13 Dec, 2011

15 commits


05 Dec, 2011

1 commit

  • Sometimes the register map information may change in ways that drivers can
    discover at runtime. For example, new revisions of a device may add new
    registers. Support runtime discovery by drivers by allowing the register
    cache to be reinitialised with a new function regmap_reinit_cache() which
    discards the existing cache and creates a new one.

    Signed-off-by: Mark Brown

    Mark Brown
     

24 Nov, 2011

15 commits

  • Linus Torvalds
     
  • * git://github.com/rustyrussell/linux:
    virtio-pci: make reset operation safer
    virtio-mmio: Correct the name of the guest features selector
    virtio: add HAS_IOMEM dependency to MMIO platform bus driver

    Linus Torvalds
     
  • virtio pci device reset actually just does an I/O
    write, which in PCI is really posted, that is it
    can complete on CPU before the device has received it.

    Further, interrupts might have been pending on
    another CPU, so device callback might get invoked after reset.

    This conflicts with how drivers use reset, which is typically:
    reset
    unregister
    a callback running after reset completed can race with
    unregister, potentially leading to use after free bugs.

    Fix by flushing out the write, and flushing pending interrupts.

    This assumes that device is never reset from
    its vq/config callbacks, or in parallel with being
    added/removed, document this assumption.

    Signed-off-by: Michael S. Tsirkin
    Signed-off-by: Rusty Russell

    Michael S. Tsirkin
     
  • Guest features selector spelling mistake.

    Cc: Pawel Moll
    Cc: Rusty Russell
    Cc: virtualization@lists.linux-foundation.org
    Signed-off-by: Sasha Levin
    Signed-off-by: Rusty Russell

    Sasha Levin
     
  • Fix this compile error on s390:

    CC [M] drivers/virtio/virtio_mmio.o
    drivers/virtio/virtio_mmio.c: In function 'vm_get_features':
    drivers/virtio/virtio_mmio.c:107:2: error: implicit declaration of function 'writel'

    Cc: Christian Borntraeger
    Signed-off-by: Heiko Carstens
    Acked-by: Pawel Moll
    Signed-off-by: Rusty Russell

    Heiko Carstens
     
  • * 'upstream-linus' of git://github.com/jgarzik/libata-dev:
    libata: fix build without BMDMA
    [libata] ahci_platform: fix DT probing

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci:
    PCI hotplug: shpchp: don't blindly claim non-AMD 0x7450 device IDs
    PCI: pciehp: wait 100 ms after Link Training check
    PCI: pciehp: wait 1000 ms before Link Training check
    PCI: pciehp: Retrieve link speed after link is trained
    PCI: Let PCI_PRI depend on PCI
    PCI: Fix compile errors with PCI_ATS and !PCI_IOV
    PCI / ACPI: Make acpiphp ignore root bridges using PCIe native hotplug

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
    eCryptfs: Extend array bounds for all filename chars
    eCryptfs: Flush file in vma close
    eCryptfs: Prevent file create race condition

    Linus Torvalds
     
  • From mhalcrow's original commit message:

    Characters with ASCII values greater than the size of
    filename_rev_map[] are valid filename characters.
    ecryptfs_decode_from_filename() will access kernel memory beyond
    that array, and ecryptfs_parse_tag_70_packet() will then decrypt
    those characters. The attacker, using the FNEK of the crafted file,
    can then re-encrypt the characters to reveal the kernel memory past
    the end of the filename_rev_map[] array. I expect low security
    impact since this array is statically allocated in the text area,
    and the amount of memory past the array that is accessible is
    limited by the largest possible ASCII filename character.

    This patch solves the issue reported by mhalcrow but with an
    implementation suggested by Linus to simply extend the length of
    filename_rev_map[] to 256. Characters greater than 0x7A are mapped to
    0x00, which is how invalid characters less than 0x7A were previously
    being handled.

    Signed-off-by: Tyler Hicks
    Reported-by: Michael Halcrow
    Cc: stable@kernel.org

    Tyler Hicks
     
  • Dirty pages weren't being written back when an mmap'ed eCryptfs file was
    closed before the mapping was unmapped. Since f_ops->flush() is not
    called by the munmap() path, the lower file was simply being released.
    This patch flushes the eCryptfs file in the vm_ops->close() path.

    https://launchpad.net/bugs/870326

    Signed-off-by: Tyler Hicks
    Cc: stable@kernel.org [2.6.39+]

    Tyler Hicks
     
  • The file creation path prematurely called d_instantiate() and
    unlock_new_inode() before the eCryptfs inode info was fully
    allocated and initialized and before the eCryptfs metadata was written
    to the lower file.

    This could result in race conditions in subsequent file and inode
    operations leading to unexpected error conditions or a null pointer
    dereference while attempting to use the unallocated memory.

    https://launchpad.net/bugs/813146

    Signed-off-by: Tyler Hicks
    Cc: stable@kernel.org

    Tyler Hicks
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest:
    ktest: Check parent options for iterated tests

    Linus Torvalds
     
  • * 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
    i2c: Make i2cdev_notifier_call static
    i2c: Delete ANY_I2C_BUS
    i2c: Fix device name for 10-bit slave address
    i2c-algo-bit: Generate correct i2c address sequence for 10-bit target

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
    regulator: TPS65910: Fix VDD1/2 voltage selector count

    Linus Torvalds
     
  • * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (31 commits)
    drm: integer overflow in drm_mode_dirtyfb_ioctl()
    drivers/gpu/vga/vgaarb.c: add missing kfree
    drm/radeon/kms/atom: unify i2c gpio table handling
    drm/radeon/kms: fix up gpio i2c mask bits for r4xx for real
    ttm: Don't return the bo reserved on error path
    drm/radeon/kms: add a CS ioctl flag not to rewrite tiling flags in the CS
    drm/i915: Fix inconsistent backlight level during disabled
    drm, i915: Fix memory leak in i915_gem_busy_ioctl().
    drm/i915: Use DPCD value for max DP lanes.
    drm/i915: Initiate DP link training only on the lanes we'll be using
    drm/i915: Remove trailing white space
    drm/i915: Try harder during dp pattern 1 link training
    drm/i915: Make DP prepare/commit consistent with DP dpms
    drm/i915: Let panel power sequencing hardware do its job
    drm/i915: Treat PCH eDP like DP in most places
    drm/i915: Remove link_status field from intel_dp structure
    drm/i915: Move common PCH_PP_CONTROL setup to ironlake_get_pp_control
    drm/i915: Module parameters using '-1' as default must be signed type
    drm/i915: Turn on another required clock gating bit on gen6.
    drm/i915: Turn on a required 3D clock gating bit on Sandybridge.
    ...

    Linus Torvalds
     

23 Nov, 2011

9 commits

  • Count of selector voltage is required for regulator_set_voltage
    to work via set_voltage_sel. VDD1/2 currently have it as zero,
    so regulator_set_voltage won't work for VDD1/2.
    Update count (n_voltages) for VDD1/2.

    Output Voltage = (step value * 12.5 mV + 562.5 mV) * gain

    With above expr, number of voltages that can be selected is
    step value count * gain count

    constant for gain count will be called VDD1_2_NUM_VOLT_COARSE

    existing constant for step value count is VDD1_2_NUM_VOLTS,
    use VDD1_2_NUM_VOLT_FINE instead to make clear that step value
    is not the only component in deciding selectable voltage count

    Signed-off-by: Afzal Mohammed
    Signed-off-by: Mark Brown

    Afzal Mohammed
     
  • The function i2cdev_notifier_call is used only in i2c-dev file
    making it static.
    Also removes the following sparse warning

    drivers/i2c/i2c-dev.c:582:5: warning: symbol 'i2cdev_notifier_call'
    was not declared. Should it be static?

    Signed-off-by: Shubhrajyoti D
    Signed-off-by: Jean Delvare

    Shubhrajyoti D
     
  • Last piece of code using ANY_I2C_BUS was deleted almost 2 years ago,
    so ANY_I2C_BUS can go away as well.

    Signed-off-by: Jean Delvare

    Jean Delvare
     
  • 10-bit addresses overlap with traditional 7-bit addresses, leading in
    device name collisions. Add an arbitrary offset to 10-bit addresses to
    prevent this collision. The offset was chosen so that the address is
    still easily recognizable.

    Signed-off-by: Jean Delvare
    Acked-by: Wolfram Sang

    Jean Delvare
     
  • The wrong bits were put on the wire, fix that.

    This fixes kernel bug #42562.

    Signed-off-by: Sheng-Hui J. Chu
    Cc: stable@kernel.org
    Signed-off-by: Jean Delvare

    Jeffrey (Sheng-Hui) Chu
     
  • There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
    if userspace passes in a large num_clips. The call to kmalloc would
    allocate a small buffer, and the call to fb->funcs->dirty may result
    in a memory corruption.

    Reported-by: Haogang Chen
    Signed-off-by: Xi Wang
    Cc: stable@kernel.org
    Signed-off-by: Dave Airlie

    Xi Wang
     
  • This reverts commit dc9372808412edbc653a675a526c2ee6c0c14a91.

    As requested by Ben Herrenschmidt:
    "This breaks some powerpc platforms at least. The practice of having
    a node provide an explicit "interrupt-parent" property pointing to
    itself is an old trick that we've used in the past to allow a
    device-node to have interrupts routed to different controllers.

    In that case, the node also contains an interrupt-map, so the node is
    its own parent, the interrupt resolution hits the map, which then can
    route each individual interrupt to a different parent."

    Grant says:
    "Ah, nuts, yes that is broken then. Yes, please revert the commit and
    Rob & I will come up with a better solution.

    Rob, I think it can be done by explicitly checking for np ==
    desc->interrupt_parent in of_irq_init() instead of relying on
    of_irq_find_parent() returning NULL."

    Requested-by: Benjamin Herrenschmidt
    Acked-by: Grant Likely
    Cc: Rob Herring
    Cc: devicetree-discuss@lists.ozlabs.org
    Cc: linuxppc-dev
    Cc: Tanmay Inamdar
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
    mount_subtree() pointless use-after-free
    iio: fix a leak due to improper use of anon_inode_getfd()
    microblaze: bury asm/namei.h

    Linus Torvalds
     
  • kbuf is a buffer that is local to this function, so all of the error paths
    leaving the function should release it.

    Signed-off-by: Julia Lawall
    Cc: Jesper Juhl
    Signed-off-by: Andrew Morton
    Signed-off-by: Dave Airlie

    Julia Lawall