summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-03-05drivers/tty/hvc: Use strlcpy instead of strncpyChen Gang
when strlen pi->location_code is larger than HVCS_CLC_LENGTH + 1, original implementation can not let hvcsd->p_location_code NUL terminated. so need fix it (also can simplify the code) Signed-off-by: Chen Gang <gang.chen@asianux.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-03-05powerpc/pseries/hvcserver: Fix strncpy buffer limit in location codeChen Gang
the dest buf len is 80 (HVCS_CLC_LENGTH + 1). the src buf len is PAGE_SIZE. if src buf string len is more than 80, it will cause issue. Signed-off-by: Chen Gang <gang.chen@asianux.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-03-05powerpc: Fix compile of sha1-powerpc-asm.S on 32-bitTony Breeds
When building with CRYPTO_SHA1_PPC enabled we fail with: powerpc/crypto/sha1-powerpc-asm.S: Assembler messages: powerpc/crypto/sha1-powerpc-asm.S:116: Error: can't resolve `0' {*ABS* section} - `STACKFRAMESIZE' {*UND* section} powerpc/crypto/sha1-powerpc-asm.S:116: Error: expression too complex powerpc/crypto/sha1-powerpc-asm.S:178: Error: unsupported relocation against STACKFRAMESIZE Use INT_FRAME_SIZE instead of STACKFRAMESIZE. Signed-off-by: Tony Breeds <tony@bakeyournoodle.com> Tested-by: Christian Kujau <lists@nerdbynature.de> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-03-05ASoC: tegra: fix I2S bit count maskStephen Warren
This register field is 11 bits wide, not 15 bits wide. Given the way this value is currently, used, this patch has no practical effect. However, it's still best if the value is correct. Signed-off-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2013-03-05Merge remote-tracking branch 'regulator/fix/twl' into tmpMark Brown
2013-03-05Merge remote-tracking branch 'regulator/fix/palmas' into tmpMark Brown
2013-03-05Merge remote-tracking branch 'regulator/fix/doc' into tmpMark Brown
2013-03-05Merge remote-tracking branch 'regulator/fix/db8500' into tmpMark Brown
2013-03-05Merge remote-tracking branch 'regulator/fix/core' into tmpMark Brown
2013-03-04Merge tag 'mxs-fixes-3.9' of git://git.linaro.org/people/shawnguo/linux-2.6 ↵Olof Johansson
into fixes From Shawn Guo: The mxs fixes for 3.9: - A few sparse warning fixes - Fix usb function regression caused by usb Kconfig option changes * tag 'mxs-fixes-3.9' of git://git.linaro.org/people/shawnguo/linux-2.6: ARM: mxs: ocotp: Fix sparse warning ARM: mxs: icoll: Fix sparse warning ARM: mxs: mm: Fix sparse warning ARM: mxs_defconfig: Make USB host functional again Signed-off-by: Olof Johansson <olof@lixom.net>
2013-03-04Merge tag 'imx-fixes-3.9' of git://git.linaro.org/people/shawnguo/linux-2.6 ↵Olof Johansson
into fixes From Shawn Guo: The imx fixes for 3.9: - move early resume code out of .data section to fix allyesconfig failure since c08e20d (arm: Add v7_invalidate_l1 to cache-v7.S) gets merged - Fix incorrect DISP1_DAT_21 number in imx53-mba53 disp1-grp1 * tag 'imx-fixes-3.9' of git://git.linaro.org/people/shawnguo/linux-2.6: ARM: dts: imx53-mba53: fix fsl,pins for disp1-grp1 ARM: mach-imx: move early resume code out of the .data section Signed-off-by: Olof Johansson <olof@lixom.net>
2013-03-04clk: Tegra: Remove duplicate smp_twd clockPrashant Gaikwad
Remove duplicate smp_twd clocks as these clocks are accessed using DT now. Signed-off-by: Prashant Gaikwad <pgaikwad@nvidia.com> Signed-off-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Olof Johansson <olof@lixom.net>
2013-03-04ARM: Tegra: Add clock entry for smp_twd clockPrashant Gaikwad
As DT support for clocks and smp_twd is enabled, add clock entry for smp_twd clock to DT. This fixes the following error while booting the kernel: smp_twd: clock not found -2 Signed-off-by: Prashant Gaikwad <pgaikwad@nvidia.com> [swarren: include kernel log spew that this fixes] Signed-off-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Olof Johansson <olof@lixom.net>
2013-03-04ARM: dts: remove generated .dtb files on cleanNishanth Menon
commit 5f300acd8ae9f3d4585154370012ffc5c665330f (ARM: 7152/1: distclean: Remove generated .dtb files) ensured that dtbs were cleaned up when they were in arch/arm/boot. However, with the following commit: commit 499cd8298628eeabf0eb5eb6525d4faa0eec80d8 (ARM: dt: change .dtb build rules to build in dts directory) make clean now leaves dtbs in arch/arm/boot/dts/ untouched. Include dts directory so that clean-files rule from arch/arm/boot/dts/Makefile is invoked when make clean is done. Cc: Dirk Behme <dirk.behme@de.bosch.com> CC: Grant Likely <grant.likely@secretlab.ca> Signed-off-by: Nishanth Menon <nm@ti.com> Signed-off-by: Olof Johansson <olof@lixom.net>
2013-03-04ARM: bcm2835: fix I2C module clock rateStephen Warren
BCM2835-ARM-Peripherals.pdf states that the I2C module's input clock is nominally 150MHz, and that value is currently reflected in bcm2835.dtsi. However, practical measurements show that the rate is actually 250MHz, and this agrees with various downstream kernels. Switch the I2C clock's frequency to 250MHz so that the generated bus clock rate is accurate. Signed-off-by: Stephen Warren <swarren@wwwdotorg.org> Signed-off-by: Olof Johansson <olof@lixom.net>
2013-03-04irqchip: fix typo when moving gic_raise_softirq()Javi Merino
In b1cffebf (ARM: GIC: remove direct use of gic_raise_softirq) gic_raise_softirq() was moved inside arch/arm/common/gic.c but in the process it reverted by mistake a change to that function made by 384a290 (ARM: gic: use a private mapping for CPU target interfaces). This breaks multicluster systems on ARM. This patch fixes the typo. Signed-off-by: Javi Merino <javi.merino@arm.com> Acked-by: Rob Herring <rob.herring@calxeda.com> Signed-off-by: Olof Johansson <olof@lixom.net>
2013-03-05hw_random: make buffer usable in scatterlist.Rusty Russell
virtio_rng feeds the randomness buffer handed by the core directly into the scatterlist, since commit bb347d98079a547e80bd4722dee1de61e4dca0e8. However, if CONFIG_HW_RANDOM=m, the static buffer isn't a linear address (at least on most archs). We could fix this in virtio_rng, but it's actually far easier to just do it in the core as virtio_rng would have to allocate a buffer every time (it doesn't know how much the core will want to read). Reported-by: Aurelien Jarno <aurelien@aurel32.net> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Cc: stable@kernel.org
2013-03-04Btrfs: allow running defrag in parallel to administrative tasksStefan Behrens
Commit 5ac00add added a testnset mutex and code that disallows running administrative tasks in parallel. It is prevented that the device add/delete/balance/replace/resize operations are started in parallel. By mistake, the defragmentation operation was included in the check for mutually exclusiveness as well. This is fixed with this commit. Signed-off-by: Stefan Behrens <sbehrens@giantdisaster.de> Signed-off-by: Josef Bacik <jbacik@fusionio.com>
2013-03-04Btrfs: avoid deadlock on transaction waiting listLiu Bo
Only let one trans handle to wait for other handles, otherwise we will get ABBA issues. Signed-off-by: Liu Bo <bo.li.liu@oracle.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com>
2013-03-04Btrfs: do not BUG_ON on aborted situationLiu Bo
Btrfs balance can easily hit BUG_ON in these places, but we want to it bail out gracefully after we force the whole filesystem to readonly. So we use btrfs_std_error hook in place of BUG_ON. Signed-off-by: Liu Bo <bo.li.liu@oracle.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com>
2013-03-04Btrfs: do not BUG_ON in prepare_to_relocLiu Bo
We can bail out from here gracefully instead of a cold BUG_ON. Signed-off-by: Liu Bo <bo.li.liu@oracle.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com>
2013-03-04Btrfs: free all recorded tree blocks on errorLiu Bo
We've missed the 'free blocks' part on ENOMEM error. Signed-off-by: Liu Bo <bo.li.liu@oracle.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com>
2013-03-04Btrfs: build up error handling for merge_reloc_rootsLiu Bo
We first use btrfs_std_error hook to replace with BUG_ON, and we also need to cleanup what is left, including reloc roots rbtree and reloc roots list. Here we use a helper function to cleanup both rbtree and list, and since this function can also be used in the balance recover path, we also make the change as well to keep code simple. Signed-off-by: Liu Bo <bo.li.liu@oracle.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com>
2013-03-04Btrfs: check for NULL pointer in updating reloc rootsLiu Bo
Add a check for NULL pointer to avoid invalid reference. Signed-off-by: Liu Bo <bo.li.liu@oracle.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com>
2013-03-04Btrfs: fix unclosed transaction handler when the async transaction ↵Miao Xie
commitment fails If the async transaction commitment failed, we need close the current transaction handler, or the current transaction will be blocked to commit because of this orphan handler. We fix the problem by doing sync transaction commitment, that is to invoke btrfs_commit_transaction(). Signed-off-by: Miao Xie <miaox@cn.fujitsu.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com>
2013-03-04Btrfs: fix wrong handle at error path of create_snapshot() when the commit failsMiao Xie
There are several bugs at error path of create_snapshot() when the transaction commitment failed. - access the freed transaction handler. At the end of the transaction commitment, the transaction handler was freed, so we should not access it after the transaction commitment. - we were not aware of the error which happened during the snapshot creation if we submitted a async transaction commitment. - pending snapshot access vs pending snapshot free. when something wrong happened after we submitted a async transaction commitment, the transaction committer would cleanup the pending snapshots and free them. But the snapshot creators were not aware of it, they would access the freed pending snapshots. This patch fixes the above problems by: - remove the dangerous code that accessed the freed handler - assign ->error if the error happens during the snapshot creation - the transaction committer doesn't free the pending snapshots, just assigns the error number and evicts them before we unblock the transaction. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Miao Xie <miaox@cn.fujitsu.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com>
2013-03-04Btrfs: use set_nlink if our i_nlink is 0Josef Bacik
We need to inc the nlink of deleted entries when running replay so we can do the unlink on the fs_root and get everything cleaned up and then have the orphan cleanup do the right thing. The problem is inc_nlink complains about this, even thought it still does the right thing. So use set_nlink() if our i_nlink is 0 to keep users from seeing the warnings during log replay. Thanks, Signed-off-by: Josef Bacik <jbacik@fusionio.com>
2013-03-04ARM: OMAP2+: Remove duplicate omap4430_init_late() declarationSantosh Shilimkar
Commit bbd707ac {ARM: omap2: use machine specific hook for late init} accidentally added two declarations for omap4430_init_late(). Remove the duplicate declaration. Cc: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com> Reviewed-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2013-03-04ARM: OMAP2+: mux: correct wrong error messagesRuslan Bilovol
This is needed because the omap_mux_get_by_name() function calls the _omap_mux_get_by_name subfunction for each mux partition until needed mux is not found. As a result, we get messages like "Could not find signal XXX" for each partition where this mux name does not exist. This patch fixes wrong error message in the _omap_mux_get_by_name() function moving it to the omap_mux_get_by_name() one and as result reduces noise in the kernel log. My kernel log without this patch: [...] [ 0.221801] omap_mux_init: Add partition: #2: wkup, flags: 3 [ 0.222045] _omap_mux_get_by_name: Could not find signal fref_clk0_out.sys_drm_msecure [ 0.222137] _omap_mux_get_by_name: Could not find signal sys_nirq [ 0.222167] _omap_mux_get_by_name: Could not find signal sys_nirq [ 0.225006] _omap_mux_get_by_name: Could not find signal uart1_rx.uart1_rx [ 0.225006] _omap_mux_get_by_name: Could not find signal uart1_rx.uart1_rx [ 0.270111] _omap_mux_get_by_name: Could not find signal fref_clk4_out.fref_clk4_out [ 0.273406] twl: not initialized [...] My kernel log with this patch: [...] [ 0.221771] omap_mux_init: Add partition: #2: wkup, flags: 3 [ 0.222106] omap_mux_get_by_name: Could not find signal sys_nirq [ 0.224945] omap_mux_get_by_name: Could not find signal uart1_rx.uart1_rx [ 0.274536] twl: not initialized [...] Signed-off-by: Ruslan Bilovol <ruslan.bilovol@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2013-03-04Merge branch 'for-john' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes
2013-03-04Merge branch 'for-john' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
2013-03-04ARM: OMAP2+: mux: fix debugfs file permissionFelipe Balbi
OMAP's debugfs interface creates one file for each signal in the mux table, such file provides a read method but didn't provide read permission. Fix it. Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2013-03-04ARM: OMAP2+: Fix unmet direct dependencies for zoom for 8250 serialTony Lindgren
We should not select drivers from kconfig as they should by default be optional. Otherwise we'll be chasing broken dependencies forever: warning: (MACH_OMAP_ZOOM2 && MACH_OMAP_ZOOM3 && MWAVE) selects SERIAL_8250 which has unmet direct dependencies (TTY && HAS_IOMEM && GENERIC_HARDIRQS) Fix the issue by removing the selects for zoom and add them to omap2plus_defconfig. Reported-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Tony Lindgren <tony@atomide.com>
2013-03-04ARM: OMAP3: board-generic: Add missing omap3_init_lateRajendra Nayak
The .init_late callback for OMAP3 has been missing for DT builds, which causes a lot of late PM initializations to be missed in turn. Signed-off-by: Rajendra Nayak <rnayak@ti.com> Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2013-03-04ARM: OMAP2+: Fix broken gpmc supportJon Hunter
Commit 6797b4fe (ARM: OMAP2+: Prevent potential crash if GPMC probe fails) added code to ensure that GPMC chip-selects could not be requested until the device probe was successful. The chip-selects should have been unreserved at the end of the probe function, but the code to unreserve them appears to have ended up in the gpmc_calc_timings() function and hence, this is causing problems requesting chip-selects. Fix this merge error by unreserving the chip-selects at the end of the probe, but before we call the gpmc child probe functions (for device-tree) which request a chip-select. Signed-off-by: Jon Hunter <jon-hunter@ti.com> Tested-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com> Tested-by: Philip Avinash <avinashphilip@ti.com> Tested-by: Grazvydas Ignotas <notasas@gmail.com> [tony@atomide.com: updated description to add breaking commit id] Signed-off-by: Tony Lindgren <tony@atomide.com>
2013-03-04ARM: OMAP1: Fix build related to kgdb.h no longer including serial_8250.hTony Lindgren
Commit 16559ae4 (kgdb: remove #include <linux/serial_8250.h> from kgdb.h) had a side effect of breaking omap1_defconfig build as some headers were included indirectly: arch/arm/mach-omap1/board-h2.c:249: error: ‘INT_KEYBOARD’ undeclared here (not in a function) ... This worked earlier as linux/serial_8250.h included linux/serial_core.h, via linux/serial_8250.h from linux/kgdb.h. Fix this by including the necessary headers directly. Signed-off-by: Tony Lindgren <tony@atomide.com>
2013-03-04tcp: fix double-counted receiver RTT when leaving receiver fast pathNeal Cardwell
We should not update ts_recent and call tcp_rcv_rtt_measure_ts() both before and after going to step5. That wastes CPU and double-counts the receiver-side RTT sample. Signed-off-by: Neal Cardwell <ncardwell@google.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-04CAIF: fix sparse warning for caif_usbSilviu-Mihai Popescu
This fixes the following sparse warning: net/caif/caif_usb.c:84:16: warning: symbol 'cfusbl_create' was not declared. Should it be static? Signed-off-by: Silviu-Mihai Popescu <silviupopescu1990@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-04rds: simplify a warning messageCong Wang
Cc: David S. Miller <davem@davemloft.net> Cc: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com> Signed-off-by: Cong Wang <amwang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-04net: fec: fix build error in no MXC platformFrank Li
build error cause by Commit ff43da86c69d76a726ffe7d1666148960dc1d108 ("NET: FEC: dynamtic check DMA desc buff type") drivers/net/ethernet/freescale/fec.c: In function ‘fec_enet_get_nextdesc’: drivers/net/ethernet/freescale/fec.c:215:18: error: invalid use of undefined type ‘struct bufdesc_ex’ drivers/net/ethernet/freescale/fec.c: In function ‘fec_enet_get_prevdesc’: drivers/net/ethernet/freescale/fec.c:224:18: error: invalid use of undefined type ‘struct bufdesc_ex’ drivers/net/ethernet/freescale/fec.c: In function ‘fec_enet_start_xmit’: drivers/net/ethernet/freescale/fec.c:286:37: error: arithmetic on pointer to an incomplete type drivers/net/ethernet/freescale/fec.c:287:13: error: arithmetic on pointer to an incomplete type drivers/net/ethernet/freescale/fec.c:324:7: error: dereferencing pointer to incomplete type etc.... Signed-off-by: Frank Li <Frank.Li@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-04net: ipv6: Don't purge default router if accept_ra=2Lorenzo Colitti
Setting net.ipv6.conf.<interface>.accept_ra=2 causes the kernel to accept RAs even when forwarding is enabled. However, enabling forwarding purges all default routes on the system, breaking connectivity until the next RA is received. Fix this by not purging default routes on interfaces that have accept_ra=2. Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-04net: fec: put tx to napi poll function to fix dead lockFrank Li
up stack ndo_start_xmit already hold lock. fec_enet_start_xmit needn't spin lock. stat_xmit just update fep->cur_tx fec_enet_tx just update fep->dirty_tx Reserve a empty bdb to check full or empty cur_tx == dirty_tx means full cur_tx == dirty_tx +1 means empty So needn't is_full variable. Fix spin lock deadlock ================================= [ INFO: inconsistent lock state ] 3.8.0-rc5+ #107 Not tainted --------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. ptp4l/615 [HC1[1]:SC0[0]:HE0:SE1] takes: (&(&list->lock)->rlock#3){?.-...}, at: [<8042c3c4>] skb_queue_tail+0x20/0x50 {HARDIRQ-ON-W} state was registered at: [<80067250>] mark_lock+0x154/0x4e8 [<800676f4>] mark_irqflags+0x110/0x1a4 [<80069208>] __lock_acquire+0x494/0x9c0 [<80069ce8>] lock_acquire+0x90/0xa4 [<80527ad0>] _raw_spin_lock_bh+0x44/0x54 [<804877e0>] first_packet_length+0x38/0x1f0 [<804879e4>] udp_poll+0x4c/0x5c [<804231f8>] sock_poll+0x24/0x28 [<800d27f0>] do_poll.isra.10+0x120/0x254 [<800d36e4>] do_sys_poll+0x15c/0x1e8 [<800d3828>] sys_poll+0x60/0xc8 [<8000e780>] ret_fast_syscall+0x0/0x3c *** DEADLOCK *** 1 lock held by ptp4l/615: #0: (&(&fep->hw_lock)->rlock){-.-...}, at: [<80355f9c>] fec_enet_tx+0x24/0x268 stack backtrace: Backtrace: [<800121e0>] (dump_backtrace+0x0/0x10c) from [<80516210>] (dump_stack+0x18/0x1c) r6:8063b1fc r5:bf38b2f8 r4:bf38b000 r3:bf38b000 [<805161f8>] (dump_stack+0x0/0x1c) from [<805189d0>] (print_usage_bug.part.34+0x164/0x1a4) [<8051886c>] (print_usage_bug.part.34+0x0/0x1a4) from [<80518a88>] (print_usage_bug+0x78/0x88) r8:80065664 r7:bf38b2f8 r6:00000002 r5:00000000 r4:bf38b000 [<80518a10>] (print_usage_bug+0x0/0x88) from [<80518b58>] (mark_lock_irq+0xc0/0x270) r7:bf38b000 r6:00000002 r5:bf38b2f8 r4:00000000 [<80518a98>] (mark_lock_irq+0x0/0x270) from [<80067270>] (mark_lock+0x174/0x4e8) [<800670fc>] (mark_lock+0x0/0x4e8) from [<80067744>] (mark_irqflags+0x160/0x1a4) [<800675e4>] (mark_irqflags+0x0/0x1a4) from [<80069208>] (__lock_acquire+0x494/0x9c0) r5:00000002 r4:bf38b2f8 [<80068d74>] (__lock_acquire+0x0/0x9c0) from [<80069ce8>] (lock_acquire+0x90/0xa4) [<80069c58>] (lock_acquire+0x0/0xa4) from [<805278d8>] (_raw_spin_lock_irqsave+0x4c/0x60) [<8052788c>] (_raw_spin_lock_irqsave+0x0/0x60) from [<8042c3c4>] (skb_queue_tail+0x20/0x50) r6:bfbb2180 r5:bf1d0190 r4:bf1d0184 [<8042c3a4>] (skb_queue_tail+0x0/0x50) from [<8042c4cc>] (sock_queue_err_skb+0xd8/0x188) r6:00000056 r5:bfbb2180 r4:bf1d0000 r3:00000000 [<8042c3f4>] (sock_queue_err_skb+0x0/0x188) from [<8042d15c>] (skb_tstamp_tx+0x70/0xa0) r6:bf0dddb0 r5:bf1d0000 r4:bfbb2180 r3:00000004 [<8042d0ec>] (skb_tstamp_tx+0x0/0xa0) from [<803561d0>] (fec_enet_tx+0x258/0x268) r6:c089d260 r5:00001c00 r4:bfbd0000 [<80355f78>] (fec_enet_tx+0x0/0x268) from [<803562cc>] (fec_enet_interrupt+0xec/0xf8) [<803561e0>] (fec_enet_interrupt+0x0/0xf8) from [<8007d5b0>] (handle_irq_event_percpu+0x54/0x1a0) [<8007d55c>] (handle_irq_event_percpu+0x0/0x1a0) from [<8007d740>] (handle_irq_event+0x44/0x64) [<8007d6fc>] (handle_irq_event+0x0/0x64) from [<80080690>] (handle_fasteoi_irq+0xc4/0x15c) r6:bf0dc000 r5:bf811290 r4:bf811240 r3:00000000 [<800805cc>] (handle_fasteoi_irq+0x0/0x15c) from [<8007ceec>] (generic_handle_irq+0x28/0x38) r5:807130c8 r4:00000096 [<8007cec4>] (generic_handle_irq+0x0/0x38) from [<8000f16c>] (handle_IRQ+0x54/0xb4) r4:8071d280 r3:00000180 [<8000f118>] (handle_IRQ+0x0/0xb4) from [<80008544>] (gic_handle_irq+0x30/0x64) r8:8000e924 r7:f4000100 r6:bf0ddef8 r5:8071c974 r4:f400010c r3:00000000 [<80008514>] (gic_handle_irq+0x0/0x64) from [<8000e2e4>] (__irq_svc+0x44/0x5c) Exception stack(0xbf0ddef8 to 0xbf0ddf40) Signed-off-by: Frank Li <Frank.Li@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-04sctp: use KMALLOC_MAX_SIZE instead of its own MAX_KMALLOC_SIZECong Wang
Don't definite its own MAX_KMALLOC_SIZE, use the one defined in mm. Cc: Vlad Yasevich <vyasevich@gmail.com> Cc: Sridhar Samudrala <sri@us.ibm.com> Cc: Neil Horman <nhorman@tuxdriver.com> Cc: David S. Miller <davem@davemloft.net> Signed-off-by: Cong Wang <amwang@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-04rds: limit the size allocated by rds_message_alloc()Cong Wang
Dave Jones reported the following bug: "When fed mangled socket data, rds will trust what userspace gives it, and tries to allocate enormous amounts of memory larger than what kmalloc can satisfy." WARNING: at mm/page_alloc.c:2393 __alloc_pages_nodemask+0xa0d/0xbe0() Hardware name: GA-MA78GM-S2H Modules linked in: vmw_vsock_vmci_transport vmw_vmci vsock fuse bnep dlci bridge 8021q garp stp mrp binfmt_misc l2tp_ppp l2tp_core rfcomm s Pid: 24652, comm: trinity-child2 Not tainted 3.8.0+ #65 Call Trace: [<ffffffff81044155>] warn_slowpath_common+0x75/0xa0 [<ffffffff8104419a>] warn_slowpath_null+0x1a/0x20 [<ffffffff811444ad>] __alloc_pages_nodemask+0xa0d/0xbe0 [<ffffffff8100a196>] ? native_sched_clock+0x26/0x90 [<ffffffff810b2128>] ? trace_hardirqs_off_caller+0x28/0xc0 [<ffffffff810b21cd>] ? trace_hardirqs_off+0xd/0x10 [<ffffffff811861f8>] alloc_pages_current+0xb8/0x180 [<ffffffff8113eaaa>] __get_free_pages+0x2a/0x80 [<ffffffff811934fe>] kmalloc_order_trace+0x3e/0x1a0 [<ffffffff81193955>] __kmalloc+0x2f5/0x3a0 [<ffffffff8104df0c>] ? local_bh_enable_ip+0x7c/0xf0 [<ffffffffa0401ab3>] rds_message_alloc+0x23/0xb0 [rds] [<ffffffffa04043a1>] rds_sendmsg+0x2b1/0x990 [rds] [<ffffffff810b21cd>] ? trace_hardirqs_off+0xd/0x10 [<ffffffff81564620>] sock_sendmsg+0xb0/0xe0 [<ffffffff810b2052>] ? get_lock_stats+0x22/0x70 [<ffffffff810b24be>] ? put_lock_stats.isra.23+0xe/0x40 [<ffffffff81567f30>] sys_sendto+0x130/0x180 [<ffffffff810b872d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff816c547b>] ? _raw_spin_unlock_irq+0x3b/0x60 [<ffffffff816cd767>] ? sysret_check+0x1b/0x56 [<ffffffff810b8695>] ? trace_hardirqs_on_caller+0x115/0x1a0 [<ffffffff81341d8e>] ? trace_hardirqs_on_thunk+0x3a/0x3f [<ffffffff816cd742>] system_call_fastpath+0x16/0x1b ---[ end trace eed6ae990d018c8b ]--- Reported-by: Dave Jones <davej@redhat.com> Cc: Dave Jones <davej@redhat.com> Cc: David S. Miller <davem@davemloft.net> Cc: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com> Signed-off-by: Cong Wang <amwang@redhat.com> Acked-by: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-04tile: properly use COMPAT_SYSCALL_DEFINExChris Metcalf
This was pointed out by Al Viro. Using the correct wrappers properly does sign extension as necessary on syscall arguments. Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
2013-03-04random: fix locking dependency with the tasklist_lockTheodore Ts'o
Commit 6133705494bb introduced a circular lock dependency because posix_cpu_timers_exit() is called by release_task(), which is holding a writer lock on tasklist_lock, and this can cause a deadlock since kill_fasync() gets called with nonblocking_pool.lock taken. There's no reason why kill_fasync() needs to be taken while the random pool is locked, so move it out to fix this locking dependency. Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Reported-by: Russ Dill <Russ.Dill@gmail.com> Cc: stable@kernel.org
2013-03-04DRM/i915: On G45 enable cursor plane briefly after enabling the display plane.Egbert Eich
On G45 some low res modes (800x600 and 1024x768) produce a blank screen when the display plane is enabled with with cursor plane off. Experiments showed that this issue occurred when the following conditions were met: a. a previous mode had the cursor plane enabled (Xserver). b. this mode or the previous one was using self refresh. (Thus the problem was only seen with low res modes). The screens lit up as soon as the cursor plane got enabled. Therefore the blank screen occurred only in console mode, not when running an Xserver. It also seemed to be necessary to disable self refresh while briefly enabling the cursor plane. Signed-off-by: Egbert Eich <eich@suse.com> Bugzilla: https://bugs.freedesktop.org/attachment.cgi?bugid=61457 Acked-by: Chris Wilson <chris@chris-wilson.co.uk> [danvet: drop spurious whitespace change.] Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-03-04tile: work around bug in the generic sys_llseekChris Metcalf
sys_llseek should specify the high and low 32-bit seek values as "unsigned int" but instead it specifies "unsigned long". Since compat syscall arguments are always sign-extended on tile, this means that a seek value of 0xffffffff will be incorrectly interpreted as a value of -1ULL. To avoid the risk of breaking binary compatibility on architectures that already use sys_llseek this way, we follow the same path as MIPS and provide a wrapper override. Signed-off-by: Chris Metcalf <cmetcalf@tilera.com> Cc: stable@kernel.org [v3.6 onwards]
2013-03-04ALSA: seq: seq_oss_event: missing range checksDan Carpenter
The "dev" variable could be out of bounds. Calling snd_seq_oss_synth_is_valid() checks that it is is a valid device which has been opened. We check this inside set_note_event() so this function can't succeed without a valid "dev". But we need to do the check earlier to prevent invalid dereferences and memory corruption. One call tree where "dev" could be out of bounds is: -> snd_seq_oss_oob_user() -> snd_seq_oss_process_event() -> extended_event() -> note_on_event() Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-03-04netfilter: nfnetlink: silence warning if CONFIG_PROVE_RCU isn't setPaul Bolle
Since commit c14b78e7decd0d1d5add6a4604feb8609fe920a9 ("netfilter: nfnetlink: add mutex per subsystem") building nefnetlink.o without CONFIG_PROVE_RCU set, triggers this GCC warning: net/netfilter/nfnetlink.c:65:22: warning: ‘nfnl_get_lock’ defined but not used [-Wunused-function] The cause of that warning is, in short, that rcu_lockdep_assert() compiles away if CONFIG_PROVE_RCU is not set. Silence this warning by open coding nfnl_get_lock() in the sole place it was called, which allows to remove that function. Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>