summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-06-02ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixupTakashi Iwai
The conversion to a fixup table for Replacer model with ALC260 in commit 20f7d928 took the wrong widget NID for COEF setups. Namely, NID 0x1a should have been used instead of NID 0x20, which is the common node for all Realtek codecs but ALC260. Fixes: 20f7d928fa6e ('ALSA: hda/realtek - Replace ALC260 model=replacer with the auto-parser') Cc: <stable@vger.kernel.org> [v3.4+] Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-06-02ext4: handle symlink properly with inline_dataZheng Liu
This commit tries to fix a bug that we can't read symlink properly with inline data feature when the length of symlink is greater than 60 bytes but less than extra space. The key issue is in ext4_inode_is_fast_symlink() that it doesn't check whether or not an inode has inline data. When the user creates a new symlink, an inode will be allocated with MAY_INLINE_DATA flag. Then symlink will be stored in ->i_block and extended attribute space. In the mean time, this inode is with inline data flag. After remounting it, ext4_inode_is_fast_symlink() function thinks that this inode is a fast symlink so that the data in ->i_block is copied to the user, and the data in extra space is trimmed. In fact this inode should be as a normal symlink. The following script can hit this bug. #!/bin/bash cd ${MNT} filename=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 rm -rf test mkdir test cd test echo "hello" >$filename ln -s $filename symlinkfile cd sudo umount /mnt/sda1 sudo mount -t ext4 /dev/sda1 /mnt/sda1 readlink /mnt/sda1/test/symlinkfile After applying this patch, it will break the assumption in e2fsck because the original implementation doesn't want to support symlink with inline data. Reported-by: "Darrick J. Wong" <darrick.wong@oracle.com> Reported-by: Ian Nartowicz <claws@nartowicz.co.uk> Cc: Ian Nartowicz <claws@nartowicz.co.uk> Cc: Tao Ma <tm@tao.ma> Cc: "Darrick J. Wong" <darrick.wong@oracle.com> Cc: Andreas Dilger <adilger.kernel@dilger.ca> Signed-off-by: Zheng Liu <wenqing.lz@taobao.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2014-06-02ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptopRonan Marquet
Correcion of wrong fixup entries add in commit ca8f0424 to replace static model quirk for PB V7900 laptop (will model). [note: the removal of ALC260_FIXUP_HP_PIN_0F chain is also needed as a part of the fix; otherwise the pin is set up wrongly as a headphone, and user-space (PulseAudio) may be wrongly trying to detect the jack state -- tiwai] Fixes: ca8f04247eaa ('ALSA: hda/realtek - Add the fixup codes for ALC260 model=will') Signed-off-by: Ronan Marquet <ronan.marquet@orange.fr> Cc: <stable@vger.kernel.org> [v3.4+] Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-06-02mips: Update the email address of Geert UytterhoevenGeert Uytterhoeven
All my Sony addresses are defunct. Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/6817/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2014-06-02drm/radeon: use hw cts/n values for deep colorAlex Deucher
I'm not really sure how these should be calculated for deep color. The hw generated values seem to work. Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: only apply hdmi bpc pll flags when encoder mode is hdmiAlex Deucher
May fix display issues with non-HDMI displays. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-06-02drm/radeon/atom: fix dithering on certain panelsAlex Deucher
We need to specify the encoder mode as LVDS for eDP when using the Crtc_Source atom table in order to properly set up the FMT hardware. bug: https://bugs.freedesktop.org/show_bug.cgi?id=73911 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-06-02drm/radeon: optimize CIK VM handling v2Christian König
Fill VM page tables from the GART page table if applicable. v2: fix copy&paste error Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: optimize SI VM handlingChristian König
Fill VM page tables from the GART page table if applicable. Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: add define for flags used in R600+ GTTChristian König
Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: rework page flip handling v3Christian König
Instead of trying to flip inside the vblank period when the buffer is idle, offload blocking for idle to a kernel thread and program the flip directly into the hardware. v2: add error handling, fix EBUSY handling v3: add proper exclusive_lock handling Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: separate vblank and pflip crtc handlingChristian König
Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: split page flip and pending callbackChristian König
Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: remove drm_vblank_get|put from pflip handlingChristian König
We activate the VBLANK irq manually anyway, so this is unnecessary. Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: remove (pre|post)_page_flip callbacksChristian König
They are doing the same on all generations anyway. Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon/dp: fix lane/clock setup for dp 1.2 capable devicesAlex Deucher
Only DCE5+ asics support DP 1.2. Noticed by ArtForz on IRC. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-06-02drm/radeon: fix typo in radeon_connector_is_dp12_capable()Alex Deucher
We were checking the ext clock rather than the display clock. Noticed by ArtForz on IRC. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-06-02radeon: Remove useless quirk for zx1/FireGL X1 combo introduced with fdo #7770Émeric MASCHINO
Removes useless quirk a7f465f73363fce409870f62173d518b1bc02ae6 introduced with fdo #7770 as a failed attempt to minimize stability issues with hp zx1 chipset/ ATI FireGL X1 graphics adapter configuration (see http://marc.info/?l=linux-ia64&m=140077543819871&w=2 for details/reason) Signed-off-by: Émeric MASCHINO <emeric.maschino@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02vgaswitcheroo: switch the mux to the igp on power down when runpm is enabledAlex Deucher
Avoids blank screens on muxed systems when runpm is active. bug: https://bugs.freedesktop.org/show_bug.cgi?id=75917 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-06-02drm/radeon: use NULL instead of zero in clearstate headersMichele CURTI
Signed-off-by: Michele Curti <michele.curti@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: use NULL instead of zero in object functionsMichele CURTI
Signed-off-by: Michele Curti <michele.curti@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon/hdmi: DCE2: simplify audio workaroundRafał Miłecki
Thanks to advanced RE of fglrx we finally know what exactly needs to be handled of AFMT change. This has been tested for possible regressions on: 1) DCE2 HD2400 (RV610) 2) DCE3 HD3470 (RV620) For a reference and details see: https://bugzilla.kernel.org/show_bug.cgi?id=76231 Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon/hdmi: DCE2: update setmodeRafał Miłecki
Recent RE efforts revealed ops performed by fglrx during HDMI setup. This mostly adds masks to r/w ops plus few single missing bits. This has been tested for possible regressions on: 1) DCE2 HD2400 (RV610) 2) DCE3 HD3470 (RV620) For a reference and details see: https://bugzilla.kernel.org/show_bug.cgi?id=76231 Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon/hdmi: DCE3: clean ACR controlRafał Miłecki
What initially seemed to be a typo in fglrx (using register 0x740c instead of 0x74dc) appeared to be a correct behavior. DCE3 has ACR and CRC registers swapped which explains why we needed WREG32(HDMI0_AUDIO_CRC_CONTROL + offset, 0x1000); This has been tested for possible regressions on DCE3 HD3470 (RV620). Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon/hdmi: use separated file for DCE 3.1/3.2 codeRafał Miłecki
DCE 3.1 and 3.2 should be programmed in a different way than DCE 2 and DCE 3. The order of setting registers and sets of registers are different. It's still unsure how we will handle DCE 3.1 vs. DCE 3.2, since they have few differences as well. For now separate DCE 2 and DCE 3 path, so we can work on it without a risk of breaking DCE 3.1+. This has been tested for possible regressions on DCE32 HD4550 (RV710). Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: add proper support for RADEON_VM_BLOCK_SIZE v2Christian König
This patch makes it possible to decide how many address bits are spend on the page directory vs the page tables. v2: remove unintended change Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: add large PTE support for NI, SI and CIK v5Christian König
This patch implements support for VRAM page table entry compression. PTE construction is enhanced to identify physically contiguous page ranges and mark them in the PTE fragment field. L1/L2 TLB support is enabled for 64KB (SI/CIK) and 256KB (NI) PTE fragments, significantly improving TLB utilization for VRAM allocations. Linear store bandwidth is improved from 60GB/s to 125GB/s on Pitcairn. Unigine Heaven 3.0 sees an average improvement from 24.7 to 27.7 FPS on default settings at 1920x1200 resolution with vsync disabled. See main comment in radeon_vm.c for a technical description. v2 (chk): rebased and simplified. v3 (chk): add missing hw setup v4 (chk): rebased on current drm-fixes-3.15 v5 (chk): fix comments and commit text Signed-off-by: Jay Cornwall <jay@jcornwall.me> Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-06-02drm/radeon: add a i2c bus mutexAlex Deucher
The i2c and aux buses use the same pads so add a mutex to protect access to the pads. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Christian König <christian.koenig@amd.com>
2014-06-02regulator: pbias: remove unnecessary OOM messagesJingoo Han
The site-specific OOM messages are unnecessary, because they duplicate the MM subsystem generic OOM message. Signed-off-by: Jingoo Han <jg1.han@samsung.com> Signed-off-by: Mark Brown <broonie@linaro.org>
2014-06-02regulator: max8649: remove unnecessary OOM messagesJingoo Han
The site-specific OOM messages are unnecessary, because they duplicate the MM subsystem generic OOM message. Signed-off-by: Jingoo Han <jg1.han@samsung.com> Signed-off-by: Mark Brown <broonie@linaro.org>
2014-06-02uprobes: Teach copy_insn() to support tmpfsOleg Nesterov
tmpfs is widely used but as Denys reports shmem_aops doesn't have ->readpage() and thus you can't probe a binary on this filesystem. As Hugh suggested we can use shmem_read_mapping_page() in this case, just we need to check shmem_mapping() if ->readpage == NULL. Reported-by: Denys Vlasenko <dvlasenk@redhat.com> Suggested-by: Hugh Dickins <hughd@google.com> Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com> Signed-off-by: Oleg Nesterov <oleg@redhat.com>
2014-06-02uprobes: Shift ->readpage check from __copy_insn() to uprobe_register()Oleg Nesterov
copy_insn() fails with -EIO if ->readpage == NULL, but this error is not propagated unless uprobe_register() path finds ->mm which already mmaps this file. In this case (say) "perf record" does not actually install the probe, but the user can't know about this. Move this check into uprobe_register() so that this problem can be detected earlier and reported to user. Note: this is still not perfect, - copy_insn() and arch_uprobe_analyze_insn() should be called by uprobe_register() but this is not simple, we need vm_file for read_mapping_page() (although perhaps we can pass NULL), and we need ->mm for is_64bit_mm() (although this logic is broken anyway). - uprobe_register() should be called by create_trace_uprobe(), not by probe_event_enable(), so that an error can be detected at "perf probe -x" time. This also needs more changes in the core uprobe code, uprobe register/unregister interface was poorly designed from the very beginning. Reported-by: Denys Vlasenko <dvlasenk@redhat.com> Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com> Signed-off-by: Oleg Nesterov <oleg@redhat.com>
2014-06-02f2fs: fix recursive lock by f2fs_setxattrJaegeuk Kim
This patch should resolve the following recursive lock. [<ffffffff8135a9c3>] call_rwsem_down_write_failed+0x13/0x20 [<ffffffffa01749dc>] f2fs_setxattr+0x5c/0xa0 [f2fs] [<ffffffffa0174c99>] __f2fs_set_acl+0x1b9/0x340 [f2fs] [<ffffffffa017515a>] f2fs_init_acl+0x4a/0xcb [f2fs] [<ffffffffa0159abe>] __f2fs_add_link+0x26e/0x780 [f2fs] [<ffffffffa015d4d8>] f2fs_mkdir+0xb8/0x150 [f2fs] [<ffffffff811cebd7>] vfs_mkdir+0xb7/0x160 [<ffffffff811cf89b>] SyS_mkdir+0xab/0xe0 [<ffffffff817244bf>] tracesys+0xe1/0xe6 [<ffffffffffffffff>] 0xffffffffffffffff The call path indicates: - f2fs_add_link : down_write(&fi->i_sem); - init_inode_metadata - f2fs_init_acl - __f2fs_set_acl - f2fs_setxattr : down_write(&fi->i_sem); Here we should not call f2fs_setxattr, but __f2fs_setxattr. But __f2fs_setxattr is a static function in xattr.c, so that I found the other generic approach to use f2fs_setxattr. In f2fs_setxattr, the page pointer is only given from init_inode_metadata. So, this patch adds this condition to avoid this in f2fs_setxattr. Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2014-06-02locks: add some tracepoints in the lease handling codeJeff Layton
v2: add a __break_lease tracepoint for non-blocking case Recently, I needed these to help track down a softlockup when recalling a delegation, but they might be helpful in other situations as well. Cc: "J. Bruce Fields" <bfields@fieldses.org> Signed-off-by: Jeff Layton <jlayton@poochiereds.net>
2014-06-02fs/locks.c: replace seq_printf by seq_putsFabian Frederick
Replace seq_printf where possible Cc: Jeff Layton <jlayton@redhat.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Fabian Frederick <fabf@skynet.be> Signed-off-by: Jeff Layton <jlayton@poochiereds.net>
2014-06-02locks: ensure that fl_owner is always initialized properly in flock and ↵Jeff Layton
lease codepaths Currently, the fl_owner isn't set for flock locks. Some filesystems use byte-range locks to simulate flock locks and there is a common idiom in those that does: fl->fl_owner = (fl_owner_t)filp; fl->fl_start = 0; fl->fl_end = OFFSET_MAX; Since flock locks are generally "owned" by the open file description, move this into the common flock lock setup code. The fl_start and fl_end fields are already set appropriately, so remove the unneeded setting of that in flock ops in those filesystems as well. Finally, the lease code also sets the fl_owner as if they were owned by the process and not the open file description. This is incorrect as leases have the same ownership semantics as flock locks. Set them the same way. The lease code doesn't actually use the fl_owner value for anything, so this is more for consistency's sake than a bugfix. Reported-by: Trond Myklebust <trond.myklebust@primarydata.com> Signed-off-by: Jeff Layton <jlayton@poochiereds.net> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (Staging portion) Acked-by: J. Bruce Fields <bfields@fieldses.org>
2014-06-02ARM: ensure C page table setup code follows assembly code (part II)Russell King
This does the same as the previous commit, but for the S bit, which also needs to match the initial value which the assembly code used for the same reasons. Again, we add a check for SMP to ensure that the page tables are correctly setup for SMP. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2014-06-02MIPS: Add minimal defconfig for mips_paravirtAndreas Herrmann
Signed-off-by: Andreas Herrmann <andreas.herrmann@caviumnetworks.com> Cc: linux-mips@linux-mips.org Cc: David Daney <ddaney.cavm@gmail.com> Cc: James Hogan <james.hogan@imgtec.com> Cc: kvm@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/7008/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2014-06-02drm/msm: use correct gfp flag for vram allocationRob Clark
We want at least __GFP_WAIT, otherwise dma-mapping tries to use coherent pool rather than CMA pool. Signed-off-by: Rob Clark <robdclark@gmail.com>
2014-06-02drm/msm/mdp5: fix error return valueRob Clark
Signed-off-by: Rob Clark <robdclark@gmail.com>
2014-06-02drm/msm: remove redundant private plane cleanupRob Clark
Now that drm core knows about private planes, it cleans them up for us. Trying to do this twice results in badness. Signed-off-by: Rob Clark <robdclark@gmail.com>
2014-06-02drm/msm: add perf logging debugfsRob Clark
Signed-off-by: Rob Clark <robdclark@gmail.com>
2014-06-02drm/msm: add rd logging debugfsRob Clark
To ease debugging, add debugfs file which can be cat/tail'd to log submits, along with fence #. If GPU hangs, you can look at 'gpu' debugfs file to find last completed fence and current register state, and compare with logged rd file to narrow down the DRAW_INDX which triggered the GPU hang. Signed-off-by: Rob Clark <robdclark@gmail.com>
2014-06-02x86/efi: Do not export efi runtime map in case old mapDave Young
For ioremapped efi memory aka old_map the virt addresses are not persistant across kexec reboot. kexec-tools will read the runtime maps from sysfs then pass them to 2nd kernel and assuming kexec efi boot is ok. This will cause kexec boot failure. To address this issue do not export runtime maps in case efi old_map so userspace can use no efi boot instead. Signed-off-by: Dave Young <dyoung@redhat.com> Acked-by: Borislav Petkov <bp@suse.de> Acked-by: Vivek Goyal <vgoyal@redhat.com> Signed-off-by: Matt Fleming <matt.fleming@intel.com>
2014-06-02HID: hid-sensor-hub: new device id and quirk for STM Sensor hubArchana Patni
Added STM sensor hub new device id. Also added this new device in HID_SENSOR_HUB_ENUM_QUIRK to fix report descriptors. These devices uses old FW which uses logical 0 as minimum. In these, HID reports are not using proper collection classes. So we need to fix report descriptors,for such devices. This will not have any impact, if the FW uses logical 1 as minimum. Signed-off-by: Archana Patni <archana.patni@intel.com> Signed-off-by: Subramony Sesha <subramony.sesha@intel.com> Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2014-06-02intel_pstate: Improve initial busy calculationDoug Smythies
This change makes the busy calculation using 64 bit math which prevents overflow for large values of aperf/mperf. Cc: 3.14+ <stable@vger.kernel.org> # 3.14+ Signed-off-by: Doug Smythies <dsmythies@telus.net> Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-06-02intel_pstate: add sample time scalingDirk Brandewie
The PID assumes that samples are of equal time, which for a deferable timers this is not true when the system goes idle. This causes the PID to take a long time to converge to the min P state and depending on the pattern of the idle load can make the P state appear stuck. The hold-off value of three sample times before using the scaling is to give a grace period for applications that have high performance requirements and spend a lot of time idle, The poster child for this behavior is the ffmpeg benchmark in the Phoronix test suite. Cc: 3.14+ <stable@vger.kernel.org> # 3.14+ Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-06-02intel_pstate: Correct rounding in busy calculationDirk Brandewie
Changing to fixed point math throughout the busy calculation in commit e66c1768 (Change busy calculation to use fixed point math.) Introduced some inaccuracies by rounding the busy value at two points in the calculation. This change removes roundings and moves the rounding to the output of the PID where the calculations are complete and the value returned as an integer. Fixes: e66c17683746 (intel_pstate: Change busy calculation to use fixed point math.) Reported-by: Doug Smythies <dsmythies@telus.net> Cc: 3.14+ <stable@vger.kernel.org> # 3.14+ Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-06-02intel_pstate: Remove C0 trackingDirk Brandewie
Commit fcb6a15c (intel_pstate: Take core C0 time into account for core busy calculation) introduced a regression referenced below. The issue with "lockup" after suspend that this commit was addressing is now dealt with in the suspend path. Fixes: fcb6a15c2e7e (intel_pstate: Take core C0 time into account for core busy calculation) Link: https://bugzilla.kernel.org/show_bug.cgi?id=66581 Link: https://bugzilla.kernel.org/show_bug.cgi?id=75121 Reported-by: Doug Smythies <dsmythies@telus.net> Cc: 3.14+ <stable@vger.kernel.org> # 3.14+ Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-06-02Bluetooth: Fix L2CAP deadlockJukka Taimisto
-[0x01 Introduction We have found a programming error causing a deadlock in Bluetooth subsystem of Linux kernel. The problem is caused by missing release_sock() call when L2CAP connection creation fails due full accept queue. The issue can be reproduced with 3.15-rc5 kernel and is also present in earlier kernels. -[0x02 Details The problem occurs when multiple L2CAP connections are created to a PSM which contains listening socket (like SDP) and left pending, for example, configuration (the underlying ACL link is not disconnected between connections). When L2CAP connection request is received and listening socket is found the l2cap_sock_new_connection_cb() function (net/bluetooth/l2cap_sock.c) is called. This function locks the 'parent' socket and then checks if the accept queue is full. 1178 lock_sock(parent); 1179 1180 /* Check for backlog size */ 1181 if (sk_acceptq_is_full(parent)) { 1182 BT_DBG("backlog full %d", parent->sk_ack_backlog); 1183 return NULL; 1184 } If case the accept queue is full NULL is returned, but the 'parent' socket is not released. Thus when next L2CAP connection request is received the code blocks on lock_sock() since the parent is still locked. Also note that for connections already established and waiting for configuration to complete a timeout will occur and l2cap_chan_timeout() (net/bluetooth/l2cap_core.c) will be called. All threads calling this function will also be blocked waiting for the channel mutex since the thread which is waiting on lock_sock() alread holds the channel mutex. We were able to reproduce this by sending continuously L2CAP connection request followed by disconnection request containing invalid CID. This left the created connections pending configuration. After the deadlock occurs it is impossible to kill bluetoothd, btmon will not get any more data etc. requiring reboot to recover. -[0x03 Fix Releasing the 'parent' socket when l2cap_sock_new_connection_cb() returns NULL seems to fix the issue. Signed-off-by: Jukka Taimisto <jtt@codenomicon.com> Reported-by: Tommi Mäkilä <tmakila@codenomicon.com> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Cc: stable@vger.kernel.org