summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2011-09-10Merge branch 'for-linus' of git://neil.brown.name/mdLinus Torvalds4-32/+48
* 'for-linus' of git://neil.brown.name/md: md: Fix handling for devices from 2TB to 4TB in 0.90 metadata. md/raid1,10: Remove use-after-free bug in make_request. md/raid10: unify handling of write completion. Avoid dereferencing a 'request_queue' after last close.
2011-09-10md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.NeilBrown1-2/+10
0.90 metadata uses an unsigned 32bit number to count the number of kilobytes used from each device. This should allow up to 4TB per device. However we multiply this by 2 (to get sectors) before casting to a larger type, so sizes above 2TB get truncated. Also we allow rdev->sectors to be larger than 4TB, so it is possible for the array to be resized larger than the metadata can handle. So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in used. Also the sanity check at the end of super_90_load should include level 1 as it used ->size too. (RAID0 and Linear don't use ->size at all). Reported-by: Pim Zandbergen <P.Zandbergen@macroscoop.nl> Cc: stable@kernel.org Signed-off-by: NeilBrown <neilb@suse.de>
2011-09-10md/raid1,10: Remove use-after-free bug in make_request.NeilBrown2-10/+17
A single request to RAID1 or RAID10 might result in multiple requests if there are known bad blocks that need to be avoided. To detect if we need to submit another write request we test: if (sectors_handled < (bio->bi_size >> 9)) { However this is after we call **_write_done() so the 'bio' no longer belongs to us - the writes could have completed and the bio freed. So move the **_write_done call until after the test against bio->bi_size. This addresses https://bugzilla.kernel.org/show_bug.cgi?id=41862 Reported-by: Bruno Wolff III <bruno@wolff.to> Tested-by: Bruno Wolff III <bruno@wolff.to> Signed-off-by: NeilBrown <neilb@suse.de>
2011-09-10md/raid10: unify handling of write completion.NeilBrown1-20/+18
A write can complete at two different places: 1/ when the last member-device write completes, through raid10_end_write_request 2/ in make_request() when we remove the initial bias from ->remaining. These two should do exactly the same thing and the comment says they do, but they don't. So factor the correct code out into a function and call it in both places. This makes the code much more similar to RAID1. The difference is only significant if there is an error, and they usually take a while, so it is unlikely that there will be an error already when make_request is completing, so this is unlikely to cause real problems. Signed-off-by: NeilBrown <neilb@suse.de>
2011-09-10Avoid dereferencing a 'request_queue' after last close.NeilBrown1-2/+5
On the last close of an 'md' device which as been stopped, the device is destroyed and in particular the request_queue is freed. The free is done in a separate thread so it might happen a short time later. __blkdev_put calls bdev_inode_switch_bdi *after* ->release has been called. Since commit f758eeabeb96f878c860e8f110f94ec8820822a9 bdev_inode_switch_bdi will dereference the 'old' bdi, which lives inside a request_queue, to get a spin lock. This causes the last close on an md device to sometime take a spin_lock which lives in freed memory - which results in an oops. So move the called to bdev_inode_switch_bdi before the call to ->release. Cc: Christoph Hellwig <hch@lst.de> Cc: Hugh Dickins <hughd@google.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Wu Fengguang <fengguang.wu@intel.com> Acked-by: Wu Fengguang <fengguang.wu@intel.com> Cc: stable@kernel.org Signed-off-by: NeilBrown <neilb@suse.de>
2011-09-10PCI: Remove MRRS modification from MPS setting codeJon Mason2-20/+23
Modifying the Maximum Read Request Size to 0 (value of 128Bytes) has massive negative ramifications on some devices. Without knowing which devices have this issue, do not modify from the default value when walking the PCI-E bus in pcie_bus_safe mode. Also, make pcie_bus_safe the default procedure. Tested-by: Sven Schnelle <svens@stackframe.org> Tested-by: Simon Kirby <sim@hostway.ca> Tested-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Reported-and-tested-by: Eric Dumazet <eric.dumazet@gmail.com> Reported-and-tested-by: Niels Ole Salscheider <niels_ole@salscheider-online.de> References: https://bugzilla.kernel.org/show_bug.cgi?id=42162 Signed-off-by: Jon Mason <mason@myri.com> Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-10Fix pointer dereference before call to pcie_bus_configure_settingsShyam Iyer3-6/+10
Commit b03e7495a862 ("PCI: Set PCI-E Max Payload Size on fabric") introduced a potential NULL pointer dereference in calls to pcie_bus_configure_settings due to attempts to access pci_bus self variables when the self pointer is NULL. To correct this, verify that the self pointer in pci_bus is non-NULL before dereferencing it. Reported-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Shyam Iyer <shyam_iyer@dell.com> Signed-off-by: Jon Mason <mason@myri.com> Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-10Merge branch 'for-linus' of git://dev.laptop.org/users/cjb/mmcLinus Torvalds7-44/+99
* 'for-linus' of git://dev.laptop.org/users/cjb/mmc: mmc: sdhci-s3c: Fix mmc card I/O problem mmc: sd: UHS-I bus speed should be set last in UHS initialization mmc: sdhi: initialise mmc_data->flags before use mmc: core: use non-reentrant workqueue for clock gating mmc: core: prevent aggressive clock gating racing with ios updates mmc: rename mmc_host_clk_{ungate|gate} to mmc_host_clk_{hold|release} mmc: sdhci-esdhc-imx: add missing inclusion of linux/module.h
2011-09-10Merge branch 'for-linus' of git://ceph.newdream.net/git/ceph-clientLinus Torvalds4-19/+49
* 'for-linus' of git://ceph.newdream.net/git/ceph-client: libceph: fix leak of osd structs during shutdown ceph: fix memory leak ceph: fix encoding of ino only (not relative) paths libceph: fix msgpool
2011-09-10vfs: automount should ignore LOOKUP_FOLLOWMiklos Szeredi1-18/+15
Prior to 2.6.38 automount would not trigger on either stat(2) or lstat(2) on the automount point. After 2.6.38, with the introduction of the ->d_automount() infrastructure, stat(2) and others would start triggering automount while lstat(2), etc. still would not. This is a regression and a userspace ABI change. Problem originally reported here: http://thread.gmane.org/gmane.linux.kernel.autofs/6098 It appears that there was an attempt at fixing various userspace tools to not trigger the automount. But since the stat system call is rather common it is impossible to "fix" all userspace. This patch reverts the original behavior, which is to not trigger on stat(2) and other symlink following syscalls. [ It's not really clear what the right behavior is. Apparently Solaris does the "automount on stat, leave alone on lstat". And some programs can get unhappy when "stat+open+fstat" ends up giving a different result from the fstat than from the initial stat. But the change in 2.6.38 resulted in problems for some people, so we're going back to old behavior. Maybe we can re-visit this discussion at some future date - Linus ] Reported-by: Leonardo Chiquitto <leonardo.lists@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> Acked-by: Ian Kent <raven@themaw.net> Cc: David Howells <dhowells@redhat.com> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-09Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dmaLinus Torvalds1-13/+29
* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine/ste_dma40: fix memory leak due to prepared descriptors dmaengine/ste_dma40: fix Oops due to double free of client descriptor dmaengine/ste_dma40: remove duplicate call to d40_pool_lli_free(). dmaengine/ste_dma40: add missing kernel doc for pending_queue
2011-09-09Merge branch 'for-linus' of git://opensource.wolfsonmicro.com/regmapLinus Torvalds1-4/+1
* 'for-linus' of git://opensource.wolfsonmicro.com/regmap: regmap: Remove bitrotted module_put()s
2011-09-09Merge branch 'for-linus' of git://twin.jikos.cz/jikos/hidLinus Torvalds4-23/+67
* 'for-linus' of git://twin.jikos.cz/jikos/hid: HID: wacom: Unregister sysfs attributes on remove HID: wacom: Fix error path of power-supply initialization HID: add support for HuiJia USB Gamepad connector HID: magicmouse: ignore 'ivalid report id' while switching modes, v2 HID: magicmouse: Set resolution of touch surfaces
2011-09-09Merge branch 'for-31-rc5/i2c-fixes' of git://git.fluff.org/bjdooks/linuxLinus Torvalds2-16/+49
* 'for-31-rc5/i2c-fixes' of git://git.fluff.org/bjdooks/linux: i2c-tegra: fix possible race condition after tx i2c-tegra: add I2C_FUNC_SMBUS_EMUL i2c-tegra: Add of_match_table i2c-pxa2xx: return proper error code in ce4100_i2c_probe error paths
2011-09-09Merge branch 'amd/fixes' of git://git.8bytes.org/scm/iommuLinus Torvalds1-8/+10
* 'amd/fixes' of git://git.8bytes.org/scm/iommu: iommu/amd: Don't take domain->lock recursivly iommu/amd: Make sure iommu->need_sync contains correct value
2011-09-09regulator: fix kernel-doc warning in consumer.hRandy Dunlap1-1/+1
Fix kernel-doc warning about internal/private data by marking it as "private:" so that kernel-doc will ignore it. Warning(include/linux/regulator/consumer.h:128): No description found for parameter 'ret' Signed-off-by: Randy Dunlap <rdunlap@xenotime.net> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-09wireless: fix kernel-doc warning in net/cfg80211.hRandy Dunlap1-0/+2
Fix kernel-doc warning in net/cfg80211.h: Warning(include/net/cfg80211.h:1884): No description found for parameter 'registered' Signed-off-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-08Merge branch 'timers-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tipLinus Torvalds4-49/+47
* 'timers-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: rtc: twl: Fix registration vs. init order rtc: Initialized rtc_time->tm_isdst rtc: Fix RTC PIE frequency limit rtc: rtc-twl: Remove lockdep related local_irq_enable() rtc: rtc-twl: Switch to using threaded irq rtc: ep93xx: Fix 'rtc' may be used uninitialized warning alarmtimers: Avoid possible denial of service with high freq periodic timers alarmtimers: Memset itimerspec passed into alarm_timer_get alarmtimers: Avoid possible null pointer traversal
2011-09-08Merge branch 'sched-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tipLinus Torvalds1-15/+26
* 'sched-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: sched: Fix a memory leak in __sdt_free() sched: Move blk_schedule_flush_plug() out of __schedule() sched: Separate the scheduler entry for preemption
2011-09-08Merge branch 'perf-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tipLinus Torvalds4-22/+74
* 'perf-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: x86, perf: Check that current->mm is alive before getting user callchain perf_event: Fix broken calc_timer_values() perf events: Fix slow and broken cgroup context switch code
2011-09-07Merge branch 'linux-next' of git://git.infradead.org/ubifs-2.6 and ↵Linus Torvalds2-4/+4
git://git.infradead.org/ubi-2.6 * branch 'linux-next' of git://git.infradead.org/ubifs-2.6: UBIFS: not build debug messages with CONFIG_UBIFS_FS_DEBUG disabled * branch 'linux-next' of git://git.infradead.org/ubi-2.6: UBI: do not link debug messages when debugging is disabled
2011-09-07Merge branch 'hwmon-for-linus' of git://github.com/groeck/linuxLinus Torvalds4-9/+12
* 'hwmon-for-linus' of git://github.com/groeck/linux: hwmon: (ucd9000/ucd9200) Optimize array walk hwmon: (max16065) Add chip access warning to documentation hwmon: (max16065) Fix current calculation
2011-09-07Merge branch 'for-linus' of git://github.com/ericvh/linuxLinus Torvalds7-81/+234
* 'for-linus' of git://github.com/ericvh/linux: fs/9p: Use protocol-defined value for lock/getlock 'type' field. fs/9p: Always ask new inode in lookup for cache mode disabled fs/9p: Add OS dependent open flags in 9p protocol net/9p: Fix kernel crash with msize 512K fs/9p: Don't update file type when updating file attributes fs/9p: Add fid before dentry instantiation
2011-09-07Merge branch 'stable/bug.fixes' of git://oss.oracle.com/git/kwilk/xenLinus Torvalds3-3/+34
* 'stable/bug.fixes' of git://oss.oracle.com/git/kwilk/xen: xen/smp: Warn user why they keel over - nosmp or noapic and what to use instead. xen: x86_32: do not enable iterrupts when returning from exception in interrupt context xen: use maximum reservation to limit amount of usable RAM
2011-09-07Merge branch 'kvm-updates/3.1' of git://github.com/avikivity/kvmLinus Torvalds1-1/+1
* 'kvm-updates/3.1' of git://github.com/avikivity/kvm: KVM: Fix instruction size issue in pvclock scaling
2011-09-07Merge branches 'upstream-fixes' and 'magicmouse' into for-linusJiri Kosina4-23/+67
2011-09-07HID: wacom: Unregister sysfs attributes on removeDavid Herrmann1-0/+1
HID devices can be hotplugged so we should unregister all sysfs attributes when removing a driver. Otherwise, manually unloading the wacom-driver will not remove the sysfs attributes. Only when the device is disconnected, they are removed, eventually. Signed-off-by: David Herrmann <dh.herrmann@googlemail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-09-07HID: wacom: Fix error path of power-supply initializationDavid Herrmann1-12/+9
power_supply_unregister() must not be called if power_supply_register() failed. The wdata->psy.dev pointer may point to invalid memory after a failed power_supply_register() and hence wacom_remove() will fail while calling power_supply_unregister(). This changes the wacom_probe function to fail if it cannot register the power_supply devices. If we would want to keep the previous behaviour we had to keep some flag about the power_supply state and check it on wacom_remove, but this seems inappropriate here. Hence, we simply fail, too, if power_supply_register fails. Signed-off-by: David Herrmann <dh.herrmann@googlemail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-09-07i2c-tegra: fix possible race condition after txDoug Anderson1-14/+32
In tegra_i2c_fill_tx_fifo, once we have finished pushing all the bytes to the I2C hardware controller, the interrupt might happen before we have updated i2c_dev->msg_buf_remaining at the end of the function. Then, in tegra_i2c_isr, we will call again tegra_i2c_fill_tx_fifo triggering weird behaviour. This has been shown to happen under real conditions. Signed-off-by: Doug Anderson <dianders@chromium.org> Tested-by: Vincent Palatin <vpalatin@chromium.org> Acked-by: Rhyland Klein <rklein@nvidia.com> Acked-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Ben Dooks <ben-linux@fluff.org>
2011-09-07i2c-tegra: add I2C_FUNC_SMBUS_EMULMike Rapoport1-1/+1
Signed-off-by: Mike Rapoport <mike@compulab.co.il> Signed-off-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Ben Dooks <ben-linux@fluff.org>
2011-09-07i2c-tegra: Add of_match_tableJohn Bonesio1-0/+12
This patch was intended to be part of 7ca2d1a105a239e300b937e9c41a10a4bd08f569 "i2c: Tegra: Add DeviceTree support". However, an early version of that patch, which was missing a chunk, was applied to next-i2c. This change is that missing chunk. Signed-off-by: John Bonesio <bones@secretlab.ca> Signed-off-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Ben Dooks <ben-linux@fluff.org>
2011-09-07i2c-pxa2xx: return proper error code in ce4100_i2c_probe error pathsAxel Lin1-1/+4
Signed-off-by: Axel Lin <axel.lin@gmail.com> Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Ben Dooks <ben-linux@fluff.org>
2011-09-06hwmon: (ucd9000/ucd9200) Optimize array walkJean Delvare2-8/+4
Rewrite the loop walking the id array during probe. The new code is better adapted to a null-terminated array, and is also clearer and more efficient than the original. Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: Axel Lin <axel.lin@gmail.com> Cc: Guenter Roeck <guenter.roeck@ericsson.com> Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
2011-09-06hwmon: (max16065) Add chip access warning to documentationGuenter Roeck1-0/+7
The chips supported by the max16065 driver should not be accessed using direct i2ctools commands. Add warning to driver documentation to alert users. Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> Acked-by: Jean Delvare <khali@linux-fr.org>
2011-09-06hwmon: (max16065) Fix current calculationGuenter Roeck1-1/+1
Current calculation is completely wrong. Add missing brackets to fix it. Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> Acked-by: Jean Delvare <khali@linux-fr.org> Cc: stable@kernel.org # 3.0+
2011-09-06fs/9p: Use protocol-defined value for lock/getlock 'type' field.Jim Garlick2-7/+32
Signed-off-by: Jim Garlick <garlick@llnl.gov> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2011-09-06fs/9p: Always ask new inode in lookup for cache mode disabledAneesh Kumar K.V1-7/+21
This make sure we don't end up reusing the unlinked inode object. The ideal way is to use inode i_generation. But i_generation is not available in userspace always. Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2011-09-06fs/9p: Add OS dependent open flags in 9p protocolAneesh Kumar K.V5-3/+96
Some of the flags are OS/arch dependent we add a 9p protocol value which maps to asm-generic/fcntl.h values in Linux Based on the original patch from Venkateswararao Jujjuri <jvrao@linux.vnet.ibm.com> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2011-09-06net/9p: Fix kernel crash with msize 512KAneesh Kumar K.V1-5/+12
With msize equal to 512K (PAGE_SIZE * VIRTQUEUE_NUM), we hit multiple crashes. This patch fix those. Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
2011-09-06fs/9p: Don't update file type when updating file attributesAneesh Kumar K.V4-52/+68
We should only update attributes that we can change on stat2inode. Also do file type initialization in v9fs_init_inode. Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
2011-09-06fs/9p: Add fid before dentry instantiationAneesh Kumar K.V2-7/+5
d_instantiate marks the dentry positive. So a parallel lookup and mkdir of the directory can find dentry that doesn't have fid attached. This can result in both the code path doing v9fs_fid_add which results in v9fs_dentry leak. Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
2011-09-05regmap: Remove bitrotted module_put()sMark Brown1-4/+1
The conversion to per bus type registration functions means we don't need to do module_get()s to hold the bus types in memory (their users will link to them) so we removed all those calls. This left module_put() calls in the cleanup paths which aren't needed and which cause unbalanced puts if we ever try to unload anything. Reported-by: Jonathan Cameron <jic23@cam.ac.uk> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2011-09-05dmaengine/ste_dma40: fix memory leak due to prepared descriptorsPer Forlin1-0/+16
Prepared descriptors that are not submitted will not be freed. Add prepared descriptor to a list to be able to release them upon dmaengine_terminate_all(). Signed-off-by: Per Forlin <per.forlin@linaro.org> Acked-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2011-09-05dmaengine/ste_dma40: fix Oops due to double free of client descriptorPer Forlin1-10/+12
The client list may exist in two lists at the same time. This makes free fail since the same desc is freed multiple times. Remove desc from client list when adding it to the pending queue. Move free of client owned descriptors from free_dma() to terminate_all(). Unable to handle kernel paging request at virtual address 00100104 pgd = dea8c000 [00100104] *pgd=1ea62831, *pte=00000000, *ppte=00000000 Internal error: Oops: 817 [#1] PREEMPT SMP Modules linked in: CPU: 0 Not tainted (3.1.0-rc3+ #58) PC is at d40_free_chan_resources+0x64/0x330 Signed-off-by: Per Forlin <per.forlin@linaro.org> Acked-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2011-09-05dmaengine/ste_dma40: remove duplicate call to d40_pool_lli_free().Per Forlin1-3/+0
d40_desc_free() already calls d40_pool_lli_free(). Signed-off-by: Per Forlin <per.forlin@linaro.org> Acked-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2011-09-05dmaengine/ste_dma40: add missing kernel doc for pending_queuePer Forlin1-0/+1
Signed-off-by: Per Forlin <per.forlin@linaro.org> Acked-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2011-09-05Linux 3.1-rc5Linus Torvalds1-1/+1
2011-09-02Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds3-0/+33
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/radeon/kms: make sure pci max read request size is valid on evergreen+ (v2) drm/radeon/kms: set a default max_pixel_clock
2011-09-02Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfsLinus Torvalds3-28/+30
* 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: fix ->write_inode return values xfs: fix xfs_mark_inode_dirty during umount xfs: deprecate the nodelaylog mount option
2011-09-02iommu/amd: Don't take domain->lock recursivlyJoerg Roedel1-5/+0
The domain_flush_devices() function takes the domain->lock. But this function is only called from update_domain() which itself is already called unter the domain->lock. This causes a deadlock situation when the dma-address-space of a domain grows larger than 1GB. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>