Doug / smarc-fsl-linux-kernel

15 Oct, 2009

2 commits

  • 7e44c0b56   firewire: cdev: fix memory leak in an error path ... Browse Code »

    If copy_from_user in an FW_CDEV_IOC_SEND_RESPONSE ioctl failed, an
    inbound_transaction_resource instance is no longer referenced and needs
    to be freed.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • eaf76e0d0   firewire: sbp2: provide fallback if mgt_ORB_timeout is missing ... Browse Code »

    The Unit_Characteristics entry of an SBP-2 unit directory is not
    mandatory as far as I can tell. If it is missing, we would probably
    fail to log in into the target because firewire-sbp2 would not wait for
    status after it sent the login request.

    The fix moves the cleanup of tgt->mgt_orb_timeout into a place where it
    is executed exactly once before login, rather than 0..n times depending
    on the target's config ROM. With targets with one or more
    Unit_Characteristics entries, the result is the same as before.

    Signed-off-by: Stefan Richter

    Stefan Richter
     

08 Oct, 2009

1 commit

03 Oct, 2009

1 commit

  • 211a64177   ieee1394: update URLs in debugging-via-ohci1394.txt ... Browse Code »

    Update URLs of the userspace tools to use ohci1394_dma=early for
    debugging.

    Seems the address ftp://ftp.suse.de/private/bk/firewire/tools/* is not
    very helpful. After a quick search, seems this was talked about:
    http://www.mail-archive.com/kgdb-bugreport@lists.sourceforge.net/msg02761.html
    (can't find the original thread).

    Signed-off-by: Justin P. Mattock
    Signed-off-by: Stefan Richter

    Justin P. Mattock
     

12 Sep, 2009

8 commits

  • 625f0850a   ieee1394: sbp2: remove a workaround for Momobay FX-3A ... Browse Code »

    The inquiry delay is not necessary anymore in tests on a recent kernel.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • 3c5f80357   firewire: sbp2: remove a workaround for Momobay FX-3A ... Browse Code »

    The inquiry delay does more harm than good in tests on a recent kernel.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • 094614fc1   firewire: sbp2: fix status reception ... Browse Code »

    Per SBP-2 clause 5.3, a target shall store 8...32 bytes of status
    information. Trailing zeros after the first 8 bytes don't need to be
    stored, they are implicit. Fix the status write handler to clear all
    unwritten status data.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • 85cb9b686   firewire: core: fix topology map response handler ... Browse Code »

    This register is 1 kBytes large. Adjust topology_map.length to prevent
    registration of other response handlers in this region and to make sure
    that we respond to requests to the upper half of the register.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • b171e204b   firewire: core: fix race with parallel PCI device probe ... Browse Code »

    The config ROM buffer received from generate_config_rom is a globally
    shared static buffer. Extend the card_mutex protection in fw_add_card
    until after the config ROM was copied into the card driver's buffer.
    Otherwise, parallelized card driver probes may end up with ROM contents
    that were meant for a different card.

    firewire-ohci's card->driver->enable hook is safe to be called within
    the card_mutex. Furthermore, it is safe to reorder card_list update
    versus card enable, which simplifies the code a little.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • 18668ff9a   firewire: core: header file cleanup ... Browse Code »

    fw_card_get, fw_card_put, fw_card_release are currently not exported for
    use outside the firewire-core. Move their definitions/ declarations
    from the subsystem header file to the core header file.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • 928ec5f14   firewire: ohci: fix Self ID Count register mask (safeguard against buffer overflow) ... Browse Code »

    The selfIDSize field of Self ID Count is 9 bits wide, and we are only
    interested in the high 8 bits. Fix the mask accordingly. The
    previously too large mask didn't do damage though because the next few
    bits in the register are reserved and therefore zero with presently
    existing hardware.

    Also, check for the maximum possible self ID count of 252 (according to
    OHCI 1.1 clause 11.2 and IEEE 1394a-2000 clause 4.3.4.1, i.e. up to four
    self IDs of up to 63 nodes, even though IEEE 1394 up to edition 2008
    defines only up to three self IDs per node). More than 252 self IDs
    would only happen if the self ID receive DMA unit malfunctioned, which
    would likely be caught by other self ID buffer checks. However, check
    it early to be sure. More than 253 quadlets would overflow the Topology
    Map CSR.

    Reported-By: PaX Team
    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • 64549e935   ieee1394: raw1394: Do not leak memory on failed trylock. ... Browse Code »

    Do not leak the allocated memory in case the mutex_trylock() failed
    to acquire the lock.

    Signed-off-by: Michael Buesch

    This bug does not happen in practice: All raw1394 clients use
    libraw1394, and accesses to a libraw1394 handle need to be serialized
    by the client. This is documented in libraw1394's API reference.

    Signed-off-by: Stefan Richter

    Michael Buesch
     

10 Sep, 2009

1 commit

09 Sep, 2009

3 commits

  • 7135a71b1   aoe: allocate unused request_queue for sysfs ... Browse Code »

    Andy Whitcroft reported an oops in aoe triggered by use of an
    incorrectly initialised request_queue object:

    [ 2645.959090] kobject '' (ffff880059ca22c0): tried to add
    an uninitialized object, something is seriously wrong.
    [ 2645.959104] Pid: 6, comm: events/0 Not tainted 2.6.31-5-generic #24-Ubuntu
    [ 2645.959107] Call Trace:
    [ 2645.959139] [] kobject_add+0x5f/0x70
    [ 2645.959151] [] blk_register_queue+0x8b/0xf0
    [ 2645.959155] [] add_disk+0x8f/0x160
    [ 2645.959161] [] aoeblk_gdalloc+0x164/0x1c0 [aoe]

    The request queue of an aoe device is not used but can be allocated in
    code that does not sleep.

    Bruno bisected this regression down to

    cd43e26f071524647e660706b784ebcbefbd2e44

    block: Expose stacked device queues in sysfs

    "This seems to generate /sys/block/$device/queue and its contents for
    everyone who is using queues, not just for those queues that have a
    non-NULL queue->request_fn."

    Addresses http://bugs.launchpad.net/bugs/410198
    Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13942

    Note that embedding a queue inside another object has always been
    an illegal construct, since the queues are reference counted and
    must persist until the last reference is dropped. So aoe was
    always buggy in this respect (Jens).

    Signed-off-by: Ed Cashin
    Cc: Andy Whitcroft
    Cc: "Rafael J. Wysocki"
    Cc: Bruno Premont
    Cc: Martin K. Petersen
    Cc: Andrew Morton
    Signed-off-by: Jens Axboe

    Ed Cashin
     
  • e6890f6f3   i915: disable interrupts before tearing down GEM state ... Browse Code »

    Reinette Chatre reports a frozen system (with blinking keyboard LEDs)
    when switching from graphics mode to the text console, or when
    suspending (which does the same thing). With netconsole, the oops
    turned out to be

    BUG: unable to handle kernel NULL pointer dereference at 0000000000000084
    IP: [] i915_driver_irq_handler+0x26b/0xd20 [i915]

    and it's due to the i915_gem.c code doing drm_irq_uninstall() after
    having done i915_gem_idle(). And the i915_gem_idle() path will do

    i915_gem_idle() ->
    i915_gem_cleanup_ringbuffer() ->
    i915_gem_cleanup_hws() ->
    dev_priv->hw_status_page = NULL;

    but if an i915 interrupt comes in after this stage, it may want to
    access that hw_status_page, and gets the above NULL pointer dereference.

    And since the NULL pointer dereference happens from within an interrupt,
    and with the screen still in graphics mode, the common end result is
    simply a silently hung machine.

    Fix it by simply uninstalling the irq handler before idling rather than
    after. Fixes

    http://bugzilla.kernel.org/show_bug.cgi?id=13819

    Reported-and-tested-by: Reinette Chatre
    Acked-by: Jesse Barnes
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     
  • 7c8460db3   drm/i915: fix mask bits setting ... Browse Code »

    eDP is exclusive connector too, and add missing crtc_mask
    setting for TV.

    This fixes

    http://bugzilla.kernel.org/show_bug.cgi?id=14139

    Signed-off-by: Zhenyu Wang
    Reported-and-tested-by: Carlos R. Mafra
    Signed-off-by: Linus Torvalds

    Zhenyu Wang
     

08 Sep, 2009

5 commits

07 Sep, 2009

2 commits

  • a54775c87   drm/radeon/kms: add LTE/GTE discard + rv515 two sided stencil register. ... Browse Code »

    This adds some rv350+ register for LTE/GTE discard,
    and enables the rv515 two sided stencil register.
    It also disables the DEPTHXY_OFFSET register which
    can be used to workaround the CS checker.
    Moves rs690 to proper place in rs600 and uses correct
    table on rs600.

    Signed-off-by: Dave Airlie

    Dave Airlie
     
  • acd0c9351   IMA: update ima_counts_put ... Browse Code »

    - As ima_counts_put() may be called after the inode has been freed,
    verify that the inode is not NULL, before dereferencing it.

    - Maintain the IMA file counters in may_open() properly, decrementing
    any counter increments on subsequent errors.

    Reported-by: Ciprian Docan
    Reported-by: J.R. Okajima
    Signed-off-by: Mimi Zohar
    Acked-by: Eric Paris

    Mimi Zohar
     

06 Sep, 2009

17 commits