16 Mar, 2012
9 commits
-
strict_strtoul() writes a long but ->gamma_mode only has space to store an
int, so on 64 bit systems we end up scribbling over ->gamma_table_count as
well. I've changed it to use kstrtouint() instead.Signed-off-by: Dan Carpenter
Acked-by: Inki Dae
Signed-off-by: Florian Tobias Schandinat
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
I'd like to add Inki Dae, Donghwa Lee and Kyungmin Park as maintainers
who developers for exynos mipi display drivers for
video/driver/exynos/exynos_mipi* and include/video/exynos_mipi*.Signed-off-by: Donghwa Lee
Signed-off-by: Inki Dae
Signed-off-by: Kyungmin Park
Cc: Florian Tobias Schandinat
Cc: Richard Purdie
Cc: Kukjin Kim
Cc: Jingoo Han
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
Gustavo's tree is called just bluetooth.git and not bluetooth-2.6.git
anymore.Signed-off-by: Johan Hedberg
Cc: Marcel Holtmann
Cc: "Gustavo F. Padovan"
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
I've been coordinating Bluetooth patches in my tree for some time and
it's possible I'll do it in the future too, so add myself to the
Bluetooth sections as well as mention my tree there.Signed-off-by: Johan Hedberg
Cc: Marcel Holtmann
Cc: "Gustavo F. Padovan"
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
This is going to be the primary e-mail for kernel development.
Signed-off-by: Gustavo Padovan
Cc: Johan Hedberg
Cc: Marcel Holtmann
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
CAP_SYS_ADMIN is already overloaded left and right, so to have more
fine-grained access control use CAP_SYS_RESOURCE here.The CAP_SYS_RESOUCE is chosen because this prctl option allows a current
process to adjust some fields of memory map descriptor which rather
represents what the process owns: pointers to code, data, stack
segments, command line, auxiliary vector data and etc.Suggested-by: Michael Kerrisk
Acked-by: Kees Cook
Acked-by: Michael Kerrisk
Cc: Pavel Emelyanov
Cc: Tejun Heo
Cc: Oleg Nesterov
Cc: Paul Bolle
Cc: KOSAKI Motohiro
Signed-off-by: Cyrill Gorcunov
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
Fix indexed register offset definitions that use decimal (wrong) instead
of hexadecimal (correct) notation for indexing multipliers.Incorrect definitions do not affect Tsi721 driver in its current default
configuration because it uses only IDB queue 0. Loss of inbound
doorbell functionality should be observed if queue other than 0 is used.Signed-off-by: Alexandre Bounine
Cc: Matt Porter
Cc: Chul Kim
Cc: [3.2+]
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
We have created a ST's Mailing list for SPEAr. This can be accessed
from non-st email ids. I want people to cc this list, when they have
changes specific to SPEAr. So, its better to get this updated in
MAINTAINERS file.linux-arm-kernel@lists.infradead.org is also added for SPEAr.
Signed-off-by: Viresh Kumar
Cc: Russell King
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
After fixing the GPF in mem_cgroup_lru_del_list(), three times one
machine running a similar load (moving and removing memcgs while
swapping) has oopsed in mem_cgroup_zone_nr_lru_pages(), when retrieving
memcg zone numbers for get_scan_count() for shrink_mem_cgroup_zone():
this is where a struct mem_cgroup is first accessed after being chosen
by mem_cgroup_iter().Just what protects a struct mem_cgroup from being freed, in between
mem_cgroup_iter()'s css_get_next() and its css_tryget()? css_tryget()
fails once css->refcnt is zero with CSS_REMOVED set in flags, yes: but
what if that memory is freed and reused for something else, which sets
"refcnt" non-zero? Hmm, and scope for an indefinite freeze if refcnt is
left at zero but flags are cleared.It's tempting to move the css_tryget() into css_get_next(), to make it
really "get" the css, but I don't think that actually solves anything:
the same difficulty in moving from css_id found to stable css remains.But we already have rcu_read_lock() around the two, so it's easily fixed
if __mem_cgroup_free() just uses kfree_rcu() to free mem_cgroup.However, a big struct mem_cgroup is allocated with vzalloc() instead of
kzalloc(), and we're not allowed to vfree() at interrupt time: there
doesn't appear to be a general vfree_rcu() to help with this, so roll
our own using schedule_work(). The compiler decently removes
vfree_work() and vfree_rcu() when the config doesn't need them.Signed-off-by: Hugh Dickins
Acked-by: KAMEZAWA Hiroyuki
Acked-by: Johannes Weiner
Cc: Konstantin Khlebnikov
Cc: Tejun Heo
Cc: Ying Han
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
15 Mar, 2012
4 commits
-
Pull block fixes from Jens Axboe:
"Been sitting on this for a while, but lets get this out the door.
This fixes various important bugs for 3.3 final, along with a few more
trivial ones. Please pull!"* 'for-linus' of git://git.kernel.dk/linux-block:
block: fix ioc leak in put_io_context
block, sx8: fix pointer math issue getting fw version
Block: use a freezable workqueue for disk-event polling
drivers/block/DAC960: fix -Wuninitialized warning
drivers/block/DAC960: fix DAC960_V2_IOCTL_Opcode_T -Wenum-compare warning
block: fix __blkdev_get and add_disk race condition
block: Fix setting bio flags in drivers (sd_dif/floppy)
block: Fix NULL pointer dereference in sd_revalidate_disk
block: exit_io_context() should call elevator_exit_icq_fn()
block: simplify ioc_release_fn()
block: replace icq->changed with icq->flags -
Pull regulator fixes from Mark Brown:
"Another small batch of driver specific bug fixes, a couple more errors
in the da9052 driver and a bad return value in the tps6524x driver."* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: da9052: Ensure the selected voltage falls within the specified range
regulator: Set n_voltages for da9052 regulators
regulator: Fix setting selector in tps6524x set_voltage function -
Pull arch/tile update to run "make minconfig" on the tile defconfigs
from Chris Metcalf.This removes almost three thousand lines of inane defconfig chatter.
* 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
arch/tile/configs: convert to minimal configs via "make savedefconfig" -
Signed-off-by: Chris Metcalf
14 Mar, 2012
11 commits
-
When put_io_context is called, if ioc->icq_list is empty and refcount
is 1, kernel will not free the ioc.This is caught by following kmemleak:
unreferenced object 0xffff880036349fe0 (size 216):
comm "sh", pid 2137, jiffies 4294931140 (age 290579.412s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01 00 01 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
backtrace:
[] kmemleak_alloc+0x26/0x50
[] kmem_cache_alloc_node+0x1cc/0x2a0
[] create_io_context_slowpath+0x27/0x130
[] get_task_io_context+0xbb/0xf0
[] copy_process+0x188e/0x18b0
[] do_fork+0x11b/0x420
[] sys_clone+0x28/0x30
[] stub_clone+0x13/0x20
[] 0xffffffffffffffffioc should be freed if ioc->icq_list is empty.
Signed-off-by: Xiaotian Feng
Acked-by: Vivek Goyal
Acked-by: Tejun Heo
Signed-off-by: Jens Axboe -
Pull sparc updates from David Miller:
"Please pull to get this fix for the sparc32 build when using a more
recent binutils."* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
sparc32: Add -Av8 to assembler command line. -
Newer version of binutils are more strict about specifying the
correct options to enable certain classes of instructions.The sparc32 build is done for v7 in order to support sun4c systems
which lack hardware integer multiply and divide instructions.So we have to pass -Av8 when building the assembler routines that
use these instructions and get patched into the kernel when we find
out that we have a v8 capable cpu.Reported-by: Paul Gortmaker
Signed-off-by: David S. Miller -
Pull networking changes from David Miller:
"The most important bit here is the TCP syncookies issue, which seems
to have been busted for some time. That fix has been verified in
production by the reporter.1) Persistent TUN devices erroneously hold on to the network namespace
in such a way that it cannot be shutdown. Fix from Stanislav
Kinsbursky with help from Eric Dumazet.2) TCP SYN cookies have been broken for a while due to how the route
lookup flow key is managed, connections can be delayed by as much
as 20 seconds due to this bug. Fix from Eric Dumazet.3) Missing jiffies.h include in lib/dynamic_queue_limits.c can break
the build, from Tom Herbert.4) Add USB device ID for Sitecom LN-031, from Joerg Neikes.
5) Fix OOPS in delayed workqueue in iwlegacy, from Stanislaw Gruszka.
6) rt2x00 TX queue can be disabled forever due to races, fix by
synchronizing pause/unpause with a lock. Also from Stanislaw
Gruszka.7) Statistics and endian fix in bnx2x driver from Yuval Mintz, Eilon
Greenstein, and Ariel Elior."* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
tun: don't hold network namespace by tun sockets
bnx2x: FCoE statistics id fixed
bnx2x: dcb bit indices flags used as bits
bnx2x: added cpu_to_le16 when preparing ramrod's data
bnx2x: pfc statistics counts pfc events twice
rt2x00: fix random stalls
iwl3945: fix possible il->txq NULL pointer dereference in delayed works
dql: Fix undefined jiffies
tcp: fix syncookie regression
usb: asix: Patch for Sitecom LN-031 -
Pull arch/tile update from Chris Metcalf
"These include a couple of queued-up minor bug fixes from the
community, a fix to unbreak the sysfs hooks in tile, and syncing up
the defconfigs."Ugh. defconfigs updates without "make minconfig". Tons of ugly
pointless lines there, I suspect.* 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
tile: Use set_current_blocked() and block_sigmask()
arch/tile: misplaced parens near likely
arch/tile: sync up the defconfig files to the tip
arch/tile: Fix up from commit 8a25a2fd126c621f44f3aeaef80d51f00fc11639 -
Pull perf fixes from Ingo Molnar.
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf record: Fix buffer overrun bug in tracepoint_id_to_path()
perf/x86: Fix local vs remote memory events for NHM/WSM -
Pull CIFS fixes from Steve French.
* git://git.samba.org/sfrench/cifs-2.6:
CIFS: Do not kmalloc under the flocks spinlock
cifs: possible memory leak in xattr. -
Pull vfs fixes from Al Viro:
"A bunch of assorted fixes; Jan's freezing stuff still _not_ in there
and neither is mm fun ;-/"* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
restore smp_mb() in unlock_new_inode()
vfs: fix return value from do_last()
vfs: fix double put after complete_walk()
udf: Fix deadlock in udf_release_file()
vfs: Correctly set the dir i_mutex lockdep class -
As described in e6fa16ab ("signal: sigprocmask() should do
retarget_shared_pending()") the modification of current->blocked is
incorrect as we need to check whether the signal we're about to block
is pending in the shared queue.Also, use the new helper function introduced in commit 5e6292c0f28f
("signal: add block_sigmask() for adding sigmask to current->blocked")
which centralises the code for updating current->blocked after
successfully delivering a signal and reduces the amount of duplicate
code across architectures. In the past some architectures got this
code wrong, so using this helper function should stop that from
happening again.Cc: Arnd Bergmann
Acked-by: Oleg Nesterov
Signed-off-by: Matt Fleming
Signed-off-by: Chris Metcalf -
…wireless into for-davem
-
This patch fixes a buffer overrun bug in
tracepoint_id_to_path(). The bug manisfested itself as a memory
error reported by perf record. I ran into it with perf sched:$ perf sched rec noploop 2 noploop for 2 seconds
[ perf record: Woken up 14 times to write data ]
[ perf record: Captured and wrote 42.701 MB perf.data (~1865622 samples) ]
Fatal: No memory to alloc tracepoints listIt turned out that tracepoint_id_to_path() was reading the
tracepoint id using read() but the buffer was not large enough
to include the \n terminator for id with 4 digits or more.The patch fixes the problem by extending the buffer to a more
reasonable size covering all possible id length include \n
terminator. Note that atoll() stops at the first non digit
character, thus it is not necessary to clear the buffer between
each read.Signed-off-by: Stephane Eranian
Acked-by: Arnaldo Carvalho de Melo
Acked-by: Peter Zijlstra
Cc: fweisbec@gmail.com
Cc: dsahern@gmail.com
Link: http://lkml.kernel.org/r/20120313155102.GA6465@quad
Signed-off-by: Ingo Molnar
13 Mar, 2012
15 commits
-
Pull x86 platfrm driver fixes from Matthew Garrett:
"Some trivial patches that fix wifi on some Lenovos and avoid a
potential memory corruption issue on some Panasonics, plus two
straightforward new drivers that touch no existing code."* 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86:
panasonic-laptop: avoid overflow in acpi_pcc_hotkey_add()
acer-wmi: No wifi rfkill on Lenovo machines
Fujitsu tablet extras driver
x86: Add amilo-rfkill driver for some Fujitsu-Siemens Amilo laptops -
Pull PCI changes from Jesse Barnes:
"A single fix for a regression that affects some people who try to
disable ASPM for whatever reason."* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci:
PCI: ignore pre-1.1 ASPM quirking when ASPM is disabled -
Pull SuperH fixes from Paul Mundt.
* tag 'sh-for-linus' of git://github.com/pmundt/linux-sh:
sh-sci / PM: Avoid deadlocking runtime PM
sh: fix up the ubc clock definition for sh7785.
sh: add parameter for RSPI in clock-sh7757
sh: Fix sh2a vbr table for more than 255 irqs -
Pull SH/R-Mobile fixes from Paul Mundt.
* tag 'rmobile-for-linus' of git://github.com/pmundt/linux-sh:
ARM: mach-shmobile: ap4evb: fixup fsi2_ak4643_info typo
ARM: mach-shmobile: mackerel: Reserve DMA memory for the frame buffer
ARM: mach-shmobile: Fix ag5evm compilation by including linux/videodev2.h
ARM: mach-shmobile: Fix bonito compile breakage -
v3: added previously removed sock_put() to the tun_release() callback, because
sk_release_kernel() doesn't drop the socket reference.v2: sk_release_kernel() used for socket release. Dummy tun_release() is
required for sk_release_kernel() ---> sock_release() ---> sock->ops->release()
call.TUN was designed to destroy it's socket on network namesapce shutdown. But this
will never happen for persistent device, because it's socket holds network
namespace.
This patch removes of holding network namespace by TUN socket and replaces it
by creating socket in init_net and then changing it's net it to desired one. On
shutdown socket is moved back to init_net prior to final put.Signed-off-by: Stanislav Kinsbursky
Signed-off-by: David S. Miller -
FCoE statistics ids were distinguished from the L2's statistics ids.
However, not all of the change was committed. This causes a possible
collision of indices when FCoE is present.This patch fixes the issue.
Signed-off-by: Yuval Mintz
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
DCB flags were updated using the flags' bit offsets instead of
the actual bits. This is now fixed.Signed-off-by: Yuval Mintz
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Fixed endianess issue when passing arguments to FW.
Signed-off-by: Ariel Elior
Signed-off-by: Yuval Mintz
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
When pfc statistics were counted, the delta change from last count
was summed twice. This fixes the issue.Signed-off-by: Yuval Mintz
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Verified using the below proglet.. before:
[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0
remote writePerformance counter stats for './numa 0':
2,101,554 node-stores
2,096,931 node-store-misses5.021546079 seconds time elapsed
[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1
local writePerformance counter stats for './numa 1':
501,137 node-stores
199 node-store-misses5.124451068 seconds time elapsed
After:
[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0
remote writePerformance counter stats for './numa 0':
2,107,516 node-stores
2,097,187 node-store-misses5.012755149 seconds time elapsed
[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1
local writePerformance counter stats for './numa 1':
2,063,355 node-stores
165 node-store-misses5.082091494 seconds time elapsed
#define _GNU_SOURCE
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include#define SIZE (32*1024*1024)
volatile int done;
void sig_done(int sig)
{
done = 1;
}int main(int argc, char **argv)
{
cpu_set_t *mask, *mask2;
size_t size;
int i, err, t;
int nrcpus = 1024;
char *mem;
unsigned long nodemask = 0x01; /* node 0 */
DIR *node;
struct dirent *de;
int read = 0;
int local = 0;if (argc < 2) {
printf("usage: %s [0-3]\n", argv[0]);
printf(" bit0 - local/remote\n");
printf(" bit1 - read/write\n");
exit(0);
}switch (atoi(argv[1])) {
case 0:
printf("remote write\n");
break;
case 1:
printf("local write\n");
local = 1;
break;
case 2:
printf("remote read\n");
read = 1;
break;
case 3:
printf("local read\n");
local = 1;
read = 1;
break;
}mask = CPU_ALLOC(nrcpus);
size = CPU_ALLOC_SIZE(nrcpus);
CPU_ZERO_S(size, mask);node = opendir("/sys/devices/system/node/node0/");
if (!node)
perror("opendir");
while ((de = readdir(node))) {
int cpu;if (sscanf(de->d_name, "cpu%d", &cpu) == 1)
CPU_SET_S(cpu, size, mask);
}
closedir(node);mask2 = CPU_ALLOC(nrcpus);
CPU_ZERO_S(size, mask2);
for (i = 0; i < size; i++)
CPU_SET_S(i, size, mask2);
CPU_XOR_S(size, mask2, mask2, mask); // invertif (!local)
mask = mask2;err = sched_setaffinity(0, size, mask);
if (err)
perror("sched_setaffinity");mem = mmap(0, SIZE, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
err = mbind(mem, SIZE, MPOL_BIND, &nodemask, 8*sizeof(nodemask), MPOL_MF_MOVE);
if (err)
perror("mbind");signal(SIGALRM, sig_done);
alarm(5);if (!read) {
while (!done) {
for (i = 0; i < SIZE; i++)
mem[i] = 0x01;
}
} else {
while (!done) {
for (i = 0; i < SIZE; i++)
t += *(volatile char *)(mem + i);
}
}return 0;
}Signed-off-by: Peter Zijlstra
Cc: Stephane Eranian
Cc:
Link: http://lkml.kernel.org/n/tip-tq73sxus35xmqpojf7ootxgs@git.kernel.org
Signed-off-by: Ingo Molnar -
Parentheses were missing.
Signed-off-by: Roel Kluin
Signed-off-by: Chris Metcalf -
This was inspired by mchehab@redhat.com's observation that we
didn't have EDAC configured on by default in both files. In addition,
we were setting INITRAMFS_SOURCE to a non-empty string, which isn't
a very common default and required editing to do test builds.Signed-off-by: Chris Metcalf
-
This was Kay Siever's bombing to convert 'cpu' to a regular subsystem.
The change left a bogus second argument to sysfs_create_file().Signed-off-by: Chris Metcalf
-
Is possible that we stop queue and then do not wake up it again,
especially when packets are transmitted fast. That can be easily
reproduced with modified tx queue entry_num to some small value e.g. 16.If mac80211 already hold local->queue_stop_reason_lock, then we can wait
on that lock in both rt2x00queue_pause_queue() and
rt2x00queue_unpause_queue(). After drooping ->queue_stop_reason_lock
is possible that __ieee80211_wake_queue() will be performed before
__ieee80211_stop_queue(), hence we stop queue and newer wake up it
again.Another race condition is possible when between rt2x00queue_threshold()
check and rt2x00queue_pause_queue() we will process all pending tx
buffers on different cpu. This might happen if for example interrupt
will be triggered on cpu performing rt2x00mac_tx().To prevent race conditions serialize pause/unpause by queue->tx_lock.
Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka
Acked-by: Gertjan van Wingerde
Signed-off-by: John W. Linville -
On il3945_down procedure we free tx queue data and nullify il->txq
pointer. After that we drop mutex and then cancel delayed works. There
is possibility, that after drooping mutex and before the cancel, some
delayed work will start and crash while trying to send commands to
the device. For example, here is reported crash in
il3945_bg_reg_txpower_periodic():
https://bugzilla.kernel.org/show_bug.cgi?id=42766#c10Patch fix problem by adding il->txq check on works that send commands,
hence utilize tx queue.Reported-by: Clemens Eisserer
Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka
Signed-off-by: John W. Linville
12 Mar, 2012
1 commit
-
num_sifr could go negative since acpi_pcc_get_sqty() returns -EINVAL
on error. Then it could bypass the sanity check (num_sifr > 255).
The subsequent call to kzalloc() would allocate a small buffer, leading
to a memory corruption.Signed-off-by: Xi Wang
Signed-off-by: Matthew Garrett
