summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-10-16usb: misc: usb3503: Fix compile error due to incorrect regmap depedencyMatthew Dawson
The USB3503 driver had an incorrect depedency on REGMAP, instead of REGMAP_I2C. This caused the build to fail since the necessary regmap i2c pieces were not available. Signed-off-by: Matthew Dawson <matthew@mjdsystems.ca> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-10-16usb/chipidea: fix oops on memory allocation failureRussell King - ARM Linux
When CMA fails to initialize in v3.12-rc4, the chipidea driver oopses the kernel while trying to remove and put the HCD which doesn't exist: WARNING: CPU: 0 PID: 6 at /home/rmk/git/linux-rmk/arch/arm/mm/dma-mapping.c:511 __dma_alloc+0x200/0x240() coherent pool not initialised! Modules linked in: CPU: 0 PID: 6 Comm: kworker/u2:0 Tainted: G W 3.12.0-rc4+ #56 Workqueue: deferwq deferred_probe_work_func Backtrace: [<c001218c>] (dump_backtrace+0x0/0x10c) from [<c0012328>] (show_stack+0x18/0x1c) r6:c05fd9cc r5:000001ff r4:00000000 r3:df86ad00 [<c0012310>] (show_stack+0x0/0x1c) from [<c05f3a4c>] (dump_stack+0x70/0x8c) [<c05f39dc>] (dump_stack+0x0/0x8c) from [<c00230a8>] (warn_slowpath_common+0x6c/0x8c) r4:df883a60 r3:df86ad00 [<c002303c>] (warn_slowpath_common+0x0/0x8c) from [<c002316c>] (warn_slowpath_fmt+0x38/0x40) r8:ffffffff r7:00001000 r6:c083b808 r5:00000000 r4:df2efe80 [<c0023134>] (warn_slowpath_fmt+0x0/0x40) from [<c00196bc>] (__dma_alloc+0x200/0x240) r3:00000000 r2:c05fda00 [<c00194bc>] (__dma_alloc+0x0/0x240) from [<c001982c>] (arm_dma_alloc+0x88/0xa0) [<c00197a4>] (arm_dma_alloc+0x0/0xa0) from [<c03e2904>] (ehci_setup+0x1f4/0x438) [<c03e2710>] (ehci_setup+0x0/0x438) from [<c03cbd60>] (usb_add_hcd+0x18c/0x664) [<c03cbbd4>] (usb_add_hcd+0x0/0x664) from [<c03e89f4>] (host_start+0xf0/0x180) [<c03e8904>] (host_start+0x0/0x180) from [<c03e7c34>] (ci_hdrc_probe+0x360/0x670 ) r6:df2ef410 r5:00000000 r4:df2c3010 r3:c03e8904 [<c03e78d4>] (ci_hdrc_probe+0x0/0x670) from [<c0311044>] (platform_drv_probe+0x20/0x24) [<c0311024>] (platform_drv_probe+0x0/0x24) from [<c030fcac>] (driver_probe_device+0x9c/0x234) ... ---[ end trace c88ccaf3969e8422 ]--- Unable to handle kernel NULL pointer dereference at virtual address 00000028 pgd = c0004000 [00000028] *pgd=00000000 Internal error: Oops: 17 [#1] SMP ARM Modules linked in: CPU: 0 PID: 6 Comm: kworker/u2:0 Tainted: G W 3.12.0-rc4+ #56 Workqueue: deferwq deferred_probe_work_func task: df86ad00 ti: df882000 task.ti: df882000 PC is at usb_remove_hcd+0x10/0x150 LR is at host_stop+0x1c/0x3c pc : [<c03cacec>] lr : [<c03e88e4>] psr: 60000013 sp : df883b50 ip : df883b78 fp : df883b74 r10: c11f4c54 r9 : c0836450 r8 : df30c400 r7 : fffffff4 r6 : df2ef410 r5 : 00000000 r4 : df2c3010 r3 : 00000000 r2 : 00000000 r1 : df86b0a0 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel Control: 10c53c7d Table: 2f29404a DAC: 00000015 Process kworker/u2:0 (pid: 6, stack limit = 0xdf882240) Stack: (0xdf883b50 to 0xdf884000) ... Backtrace: [<c03cacdc>] (usb_remove_hcd+0x0/0x150) from [<c03e88e4>] (host_stop+0x1c/0x3c) r6:df2ef410 r5:00000000 r4:df2c3010 [<c03e88c8>] (host_stop+0x0/0x3c) from [<c03e8aa0>] (ci_hdrc_host_destroy+0x1c/0x20) r5:00000000 r4:df2c3010 [<c03e8a84>] (ci_hdrc_host_destroy+0x0/0x20) from [<c03e7c80>] (ci_hdrc_probe+0x3ac/0x670) [<c03e78d4>] (ci_hdrc_probe+0x0/0x670) from [<c0311044>] (platform_drv_probe+0x20/0x24) [<c0311024>] (platform_drv_probe+0x0/0x24) from [<c030fcac>] (driver_probe_device+0x9c/0x234) [<c030fc10>] (driver_probe_device+0x0/0x234) from [<c030ff28>] (__device_attach+0x44/0x48) ... ---[ end trace c88ccaf3969e8423 ]--- Fix this so at least we can continue booting and get to a shell prompt. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Tested-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-10-16target: Return an error for WRITE SAME with ANCHOR==1Roland Dreier
Per SBC-3, since we report ANC_SUP==0 in VPD page B2h, we need to return an error (ILLEGAL REQUEST/INVALID FIELD IN CDB) for all WRITE SAME requests with ANCHOR==1. Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-10-16usb-storage: add quirk for mandatory READ_CAPACITY_16Oliver Neukum
Some USB drive enclosures do not correctly report an overflow condition if they hold a drive with a capacity over 2TB and are confronted with a READ_CAPACITY_10. They answer with their capacity modulo 2TB. The generic layer cannot cope with that. It must be told to use READ_CAPACITY_16 from the beginning. Signed-off-by: Oliver Neukum <oneukum@suse.de> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-10-16usb: serial: option: blacklist Olivetti Olicard200Enrico Mioso
Interface 6 of this device speaks QMI as per tests done by us. Credits go to Antonella for providing the hardware. Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com> Signed-off-by: Antonella Pellizzari <anto.pellizzari83@gmail.com> Tested-by: Dan Williams <dcbw@redhat.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-10-16serial: vt8500: add missing bracesRoel Kluin
Due to missing braces on an if statement, in presence of a device_node a port was always assigned -1, regardless of any alias entries in the device tree. Conversely, if device_node was NULL, an unitialized port ended up being used. This patch adds the missing braces, fixing the issues. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Acked-by: Tony Prisk <linux@prisktech.co.nz> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-10-16xtensa: Cocci spatch "noderef"Thomas Meyer
sizeof when applied to a pointer typed expression gives the size of the pointer. Found by coccinelle spatch "misc/noderef.cocci" Signed-off-by: Thomas Meyer <thomas@m3y3r.de> Signed-off-by: Chris Zankel <chris@zankel.net>
2013-10-16USB: quirks: add touchscreen that is dazzeled by remote wakeupOliver Neukum
The device descriptors are messed up after remote wakeup Signed-off-by: Oliver Neukum <oneukum@suse.de> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-10-16Bluetooth: Expose inquiry_cache debugfs only on BR/EDR controllersMarcel Holtmann
The inquiry_cache debugfs entry is only valid for BR/EDR capable controllers. In case of single mode LE-only controllers that entry is not valid. Move the creating of the debugfs entries to the end of controller init and only create the inquiry_cache entry if BR/EDR is actually supported. At the same time this avoids creating any debugfs entries for AMP controllers since none of the entries are valid there. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-16Bluetooth: Socket address parameter for CID is in little endianMarcel Holtmann
The L2CAP socket parameter for CID are actually provided in little endian. So convert our constants into little endian before comparing them. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-16Bluetooth: Convert idle timer to use delayed workJohan Hedberg
There is no need to use a timer since the entire Bluetooth subsystem runs using workqueues these days. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-16Bluetooth: Convert auto accept timer to use delayed workJohan Hedberg
Since the entire Bluetooth subsystem runs in workqueues these days there is no need to use a timer for deferring work. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-16Bluetooth: Reintroduce socket restrictions for LE socketsJohan Hedberg
Right now we do not allow user space to use connection oriented channels on LE, and the only CID that can be used is the Attribute Protocol one. These restrictions went away together with the recent refactoring of the L2CAP code, but this patch puts them back to their appropriate places. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-16Bluetooth: Fix updating the right variable in update_scan_rsp_data()Johan Hedberg
This function should be operating on scan_rsp_data_len and scan_rsp_data and not the advertising data variables. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-16[SCSI] BusLogic: Fix an oops when intializing multimaster adapterKhalid Aziz
This fixes an oops caused by buslogic driver when initializing a BusLogic MultiMaster adapter. Initialization code used scope of a variable incorrectly which created a NULL pointer. Oops message is below: BUG: unable to handle kernel NULL pointer dereference at 0000000c IP: [<c150c137>] blogic_init_mm_probeinfo.isra.17+0x20a/0x583 *pde = 00000000 Oops: 002 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.11.1.puz1 #1 Hardware name: /Canterwood, BIOS 6.00 PG 05/16/2003 task: f7050000 ti: f7054000 task.ti: f7054000 EIP: 0060:[<c150c137>] EFLAGS: 00010246 CPU:1 EIP is at blogic_init_mm_probeinfo.isra.17+0x20a/0x583 EAX: 00000013 EBX: 00000000 ECX: 00000000 EDX: f8001000 ESI: f71cb800 EDI: f7388000 EBP: 00007800 ESP: f7055c84 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 CR0: 8005003b CR2: 0000000c CR3: 0154f000 CR4: 000007d0 Stack: 0000001c 00000000 c11a59f6 f7055c98 00008130 ffffffff ffffffff 00000000 00000003 00000000 00000000 00000000 00000013 f8001000 00000001 000003d0 00000000 00000000 00000000 c14e3f84 f78803c8 00000000 f738c000 000000e9 Call Trace: [<c11a59f6>] ? pci_get_subsys+0x33/0x38 [<c150c4fb>] ? blogic_init_probeinfo_list+0x4b/0x19e [<c108d593>] ? __alloc_pages_nodemask+0xe3/0x623 [<c108d593>] ? __alloc_pages_nodemask+0xe3/0x623 [<c10fb99e>] ? sysfs_link_sibling+0x61/0x8d [<c10b0519>] ? kmem_cache_alloc+0x8b/0xb5 [<c150cce5>] ? blogic_init+0xa1/0x10e8 [<c10fc0a8>] ? sysfs_add_one+0x10/0x9d [<c10fc18a>] ? sysfs_addrm_finish+0x12/0x85 [<c10fca37>] ? sysfs_do_create_link_sd+0x9d/0x1b4 [<c117c272>] ? blk_register_queue+0x69/0xb3 [<c10fcb68>] ? sysfs_create_link+0x1a/0x2c [<c1181a07>] ? add_disk+0x1a1/0x3c7 [<c138737b>] ? klist_next+0x60/0xc3 [<c122cc3a>] ? scsi_dh_detach+0x68/0x68 [<c1213e36>] ? bus_for_each_dev+0x51/0x61 [<c1000356>] ? do_one_initcall+0x22/0x12c [<c10f3688>] ? __proc_create+0x8c/0xba [<c150cc44>] ? blogic_setup+0x5f6/0x5f6 [<c14e94aa>] ? repair_env_string+0xf/0x4d [<c14e949b>] ? do_early_param+0x71/0x71 [<c103efaa>] ? parse_args+0x21f/0x33d [<c14e9a54>] ? kernel_init_freeable+0xdf/0x17d [<c14e949b>] ? do_early_param+0x71/0x71 [<c1388b64>] ? kernel_init+0x8/0xc0 [<c1392222>] ? ret_from_kernel_thread+0x6/0x28 [<c1392227>] ? ret_from_kernel_thread+0x1b/0x28 [<c1388b5c>] ? rest_init+0x6c/0x6c Code: 89 44 24 10 0f b6 44 24 3d 89 44 24 0c c7 44 24 08 00 00 00 00 c7 44 24 04 38 62 46 c1 c7 04 24 02 00 00 00 e8 78 13 d2 ff 31 db <89> 6b 0c b0 20 89 ea ee c7 44 24 08 04 00 00 00 8d 44 24 4c 89 EIP: [<c150c137>] blogic_init_mm_probeinfo.isra.17+0x20a/0x583 SS:ESP 0068:f7055c84 CR2: 000000000000000c ---[ end trace 17f45f5196d40487 ]--- Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com> Cc: <stable@vger.kernel.org> # 3.11.x Reported-by: Pierre Uszynski <pierre@rahul.net> Tested-by: Pierre Uszynski <pierre@rahul.net> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-10-16ath10k: add might_sleep() to ath10k_wmi_cmd_send()Kalle Valo
ath10k_wmi_cmd_send() will now sleep if there are no credits available. To make it easier to catch callers in atomic context add might_sleep() to the function. Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2013-10-16ath10k: fix ath10k_bss_assoc() to not sleep in atomic contextKalle Valo
ath10k_bss_assoc() was calling ath10k_peer_assoc(), which can sleep, under atomic rcu_read_lock() and causing scheduing while atomic errors. Workaround that by delaying the call to ath10k_wmi_peer_assoc(). Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2013-10-16ath10k: remove unnecessary checksMichal Kazior
mac80211 interface iteration functions that were used originally iterated over interfaces that weren't re-added to the driver during recovery. Since internal vif list is now used it's safe to remove the safe-guard as internal vif list is based on add/remove_interface function which guarantees that vdev is created in FW before it is iterated over. Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2013-10-16ath10k: fix scheduling while atomic config bugMichal Kazior
Recent HTC/WMI changes introduced the bug. ath10k was using _atomic iteration function with sleepable functions. mac80211 provides another iteration function but it cannot be safely called in hw_config() callback due to local->iflist_mtx being possibly acquired already. The patch uses internal vif list for iteration purposes and removes/refactors no longer necessary _iter functions. Reported-By: Kalle Valo <kvalo@qca.qualcomm.com> Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2013-10-16ath10k: track vif list internallyMichal Kazior
mac80211 interface interations functions have peculiar locking issues. This patch introduces internal (to ath10k) vif list that will be used for vif iteration purposes. kvalo: remove extra INIT_LIST_HEAD() Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2013-10-16ath10k: fix add_interface failure handlingMichal Kazior
If something failed along add_interface() setup it was possible to leak a vdev id, vdev and peer. This could end up with leaked FW state or FW crash (assuming add_interface() failure wasn't a result of a crash). kvalo: rebased, whitespace fixes Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2013-10-16ath10k: use workqueue to set WEP TX keyMichal Kazior
Recent WMI/HTC changes made it possible for WMI commands to sleep (if there's not enough HTC TX credits to submit a command). TX path is in an atomic context so calling WMI commands in it is wrong. This simply moves WEP key index update to a worker and fixes the 'scheduling while atomic' bug. This still leaves multiple WEP key handling laggy, i.e. some frames may be TXed with an old/different key (although recipient should still be able to RX them). kvalo: changed the title Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2013-10-16Bluetooth: Remove enable_hs declarationMarcel Holtmann
This seems to be a left-over. The module parameter enable_hs has been removed, but its extern declaration is still present. It is not needed anymore, so just remove it. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-16ALSA: hdsp - info leak in snd_hdsp_hwdep_ioctl()Dan Carpenter
In GCC the sizeof(hdsp_version) is 8 because there is a 2 byte hole at the end of the struct after ->firmware_rev. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-10-16ath10k: return better errno for unsupported pdev paramsBartosz Markowski
Return -EOPNOTSUPP if given parameter is not supported by firmware. Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2013-10-16ath10k: rename WMI_CMD_UNDEFINEDBartosz Markowski
Rename WMI_CMD_UNDEFINED to WMI_CMD_UNSUPPORTED. This is more accurate here. Also return -EOPNOTSUPP instead of -EINVAL in wmi_cmd_send(). Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2013-10-16ath10k: do not warn about unsupported vdev paramBartosz Markowski
10.X firmware does not support WMI_VDEV_PARAM_TX_ENCAP_TYPE. It's a known limitation and we should not warn about this. Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2013-10-16Bluetooth: Ignore SMP data on non-LE linksJohan Hedberg
The SMP CID is only defined for LE transports. Instead of returning an error from smp_sig_channel() in this case (which would cause a disconnection) just return 0 to ignore the data, which is consistent with the behavior for other unknown CIDs. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-16Bluetooth: Ignore A2MP data on non-BR/EDR linksJohan Hedberg
The A2MP CID is only valid for BR/EDR transports. We should ignore A2MP data on non-BR/EDR links and refuse to create an amp_mgr object. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-16Bluetooth: Remove useless l2cap_err_to_reason functionJohan Hedberg
Now that the only reason code this function can return is L2CAP_REJ_NOT_UNDERSTOOD we can just do the necessary assignment without needing a separate function at all. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-16Bluetooth: Remove unused command reject mapping for EMSGSIZEJohan Hedberg
There is no command handler that would return an EMSGSIZE error, so just remove this mapping from the l2cap_err_to_reason function. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-16Bluetooth: Fix L2CAP "Command Reject: Invalid CID" responseJohan Hedberg
When the reason code in the L2CAP command reject is "invalid CID" there should be four additional bytes of data in the PDU, namely the source and destination CIDs (which should be zero if one or both are not applicable). This patch fixes all occurrences of such errors to return the right kind of PDU. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-16Bluetooth: Remove duplicate definitions for advertising event typesMarcel Holtmann
The constants for advertising event types have been defined twice. So remove one copy of it. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-16Bluetooth: Rename update_ad into update_adv_dataMarcel Holtmann
Since there is update_scan_rsp_data, it is also better to use the clear name update_adv_data instead of update_ad. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-16Bluetooth: Store device name in scan response dataMarcel Holtmann
The scan response data is a better place to store the device name since it has more space available and is also enforcing privacy. When the controller is advertising, the connectable setting decides if ADV_IND or ADV_NONCONN_IND is used. In case of ADV_IND, the remote side is allowed to request the scan response data. Same as with BR/EDR where either EIR is used or a remote name request. In non-connectable mode, the device name is not available since it is not allowed to request scan response data. Same as in BR/EDR where the device is non-discoverable and no name requests are answered. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-16Bluetooth: Set the scan response data when neededMarcel Holtmann
On controller power on and when enabling LE functionality, make sure that also the scan response data is correctly set. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-16Bluetooth: Store scan response data in HCI deviceMarcel Holtmann
The scan response data needs to be stored in HCI device and so add a buffer for it and also ensure to clear it when resetting the controller. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-16Bluetooth: Rename create_ad into create_adv_dataMarcel Holtmann
Rename the create_ad function into create_adv_data to make it clear that it is used to create the advertising data. This is important since later on a function adding the scan response data will be added. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-15Input: wacom - export battery scopeBastien Nocera
This will stop UPower from detecting the tablet as a power supply, and using its battery status to hibernate or switch off the machine. https://bugs.freedesktop.org/show_bug.cgi?id=70321 Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2013-10-16dm snapshot: fix data corruptionMikulas Patocka
This patch fixes a particular type of data corruption that has been encountered when loading a snapshot's metadata from disk. When we allocate a new chunk in persistent_prepare, we increment ps->next_free and we make sure that it doesn't point to a metadata area by further incrementing it if necessary. When we load metadata from disk on device activation, ps->next_free is positioned after the last used data chunk. However, if this last used data chunk is followed by a metadata area, ps->next_free is positioned erroneously to the metadata area. A newly-allocated chunk is placed at the same location as the metadata area, resulting in data or metadata corruption. This patch changes the code so that ps->next_free skips the metadata area when metadata are loaded in function read_exceptions. The patch also moves a piece of code from persistent_prepare_exception to a separate function skip_metadata to avoid code duplication. CVE-2013-4299 Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Cc: stable@vger.kernel.org Cc: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2013-10-16apparmor: fix bad lock balance when introspecting policyJohn Johansen
BugLink: http://bugs.launchpad.net/bugs/1235977 The profile introspection seq file has a locking bug when policy is viewed from a virtual root (task in a policy namespace), introspection from the real root is not affected. The test for root while (parent) { is correct for the real root, but incorrect for tasks in a policy namespace. This allows the task to walk backup the policy tree past its virtual root causing it to be unlocked before the virtual root should be in the p_stop fn. This results in the following lockdep back trace: [ 78.479744] [ BUG: bad unlock balance detected! ] [ 78.479792] 3.11.0-11-generic #17 Not tainted [ 78.479838] ------------------------------------- [ 78.479885] grep/2223 is trying to release lock (&ns->lock) at: [ 78.479952] [<ffffffff817bf3be>] mutex_unlock+0xe/0x10 [ 78.480002] but there are no more locks to release! [ 78.480037] [ 78.480037] other info that might help us debug this: [ 78.480037] 1 lock held by grep/2223: [ 78.480037] #0: (&p->lock){+.+.+.}, at: [<ffffffff812111bd>] seq_read+0x3d/0x3d0 [ 78.480037] [ 78.480037] stack backtrace: [ 78.480037] CPU: 0 PID: 2223 Comm: grep Not tainted 3.11.0-11-generic #17 [ 78.480037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 78.480037] ffffffff817bf3be ffff880007763d60 ffffffff817b97ef ffff8800189d2190 [ 78.480037] ffff880007763d88 ffffffff810e1c6e ffff88001f044730 ffff8800189d2190 [ 78.480037] ffffffff817bf3be ffff880007763e00 ffffffff810e5bd6 0000000724fe56b7 [ 78.480037] Call Trace: [ 78.480037] [<ffffffff817bf3be>] ? mutex_unlock+0xe/0x10 [ 78.480037] [<ffffffff817b97ef>] dump_stack+0x54/0x74 [ 78.480037] [<ffffffff810e1c6e>] print_unlock_imbalance_bug+0xee/0x100 [ 78.480037] [<ffffffff817bf3be>] ? mutex_unlock+0xe/0x10 [ 78.480037] [<ffffffff810e5bd6>] lock_release_non_nested+0x226/0x300 [ 78.480037] [<ffffffff817bf2fe>] ? __mutex_unlock_slowpath+0xce/0x180 [ 78.480037] [<ffffffff817bf3be>] ? mutex_unlock+0xe/0x10 [ 78.480037] [<ffffffff810e5d5c>] lock_release+0xac/0x310 [ 78.480037] [<ffffffff817bf2b3>] __mutex_unlock_slowpath+0x83/0x180 [ 78.480037] [<ffffffff817bf3be>] mutex_unlock+0xe/0x10 [ 78.480037] [<ffffffff81376c91>] p_stop+0x51/0x90 [ 78.480037] [<ffffffff81211408>] seq_read+0x288/0x3d0 [ 78.480037] [<ffffffff811e9d9e>] vfs_read+0x9e/0x170 [ 78.480037] [<ffffffff811ea8cc>] SyS_read+0x4c/0xa0 [ 78.480037] [<ffffffff817ccc9d>] system_call_fastpath+0x1a/0x1f Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
2013-10-16apparmor: fix memleak of the profile hashJohn Johansen
BugLink: http://bugs.launchpad.net/bugs/1235523 This fixes the following kmemleak trace: unreferenced object 0xffff8801e8c35680 (size 32): comm "apparmor_parser", pid 691, jiffies 4294895667 (age 13230.876s) hex dump (first 32 bytes): e0 d3 4e b5 ac 6d f4 ed 3f cb ee 48 1c fd 40 cf ..N..m..?..H..@. 5b cc e9 93 00 00 00 00 00 00 00 00 00 00 00 00 [............... backtrace: [<ffffffff817a97ee>] kmemleak_alloc+0x4e/0xb0 [<ffffffff811ca9f3>] __kmalloc+0x103/0x290 [<ffffffff8138acbc>] aa_calc_profile_hash+0x6c/0x150 [<ffffffff8138074d>] aa_unpack+0x39d/0xd50 [<ffffffff8137eced>] aa_replace_profiles+0x3d/0xd80 [<ffffffff81376937>] profile_replace+0x37/0x50 [<ffffffff811e9f2d>] vfs_write+0xbd/0x1e0 [<ffffffff811ea96c>] SyS_write+0x4c/0xa0 [<ffffffff817ccb1d>] system_call_fastpath+0x1a/0x1f [<ffffffffffffffff>] 0xffffffffffffffff Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
2013-10-15Merge tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linuxLinus Torvalds
Pull device tree fixes and reverts from Grant Likely: "One bug fix and three reverts. The reverts back out the slightly controversial feeding the entire device tree into the random pool and the reserved-memory binding which isn't fully baked yet. Expect the reserved-memory patches at least to resurface for v3.13. The bug fixes removes a scary but harmless warning on SPARC that was introduced in the v3.12 merge window. v3.13 will contain a proper fix that makes the new code work on SPARC. On the plus side, the diffstat looks *awesome*. I love removing lines of code" * tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux: Revert "drivers: of: add initialization code for dma reserved memory" Revert "ARM: init: add support for reserved memory defined by device tree" Revert "of: Feed entire flattened device tree into the random pool" of: fix unnecessary warning on missing /cpus node
2013-10-15Merge branch 'fixes-for-v3.12' of ↵Linus Torvalds
git://git.linaro.org/people/mszyprowski/linux-dma-mapping Pull DMA-mapping fix from Marek Szyprowski: "A bugfix for the IOMMU-based implementation of dma-mapping subsystem for ARM architecture" * 'fixes-for-v3.12' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping: ARM: dma-mapping: Always pass proper prot flags to iommu_map()
2013-10-15Bluetooth: Make mgmt_new_ltk() return voidMarcel Holtmann
The return value of mgmt_new_ltk() function is not used and so just change it to return void. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-10-15Bluetooth: Make mgmt_read_local_oob_data_reply_complete() return voidMarcel Holtmann
The return value of mgmt_read_local_oob_data_reply_complete() function is not used and so just change it to return void. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-10-15Bluetooth: Make mgmt_set_local_name_complete() return voidMarcel Holtmann
The return value of mgmt_set_local_name_complete() function is not used and so just change it to return void. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-10-15Bluetooth: Make mgmt_set_class_of_dev_complete() return voidMarcel Holtmann
The return value of mgmt_set_class_of_dev_complete() function is not used and so just change it to return void. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-10-15Bluetooth: Make mgmt_ssp_enable_complete() return voidMarcel Holtmann
The return value of mgmt_ssp_enable_complete() function is not used and so just change it to return void. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-10-15Bluetooth: Make mgmt_auth_enable_complete() return voidMarcel Holtmann
The return value of mgmt_auth_enable_complete() function is not used and so just change it to return void. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>