OSDN Git Service
Randy Dunlap [Thu, 10 Mar 2011 21:45:57 +0000 (13:45 -0800)]
net: bridge builtin vs. ipv6 modular
When configs BRIDGE=y and IPV6=m, this build error occurs:
br_multicast.c:(.text+0xa3341): undefined reference to `ipv6_dev_get_saddr'
BRIDGE_IGMP_SNOOPING is boolean; if it were tristate, then adding
depends on IPV6 || IPV6=n
to BRIDGE_IGMP_SNOOPING would be a good fix. As it is currently,
making BRIDGE depend on the IPV6 config works.
Reported-by: Patrick Schaaf <netdev@bof.de>
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Thu, 10 Mar 2011 03:55:25 +0000 (19:55 -0800)]
ipv6: Don't create clones of host routes.
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=29252
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=30462
In commit
d80bc0fd262ef840ed4e82593ad6416fa1ba3fc4 ("ipv6: Always
clone offlink routes.") we forced the kernel to always clone offlink
routes.
The reason we do that is to make sure we never bind an inetpeer to a
prefixed route.
The logic turned on here has existed in the tree for many years,
but was always off due to a protecting CPP define. So perhaps
it's no surprise that there is a logic bug here.
The problem is that we canot clone a route that is already a
host route (ie. has DST_HOST set). Because if we do, an identical
entry already exists in the routing tree and therefore the
ip6_rt_ins() call is going to fail.
This sets off a series of failures and high cpu usage, because when
ip6_rt_ins() fails we loop retrying this operation a few times in
order to handle a race between two threads trying to clone and insert
the same host route at the same time.
Fix this by simply using the route as-is when DST_HOST is set.
Reported-by: slash@ac.auone-net.jp
Reported-by: Ernst Sjöstrand <ernstp@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Turull [Wed, 9 Mar 2011 22:11:00 +0000 (14:11 -0800)]
pktgen: fix errata in show results
The units in show_results in pktgen were not correct.
The results are in usec but it was displayed nsec.
Reported-by: Jong-won Lee <ljw@handong.edu>
Signed-off-by: Daniel Turull <daniel.turull@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Wed, 9 Mar 2011 21:27:16 +0000 (13:27 -0800)]
ipv4: Fix erroneous uses of ifa_address.
In usual cases ifa_address == ifa_local, but in the case where
SIOCSIFDSTADDR sets the destination address on a point-to-point
link, ifa_address gets set to that destination address.
Therefore we should use ifa_local when we want the local interface
address.
There were two cases where the selection was done incorrectly:
1) When devinet_ioctl() does matching, it checks ifa_address even
though gifconf correct reported ifa_local to the user
2) IN_DEV_ARP_NOTIFY handling sends a gratuitous ARP using
ifa_address instead of ifa_local.
Reported-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jon Mason [Mon, 7 Mar 2011 07:02:01 +0000 (07:02 +0000)]
vxge: update MAINTAINERS
Exar has exited the 10G Ethernet NIC market, orphaning both the s2io and
vxge drivers. With the promise of free hardware, I'll take over
maintainership.
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Florian Fainelli [Mon, 7 Mar 2011 00:09:42 +0000 (00:09 +0000)]
r6040: bump to version 0.27 and date
23Feb2011
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Shawn Lin [Mon, 7 Mar 2011 00:09:40 +0000 (00:09 +0000)]
r6040: fix multicast operations
The original code does not work well when the number of mulitcast
address to handle is greater than MCAST_MAX. It only enable promiscous
mode instead of multicast hash table mode, so the hash table function
will not be activated and all multicast frames will be recieved in this
condition.
This patch fixes the following issues with the r6040 NIC operating in
multicast:
1) When the IFF_ALLMULTI flag is set, we should write 0xffff to the NIC
hash table registers to make it process multicast traffic.
2) When the number of multicast address to handle is smaller than
MCAST_MAX, we should use the NIC multicast registers MID1_{L,M,H}.
3) The hashing of the address was not correct, due to an invalid
substraction (15 - (crc & 0x0f)) instead of (crc & 0x0f) and an
incorrect crc algorithm (ether_crc_le) instead of (ether_crc).
4) If necessary, we should set HASH_EN flag in MCR0 to enable multicast
hash table function.
Reported-by: Marc Leclerc <marc-leclerc@signaturealpha.com>
Tested-by: Marc Leclerc <marc-leclerc@signaturealpha.com>
Signed-off-by: Shawn Lin <shawn@dmp.com.tw>
Signed-off-by: Albert Chen <albert.chen@rdc.com.tw>
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Neil Horman [Wed, 2 Mar 2011 06:28:22 +0000 (06:28 +0000)]
rds: prevent BUG_ON triggering on congestion map updates
Recently had this bug halt reported to me:
kernel BUG at net/rds/send.c:329!
Oops: Exception in kernel mode, sig: 5 [#1]
SMP NR_CPUS=1024 NUMA pSeries
Modules linked in: rds sunrpc ipv6 dm_mirror dm_region_hash dm_log ibmveth sg
ext4 jbd2 mbcache sd_mod crc_t10dif ibmvscsic scsi_transport_srp scsi_tgt
dm_mod [last unloaded: scsi_wait_scan]
NIP:
d000000003ca68f4 LR:
d000000003ca67fc CTR:
d000000003ca8770
REGS:
c000000175cab980 TRAP: 0700 Not tainted (2.6.32-118.el6.ppc64)
MSR:
8000000000029032 <EE,ME,CE,IR,DR> CR:
44000022 XER:
00000000
TASK =
c00000017586ec90[1896] 'krdsd' THREAD:
c000000175ca8000 CPU: 0
GPR00:
0000000000000150 c000000175cabc00 d000000003cb7340 0000000000002030
GPR04:
ffffffffffffffff 0000000000000030 0000000000000000 0000000000000030
GPR08:
0000000000000001 0000000000000001 c0000001756b1e30 0000000000010000
GPR12:
d000000003caac90 c000000000fa2500 c0000001742b2858 c0000001742b2a00
GPR16:
c0000001742b2a08 c0000001742b2820 0000000000000001 0000000000000001
GPR20:
0000000000000040 c0000001742b2814 c000000175cabc70 0800000000000000
GPR24:
0000000000000004 0200000000000000 0000000000000000 c0000001742b2860
GPR28:
0000000000000000 c0000001756b1c80 d000000003cb68e8 c0000001742b27b8
NIP [
d000000003ca68f4] .rds_send_xmit+0x4c4/0x8a0 [rds]
LR [
d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds]
Call Trace:
[
c000000175cabc00] [
d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds]
(unreliable)
[
c000000175cabd30] [
d000000003ca7e64] .rds_send_worker+0x54/0x100 [rds]
[
c000000175cabdb0] [
c0000000000b475c] .worker_thread+0x1dc/0x3c0
[
c000000175cabed0] [
c0000000000baa9c] .kthread+0xbc/0xd0
[
c000000175cabf90] [
c000000000032114] .kernel_thread+0x54/0x70
Instruction dump:
4bfffd50 60000000 60000000 39080001 935f004c f91f0040 41820024 813d017c
7d094a78 7d290074 7929d182 394a0020 <
0b090000>
40e2ff68 4bffffa4 39200000
Kernel panic - not syncing: Fatal exception
Call Trace:
[
c000000175cab560] [
c000000000012e04] .show_stack+0x74/0x1c0 (unreliable)
[
c000000175cab610] [
c0000000005a365c] .panic+0x80/0x1b4
[
c000000175cab6a0] [
c00000000002fbcc] .die+0x21c/0x2a0
[
c000000175cab750] [
c000000000030000] ._exception+0x110/0x220
[
c000000175cab910] [
c000000000004b9c] program_check_common+0x11c/0x180
Signed-off-by: David S. Miller <davem@davemloft.net>
Nils Carlson [Thu, 3 Mar 2011 22:09:12 +0000 (22:09 +0000)]
bonding 802.3ad: Rename rx_machine_lock to state_machine_lock
Rename the rx_machine_lock to state_machine_lock as this makes more
sense in light of it now protecting all the state machines against
concurrency.
Signed-off-by: Nils Carlson <nils.carlson@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Nils Carlson [Thu, 3 Mar 2011 22:09:11 +0000 (22:09 +0000)]
bonding 802.3ad: Fix the state machine locking v2
Changes since v1:
* Clarify an unclear comment
* Move a (possible) name change to a separate patch
The ad_rx_machine, ad_periodic_machine and ad_port_selection_logic
functions all inspect and alter common fields within the port structure.
Previous to this patch, only the ad_rx_machines were mutexed, and the
periodic and port_selection could run unmutexed against an ad_rx_machine
trigged by an arriving LACPDU.
This patch remedies the situation by protecting all the state machines
from concurrency. This is accomplished by locking around all the state
machines for a given port, which are executed at regular intervals; and
the ad_rx_machine when handling an incoming LACPDU.
Signed-off-by: Nils Carlson <nils.carlson@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Nicolas Kaiser [Fri, 4 Mar 2011 13:49:41 +0000 (13:49 +0000)]
drivers/net/macvtap: fix error check
'len' is unsigned of type size_t and can't be negative.
Signed-off-by: Nicolas Kaiser <nikai@nikai.net>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Rainer Weikusat [Mon, 28 Feb 2011 04:50:55 +0000 (04:50 +0000)]
net: fix multithreaded signal handling in unix recv routines
The unix_dgram_recvmsg and unix_stream_recvmsg routines in
net/af_unix.c utilize mutex_lock(&u->readlock) calls in order to
serialize read operations of multiple threads on a single socket. This
implies that, if all n threads of a process block in an AF_UNIX recv
call trying to read data from the same socket, one of these threads
will be sleeping in state TASK_INTERRUPTIBLE and all others in state
TASK_UNINTERRUPTIBLE. Provided that a particular signal is supposed to
be handled by a signal handler defined by the process and that none of
this threads is blocking the signal, the complete_signal routine in
kernel/signal.c will select the 'first' such thread it happens to
encounter when deciding which thread to notify that a signal is
supposed to be handled and if this is one of the TASK_UNINTERRUPTIBLE
threads, the signal won't be handled until the one thread not blocking
on the u->readlock mutex is woken up because some data to process has
arrived (if this ever happens). The included patch fixes this by
changing mutex_lock to mutex_lock_interruptible and handling possible
error returns in the same way interruptions are handled by the actual
receive-code.
Signed-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Thomas Graf [Thu, 3 Mar 2011 23:35:07 +0000 (23:35 +0000)]
net: Enter net/ipv6/ even if CONFIG_IPV6=n
exthdrs_core.c and addrconf_core.c in net/ipv6/ contain bits which
must be made available even if IPv6 is disabled.
net/ipv6/Makefile already correctly includes them if CONFIG_IPV6=n
but net/Makefile prevents entering the subdirectory.
Signed-off-by: Thomas Graf <tgraf@infradead.org>
Acked-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Göran Weinholt [Wed, 2 Mar 2011 04:07:21 +0000 (04:07 +0000)]
net/smsc911x.c: Set the VLAN1 register to fix VLAN MTU problem
The smsc911x driver would drop frames longer than 1518 bytes, which is a
problem for networks with VLAN tagging. The VLAN1 tag register is used
to increase the legal frame size to 1522 when a VLAN tag is identified.
Signed-off-by: Göran Weinholt <weinholt@csbnet.se>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dmitry Kravkov [Sun, 6 Mar 2011 10:51:37 +0000 (10:51 +0000)]
bnx2x: fix MaxBW configuration
Increase resolution of MaxBW algorithm to suit
Min Bandwidth configuration.
Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dmitry Kravkov [Sun, 6 Mar 2011 10:50:44 +0000 (10:50 +0000)]
bnx2x: (NPAR) prevent HW access in D3 state
Changing speed setting in NPAR requires HW access, this patch
delays the access to D0 state when performed in D3.
Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dmitry Kravkov [Sun, 6 Mar 2011 10:49:15 +0000 (10:49 +0000)]
bnx2x: fix link notification
Report link to OS and other PFs after HW is fully reconfigured
according to new link parameters. (Affected only Multi Function modes).
Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dmitry Kravkov [Sun, 6 Mar 2011 10:49:25 +0000 (10:49 +0000)]
bnx2x: fix non-pmf device load flow
Remove port MAX BW configuration from non-pmf functions,
which caused reconfigure of HW according to 10G (fake) link.
Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Thu, 3 Mar 2011 23:48:01 +0000 (15:48 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/security-testing-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]
Linus Torvalds [Thu, 3 Mar 2011 23:43:15 +0000 (15:43 -0800)]
Merge git://git./linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits)
MAINTAINERS: Add Andy Gospodarek as co-maintainer.
r8169: disable ASPM
RxRPC: Fix v1 keys
AF_RXRPC: Handle receiving ACKALL packets
cnic: Fix lost interrupt on bnx2x
cnic: Prevent status block race conditions with hardware
net: dcbnl: check correct ops in dcbnl_ieee_set()
e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead
igb: fix sparse warning
e1000: fix sparse warning
netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values
dccp: fix oops on Reset after close
ipvs: fix dst_lock locking on dest update
davinci_emac: Add Carrier Link OK check in Davinci RX Handler
bnx2x: update driver version to 1.62.00-6
bnx2x: properly calculate lro_mss
bnx2x: perform statistics "action" before state transition.
bnx2x: properly configure coefficients for MinBW algorithm (NPAR mode).
bnx2x: Fix ethtool -t link test for MF (non-pmf) devices.
bnx2x: Fix nvram test for single port devices.
...
Linus Torvalds [Thu, 3 Mar 2011 23:42:35 +0000 (15:42 -0800)]
Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block
* 'for-linus' of git://git.kernel.dk/linux-2.6-block:
block: kill loop_mutex
blktrace: Remove blk_fill_rwbs_rq.
block: blk-flush shouldn't call directly into q->request_fn() __blk_run_queue()
block: add @force_kblockd to __blk_run_queue()
block: fix kernel-doc format for blkdev_issue_zeroout
blk-throttle: Do not use kblockd workqueue for throtl work
Linus Torvalds [Thu, 3 Mar 2011 23:37:59 +0000 (15:37 -0800)]
Merge branch 'i_nlink' of git://git./linux/kernel/git/viro/vfs-2.6
* 'i_nlink' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
hfs: fix rename() over non-empty directory
udf: fix i_nlink limit
fix reiserfs mkdir() breakage
exofs: i_nlink races in rename()
nilfs2: i_nlink races in rename()
minix: i_nlink races in rename()
ufs: i_nlink races in rename()
sysv: i_nlink races in rename()
David Howells [Thu, 3 Mar 2011 11:28:58 +0000 (11:28 +0000)]
DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]
When a DNS resolver key is instantiated with an error indication, attempts to
read that key will result in an oops because user_read() is expecting there to
be a payload - and there isn't one [CVE-2011-1076].
Give the DNS resolver key its own read handler that returns the error cached in
key->type_data.x[0] as an error rather than crashing.
Also make the kenter() at the beginning of dns_resolver_instantiate() limit the
amount of data it prints, since the data is not necessarily NUL-terminated.
The buggy code was added in:
commit
4a2d789267e00b5a1175ecd2ddefcc78b83fbf09
Author: Wang Lei <wang840925@gmail.com>
Date: Wed Aug 11 09:37:58 2010 +0100
Subject: DNS: If the DNS server returns an error, allow that to be cached [ver #2]
This can trivially be reproduced by any user with the following program
compiled with -lkeyutils:
#include <stdlib.h>
#include <keyutils.h>
#include <err.h>
static char payload[] = "#dnserror=6";
int main()
{
key_serial_t key;
key = add_key("dns_resolver", "a", payload, sizeof(payload),
KEY_SPEC_SESSION_KEYRING);
if (key == -1)
err(1, "add_key");
if (keyctl_read(key, NULL, 0) == -1)
err(1, "read_key");
return 0;
}
What should happen is that keyctl_read() reports error 6 (ENXIO) to the user:
dns-break: read_key: No such device or address
but instead the kernel oopses.
This cannot be reproduced with the 'keyutils add' or 'keyutils padd' commands
as both of those cut the data down below the NUL termination that must be
included in the data. Without this dns_resolver_instantiate() will return
-EINVAL and the key will not be instantiated such that it can be read.
The oops looks like:
BUG: unable to handle kernel NULL pointer dereference at
0000000000000010
IP: [<
ffffffff811b99f7>] user_read+0x4f/0x8f
PGD
3bdf8067 PUD
385b9067 PMD 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:19.0/irq
CPU 0
Modules linked in:
Pid: 2150, comm: dns-break Not tainted 2.6.38-rc7-cachefs+ #468 /DG965RY
RIP: 0010:[<
ffffffff811b99f7>] [<
ffffffff811b99f7>] user_read+0x4f/0x8f
RSP: 0018:
ffff88003bf47f08 EFLAGS:
00010246
RAX:
0000000000000001 RBX:
ffff88003b5ea378 RCX:
ffffffff81972368
RDX:
0000000000000000 RSI:
0000000000000000 RDI:
ffff88003b5ea378
RBP:
ffff88003bf47f28 R08:
ffff88003be56620 R09:
0000000000000000
R10:
0000000000000395 R11:
0000000000000002 R12:
0000000000000000
R13:
0000000000000000 R14:
0000000000000000 R15:
ffffffffffffffa1
FS:
00007feab5751700(0000) GS:
ffff88003e000000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
0000000000000010 CR3:
000000003de40000 CR4:
00000000000006f0
DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
DR3:
0000000000000000 DR6:
00000000ffff0ff0 DR7:
0000000000000400
Process dns-break (pid: 2150, threadinfo
ffff88003bf46000, task
ffff88003be56090)
Stack:
ffff88003b5ea378 ffff88003b5ea3a0 0000000000000000 0000000000000000
ffff88003bf47f68 ffffffff811b708e ffff88003c442bc8 0000000000000000
00000000004005a0 00007fffba368060 0000000000000000 0000000000000000
Call Trace:
[<
ffffffff811b708e>] keyctl_read_key+0xac/0xcf
[<
ffffffff811b7c07>] sys_keyctl+0x75/0xb6
[<
ffffffff81001f7b>] system_call_fastpath+0x16/0x1b
Code: 75 1f 48 83 7b 28 00 75 18 c6 05 58 2b fb 00 01 be bb 00 00 00 48 c7 c7 76 1c 75 81 e8 13 c2 e9 ff 4c 8b b3 e0 00 00 00 4d 85 ed <41> 0f b7 5e 10 74 2d 4d 85 e4 74 28 e8 98 79 ee ff 49 39 dd 48
RIP [<
ffffffff811b99f7>] user_read+0x4f/0x8f
RSP <
ffff88003bf47f08>
CR2:
0000000000000010
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
cc: Wang Lei <wang840925@gmail.com>
Signed-off-by: James Morris <jmorris@namei.org>
Jay Vosburgh [Thu, 3 Mar 2011 10:43:10 +0000 (10:43 +0000)]
MAINTAINERS: Add Andy Gospodarek as co-maintainer.
Acked-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Thu, 3 Mar 2011 20:44:22 +0000 (12:44 -0800)]
Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
* 'for-linus' of git://oss.sgi.com/xfs/xfs:
xfs: zero proper structure size for geometry calls
Linus Torvalds [Thu, 3 Mar 2011 20:42:48 +0000 (12:42 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/ryusuke/nilfs2
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2:
nilfs2: fix regression that i-flag is not set on changeless checkpoints
Stanislaw Gruszka [Tue, 22 Feb 2011 02:00:11 +0000 (02:00 +0000)]
r8169: disable ASPM
For some time is known that ASPM is causing troubles on r8169, i.e. make
device randomly stop working without any errors in dmesg.
Currently Tomi Leppikangas reports that system with r8169 device hangs
with MCE errors when ASPM is enabled:
https://bugzilla.redhat.com/show_bug.cgi?id=642861#c4
Lets disable ASPM for r8169 devices at all, to avoid problems with
r8169 PCIe devices at least for some users.
Reported-by: Tomi Leppikangas <tomi.leppikangas@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Petr Uzel [Thu, 3 Mar 2011 16:48:50 +0000 (11:48 -0500)]
block: kill loop_mutex
Following steps lead to deadlock in kernel:
dd if=/dev/zero of=img bs=512 count=1000
losetup -f img
mkfs.ext2 /dev/loop0
mount -t ext2 -o loop /dev/loop0 mnt
umount mnt/
Stacktrace:
[<
c102ec04>] irq_exit+0x36/0x59
[<
c101502c>] smp_apic_timer_interrupt+0x6b/0x75
[<
c127f639>] apic_timer_interrupt+0x31/0x38
[<
c101df88>] mutex_spin_on_owner+0x54/0x5b
[<
fe2250e9>] lo_release+0x12/0x67 [loop]
[<
c10c4eae>] __blkdev_put+0x7c/0x10c
[<
c10a4da5>] fput+0xd5/0x1aa
[<
fe2250cf>] loop_clr_fd+0x1a9/0x1b1 [loop]
[<
fe225110>] lo_release+0x39/0x67 [loop]
[<
c10c4eae>] __blkdev_put+0x7c/0x10c
[<
c10a59d9>] deactivate_locked_super+0x17/0x36
[<
c10b6f37>] sys_umount+0x27e/0x2a5
[<
c10b6f69>] sys_oldumount+0xb/0xe
[<
c1002897>] sysenter_do_call+0x12/0x26
[<
ffffffff>] 0xffffffff
Regression since
2a48fc0ab24241755dc9, which introduced the private
loop_mutex as part of the BKL removal process.
As per [1], the mutex can be safely removed.
[1] http://www.gossamer-threads.com/lists/linux/kernel/
1341930
Addresses: https://bugzilla.novell.com/show_bug.cgi?id=669394
Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=29172
Signed-off-by: Petr Uzel <petr.uzel@suse.cz>
Cc: stable@kernel.org
Reviewed-by: Nikanth Karthikesan <knikanth@suse.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Tao Ma [Thu, 3 Mar 2011 15:53:20 +0000 (10:53 -0500)]
blktrace: Remove blk_fill_rwbs_rq.
If we enable trace events to trace block actions, We use
blk_fill_rwbs_rq to analyze the corresponding actions
in request's cmd_flags, but we only choose the minor 2 bits
from it, so most of other flags(e.g, REQ_SYNC) are missing.
For example, with a sync write we get:
write_test-2409 [001] 160.013869: block_rq_insert: 3,64 W 0 () 258135 + =
8 [write_test]
Since now we have integrated the flags of both bio and request,
it is safe to pass rq->cmd_flags directly to blk_fill_rwbs and
blk_fill_rwbs_rq isn't needed any more.
With this patch, after a sync write we get:
write_test-2417 [000] 226.603878: block_rq_insert: 3,64 WS 0 () 258135 +=
8 [write_test]
Signed-off-by: Tao Ma <boyu.mt@taobao.com>
Acked-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Al Viro [Thu, 3 Mar 2011 04:46:51 +0000 (23:46 -0500)]
hfs: fix rename() over non-empty directory
merge hfs_unlink() and hfs_rmdir(), while we are at it.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 2 Mar 2011 15:15:26 +0000 (10:15 -0500)]
udf: fix i_nlink limit
(256 << sizeof(x)) - 1 is not the maximal possible value of x...
In reality, the maximal allowed value for UDF FileLinkCount is
65535.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 2 Mar 2011 14:35:13 +0000 (09:35 -0500)]
fix reiserfs mkdir() breakage
if directory has so many subdirectories that its link count is set
to 1 (i.e. "can't tell accurately") and reiserfs_new_inode() fails,
we shouldn't decrement the parent's link count in cleanup path;
that's what DEC_DIR_INODE_NLINK() is for. As it is, we end up
with parent suddenly getting zero i_nlink, with very unpleasant
effects.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 2 Mar 2011 21:42:38 +0000 (16:42 -0500)]
exofs: i_nlink races in rename()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 2 Mar 2011 17:01:13 +0000 (12:01 -0500)]
nilfs2: i_nlink races in rename()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 2 Mar 2011 14:41:38 +0000 (09:41 -0500)]
minix: i_nlink races in rename()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 2 Mar 2011 14:40:21 +0000 (09:40 -0500)]
ufs: i_nlink races in rename()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 2 Mar 2011 14:38:45 +0000 (09:38 -0500)]
sysv: i_nlink races in rename()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Anton Blanchard [Mon, 28 Feb 2011 03:27:53 +0000 (03:27 +0000)]
RxRPC: Fix v1 keys
commit
339412841d7 (RxRPC: Allow key payloads to be passed in XDR form)
broke klog for me. I notice the v1 key struct had a kif_version field
added:
-struct rxkad_key {
- u16 security_index; /* RxRPC header security index */
- u16 ticket_len; /* length of ticket[] */
- u32 expiry; /* time at which expires */
- u32 kvno; /* key version number */
- u8 session_key[8]; /* DES session key */
- u8 ticket[0]; /* the encrypted ticket */
-};
+struct rxrpc_key_data_v1 {
+ u32 kif_version; /* 1 */
+ u16 security_index;
+ u16 ticket_length;
+ u32 expiry; /* time_t */
+ u32 kvno;
+ u8 session_key[8];
+ u8 ticket[0];
+};
However the code in rxrpc_instantiate strips it away:
data += sizeof(kver);
datalen -= sizeof(kver);
Removing kif_version fixes my problem.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David Howells [Mon, 28 Feb 2011 03:27:43 +0000 (03:27 +0000)]
AF_RXRPC: Handle receiving ACKALL packets
The OpenAFS server is now sending ACKALL packets, so we need to handle them.
Otherwise we report a protocol error and abort.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Thu, 3 Mar 2011 04:02:32 +0000 (20:02 -0800)]
Merge branch 'drm-fixes' of git://git./linux/kernel/git/airlied/drm-2.6
* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
drm/i915: fix memory corruption with GM965 and >4GB RAM
Linus Torvalds [Thu, 3 Mar 2011 04:01:57 +0000 (20:01 -0800)]
Merge branch 'devicetree/merge' of git://git.secretlab.ca/git/linux-2.6
* 'devicetree/merge' of git://git.secretlab.ca/git/linux-2.6:
of/promtree: allow DT device matching by fixing 'name' brokenness (v5)
x86: OLPC: have prom_early_alloc BUG rather than return NULL
of/flattree: Drop an uninteresting message to pr_debug level
of: Add missing of_address.h to xilinx ehci driver
Linus Torvalds [Thu, 3 Mar 2011 04:01:31 +0000 (20:01 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/mattst88/alpha-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6:
alpha: Enable GENERIC_HARDIRQS_NO_DEPRECATED
alpha: irq: Convert affinity to use irq_data
alpha: irq: Remove pointless irq status manipulation
alpha: titan: Convert irq_chip functions
alpha: takara: Convert irq_chip functions
alpha: sable: Convert irq_chip functions
alpha: rx164: Convert irq_chip functions
alpha: noritake: Convert irq_chip functions
alpha: rawhide: Convert irq_chip functions
alpha: mikasa: Convert irq_chip functions
alpha: marvel: Convert irq_chip functions
alpha: eiger: Convert irq_chip functions
alpha: eb64p: Convert irq_chip functions
alpha: dp264: Convert irq_chip functions
alpha: cabriolet: Convert irq_chip functions
alpha: i8259, alcor, jensen wildfire: Convert irq_chip
alpha: srm: Convert irq_chip functions
alpha: Pyxis convert irq_chip functions
Fix typo in call to irq_to_desc()
Linus Torvalds [Thu, 3 Mar 2011 04:01:07 +0000 (20:01 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/sameo/mfd-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6:
mfd: Avoid tps6586x burst writes
mfd: Don't suspend WM8994 if the CODEC is not suspended
mfd: Fix DaVinci voice codec device name
mfd: Fix NULL pointer due to non-initialized ucb1x00-ts absinfo
mfd: Fix ASIC3 build with GENERIC_HARDIRQS_NO_DEPRECATED
Linus Torvalds [Thu, 3 Mar 2011 04:00:47 +0000 (20:00 -0800)]
Merge branch 'for_linus' of git://git./linux/kernel/git/jack/linux-fs-2.6
* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6:
ext2: Fix link count corruption under heavy link+rename load
Linus Torvalds [Thu, 3 Mar 2011 03:58:31 +0000 (19:58 -0800)]
Merge branch 'fixes' of git://git./linux/kernel/git/davej/cpufreq
* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq:
[CPUFREQ] p4-clockmod: print EST-capable warning message only once
[CPUFREQ] fix BUG on cpufreq policy init failure
[CPUFREQ] Fix another notifier leak in powernow-k8.
[CPUFREQ] Missing "unregister_cpu_notifier" in powernow-k8.c
Linus Torvalds [Thu, 3 Mar 2011 03:58:14 +0000 (19:58 -0800)]
Merge branch 'merge' of git://git./linux/kernel/git/benh/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc: Fix call to flush_ptrace_hw_breakpoint()
powerpc/kexec: Restore ppc_md.machine_kexec
powerpc/mm: Make hpte_need_flush() safe for preemption
Linus Torvalds [Thu, 3 Mar 2011 02:08:03 +0000 (18:08 -0800)]
Merge branch 'idle-release' of git://git./linux/kernel/git/lenb/linux-idle-2.6
* 'idle-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6:
intel_idle: disable Atom/Lincroft HW C-state auto-demotion
intel_idle: disable NHM/WSM HW C-state auto-demotion
Michael Chan [Wed, 2 Mar 2011 13:00:50 +0000 (13:00 +0000)]
cnic: Fix lost interrupt on bnx2x
We service 2 queues (kcq1 and kcq2) in cnic_service_bnx2x_bh(). If
the status block index has changed when servicing the kcq2, we must
go back and check kcq1. The latest status block index will be used
to acknowledge the interrupt, and without looping back to check kcq1,
we may miss events on kcq1.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Michael Chan [Wed, 2 Mar 2011 13:00:49 +0000 (13:00 +0000)]
cnic: Prevent status block race conditions with hardware
The status block index is used to acknowledge interrupt events and must
be read before checking for the interrupt events, so we need to add rmb()
to guarantee that.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Wed, 2 Mar 2011 23:26:57 +0000 (15:26 -0800)]
Merge branch 'release' of git://git./linux/kernel/git/lenb/linux-acpi-2.6
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6:
ACPI / ACPICA: Implicit notify for multiple devices
ACPI / debugfs: Fix buffer overflows, double free
David S. Miller [Wed, 2 Mar 2011 23:06:01 +0000 (15:06 -0800)]
Merge branch 'master' of /linux/kernel/git/jkirsher/net-2.6
John Fastabend [Wed, 2 Mar 2011 10:35:33 +0000 (10:35 +0000)]
net: dcbnl: check correct ops in dcbnl_ieee_set()
The incorrect ops routine was being tested for in
DCB_ATTR_IEEE_PFC attributes. This patch corrects
it.
Currently, every driver implementing ieee_setets also
implements ieee_setpfc so this bug is not actualized
yet.
Signed-off-by: John Fastabend <john.r.fastabend@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Andres Salomon [Thu, 24 Feb 2011 06:38:22 +0000 (22:38 -0800)]
of/promtree: allow DT device matching by fixing 'name' brokenness (v5)
Commit
e2f2a93b, "of/promtree: add package-to-path support to pdt"
changed dp->name from using the 'name' property to using
package-to-path. This fixed /proc/device-tree creation by eliminating
conflicts between names (the 'name' property provides names like
'battery', whereas package-to-path provides names like
'/foo/bar/battery@0', which we stripped to 'battery@0'). However, it
also breaks of_device_id table matching.
The fix that we _really_ wanted was to keep dp->name based upon
the name property ('battery'), but based dp->full_name upon
package-to-path ('battery@0'). This patch does just that.
This changes all users (except SPARC) of promtree to use the full
result from package-to-path for full_name, rather than stripping the
directory out. In practice, the strings end up being exactly the
same; this change saves time, code, and memory.
SPARC continues to use the existing build_path_component() code.
v2: combine two patches and revert of_pdt_node_name to original version
v3: use dp->phandle instead of passing around node
v4: warn/bail out for non-sparc archs if pkg2path is not set
v5: split of_pdt_build_full_name into sparc & non-sparc versions
v6: Pass NULL to pkg2path before buf gets assigned.
Drop check for pkg2path hook on each and every node.
v7: Don't BUG() when unable to get the full_path; create a
known-unique name instead.
Signed-off-by: Andres Salomon <dilinger@queued.net>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Andres Salomon [Fri, 25 Feb 2011 04:06:31 +0000 (20:06 -0800)]
x86: OLPC: have prom_early_alloc BUG rather than return NULL
..similar to what sparc's prom_early_alloc does.
Signed-off-by: Andres Salomon <dilinger@queued.net>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Paul Bolle [Mon, 14 Feb 2011 21:34:22 +0000 (22:34 +0100)]
of/flattree: Drop an uninteresting message to pr_debug level
This message looks like an error (which it isn't) when booting with a
flattened device tree. Remove the message from normal kernel builds.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Michal Simek [Mon, 14 Feb 2011 10:40:09 +0000 (11:40 +0100)]
of: Add missing of_address.h to xilinx ehci driver
Build log:
In file included from drivers/usb/host/ehci-hcd.c:1208:
drivers/usb/host/ehci-xilinx-of.c: In function 'ehci_hcd_xilinx_of_probe':
drivers/usb/host/ehci-xilinx-of.c:168: error: implicit declaration of function 'of_address_to_resource'
Signed-off-by: John Williams <john.williams@petalogix.com>
Signed-off-by: Michal Simek <monstr@monstr.eu>
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Thomas Gleixner [Sun, 6 Feb 2011 14:33:02 +0000 (14:33 +0000)]
alpha: Enable GENERIC_HARDIRQS_NO_DEPRECATED
All interrupt chips are converted. Mark it clean.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:33:00 +0000 (14:33 +0000)]
alpha: irq: Convert affinity to use irq_data
affinity is moving to irq_data. Fix it up.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:58 +0000 (14:32 +0000)]
alpha: irq: Remove pointless irq status manipulation
The irq descriptors are initialized IRQ_DISABLED in the generic
code. No need to fiddle with them.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:56 +0000 (14:32 +0000)]
alpha: titan: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:53 +0000 (14:32 +0000)]
alpha: takara: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:51 +0000 (14:32 +0000)]
alpha: sable: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:49 +0000 (14:32 +0000)]
alpha: rx164: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:46 +0000 (14:32 +0000)]
alpha: noritake: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:44 +0000 (14:32 +0000)]
alpha: rawhide: Convert irq_chip functions
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:42 +0000 (14:32 +0000)]
alpha: mikasa: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:39 +0000 (14:32 +0000)]
alpha: marvel: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:37 +0000 (14:32 +0000)]
alpha: eiger: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:35 +0000 (14:32 +0000)]
alpha: eb64p: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:33 +0000 (14:32 +0000)]
alpha: dp264: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:30 +0000 (14:32 +0000)]
alpha: cabriolet: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:28 +0000 (14:32 +0000)]
alpha: i8259, alcor, jensen wildfire: Convert irq_chip
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:26 +0000 (14:32 +0000)]
alpha: srm: Convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Thomas Gleixner [Sun, 6 Feb 2011 14:32:23 +0000 (14:32 +0000)]
alpha: Pyxis convert irq_chip functions
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Morten Holst Larsen [Sun, 23 Jan 2011 12:40:47 +0000 (13:40 +0100)]
Fix typo in call to irq_to_desc()
Fix typo in call to irq_to_desc()
Signed-off-by: Morten H. Larsen <m-larsen@post6.tele.dk>
Signed-off-by: Matt Turner <mattst88@gmail.com>
David S. Miller [Wed, 2 Mar 2011 19:29:31 +0000 (11:29 -0800)]
Merge branch 'master' of git://git./linux/kernel/git/kaber/nf-2.6
Tejun Heo [Wed, 2 Mar 2011 13:48:06 +0000 (08:48 -0500)]
block: blk-flush shouldn't call directly into q->request_fn() __blk_run_queue()
blk-flush decomposes a flush into sequence of multiple requests. On
completion of a request, the next one is queued; however, block layer
must not implicitly call into q->request_fn() directly from completion
path. This makes the queue behave unexpectedly when seen from the
drivers and violates the assumption that q->request_fn() is called
with process context + queue_lock.
This patch makes blk-flush the following two changes to make sure
q->request_fn() is not called directly from request completion path.
- blk_flush_complete_seq_end_io() now asks __blk_run_queue() to always
use kblockd instead of calling directly into q->request_fn().
- queue_next_fseq() uses ELEVATOR_INSERT_REQUEUE instead of
ELEVATOR_INSERT_FRONT so that elv_insert() doesn't try to unplug the
request queue directly.
Reported by Jan in the following threads.
http://thread.gmane.org/gmane.linux.ide/48778
http://thread.gmane.org/gmane.linux.ide/48786
stable: applicable to v2.6.37.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Jan Beulich <JBeulich@novell.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: stable@kernel.org
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Tejun Heo [Wed, 2 Mar 2011 13:48:05 +0000 (08:48 -0500)]
block: add @force_kblockd to __blk_run_queue()
__blk_run_queue() automatically either calls q->request_fn() directly
or schedules kblockd depending on whether the function is recursed.
blk-flush implementation needs to be able to explicitly choose
kblockd. Add @force_kblockd.
All the current users are converted to specify %false for the
parameter and this patch doesn't introduce any behavior change.
stable: This is prerequisite for fixing ide oops caused by the new
blk-flush implementation.
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Jan Beulich <JBeulich@novell.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: stable@kernel.org
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Bruce Allan [Wed, 2 Feb 2011 09:30:36 +0000 (09:30 +0000)]
e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead
When support for 82577/82578 was added[1] in 2.6.31, PHY wakeup was in-
advertently enabled (even though it does not function properly) on ICH10
LOMs. This patch makes it so that the ICH10 LOMs use MAC wakeup instead
as was done with the initial support for those devices (i.e. 82567LM-3,
82567LF-3 and 82567V-4).
[1] commit
a4f58f5455ba0efda36fb33c37074922d1527a10
Reported-by: Aurelien Jarno <aurelien@aurel32.net>
Cc: <stable@kernel.org>
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Jeff Kirsher [Thu, 17 Feb 2011 18:47:48 +0000 (18:47 +0000)]
igb: fix sparse warning
Reported-by: Stephen Hemminger <shemminger@vyatta.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Stephen Hemminger [Thu, 24 Feb 2011 16:11:42 +0000 (16:11 +0000)]
e1000: fix sparse warning
Sparse complains because the e1000 driver is calling ioread on a pointer
not tagged as __iomem.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Jan Engelhardt [Wed, 2 Mar 2011 11:10:13 +0000 (12:10 +0100)]
netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values
Like many other places, we have to check that the array index is
within allowed limits, or otherwise, a kernel oops and other nastiness
can ensue when we access memory beyond the end of the array.
[ 5954.115381] BUG: unable to handle kernel paging request at
0000004000000000
[ 5954.120014] IP: __find_logger+0x6f/0xa0
[ 5954.123979] nf_log_bind_pf+0x2b/0x70
[ 5954.123979] nfulnl_recv_config+0xc0/0x4a0 [nfnetlink_log]
[ 5954.123979] nfnetlink_rcv_msg+0x12c/0x1b0 [nfnetlink]
...
The problem goes back to v2.6.30-rc1~1372~1342~31 where nf_log_bind
was decoupled from nf_log_register.
Reported-by: Miguel Di Ciurcio Filho <miguel.filho@gmail.com>,
via irc.freenode.net/#netfilter
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Josh Hunt [Thu, 24 Feb 2011 10:48:22 +0000 (11:48 +0100)]
ext2: Fix link count corruption under heavy link+rename load
vfs_rename_other() does not lock renamed inode with i_mutex. Thus changing
i_nlink in a non-atomic manner (which happens in ext2_rename()) can corrupt
it as reported and analyzed by Josh.
In fact, there is no good reason to mess with i_nlink of the moved file.
We did it presumably to simulate linking into the new directory and unlinking
from an old one. But the practical effect of this is disputable because fsck
can possibly treat file as being properly linked into both directories without
writing any error which is confusing. So we just stop increment-decrement
games with i_nlink which also fixes the corruption.
CC: stable@kernel.org
CC: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Josh Hunt <johunt@akamai.com>
Signed-off-by: Jan Kara <jack@suse.cz>
vwadekar@nvidia.com [Thu, 24 Feb 2011 04:48:13 +0000 (10:18 +0530)]
mfd: Avoid tps6586x burst writes
tps6586 does not support burst writes. i2c writes have to be
1 byte at a time.
Cc: stable@kernel.org
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Mark Brown [Fri, 4 Feb 2011 14:57:43 +0000 (14:57 +0000)]
mfd: Don't suspend WM8994 if the CODEC is not suspended
ASoC supports keeping the audio subsysetm active over suspend in order
to support use cases such as audio passthrough from a cellular modem
with the main CPU suspended. Ensure that we don't power down the CODEC
when this is happening by checking to see if VMID is up and skipping
suspend and resume when it is. If the CODEC has suspended then it'll
turn VMID off before the core suspend() gets called.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Manjunathappa, Prakash [Thu, 27 Jan 2011 13:28:36 +0000 (18:58 +0530)]
mfd: Fix DaVinci voice codec device name
Fix the device name in DaVinci Voice Codec MFD driver to load
davinci-vcif and cq93vc codec client drivers.
Signed-off-by: Manjunathappa, Prakash <prakash.pm@ti.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Jochen Friedrich [Wed, 26 Jan 2011 10:30:01 +0000 (11:30 +0100)]
mfd: Fix NULL pointer due to non-initialized ucb1x00-ts absinfo
Call input_set_abs_params instead of manually setting absbit only.
This fixes this oops:
Unable to handle kernel NULL pointer dereference at virtual address
00000024
Internal error: Oops:
41b67017 [#1]
CPU: 0 Not tainted (2.6.37 #4)
pc : [<
c016d1fc>] lr : [<
00000000>] psr:
20000093
sp :
c19e5f30 ip :
c19e5e6c fp :
c19e5f58
r10:
00000000 r9 :
c19e4000 r8 :
00000003
r7 :
000001e4 r6 :
00000001 r5 :
c1854400 r4 :
00000003
r3 :
00000018 r2 :
00000018 r1 :
00000018 r0 :
c185447c
Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
Control:
c1b6717f Table:
c1b6717f DAC:
00000017
Stack: (0xc19e5f30 to 0xc19e6000)
5f20:
00000003 00000003 c1854400 00000013
5f40:
00000001 000001e4 000001c5 c19e5f80 c19e5f5c c016d5e8 c016cf5c 000001e4
5f60:
c1854400 c18b5860 00000000 00000171 000001e4 c19e5fc4 c19e5f84 c01559a4
5f80:
c016d584 c18b5868 00000000 c1bb5c40 c0035afc c18b5868 c18b5868 c1a55d54
5fa0:
c18b5860 c0155750 00000013 00000000 00000000 00000000 c19e5ff4 c19e5fc8
5fc0:
c0050174 c015575c 00000000 c18b5860 00000000 c19e5fd4 c19e5fd4 c1a55d54
5fe0:
c00500f0 c003b464 00000000 c19e5ff8 c003b464 c00500fc 04000400 04000400
Backtrace:
Function entered at [<
c016cf50>] from [<
c016d5e8>]
Function entered at [<
c016d578>] from [<
c01559a4>]
r8:
000001e4 r7:
00000171 r6:
00000000 r5:
c18b5860 r4:
c1854400
Function entered at [<
c0155750>] from [<
c0050174>]
Function entered at [<
c00500f0>] from [<
c003b464>]
r6:
c003b464 r5:
c00500f0 r4:
c1a55d54
Code:
e59520fc e1a03286 e0433186 e0822003 (
e592000c)
>>PC;
c016d1fc <input_handle_event+2ac/5a0> <=====
Trace;
c016cf50 <input_handle_event+0/5a0>
Trace;
c016d5e8 <input_event+70/88>
Trace;
c016d578 <input_event+0/88>
Trace;
c01559a4 <ucb1x00_thread+254/2dc>
Trace;
c0155750 <ucb1x00_thread+0/2dc>
Trace;
c0050174 <kthread+84/8c>
Trace;
c00500f0 <kthread+0/8c>
Trace;
c003b464 <do_exit+0/624>
Signed-off-by: Jochen Friedrich <jochen@scram.de>
CC: stable@kernel.org
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Lennert Buytenhek [Sat, 22 Jan 2011 01:08:30 +0000 (02:08 +0100)]
mfd: Fix ASIC3 build with GENERIC_HARDIRQS_NO_DEPRECATED
Signed-off-by: Lennert Buytenhek <buytenh@secretlab.ca>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Gerrit Renker [Wed, 2 Mar 2011 07:02:07 +0000 (23:02 -0800)]
dccp: fix oops on Reset after close
This fixes a bug in the order of dccp_rcv_state_process() that still permitted
reception even after closing the socket. A Reset after close thus causes a NULL
pointer dereference by not preventing operations on an already torn-down socket.
dccp_v4_do_rcv()
|
| state other than OPEN
v
dccp_rcv_state_process()
|
| DCCP_PKT_RESET
v
dccp_rcv_reset()
|
v
dccp_time_wait()
WARNING: at net/ipv4/inet_timewait_sock.c:141 __inet_twsk_hashdance+0x48/0x128()
Modules linked in: arc4 ecb carl9170 rt2870sta(C) mac80211 r8712u(C) crc_ccitt ah
[<
c0038850>] (unwind_backtrace+0x0/0xec) from [<
c0055364>] (warn_slowpath_common)
[<
c0055364>] (warn_slowpath_common+0x4c/0x64) from [<
c0055398>] (warn_slowpath_n)
[<
c0055398>] (warn_slowpath_null+0x1c/0x24) from [<
c02b72d0>] (__inet_twsk_hashd)
[<
c02b72d0>] (__inet_twsk_hashdance+0x48/0x128) from [<
c031caa0>] (dccp_time_wai)
[<
c031caa0>] (dccp_time_wait+0x40/0xc8) from [<
c031c15c>] (dccp_rcv_state_proces)
[<
c031c15c>] (dccp_rcv_state_process+0x120/0x538) from [<
c032609c>] (dccp_v4_do_)
[<
c032609c>] (dccp_v4_do_rcv+0x11c/0x14c) from [<
c0286594>] (release_sock+0xac/0)
[<
c0286594>] (release_sock+0xac/0x110) from [<
c031fd34>] (dccp_close+0x28c/0x380)
[<
c031fd34>] (dccp_close+0x28c/0x380) from [<
c02d9a78>] (inet_release+0x64/0x70)
The fix is by testing the socket state first. Receiving a packet in Closed state
now also produces the required "No connection" Reset reply of RFC 4340, 8.3.1.
Reported-and-tested-by: Johan Hovold <jhovold@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
K.Prasad [Thu, 10 Feb 2011 04:44:35 +0000 (04:44 +0000)]
powerpc: Fix call to flush_ptrace_hw_breakpoint()
Fix the error in spelling the config option for hw-breakpoints and fix
the build issue that follows.
Signed-off by: K.Prasad <prasad@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Anton Blanchard [Wed, 23 Feb 2011 12:46:16 +0000 (12:46 +0000)]
powerpc/kexec: Restore ppc_md.machine_kexec
Kyle Moffett points out that mpc85xx has started using the
ppc_md.machine_kexec hook. As such, revert patch
c94868788cf2
(powerpc/kexec: Remove ppc_md.machine_kexec).
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Peter Zijlstra [Thu, 24 Feb 2011 10:47:32 +0000 (10:47 +0000)]
powerpc/mm: Make hpte_need_flush() safe for preemption
hpte_need_flush() might be called outside of a preempt section
when manipulating the kernel page tables, so we need to use the
appopriate variants of per-cpu variable accesses. There should
be no risk of being in the middle of a batch and a context
switch will flush any pending batch.
[Patch extracted from a larger patch in Peter's preemptible
mmu_gather series]
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Alex Elder [Tue, 1 Mar 2011 17:50:00 +0000 (17:50 +0000)]
xfs: zero proper structure size for geometry calls
Commit
493f3358cb289ccf716c5a14fa5bb52ab75943e5 added this call to
xfs_fs_geometry() in order to avoid passing kernel stack data back
to user space:
+ memset(geo, 0, sizeof(*geo));
Unfortunately, one of the callers of that function passes the
address of a smaller data type, cast to fit the type that
xfs_fs_geometry() requires. As a result, this can happen:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted
in:
f87aca93
Pid: 262, comm: xfs_fsr Not tainted 2.6.38-rc6-
493f3358cb2+ #1
Call Trace:
[<
c12991ac>] ? panic+0x50/0x150
[<
c102ed71>] ? __stack_chk_fail+0x10/0x18
[<
f87aca93>] ? xfs_ioc_fsgeometry_v1+0x56/0x5d [xfs]
Fix this by fixing that one caller to pass the right type and then
copy out the subset it is interested in.
Note: This patch is an alternative to one originally proposed by
Eric Sandeen.
Reported-by: Jeffrey Hundstad <jeffrey.hundstad@mnsu.edu>
Signed-off-by: Alex Elder <aelder@sgi.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Tested-by: Jeffrey Hundstad <jeffrey.hundstad@mnsu.edu>
Dave Airlie [Wed, 2 Mar 2011 02:48:23 +0000 (12:48 +1000)]
Merge remote branch 'intel/drm-intel-fixes' of /ssd/git/drm-next into drm-fixes
Ryusuke Konishi [Mon, 28 Feb 2011 04:41:11 +0000 (13:41 +0900)]
nilfs2: fix regression that i-flag is not set on changeless checkpoints
According to the report from Jiro SEKIBA titled "regression in
2.6.37?" (Message-Id: <8739n8vs1f.wl%jir@sekiba.com>), on 2.6.37 and
later kernels, lscp command no longer displays "i" flag on checkpoints
that snapshot operations or garbage collection created.
This is a regression of nilfs2 checkpointing function, and it's
critical since it broke behavior of a part of nilfs2 applications.
For instance, snapshot manager of TimeBrowse gets to create
meaningless snapshots continuously; snapshot creation triggers another
checkpoint, but applications cannot distinguish whether the new
checkpoint contains meaningful changes or not without the i-flag.
This patch fixes the regression and brings that application behavior
back to normal.
Reported-by: Jiro SEKIBA <jir@unicus.jp>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Jiro SEKIBA <jir@unicus.jp>
Cc: stable <stable@kernel.org> [2.6.37]
Naga Chumbalkar [Tue, 15 Feb 2011 17:44:11 +0000 (17:44 +0000)]
[CPUFREQ] p4-clockmod: print EST-capable warning message only once
Print the message only once. I see it 16 times on a 2P box with 16 logical CPUs.
Signed-off-by: Naga Chumbalkar <nagananda.chumbalkar@hp.com>
Jiri Slaby [Tue, 1 Mar 2011 16:41:10 +0000 (17:41 +0100)]
[CPUFREQ] fix BUG on cpufreq policy init failure
cpufreq_register_driver sets cpufreq_driver to a structure owned (and
placed) in the caller's memory. If cpufreq policy fails in its ->init
function, sysdev_driver_register returns nonzero in
cpufreq_register_driver. Now, cpufreq_register_driver returns an error
without setting cpufreq_driver back to NULL.
Usually cpufreq policy modules are unloaded because they propagate the
error to the module init function and return that.
So a later access to any member of cpufreq_driver causes bugs like:
BUG: unable to handle kernel paging request at
ffffffffa00270a0
IP: [<
ffffffff8145eca3>] cpufreq_cpu_get+0x53/0xe0
PGD
1805067 PUD
1809063 PMD
1c3f90067 PTE 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/virtual/net/tun0/statistics/collisions
CPU 0
Modules linked in: ...
Pid: 5677, comm: thunderbird-bin Tainted: G W 2.6.38-rc4-mm1_64+ #1389 To be filled by O.E.M./To Be Filled By O.E.M.
RIP: 0010:[<
ffffffff8145eca3>] [<
ffffffff8145eca3>] cpufreq_cpu_get+0x53/0xe0
RSP: 0018:
ffff8801aec37d98 EFLAGS:
00010086
RAX:
0000000000000202 RBX:
0000000000000000 RCX:
0000000000000001
RDX:
ffffffffa00270a0 RSI:
0000000000001000 RDI:
ffffffff8199ece8
...
Call Trace:
[<
ffffffff8145f490>] cpufreq_quick_get+0x10/0x30
[<
ffffffff8103f12b>] show_cpuinfo+0x2ab/0x300
[<
ffffffff81136292>] seq_read+0xf2/0x3f0
[<
ffffffff8126c5d3>] ? __strncpy_from_user+0x33/0x60
[<
ffffffff8116850d>] proc_reg_read+0x6d/0xa0
[<
ffffffff81116e53>] vfs_read+0xc3/0x180
[<
ffffffff81116f5c>] sys_read+0x4c/0x90
[<
ffffffff81030dbb>] system_call_fastpath+0x16/0x1b
...
It's all cause by weird fail path handling in cpufreq_register_driver.
To fix that, shuffle the code to do proper handling with gotos.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Dave Jones <davej@redhat.com>
Dave Jones [Wed, 24 Nov 2010 02:29:31 +0000 (21:29 -0500)]
[CPUFREQ] Fix another notifier leak in powernow-k8.
Do the notifier registration later, so we don't have to worry
about freeing it if we fail the msr allocation.
Signed-off-by: Dave Jones <davej@redhat.com>
Neil Brown [Wed, 24 Nov 2010 00:28:01 +0000 (11:28 +1100)]
[CPUFREQ] Missing "unregister_cpu_notifier" in powernow-k8.c
It appears that when powernow-k8 finds that
No compatible ACPI _PSS objects found.
and suggests
Try again with latest BIOS.
it fails the module load, but does not unregister the cpu_notifier that was
registered in powernowk8_init
This ends up leaving freed memory on the cpu notifier list for some other
poor module (e.g. md/raid5) to come along and trip over.
The following might be a partial fix, but I suspect there is probably other
clean-up that is needed.
( https://bugzilla.novell.com/show_bug.cgi?id=655215 has full dmesg traces).
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Neil Brown <neilb@suse.de>
Jan Niehusmann [Tue, 1 Mar 2011 22:24:16 +0000 (23:24 +0100)]
drm/i915: fix memory corruption with GM965 and >4GB RAM
On a Thinkpad x61s, I noticed some memory corruption when
plugging/unplugging the external VGA connection. The symptoms are that
4 bytes at the beginning of a page get overwritten by zeroes.
The address of the corruption varies when rebooting the machine, but
stays constant while it's running (so it's possible to repeatedly write
some data and then corrupt it again by plugging the cable).
Further investigation revealed that the corrupted address is
(dev_priv->status_page_dmah->busaddr & 0xffffffff), ie. the beginning of
the hardware status page of the i965 graphics card, cut to 32 bits.
So it seems that for some memory access, the hardware uses only 32 bit
addressing. If the hardware status page is located >4GB, this
corrupts unrelated memory.
Signed-off-by: Jan Niehusmann <jan@gondor.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org