Al Viro [Wed, 14 Sep 2011 23:21:38 +0000 (16:21 -0700)]
um: fix strrchr() problems
richard@nod.at:
Fixes:
/usr/lib/gcc/x86_64-linux-gnu/4.4.5/../../../../lib/libc.a(strrchr.o): In function `rindex':
(.text+0x0): multiple definition of `strrchr'
If both STATIC_LINK and UML_NET_VDE are set to "y" libc's strrchr may
clash with the kernel implementation.
This workaround comes originally from Jeff Dike:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494995#35
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Richard Weinberger <richard@nod.at>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Wed, 14 Sep 2011 23:21:37 +0000 (16:21 -0700)]
um: clean arch_ptrace() up a bit
1) take subarch-specific stuff to subarch_ptrace()
2) PTRACE_{PEEK,POKE}{TEXT,DATA} is handled by ptrace_request() just fine...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Wed, 14 Sep 2011 23:21:34 +0000 (16:21 -0700)]
um: PTRACE_[GS]ETFPXREGS had been wired on the wrong subarch
It's 32bit-only, not 64bit-only... And while we are at it, it's
set_fpxregs(), not set_fpregs()...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Wed, 14 Sep 2011 23:21:31 +0000 (16:21 -0700)]
um: fix free_winch() mess
while not doing free_irq() from irq handler is commendable, kfree() on the
data passed to said handler before free_irq() is Not Good(tm). Freeing
the stack it's being run on is also not nice... Solution: delay actually
freeing stuff.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Wed, 14 Sep 2011 23:21:28 +0000 (16:21 -0700)]
um: winch_interrupt() can happen inside of free_winch()
... so set winch->fd to -1 before doing free_irq(), to avoid having
winch_interrupt() come from/during the latter and attempt to do
reactivate_fd() on something that's already gone.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Wed, 14 Sep 2011 23:21:25 +0000 (16:21 -0700)]
um: fix oopsable race in line_close()
tty->count is decremented only after ->close() had been called and
several tasks can hit it in parallel. As the result, using tty->count
to check if you are the last one is broken. We end up leaving line->tty
not reset to NULL and the next IRQ on that sucker will blow up trying to
dereference pointers from kfree'd struct tty.
Fix is obvious: we need to use a counter of our own.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Ingo van Lil [Wed, 14 Sep 2011 23:21:23 +0000 (16:21 -0700)]
um: Save FPU registers between task switches
Some time ago Jeff prepared
42daba316557 ("uml: stop saving process FP
state") for UML to stop saving the process FP state between task
switches. The assumption was that since with SKAS0 every guest process
runs inside a host process context the host OS will take care of keeping
the proper FP state.
Unfortunately this is not true for multi-threaded applications, where
all guest threads share a single host process context yet all may use
the FPU on their own. Although I haven't verified it I suspect things
to be even worse in SKAS3 mode where all guest processes run inside a
single host process.
The patch reintroduces the saving and restoring of the FP context
between task switches.
[richard@nod.at: Ingo posted this patch in 2009, sadly it was never applied
and got lost. Now in 2011 the problem was reported by Gunnar.]
Signed-off-by: Ingo van Lil <inguin@gmx.de>
Signed-off-by: Richard Weinberger <richard@nod.at>
Reported-by: <gunnarlindroth@hotmail.com>
Tested-by: <gunnarlindroth@hotmail.com>
Cc: Stanislav Meduna <stano@meduna.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Jonathan Neuschäfer [Wed, 14 Sep 2011 23:21:20 +0000 (16:21 -0700)]
um: drivers/xterm.c: fix a file descriptor leak
I could use out_close1, but that seems to be the code path to close the fd
returned by os_create_unix_socket, and using it to close the fd returned
by mkstemp might lead to some confusion, so I don't do it.
Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Thadeu Lima de Souza Cascardo [Wed, 14 Sep 2011 23:21:08 +0000 (16:21 -0700)]
um: disable CMPXCHG_DOUBLE as it breaks UML build
Commit
b789ef518b2 ("slub: Add cmpxchg_double_slab()") tests for
cmpxchg_double support in the SLUB code and it breaks UML builds with
SLUB. Since UML does not support checking for CPU features, disable
CMPXCHG_DOUBLE just like CMPXCHG_LOCAL is disabled for UML.
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
Reviewed-by: Christoph Lameter <cl@linux.com>
Cc: Jeff Dike <jdike@addtoit.com>
Cc: Richard Weinberger <richard@nod.at>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Rientjes [Wed, 14 Sep 2011 23:21:05 +0000 (16:21 -0700)]
numa: fix NUMA compile error when sysfs and procfs are disabled
The vmstat_text array is only defined for CONFIG_SYSFS or CONFIG_PROC_FS,
yet it is referenced for per-node vmstat with CONFIG_NUMA:
drivers/built-in.o: In function `node_read_vmstat':
node.c:(.text+0x1106df): undefined reference to `vmstat_text'
Introduced in commit
fa25c503dfa2 ("mm: per-node vmstat: show proper
vmstats").
Define the array for CONFIG_NUMA as well.
[akpm@linux-foundation.org: remove unneeded ifdefs]
Signed-off-by: David Rientjes <rientjes@google.com>
Reported-by: Cong Wang <amwang@redhat.com>
Acked-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
KAMEZAWA Hiroyuki [Wed, 14 Sep 2011 23:21:02 +0000 (16:21 -0700)]
mm/mempolicy.c: make copy_from_user() provably correct
When compiling mm/mempolicy.c with struct user copy checks the following
warning is shown:
In file included from arch/x86/include/asm/uaccess.h:572,
from include/linux/uaccess.h:5,
from include/linux/highmem.h:7,
from include/linux/pagemap.h:10,
from include/linux/mempolicy.h:70,
from mm/mempolicy.c:68:
In function `copy_from_user',
inlined from `compat_sys_get_mempolicy' at mm/mempolicy.c:1415:
arch/x86/include/asm/uaccess_64.h:64: warning: call to `copy_from_user_overflow' declared with attribute warning: copy_from_user() buffer size is not provably correct
LD mm/built-in.o
Fix this by passing correct buffer size value.
Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Caspar Zhang [Wed, 14 Sep 2011 23:20:58 +0000 (16:20 -0700)]
mm/mempolicy.c: fix pgoff in mbind vma merge
commit
9d8cebd4bcd7 ("mm: fix mbind vma merge problem") didn't really
fix the mbind vma merge problem due to wrong pgoff value passing to
vma_merge(), which made vma_merge() always return NULL.
Before the patch applied, we are getting a result like:
addr = 0x7fa58f00c000
[snip]
7fa58f00c000-
7fa58f00d000 rw-p
00000000 00:00 0
7fa58f00d000-
7fa58f00e000 rw-p
00000000 00:00 0
7fa58f00e000-
7fa58f00f000 rw-p
00000000 00:00 0
here
7fa58f00c000->
7fa58f00f000 we get 3 VMAs which are expected to be
merged described as described in commit
9d8cebd.
Re-testing the patched kernel with the reproducer provided in commit
9d8cebd, we get the correct result:
addr = 0x7ffa5aaa2000
[snip]
7ffa5aaa2000-
7ffa5aaa6000 rw-p
00000000 00:00 0
7fffd556f000-
7fffd5584000 rw-p
00000000 00:00 0 [stack]
Signed-off-by: Caspar Zhang <caspar@casparzhang.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Christoph Lameter <cl@linux-foundation.org>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Minchan Kim <minchan.kim@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Wed, 14 Sep 2011 23:09:14 +0000 (16:09 -0700)]
Merge git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6
* git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6: (25 commits)
[SCSI] bnx2i: Fixed the endian on TTT for NOP out transmission
[SCSI] libfc: fix referencing to fc_fcp_pkt from the frame pointer via fr_fsp()
[SCSI] libfc: block SCSI eh thread for blocked rports
[SCSI] libfc: fix fc_eh_host_reset
[SCSI] fcoe: Fix deadlock between fip's recv_work and rtnl
[SCSI] qla2xxx: Update version number to 8.03.07.07-k.
[SCSI] qla2xxx: Set the task attributes after memsetting fcp cmnd.
[SCSI] qla2xxx: Correct inadvertent loop state transitions during port-update handling.
[SCSI] qla2xxx: Save and restore irq in the response queue interrupt handler.
[SCSI] qla2xxx: Double check for command completion if abort mailbox command fails.
[SCSI] qla2xxx: Acquire hardware lock while manipulating dsd list.
[SCSI] qla2xxx: Fix qla24xx revision check while enabling interrupts.
[SCSI] qla2xxx: T10 DIF - Fix incorrect error reporting.
[SCSI] qla2xxx: T10 DIF - Handle uninitalized sectors.
[SCSI] hpsa: fix physical device lun and target numbering problem
[SCSI] hpsa: fix problem that OBDR devices are not detected
[SCSI] isci: add version number
[SCSI] isci: fix event-get pointer increment
[SCSI] isci: dynamic interrupt coalescing
[SCSI] isci: Leave requests alone if already terminating.
...
Linus Torvalds [Wed, 14 Sep 2011 23:08:29 +0000 (16:08 -0700)]
Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
* 'for-linus' of git://oss.sgi.com/xfs/xfs:
xfs: fix a use after free in xfs_end_io_direct_write
Al Viro [Wed, 14 Sep 2011 17:55:41 +0000 (18:55 +0100)]
restore pinning the victim dentry in vfs_rmdir()/vfs_rename_dir()
We used to get the victim pinned by dentry_unhash() prior to commit
64252c75a219 ("vfs: remove dget() from dentry_unhash()") and ->rmdir()
and ->rename() instances relied on that; most of them don't care, but
ones that used d_delete() themselves do. As the result, we are getting
rmdir() oopses on NFS now.
Just grab the reference before locking the victim and drop it explicitly
after unlocking, same as vfs_rename_other() does.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Tested-by: Simon Kirby <sim@hostway.ca>
Cc: stable@kernel.org (3.0.x)
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Takashi Iwai [Wed, 14 Sep 2011 17:11:13 +0000 (19:11 +0200)]
Merge branch 'fix/asoc' into for-linus
Christoph Hellwig [Tue, 13 Sep 2011 22:26:00 +0000 (22:26 +0000)]
xfs: fix a use after free in xfs_end_io_direct_write
There is a window in which the ioend that we call inode_dio_wake on
in xfs_end_io_direct_write is already free. Fix this by storing
the inode pointer in a local variable.
This is a fix for the regression introduced in 3.1-rc by
"fs: move inode_dio_done to the end_io handler".
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Alex Elder <aelder@sgi.com>
Michel Dänzer [Tue, 13 Sep 2011 09:29:12 +0000 (11:29 +0200)]
drm/radeon: Unreference GEM object outside of spinlock in page flip error path.
Should fix https://bugzilla.redhat.com/show_bug.cgi?id=726277 .
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Michel Dänzer [Tue, 13 Sep 2011 09:27:35 +0000 (11:27 +0200)]
drm/radeon: Don't read from CP ring write pointer registers.
Apparently this doesn't always work reliably, e.g. at resume time.
Just initialize to 0, so the ring is considered empty.
Tested with hibernation on Sumo and Cayman cards.
Should fix https://bugs.launchpad.net/ubuntu/+source/linux/+bug/820746/ .
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Ben Skeggs [Tue, 13 Sep 2011 20:08:06 +0000 (06:08 +1000)]
drm/ttm: request zeroed system memory pages for new TT buffer objects
Fixes an information leak to userspace, we were handing out un-zeroed pages
for any newly created TTM_PL_TT buffer.
Reported-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Tested-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
David Henningsson [Wed, 14 Sep 2011 11:22:54 +0000 (13:22 +0200)]
ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name
This patch fixes "Surround Speaker Playback Volume" being cut off.
(Commit
b4dabfc452a10 was probably meant to fix this, but it fixed
only the "Switch" name, not the "Volume" name.)
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Jean Delvare [Wed, 14 Sep 2011 08:43:07 +0000 (04:43 -0400)]
hwmon: (coretemp) Initialize tmin
ttarget is initialized when the driver is loaded, but tmin is not.
As a result, tempX_max_hyst attributes read 0. Fix this.
Also use THERM_*_THRESHOLD* constants in these initializations instead
of hard-coding the constants.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: "R, Durgadoss" <durgadoss.r@intel.com>
Cc: Guenter Roeck <guenter.roeck@ericsson.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
H Hartley Sweeten [Fri, 9 Sep 2011 18:30:27 +0000 (11:30 -0700)]
lib/sha1.c: quiet sparse noise about symbol not declared
Include <linux/cryptohash.h> to pickup the declarations for sha_transform
and sha_init to quite the sparse noise:
warning: symbol 'sha_transform' was not declared. Should it be static?
warning: symbol 'sha_init' was not declared. Should it be static?
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Acked-by: Mandeep Singh Baines <msb@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Benjamin Herrenschmidt [Tue, 13 Sep 2011 18:16:33 +0000 (15:16 -0300)]
pci: Don't crash when reading mpss from root complex
In pcie_find_smpss(), we have the following statement:
if (dev->is_hotplug_bridge && (!list_is_singular(&dev->bus->devices) ||
dev->bus->self->pcie_type != PCI_EXP_TYPE_ROOT_PORT))
The problem is that at least on my machine, this gets called for the
root complex (virtual P2P bridge), and dev->bus->self is NULL since
the parent bus for this is not itself anchor to a PCI device.
This adds the necessary NULL check.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Jon Mason <mason@myri.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Thomas Gleixner [Tue, 19 Jul 2011 14:25:42 +0000 (16:25 +0200)]
x86, iommu: Mark DMAR IRQ as non-threaded
Mark this lowlevel IRQ handler as non-threaded. This prevents a boot
crash when "threadirqs" is on the kernel commandline. Also the
interrupt handler is handling hardware critical events which should
not be delayed into a thread.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Sachin Prabhu [Mon, 1 Aug 2011 11:10:12 +0000 (12:10 +0100)]
nfs: Do not allow multiple mounts on same mountpoint when using -o noac
Do not allow multiple mounts on same mountpoint when using -o noac
When you normally attempt to mount a share twice on the same mountpoint,
a check in do_add_mount causes it to return an error
# mount localhost:/nfsv3 /mnt
# mount localhost:/nfsv3 /mnt
mount.nfs: /mnt is already mounted or busy
However when using the option 'noac', the user is able to mount the same
share on the same mountpoint multiple times. This happens because a
share mounted with the noac option is automatically assigned the 'sync'
flag MS_SYNCHRONOUS in nfs_initialise_sb(). This flag is set after the
check for already existing superblocks is done in sget(). The check for
the mount flags in nfs_compare_mount_options() does not take into
account the 'sync' flag applied later on in the code path. This means
that when using 'noac', a new superblock structure is assigned for every
new mount of the same share and multiple shares on the same mountpoint
are allowed.
ie.
# mount -onoac localhost:/nfsv3 /mnt
can be run multiple times.
The patch checks for noac and assigns the sync flag before sget() is
called to obtain an already existing superblock structure.
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Trond Myklebust [Mon, 12 Sep 2011 15:47:53 +0000 (11:47 -0400)]
NFS: Fix a typo in nfs_flush_multi
Fix a typo which causes an Oops in the RPC layer, when using wsize < 4k.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Tested-by: Sricharan R <r.sricharan@ti.com>
Johannes Berg [Mon, 12 Sep 2011 19:09:10 +0000 (12:09 -0700)]
iwlagn: fix command queue timeout
If the command queue is constantly busy,
which can happen in P2P, the hangcheck
timer will frequently find a command in
it and will eventually reset the device
because nothing sets the timestamp for
this queue when commands are processed.
Fix this by setting the timestamp when
a command completes.
Cc: stable@kernel.org #2.6.39, #3.0.0 #3.1.0
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
SIgned-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Johannes Berg [Mon, 12 Sep 2011 19:08:25 +0000 (21:08 +0200)]
iwlagn: fix stack corruption
Alexander reported a strange crash in iwlagn that
Meenakshi and Wey couldn't reproduce. I just ran
into the same issue and tracked it down to stack
corruption. This fixes it.
The problem was introduced in
commit
4b8b99b6e650d0527f3a123744b7459976581d14
Author: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Date: Fri Jul 8 14:29:48 2011 -0700
iwlagn: radio sensor offset in le16 format
Cc: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Cc: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
Reported-by: Alexander Diewald <alex@diewald.cc>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Mohammed Shafi Shajakhan [Fri, 9 Sep 2011 05:11:08 +0000 (10:41 +0530)]
ath9k: Fix kernel panic on unplugging the device
when the device is yanked out ath_pci_remove starts doing the cleanups,
unregistering the hardware etc. so we should bail out immediately when
we get drv_flush callback from mac80211 when the card is being unplugged.
the panic occurs after we had associated to an AP.
EIP: 0060:[<
fb315b00>] EFLAGS:
00010246 CPU: 0
EIP is at ath_reset+0xa0/0x1c0 [ath9k]
EAX:
00000000 EBX:
000697c0 ECX:
00000002 EDX:
f3c3ccf0
ESI:
00000000 EDI:
00000000 EBP:
f43e7b78 ESP:
f43e7b50
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process kworker/u:2 (pid: 182, ti=
f43e6000 task=
f3c3c7c0
task.ti=
f43e6000)
Stack:
0000002a 00000000 00000000 003e7b78 0000000f eaaa8500
ffffffea eaaa97c0
eaaaa000 00000001 f43e7ba8 fb315d23 f99e7721 ecece680
eaaac738 eaaa8500
eaaaa020 000000c8 000000c8 00000000 eaaa8d58 eaaa8500
f43e7bd0 fb080b29
Call Trace:
[<
fb315d23>] ath9k_flush+0x103/0x170 [ath9k]
[<
fb080b29>] __ieee80211_recalc_idle+0x2c9/0x400
[mac80211]
[<
fb080c8e>] ieee80211_recalc_idle+0x2e/0x60 [mac80211]
[<
fb07aa73>] ieee80211_mgd_deauth+0x173/0x210 [mac80211]
[<
fb084559>] ieee80211_deauth+0x19/0x20 [mac80211]
[<
f99dda53>] __cfg80211_mlme_deauth+0xf3/0x140
[cfg80211]
[<
c0633d00>] ? __mutex_lock_common+0x1f0/0x380
[<
f99e1b5d>] __cfg80211_disconnect+0x18d/0x1f0
[cfg80211]
[<
f99c8199>] cfg80211_netdev_notifier_call+0x159/0x5c0
[cfg80211]
[<
c0608a64>] ? packet_notifier+0x174/0x1f0
[<
c0639202>] notifier_call_chain+0x82/0xb0
[<
c0170d8f>] raw_notifier_call_chain+0x1f/0x30
[<
c053b86c>] call_netdevice_notifiers+0x2c/0x60
[<
c0182184>] ? trace_hardirqs_on_caller+0xf4/0x180
[<
c053b8ec>] __dev_close_many+0x4c/0xd0
[<
c053ba2d>] dev_close_many+0x6d/0xc0
[<
c053bb53>] rollback_registered_many+0x93/0x1c0
[<
c018221b>] ? trace_hardirqs_on+0xb/0x10
[<
c053bc95>] unregister_netdevice_many+0x15/0x50
[<
fb07f83b>] ieee80211_remove_interfaces+0x7b/0xb0
[mac80211]
[<
fb06a14b>] ieee80211_unregister_hw+0x4b/0x110
[mac80211]
[<
fb311a4a>] ath9k_deinit_device+0x3a/0x60 [ath9k]
[<
fb31eed6>] ath_pci_remove+0x46/0x90 [ath9k]
[<
c03b4ac4>] pci_device_remove+0x44/0x100
[<
c043eb54>] __device_release_driver+0x64/0xb0
[<
c043ec67>] device_release_driver+0x27/0x40
[<
c043deeb>] bus_remove_device+0x7b/0xa0
[<
c043c491>] device_del+0xf1/0x180
[<
c043c530>] device_unregister+0x10/0x20
[<
c03afafe>] pci_stop_bus_device+0x6e/0x80
[<
c03afb72>] pci_remove_bus_device+0x12/0xa0
[<
c03c2f29>] pciehp_unconfigure_device+0x89/0x180
[<
c0181e54>] ? mark_held_locks+0x64/0x100
[<
c063390f>] ? __mutex_unlock_slowpath+0xaf/0x140
[<
c03c1f84>] pciehp_disable_slot+0x64/0x1b0
[<
c03c2850>] pciehp_power_thread+0xd0/0x100
[<
c0164ad0>] ? process_one_work+0x100/0x4d0
[<
c0164b4c>] process_one_work+0x17c/0x4d0
[<
c0164ad0>] ? process_one_work+0x100/0x4d0
[<
c03c2780>] ? queue_interrupt_event+0xa0/0xa0
[<
c01662bb>] worker_thread+0x13b/0x320
[<
c018221b>] ? trace_hardirqs_on+0xb/0x10
[<
c0166180>] ? manage_workers+0x1e0/0x1e0
[<
c016a654>] kthread+0x84/0x90
[<
c016a5d0>] ? __init_kthread_worker+0x60/0x60
[<
c063d106>] kernel_thread_helper+0x6/0x10
Cc: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Johannes Berg [Tue, 6 Sep 2011 10:47:39 +0000 (12:47 +0200)]
mac80211: fix missing sta_lock in __sta_info_destroy
Since my commit
34e895075e21be3e21e71d6317440d1ee7969ad0
("mac80211: allow station add/remove to sleep") there is
a race in mac80211 when it clears the TIM bit because a
sleeping station disconnected, the spinlock isn't held
around the relevant code any more. Use the right API to
acquire the spinlock correctly.
Cc: stable@kernel.org [2.6.34+]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
George [Sat, 3 Sep 2011 15:58:48 +0000 (10:58 -0500)]
rtlwifi: Fix problem when switching connections
The driver fails to clear encryption keys making it impossible
to switch connections.
Signed-off-by: George <george0505@realtek.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@kernel.org> [2.6.39+]
Signed-off-by: John W. Linville <linville@tuxdriver.com>
George [Sat, 3 Sep 2011 15:58:47 +0000 (10:58 -0500)]
rtlwifi: rtl8192su: Fix problem connecting to HT-enabled AP
The driver fails to connect to 802.11n-enabled APs. The patch fixes
Bug #42262.
Signed-off-by: George <george0505@realtek.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@kernel.org> [2.6.39+]
Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Vrabel [Tue, 13 Sep 2011 14:17:32 +0000 (10:17 -0400)]
xen/e820: if there is no dom0_mem=, don't tweak extra_pages.
The patch "xen: use maximum reservation to limit amount of usable RAM"
(
d312ae878b6aed3912e1acaaf5d0b2a9d08a4f11) breaks machines that
do not use 'dom0_mem=' argument with:
reserve RAM buffer:
000000133f2e2000 -
000000133fffffff
(XEN) mm.c:4976:d0 Global bit is set to kernel page
fffff8117e
(XEN) domain_crash_sync called from entry.S
(XEN) Domain 0 (vcpu#0) crashed on cpu#0:
...
The reason being that the last E820 entry is created using the
'extra_pages' (which is based on how many pages have been freed).
The mentioned git commit sets the initial value of 'extra_pages'
using a hypercall which returns the number of pages (if dom0_mem
has been used) or -1 otherwise. If the later we return with
MAX_DOMAIN_PAGES as basis for calculation:
return min(max_pages, MAX_DOMAIN_PAGES);
and use it:
extra_limit = xen_get_max_pages();
if (extra_limit >= max_pfn)
extra_pages = extra_limit - max_pfn;
else
extra_pages = 0;
which means we end up with extra_pages = 128GB in PFNs (
33554432)
- 8GB in PFNs (
2097152, on this specific box, can be larger or smaller),
and then we add that value to the E820 making it:
Xen:
00000000ff000000 -
0000000100000000 (reserved)
Xen:
0000000100000000 -
000000133f2e2000 (usable)
which is clearly wrong. It should look as so:
Xen:
00000000ff000000 -
0000000100000000 (reserved)
Xen:
0000000100000000 -
000000027fbda000 (usable)
Naturally this problem does not present itself if dom0_mem=max:X
is used.
CC: stable@kernel.org
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Guenter Roeck [Sat, 10 Sep 2011 13:02:12 +0000 (06:02 -0700)]
hwmon: (pmbus) Fix low limit temperature alarms
Temperature alarms are detected by checking the alarm bit and comparing
temperature limits against the current temperature. For low limits, this
comparison needs to be reversed (temp < limit instead of temp > limit).
This was not taken into account, resulting in wrong alarms if a temperature
fell below a low limit.
Fix by adding a low limit flag in the limit data structure. When creating the
sensor entry, the order of registers to compare is now reversed for low limits.
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
Acked-by: Jean Delvare <khali@linux-fr.org>
Cc: stable@kernel.org # 3.0+
Takashi Iwai [Tue, 13 Sep 2011 08:33:16 +0000 (10:33 +0200)]
ALSA: hda - Terminate the recursive connection search properly
The recursive search of widget connections in snd_hda_get_conn_index()
must be terminated at the pin and the audio-out widgets. Otherwise
you'll get "too deep connection" warnings unnecessarily.
Reported-by: Francis Moreau <francis.moro@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Chris Bagwell [Fri, 9 Sep 2011 20:38:10 +0000 (13:38 -0700)]
Input: wacom - fix touch parsing on newer Bamboos
Bamboos with Product ID's > 0xD4 return values unrelated to pressure
in touch 1 pressure field. They also report 2nd touch X/Y values
shifted down 1 byte (where pressure was). This results in jumpy
1 finger touch and totally invalid 2nd finger data.
For touch detection, switch to a Touch Present single bit that
all versions of Bamboo support.
For touch 2 offset, calculate offset based on a bit that is set
different between the two packet layouts.
Since touch pressure reports were removed from driver, there was
no need to be reading pressure any more.
Signed-off-by: Chris Bagwell <chris@cnpbagwell.com>
Reviewed-by: Ping Cheng <pinglinux@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Linus Torvalds [Tue, 13 Sep 2011 03:39:53 +0000 (20:39 -0700)]
Merge branch 'acpi' of git://github.com/lenb/linux
* 'acpi' of git://github.com/lenb/linux:
acpica: ACPI_MAX_SLEEP should be 2 sec, not 20
ACPI APEI: Add Kconfig option IRQ_WORK for GHES
PNP: update pnp.debug usage (needs value on command line)
APEI: Fix WHEA _OSC call
Linus Torvalds [Tue, 13 Sep 2011 00:22:31 +0000 (17:22 -0700)]
Merge branch 'upstream/bugfix' of git://github.com/jsgf/linux-xen
* 'upstream/bugfix' of git://github.com/jsgf/linux-xen:
xen: use non-tracing preempt in xen_clocksource_read()
Len Brown [Tue, 13 Sep 2011 00:00:00 +0000 (20:00 -0400)]
Merge branches 'apei', 'bz-13195' and 'doc' into acpi
Linus Torvalds [Mon, 12 Sep 2011 21:02:02 +0000 (14:02 -0700)]
Linux 3.1-rc6
Linus Torvalds [Mon, 12 Sep 2011 20:49:07 +0000 (13:49 -0700)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm: Remove duplicate "return" statement
drm/nv04/crtc: Bail out if FB is not bound to crtc
drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs
drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
drm/nouveau: fix oops on pre-semaphore hardware
drm/nv50/crtc: Bail out if FB is not bound to crtc
drm/radeon/kms: fix DP detect and EDID fetch for DP bridges
Linus Torvalds [Mon, 12 Sep 2011 18:51:35 +0000 (11:51 -0700)]
Merge branch 'fixes' of git://git.linaro.org/people/arnd/arm-soc
* 'fixes' of git://git.linaro.org/people/arnd/arm-soc:
ARM: CSR: add missing sentinels to of_device_id tables
ARM: cns3xxx: Fix newly introduced warnings in the PCIe code
ARM: cns3xxx: Fix compile error caused by hardware.h removed
ARM: davinci: fix cache flush build error
ARM: davinci: correct MDSTAT_STATE_MASK
ARM: davinci: da850 EVM: read mac address from SPI flash
OMAP: omap_device: fix !CONFIG_SUSPEND case in _noirq handlers
OMAP2430: hwmod: musb: add missing terminator to omap2430_usbhsotg_addrs[]
OMAP3: clock: indicate that gpt12_fck and wdt1_fck are in the WKUP clockdomain
OMAP4: clock: fix compile warning
OMAP4: clock: re-enable previous clockdomain enable/disable sequence
OMAP: clockdomain: Wait for powerdomain to be ON when using clockdomain force wakeup
OMAP: powerdomains: Make all powerdomain target states as ON at init
Mathieu Desnoyers [Sun, 11 Sep 2011 21:59:04 +0000 (17:59 -0400)]
ioctl: register LTTng ioctl
The LTTng 2.0 kernel tracer (stand-alone module package, available at
http://lttng.org) uses the 0xF6 ioctl range for tracer control and
transport operations.
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Mon, 12 Sep 2011 18:47:49 +0000 (11:47 -0700)]
Merge branch 'for-linus' of git://github.com/chrismason/linux
* 'for-linus' of git://github.com/chrismason/linux:
Btrfs: add dummy extent if dst offset excceeds file end in
Btrfs: calc file extent num_bytes correctly in file clone
btrfs: xattr: fix attribute removal
Btrfs: fix wrong nbytes information of the inode
Btrfs: fix the file extent gap when doing direct IO
Btrfs: fix unclosed transaction handle in btrfs_cont_expand
Btrfs: fix misuse of trans block rsv
Btrfs: reset to appropriate block rsv after orphan operations
Btrfs: skip locking if searching the commit root in csum lookup
btrfs: fix warning in iput for bad-inode
Btrfs: fix an oops when deleting snapshots
Miklos Szeredi [Mon, 12 Sep 2011 07:38:03 +0000 (09:38 +0200)]
fuse: fix memory leak
kmemleak is reporting that 32 bytes are being leaked by FUSE:
unreferenced object 0xe373b270 (size 32):
comm "fusermount", pid 1207, jiffies
4294707026 (age 2675.187s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<
b05517d7>] kmemleak_alloc+0x27/0x50
[<
b0196435>] kmem_cache_alloc+0xc5/0x180
[<
b02455be>] fuse_alloc_forget+0x1e/0x20
[<
b0245670>] fuse_alloc_inode+0xb0/0xd0
[<
b01b1a8c>] alloc_inode+0x1c/0x80
[<
b01b290f>] iget5_locked+0x8f/0x1a0
[<
b0246022>] fuse_iget+0x72/0x1a0
[<
b02461da>] fuse_get_root_inode+0x8a/0x90
[<
b02465cf>] fuse_fill_super+0x3ef/0x590
[<
b019e56f>] mount_nodev+0x3f/0x90
[<
b0244e95>] fuse_mount+0x15/0x20
[<
b019d1bc>] mount_fs+0x1c/0xc0
[<
b01b5811>] vfs_kern_mount+0x41/0x90
[<
b01b5af9>] do_kern_mount+0x39/0xd0
[<
b01b7585>] do_mount+0x2e5/0x660
[<
b01b7966>] sys_mount+0x66/0xa0
This leak report is consistent and happens once per boot on
3.1.0-rc5-dirty.
This happens if a FORGET request is queued after the fuse device was
released.
Reported-by: Sitsofe Wheeler <sitsofe@yahoo.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Tested-by: Sitsofe Wheeler <sitsofe@yahoo.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Miklos Szeredi [Mon, 12 Sep 2011 07:31:49 +0000 (09:31 +0200)]
fuse: fix flock breakage
Commit
37fb3a30b4 ("fuse: fix flock") added in 3.1-rc4 caused flock() to
fail with ENOSYS with the kernel ABI version 7.16 or earlier.
Fix by falling back to testing FUSE_POSIX_LOCKS for ABI versions 7.16
and earlier.
Reported-by: Martin Ziegler <ziegler@email.mathematik.uni-freiburg.de>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Tested-by: Martin Ziegler <ziegler@email.mathematik.uni-freiburg.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Arnd Bergmann [Mon, 12 Sep 2011 18:30:22 +0000 (20:30 +0200)]
Merge branch 'for_3.1/pm-fixes-2' of git://gitorious.org/khilman/linux-omap-pm into fixes
Arnd Bergmann [Mon, 12 Sep 2011 14:59:37 +0000 (14:59 +0000)]
Merge branch 'sirf/fixes' into fixes
Arnd Bergmann [Sun, 11 Sep 2011 18:07:30 +0000 (20:07 +0200)]
ASoC: Fix trivial build regression in Kirkwood I2S
A fix merged in 3.1-rc2 introduced a small regression, this should get it
to build again.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Liam Girdwood <lrg@ti.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Geert Uytterhoeven [Sun, 11 Sep 2011 11:59:27 +0000 (13:59 +0200)]
genirq: Make irq_shutdown() symmetric vs. irq_startup again
If an irq_chip provides .irq_shutdown(), but neither of .irq_disable() or
.irq_mask(), free_irq() crashes when jumping to NULL.
Fix this by only trying .irq_disable() and .irq_mask() if there's no
.irq_shutdown() provided.
This revives the symmetry with irq_startup(), which tries .irq_startup(),
.irq_enable(), and irq_unmask(), and makes it consistent with the comment for
irq_chip.irq_shutdown() in <linux/irq.h>, which says:
* @irq_shutdown: shut down the interrupt (defaults to ->disable if NULL)
This is also how __free_irq() behaved before the big overhaul, cfr. e.g.
3b56f0585fd4c02d047dc406668cb40159b2d340 ("genirq: Remove bogus conditional"),
where the core interrupt code always overrode .irq_shutdown() to
.irq_disable() if .irq_shutdown() was NULL.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Link: http://lkml.kernel.org/r/1315742394-16036-2-git-send-email-geert@linux-m68k.org
Cc: stable@kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Linus Torvalds [Sun, 11 Sep 2011 21:58:47 +0000 (14:58 -0700)]
Merge branch 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus
* 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus:
[media] vp7045: fix buffer setup
[media] nuvoton-cir: simplify raw IR sample handling
[media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL
[media] v4l2: Fix documentation of the codec device controls
[media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240
[media] gspca - sonixj: Fix wrong register mask for sensor om6802
[media] gspca - ov519: Fix LED inversion of some ov519 webcams
[media] pwc: precedence bug in pwc_init_controls()
Linus Torvalds [Sun, 11 Sep 2011 21:55:43 +0000 (14:55 -0700)]
Merge branch 'for-linus' of git://openrisc.net/~jonas/linux
* 'for-linus' of git://openrisc.net/~jonas/linux:
Add missing DMA ops
openrisc: don't use pt_regs in struct sigcontext
Li Zefan [Sun, 11 Sep 2011 14:52:25 +0000 (10:52 -0400)]
Btrfs: add dummy extent if dst offset excceeds file end in
You can see there's no file extent with range [0, 4096]. Check this by
btrfsck:
# btrfsck /dev/sda7
root 5 inode 258 errors 100
...
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Li Zefan [Sun, 11 Sep 2011 14:52:25 +0000 (10:52 -0400)]
Btrfs: calc file extent num_bytes correctly in file clone
num_bytes should be 4096 not 12288.
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
David Sterba [Sun, 11 Sep 2011 14:52:25 +0000 (10:52 -0400)]
btrfs: xattr: fix attribute removal
An attribute is not removed by 'setfattr -x attr file' and remains
visible in attr list. This makes xfstests/062 pass again.
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Miao Xie [Sun, 11 Sep 2011 14:52:25 +0000 (10:52 -0400)]
Btrfs: fix wrong nbytes information of the inode
If we write some data into the data hole of the file(no preallocation for this
hole), Btrfs will allocate some disk space, and update nbytes of the inode, but
the other element--disk_i_size needn't be updated. At this condition, we must
update inode metadata though disk_i_size is not changed(btrfs_ordered_update_i_size()
return 1).
# mkfs.btrfs /dev/sdb1
# mount /dev/sdb1 /mnt
# touch /mnt/a
# truncate -s 856002 /mnt/a
# dd if=/dev/zero of=/mnt/a bs=4K count=1 conv=nocreat,notrunc
# umount /mnt
# btrfsck /dev/sdb1
root 5 inode 257 errors 400
found 32768 bytes used err is 1
Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Miao Xie [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: fix the file extent gap when doing direct IO
When we write some data to the place that is beyond the end of the file
in direct I/O mode, a data hole will be created. And Btrfs should insert
a file extent item that point to this hole into the fs tree. But unfortunately
Btrfs forgets doing it.
The following is a simple way to reproduce it:
# mkfs.btrfs /dev/sdc2
# mount /dev/sdc2 /test4
# touch /test4/a
# dd if=/dev/zero of=/test4/a seek=8 count=1 bs=4K oflag=direct conv=nocreat,notrunc
# umount /test4
# btrfsck /dev/sdc2
root 5 inode 257 errors 100
Reported-by: Tsutomu Itoh <t-itoh@jp.fujitsu.com>
Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
Tested-by: Tsutomu Itoh <t-itoh@jp.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Miao Xie [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: fix unclosed transaction handle in btrfs_cont_expand
The function - btrfs_cont_expand() forgot to close the transaction handle before
it jump out the while loop. Fix it.
Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Liu Bo [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: fix misuse of trans block rsv
At the beginning of create_pending_snapshot, trans->block_rsv is set
to pending->block_rsv and is used for snapshot things, however, when
it is done, we do not recover it as will.
Signed-off-by: Liu Bo <liubo2009@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Liu Bo [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: reset to appropriate block rsv after orphan operations
While truncating free space cache, we forget to change trans->block_rsv
back to the original one, but leave it with the orphan_block_rsv, and
then with option inode_cache enable, it leads to countless warnings of
btrfs_alloc_free_block and btrfs_orphan_commit_root:
WARNING: at fs/btrfs/extent-tree.c:5711 btrfs_alloc_free_block+0x180/0x350 [btrfs]()
...
WARNING: at fs/btrfs/inode.c:2193 btrfs_orphan_commit_root+0xb0/0xc0 [btrfs]()
Signed-off-by: Liu Bo <liubo2009@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Josef Bacik [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: skip locking if searching the commit root in csum lookup
It's not enough to just search the commit root, since we could be cow'ing the
very block we need to search through, which would mean that its locked and we'll
still deadlock. So use path->skip_locking as well. Thanks,
Signed-off-by: Josef Bacik <josef@redhat.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Sergei Trofimovich [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
btrfs: fix warning in iput for bad-inode
iput() shouldn't be called for inodes in I_NEW state.
We need to mark inode as constructed first.
WARNING: at fs/inode.c:1309 iput+0x20b/0x210()
Call Trace:
[<
ffffffff8103e7ba>] warn_slowpath_common+0x7a/0xb0
[<
ffffffff8103e805>] warn_slowpath_null+0x15/0x20
[<
ffffffff810eaf0b>] iput+0x20b/0x210
[<
ffffffff811b96fb>] btrfs_iget+0x1eb/0x4a0
[<
ffffffff811c3ad6>] btrfs_run_defrag_inodes+0x136/0x210
[<
ffffffff811ad55f>] cleaner_kthread+0x17f/0x1a0
[<
ffffffff81035b7d>] ? sub_preempt_count+0x9d/0xd0
[<
ffffffff811ad3e0>] ? transaction_kthread+0x280/0x280
[<
ffffffff8105af86>] kthread+0x96/0xa0
[<
ffffffff814336d4>] kernel_thread_helper+0x4/0x10
[<
ffffffff8105aef0>] ? kthread_worker_fn+0x190/0x190
[<
ffffffff814336d0>] ? gs_change+0xb/0xb
Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
CC: Konstantin Khlebnikov <khlebnikov@openvz.org>
Tested-by: David Sterba <dsterba@suse.cz>
CC: Josef Bacik <josef@redhat.com>
CC: Chris Mason <chris.mason@oracle.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Liu Bo [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: fix an oops when deleting snapshots
We can reproduce this oops via the following steps:
$ mkfs.btrfs /dev/sdb7
$ mount /dev/sdb7 /mnt/btrfs
$ for ((i=0; i<3; i++)); do btrfs sub snap /mnt/btrfs /mnt/btrfs/s_$i; done
$ rm -fr /mnt/btrfs/*
$ rm -fr /mnt/btrfs/*
then we'll get
------------[ cut here ]------------
kernel BUG at fs/btrfs/inode.c:2264!
[...]
Call Trace:
[<
ffffffffa05578c7>] btrfs_rmdir+0xf7/0x1b0 [btrfs]
[<
ffffffff81150b95>] vfs_rmdir+0xa5/0xf0
[<
ffffffff81153cc3>] do_rmdir+0x123/0x140
[<
ffffffff81145ac7>] ? fput+0x197/0x260
[<
ffffffff810aecff>] ? audit_syscall_entry+0x1bf/0x1f0
[<
ffffffff81153d0d>] sys_unlinkat+0x2d/0x40
[<
ffffffff8147896b>] system_call_fastpath+0x16/0x1b
RIP [<
ffffffffa054f7b9>] btrfs_orphan_add+0x179/0x1a0 [btrfs]
When it comes to btrfs_lookup_dentry, we may set a snapshot's inode->i_ino
to BTRFS_EMPTY_SUBVOL_DIR_OBJECTID instead of BTRFS_FIRST_FREE_OBJECTID,
while the snapshot's location.objectid remains unchanged.
However, btrfs_ino() does not take this into account, and returns a wrong ino,
and causes the oops.
Signed-off-by: Liu Bo <liubo2009@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Florian Mickler [Wed, 10 Aug 2011 10:05:20 +0000 (07:05 -0300)]
[media] vp7045: fix buffer setup
dvb_usb_device_init calls the frontend_attach method of this driver which
uses vp7045_usb_ob. In order to have a buffer ready in vp7045_usb_op, it has to
be allocated before that happens.
Luckily we can use the whole private data as the buffer as it gets separately
allocated on the heap via kzalloc in dvb_usb_device_init and is thus apt for
use via usb_control_msg.
This fixes a
BUG: unable to handle kernel paging request at
0000000000001e78
reported by Tino Keitel and diagnosed by Dan Carpenter.
Cc: stable@kernel.org # For v3.0 and upper
Tested-by: Tino Keitel <tino.keitel@tikei.de>
Signed-off-by: Florian Mickler <florian@mickler.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Jarod Wilson [Mon, 8 Aug 2011 20:20:40 +0000 (17:20 -0300)]
[media] nuvoton-cir: simplify raw IR sample handling
The nuvoton-cir driver was storing up consecutive pulse-pulse and
space-space samples internally, for no good reason, since
ir_raw_event_store_with_filter() already merges back to back like
samples types for us. This should also fix a regression introduced late
in 3.0 that related to a timeout change, which actually becomes correct
when coupled with this change. Tested with RC6 and RC5 on my own
nuvoton-cir hardware atop vanilla 3.0.0, after verifying quirky
behavior in 3.0 due to the timeout change.
Reported-by: Stephan Raue <sraue@openelec.tv>
CC: Stephan Raue <sraue@openelec.tv>
CC: stable@vger.kernel.org
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Jesper Juhl [Mon, 1 Aug 2011 21:39:17 +0000 (18:39 -0300)]
[media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL
In the unlikely case that pci_find_bus() should return NULL
viacam_serial_is_enabled() is going to dereference a NULL pointer and
blow up. Better safe than sorry, so be defensive and check the
pointer.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Kamil Debski [Tue, 2 Aug 2011 15:53:49 +0000 (12:53 -0300)]
[media] v4l2: Fix documentation of the codec device controls
Fixed missing ids of the codec controls description in the controls.xml file.
Signed-off-by: Kamil Debski <k.debski@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Reported-by: Randy Dunlap <rdunlap@xenotime.net>
Acked-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Jean-François Moine [Tue, 9 Aug 2011 18:13:50 +0000 (15:13 -0300)]
[media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240
The images are clearer with a lower bridge clock.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Luiz Carlos Ramos [Tue, 9 Aug 2011 17:36:57 +0000 (14:36 -0300)]
[media] gspca - sonixj: Fix wrong register mask for sensor om6802
The bug was introduced by git commit
0e4d413af1a9d, giving very dark images.
Signed-off-by: Luiz Carlos Ramos <lramos.prof@yahoo.com.br>
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Jean-François Moine [Tue, 9 Aug 2011 08:28:17 +0000 (05:28 -0300)]
[media] gspca - ov519: Fix LED inversion of some ov519 webcams
The list of the webcams which have LED inversion was rebuild scanning
ms-win .inf files.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Dan Carpenter [Sat, 23 Jul 2011 18:53:03 +0000 (15:53 -0300)]
[media] pwc: precedence bug in pwc_init_controls()
'!' has higher precedence than '&' so we need parenthesis here.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Jonas Bonn [Mon, 5 Sep 2011 11:47:10 +0000 (13:47 +0200)]
Add missing DMA ops
For the initial architecture submission, not all of the DMA ops were
implemented. This patch adds the *map_page and *map_sg variants of the
DMA mapping ops.
This patch is currently of interest mainly to some drivers that haven't
been submitted upstream yet.
Signed-off-by: Jonas Bonn <jonas@southpole.se>
Jamie Iles [Mon, 1 Aug 2011 20:09:36 +0000 (21:09 +0100)]
ARM: CSR: add missing sentinels to of_device_id tables
The of_device_id tables used for matching should be terminated with
empty sentinel values.
Signed-off-by: Jamie Iles <jamie@jamieiles.com>
Signed-off-by: Barry Song <baohua.song@csr.com>
Randy Dunlap [Sun, 11 Sep 2011 00:13:34 +0000 (17:13 -0700)]
scsi: qla4xxx driver depends on NET
When CONFIG_NET is disabled, SCSI_QLA_ISCSI selects SCSI_ISCSI_ATTRS,
which uses network interfaces, so the build fails with multiple errors:
warning: (ISCSI_TCP && SCSI_CXGB3_ISCSI && SCSI_CXGB4_ISCSI && SCSI_QLA_ISCSI && INFINIBAND_ISER) selects SCSI_ISCSI_ATTRS which has unmet direct dependencies (SCSI && NET)
ERROR: "skb_trim" [drivers/scsi/scsi_transport_iscsi.ko] undefined!
ERROR: "netlink_kernel_create" [drivers/scsi/scsi_transport_iscsi.ko] undefined!
ERROR: "netlink_kernel_release" [drivers/scsi/scsi_transport_iscsi.ko] undefined!
...
so make SCSI_QLA_ISCSI also depend on NET to prevent the build errors.
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Cc: Ravi Anand <ravi.anand@qlogic.com>
Cc: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Cc: iscsi-driver@qlogic.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sun, 11 Sep 2011 00:28:46 +0000 (17:28 -0700)]
Merge branch 'fixes' of ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm
* 'fixes' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm:
ARM: 7088/1: entry: fix wrong parameter name used in do_thumb_abort
ARM: 7080/1: l2x0: make sure I&D are not locked down on init
ARM: 7081/1: mach-integrator: fix the clocksource
NET: am79c961: fix race in link status code
ARM: 7067/1: mm: keep significant bits in pfn_valid
Janusz Krzysztofik [Thu, 8 Sep 2011 17:45:40 +0000 (18:45 +0100)]
ARM: 7088/1: entry: fix wrong parameter name used in do_thumb_abort
Commit
be020f8618ca, "ARM: entry: abort-macro: specify registers to be
used for macros", while replacing register numbers with macro parameter
names, mismatched the name used for r1. For me, this resulted in user
space built for EABI with -march=armv4t -mtune=arm920t -mthumb-interwork
-mthumb broken on my OMAP1510 based Amstrad Delta (old ABI and no thumb
still worked for me though).
Fix this by using correct parameter name fsr instead of mismatched psr,
used by callers for another purpose.
Signed-off-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Arnd Bergmann [Sat, 10 Sep 2011 21:20:25 +0000 (23:20 +0200)]
Merge branches 'cns3xxx/fixes', 'omap/fixes' and 'davinci/fixes' into fixes
Bart Van Assche [Sat, 10 Sep 2011 18:13:01 +0000 (20:13 +0200)]
backlight: Declare backlight_types[] const
Since backlight_types[] isn't modified, let's declare it const. That
was probably the intention of the author of commit
bb7ca747f8d6
("backlight: add backlight type"), via which the "const char const *"
construct was introduced. The duplicate const was detected by sparse.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Cc: Matthew Garrett <mjg@redhat.com>
Cc: Richard Purdie <rpurdie@rpsys.net>
Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sat, 10 Sep 2011 17:19:15 +0000 (10:19 -0700)]
Merge branch 'for-linus' of git://neil.brown.name/md
* 'for-linus' of git://neil.brown.name/md:
md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
md/raid1,10: Remove use-after-free bug in make_request.
md/raid10: unify handling of write completion.
Avoid dereferencing a 'request_queue' after last close.
NeilBrown [Sat, 10 Sep 2011 07:21:28 +0000 (17:21 +1000)]
md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
0.90 metadata uses an unsigned 32bit number to count the number of
kilobytes used from each device.
This should allow up to 4TB per device.
However we multiply this by 2 (to get sectors) before casting to a
larger type, so sizes above 2TB get truncated.
Also we allow rdev->sectors to be larger than 4TB, so it is possible
for the array to be resized larger than the metadata can handle.
So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in
used.
Also the sanity check at the end of super_90_load should include level
1 as it used ->size too. (RAID0 and Linear don't use ->size at all).
Reported-by: Pim Zandbergen <P.Zandbergen@macroscoop.nl>
Cc: stable@kernel.org
Signed-off-by: NeilBrown <neilb@suse.de>
NeilBrown [Sat, 10 Sep 2011 07:21:23 +0000 (17:21 +1000)]
md/raid1,10: Remove use-after-free bug in make_request.
A single request to RAID1 or RAID10 might result in multiple
requests if there are known bad blocks that need to be avoided.
To detect if we need to submit another write request we test:
if (sectors_handled < (bio->bi_size >> 9)) {
However this is after we call **_write_done() so the 'bio' no longer
belongs to us - the writes could have completed and the bio freed.
So move the **_write_done call until after the test against
bio->bi_size.
This addresses https://bugzilla.kernel.org/show_bug.cgi?id=41862
Reported-by: Bruno Wolff III <bruno@wolff.to>
Tested-by: Bruno Wolff III <bruno@wolff.to>
Signed-off-by: NeilBrown <neilb@suse.de>
NeilBrown [Sat, 10 Sep 2011 07:21:17 +0000 (17:21 +1000)]
md/raid10: unify handling of write completion.
A write can complete at two different places:
1/ when the last member-device write completes, through
raid10_end_write_request
2/ in make_request() when we remove the initial bias from ->remaining.
These two should do exactly the same thing and the comment says they
do, but they don't.
So factor the correct code out into a function and call it in both
places. This makes the code much more similar to RAID1.
The difference is only significant if there is an error, and they
usually take a while, so it is unlikely that there will be an error
already when make_request is completing, so this is unlikely to cause
real problems.
Signed-off-by: NeilBrown <neilb@suse.de>
NeilBrown [Sat, 10 Sep 2011 07:20:21 +0000 (17:20 +1000)]
Avoid dereferencing a 'request_queue' after last close.
On the last close of an 'md' device which as been stopped, the device
is destroyed and in particular the request_queue is freed. The free
is done in a separate thread so it might happen a short time later.
__blkdev_put calls bdev_inode_switch_bdi *after* ->release has been
called.
Since commit
f758eeabeb96f878c860e8f110f94ec8820822a9
bdev_inode_switch_bdi will dereference the 'old' bdi, which lives
inside a request_queue, to get a spin lock. This causes the last
close on an md device to sometime take a spin_lock which lives in
freed memory - which results in an oops.
So move the called to bdev_inode_switch_bdi before the call to
->release.
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hugh Dickins <hughd@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Acked-by: Wu Fengguang <fengguang.wu@intel.com>
Cc: stable@kernel.org
Signed-off-by: NeilBrown <neilb@suse.de>
Jon Mason [Thu, 8 Sep 2011 21:41:18 +0000 (16:41 -0500)]
PCI: Remove MRRS modification from MPS setting code
Modifying the Maximum Read Request Size to 0 (value of 128Bytes) has
massive negative ramifications on some devices. Without knowing which
devices have this issue, do not modify from the default value when
walking the PCI-E bus in pcie_bus_safe mode. Also, make pcie_bus_safe
the default procedure.
Tested-by: Sven Schnelle <svens@stackframe.org>
Tested-by: Simon Kirby <sim@hostway.ca>
Tested-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Reported-and-tested-by: Eric Dumazet <eric.dumazet@gmail.com>
Reported-and-tested-by: Niels Ole Salscheider <niels_ole@salscheider-online.de>
References: https://bugzilla.kernel.org/show_bug.cgi?id=42162
Signed-off-by: Jon Mason <mason@myri.com>
Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Shyam Iyer [Thu, 8 Sep 2011 21:41:17 +0000 (16:41 -0500)]
Fix pointer dereference before call to pcie_bus_configure_settings
Commit
b03e7495a862 ("PCI: Set PCI-E Max Payload Size on fabric")
introduced a potential NULL pointer dereference in calls to
pcie_bus_configure_settings due to attempts to access pci_bus self
variables when the self pointer is NULL.
To correct this, verify that the self pointer in pci_bus is non-NULL
before dereferencing it.
Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Shyam Iyer <shyam_iyer@dell.com>
Signed-off-by: Jon Mason <mason@myri.com>
Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Fri, 9 Sep 2011 22:50:25 +0000 (15:50 -0700)]
Merge branch 'for-linus' of git://dev.laptop.org/users/cjb/mmc
* 'for-linus' of git://dev.laptop.org/users/cjb/mmc:
mmc: sdhci-s3c: Fix mmc card I/O problem
mmc: sd: UHS-I bus speed should be set last in UHS initialization
mmc: sdhi: initialise mmc_data->flags before use
mmc: core: use non-reentrant workqueue for clock gating
mmc: core: prevent aggressive clock gating racing with ios updates
mmc: rename mmc_host_clk_{ungate|gate} to mmc_host_clk_{hold|release}
mmc: sdhci-esdhc-imx: add missing inclusion of linux/module.h
Linus Torvalds [Fri, 9 Sep 2011 22:48:34 +0000 (15:48 -0700)]
Merge branch 'for-linus' of git://ceph.newdream.net/git/ceph-client
* 'for-linus' of git://ceph.newdream.net/git/ceph-client:
libceph: fix leak of osd structs during shutdown
ceph: fix memory leak
ceph: fix encoding of ino only (not relative) paths
libceph: fix msgpool
Miklos Szeredi [Mon, 5 Sep 2011 16:06:26 +0000 (18:06 +0200)]
vfs: automount should ignore LOOKUP_FOLLOW
Prior to 2.6.38 automount would not trigger on either stat(2) or
lstat(2) on the automount point.
After 2.6.38, with the introduction of the ->d_automount()
infrastructure, stat(2) and others would start triggering automount
while lstat(2), etc. still would not. This is a regression and a
userspace ABI change.
Problem originally reported here:
http://thread.gmane.org/gmane.linux.kernel.autofs/6098
It appears that there was an attempt at fixing various userspace tools
to not trigger the automount. But since the stat system call is
rather common it is impossible to "fix" all userspace.
This patch reverts the original behavior, which is to not trigger on
stat(2) and other symlink following syscalls.
[ It's not really clear what the right behavior is. Apparently Solaris
does the "automount on stat, leave alone on lstat". And some programs
can get unhappy when "stat+open+fstat" ends up giving a different
result from the fstat than from the initial stat.
But the change in 2.6.38 resulted in problems for some people, so
we're going back to old behavior. Maybe we can re-visit this
discussion at some future date - Linus ]
Reported-by: Leonardo Chiquitto <leonardo.lists@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Acked-by: Ian Kent <raven@themaw.net>
Cc: David Howells <dhowells@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Pieter-Augustijn Van Malleghem [Fri, 9 Sep 2011 20:29:45 +0000 (13:29 -0700)]
Input: bcm5974 - add MacBookAir4,1 trackpad support
This patch adds trackpad support for the MacBookAir4,1, released in July 2011.
It is very similar to the MacBookAir4,2 patch submitted by Joshua Dillon and
Chase Douglas.
Signed-off-by: Pieter-Augustijn Van Malleghem <p-a@scarlet.be>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Anton Vorontsov [Fri, 9 Sep 2011 19:18:00 +0000 (23:18 +0400)]
ARM: cns3xxx: Fix newly introduced warnings in the PCIe code
commit
d5341942d784134f2997b3ff82cd63cf71d1f932 ("PCI: Make the struct
pci_dev * argument of pci_fixup_irqs const") did not change argument
of pdev_to_cnspci(), and thus introduced the following warnings:
CHECK arch/arm/mach-cns3xxx/pcie.c
pcie.c:177:60: warning: incorrect type in argument 1 (different modifiers)
pcie.c:177:60: expected struct pci_dev *dev
pcie.c:177:60: got struct pci_dev const *dev
CC arch/arm/mach-cns3xxx/pcie.o
pcie.c: In function 'cns3xxx_pcie_map_irq':
pcie.c:177: warning: passing argument 1 of 'pdev_to_cnspci' discards qualifiers from pointer target type
pcie.c:52: note: expected 'struct pci_dev *' but argument is of type 'const struct pci_dev *'
This patch fixes the issue.
Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>
Tommy Lin [Thu, 28 Jul 2011 17:14:46 +0000 (01:14 +0800)]
ARM: cns3xxx: Fix compile error caused by hardware.h removed
Commit
c9d95fbe59e426eed7f16e7cac812e46ac4772d0 "ARM: convert PCI defines
to variables" deleted cns3xxx' hardware.h, but didn't remove references
for it, so do it now.
This patch removes lines that refer to hardware.h.
Signed-off-by: Tommy Lin <tommy.lin.1101@gmail.com>
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>
Lin Ming [Wed, 7 Sep 2011 14:58:09 +0000 (22:58 +0800)]
drm: Remove duplicate "return" statement
Remove the duplicate "return" statement in drm_fb_helper_panic().
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Fri, 9 Sep 2011 08:10:04 +0000 (09:10 +0100)]
Merge branch 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-test
* 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
drm/nv04/crtc: Bail out if FB is not bound to crtc
drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs
drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
drm/nouveau: fix oops on pre-semaphore hardware
drm/nv50/crtc: Bail out if FB is not bound to crtc
Emil Velikov [Thu, 25 Aug 2011 20:36:51 +0000 (21:36 +0100)]
drm/nv04/crtc: Bail out if FB is not bound to crtc
This commit resolves a possible 'NULL pointer dereference'
It uses the same approach as radeon, intel and nouveau/nv50
Fixes bug 'Nouveau: Kernel oops when unplugging external monitor'
https://bugs.freedesktop.org/show_bug.cgi?id=40336
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Marcin Slusarz [Mon, 22 Aug 2011 21:22:13 +0000 (23:22 +0200)]
drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs
nv04_sgdma_bind binds the same page multiple times on
architectures where PAGE_SIZE != 4096.
Let's fix it.
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Marcin Slusarz [Mon, 22 Aug 2011 21:14:05 +0000 (23:14 +0200)]
drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
Not cleaning after alloc failure would result in crash on destroy,
because nouveau_sgdma_clear assumes "ttm_alloced" to be not null when
"pages" is not null.
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Ben Skeggs [Tue, 23 Aug 2011 00:23:11 +0000 (10:23 +1000)]
drm/nouveau: fix oops on pre-semaphore hardware
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Emil Velikov [Sun, 21 Aug 2011 21:48:12 +0000 (22:48 +0100)]
drm/nv50/crtc: Bail out if FB is not bound to crtc
Fixes possbile NULL pointer dereference
Resolves 'kernel crash in nv50_crtc_do_mode_set_base during shutdown'
https://bugs.freedesktop.org/show_bug.cgi?id=40005
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Linus Torvalds [Thu, 8 Sep 2011 23:49:32 +0000 (16:49 -0700)]
Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma
* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
dmaengine/ste_dma40: fix memory leak due to prepared descriptors
dmaengine/ste_dma40: fix Oops due to double free of client descriptor
dmaengine/ste_dma40: remove duplicate call to d40_pool_lli_free().
dmaengine/ste_dma40: add missing kernel doc for pending_queue
This page took 0.078092 seconds and 5 git commands to generate.