summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2011-05-18block: add proper state guards to __elv_next_requestJames Bottomley
blk_cleanup_queue() calls elevator_exit() and after this, we can't touch the elevator without oopsing. __elv_next_request() must check for this state because in the refcounted queue model, we can still call it after blk_cleanup_queue() has been called. This was reported as causing an oops attributable to scsi. Signed-off-by: James Bottomley <James.Bottomley@suse.de> Cc: stable@kernel.org Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-18ASoC: Max98095: Move existing NULL check before pointer dereference.Taylor Hutt
Visual inspection shows that max98095_put_eq_enum() and max98095_put_bq_enum() each have a possible NULL deref of 'pdata'. This change moves the NULL check above the use. Signed-off-by: Taylor Hutt <thutt@chromium.org> Acked-by: Peter Hsiang <Peter.Hsiang@maxim-ic.com> Acked-by: Liam Girdwood <lrg@ti.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2011-05-18of: fix race when matching driversMilton Miller
If two drivers are probing devices at the same time, both will write their match table result to the dev->of_match cache at the same time. Only write the result if the device matches. In a thread titled "SBus devices sometimes detected, sometimes not", Meelis reported his SBus hme was not detected about 50% of the time. From the debug suggested by Grant it was obvious another driver matched some devices between the call to match the hme and the hme discovery failling. Reported-by: Meelis Roos <mroos@linux.ee> Signed-off-by: Milton Miller <miltonm@bga.com> [grant.likely: modified to only call of_match_device() once] Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2011-05-18staging/mei: add mei to staging KbuildOren Weil
Add mei to Kconfig and Makefile in drivers/staging Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Itzhak Tzeel-Krupp <itzhak.tzeel-krupp@intel.com> Signed-off-by: Oren Weil <oren.jer.weil@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/mei: AMT WatchdogOren Weil
code that open connection and invoke heartbeats to the AMT Watchdog client/feature, if exists Connect to WD Client, if exists Send Start WD Command. Every 2 secs send heartbeats. On System shutdown/suspends, send Stop WD command. This is intermediate stage before moving this code to standalone watchdog driver. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Itzhak Tzeel-Krupp <itzhak.tzeel-krupp@intel.com> Signed-off-by: Oren Weil <oren.jer.weil@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/mei: mei.h defining user space interfaceOren Weil
define IOCTL_MEI_CONNECT_CLIENT and its associated structure When the user wants to connect to a ME feature/client after it open a file descriptor to the driver, he need to use Connect IOCTL. This IOCTL received a struct that contains a union of 2 other structs. 1st struct - Input Parameters: UUID - a predefine unique that identify the ME feature, this id per feature is constant all over the chipsets and versions. 2nd struct Output Parameters: MaxMessageLen - maximum message length that allowed to be send to the feature ProtocolVersion ME feature current protocol version. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Itzhak Tzeel-Krupp <itzhak.tzeel-krupp@intel.com> Signed-off-by: Oren Weil <oren.jer.weil@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/mei: Hardware and MEI driver internal struct definitionOren Weil
define the MEI protocol msg structs and HW registers, also define the MEI internal status and struct Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Itzhak Tzeel-Krupp <itzhak.tzeel-krupp@intel.com> Signed-off-by: Oren Weil <oren.jer.weil@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/mei: MEI driver init flow.Oren Weil
Init driver list and queue, MEI Hardware reset flow, init of driver specific host client. MEI Init/reset flow: - Ack all waiting interrupts - Hardware reset flow (Set Reset Bit, Generate Interrupt, Clear Reset Bit Generate Interrupt) - Wait for ME Ready Bit (done in interrupt thread) - Set ME Ready Bit (done in interrupt thread) - Send Start request (done in interrupt thread) - wait for answer - Send Enumerate Clients request (done in interrupt thread) - wait for answer - Send Get Client property for each client request (done in interrupt thread) - Wait for answers - Init Done. MEI Driver connect internally to 2 ME clients/features: AMTHI and AMT watchdog. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Itzhak Tzeel-Krupp <itzhak.tzeel-krupp@intel.com> Signed-off-by: Oren Weil <oren.jer.weil@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/mei: MEI link layerOren Weil
Implementation of the communication between host and ME. connect/disconnect to/from a client, send MEI message, read MEI message, flow control handling. Each MEI message has mei_msg_hdr followed by a payload. Driver is oblivious the payload. ME Address/ID - This is the logical address of the ME feature/client of that message. Host Address/ID - This is the logical address of the Host client of that message Length - This is the Length of message payload in bytes Reserved - reserved for future use. Message Complete - This bit is used to indicative that this is the last message of multi message MEI transfer of a client message that is larger then the MEI circular buffer. Payload - Message payload (data) up to 512bytes The HW data registers are consist two circular buffers, one for data from ME and other data from Host application. Each buffer has two pointers, read_ptr (H_CBRP) and write_ptr (H_CBWP). The buffers size is defined by depth value that exists in the status registers (H_CBD and ME_CBD_HRA). Every read from ME circular buffer cause read_ptr++ Every write to the Host circular buffer write_ptr++ Flow control MEI message that ME and MEI Driver use to notify each other that a ME feature/client or Host client buffer is ready to receive data. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Itzhak Tzeel-Krupp <itzhak.tzeel-krupp@intel.com> Signed-off-by: Oren Weil <oren.jer.weil@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/mei: Interrupt handling.Oren Weil
ISR and interrupt thread for handling incoming data. e.g. read bus message, read client message, handle reset requests. quick handler: As MEI may share interrupt with GFX and/or USB the HW register need to be checked and acknowledged. thread handler: Check if HW has data for read. Write data to HW if possible. May init reset flow on error there can be two types of messages: 1) bus messages: Management messages between MEI Driver and ME e.g. Connect request/response, Disconnect request/response Enum clients request/response Flow control request/response those message are indicated by ME Address/ID == 0 && Host Address/ID == 0 2) feature/client messages: message that are sends between ME Feature/Client and an application, the struct of the message is defined by the ME Feature Protocol (e.g. APF Protocol, AMTHI Protocol) those message are indicated by ME Address/ID != 0 && Host Address/ID != 0 MEI Initialization state machine is also managed by this patch. After MEI Reset is preform: Send Start request wait for answer Send Enumerate Clients request wait for answer Send Get Client property for each client request wait for answers Init Done. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Itzhak Tzeel-Krupp <itzhak.tzeel-krupp@intel.com> Signed-off-by: Oren Weil <oren.jer.weil@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/mei: PCI device and char driver support.Oren Weil
contains module entries and PCI driver and char device definitions (using file_operations, pci_driver struts). The HW interface is exposed on PCI interface. PCI: The MEI HW resources are memory map 32 bit registers (Host and ME Status Registers and Data Registers) and interrupt (shared, with Intel GFX on some chipsets and USB2 controller on others). The device is part of the chipsets and cannot be hotplugged. The MEI device present is determined by BIOS configuration. Probe: The driver starts the init MEI flow, that is explained in the patch "MEI driver init flow" [06/10], then schedules a timer that handles timeouts and watchdog heartbeats. Remove: The driver closes all connections and stops the watchdog. The driver expose char device that supports: open, release, write, read, ioctl, poll. Open: Upon open the driver allocates HOST data structure on behalf of application which will resides in the file's private data and assign a host ID number which will identify messages between driver client instance and MEI client. The driver also checks readiness of the device. The number of simultaneously opened instances is limited to 253. (255 - (amthi + watchdog)) Release: In release the driver sends a Disconnect Command to ME feature and clean all the data structs. IOCTL: MEI adds new IOCTL: (IOCTL_MEI_CONNECT_CLIENT) The IOCTL links the current file descriptor to ME feature. This is done by sending MEI Bus command: 'hbm_client_connect_request' to the ME and waiting for an answer :'hbm_client_connect_response'. Upon answer reception the driver updates its and HOST data structures in file structure to indicate that the file descriptor is associated to ME feature. Each ME feature is represented by UUID which is given as an input parameter to the IOCTL, upon success connect command the IOCTL will return the ME feature properties. ME can reject CONNECT commands due to several reasons, most common are: Invalid UUID ME or feature does not exists in ME. No More Connection allowed to this is feature, usually only one connection is allowed. Write: Upon write, the driver splits the user data into several MEI messages up to 512 bytes each and sends it to the HW. If the user wants to write data to AMTHI ME feature then the drivers routes the messages through AMTHI queues. Read: In read the driver checks is a connection exists to current file descriptor and then wait until a data is available. Message might be received (by interrupt from ME) in multiple chunks. Only complete message is released to the application. Poll: Nothing special here. Waiting for see if we have data available for reading. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Itzhak Tzeel-Krupp <itzhak.tzeel-krupp@intel.com> Signed-off-by: Oren Weil <oren.jer.weil@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/mei: MEI Driver TODO listOren Weil
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Oren Weil <oren.jer.weil@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/mei: MEI Driver documentationsOren Weil
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Oren Weil <oren.jer.weil@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18xen/blkback: don't fail empty barrier requestsJan Beulich
The sector number on empty barrier requests may (will?) be -1, which, given that it's being treated as unsigned 64-bit quantity, will almost always exceed the actual (virtual) disk's size. Inspired by Konrad's "When writting barriers set the sector number to zero...". While at it also add overflow checking to the math in vbd_translate(). Signed-off-by: Jan Beulich <jbeulich@novell.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2011-05-18staging/keucr: fix transport other code styleCho, Yu-Chen
fix keucr transport.c other coding style but not from checkpatch.pl. replace ternary conditional "?:" with if/else Signed-off-by: Cho, Yu-Chen <acho@novell.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/keucr: fix keucr transport coding styleCho, Yu-Chen
fix keucr transport.c transport.h coding style Signed-off-by: Cho, Yu-Chen <acho@novell.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/keucr: fix keucr smil.h coding styleCho, Yu-Chen
fix keucr smil.h coding style Signed-off-by: Cho, Yu-Chen <acho@novell.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/keucr: fix keucr smilecc.c coding styleCho, Yu-Chen
fix keucr smilecc.c coding style Signed-off-by: Cho, Yu-Chen <acho@novell.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/keucr: fix keucr scsiglue coding styleCho, Yu-Chen
fix keucr scsiglue.c coding style Signed-off-by: Cho, Yu-Chen <acho@novell.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/keucr: fix keucr msscsi coding styleCho, Yu-Chen
Fix keucr msscsi.c coding style. Remove externs ,and move MS_SCSIIrp to end, because there are not necessary to add extern for MS_SCSIIrp function. Signed-off-by: Cho, Yu-Chen <acho@novell.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18staging/keucr: fix keucr ms coding styleCho, Yu-Chen
fix keucr ms.c and ms.h coding style Signed-off-by: Cho, Yu-Chen <acho@novell.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-18ALSA: sound, core, pcm_lib: xrun_log: log also in_interruptBen Gardiner
When debugging pcm drivers I found the "period" or "hw" prefix printed by either XRUN_DEBUG_PERIODUPDATE or XRUN_DEBUG_PERIODUPDATE events, respectively to be very useful is observing the interplay between interrupt-context updates and syscall-context updates. Similarly, when debugging overruns with XRUN_DEBUG_LOG it is useful to see the context of the last 10 positions. Add an in_interrupt member to hwptr_log_entry which stores the value of the in_interrupt parameter of snd_pcm_update_hw_ptr0 when the log entry is created. Print a "[Q]" prefix when dumping the log entries if in_interrupt was true. Signed-off-by: Ben Gardiner <bengardiner@nanometrics.ca> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-05-18ALSA: usb-audio - Add support for USB X-Fi S51 ProMathieu Bouffard
USB X-Fi S51 Pro volume and mute from the volume knob on the unit. Compiled and tested with 2.6.39-rc7-git12 Signed-off-by: Mathieu Bouffard <mbouffard@strangequarks.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-05-18HID: assorted usage updates from hut 1.12Jarod Wilson
I've got a Tivo Slide bluetooth remote/dongle, which uses a fair number of hid usages that aren't currently mapped in hid-input.c. I'd initially written additions to hid-input.c with just this device in mind, including some bits that were specific to the device. This go around, I'm looking at adding/correcting as many generic HID usages from the HID Usage Tables, version 1.12, as I can -- which also serves to enable all but four of the buttons on the Tivo Slide remote[*]. Outside of fixing the obviously incorrect mapping of 0xc 0x45 from KEY_RADIO to KEY_RIGHT, and making use of the new KEY_IMAGES (just added in 2.6.39-rc4) for AL Image Browser instead of KEY_MEDIA, these are purely additions, and thus should have no negative impact on any already functional HID devices. Most of the added mappings seemed to be perfectly logical to me, but there were a few that were mapped on more of an "I think this makes the most sense" basis. [*] I'll handle the last four tivo buttons via an hid-tivo.c follow-up. CC: Dmitry Torokhov <dmitry.torokhov@gmail.com> CC: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Jarod Wilson <jarod@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-05-18Merge branch 'master' into upstream.Jiri Kosina
This is sync with Linus' tree to receive KEY_IMAGES definition that went in through input tree.
2011-05-18drm/i915/sdvo: Reorder i2c initialisation before ddc proxyChris Wilson
The ddc proxy depends upon the underlying i2c bus being selected. Under certain configurations, the i2c-adapter functionality is queried during initialisation and so may trigger an OOPS during boot. Hence, we need to reorder the initialisation of the ddc proxy until after we hook up the i2c adapter for the SDVO device. The condition under which it fails is when the i2c_add_adapter calls into i2c_detect which will attempt to probe all valid addresses on the adapter iff there is a pre-existing i2c_driver with the same class as the freshly added i2c_adapter. So it appears to depend upon having compiled in (or loaded such a module before i915.ko) an i2c-driver that likes to futz over the i2c_adapters claiming DDC support. Reported-by: Mihai Moldovan <ionic@ionic.de> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-05-18HID: roccat: fix actual/startup profile sysfs attribute in koneplusStefan Achatz
startup_profile and actual_profile didn't work as expected. Also as the actual profile is persistent, the distinction between the two was ambiguous, so both use the same code now and startup_profile has been deprecated. Also the event is now propagated through chardev. The userland tool has been updated to support this change. Signed-off-by: Stefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-05-18Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-blockLinus Torvalds
* 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: don't delay blk_run_queue_async scsi: remove performance regression due to async queue run blk-throttle: Use task_subsys_state() to determine a task's blkio_cgroup block: rescan partitions on invalidated devices on -ENOMEDIA too cdrom: always check_disk_change() on open block: unexport DISK_EVENT_MEDIA_CHANGE for legacy/fringe drivers
2011-05-18HID: hid-multitouch: Add support for Lumio panelsBenjamin Tissoires
This patch enables support for Lumio optical devices. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-05-18MIPS: Kludge IP27 build for 2.6.39.Ralf Baechle
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2011-05-18MIPS: AR7: Fix GPIO register size for Titan variant.Florian Fainelli
The 'size' variable contains the correct register size for both AR7 and Titan, but we never used it to ioremap the correct register size. This problem only shows up on Titan. [ralf@linux-mips.org: Fixed the fix. The original patch as in patchwork recognizes the problem correctly then fails to fix it ...] Reported-by: Alexander Clouter <alex@digriz.org.uk> Signed-off-by: Florian Fainelli <florian@openwrt.org> Patchwork: https://patchwork.linux-mips.org/patch/2380/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2011-05-18MIPS: Fix duplicate invocation of notify_die.Ralf Baechle
Initial patch by Yury Polyanskiy <ypolyans@princeton.edu>. Signed-off-by: Ralf Baechle <ralf@linux-mips.org> Patchwork: https://patchwork.linux-mips.org/patch/2373/
2011-05-18MIPS: RB532: Fix iomap resource size miscalculation.Ralf Baechle
This is the MIPS portion of Joe Perches <joe@perches.com>'s https://patchwork.linux-mips.org/patch/2172/ which seems to have been lost in time and space. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2011-05-18Merge branch 'signals-review' into ptraceOleg Nesterov
2011-05-18signal: trivial, fix the "timespec declared inside parameter list" warningOleg Nesterov
Fix the compile warning, do_sigtimedwait(struct timespec *) in signal.h needs the forward declaration of timespec. Reported-and-acked-by: Mike Frysinger <vapier.adi@gmail.com> Signed-off-by: Oleg Nesterov <oleg@redhat.com>
2011-05-18irq: Export functions to allow modular irq driversJonathan Cameron
Export handle_simple_irq, irq_modify_status, irq_alloc_descs, irq_free_descs and generic_handle_irq to allow their usage in modules. First user is IIO, which wants to be built modular, but needs to be able to create irq chips, allocate and configure interrupt descriptors and handle demultiplexing interrupts. [ tglx: Moved the uninlinig of generic_handle_irq to a separate patch ] Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk> Link: http://lkml.kernel.org/r/%3C1305711544-505-1-git-send-email-jic23%40cam.ac.uk%3E Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2011-05-18genirq: Uninline and sanity check generic_handle_irq()Thomas Gleixner
generic_handle_irq() is missing a NULL pointer check for the result of irq_to_desc. This was a not a big problem, but we want to expose it to drivers, so we better have sanity checks in place. Add a return value as well, which indicates that the irq number was valid and the handler was invoked. Based on the pure code move from Jonathan Cameron. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Jonathan Cameron <jic23@cam.ac.uk>
2011-05-18genirq: Remove pointless ifdefsThomas Gleixner
kernel/irq/ is only built when CONFIG_GENERIC_HARDIRQS=y. So making code inside of kernel/irq/ conditional on CONFIG_GENERIC_HARDIRQS is pointless. Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2011-05-18usb: musb: ux500: add configuration and build options for ux500 dmaMian Yousaf Kaukab
Signed-off-by: Mian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2011-05-18usb: musb: ux500: add dma glue layer for ux500Mian Yousaf Kaukab
Unaligned sizes and buffers are not supported and they will be filtered out by is_compatible(). Signed-off-by: Mian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2011-05-18usb: musb: ux500: add dma name for ux500Mian Yousaf Kaukab
Signed-off-by: Mian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2011-05-18usb: musb: ux500: add ux500 specific code for gadget sideMian Yousaf Kaukab
Although U8500 and U5500 platforms use paltform dma, Inventra dma specific code can work for them for the most part. Only difference is for the Rx path where this patch is making use of request->short_not_ok to select dma mode. Signed-off-by: Mian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2011-05-18usb: musb: fix compile errorFelipe Balbi
commit 35a83365da6aa10095c6138cc428c15853409c32 (usb: musb: drop unneeded musb_debug trickery) introduced a compile error for blackfin and tusb6010 glue layers. Fix it. Reported-by: Mike Frysinger <vapier.adi@gmail.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2011-05-18HID: 'name' and 'phys' in 'struct hid_device' can never be NULLDaniel Mack
As they are static members of fix size, there is no need to NULL-check them. Signed-off-by: Daniel Mack <zonque@gmail.com> Cc: Dmitry Torokhov <dtor@mail.ru> Cc: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-05-18cris: typo in mach-fs MakefileSarah Nadi
Signed-off-by: Sarah Nadi <snadi@uwaterloo.ca> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-05-18configfs: Fix race between configfs_readdir() and configfs_d_iput()Joel Becker
configfs_readdir() will use the existing inode numbers of inodes in the dcache, but it makes them up for attribute files that aren't currently instantiated. There is a race where a closing attribute file can be tearing down at the same time as configfs_readdir() is trying to get its inode number. We want to get the inode number of open attribute files, because they should match while instantiated. We can't lock down the transition where dentry->d_inode is set to NULL, so we just check for NULL there. We can, however, ensure that an inode we find isn't iput() in configfs_d_iput() until after we've accessed it. Signed-off-by: Joel Becker <jlbec@evilplan.org>
2011-05-18x86, 64-bit: Fix copy_[to/from]_user() checks for the userspace address limitJiri Olsa
As reported in BZ #30352: https://bugzilla.kernel.org/show_bug.cgi?id=30352 there's a kernel bug related to reading the last allowed page on x86_64. The _copy_to_user() and _copy_from_user() functions use the following check for address limit: if (buf + size >= limit) fail(); while it should be more permissive: if (buf + size > limit) fail(); That's because the size represents the number of bytes being read/write from/to buf address AND including the buf address. So the copy function will actually never touch the limit address even if "buf + size == limit". Following program fails to use the last page as buffer due to the wrong limit check: #include <sys/mman.h> #include <sys/socket.h> #include <assert.h> #define PAGE_SIZE (4096) #define LAST_PAGE ((void*)(0x7fffffffe000)) int main() { int fds[2], err; void * ptr = mmap(LAST_PAGE, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0); assert(ptr == LAST_PAGE); err = socketpair(AF_LOCAL, SOCK_STREAM, 0, fds); assert(err == 0); err = send(fds[0], ptr, PAGE_SIZE, 0); perror("send"); assert(err == PAGE_SIZE); err = recv(fds[1], ptr, PAGE_SIZE, MSG_WAITALL); perror("recv"); assert(err == PAGE_SIZE); return 0; } The other place checking the addr limit is the access_ok() function, which is working properly. There's just a misleading comment for the __range_not_ok() macro - which this patch fixes as well. The last page of the user-space address range is a guard page and Brian Gerst observed that the guard page itself due to an erratum on K8 cpus (#121 Sequential Execution Across Non-Canonical Boundary Causes Processor Hang). However, the test code is using the last valid page before the guard page. The bug is that the last byte before the guard page can't be read because of the off-by-one error. The guard page is left in place. This bug would normally not show up because the last page is part of the process stack and never accessed via syscalls. Signed-off-by: Jiri Olsa <jolsa@redhat.com> Acked-by: Brian Gerst <brgerst@gmail.com> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: <stable@kernel.org> Link: http://lkml.kernel.org/r/1305210630-7136-1-git-send-email-jolsa@redhat.com Signed-off-by: Ingo Molnar <mingo@elte.hu>
2011-05-18configfs: Don't try to d_delete() negative dentries.Joel Becker
When configfs is faking mkdir() on its subsystem or default group objects, it starts by adding a negative dentry. It then tries to instantiate the group. If that should fail, it must clean up after itself. I was using d_delete() here, but configfs_attach_group() promises to return an empty dentry on error. d_delete() explodes with the entry dentry. Let's try d_drop() instead. The unhashing is what we want for our dentry. Signed-off-by: Joel Becker <jlbec@evilplan.org>
2011-05-18block: don't delay blk_run_queue_asyncShaohua Li
Let's check a scenario: 1. blk_delay_queue(q, SCSI_QUEUE_DELAY); 2. blk_run_queue_async(); the second one will became a noop, because q->delay_work already has WORK_STRUCT_PENDING_BIT set, so the delayed work will still run after SCSI_QUEUE_DELAY. But blk_run_queue_async actually hopes the delayed work runs immediately. Fix this by doing a cancel on potentially pending delayed work before queuing an immediate run of the workqueue. Signed-off-by: Shaohua Li <shaohua.li@intel.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-18Merge branch 'v4l_for_linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: [media] V4L: soc-camera: regression fix: calculate .sizeimage in soc_camera.c [media] v4l2-subdev: fix broken subdev control enumeration [media] Fix cx88 remote control input [media] v4l: Release module if subdev registration fails