Commit Graph

288619 Commits

Author SHA1 Message Date
Linus Torvalds
0a49aecaf4 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf fixes from Ingo Molnar.

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf record: Fix buffer overrun bug in tracepoint_id_to_path()
  perf/x86: Fix local vs remote memory events for NHM/WSM
2012-03-13 17:04:50 -07:00
Linus Torvalds
8e8bb96d24 Merge git://git.samba.org/sfrench/cifs-2.6
Pull CIFS fixes from Steve French.

* git://git.samba.org/sfrench/cifs-2.6:
  CIFS: Do not kmalloc under the flocks spinlock
  cifs: possible memory leak in xattr.
2012-03-13 17:03:53 -07:00
Linus Torvalds
cd7945397d Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull vfs fixes from Al Viro:
 "A bunch of assorted fixes; Jan's freezing stuff still _not_ in there
  and neither is mm fun ;-/"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  restore smp_mb() in unlock_new_inode()
  vfs: fix return value from do_last()
  vfs: fix double put after complete_walk()
  udf: Fix deadlock in udf_release_file()
  vfs: Correctly set the dir i_mutex lockdep class
2012-03-13 17:00:50 -07:00
Matt Fleming
ad09233835 tile: Use set_current_blocked() and block_sigmask()
As described in e6fa16ab ("signal: sigprocmask() should do
retarget_shared_pending()") the modification of current->blocked is
incorrect as we need to check whether the signal we're about to block
is pending in the shared queue.

Also, use the new helper function introduced in commit 5e6292c0f2
("signal: add block_sigmask() for adding sigmask to current->blocked")
which centralises the code for updating current->blocked after
successfully delivering a signal and reduces the amount of duplicate
code across architectures. In the past some architectures got this
code wrong, so using this helper function should stop that from
happening again.

Cc: Arnd Bergmann <arnd@arndb.de>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
2012-03-13 16:42:05 -04:00
John W. Linville
750084b51b Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem 2012-03-13 14:38:51 -04:00
Stephane Eranian
8aa8a7c80c perf record: Fix buffer overrun bug in tracepoint_id_to_path()
This patch fixes a buffer overrun bug in
tracepoint_id_to_path(). The bug manisfested itself as a memory
error reported by perf record. I ran into it with perf sched:

 $ perf sched rec noploop 2 noploop for 2 seconds
 [ perf record: Woken up 14 times to write data ]
 [ perf record: Captured and wrote 42.701 MB perf.data (~1865622 samples) ]
 Fatal: No memory to alloc tracepoints list

It turned out that tracepoint_id_to_path() was reading the
tracepoint id using read() but the buffer was not large enough
to include the \n terminator for id with 4 digits or more.

The patch fixes the problem by extending the buffer to a more
reasonable size covering all possible id length include \n
terminator. Note that atoll() stops at the first non digit
character, thus it is not necessary to clear the buffer between
each read.

Signed-off-by: Stephane Eranian <eranian@google.com>
Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: fweisbec@gmail.com
Cc: dsahern@gmail.com
Link: http://lkml.kernel.org/r/20120313155102.GA6465@quad
Signed-off-by: Ingo Molnar <mingo@elte.hu>
2012-03-13 17:01:28 +01:00
Guenter Roeck
c43524b580 hwmon: (w83627ehf) Describe undocumented pwm attributes
Add description of pwm[1-4]_start_output, pwm[1-4]_step_output,
pwm[1-4]_stop_output, and pwm[1-4]_max_output attributes to driver
documentation.

Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
Acked-by: Jean Delvare <khali@linux-fr.org>
2012-03-13 03:48:07 -07:00
Jean Delvare
aacb6b0052 hwmon: (w83627ehf) Fix temp2 source for W83627UHG
Properly set the source of temp2 for the W83627UHG. Also fix a
comment right before that, and document the W83627UHG as reporting up
to 3 temperatures.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Guenter Roeck <guenter.roeck@ericsson.com>
Cc: stable@vger.kernel.org
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
2012-03-13 03:30:56 -07:00
Linus Torvalds
2f1c2b8155 Merge branch 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86
Pull x86 platfrm driver fixes from Matthew Garrett:
 "Some trivial patches that fix wifi on some Lenovos and avoid a
  potential memory corruption issue on some Panasonics, plus two
  straightforward new drivers that touch no existing code."

* 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86:
  panasonic-laptop: avoid overflow in acpi_pcc_hotkey_add()
  acer-wmi: No wifi rfkill on Lenovo machines
  Fujitsu tablet extras driver
  x86: Add amilo-rfkill driver for some Fujitsu-Siemens Amilo laptops
2012-03-12 22:59:34 -07:00
Linus Torvalds
0ae5eaf103 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci
Pull PCI changes from Jesse Barnes:
 "A single fix for a regression that affects some people who try to
  disable ASPM for whatever reason."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci:
  PCI: ignore pre-1.1 ASPM quirking when ASPM is disabled
2012-03-12 22:53:37 -07:00
Linus Torvalds
212ad2f5f9 SuperH fixes for 3.3-rc.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iEYEABECAAYFAk9dltgACgkQGkmNcg7/o7joMQCgnQlwX1MKLNvKtvxvzz7biF48
 aigAoLELf2MGKHFs/yMilS/NMZTJR3Pd
 =ttKa
 -----END PGP SIGNATURE-----

Merge tag 'sh-for-linus' of git://github.com/pmundt/linux-sh

Pull SuperH fixes from Paul Mundt.

* tag 'sh-for-linus' of git://github.com/pmundt/linux-sh:
  sh-sci / PM: Avoid deadlocking runtime PM
  sh: fix up the ubc clock definition for sh7785.
  sh: add parameter for RSPI in clock-sh7757
  sh: Fix sh2a vbr table for more than 255 irqs
2012-03-12 22:50:20 -07:00
Linus Torvalds
a10a854365 SH/R-Mobile fixes for 3.3-rc.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iEYEABECAAYFAk9dlvwACgkQGkmNcg7/o7jooQCgyKYhMoe5mACOy0jI1temge8S
 inUAnRUWKbqKC8c7HDUV5GzbCeps0ccI
 =5hsb
 -----END PGP SIGNATURE-----

Merge tag 'rmobile-for-linus' of git://github.com/pmundt/linux-sh

Pull SH/R-Mobile fixes from Paul Mundt.

* tag 'rmobile-for-linus' of git://github.com/pmundt/linux-sh:
  ARM: mach-shmobile: ap4evb: fixup fsi2_ak4643_info typo
  ARM: mach-shmobile: mackerel: Reserve DMA memory for the frame buffer
  ARM: mach-shmobile: Fix ag5evm compilation by including linux/videodev2.h
  ARM: mach-shmobile: Fix bonito compile breakage
2012-03-12 22:47:20 -07:00
Stanislav Kinsbursky
1ab5ecb90c tun: don't hold network namespace by tun sockets
v3: added previously removed sock_put() to the tun_release() callback, because
sk_release_kernel() doesn't drop the socket reference.

v2: sk_release_kernel() used for socket release. Dummy tun_release() is
required for sk_release_kernel() ---> sock_release() ---> sock->ops->release()
call.

TUN was designed to destroy it's socket on network namesapce shutdown. But this
will never happen for persistent device, because it's socket holds network
namespace.
This patch removes of holding network namespace by TUN socket and replaces it
by creating socket in init_net and then changing it's net it to desired one. On
shutdown socket is moved back to init_net prior to final put.

Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-12 17:14:00 -07:00
Yuval Mintz
de5c37414a bnx2x: FCoE statistics id fixed
FCoE statistics ids were distinguished from the L2's statistics ids.
However, not all of the change was committed. This causes a possible
collision of indices when FCoE is present.

This patch fixes the issue.

Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-12 17:01:25 -07:00
Yuval Mintz
e695a2dda1 bnx2x: dcb bit indices flags used as bits
DCB flags were updated using the flags' bit offsets instead of
the actual bits. This is now fixed.

Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-12 17:01:25 -07:00
Ariel Elior
ab4a71392e bnx2x: added cpu_to_le16 when preparing ramrod's data
Fixed endianess issue when passing arguments to FW.

Signed-off-by: Ariel Elior <ariele@broadcom.com>
Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-12 17:01:25 -07:00
Yuval Mintz
db0ea84845 bnx2x: pfc statistics counts pfc events twice
When pfc statistics were counted, the delta change from last count
was summed twice. This fixes the issue.

Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-12 17:01:25 -07:00
Peter Zijlstra
87e24f4b67 perf/x86: Fix local vs remote memory events for NHM/WSM
Verified using the below proglet.. before:

[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0
remote write

 Performance counter stats for './numa 0':

         2,101,554 node-stores
         2,096,931 node-store-misses

       5.021546079 seconds time elapsed

[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1
local write

 Performance counter stats for './numa 1':

           501,137 node-stores
               199 node-store-misses

       5.124451068 seconds time elapsed

After:

[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0
remote write

 Performance counter stats for './numa 0':

         2,107,516 node-stores
         2,097,187 node-store-misses

       5.012755149 seconds time elapsed

[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1
local write

 Performance counter stats for './numa 1':

         2,063,355 node-stores
               165 node-store-misses

       5.082091494 seconds time elapsed

#define _GNU_SOURCE

#include <sched.h>
#include <stdio.h>
#include <errno.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <dirent.h>
#include <signal.h>
#include <unistd.h>
#include <numaif.h>
#include <stdlib.h>

#define SIZE (32*1024*1024)

volatile int done;

void sig_done(int sig)
{
	done = 1;
}

int main(int argc, char **argv)
{
	cpu_set_t *mask, *mask2;
	size_t size;
	int i, err, t;
	int nrcpus = 1024;
	char *mem;
	unsigned long nodemask = 0x01; /* node 0 */
	DIR *node;
	struct dirent *de;
	int read = 0;
	int local = 0;

	if (argc < 2) {
		printf("usage: %s [0-3]\n", argv[0]);
		printf("  bit0 - local/remote\n");
		printf("  bit1 - read/write\n");
		exit(0);
	}

	switch (atoi(argv[1])) {
	case 0:
		printf("remote write\n");
		break;
	case 1:
		printf("local write\n");
		local = 1;
		break;
	case 2:
		printf("remote read\n");
		read = 1;
		break;
	case 3:
		printf("local read\n");
		local = 1;
		read = 1;
		break;
	}

	mask = CPU_ALLOC(nrcpus);
	size = CPU_ALLOC_SIZE(nrcpus);
	CPU_ZERO_S(size, mask);

	node = opendir("/sys/devices/system/node/node0/");
	if (!node)
		perror("opendir");
	while ((de = readdir(node))) {
		int cpu;

		if (sscanf(de->d_name, "cpu%d", &cpu) == 1)
			CPU_SET_S(cpu, size, mask);
	}
	closedir(node);

	mask2 = CPU_ALLOC(nrcpus);
	CPU_ZERO_S(size, mask2);
	for (i = 0; i < size; i++)
		CPU_SET_S(i, size, mask2);
	CPU_XOR_S(size, mask2, mask2, mask); // invert

	if (!local)
		mask = mask2;

	err = sched_setaffinity(0, size, mask);
	if (err)
		perror("sched_setaffinity");

	mem = mmap(0, SIZE, PROT_READ|PROT_WRITE,
			MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
	err = mbind(mem, SIZE, MPOL_BIND, &nodemask, 8*sizeof(nodemask), MPOL_MF_MOVE);
	if (err)
		perror("mbind");

	signal(SIGALRM, sig_done);
	alarm(5);

	if (!read) {
		while (!done) {
			for (i = 0; i < SIZE; i++)
				mem[i] = 0x01;
		}
	} else {
		while (!done) {
			for (i = 0; i < SIZE; i++)
				t += *(volatile char *)(mem + i);
		}
	}

	return 0;
}

Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Stephane Eranian <eranian@google.com>
Cc: <stable@kernel.org>
Link: http://lkml.kernel.org/n/tip-tq73sxus35xmqpojf7ootxgs@git.kernel.org
Signed-off-by: Ingo Molnar <mingo@elte.hu>
2012-03-12 20:43:41 +01:00
Guenter Roeck
32260d9440 hwmon: (w83627ehf) Fix memory leak in probe function
The driver probe function leaked memory if creating the cpu0_vid attribute file
failed. Fix by converting the driver to use devm_kzalloc.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable@vger.kernel.org # 2.6.32+
Acked-by: Jean Delvare <khali@linux-fr.org>
2012-03-12 12:41:44 -07:00
roel
cf8c1dafe1 arch/tile: misplaced parens near likely
Parentheses were missing.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
2012-03-12 15:32:18 -04:00
Chris Metcalf
7ed725cf5d arch/tile: sync up the defconfig files to the tip
This was inspired by mchehab@redhat.com's observation that we
didn't have EDAC configured on by default in both files.  In addition,
we were setting INITRAMFS_SOURCE to a non-empty string, which isn't
a very common default and required editing to do test builds.

Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
2012-03-12 15:32:12 -04:00
Chris Metcalf
688b4db0d9 arch/tile: Fix up from commit 8a25a2fd12
This was Kay Siever's bombing to convert 'cpu' to a regular subsystem.
The change left a bogus second argument to sysfs_create_file().

Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
2012-03-12 15:31:37 -04:00
Stanislaw Gruszka
3780d038fd rt2x00: fix random stalls
Is possible that we stop queue and then do not wake up it again,
especially when packets are transmitted fast. That can be easily
reproduced with modified tx queue entry_num to some small value e.g. 16.

If mac80211 already hold local->queue_stop_reason_lock, then we can wait
on that lock in both rt2x00queue_pause_queue() and
rt2x00queue_unpause_queue(). After drooping ->queue_stop_reason_lock
is possible that __ieee80211_wake_queue() will be performed before
__ieee80211_stop_queue(), hence we stop queue and newer wake up it
again.

Another race condition is possible when between rt2x00queue_threshold()
check and rt2x00queue_pause_queue() we will process all pending tx
buffers on different cpu. This might happen if for example interrupt
will be triggered on cpu performing rt2x00mac_tx().

To prevent race conditions serialize pause/unpause by queue->tx_lock.

Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-03-12 14:00:17 -04:00
Stanislaw Gruszka
210787e82a iwl3945: fix possible il->txq NULL pointer dereference in delayed works
On il3945_down procedure we free tx queue data and nullify il->txq
pointer. After that we drop mutex and then cancel delayed works. There
is possibility, that after drooping mutex and before the cancel, some
delayed work will start and crash while trying to send commands to
the device. For example, here is reported crash in
il3945_bg_reg_txpower_periodic():
https://bugzilla.kernel.org/show_bug.cgi?id=42766#c10

Patch fix problem by adding il->txq check on works that send commands,
hence utilize tx queue.

Reported-by: Clemens Eisserer <linuxhippy@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-03-12 14:00:16 -04:00
Guenter Roeck
33fa9b6204 hwmon: (w83627ehf) Fix writing into fan_stop_time for NCT6775F/NCT6776F
NCT6775F and NCT6776F have their own set of registers for FAN_STOP_TIME. The
correct registers were used to read FAN_STOP_TIME, but writes used the wrong
registers. Fix it.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable@vger.kernel.org # 3.0+
Acked-by: Jean Delvare <khali@linux-fr.org>
2012-03-12 10:40:30 -07:00
Xi Wang
e424fb8cc4 panasonic-laptop: avoid overflow in acpi_pcc_hotkey_add()
num_sifr could go negative since acpi_pcc_get_sqty() returns -EINVAL
on error.  Then it could bypass the sanity check (num_sifr > 255).
The subsequent call to kzalloc() would allocate a small buffer, leading
to a memory corruption.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
2012-03-12 10:25:51 -04:00
Ike Panhc
461e74377c acer-wmi: No wifi rfkill on Lenovo machines
We have several reports which says acer-wmi is loaded on ideapads
and register rfkill for wifi which can not be unblocked.

Since ideapad-laptop also register rfkill for wifi and it works
reliably, it will be fine acer-wmi is not going to register rfkill
for wifi once VPC2004 is found.

Also put IBM0068/LEN0068 in the list. Though thinkpad_acpi has no
wifi rfkill capability, there are reports which says acer-wmi also
block wireless on Thinkpad E520/E420.

Signed-off-by: Ike Panhc <ike.pan@canonical.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
2012-03-12 09:58:02 -04:00
Robert Gerlach
2d24c49080 Fujitsu tablet extras driver
This patch adds support for some of the devices within a wide variety
of Fujitsu Tablet Computers, both convertibles and slates. Primarily
it allows for the automatic detection of the tablet/notebook mode for
convertible tablet pc's, and orientation for docked slates. It also
adds support for the application panel buttons usually found next to
the tablet screen, and docking station detection for slates.

Signed-off-by: Robert Gerlach <khnz@gmx.de>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
2012-03-12 09:57:52 -04:00
Ben Hutchings
c215ab9a75 x86: Add amilo-rfkill driver for some Fujitsu-Siemens Amilo laptops
An rfkill driver based on the fsaa1655g and fsam7440 drivers for
Fujitsu-Siemens Amilo A1655 and M7440 models found at:

http://sourceforge.net/projects/fsaa1655g/
http://sourceforge.net/projects/fsam7440/

This adds DMI matching, replaces the procfs files with rfkill devices,
and uses the proper functions to write to the i8042 safely.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
2012-03-12 09:56:47 -04:00
Tom Herbert
930c514f69 dql: Fix undefined jiffies
In some configurations, jiffies may be undefined in
lib/dynamic_queue_limits.c.  Adding include of jiffies.h to avoid
this.

Signed-off-by: Tom Herbert <therbert@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-11 19:59:43 -07:00
Eric Dumazet
dfd25ffffc tcp: fix syncookie regression
commit ea4fc0d619 (ipv4: Don't use rt->rt_{src,dst} in ip_queue_xmit())
added a serious regression on synflood handling.

Simon Kirby discovered a successful connection was delayed by 20 seconds
before being responsive.

In my tests, I discovered that xmit frames were lost, and needed ~4
retransmits and a socket dst rebuild before being really sent.

In case of syncookie initiated connection, we use a different path to
initialize the socket dst, and inet->cork.fl.u.ip4 is left cleared.

As ip_queue_xmit() now depends on inet flow being setup, fix this by
copying the temp flowi4 we use in cookie_v4_check().

Reported-by: Simon Kirby <sim@netnation.com>
Bisected-by: Simon Kirby <sim@netnation.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-11 15:52:12 -07:00
Joerg Neikes
4e50391968 usb: asix: Patch for Sitecom LN-031
This patch adds support for the Sitecom LN-031 USB adapter with a AX88178 chip.

Added USB id to find correct driver for AX88178 1000 Ethernet adapter.

Signed-off-by: Joerg Neikes <j.neikes@midlandgate.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-11 15:52:12 -07:00
Axel Lin
9365121869 regulator: da9052: Ensure the selected voltage falls within the specified range
Integer division may truncate the result, use DIV_ROUND_UP to ensure the
selected voltage falls within the specified range.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2012-03-11 20:39:10 +00:00
Axel Lin
7b95765495 regulator: Set n_voltages for da9052 regulators
The n_voltages setting for all LDOs and DCDCs are missing in current code.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2012-03-11 20:39:04 +00:00
Axel Lin
f03570cf17 regulator: Fix setting selector in tps6524x set_voltage function
Don't assign the voltage to selector.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@vger.kernel.org
2012-03-11 20:38:10 +00:00
Al Viro
310fa7a367 restore smp_mb() in unlock_new_inode()
wait_on_inode() doesn't have ->i_lock

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-03-10 17:07:28 -05:00
Miklos Szeredi
7f6c7e62fc vfs: fix return value from do_last()
complete_walk() returns either ECHILD or ESTALE.  do_last() turns this into
ECHILD unconditionally.  If not in RCU mode, this error will reach userspace
which is complete nonsense.

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-03-10 17:05:30 -05:00
Miklos Szeredi
097b180ca0 vfs: fix double put after complete_walk()
complete_walk() already puts nd->path, no need to do it again at cleanup time.

This would result in Oopses if triggered, apparently the codepath is not too
well exercised.

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-03-10 17:05:30 -05:00
Linus Torvalds
fde7d9049e Linux 3.3-rc7 2012-03-10 13:49:52 -08:00
Jan Kara
f6940fe909 udf: Fix deadlock in udf_release_file()
udf_release_file() can be called from munmap() path with mmap_sem held.  Thus
we cannot take i_mutex there because that ranks above mmap_sem. Luckily,
i_mutex is not needed in udf_release_file() anymore since protection by
i_data_sem is enough to protect from races with write and truncate.

Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Reviewed-by: Namjae Jeon <linkinjeon@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-03-10 16:05:38 -05:00
Tyler Hicks
978d6d8c45 vfs: Correctly set the dir i_mutex lockdep class
9a7aa12f39 introduced additional logic around setting the i_mutex
lockdep class for directory inodes. The idea was that some filesystems
may want their own special lockdep class for different directory
inodes and calling unlock_new_inode() should not clobber one of
those special classes.

I believe that the added conditional, around the *negated* return value
of lockdep_match_class(), caused directory inodes to be placed in the
wrong lockdep class.

inode_init_always() sets the i_mutex lockdep class with i_mutex_key for
all inodes. If the filesystem did not change the class during inode
initialization, then the conditional mentioned above was false and the
directory inode was incorrectly left in the non-directory lockdep class.
If the filesystem did set a special lockdep class, then the conditional
mentioned above was true and that class was clobbered with
i_mutex_dir_key.

This patch removes the negation from the conditional so that the i_mutex
lockdep class is properly set for directory inodes. Special classes are
preserved and directory inodes with unmodified classes are set with
i_mutex_dir_key.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-03-10 16:05:38 -05:00
Al Viro
c7b2855505 aio: fix the "too late munmap()" race
Current code has put_ioctx() called asynchronously from aio_fput_routine();
that's done *after* we have killed the request that used to pin ioctx,
so there's nothing to stop io_destroy() waiting in wait_for_all_aios()
from progressing.  As the result, we can end up with async call of
put_ioctx() being the last one and possibly happening during exit_mmap()
or elf_core_dump(), neither of which expects stray munmap() being done
to them...

We do need to prevent _freeing_ ioctx until aio_fput_routine() is done
with that, but that's all we care about - neither io_destroy() nor
exit_aio() will progress past wait_for_all_aios() until aio_fput_routine()
does really_put_req(), so the ioctx teardown won't be done until then
and we don't care about the contents of ioctx past that point.

Since actual freeing of these suckers is RCU-delayed, we don't need to
bump ioctx refcount when request goes into list for async removal.
All we need is rcu_read_lock held just over the ->ctx_lock-protected
area in aio_fput_routine().

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-03-09 18:59:59 -08:00
Al Viro
86b62a2cb4 aio: fix io_setup/io_destroy race
Have ioctx_alloc() return an extra reference, so that caller would drop it
on success and not bother with re-grabbing it on failure exit.  The current
code is obviously broken - io_destroy() from another thread that managed
to guess the address io_setup() would've returned would free ioctx right
under us; gets especially interesting if aio_context_t * we pass to
io_setup() points to PROT_READ mapping, so put_user() fails and we end
up doing io_destroy() on kioctx another thread has just got freed...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-03-09 18:59:59 -08:00
Linus Torvalds
86e0600833 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs
Pull btrfs updates from Chris Mason:
 "I have two additional and btrfs fixes in my for-linus branch.  One is
  a casting error that leads to memory corruption on i386 during scrub,
  and the other fixes a corner case in the backref walking code (also
  triggered by scrub)."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  Btrfs: fix casting error in scrub reada code
  btrfs: fix locking issues in find_parent_nodes()
2012-03-09 18:09:18 -08:00
Hugh Dickins
be22aece68 memcg: revert fix to mapcount check for this release
Respectfully revert commit e6ca7b89dc "memcg: fix mapcount check
in move charge code for anonymous page" for the 3.3 release, so that
it behaves exactly like releases 2.6.35 through 3.2 in this respect.

Horiguchi-san's commit is correct in itself, 1 makes much more sense
than 2 in that check; but it does not go far enough - swapcount
should be considered too - if we really want such a check at all.

We appear to have reached agreement now, and expect that 3.4 will
remove the mapcount check, but had better not make 3.3 different.

Signed-off-by: Hugh Dickins <hughd@google.com>
Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-03-09 15:32:20 -08:00
Thomas Gleixner
a7f4255f90 x86: Derandom delay_tsc for 64 bit
Commit f0fbf0abc0 ("x86: integrate delay functions") converted
delay_tsc() into a random delay generator for 64 bit.  The reason is
that it merged the mostly identical versions of delay_32.c and
delay_64.c.  Though the subtle difference of the result was:

 static void delay_tsc(unsigned long loops)
 {
-	unsigned bclock, now;
+	unsigned long bclock, now;

Now the function uses rdtscl() which returns the lower 32bit of the
TSC. On 32bit that's not problematic as unsigned long is 32bit. On 64
bit this fails when the lower 32bit are close to wrap around when
bclock is read, because the following check

       if ((now - bclock) >= loops)
       	  	break;

evaluated to true on 64bit for e.g. bclock = 0xffffffff and now = 0
because the unsigned long (now - bclock) of these values results in
0xffffffff00000001 which is definitely larger than the loops
value. That explains Tvortkos observation:

"Because I am seeing udelay(500) (_occasionally_) being short, and
 that by delaying for some duration between 0us (yep) and 491us."

Make those variables explicitely u32 again, so this works for both 32
and 64 bit.

Reported-by: Tvrtko Ursulin <tvrtko.ursulin@onelan.co.uk>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org # >= 2.6.27
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-03-09 12:43:27 -08:00
Linus Torvalds
c447064de4 sound fixes for 3.3-rc7
Nothing exciting here: just a few regression fixes for HD-audio and ASoC,
 also the support of missing 32bit compat ioctl for HDSPM.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.18 (GNU/Linux)
 
 iQIcBAABAgAGBQJPWkMOAAoJEGwxgFQ9KSmk28sP/jGD+gCptQOFsA37fmkPKRNZ
 1ILs2iAPeEXL71R6gHUED/sarI4/wcUMQUMZkg4EZ81jiug7wWeT87VrjD6JiuEl
 PcYZU7PxWJgQ8xoPUEU9+HmjOnxrl1dRqrRYSEzApkCKq47inT9xPRQJek9LH9dD
 w8FCOf5n3i1Xbtb3TZsaUY2gKBF62x/xHA6ko8YXt531KLCbFskEMQ5uz442Aqa0
 HuhWMVgNJOxkGUkViE5hFz5dha8xi6RsdWW5wBCaRfMJoIE1LqP3p4L6YHfAYUN9
 aTgELyNMUgjZN77JgTyEn9VDc3fCJi9E4/bmTwJrPKpvkmZcUKkleUn8h7muS/9s
 8WI2rXFt+HJoOz+1xdfQ2o1J3uMcFePsIqWHiQlgjRLWn6I9E5hvWm36ExtgdaSr
 ySTCiLhGO6E1v27b9DYhU6gSxdjZgISNcRrEkGZKUcYf5iSOPkBJbhg3P4fz/Sas
 aCKGDgWVerWrGVVxsphJJ4uWxx9WZVLpKhGie8Zl9Umo4I6p33U+SX1kkRMJtKFl
 WMBph5qVOcVKDP8t2EPsK8/eZz7rMfNdAVT0YYUwB/iW/BPwb8M3KJt05Le8bhtc
 ma19c2MjEIHeeSsd6mVLW3NVrnSLNSrdiZLTzWnlg6zVbBcY9TAdkiUX1wZWERCN
 2NdPx0nP3Z1xbsVLorb9
 =aCRY
 -----END PGP SIGNATURE-----

Merge tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "Nothing exciting here: just a few regression fixes for HD-audio and
  ASoC, also the support of missing 32bit compat ioctl for HDSPM."

* tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hdspm - Provide ioctl_compat
  ALSA: hda/realtek - Apply the coef-setup only to ALC269VB
  ALSA: hda - add quirk to detect CD input on Gigabyte EP45-DS3
  ASoC: neo1973: fix neo1973 wm8753 initialization
2012-03-09 12:14:23 -08:00
David Brown
8cd5c8661d MAINTAINERS: new git entry for arm/mach-msm
The msm git tree moved to

  git://git.kernel.org/pub/scm/linux/kernel/git/davidb/linux-msm.git

Signed-off-by: David Brown <davidb@codeaurora.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-03-09 12:13:36 -08:00
Linus Torvalds
0ab5d757db Fix for C6X KSTK_EIP and KSTK_ESP macros.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJPV41FAAoJEOiN4VijXeFPsuEQAJDPafvpu9KEqSV/TOGKyelu
 rQk94tvHSVuGeAZiFpjjzQ/u0ofGNOxBqwbVnQjHwt6ameWX9VOxjbR4ZzdF5h9i
 1KbeapNIOKjebHUAf2Sh5mO8MkY8TcTFUzFBk5rOhP8BpNKfpFgfVFxh6JZVFo/b
 7a0kokAFoH24XQXAx4GK11uNE697fQqfcqyxqZ3lRhZ6jtEiIjMkUeRFgLy/G6gE
 Xo3H03ETawbJWzl4PXOiYNFH1Xf3DhT1VM7hLJVuPIrB3KT2oBweGQGn2DKextXe
 /4WE3XwGr9euHbJcJ7c5P0Gu2P76QDhLjgjz/hQfJdMfkD4ZsH0/VrLdTDs5AWOT
 WgzJg40WUDWgL7GuJgL+pCjt6pGszQq5EXGwakHesJU6zT4xZu9NyxChoTzyZdjW
 HIx3NJe5JaeCv0hKpmHlSaaJMXiYKWwKs1d3GOiAKP84AvQlqdsV3UyPCFRNCKNv
 cO2lkkC6pdHnGlJezmNxXqYZaaHwFsbTIcmOLiNlb8B2Q1uttsm3cbS0AReosdC8
 5PLGlvEbXfe/MURrquorpGMKEq5DjnbNdwHx5RcUh/882hZEieDbGVO6R6vApTy2
 dDR5vVhaOfcc86ST0WFLRrjUfqzPUGxBrMvGDn7pwKHlKC5h9IWOptTB/nSgJGuf
 7kCcp9qpXff8fvP2l4/A
 =2BoN
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming

Pull C6X fix from Mark Salter:
 "Fix for C6X KSTK_EIP and KSTK_ESP macros."

* tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
  C6X: fix KSTK_EIP and KSTK_ESP macros
2012-03-09 07:27:38 -08:00
Linus Torvalds
0cacaf51a0 IOMMU fixes for Linux v3.3-rc6
Two fixes are queued up. The first is an additional fix for the OMAP
 initialization order issue and the second patch fixes a possible section
 mismatch which can lead to a kernel crash in the AMD IOMMU driver when
 suspend/resume is used and the compiler has not inlined the
 iommu_set_device_table function.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJPWgA/AAoJECvwRC2XARrj7voQAN6evWicqjRDiXQgEC3muQFU
 OrA/Jz/i7+pHEYXcsTt0xHLb8juZNJAdkJjToB+oz7i/7D+TYRmJe+QRNkVmw7Ld
 d3DbUSUi9B3agvGblosKV3DYM8By1vTn9Gy2GNatW1yPuo5o4FHK2ePC5sn8Z/8z
 qwTZZnmvqluz7frNiw6Y3bNOqLd46z+9thUOoKmRn/fo3vKCOOVvb85yu1m/uqy6
 Dmpn6ep0w53jK29ZTKWcL8PW0YrLTEfszhMcVshFT+Y7GVSGnSxwgSh1fnZm/WL6
 z11L57dI0+7RS/z+cw+ko7ymIloV2v4ABRArMPIoLgbIQT0lidDNSqOQnPvWaBek
 MwdLL8W64lt2h4T7bLhDNRSDggWCX+EJYlk87O4hJYt4n57c3yT55z2+BGdoFivZ
 tzPshNWN4KVDMZCU6sTvzvz6eErwvro5wlVM2WxDVfXTxn6UTblP5uIQDGb2zVA9
 G95kK/OlK/s+giwOSOKxtR62livKEAuJ2Croa5LsdJnLdCo6ipvIz9cuAG6eij2W
 tulJQUN3FZr288iUAOPQ9xj6hWYM9RXqoYBxAHAvgYgGuirj9E6hjk/fL0y6XGQk
 jcg0bCdJjh2RzsLZR0eeslybtlrvUsBWYCPYCAAmRjUYHwZ6s822aO7qh0VnrFuQ
 csH09+3B0twvJ+ZRJibN
 =PZDd
 -----END PGP SIGNATURE-----

Merge tag 'iommu-fixes-v3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

Pull two IOMMU fixes from Joerg Roedel:
 "The first is an additional fix for the OMAP initialization order issue
  and the second patch fixes a possible section mismatch which can lead
  to a kernel crash in the AMD IOMMU driver when suspend/resume is used
  and the compiler has not inlined the iommu_set_device_table function."

* tag 'iommu-fixes-v3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  x86/amd: iommu_set_device_table() must not be __init
  ARM: OMAP: fix iommu, not mailbox
2012-03-09 07:26:25 -08:00