summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-12-04Merge tag 'davinci-fixes-for-v3.13-rc1' of ↵Olof Johansson
git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci into fixes From Sekhar Nori: This pull request contains a fixe for broken unbanked GPIO IRQ support and a fix for some random memory corruption. The bugs were introduced during v3.13 merge window. * tag 'davinci-fixes-for-v3.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci: ARM: davinci: fix number of resources passed to davinci_gpio_register() gpio: davinci: fix check for unbanked gpio
2013-12-04drm/vmwgfx: Add our connectors to sysfsThomas Hellstrom
Some user-space apps expects to find them there. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
2013-12-04drm/vmwgfx: Fix dma buffer memory size accountingThomas Hellstrom
Also request kernel ttm_buffer objects for buffer objects that obviously aren't visible to user-space, and save some device address space. The accounting was broken in a couple of ways: 1) We did not differentiate between user dma buffers and kernel dma buffers. 2) The ttm_bo_acc_size function is broken in that it a) Doesn't take into account the size of the optional dma address array, b) Doesn't take into account the fact that drivers typically embed the ttm_tt structure. This needs to be fixed in ttm, but meanwhile provide a vmwgfx-specific function to do the job. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
2013-12-04drm/vmwgfx: Fix up and comment the dumb buffer implementationThomas Hellstrom
Allocation was duplicating code. Comments were missing. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
2013-12-04drm/vmwgfx: Correctly set the enabled state on crtcsThomas Hellstrom
Failure to do this would make the drm_mode_get_crtc ioctl return without crtc mode info, indicating that no mode was set. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
2013-12-04nfs: fix do_div() warning by instead using sector_div()Helge Deller
When compiling a 32bit kernel with CONFIG_LBDAF=n the compiler complains like shown below. Fix this warning by instead using sector_div() which is provided by the kernel.h header file. fs/nfs/blocklayout/extents.c: In function ‘normalize’: include/asm-generic/div64.h:43:28: warning: comparison of distinct pointer types lacks a cast [enabled by default] fs/nfs/blocklayout/extents.c:47:13: note: in expansion of macro ‘do_div’ nfs/blocklayout/extents.c:47:2: warning: right shift count >= width of type [enabled by default] fs/nfs/blocklayout/extents.c:47:2: warning: passing argument 1 of ‘__div64_32’ from incompatible pointer type [enabled by default] include/asm-generic/div64.h:35:17: note: expected ‘uint64_t *’ but argument is of type ‘sector_t *’ extern uint32_t __div64_32(uint64_t *dividend, uint32_t divisor); Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
2013-12-04MAINTAINERS: Update contact information for Trond MyklebustTrond Myklebust
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
2013-12-04NFSv4.1: Prevent a 3-way deadlock between layoutreturn, open and state recoveryTrond Myklebust
Andy Adamson reports: The state manager is recovering expired state and recovery OPENs are being processed. If kswapd is pruning inodes at the same time, a deadlock can occur when kswapd calls evict_inode on an NFSv4.1 inode with a layout, and the resultant layoutreturn gets an error that the state mangager is to handle, causing the layoutreturn to wait on the (NFS client) cl_rpcwaitq. At the same time an open is waiting for the inode deletion to complete in __wait_on_freeing_inode. If the open is either the open called by the state manager, or an open from the same open owner that is holding the NFSv4 sequence id which causes the OPEN from the state manager to wait for the sequence id on the Seqid_waitqueue, then the state is deadlocked with kswapd. The fix is simply to have layoutreturn ignore all errors except NFS4ERR_DELAY. We already know that layouts are dropped on all server reboots, and that it has to be coded to deal with the "forgetful client model" that doesn't send layoutreturns. Reported-by: Andy Adamson <andros@netapp.com> Link: http://lkml.kernel.org/r/1385402270-14284-1-git-send-email-andros@netapp.com Signed-off-by: Trond Myklebust <Trond.Myklebust@primarydata.com>
2013-12-04ARM: highbank: handle soft poweroff and reset key eventsRob Herring
Graceful reboot and poweroff via IPMI commands to the management processor don't work. Power and reset keys are events from the management processor which are generated via IPC messages. Passing the keys to userspace does not work as neither acpid nor a desktop environment are present. This adds a notifier handler for the IPC messages so the kernel can handle the key events directly and IPMI graceful shutdown will work. Signed-off-by: Rob Herring <rob.herring@calxeda.com> Cc: stable@vger.kernel.org Signed-off-by: Olof Johansson <olof@lixom.net>
2013-12-04[media] af9035: unlock on error in af9035_i2c_master_xfer()Dan Carpenter
We introduced a couple new error paths which are missing unlocks. Fixes: 7760e148350b ('[media] af9035: Don't use dynamic static allocation') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Cc: stable@vger.kernel.org
2013-12-04[media] af9033: fix broken I2CAntti Palosaari
Driver did not work anymore since I2C has gone broken due to recent commit: commit 37ebaf6891ee81687bb558e8375c0712d8264ed8 [media] dvb-frontends: Don't use dynamic static allocation Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Cc: stable@vger.kernel.org
2013-12-04[media] v4l: omap3isp: Don't check for missing get_fmt op on remote subdevLaurent Pinchart
The remote subdev of any video node in the OMAP3 ISP is an internal subdev that is guaranteed to implement get_fmt. Don't check the return value for -ENOIOCTLCMD, as this can't happen. While at it, move non-critical code out of the mutex-protected section. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Sakari Ailus <sakari.ailus@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-12-04[media] af9035: fix broken I2C and USB I/OAntti Palosaari
There was three small buffer len calculation bugs which caused driver non-working. These are coming from recent commit: commit 7760e148350bf6df95662bc0db3734e9d991cb03 [media] af9035: Don't use dynamic static allocation Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Cc: stable@vger.kernel.org
2013-12-04Merge tag 'gpio-v3.13-3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Here are a few more GPIO patches, we're a bit noisy for being the GPIO subsystem, mostly due to the new descriptor API, but all is getting into shape. - Fix compile warnings - Fix overly talkative diagnostic messages from usual use cases wrt GPIO descriptors - Add a documentation 00-INDEX - Use platform GPIOs as fallback when ACPI or device tree is used as the primary means to get GPIO lines - A bug fix for the MPC8572/MPC8536 fixing erroneous input data" * tag 'gpio-v3.13-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpiolib: change a warning to debug message when failing to get gpio powerpc/gpio: Fix the wrong GPIO input data on MPC8572/MPC8536 gpiolib: use platform GPIO mappings as fallback Documentation: gpiolib: add 00-INDEX file gpiolib: fix lookup of platform-mapped GPIOs gpiolib: add missing declarations
2013-12-04Merge tag 'fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "Another batch of fixes for ARM SoCs for 3.13. The diffstat is large, mostly because of: - Another set of fixes to fix regressions caused by moving OMAP from board files to DT. Tony thinks this was the last major set of fixes, with maybe just a few small patches to follow. - More fixes for Marvell platforms, most dealing with misdescribed PCIe hardware, i.e. incorrect number of busses on some SoCs, etc. The line delta adds up due to various ranges moving around when this is fixed. But there's also: - Some smaller tweaks to defconfigs to make more boards bootable in my test setup for better coverage. - There are also a few other smaller fixes, a short series for at91, a couple of reverts for ux500, etc" * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (39 commits) arm: dts: socfpga: Change some clocks of gate-clk type to perip-clk arm: socfpga: Enable ARM_TWD for socfpga ARM: multi_v7_defconfig: enable SDHCI_BCM_KONA and MMC_BLOCK_MINORS=16 ARM: sunxi_defconfig: enable NFS, TMPFS, PRINTK_TIME and nfsroot support ARM: multi_v7_defconfig: enable network for BeagleBone Black ARM: dts: Fix the name of supplies for smsc911x shared by OMAP ARM: OMAP2+: Powerdomain: Fix unchecked dereference of arch_pwrdm ARM: dts: omap3-beagle: Add omap-twl4030 audio support ARM: dts: omap4-sdp: Fix pin muxing for wl12xx ARM: dts: omap4-panda-common: Fix pin muxing for wl12xx ARM: at91: fixed unresolved symbol "at91_pm_set_standby" when built without CONFIG_PM ARM: at91: add usart3 alias to dtsi ARM: at91: sama5d3: reduce TWI internal clock frequency mmc: omap: Fix I2C dependency and make driver usable with device tree mmc: omap: Fix DMA configuration to not rely on device id ARM: dts: omap3-beagle: Fix USB host on beagle boards (for 3.13) ARM: dts: omap3-igep0020: name twl4030 VPLL2 regulator as vdds_dsi ARM: dts: AM33XX IGEP0033: add USB support ARM: dts: AM33XX BASE0033: add 32KBit EEPROM support ARM: dts: AM33XX BASE0033: add pinmux and user led support ...
2013-12-04Merge branch 'parisc-3.13' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parsic updates from Helge Deller: - a fix for the mmap(MAP_FIXED|MAP_SHARED) syscall to the same address which was already given in a previous call (fixes locale-gen on debian) - change the memory layout of the kernel to avoid the need for the -mlong-calls compiler option (depends on commit 5ecbe3c3c690 - "kernel/extable: fix address-checks for core_kernel and init areas") - defconfig updates, e.g. use the SIL680 driver instead of the SIIMAGE driver - add more parisc machine names to the machine database * 'parisc-3.13' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: update 64bit defconfigs and use SIL680 instead of SIIMAGE driver parisc: remove CONFIG_MLONGCALLS=y from defconfigs parisc: fix kernel memory layout in vmlinux.ld.S parisc: use kernel_text_address() in unwind functions parisc: remove empty SERIAL_PORT_DFNS in serial.h parisc: add some more machine names to hardware database parisc: fix mmap(MAP_FIXED|MAP_SHARED) to already mmapped address
2013-12-04Merge tag 'squashfs-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-next Pull squashfs bugfix from Phillip Lougher: "Just a single bug fix to the new "directly decompress into the page cache" code" * tag 'squashfs-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-next: Squashfs: fix failure to unlock pages on decompress error
2013-12-04Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds
Pull crypto fixes from Herbert Xu: "This push fixes a number of crashes triggered by a previous crypto self-test update. It also fixes a build problem in the caam driver, as well as a concurrency issue in s390. Finally there is a pair of fixes to bugs in the crypto scatterwalk code and authenc that may lead to crashes" * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: testmgr - fix sglen in test_aead for case 'dst != src' crypto: talitos - fix aead sglen for case 'dst != src' crypto: caam - fix aead sglen for case 'dst != src' crypto: ccm - Fix handling of zero plaintext when computing mac crypto: s390 - Fix aes-xts parameter corruption crypto: talitos - corrrectly handle zero-length assoc data crypto: scatterwalk - Set the chain pointer indication bit crypto: authenc - Find proper IV address in ablkcipher callback crypto: caam - Add missing Job Ring include
2013-12-04Merge branch 'timers-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Thomas Gleixner: - timekeeping: Cure a subtle drift issue on GENERIC_TIME_VSYSCALL_OLD - nohz: Make CONFIG_NO_HZ=n and nohz=off command line option behave the same way. Fixes a long standing load accounting wreckage. - clocksource/ARM: Kconfig update to avoid ARM=n wreckage - clocksource/ARM: Fixlets for the AT91 and SH clocksource/clockevents - Trivial documentation update and kzalloc conversion from akpms pile * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: nohz: Fix another inconsistency between CONFIG_NO_HZ=n and nohz=off time: Fix 1ns/tick drift w/ GENERIC_TIME_VSYSCALL_OLD clocksource: arm_arch_timer: Hide eventstream Kconfig on non-ARM clocksource: sh_tmu: Add clk_prepare/unprepare support clocksource: sh_tmu: Release clock when sh_tmu_register() fails clocksource: sh_mtu2: Add clk_prepare/unprepare support clocksource: sh_mtu2: Release clock when sh_mtu2_register() fails ARM: at91: rm9200: switch back to clockevents_config_and_register tick: Document tick_do_timer_cpu timer: Convert kmalloc_node(...GFP_ZERO...) to kzalloc_node(...) NOHZ: Check for nohz active instead of nohz enabled
2013-12-04drm/i915: Hold mutex across i915_gem_releaseChris Wilson
Inorder to serialise the closing of the file descriptor and its subsequent release of client requests with i915_gem_free_request(), we need to hold the struct_mutex in i915_gem_release(). Failing to do so has the potential to trigger an OOPS, later with a use-after-free. Testcase: igt/gem_close_race Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70874 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=71029 Reported-by: Eric Anholt <eric@anholt.net> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-12-04ALSA: hda - Fix silent output on MacBook Air 2,1Takashi Iwai
MacBook Air 2,1 has a fairly different pin assignment from its brother MBA 1,1, and yet another quirks are needed for pin 0x18 and 0x19, similarly like what iMac 9,1 requires, in order to make the sound working on it. Reported-and-tested-by: Bruno Prémont <bonbons@linux-vserver.org> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-12-04ASoC: sam9x5_wm8731: change to work in DSP A modeBo Shen
Change sam9x5 with wm8731 work in DSP A mode, this will fix the left/right channel swap issue. Signed-off-by: Bo Shen <voice.shen@atmel.com> Tested-by: Richard Genoud <richard.genoud@gmail.com> Signed-off-by: Mark Brown <broonie@linaro.org>
2013-12-04ASoC: atmel_ssc_dai: add dai trigger opsBo Shen
According to the SSC specifiation, it should be enabled after DMA is enabled. So, add trigger operation to make sure the right sequence. Signed-off-by: Bo Shen <voice.shen@atmel.com> Tested-by: Richard Genoud <richard.genoud@gmail.com> Signed-off-by: Mark Brown <broonie@linaro.org>
2013-12-04ASoC: soc-pcm: Use valid condition for snd_soc_dai_digital_mute() in hw_free()Nicolin Chen
The snd_soc_dai_digital_mute() here will be never executed because we only decrease codec->active in snd_soc_close(). Thus correct it. Signed-off-by: Nicolin Chen <b42378@freescale.com> Signed-off-by: Mark Brown <broonie@linaro.org>
2013-12-04Merge tag 'asoc-v3.13-rc2' of ↵Takashi Iwai
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v3.13 A smattering of fixes here, some core ones for the rate combination issues for things other than simple bitmasks, for readback of byte controls and for updating the power of value muxes plus a bunch of driver fixes of varying severity. The warning fix in the i.MX FIQ driver is fixing a warning introduced by a previous fix.
2013-12-04XEN: Grant table address, xen_hvm_resume_frames, is a phys_addr not a pfnEric Trudeau
From: Eric Trudeau <etrudeau@broadcom.com> xen_hvm_resume_frames stores the physical address of the grant table. englighten.c was incorrectly setting it as if it was a page frame number. This caused the table to be mapped into the guest at an unexpected physical address. Additionally, a warning is improved to include the grant table address which failed in xen_remap. Signed-off-by: Eric Trudeau <etrudeau@broadcom.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2013-12-04ext2: Fix oops in ext2_get_block() called from ext2_quota_write()Jan Kara
ext2_quota_write() doesn't properly setup bh it passes to ext2_get_block() and thus we hit assertion BUG_ON(maxblocks == 0) in ext2_get_blocks() (or we could actually ask for mapping arbitrary number of blocks depending on whatever value was on stack). Fix ext2_quota_write() to properly fill in number of blocks to map. CC: stable@vger.kernel.org # >= 2.6.12 Reviewed-by: "Theodore Ts'o" <tytso@mit.edu> Reviewed-by: Christoph Hellwig <hch@lst.de> Reported-by: Christoph Hellwig <hch@infradead.org> Signed-off-by: Jan Kara <jack@suse.cz>
2013-12-04video: vt8500: fix error handling in probe()Dan Carpenter
We shouldn't kfree(fbi) because that was allocated with devm_kzalloc(). There were several error paths which returned directly instead of releasing resources. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2013-12-04atmel_lcdfb: fix module autoloadJohan Hovold
Add missing module device table which is needed for module autoloading. Signed-off-by: Johan Hovold <jhovold@gmail.com> Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2013-12-04ALSA: hda - Fix missing ELD info when using jackpoll_ms parameterDavid Henningsson
In the case of using jackpoll_ms instead of unsol events, the jack was correctly detected, but ELD info was not refreshed on plug-in. And without ELD info, no proper restriction of pcm, which can in turn break sound output on some devices. Signed-off-by: David Henningsson <david.henningsson@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-12-04ALSA: hda/realtek - remove hp_automute_hook from alc283_fixup_chromebookKailang Yang
I forgot to remove the hp_automute_hook from alc283_fixup_chromebook. It doesn't need this for other chrome os machine. Signed-off-by: Kailang Yang <kailang@realtek.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-12-04dma: fix build breakage in s3c24xx-dmaDan Williams
This driver missed the dma unmap conversion. Replace s3c24xx_dma_unmap_buffers with dma_descriptor_unmap. Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2013-12-04Fix pl08x warningsRussell King - ARM Linux
drivers/dma/amba-pl08x.c: In function 'pl08x_desc_free': drivers/dma/amba-pl08x.c:1173:2: warning: passing argument 1 of 'dma_descriptor_unmap' from incompatible pointer type include/linux/dmaengine.h:476:91: note: expected 'struct dma_async_tx_descriptor *' but argument is of type 'struct pl08x_txd *' Fixes: d38a8c622a1b ("dmaengine: prepare for generic 'unmap' data") Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2013-12-03ext4: check for overlapping extents in ext4_valid_extent_entries()Eryu Guan
A corrupted ext4 may have out of order leaf extents, i.e. extent: lblk 0--1023, len 1024, pblk 9217, flags: LEAF UNINIT extent: lblk 1000--2047, len 1024, pblk 10241, flags: LEAF UNINIT ^^^^ overlap with previous extent Reading such extent could hit BUG_ON() in ext4_es_cache_extent(). BUG_ON(end < lblk); The problem is that __read_extent_tree_block() tries to cache holes as well but assumes 'lblk' is greater than 'prev' and passes underflowed length to ext4_es_cache_extent(). Fix it by checking for overlapping extents in ext4_valid_extent_entries(). I hit this when fuzz testing ext4, and am able to reproduce it by modifying the on-disk extent by hand. Also add the check for (ee_block + len - 1) in ext4_valid_extent() to make sure the value is not overflow. Ran xfstests on patched ext4 and no regression. Cc: Lukáš Czerner <lczerner@redhat.com> Signed-off-by: Eryu Guan <guaneryu@gmail.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Cc: stable@vger.kernel.org
2013-12-03Btrfs: update the MAINTAINERS fileChris Mason
Josef and I have new email addresses Signed-off-by: Chris Mason <clm@fb.com> Signed-off-by: Josef Bacik <jbacik@fb.com>
2013-12-03x86-64, build: Always pass in -mno-sseH. Peter Anvin
Always pass in the -mno-sse argument, regardless if -preferred-stack-boundary is supported. We never want to generate SSE instructions in the kernel unless we *really* know what we're doing. According to H. J. Lu, any version of gcc new enough that we support it at all should handle the -mno-sse option, so just add it unconditionally. Reported-by: Kevin B. Smith <kevin.b.smith@intel.com> Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Cc: H. J. Lu <hjl.tools@gmail.com> Link: http://lkml.kernel.org/n/tip-j21wzqv790q834n7yc6g80j1@git.kernel.org Cc: <stable@vger.kernel.org> # build fix only
2013-12-03ext4: fix use-after-free in ext4_mb_new_blocksJunho Ryu
ext4_mb_put_pa should hold pa->pa_lock before accessing pa->pa_count. While ext4_mb_use_preallocated checks pa->pa_deleted first and then increments pa->count later, ext4_mb_put_pa decrements pa->pa_count before holding pa->pa_lock and then sets pa->pa_deleted. * Free sequence ext4_mb_put_pa (1): atomic_dec_and_test pa->pa_count ext4_mb_put_pa (2): lock pa->pa_lock ext4_mb_put_pa (3): check pa->pa_deleted ext4_mb_put_pa (4): set pa->pa_deleted=1 ext4_mb_put_pa (5): unlock pa->pa_lock ext4_mb_put_pa (6): remove pa from a list ext4_mb_pa_callback: free pa * Use sequence ext4_mb_use_preallocated (1): iterate over preallocation ext4_mb_use_preallocated (2): lock pa->pa_lock ext4_mb_use_preallocated (3): check pa->pa_deleted ext4_mb_use_preallocated (4): increase pa->pa_count ext4_mb_use_preallocated (5): unlock pa->pa_lock ext4_mb_release_context: access pa * Use-after-free sequence [initial status] <pa->pa_deleted = 0, pa_count = 1> ext4_mb_use_preallocated (1): iterate over preallocation ext4_mb_use_preallocated (2): lock pa->pa_lock ext4_mb_use_preallocated (3): check pa->pa_deleted ext4_mb_put_pa (1): atomic_dec_and_test pa->pa_count [pa_count decremented] <pa->pa_deleted = 0, pa_count = 0> ext4_mb_use_preallocated (4): increase pa->pa_count [pa_count incremented] <pa->pa_deleted = 0, pa_count = 1> ext4_mb_use_preallocated (5): unlock pa->pa_lock ext4_mb_put_pa (2): lock pa->pa_lock ext4_mb_put_pa (3): check pa->pa_deleted ext4_mb_put_pa (4): set pa->pa_deleted=1 [race condition!] <pa->pa_deleted = 1, pa_count = 1> ext4_mb_put_pa (5): unlock pa->pa_lock ext4_mb_put_pa (6): remove pa from a list ext4_mb_pa_callback: free pa ext4_mb_release_context: access pa AddressSanitizer has detected use-after-free in ext4_mb_new_blocks Bug report: http://goo.gl/rG1On3 Signed-off-by: Junho Ryu <jayr@google.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Cc: stable@vger.kernel.org
2013-12-03parisc: update 64bit defconfigs and use SIL680 instead of SIIMAGE driverHelge Deller
Signed-off-by: Helge Deller <deller@gmx.de>
2013-12-03arm: dts: socfpga: Change some clocks of gate-clk type to perip-clkDinh Nguyen
Some of the clocks that were designated gate-clk do not have a gate, so change those clocks to be of periph-clk type. Signed-off-by: Dinh Nguyen <dinguyen@altera.com> Signed-off-by: Olof Johansson <olof@lixom.net>
2013-12-03arm: socfpga: Enable ARM_TWD for socfpgaDinh Nguyen
Update Kconfig to enable TWD. Signed-off-by: Dinh Nguyen <dinguyen@altera.com> Reviewed-by: Pavel Machek <pavel@denx.de> Signed-off-by: Olof Johansson <olof@lixom.net>
2013-12-03drm/i915: Skip clock checks on BDWVille Syrjälä
We don't have clock state readout support for DDI, so skip the pipe config clock checks on all DDI platforms. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Damien Lespiau <damien.lespiau@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-12-03drm/i915: Do not clobber config status after a forced restore of hw stateChris Wilson
We call intel_modeset_setup_hw_state() along two paths, driver load/resume and after a lid event notification. During initialisation of the driver, it is imperative that we reset the config state. This correctly sets up the initial connector statuses and prepares the hardware for a thorough probing. However, during a lid event, we only want to undo the damage caused by the bios by resetting our last known mode. In this cirumstance, we do not want to clobber our desired state. In order to try and keep sanity between the config state and our own tracking, do the drm_mode_config_reset() first along the load/resume paths before reading out the hw state and apply any definite known corrections. v2: "As discussed on irc I don't think we should force the connector state to anything here: Imo connector->status should reflect what we believe to be the true output connection state, whereas connector->encoder reflects whether this connector is wired up to a pipe. And since we no longer reject modeset on disconnected connectors and never nuked the pipe if the connector gets disconnected there's no reason for that - such policy is userspace's job. This regression has been introduced in commit 2e9388923e83bc4e2726f170a984621f1d582e77 Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Thu Oct 11 20:08:24 2012 +0200 drm/i915/crt: explicitly set up HOTPLUG_BITS on resume" so sayeth Daniel. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: stable@vger.kernel.org (v3.8 and later) Cc: Paulo Zanoni <paulo.r.zanoni@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-12-03drm/i915: Take modeset locks around intel_modeset_setup_hw_state()Ville Syrjälä
Some lower level things get angry if we don't have modeset locks during intel_modeset_setup_hw_state(). Actually the resume and lid_notify codepaths alreday hold the locks, but the init codepath doesn't, so fix that. Note: This slipped through since we only disable pipes if the plane/pipe linking doesn't match. Which is only relevant on older gen3 mobile machines, if the BIOS fails to set up our preferred linking. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: stable@vger.kernel.org Tested-and-reported-by: Paul Bolle <pebolle@tiscali.nl> [danvet: Add note now that I could confirm my theory with the log files Paul Bolle provided.] Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-12-03Merge branch 'cxgb4'David S. Miller
Hariprasad Shenai says: ==================== Fixes T5 adapter init, due to incorrect FW version check This patch series fixes, Chelsio T5 adapter initialization failure due to incorrect firmware version check. This patch series modifies the firmware flashing mechanism for T4/T5 adapter. The patch series moves chip type from struct adapter to struct adapter_params. It changes the references of chip type in cxgb4 and cxgb4vf drivers such that build failure is avoided. Patch 3/3 is dependent on patch 1/3 Patch 2/3 is also dependent on patch 1/3 We would like to request this patch series to get merged via David Miller's 'net' tree. We have included all the maintainers of respective drivers. Kindly review the change and let us know in case of any review comments. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2013-12-03cxgb4: Add new scheme to update T4/T5 firmwareHariprasad Shenai
Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-12-03cxgb4vf: added much cleaner implementation of is_t4()Hariprasad Shenai
Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-12-03cxgb4: Much cleaner implementation of is_t4()/is_t5()Hariprasad Shenai
Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-12-03Merge tag 'iio-fixes-for-3.13b' of ↵Greg Kroah-Hartman
git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: Second round of IIO fixes for the 3.13 cycle. 2 fixes here. * The gp2ap020a00f is a simple missing kconfig dependency. * The hid sensors hub fix is a work around for an issue introduced by hardware changes due to a certain large software vendor having an 'interesting' interpretation of the specification and hence indexing some arrays from 1 rather than 0. The fix takes advantage of the logical min and max reading facilities introduced by the precursor patch to figure out whether we have a 0 indexed or 1 indexed device and to adjust appropriately. It also drops a previous kconfig option that allowed this issue to be worked around at build time.
2013-12-03blk-mq: fix dereference of rq->mq_ctx if allocation failsJeff Moyer
If __GFP_WAIT isn't set and we fail allocating, when we go to drop the reference on the ctx, we will attempt to dereference the NULL rq. Fix that. Signed-off-by: Jeff Moyer <jmoyer@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2013-12-03cpuidle: Check for dev before deregistering it.Konrad Rzeszutek Wilk
If not, we could end up in the unfortunate situation where we dereference a NULL pointer b/c we have cpuidle disabled. This is the case when booting under Xen (which uses the ACPI P/C states but disables the CPU idle driver) - and can be easily reproduced when booting with cpuidle.off=1. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff8156db4a>] cpuidle_unregister_device+0x2a/0x90 .. snip.. Call Trace: [<ffffffff813b15b4>] acpi_processor_power_exit+0x3c/0x5c [<ffffffff813af0a9>] acpi_processor_stop+0x61/0xb6 [<ffffffff814215bf>] __device_release_driver+0fffff81421653>] device_release_driver+0x23/0x30 [<ffffffff81420ed8>] bus_remove_device+0x108/0x180 [<ffffffff8141d9d9>] device_del+0x129/0x1c0 [<ffffffff813cb4b0>] ? unregister_xenbus_watch+0x1f0/0x1f0 [<ffffffff8141da8e>] device_unregister+0x1e/0x60 [<ffffffff814243e9>] unregister_cpu+0x39/0x60 [<ffffffff81019e03>] arch_unregister_cpu+0x23/0x30 [<ffffffff813c3c51>] handle_vcpu_hotplug_event+0xc1/0xe0 [<ffffffff813cb4f5>] xenwatch_thread+0x45/0x120 [<ffffffff810af010>] ? abort_exclusive_wait+0xb0/0xb0 [<ffffffff8108ec42>] kthread+0xd2/0xf0 [<ffffffff8108eb70>] ? kthread_create_on_node+0x180/0x180 [<ffffffff816ce17c>] ret_from_fork+0x7c/0xb0 [<ffffffff8108eb70>] ? kthread_create_on_node+0x180/0x180 This problem also appears in 3.12 and could be a candidate for backport. Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Cc: All applicable <stable@vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>