Commit Graph
264006 Commits
Author SHA1 Message Date
Oliver Neukum 2d20a26a92 Bluetooth: Fix timeout on scanning for the second time
The checks for HCI_INQUIRY and HCI_MGMT were in the wrong order,
so that second scans always failed.

Signed-off-by: Oliver Neukum <[email protected]>
Signed-off-by: Gustavo F. Padovan <[email protected]>
2011-09-15 11:54:05 -03:00
Jan Beulich 61cca2fab7 xen/i386: follow-up to "replace order-based range checking of M2P table by linear one"
The numbers obtained from the hypervisor really can't ever lead to an
overflow here, only the original calculation going through the order
of the range could have. This avoids the (as Jeremy points outs)
somewhat ugly NULL-based calculation here.

Signed-off-by: Jan Beulich <[email protected]>
Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2011-09-15 04:39:46 -04:00
Konrad Rzeszutek Wilk 7736594836 xen/irq: Alter the locking to use a mutex instead of a spinlock.
When we allocate/change the IRQ informations, we do not
need to use spinlocks. We can use a mutex (which is
what the generic IRQ code does for allocations/changes).
Fixes a slew of:

BUG: sleeping function called from invalid context at /linux/kernel/mutex.c:271
in_atomic(): 1, irqs_disabled(): 0, pid: 3216, name: xenstored
2 locks held by xenstored/3216:
 #0:  (&u->bind_mutex){......}, at: [<ffffffffa02e0920>] evtchn_ioctl+0x30/0x3a0 [xen_evtchn]
 #1:  (irq_mapping_update_lock){......}, at: [<ffffffff8138b274>] bind_evtchn_to_irq+0x24/0x90
Pid: 3216, comm: xenstored Not tainted 3.1.0-rc6-00021-g437a3d1 #2
Call Trace:
 [<ffffffff81088d10>] __might_sleep+0x100/0x130
 [<ffffffff81645c2f>] mutex_lock_nested+0x2f/0x50
 [<ffffffff81627529>] __irq_alloc_descs+0x49/0x200
 [<ffffffffa02e0920>] ? evtchn_ioctl+0x30/0x3a0 [xen_evtchn]
 [<ffffffff8138b214>] xen_allocate_irq_dynamic+0x34/0x70
 [<ffffffff8138b2ad>] bind_evtchn_to_irq+0x5d/0x90
 [<ffffffffa02e03c0>] ? evtchn_bind_to_user+0x60/0x60 [xen_evtchn]
 [<ffffffff8138c282>] bind_evtchn_to_irqhandler+0x32/0x80
 [<ffffffffa02e03a9>] evtchn_bind_to_user+0x49/0x60 [xen_evtchn]
 [<ffffffffa02e0a34>] evtchn_ioctl+0x144/0x3a0 [xen_evtchn]
 [<ffffffff811b4070>] ? vfsmount_lock_local_unlock+0x50/0x80
 [<ffffffff811a6a1a>] do_vfs_ioctl+0x9a/0x5e0
 [<ffffffff811b476f>] ? mntput+0x1f/0x30
 [<ffffffff81196259>] ? fput+0x199/0x240
 [<ffffffff811a7001>] sys_ioctl+0xa1/0xb0
 [<ffffffff8164ea82>] system_call_fastpath+0x16/0x1b

Reported-by: Jim Burns <[email protected]>
Acked-by: Ian Campbell <[email protected]>
Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2011-09-15 04:32:02 -04:00
Arjan van de Ven 763437a9e7 ALSA: pcm - fix race condition in wait_for_avail()
wait_for_avail() in pcm_lib.c has a race in it (observed in practice by an
Intel validation group).

The function is supposed to return once space in the buffer has become
available, or if some timeout happens.  The entity that creates space (irq
handler of sound driver and some such) will do a wake up on a waitqueue
that this function registers for.

However there are two races in the existing code

1) If space became available between the caller noticing there was no
   space and this function actually sleeping, the wakeup is missed and the
   timeout condition will happen instead

2) If a wakeup happened but not sufficient space became available, the
   code will loop again and wait for more space.  However, if the second
   wake comes in prior to hitting the schedule_timeout_interruptible(), it
   will be missed, and potentially you'll wait out until the timeout
   happens.

The fix consists of using more careful setting of the current state (so
that if a wakeup happens in the main loop window, the schedule_timeout()
falls through) and by checking for available space prior to going into the
schedule_timeout() loop, but after being on the waitqueue and having the
state set to interruptible.

[tiwai: the following changes have been added to Arjan's original patch:
 - merged akpm's fix for waitqueue adding order into a single patch
 - reduction of duplicated code of avail check
]

Signed-off-by: Arjan van de Ven <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Cc: <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
2011-09-15 09:03:16 +02:00
Shaohua Li cc39c6a9bb mm: account skipped entries to avoid looping in find_get_pages
The found entries by find_get_pages() could be all swap entries.  In
this case we skip the entries, but make sure the skipped entries are
accounted, so we don't keep looping.

Using nr_found > nr_skip to simplify code as suggested by Eric.

Reported-and-tested-by: Eric Dumazet <[email protected]>
Signed-off-by: Shaohua Li <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:17:56 -07:00
Russell King 4f5b04800a drivers/gpio/gpio-generic.c: fix build errors
Building a kernel with hotplug disabled results in a link failure:

  `bgpio_remove' referenced in section `___ksymtab_gpl+bgpio_remove' of drivers/built-in.o: defined in discarded section `.devexit.text' of drivers/built-in.o

This is because of bgpio_remove() is exported.  It is illegal to export
symbols which are discarded either at link time or as part of an
init/exit section.

Fix this by dropping the __devexit attributation from bgpio_remove().
Also drop the __devinit attributation from bgpio_init().

Signed-off-by: Russell King <[email protected]>
Cc: Grant Likely <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:38 -07:00
Thomas Tuttle fa2563e41c workqueue: lock cwq access in drain_workqueue
Take cwq->gcwq->lock to avoid racing between drain_workqueue checking to
make sure the workqueues are empty and cwq_dec_nr_in_flight decrementing
and then incrementing nr_active when it activates a delayed work.

We discovered this when a corner case in one of our drivers resulted in
us trying to destroy a workqueue in which the remaining work would
always requeue itself again in the same workqueue.  We would hit this
race condition and trip the BUG_ON on workqueue.c:3080.

Signed-off-by: Thomas Tuttle <[email protected]>
Acked-by: Tejun Heo <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:38 -07:00
Benny Halevy df4e33ad24 MAINTAINERS: update e-mail address of Benny Halevy
Acked-by: Boaz Harrosh <[email protected]>
Signed-off-by: Benny Halevy <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:38 -07:00
Naga Chumbalkar e71f5cc402 drivers/cpufreq/pcc-cpufreq.c: avoid NULL pointer dereference
per_cpu(processors, n) can be NULL, resulting in:

  Loading CPUFreq modules[  437.661360] BUG: unable to handle kernel NULL pointer dereference at (null)
  IP: [<ffffffffa0434314>] pcc_cpufreq_cpu_init+0x74/0x220 [pcc_cpufreq]

It's better to avoid the oops by failing the driver, and allowing the
system to boot.

Signed-off-by: Naga Chumbalkar <[email protected]>
Cc: Dave Jones <[email protected]>
Cc: Len Brown <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:38 -07:00
Donggeun Kim 88cee8fd77 drivers/rtc/rtc-s3c.c: fix no occurrence of alarm interrupt
The driver does not generate an alarm interrupt even though a time for
an alarm is set.

This results from disabling rtc_clk after setting the alarm time.

To generate an alarm interrupt the driver should maintain its enabled
state for rtc_clk the until alarm interrupt occurs.  This patch permits
generation of an alarm interrupt.

[[email protected]: make s3c_rtc_alarm_clk_lock local to s3c_rtc_alarm_clk_enable()]
Signed-off-by: Donggeun Kim <[email protected]>
Signed-off-by: MyungJoo Ham <[email protected]>
Signed-off-by: Kyungmin Park <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:38 -07:00
Johan Hovold 7a5caabd09 drivers/leds/ledtrig-timer.c: fix broken sysfs delay handling
Fix regression introduced by commit 5ada28bf76 ("led-class: always
implement blinking") which broke sysfs delay handling by not storing the
updated value.  Consequently it was only possible to set one of the delays
through the sysfs interface as the other delay was automatically restored
to it's default value.  Reading the parameters always gave the defaults.

Signed-off-by: Johan Hovold <[email protected]>
Acked-by: Florian Fainelli <[email protected]>
Acked-by: Richard Purdie <[email protected]>
Cc: <[email protected]>		[2.6.37+]
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:38 -07:00
Jesper Juhl 1ebe9dad94 drivers/misc/pti.c: give 'comm' function scope in pti_control_frame_built_and_sent()
In drivers/misc/pti.c::pti_control_frame_built_and_sent() we assign 'comm'
to 'thread_name_p' if (!thread_name).  The problem is that 'comm' then
goes out of scope and later we use 'thread_name_p' which now refers to an
out-of-scope variable.  To fix that, simply move 'comm' up to have
function scope.

Signed-off-by: Jesper Juhl <[email protected]>
Cc: Greg Kroah-Hartman <[email protected]>
Cc: J Freyensee <[email protected]>
Cc: Jeremy Rocher <[email protected]>
Cc: Sergei Trofimovich <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:38 -07:00
WANG Cong 83ede96e98 cris: fix a build error in drivers/tty/serial/crisv10.c
Fix these errors:

    drivers/tty/serial/crisv10.c:4453: error: 'if_ser0' undeclared (first use in this function): 2 errors in 2 logs
    drivers/tty/serial/crisv10.c:4453: error: (Each undeclared identifier is reported only once: 2 errors in 2 logs
    drivers/tty/serial/crisv10.c:4453: error: for each function it appears in.): 2 errors in 2 logs

"if_ser0" is a typo, it should be "if_serial_0".

Signed-off-by: WANG Cong <[email protected]>
Cc: Mikael Starvik <[email protected]>
Cc: Jesper Nilsson <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:38 -07:00
David Vrabel 461ae488ec mm: sync vmalloc address space page tables in alloc_vm_area()
Xen backend drivers (e.g., blkback and netback) would sometimes fail to
map grant pages into the vmalloc address space allocated with
alloc_vm_area().  The GNTTABOP_map_grant_ref would fail because Xen could
not find the page (in the L2 table) containing the PTEs it needed to
update.

(XEN) mm.c:3846:d0 Could not find L1 PTE for address fbb42000

netback and blkback were making the hypercall from a kernel thread where
task->active_mm != &init_mm and alloc_vm_area() was only updating the page
tables for init_mm.  The usual method of deferring the update to the page
tables of other processes (i.e., after taking a fault) doesn't work as a
fault cannot occur during the hypercall.

This would work on some systems depending on what else was using vmalloc.

Fix this by reverting ef691947d8 ("vmalloc: remove vmalloc_sync_all()
from alloc_vm_area()") and add a comment to explain why it's needed.

Signed-off-by: David Vrabel <[email protected]>
Cc: Jeremy Fitzhardinge <[email protected]>
Cc: Konrad Rzeszutek Wilk <[email protected]>
Cc: Ian Campbell <[email protected]>
Cc: Keir Fraser <[email protected]>
Cc: <[email protected]>		[3.0.x]
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:38 -07:00
Johannes Weiner 185efc0f9a memcg: Revert "memcg: add memory.vmscan_stat"
Revert the post-3.0 commit 82f9d486e5 ("memcg: add
memory.vmscan_stat").

The implementation of per-memcg reclaim statistics violates how memcg
hierarchies usually behave: hierarchically.

The reclaim statistics are accounted to child memcgs and the parent
hitting the limit, but not to hierarchy levels in between.  Usually,
hierarchical statistics are perfectly recursive, with each level
representing the sum of itself and all its children.

Since this exports statistics to userspace, this may lead to confusion
and problems with changing things after the release, so revert it now,
we can try again later.

Signed-off-by: Johannes Weiner <[email protected]>
Acked-by: KAMEZAWA Hiroyuki <[email protected]>
Cc: Daisuke Nishimura <[email protected]>
Cc: Michal Hocko <[email protected]>
Cc: Ying Han <[email protected]>
Cc: Balbir Singh <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:38 -07:00
Johannes Weiner a4d3e9e763 mm: vmscan: fix force-scanning small targets without swap
Without swap, anonymous pages are not scanned.  As such, they should not
count when considering force-scanning a small target if there is no swap.

Otherwise, targets are not force-scanned even when their effective scan
number is zero and the other conditions--kswapd/memcg--apply.

This fixes 246e87a939 ("memcg: fix get_scan_count() for small
targets").

[[email protected]: fix comment]
Signed-off-by: Johannes Weiner <[email protected]>
Acked-by: KAMEZAWA Hiroyuki <[email protected]>
Reviewed-by: Michal Hocko <[email protected]>
Cc: Ying Han <[email protected]>
Cc: Balbir Singh <[email protected]>
Cc: KOSAKI Motohiro <[email protected]>
Cc: Daisuke Nishimura <[email protected]>
Acked-by: Mel Gorman <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
Axel Lin d4c32f355c drivers/rtc/rtc-imxdi.c needs linux/sched.h
Include linux/sched.h to fix below build error.

    CC      drivers/rtc/rtc-imxdi.o
  drivers/rtc/rtc-imxdi.c: In function 'di_write_wait':
  drivers/rtc/rtc-imxdi.c:168: error: 'TASK_INTERRUPTIBLE' undeclared (first use in this function)
  drivers/rtc/rtc-imxdi.c:168: error: (Each undeclared identifier is reported only once
  drivers/rtc/rtc-imxdi.c:168: error: for each function it appears in.)
  drivers/rtc/rtc-imxdi.c:168: error: implicit declaration of function 'signal_pending'
  drivers/rtc/rtc-imxdi.c:168: error: implicit declaration of function 'schedule_timeout'
  drivers/rtc/rtc-imxdi.c: In function 'dryice_norm_irq':
  drivers/rtc/rtc-imxdi.c:329: error: 'TASK_INTERRUPTIBLE' undeclared (first use in this function)

Signed-off-by: Axel Lin <[email protected]>
Cc: Baruch Siach <[email protected]>
Cc: Wan ZongShun <[email protected]>
Cc: Alessandro Zummo <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
Ben Hutchings 8694a1840c alpha, gpio: GENERIC_GPIO default must be n
Since GPIOLIB is optional on alpha, GENERIC_GPIO must not be selected by
default.  If GPIOLIB is enabled, it will select GENERIC_GPIO.

See <http://bugs.debian.org/638696> for an example of what 'def_bool y'
breaks.

Reported-by: Michael Cree <[email protected]>
Signed-off-by: Ben Hutchings <[email protected]>
Cc: Richard Henderson <[email protected]>
Cc: Ivan Kokshaysky <[email protected]>
Cc: Matt Turner <[email protected]>
Cc: Michael Cree <[email protected]>
Cc: Mark Brown <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
Al Viro 2c51a4bc02 um: fix strrchr() problems
[email protected]:
Fixes:
  /usr/lib/gcc/x86_64-linux-gnu/4.4.5/../../../../lib/libc.a(strrchr.o): In function `rindex':
  (.text+0x0): multiple definition of `strrchr'

If both STATIC_LINK and UML_NET_VDE are set to "y" libc's strrchr may
clash with the kernel implementation.

This workaround comes originally from Jeff Dike:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494995#35

Signed-off-by: Al Viro <[email protected]>
Signed-off-by: Richard Weinberger <[email protected]>
Cc: Jeff Dike <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
Al Viro f2833aef6a um: clean arch_ptrace() up a bit
1) take subarch-specific stuff to subarch_ptrace()
2) PTRACE_{PEEK,POKE}{TEXT,DATA} is handled by ptrace_request() just fine...

Signed-off-by: Al Viro <[email protected]>
Signed-off-by: Richard Weinberger <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
Al Viro 01599cdc2f um: PTRACE_[GS]ETFPXREGS had been wired on the wrong subarch
It's 32bit-only, not 64bit-only...  And while we are at it, it's
set_fpxregs(), not set_fpregs()...

Signed-off-by: Al Viro <[email protected]>
Signed-off-by: Richard Weinberger <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
Al Viro 7cf3cf21aa um: fix free_winch() mess
while not doing free_irq() from irq handler is commendable, kfree() on the
data passed to said handler before free_irq() is Not Good(tm).  Freeing
the stack it's being run on is also not nice...  Solution: delay actually
freeing stuff.

Signed-off-by: Al Viro <[email protected]>
Signed-off-by: Richard Weinberger <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
Al Viro 45cd5e2d4e um: winch_interrupt() can happen inside of free_winch()
...  so set winch->fd to -1 before doing free_irq(), to avoid having
winch_interrupt() come from/during the latter and attempt to do
reactivate_fd() on something that's already gone.

Signed-off-by: Al Viro <[email protected]>
Signed-off-by: Richard Weinberger <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
Al Viro f71f94845e um: fix oopsable race in line_close()
tty->count is decremented only after ->close() had been called and
several tasks can hit it in parallel.  As the result, using tty->count
to check if you are the last one is broken.  We end up leaving line->tty
not reset to NULL and the next IRQ on that sucker will blow up trying to
dereference pointers from kfree'd struct tty.

Fix is obvious: we need to use a counter of our own.

Signed-off-by: Al Viro <[email protected]>
Signed-off-by: Richard Weinberger <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
Ingo van Lil fbfe9c847e um: Save FPU registers between task switches
Some time ago Jeff prepared 42daba3165 ("uml: stop saving process FP
state") for UML to stop saving the process FP state between task
switches.  The assumption was that since with SKAS0 every guest process
runs inside a host process context the host OS will take care of keeping
the proper FP state.

Unfortunately this is not true for multi-threaded applications, where
all guest threads share a single host process context yet all may use
the FPU on their own.  Although I haven't verified it I suspect things
to be even worse in SKAS3 mode where all guest processes run inside a
single host process.

The patch reintroduces the saving and restoring of the FP context
between task switches.

[[email protected]: Ingo posted this patch in 2009, sadly it was never applied
and got lost. Now in 2011 the problem was reported by Gunnar.]

Signed-off-by: Ingo van Lil <[email protected]>
Signed-off-by: Richard Weinberger <[email protected]>
Reported-by: <[email protected]>
Tested-by: <[email protected]>
Cc: Stanislav Meduna <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
Jonathan Neuschäfer b40997b872 um: drivers/xterm.c: fix a file descriptor leak
I could use out_close1, but that seems to be the code path to close the fd
returned by os_create_unix_socket, and using it to close the fd returned
by mkstemp might lead to some confusion, so I don't do it.

Signed-off-by: Jonathan Neuschäfer <[email protected]>
Signed-off-by: Richard Weinberger <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
Thadeu Lima de Souza Cascardo e5f0bdc784 um: disable CMPXCHG_DOUBLE as it breaks UML build
Commit b789ef518b ("slub: Add cmpxchg_double_slab()") tests for
cmpxchg_double support in the SLUB code and it breaks UML builds with
SLUB.  Since UML does not support checking for CPU features, disable
CMPXCHG_DOUBLE just like CMPXCHG_LOCAL is disabled for UML.

Signed-off-by: Thadeu Lima de Souza Cascardo <[email protected]>
Reviewed-by: Christoph Lameter <[email protected]>
Cc: Jeff Dike <[email protected]>
Cc: Richard Weinberger <[email protected]>
Signed-off-by: Richard Weinberger <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
David Rientjes 0d6617c773 numa: fix NUMA compile error when sysfs and procfs are disabled
The vmstat_text array is only defined for CONFIG_SYSFS or CONFIG_PROC_FS,
yet it is referenced for per-node vmstat with CONFIG_NUMA:

	drivers/built-in.o: In function `node_read_vmstat':
	node.c:(.text+0x1106df): undefined reference to `vmstat_text'

Introduced in commit fa25c503df ("mm: per-node vmstat: show proper
vmstats").

Define the array for CONFIG_NUMA as well.

[[email protected]: remove unneeded ifdefs]
Signed-off-by: David Rientjes <[email protected]>
Reported-by: Cong Wang <[email protected]>
Acked-by: Randy Dunlap <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:37 -07:00
KAMEZAWA Hiroyuki 2bbff6c761 mm/mempolicy.c: make copy_from_user() provably correct
When compiling mm/mempolicy.c with struct user copy checks the following
warning is shown:

  In file included from arch/x86/include/asm/uaccess.h:572,
                   from include/linux/uaccess.h:5,
                   from include/linux/highmem.h:7,
                   from include/linux/pagemap.h:10,
                   from include/linux/mempolicy.h:70,
                   from mm/mempolicy.c:68:
  In function `copy_from_user',
      inlined from `compat_sys_get_mempolicy' at mm/mempolicy.c:1415:
  arch/x86/include/asm/uaccess_64.h:64: warning: call to `copy_from_user_overflow' declared with attribute warning: copy_from_user() buffer size is not provably correct
    LD      mm/built-in.o

Fix this by passing correct buffer size value.

Signed-off-by: KAMEZAWA Hiroyuki <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:36 -07:00
Caspar Zhang 8aacc9f550 mm/mempolicy.c: fix pgoff in mbind vma merge
commit 9d8cebd4bc ("mm: fix mbind vma merge problem") didn't really
fix the mbind vma merge problem due to wrong pgoff value passing to
vma_merge(), which made vma_merge() always return NULL.

Before the patch applied, we are getting a result like:

  addr = 0x7fa58f00c000
  [snip]
  7fa58f00c000-7fa58f00d000 rw-p 00000000 00:00 0
  7fa58f00d000-7fa58f00e000 rw-p 00000000 00:00 0
  7fa58f00e000-7fa58f00f000 rw-p 00000000 00:00 0

here 7fa58f00c000->7fa58f00f000 we get 3 VMAs which are expected to be
merged described as described in commit 9d8cebd.

Re-testing the patched kernel with the reproducer provided in commit
9d8cebd, we get the correct result:

  addr = 0x7ffa5aaa2000
  [snip]
  7ffa5aaa2000-7ffa5aaa6000 rw-p 00000000 00:00 0
  7fffd556f000-7fffd5584000 rw-p 00000000 00:00 0                          [stack]

Signed-off-by: Caspar Zhang <[email protected]>
Cc: KOSAKI Motohiro <[email protected]>
Cc: Christoph Lameter <[email protected]>
Cc: Hugh Dickins <[email protected]>
Cc: Mel Gorman <[email protected]>
Cc: Lee Schermerhorn <[email protected]>
Cc: Minchan Kim <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 18:09:36 -07:00
Linus Torvalds bcd438be3b Merge git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6
* git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6: (25 commits)
  [SCSI] bnx2i: Fixed the endian on TTT for NOP out transmission
  [SCSI] libfc: fix referencing to fc_fcp_pkt from the frame pointer via fr_fsp()
  [SCSI] libfc: block SCSI eh thread for blocked rports
  [SCSI] libfc: fix fc_eh_host_reset
  [SCSI] fcoe: Fix deadlock between fip's recv_work and rtnl
  [SCSI] qla2xxx: Update version number to 8.03.07.07-k.
  [SCSI] qla2xxx: Set the task attributes after memsetting fcp cmnd.
  [SCSI] qla2xxx: Correct inadvertent loop state transitions during port-update handling.
  [SCSI] qla2xxx: Save and restore irq in the response queue interrupt handler.
  [SCSI] qla2xxx: Double check for command completion if abort mailbox command fails.
  [SCSI] qla2xxx: Acquire hardware lock while manipulating dsd list.
  [SCSI] qla2xxx: Fix qla24xx revision check while enabling interrupts.
  [SCSI] qla2xxx: T10 DIF - Fix incorrect error reporting.
  [SCSI] qla2xxx: T10 DIF - Handle uninitalized sectors.
  [SCSI] hpsa: fix physical device lun and target numbering problem
  [SCSI] hpsa: fix problem that OBDR devices are not detected
  [SCSI] isci: add version number
  [SCSI] isci: fix event-get pointer increment
  [SCSI] isci: dynamic interrupt coalescing
  [SCSI] isci: Leave requests alone if already terminating.
  ...
2011-09-14 16:09:14 -07:00
Linus Torvalds 53d872e995 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
* 'for-linus' of git://oss.sgi.com/xfs/xfs:
  xfs: fix a use after free in xfs_end_io_direct_write
2011-09-14 16:08:29 -07:00
Al Viro 1d2ef59014 restore pinning the victim dentry in vfs_rmdir()/vfs_rename_dir()
We used to get the victim pinned by dentry_unhash() prior to commit
64252c75a2 ("vfs: remove dget() from dentry_unhash()") and ->rmdir()
and ->rename() instances relied on that; most of them don't care, but
ones that used d_delete() themselves do.  As the result, we are getting
rmdir() oopses on NFS now.

Just grab the reference before locking the victim and drop it explicitly
after unlocking, same as vfs_rename_other() does.

Signed-off-by: Al Viro <[email protected]>
Tested-by: Simon Kirby <[email protected]>
Cc: [email protected] (3.0.x)
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-14 11:31:55 -07:00
Takashi Iwai 4038a12e74 Merge branch 'fix/asoc' into for-linus 2011-09-14 19:11:13 +02:00
Christoph Hellwig 2d2422aebc xfs: fix a use after free in xfs_end_io_direct_write
There is a window in which the ioend that we call inode_dio_wake on
in xfs_end_io_direct_write is already free.  Fix this by storing
the inode pointer in a local variable.

This is a fix for the regression introduced in 3.1-rc by
"fs: move inode_dio_done to the end_io handler".

Signed-off-by: Christoph Hellwig <[email protected]>
Signed-off-by: Alex Elder <[email protected]>
2011-09-14 08:56:35 -05:00
Michel Dänzer db318d7a8a drm/radeon: Unreference GEM object outside of spinlock in page flip error path.
Should fix https://bugzilla.redhat.com/show_bug.cgi?id=726277 .

Signed-off-by: Michel Dänzer <[email protected]>
cc: [email protected]
Signed-off-by: Dave Airlie <[email protected]>
2011-09-14 13:36:39 +01:00
Michel Dänzer 87463ff83b drm/radeon: Don't read from CP ring write pointer registers.
Apparently this doesn't always work reliably, e.g. at resume time.

Just initialize to 0, so the ring is considered empty.

Tested with hibernation on Sumo and Cayman cards.

Should fix https://bugs.launchpad.net/ubuntu/+source/linux/+bug/820746/ .

Signed-off-by: Michel Dänzer <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
cc: [email protected]
Signed-off-by: Dave Airlie <[email protected]>
2011-09-14 13:35:35 +01:00
Ben Skeggs ff02b13f68 drm/ttm: request zeroed system memory pages for new TT buffer objects
Fixes an information leak to userspace, we were handing out un-zeroed pages
for any newly created TTM_PL_TT buffer.

Reported-by: Marcin Slusarz <[email protected]>
Signed-off-by: Ben Skeggs <[email protected]>
Tested-by: Marcin Slusarz <[email protected]>
Cc: [email protected]
Signed-off-by: Dave Airlie <[email protected]>
2011-09-14 13:34:51 +01:00
David Henningsson 2e1210bc3d ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name
This patch fixes "Surround Speaker Playback Volume" being cut off.
(Commit b4dabfc452 was probably meant to fix this, but it fixed
only the "Switch" name, not the "Volume" name.)

Signed-off-by: David Henningsson <[email protected]>
Cc: <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
2011-09-14 13:45:12 +02:00
Jean Delvare cd5bd3df1a hwmon: (coretemp) Initialize tmin
ttarget is initialized when the driver is loaded, but tmin is not.
As a result, tempX_max_hyst attributes read 0. Fix this.

Also use THERM_*_THRESHOLD* constants in these initializations instead
of hard-coding the constants.

Signed-off-by: Jean Delvare <[email protected]>
Cc: "R, Durgadoss" <[email protected]>
Cc: Guenter Roeck <[email protected]>
Cc: Fenghua Yu <[email protected]>
Signed-off-by: Guenter Roeck <[email protected]>
2011-09-14 03:55:05 -07:00
H Hartley Sweeten 003f6c9df5 lib/sha1.c: quiet sparse noise about symbol not declared
Include <linux/cryptohash.h> to pickup the declarations for sha_transform
and sha_init to quite the sparse noise:

  warning: symbol 'sha_transform' was not declared. Should it be static?
  warning: symbol 'sha_init' was not declared. Should it be static?

Signed-off-by: H Hartley Sweeten <[email protected]>
Acked-by: Mandeep Singh Baines <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-13 16:09:41 -07:00
Benjamin Herrenschmidt 1a4b1a41b8 pci: Don't crash when reading mpss from root complex
In pcie_find_smpss(), we have the following statement:

 	if (dev->is_hotplug_bridge && (!list_is_singular(&dev->bus->devices) ||
	    dev->bus->self->pcie_type != PCI_EXP_TYPE_ROOT_PORT))

The problem is that at least on my machine, this gets called for the
root complex (virtual P2P bridge), and dev->bus->self is NULL since
the parent bus for this is not itself anchor to a PCI device.

This adds the necessary NULL check.

Signed-off-by: Benjamin Herrenschmidt <[email protected]>
Acked-by: Jon Mason <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2011-09-13 16:08:31 -07:00
Thomas Gleixner 477694e711 x86, iommu: Mark DMAR IRQ as non-threaded
Mark this lowlevel IRQ handler as non-threaded. This prevents a boot
crash when "threadirqs" is on the kernel commandline. Also the
interrupt handler is handling hardware critical events which should
not be delayed into a thread.

Signed-off-by: Thomas Gleixner <[email protected]>
Cc: [email protected]
Signed-off-by: Ingo Molnar <[email protected]>
2011-09-13 23:44:53 +02:00
Sachin Prabhu fb2088ccc1 nfs: Do not allow multiple mounts on same mountpoint when using -o noac
Do not allow multiple mounts on same mountpoint when using -o noac

When you normally attempt to mount a share twice on the same mountpoint,
a check in do_add_mount causes it to return an error

# mount localhost:/nfsv3 /mnt
# mount localhost:/nfsv3 /mnt
mount.nfs: /mnt is already mounted or busy

However when using the option 'noac', the user is able to mount the same
share on the same mountpoint multiple times. This happens because a
share mounted with the noac option is automatically assigned the 'sync'
flag MS_SYNCHRONOUS in nfs_initialise_sb(). This flag is set after the
check for already existing superblocks is done in sget(). The check for
the mount flags in nfs_compare_mount_options() does not take into
account the 'sync' flag applied later on in the code path. This means
that when using 'noac', a new superblock structure is assigned for every
new mount of the same share and multiple shares on the same mountpoint
are allowed.

ie.
# mount -onoac localhost:/nfsv3 /mnt
can be run multiple times.

The patch checks for noac and assigns the sync flag before sget() is
called to obtain an already existing superblock structure.

Signed-off-by: Sachin Prabhu <[email protected]>
Reviewed-by: Jeff Layton <[email protected]>
Signed-off-by: Trond Myklebust <[email protected]>
2011-09-13 17:10:15 -04:00
Trond Myklebust f13c3620a4 NFS: Fix a typo in nfs_flush_multi
Fix a typo which causes an Oops in the RPC layer, when using wsize < 4k.

Signed-off-by: Trond Myklebust <[email protected]>
Tested-by: Sricharan R <[email protected]>
2011-09-13 17:06:57 -04:00
Johannes Berg 282cdb325a iwlagn: fix command queue timeout
If the command queue is constantly busy,
which can happen in P2P, the hangcheck
timer will frequently find a command in
it and will eventually reset the device
because nothing sets the timestamp for
this queue when commands are processed.

Fix this by setting the timestamp when
a command completes.

Cc: [email protected] #2.6.39, #3.0.0 #3.1.0
Signed-off-by: Johannes Berg <[email protected]>
SIgned-off-by: Wey-Yi Guy <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
2011-09-13 14:32:02 -04:00
Johannes Berg 456fc37e45 iwlagn: fix stack corruption
Alexander reported a strange crash in iwlagn that
Meenakshi and Wey couldn't reproduce. I just ran
into the same issue and tracked it down to stack
corruption. This fixes it.

The problem was introduced in
commit 4b8b99b6e650d0527f3a123744b7459976581d14
Author: Wey-Yi Guy <[email protected]>
Date:   Fri Jul 8 14:29:48 2011 -0700

    iwlagn: radio sensor offset in le16 format

Cc: Wey-Yi Guy <[email protected]>
Cc: Meenakshi Venkataraman <[email protected]>
Reported-by: Alexander Diewald <[email protected]>
Signed-off-by: Johannes Berg <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
2011-09-13 14:18:39 -04:00
Mohammed Shafi Shajakhan 6a6b3f3e13 ath9k: Fix kernel panic on unplugging the device
when the device is yanked out ath_pci_remove starts doing the cleanups,
unregistering the hardware etc. so we should bail out immediately when
we get drv_flush callback from mac80211 when the card is being unplugged.
the panic occurs after we had associated to an AP.

	EIP: 0060:[<fb315b00>] EFLAGS: 00010246 CPU: 0
	EIP is at ath_reset+0xa0/0x1c0 [ath9k]
	EAX: 00000000 EBX: 000697c0 ECX: 00000002 EDX: f3c3ccf0
	ESI: 00000000 EDI: 00000000 EBP: f43e7b78 ESP: f43e7b50
 	DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
 	Process kworker/u:2 (pid: 182, ti=f43e6000 task=f3c3c7c0
	task.ti=f43e6000)
 	Stack:
 	0000002a 00000000 00000000 003e7b78 0000000f eaaa8500
	ffffffea eaaa97c0
 	eaaaa000 00000001 f43e7ba8 fb315d23 f99e7721 ecece680
	eaaac738 eaaa8500
 	eaaaa020 000000c8 000000c8 00000000 eaaa8d58 eaaa8500
	f43e7bd0 fb080b29
 	Call Trace:
	[<fb315d23>] ath9k_flush+0x103/0x170 [ath9k]
	[<fb080b29>] __ieee80211_recalc_idle+0x2c9/0x400
	[mac80211]
	[<fb080c8e>] ieee80211_recalc_idle+0x2e/0x60 [mac80211]
	[<fb07aa73>] ieee80211_mgd_deauth+0x173/0x210 [mac80211]
	[<fb084559>] ieee80211_deauth+0x19/0x20 [mac80211]
	[<f99dda53>] __cfg80211_mlme_deauth+0xf3/0x140
	[cfg80211]
	[<c0633d00>] ? __mutex_lock_common+0x1f0/0x380
	[<f99e1b5d>] __cfg80211_disconnect+0x18d/0x1f0
	[cfg80211]
	[<f99c8199>] cfg80211_netdev_notifier_call+0x159/0x5c0
	[cfg80211]
	[<c0608a64>] ? packet_notifier+0x174/0x1f0
	[<c0639202>] notifier_call_chain+0x82/0xb0
	[<c0170d8f>] raw_notifier_call_chain+0x1f/0x30
	[<c053b86c>] call_netdevice_notifiers+0x2c/0x60
	[<c0182184>] ? trace_hardirqs_on_caller+0xf4/0x180
	[<c053b8ec>] __dev_close_many+0x4c/0xd0
	[<c053ba2d>] dev_close_many+0x6d/0xc0
	[<c053bb53>] rollback_registered_many+0x93/0x1c0
	[<c018221b>] ? trace_hardirqs_on+0xb/0x10
	[<c053bc95>] unregister_netdevice_many+0x15/0x50
	[<fb07f83b>] ieee80211_remove_interfaces+0x7b/0xb0
	[mac80211]
	[<fb06a14b>] ieee80211_unregister_hw+0x4b/0x110
	[mac80211]
	[<fb311a4a>] ath9k_deinit_device+0x3a/0x60 [ath9k]
	[<fb31eed6>] ath_pci_remove+0x46/0x90 [ath9k]
	[<c03b4ac4>] pci_device_remove+0x44/0x100
	[<c043eb54>] __device_release_driver+0x64/0xb0
	[<c043ec67>] device_release_driver+0x27/0x40
	[<c043deeb>] bus_remove_device+0x7b/0xa0
	[<c043c491>] device_del+0xf1/0x180
	[<c043c530>] device_unregister+0x10/0x20
	[<c03afafe>] pci_stop_bus_device+0x6e/0x80
	[<c03afb72>] pci_remove_bus_device+0x12/0xa0
	[<c03c2f29>] pciehp_unconfigure_device+0x89/0x180
	[<c0181e54>] ? mark_held_locks+0x64/0x100
	[<c063390f>] ? __mutex_unlock_slowpath+0xaf/0x140
	[<c03c1f84>] pciehp_disable_slot+0x64/0x1b0
	[<c03c2850>] pciehp_power_thread+0xd0/0x100
	[<c0164ad0>] ? process_one_work+0x100/0x4d0
	[<c0164b4c>] process_one_work+0x17c/0x4d0
	[<c0164ad0>] ? process_one_work+0x100/0x4d0
	[<c03c2780>] ? queue_interrupt_event+0xa0/0xa0
	[<c01662bb>] worker_thread+0x13b/0x320
	[<c018221b>] ? trace_hardirqs_on+0xb/0x10
	[<c0166180>] ? manage_workers+0x1e0/0x1e0
	[<c016a654>] kthread+0x84/0x90
	[<c016a5d0>] ? __init_kthread_worker+0x60/0x60
	[<c063d106>] kernel_thread_helper+0x6/0x10

Cc: Rajkumar Manoharan <[email protected]>
Signed-off-by: Mohammed Shafi Shajakhan <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
2011-09-13 14:18:39 -04:00
Johannes Berg 4bae7d9769 mac80211: fix missing sta_lock in __sta_info_destroy
Since my commit 34e895075e
("mac80211: allow station add/remove to sleep") there is
a race in mac80211 when it clears the TIM bit because a
sleeping station disconnected, the spinlock isn't held
around the relevant code any more. Use the right API to
acquire the spinlock correctly.

Cc: [email protected] [2.6.34+]
Signed-off-by: Johannes Berg <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
2011-09-13 14:18:38 -04:00
George bac2555c6d rtlwifi: Fix problem when switching connections
The driver fails to clear encryption keys making it impossible
to switch connections.

Signed-off-by: George <[email protected]>
Signed-off-by: Larry Finger <[email protected]>
Cc: Stable <[email protected]>        [2.6.39+]
Signed-off-by: John W. Linville <[email protected]>
2011-09-13 14:18:38 -04:00