rtc_read_u8 (&rtc_irq_bits,REG_RTC_INTERRUPTS_REG );if (ret <0 )
PATCH 7/108 mm/page_alloc: fix the page address of higher pages buddy calculation
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Haifeng <[email protected]>
commit 0ba8f2d59304dfe69b59c034de723ad80f7ab9ac upstream.
The heuristic method for buddy has been introduced since commit 43506fad21ca ("mm/page_alloc.c: simplify calculation of combined index of adjacent buddy lists"). But the page address of higher page's buddy was wrongly calculated, which will lead page_is_buddy to fail for ever. IOW, the heuristic method would be disabled with the wrong page address of higher page's buddy.
Calculating the page address of higher page's buddy should be based higher_page with the offset between index of higher page and index of higher page's buddy.
--- mm/page_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/page_alloc.c +1 -1
@@ -584,7 +584,7 @@ static inline void __free_one_page(struct page *page, combined_idx = buddy_idx & page_idx; higher_page = page + (combined_idx - page_idx); buddy_idx =__find_buddy_index (combined_idx, order +1 ); - higher_buddy = page + (buddy_idx - combined_idx); + higher_buddy = higher_page + (buddy_idx - combined_idx);if (page_is_buddy (higher_page, higher_buddy, order +1 )) {list_add_tail (&page->lru, &zone->free_area[order].free_list[migratetype]);
PATCH 8/108 memory hotplug: fix section info double registration bug
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: qiuxishi <[email protected]>
commit f14851af0ebb32745c6c5a2e400aa0549f9d20df upstream.
There may be a bug when registering section info. For example, on my Itanium platform, the pfn range of node0 includes the other nodes, so other nodes' section info will be double registered, and memmap's page count will equal to 3.
node0: start_pfn=0x100, spanned_pfn=0x20fb00, present_pfn=0x7f8a3, => 0x000100-0x20fc00
node1: start_pfn=0x80000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x080000-0x100000 node2: start_pfn=0x100000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x100000-0x180000 node3: start_pfn=0x180000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x180000-0x200000
free_all_bootmem_node()
register_page_bootmem_info_node()
register_page_bootmem_info_section()
When hot remove memory, we can't free the memmap's page because page_count() is 2 after put_page_bootmem().
sparse_remove_one_section()
free_section_usemap()
free_map_bootmem()
put_page_bootmem()
--- mm/memory_hotplug.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
mm/memory_hotplug.c +10 -6
@@ -126,9 +126,6 @@ static void register_page_bootmem_info_section(unsigned long start_pfn)struct mem_section *ms;struct page *page, *memmap; -if (!pfn_valid (start_pfn)) -return ; - section_nr =pfn_to_section_nr (start_pfn); ms =__nr_to_section (section_nr);
@@ -187,9 +184,16 @@ void register_page_bootmem_info_node(struct pglist_data *pgdat) end_pfn = pfn + pgdat->node_spanned_pages;/* register_section info */ -for (; pfn < end_pfn; pfn +=PAGES_PER_SECTION ) - register_page_bootmem_info_section(pfn); - +for (; pfn < end_pfn; pfn +=PAGES_PER_SECTION ) { +/* +* Some platforms can assign the same pfn to multiple nodes - on +* node0 as well as nodeN. To avoid registering a pfn against +* multiple nodes we check that this pfn does not already +* reside in some other node. +*/ +if (pfn_valid (pfn) && (pfn_to_nid (pfn) == node)) +register_page_bootmem_info_section (pfn); + } }#endif /* !CONFIG_SPARSEMEM_VMEMMAP */
PATCH 9/108 cciss: fix handling of protocol error
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Stephen M. Cameron" <[email protected]>
commit 2453f5f992717251cfadab6184fbb3ec2f2e8b40 upstream.
If a command completes with a status of CMD_PROTOCOL_ERR, this information should be conveyed to the SCSI mid layer, not dropped on the floor. Unlike a similar bug in the hpsa driver, this bug only affects tape drives and CD and DVD ROM drives in the cciss driver, and to induce it, you have to disconnect (or damage) a cable, so it is not a very likely scenario (which would explain why the bug has gone undetected for the last 10 years.)
--- drivers/block/cciss_scsi.c | 1 + 1 file changed, 1 insertion(+)
drivers/block/cciss_scsi.c +1 -0
@@ -795,6 +795,7 @@ static void complete_scsi_command(CommandList_struct *c, int timeout, }break ;case CMD_PROTOCOL_ERR : + cmd->result =DID_ERROR <<16 ;dev_warn (&h->pdev->dev,"%p has protocol error\n" , c);break ;
PATCH 10/108 vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit b161dfa6937ae46d50adce8a7c6b12233e96e7bd upstream.
IBM reported a soft lockup after applying the fix for the rename_lock deadlock. Commit c83ce989cb5f ("VFS: Fix the nfs sillyrename regression in kernel 2.6.38") was found to be the culprit.
The nfs sillyrename fix used DCACHE_DISCONNECTED to indicate that the dentry was killed. This flag can be set on non-killed dentries too, which results in infinite retries when trying to traverse the dentry tree.
This patch introduces a separate flag: DCACHE_DENTRY_KILLED, which is only set in d_kill() and makes try_to_ascend() test only this flag.
IBM reported successful test results with this patch.
--- fs/dcache.c | 4 ++-- include/linux/dcache.h | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-)
fs/dcache.c +2 -2
@@ -389,7 +389,7 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent)* Inform try_to_ascend() that we are no longer attached to the * dentry tree */ - dentry->d_flags |=DCACHE_DISCONNECTED ; + dentry->d_flags |=DCACHE_DENTRY_KILLED ;if (parent)spin_unlock (&parent->d_lock);dentry_iput (dentry);
@@ -1048,7 +1048,7 @@ static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned seq* or deletion */ if (new != old->d_parent || - (old->d_flags &DCACHE_DISCONNECTED ) || + (old->d_flags &DCACHE_DENTRY_KILLED ) || (!locked &&read_seqretry (&rename_lock, seq))) {spin_unlock (&new->d_lock); new =NULL ;
include/linux/dcache.h +2 -0
@@ -206,6 +206,8 @@ struct dentry_operations {#define DCACHE_MANAGED_DENTRY \ (DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT) +#define DCACHE_DENTRY_KILLED 0x100000 +extern seqlock_t rename_lock;static inline int dname_external (struct dentry *dentry)
PATCH 11/108 workqueue: reimplement work_on_cpu() using system_wq
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 upstream.
The existing work_on_cpu() implementation is hugely inefficient. It creates a new kthread, execute that single function and then let the kthread die on each invocation.
Now that system_wq can handle concurrent executions, there's no advantage of doing this. Reimplement work_on_cpu() using system_wq which makes it simpler and way more efficient.
stable: While this isn't a fix in itself, it's needed to fix a
workqueue related bug in cpufreq/powernow-k8. AFAICS, this shouldn't break other existing users.
--- kernel/workqueue.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-)
kernel/workqueue.c +8 -17
@@ -3576,18 +3576,17 @@ static int __devinit workqueue_cpu_down_callback(struct notifier_block *nfb,#ifdef CONFIG_SMP struct work_for_cpu { -struct completion completion; +struct work_struct work;long (*fn)(void *);void *arg;long ret; }; -static int do_work_for_cpu (void *_wfc) +static void work_for_cpu_fn (struct work_struct *work) { -struct work_for_cpu *wfc = _wfc; + struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work); + wfc->ret = wfc->fn (wfc->arg); -complete (&wfc->completion); -return 0 ; }/**
@@ -3602,19 +3601,11 @@ static int do_work_for_cpu(void *_wfc)*/ long work_on_cpu (unsigned int cpu,long (*fn)(void *),void *arg) { -struct task_struct *sub_thread; -struct work_for_cpu wfc = { - .completion =COMPLETION_INITIALIZER_ONSTACK (wfc.completion), - .fn = fn, - .arg = arg, - }; +struct work_for_cpu wfc = { .fn = fn, .arg = arg }; - sub_thread =kthread_create (do_work_for_cpu, &wfc,"work_for_cpu" ); -if (IS_ERR (sub_thread)) -return PTR_ERR (sub_thread); -kthread_bind (sub_thread, cpu); -wake_up_process (sub_thread); -wait_for_completion (&wfc.completion); +INIT_WORK_ONSTACK (&wfc.work, work_for_cpu_fn); +schedule_work_on (cpu, &wfc.work); +flush_work (&wfc.work);return wfc.ret; }EXPORT_SYMBOL_GPL (work_on_cpu);
PATCH 12/108 cpufreq/powernow-k8: workqueue user shouldnt migrate the kworker to another CPU
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 upstream.
powernowk8_target() runs off a per-cpu work item and if the cpufreq_policy->cpu is different from the current one, it migrates the kworker to the target CPU by manipulating current->cpus_allowed. The function migrates the kworker back to the original CPU but this is still broken. Workqueue concurrency management requires the kworkers to stay on the same CPU and powernowk8_target() ends up triggerring BUG_ON(rq != this_rq()) in try_to_wake_up_local() if it contends on fidvid_mutex and sleeps.
It is unclear why this bug is being reported now. Duncan says it appeared to be a regression of 3.6-rc1 and couldn't reproduce it on 3.5. Bisection seemed to point to 63d95a91 "workqueue: use @pool instead of @gcwq or @cpu where applicable" which is an non-functional change. Given that the reproduce case sometimes took upto days to trigger, it's easy to be misled while bisecting. Maybe something made contention on fidvid_mutex more likely? I don't know.
This patch fixes the bug by using work_on_cpu() instead if @pol->cpu isn't the same as the current one. The code assumes that cpufreq_policy->cpu is kept online by the caller, which Rafael tells me is the case.
stable: ed48ece27c ("workqueue: reimplement work_on_cpu() using
system_wq") should be applied before this; otherwise, the behavior could be horrible.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47301
--- drivers/cpufreq/powernow-k8.c | 63 ++++++++++++++++++++++------------------- 1 file changed, 34 insertions(+), 29 deletions(-)
drivers/cpufreq/powernow-k8.c +34 -29
@@ -35,7 +35,6 @@#include <linux/slab.h> #include <linux/string.h> #include <linux/cpumask.h> -#include <linux/sched.h> /* for current / set_cpus_allowed() */ #include <linux/io.h> #include <linux/delay.h>
@@ -1139,16 +1138,23 @@ static int transition_frequency_pstate(struct powernow_k8_data *data,return res; } -/* Driver entry point to switch to the target frequency */ -static int powernowk8_target (struct cpufreq_policy *pol, -unsigned targfreq,unsigned relation) +struct powernowk8_target_arg { +struct cpufreq_policy *pol; +unsigned targfreq; +unsigned relation; +}; + +static long powernowk8_target_fn (void *arg) { -cpumask_var_t oldmask; +struct powernowk8_target_arg *pta = arg; +struct cpufreq_policy *pol = pta->pol; +unsigned targfreq = pta->targfreq; +unsigned relation = pta->relation;struct powernow_k8_data *data =per_cpu (powernow_data, pol->cpu);u32 checkfid;u32 checkvid;unsigned int newstate; -int ret = -EIO ; +int ret;if (!data)return -EINVAL ;
@@ -1156,29 +1162,16 @@ static int powernowk8_target(struct cpufreq_policy *pol, checkfid = data->currfid; checkvid = data->currvid; -/* only run on specific CPU from here on. */ -/* This is poor form: use a workqueue or smp_call_function_single */ -if (!alloc_cpumask_var (&oldmask,GFP_KERNEL )) -return -ENOMEM ; - -cpumask_copy (oldmask,tsk_cpus_allowed (current)); -set_cpus_allowed_ptr (current,cpumask_of (pol->cpu)); - -if (smp_processor_id () != pol->cpu) { - printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu); - goto err_out; - } -if (pending_bit_stuck ()) { printk(KERN_ERR PFX "failing targ, change pending bit set\n"); - goto err_out; +return -EIO ; }pr_debug ("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n" , pol->cpu, targfreq, pol->min, pol->max, relation);if (query_current_values_with_pending_wait (data)) - goto err_out; +return -EIO ;if (cpu_family !=CPU_HW_PSTATE ) { pr_debug("targ: curr fid 0x%x, vid 0x%x\n",
@@ -1196,7 +1189,7 @@ static int powernowk8_target(struct cpufreq_policy *pol,if (cpufreq_frequency_table_target (pol, data->powernow_table, targfreq, relation, &newstate)) - goto err_out; +return -EIO ;mutex_lock (&fidvid_mutex);
@@ -1209,9 +1202,8 @@ static int powernowk8_target(struct cpufreq_policy *pol, ret =transition_frequency_fidvid (data, newstate);if (ret) { printk(KERN_ERR PFX "transition frequency failed\n"); - ret =1 ;mutex_unlock (&fidvid_mutex); - goto err_out; +return 1 ; }mutex_unlock (&fidvid_mutex);
@@ -1220,12 +1212,25 @@ static int powernowk8_target(struct cpufreq_policy *pol, data->powernow_table[newstate].index); else pol->cur = find_khz_freq_from_fid(data->currfid); - ret =0 ; -err_out: -set_cpus_allowed_ptr (current, oldmask); -free_cpumask_var (oldmask); -return ret; +return 0 ; +} + +/* Driver entry point to switch to the target frequency */ +static int powernowk8_target (struct cpufreq_policy *pol, +unsigned targfreq,unsigned relation) +{ +struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq, + .relation = relation }; + +/* +* Must run on @pol->cpu. cpufreq core is responsible for ensuring +* that we're bound to the current CPU and pol->cpu stays online. +*/ +if (smp_processor_id () == pol->cpu) +return powernowk8_target_fn (&pta); +else +return work_on_cpu (pol->cpu, powernowk8_target_fn, &pta); }/* Driver entry point to verify the policy and range of frequencies */
PATCH 13/108 sched: Fix ancient race in do_exit()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yasunori Goto <[email protected]>
commit b5740f4b2cb3503b436925eb2242bc3d75cd3dfe upstream.
try_to_wake_up() has a problem which may change status from TASK_DEAD to TASK_RUNNING in race condition with SMI or guest environment of virtual machine. As a result, exited task is scheduled() again and panic occurs.
Here is the sequence how it occurs:
----------------------------------+-----------------------------
|
CPU A | CPU B
----------------------------------+-----------------------------
TASK A calls exit()....
do_exit()
exit_mm()
down_read(mm->mmap_sem); rwsem_down_failed_common()
set TASK_UNINTERRUPTIBLE
set waiter.task <= task A
list_add to sem->wait_list
:
raw_spin_unlock_irq()
(I/O interruption occured)
__rwsem_do_wake(mmap_sem)
list_del(&waiter->list);
waiter->task = NULL
wake_up_process(task A)
try_to_wake_up()
(task is still
TASK_UNINTERRUPTIBLE)
p->on_rq is still 1.)
ttwu_do_wakeup()
(*A)
:
(I/O interruption handler finished)
if (!waiter.task)
schedule() is not called
due to waiter.task is NULL.
tsk->state = TASK_RUNNING
:
check_preempt_curr();
: task->state = TASK_DEAD
(*B)
<--- set TASK_RUNNING (*C)
schedule()
(exit task is running again)
BUG_ON() is called!
--------------------------------------------------------
The execution time between (*A) and (*B) is usually very short, because the interruption is disabled, and setting TASK_RUNNING at (*C) must be executed before setting TASK_DEAD.
HOWEVER, if SMI is interrupted between (*A) and (*B), (*C) is able to execute AFTER setting TASK_DEAD!
Then, exited task is scheduled again, and BUG_ON() is called....
If the system works on guest system of virtual machine, the time between (*A) and (*B) may be also long due to scheduling of hypervisor, and same phenomenon can occur.
By this patch, do_exit() waits for releasing task->pi_lock which is used in try_to_wake_up(). It guarantees the task becomes TASK_DEAD after waking up.
--- kernel/exit.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
kernel/exit.c +16 -0
@@ -1019,6 +1019,22 @@ NORET_TYPE void do_exit(long code)preempt_disable ();exit_rcu (); + +/* +* The setting of TASK_RUNNING by try_to_wake_up() may be delayed +* when the following two conditions become true. +* - There is race condition of mmap_sem (It is acquired by +* exit_mm()), and +* - SMI occurs before setting TASK_RUNINNG. +* (or hypervisor of virtual machine switches to other guest) +* As a result, we may become TASK_RUNNING after becoming TASK_DEAD +* +* To avoid it, we have to wait for releasing tsk->pi_lock which +* is held by try_to_wake_up() +*/ +smp_mb (); +raw_spin_unlock_wait (&tsk->pi_lock); +/* causes final put_task_struct in finish_task_switch(). */ tsk->state =TASK_DEAD ;schedule ();
PATCH 14/108 hpwdt: Fix kdump issue in hpwdt
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toshi Kani <[email protected]>
commit 308b135e4fcc00c80c07e0e04e7afa8edf78583c upstream.
kdump can be interrupted by watchdog timer when the timer is left activated on the crash kernel. Changed the hpwdt driver to disable watchdog timer at boot-time. This assures that watchdog timer is disabled until /dev/watchdog is opened, and prevents watchdog timer to be left running on the crash kernel.
--- drivers/watchdog/hpwdt.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/watchdog/hpwdt.c +3 -0
@@ -814,6 +814,9 @@ static int __devinit hpwdt_init_one(struct pci_dev *dev, hpwdt_timer_reg = pci_mem_addr +0x70 ; hpwdt_timer_con = pci_mem_addr +0x72 ; +/* Make sure that timer is disabled until /dev/watchdog is opened */ +hpwdt_stop (); +/* Make sure that we have a valid soft_margin */ if (hpwdt_change_timer (soft_margin))hpwdt_change_timer (DEFAULT_MARGIN );
PATCH 15/108 rtlwifi: rtl8192ce: Log message that B_CUT device may not work
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit 022e1d0680c7b4366017393417b8758be5abcee8 upstream.
There are a number of problems that occur for the latest version of the Realtek RTL8188CE device with the in-kernel driver. These include selection of the wrong firmware, and system lockup. A full fix is known, but is too invasive for inclusion in stable. This patch fixes the problem with loading the wrong firmware, and logs a message that the device may not work for kernels 3.6 and older.
---
drivers/net/wireless/rtlwifi/rtl8192ce/def.h +1 -0
@@ -117,6 +117,7 @@#define CHIP_VER_B BIT(4)#define CHIP_92C_BITMASK BIT(0) +#define CHIP_UNKNOWN BIT(7)#define CHIP_92C_1T2R 0x03#define CHIP_92C 0x01#define CHIP_88C 0x00
drivers/net/wireless/rtlwifi/rtl8192ce/hw.c +10 -2
@@ -1001,8 +1001,16 @@ static enum version_8192c _rtl92ce_read_ version = (value32 &TYPE_ID ) ?VERSION_A_CHIP_92C :VERSION_A_CHIP_88C ; }else { - version = (value32 &TYPE_ID ) ?VERSION_B_CHIP_92C : -VERSION_B_CHIP_88C ; + version = (enum version_8192c ) (CHIP_VER_B | + ((value32 &TYPE_ID ) ?CHIP_92C_BITMASK :0 ) | + ((value32 &VENDOR_ID ) ?CHIP_VENDOR_UMC :0 )); +if ((!IS_CHIP_VENDOR_UMC (version)) && (value32 & +CHIP_VER_RTL_MASK )) { + version = (enum version_8192c )(version | + ((((value32 &CHIP_VER_RTL_MASK ) ==BIT (12 )) + ?CHIP_VENDOR_UMC_B_CUT :CHIP_UNKNOWN ) | +CHIP_VENDOR_UMC )); + } }switch (version) {
drivers/net/wireless/rtlwifi/rtl8192ce/sw.c +5 -3
@@ -165,12 +165,14 @@ int rtl92c_init_sw_vars(struct ieee80211/* request fw */ if (IS_VENDOR_UMC_A_CUT (rtlhal->version) && - !IS_92C_SERIAL (rtlhal->version)) + !IS_92C_SERIAL (rtlhal->version)) { fw_name ="rtlwifi/rtl8192cfwU.bin" ; -else if (IS_81xxC_VENDOR_UMC_B_CUT (rtlhal->version)) + }else if (IS_81xxC_VENDOR_UMC_B_CUT (rtlhal->version)) { fw_name ="rtlwifi/rtl8192cfwU_B.bin" ; -else +pr_info ("****** This B_CUT device may not work with kernels 3.6 and earlier\n" ); + }else { fw_name = rtlpriv->cfg->fw_name; + } err =request_firmware (&firmware, fw_name, rtlpriv->io.dev);if (err) { RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
PATCH 16/108 brcmfmac: fix big endian bug in i-scan.
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hante Meuleman <[email protected]>
commit ed205b361956c96e0d8c09a8c9135a6a79cd9541 upstream.
ssid len is 32 bit and needs endian conversion for big endian systems.
--- drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c +4 -2
@@ -500,8 +500,10 @@ static void wl_iscan_prep(struct brcmf_scan_params_le *params_le, params_le->active_time =cpu_to_le32 (-1 ); params_le->passive_time =cpu_to_le32 (-1 ); params_le->home_time =cpu_to_le32 (-1 ); -if (ssid && ssid->SSID_len) -memcpy (¶ms_le->ssid_le, ssid,sizeof (struct brcmf_ssid )); +if (ssid && ssid->SSID_len) { + params_le->ssid_le.SSID_len =cpu_to_le32 (ssid->SSID_len); +memcpy (¶ms_le->ssid_le.SSID, ssid->SSID, ssid->SSID_len); + } } static s32
PATCH 17/108 brcmfmac: Fix big endian host configuration data.
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hante Meuleman <[email protected]>
commit e020a83d0942a5aceac35986500c9834efc8707d upstream.
Fixes big endian host configuration parameters.
--- .../net/wireless/brcm80211/brcmfmac/dhd_common.c | 26 ++++++++++++-------- 1 file changed, 16 insertions(+), 10 deletions(-)
drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c +16 -10
@@ -775,8 +775,11 @@ static void brcmf_c_arp_offload_set(stru {char iovbuf[32 ];int retcode; +__le32 arp_mode_le; -brcmf_c_mkiovar ("arp_ol" , (char *)&arp_mode,4 , iovbuf,sizeof (iovbuf)); + arp_mode_le =cpu_to_le32 (arp_mode); +brcmf_c_mkiovar ("arp_ol" , (char *)&arp_mode_le,4 , iovbuf, +sizeof (iovbuf)); retcode =brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf)); retcode = retcode >=0 ?0 : retcode;
@@ -792,8 +795,11 @@ static void brcmf_c_arp_offload_enable(s {char iovbuf[32 ];int retcode; +__le32 arp_enable_le; -brcmf_c_mkiovar ("arpoe" , (char *)&arp_enable,4 , + arp_enable_le =cpu_to_le32 (arp_enable); + +brcmf_c_mkiovar ("arpoe" , (char *)&arp_enable_le,4 , iovbuf,sizeof (iovbuf)); retcode =brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf));
@@ -814,10 +820,10 @@ int brcmf_c_preinit_dcmds(struct brcmf_pchar buf[128 ], *ptr;u32 dongle_align =BRCMF_SDALIGN ;u32 glom =0 ; -u32 roaming =1 ; -uint bcn_timeout =3 ; -int scan_assoc_time =40 ; -int scan_unassoc_time =40 ; +__le32 roaming_le =cpu_to_le32 (1 ); +__le32 bcn_timeout_le =cpu_to_le32 (3 ); +__le32 scan_assoc_time_le =cpu_to_le32 (40 ); +__le32 scan_unassoc_time_le =cpu_to_le32 (40 );int i;brcmf_os_proto_block (drvr);
@@ -852,14 +858,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_p/* Setup timeout if Beacons are lost and roam is off to report link down */ -brcmf_c_mkiovar ("bcn_timeout" , (char *)&bcn_timeout,4 , iovbuf, +brcmf_c_mkiovar ("bcn_timeout" , (char *)&bcn_timeout_le,4 , iovbuf,sizeof (iovbuf));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf));/* Enable/Disable build-in roaming to allowed ext supplicant to take of romaing */ -brcmf_c_mkiovar ("roam_off" , (char *)&roaming,4 , +brcmf_c_mkiovar ("roam_off" , (char *)&roaming_le,4 , iovbuf,sizeof (iovbuf));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf));
@@ -874,9 +880,9 @@ int brcmf_c_preinit_dcmds(struct brcmf_p sizeof(iovbuf));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_SCAN_CHANNEL_TIME , - (char *)&scan_assoc_time,sizeof (scan_assoc_time)); + (char *)&scan_assoc_time_le,sizeof (scan_assoc_time_le));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_SCAN_UNASSOC_TIME , - (char *)&scan_unassoc_time,sizeof (scan_unassoc_time)); + (char *)&scan_unassoc_time_le,sizeof (scan_unassoc_time_le));/* Set and enable ARP offload feature */ brcmf_c_arp_offload_set (drvr,BRCMF_ARPOL_MODE );
PATCH 18/108 dmaengine: at_hdmac: fix comment in atc_prep_slave_sg()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
commit c618a9be0e8c0f36baee2560860a0118a428fb26 upstream.
s/dma_memcpy/slave_sg/ and it is sg length that we are talking about.
--- drivers/dma/at_hdmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/at_hdmac.c +1 -1
@@ -661,7 +661,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, flags);if (unlikely (!atslave || !sg_len)) { -dev_dbg (chan2dev (chan),"prep_dma_memcpy: length is zero!\n" ); +dev_dbg (chan2dev (chan),"prep_slave_sg: sg length is zero!\n" );return NULL ; }
PATCH 19/108 dmaengine: at_hdmac: check that each sg data length is non-null
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
commit c456797681db814f4f5b36909e8e94047bf53d9c upstream.
Avoid the construction of a malformed DMA request sent to the DMA controller.
Log message is for debug only because this condition is unlikely to append and may only trigger at driver development time.
--- drivers/dma/at_hdmac.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/dma/at_hdmac.c +11 -0
@@ -689,6 +689,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, mem =sg_dma_address (sg); len =sg_dma_len (sg); +if (unlikely (!len)) { +dev_dbg (chan2dev (chan), +"prep_slave_sg: sg(%d) data length is zero\n" , i); + goto err; + } mem_width =2 ;if (unlikely (mem &3 || len &3 )) mem_width =0 ;
@@ -724,6 +729,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, mem =sg_dma_address (sg); len =sg_dma_len (sg); +if (unlikely (!len)) { +dev_dbg (chan2dev (chan), +"prep_slave_sg: sg(%d) data length is zero\n" , i); + goto err; + } mem_width =2 ;if (unlikely (mem &3 || len &3 )) mem_width =0 ;
@@ -757,6 +767,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, err_desc_get:dev_err (chan2dev (chan),"not enough descriptors available\n" ); +err:atc_desc_put (atchan, first);return NULL ; }
PATCH 20/108 ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Leach <[email protected]>
commit e1e5b7e4251c7538ca08c2c5545b0c2fbd8a6635 upstream.
This patch zeroes the SCTLR.TRE bit prior to setting the mapping as cacheable for ARMv7 cores in the decompressor, ensuring that the memory region attributes are obtained from the C and B bits, not from the page tables.
--- arch/arm/boot/compressed/head.S | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/compressed/head.S +1 -0
@@ -653,6 +653,7 @@ __armv7_mmu_cache_on: mcrne p15, 0, r0, c8, c7, 0 @ flush I,D TLBs #endif mrc p15, 0, r0, c1, c0, 0 @ read control reg + bic r0, r0, #1 << 28 @ clear SCTLR.TRE orr r0, r0, #0x5000 @ I-cache enable, RR cache replacement orr r0, r0, #0x003c @ write buffer #ifdef CONFIG_MMU
PATCH 21/108 drm/i915: Reduce a pin-leak BUG into a WARN
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <[email protected]>
commit 7e81a42e341a4f15d76624b7c02ffb21b085b56f upstream.
Pin-leaks persist and we get the perennial bug reports of machine lockups to the BUG_ON(pin_count==MAX). If we instead loudly report that the object cannot be pinned at that time it should prevent the driver from locking up, and hopefully restore a semblance of working whilst still leaving us a OOPS to debug.
--- drivers/gpu/drm/i915/i915_gem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_gem.c +2 -1
@@ -3357,7 +3357,8 @@ i915_gem_object_pin(struct drm_i915_gem_struct drm_i915_private *dev_priv = dev->dev_private;int ret; -BUG_ON (obj->pin_count ==DRM_I915_GEM_OBJECT_MAX_PIN_COUNT ); +if (WARN_ON (obj->pin_count ==DRM_I915_GEM_OBJECT_MAX_PIN_COUNT )) +return -EBUSY ;WARN_ON (i915_verify_lists (dev));if (obj->gtt_space !=NULL ) {
PATCH 22/108 drm/i915: HDMI - Clear Audio Enable bit for Hot Plug
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Xingchao <[email protected]>
commit b98b60167279df3acac9422c3c9820d9ebbcf9fb upstream.
Clear Audio Enable bit to trigger unsolicated event to notify Audio Driver part the HDMI hot plug change. The patch fixed the bug when remove HDMI cable the bit was not cleared correctly.
In intel_hdmi_dpms(), if intel_hdmi->has_audio been true, the "Audio enable bit" will be set to trigger unsolicated event to notify Alsa driver the change.
intel_hdmi->has_audio will be reset to false from intel_hdmi_detect() after remove the hdmi cable, here's debug log:
[ 187.494153] [drm:output_poll_execute], [CONNECTOR:17:HDMI-A-1] status updated from 1 to 2 [ 187.525349] [drm:intel_hdmi_detect], HDMI: has_audio = 0
so when comes back to intel_hdmi_dpms(), the "Audio enable bit" will not be cleared. And this cause the eld infomation and pin presence doesnot update accordingly in alsa driver side.
This patch will also trigger unsolicated event to alsa driver to notify the hot plug event:
[ 187.853159] ALSA sound/pci/hda/patch_hdmi.c:772 HDMI hot plug event: Codec=3 Pin=5 Presence_Detect=0 ELD_Valid=1 [ 187.853268] ALSA sound/pci/hda/patch_hdmi.c:990 HDMI status: Codec=3 Pin=5 Presence_Detect=0 ELD_Valid=0
--- drivers/gpu/drm/i915/intel_hdmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/intel_hdmi.c +1 -1
@@ -609,7 +609,7 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)u32 temp;u32 enable_bits =SDVO_ENABLE ; -if (intel_hdmi->has_audio) +if (intel_hdmi->has_audio || mode !=DRM_MODE_DPMS_ON ) enable_bits |=SDVO_AUDIO_ENABLE ; temp =I915_READ (intel_hdmi->sdvox_reg);
PATCH 23/108 bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eddie Wai <[email protected]>
commit d6532207116307eb7ecbfa7b9e02c53230096a50 upstream.
This patch fixes the following kernel panic invoked by uninitialized fields in the chip initialization for the 1G bnx2 iSCSI offload.
One of the bits in the chip initialization is being used by the latest firmware to control overflow packets. When this control bit gets enabled erroneously, it would ultimately result in a bad packet placement which would cause the bnx2 driver to dereference a NULL ptr in the placement handler.
This can happen under certain stress I/O environment under the Linux iSCSI offload operation.
This change only affects Broadcom's 5709 chipset.
Unable to handle kernel NULL pointer dereference at 0000000000000008 RIP: [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5 Pid: 0, comm: swapper Tainted: G ---- 2.6.18-333.el5debug #2 RIP: 0010:[<ffffffff881f0e7d>] [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5 RSP: 0018:ffff8101b575bd50 EFLAGS: 00010216 RAX: 0000000000000005 RBX: ffff81007c5fb180 RCX: 0000000000000000 RDX: 0000000000000ffc RSI: 00000000817e8000 RDI: 0000000000000220 RBP: ffff81015bbd7ec0 R08: ffff8100817e9000 R09: 0000000000000000 R10: ffff81007c5fb180 R11: 00000000000000c8 R12: 000000007a25a010 R13: 0000000000000000 R14: 0000000000000005 R15: ffff810159f80558 FS: 0000000000000000(0000) GS:ffff8101afebc240(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 0000000000000008 CR3: 0000000000201000 CR4: 00000000000006a0 Process swapper (pid: 0, threadinfo ffff8101b5754000, task ffff8101afebd820) Stack: 000000000000000b ffff810159f80000 0000000000000040 ffff810159f80520 ffff810159f80500 00cf00cf8008e84b ffffc200100939e0 ffff810009035b20 0000502900000000 000000be00000001 ffff8100817e7810 00d08101b575bea8 Call Trace: <IRQ> [<ffffffff8008e0d0>] show_schedstat+0x1c2/0x25b [<ffffffff881f1886>] :bnx2:bnx2_poll+0xf6/0x231 [<ffffffff8000c9b9>] net_rx_action+0xac/0x1b1 [<ffffffff800125a0>] __do_softirq+0x89/0x133 [<ffffffff8005e30c>] call_softirq+0x1c/0x28 [<ffffffff8006d5de>] do_softirq+0x2c/0x7d [<ffffffff8006d46e>] do_IRQ+0xee/0xf7 [<ffffffff8005d625>] ret_from_intr+0x0/0xa <EOI> [<ffffffff801a5780>] acpi_processor_idle_simple+0x1c5/0x341 [<ffffffff801a573d>] acpi_processor_idle_simple+0x182/0x341 [<ffffffff801a55bb>] acpi_processor_idle_simple+0x0/0x341 [<ffffffff80049560>] cpu_idle+0x95/0xb8 [<ffffffff80078b1c>] start_secondary+0x479/0x488
--- drivers/scsi/bnx2i/bnx2i_hwi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/bnx2i/bnx2i_hwi.c +3 -0
@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)int rc =0 ;u64 mask64; +memset (&iscsi_init,0x00 ,sizeof (struct iscsi_kwqe_init1 )); +memset (&iscsi_init2,0x00 ,sizeof (struct iscsi_kwqe_init2 )); +bnx2i_adjust_qp_size (hba); iscsi_init.flags =
PATCH 24/108 mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "[email protected]" <[email protected]>
commit 10cce6d8b5af0b32bc4254ae4a28423a74c0921c upstream.
This patch checks whether HBA is SAS2008 B0 controller.
if it is a SAS2008 B0 controller then it use IO-APIC interrupt instead of MSIX, as SAS2008 B0 controller doesn't support MSIX interrupts.
--- drivers/scsi/mpt2sas/mpt2sas_base.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/scsi/mpt2sas/mpt2sas_base.c +7 -0
@@ -1209,6 +1209,13 @@ _base_check_enable_msix(struct MPT2SAS_ADAPTER *ioc)u16 message_control; +/* Check whether controller SAS2008 B0 controller, +if it is SAS2008 B0 controller use IO-APIC instead of MSIX */ +if (ioc->pdev->device ==MPI2_MFGPAGE_DEVID_SAS2008 && + ioc->pdev->revision ==0x01 ) { +return -EINVAL ; + } + base =pci_find_capability (ioc->pdev,PCI_CAP_ID_MSIX );if (!base) { dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not "
PATCH 25/108 hwmon: (ads7871) Add name sysfs attribute
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
commit 4e21f4eaa49f78d3e977e316514c941053871c76 upstream.
The 'name' sysfs attribute is mandatory for hwmon devices, but was missing in this driver.
--- drivers/hwmon/ads7871.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/hwmon/ads7871.c +9 -0
@@ -139,6 +139,12 @@ static ssize_t show_voltage(struct device *dev, } } +static ssize_t ads7871_show_name (struct device *dev, +struct device_attribute *devattr,char *buf) +{ +return sprintf (buf,"%s\n" ,to_spi_device (dev)->modalias); +} + static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_voltage, NULL, 0); static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_voltage, NULL, 1); static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_voltage, NULL, 2);
@@ -148,6 +154,8 @@ static SENSOR_DEVICE_ATTR(in5_input, S_IRUGO, show_voltage, NULL, 5); static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_voltage, NULL, 6); static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_voltage, NULL, 7); +static DEVICE_ATTR(name, S_IRUGO, ads7871_show_name, NULL); +static struct attribute *ads7871_attributes[] = { &sensor_dev_attr_in0_input.dev_attr.attr, &sensor_dev_attr_in1_input.dev_attr.attr,
@@ -157,6 +165,7 @@ static struct attribute *ads7871_attributes[] = { &sensor_dev_attr_in5_input.dev_attr.attr, &sensor_dev_attr_in6_input.dev_attr.attr, &sensor_dev_attr_in7_input.dev_attr.attr, + &dev_attr_name.attr, NULL };
PATCH 26/108 DMA: PL330: Check the pointer returned by kzalloc
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sachin Kamat <[email protected]>
commit 61c6e7531d3b66b33187b8cdd700fd8ab93ffd62 upstream.
kzalloc could return NULL. Hence add a check to avoid NULL pointer dereference.
--- drivers/dma/pl330.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/dma/pl330.c +5 -0
@@ -858,6 +858,11 @@ pl330_probe(struct amba_device *adev, co/* Initialize channel parameters */ num_chan =max (pdat ? pdat->nr_valid_peri :0 , (u8 )pi->pcfg.num_chan); pdmac->peripherals =kzalloc (num_chan *sizeof (*pch),GFP_KERNEL ); +if (!pdmac->peripherals) { + ret = -ENOMEM ; +dev_err (&adev->dev,"unable to allocate pdmac->peripherals\n" ); + goto probe_err4; + }for (i =0 ; i < num_chan; i++) { pch = &pdmac->peripherals[i];
PATCH 27/108 hpsa: fix handling of protocol error
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Stephen M. Cameron" <[email protected]>
commit 256d0eaac87da1e993190846064f339f4c7a63f5 upstream.
If a command status of CMD_PROTOCOL_ERR is received, this information should be conveyed to the SCSI mid layer, not dropped on the floor. CMD_PROTOCOL_ERR may be received from the Smart Array for any commands destined for an external RAID controller such as a P2000, or commands destined for tape drives or CD/DVD-ROM drives, if for instance a cable is disconnected. This mostly affects multipath configurations, as disconnecting a cable on a non-multipath configuration is not going to do anything good regardless of whether CMD_PROTOCOL_ERR is handled correctly or not. Not handling CMD_PROTOCOL_ERR correctly in a multipath configaration involving external RAID controllers may cause data corruption, so this is quite a serious bug. This bug should not normally cause a problem for direct attached disk storage.
--- drivers/scsi/hpsa.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/hpsa.c +2 -1
@@ -1315,8 +1315,9 @@ static void complete_scsi_command(struct CommandList *cp) }break ;case CMD_PROTOCOL_ERR : + cmd->result =DID_ERROR <<16 ;dev_warn (&h->pdev->dev,"cp %p has " -"protocol error \n" , cp); +"protocol error\n" , cp);break ;case CMD_HARDWARE_ERR : cmd->result =DID_ERROR <<16 ;
PATCH 28/108 ARM: imx: armadillo5x0: Fix illegal register access
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 35495173e1df621dff0e9a244accbe32cd28a98f upstream.
Since commit eb92044eb (ARM i.MX3: Make ccm base address a variable ) it is necessary to pass the CCM register base as a variable.
Fix the CCM register access in mach-armadillo5x0 by passing mx3_ccm_base and avoid illegal accesses.
Also applies to v3.5
--- arch/arm/mach-imx/mach-armadillo5x0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/mach-imx/mach-armadillo5x0.c +2 -1
@@ -526,7 +526,8 @@ static void __init armadillo5x0_init(void)imx31_add_mxc_nand (&armadillo5x0_nand_board_info);/* set NAND page size to 2k if not configured via boot mode pins */ -__raw_writel (__raw_readl (MXC_CCM_RCSR ) | (1 <<30 ),MXC_CCM_RCSR ); +__raw_writel (__raw_readl (mx3_ccm_base +MXC_CCM_RCSR ) | + (1 <<30 ), mx3_ccm_base +MXC_CCM_RCSR );/* RTC */ /* Get RTC IRQ and register the chip */
RE: [ 028/108] ARM: imx: armadillo5x0: Fix illegal register access
No, please drop it from 3.2-stable.
This one should only go to 3.5/3.6 stable trees.
Otherwise it will break 3.2-stable.
Regards,
Fabio Estevam
________________________________________
From: Ben Hutchings [[email protected]]
Sent: Sunday, October 07, 2012 5:59 PM
To: [email protected]; [email protected]
Cc: [email protected]; [email protected]; Estevam Fabio-R49496; Arnd Bergmann; Sascha Hauer
Subject: [ 028/108] ARM: imx: armadillo5x0: Fix illegal register access
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 35495173e1df621dff0e9a244accbe32cd28a98f upstream.
Since commit eb92044eb (ARM i.MX3: Make ccm base address a variable ) it is necessary to pass the CCM register base as a variable.
Fix the CCM register access in mach-armadillo5x0 by passing mx3_ccm_base and avoid illegal accesses.
Also applies to v3.5
--- arch/arm/mach-imx/mach-armadillo5x0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/mach-imx/mach-armadillo5x0.c +2 -1
@@ -526,7 +526,8 @@ static void __init armadillo5x0_init(void)imx31_add_mxc_nand (&armadillo5x0_nand_board_info);/* set NAND page size to 2k if not configured via boot mode pins */ -__raw_writel (__raw_readl (MXC_CCM_RCSR ) | (1 <<30 ),MXC_CCM_RCSR ); +__raw_writel (__raw_readl (mx3_ccm_base +MXC_CCM_RCSR ) | + (1 <<30 ), mx3_ccm_base +MXC_CCM_RCSR );/* RTC */ /* Get RTC IRQ and register the chip */
Re: [ 028/108] ARM: imx: armadillo5x0: Fix illegal register access
Quoted 5 lines · On Sun, 2012-10-07 at 23:37 +0000, Estevam Fabio-R49496 wrote:
No, please drop it from 3.2-stable.
This one should only go to 3.5/3.6 stable trees.
Otherwise it will break 3.2-stable.
Thanks, I've dropped this.
Ben.
Signature · 2 lines
Ben Hutchings Who are all these weirdos? - David Bowie, about L-Space IRC channel #afp
PATCH 29/108 hwmon: (ad7314) Add name sysfs attribute
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
commit 3ceefe4319636d89d4bdf40dca9471970f942e4f upstream.
The 'name' sysfs attribute is mandatory for hwmon devices, but was missing in this driver.
--- drivers/hwmon/ad7314.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/hwmon/ad7314.c +8 -0
@@ -87,10 +87,18 @@ static ssize_t ad7314_show_temperature(struct device *dev, } } +static ssize_t ad7314_show_name (struct device *dev, +struct device_attribute *devattr,char *buf) +{ +return sprintf (buf,"%s\n" ,to_spi_device (dev)->modalias); +} + +static DEVICE_ATTR(name, S_IRUGO, ad7314_show_name, NULL); static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, ad7314_show_temperature, NULL, 0);static struct attribute *ad7314_attributes[] = { + &dev_attr_name.attr, &sensor_dev_attr_temp1_input.dev_attr.attr,NULL , };
PATCH 30/108 cifs: fix return value in cifsConvertToUTF16
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit c73f693989d7a7d99ec66a7065295a0c93d0b127 upstream.
This function returns the wrong value, which causes the callers to get the length of the resulting pathname wrong when it contains non-ASCII characters.
This seems to fix https://bugzilla.samba.org/show_bug.cgi?id=6767
--- fs/cifs/cifs_unicode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/cifs_unicode.c +1 -1
@@ -327,6 +327,6 @@ cifsConvertToUCS(__le16 *target, const c } ctoUCS_out: -return i; +return j; }
PATCH 31/108 cfg80211: fix possible circular lock on reg_regdb_search()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Luis R. Rodriguez" <[email protected]>
commit a85d0d7f3460b1a123b78e7f7e39bf72c37dfb78 upstream.
When call_crda() is called we kick off a witch hunt search for the same regulatory domain on our internal regulatory database and that work gets kicked off on a workqueue, this is done while the cfg80211_mutex is held. If that workqueue kicks off it will first lock reg_regdb_search_mutex and later cfg80211_mutex but to ensure two CPUs will not contend against cfg80211_mutex the right thing to do is to have the reg_regdb_search() wait until the cfg80211_mutex is let go.
The lockdep report is pasted below.
cfg80211: Calling CRDA to update world regulatory domain
======================================================
[ INFO: possible circular locking dependency detected ]
3.3.8 #3 Tainted: G O
-------------------------------------------------------
kworker/0:1/235 is trying to acquire lock:
(cfg80211_mutex){+.+...}, at: [<816468a4>] set_regdom+0x78c/0x808 [cfg80211]
but task is already holding lock:
(reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (reg_regdb_search_mutex){+.+...}:
[<800a8384>] lock_acquire+0x60/0x88
[<802950a8>] mutex_lock_nested+0x54/0x31c
[<81645778>] is_world_regdom+0x9f8/0xc74 [cfg80211]-> #1 (reg_mutex#2){+.+...}:
[<800a8384>] lock_acquire+0x60/0x88
[<802950a8>] mutex_lock_nested+0x54/0x31c
[<8164539c>] is_world_regdom+0x61c/0xc74 [cfg80211]-> #0 (cfg80211_mutex){+.+...}:
[<800a77b8>] __lock_acquire+0x10d4/0x17bc
[<800a8384>] lock_acquire+0x60/0x88
[<802950a8>] mutex_lock_nested+0x54/0x31c
[<816468a4>] set_regdom+0x78c/0x808 [cfg80211]other info that might help us debug this:
Chain exists of: cfg80211_mutex --> reg_mutex#2 --> reg_regdb_search_mutex Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(reg_regdb_search_mutex);
lock(reg_mutex#2);
lock(reg_regdb_search_mutex); lock(cfg80211_mutex);
*** DEADLOCK ***
3 locks held by kworker/0:1/235:
#0: (events){.+.+..}, at: [<80089a00>] process_one_work+0x230/0x460
#1: (reg_regdb_work){+.+...}, at: [<80089a00>] process_one_work+0x230/0x460
#2: (reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211]stack backtrace: Call Trace: [<80290fd4>] dump_stack+0x8/0x34 [<80291bc4>] print_circular_bug+0x2ac/0x2d8 [<800a77b8>] __lock_acquire+0x10d4/0x17bc [<800a8384>] lock_acquire+0x60/0x88 [<802950a8>] mutex_lock_nested+0x54/0x31c [<816468a4>] set_regdom+0x78c/0x808 [cfg80211]
--- net/wireless/reg.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
net/wireless/reg.c +9 -3
@@ -350,6 +350,9 @@ static void reg_regdb_search(struct work_struct *work)struct reg_regdb_search_request *request;const struct ieee80211_regdomain *curdom, *regdom;int i, r; +bool set_reg = false; + +mutex_lock (&cfg80211_mutex);mutex_lock (®_regdb_search_mutex);while (!list_empty (®_regdb_search_list)) {
@@ -365,9 +368,7 @@ static void reg_regdb_search(struct work_struct *work) r =reg_copy_regd (®dom, curdom);if (r)break ; -mutex_lock (&cfg80211_mutex); -set_regdom (regdom); -mutex_unlock (&cfg80211_mutex); + set_reg = true;break ; } }
@@ -375,6 +376,11 @@ static void reg_regdb_search(struct work_struct *work)kfree (request); }mutex_unlock (®_regdb_search_mutex); + +if (set_reg) +set_regdom (regdom); + +mutex_unlock (&cfg80211_mutex); } static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
PATCH 32/108 xen/boot: Disable BIOS SMP MP table search.
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <[email protected]>
commit bd49940a35ec7d488ae63bd625639893b3385b97 upstream.
As the initial domain we are able to search/map certain regions of memory to harvest configuration data. For all low-level we use ACPI tables - for interrupts we use exclusively ACPI _PRT (so DSDT) and MADT for INT_SRC_OVR.
The SMP MP table is not used at all. As a matter of fact we do not even support machines that only have SMP MP but no ACPI tables.
Lets follow how Moorestown does it and just disable searching for BIOS SMP tables.
This also fixes an issue on HP Proliant BL680c G5 and DL380 G6:
9f->100 for 1:1 PTE
Freeing 9f-100 pfn range: 97 pages freed
1-1 mapping on 9f->100
.. snip..
e820: BIOS-provided physical RAM map:
Xen: [mem 0x0000000000000000-0x000000000009efff] usable
Xen: [mem 0x000000000009f400-0x00000000000fffff] reserved
Xen: [mem 0x0000000000100000-0x00000000cfd1dfff] usable
.. snip..
Scan for SMP in [mem 0x00000000-0x000003ff]
Scan for SMP in [mem 0x0009fc00-0x0009ffff]
Scan for SMP in [mem 0x000f0000-0x000fffff]
found SMP MP-table at [mem 0x000f4fa0-0x000f4faf] mapped at [ffff8800000f4fa0]
(XEN) mm.c:908:d0 Error getting mfn 100 (pfn 5555555555555555) from L1 entry 0000000000100461 for l1e_owner=0, pg_owner=0 (XEN) mm.c:4995:d0 ptwr_emulate: could not get_page_from_l1e()
BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff81ac07e2>] xen_set_pte_init+0x66/0x71 . snip.. Pid: 0, comm: swapper Not tainted 3.6.0-rc6upstream-00188-gb6fb969-dirty #2 HP ProLiant BL680c G5 .. snip.. Call Trace: [<ffffffff81ad31c6>] __early_ioremap+0x18a/0x248 [<ffffffff81624731>] ? printk+0x48/0x4a [<ffffffff81ad32ac>] early_ioremap+0x13/0x15 [<ffffffff81acc140>] get_mpc_size+0x2f/0x67 [<ffffffff81acc284>] smp_scan_config+0x10c/0x136 [<ffffffff81acc2e4>] default_find_smp_config+0x36/0x5a [<ffffffff81ac3085>] setup_arch+0x5b3/0xb5b [<ffffffff81624731>] ? printk+0x48/0x4a [<ffffffff81abca7f>] start_kernel+0x90/0x390 [<ffffffff81abc356>] x86_64_start_reservations+0x131/0x136 [<ffffffff81abfa83>] xen_start_kernel+0x65f/0x661
(XEN) Domain 0 crashed: 'noreboot' set - not rebooting.
which is that ioremap would end up mapping 0xff using _PAGE_IOMAP (which is what early_ioremap sticks as a flag) - which meant we would get MFN 0xFF (pte ff461, which is OK), and then it would also map 0x100 (b/c ioremap tries to get page aligned request, and it was trying to map 0xf4fa0 + PAGE_SIZE - so it mapped the next page) as _PAGE_IOMAP. Since 0x100 is actually a RAM page, and the _PAGE_IOMAP bypasses the P2M lookup we would happily set the PTE to 1000461. Xen would deny the request since we do not have access to the Machine Frame Number (MFN) of 0x100. The P2M[0x100] is for example 0x80140.
Fixes-Oracle-Bugzilla: https://bugzilla.oracle.com/bugzilla/show_bug.cgi?id=13665
--- arch/x86/xen/enlighten.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/xen/enlighten.c +4 -0
@@ -1289,6 +1289,10 @@ asmlinkage void __init xen_start_kernel(/* Make sure ACS will be enabled */ pci_request_acs (); + +/* Avoid searching for BIOS MP tables */ + x86_init.mpparse.find_smp_config = x86_init_noop; + x86_init.mpparse.get_smp_config = x86_init_uint_noop; }#ifdef CONFIG_PCI /* PCI BIOS service won't work from a PV guest. */
PATCH 33/108 asix: Support DLink DUB-E100 H/W Ver C1
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Søren Holm <[email protected]>
commit ed3770a9cd5764a575b83810ea679bbff2b03082 upstream.
--- drivers/net/usb/asix.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/usb/asix.c +4 -0
@@ -1648,6 +1648,10 @@ static const struct usb_device_id produc USB_DEVICE (0x2001, 0x3c05), .driver_info = (unsigned long ) &ax88772_info, }, { +// DLink DUB-E100 H/W Ver C1 +USB_DEVICE (0x2001 ,0x1a02 ), + .driver_info = (unsigned long) &ax88772_info, +}, {// Linksys USB1000 USB_DEVICE (0x1737 ,0x0039 ), .driver_info = (unsigned long) &ax88178_info,
PATCH 34/108 Input: i8042 - disable mux on Toshiba C850D
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anisse Astier <[email protected]>
commit 8669cf6793bb38307a30fb6b9565ddc8840ebd3f upstream.
On Toshiba Satellite C850D, the touchpad and the keyboard might randomly not work at boot. Preventing MUX mode activation solves this issue.
--- drivers/input/serio/i8042-x86ia64io.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +6 -0
@@ -335,6 +335,12 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { }, { .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), + DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"), + }, + }, + { + .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"ALIENWARE" ), DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"), },
PATCH 35/108 tracing: Dont call page_to_pfn() if page is NULL
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Congyang <[email protected]>
commit 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa upstream.
When allocating memory fails, page is NULL. page_to_pfn() will cause the kernel panicked if we don't use sparsemem vmemmap.
--- include/trace/events/kmem.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/trace/events/kmem.h +2 -2
@@ -214,7 +214,7 @@ TRACE_EVENT(mm_page_alloc,TP_printk ("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s" , __entry->page, -page_to_pfn (__entry->page), + __entry->page ?page_to_pfn (__entry->page) :0 , __entry->order, __entry->migratetype,show_gfp_flags (__entry->gfp_flags))
@@ -240,7 +240,7 @@ DECLARE_EVENT_CLASS(mm_page,TP_printk ("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d" , __entry->page, -page_to_pfn (__entry->page), + __entry->page ?page_to_pfn (__entry->page) :0 , __entry->order, __entry->migratetype, __entry->order ==0 )
PATCH 36/108 can: janz-ican3: fix support for older hardware revisions
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Ira W. Snyder" <[email protected]>
commit e21093ef6fb4cbecdf926102286dbe280ae965db upstream.
The Revision 1.0 Janz CMOD-IO Carrier Board does not have support for the reset registers. To support older hardware, the code is changed to use the hardware reset register on the Janz VMOD-ICAN3 hardware itself.
--- drivers/net/can/janz-ican3.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/can/janz-ican3.c +1 -3
@@ -1391,7 +1391,6 @@ static irqreturn_t ican3_irq(int irq, void *dev_id)*/ static int ican3_reset_module (struct ican3_dev *mod) { -u8 val =1 << mod->num;unsigned long start;u8 runold, runnew;
@@ -1405,8 +1404,7 @@ static int ican3_reset_module(struct ican3_dev *mod) runold =ioread8 (mod->dpm +TARGET_RUNNING );/* reset the module */ -iowrite8 (val, &mod->ctrl->reset_assert); -iowrite8 (val, &mod->ctrl->reset_deassert); +iowrite8 (0x00 , &mod->dpmctrl->hwreset);/* wait until the module has finished resetting and is running */ start = jiffies;
PATCH 37/108 can: ti_hecc: fix oops during rmmod
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit ab04c8bd423edb03e2148350a091836c196107fc upstream.
This patch fixes an oops which occurs when unloading the driver, while the network interface is still up. The problem is that first the io mapping is teared own, then the CAN device is unregistered, resulting in accessing the hardware's iomem:
[ 172.744232] Unable to handle kernel paging request at virtual address c88b0040 [ 172.752441] pgd = c7be4000 [ 172.755645] [c88b0040] *pgd=87821811, *pte=00000000, *ppte=00000000 [ 172.762207] Internal error: Oops: 807 [#1] PREEMPT ARM [ 172.767517] Modules linked in: ti_hecc(-) can_dev [ 172.772430] CPU: 0 Not tainted (3.5.0alpha-00037-g3554cc0 #126) [ 172.778961] PC is at ti_hecc_close+0xb0/0x100 [ti_hecc] [ 172.784423] LR is at __dev_close_many+0x90/0xc0 [ 172.789123] pc : [<bf00c768>] lr : [<c033be58>] psr: 60000013 [ 172.789123] sp : c5c1de68 ip : 00040081 fp : 00000000 [ 172.801025] r10: 00000001 r9 : c5c1c000 r8 : 00100100 [ 172.806457] r7 : c5d0a48c r6 : c5d0a400 r5 : 00000000 r4 : c5d0a000 [ 172.813232] r3 : c88b0000 r2 : 00000001 r1 : c5d0a000 r0 : c5d0a000 [ 172.820037] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 172.827423] Control: 10c5387d Table: 87be4019 DAC: 00000015 [ 172.833404] Process rmmod (pid: 600, stack limit = 0xc5c1c2f0) [ 172.839447] Stack: (0xc5c1de68 to 0xc5c1e000) [ 172.843994] de60: bf00c6b8 c5c1dec8 c5d0a000 c5d0a000 00200200 c033be58 [ 172.852478] de80: c5c1de44 c5c1dec8 c5c1dec8 c033bf2c c5c1de90 c5c1de90 c5d0a084 c5c1de44 [ 172.860992] dea0: c5c1dec8 c033c098 c061d3dc c5d0a000 00000000 c05edf28 c05edb34 c000d724 [ 172.869476] dec0: 00000000 c033c2f8 c5d0a084 c5d0a084 00000000 c033c370 00000000 c5d0a000 [ 172.877990] dee0: c05edb00 c033c3b8 c5d0a000 bf00d3ac c05edb00 bf00d7c8 bf00d7c8 c02842dc [ 172.886474] df00: c02842c8 c0282f90 c5c1c000 c05edb00 bf00d7c8 c0283668 bf00d7c8 00000000 [ 172.894989] df20: c0611f98 befe2f80 c000d724 c0282d10 bf00d804 00000000 00000013 c0068a8c [ 172.903472] df40: c5c538e8 685f6974 00636365 c61571a8 c5cb9980 c61571a8 c6158a20 c00c9bc4 [ 172.911987] df60: 00000000 00000000 c5cb9980 00000000 c5cb9980 00000000 c7823680 00000006 [ 172.920471] df80: bf00d804 00000880 c5c1df8c 00000000 000d4267 befe2f80 00000001 b6d90068 [ 172.928985] dfa0: 00000081 c000d5a0 befe2f80 00000001 befe2f80 00000880 b6d90008 00000008 [ 172.937469] dfc0: befe2f80 00000001 b6d90068 00000081 00000001 00000000 befe2eac 00000000 [ 172.945983] dfe0: 00000000 befe2b18 00023ba4 b6e6addc 60000010 befe2f80 a8e00190 86d2d344 [ 172.954498] [<bf00c768>] (ti_hecc_close+0xb0/0x100 [ti_hecc]) from [<c033be58>] (__dev__registered_many+0xc0/0x2a0) [ 172.984161] [<c033c098>] (rollback_registered_many+0xc0/0x2a0) from [<c033c2f8>] (rollback_registered+0x20/0x30) [ 172.994750] [<c033c2f8>] (rollback_registered+0x20/0x30) from [<c033c370>] (unregister_netdevice_queue+0x68/0x98) [ 173.005401] [<c033c370>] (unregister_netdevice_queue+0x68/0x98) from [<c033c3b8>] (unregister_netdev+0x18/0x20) [ 173.015899] [<c033c3b8>] (unregister_netdev+0x18/0x20) from [<bf00d3ac>] (ti_hecc_remove+0x60/0x80 [ti_hecc]) [ 173.026245] [<bf00d3ac>] (ti_hecc_remove+0x60/0x80 [ti_hecc]) from [<c02842dc>] (platform_drv_remove+0x14/0x18) [ 173.036712] [<c02842dc>] (platform_drv_remove+0x14/0x18) from [<c0282f90>] (__device_release_driver+0x7c/0xbc)
--- drivers/net/can/ti_hecc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/ti_hecc.c +1 -1
@@ -984,12 +984,12 @@ static int __devexit ti_hecc_remove(struct platform_device *pdev)struct net_device *ndev =platform_get_drvdata (pdev);struct ti_hecc_priv *priv =netdev_priv (ndev); +unregister_candev (ndev);clk_disable (priv->clk);clk_put (priv->clk); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );iounmap (priv->base);release_mem_region (res->start,resource_size (res)); -unregister_candev (ndev);free_candev (ndev);platform_set_drvdata (pdev,NULL );
PATCH 38/108 HID: logitech: fix mask to enable DJ mode
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nestor Lopez Casado <[email protected]>
commit 765031668fb2b064aebd9a568e5ad794cbe3413a upstream.
The user can only experience the bug if she pairs 6 devices to a Unifying receiver. The sixth paired device would not work.
The value changed is actually a bitmask that enables reporting from each paired device. As the sixth bit was not set, the sixth device reports are ignored by the receiver and never get to the driver.
drivers/hid/hid-logitech-dj.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
--- drivers/hid/hid-logitech-dj.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-logitech-dj.c +1 -1
@@ -445,7 +445,7 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev, dj_report.report_id =REPORT_ID_DJ_SHORT ; dj_report.device_index =0xFF ; dj_report.report_type =REPORT_TYPE_CMD_SWITCH ; - dj_report.report_params[CMD_SWITCH_PARAM_DEVBITFIELD ] =0x1F ; + dj_report.report_params[CMD_SWITCH_PARAM_DEVBITFIELD ] =0x3F ; dj_report.report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS ] = (u8 )timeout;return logi_dj_recv_send_report (djrcv_dev, &dj_report); }
PATCH 39/108 HID: logitech: dont use stack based dj_report structures
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Dionne <[email protected]>
commit d8dc3494f77a5cc3b274bae36f7e74e85cf8a407 upstream.
On a system with a logitech wireless keyboard/mouse and DMA-API debugging enabled, this warning appears at boot:
kernel: WARNING: at lib/dma-debug.c:929 check_for_stack.part.12+0x70/0xa7()
kernel: Hardware name: MS-7593
kernel: uhci_hcd 0000:00:1d.1: DMA-API: device driver maps memory fromstack [addr=ffff8801b0079c29]
Make logi_dj_recv_query_paired_devices and logi_dj_recv_switch_to_dj_mode use a structure allocated with kzalloc rather than a stack based one.
--- drivers/hid/hid-logitech-dj.c | 38 ++++++++++++++++++++++++-------------- 1 file changed, 24 insertions(+), 14 deletions(-)
drivers/hid/hid-logitech-dj.c +24 -14
@@ -436,27 +436,37 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,static int logi_dj_recv_query_paired_devices (struct dj_receiver_dev *djrcv_dev) { -struct dj_report dj_report; +struct dj_report *dj_report; +int retval; -memset (&dj_report,0 ,sizeof (dj_report)); - dj_report.report_id =REPORT_ID_DJ_SHORT ; - dj_report.device_index =0xFF ; - dj_report.report_type =REPORT_TYPE_CMD_GET_PAIRED_DEVICES ; -return logi_dj_recv_send_report (djrcv_dev, &dj_report); + dj_report =kzalloc (sizeof (dj_report),GFP_KERNEL ); +if (!dj_report) +return -ENOMEM ; + dj_report->report_id =REPORT_ID_DJ_SHORT ; + dj_report->device_index =0xFF ; + dj_report->report_type =REPORT_TYPE_CMD_GET_PAIRED_DEVICES ; + retval =logi_dj_recv_send_report (djrcv_dev, dj_report); +kfree (dj_report); +return retval; }static int logi_dj_recv_switch_to_dj_mode (struct dj_receiver_dev *djrcv_dev,unsigned timeout) { -struct dj_report dj_report; +struct dj_report *dj_report; +int retval; -memset (&dj_report,0 ,sizeof (dj_report)); - dj_report.report_id =REPORT_ID_DJ_SHORT ; - dj_report.device_index =0xFF ; - dj_report.report_type =REPORT_TYPE_CMD_SWITCH ; - dj_report.report_params[CMD_SWITCH_PARAM_DEVBITFIELD ] =0x3F ; - dj_report.report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS ] = (u8 )timeout; -return logi_dj_recv_send_report (djrcv_dev, &dj_report); + dj_report =kzalloc (sizeof (dj_report),GFP_KERNEL ); +if (!dj_report) +return -ENOMEM ; + dj_report->report_id =REPORT_ID_DJ_SHORT ; + dj_report->device_index =0xFF ; + dj_report->report_type =REPORT_TYPE_CMD_SWITCH ; + dj_report->report_params[CMD_SWITCH_PARAM_DEVBITFIELD ] =0x3F ; + dj_report->report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS ] = (u8 )timeout; + retval =logi_dj_recv_send_report (djrcv_dev, dj_report); +kfree (dj_report); +return retval; }
PATCH 40/108 dj: memory scribble in logi_dj
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Cox <[email protected]>
commit 8a55ade76551e3927b4e41ee9e7751875d18bc25 upstream.
Allocate a structure not a pointer to it !
--- drivers/hid/hid-logitech-dj.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hid/hid-logitech-dj.c +2 -2
@@ -439,7 +439,7 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)struct dj_report *dj_report;int retval; - dj_report =kzalloc (sizeof (dj_report),GFP_KERNEL ); + dj_report =kzalloc (sizeof (struct dj_report ),GFP_KERNEL );if (!dj_report)return -ENOMEM ; dj_report->report_id =REPORT_ID_DJ_SHORT ;
@@ -456,7 +456,7 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,struct dj_report *dj_report;int retval; - dj_report =kzalloc (sizeof (dj_report),GFP_KERNEL ); + dj_report =kzalloc (sizeof (struct dj_report ),GFP_KERNEL );if (!dj_report)return -ENOMEM ; dj_report->report_id =REPORT_ID_DJ_SHORT ;
PATCH 41/108 HID: Fix logitech-dj: missing Unifying device issue
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nestor Lopez Casado <[email protected]>
commit 596264082f10dd4a567c43d4526b2f54ac5520bc upstream.
This patch fixes an issue introduced after commit 4ea5454203d991ec ("HID: Fix race condition between driver core and ll-driver").
After that commit, hid-core discards any incoming packet that arrives while hid driver's probe function is being executed.
This broke the enumeration process of hid-logitech-dj, that must receive control packets in-band with the mouse and keyboard packets. Discarding mouse or keyboard data at the very begining is usually fine, but it is not the case for control packets.
This patch forces a re-enumeration of the paired devices when a packet arrives that comes from an unknown device.
Based on a patch originally written by Benjamin Tissoires.
--- drivers/hid/hid-logitech-dj.c | 45 +++++++++++++++++++++++++++++++++++++++++ drivers/hid/hid-logitech-dj.h | 1 + 2 files changed, 46 insertions(+)
drivers/hid/hid-logitech-dj.c +45 -0
@@ -193,6 +193,7 @@ static struct hid_ll_driver logi_dj_ll_driver;static int logi_dj_output_hidraw_report (struct hid_device *hid,u8 * buf,size_t count,unsigned char report_type); +static int logi_dj_recv_query_paired_devices (struct dj_receiver_dev *djrcv_dev);static void logi_dj_recv_destroy_djhid_device (struct dj_receiver_dev *djrcv_dev,struct dj_report *dj_report)
@@ -233,6 +234,7 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION ] &SPFUNCTION_DEVICE_LIST_EMPTY ) {dbg_hid ("%s: device list is empty\n" , __func__); + djrcv_dev->querying_devices = false;return ; }
@@ -243,6 +245,12 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,return ; } +if (djrcv_dev->paired_dj_devices[dj_report->device_index]) { +/* The device is already known. No need to reallocate it. */ +dbg_hid ("%s: device is already known\n" , __func__); +return ; + } + dj_hiddev =hid_allocate_device ();if (IS_ERR (dj_hiddev)) { dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
@@ -306,6 +314,7 @@ static void delayedwork_callback(struct work_struct *work)struct dj_report dj_report;unsigned long flags;int count; +int retval;dbg_hid ("%s\n" , __func__);
@@ -338,6 +347,25 @@ static void delayedwork_callback(struct work_struct *work)logi_dj_recv_destroy_djhid_device (djrcv_dev, &dj_report);break ;default : +/* A normal report (i. e. not belonging to a pair/unpair notification) +* arriving here, means that the report arrived but we did not have a +* paired dj_device associated to the report's device_index, this +* means that the original "device paired" notification corresponding +* to this dj_device never arrived to this driver. The reason is that +* hid-core discards all packets coming from a device while probe() is +* executing. */ +if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) { +/* ok, we don't know the device, just re-ask the +* receiver for the list of connected devices. */ + retval =logi_dj_recv_query_paired_devices (djrcv_dev); +if (!retval) { +/* everything went fine, so just leave */ +break ; + } +dev_err (&djrcv_dev->hdev->dev, +"%s:logi_dj_recv_query_paired_devices " +"error:%d\n" , __func__, retval); + }dbg_hid ("%s: unexpected report type\n" , __func__); } }
@@ -368,6 +396,12 @@ static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,if (!djdev) {dbg_hid ("djrcv_dev->paired_dj_devices[dj_report->device_index]" " is NULL, index %d\n" , dj_report->device_index); +kfifo_in (&djrcv_dev->notif_fifo, dj_report,sizeof (struct dj_report )); + +if (schedule_work (&djrcv_dev->work) ==0 ) { +dbg_hid ("%s: did not schedule the work item, was already " +"queued\n" , __func__); + }return ; }
@@ -398,6 +432,12 @@ static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,if (dj_device ==NULL ) {dbg_hid ("djrcv_dev->paired_dj_devices[dj_report->device_index]" " is NULL, index %d\n" , dj_report->device_index); +kfifo_in (&djrcv_dev->notif_fifo, dj_report,sizeof (struct dj_report )); + +if (schedule_work (&djrcv_dev->work) ==0 ) { +dbg_hid ("%s: did not schedule the work item, was already " +"queued\n" , __func__); + }return ; }
@@ -439,6 +479,10 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)struct dj_report *dj_report;int retval; +/* no need to protect djrcv_dev->querying_devices */ +if (djrcv_dev->querying_devices) +return 0 ; + dj_report =kzalloc (sizeof (struct dj_report ),GFP_KERNEL );if (!dj_report)return -ENOMEM ;
@@ -450,6 +494,7 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)return retval; } +static int logi_dj_recv_switch_to_dj_mode (struct dj_receiver_dev *djrcv_dev,unsigned timeout) {
drivers/hid/hid-logitech-dj.h +1 -0
@@ -101,6 +101,7 @@ struct dj_receiver_dev {struct work_struct work;struct kfifo notif_fifo;spinlock_t lock; +bool querying_devices; };struct dj_device {
PATCH 42/108 hwmon: (fam15h_power) Tweak runavg_range on resume
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Herrmann <[email protected]>
commit 5f0ecb907deb1e6f28071ee3bd568903b9da1be4 upstream.
The quirk introduced with commit 00250ec90963b7ef6678438888f3244985ecde14 (hwmon: fam15h_power: fix bogus values with current BIOSes) is not only required during driver load but also when system resumes from suspend. The BIOS might set the previously recommended (but unsuitable) initilization value for the running average range register during resume.
--- drivers/hwmon/fam15h_power.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/hwmon/fam15h_power.c +13 -2
@@ -128,12 +128,12 @@ static bool __devinit fam15h_power_is_in* counter saturations resulting in bogus power readings. * We correct this value ourselves to cope with older BIOSes. */ -static DEFINE_PCI_DEVICE_TABLE (affected_device) = { +static const struct pci_device_id affected_device[] = { {PCI_VDEVICE (AMD ,PCI_DEVICE_ID_AMD_15H_NB_F4 ) }, {0 } }; -static void __devinit tweak_runavg_range (struct pci_dev *pdev) +static void tweak_runavg_range (struct pci_dev *pdev) {u32 val;
@@ -157,6 +157,16 @@ static void __devinit tweak_runavg_range REG_TDP_RUNNING_AVERAGE, val); } +#ifdef CONFIG_PM +static int fam15h_power_resume (struct pci_dev *pdev) +{ +tweak_runavg_range (pdev); +return 0 ; +} +#else +#define fam15h_power_resume NULL +#endif +static void __devinit fam15h_power_init_data (struct pci_dev *f4,struct fam15h_power_data *data) {
@@ -255,6 +265,7 @@ static struct pci_driver fam15h_power_dr .id_table = fam15h_power_id_table, .probe = fam15h_power_probe, .remove = __devexit_p(fam15h_power_remove), + .resume = fam15h_power_resume, };static int __init fam15h_power_init (void )
PATCH 43/108 xen/boot: Disable NUMA for PV guests.
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <[email protected]>
commit 8d54db795dfb1049d45dc34f0dddbc5347ec5642 upstream.
The hypervisor is in charge of allocating the proper "NUMA" memory and dealing with the CPU scheduler to keep them bound to the proper NUMA node. The PV guests (and PVHVM) have no inkling of where they run and do not need to know that right now. In the future we will need to inject NUMA configuration data (if a guest spans two or more NUMA nodes) so that the kernel can make the right choices. But those patches are not yet present.
In the meantime, disable the NUMA capability in the PV guest, which also fixes a bootup issue. Andre says:
"we see Dom0 crashes due to the kernel detecting the NUMA topology not by ACPI, but directly from the northbridge (CONFIG_AMD_NUMA).
This will detect the actual NUMA config of the physical machine, but will crash about the mismatch with Dom0's virtual memory. Variation of the theme: Dom0 sees what it's not supposed to see.
This happens with the said config option enabled and on a machine where this scanning is still enabled (K8 and Fam10h, not Bulldozer class)
We have this dump then:
NUMA: Warning: node ids are out of bound, from=-1 to=-1 distance=10 Scanning NUMA topology in Northbridge 24
Number of physical nodes 4
Node 0 MemBase 0000000000000000 Limit 0000000040000000 Node 1 MemBase 0000000040000000 Limit 0000000138000000 Node 2 MemBase 0000000138000000 Limit 00000001f8000000 Node 3 MemBase 00000001f8000000 Limit 0000000238000000 Initmem setup node 0 0000000000000000-0000000040000000
NODE_DATA [000000003ffd9000 - 000000003fffffff]
Initmem setup node 1 0000000040000000-0000000138000000
NODE_DATA [0000000137fd9000 - 0000000137ffffff]
Initmem setup node 2 0000000138000000-00000001f8000000
NODE_DATA [00000001f095e000 - 00000001f0984fff]
Initmem setup node 3 00000001f8000000-0000000238000000 Cannot find 159744 bytes in node 3
BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff81d220e6>] __alloc_bootmem_node+0x43/0x96 Pid: 0, comm: swapper Not tainted 3.3.6 #1 AMD Dinar/Dinar RIP: e030:[<ffffffff81d220e6>] [<ffffffff81d220e6>] __alloc_bootmem_node+0x43/0x96 .. snip.. [<ffffffff81d23024>] sparse_early_usemaps_alloc_node+0x64/0x178 [<ffffffff81d23348>] sparse_init+0xe4/0x25a [<ffffffff81d16840>] paging_init+0x13/0x22 [<ffffffff81d07fbb>] setup_arch+0x9c6/0xa9b [<ffffffff81683954>] ? printk+0x3c/0x3e [<ffffffff81d01a38>] start_kernel+0xe5/0x468 [<ffffffff81d012cf>] x86_64_start_reservations+0xba/0xc1 [<ffffffff81007153>] ? xen_setup_runstate_info+0x2c/0x36 [<ffffffff81d050ee>] xen_start_kernel+0x565/0x56c
"
so we just disable NUMA scanning by setting numa_off=1.
--- arch/x86/xen/setup.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/xen/setup.c +4 -0
@@ -16,6 +16,7 @@#include <asm/e820.h> #include <asm/setup.h> #include <asm/acpi.h> +#include <asm/numa.h> #include <asm/xen/hypervisor.h> #include <asm/xen/hypercall.h>
@@ -431,4 +432,7 @@ void __init xen_arch_setup(void) boot_option_idle_override =IDLE_HALT ;WARN_ON (set_pm_idle_to_default ());fiddle_vdso (); +#ifdef CONFIG_NUMA + numa_off =1 ; +#endif }
PATCH 44/108 gpio-lpc32xx: Fix value handling of gpio_direction_output()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Stigge <[email protected]>
commit b1268d3737c6316016026245eef276eda6b0a621 upstream.
For GPIOs of gpio-lpc32xx, gpio_direction_output() ignores the value argument (initial value of output). This patch fixes this by setting the level accordingly.
--- drivers/gpio/gpio-lpc32xx.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpio/gpio-lpc32xx.c +5 -0
@@ -308,6 +308,7 @@ static int lpc32xx_gpio_dir_output_p012(struct gpio_chip *chip, unsigned pin, {struct lpc32xx_gpio_chip *group =to_lpc32xx_gpio (chip); +__set_gpio_level_p012 (group, pin, value);__set_gpio_dir_p012 (group, pin,0 );return 0 ;
@@ -318,6 +319,7 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin, {struct lpc32xx_gpio_chip *group =to_lpc32xx_gpio (chip); +__set_gpio_level_p3 (group, pin, value);__set_gpio_dir_p3 (group, pin,0 );return 0 ;
@@ -326,6 +328,9 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin,static int lpc32xx_gpio_dir_out_always (struct gpio_chip *chip,unsigned pin,int value) { +struct lpc32xx_gpio_chip *group =to_lpc32xx_gpio (chip); + +__set_gpo_level_p3 (group, pin, value);return 0 ; }
PATCH 45/108 sb_edac: Avoid overflow errors at memory size calculation
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit deb09ddaff1435f72dd598d38f9b58354c68a5ec upstream.
Sandy bridge EDAC is calculating the memory size with overflow. Basically, the size field and the integer calculation is using 32 bits. More bits are needed, when the DIMM memories have high density.
The net result is that memories are improperly reported there, when high-density DIMMs are used:
EDAC DEBUG: in drivers/edac/sb_edac.c, line at 591: mc#0: channel 0, dimm 0, -16384 Mb (-4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800 EDAC DEBUG: in drivers/edac/sb_edac.c, line at 591: mc#0: channel 1, dimm 0, -16384 Mb (-4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800
As the number of pages value is handled at the EDAC core as unsigned ints, the driver shows the 16 GB memories at sysfs interface as 16760832 MB! The fix is simple: calculate the number of pages as unsigned 64-bits integer.
After the patch, the memory size (16 GB) is properly detected:
EDAC DEBUG: in drivers/edac/sb_edac.c, line at 592: mc#0: channel 0, dimm 0, 16384 Mb (4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800 EDAC DEBUG: in drivers/edac/sb_edac.c, line at 592: mc#0: channel 1, dimm 0, 16384 Mb (4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800
[bwh: Backported to 3.2:
- Adjust context
- Debug log function is debugf0(), not edac_dbg()]
--- drivers/edac/sb_edac.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/edac/sb_edac.c +4 -3
@@ -554,7 +554,8 @@ static int get_dimm_config(const struct {struct sbridge_pvt *pvt = mci->pvt_info;struct csrow_info *csr; -int i, j, banks, ranks, rows, cols, size, npages; +unsigned i, j, banks, ranks, rows, cols, npages; +u64 size;int csrow =0 ;unsigned long last_page =0 ;u32 reg;
@@ -626,10 +627,10 @@ static int get_dimm_config(const struct cols =numcol (mtr);/* DDR3 has 8 I/O banks */ - size = (rows * cols * banks * ranks) >> (20 -3 ); + size = ((u64 )rows * cols * banks * ranks) >> (20 -3 ); npages =MiB_TO_PAGES (size); -debugf0 ("mc#%d: channel %d, dimm %d, %d Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n" , +debugf0 ("mc#%d: channel %d, dimm %d, %Ld Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n" , pvt->sbridge_dev->mc, i, j, size, npages, banks, ranks, rows, cols);
PATCH 46/108 dm: handle requests beyond end of device instead of using BUG_ON
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit ba1cbad93dd47223b1f3b8edd50dd9ef2abcb2ed upstream.
The access beyond the end of device BUG_ON that was introduced to dm_request_fn via commit 29e4013de7ad950280e4b2208 ("dm: implement REQ_FLUSH/FUA support for request-based dm") was an overly drastic (but simple) response to this situation.
I have received a report that this BUG_ON was hit and now think it would be better to use dm_kill_unmapped_request() to fail the clone and original request with -EIO.
map_request() will assign the valid target returned by dm_table_find_target to tio->ti. But when the target isn't valid tio->ti is never assigned (because map_request isn't called); so add a check for tio->ti != NULL to dm_done().
--- drivers/md/dm.c | 56 +++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 38 insertions(+), 18 deletions(-)
drivers/md/dm.c +38 -18
@@ -865,10 +865,14 @@ static void dm_done(struct request *clone, int error, bool mapped) {int r = error;struct dm_rq_target_io *tio = clone->end_io_data; -dm_request_endio_fn rq_end_io = tio->ti->type->rq_end_io; +dm_request_endio_fn rq_end_io =NULL ; -if (mapped && rq_end_io) - r =rq_end_io (tio->ti, clone, error, &tio->info); +if (tio->ti) { + rq_end_io = tio->ti->type->rq_end_io; + +if (mapped && rq_end_io) + r =rq_end_io (tio->ti, clone, error, &tio->info); + }if (r <=0 )/* The target wants to complete the I/O */
@@ -1588,15 +1592,6 @@ static int map_request(struct dm_target *ti, struct request *clone,int r, requeued =0 ;struct dm_rq_target_io *tio = clone->end_io_data; -/* -* Hold the md reference here for the in-flight I/O. -* We can't rely on the reference count by device opener, -* because the device may be closed during the request completion -* when all bios are completed. -* See the comment in rq_completed() too. -*/ -dm_get (md); - tio->ti = ti; r = ti->type->map_rq (ti, clone, &tio->info);switch (r) {
@@ -1628,6 +1623,26 @@ static int map_request(struct dm_target *ti, struct request *clone,return requeued; } +static struct request *dm_start_request (struct mapped_device *md,struct request *orig) +{ +struct request *clone; + +blk_start_request (orig); + clone = orig->special; +atomic_inc (&md->pending[rq_data_dir (clone)]); + +/* +* Hold the md reference here for the in-flight I/O. +* We can't rely on the reference count by device opener, +* because the device may be closed during the request completion +* when all bios are completed. +* See the comment in rq_completed() too. +*/ +dm_get (md); + +return clone; +} +/* * q->request_fn for request-based dm. * Called with the queue lock held.
@@ -1657,14 +1672,21 @@ static void dm_request_fn(struct request_queue *q) pos =blk_rq_pos (rq); ti =dm_table_find_target (map, pos); -BUG_ON (!dm_target_is_valid (ti)); +if (!dm_target_is_valid (ti)) { +/* +* Must perform setup, that dm_done() requires, +* before calling dm_kill_unmapped_request +*/ +DMERR_LIMIT ("request attempted access beyond the end of device" ); + clone =dm_start_request (md, rq); +dm_kill_unmapped_request (clone, -EIO ); +continue ; + }if (ti->type->busy && ti->type->busy (ti)) goto delay_and_out; -blk_start_request (rq); - clone = rq->special; -atomic_inc (&md->pending[rq_data_dir (clone)]); + clone =dm_start_request (md, rq);spin_unlock (q->queue_lock);if (map_request (ti, clone, md))
@@ -1684,8 +1706,6 @@ delay_and_out:blk_delay_queue (q,HZ /10 ); out:dm_table_put (map); - -return ; }int dm_underlying_device_busy (struct request_queue *q)
PATCH 47/108 dm table: clear add_random unless all devices have it set
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milan Broz <[email protected]>
commit c3c4555edd10dbc0b388a0125b9c50de5e79af05 upstream.
Always clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not have it set. Otherwise devices with predictable characteristics may contribute entropy.
QUEUE_FLAG_ADD_RANDOM specifies whether or not queue IO timings contribute to the random pool.
For bio-based targets this flag is always 0 because such devices have no real queue.
For request-based devices this flag was always set to 1 by default.
Now set it according to the flags on underlying devices. If there is at least one device which should not contribute, set the flag to zero: If a device, such as fast SSD storage, is not suitable for supplying entropy, a request-based queue stacked over it will not be either.
Because the checking logic is exactly same as for the rotational flag, share the iteration function with device_is_nonrot().
--- drivers/md/dm-table.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
drivers/md/dm-table.c +22 -4
@@ -1354,17 +1354,25 @@ static int device_is_nonrot(struct dm_target *ti, struct dm_dev *dev,return q &&blk_queue_nonrot (q); } -static bool dm_table_is_nonrot (struct dm_table *t) +static int device_is_not_random (struct dm_target *ti,struct dm_dev *dev, +sector_t start,sector_t len,void *data) +{ +struct request_queue *q =bdev_get_queue (dev->bdev); + +return q && !blk_queue_add_random (q); +} + +static bool dm_table_all_devices_attribute (struct dm_table *t, +iterate_devices_callout_fn func) {struct dm_target *ti;unsigned i =0 ; -/* Ensure that all underlying device are non-rotational. */ while (i <dm_table_get_num_targets (t)) { ti =dm_table_get_target (t, i++);if (!ti->type->iterate_devices || - !ti->type->iterate_devices (ti, device_is_nonrot,NULL )) + !ti->type->iterate_devices (ti, func,NULL ))return 0 ; }
@@ -1396,7 +1404,8 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,if (!dm_table_discard_zeroes_data (t)) q->limits.discard_zeroes_data =0 ; -if (dm_table_is_nonrot (t)) +/* Ensure that all underlying devices are non-rotational. */ +if (dm_table_all_devices_attribute (t, device_is_nonrot))queue_flag_set_unlocked (QUEUE_FLAG_NONROT , q);else queue_flag_clear_unlocked (QUEUE_FLAG_NONROT , q);
@@ -1404,6 +1413,15 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,dm_table_set_integrity (t);/* +* Determine whether or not this queue's I/O timings contribute +* to the entropy pool, Only request-based targets use this. +* Clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not +* have it set. +*/ +if (blk_queue_add_random (q) &&dm_table_all_devices_attribute (t, device_is_not_random)) +queue_flag_clear_unlocked (QUEUE_FLAG_ADD_RANDOM , q); + +/* * QUEUE_FLAG_STACKABLE must be set after all queue settings are * visible to other CPUs because, once the flag is set, incoming bios * are processed by request-based dm, which refers to the queue
PATCH 48/108 md/raid10: fix "enough" function for detecting if array is failed.
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 80b4812407c6b1f66a4f2430e69747a13f010839 upstream.
The 'enough' function is written to work with 'near' arrays only in that is implicitly assumes that the offset from one 'group' of devices to the next is the same as the number of copies. In reality it is the number of 'near' copies.
So change it to make this number explicit.
This bug makes it possible to run arrays without enough drives present, which is dangerous.
It is appropriate for an -stable kernel, but will almost certainly need to be modified for some of them.
--- drivers/md/raid10.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/md/raid10.c +5 -3
@@ -1226,14 +1226,16 @@ static int enough(struct r10conf *conf,do {int n = conf->copies;int cnt =0 ; +int this = first;while (n--) { -if (conf->mirrors[first].rdev && - first != ignore) +if (conf->mirrors[this].rdev && + this != ignore) cnt++; - first = (first+1 ) % conf->raid_disks; + this = (this+1 ) % conf->raid_disks; }if (cnt ==0 )return 0 ; + first = (first + conf->near_copies) % conf->raid_disks; }while (first !=0 );return 1 ; }
PATCH 49/108 USB: Fix race condition when removing host controllers
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 0d00dc2611abbe6ad244d50569c2ee82ce42846c upstream.
This patch (as1607) fixes a race that can occur if a USB host controller is removed while a process is reading the /sys/kernel/debug/usb/devices file.
The usb_device_read() routine uses the bus->root_hub pointer to determine whether or not the root hub is registered. The is not a valid test, because the pointer is set before the root hub gets registered and remains set even after the root hub is unregistered and deallocated. As a result, usb_device_read() or usb_device_dump() can access freed memory, causing an oops.
The patch changes the test to use the hcd->rh_registered flag, which does get set and cleared at the appropriate times. It also makes sure to hold the usb_bus_list_lock mutex while setting the flag, so that usb_device_read() will become aware of new root hubs as soon as they are registered.
--- drivers/usb/core/devices.c | 2 +- drivers/usb/core/hcd.c | 6 ++---- 2 files changed, 3 insertions(+), 5 deletions(-)
drivers/usb/core/devices.c +1 -1
@@ -624,7 +624,7 @@ static ssize_t usb_device_read(struct file *file, char __user *buf,/* print devices for all busses */ list_for_each_entry (bus, &usb_bus_list, bus_list) {/* recurse through all children of the root hub */ -if (!bus->root_hub) +if (!bus_to_hcd (bus)->rh_registered)continue ;usb_lock_device (bus->root_hub); ret = usb_device_dump(&buf, &nbytes, &skip_bytes, ppos,
drivers/usb/core/hcd.c +2 -4
@@ -1011,10 +1011,7 @@ static int register_root_hub(struct usb_hcd *hcd)if (retval) {dev_err (parent_dev,"can't register root hub for %s, %d\n" ,dev_name (&usb_dev->dev), retval); - } -mutex_unlock (&usb_bus_list_lock); - -if (retval ==0 ) { + }else {spin_lock_irq (&hcd_root_hub_lock); hcd->rh_registered =1 ;spin_unlock_irq (&hcd_root_hub_lock);
@@ -1023,6 +1020,7 @@ static int register_root_hub(struct usb_hcd *hcd)if (HCD_DEAD (hcd))usb_hc_died (hcd);/* This time clean up */ } +mutex_unlock (&usb_bus_list_lock);return retval; }
PATCH 50/108 asus-laptop: HRWS/HWRS typo
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corentin Chary <[email protected]>
commit 8871e99f89b7d7b1ea99de550eea2a56273f42ab upstream.
Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=24222
--- drivers/platform/x86/asus-laptop.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/platform/x86/asus-laptop.c +4 -4
@@ -863,9 +863,9 @@ static ssize_t show_infos(struct device *dev,* The significance of others is yet to be found. * If we don't find the method, we assume the device are present. */ - rv =acpi_evaluate_integer (asus->handle,"HRWS" ,NULL , &temp); + rv =acpi_evaluate_integer (asus->handle,"HWRS" ,NULL , &temp);if (!ACPI_FAILURE (rv)) - len +=sprintf (page + len,"HRWS value : %#x\n" , + len +=sprintf (page + len,"HWRS value : %#x\n" , (uint ) temp);/* * Another value for userspace: the ASYM method returns 0x02 for
@@ -1751,9 +1751,9 @@ static int asus_laptop_get_info(struct asus_laptop *asus)* The significance of others is yet to be found. */ status = -acpi_evaluate_integer (asus->handle,"HRWS" ,NULL , &hwrs_result); +acpi_evaluate_integer (asus->handle,"HWRS" ,NULL , &hwrs_result);if (!ACPI_FAILURE (status)) -pr_notice (" HRWS returned %x" , (int )hwrs_result); +pr_notice (" HWRS returned %x" , (int )hwrs_result);if (!acpi_check_handle (asus->handle,METHOD_WL_STATUS ,NULL )) asus->have_rsts = true;
PATCH 51/108 Bluetooth: btusb: Add vendor specific ID (0a5c:21f4) BCM20702A0
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manoj Iyer <[email protected]>
commit 61c964ba1748e984cb232b431582815899bf10fe upstream.
Patch adds support for BCM20702A0 device id (0a5c:21f4).
usb-devices after patch was applied:
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0a5c ProdID=21f4 Rev=01.12
S: Manufacturer=Broadcom Corp
S: Product=BCM20702A0
S: SerialNumber=E4D53DF154D6
C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
usb-devices before patch was applied:
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0a5c ProdID=21f4 Rev=01.12
S: Manufacturer=Broadcom Corp
S: Product=BCM20702A0
S: SerialNumber=E4D53DF154D6
C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
--- drivers/bluetooth/btusb.c | 1 + 1 file changed, 1 insertion(+)
drivers/bluetooth/btusb.c +1 -0
@@ -98,6 +98,7 @@ static struct usb_device_id btusb_table[] = { { USB_DEVICE(0x0a5c, 0x21e6) }, { USB_DEVICE(0x0a5c, 0x21e8) }, { USB_DEVICE(0x0a5c, 0x21f3) }, + { USB_DEVICE(0x0a5c, 0x21f4) }, { USB_DEVICE(0x413c, 0x8197) },/* Foxconn - Hon Hai */
PATCH 52/108 Bluetooth: Use USB_VENDOR_AND_INTERFACE() for Broadcom devices
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo Padovan <[email protected]>
commit 92c385f46b30f4954e9dd2d2005c12d233b479ea upstream.
Many Broadcom devices has a vendor specific devices class, with this rule we match all existent and future controllers with this behavior.
We also remove old rules to that matches product id for Broadcom devices.
--- drivers/bluetooth/btusb.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/bluetooth/btusb.c +3 -5
@@ -94,16 +94,14 @@ static struct usb_device_id btusb_table[] = {/* Broadcom BCM20702A0 */ { USB_DEVICE(0x0489, 0xe042) }, - { USB_DEVICE(0x0a5c, 0x21e3) }, - { USB_DEVICE(0x0a5c, 0x21e6) }, - { USB_DEVICE(0x0a5c, 0x21e8) }, - { USB_DEVICE(0x0a5c, 0x21f3) }, - { USB_DEVICE(0x0a5c, 0x21f4) }, { USB_DEVICE(0x413c, 0x8197) },/* Foxconn - Hon Hai */ { USB_DEVICE(0x0489, 0xe033) }, +/*Broadcom devices with vendor specific id */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }, + { } /* Terminating entry */ };
PATCH 53/108 Bluetooth: Add support for Apple vendor-specific devices
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrik Rydberg <[email protected]>
commit 1fa6535faf055cd71311ab887e94fc234f04ee18 upstream.
As pointed out by Gustavo and Marcel, all Apple-specific Broadcom devices seen so far have the same interface class, subclass and protocol numbers. This patch adds an entry which matches all of them, using the new USB_VENDOR_AND_INTERFACE_INFO() macro.
In particular, this patch adds support for the MacBook Pro Retina (05ac:8286), which is not in the present list.
--- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/btusb.c +3 -0
@@ -52,6 +52,9 @@ static struct usb_device_id btusb_table[] = {/* Generic Bluetooth USB device */ { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, +/* Apple-specific (Broadcom) devices */ + { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) }, +/* Broadcom SoftSailing reporting vendor specific */ { USB_DEVICE(0x0a5c, 0x21e1) },
PATCH 54/108 net: Statically initialize init_net.dev_base_head
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rustad, Mark D" <[email protected]>
commit 734b65417b24d6eea3e3d7457e1f11493890ee1d upstream.
This change eliminates an initialization-order hazard most recently seen when netprio_cgroup is built into the kernel.
With thanks to Eric Dumazet for catching a bug.
--- net/core/dev.c | 3 ++- net/core/net_namespace.c | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-)
net/core/dev.c +2 -1
@@ -6283,7 +6283,8 @@ static struct hlist_head *netdev_create_hash(void)/* Initialize per network namespace state */ static int __net_init netdev_init (struct net *net) { -INIT_LIST_HEAD (&net->dev_base_head); +if (net != &init_net) +INIT_LIST_HEAD (&net->dev_base_head); net->dev_name_head =netdev_create_hash ();if (net->dev_name_head ==NULL )
net/core/net_namespace.c +3 -1
@@ -27,7 +27,9 @@ static DEFINE_MUTEX(net_mutex);LIST_HEAD (net_namespace_list);EXPORT_SYMBOL_GPL (net_namespace_list); -struct net init_net; +struct net init_net = { + .dev_base_head =LIST_HEAD_INIT (init_net.dev_base_head), +};EXPORT_SYMBOL (init_net);#define INITIAL_NET_GEN_PTRS 13/* +1 for len +2 for rcu_head */
PATCH 55/108 Fix a dead loop in async_synchronize_full()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhong <[email protected]>
[Fixed upstream by commits 2955b47d2c1983998a8c5915cb96884e67f7cb53 and a4683487f90bfe3049686fc5c566bdc1ad03ace6 from Dan Williams, but they are much more intrusive than this tiny fix, according to Andrew - gregkh]
This patch tries to fix a dead loop in async_synchronize_full(), which could be seen when preemption is disabled on a single cpu machine.
void async_synchronize_full(void)
{
do {
async_synchronize_cookie(next_cookie);
} while (!list_empty(&async_running) || !list_empty(&async_pending));
}
async_synchronize_cookie() calls async_synchronize_cookie_domain() with &async_running as the default domain to synchronize.
However, there might be some works in the async_pending list from other domains. On a single cpu system, without preemption, there is no chance for the other works to finish, so async_synchronize_full() enters a dead loop.
It seems async_synchronize_full() wants to synchronize all entries in all running lists(domains), so maybe we could just check the entry_count to know whether all works are finished.
Currently, async_synchronize_cookie_domain() expects a non-NULL running list ( if NULL, there would be NULL pointer dereference ), so maybe a NULL pointer could be used as an indication for the functions to synchronize all works in all domains.
--- kernel/async.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
kernel/async.c +9 -4
@@ -87,6 +87,13 @@ static async_cookie_t __lowest_in_progr {struct async_entry *entry; +if (!running) {/* just check the entry count */ +if (atomic_read (&entry_count)) +return 0 ;/* smaller than any cookie */ +else +return next_cookie; + } +if (!list_empty (running)) { entry =list_first_entry (running, struct async_entry, list);
@@ -236,9 +243,7 @@ EXPORT_SYMBOL_GPL(async_schedule_domain)*/ void async_synchronize_full (void ) { -do { -async_synchronize_cookie (next_cookie); - }while (!list_empty (&async_running) || !list_empty (&async_pending)); +async_synchronize_cookie_domain (next_cookie,NULL ); }EXPORT_SYMBOL_GPL (async_synchronize_full);
@@ -258,7 +263,7 @@ EXPORT_SYMBOL_GPL(async_synchronize_full/** * async_synchronize_cookie_domain - synchronize asynchronous function calls within a certain domain with cookie checkpointing * @cookie: async_cookie_t to use as checkpoint -* @running: running list to synchronize on +* @running: running list to synchronize on, NULL indicates all lists * * This function waits until all asynchronous function calls for the * synchronization domain specified by the running list @list submitted
PATCH 56/108 rds: set correct msg_namelen
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiping Pan <[email protected]>
commit 06b6a1cf6e776426766298d055bb3991957d90a7 upstream.
Jay Fenlason ([email protected]) found a bug,
that recvfrom() on an RDS socket can return the contents of random kernel memory to userspace if it was called with a address length larger than sizeof(struct sockaddr_in).rds_recvmsg() also fails to set the addr_len paramater properly before returning, but that's just a bug.
There are also a number of cases wher recvfrom() can return an entirely bogus address. Anything in rds_recvmsg() that returns a non-negative value but does not go through the "sin = (struct sockaddr_in *)msg->msg_name;" code path at the end of the while(1) loop will return up to 128 bytes of kernel memory to userspace.
And I write two test programs to reproduce this bug, you will see that in rds_server, fromAddr will be overwritten and the following sock_fd will be destroyed.
Yes, it is the programmer's fault to set msg_namelen incorrectly, but it is better to make the kernel copy the real length of address to user space in such case.
How to run the test programs ?
I test them on 32bit x86 system, 3.5.0-rc7.
1 compile
gcc -o rds_client rds_client.c
gcc -o rds_server rds_server.c
2 run ./rds_server on one console
3 run ./rds_client on another console
4 you will see something like:
server is waiting to receive data...
old socket fd=3
server received data from client:data from client
msg.msg_namelen=32
new socket fd=-1067277685sendmsg()
: Bad file descriptor
/***************** rds_client.c ********************/
int main(void)
{
int sock_fd;
struct sockaddr_in serverAddr;
struct sockaddr_in toAddr;
char recvBuffer[128] = "data from client";
struct msghdr msg;
struct iovec iov;
sock_fd = socket(AF_RDS, SOCK_SEQPACKET, 0);
if (sock_fd < 0) {
perror("create socket error\n");
exit(1);
}
memset(&serverAddr, 0, sizeof(serverAddr));
serverAddr.sin_family = AF_INET;
serverAddr.sin_addr.s_addr = inet_addr("127.0.0.1");
serverAddr.sin_port = htons(4001);
if (bind(sock_fd, (struct sockaddr*)&serverAddr, sizeof(serverAddr)) < 0) {
perror("bind() error\n");
close(sock_fd);
exit(1);
}
memset(&toAddr, 0, sizeof(toAddr));
toAddr.sin_family = AF_INET;
toAddr.sin_addr.s_addr = inet_addr("127.0.0.1");
toAddr.sin_port = htons(4000);
msg.msg_name = &toAddr;
msg.msg_namelen = sizeof(toAddr);
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
msg.msg_iov->iov_base = recvBuffer;
msg.msg_iov->iov_len = strlen(recvBuffer) + 1;
msg.msg_control = 0;
msg.msg_controllen = 0;
msg.msg_flags = 0;
if (sendmsg(sock_fd, &msg, 0) == -1) {
perror("sendto() error\n");
close(sock_fd);
exit(1);
}
printf("client send data:%s\n", recvBuffer);
memset(recvBuffer, '\0', 128);
msg.msg_name = &toAddr;
msg.msg_namelen = sizeof(toAddr);
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
msg.msg_iov->iov_base = recvBuffer;
msg.msg_iov->iov_len = 128;
msg.msg_control = 0;
msg.msg_controllen = 0;
msg.msg_flags = 0;
if (recvmsg(sock_fd, &msg, 0) == -1) {
perror("recvmsg() error\n");
close(sock_fd);
exit(1);
}
printf("receive data from server:%s\n", recvBuffer);
close(sock_fd);
return 0;
}/***************** rds_server.c ********************/
int main(void)
{
struct sockaddr_in fromAddr;
int sock_fd;
struct sockaddr_in serverAddr;
unsigned int addrLen;
char recvBuffer[128];
struct msghdr msg;
struct iovec iov;
sock_fd = socket(AF_RDS, SOCK_SEQPACKET, 0);
if(sock_fd < 0) {
perror("create socket error\n");
exit(0);
}
memset(&serverAddr, 0, sizeof(serverAddr));
serverAddr.sin_family = AF_INET;
serverAddr.sin_addr.s_addr = inet_addr("127.0.0.1");
serverAddr.sin_port = htons(4000);
if (bind(sock_fd, (struct sockaddr*)&serverAddr, sizeof(serverAddr)) < 0) {
perror("bind error\n");
close(sock_fd);
exit(1);
}
printf("server is waiting to receive data...\n");
msg.msg_name = &fromAddr;
/*
* I add 16 to sizeof(fromAddr), ie 32,
* and pay attention to the definition of fromAddr,
* recvmsg() will overwrite sock_fd,
* since kernel will copy 32 bytes to userspace.
*
* If you just use sizeof(fromAddr), it works fine.
* */
msg.msg_namelen = sizeof(fromAddr) + 16;
/* msg.msg_namelen = sizeof(fromAddr); */
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
msg.msg_iov->iov_base = recvBuffer;
msg.msg_iov->iov_len = 128;
msg.msg_control = 0;
msg.msg_controllen = 0;
msg.msg_flags = 0;
while (1) {
printf("old socket fd=%d\n", sock_fd);
if (recvmsg(sock_fd, &msg, 0) == -1) {
perror("recvmsg() error\n");
close(sock_fd);
exit(1);
}
printf("server received data from client:%s\n", recvBuffer);
printf("msg.msg_namelen=%d\n", msg.msg_namelen);
printf("new socket fd=%d\n", sock_fd);
strcat(recvBuffer, "--data from server");
if (sendmsg(sock_fd, &msg, 0) == -1) {
perror("sendmsg()\n");
close(sock_fd);
exit(1);
}
}
close(sock_fd);
return 0;
}--- net/rds/recv.c | 3 +++ 1 file changed, 3 insertions(+)
net/rds/recv.c +3 -0
@@ -410,6 +410,8 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,rdsdebug ("size %zu flags 0x%x timeo %ld\n" , size, msg_flags, timeo); + msg->msg_namelen =0 ; +if (msg_flags &MSG_OOB ) goto out;
@@ -485,6 +487,7 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, sin->sin_port = inc->i_hdr.h_sport; sin->sin_addr.s_addr = inc->i_saddr;memset (sin->sin_zero,0 ,sizeof (sin->sin_zero)); + msg->msg_namelen =sizeof (*sin); }break ; }
PATCH 57/108 Prevent interface errors with Seagate FreeAgent GoFlex
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel J Blueman <[email protected]>
commit c531077f40abc9f2129c4c83a30b3f8d6ce1c0e7 upstream.
When using my Seagate FreeAgent GoFlex eSATAp external disk enclosure, interface errors are always seen until 1.5Gbps is negotiated [1]. This occurs using any disk in the enclosure, and when the disk is connected directly with a generic passive eSATAp cable, we see stable 3Gbps operation as expected.
Blacklist 3Gbps mode to avoid dataloss and the ~30s delay bus reset and renegotiation incurs.
--- drivers/ata/libata-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/libata-core.c +1 -0
@@ -4129,6 +4129,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {/* Devices which aren't very happy with higher link speeds */ { "WD My Book", NULL, ATA_HORKAGE_1_5_GBPS, }, + { "Seagate FreeAgent GoFlex", NULL, ATA_HORKAGE_1_5_GBPS, },/* * Devices which choke on SETXFER. Applies only if both the
PATCH 58/108 mmc: Prevent 1.8V switch for SD hosts that dont support UHS modes.
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Cooper <[email protected]>
commit 4188bba0e9e7ba58d231b528df495666f2742b74 upstream.
The driver should not try to switch to 1.8V when the SD 3.0 host controller does not have any UHS capabilities bits set (SDR50, DDR50 or SDR104). See page 72 of "SD Specifications Part A2 SD Host Controller Simplified Specification Version 3.00" under "1.8V Signaling Enable". Instead of setting SDR12 and SDR25 in the host capabilities data structure for all V3.0 host controllers, only set them if SDR104, SDR50 or DDR50 is set in the host capabilities register. This will prevent the switch to 1.8V later.
--- drivers/mmc/host/sdhci.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci.c +3 -2
@@ -2782,8 +2782,9 @@ int sdhci_add_host(struct sdhci_host *host) mmc_card_is_removable(mmc)) mmc->caps |=MMC_CAP_NEEDS_POLL ; -/* UHS-I mode(s) supported by the host controller. */ -if (host->version >=SDHCI_SPEC_300 ) +/* Any UHS-I mode in caps implies SDR12 and SDR25 support. */ +if (caps[1 ] & (SDHCI_SUPPORT_SDR104 |SDHCI_SUPPORT_SDR50 | +SDHCI_SUPPORT_DDR50 )) mmc->caps |=MMC_CAP_UHS_SDR12 |MMC_CAP_UHS_SDR25 ;/* SDR104 supports also implies SDR50 support */
PATCH 59/108 Bluetooth: Change signature of smp_conn_security()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <[email protected]>
commit cc110922da7e902b62d18641a370fec01a9fa794 upstream.
To make it clear that it may be called from contexts that may not have any knowledge of L2CAP, we change the connection parameter, to receive a hci_conn.
This also makes it clear that it is checking the security of the link.
--- include/net/bluetooth/smp.h | 2 +- net/bluetooth/l2cap_core.c | 11 ++++++----- net/bluetooth/l2cap_sock.c | 2 +- net/bluetooth/smp.c | 4 ++-- 4 files changed, 10 insertions(+), 9 deletions(-)
include/net/bluetooth/smp.h +1 -1
@@ -131,7 +131,7 @@ struct smp_chan { };/* SMP Commands */ -int smp_conn_security (struct l2cap_conn *conn,__u8 sec_level); +int smp_conn_security (struct hci_conn *hcon,__u8 sec_level);int smp_sig_channel (struct l2cap_conn *conn,struct sk_buff *skb);int smp_distribute_keys (struct l2cap_conn *conn,__u8 force);
net/bluetooth/l2cap_core.c +6 -5
@@ -902,14 +902,15 @@ static void l2cap_chan_ready(struct sockstatic void l2cap_conn_ready (struct l2cap_conn *conn) {struct l2cap_chan *chan; +struct hci_conn *hcon = conn->hcon;BT_DBG ("conn %p" , conn); -if (!conn->hcon->out && conn->hcon->type ==LE_LINK ) +if (!hcon->out && hcon->type ==LE_LINK )l2cap_le_conn_ready (conn); -if (conn->hcon->out && conn->hcon->type ==LE_LINK ) -smp_conn_security (conn, conn->hcon->pending_sec_level); +if (hcon->out && hcon->type ==LE_LINK ) +smp_conn_security (hcon, hcon->pending_sec_level);read_lock (&conn->chan_lock);
@@ -918,8 +919,8 @@ static void l2cap_conn_ready(struct l2cabh_lock_sock (sk); -if (conn->hcon->type ==LE_LINK ) { -if (smp_conn_security (conn, chan->sec_level)) +if (hcon->type ==LE_LINK ) { +if (smp_conn_security (hcon, chan->sec_level))l2cap_chan_ready (sk); }else if (chan->chan_type !=L2CAP_CHAN_CONN_ORIENTED ) {
net/bluetooth/l2cap_sock.c +1 -1
@@ -616,7 +616,7 @@ static int l2cap_sock_setsockopt(structbreak ; } -if (smp_conn_security (conn, sec.level)) +if (smp_conn_security (conn->hcon, sec.level))break ; err =0 ;
net/bluetooth/smp.c +2 -2
@@ -554,9 +554,9 @@ static u8 smp_cmd_security_req(struct l2return 0 ; } -int smp_conn_security (struct l2cap_conn *conn,__u8 sec_level) +int smp_conn_security (struct hci_conn *hcon,__u8 sec_level) { -struct hci_conn *hcon = conn->hcon; +struct l2cap_conn *conn = hcon->l2cap_data;struct smp_chan *smp = conn->smp_chan;BT_DBG ("conn %p hcon %p level 0x%2.2x" , conn, hcon, sec_level);
PATCH 60/108 Bluetooth: Fix sending a HCI Authorization Request over LE links
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <[email protected]>
commit d8343f125710fb596f7a88cd756679f14f4e77b9 upstream.
In the case that the link is already in the connected state and a Pairing request arrives from the mgmt interface, hci_conn_security() would be called but it was not considering LE links.
--- net/bluetooth/hci_conn.c | 4 ++++ 1 file changed, 4 insertions(+)
net/bluetooth/hci_conn.c +4 -0
@@ -44,6 +44,7 @@#include <net/bluetooth/bluetooth.h> #include <net/bluetooth/hci_core.h> +#include <net/bluetooth/smp.h> static void hci_le_connect (struct hci_conn *conn) {
@@ -641,6 +642,9 @@ int hci_conn_security(struct hci_conn *c {BT_DBG ("conn %p" , conn); +if (conn->type ==LE_LINK ) +return smp_conn_security (conn, sec_level); +/* For sdp we don't need the link key. */ if (sec_level ==BT_SECURITY_SDP )return 1 ;
PATCH 61/108 pch_uart: Add eg20t_port lock field, avoid recursive spinlocks
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darren Hart <[email protected]>
commit 2588aba002d14e938c2f56d299ecf3e7ce1302a5 upstream.
pch_uart_interrupt() takes priv->port.lock which leads to two recursive spinlock calls if low_latency==1 or CONFIG_PREEMPT_RT_FULL=y (one otherwise):
pch_uart_interrupt
spin_lock_irqsave(priv->port.lock, flags)
case PCH_UART_IID_RDR_TO (data ready)
handle_rx_to
push_rx
tty_port_tty_get
spin_lock_irqsave(&port->lock, flags) <--- already hold this lock
...
tty_flip_buffer_push
...
flush_to_ldisc
spin_lock_irqsave(&tty->buf.lock)
spin_lock_irqsave(&tty->buf.lock)
disc->ops->receive_buf(tty, char_buf)
n_tty_receive_buf
tty->ops->flush_chars()
uart_flush_chars
uart_start
spin_lock_irqsave(&port->lock) <--- already hold this lockAvoid this by using a dedicated lock to protect the eg20t_port structure and IO access to its membase. This is more consistent with the 8250 driver. Ensure priv->lock is always take prior to priv->port.lock when taken at the same time.
V2: Remove inadvertent whitespace change.
V3: Account for oops_in_progress for the private lock in
pch_console_write().
Note: Like the 8250 driver, if a printk is introduced anywhere inside
the pch_console_write() critical section, the kernel will hang on a recursive spinlock on the private lock. The oops case is handled by using a trylock in the oops_in_progress case.
[bwh: Backported to 3.2:
- Adjust context
- Drop changes to pch_console_write()]
--- drivers/tty/serial/pch_uart.c | 38 ++++++++++++++++++++++++++------------ 1 file changed, 26 insertions(+), 12 deletions(-)
drivers/tty/serial/pch_uart.c +13 -6
@@ -236,6 +236,9 @@ struct eg20t_port {int tx_dma_use;void *rx_buf_virt;dma_addr_t rx_buf_dma; + +/* protect the eg20t_port private structure and io access to membase */ +spinlock_t lock; };/**
@@ -964,7 +967,7 @@ static irqreturn_t pch_uart_interrupt(inunsigned int iid;unsigned long flags; -spin_lock_irqsave (&priv->port.lock, flags); +spin_lock_irqsave (&priv->lock, flags); handled =0 ;while ((iid =pch_uart_hal_get_iid (priv)) >1 ) {switch (iid) {
@@ -1017,7 +1020,7 @@ static irqreturn_t pch_uart_interrupt(in priv->int_dis_flag =0 ; } -spin_unlock_irqrestore (&priv->port.lock, flags); +spin_unlock_irqrestore (&priv->lock, flags);return IRQ_RETVAL (handled); }
@@ -1131,9 +1134,9 @@ static void pch_uart_break_ctl(struct uaunsigned long flags; priv = container_of(port, struct eg20t_port, port); -spin_lock_irqsave (&port->lock, flags); +spin_lock_irqsave (&priv->lock, flags);pch_uart_hal_set_break (priv, ctl); -spin_unlock_irqrestore (&port->lock, flags); +spin_unlock_irqrestore (&priv->lock, flags); }/* Grab any interrupt resources and initialise any low level driver state. */
@@ -1284,7 +1287,8 @@ static void pch_uart_set_termios(struct baud =uart_get_baud_rate (port, termios, old,0 , port->uartclk /16 ); -spin_lock_irqsave (&port->lock, flags); +spin_lock_irqsave (&priv->lock, flags); +spin_lock (&port->lock);uart_update_timeout (port, termios->c_cflag, baud); rtn =pch_uart_hal_set_line (priv, baud, parity, bits, stb);
@@ -1297,7 +1301,8 @@ static void pch_uart_set_termios(structtty_termios_encode_baud_rate (termios, baud, baud); out: -spin_unlock_irqrestore (&port->lock, flags); +spin_unlock (&port->lock); +spin_unlock_irqrestore (&priv->lock, flags); }static const char *pch_uart_type (struct uart_port *port)
@@ -1449,6 +1454,8 @@ static struct eg20t_port *pch_uart_init_pci_enable_msi (pdev);pci_set_master (pdev); +spin_lock_init (&priv->lock); + iobase =pci_resource_start (pdev,0 ); mapbase =pci_resource_start (pdev,1 ); priv->mapbase = mapbase;
PATCH 62/108 irq_remap: disable IRQ remapping if any IOAPIC lacks an IOMMU
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Forshee <[email protected]>
commit 32ab31e01e2def6f48294d872d9bb42573aae00f upstream.
The ACPI tables in the Macbook Air 5,1 define a single IOAPIC with id 2, but the only remapping unit described in the DMAR table matches id 0. Interrupt remapping fails as a result, and the kernel panics with the message "timer doesn't work through Interrupt-remapped IO-APIC."
To fix this, check each IOAPIC for a corresponding IOMMU. If an IOMMU is not found, do not allow IRQ remapping to be enabled.
v2: Move check to parse_ioapics_under_ir(), raise log level to KERN_ERR,
and add FW_BUG to the log message
v3: Skip check if IOMMU doesn't support interrupt remapping and remove
existing check that the IOMMU count equals the IOAPIC count
--- drivers/iommu/intr_remapping.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/iommu/intr_remapping.c +13 -5
@@ -752,6 +752,7 @@ int __init parse_ioapics_under_ir(void) {struct dmar_drhd_unit *drhd;int ir_supported =0 ; +int ioapic_idx;for_each_drhd_unit (drhd) {struct intel_iommu *iommu = drhd->iommu;
@@ -764,13 +765,20 @@ int __init parse_ioapics_under_ir(void) } } -if (ir_supported && ir_ioapic_num != nr_ioapics) { -printk (KERN_WARNING -"Not all IO-APIC's listed under remapping hardware\n" ); -return -1 ; +if (!ir_supported) +return 0 ; + +for (ioapic_idx =0 ; ioapic_idx < nr_ioapics; ioapic_idx++) { +int ioapic_id =mpc_ioapic_id (ioapic_idx); +if (!map_ioapic_to_ir (ioapic_id)) { +pr_err (FW_BUG "ioapic %d has no mapping iommu, " +"interrupt remapping will be disabled\n" , + ioapic_id); +return -1 ; + } } -return ir_supported; +return 1 ; }int __init ir_dev_scope_init (void )
PATCH 63/108 vfs: dcache: fix deadlock in tree traversal
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 8110e16d42d587997bcaee0c864179e6d93603fe upstream.
IBM reported a deadlock in select_parent(). This was found to be caused by taking rename_lock when already locked when restarting the tree traversal.
There are two cases when the traversal needs to be restarted:
1) concurrent d_move(); this can only happen when not already locked, since taking rename_lock protects against concurrent d_move().
2) racing with final d_put() on child just at the moment of ascending to parent; rename_lock doesn't protect against this rare race, so it can happen when already locked.
Because of case 2, we need to be able to handle restarting the traversal when rename_lock is already held. This patch fixes all three callers of try_to_ascend().
IBM reported that the deadlock is gone with this patch.
[ I rewrote the patch to be smaller and just do the "goto again" if the
lock was already held, but credit goes to Miklos for the real work.
- Linus ]
--- fs/dcache.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/dcache.c +6 -0
@@ -1134,6 +1134,8 @@ positive:return 1 ; rename_retry: +if (locked) + goto again; locked =1 ;write_seqlock (&rename_lock); goto again;
@@ -1236,6 +1238,8 @@ out: rename_retry:if (found)return found; +if (locked) + goto again; locked =1 ;write_seqlock (&rename_lock); goto again;
@@ -3035,6 +3039,8 @@ resume:return ; rename_retry: +if (locked) + goto again; locked =1 ;write_seqlock (&rename_lock); goto again;
PATCH 64/108 usb: gadget: dummy_hcd: fixup error probe path
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
commit 1b68a4ca2d038addb7314211d122fb6d7002b38b upstream.
If USB2 host controller probes fine but USB3 does not then we don't remove the USB controller properly and lock up the system while the HUB code will try to enumerate the USB2 controller and access memory which is no longer available in case the dummy_hcd was compiled as a module.
This is a problem since 448b6eb1 ("USB: Make sure to fetch the BOS desc for roothubs.) if used in USB3 mode because dummy does not provide this descriptor and explodes later.
--- drivers/usb/gadget/dummy_hcd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/gadget/dummy_hcd.c +4 -4
@@ -2503,10 +2503,8 @@ static int dummy_hcd_probe(struct platform_device *pdev) hs_hcd->has_tt =1 ; retval =usb_add_hcd (hs_hcd,0 ,0 ); -if (retval !=0 ) { -usb_put_hcd (hs_hcd); -return retval; - } +if (retval) + goto put_usb2_hcd;if (mod_data.is_super_speed) { ss_hcd = usb_create_shared_hcd(&dummy_hcd, &pdev->dev,
@@ -2525,6 +2523,8 @@ static int dummy_hcd_probe(struct platform_device *pdev) put_usb3_hcd:usb_put_hcd (ss_hcd); dealloc_usb2_hcd: +usb_remove_hcd (hs_hcd); +put_usb2_hcd:usb_put_hcd (hs_hcd); the_controller.hs_hcd = the_controller.ss_hcd =NULL ;return retval;
PATCH 65/108 CPU hotplug, cpusets, suspend: Dont modify cpusets during suspend/resume
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Srivatsa S. Bhat" <[email protected]>
commit d35be8bab9b0ce44bed4b9453f86ebf64062721e upstream.
In the event of CPU hotplug, the kernel modifies the cpusets' cpus_allowed masks as and when necessary to ensure that the tasks belonging to the cpusets have some place (online CPUs) to run on. And regular CPU hotplug is destructive in the sense that the kernel doesn't remember the original cpuset configurations set by the user, across hotplug operations.
However, suspend/resume (which uses CPU hotplug) is a special case in which the kernel has the responsibility to restore the system (during resume), to exactly the same state it was in before suspend.
In order to achieve that, do the following:
1. Don't modify cpusets during suspend/resume. At all.
In particular, don't move the tasks from one cpuset to another, and don't modify any cpuset's cpus_allowed mask. So, simply ignore cpusets during the CPU hotplug operations that are carried out in the suspend/resume path.
2. However, cpusets and sched domains are related. We just want to avoid altering cpusets alone. So, to keep the sched domains updated, build a single sched domain (containing all active cpus) during each of the CPU hotplug operations carried out in s/r path, effectively ignoring the cpusets' cpus_allowed masks.
(Since userspace is frozen while doing all this, it will go unnoticed.)
3. During the last CPU online operation during resume, build the sched domains by looking up the (unaltered) cpusets' cpus_allowed masks. That will bring back the system to the same original state as it was in before suspend.
Ultimately, this will not only solve the cpuset problem related to suspend resume (ie., restores the cpusets to exactly what it was before suspend, by not touching it at all) but also speeds up suspend/resume because we avoid running cpuset update code for every CPU being offlined/onlined.
--- kernel/cpuset.c | 3 +++ kernel/sched.c | 40 ++++++++++++++++++++++++++++++++++++---- 2 files changed, 39 insertions(+), 4 deletions(-)
kernel/cpuset.c +3 -0
@@ -2080,6 +2080,9 @@ static void scan_for_empty_cpusets(struc* (of no affect) on systems that are actively using CPU hotplug * but making no active use of cpusets. * +* The only exception to this is suspend/resume, where we don't +* modify cpusets at all. +* * This routine ensures that top_cpuset.cpus_allowed tracks * cpu_active_mask on each CPU hotplug (cpuhp) event. *
kernel/sched.c +36 -4
@@ -8192,34 +8192,66 @@ int __init sched_create_sysfs_power_savi }#endif /* CONFIG_SCHED_MC || CONFIG_SCHED_SMT */ +static int num_cpus_frozen;/* used to mark begin/end of suspend/resume */ +/* * Update cpusets according to cpu_active mask. If cpusets are * disabled, cpuset_update_active_cpus() becomes a simple wrapper * around partition_sched_domains(). +* +* If we come here as part of a suspend/resume, don't touch cpusets because we +* want to restore it back to its original state upon resume anyway. */ static int cpuset_cpu_active (struct notifier_block *nfb,unsigned long action,void *hcpu) { -switch (action & ~CPU_TASKS_FROZEN ) { +switch (action) { +case CPU_ONLINE_FROZEN : +case CPU_DOWN_FAILED_FROZEN : + +/* +* num_cpus_frozen tracks how many CPUs are involved in suspend +* resume sequence. As long as this is not the last online +* operation in the resume sequence, just build a single sched +* domain, ignoring cpusets. +*/ + num_cpus_frozen--; +if (likely (num_cpus_frozen)) { +partition_sched_domains (1 ,NULL ,NULL ); +break ; + } + +/* +* This is the last CPU online operation. So fall through and +* restore the original sched domains by considering the +* cpuset configurations. +*/ +case CPU_ONLINE :case CPU_DOWN_FAILED :cpuset_update_active_cpus (); -return NOTIFY_OK ; +break ;default :return NOTIFY_DONE ; } +return NOTIFY_OK ; }static int cpuset_cpu_inactive (struct notifier_block *nfb,unsigned long action,void *hcpu) { -switch (action & ~CPU_TASKS_FROZEN ) { +switch (action) {case CPU_DOWN_PREPARE :cpuset_update_active_cpus (); -return NOTIFY_OK ; +break ; +case CPU_DOWN_PREPARE_FROZEN : + num_cpus_frozen++; +partition_sched_domains (1 ,NULL ,NULL ); +break ;default :return NOTIFY_DONE ; } +return NOTIFY_OK ; } static int update_runtime(struct notifier_block *nfb,
PATCH 66/108 Revert "drm/radeon: rework pll selection (v3)"
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 2f1f4d9b60396d2df4cff829bd5376ffc8ed9a2c upstream.
This reverts commit 985f61f7ee647ad570c05eab0b74915da2ac8e19.
This commit fixed certain cases, but ended up regressing others due to limitations in the current KMS API. A proper fix is too invasive for 3.6. Push it back to 3.7.
--- drivers/gpu/drm/radeon/atombios_crtc.c | 163 +++++++------------------------- 1 file changed, 34 insertions(+), 129 deletions(-)
drivers/gpu/drm/radeon/atombios_crtc.c +20 -106
@@ -1446,98 +1446,14 @@ static void radeon_legacy_atom_fixup(str } } -/** -* radeon_get_pll_use_mask - look up a mask of which pplls are in use -* -* @crtc: drm crtc -* -* Returns the mask of which PPLLs (Pixel PLLs) are in use. -*/ -static u32 radeon_get_pll_use_mask (struct drm_crtc *crtc) -{ -struct drm_device *dev = crtc->dev; -struct drm_crtc *test_crtc; -struct radeon_crtc *radeon_test_crtc; -u32 pll_in_use =0 ; - -list_for_each_entry (test_crtc, &dev->mode_config.crtc_list, head) { -if (crtc == test_crtc) -continue ; - - radeon_test_crtc =to_radeon_crtc (test_crtc); -if (radeon_test_crtc->pll_id !=ATOM_PPLL_INVALID ) - pll_in_use |= (1 << radeon_test_crtc->pll_id); - } -return pll_in_use; -} - -/** -* radeon_get_shared_dp_ppll - return the PPLL used by another crtc for DP -* -* @crtc: drm crtc -* -* Returns the PPLL (Pixel PLL) used by another crtc/encoder which is -* also in DP mode. For DP, a single PPLL can be used for all DP -* crtcs/encoders. -*/ -static int radeon_get_shared_dp_ppll (struct drm_crtc *crtc) -{ -struct drm_device *dev = crtc->dev; -struct drm_encoder *test_encoder; -struct radeon_crtc *radeon_test_crtc; - -list_for_each_entry (test_encoder, &dev->mode_config.encoder_list, head) { -if (test_encoder->crtc && (test_encoder->crtc != crtc)) { -if (ENCODER_MODE_IS_DP (atombios_get_encoder_mode (test_encoder))) { -/* for DP use the same PLL for all */ - radeon_test_crtc =to_radeon_crtc (test_encoder->crtc); -if (radeon_test_crtc->pll_id !=ATOM_PPLL_INVALID ) -return radeon_test_crtc->pll_id; - } - } - } -return ATOM_PPLL_INVALID ; -} - -/** -* radeon_atom_pick_pll - Allocate a PPLL for use by the crtc. -* -* @crtc: drm crtc -* -* Returns the PPLL (Pixel PLL) to be used by the crtc. For DP monitors -* a single PPLL can be used for all DP crtcs/encoders. For non-DP -* monitors a dedicated PPLL must be used. If a particular board has -* an external DP PLL, return ATOM_PPLL_INVALID to skip PLL programming -* as there is no need to program the PLL itself. If we are not able to -* allocate a PLL, return ATOM_PPLL_INVALID to skip PLL programming to -* avoid messing up an existing monitor. -* -* Asic specific PLL information -* -* DCE 6.1 -* - PPLL2 is only available to UNIPHYA (both DP and non-DP) -* - PPLL0, PPLL1 are available for UNIPHYB/C/D/E/F (both DP and non-DP) -* -* DCE 6.0 -* - PPLL0 is available to all UNIPHY (DP only) -* - PPLL1, PPLL2 are available for all UNIPHY (both DP and non-DP) and DAC -* -* DCE 5.0 -* - DCPLL is available to all UNIPHY (DP only) -* - PPLL1, PPLL2 are available for all UNIPHY (both DP and non-DP) and DAC -* -* DCE 3.0/4.0/4.1 -* - PPLL1, PPLL2 are available for all UNIPHY (both DP and non-DP) and DAC -* -*/ static int radeon_atom_pick_pll (struct drm_crtc *crtc) {struct radeon_crtc *radeon_crtc =to_radeon_crtc (crtc);struct drm_device *dev = crtc->dev;struct radeon_device *rdev = dev->dev_private;struct drm_encoder *test_encoder; -u32 pll_in_use; -int pll; +struct drm_crtc *test_crtc; +uint32_t pll_in_use =0 ;if (ASIC_IS_DCE4 (rdev)) {list_for_each_entry (test_encoder, &dev->mode_config.encoder_list, head) {
@@ -1545,7 +1461,7 @@ static int radeon_atom_pick_pll(struct d/* in DP mode, the DP ref clock can come from PPLL, DCPLL, or ext clock, * depending on the asic: * DCE4: PPLL or ext clock -* DCE5: PPLL, DCPLL, or ext clock +* DCE5: DCPLL or ext clock * * Setting ATOM_PPLL_INVALID will cause SetPixelClock to skip * PPLL/DCPLL programming and only program the DP DTO for the
@@ -1553,31 +1469,29 @@ static int radeon_atom_pick_pll(struct d*/ if (ENCODER_MODE_IS_DP (atombios_get_encoder_mode (test_encoder))) {if (rdev->clock.dp_extclk) -/* skip PPLL programming if using ext clock */ return ATOM_PPLL_INVALID ;else if (ASIC_IS_DCE5 (rdev)) -/* use DCPLL for all DP */ return ATOM_DCPLL ; -else { -/* use the same PPLL for all DP monitors */ - pll =radeon_get_shared_dp_ppll (crtc); -if (pll !=ATOM_PPLL_INVALID ) -return pll; - } } -break ; } } -/* all other cases */ - pll_in_use =radeon_get_pll_use_mask (crtc); -if (!(pll_in_use & (1 <<ATOM_PPLL2 ))) -return ATOM_PPLL2 ; -if (!(pll_in_use & (1 <<ATOM_PPLL1 ))) + +/* otherwise, pick one of the plls */ +list_for_each_entry (test_crtc, &dev->mode_config.crtc_list, head) { +struct radeon_crtc *radeon_test_crtc; + +if (crtc == test_crtc) +continue ; + + radeon_test_crtc =to_radeon_crtc (test_crtc); +if ((radeon_test_crtc->pll_id >=ATOM_PPLL1 ) && + (radeon_test_crtc->pll_id <=ATOM_PPLL2 )) + pll_in_use |= (1 << radeon_test_crtc->pll_id); + } +if (!(pll_in_use &1 ))return ATOM_PPLL1 ; -DRM_ERROR ("unable to allocate a PPLL\n" ); -return ATOM_PPLL_INVALID ; +return ATOM_PPLL2 ; }else -/* use PPLL1 or PPLL2 */ return radeon_crtc->crtc_id; }
@@ -1696,7 +1610,7 @@ static void atombios_crtc_disable(structbreak ; } done: - radeon_crtc->pll_id =ATOM_PPLL_INVALID ; + radeon_crtc->pll_id =-1 ; }static const struct drm_crtc_helper_funcs atombios_helper_funcs = {
@@ -1745,6 +1659,6 @@ void radeon_atombios_init_crtc(struct drelse radeon_crtc->crtc_offset =0 ; } - radeon_crtc->pll_id =ATOM_PPLL_INVALID ; + radeon_crtc->pll_id =-1 ;drm_crtc_helper_add (&radeon_crtc->base, &atombios_helper_funcs); }
PATCH 67/108 x86/alternatives: Fix p6 nops on non-modular kernels
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avi Kivity <[email protected]>
commit cb09cad44f07044d9810f18f6f9a6a6f3771f979 upstream.
Probably a leftover from the early days of self-patching, p6nops are marked __initconst_or_module, which causes them to be discarded in a non-modular kernel. If something later triggers patching, it will overwrite kernel code with garbage.
--- arch/x86/kernel/alternative.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/alternative.c +1 -1
@@ -165,7 +165,7 @@ static const unsigned char * const k7_nops[ASM_NOP_MAX+2] =#endif #ifdef P6_NOP1 -static const unsigned char __initconst_or_module p6nops[] = +static const unsigned char p6nops[] = {P6_NOP1 , P6_NOP2,
PATCH 68/108 HID: hidraw: add proper error handling to raw event reporting
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit b6787242f32700377d3da3b8d788ab3928bab849 upstream.
If kmemdup() in hidraw_report_event() fails, we are not propagating this fact properly.
Let hidraw_report_event() and hid_report_raw_event() return an error value to the caller.
--- drivers/hid/hid-core.c | 16 +++++++++++----- drivers/hid/hidraw.c | 19 +++++++++++++------ include/linux/hid.h | 2 +- include/linux/hidraw.h | 4 ++-- 4 files changed, 27 insertions(+), 14 deletions(-)
drivers/hid/hid-core.c +11 -5
@@ -1032,7 +1032,7 @@ static struct hid_report *hid_get_report(struct hid_report_enum *report_enum,return report; } -void hid_report_raw_event (struct hid_device *hid,int type,u8 *data,int size, +int hid_report_raw_event (struct hid_device *hid,int type,u8 *data,int size,int interrupt) {struct hid_report_enum *report_enum = hid->report_enum + type;
@@ -1040,10 +1040,11 @@ void hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,unsigned int a;int rsize, csize = size;u8 *cdata = data; +int ret =0 ; report =hid_get_report (report_enum, data);if (!report) -return ; + goto out;if (report_enum->numbered) { cdata++;
@@ -1063,14 +1064,19 @@ void hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,if ((hid->claimed &HID_CLAIMED_HIDDEV ) && hid->hiddev_report_event) hid->hiddev_report_event (hid, report); -if (hid->claimed &HID_CLAIMED_HIDRAW ) -hidraw_report_event (hid, data, size); +if (hid->claimed &HID_CLAIMED_HIDRAW ) { + ret =hidraw_report_event (hid, data, size); +if (ret) + goto out; + }for (a =0 ; a < report->maxfield; a++)hid_input_field (hid, report->field[a], cdata, interrupt);if (hid->claimed &HID_CLAIMED_INPUT )hidinput_report_event (hid, report); +out: +return ret; }EXPORT_SYMBOL_GPL (hid_report_raw_event);
@@ -1147,7 +1153,7 @@ nomem: } } -hid_report_raw_event (hid, type, data, size, interrupt); + ret =hid_report_raw_event (hid, type, data, size, interrupt); unlock:up (&hid->driver_lock);
drivers/hid/hidraw.c +13 -6
@@ -87,11 +87,13 @@ static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, len = list->buffer[list->tail].len > count ? count : list->buffer[list->tail].len; -if (copy_to_user (buffer, list->buffer[list->tail].value, len)) { - ret = -EFAULT ; - goto out; +if (list->buffer[list->tail].value) { +if (copy_to_user (buffer, list->buffer[list->tail].value, len)) { + ret = -EFAULT ; + goto out; + } + ret = len; } - ret = len;kfree (list->buffer[list->tail].value); list->tail = (list->tail +1 ) & (HIDRAW_BUFFER_SIZE -1 );
@@ -437,19 +439,24 @@ static const struct file_operations hidraw_ops = { .llseek = noop_llseek, }; -void hidraw_report_event (struct hid_device *hid,u8 *data,int len) +int hidraw_report_event (struct hid_device *hid,u8 *data,int len) {struct hidraw *dev = hid->hidraw;struct hidraw_list *list; +int ret =0 ;list_for_each_entry (list, &dev->list, node) { - list->buffer[list->head].value =kmemdup (data, len,GFP_ATOMIC ); +if (!(list->buffer[list->head].value =kmemdup (data, len,GFP_ATOMIC ))) { + ret = -ENOMEM ; +break ; + } list->buffer[list->head].len = len; list->head = (list->head +1 ) & (HIDRAW_BUFFER_SIZE -1 );kill_fasync (&list->fasync,SIGIO ,POLL_IN ); }wake_up_interruptible (&dev->wait); +return ret; }EXPORT_SYMBOL_GPL (hidraw_report_event);
include/linux/hid.h +1 -1
@@ -896,7 +896,7 @@ static inline int hid_hw_power(struct hid_device *hdev, int level)return hdev->ll_driver->power ? hdev->ll_driver->power (hdev, level) :0 ; } -void hid_report_raw_event (struct hid_device *hid,int type,u8 *data,int size, +int hid_report_raw_event (struct hid_device *hid,int type,u8 *data,int size,int interrupt);extern int hid_generic_init (void );
include/linux/hidraw.h +2 -2
@@ -76,13 +76,13 @@ struct hidraw_list {#ifdef CONFIG_HIDRAW int hidraw_init (void );void hidraw_exit (void ); -void hidraw_report_event (struct hid_device *,u8 *,int ); +int hidraw_report_event (struct hid_device *,u8 *,int );int hidraw_connect (struct hid_device *);void hidraw_disconnect (struct hid_device *);#else static inline int hidraw_init (void ) {return 0 ; }static inline void hidraw_exit (void ) { } -static inline void hidraw_report_event (struct hid_device *hid,u8 *data,int len) { } +static inline int hidraw_report_event (struct hid_device *hid,u8 *data,int len) { }static inline int hidraw_connect (struct hid_device *hid) {return -1 ; }static inline void hidraw_disconnect (struct hid_device *hid) { }#endif
Re: [ 068/108] HID: hidraw: add proper error handling to raw event reporting
Quoted 6 lines · Ben Hutchings
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
Quoted 7 lines
commit
b6787242f32700377d3da3b8d788ab3928bab849upstream.If
kmemdup()inhidraw_report_event()fails, we are not propagating this fact properly.Let
hidraw_report_event()andhid_report_raw_event()return an error value to the caller.
This needs in addition a small fix on top, commit d6d7c87 ("HID: fix return value of hidraw_report_event() when !CONFIG_HIDRAW")
Signature · 2 lines
[]'s Herton
Re: [ 068/108] HID: hidraw: add proper error handling to raw event reporting
Quoted 9 lines · Herton Ronaldo Krzesinski
Quoted 8 lines · Ben Hutchings
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit
b6787242f32700377d3da3b8d788ab3928bab849upstream.
Quoted 8 lines
Quoted 5 lines
If
kmemdup()inhidraw_report_event()fails, we are not propagating this fact properly.Let
hidraw_report_event()andhid_report_raw_event()return an error value to the caller.This needs in addition a small fix on top, commit d6d7c87 ("HID: fix return value of
hidraw_report_event()when !CONFIG_HIDRAW")
I've added that, thanks.
Ben.
Signature · 2 lines
Ben Hutchings Who are all these weirdos? - David Bowie, about L-Space IRC channel #afp
PATCH 69/108 HID: hidraw: fix list->buffer memleak
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu CASTET <[email protected]>
commit 4c7b417ecb756e85dfc955b0e7a04fd45585533e upstream.
If we don't read fast enough hidraw device, hidraw_report_event will cycle and we will leak list->buffer.
Also list->buffer are not free on release.
After this patch, kmemleak report nothing.
--- drivers/hid/hidraw.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/hid/hidraw.c +11 -1
@@ -96,6 +96,7 @@ static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, }kfree (list->buffer[list->tail].value); + list->buffer[list->tail].value =NULL ; list->tail = (list->tail +1 ) & (HIDRAW_BUFFER_SIZE -1 ); } out:
@@ -300,6 +301,7 @@ static int hidraw_release(struct inode * inode, struct file * file)struct hidraw *dev;struct hidraw_list *list = file->private_data;int ret; +int i;mutex_lock (&minors_lock);if (!hidraw_table[minor]) {
@@ -317,6 +319,9 @@ static int hidraw_release(struct inode * inode, struct file * file)kfree (list->hidraw); } } + +for (i =0 ; i <HIDRAW_BUFFER_SIZE ; ++i) +kfree (list->buffer[i].value);kfree (list); ret =0 ; unlock:
@@ -446,12 +451,17 @@ int hidraw_report_event(struct hid_device *hid, u8 *data, int len)int ret =0 ;list_for_each_entry (list, &dev->list, node) { +int new_head = (list->head +1 ) & (HIDRAW_BUFFER_SIZE -1 ); + +if (new_head == list->tail) +continue ; +if (!(list->buffer[list->head].value =kmemdup (data, len,GFP_ATOMIC ))) { ret = -ENOMEM ;break ; } list->buffer[list->head].len = len; - list->head = (list->head +1 ) & (HIDRAW_BUFFER_SIZE -1 ); + list->head = new_head;kill_fasync (&list->fasync,SIGIO ,POLL_IN ); }
PATCH 70/108 HID: hidraw: improve error handling in hidraw_init()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Khoroshilov <[email protected]>
commit bcb4a75bde3821cecb17a71d287abfd6ef9bd68d upstream.
Several improvements in error handling:
- do not report success if alloc_chrdev_region() failed
- check for error code of cdev_add()
- use unregister_chrdev_region() instead of unregister_chrdev() if class_create() failed
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/hid/hidraw.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/hid/hidraw.c +11 -4
@@ -559,21 +559,28 @@ int __init hidraw_init(void)if (result <0 ) {pr_warn ("can't get major number\n" ); - result =0 ; goto out; } hidraw_class =class_create (THIS_MODULE ,"hidraw" );if (IS_ERR (hidraw_class)) { result =PTR_ERR (hidraw_class); -unregister_chrdev (hidraw_major,"hidraw" ); - goto out; + goto error_cdev; }cdev_init (&hidraw_cdev, &hidraw_ops); -cdev_add (&hidraw_cdev, dev_id,HIDRAW_MAX_DEVICES ); + result =cdev_add (&hidraw_cdev, dev_id,HIDRAW_MAX_DEVICES ); +if (result <0 ) + goto error_class; + out:return result; + +error_class: +class_destroy (hidraw_class); +error_cdev: +unregister_chrdev_region (dev_id,HIDRAW_MAX_DEVICES ); + goto out; }void hidraw_exit (void )
PATCH 71/108 HID: hidraw: dont deallocate memory when it is in use
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratan Nalumasu <[email protected]>
commit 4fe9f8e203fdad1524c04beb390f3c6099781ed9 upstream.
When a device is unplugged, wait for all processes that have opened the device to close before deallocating the device.
--- drivers/hid/hidraw.c | 69 +++++++++++++++++++------------------------------- 1 file changed, 26 insertions(+), 43 deletions(-)
drivers/hid/hidraw.c +26 -43
@@ -42,6 +42,7 @@ static struct cdev hidraw_cdev;static struct class *hidraw_class;static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES ];static DEFINE_MUTEX (minors_lock); +static void drop_ref (struct hidraw *hid,int exists_bit);static ssize_t hidraw_read (struct file *file,char __user *buffer,size_t count,loff_t *ppos) {
@@ -113,7 +114,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,__u8 *buf;int ret =0 ; -if (!hidraw_table[minor]) { +if (!hidraw_table[minor] || !hidraw_table[minor]->exist) { ret = -ENODEV ; goto out; }
@@ -261,7 +262,7 @@ static int hidraw_open(struct inode *inode, struct file *file) }mutex_lock (&minors_lock); -if (!hidraw_table[minor]) { +if (!hidraw_table[minor] || !hidraw_table[minor]->exist) { err = -ENODEV ; goto out_unlock; }
@@ -298,36 +299,12 @@ out:static int hidraw_release (struct inode * inode,struct file * file) {unsigned int minor =iminor (inode); -struct hidraw *dev;struct hidraw_list *list = file->private_data; -int ret; -int i; - -mutex_lock (&minors_lock); -if (!hidraw_table[minor]) { - ret = -ENODEV ; - goto unlock; - } +drop_ref (hidraw_table[minor],0 );list_del (&list->node); - dev = hidraw_table[minor]; -if (!--dev->open) { -if (list->hidraw->exist) { -hid_hw_power (dev->hid,PM_HINT_NORMAL ); -hid_hw_close (dev->hid); - }else { -kfree (list->hidraw); - } - } - -for (i =0 ; i <HIDRAW_BUFFER_SIZE ; ++i) -kfree (list->buffer[i].value);kfree (list); - ret =0 ; -unlock: -mutex_unlock (&minors_lock); - -return ret; +return 0 ; } static long hidraw_ioctl(struct file *file, unsigned int cmd,
@@ -529,21 +506,7 @@ EXPORT_SYMBOL_GPL(hidraw_connect);void hidraw_disconnect (struct hid_device *hid) {struct hidraw *hidraw = hid->hidraw; - -mutex_lock (&minors_lock); - hidraw->exist =0 ; - -device_destroy (hidraw_class,MKDEV (hidraw_major, hidraw->minor)); - - hidraw_table[hidraw->minor] =NULL ; - -if (hidraw->open) { -hid_hw_close (hid); -wake_up_interruptible (&hidraw->wait); - }else { -kfree (hidraw); - } -mutex_unlock (&minors_lock); +drop_ref (hidraw,1 ); }EXPORT_SYMBOL_GPL (hidraw_disconnect);
@@ -585,3 +548,23 @@ void hidraw_exit(void)unregister_chrdev_region (dev_id,HIDRAW_MAX_DEVICES ); } + +static void drop_ref (struct hidraw *hidraw,int exists_bit) +{ +mutex_lock (&minors_lock); +if (exists_bit) { +hid_hw_close (hidraw->hid); + hidraw->exist =0 ; +if (hidraw->open) +wake_up_interruptible (&hidraw->wait); + }else { + --hidraw->open; + } + +if (!hidraw->open && !hidraw->exist) { +device_destroy (hidraw_class,MKDEV (hidraw_major, hidraw->minor)); + hidraw_table[hidraw->minor] =NULL ; +kfree (hidraw); + } +mutex_unlock (&minors_lock); +}
PATCH 72/108 PCI: acpiphp: check whether _ADR evaluation succeeded
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
commit dfb117b3e50c52c7b3416db4a4569224b8db80bb upstream.
Check whether we evaluated _ADR successfully. Previously we ignored failure, so we would have used garbage data from the stack as the device and function number.
We return AE_OK so that we ignore only this slot and continue looking for other slots.
Found by Coverity (CID 113981).
--- drivers/pci/hotplug/acpiphp_glue.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/pci/hotplug/acpiphp_glue.c +9 -4
@@ -132,6 +132,15 @@ register_slot(acpi_handle handle, u32 lvl, void *context, void **rv)if (!acpi_pci_check_ejectable (pbus, handle) && !is_dock_device (handle))return AE_OK ; + status =acpi_evaluate_integer (handle,"_ADR" ,NULL , &adr); +if (ACPI_FAILURE (status)) { +warn ("can't evaluate _ADR (%#x)\n" , status); +return AE_OK ; + } + + device = (adr >>16 ) &0xffff ; + function = adr &0xffff ; + pdev = pbus->self;if (pdev &&pci_is_pcie (pdev)) { tmp =acpi_find_root_bridge_handle (pdev);
@@ -144,10 +153,6 @@ register_slot(acpi_handle handle, u32 lvl, void *context, void **rv) } } -acpi_evaluate_integer (handle,"_ADR" ,NULL , &adr); - device = (adr >>16 ) &0xffff ; - function = adr &0xffff ; - newfunc =kzalloc (sizeof (struct acpiphp_func ),GFP_KERNEL );if (!newfunc)return AE_NO_MEMORY ;
PATCH 73/108 bnx2x: fix rx checksum validation for IPv6
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <[email protected]>
[ Upstream commit e488921f44765e8ab6c48ca35e3f6b78df9819df ]
Commit d6cb3e41 "bnx2x: fix checksum validation" caused a performance regression for IPv6. Rx checksum offload does not work. IPv6 packets are passed to the stack with CHECKSUM_NONE.
The hardware obviously cannot perform IP checksum validation for IPv6, because there is no checksum in the IPv6 header. This should not prevent us from setting CHECKSUM_UNNECESSARY.
Tested on BCM57711.
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +7 -5
@@ -554,14 +554,16 @@ static inline void bnx2x_set_skb_rxhash(struct bnx2x *bp, union eth_rx_cqe *cqe,static void bnx2x_csum_validate (struct sk_buff *skb,union eth_rx_cqe *cqe,struct bnx2x_fastpath *fp) { -/* Do nothing if no IP/L4 csum validation was done */ - +/* Do nothing if no L4 csum validation was done. +* We do not check whether IP csum was validated. For IPv4 we assume +* that if the card got as far as validating the L4 csum, it also +* validated the IP csum. IPv6 has no IP csum. +*/ if (cqe->fast_path_cqe.status_flags & - (ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG | -ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG )) +ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG )return ; -/* If both IP/L4 validation were done, check if an error was found. */ +/* If L4 validation was done, check if an error was found. */ if (cqe->fast_path_cqe.type_error_flags & (ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG |
PATCH 74/108 xfrm: Workaround incompatibility of ESN and async crypto
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <[email protected]>
[ Upstream commit 3b59df46a449ec9975146d71318c4777ad086744 ]
ESN for esp is defined in RFC 4303. This RFC assumes that the sequence number counters are always up to date. However, this is not true if an async crypto algorithm is employed.
If the sequence number counters are not up to date on sequence number check, we may incorrectly update the upper 32 bit of the sequence number. This leads to a DOS.
We workaround this by comparing the upper sequence number, (used for authentication) with the upper sequence number computed after the async processing. We drop the packet if these numbers are different.
To do this, we introduce a recheck function that does this check in the ESN case.
--- include/net/xfrm.h | 3 +++ net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_replay.c | 15 +++++++++++++++ 3 files changed, 19 insertions(+), 1 deletion(-)
include/net/xfrm.h +3 -0
@@ -269,6 +269,9 @@ struct xfrm_replay {int (*check)(struct xfrm_state *x,struct sk_buff *skb,__be32 net_seq); +int (*recheck)(struct xfrm_state *x, +struct sk_buff *skb, +__be32 net_seq);void (*notify)(struct xfrm_state *x,int event);int (*overflow)(struct xfrm_state *x,struct sk_buff *skb); };
net/xfrm/xfrm_input.c +1 -1
@@ -212,7 +212,7 @@ resume:/* only the first xfrm gets the encap type */ encap_type =0 ; -if (async && x->repl->check (x, skb, seq)) { +if (async && x->repl->recheck (x, skb, seq)) {XFRM_INC_STATS (net,LINUX_MIB_XFRMINSTATESEQERROR ); goto drop_unlock; }
net/xfrm/xfrm_replay.c +15 -0
@@ -420,6 +420,18 @@ err:return -EINVAL ; } +static int xfrm_replay_recheck_esn (struct xfrm_state *x, +struct sk_buff *skb,__be32 net_seq) +{ +if (unlikely (XFRM_SKB_CB (skb)->seq.input.hi != +htonl (xfrm_replay_seqhi (x, net_seq)))) { + x->stats.replay_window++; +return -EINVAL ; + } + +return xfrm_replay_check_esn (x, skb, net_seq); +} +static void xfrm_replay_advance_esn (struct xfrm_state *x,__be32 net_seq) {unsigned int bitnr, nr, i;
@@ -479,6 +491,7 @@ static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)static struct xfrm_replay xfrm_replay_legacy = { .advance = xfrm_replay_advance, .check = xfrm_replay_check, + .recheck = xfrm_replay_check, .notify = xfrm_replay_notify, .overflow = xfrm_replay_overflow, };
@@ -486,6 +499,7 @@ static struct xfrm_replay xfrm_replay_legacy = {static struct xfrm_replay xfrm_replay_bmp = { .advance = xfrm_replay_advance_bmp, .check = xfrm_replay_check_bmp, + .recheck = xfrm_replay_check_bmp, .notify = xfrm_replay_notify_bmp, .overflow = xfrm_replay_overflow_bmp, };
@@ -493,6 +507,7 @@ static struct xfrm_replay xfrm_replay_bmp = {static struct xfrm_replay xfrm_replay_esn = { .advance = xfrm_replay_advance_esn, .check = xfrm_replay_check_esn, + .recheck = xfrm_replay_recheck_esn, .notify = xfrm_replay_notify_bmp, .overflow = xfrm_replay_overflow_esn, };
PATCH 75/108 xfrm_user: return error pointer instead of NULL
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 864745d291b5ba80ea0bd0edcbe67273de368836 ]
When dump_one_state() returns an error, e.g. because of a too small buffer to dump the whole xfrm state, xfrm_state_netlink() returns NULL instead of an error pointer. But its callers expect an error pointer and therefore continue to operate on a NULL skbuff.
This could lead to a privilege escalation (execution of user code in kernel context) if the attacker has CAP_NET_ADMIN and is able to map address 0.
--- net/xfrm/xfrm_user.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/xfrm/xfrm_user.c +4 -2
@@ -862,6 +862,7 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb, {struct xfrm_dump_info info;struct sk_buff *skb; +int err; skb =nlmsg_new (NLMSG_DEFAULT_SIZE ,GFP_ATOMIC );if (!skb)
@@ -872,9 +873,10 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb, info.nlmsg_seq = seq; info.nlmsg_flags =0 ; -if (dump_one_state (x,0 , &info)) { + err =dump_one_state (x,0 , &info); +if (err) {kfree_skb (skb); -return NULL ; +return ERR_PTR (err); }return skb;
PATCH 76/108 xfrm_user: return error pointer instead of NULL #2
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit c25463722509fef0ed630b271576a8c9a70236f3 ]
When dump_one_policy() returns an error, e.g. because of a too small buffer to dump the whole xfrm policy, xfrm_policy_netlink() returns NULL instead of an error pointer. But its caller expects an error pointer and therefore continues to operate on a NULL skbuff.
--- net/xfrm/xfrm_user.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/xfrm/xfrm_user.c +4 -2
@@ -1531,6 +1531,7 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb, {struct xfrm_dump_info info;struct sk_buff *skb; +int err; skb =nlmsg_new (NLMSG_DEFAULT_SIZE ,GFP_KERNEL );if (!skb)
@@ -1541,9 +1542,10 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb, info.nlmsg_seq = seq; info.nlmsg_flags =0 ; -if (dump_one_policy (xp, dir,0 , &info) <0 ) { + err =dump_one_policy (xp, dir,0 , &info); +if (err) {kfree_skb (skb); -return NULL ; +return ERR_PTR (err); }return skb;
PATCH 77/108 xfrm: fix a read lock imbalance in make_blackhole
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit 433a19548061bb5457b6ab77ed7ea58ca6e43ddb ]
if xfrm_policy_get_afinfo returns 0, it has already released the read lock, xfrm_policy_put_afinfo should not be called again.
--- net/xfrm/xfrm_policy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_policy.c +1 -1
@@ -1761,7 +1761,7 @@ static struct dst_entry *make_blackhole(struct net *net, u16 family,if (!afinfo) {dst_release (dst_orig); - ret =ERR_PTR (-EINVAL ); +return ERR_PTR (-EINVAL ); }else { ret = afinfo->blackhole_route (net, dst_orig); }
PATCH 78/108 xfrm_user: fix info leak in copy_to_user_auth()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 4c87308bdea31a7b4828a51f6156e6f721a1fcc9 ]
copy_to_user_auth() fails to initialize the remainder of alg_name and therefore discloses up to 54 bytes of heap memory via netlink to userland.
Use strncpy() instead of strcpy() to fill the trailing bytes of alg_name with null bytes.
--- net/xfrm/xfrm_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_user.c +1 -1
@@ -742,7 +742,7 @@ static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)return -EMSGSIZE ; algo =nla_data (nla); -strcpy (algo->alg_name, auth->alg_name); +strncpy (algo->alg_name, auth->alg_name,sizeof (algo->alg_name));memcpy (algo->alg_key, auth->alg_key, (auth->alg_key_len +7 ) /8 ); algo->alg_key_len = auth->alg_key_len;
PATCH 79/108 xfrm_user: fix info leak in copy_to_user_state()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit f778a636713a435d3a922c60b1622a91136560c1 ]
The memory reserved to dump the xfrm state includes the padding bytes of struct xfrm_usersa_info added by the compiler for alignment (7 for amd64, 3 for i386). Add an explicit memset(0) before filling the buffer to avoid the info leak.
--- net/xfrm/xfrm_user.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_user.c +1 -0
@@ -689,6 +689,7 @@ out:static void copy_to_user_state (struct xfrm_state *x,struct xfrm_usersa_info *p) { +memset (p,0 ,sizeof (*p));memcpy (&p->id, &x->id,sizeof (p->id));memcpy (&p->sel, &x->sel,sizeof (p->sel));memcpy (&p->lft, &x->lft,sizeof (p->lft));
PATCH 80/108 xfrm_user: fix info leak in copy_to_user_policy()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 7b789836f434c87168eab067cfbed1ec4783dffd ]
The memory reserved to dump the xfrm policy includes multiple padding bytes added by the compiler for alignment (padding bytes in struct xfrm_selector and struct xfrm_userpolicy_info). Add an explicit memset(0) before filling the buffer to avoid the heap info leak.
--- net/xfrm/xfrm_user.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_user.c +1 -0
@@ -1300,6 +1300,7 @@ static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicystatic void copy_to_user_policy (struct xfrm_policy *xp,struct xfrm_userpolicy_info *p,int dir) { +memset (p,0 ,sizeof (*p));memcpy (&p->sel, &xp->selector,sizeof (p->sel));memcpy (&p->lft, &xp->lft,sizeof (p->lft));memcpy (&p->curlft, &xp->curlft,sizeof (p->curlft));
PATCH 81/108 xfrm_user: fix info leak in copy_to_user_tmpl()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 1f86840f897717f86d523a13e99a447e6a5d2fa5 ]
The memory used for the template copy is a local stack variable. As struct xfrm_user_tmpl contains multiple holes added by the compiler for alignment, not initializing the memory will lead to leaking stack bytes to userland. Add an explicit memset(0) to avoid the info leak.
Initial version of the patch by Brad Spengler.
--- net/xfrm/xfrm_user.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_user.c +1 -0
@@ -1405,6 +1405,7 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)struct xfrm_user_tmpl *up = &vec[i];struct xfrm_tmpl *kp = &xp->xfrm_vec[i]; +memset (up,0 ,sizeof (*up));memcpy (&up->id, &kp->id,sizeof (up->id)); up->family = kp->encap_family;memcpy (&up->saddr, &kp->saddr,sizeof (up->saddr));
PATCH 82/108 xfrm_user: dont copy esn replay window twice for new states
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit e3ac104d41a97b42316915020ba228c505447d21 ]
The ESN replay window was already fully initialized in xfrm_alloc_replay_state_esn(). No need to copy it again.
--- net/xfrm/xfrm_user.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/xfrm/xfrm_user.c +5 -4
@@ -442,10 +442,11 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info ** somehow made shareable and move it to xfrm_state.c - JHS * */ -static void xfrm_update_ae_params (struct xfrm_state *x,struct nlattr **attrs) +static void xfrm_update_ae_params (struct xfrm_state *x,struct nlattr **attrs, +int update_esn) {struct nlattr *rp = attrs[XFRMA_REPLAY_VAL ]; -struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL ]; +struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL ] :NULL ;struct nlattr *lt = attrs[XFRMA_LTIME_VAL ];struct nlattr *et = attrs[XFRMA_ETIMER_THRESH ];struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH ];
@@ -555,7 +556,7 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, goto error;/* override default values from above */ -xfrm_update_ae_params (x, attrs); +xfrm_update_ae_params (x, attrs,0 );return x;
@@ -1801,7 +1802,7 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, goto out;spin_lock_bh (&x->lock); -xfrm_update_ae_params (x, attrs); +xfrm_update_ae_params (x, attrs,1 );spin_unlock_bh (&x->lock); c.event = nlh->nlmsg_type;
PATCH 83/108 xfrm_user: ensure user supplied esn replay window is valid
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit ecd7918745234e423dd87fcc0c077da557909720 ]
The current code fails to ensure that the netlink message actually contains as many bytes as the header indicates. If a user creates a new state or updates an existing one but does not supply the bytes for the whole ESN replay window, the kernel copies random heap bytes into the replay bitmap, the ones happen to follow the XFRMA_REPLAY_ESN_VAL netlink attribute. This leads to following issues:
1. The replay window has random bits set confusing the replay handling code later on.
2. A malicious user could use this flaw to leak up to ~3.5kB of heap memory when she has access to the XFRM netlink interface (requires CAP_NET_ADMIN).
Known users of the ESN replay window are strongSwan and Steffen's iproute2 patch (<http://patchwork.ozlabs.org/patch/85962/>). The latter uses the interface with a bitmap supplied while the former does not. strongSwan is therefore prone to run into issue 1.
To fix both issues without breaking existing userland allow using the XFRMA_REPLAY_ESN_VAL netlink attribute with either an empty bitmap or a fully specified one. For the former case we initialize the in-kernel bitmap with zero, for the latter we copy the user supplied bitmap. For state updates the full bitmap must be supplied.
To prevent overflows in the bitmap length calculation the maximum size of bmp_len is limited to 128 by this patch -- resulting in a maximum replay window of 4096 packets. This should be sufficient for all real life scenarios (RFC 4303 recommends a default replay window size of 64).
--- include/linux/xfrm.h | 2 ++ net/xfrm/xfrm_user.c | 31 +++++++++++++++++++++++++------ 2 files changed, 27 insertions(+), 6 deletions(-)
include/linux/xfrm.h +2 -0
@@ -84,6 +84,8 @@ struct xfrm_replay_state {__u32 bitmap; }; +#define XFRMA_REPLAY_ESN_MAX 4096 +struct xfrm_replay_state_esn {unsigned int bmp_len;__u32 oseq;
net/xfrm/xfrm_user.c +25 -6
@@ -123,9 +123,21 @@ static inline int verify_replay(struct xfrm_usersa_info *p, struct nlattr **attrs) {struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL ]; +struct xfrm_replay_state_esn *rs; -if ((p->flags &XFRM_STATE_ESN ) && !rt) -return -EINVAL ; +if (p->flags &XFRM_STATE_ESN ) { +if (!rt) +return -EINVAL ; + + rs =nla_data (rt); + +if (rs->bmp_len >XFRMA_REPLAY_ESN_MAX /sizeof (rs->bmp[0 ]) /8 ) +return -EINVAL ; + +if (nla_len (rt) <xfrm_replay_state_esn_len (rs) && +nla_len (rt) !=sizeof (*rs)) +return -EINVAL ; + }if (!rt)return 0 ;
@@ -370,14 +382,15 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es struct nlattr *rp) {struct xfrm_replay_state_esn *up; +int ulen;if (!replay_esn || !rp)return 0 ; up =nla_data (rp); + ulen =xfrm_replay_state_esn_len (up); -if (xfrm_replay_state_esn_len (replay_esn) != -xfrm_replay_state_esn_len (up)) +if (nla_len (rp) < ulen ||xfrm_replay_state_esn_len (replay_esn) != ulen)return -EINVAL ;return 0 ;
@@ -388,22 +401,28 @@ static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn struct nlattr *rta) {struct xfrm_replay_state_esn *p, *pp, *up; +int klen, ulen;if (!rta)return 0 ; up =nla_data (rta); + klen =xfrm_replay_state_esn_len (up); + ulen =nla_len (rta) >= klen ? klen :sizeof (*up); - p =kmemdup (up,xfrm_replay_state_esn_len (up),GFP_KERNEL ); + p =kzalloc (klen,GFP_KERNEL );if (!p)return -ENOMEM ; - pp =kmemdup (up,xfrm_replay_state_esn_len (up),GFP_KERNEL ); + pp =kzalloc (klen,GFP_KERNEL );if (!pp) {kfree (p);return -ENOMEM ; } +memcpy (p, up, ulen); +memcpy (pp, up, ulen); + *replay_esn = p; *preplay_esn = pp;
PATCH 84/108 net: ethernet: davinci_cpdma: decrease the desc count when cleaning up the remaining packets
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: htbegin <[email protected]>
[ Upstream commit ffb5ba90017505a19e238e986e6d33f09e4df765 ]
chan->count is used by rx channel. If the desc count is not updated by the clean up loop in cpdma_chan_stop, the value written to the rxfree register in cpdma_chan_start will be incorrect.
--- drivers/net/ethernet/ti/davinci_cpdma.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/ti/davinci_cpdma.c +1 -0
@@ -851,6 +851,7 @@ int cpdma_chan_stop(struct cpdma_chan *chan) next_dma =desc_read (desc, hw_next); chan->head =desc_from_phys (pool, next_dma); + chan->count--; chan->stats.teardown_dequeue++;/* issue callback without locks held */
PATCH 85/108 ixp4xx_hss: fix build failure due to missing linux/module.h inclusion
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
[ Upstream commit 0b836ddde177bdd5790ade83772860940bd481ea ]
Commit 36a1211970193ce215de50ed1e4e1272bc814df1 (netprio_cgroup.h:
dont include module.h from other includes) made the following build error on ixp4xx_hss pop up:
CC [M] drivers/net/wan/ixp4xx_hss.o
drivers/net/wan/ixp4xx_hss.c:1412:20: error: expected ';', ',' or ')' before string constant drivers/net/wan/ixp4xx_hss.c:1413:25: error: expected ';', ',' or ')' before string constant drivers/net/wan/ixp4xx_hss.c:1414:21: error: expected ';', ',' or ')' before string constant drivers/net/wan/ixp4xx_hss.c:1415:19: error: expected ';', ',' or ')' before string constant
make[8]: *** [drivers/net/wan/ixp4xx_hss.o] Error 1
This was previously hidden because ixp4xx_hss includes linux/hdlc.h which includes linux/netdevice.h which includes linux/netprio_cgroup.h which used to include linux/module.h. The real issue was actually present since the initial commit that added this driver since it uses macros from linux/module.h without including this file.
--- drivers/net/wan/ixp4xx_hss.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wan/ixp4xx_hss.c +1 -0
@@ -10,6 +10,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt +#include <linux/module.h> #include <linux/bitops.h> #include <linux/cdev.h> #include <linux/dma-mapping.h>
PATCH 86/108 netxen: check for root bus in netxen_mask_aer_correctable
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit e4d1aa40e363ed3e0486aeeeb0d173f7f822737e ]
Add a check if pdev->bus->self == NULL (root bus). When attaching a netxen NIC to a VM it can be on the root bus and the guest would crash in netxen_mask_aer_correctable() because of a NULL pointer dereference if CONFIG_PCIEAER is present.
--- drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c +4 -0
@@ -1351,6 +1351,10 @@ static void netxen_mask_aer_correctable(struct netxen_adapter *adapter)struct pci_dev *root = pdev->bus->self;u32 aer_pos; +/* root bus? */ +if (!root) +return ; +if (adapter->ahw.board_type !=NETXEN_BRDTYPE_P3_4_GB_MM && adapter->ahw.board_type !=NETXEN_BRDTYPE_P3_10G_TP )return ;
PATCH 87/108 net-sched: sch_cbq: avoid infinite loop
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit bdfc87f7d1e253e0a61e2fc6a75ea9d76f7fc03a ]
Its possible to setup a bad cbq configuration leading to an infinite loop in cbq_classify()
DEV_OUT=eth0
ICMP="match ip protocol 1 0xff"
U32="protocol ip u32"
DST="match ip dst"
tc qdisc add dev $DEV_OUT root handle 1: cbq avpkt 1000 \
bandwidth 100mbit
tc class add dev $DEV_OUT parent 1: classid 1:1 cbq \
rate 512kbit allot 1500 prio 5 bounded isolated
tc filter add dev $DEV_OUT parent 1: prio 3 $U32 \ $ICMP $DST 192.168.3.234 flowid 1:
--- net/sched/sch_cbq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/sched/sch_cbq.c +3 -2
@@ -250,10 +250,11 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)else if ((cl = defmap[res.classid &TC_PRIO_MAX ]) ==NULL ) cl = defmap[TC_PRIO_BESTEFFORT ]; -if (cl ==NULL || cl->level >= head->level) +if (cl ==NULL ) goto fallback; } - +if (cl->level >= head->level) + goto fallback;#ifdef CONFIG_NET_CLS_ACT switch (result) {case TC_ACT_QUEUED :
PATCH 88/108 pkt_sched: fix virtual-start-time update in QFQ
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Valente <[email protected]>
[ Upstream commit 71261956973ba9e0637848a5adb4a5819b4bae83 ]
If the old timestamps of a class, say cl, are stale when the class becomes active, then QFQ may assign to cl a much higher start time than the maximum value allowed. This may happen when QFQ assigns to the start time of cl the finish time of a group whose classes are characterized by a higher value of the ratio max_class_pkt/weight_of_the_class with respect to that of cl. Inserting a class with a too high start time into the bucket list corrupts the data structure and may eventually lead to crashes. This patch limits the maximum start time assigned to a class.
--- net/sched/sch_qfq.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/sched/sch_qfq.c +4 -1
@@ -829,7 +829,10 @@ static void qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)if (mask) {struct qfq_group *next =qfq_ffs (q, mask);if (qfq_gt (roundedF, next->F)) { - cl->S = next->F; +if (qfq_gt (limit, next->F)) + cl->S = next->F; +else /* preserve timestamp correctness */ + cl->S = limit;return ; } }
PATCH 89/108 sierra_net: Endianess bug fix.
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lennart Sorensen <[email protected]>
[ Upstream commit 2120c52da6fe741454a60644018ad2a6abd957ac ]
I discovered I couldn't get sierra_net to work on a powerpc. Turns out the firmware attribute check assumes the system is little endian and hence fails because the attributes is a 16 bit value.
--- drivers/net/usb/sierra_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/sierra_net.c +1 -1
@@ -678,7 +678,7 @@ static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)return -EIO ; } - *datap = *attrdata; + *datap =le16_to_cpu (*attrdata);kfree (attrdata);return result;
PATCH 90/108 8021q: fix mac_len recomputation in vlan_untag()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Quartulli <[email protected]>
[ Upstream commit 5316cf9a5197eb80b2800e1acadde287924ca975 ]
skb_reset_mac_len() relies on the value of the skb->network_header pointer, therefore we must wait for such pointer to be recalculated before computing the new mac_len value.
--- net/8021q/vlan_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/8021q/vlan_core.c +2 -1
@@ -106,7 +106,6 @@ static struct sk_buff *vlan_reorder_header(struct sk_buff *skb)return NULL ;memmove (skb->data -ETH_HLEN , skb->data -VLAN_ETH_HLEN ,2 *ETH_ALEN ); skb->mac_header +=VLAN_HLEN ; -skb_reset_mac_len (skb);return skb; }
@@ -173,6 +172,8 @@ struct sk_buff *vlan_untag(struct sk_buff *skb)skb_reset_network_header (skb);skb_reset_transport_header (skb); +skb_reset_mac_len (skb); +return skb; err_free:
PATCH 91/108 ipv6: release reference of ip6_null_entrys dst entry in __ip6_del_rt
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao feng <[email protected]>
[ Upstream commit 6825a26c2dc21eb4f8df9c06d3786ddec97cf53b ]
as we hold dst_entry before we call __ip6_del_rt, so we should alse call dst_release not only return -ENOENT when the rt6_info is ip6_null_entry.
and we already hold the dst entry, so I think it's safe to call dst_release out of the write-read lock.
--- net/ipv6/route.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/ipv6/route.c +6 -5
@@ -1435,17 +1435,18 @@ static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)struct fib6_table *table;struct net *net =dev_net (rt->rt6i_dev); -if (rt == net->ipv6.ip6_null_entry) -return -ENOENT ; +if (rt == net->ipv6.ip6_null_entry) { + err = -ENOENT ; + goto out; + } table = rt->rt6i_table;write_lock_bh (&table->tb6_lock); - err =fib6_del (rt, info); -dst_release (&rt->dst); -write_unlock_bh (&table->tb6_lock); +out: +dst_release (&rt->dst);return err; }
PATCH 92/108 tcp: flush DMA queue before sk_wait_data if rcv_wnd is zero
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kubeček <[email protected]>
[ Upstream commit 15c041759bfcd9ab0a4e43f1c16e2644977d0467 ]
If recv() syscall is called for a TCP socket so that
- IOAT DMA is used
- MSG_WAITALL flag is used
- requested length is bigger than sk_rcvbuf
- enough data has already arrived to bring rcv_wnd to zero
then when tcp_recvmsg() gets to calling sk_wait_data(), receive window can be still zero while sk_async_wait_queue exhausts enough space to keep it zero. As this queue isn't cleaned until the tcp_service_net_dma() call, sk_wait_data() cannot receive any data and blocks forever.
If zero receive window and non-empty sk_async_wait_queue is detected before calling sk_wait_data(), process the queue first.
--- net/ipv4/tcp.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
net/ipv4/tcp.c +8 -2
@@ -1589,8 +1589,14 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, }#ifdef CONFIG_NET_DMA -if (tp->ucopy.dma_chan) -dma_async_memcpy_issue_pending (tp->ucopy.dma_chan); +if (tp->ucopy.dma_chan) { +if (tp->rcv_wnd ==0 && + !skb_queue_empty (&sk->sk_async_wait_queue)) { +tcp_service_net_dma (sk, true); +tcp_cleanup_rbuf (sk, copied); + }else +dma_async_memcpy_issue_pending (tp->ucopy.dma_chan); + }#endif if (copied >= target) {/* Do not sleep, just process backlog. */
PATCH 93/108 sctp: Dont charge for data in sndbuf again when transmitting packet
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Graf <[email protected]>
[ Upstream commit 4c3a5bdae293f75cdf729c6c00124e8489af2276 ]
SCTP charges wmem_alloc via sctp_set_owner_w() in sctp_sendmsg() and via skb_set_owner_w() in sctp_packet_transmit(). If a sender runs out of sndbuf it will sleep in sctp_wait_for_sndbuf() and expects to be waken up by __sctp_write_space().
Buffer space charged via sctp_set_owner_w() is released in sctp_wfree() which calls __sctp_write_space() directly.
Buffer space charged via skb_set_owner_w() is released via sock_wfree() which calls sk->sk_write_space() _if_ SOCK_USE_WRITE_QUEUE is not set. sctp_endpoint_init() sets SOCK_USE_WRITE_QUEUE on all sockets.
Therefore if sctp_packet_transmit() manages to queue up more than sndbuf bytes, sctp_wait_for_sndbuf() will never be woken up again unless it is interrupted by a signal.
This could be fixed by clearing the SOCK_USE_WRITE_QUEUE flag but ...
Charging for the data twice does not make sense in the first place, it leads to overcharging sndbuf by a factor 2. Therefore this patch only charges a single byte in wmem_alloc when transmitting an SCTP packet to ensure that the socket stays alive until the packet has been released.
This means that control chunks are no longer accounted for in wmem_alloc which I believe is not a problem as skb->truesize will typically lead to overcharging anyway and thus compensates for any control overhead.
--- net/sctp/output.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
net/sctp/output.c +20 -1
@@ -334,6 +334,25 @@ finish:return retval; } +static void sctp_packet_release_owner (struct sk_buff *skb) +{ +sk_free (skb->sk); +} + +static void sctp_packet_set_owner_w (struct sk_buff *skb,struct sock *sk) +{ +skb_orphan (skb); + skb->sk = sk; + skb->destructor = sctp_packet_release_owner; + +/* +* The data chunks have already been accounted for in sctp_sendmsg(), +* therefore only reserve a single byte to keep socket around until +* the packet has been transmitted. +*/ +atomic_inc (&sk->sk_wmem_alloc); +} +/* All packets are sent to the network through this function from * sctp_outq_tail(). *
@@ -375,7 +394,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)/* Set the owning socket so that we know where to get the * destination IP address. */ -skb_set_owner_w (nskb, sk); +sctp_packet_set_owner_w (nskb, sk);if (!sctp_transport_dst_check (tp)) {sctp_transport_route (tp,NULL ,sctp_sk (sk));
PATCH 94/108 pppoe: drop PPPOX_ZOMBIEs in pppoe_release
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaodong Xu <[email protected]>
[ Upstream commit 2b018d57ff18e5405823e5cb59651a5b4d946d7b ]
When PPPOE is running over a virtual ethernet interface (e.g., a bonding interface) and the user tries to delete the interface in case the PPPOE state is ZOMBIE, the kernel will loop forever while unregistering net_device for the reference count is not decreased to zero which should have been done with dev_put().
--- drivers/net/ppp/pppoe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ppp/pppoe.c +1 -1
@@ -576,7 +576,7 @@ static int pppoe_release(struct socket *sock) po =pppox_sk (sk); -if (sk->sk_state & (PPPOX_CONNECTED |PPPOX_BOUND )) { +if (sk->sk_state & (PPPOX_CONNECTED |PPPOX_BOUND |PPPOX_ZOMBIE )) {dev_put (po->pppoe_dev); po->pppoe_dev =NULL ; }
PATCH 95/108 net: small bug on rxhash calculation
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chema Gonzalez <[email protected]>
[ Upstream commit 6862234238e84648c305526af2edd98badcad1e0 ]
In the current rxhash calculation function, while the sorting of the ports/addrs is coherent (you get the same rxhash for packets sharing the same 4-tuple, in both directions), ports and addrs are sorted independently. This implies packets from a connection between the same addresses but crossed ports hash to the same rxhash.
For example, traffic between A=S:l and B=L:s is hashed (in both directions) from {L, S, {s, l}}. The same rxhash is obtained for packets between C=S:s and D=L:l.
This patch ensures that you either swap both addrs and ports, or you swap none. Traffic between A and B, and traffic between C and D, get their rxhash from different sources ({L, S, {l, s}} for A<->B, and {L, S, {s, l}} for C<->D)
The patch is co-written with Eric Dumazet <[email protected]>
--- net/core/dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/core/dev.c +5 -4
@@ -2686,16 +2686,17 @@ ipv6: nhoff += poff;if (pskb_may_pull (skb, nhoff +4 )) { ports.v32 = * (__force u32 *) (skb->data + nhoff); -if (ports.v16[1 ] < ports.v16[0 ]) -swap (ports.v16[0 ], ports.v16[1 ]); skb->l4_rxhash =1 ; } }/* get a consistent hash (same value on both flow directions) */ -if (addr2 < addr1) +if (addr2 < addr1 || + (addr2 == addr1 && + ports.v16[1 ] < ports.v16[0 ])) {swap (addr1, addr2); - +swap (ports.v16[0 ], ports.v16[1 ]); + } hash =jhash_3words (addr1, addr2, ports.v32, hashrnd);if (!hash) hash =1 ;
PATCH 96/108 net: guard tcp_set_keepalive() to tcp sockets
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3e10986d1d698140747fcfc2761ec9cb64c1d582 ]
Its possible to use RAW sockets to get a crash in tcp_set_keepalive() / sk_reset_timer()
Fix is to make sure socket is a SOCK_STREAM one.
--- net/core/sock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/core/sock.c +2 -1
@@ -593,7 +593,8 @@ set_rcvbuf:case SO_KEEPALIVE :#ifdef CONFIG_INET -if (sk->sk_protocol ==IPPROTO_TCP ) +if (sk->sk_protocol ==IPPROTO_TCP && + sk->sk_type ==SOCK_STREAM )tcp_set_keepalive (sk, valbool);#endif sock_valbool_flag (sk,SOCK_KEEPOPEN , valbool);
PATCH 97/108 ipv4: raw: fix icmp_filter()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ab43ed8b7490cb387782423ecf74aeee7237e591 ]
icmp_filter() should not modify its input, or else its caller would need to recompute ip_hdr() if skb->head is reallocated.
Use skb_header_pointer() instead of pskb_may_pull() and change the prototype to make clear both sk and skb are const.
--- net/ipv4/raw.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/ipv4/raw.c +8 -6
@@ -131,18 +131,20 @@ found:* 0 - deliver * 1 - block */ -static __inline__int icmp_filter (struct sock *sk,struct sk_buff *skb) +static int icmp_filter (const struct sock *sk,const struct sk_buff *skb) { -int type; +struct icmphdr _hdr; +const struct icmphdr *hdr; -if (!pskb_may_pull (skb,sizeof (struct icmphdr ))) + hdr =skb_header_pointer (skb,skb_transport_offset (skb), +sizeof (_hdr), &_hdr); +if (!hdr)return 1 ; - type =icmp_hdr (skb)->type; -if (type <32 ) { +if (hdr->type <32 ) {__u32 data =raw_sk (sk)->filter.data; -return ((1 << type) & data) !=0 ; +return ((1U << hdr->type) & data) !=0 ; }/* Do not block unknown ICMP types */
PATCH 98/108 ipv6: raw: fix icmpv6_filter()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 1b05c4b50edbddbdde715c4a7350629819f6655e ]
icmpv6_filter() should not modify its input, or else its caller would need to recompute ipv6_hdr() if skb->head is reallocated.
Use skb_header_pointer() instead of pskb_may_pull() and change the prototype to make clear both sk and skb are const.
Also, if icmpv6 header cannot be found, do not deliver the packet, as we do in IPv4.
--- net/ipv6/raw.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-)
net/ipv6/raw.c +10 -11
@@ -107,21 +107,20 @@ found:* 0 - deliver * 1 - block */ -static __inline__int icmpv6_filter (struct sock *sk,struct sk_buff *skb) +static int icmpv6_filter (const struct sock *sk,const struct sk_buff *skb) { -struct icmp6hdr *icmph; -struct raw6_sock *rp =raw6_sk (sk); - -if (pskb_may_pull (skb,sizeof (struct icmp6hdr ))) { -__u32 *data = &rp->filter.data[0 ]; -int bit_nr; +struct icmp6hdr *_hdr; +const struct icmp6hdr *hdr; - icmph = (struct icmp6hdr *) skb->data; - bit_nr = icmph->icmp6_type; + hdr =skb_header_pointer (skb,skb_transport_offset (skb), +sizeof (_hdr), &_hdr); +if (hdr) { +const __u32 *data = &raw6_sk (sk)->filter.data[0 ]; +unsigned int type = hdr->icmp6_type; -return (data[bit_nr >>5 ] & (1 << (bit_nr &31 ))) !=0 ; +return (data[type >>5 ] & (1U << (type &31 ))) !=0 ; } -return 0 ; +return 1 ; }#if defined(CONFIG_IPV6_MIP6 ) || defined(CONFIG_IPV6_MIP6_MODULE )
PATCH 99/108 ipv6: mip6: fix mip6_mh_filter()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 96af69ea2a83d292238bdba20e4508ee967cf8cb ]
mip6_mh_filter() should not modify its input, or else its caller would need to recompute ipv6_hdr() if skb->head is reallocated.
Use skb_header_pointer() instead of pskb_may_pull()
--- net/ipv6/mip6.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
net/ipv6/mip6.c +11 -9
@@ -84,28 +84,30 @@ static int mip6_mh_len(int type)static int mip6_mh_filter (struct sock *sk,struct sk_buff *skb) { -struct ip6_mh *mh; +struct ip6_mh _hdr; +const struct ip6_mh *mh; -if (!pskb_may_pull (skb, (skb_transport_offset (skb)) +8 ) || - !pskb_may_pull (skb, (skb_transport_offset (skb) + - ((skb_transport_header (skb)[1 ] +1 ) <<3 )))) + mh =skb_header_pointer (skb,skb_transport_offset (skb), +sizeof (_hdr), &_hdr); +if (!mh)return -1 ; - mh = (struct ip6_mh *)skb_transport_header (skb); +if (((mh->ip6mh_hdrlen +1 ) <<3 ) > skb->len) +return -1 ;if (mh->ip6mh_hdrlen <mip6_mh_len (mh->ip6mh_type)) {LIMIT_NETDEBUG (KERN_DEBUG "mip6: MH message too short: %d vs >=%d\n" , mh->ip6mh_hdrlen,mip6_mh_len (mh->ip6mh_type)); -mip6_param_prob (skb,0 , ((&mh->ip6mh_hdrlen) - -skb_network_header (skb))); +mip6_param_prob (skb,0 , offsetof(struct ip6_mh , ip6mh_hdrlen) + +skb_network_header_len (skb));return -1 ; }if (mh->ip6mh_proto !=IPPROTO_NONE ) {LIMIT_NETDEBUG (KERN_DEBUG "mip6: MH invalid payload proto = %d\n" , mh->ip6mh_proto); -mip6_param_prob (skb,0 , ((&mh->ip6mh_proto) - -skb_network_header (skb))); +mip6_param_prob (skb,0 , offsetof(struct ip6_mh , ip6mh_proto) + +skb_network_header_len (skb));return -1 ; }
PATCH 100/108 l2tp: fix a typo in l2tp_eth_dev_recv()
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c0cc88a7627c333de50b07b7c60b1d49d9d2e6cc ]
While investigating l2tp bug, I hit a bug in eth_type_trans(), because not enough bytes were pulled in skb head.
--- net/l2tp/l2tp_eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/l2tp/l2tp_eth.c +1 -1
@@ -132,7 +132,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,printk ("\n" ); } -if (!pskb_may_pull (skb,sizeof (ETH_HLEN ))) +if (!pskb_may_pull (skb,ETH_HLEN )) goto error;secpath_reset (skb);
PATCH 101/108 netrom: copy_datagram_iovec can fail
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Cox <[email protected]>
[ Upstream commit 6cf5c951175abcec4da470c50565cc0afe6cd11d ]
Check for an error from this and if so bail properly.
--- net/netrom/af_netrom.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/netrom/af_netrom.c +6 -1
@@ -1170,7 +1170,12 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock, msg->msg_flags |=MSG_TRUNC ; } -skb_copy_datagram_iovec (skb,0 , msg->msg_iov, copied); + er =skb_copy_datagram_iovec (skb,0 , msg->msg_iov, copied); +if (er <0 ) { +skb_free_datagram (sk, skb); +release_sock (sk); +return er; + }if (sax !=NULL ) { sax->sax25_family =AF_NETROM ;
PATCH 102/108 net: do not disable sg for packets requiring no checksum
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ed Cashin <[email protected]>
[ Upstream commit c0d680e577ff171e7b37dbdb1b1bf5451e851f04 ]
A change in a series of VLAN-related changes appears to have inadvertently disabled the use of the scatter gather feature of network cards for transmission of non-IP ethernet protocols like ATA over Ethernet (AoE). Below is a reference to the commit that introduces a "harmonize_features" function that turns off scatter gather when the NIC does not support hardware checksumming for the ethernet protocol of an sk buff.
commit f01a5236bd4b140198fbcc550f085e8361fd73fa
Author: Jesse Gross <[email protected]>
Date: Sun Jan 9 06:23:31 2011 +0000
net offloading: Generalize netif_get_vlan_features().
The can_checksum_protocol function is not equipped to consider a protocol that does not require checksumming. Calling it for a protocol that requires no checksum is inappropriate.
The patch below has harmonize_features call can_checksum_protocol when the protocol needs a checksum, so that the network layer is not forced to perform unnecessary skb linearization on the transmission of AoE packets. Unnecessary linearization results in decreased performance and increased memory pressure, as reported here:
http://www.spinics.net/lists/linux-mm/msg15184.html
The problem has probably not been widely experienced yet, because only recently has the kernel.org-distributed aoe driver acquired the ability to use payloads of over a page in size, with the patchset recently included in the mm tree:
https://lkml.org/lkml/2012/8/28/140
The coraid.com-distributed aoe driver already could use payloads of greater than a page in size, but its users generally do not use the newest kernels.
--- net/core/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/core/dev.c +2 -1
@@ -2108,7 +2108,8 @@ static bool can_checksum_protocol(unsigned long features, __be16 protocol)static u32 harmonize_features (struct sk_buff *skb,__be16 protocol,u32 features) { -if (!can_checksum_protocol (features, protocol)) { +if (skb->ip_summed !=CHECKSUM_NONE && + !can_checksum_protocol (features, protocol)) { features &= ~NETIF_F_ALL_CSUM ; features &= ~NETIF_F_SG ; }else if (illegal_highdma (skb->dev, skb)) {
PATCH 103/108 aoe: assert AoE packets marked as requiring no checksum
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ed Cashin <[email protected]>
[ Upstream commit 8babe8cc6570ed896b7b596337eb8fe730c3ff45 ]
In order for the network layer to see that AoE requires no checksumming in a generic way, the packets must be marked as requiring no checksum, so we make this requirement explicit with the assertion.
--- drivers/block/aoe/aoecmd.c | 1 + 1 file changed, 1 insertion(+)
drivers/block/aoe/aoecmd.c +1 -0
@@ -35,6 +35,7 @@ new_skb(ulong len)skb_reset_mac_header (skb);skb_reset_network_header (skb); skb->protocol =__constant_htons (ETH_P_AOE ); +skb_checksum_none_assert (skb); }return skb; }
PATCH 104/108 tg3: Fix TSO CAP for 5704 devs w / ASF enabled
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Carlson <[email protected]>
[ Upstream commit cf9ecf4b631f649a964fa611f1a5e8874f2a76db ]
On the earliest TSO capable devices, TSO was accomplished through firmware. The TSO cannot coexist with ASF management firmware though. The tg3 driver determines whether or not ASF is enabled by calling tg3_get_eeprom_hw_cfg(), which checks a particular bit of NIC memory. Commit dabc5c670d3f86d15ee4f42ab38ec5bd2682487d, entitled "tg3: Move TSO_CAPABLE assignment", accidentally moved the code that determines TSO capabilities earlier than the call to tg3_get_eeprom_hw_cfg(). As a consequence, the driver was attempting to determine TSO capabilities before it had all the data it needed to make the decision.
This patch fixes the problem by revisiting and reevaluating the decision after tg3_get_eeprom_hw_cfg() is called.
--- drivers/net/ethernet/broadcom/tg3.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/tg3.c +12 -2
@@ -14013,9 +14013,13 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)if (tg3_flag (tp,HW_TSO_1 ) ||tg3_flag (tp,HW_TSO_2 ) ||tg3_flag (tp,HW_TSO_3 ) || - (tp->fw_needed && !tg3_flag (tp,ENABLE_ASF ))) + tp->fw_needed) { +/* For firmware TSO, assume ASF is disabled. +* We'll disable TSO later if we discover ASF +* is enabled in tg3_get_eeprom_hw_cfg(). +*/ tg3_flag_set (tp,TSO_CAPABLE ); -else { + }else {tg3_flag_clear (tp,TSO_CAPABLE );tg3_flag_clear (tp,TSO_BUG ); tp->fw_needed =NULL ;
@@ -14290,6 +14294,12 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)*/ tg3_get_eeprom_hw_cfg (tp); +if (tp->fw_needed &&tg3_flag (tp,ENABLE_ASF )) { +tg3_flag_clear (tp,TSO_CAPABLE ); +tg3_flag_clear (tp,TSO_BUG ); + tp->fw_needed =NULL ; + } +if (tg3_flag (tp,ENABLE_APE )) {/* Allow reads and writes to the * APE register and memory space.
PATCH 105/108 Bluetooth: Support AR3011 in Acer Iconia Tab W500
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 6eda541d12116b4772baa09d3e8d7b0389df4289 upstream.
Acer used this chip connected via USB:
Bus 005 Device 005: ID 0cf3:3005 Atheros Communications, Inc. AR3011 Bluetooth Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 224 Wireless
bDeviceSubClass 1 Radio Frequency
bDeviceProtocol 1 Bluetooth
bMaxPacketSize0 64
idVendor 0x0cf3 Atheros Communications, Inc.
idProduct 0x3005 AR3011 Bluetooth
bcdDevice 0.01
iManufacturer 0 iProduct 0 iSerial 0 bNumConfigurations 1
--- drivers/bluetooth/ath3k.c | 1 + drivers/bluetooth/btusb.c | 1 + 2 files changed, 2 insertions(+)
drivers/bluetooth/ath3k.c +1 -0
@@ -63,6 +63,7 @@ static struct usb_device_id ath3k_table[] = {/* Atheros AR3011 with sflash firmware*/ { USB_DEVICE(0x0CF3, 0x3002) }, + { USB_DEVICE(0x0CF3, 0xE019) }, { USB_DEVICE(0x13d3, 0x3304) }, { USB_DEVICE(0x0930, 0x0215) }, { USB_DEVICE(0x0489, 0xE03D) },
drivers/bluetooth/btusb.c +1 -0
@@ -125,6 +125,7 @@ static struct usb_device_id blacklist_table[] = {/* Atheros 3011 with sflash firmware */ { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
PATCH 106/108 Bluetooth: add support for atheros 0930:0219
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giancarlo Formicuccia <[email protected]>
commit 6c4ae5c2e7bfbb7d10d73611f69ac8a8609d84fd upstream.
Add support for the AR3012 chip found on the Toshiba Sallite M840-1000-XQ.
usb-devices shows:
T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 5 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0930 ProdID=0219 Rev=00.02 S: Manufacturer=Atheros Communications S: Product=Bluetooth USB Host Controller S: SerialNumber=Alaska Day 2006 C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -78,6 +78,7 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x04CA, 0x3005) }, { USB_DEVICE(0x13d3, 0x3362) }, { USB_DEVICE(0x0CF3, 0xE004) }, + { USB_DEVICE(0x0930, 0x0219) },/* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xE02C) },
@@ -102,6 +103,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, /* Atheros AR5BBU22 with sflash firmware */ { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -140,6 +140,7 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, /* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
PATCH 107/108 Bluetooth: add support for atheros 0489:e057
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Chen <[email protected]>
commit 2096ae6ca647302d50a68aa36cb66a00e7dfac70 upstream.
Add support for the AR3012 chip found on Fioxconn.
usb-devices shows:
T: Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 44 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0489 ProdID=e057 Rev= 0.02
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -79,6 +79,7 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x13d3, 0x3362) }, { USB_DEVICE(0x0CF3, 0xE004) }, { USB_DEVICE(0x0930, 0x0219) }, + { USB_DEVICE(0x0489, 0xe057) },/* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xE02C) },
@@ -104,6 +105,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, /* Atheros AR5BBU22 with sflash firmware */ { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -134,6 +134,7 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, /* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
PATCH 108/108 Bluetooth: Add support for Sony Vaio T-Series
In reply to Ben Hutchings3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yevgeniy Melnichuk <[email protected]>
commit bc21fde2d549d1cb1ebef04016eb7affa43bb5c1 upstream.
Add Sony Vaio T-Series Bluetooth Module( 0x489:0xE036) to the blacklist of btusb module and add it to the ath3k module.
output of cat /sys/kernel/debug/usb/devices
T: Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 5 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e036 Rev= 0.02 S: Manufacturer=Atheros Communications S: Product=Bluetooth USB Host Controller S: SerialNumber=Alaska Day 2006 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -86,6 +86,7 @@ static struct usb_device_id ath3k_table[] = {/* Atheros AR5BBU22 with sflash firmware */ { USB_DEVICE(0x0489, 0xE03C) }, + { USB_DEVICE(0x0489, 0xE036) }, { } /* Terminating entry */ };
@@ -109,6 +110,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {/* Atheros AR5BBU22 with sflash firmware */ { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 }, { }/* Terminating entry */ };
drivers/bluetooth/btusb.c +1 -0
@@ -141,6 +141,7 @@ static struct usb_device_id blacklist_table[] = {/* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, /* Broadcom BCM2035 */ { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
Makefile +2 -2
@@ -1,7 +1,7 @@ VERSION = 3 PATCHLEVEL = 2 -SUBLEVEL = 30 -EXTRAVERSION = +SUBLEVEL = 31 +EXTRAVERSION = -rc1 NAME = Saber-toothed Squirrel # *DOCUMENTATION*
arch/arm/boot/compressed/head.S +1 -0
@@ -648,6 +648,7 @@ __armv7_mmu_cache_on: mcrne p15, 0, r0, c8, c7, 0 @ flush I,D TLBs #endif mrc p15, 0, r0, c1, c0, 0 @ read control reg + bic r0, r0, #1 << 28 @ clear SCTLR.TRE orr r0, r0, #0x5000 @ I-cache enable, RR cache replacement orr r0, r0, #0x003c @ write buffer #ifdef CONFIG_MMU
arch/arm/mach-imx/mach-armadillo5x0.c +2 -1
@@ -517,7 +517,8 @@ static void __init armadillo5x0_init(void)imx31_add_mxc_nand (&armadillo5x0_nand_board_info);/* set NAND page size to 2k if not configured via boot mode pins */ -__raw_writel (__raw_readl (MXC_CCM_RCSR ) | (1 <<30 ),MXC_CCM_RCSR ); +__raw_writel (__raw_readl (mx3_ccm_base +MXC_CCM_RCSR ) | + (1 <<30 ), mx3_ccm_base +MXC_CCM_RCSR );/* RTC */ /* Get RTC IRQ and register the chip */
arch/x86/kernel/alternative.c +1 -1
@@ -160,7 +160,7 @@ static const unsigned char * const k7_nops[ASM_NOP_MAX+2] =#endif #ifdef P6_NOP1 -static const unsigned char __initconst_or_module p6nops[] = +static const unsigned char p6nops[] = {P6_NOP1 , P6_NOP2,
arch/x86/xen/enlighten.c +4 -0
@@ -1289,6 +1289,10 @@ asmlinkage void __init xen_start_kernel(void)/* Make sure ACS will be enabled */ pci_request_acs (); + +/* Avoid searching for BIOS MP tables */ + x86_init.mpparse.find_smp_config = x86_init_noop; + x86_init.mpparse.get_smp_config = x86_init_uint_noop; }#ifdef CONFIG_PCI /* PCI BIOS service won't work from a PV guest. */
arch/x86/xen/setup.c +4 -0
@@ -16,6 +16,7 @@#include <asm/e820.h> #include <asm/setup.h> #include <asm/acpi.h> +#include <asm/numa.h> #include <asm/xen/hypervisor.h> #include <asm/xen/hypercall.h>
@@ -431,4 +432,7 @@ void __init xen_arch_setup(void) boot_option_idle_override =IDLE_HALT ;WARN_ON (set_pm_idle_to_default ());fiddle_vdso (); +#ifdef CONFIG_NUMA + numa_off =1 ; +#endif }
drivers/ata/libata-core.c +1 -0
@@ -4118,6 +4118,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {/* Devices which aren't very happy with higher link speeds */ { "WD My Book", NULL, ATA_HORKAGE_1_5_GBPS, }, + { "Seagate FreeAgent GoFlex", NULL, ATA_HORKAGE_1_5_GBPS, },/* * Devices which choke on SETXFER. Applies only if both the
drivers/block/aoe/aoecmd.c +1 -0
@@ -35,6 +35,7 @@ new_skb(ulong len)skb_reset_mac_header (skb);skb_reset_network_header (skb); skb->protocol =__constant_htons (ETH_P_AOE ); +skb_checksum_none_assert (skb); }return skb; }
drivers/block/cciss_scsi.c +1 -0
@@ -795,6 +795,7 @@ static void complete_scsi_command(CommandList_struct *c, int timeout, }break ;case CMD_PROTOCOL_ERR : + cmd->result =DID_ERROR <<16 ;dev_warn (&h->pdev->dev,"%p has protocol error\n" , c);break ;
drivers/block/nbd.c +9 -0
@@ -445,6 +445,14 @@ static void nbd_clear_que(struct nbd_device *lo) req->errors++;nbd_end_request (req); } + +while (!list_empty (&lo->waiting_queue)) { + req = list_entry(lo->waiting_queue.next, struct request, + queuelist); +list_del_init (&req->queuelist); + req->errors++; +nbd_end_request (req); + } }
@@ -594,6 +602,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo, lo->file =NULL ;nbd_clear_que (lo);BUG_ON (!list_empty (&lo->queue_head)); +BUG_ON (!list_empty (&lo->waiting_queue));if (file)fput (file);return 0 ;
drivers/bluetooth/ath3k.c +7 -0
@@ -62,6 +62,7 @@ static struct usb_device_id ath3k_table[] = {/* Atheros AR3011 with sflash firmware*/ { USB_DEVICE(0x0CF3, 0x3002) }, + { USB_DEVICE(0x0CF3, 0xE019) }, { USB_DEVICE(0x13d3, 0x3304) }, { USB_DEVICE(0x0930, 0x0215) }, { USB_DEVICE(0x0489, 0xE03D) },
@@ -76,12 +77,15 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x04CA, 0x3005) }, { USB_DEVICE(0x13d3, 0x3362) }, { USB_DEVICE(0x0CF3, 0xE004) }, + { USB_DEVICE(0x0930, 0x0219) }, + { USB_DEVICE(0x0489, 0xe057) },/* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xE02C) },/* Atheros AR5BBU22 with sflash firmware */ { USB_DEVICE(0x0489, 0xE03C) }, + { USB_DEVICE(0x0489, 0xE036) }, { } /* Terminating entry */ };
@@ -100,9 +104,12 @@ static struct usb_device_id ath3k_blist_tbl[] = { { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, /* Atheros AR5BBU22 with sflash firmware */ { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 }, { } /* Terminating entry */ };
drivers/bluetooth/btusb.c +10 -4
@@ -60,6 +60,9 @@ static struct usb_device_id btusb_table[] = {/* Generic Bluetooth USB device */ { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, +/* Apple-specific (Broadcom) devices */ + { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) }, +/* Broadcom SoftSailing reporting vendor specific */ { USB_DEVICE(0x0a5c, 0x21e1) },
@@ -102,15 +105,14 @@ static struct usb_device_id btusb_table[] = {/* Broadcom BCM20702A0 */ { USB_DEVICE(0x0489, 0xe042) }, - { USB_DEVICE(0x0a5c, 0x21e3) }, - { USB_DEVICE(0x0a5c, 0x21e6) }, - { USB_DEVICE(0x0a5c, 0x21e8) }, - { USB_DEVICE(0x0a5c, 0x21f3) }, { USB_DEVICE(0x413c, 0x8197) },/* Foxconn - Hon Hai */ { USB_DEVICE(0x0489, 0xe033) }, +/*Broadcom devices with vendor specific id */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }, + { } /* Terminating entry */ };
@@ -125,6 +127,7 @@ static struct usb_device_id blacklist_table[] = {/* Atheros 3011 with sflash firmware */ { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
@@ -139,12 +142,15 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, /* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, /* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, /* Broadcom BCM2035 */ { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
drivers/cpufreq/powernow-k8.c +34 -29
114 lines not on this page · raw message
drivers/dma/at_hdmac.c +12 -1
@@ -678,7 +678,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, flags);if (unlikely (!atslave || !sg_len)) { -dev_dbg (chan2dev (chan),"prep_dma_memcpy: length is zero!\n" ); +dev_dbg (chan2dev (chan),"prep_slave_sg: sg length is zero!\n" );return NULL ; }
@@ -706,6 +706,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, mem =sg_dma_address (sg); len =sg_dma_len (sg); +if (unlikely (!len)) { +dev_dbg (chan2dev (chan), +"prep_slave_sg: sg(%d) data length is zero\n" , i); + goto err; + } mem_width =2 ;if (unlikely (mem &3 || len &3 )) mem_width =0 ;
@@ -740,6 +745,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, mem =sg_dma_address (sg); len =sg_dma_len (sg); +if (unlikely (!len)) { +dev_dbg (chan2dev (chan), +"prep_slave_sg: sg(%d) data length is zero\n" , i); + goto err; + } mem_width =2 ;if (unlikely (mem &3 || len &3 )) mem_width =0 ;
@@ -773,6 +783,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, err_desc_get:dev_err (chan2dev (chan),"not enough descriptors available\n" ); +err:atc_desc_put (atchan, first);return NULL ; }
drivers/dma/pl330.c +5 -0
@@ -858,6 +858,11 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)/* Initialize channel parameters */ num_chan =max (pdat ? pdat->nr_valid_peri :0 , (u8 )pi->pcfg.num_chan); pdmac->peripherals =kzalloc (num_chan *sizeof (*pch),GFP_KERNEL ); +if (!pdmac->peripherals) { + ret = -ENOMEM ; +dev_err (&adev->dev,"unable to allocate pdmac->peripherals\n" ); + goto probe_err4; + }for (i =0 ; i < num_chan; i++) { pch = &pdmac->peripherals[i];
drivers/edac/sb_edac.c +4 -3
@@ -554,7 +554,8 @@ static int get_dimm_config(const struct mem_ctl_info *mci) {struct sbridge_pvt *pvt = mci->pvt_info;struct csrow_info *csr; -int i, j, banks, ranks, rows, cols, size, npages; +unsigned i, j, banks, ranks, rows, cols, npages; +u64 size;int csrow =0 ;unsigned long last_page =0 ;u32 reg;
@@ -626,10 +627,10 @@ static int get_dimm_config(const struct mem_ctl_info *mci) cols =numcol (mtr);/* DDR3 has 8 I/O banks */ - size = (rows * cols * banks * ranks) >> (20 -3 ); + size = ((u64 )rows * cols * banks * ranks) >> (20 -3 ); npages =MiB_TO_PAGES (size); -debugf0 ("mc#%d: channel %d, dimm %d, %d Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n" , +debugf0 ("mc#%d: channel %d, dimm %d, %Ld Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n" , pvt->sbridge_dev->mc, i, j, size, npages, banks, ranks, rows, cols);
drivers/gpio/gpio-lpc32xx.c +5 -0
@@ -295,6 +295,7 @@ static int lpc32xx_gpio_dir_output_p012(struct gpio_chip *chip, unsigned pin, {struct lpc32xx_gpio_chip *group =to_lpc32xx_gpio (chip); +__set_gpio_level_p012 (group, pin, value);__set_gpio_dir_p012 (group, pin,0 );return 0 ;
@@ -305,6 +306,7 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin, {struct lpc32xx_gpio_chip *group =to_lpc32xx_gpio (chip); +__set_gpio_level_p3 (group, pin, value);__set_gpio_dir_p3 (group, pin,0 );return 0 ;
@@ -313,6 +315,9 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin,static int lpc32xx_gpio_dir_out_always (struct gpio_chip *chip,unsigned pin,int value) { +struct lpc32xx_gpio_chip *group =to_lpc32xx_gpio (chip); + +__set_gpo_level_p3 (group, pin, value);return 0 ; }
drivers/gpu/drm/i915/i915_gem.c +2 -1
@@ -3357,7 +3357,8 @@ i915_gem_object_pin(struct drm_i915_gem_object *obj,struct drm_i915_private *dev_priv = dev->dev_private;int ret; -BUG_ON (obj->pin_count ==DRM_I915_GEM_OBJECT_MAX_PIN_COUNT ); +if (WARN_ON (obj->pin_count ==DRM_I915_GEM_OBJECT_MAX_PIN_COUNT )) +return -EBUSY ;WARN_ON (i915_verify_lists (dev));if (obj->gtt_space !=NULL ) {
drivers/gpu/drm/i915/intel_hdmi.c +1 -1
@@ -271,7 +271,7 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)u32 temp;u32 enable_bits =SDVO_ENABLE ; -if (intel_hdmi->has_audio) +if (intel_hdmi->has_audio || mode !=DRM_MODE_DPMS_ON ) enable_bits |=SDVO_AUDIO_ENABLE ; temp =I915_READ (intel_hdmi->sdvox_reg);
drivers/gpu/drm/radeon/atombios_crtc.c +20 -106
169 lines not on this page · raw message
drivers/hid/hid-core.c +11 -5
@@ -1026,7 +1026,7 @@ static struct hid_report *hid_get_report(struct hid_report_enum *report_enum,return report; } -void hid_report_raw_event (struct hid_device *hid,int type,u8 *data,int size, +int hid_report_raw_event (struct hid_device *hid,int type,u8 *data,int size,int interrupt) {struct hid_report_enum *report_enum = hid->report_enum + type;
@@ -1034,10 +1034,11 @@ void hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,unsigned int a;int rsize, csize = size;u8 *cdata = data; +int ret =0 ; report =hid_get_report (report_enum, data);if (!report) -return ; + goto out;if (report_enum->numbered) { cdata++;
@@ -1057,14 +1058,19 @@ void hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,if ((hid->claimed &HID_CLAIMED_HIDDEV ) && hid->hiddev_report_event) hid->hiddev_report_event (hid, report); -if (hid->claimed &HID_CLAIMED_HIDRAW ) -hidraw_report_event (hid, data, size); +if (hid->claimed &HID_CLAIMED_HIDRAW ) { + ret =hidraw_report_event (hid, data, size); +if (ret) + goto out; + }for (a =0 ; a < report->maxfield; a++)hid_input_field (hid, report->field[a], cdata, interrupt);if (hid->claimed &HID_CLAIMED_INPUT )hidinput_report_event (hid, report); +out: +return ret; }EXPORT_SYMBOL_GPL (hid_report_raw_event);
@@ -1141,7 +1147,7 @@ nomem: } } -hid_report_raw_event (hid, type, data, size, interrupt); + ret =hid_report_raw_event (hid, type, data, size, interrupt); unlock:up (&hid->driver_lock);
drivers/hid/hid-logitech-dj.c +69 -14
138 lines not on this page · raw message
drivers/hid/hid-logitech-dj.h +1 -0
@@ -101,6 +101,7 @@ struct dj_receiver_dev {struct work_struct work;struct kfifo notif_fifo;spinlock_t lock; +bool querying_devices; };struct dj_device {
drivers/hid/hidraw.c +57 -50
186 lines not on this page · raw message
drivers/hwmon/ad7314.c +8 -0
@@ -96,10 +96,18 @@ static ssize_t ad7314_show_temperature(struct device *dev, } } +static ssize_t ad7314_show_name (struct device *dev, +struct device_attribute *devattr,char *buf) +{ +return sprintf (buf,"%s\n" ,to_spi_device (dev)->modalias); +} + +static DEVICE_ATTR(name, S_IRUGO, ad7314_show_name, NULL); static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, ad7314_show_temperature, NULL, 0);static struct attribute *ad7314_attributes[] = { + &dev_attr_name.attr, &sensor_dev_attr_temp1_input.dev_attr.attr,NULL , };
drivers/hwmon/ads7871.c +9 -0
@@ -133,6 +133,12 @@ static ssize_t show_voltage(struct device *dev, } } +static ssize_t ads7871_show_name (struct device *dev, +struct device_attribute *devattr,char *buf) +{ +return sprintf (buf,"%s\n" ,to_spi_device (dev)->modalias); +} + static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_voltage, NULL, 0); static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_voltage, NULL, 1); static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_voltage, NULL, 2);
@@ -142,6 +148,8 @@ static SENSOR_DEVICE_ATTR(in5_input, S_IRUGO, show_voltage, NULL, 5); static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_voltage, NULL, 6); static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_voltage, NULL, 7); +static DEVICE_ATTR(name, S_IRUGO, ads7871_show_name, NULL); +static struct attribute *ads7871_attributes[] = { &sensor_dev_attr_in0_input.dev_attr.attr, &sensor_dev_attr_in1_input.dev_attr.attr,
@@ -151,6 +159,7 @@ static struct attribute *ads7871_attributes[] = { &sensor_dev_attr_in5_input.dev_attr.attr, &sensor_dev_attr_in6_input.dev_attr.attr, &sensor_dev_attr_in7_input.dev_attr.attr, + &dev_attr_name.attr, NULL };
drivers/hwmon/fam15h_power.c +13 -2
@@ -128,12 +128,12 @@ static bool __devinit fam15h_power_is_internal_node0(struct pci_dev *f4)* counter saturations resulting in bogus power readings. * We correct this value ourselves to cope with older BIOSes. */ -static DEFINE_PCI_DEVICE_TABLE (affected_device) = { +static const struct pci_device_id affected_device[] = { {PCI_VDEVICE (AMD ,PCI_DEVICE_ID_AMD_15H_NB_F4 ) }, {0 } }; -static void __devinit tweak_runavg_range (struct pci_dev *pdev) +static void tweak_runavg_range (struct pci_dev *pdev) {u32 val;
@@ -157,6 +157,16 @@ static void __devinit tweak_runavg_range(struct pci_dev *pdev) REG_TDP_RUNNING_AVERAGE, val); } +#ifdef CONFIG_PM +static int fam15h_power_resume (struct pci_dev *pdev) +{ +tweak_runavg_range (pdev); +return 0 ; +} +#else +#define fam15h_power_resume NULL +#endif +static void __devinit fam15h_power_init_data (struct pci_dev *f4,struct fam15h_power_data *data) {
@@ -255,6 +265,7 @@ static struct pci_driver fam15h_power_driver = { .id_table = fam15h_power_id_table, .probe = fam15h_power_probe, .remove = __devexit_p(fam15h_power_remove), + .resume = fam15h_power_resume, };static int __init fam15h_power_init (void )
drivers/input/serio/i8042-x86ia64io.h +6 -0
@@ -335,6 +335,12 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { }, { .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), + DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"), + }, + }, + { + .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"ALIENWARE" ), DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"), },
drivers/iommu/intr_remapping.c +13 -5
@@ -752,6 +752,7 @@ int __init parse_ioapics_under_ir(void) {struct dmar_drhd_unit *drhd;int ir_supported =0 ; +int ioapic_idx;for_each_drhd_unit (drhd) {struct intel_iommu *iommu = drhd->iommu;
@@ -764,13 +765,20 @@ int __init parse_ioapics_under_ir(void) } } -if (ir_supported && ir_ioapic_num != nr_ioapics) { -printk (KERN_WARNING -"Not all IO-APIC's listed under remapping hardware\n" ); -return -1 ; +if (!ir_supported) +return 0 ; + +for (ioapic_idx =0 ; ioapic_idx < nr_ioapics; ioapic_idx++) { +int ioapic_id =mpc_ioapic_id (ioapic_idx); +if (!map_ioapic_to_ir (ioapic_id)) { +pr_err (FW_BUG "ioapic %d has no mapping iommu, " +"interrupt remapping will be disabled\n" , + ioapic_id); +return -1 ; + } } -return ir_supported; +return 1 ; }int __init ir_dev_scope_init (void )
drivers/md/dm-table.c +22 -4
@@ -1350,17 +1350,25 @@ static int device_is_nonrot(struct dm_target *ti, struct dm_dev *dev,return q &&blk_queue_nonrot (q); } -static bool dm_table_is_nonrot (struct dm_table *t) +static int device_is_not_random (struct dm_target *ti,struct dm_dev *dev, +sector_t start,sector_t len,void *data) +{ +struct request_queue *q =bdev_get_queue (dev->bdev); + +return q && !blk_queue_add_random (q); +} + +static bool dm_table_all_devices_attribute (struct dm_table *t, +iterate_devices_callout_fn func) {struct dm_target *ti;unsigned i =0 ; -/* Ensure that all underlying device are non-rotational. */ while (i <dm_table_get_num_targets (t)) { ti =dm_table_get_target (t, i++);if (!ti->type->iterate_devices || - !ti->type->iterate_devices (ti, device_is_nonrot,NULL )) + !ti->type->iterate_devices (ti, func,NULL ))return 0 ; }
@@ -1392,7 +1400,8 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,if (!dm_table_discard_zeroes_data (t)) q->limits.discard_zeroes_data =0 ; -if (dm_table_is_nonrot (t)) +/* Ensure that all underlying devices are non-rotational. */ +if (dm_table_all_devices_attribute (t, device_is_nonrot))queue_flag_set_unlocked (QUEUE_FLAG_NONROT , q);else queue_flag_clear_unlocked (QUEUE_FLAG_NONROT , q);
@@ -1400,6 +1409,15 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,dm_table_set_integrity (t);/* +* Determine whether or not this queue's I/O timings contribute +* to the entropy pool, Only request-based targets use this. +* Clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not +* have it set. +*/ +if (blk_queue_add_random (q) &&dm_table_all_devices_attribute (t, device_is_not_random)) +queue_flag_clear_unlocked (QUEUE_FLAG_ADD_RANDOM , q); + +/* * QUEUE_FLAG_STACKABLE must be set after all queue settings are * visible to other CPUs because, once the flag is set, incoming bios * are processed by request-based dm, which refers to the queue
drivers/md/dm.c +38 -18
91 lines not on this page · raw message
drivers/md/raid10.c +5 -3
@@ -1226,14 +1226,16 @@ static int enough(struct r10conf *conf, int ignore)do {int n = conf->copies;int cnt =0 ; +int this = first;while (n--) { -if (conf->mirrors[first].rdev && - first != ignore) +if (conf->mirrors[this].rdev && + this != ignore) cnt++; - first = (first+1 ) % conf->raid_disks; + this = (this+1 ) % conf->raid_disks; }if (cnt ==0 )return 0 ; + first = (first + conf->near_copies) % conf->raid_disks; }while (first !=0 );return 1 ; }
drivers/mmc/host/sdhci.c +3 -2
@@ -2712,8 +2712,9 @@ int sdhci_add_host(struct sdhci_host *host) mmc_card_is_removable(mmc)) mmc->caps |=MMC_CAP_NEEDS_POLL ; -/* UHS-I mode(s) supported by the host controller. */ -if (host->version >=SDHCI_SPEC_300 ) +/* Any UHS-I mode in caps implies SDR12 and SDR25 support. */ +if (caps[1 ] & (SDHCI_SUPPORT_SDR104 |SDHCI_SUPPORT_SDR50 | +SDHCI_SUPPORT_DDR50 )) mmc->caps |=MMC_CAP_UHS_SDR12 |MMC_CAP_UHS_SDR25 ;/* SDR104 supports also implies SDR50 support */
drivers/net/can/janz-ican3.c +1 -3
@@ -1250,7 +1250,6 @@ static irqreturn_t ican3_irq(int irq, void *dev_id)*/ static int ican3_reset_module (struct ican3_dev *mod) { -u8 val =1 << mod->num;unsigned long start;u8 runold, runnew;
@@ -1264,8 +1263,7 @@ static int ican3_reset_module(struct ican3_dev *mod) runold =ioread8 (mod->dpm +TARGET_RUNNING );/* reset the module */ -iowrite8 (val, &mod->ctrl->reset_assert); -iowrite8 (val, &mod->ctrl->reset_deassert); +iowrite8 (0x00 , &mod->dpmctrl->hwreset);/* wait until the module has finished resetting and is running */ start = jiffies;
drivers/net/can/ti_hecc.c +1 -1
@@ -971,12 +971,12 @@ static int __devexit ti_hecc_remove(struct platform_device *pdev)struct net_device *ndev =platform_get_drvdata (pdev);struct ti_hecc_priv *priv =netdev_priv (ndev); +unregister_candev (ndev);clk_disable (priv->clk);clk_put (priv->clk); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );iounmap (priv->base);release_mem_region (res->start,resource_size (res)); -unregister_candev (ndev);free_candev (ndev);platform_set_drvdata (pdev,NULL );
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +7 -5
@@ -554,14 +554,16 @@ static inline void bnx2x_set_skb_rxhash(struct bnx2x *bp, union eth_rx_cqe *cqe,static void bnx2x_csum_validate (struct sk_buff *skb,union eth_rx_cqe *cqe,struct bnx2x_fastpath *fp) { -/* Do nothing if no IP/L4 csum validation was done */ - +/* Do nothing if no L4 csum validation was done. +* We do not check whether IP csum was validated. For IPv4 we assume +* that if the card got as far as validating the L4 csum, it also +* validated the IP csum. IPv6 has no IP csum. +*/ if (cqe->fast_path_cqe.status_flags & - (ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG | -ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG )) +ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG )return ; -/* If both IP/L4 validation were done, check if an error was found. */ +/* If L4 validation was done, check if an error was found. */ if (cqe->fast_path_cqe.type_error_flags & (ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG |
drivers/net/ethernet/broadcom/tg3.c +12 -2
@@ -14013,9 +14013,13 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)if (tg3_flag (tp,HW_TSO_1 ) ||tg3_flag (tp,HW_TSO_2 ) ||tg3_flag (tp,HW_TSO_3 ) || - (tp->fw_needed && !tg3_flag (tp,ENABLE_ASF ))) + tp->fw_needed) { +/* For firmware TSO, assume ASF is disabled. +* We'll disable TSO later if we discover ASF +* is enabled in tg3_get_eeprom_hw_cfg(). +*/ tg3_flag_set (tp,TSO_CAPABLE ); -else { + }else {tg3_flag_clear (tp,TSO_CAPABLE );tg3_flag_clear (tp,TSO_BUG ); tp->fw_needed =NULL ;
@@ -14290,6 +14294,12 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)*/ tg3_get_eeprom_hw_cfg (tp); +if (tp->fw_needed &&tg3_flag (tp,ENABLE_ASF )) { +tg3_flag_clear (tp,TSO_CAPABLE ); +tg3_flag_clear (tp,TSO_BUG ); + tp->fw_needed =NULL ; + } +if (tg3_flag (tp,ENABLE_APE )) {/* Allow reads and writes to the * APE register and memory space.
drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c +4 -0
@@ -1351,6 +1351,10 @@ static void netxen_mask_aer_correctable(struct netxen_adapter *adapter)struct pci_dev *root = pdev->bus->self;u32 aer_pos; +/* root bus? */ +if (!root) +return ; +if (adapter->ahw.board_type !=NETXEN_BRDTYPE_P3_4_GB_MM && adapter->ahw.board_type !=NETXEN_BRDTYPE_P3_10G_TP )return ;
drivers/net/ethernet/ti/davinci_cpdma.c +1 -0
@@ -851,6 +851,7 @@ int cpdma_chan_stop(struct cpdma_chan *chan) next_dma =desc_read (desc, hw_next); chan->head =desc_from_phys (pool, next_dma); + chan->count--; chan->stats.teardown_dequeue++;/* issue callback without locks held */
drivers/net/ppp/pppoe.c +1 -1
@@ -576,7 +576,7 @@ static int pppoe_release(struct socket *sock) po =pppox_sk (sk); -if (sk->sk_state & (PPPOX_CONNECTED |PPPOX_BOUND )) { +if (sk->sk_state & (PPPOX_CONNECTED |PPPOX_BOUND |PPPOX_ZOMBIE )) {dev_put (po->pppoe_dev); po->pppoe_dev =NULL ; }
drivers/net/usb/asix.c +4 -0
@@ -1648,6 +1648,10 @@ static const struct usb_device_id products [] = { USB_DEVICE (0x2001, 0x3c05), .driver_info = (unsigned long ) &ax88772_info, }, { +// DLink DUB-E100 H/W Ver C1 +USB_DEVICE (0x2001 ,0x1a02 ), + .driver_info = (unsigned long) &ax88772_info, +}, {// Linksys USB1000 USB_DEVICE (0x1737 ,0x0039 ), .driver_info = (unsigned long) &ax88178_info,
drivers/net/usb/sierra_net.c +1 -1
@@ -678,7 +678,7 @@ static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)return -EIO ; } - *datap = *attrdata; + *datap =le16_to_cpu (*attrdata);kfree (attrdata);return result;
drivers/net/wan/ixp4xx_hss.c +1 -0
@@ -10,6 +10,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt +#include <linux/module.h> #include <linux/bitops.h> #include <linux/cdev.h> #include <linux/dma-mapping.h>
drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c +16 -10
@@ -775,8 +775,11 @@ static void brcmf_c_arp_offload_set(struct brcmf_pub *drvr, int arp_mode) {char iovbuf[32 ];int retcode; +__le32 arp_mode_le; -brcmf_c_mkiovar ("arp_ol" , (char *)&arp_mode,4 , iovbuf,sizeof (iovbuf)); + arp_mode_le =cpu_to_le32 (arp_mode); +brcmf_c_mkiovar ("arp_ol" , (char *)&arp_mode_le,4 , iovbuf, +sizeof (iovbuf)); retcode =brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf)); retcode = retcode >=0 ?0 : retcode;
@@ -792,8 +795,11 @@ static void brcmf_c_arp_offload_enable(struct brcmf_pub *drvr, int arp_enable) {char iovbuf[32 ];int retcode; +__le32 arp_enable_le; -brcmf_c_mkiovar ("arpoe" , (char *)&arp_enable,4 , + arp_enable_le =cpu_to_le32 (arp_enable); + +brcmf_c_mkiovar ("arpoe" , (char *)&arp_enable_le,4 , iovbuf,sizeof (iovbuf)); retcode =brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf));
@@ -814,10 +820,10 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)char buf[128 ], *ptr;u32 dongle_align =BRCMF_SDALIGN ;u32 glom =0 ; -u32 roaming =1 ; -uint bcn_timeout =3 ; -int scan_assoc_time =40 ; -int scan_unassoc_time =40 ; +__le32 roaming_le =cpu_to_le32 (1 ); +__le32 bcn_timeout_le =cpu_to_le32 (3 ); +__le32 scan_assoc_time_le =cpu_to_le32 (40 ); +__le32 scan_unassoc_time_le =cpu_to_le32 (40 );int i;brcmf_os_proto_block (drvr);
@@ -852,14 +858,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)/* Setup timeout if Beacons are lost and roam is off to report link down */ -brcmf_c_mkiovar ("bcn_timeout" , (char *)&bcn_timeout,4 , iovbuf, +brcmf_c_mkiovar ("bcn_timeout" , (char *)&bcn_timeout_le,4 , iovbuf,sizeof (iovbuf));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf));/* Enable/Disable build-in roaming to allowed ext supplicant to take of romaing */ -brcmf_c_mkiovar ("roam_off" , (char *)&roaming,4 , +brcmf_c_mkiovar ("roam_off" , (char *)&roaming_le,4 , iovbuf,sizeof (iovbuf));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_VAR , iovbuf,sizeof (iovbuf));
@@ -874,9 +880,9 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr) sizeof(iovbuf));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_SCAN_CHANNEL_TIME , - (char *)&scan_assoc_time,sizeof (scan_assoc_time)); + (char *)&scan_assoc_time_le,sizeof (scan_assoc_time_le));brcmf_proto_cdc_set_dcmd (drvr,0 ,BRCMF_C_SET_SCAN_UNASSOC_TIME , - (char *)&scan_unassoc_time,sizeof (scan_unassoc_time)); + (char *)&scan_unassoc_time_le,sizeof (scan_unassoc_time_le));/* Set and enable ARP offload feature */ brcmf_c_arp_offload_set (drvr,BRCMF_ARPOL_MODE );
drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c +4 -2
@@ -498,8 +498,10 @@ static void wl_iscan_prep(struct brcmf_scan_params_le *params_le, params_le->active_time =cpu_to_le32 (-1 ); params_le->passive_time =cpu_to_le32 (-1 ); params_le->home_time =cpu_to_le32 (-1 ); -if (ssid && ssid->SSID_len) -memcpy (¶ms_le->ssid_le, ssid,sizeof (struct brcmf_ssid )); +if (ssid && ssid->SSID_len) { + params_le->ssid_le.SSID_len =cpu_to_le32 (ssid->SSID_len); +memcpy (¶ms_le->ssid_le.SSID, ssid->SSID, ssid->SSID_len); + } } static s32
drivers/net/wireless/rtlwifi/rtl8192ce/def.h +1 -0
@@ -117,6 +117,7 @@#define CHIP_VER_B BIT(4)#define CHIP_92C_BITMASK BIT(0) +#define CHIP_UNKNOWN BIT(7)#define CHIP_92C_1T2R 0x03#define CHIP_92C 0x01#define CHIP_88C 0x00
drivers/net/wireless/rtlwifi/rtl8192ce/hw.c +10 -2
@@ -1001,8 +1001,16 @@ static enum version_8192c _rtl92ce_read_chip_version(struct ieee80211_hw *hw) version = (value32 &TYPE_ID ) ?VERSION_A_CHIP_92C :VERSION_A_CHIP_88C ; }else { - version = (value32 &TYPE_ID ) ?VERSION_B_CHIP_92C : -VERSION_B_CHIP_88C ; + version = (enum version_8192c ) (CHIP_VER_B | + ((value32 &TYPE_ID ) ?CHIP_92C_BITMASK :0 ) | + ((value32 &VENDOR_ID ) ?CHIP_VENDOR_UMC :0 )); +if ((!IS_CHIP_VENDOR_UMC (version)) && (value32 & +CHIP_VER_RTL_MASK )) { + version = (enum version_8192c )(version | + ((((value32 &CHIP_VER_RTL_MASK ) ==BIT (12 )) + ?CHIP_VENDOR_UMC_B_CUT :CHIP_UNKNOWN ) | +CHIP_VENDOR_UMC )); + } }switch (version) {
drivers/net/wireless/rtlwifi/rtl8192ce/sw.c +5 -3
@@ -165,12 +165,14 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)/* request fw */ if (IS_VENDOR_UMC_A_CUT (rtlhal->version) && - !IS_92C_SERIAL (rtlhal->version)) + !IS_92C_SERIAL (rtlhal->version)) { fw_name ="rtlwifi/rtl8192cfwU.bin" ; -else if (IS_81xxC_VENDOR_UMC_B_CUT (rtlhal->version)) + }else if (IS_81xxC_VENDOR_UMC_B_CUT (rtlhal->version)) { fw_name ="rtlwifi/rtl8192cfwU_B.bin" ; -else +pr_info ("****** This B_CUT device may not work with kernels 3.6 and earlier\n" ); + }else { fw_name = rtlpriv->cfg->fw_name; + } err =request_firmware (&firmware, fw_name, rtlpriv->io.dev);if (err) { RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
drivers/pci/hotplug/acpiphp_glue.c +9 -4
@@ -132,6 +132,15 @@ register_slot(acpi_handle handle, u32 lvl, void *context, void **rv)if (!acpi_pci_check_ejectable (pbus, handle) && !is_dock_device (handle))return AE_OK ; + status =acpi_evaluate_integer (handle,"_ADR" ,NULL , &adr); +if (ACPI_FAILURE (status)) { +warn ("can't evaluate _ADR (%#x)\n" , status); +return AE_OK ; + } + + device = (adr >>16 ) &0xffff ; + function = adr &0xffff ; + pdev = pbus->self;if (pdev &&pci_is_pcie (pdev)) { tmp =acpi_find_root_bridge_handle (pdev);
@@ -144,10 +153,6 @@ register_slot(acpi_handle handle, u32 lvl, void *context, void **rv) } } -acpi_evaluate_integer (handle,"_ADR" ,NULL , &adr); - device = (adr >>16 ) &0xffff ; - function = adr &0xffff ; - newfunc =kzalloc (sizeof (struct acpiphp_func ),GFP_KERNEL );if (!newfunc)return AE_NO_MEMORY ;
drivers/platform/x86/asus-laptop.c +4 -4
@@ -823,9 +823,9 @@ static ssize_t show_infos(struct device *dev,* The significance of others is yet to be found. * If we don't find the method, we assume the device are present. */ - rv =acpi_evaluate_integer (asus->handle,"HRWS" ,NULL , &temp); + rv =acpi_evaluate_integer (asus->handle,"HWRS" ,NULL , &temp);if (!ACPI_FAILURE (rv)) - len +=sprintf (page + len,"HRWS value : %#x\n" , + len +=sprintf (page + len,"HWRS value : %#x\n" , (uint ) temp);/* * Another value for userspace: the ASYM method returns 0x02 for
@@ -1660,9 +1660,9 @@ static int asus_laptop_get_info(struct asus_laptop *asus)* The significance of others is yet to be found. */ status = -acpi_evaluate_integer (asus->handle,"HRWS" ,NULL , &hwrs_result); +acpi_evaluate_integer (asus->handle,"HWRS" ,NULL , &hwrs_result);if (!ACPI_FAILURE (status)) -pr_notice (" HRWS returned %x" , (int )hwrs_result); +pr_notice (" HWRS returned %x" , (int )hwrs_result);if (!acpi_check_handle (asus->handle,METHOD_WL_STATUS ,NULL )) asus->have_rsts = true;
drivers/rtc/rtc-twl.c +5 -0
@@ -462,6 +462,11 @@ static int __devinit twl_rtc_probe(struct platform_device *pdev) goto out1; } +/* ensure interrupts are disabled, bootloaders can be strange */ + ret =twl_rtc_write_u8 (0 ,REG_RTC_INTERRUPTS_REG ); +if (ret <0 ) +dev_warn (&pdev->dev,"unable to disable interrupt\n" ); +/* init cached IRQ enable bits */ ret =twl_rtc_read_u8 (&rtc_irq_bits,REG_RTC_INTERRUPTS_REG );if (ret <0 )
drivers/scsi/bnx2i/bnx2i_hwi.c +3 -0
@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)int rc =0 ;u64 mask64; +memset (&iscsi_init,0x00 ,sizeof (struct iscsi_kwqe_init1 )); +memset (&iscsi_init2,0x00 ,sizeof (struct iscsi_kwqe_init2 )); +bnx2i_adjust_qp_size (hba); iscsi_init.flags =
drivers/scsi/hpsa.c +2 -1
@@ -1213,8 +1213,9 @@ static void complete_scsi_command(struct CommandList *cp) }break ;case CMD_PROTOCOL_ERR : + cmd->result =DID_ERROR <<16 ;dev_warn (&h->pdev->dev,"cp %p has " -"protocol error \n" , cp); +"protocol error\n" , cp);break ;case CMD_HARDWARE_ERR : cmd->result =DID_ERROR <<16 ;
drivers/scsi/mpt2sas/mpt2sas_base.c +7 -0
@@ -1156,6 +1156,13 @@ _base_check_enable_msix(struct MPT2SAS_ADAPTER *ioc)u16 message_control; +/* Check whether controller SAS2008 B0 controller, +if it is SAS2008 B0 controller use IO-APIC instead of MSIX */ +if (ioc->pdev->device ==MPI2_MFGPAGE_DEVID_SAS2008 && + ioc->pdev->revision ==0x01 ) { +return -EINVAL ; + } + base =pci_find_capability (ioc->pdev,PCI_CAP_ID_MSIX );if (!base) { dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not "
drivers/target/target_core_transport.c +7 -2
@@ -3039,15 +3039,20 @@ static int transport_generic_cmd_sequencer(/* Returns CHECK_CONDITION + INVALID_CDB_FIELD */ goto out_invalid_cdb_field; } - +/* +* For the overflow case keep the existing fabric provided +* ->data_length. Otherwise for the underflow case, reset +* ->data_length to the smaller SCSI expected data transfer +* length. +*/ if (size > cmd->data_length) { cmd->se_cmd_flags |=SCF_OVERFLOW_BIT ; cmd->residual_count = (size - cmd->data_length); }else { cmd->se_cmd_flags |=SCF_UNDERFLOW_BIT ; cmd->residual_count = (cmd->data_length - size); + cmd->data_length = size; } - cmd->data_length = size; }/* reject any command that we don't have a handler for */
drivers/tty/serial/pch_uart.c +13 -6
@@ -236,6 +236,9 @@ struct eg20t_port {int tx_dma_use;void *rx_buf_virt;dma_addr_t rx_buf_dma; + +/* protect the eg20t_port private structure and io access to membase */ +spinlock_t lock; };/**
@@ -964,7 +967,7 @@ static irqreturn_t pch_uart_interrupt(int irq, void *dev_id)unsigned int iid;unsigned long flags; -spin_lock_irqsave (&priv->port.lock, flags); +spin_lock_irqsave (&priv->lock, flags); handled =0 ;while ((iid =pch_uart_hal_get_iid (priv)) >1 ) {switch (iid) {
@@ -1017,7 +1020,7 @@ static irqreturn_t pch_uart_interrupt(int irq, void *dev_id) priv->int_dis_flag =0 ; } -spin_unlock_irqrestore (&priv->port.lock, flags); +spin_unlock_irqrestore (&priv->lock, flags);return IRQ_RETVAL (handled); }
@@ -1131,9 +1134,9 @@ static void pch_uart_break_ctl(struct uart_port *port, int ctl)unsigned long flags; priv = container_of(port, struct eg20t_port, port); -spin_lock_irqsave (&port->lock, flags); +spin_lock_irqsave (&priv->lock, flags);pch_uart_hal_set_break (priv, ctl); -spin_unlock_irqrestore (&port->lock, flags); +spin_unlock_irqrestore (&priv->lock, flags); }/* Grab any interrupt resources and initialise any low level driver state. */
@@ -1284,7 +1287,8 @@ static void pch_uart_set_termios(struct uart_port *port, baud =uart_get_baud_rate (port, termios, old,0 , port->uartclk /16 ); -spin_lock_irqsave (&port->lock, flags); +spin_lock_irqsave (&priv->lock, flags); +spin_lock (&port->lock);uart_update_timeout (port, termios->c_cflag, baud); rtn =pch_uart_hal_set_line (priv, baud, parity, bits, stb);
@@ -1297,7 +1301,8 @@ static void pch_uart_set_termios(struct uart_port *port,tty_termios_encode_baud_rate (termios, baud, baud); out: -spin_unlock_irqrestore (&port->lock, flags); +spin_unlock (&port->lock); +spin_unlock_irqrestore (&priv->lock, flags); }static const char *pch_uart_type (struct uart_port *port)
@@ -1449,6 +1454,8 @@ static struct eg20t_port *pch_uart_init_port(struct pci_dev *pdev,pci_enable_msi (pdev);pci_set_master (pdev); +spin_lock_init (&priv->lock); + iobase =pci_resource_start (pdev,0 ); mapbase =pci_resource_start (pdev,1 ); priv->mapbase = mapbase;
drivers/usb/core/devices.c +1 -1
@@ -624,7 +624,7 @@ static ssize_t usb_device_read(struct file *file, char __user *buf,/* print devices for all busses */ list_for_each_entry (bus, &usb_bus_list, bus_list) {/* recurse through all children of the root hub */ -if (!bus->root_hub) +if (!bus_to_hcd (bus)->rh_registered)continue ;usb_lock_device (bus->root_hub); ret = usb_device_dump(&buf, &nbytes, &skip_bytes, ppos,
drivers/usb/core/hcd.c +2 -4
@@ -1002,10 +1002,7 @@ static int register_root_hub(struct usb_hcd *hcd)if (retval) {dev_err (parent_dev,"can't register root hub for %s, %d\n" ,dev_name (&usb_dev->dev), retval); - } -mutex_unlock (&usb_bus_list_lock); - -if (retval ==0 ) { + }else {spin_lock_irq (&hcd_root_hub_lock); hcd->rh_registered =1 ;spin_unlock_irq (&hcd_root_hub_lock);
@@ -1014,6 +1011,7 @@ static int register_root_hub(struct usb_hcd *hcd)if (HCD_DEAD (hcd))usb_hc_died (hcd);/* This time clean up */ } +mutex_unlock (&usb_bus_list_lock);return retval; }
drivers/usb/gadget/dummy_hcd.c +4 -4
@@ -2292,10 +2292,8 @@ static int dummy_hcd_probe(struct platform_device *pdev) hs_hcd->has_tt =1 ; retval =usb_add_hcd (hs_hcd,0 ,0 ); -if (retval !=0 ) { -usb_put_hcd (hs_hcd); -return retval; - } +if (retval) + goto put_usb2_hcd;if (mod_data.is_super_speed) { ss_hcd = usb_create_shared_hcd(&dummy_hcd, &pdev->dev,
@@ -2314,6 +2312,8 @@ static int dummy_hcd_probe(struct platform_device *pdev) put_usb3_hcd:usb_put_hcd (ss_hcd); dealloc_usb2_hcd: +usb_remove_hcd (hs_hcd); +put_usb2_hcd:usb_put_hcd (hs_hcd); the_controller.hs_hcd = the_controller.ss_hcd =NULL ;return retval;
drivers/watchdog/hpwdt.c +3 -0
@@ -813,6 +813,9 @@ static int __devinit hpwdt_init_one(struct pci_dev *dev, hpwdt_timer_reg = pci_mem_addr +0x70 ; hpwdt_timer_con = pci_mem_addr +0x72 ; +/* Make sure that timer is disabled until /dev/watchdog is opened */ +hpwdt_stop (); +/* Make sure that we have a valid soft_margin */ if (hpwdt_change_timer (soft_margin))hpwdt_change_timer (DEFAULT_MARGIN );
fs/cifs/cifs_unicode.c +1 -1
@@ -327,6 +327,6 @@ cifsConvertToUCS(__le16 *target, const char *source, int srclen, } ctoUCS_out: -return i; +return j; }
fs/dcache.c +8 -2
@@ -311,7 +311,7 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent)* Inform try_to_ascend() that we are no longer attached to the * dentry tree */ - dentry->d_flags |=DCACHE_DISCONNECTED ; + dentry->d_flags |=DCACHE_DENTRY_KILLED ;if (parent)spin_unlock (&parent->d_lock);dentry_iput (dentry);
@@ -968,7 +968,7 @@ static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned seq* or deletion */ if (new != old->d_parent || - (old->d_flags &DCACHE_DISCONNECTED ) || + (old->d_flags &DCACHE_DENTRY_KILLED ) || (!locked &&read_seqretry (&rename_lock, seq))) {spin_unlock (&new->d_lock); new =NULL ;
@@ -1054,6 +1054,8 @@ positive:return 1 ; rename_retry: +if (locked) + goto again; locked =1 ;write_seqlock (&rename_lock); goto again;
@@ -1156,6 +1158,8 @@ out: rename_retry:if (found)return found; +if (locked) + goto again; locked =1 ;write_seqlock (&rename_lock); goto again;
@@ -2922,6 +2926,8 @@ resume:return ; rename_retry: +if (locked) + goto again; locked =1 ;write_seqlock (&rename_lock); goto again;
fs/proc/proc_sysctl.c +2 -3
@@ -123,9 +123,6 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry, err =ERR_PTR (-ENOMEM ); inode =proc_sys_make_inode (dir->i_sb, h ? h : head, p); -if (h) -sysctl_head_finish (h); -if (!inode) goto out;
@@ -134,6 +131,8 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,d_add (dentry, inode); out: +if (h) +sysctl_head_finish (h);sysctl_head_finish (head);return err; }
include/linux/dcache.h +2 -0
@@ -219,6 +219,8 @@ struct dentry_operations {#define DCACHE_MANAGED_DENTRY \ (DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT) +#define DCACHE_DENTRY_KILLED 0x100000 +extern seqlock_t rename_lock;static inline int dname_external (struct dentry *dentry)
include/linux/hid.h +1 -1
@@ -875,7 +875,7 @@ static inline int hid_hw_power(struct hid_device *hdev, int level)return hdev->ll_driver->power ? hdev->ll_driver->power (hdev, level) :0 ; } -void hid_report_raw_event (struct hid_device *hid,int type,u8 *data,int size, +int hid_report_raw_event (struct hid_device *hid,int type,u8 *data,int size,int interrupt);extern int hid_generic_init (void );
include/linux/hidraw.h +2 -2
@@ -76,13 +76,13 @@ struct hidraw_list {#ifdef CONFIG_HIDRAW int hidraw_init (void );void hidraw_exit (void ); -void hidraw_report_event (struct hid_device *,u8 *,int ); +int hidraw_report_event (struct hid_device *,u8 *,int );int hidraw_connect (struct hid_device *);void hidraw_disconnect (struct hid_device *);#else static inline int hidraw_init (void ) {return 0 ; }static inline void hidraw_exit (void ) { } -static inline void hidraw_report_event (struct hid_device *hid,u8 *data,int len) { } +static inline int hidraw_report_event (struct hid_device *hid,u8 *data,int len) { }static inline int hidraw_connect (struct hid_device *hid) {return -1 ; }static inline void hidraw_disconnect (struct hid_device *hid) { }#endif
include/linux/memory.h +1 -1
@@ -20,7 +20,7 @@#include <linux/compiler.h> #include <linux/mutex.h> -#define MIN_MEMORY_BLOCK_SIZE (1 << SECTION_SIZE_BITS) +#define MIN_MEMORY_BLOCK_SIZE (1UL << SECTION_SIZE_BITS)struct memory_block {unsigned long start_section_nr;
include/linux/xfrm.h +2 -0
@@ -84,6 +84,8 @@ struct xfrm_replay_state {__u32 bitmap; }; +#define XFRMA_REPLAY_ESN_MAX 4096 +struct xfrm_replay_state_esn {unsigned int bmp_len;__u32 oseq;
include/net/bluetooth/smp.h +1 -1
@@ -131,7 +131,7 @@ struct smp_chan { };/* SMP Commands */ -int smp_conn_security (struct l2cap_conn *conn,__u8 sec_level); +int smp_conn_security (struct hci_conn *hcon,__u8 sec_level);int smp_sig_channel (struct l2cap_conn *conn,struct sk_buff *skb);int smp_distribute_keys (struct l2cap_conn *conn,__u8 force);
include/net/xfrm.h +3 -0
@@ -269,6 +269,9 @@ struct xfrm_replay {int (*check)(struct xfrm_state *x,struct sk_buff *skb,__be32 net_seq); +int (*recheck)(struct xfrm_state *x, +struct sk_buff *skb, +__be32 net_seq);void (*notify)(struct xfrm_state *x,int event);int (*overflow)(struct xfrm_state *x,struct sk_buff *skb); };
include/trace/events/kmem.h +2 -2
@@ -214,7 +214,7 @@ TRACE_EVENT(mm_page_alloc,TP_printk ("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s" , __entry->page, -page_to_pfn (__entry->page), + __entry->page ?page_to_pfn (__entry->page) :0 , __entry->order, __entry->migratetype,show_gfp_flags (__entry->gfp_flags))
@@ -240,7 +240,7 @@ DECLARE_EVENT_CLASS(mm_page,TP_printk ("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d" , __entry->page, -page_to_pfn (__entry->page), + __entry->page ?page_to_pfn (__entry->page) :0 , __entry->order, __entry->migratetype, __entry->order ==0 )
kernel/async.c +9 -4
@@ -88,6 +88,13 @@ static async_cookie_t __lowest_in_progress(struct list_head *running) {struct async_entry *entry; +if (!running) {/* just check the entry count */ +if (atomic_read (&entry_count)) +return 0 ;/* smaller than any cookie */ +else +return next_cookie; + } +if (!list_empty (running)) { entry =list_first_entry (running, struct async_entry, list);
@@ -238,9 +245,7 @@ EXPORT_SYMBOL_GPL(async_schedule_domain);*/ void async_synchronize_full (void ) { -do { -async_synchronize_cookie (next_cookie); - }while (!list_empty (&async_running) || !list_empty (&async_pending)); +async_synchronize_cookie_domain (next_cookie,NULL ); }EXPORT_SYMBOL_GPL (async_synchronize_full);
@@ -260,7 +265,7 @@ EXPORT_SYMBOL_GPL(async_synchronize_full_domain);/** * async_synchronize_cookie_domain - synchronize asynchronous function calls within a certain domain with cookie checkpointing * @cookie: async_cookie_t to use as checkpoint -* @running: running list to synchronize on +* @running: running list to synchronize on, NULL indicates all lists * * This function waits until all asynchronous function calls for the * synchronization domain specified by the running list @list submitted
kernel/cpuset.c +3 -0
@@ -2080,6 +2080,9 @@ static void scan_for_empty_cpusets(struct cpuset *root)* (of no affect) on systems that are actively using CPU hotplug * but making no active use of cpusets. * +* The only exception to this is suspend/resume, where we don't +* modify cpusets at all. +* * This routine ensures that top_cpuset.cpus_allowed tracks * cpu_active_mask on each CPU hotplug (cpuhp) event. *
kernel/exit.c +16 -0
@@ -1019,6 +1019,22 @@ NORET_TYPE void do_exit(long code)preempt_disable ();exit_rcu (); + +/* +* The setting of TASK_RUNNING by try_to_wake_up() may be delayed +* when the following two conditions become true. +* - There is race condition of mmap_sem (It is acquired by +* exit_mm()), and +* - SMI occurs before setting TASK_RUNINNG. +* (or hypervisor of virtual machine switches to other guest) +* As a result, we may become TASK_RUNNING after becoming TASK_DEAD +* +* To avoid it, we have to wait for releasing tsk->pi_lock which +* is held by try_to_wake_up() +*/ +smp_mb (); +raw_spin_unlock_wait (&tsk->pi_lock); +/* causes final put_task_struct in finish_task_switch(). */ tsk->state =TASK_DEAD ;schedule ();
kernel/sched.c +36 -4
@@ -8192,34 +8192,66 @@ int __init sched_create_sysfs_power_savings_entries(struct sysdev_class *cls) }#endif /* CONFIG_SCHED_MC || CONFIG_SCHED_SMT */ +static int num_cpus_frozen;/* used to mark begin/end of suspend/resume */ +/* * Update cpusets according to cpu_active mask. If cpusets are * disabled, cpuset_update_active_cpus() becomes a simple wrapper * around partition_sched_domains(). +* +* If we come here as part of a suspend/resume, don't touch cpusets because we +* want to restore it back to its original state upon resume anyway. */ static int cpuset_cpu_active (struct notifier_block *nfb,unsigned long action,void *hcpu) { -switch (action & ~CPU_TASKS_FROZEN ) { +switch (action) { +case CPU_ONLINE_FROZEN : +case CPU_DOWN_FAILED_FROZEN : + +/* +* num_cpus_frozen tracks how many CPUs are involved in suspend +* resume sequence. As long as this is not the last online +* operation in the resume sequence, just build a single sched +* domain, ignoring cpusets. +*/ + num_cpus_frozen--; +if (likely (num_cpus_frozen)) { +partition_sched_domains (1 ,NULL ,NULL ); +break ; + } + +/* +* This is the last CPU online operation. So fall through and +* restore the original sched domains by considering the +* cpuset configurations. +*/ +case CPU_ONLINE :case CPU_DOWN_FAILED :cpuset_update_active_cpus (); -return NOTIFY_OK ; +break ;default :return NOTIFY_DONE ; } +return NOTIFY_OK ; }static int cpuset_cpu_inactive (struct notifier_block *nfb,unsigned long action,void *hcpu) { -switch (action & ~CPU_TASKS_FROZEN ) { +switch (action) {case CPU_DOWN_PREPARE :cpuset_update_active_cpus (); -return NOTIFY_OK ; +break ; +case CPU_DOWN_PREPARE_FROZEN : + num_cpus_frozen++; +partition_sched_domains (1 ,NULL ,NULL ); +break ;default :return NOTIFY_DONE ; } +return NOTIFY_OK ; } static int update_runtime(struct notifier_block *nfb,
kernel/workqueue.c +8 -17
@@ -3627,18 +3627,17 @@ static int __devinit workqueue_cpu_down_callback(struct notifier_block *nfb,#ifdef CONFIG_SMP struct work_for_cpu { -struct completion completion; +struct work_struct work;long (*fn)(void *);void *arg;long ret; }; -static int do_work_for_cpu (void *_wfc) +static void work_for_cpu_fn (struct work_struct *work) { -struct work_for_cpu *wfc = _wfc; + struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work); + wfc->ret = wfc->fn (wfc->arg); -complete (&wfc->completion); -return 0 ; }/**
@@ -3653,19 +3652,11 @@ static int do_work_for_cpu(void *_wfc)*/ long work_on_cpu (unsigned int cpu,long (*fn)(void *),void *arg) { -struct task_struct *sub_thread; -struct work_for_cpu wfc = { - .completion =COMPLETION_INITIALIZER_ONSTACK (wfc.completion), - .fn = fn, - .arg = arg, - }; +struct work_for_cpu wfc = { .fn = fn, .arg = arg }; - sub_thread =kthread_create (do_work_for_cpu, &wfc,"work_for_cpu" ); -if (IS_ERR (sub_thread)) -return PTR_ERR (sub_thread); -kthread_bind (sub_thread, cpu); -wake_up_process (sub_thread); -wait_for_completion (&wfc.completion); +INIT_WORK_ONSTACK (&wfc.work, work_for_cpu_fn); +schedule_work_on (cpu, &wfc.work); +flush_work (&wfc.work);return wfc.ret; }EXPORT_SYMBOL_GPL (work_on_cpu);
mm/memory_hotplug.c +10 -6
@@ -127,9 +127,6 @@ static void register_page_bootmem_info_section(unsigned long start_pfn)struct mem_section *ms;struct page *page, *memmap; -if (!pfn_valid (start_pfn)) -return ; - section_nr =pfn_to_section_nr (start_pfn); ms =__nr_to_section (section_nr);
@@ -188,9 +185,16 @@ void register_page_bootmem_info_node(struct pglist_data *pgdat) end_pfn = pfn + pgdat->node_spanned_pages;/* register_section info */ -for (; pfn < end_pfn; pfn +=PAGES_PER_SECTION ) - register_page_bootmem_info_section(pfn); - +for (; pfn < end_pfn; pfn +=PAGES_PER_SECTION ) { +/* +* Some platforms can assign the same pfn to multiple nodes - on +* node0 as well as nodeN. To avoid registering a pfn against +* multiple nodes we check that this pfn does not already +* reside in some other node. +*/ +if (pfn_valid (pfn) && (pfn_to_nid (pfn) == node)) +register_page_bootmem_info_section (pfn); + } }#endif /* !CONFIG_SPARSEMEM_VMEMMAP */
mm/page_alloc.c +1 -1
@@ -541,7 +541,7 @@ static inline void __free_one_page(struct page *page, combined_idx = buddy_idx & page_idx; higher_page = page + (combined_idx - page_idx); buddy_idx =__find_buddy_index (combined_idx, order +1 ); - higher_buddy = page + (buddy_idx - combined_idx); + higher_buddy = higher_page + (buddy_idx - combined_idx);if (page_is_buddy (higher_page, higher_buddy, order +1 )) {list_add_tail (&page->lru, &zone->free_area[order].free_list[migratetype]);
net/8021q/vlan_core.c +2 -1
@@ -106,7 +106,6 @@ static struct sk_buff *vlan_reorder_header(struct sk_buff *skb)return NULL ;memmove (skb->data -ETH_HLEN , skb->data -VLAN_ETH_HLEN ,2 *ETH_ALEN ); skb->mac_header +=VLAN_HLEN ; -skb_reset_mac_len (skb);return skb; }
@@ -173,6 +172,8 @@ struct sk_buff *vlan_untag(struct sk_buff *skb)skb_reset_network_header (skb);skb_reset_transport_header (skb); +skb_reset_mac_len (skb); +return skb; err_free:
net/bluetooth/hci_conn.c +4 -0
@@ -44,6 +44,7 @@#include <net/bluetooth/bluetooth.h> #include <net/bluetooth/hci_core.h> +#include <net/bluetooth/smp.h> static void hci_le_connect (struct hci_conn *conn) {
@@ -641,6 +642,9 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) {BT_DBG ("conn %p" , conn); +if (conn->type ==LE_LINK ) +return smp_conn_security (conn, sec_level); +/* For sdp we don't need the link key. */ if (sec_level ==BT_SECURITY_SDP )return 1 ;
net/bluetooth/l2cap_core.c +6 -5
@@ -902,14 +902,15 @@ static void l2cap_chan_ready(struct sock *sk)static void l2cap_conn_ready (struct l2cap_conn *conn) {struct l2cap_chan *chan; +struct hci_conn *hcon = conn->hcon;BT_DBG ("conn %p" , conn); -if (!conn->hcon->out && conn->hcon->type ==LE_LINK ) +if (!hcon->out && hcon->type ==LE_LINK )l2cap_le_conn_ready (conn); -if (conn->hcon->out && conn->hcon->type ==LE_LINK ) -smp_conn_security (conn, conn->hcon->pending_sec_level); +if (hcon->out && hcon->type ==LE_LINK ) +smp_conn_security (hcon, hcon->pending_sec_level);read_lock (&conn->chan_lock);
@@ -918,8 +919,8 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)bh_lock_sock (sk); -if (conn->hcon->type ==LE_LINK ) { -if (smp_conn_security (conn, chan->sec_level)) +if (hcon->type ==LE_LINK ) { +if (smp_conn_security (hcon, chan->sec_level))l2cap_chan_ready (sk); }else if (chan->chan_type !=L2CAP_CHAN_CONN_ORIENTED ) {
net/bluetooth/l2cap_sock.c +1 -1
@@ -616,7 +616,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, chbreak ; } -if (smp_conn_security (conn, sec.level)) +if (smp_conn_security (conn->hcon, sec.level))break ; err =0 ;
net/bluetooth/smp.c +2 -2
@@ -554,9 +554,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)return 0 ; } -int smp_conn_security (struct l2cap_conn *conn,__u8 sec_level) +int smp_conn_security (struct hci_conn *hcon,__u8 sec_level) { -struct hci_conn *hcon = conn->hcon; +struct l2cap_conn *conn = hcon->l2cap_data;struct smp_chan *smp = conn->smp_chan;BT_DBG ("conn %p hcon %p level 0x%2.2x" , conn, hcon, sec_level);
net/core/dev.c +9 -6
@@ -2108,7 +2108,8 @@ static bool can_checksum_protocol(unsigned long features, __be16 protocol)static u32 harmonize_features (struct sk_buff *skb,__be16 protocol,u32 features) { -if (!can_checksum_protocol (features, protocol)) { +if (skb->ip_summed !=CHECKSUM_NONE && + !can_checksum_protocol (features, protocol)) { features &= ~NETIF_F_ALL_CSUM ; features &= ~NETIF_F_SG ; }else if (illegal_highdma (skb->dev, skb)) {
@@ -2686,16 +2687,17 @@ ipv6: nhoff += poff;if (pskb_may_pull (skb, nhoff +4 )) { ports.v32 = * (__force u32 *) (skb->data + nhoff); -if (ports.v16[1 ] < ports.v16[0 ]) -swap (ports.v16[0 ], ports.v16[1 ]); skb->l4_rxhash =1 ; } }/* get a consistent hash (same value on both flow directions) */ -if (addr2 < addr1) +if (addr2 < addr1 || + (addr2 == addr1 && + ports.v16[1 ] < ports.v16[0 ])) {swap (addr1, addr2); - +swap (ports.v16[0 ], ports.v16[1 ]); + } hash =jhash_3words (addr1, addr2, ports.v32, hashrnd);if (!hash) hash =1 ;
@@ -6387,7 +6389,8 @@ static struct hlist_head *netdev_create_hash(void)/* Initialize per network namespace state */ static int __net_init netdev_init (struct net *net) { -INIT_LIST_HEAD (&net->dev_base_head); +if (net != &init_net) +INIT_LIST_HEAD (&net->dev_base_head); net->dev_name_head =netdev_create_hash ();if (net->dev_name_head ==NULL )
net/core/net_namespace.c +3 -1
@@ -25,7 +25,9 @@ static DEFINE_MUTEX(net_mutex);LIST_HEAD (net_namespace_list);EXPORT_SYMBOL_GPL (net_namespace_list); -struct net init_net; +struct net init_net = { + .dev_base_head =LIST_HEAD_INIT (init_net.dev_base_head), +};EXPORT_SYMBOL (init_net);#define INITIAL_NET_GEN_PTRS 13/* +1 for len +2 for rcu_head */
net/core/sock.c +2 -1
@@ -593,7 +593,8 @@ set_rcvbuf:case SO_KEEPALIVE :#ifdef CONFIG_INET -if (sk->sk_protocol ==IPPROTO_TCP ) +if (sk->sk_protocol ==IPPROTO_TCP && + sk->sk_type ==SOCK_STREAM )tcp_set_keepalive (sk, valbool);#endif sock_valbool_flag (sk,SOCK_KEEPOPEN , valbool);
net/ipv4/raw.c +8 -6
@@ -131,18 +131,20 @@ found:* 0 - deliver * 1 - block */ -static __inline__int icmp_filter (struct sock *sk,struct sk_buff *skb) +static int icmp_filter (const struct sock *sk,const struct sk_buff *skb) { -int type; +struct icmphdr _hdr; +const struct icmphdr *hdr; -if (!pskb_may_pull (skb,sizeof (struct icmphdr ))) + hdr =skb_header_pointer (skb,skb_transport_offset (skb), +sizeof (_hdr), &_hdr); +if (!hdr)return 1 ; - type =icmp_hdr (skb)->type; -if (type <32 ) { +if (hdr->type <32 ) {__u32 data =raw_sk (sk)->filter.data; -return ((1 << type) & data) !=0 ; +return ((1U << hdr->type) & data) !=0 ; }/* Do not block unknown ICMP types */
net/ipv4/tcp.c +8 -2
@@ -1589,8 +1589,14 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, }#ifdef CONFIG_NET_DMA -if (tp->ucopy.dma_chan) -dma_async_memcpy_issue_pending (tp->ucopy.dma_chan); +if (tp->ucopy.dma_chan) { +if (tp->rcv_wnd ==0 && + !skb_queue_empty (&sk->sk_async_wait_queue)) { +tcp_service_net_dma (sk, true); +tcp_cleanup_rbuf (sk, copied); + }else +dma_async_memcpy_issue_pending (tp->ucopy.dma_chan); + }#endif if (copied >= target) {/* Do not sleep, just process backlog. */
net/ipv6/mip6.c +11 -9
@@ -84,28 +84,30 @@ static int mip6_mh_len(int type)static int mip6_mh_filter (struct sock *sk,struct sk_buff *skb) { -struct ip6_mh *mh; +struct ip6_mh _hdr; +const struct ip6_mh *mh; -if (!pskb_may_pull (skb, (skb_transport_offset (skb)) +8 ) || - !pskb_may_pull (skb, (skb_transport_offset (skb) + - ((skb_transport_header (skb)[1 ] +1 ) <<3 )))) + mh =skb_header_pointer (skb,skb_transport_offset (skb), +sizeof (_hdr), &_hdr); +if (!mh)return -1 ; - mh = (struct ip6_mh *)skb_transport_header (skb); +if (((mh->ip6mh_hdrlen +1 ) <<3 ) > skb->len) +return -1 ;if (mh->ip6mh_hdrlen <mip6_mh_len (mh->ip6mh_type)) {LIMIT_NETDEBUG (KERN_DEBUG "mip6: MH message too short: %d vs >=%d\n" , mh->ip6mh_hdrlen,mip6_mh_len (mh->ip6mh_type)); -mip6_param_prob (skb,0 , ((&mh->ip6mh_hdrlen) - -skb_network_header (skb))); +mip6_param_prob (skb,0 , offsetof(struct ip6_mh , ip6mh_hdrlen) + +skb_network_header_len (skb));return -1 ; }if (mh->ip6mh_proto !=IPPROTO_NONE ) {LIMIT_NETDEBUG (KERN_DEBUG "mip6: MH invalid payload proto = %d\n" , mh->ip6mh_proto); -mip6_param_prob (skb,0 , ((&mh->ip6mh_proto) - -skb_network_header (skb))); +mip6_param_prob (skb,0 , offsetof(struct ip6_mh , ip6mh_proto) + +skb_network_header_len (skb));return -1 ; }
net/ipv6/raw.c +10 -11
@@ -107,21 +107,20 @@ found:* 0 - deliver * 1 - block */ -static __inline__int icmpv6_filter (struct sock *sk,struct sk_buff *skb) +static int icmpv6_filter (const struct sock *sk,const struct sk_buff *skb) { -struct icmp6hdr *icmph; -struct raw6_sock *rp =raw6_sk (sk); - -if (pskb_may_pull (skb,sizeof (struct icmp6hdr ))) { -__u32 *data = &rp->filter.data[0 ]; -int bit_nr; +struct icmp6hdr *_hdr; +const struct icmp6hdr *hdr; - icmph = (struct icmp6hdr *) skb->data; - bit_nr = icmph->icmp6_type; + hdr =skb_header_pointer (skb,skb_transport_offset (skb), +sizeof (_hdr), &_hdr); +if (hdr) { +const __u32 *data = &raw6_sk (sk)->filter.data[0 ]; +unsigned int type = hdr->icmp6_type; -return (data[bit_nr >>5 ] & (1 << (bit_nr &31 ))) !=0 ; +return (data[type >>5 ] & (1U << (type &31 ))) !=0 ; } -return 0 ; +return 1 ; }#if defined(CONFIG_IPV6_MIP6 ) || defined(CONFIG_IPV6_MIP6_MODULE )
net/ipv6/route.c +6 -5
@@ -1435,17 +1435,18 @@ static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)struct fib6_table *table;struct net *net =dev_net (rt->rt6i_dev); -if (rt == net->ipv6.ip6_null_entry) -return -ENOENT ; +if (rt == net->ipv6.ip6_null_entry) { + err = -ENOENT ; + goto out; + } table = rt->rt6i_table;write_lock_bh (&table->tb6_lock); - err =fib6_del (rt, info); -dst_release (&rt->dst); -write_unlock_bh (&table->tb6_lock); +out: +dst_release (&rt->dst);return err; }
net/l2tp/l2tp_eth.c +1 -1
@@ -132,7 +132,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,printk ("\n" ); } -if (!pskb_may_pull (skb,sizeof (ETH_HLEN ))) +if (!pskb_may_pull (skb,ETH_HLEN )) goto error;secpath_reset (skb);
net/netrom/af_netrom.c +6 -1
@@ -1170,7 +1170,12 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock, msg->msg_flags |=MSG_TRUNC ; } -skb_copy_datagram_iovec (skb,0 , msg->msg_iov, copied); + er =skb_copy_datagram_iovec (skb,0 , msg->msg_iov, copied); +if (er <0 ) { +skb_free_datagram (sk, skb); +release_sock (sk); +return er; + }if (sax !=NULL ) { sax->sax25_family =AF_NETROM ;
net/rds/recv.c +3 -0
@@ -410,6 +410,8 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,rdsdebug ("size %zu flags 0x%x timeo %ld\n" , size, msg_flags, timeo); + msg->msg_namelen =0 ; +if (msg_flags &MSG_OOB ) goto out;
@@ -485,6 +487,7 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, sin->sin_port = inc->i_hdr.h_sport; sin->sin_addr.s_addr = inc->i_saddr;memset (sin->sin_zero,0 ,sizeof (sin->sin_zero)); + msg->msg_namelen =sizeof (*sin); }break ; }
net/sched/sch_cbq.c +3 -2
@@ -250,10 +250,11 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)else if ((cl = defmap[res.classid &TC_PRIO_MAX ]) ==NULL ) cl = defmap[TC_PRIO_BESTEFFORT ]; -if (cl ==NULL || cl->level >= head->level) +if (cl ==NULL ) goto fallback; } - +if (cl->level >= head->level) + goto fallback;#ifdef CONFIG_NET_CLS_ACT switch (result) {case TC_ACT_QUEUED :
net/sched/sch_qfq.c +4 -1
@@ -829,7 +829,10 @@ static void qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)if (mask) {struct qfq_group *next =qfq_ffs (q, mask);if (qfq_gt (roundedF, next->F)) { - cl->S = next->F; +if (qfq_gt (limit, next->F)) + cl->S = next->F; +else /* preserve timestamp correctness */ + cl->S = limit;return ; } }
net/sctp/output.c +20 -1
@@ -334,6 +334,25 @@ finish:return retval; } +static void sctp_packet_release_owner (struct sk_buff *skb) +{ +sk_free (skb->sk); +} + +static void sctp_packet_set_owner_w (struct sk_buff *skb,struct sock *sk) +{ +skb_orphan (skb); + skb->sk = sk; + skb->destructor = sctp_packet_release_owner; + +/* +* The data chunks have already been accounted for in sctp_sendmsg(), +* therefore only reserve a single byte to keep socket around until +* the packet has been transmitted. +*/ +atomic_inc (&sk->sk_wmem_alloc); +} +/* All packets are sent to the network through this function from * sctp_outq_tail(). *
@@ -375,7 +394,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)/* Set the owning socket so that we know where to get the * destination IP address. */ -skb_set_owner_w (nskb, sk); +sctp_packet_set_owner_w (nskb, sk);if (!sctp_transport_dst_check (tp)) {sctp_transport_route (tp,NULL ,sctp_sk (sk));
net/wireless/reg.c +9 -3
@@ -331,6 +331,9 @@ static void reg_regdb_search(struct work_struct *work)struct reg_regdb_search_request *request;const struct ieee80211_regdomain *curdom, *regdom;int i, r; +bool set_reg = false; + +mutex_lock (&cfg80211_mutex);mutex_lock (®_regdb_search_mutex);while (!list_empty (®_regdb_search_list)) {
@@ -346,9 +349,7 @@ static void reg_regdb_search(struct work_struct *work) r =reg_copy_regd (®dom, curdom);if (r)break ; -mutex_lock (&cfg80211_mutex); -set_regdom (regdom); -mutex_unlock (&cfg80211_mutex); + set_reg = true;break ; } }
@@ -356,6 +357,11 @@ static void reg_regdb_search(struct work_struct *work)kfree (request); }mutex_unlock (®_regdb_search_mutex); + +if (set_reg) +set_regdom (regdom); + +mutex_unlock (&cfg80211_mutex); } static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
net/xfrm/xfrm_input.c +1 -1
@@ -212,7 +212,7 @@ resume:/* only the first xfrm gets the encap type */ encap_type =0 ; -if (async && x->repl->check (x, skb, seq)) { +if (async && x->repl->recheck (x, skb, seq)) {XFRM_INC_STATS (net,LINUX_MIB_XFRMINSTATESEQERROR ); goto drop_unlock; }
net/xfrm/xfrm_policy.c +1 -1
@@ -1761,7 +1761,7 @@ static struct dst_entry *make_blackhole(struct net *net, u16 family,if (!afinfo) {dst_release (dst_orig); - ret =ERR_PTR (-EINVAL ); +return ERR_PTR (-EINVAL ); }else { ret = afinfo->blackhole_route (net, dst_orig); }
net/xfrm/xfrm_replay.c +15 -0
@@ -420,6 +420,18 @@ err:return -EINVAL ; } +static int xfrm_replay_recheck_esn (struct xfrm_state *x, +struct sk_buff *skb,__be32 net_seq) +{ +if (unlikely (XFRM_SKB_CB (skb)->seq.input.hi != +htonl (xfrm_replay_seqhi (x, net_seq)))) { + x->stats.replay_window++; +return -EINVAL ; + } + +return xfrm_replay_check_esn (x, skb, net_seq); +} +static void xfrm_replay_advance_esn (struct xfrm_state *x,__be32 net_seq) {unsigned int bitnr, nr, i;
@@ -479,6 +491,7 @@ static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)static struct xfrm_replay xfrm_replay_legacy = { .advance = xfrm_replay_advance, .check = xfrm_replay_check, + .recheck = xfrm_replay_check, .notify = xfrm_replay_notify, .overflow = xfrm_replay_overflow, };
@@ -486,6 +499,7 @@ static struct xfrm_replay xfrm_replay_legacy = {static struct xfrm_replay xfrm_replay_bmp = { .advance = xfrm_replay_advance_bmp, .check = xfrm_replay_check_bmp, + .recheck = xfrm_replay_check_bmp, .notify = xfrm_replay_notify_bmp, .overflow = xfrm_replay_overflow_bmp, };
@@ -493,6 +507,7 @@ static struct xfrm_replay xfrm_replay_bmp = {static struct xfrm_replay xfrm_replay_esn = { .advance = xfrm_replay_advance_esn, .check = xfrm_replay_check_esn, + .recheck = xfrm_replay_recheck_esn, .notify = xfrm_replay_notify_bmp, .overflow = xfrm_replay_overflow_esn, };
net/xfrm/xfrm_user.c +42 -15
166 lines not on this page · raw message
sound/soc/samsung/dma.c +1 -7
@@ -34,9 +34,7 @@ static const struct snd_pcm_hardware dma_hardware = { .info = SNDRV_PCM_INFO_INTERLEAVED |SNDRV_PCM_INFO_BLOCK_TRANSFER |SNDRV_PCM_INFO_MMAP | -SNDRV_PCM_INFO_MMAP_VALID | -SNDRV_PCM_INFO_PAUSE | - SNDRV_PCM_INFO_RESUME, + SNDRV_PCM_INFO_MMAP_VALID, .formats =SNDRV_PCM_FMTBIT_S16_LE |SNDRV_PCM_FMTBIT_U16_LE | SNDRV_PCM_FMTBIT_U8 |
@@ -246,15 +244,11 @@ static int dma_trigger(struct snd_pcm_substream *substream, int cmd)switch (cmd) {case SNDRV_PCM_TRIGGER_START : -case SNDRV_PCM_TRIGGER_RESUME : -case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : prtd->state |=ST_RUNNING ; prtd->params->ops->trigger (prtd->params->ch);break ;case SNDRV_PCM_TRIGGER_STOP : -case SNDRV_PCM_TRIGGER_SUSPEND : -case SNDRV_PCM_TRIGGER_PAUSE_PUSH : prtd->state &= ~ST_RUNNING ; prtd->params->ops->stop (prtd->params->ch);break ;
Signature · 2 lines
Ben Hutchings Who are all these weirdos? - David Bowie, about L-Space IRC channel #afp