30 Sep, 2013

6 commits

  • Pull USB fixes from Greg KH:
    "Here are a number of USB driver fixes for 3.12-rc3.

    These are all for host controller issues that have been reported, and
    there's a fix for an annoying error message that gets printed every
    time you remove a USB 3 device from the system that's been bugging me
    for a while"

    * tag 'usb-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
    usb: dwc3: add support for Merrifield
    USB: fsl/ehci: fix failure of checking PHY_CLK_VALID during reinitialization
    USB: Fix breakage in ffs_fs_mount()
    fsl/usb: Resolve PHY_CLK_VLD instability issue for ULPI phy
    usb/core/devio.c: Don't reject control message to endpoint with wrong direction bit
    usb: chipidea: USB_CHIPIDEA should depend on HAS_DMA
    usb: chipidea: udc: free pending TD at removal procedure
    usb: chipidea: imx: Add usb_phy_shutdown at probe's error path
    usb: chipidea: Fix memleak for ci->hw_bank.regmap when removal
    usb: chipidea: udc: fix the oops after rmmod gadget
    USB: fix PM config symbol in uhci-hcd, ehci-hcd, and xhci-hcd
    USB: OHCI: accept very late isochronous URBs
    USB: UHCI: accept very late isochronous URBs
    USB: iMX21: accept very late isochronous URBs
    usbcore: check usb device's state before sending a Set SEL control transfer
    xhci: Fix race between ep halt and URB cancellation
    usb: Fix xHCI host issues on remote wakeup.
    xhci: Ensure a command structure points to the correct trb on the command ring
    xhci: Fix oops happening after address device timeout

    Linus Torvalds
     
  • Pull tty/serial fixes from Greg KH:
    "Here are some serial at tty driver fixes for 3.12-rc3

    The serial driver fixes some kref leaks, documentation is moved to the
    proper places, and the tty and n_tty fixes resolve some reported
    regressions. There is still one outstanding tty regression fix that
    isn't in here yet, as I want to test it out some more, it will be sent
    for 3.12-rc4 if it checks out"

    * tag 'tty-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
    tty: ar933x_uart: move devicetree binding documentation
    tty: Fix SIGTTOU not sent with tcflush()
    n_tty: Fix EOF push index when termios changes
    serial: pch_uart: remove unnecessary tty_port_tty_get
    serial: pch_uart: fix tty-kref leak in dma-rx path
    serial: pch_uart: fix tty-kref leak in rx-error path
    serial: tegra: fix tty-kref leak

    Linus Torvalds
     
  • Pull staging fixes from Greg KH:
    "Here are some staging driver fixes, MAINTAINER updates, and a new
    device id. All of these have been in the linux-next tree, and are
    pretty simple patches"

    * tag 'staging-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
    staging: r8188eu: Add new device ID
    staging: imx-drm: Fix probe failure
    staging: vt6656: [BUG] iwctl_siwencodeext return if device not open
    staging: vt6656: [BUG] main_usb.c oops on device_close move flag earlier.
    staging: vt6656: rxtx.c [BUG] s_vGetFreeContext dead lock on null apTD.
    Staging: rtl8192u: r819xU_cmdpkt: checking NULL value after doing dev_alloc_skb
    staging: usbip: Orphan usbip
    staging: r8188eu: Add files for new drive: Cocci spatch "noderef"
    staging: r8188eu: Cocci spatch "noderef"
    staging: octeon-usb: Cocci spatch "noderef"
    staging: r8188eu: Add files for new drive: Cocci spatch "noderef"
    MAINTAINERS: staging: dgnc and dgap drivers: add maintainer
    staging: lustre: Cocci spatch "noderef"

    Linus Torvalds
     
  • Pull driver core / sysfs fixes from Greg KH:
    "Here are 2 fixes for 3.12-rc3. One fixes a sysfs problem with
    mounting caused by 3.12-rc1, and the other is a bug reported by the
    chromeos developers with the driver core.

    Both have been in linux-next for a bit"

    * tag 'driver-core-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
    driver core : Fix use after free of dev->parent in device_shutdown
    sysfs: Allow mounting without CONFIG_NET

    Linus Torvalds
     
  • Pull char/misc driver fixes from Greg KH:
    "Here are some HyperV and MEI driver fixes for 3.12-rc3. They resolve
    some issues that people have been reporting for them"

    * tag 'char-misc-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
    Drivers: hv: vmbus: Terminate vmbus version negotiation on timeout
    Drivers: hv: util: Correctly support ws2008R2 and earlier
    mei: cancel stall timers in mei_reset
    mei: bus: stop wait for read during cl state transition
    mei: make me client counters less error prone

    Linus Torvalds
     
  • Pull drm fixes from Dave Airlie:
    "Nothing too major, radeon still has some dpm changes for off by
    default.

    Radeon, intel, msm:
    - radeon: a few more dpm fixes (still off by default), uvd fixes
    - i915: runtime warn backtrace and regression fix
    - msm: iommu changes fallout"

    * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (27 commits)
    drm/msm: use drm_gem_dumb_destroy helper
    drm/msm: deal with mach/iommu.h removal
    drm/msm: Remove iommu include from mdp4_kms.c
    drm/msm: Odd PTR_ERR usage
    drm/i915: Fix up usage of SHRINK_STOP
    drm/radeon: fix hdmi audio on DCE3.0/3.1 asics
    drm/i915: preserve pipe A quirk in i9xx_set_pipeconf
    drm/i915/tv: clear adjusted_mode.flags
    drm/i915/dp: increase i2c-over-aux retry interval on AUX DEFER
    drm/radeon/cik: fix overflow in vram fetch
    drm/radeon: add missing hdmi callbacks for rv6xx
    drm/i915: Use a temporary va_list for two-pass string handling
    drm/radeon/uvd: lower msg&fb buffer requirements on UVD3
    drm/radeon: disable tests/benchmarks if accel is disabled
    drm/radeon: don't set default clocks for SI when DPM is disabled
    drm/radeon/dpm/ci: filter clocks based on voltage/clk dep tables
    drm/radeon/dpm/si: filter clocks based on voltage/clk dep tables
    drm/radeon/dpm/ni: filter clocks based on voltage/clk dep tables
    drm/radeon/dpm/btc: filter clocks based on voltage/clk dep tables
    drm/radeon/dpm: fetch the max clk from voltage dep tables helper
    ...

    Linus Torvalds
     

29 Sep, 2013

5 commits

  • A small fix + deal with fallout of iommu changes + use new
    drm_gem_dumb_destroy helper.

    * 'msm-fixes-3.12-rc2' of git://people.freedesktop.org/~robclark/linux:
    drm/msm: use drm_gem_dumb_destroy helper
    drm/msm: deal with mach/iommu.h removal
    drm/msm: Remove iommu include from mdp4_kms.c
    drm/msm: Odd PTR_ERR usage

    Dave Airlie
     
  • …nt-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

    Pull scheduler, timer and x86 fixes from Ingo Molnar:
    - A context tracking ARM build and functional fix
    - A handful of ARM clocksource/clockevent driver fixes
    - An AMD microcode patch level sysfs reporting fixlet

    * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    arm: Fix build error with context tracking calls

    * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    clocksource: em_sti: Set cpu_possible_mask to fix SMP broadcast
    clocksource: of: Respect device tree node status
    clocksource: exynos_mct: Set IRQ affinity when the CPU goes online
    arm: clocksource: mvebu: Use the main timer as clock source from DT

    * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/microcode/AMD: Fix patch level reporting for family 15h

    Linus Torvalds
     
  • Pull i2c fixes from Wolfram Sang:
    "Some driver bugfixes for the I2C subsystem"

    * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
    i2c: ismt: initialize DMA buffer
    i2c: designware: 10-bit addressing mode enabling if I2C_DYNAMIC_TAR_UPDATE is set
    i2c: mv64xxx: Do not use writel_relaxed()
    i2c: mv64xxx: Fix some build warnings
    i2c: s3c2410: fix clk_disable/clk_unprepare WARNings

    Linus Torvalds
     
  • Pull ACPI and power management fixes from Rafael Wysocki:
    "These fix one recent cpufreq regression, a few older bugs that may
    harm users and a kerneldoc typo.

    Specifics:

    1) After the recent locking changes in the cpufreq core it is
    possible to trigger BUG_ON(!policy) in lock_policy_rwsem_read() if
    cpufreq_get() is called before registering a cpufreq driver. Fix
    from Viresh Kumar.

    2) If intel_pstate has been loaded already, it doesn't make sense to
    do anything in acpi_cpufreq_init() and moreover doing something in
    there in that case may be harmful, so make that function return
    immediately if another cpufreq driver is already present. From
    Yinghai Lu.

    3) The ACPI IPMI driver sometimes attempts to acquire a mutex from
    interrupt context, which can be avoided by replacing that mutex
    with a spinlock. From Lv Zheng.

    4) A NULL pointer may be dereferenced by the exynos5440 cpufreq
    driver if a memory allocation made by it fails. Fix from Sachin
    Kamat.

    5) Hanjun Guo's commit fixes a typo in the kerneldoc comment
    documenting acpi_bus_unregister_driver()"

    * tag 'pm+acpi-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
    ACPI / scan: fix typo in comments of acpi_bus_unregister_driver()
    cpufreq: exynos5440: Fix potential NULL pointer dereference
    cpufreq: check cpufreq driver is valid and cpufreq isn't disabled in cpufreq_get()
    acpi-cpufreq: skip loading acpi_cpufreq after intel_pstate
    ACPI / IPMI: Fix atomic context requirement of ipmi_msg_handler()

    Linus Torvalds
     
  • Ben Herrenschmidt found that commit 928bea964827 ("PCI: Delay enabling
    bridges until they're needed") breaks PCI in some powerpc environments.

    The reason is that the PCIe port driver will call pci_enable_device() on
    the bridge, so the device is enabled, but skips pci_set_master because
    pcie_port_auto and no acpi on powerpc.

    Because of that, pci_enable_bridge() later on (called as a result of the
    child device driver doing pci_enable_device) will see the bridge as
    already enabled and will not call pci_set_master() on it.

    Fixed by add checking in pci_enable_bridge, and call pci_set_master
    if driver skip that.

    That will make the code more robot and wade off problem for missing
    pci_set_master in drivers.

    Reported-by: Benjamin Herrenschmidt
    Signed-off-by: Yinghai Lu
    Signed-off-by: Linus Torvalds

    Yinghai Lu
     

28 Sep, 2013

12 commits

  • This patch adds code to initialize the DMA buffer to compensate for
    possible hardware data corruption.

    Signed-off-by: James Ralston
    [wsa: changed to use 'sizeof']
    Signed-off-by: Wolfram Sang

    James Ralston
     
  • Signed-off-by: Rob Clark

    Rob Clark
     
  • We still need an API exported by msm iommu driver (but not visible in
    any public header anymore). For now, just declare the prototype
    ourselves, but when msm iommu driver provides a better option, use that
    instead.

    Signed-off-by: Rob Clark

    Rob Clark
     
  • The include file has been removed and the file does not
    need it anyway, so remove it. Fixes a compile error.

    Signed-off-by: Joerg Roedel
    Signed-off-by: Rob Clark

    Joerg Roedel
     
  • The variable priv->kms is not initialized yet.

    Found by "scripts/coccinelle/tests/odd_ptr_err.cocci".
    PTR_ERR should access the value just tested by IS_ERR.

    Signed-off-by: Thomas Meyer

    Thomas Meyer
     
  • More radeon fixes for 3.12. Kind of all over the place: UVD, DPM,
    tiling, etc.

    * 'drm-fixes-3.12' of git://people.freedesktop.org/~agd5f/linux:
    drm/radeon: fix hdmi audio on DCE3.0/3.1 asics
    drm/radeon/cik: fix overflow in vram fetch
    drm/radeon: add missing hdmi callbacks for rv6xx
    drm/radeon/uvd: lower msg&fb buffer requirements on UVD3
    drm/radeon: disable tests/benchmarks if accel is disabled
    drm/radeon: don't set default clocks for SI when DPM is disabled
    drm/radeon/dpm/ci: filter clocks based on voltage/clk dep tables
    drm/radeon/dpm/si: filter clocks based on voltage/clk dep tables
    drm/radeon/dpm/ni: filter clocks based on voltage/clk dep tables
    drm/radeon/dpm/btc: filter clocks based on voltage/clk dep tables
    drm/radeon/dpm: fetch the max clk from voltage dep tables helper
    drm/radeon: fix missed variable sized access
    drm/radeon: Make r100_cp_ring_info() and radeon_ring_gfx() safe (v2)
    drm/radeon/cik: Add tiling mode index for 1D tiled depth/stencil surfaces
    drm/radeon/cik: Fix encoding of number of banks in tiling configuration info
    drm/radeon/cik: Fix printing of client name on VM protection fault
    drm/radeon: additional gcc fixes for radeon_atombios.c
    drm/radeon: avoid UVD corruption on AGP cards using GPU gart

    Dave Airlie
     
  • Pull hwmon fix from Guenter Roeck:
    "Fix potential crash condition in applesmc driver"

    * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
    hwmon: (applesmc) Check key count before proceeding

    Linus Torvalds
     
  • Pull fbdev fixes from Tomi Valkeinen:
    "Small fbdev fixes for various fb drivers"

    * tag 'fbdev-fixes-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux:
    video: mxsfb: Add missing break
    video: of: display_timing: correct display-timings node finding
    neofb: fix error return code in neofb_probe()
    s3fb: fix error return code in s3_pci_probe()
    video: mmp: drop needless devm cleanup
    OMAPDSS: Add missing dependency on backlight for DSI-CM panel drier
    OMAPDSS: DISPC: set irq_safe for runtime PM
    OMAPDSS: Return right error during connector probe

    Linus Torvalds
     
  • According to Designware I2C spec, if I2C_DYNAMIC_TAR_UPDATE is set to 1,
    the 10-bit addressing mode is controlled by IC_10BITADDR_MASTER bit of
    IC_TAR register instead of IC_CON register. The IC_10BITADDR_MASTER
    in IC_CON register becomes read-only copy. Since I2C_DYNAMIC_TAR_UPDATE
    value can't be detected from hardware register, so we will always set the
    IC_10BITADDR_MASTER bit in both IC_CON and IC_TAR register whenever 10-bit
    addresing mode is requested by user application.

    Signed-off-by: Chew, Chiau Ee
    Reviewed-by: Mika Westerberg
    Signed-off-by: Wolfram Sang

    Chew, Chiau Ee
     
  • The driver is used on PowerPC which don't provide writel_relaxed(). This
    breaks the c2k and prpmc2800 default configurations. To fix the build,
    turn the calls to writel_relaxed() into writel(). The impacts for ARM
    should be minimal.

    Signed-off-by: Thierry Reding
    Signed-off-by: Wolfram Sang

    Thierry Reding
     
  • Some functions and variables are only used if the configuration selects
    HAVE_CLK. Protect them with a corresponding #ifdef CONFIG_HAVE_CLK block
    to avoid compiler warnings.

    Signed-off-by: Thierry Reding
    [wsa: added marker to #endif]
    Signed-off-by: Wolfram Sang

    Thierry Reding
     
  • commit d16933b33914a6dff38a4ecbe8edce44a17898e8 "i2c: s3c2410: Move
    location of clk_prepare_enable() call in probe function" refactored
    clk_enable and clk_disable calls yet neglected to remove the
    clk_disable_unprepare call in the module's remove().

    It helps remove warnings on an arndale during unbind:

    echo 12c90000.i2c > /sys/bus/platform/devices/12c90000.i2c/driver/unbind

    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 2548 at drivers/clk/clk.c:842 clk_disable+0x18/0x24()
    Modules linked in:
    CPU: 0 PID: 2548 Comm: bash Not tainted 3.11.0-next-20130916-00003-gf4bddbc #6
    [] (unwind_backtrace+0x0/0xf8) from [] (show_stack+0x10/0x14)
    [] (show_stack+0x10/0x14) from [] (dump_stack+0x6c/0xac)
    [] (dump_stack+0x6c/0xac) from [] (warn_slowpath_common+0x64/0x88)
    [] (warn_slowpath_common+0x64/0x88) from [] (warn_slowpath_null+0x1c/0x24)
    [] (warn_slowpath_null+0x1c/0x24) from [] (clk_disable+0x18/0x24)
    [] (clk_disable+0x18/0x24) from [] (s3c24xx_i2c_remove+0x28/0x70)
    [] (s3c24xx_i2c_remove+0x28/0x70) from [] (platform_drv_remove+0x18/0x1c)
    [] (platform_drv_remove+0x18/0x1c) from [] (__device_release_driver+0x58/0xb4)
    [] (__device_release_driver+0x58/0xb4) from [] (device_release_driver+0x1c/0x28)
    [] (device_release_driver+0x1c/0x28) from [] (unbind_store+0x58/0x90)
    [] (unbind_store+0x58/0x90) from [] (drv_attr_store+0x20/0x2c)
    [] (drv_attr_store+0x20/0x2c) from [] (sysfs_write_file+0x168/0x198)
    [] (sysfs_write_file+0x168/0x198) from [] (vfs_write+0xb0/0x194)
    [] (vfs_write+0xb0/0x194) from [] (SyS_write+0x3c/0x70)
    [] (SyS_write+0x3c/0x70) from [] (ret_fast_syscall+0x0/0x30)
    ---[ end trace 4c9f9403066f57a6 ]---
    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 2548 at drivers/clk/clk.c:751 clk_unprepare+0x14/0x1c()
    Modules linked in:
    CPU: 0 PID: 2548 Comm: bash Tainted: G W 3.11.0-next-20130916-00003-gf4bddbc #6
    [] (unwind_backtrace+0x0/0xf8) from [] (show_stack+0x10/0x14)
    [] (show_stack+0x10/0x14) from [] (dump_stack+0x6c/0xac)
    [] (dump_stack+0x6c/0xac) from [] (warn_slowpath_common+0x64/0x88)
    [] (warn_slowpath_common+0x64/0x88) from [] (warn_slowpath_null+0x1c/0x24)
    [] (warn_slowpath_null+0x1c/0x24) from [] (clk_unprepare+0x14/0x1c)
    [] (clk_unprepare+0x14/0x1c) from [] (s3c24xx_i2c_remove+0x30/0x70)
    [] (s3c24xx_i2c_remove+0x30/0x70) from [] (platform_drv_remove+0x18/0x1c)
    [] (platform_drv_remove+0x18/0x1c) from [] (__device_release_driver+0x58/0xb4)
    [] (__device_release_driver+0x58/0xb4) from [] (device_release_driver+0x1c/0x28)
    [] (device_release_driver+0x1c/0x28) from [] (unbind_store+0x58/0x90)
    [] (unbind_store+0x58/0x90) from [] (drv_attr_store+0x20/0x2c)
    [] (drv_attr_store+0x20/0x2c) from [] (sysfs_write_file+0x168/0x198)
    [] (sysfs_write_file+0x168/0x198) from [] (vfs_write+0xb0/0x194)
    [] (vfs_write+0xb0/0x194) from [] (SyS_write+0x3c/0x70)
    [] (SyS_write+0x3c/0x70) from [] (ret_fast_syscall+0x0/0x30)
    ---[ end trace 4c9f9403066f57a7 ]---

    Signed-off-by: Kim Phillips
    Signed-off-by: Wolfram Sang

    Kim Phillips
     

27 Sep, 2013

12 commits

  • * pm-cpufreq-fixes:
    cpufreq: exynos5440: Fix potential NULL pointer dereference
    cpufreq: check cpufreq driver is valid and cpufreq isn't disabled in cpufreq_get()
    acpi-cpufreq: skip loading acpi_cpufreq after intel_pstate

    Rafael J. Wysocki
     
  • The DLink DWA-125 Rev D1 also uses this driver.

    Signed-off-by: Larry Finger
    Reported-by: Sergey Kostanbaev
    Tested-by: Sergey Kostanbaev
    Cc: Sergey Kostanbaev
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Larry Finger
     
  • Add PCI id for Intel Merrifield

    Signed-off-by: David Cohen
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    David Cohen
     
  • In case of usb phy reinitialization:
    e.g. insmod usb-module(usb works well) -> rmmod usb-module -> insmod usb-module
    It found the PHY_CLK_VALID bit didn't work if it's not with the power-on reset.
    So we just check PHY_CLK_VALID bit during the stage with POR, this can be met
    by the tricky of checking FSL_SOC_USB_PRICTRL register.

    Signed-off-by: Shengzhou Liu
    Signed-off-by: Greg Kroah-Hartman

    Shengzhou Liu
     
  • There's a bunch of failure exits in ffs_fs_mount() with
    seriously broken recovery logics. Most of that appears to stem
    from misunderstanding of the ->kill_sb() semantics; unlike
    ->put_super() it is called for *all* superblocks of given type,
    no matter how (in)complete the setup had been. ->put_super()
    is called only if ->s_root is not NULL; any failure prior to
    setting ->s_root will have the call of ->put_super() skipped.
    ->kill_sb(), OTOH, awaits every superblock that has come from
    sget().

    Current behaviour of ffs_fs_mount():

    We have struct ffs_sb_fill_data data on stack there. We do
    ffs_dev = functionfs_acquire_dev_callback(dev_name);
    and store that in data.private_data. Then we call mount_nodev(),
    passing it ffs_sb_fill() as a callback. That will either fail
    outright, or manage to call ffs_sb_fill(). There we allocate an
    instance of struct ffs_data, slap the value of ffs_dev (picked
    from data.private_data) into ffs->private_data and overwrite
    data.private_data by storing ffs into an overlapping member
    (data.ffs_data). Then we store ffs into sb->s_fs_info and attempt
    to set the rest of the things up (root inode, root dentry, then
    create /ep0 there). Any of those might fail. Should that
    happen, we get ffs_fs_kill_sb() called before mount_nodev()
    returns. If mount_nodev() fails for any reason whatsoever,
    we proceed to
    functionfs_release_dev_callback(data.ffs_data);

    That's broken in a lot of ways. Suppose the thing has failed in
    allocation of e.g. root inode or dentry. We have
    functionfs_release_dev_callback(ffs);
    ffs_data_put(ffs);
    done by ffs_fs_kill_sb() (ffs accessed via sb->s_fs_info), followed by
    functionfs_release_dev_callback(ffs);
    from ffs_fs_mount() (via data.ffs_data). Note that the second
    functionfs_release_dev_callback() has every chance to be done to freed memory.

    Suppose we fail *before* root inode allocation. What happens then?
    ffs_fs_kill_sb() doesn't do anything to ffs (it's either not called at all,
    or it doesn't have a pointer to ffs stored in sb->s_fs_info). And
    functionfs_release_dev_callback(data.ffs_data);
    is called by ffs_fs_mount(), but here we are in nasal daemon country - we
    are reading from a member of union we'd never stored into. In practice,
    we'll get what we used to store into the overlapping field, i.e. ffs_dev.
    And then we get screwed, since we treat it (struct gfs_ffs_obj * in
    disguise, returned by functionfs_acquire_dev_callback()) as struct
    ffs_data *, pick what would've been ffs_data ->private_data from it
    (*well* past the actual end of the struct gfs_ffs_obj - struct ffs_data
    is much bigger) and poke in whatever it points to.

    FWIW, there's a minor leak on top of all that in case if ffs_sb_fill()
    fails on kstrdup() - ffs is obviously forgotten.

    The thing is, there is no point in playing all those games with union.
    Just allocate and initialize ffs_data *before* calling mount_nodev() and
    pass a pointer to it via data.ffs_data. And once it's stored in
    sb->s_fs_info, clear data.ffs_data, so that ffs_fs_mount() knows that
    it doesn't need to kill the sucker manually - from that point on
    we'll have it done by ->kill_sb().

    Signed-off-by: Al Viro
    Acked-by: Michal Nazarewicz
    Cc: stable # 3.3+
    Signed-off-by: Greg Kroah-Hartman

    Al Viro
     
  • The put_device(dev) at the bottom of the loop of device_shutdown
    may result in the dev being cleaned up. In device_create_release,
    the dev is kfreed.

    However, device_shutdown attempts to use the dev pointer again after
    put_device by referring to dev->parent.

    Copy the parent pointer instead to avoid this condition.

    This bug was found on Chromium OS's chromeos-3.8, which is based on v3.8.11.
    See bug report : https://code.google.com/p/chromium/issues/detail?id=297842
    This can easily be reproduced when shutting down with
    hidraw devices that report battery condition.
    Two examples are the HP Bluetooth Mouse X4000b and the Apple Magic Mouse.
    For example, with the magic mouse :
    The dev in question is "hidraw0"
    dev->parent is "magicmouse"

    In the course of the shutdown for this device, the input event cleanup calls
    a put on hidraw0, decrementing its reference count.
    When we finally get to put_device(dev) in device_shutdown, kobject_cleanup
    is called and device_create_release does kfree(dev).
    dev->parent is no longer valid, and we may crash in
    put_device(dev->parent).

    This change should be applied on any kernel with this change :
    d1c6c030fcec6f860d9bb6c632a3ebe62e28440b

    Cc: stable@vger.kernel.org
    Signed-off-by: Benson Leung
    Reviewed-by: Ming Lei
    Signed-off-by: Greg Kroah-Hartman

    Benson Leung
     
  • commit 666b9adc801ef012612c4e43e0f44b2cdc1979cf terminated vmbus
    version negotiation incorrectly. We need to terminate the version
    negotiation only if the current negotiation were to timeout.

    Signed-off-by: K. Y. Srinivasan
    Cc: Olaf Hering
    Signed-off-by: Greg Kroah-Hartman

    K. Y. Srinivasan
     
  • The current code does not correctly negotiate the version numbers for the util
    driver when hosted on earlier hosts. The version numbers presented by this
    driver were not compatible with the version numbers supported by Windows Server
    2008. Fix this problem.

    I would like to thank Olaf Hering (ohering@suse.com) for identifying the problem.

    Reported-by: Olaf Hering
    Signed-off-by: K. Y. Srinivasan
    Signed-off-by: Greg Kroah-Hartman

    K. Y. Srinivasan
     
  • Unset init_clients_timer and amthif_stall_timers
    in mei_reset in order to cancel timer ticking and hence
    avoid recursive reset calls.

    Cc: # 3.9+
    Signed-off-by: Alexander Usyskin
    Signed-off-by: Tomas Winkler
    Signed-off-by: Greg Kroah-Hartman

    Alexander Usyskin
     
  • Bus layer omitted check for client state transition while waiting
    for read completion
    The client state transition may occur for example as result
    of firmware initiated reset

    Add mei_cl_is_transitioning wrapper to reduce the code
    repetition.:

    Cc: # 3.9+
    Signed-off-by: Tomas Winkler
    Signed-off-by: Greg Kroah-Hartman

    Tomas Winkler
     
  • 1. u8 counters are prone to hard to detect overflow:
    make them unsigned long to match bit_ functions argument type

    2. don't check me_clients_num for negativity, it is unsigned.

    3. init all the me client counters from one place

    Cc: # 3.9+
    Signed-off-by: Tomas Winkler
    Signed-off-by: Greg Kroah-Hartman

    Tomas Winkler
     
  • For controller versions greater than 1.6, setting ULPI_PHY_CLK_SEL
    bit when USB_EN bit is already set causes instability issues with
    PHY_CLK_VLD bit. So USB_EN is set only for IP controller version
    below 1.6 before setting ULPI_PHY_CLK_SEL bit

    Signed-off-by: Ramneek Mehresh
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Ramneek Mehresh
     

26 Sep, 2013

5 commits