summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2013-09-23Merge tag 'staging-3.12-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging fixes from Greg KH: "Here are a number of small staging tree and iio driver fixes. Nothing major, just lots of little things" * tag 'staging-3.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (34 commits) iio:buffer_cb: Add missing iio_buffer_init() iio: Prevent race between IIO chardev opening and IIO device free iio: fix: Keep a reference to the IIO device for open file descriptors iio: Stop sampling when the device is removed iio: Fix crash when scan_bytes is computed with active_scan_mask == NULL iio: Fix mcp4725 dev-to-indio_dev conversion in suspend/resume iio: Fix bma180 dev-to-indio_dev conversion in suspend/resume iio: Fix tmp006 dev-to-indio_dev conversion in suspend/resume iio: iio_device_add_event_sysfs() bugfix staging: iio: ade7854-spi: Fix return value staging:iio:hmc5843: Fix measurement conversion iio: isl29018: Fix uninitialized value staging:iio:dummy fix kfifo_buf kconfig dependency issue if kfifo modular and buffer enabled for built in dummy driver. iio: at91: fix adc_clk overflow staging: line6: add bounds check in snd_toneport_source_put() Staging: comedi: Fix dependencies for drivers misclassified as PCI staging: r8188eu: Adjust RX gain staging: r8188eu: Fix smatch warning in core/rtw_ieee80211. staging: r8188eu: Fix smatch error in core/rtw_mlme_ext.c staging: r8188eu: Fix Smatch off-by-one warning in hal/rtl8188e_hal_init.c ...
2013-09-23Merge tag 'usb-3.12-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a number of small USB fixes for 3.12-rc2. One is a revert of a EHCI change that isn't quite ready for 3.12. Others are minor things, gadget fixes, Kconfig fixes, and some quirks and documentation updates. All have been in linux-next for a bit" * tag 'usb-3.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: pl2303: distinguish between original and cloned HX chips USB: Faraday fotg210: fix email addresses USB: fix typo in usb serial simple driver Kconfig Revert "USB: EHCI: support running URB giveback in tasklet context" usb: s3c-hsotg: do not disconnect gadget when receiving ErlySusp intr usb: s3c-hsotg: fix unregistration function usb: gadget: f_mass_storage: reset endpoint driver data when disabled usb: host: fsl-mph-dr-of: Staticize local symbols usb: gadget: f_eem: Staticize eem_alloc usb: gadget: f_ecm: Staticize ecm_alloc usb: phy: omap-usb3: Fix return value usb: dwc3: gadget: avoid memory leak when failing to allocate all eps usb: dwc3: remove extcon dependency usb: gadget: add '__ref' for rndis_config_register() and cdc_config_register() usb: dwc3: pci: add support for BayTrail usb: gadget: cdc2: fix conversion to new interface of f_ecm usb: gadget: fix a bug and a WARN_ON in dummy-hcd usb: gadget: mv_u3d_core: fix violation of locking discipline in mv_u3d_ep_disable()
2013-09-23Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
Pull drm fixes from Dave Airlie: - some small fixes for msm and exynos - a regression revert affecting nouveau users with old userspace - intel pageflip deadlock and gpu hang fixes, hsw modesetting hangs * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (22 commits) Revert "drm: mark context support as a legacy subsystem" drm/i915: Don't enable the cursor on a disable pipe drm/i915: do not update cursor in crtc mode set drm/exynos: fix return value check in lowlevel_buffer_allocate() drm/exynos: Fix address space warnings in exynos_drm_fbdev.c drm/exynos: Fix address space warning in exynos_drm_buf.c drm/exynos: Remove redundant OF dependency drm/msm: drop unnecessary set_need_resched() drm/i915: kill set_need_resched drm/msm: fix potential NULL pointer dereference drm/i915/dvo: set crtc timings again for panel fixed modes drm/i915/sdvo: Robustify the dtd<->drm_mode conversions drm/msm: workaround for missing irq drm/msm: return -EBUSY if bo still active drm/msm: fix return value check in ERR_PTR() drm/msm: fix cmdstream size check drm/msm: hangcheck harder drm/msm: handle read vs write fences drm/i915/sdvo: Fully translate sync flags in the dtd->mode conversion drm/i915: Use proper print format for debug prints ...
2013-09-21iio:buffer_cb: Add missing iio_buffer_init()Lars-Peter Clausen
Make sure to properly initialize the IIO buffer data structure. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-21iio: Prevent race between IIO chardev opening and IIO device freeLars-Peter Clausen
Set the IIO device as the parent for the character device We need to make sure that the IIO device is not freed while the character device exists, otherwise the freeing of the IIO device might race against the file open callback. Do this by setting the character device's parent to the IIO device, this will cause the character device to grab a reference to the IIO device and only release it once the character device itself has been removed. Also move the registration of the character device before the registration of the IIO device to avoid the (rather theoretical case) that the IIO device is already freed again before we can add the character device and grab a reference to the IIO device. We also need to move the call to cdev_del() from iio_dev_release() to iio_device_unregister() (where it should have been in the first place anyway) to avoid a reference cycle. As iio_dev_release() is only called once all reference are dropped, but the character device holds a reference to the IIO device. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-21iio: fix: Keep a reference to the IIO device for open file descriptorsLars-Peter Clausen
Make sure that the IIO device is not freed while we still have file descriptors for it. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-21iio: Stop sampling when the device is removedLars-Peter Clausen
Make sure to stop sampling when the device is removed, otherwise it will continue to sample forever. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-21iio: Fix crash when scan_bytes is computed with active_scan_mask == NULLPeter Meerwald
if device has available_scan_masks set and the buffer is enabled without any scan_elements enabled, in a NULL pointer is dereferenced in iio_compute_scan_bytes() [ 18.993713] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 19.002593] pgd = debd4000 [ 19.005432] [00000000] *pgd=9ebc0831, *pte=00000000, *ppte=00000000 [ 19.012329] Internal error: Oops: 17 [#1] PREEMPT ARM [ 19.017639] Modules linked in: [ 19.020843] CPU: 0 Not tainted (3.9.11-00036-g75c888a-dirty #207) [ 19.027587] PC is at _find_first_bit_le+0xc/0x2c [ 19.032440] LR is at iio_compute_scan_bytes+0x2c/0xf4 [ 19.037719] pc : [<c021dc60>] lr : [<c03198d0>] psr: 200d0013 [ 19.037719] sp : debd9ed0 ip : 00000000 fp : 000802bc [ 19.049713] r10: 00000000 r9 : 00000000 r8 : deb67250 [ 19.055206] r7 : 00000000 r6 : 00000000 r5 : 00000000 r4 : deb67000 [ 19.062011] r3 : de96ec00 r2 : 00000000 r1 : 00000004 r0 : 00000000 [ 19.068847] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 19.076324] Control: 10c5387d Table: 9ebd4019 DAC: 00000015 problem is the rollback code in iio_update_buffers(), old_mask may be NULL (e.g. on first call) I'm not too confident about the fix; works for me... Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net> Reviewed-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-21iio: Fix mcp4725 dev-to-indio_dev conversion in suspend/resumePeter Meerwald
dev_to_iio_dev() is a false friend Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-21iio: Fix bma180 dev-to-indio_dev conversion in suspend/resumePeter Meerwald
dev_to_iio_dev() is a false friend Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net> Cc: Oleksandr Kravchenko <o.v.kravchenko@globallogic.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-21iio: Fix tmp006 dev-to-indio_dev conversion in suspend/resumePeter Meerwald
dev_to_iio_dev() is a false friend Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-20Merge tag 'pm+acpi-3.12-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI and power management fixes from Rafael Wysocki: 1) Four fixes for cpufreq regressions introduced by the changes that removed Device Tree parsing for CPU device nodes from cpufreq drivers from Sudeep KarkadaNagesha. 2) Two fixes for recent cpufreq regressions introduced by changes related to the preservation of sysfs attributes over system suspend/resume cycles from Viresh Kumar. 3) Fix for ACPI-based wakeup signaling in the PCI subsystem that fails to stop PME polling for devices put into the D3cold power state from Rafael J Wysocki. 4) Fix for bad interactions between cpufreq and udev on systems supporting intel_pstate where acpi-cpufreq is available as well from Yinghai Lu. * tag 'pm+acpi-3.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: return EEXIST instead of EBUSY for second registering PCI / ACPI / PM: Clear pme_poll for devices in D3cold on wakeup ARM: shmobile: change dev_id to cpu0 while registering cpu clock ARM: i.MX: change dev_id to cpu0 while registering cpu clock cpufreq: imx6q-cpufreq: assign cpu_dev correctly to cpu0 device cpufreq: cpufreq-cpu0: assign cpu_dev correctly to cpu0 device cpufreq: unlock correct rwsem while updating policy->cpu cpufreq: Clear policy->cpus bits in __cpufreq_remove_dev_finish()
2013-09-20Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhostLinus Torvalds
Pull vhost updates from Michael Tsirkin: "vhost: minor changes on top of 3.12-rc1 This fixes module loading for vhost-scsi, and tweaks locking in vhost core a bit. Both of these are not exactly release blockers but it's early in the cycle so I think it's a good idea to apply them now" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost-scsi: whitespace tweak vhost/scsi: use vmalloc for order-10 allocation vhost: wake up worker outside spin_lock
2013-09-20Merge branch 'pm-cpufreq'Rafael J. Wysocki
* pm-cpufreq: cpufreq: return EEXIST instead of EBUSY for second registering ARM: shmobile: change dev_id to cpu0 while registering cpu clock ARM: i.MX: change dev_id to cpu0 while registering cpu clock cpufreq: imx6q-cpufreq: assign cpu_dev correctly to cpu0 device cpufreq: cpufreq-cpu0: assign cpu_dev correctly to cpu0 device cpufreq: unlock correct rwsem while updating policy->cpu cpufreq: Clear policy->cpus bits in __cpufreq_remove_dev_finish()
2013-09-19Merge tag 'fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "A set of fixes for ARM platforms for 3.12. Among them: - A fix for build breakage in the MTD subsystem for some PXA devices. David Woodhouse has this patch in his for-next branch but has not been responding to our requests to send it up so here it is. I should have amended the commit message to describe the build failure for CONFIG_OF=n setups, but forgot and now it's down in the stack of commits. - Added device-tree for the BeagleBone Black. Turns out people have been using the older "regualar" bone DT for the newer boards, and there's risk of damaging hardware that way. - Misc DT and regular fixes for OMAP. - Fix to make the ST-Ericsson "snowball" boards boot with multi_v7_defconfig, and enable one of the ST-E reference boards on the same config. - Kconfig cleanup for u300 to hide submenus when the platform isn't enabled. - Enable ARM_ATAG_DTB_COMPAT to let firmware override command line when booting with an appended devicetree on non-DT-enabled firmware (needed to boot snowball)" * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (26 commits) ARM: multi_v7: add HREFv60 to multi_v7 defconfig ARM: OMAP2+: mux: fix trivial typo in name ARM: OMAP4 SMP: Corrected a typo fucntions to functions ARM: OMAP4: cpuidle: fix: call cpu_cluster_pm_exit conditionally mailbox: remove unnecessary platform_set_drvdata() ARM: mach-omap2: gpmc: Fix warning when CONFIG_ARM_LPAE=y ARM: OMAP: fix return value check in omap_device_build_from_dt() ARM: OMAP4: Fix clock_get error for GPMC during boot ARM: sa1100: collie.c: fall back to jedec_probe flash detection ARM: u300: hide submenus ARM: dts: igep00x0: Add pinmux configuration for MCBSP2 ARM: dts: Fix muxing and regulator for wl12xx on the SDIO bus for blaze ARM: dts: Fix muxing and regulator for wl12xx on the SDIO bus for pandaboard mtd: nand: pxa3xx: Remove unneeded ifdef CONFIG_OF ARM: multi_v7_defconfig: enable ARM_ATAG_DTB_COMPAT ARM: ux500: disable outer cache debug ARM: dts: OMAP5: fix ocp2scp DTS data ARM: dts: OMAP5: fix reg property size ARM: dts: am335x-bone*: add DT for BeagleBone Black ARM: dts: omap3-beagle-xm: fix string error in compatible property ...
2013-09-19Merge branch 'msm-fixes-3.12' of ↵Dave Airlie
git://people.freedesktop.org/~robclark/linux into drm-fixes A couple small msm fixes. Plus drop of set_need_resched(). * 'msm-fixes-3.12' of git://people.freedesktop.org/~robclark/linux: drm/msm: drop unnecessary set_need_resched() drm/msm: fix potential NULL pointer dereference drm/msm: workaround for missing irq drm/msm: return -EBUSY if bo still active drm/msm: fix return value check in ERR_PTR() drm/msm: fix cmdstream size check drm/msm: hangcheck harder drm/msm: handle read vs write fences
2013-09-19Merge branch 'exynos-drm-fixes' of ↵Dave Airlie
git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes Just small fixes, and code cleanups. * 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos: drm/exynos: fix return value check in lowlevel_buffer_allocate() drm/exynos: Fix address space warnings in exynos_drm_fbdev.c drm/exynos: Fix address space warning in exynos_drm_buf.c drm/exynos: Remove redundant OF dependency
2013-09-19Merge tag 'drm-intel-fixes-2013-09-19' of ↵Dave Airlie
git://people.freedesktop.org/~danvet/drm-intel into drm-fixes Some more dealock fixes around pageflips and gpu hangs, fixes for hsw hangs when doing modesets/dpms. And a few minor things to rectify issues with our modeset state tracking which the checker spotted. * tag 'drm-intel-fixes-2013-09-19' of git://people.freedesktop.org/~danvet/drm-intel: drm/i915: Don't enable the cursor on a disable pipe drm/i915: do not update cursor in crtc mode set drm/i915: kill set_need_resched drm/i915/dvo: set crtc timings again for panel fixed modes drm/i915/sdvo: Robustify the dtd<->drm_mode conversions drm/i915/sdvo: Fully translate sync flags in the dtd->mode conversion drm/i915: Use proper print format for debug prints drm/i915: fix wait_for_pending_flips vs gpu hang deadlock drm/i915: Track pfit enable state separately from size
2013-09-19cpufreq: return EEXIST instead of EBUSY for second registeringYinghai Lu
On systems that support intel_pstate, acpi_cpufreq fails to load, and udev keeps trying until trace gets filled up and kernel crashes. The root cause is driver return ret from cpufreq_register_driver(), because when some other driver takes over before, it will return EBUSY and then udev will keep trying ... cpufreq_register_driver() should return EEXIST instead so that the system can boot without appending intel_pstate=disable and still use intel_pstate. Signed-off-by: Yinghai Lu <yinghai@kernel.org> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-09-19Revert "drm: mark context support as a legacy subsystem"Dave Airlie
This reverts commit 7c510133d93dd6f15ca040733ba7b2891ed61fd1. Well looks like not enough digging was done, libdrm_nouveau before 2.4.33 used contexts, 292da616fe1f936ca78a3fa8e1b1b19883e343b6 nouveau: pull in major libdrm rewrite got rid of them, Reported-by: Paul Zimmerman <Paul.Zimmerman@synopsys.com> Reported-by: Mikael Pettersson <mikpe@it.uu.se> Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-09-19PCI / ACPI / PM: Clear pme_poll for devices in D3cold on wakeupRafael J. Wysocki
Commit 448bd85 (PCI/PM: add PCIe runtime D3cold support) added a piece of code to pci_acpi_wake_dev() causing that function to behave in a special way for devices in D3cold (so that their configuration registers are not accessed before those devices are resumed). However, it didn't take the clearing of the pme_poll flag into account. That has to be done for all devices, even if they are in D3cold, or pci_pme_list_scan() will not know that wakeup has been signaled for the device and will poll its PME Status bit unnecessarily. Fix the problem by moving the clearing of the pme_poll flag in pci_acpi_wake_dev() before the code introduced by commit 448bd85. Reported-and-tested-by: David E. Box <david.e.box@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Cc: 3.6+ <stable@vger.kernel.org> # 3.6+
2013-09-19Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds
Pull networking fixes from David Miller: 1) If the local_df boolean is set on an SKB we have to allocate a unique ID even if IP_DF is set in the ipv4 headers, from Ansis Atteka. 2) Some fixups for the new chipset support that went into the sfc driver, from Ben Hutchings. 3) Because SCTP bypasses a good chunk of, and actually duplicates, the logic of the ipv6 output path, some IPSEC things don't get done properly. Integrate SCTP better into the ipv6 output path so that these problems are fixed and such issues don't get missed in the future either. From Daniel Borkmann. 4) Fix skge regressions added by the DMA mapping error return checking added in v3.10, from Mikulas Patocka. 5) Kill some more IRQF_DISABLED references, from Michael Opdenacker. 6) Fix races and deadlocks in the bridging code, from Hong Zhiguo. 7) Fix error handling in tun_set_iff(), in particular don't leak resources. From Jason Wang. 8) Prevent format-string injection into xen-netback driver, from Kees Cook. 9) Fix regression added to netpoll ARP packet handling, in particular check for the right ETH_P_ARP protocol code. From Sonic Zhang. 10) Try to deal with AMD IOMMU errors when using r8169 chips, from Francois Romieu. 11) Cure freezes due to recent changes in the rt2x00 wireless driver, from Stanislaw Gruszka. 12) Don't do SPI transfers (which can sleep) in interrupt context in cw1200 driver, from Solomon Peachy. 13) Fix LEDs handling bug in 5720 tg3 chips already handled for 5719. From Nithin Sujir. 14) Make xen_netbk_count_skb_slots() count the actual number of slots that will be used, taking into consideration packing and other issues that the transmit path will run into. From David Vrabel. 15) Use the correct maximum age when calculating the bridge message_age_timer, from Chris Healy. 16) Get rid of memory leaks in mcs7780 IRDA driver, from Alexey Khoroshilov. 17) Netfilter conntrack extensions were converted to RCU but are not always freed properly using kfree_rcu(). Fix from Michal Kubecek. 18) VF reset recovery not being done correctly in qlcnic driver, from Manish Chopra. 19) Fix inverted test in ATM nicstar driver, from Andy Shevchenko. 20) Missing workqueue destroy in cxgb4 error handling, from Wei Yang. 21) Internal switch not initialized properly in bgmac driver, from Rafał Miłecki. 22) Netlink messages report wrong local and remote addresses in IPv6 tunneling, from Ding Zhi. 23) ICMP redirects should not generate socket errors in DCCP and SCTP. We're still working out how this should be handled for RAW and UDP sockets. From Daniel Borkmann and Duan Jiong. 24) We've had several bugs wherein the network namespace's loopback device gets accessed after it is free'd, NULL it out so that we can catch these problems more readily. From Eric W Biederman. 25) Fix regression in TCP RTO calculations, from Neal Cardwell. 26) Fix too early free of xen-netback network device when VIFs still exist. From Paul Durrant. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (87 commits) netconsole: fix a deadlock with rtnl and netconsole's mutex netpoll: fix NULL pointer dereference in netpoll_cleanup skge: fix broken driver ip: generate unique IP identificator if local fragmentation is allowed ip: use ip_hdr() in __ip_make_skb() to retrieve IP header xen-netback: Don't destroy the netdev until the vif is shut down net:dccp: do not report ICMP redirects to user space cnic: Fix crash in cnic_bnx2x_service_kcq() bnx2x, cnic, bnx2i, bnx2fc: Fix bnx2i and bnx2fc regressions. vxlan: Avoid creating fdb entry with NULL destination tcp: fix RTO calculated from cached RTT drivers: net: phy: cicada.c: clears warning Use #include <linux/io.h> instead of <asm/io.h> net loopback: Set loopback_dev to NULL when freed batman-adv: set the TAG flag for the vid passed to BLA netfilter: nfnetlink_queue: use network skb for sequence adjustment net: sctp: rfc4443: do not report ICMP redirects to user space net: usb: cdc_ether: use usb.h macros whenever possible net: usb: cdc_ether: fix checkpatch errors and warnings net: usb: cdc_ether: Use wwan interface for Telit modules ip6_tunnels: raddr and laddr are inverted in nl msg ...
2013-09-19netconsole: fix a deadlock with rtnl and netconsole's mutexNikolay Aleksandrov
This bug was introduced by commit 7a163bfb7ce50895bbe67300ea610d31b9c09230 ("netconsole: avoid a crash with multiple sysfs writers"). In store_enabled() we have the following sequence: acquire nt->mutex then rtnl, but in the netconsole netdev notifier we have rtnl then nt->mutex effectively leading to a deadlock. The NULL pointer dereference that the above commit tries to fix is actually due to another bug in netpoll_cleanup(). This is fixed by dropping the mutex from the netdev notifier as it's already protected by rtnl. Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-19skge: fix broken driverMikulas Patocka
The patch 136d8f377e1575463b47840bc5f1b22d94bf8f63 broke the skge driver. Note this part of the patch: + if (skge_rx_setup(skge, e, nskb, skge->rx_buf_size) < 0) { + dev_kfree_skb(nskb); + goto resubmit; + } + pci_unmap_single(skge->hw->pdev, dma_unmap_addr(e, mapaddr), dma_unmap_len(e, maplen), PCI_DMA_FROMDEVICE); skb = e->skb; prefetch(skb->data); - skge_rx_setup(skge, e, nskb, skge->rx_buf_size); The function skge_rx_setup modifies e->skb to point to the new skb. Thus, after this change, the new buffer, not the old, is returned to the networking stack. This bug is present in kernels 3.11, 3.11.1 and 3.12-rc1. The patch should be queued for 3.11-stable. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Reported-by: Mikulas Patocka <mpatocka@redhat.com> Reported-by: Vasiliy Glazov <vascom2@gmail.com> Tested-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-19ip: generate unique IP identificator if local fragmentation is allowedAnsis Atteka
If local fragmentation is allowed, then ip_select_ident() and ip_select_ident_more() need to generate unique IDs to ensure correct defragmentation on the peer. For example, if IPsec (tunnel mode) has to encrypt large skbs that have local_df bit set, then all IP fragments that belonged to different ESP datagrams would have used the same identificator. If one of these IP fragments would get lost or reordered, then peer could possibly stitch together wrong IP fragments that did not belong to the same datagram. This would lead to a packet loss or data corruption. Signed-off-by: Ansis Atteka <aatteka@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-19xen-netback: Don't destroy the netdev until the vif is shut downPaul Durrant
Without this patch, if a frontend cycles through states Closing and Closed (which Windows frontends need to do) then the netdev will be destroyed and requires re-invocation of hotplug scripts to restore state before the frontend can move to Connected. Thus when udev is not in use the backend gets stuck in InitWait. With this patch, the netdev is left alone whilst the backend is still online and is only de-registered and freed just prior to destroying the vif (which is also nicely symmetrical with the netdev allocation and registration being done during probe) so no re-invocation of hotplug scripts is required. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Cc: David Vrabel <david.vrabel@citrix.com> Cc: Wei Liu <wei.liu2@citrix.com> Cc: Ian Campbell <ian.campbell@citrix.com> Acked-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-19Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linusLinus Torvalds
Pull MIPS updates from Ralf Baechle: - Minor updates and fixes to the Octeon ethernet driver in staging - A fix to VGA_MAP_MEM() for 64 bit platforms - Fix a workaround for 74K/1074K processors - The symlink arch/mips/boot/dts/include/dt-bindings was pointing to a a file with a name ending in \n. I think this may have been caused by a git bug with with patches sent by email - A build fix for VGA console on BCM1480-based systems - Fix PCI device access via "/sys/bus/pci/.../resource0" or similar work for Alchemy platforms - Fix potential data leak on MIPS R5 cores. This doesn't add proper support for any R5 features, just ensures a kernel without such support will be secure to run - Adding a macros for the CP0 Config5 register to be used by the R5 fix - Make get_cycles() actually return something useful where possible This also requires a preparatory patch for performance sake - Fix a warning about the use of smp_processor_id() in preemptible code. Again this includes a preparatory patch adding the infrastructure to be used by the actual patch - Finally remove pointless one-line comment * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: MIPS: Fix invalid symbolic link file MIPS: PCI: pci-bcm1480: Include missing vt.h header MIPS: Disable usermode switching of the FR bit for MIPS R5 CPUs. MIPS: Add MIPS R5 config5 register. MIPS: PCI: Use pci_resource_to_user to map pci memory space properly MIPS: 74K/1074K: Correct erratum workaround. MIPS: Cleanup CP0 PRId and CP1 FPIR register access masks MIPS: Remove useless comment about kprobe from arch/mips/Makefile MIPS: Fix VGA_MAP_MEM macro. MIPS: Reimplement get_cycles(). MIPS: Optimize current_cpu_type() for better code. MIPS: Fix accessing to per-cpu data when flushing the cache MIPS: Provide nice way to access boot CPU's data. staging: octeon-ethernet: rgmii: enable interrupts that we can handle staging: octeon-ethernet: remove skb alloc failure warnings staging: octeon-ethernet: make dropped packets to consume NAPI budget
2013-09-19Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client Pull ceph fixes from Sage Weil: "These fix several bugs with RBD from 3.11 that didn't get tested in time for the merge window: some error handling, a use-after-free, and a sequencing issue when unmapping and image races with a notify operation. There is also a patch fixing a problem with the new ceph + fscache code that just went in" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: fscache: check consistency does not decrement refcount rbd: fix error handling from rbd_snap_name() rbd: ignore unmapped snapshots that no longer exist rbd: fix use-after free of rbd_dev->disk rbd: make rbd_obj_notify_ack() synchronous rbd: complete notifies before cleaning up osd_client and rbd_dev libceph: add function to ensure notifies are complete
2013-09-19Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
Pull drm radeon/nouveau/core fixes from Dave Airlie: "Mostly radeon fixes, with some nouveau bios parser, ttm fix and a fix for AST driver" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (42 commits) drm/fb-helper: don't sleep for screen unblank when an oops is in progress drm, ttm Fix uninitialized warning drm/ttm: fix the tt_populated check in ttm_tt_destroy() drm/nouveau/ttm: prevent double-free in nouveau_sgdma_create_ttm() failure path drm/nouveau/bios/init: fix thinko in INIT_CONFIGURE_MEM drm/nouveau/kms: enable for non-vga pci classes drm/nouveau/bios/init: stub opcode 0xaa drm/radeon: avoid UVD corruptions on AGP cards drm/radeon: fix panel scaling with eDP and LVDS bridges drm/radeon/dpm: rework auto performance level enable drm/radeon: Fix hmdi typo drm/radeon/dpm/rs780: fix force_performance state for same sclks drm/radeon/dpm/rs780: don't enable sclk scaling if not required drm/radeon/dpm/rs780: add some sanity checking to sclk scaling drm/radeon/dpm/rs780: use drm_mode_vrefresh() drm/udl: rip out set_need_resched drm/ast: fix the ast open key function drm/radeon/dpm: add bapm callback for kb/kv drm/radeon/dpm: add bapm callback for trinity drm/radeon/dpm: add infrastructure to properly handle bapm ...
2013-09-19drm/fb-helper: don't sleep for screen unblank when an oops is in progressDaniel Vetter
Otherwise the system will burn even brighter and worse, leave the user wondering what's going on exactly. Since we already have a panic handler which will (try) to restore the entire fbdev console mode, we can just bail out. Inspired by a patch from Konstantin Khlebnikov. The callchain leading to this, cut&pasted from Konstantin's original patch: callstack: panic() bust_spinlocks(1) unblank_screen() vc->vc_sw->con_blank() fbcon_blank() fb_blank() info->fbops->fb_blank() drm_fb_helper_blank() drm_fb_helper_dpms() drm_modeset_lock_all() mutex_lock(&dev->mode_config.mutex) Note that the entire locking in the fb helper around panic/sysrq and kdbg is ... non-existant. So we have a decent change of blowing up everything. But since reworking this ties in with funny concepts like the fbdev notifier chain or the impressive things which happen around console_lock while oopsing, I'll leave that as an exercise for braver souls than me. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Konstantin Khlebnikov <khlebnikov@openvz.org> Cc: Dave Airlie <airlied@gmail.com> Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-09-19cpufreq: imx6q-cpufreq: assign cpu_dev correctly to cpu0 deviceSudeep KarkadaNagesha
Commit cdc58d602d2e657602a90c190cbf745886c95977 "cpufreq: imx6q-cpufreq: remove device tree parsing for cpu nodes" assumed the pdev->dev is set to cpu0 device in the platform code. But it actually points to the virtual cpufreq-cpu0 platform device which is not present in the device tree. Most of the information needed by cpufreq is stored in cpu0 DT node. So cpu_dev must point to cpu0 device. This patch fixes the wrong assignment to cpu_dev. Reported-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Tested-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Sudeep KarkadaNagesha <sudeep.karkadanagesha@arm.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-09-19cpufreq: cpufreq-cpu0: assign cpu_dev correctly to cpu0 deviceSudeep KarkadaNagesha
Commit f837a9b5ab05c52a07108c6f09ca66f2e0aee757 "cpufreq: cpufreq-cpu0: remove device tree parsing for cpu nodes" assumed the pdev->dev is set to cpu0 device in the platform code. But it actually points to the virtual cpufreq-cpu0 platform device which is not present in the device tree. Most of the information needed by cpufreq is stored in cpu0 DT node. So cpu_dev must point to cpu0 device. This patch fixes the wrong assignment to cpu_dev. Reported-and-tested-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Cc: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Sudeep KarkadaNagesha <sudeep.karkadanagesha@arm.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-09-19drm, ttm Fix uninitialized warningPrarit Bhargava
Fix uninitialized warning. drivers/gpu/drm/ttm/ttm_object.c: In function ‘ttm_base_object_lookup’: drivers/gpu/drm/ttm/ttm_object.c:213:10: error: ‘base’ may be used uninitialized in this function [-Werror=maybe-uninitialized] kref_put(&base->refcount, ttm_release_base); ^ drivers/gpu/drm/ttm/ttm_object.c:221:26: note: ‘base’ was declared here struct ttm_base_object *base; Signed-off-by: Prarit Bhargava <prarit@redhat.com> Reviewed-by: Rob Clark <robdclark@gmail.com> Reviewed-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-09-19drm/ttm: fix the tt_populated check in ttm_tt_destroy()Ben Skeggs
After a vmalloc failure in ttm_dma_tt_alloc_page_directory(), ttm_dma_tt_init() will call ttm_tt_destroy() to cleanup, and end up inside the driver's unpopulate() hook when populate() has never yet been called. On nouveau, the first issue to be hit because of this is that dma_address[] may be a NULL pointer. After working around this, ttm_pool_unpopulate() may potentially hit the same issue with the pages[] array. It seems to make more sense to avoid calling unpopulate on already unpopulated TTMs than to add checks to all the implementations. Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Cc: stable@vger.kernel.org Cc: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-09-19Merge branch 'drm-nouveau-next' of ↵Dave Airlie
git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes A couple of bios parser fixes (one for ancient chips, another for new ones - important in Optimus configs). Another to make sure KMS is enabled on certain Optimus configs, and a TTM failure path fix. * 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6: drm/nouveau/ttm: prevent double-free in nouveau_sgdma_create_ttm() failure path drm/nouveau/bios/init: fix thinko in INIT_CONFIGURE_MEM drm/nouveau/kms: enable for non-vga pci classes drm/nouveau/bios/init: stub opcode 0xaa
2013-09-18Merge tag 'omap-for-v3.12/fixes-signed' of ↵Olof Johansson
git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes From Tony Lindgren, fixes for 3.12-rc1: OMAP fixes for build warnings and cpuidle, and a few trivial typo fixes. * tag 'omap-for-v3.12/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP2+: mux: fix trivial typo in name ARM: OMAP4 SMP: Corrected a typo fucntions to functions ARM: OMAP4: cpuidle: fix: call cpu_cluster_pm_exit conditionally mailbox: remove unnecessary platform_set_drvdata() ARM: mach-omap2: gpmc: Fix warning when CONFIG_ARM_LPAE=y ARM: OMAP: fix return value check in omap_device_build_from_dt() ARM: OMAP4: Fix clock_get error for GPMC during boot Signed-off-by: Olof Johansson <olof@lixom.net>
2013-09-18mailbox: remove unnecessary platform_set_drvdata()Jingoo Han
The driver core clears the driver data to NULL after device_release or on probe failure. Thus, it is not needed to manually clear the device driver data to NULL. Signed-off-by: Jingoo Han <jg1.han@samsung.com> Acked-by: Suman Anna <s-anna@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2013-09-18iio: iio_device_add_event_sysfs() bugfixLukasz Czerwinski
Fix mask generation for modified channels. Signed-off-by: Lukasz Czerwinski <l.czerwinski@samsung.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-18staging: iio: ade7854-spi: Fix return valueSachin Kamat
ade7854_probe can fail. Return the value obtained from it instead of 0 (success). Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Cc: Barry Song <21cnbao@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-18staging:iio:hmc5843: Fix measurement conversionPeter Meerwald
recently broken, cd6fe06588423ff4cca85c85c4402027b04dccf1 staging:iio:hmc5843: Use i2c_smbus_read_word_swapped() Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-18iio: isl29018: Fix uninitialized valueDerek Basehore
The lux_uscale value is not initialized at probe. The value will be uninitialized unless a value is written to it through the iio channel interface. This fixes that. Signed-off-by: Derek Basehore <dbasehore@chromium.org> Reviewed-on: https://gerrit.chromium.org/gerrit/65998 Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-18staging:iio:dummy fix kfifo_buf kconfig dependency issue if kfifo modular ↵Jonathan Cameron
and buffer enabled for built in dummy driver. This only occurs in the unlikely event that the example driver is built in whilst the buffer implementation is not. Solved by switching from a depends on to a select for this particular case. Reported-by: Fengguang Wu <fengguang.wu@intel.com> Reported-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-18iio: at91: fix adc_clk overflowJosh Wu
The adc_clk variable is currently defined using a 32-bits unsigned integer, which will overflow under some very valid range of operations. Such overflow will occur if, for example, the parent clock is set to a 20MHz frequency and the ADC startup time is larger than 215ns. To fix this, introduce an intermediate variable holding the clock rate in kHz. Signed-off-by: Josh Wu <josh.wu@atmel.com> Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2013-09-18cnic: Fix crash in cnic_bnx2x_service_kcq()Michael Chan
commit 104a43edb264321a4d41850e98153b4fa8a9ef42 cnic: Use CHIP_NUM macros from bnx2x.h changed the code to use the bnx2x macro NO_FCOE() to determine if FCoE is supported or not. There is another place in cnic that is still using the old method to determine if FCoE is supported or not. The 2 methods may not yield the same result after the network interface is brought down and up. This will cause the crash as cnic_bnx2x_service_kcq() will access the uninitialized cp->kcq2. The fix is to consistently use the same macro CNIC_SUPPORTS_FCOE() which uses the bnx2x NO_FCOE() macro. As a follow-up, we can clean up the code to remove the old method as it is no longer needed. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-18bnx2x, cnic, bnx2i, bnx2fc: Fix bnx2i and bnx2fc regressions.Michael Chan
commit b9871bcfd211d316adee317608dab44c58d6ea2d bnx2x: VF RSS support - PF side changed the configuration of the doorbell HW and it broke iSCSI and FCoE. We fix this by making compatible changes to the doorbell address in bnx2i and bnx2fc. For the userspace driver, we need to pass a modified CID so that the existing userspace driver will calculate the correct doorbell address and continue to work. Signed-off-by: Ariel Elior <ariele@broadcom.com> Signed-off-by: Eddie Wai <eddie.wai@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-18drm/i915: Don't enable the cursor on a disable pipeVille Syrjälä
On HSW enabling a plane on a disabled pipe may hang the entire system. And there's no good reason for doing it ever, so just don't. v2: Move the crtc active checks to intel_crtc_cursor_{set,move} to avoid confusing people during modeset Cc: stable@vger.kernel.org Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Tested-by: Paulo Zanoni <paulo.r.zanoni@intel.com> Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-09-18drm/i915: do not update cursor in crtc mode setJani Nikula
The cursor is disabled before crtc mode set in crtc disable (and we assert this is the case), and enabled afterwards in crtc enable. Do not update it in crtc mode set. On HSW enabling a plane on a disabled pipe may hang the entire system. And there's no good reason for doing it ever, so just don't. v2: Add note about HSW hangs - vsyrjala Cc: stable@vger.kernel.org Suggested-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Tested-by: Paulo Zanoni <paulo.r.zanoni@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-09-18Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID updates from Jiri Kosina: "Fixes for CVE-2013-2897, CVE-2013-2895, CVE-2013-2897, CVE-2013-2894, CVE-2013-2893, CVE-2013-2891, CVE-2013-2890, CVE-2013-2889. All the bugs are triggerable only by specially crafted evil-on-purpose HW devices. Fixes by Kees Cook and Benjamin Tissoires" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: lenovo-tpkbd: fix leak if tpkbd_probe_tp fails HID: multitouch: validate indexes details HID: logitech-dj: validate output report details HID: validate feature and input report details HID: lenovo-tpkbd: validate output report details HID: LG: validate HID output report details HID: steelseries: validate output report details HID: sony: validate HID output report details HID: zeroplus: validate output report details HID: provide a helper for validating hid reports
2013-09-18tty: disassociate_ctty() sends the extra SIGCONTOleg Nesterov
Starting from v3.10 (probably commit f91e2590410b: "tty: Signal foreground group processes in hangup") disassociate_ctty() sends SIGCONT if tty && on_exit. This breaks LSB test-suite, in particular test8 in _exit.c and test40 in sigcon5.c. Put the "!on_exit" check back to restore the old behaviour. Review by Peter Hurley: "Yes, this regression was introduced by me in that commit. The effect of the regression is that ptys will receive a SIGCONT when, in similar circumstances, ttys would not. The fact that two test vectors accidentally tripped over this regression suggests that some other apps may as well. Thanks for catching this" Cc: stable@vger.kernel.org # v3.10+ Signed-off-by: Oleg Nesterov <oleg@redhat.com> Reported-by: Karel Srot <ksrot@redhat.com> Reviewed-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-09-18vxlan: Avoid creating fdb entry with NULL destinationSridhar Samudrala
Commit afbd8bae9c798c5cdbe4439d3a50536b5438247c vxlan: add implicit fdb entry for default destination creates an implicit fdb entry for default destination. This results in an invalid fdb entry if default destination is not specified. For ex: ip link add vxlan1 type vxlan id 100 creates the following fdb entry 00:00:00:00:00:00 dev vxlan1 dst 0.0.0.0 self permanent This patch fixes this issue by creating an fdb entry only if a valid default destination is specified. Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>