23 Aug, 2012

5 commits

  • Pull drm fixes from Dave Airlie:
    "Intel: edid fixes, power consumption fix, s/r fix, haswell fix

    Radeon: BIOS loading fixes for UEFI and Thunderbolt machines, better
    MSAA validation, lockup timeout fixes, modesetting fixes

    One udl dpms fix, one vmwgfx fix, a couple of trivial core changes.

    There is an export added to ACPI as part of the radeon bios fixes.

    I've also included the fbcon flashing cursor vs deinit race fix, that
    seems the simplest place to start"

    Trivial conflict in drivers/video/console/fbcon.c due to me having
    already applied the fbcon flashing cursor vs deinit race fix, and Dave
    had added a comment in there too.

    * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (22 commits)
    fbcon: fix race condition between console lock and cursor timer (v1.1)
    drm: Add missing static storage class specifiers in drm_proc.c file
    drm/udl: dpms off the crtc when disabled.
    drm: Remove two unused fields from struct drm_display_mode
    drm: stop vmgfx driver explosion
    drm/radeon/ss: use num_crtc rather than hardcoded 6
    Revert "drm/radeon: fix bo creation retry path"
    drm/i915: use hsw rps tuning values everywhere on gen6+
    drm/radeon: split ATRM support out from the ATPX handler (v3)
    drm/radeon: convert radeon vfct code to use acpi_get_table_with_size
    ACPI: export symbol acpi_get_table_with_size
    drm/radeon: implement ACPI VFCT vbios fetch (v3)
    drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping
    drm/radeon: fix checking of MSAA renderbuffers on r600-r700
    drm/radeon: allow CMASK and FMASK in the CS checker on r600-r700
    drm/radeon: init lockup timeout on ring init
    drm/radeon: avoid turning off spread spectrum for used pll
    drm/i915: fall back to bit-banging if GMBUS fails in CRT EDID reads
    drm/i915: extract connector update from intel_ddc_get_modes() for reuse
    drm/i915: fix hsw uncached pte
    ...

    Linus Torvalds
     
  • Pull SCSI target fixes from Nicholas Bellinger:
    "The executive summary includes:

    - Post-merge review comments for tcm_vhost (MST + nab)
    - Avoid debugging overhead when not debugging for tcm-fc(FCoE) (MDR)
    - Fix NULL pointer dereference bug on alloc_page failulre (Yi Zou)
    - Fix REPORT_LUNs regression bug with pSCSI export (AlexE + nab)
    - Fix regression bug with handling of zero-length data CDBs (nab)
    - Fix vhost_scsi_target structure alignment (MST)

    Thanks again to everyone who contributed a bugfix patch, gave review
    feedback on tcm_vhost code, and/or reported a bug during their own
    testing over the last weeks.

    There is one other outstanding bug reported by Roland recently related
    to SCSI transfer length overflow handling, for which the current
    proposed bugfix has been left in queue pending further testing with
    other non iscsi-target based fabric drivers.

    As the patch is verified with loopback (local SGL memory from SCSI
    LLD) + tcm_qla2xxx (TCM allocated SGL memory mapped to PCI HW) fabric
    ports, it will be included into the next 3.6-rc-fixes PULL request."

    * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
    target: Remove unused se_cmd.cmd_spdtl
    tcm_fc: rcu_deref outside rcu lock/unlock section
    tcm_vhost: Fix vhost_scsi_target structure alignment
    target: Fix regression bug with handling of zero-length data CDBs
    target/pscsi: Fix bug with REPORT_LUNs handling for SCSI passthrough
    tcm_vhost: Change vhost_scsi_target->vhost_wwpn to char *
    target: fix NULL pointer dereference bug alloc_page() fails to get memory
    tcm_fc: Avoid debug overhead when not debugging
    tcm_vhost: Post-merge review changes requested by MST
    tcm_vhost: Fix incorrect IS_ERR() usage in vhost_scsi_map_iov_to_sgl

    Linus Torvalds
     
  • Pull i2c-embedded fixes from Wolfram Sang:
    "Some bugfixes for the "embedded" part of the I2C subsystem. The fixes
    affect mostly drivers which have been largely reworked lately and
    where regressions appeared."

    * 'i2c-embedded/for-current' of git://git.pengutronix.de/git/wsa/linux:
    i2c: tegra: protect suspend/resume callbacks with CONFIG_PM_SLEEP
    i2c: diolan-u2c: Fix master_xfer return code
    I2C: OMAP: xfer: fix runtime PM get/put balance on error
    i2c: nomadik: Add default configuration into the Nomadik I2C driver

    Linus Torvalds
     
  • Pull pwm fixes from Thierry Reding:
    "These patches fix the Samsung PWM driver and perform some minor
    cleanups like fixing checkpatch and sparse warnings.

    Two redundant error messages are removed and the Kconfig help text for
    the PWM subsystem is made more descriptive."

    * tag 'for-3.6-rc3' of git://gitorious.org/linux-pwm/linux-pwm:
    pwm: Improve Kconfig help text
    pwm: core: Fix coding style issues
    pwm: vt8500: Fix coding style issue
    pwm: Remove a redundant error message when devm_request_and_ioremap fails
    pwm: samsung: add missing device pointer to struct pwm_chip
    pwm: Add missing static storage class specifiers in core.c file

    Linus Torvalds
     
  • Pull assorted fixes - mostly vfs - from Al Viro:
    "Assorted fixes, with an unexpected detour into vfio refcounting logics
    (fell out when digging in an analog of eventpoll race in there)."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
    task_work: add a scheduling point in task_work_run()
    fs: fix fs/namei.c kernel-doc warnings
    eventpoll: use-after-possible-free in epoll_create1()
    vfio: grab vfio_device reference *before* exposing the sucker via fd_install()
    vfio: get rid of vfio_device_put()/vfio_group_get_device* races
    vfio: get rid of open-coding kref_put_mutex
    introduce kref_put_mutex()
    vfio: don't dereference after kfree...
    mqueue: lift mnt_want_write() outside ->i_mutex, clean up a bit

    Linus Torvalds
     

22 Aug, 2012

25 commits

  • It's not critical (anymore) since another thread closing the file will block
    on ->device_lock before it gets to dropping the final reference, but it's
    definitely cleaner that way...

    Acked-by: Alex Williamson
    Signed-off-by: Al Viro

    Al Viro
     
  • we really need to make sure that dropping the last reference happens
    under the group->device_lock; otherwise a loop (under device_lock)
    might find vfio_device instance that is being freed right now, has
    already dropped the last reference and waits on device_lock to exclude
    the sucker from the list.

    Acked-by: Alex Williamson
    Signed-off-by: Al Viro

    Al Viro
     
  • Acked-by: Alex Williamson
    Signed-off-by: Al Viro

    Al Viro
     
  • Acked-by: Alex Williamson
    Signed-off-by: Al Viro

    Al Viro
     
  • So we've had a fair few reports of fbcon handover breakage between
    efi/vesafb and i915 surface recently, so I dedicated a couple of
    days to finding the problem.

    Essentially the last thing we saw was the conflicting framebuffer
    message and that was all.

    So after much tracing with direct netconsole writes (printks
    under console_lock not so useful), I think I found the race.

    Thread A (driver load) Thread B (timer thread)
    unbind_con_driver -> |
    bind_con_driver -> |
    vc->vc_sw->con_deinit -> |
    fbcon_deinit -> |
    console_lock() |
    | |
    | fbcon_flashcursor timer fires
    | console_lock()
    del_timer_sync
    (BOOM)

    Of course because all of this is under the console lock,
    we never see anything, also since we also just unbound the active
    console guess what we never see anything.

    Hopefully this fixes the problem for anyone seeing vesafb->kms
    driver handoff.

    v1.1: add comment suggestion from Alan.

    Cc: stable@vger.kernel.org
    Signed-off-by: Dave Airlie

    Dave Airlie
     
  • Merge fixes from Andrew Morton.

    Random drivers and some VM fixes.

    * emailed patches from Andrew Morton : (17 commits)
    mm: compaction: Abort async compaction if locks are contended or taking too long
    mm: have order > 0 compaction start near a pageblock with free pages
    rapidio/tsi721: fix unused variable compiler warning
    rapidio/tsi721: fix inbound doorbell interrupt handling
    drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode
    mm: correct page->pfmemalloc to fix deactivate_slab regression
    drivers/rtc/rtc-pcf2123.c: initialize dynamic sysfs attributes
    mm/compaction.c: fix deferring compaction mistake
    drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources
    string: do not export memweight() to userspace
    hugetlb: update hugetlbpage.txt
    checkpatch: add control statement test to SINGLE_STATEMENT_DO_WHILE_MACRO
    mm: hugetlbfs: correctly populate shared pmd
    cciss: fix incorrect scsi status reporting
    Documentation: update mount option in filesystem/vfat.txt
    mm: change nr_ptes BUG_ON to WARN_ON
    cs5535-clockevt: typo, it's MFGPT, not MFPGT

    Linus Torvalds
     
  • Pull media fixes from Mauro Carvalho Chehab:
    "For bug fixes, at soc_camera, si470x, uvcvideo, iguanaworks IR driver,
    radio_shark Kbuild fixes, and at the V4L2 core (radio fixes)."

    * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
    [media] media: soc_camera: don't clear pix->sizeimage in JPEG mode
    [media] media: mx2_camera: Fix clock handling for i.MX27
    [media] video: mx2_camera: Use clk_prepare_enable/clk_disable_unprepare
    [media] video: mx1_camera: Use clk_prepare_enable/clk_disable_unprepare
    [media] media: mx3_camera: buf_init() add buffer state check
    [media] radio-shark2: Only compile led support when CONFIG_LED_CLASS is set
    [media] radio-shark: Only compile led support when CONFIG_LED_CLASS is set
    [media] radio-shark*: Call cancel_work_sync from disconnect rather then release
    [media] radio-shark*: Remove work-around for dangling pointer in usb intfdata
    [media] Add USB dependency for IguanaWorks USB IR Transceiver
    [media] Add missing logging for rangelow/high of hwseek
    [media] VIDIOC_ENUM_FREQ_BANDS fix
    [media] mem2mem_testdev: fix querycap regression
    [media] si470x: v4l2-compliance fixes
    [media] DocBook: Remove a spurious character
    [media] uvcvideo: Reset the bytesused field when recycling an erroneous buffer

    Linus Torvalds
     
  • Pull networking update from David Miller:
    "A couple weeks of bug fixing in there. The largest chunk is all the
    broken crap Amerigo Wang found in the netpoll layer."

    1) netpoll and it's users has several serious bugs:
    a) uses GFP_KERNEL with locks held
    b) interfaces requiring interrupts disabled are called with them
    enabled
    c) and vice versa
    d) VLAN tag demuxing, as per all other RX packet input paths, is not
    applied

    All from Amerigo Wang.

    2) Hopefully cure the ipv4 mapped ipv6 address TCP early demux bugs for
    good, from Neal Cardwell.

    3) Unlike AF_UNIX, AF_PACKET sockets don't set a default credentials
    when the user doesn't specify one explicitly during sendmsg().
    Instead we attach an empty (zero) SCM credential block which is
    definitely not what we want. Fix from Eric Dumazet.

    4) IPv6 illegally invokes netdevice notifiers with RCU lock held, fix
    from Ben Hutchings.

    5) inet_csk_route_child_sock() checks wrong inet options pointer, fix
    from Christoph Paasch.

    6) When AF_PACKET is used for transmit, packet loopback doesn't behave
    properly when a socket fanout is enabled, from Eric Leblond.

    7) On bluetooth l2cap channel create failure, we leak the socket, from
    Jaganath Kanakkassery.

    8) Fix all the netprio file handling bugs found by Al Viro, from John
    Fastabend.

    9) Several error return and NULL deref bug fixes in networking drivers
    from Julia Lawall.

    10) A large smattering of struct padding et al. kernel memory leaks to
    userspace found of Mathias Krause.

    11) Conntrack expections in netfilter can access an uninitialized timer,
    fix from Pablo Neira Ayuso.

    12) Several netfilter SIP tracker bug fixes from Patrick McHardy.

    13) IPSEC ipv6 routes are not initialized correctly all the time,
    resulting in an OOPS in inet_putpeer(). Also from Patrick McHardy.

    14) Bridging does rcu_dereference() outside of RCU protected area, from
    Stephen Hemminger.

    15) Fix routing cache removal performance regression when looking up
    output routes that have a local destination. From Zheng Yan.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (87 commits)
    af_netlink: force credentials passing [CVE-2012-3520]
    ipv4: fix ip header ident selection in __ip_make_skb()
    ipv4: Use newinet->inet_opt in inet_csk_route_child_sock()
    tcp: fix possible socket refcount problem
    net: tcp: move sk_rx_dst_set call after tcp_create_openreq_child()
    net/core/dev.c: fix kernel-doc warning
    netconsole: remove a redundant netconsole_target_put()
    net: ipv6: fix oops in inet_putpeer()
    net/stmmac: fix issue of clk_get for Loongson1B.
    caif: Do not dereference NULL in chnl_recv_cb()
    af_packet: don't emit packet on orig fanout group
    drivers/net/irda: fix error return code
    drivers/net/wan/dscc4.c: fix error return code
    drivers/net/wimax/i2400m/fw.c: fix error return code
    smsc75xx: add missing entry to MAINTAINERS
    net: qmi_wwan: new devices: UML290 and K5006-Z
    net: sh_eth: Add eth support for R8A7779 device
    netdev/phy: skip disabled mdio-mux nodes
    dt: introduce for_each_available_child_of_node, of_get_next_available_child
    net: netprio: fix cgrp create and write priomap race
    ...

    Linus Torvalds
     
  • Fix unused variable compiler warning when built with CONFIG_RAPIDIO_DEBUG
    option off.

    This patch is applicable to kernel versions starting from v3.2

    Signed-off-by: Alexandre Bounine
    Cc: Matt Porter
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexandre Bounine
     
  • Make sure that there is no doorbell messages left behind due to disabled
    interrupts during inbound doorbell processing.

    The most common case for this bug is loss of rionet JOIN messages in
    systems with three or more rionet participants and MSI or MSI-X enabled.
    As result, requests for packet transfers may finish with "destination
    unreachable" error message.

    This patch is applicable to kernel versions starting from v3.2.

    Signed-off-by: Alexandre Bounine
    Cc: Matt Porter
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexandre Bounine
     
  • Correct the offset by subtracting 20 from tm_hour before taking the
    modulo 12.

    [ "Why 20?" I hear you ask. Or at least I did.

    Here's the reason why: RS5C348_BIT_PM is 32, and is - stupidly -
    included in the RS5C348_HOURS_MASK define. So it's really subtracting
    out that bit to get "hour+12". But then because it does things modulo
    12, it needs to add the 12 in again afterwards anyway.

    This code is confused. It would be much clearer if RS5C348_HOURS_MASK
    just didn't include the RS5C348_BIT_PM bit at all, then it wouldn't
    need to do the silly subtract either.

    Whatever. It's all just math, the end result is the same. - Linus ]

    Reported-by: James Nute
    Tested-by: James Nute
    Signed-off-by: Atsushi Nemoto
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Atsushi Nemoto
     
  • Dynamically allocated sysfs attributes must be initialized using
    sysfs_attr_init(), otherwise lockdep complains: BUG: key

    not in
    .data!

    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Ilya Shchepetkov
    Cc: Chris Verges
    Cc: Christian Pellegrin
    Cc: Alessandro Zummo
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Ilya Shchepetkov
     
  • On many of our larger systems, CPU 0 has had all of its IRQ resources
    consumed before XPC loads. Worst cases on machines with multiple 10
    GigE cards and multiple IB cards have depleted the entire first socket
    of IRQs.

    This patch makes selecting the node upon which IRQs are allocated (as
    well as all the other GRU Message Queue structures) specifiable as a
    module load param and has a default behavior of searching all nodes/cpus
    for an available resources.

    [akpm@linux-foundation.org: fix build: include cpu.h and module.h]
    Signed-off-by: Robin Holt
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Robin Holt
     
  • Delete code which sets SCSI status incorrectly as it's already been set
    correctly above this incorrect code. The bug was introduced in 2009 by
    commit b0e15f6db111 ("cciss: fix typo that causes scsi status to be
    lost.")

    Signed-off-by: Stephen M. Cameron
    Reported-by: Roel van Meer
    Tested-by: Roel van Meer
    Cc: Jens Axboe
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen M. Cameron
     
  • Signed-off-by: Jens Rottmann
    Cc: Thomas Gleixner
    Cc: John Stultz
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jens Rottmann
     
  • Fixes the following sparse warning:
    drivers/gpu/drm/drm_proc.c:92:5:
    warning: symbol 'drm_proc_create_files' was not declared. Should it be static?
    drivers/gpu/drm/drm_proc.c:175:5:
    warning: symbol 'drm_proc_remove_files' was not declared. Should it be static?

    Signed-off-by: Sachin Kamat
    Signed-off-by: Dave Airlie

    Sachin Kamat
     
  • This turns off the crtc when its been disabled,
    fixes it not turning off properly the whole time.

    Signed-off-by: Dave Airlie
    Reviewed-by: Alex Deucher

    Dave Airlie
     
  • Signed-off-by: Damien Lespiau
    Reviewed-by: Jani Nikula
    Signed-off-by: Dave Airlie

    Damien Lespiau
     
  • If you do a page flip with no flags set then event is NULL. If event is
    NULL then the vmw_gfx driver likes to go digging into NULL and extracts
    NULL->base.file_priv.

    On a modern kernel with NULL mapping protection it's just another oops,
    without it there are some "intriguing" possibilities.

    What it should do is an open question but that for the driver owners to
    sort out.

    Signed-off-by: Alan Cox
    Reviewed-by: Jakob Bornecrantz
    Cc: stable@vger.kernel.org
    Signed-off-by: Dave Airlie

    Alan Cox
     
  • Daniel writes:

    " Nothing too major:
    - A few fixes around the edid handling from Jani, also fixing a regression
    in 3.5 due to us using gmbus by default.
    - Fixup hsw uncached pte flags.
    - Fix suspend/resume crash when using hw contexts, from Ben.
    - Try to tune gpu turbo a bit better, seems to help with some oddball
    power regressions."

    * 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel:
    drm/i915: use hsw rps tuning values everywhere on gen6+
    drm/i915: fall back to bit-banging if GMBUS fails in CRT EDID reads
    drm/i915: extract connector update from intel_ddc_get_modes() for reuse
    drm/i915: fix hsw uncached pte
    drm/i915/contexts: fix list corruption
    drm/i915: fix EDID memory leak in SDVO

    Dave Airlie
     
  • Alex writes:

    "This is the current set of radeon fixes for 3.6. Nothing too major.

    Highlights:
    - fix vbios fetch on pure uefi systems
    - fix vbios fetch on thunderbolt systems
    - MSAA fixes
    - lockup timeout fix
    - modesetting fix"

    * 'drm-fixes-3.6' of git://people.freedesktop.org/~agd5f/linux:
    drm/radeon/ss: use num_crtc rather than hardcoded 6
    Revert "drm/radeon: fix bo creation retry path"
    drm/radeon: split ATRM support out from the ATPX handler (v3)
    drm/radeon: convert radeon vfct code to use acpi_get_table_with_size
    ACPI: export symbol acpi_get_table_with_size
    drm/radeon: implement ACPI VFCT vbios fetch (v3)
    drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping
    drm/radeon: fix checking of MSAA renderbuffers on r600-r700
    drm/radeon: allow CMASK and FMASK in the CS checker on r600-r700
    drm/radeon: init lockup timeout on ring init
    drm/radeon: avoid turning off spread spectrum for used pll

    Dave Airlie
     
  • When checking if a pll is in use.

    Signed-off-by: Alex Deucher
    Cc: stable@vger.kernel.org

    Alex Deucher
     
  • This was originally for helping fabrics to determine overflow/underflow
    status, and has been superceeded by SCF_OVERFLOW_BIT + SCF_UNDERFLOW_BIT.

    Signed-off-by: Roland Dreier
    Signed-off-by: Nicholas Bellinger

    Roland Dreier
     
  • …git/linusw/linux-pinctrl

    Pull pin control fixes from Linus Walleij:
    - Fixed Nomadik errorpath
    - Fixed documentation spelling errors
    - Forward-declare struct device in a header file
    - Remove some extraneous code lines when getting pinctrl states
    - Correct the i.MX51 configure register number
    - Fix the Nomadik keypad function group list

    * tag 'pinctrl-fixes-v3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
    pinctrl/nomadik: add kp_b_2 keyboard function group list
    pinctrl: imx51: fix .conf_reg of MX51_PAD_SD2_CMD__CSPI_MOSI
    trivial: pinctrl core: remove extraneous code lines
    pinctrl: header: trivial: declare struct device
    Documentation/pinctrl.txt: Fix some misspelled macros
    pinctrl/nomadik: fix null in irqdomain errorpath

    Linus Torvalds
     
  • So we've had a fair few reports of fbcon handover breakage between
    efi/vesafb and i915 surface recently, so I dedicated a couple of
    days to finding the problem.

    Essentially the last thing we saw was the conflicting framebuffer
    message and that was all.

    So after much tracing with direct netconsole writes (printks
    under console_lock not so useful), I think I found the race.

    Thread A (driver load) Thread B (timer thread)
    unbind_con_driver -> |
    bind_con_driver -> |
    vc->vc_sw->con_deinit -> |
    fbcon_deinit -> |
    console_lock() |
    | |
    | fbcon_flashcursor timer fires
    | console_lock()
    del_timer_sync
    (BOOM)

    Of course because all of this is under the console lock,
    we never see anything, also since we also just unbound the active
    console guess what we never see anything.

    Hopefully this fixes the problem for anyone seeing vesafb->kms
    driver handoff.

    Signed-off-by: David Airlie
    Acked-by: Alan Cox
    Cc: stable@vger.kernel.org
    Tested-by: Josh Boyer
    Signed-off-by: Linus Torvalds

    Dave Airlie
     

21 Aug, 2012

10 commits

  • This reverts commit d1c7871ddb1f588b8eb35affd9ee1a3d5e11cd0c.

    ttm_bo_init() destroys the BO on failure. So this patch makes
    the retry path work with freed memory. This ends up causing
    kernel panics when this path is hit.

    Signed-off-by: Alex Deucher
    Cc: stable@vger.kernel.org

    Alex Deucher
     
  • Pull PCI fixes from Bjorn Helgaas:
    "Here are two patches from Rafael Wysocki.

    One fixes an EHCI-related hibernation crash on ASUS boxes. We fixed a
    similar suspend issue in v3.6-rc1, and this applies the same fix to
    the hibernate path.

    The other fixes D3/D3cold/D4 messages related to the D3cold support we
    merged in v3.6-rc1."

    (Removed redundant top non-fast-forward merge commit from pulled branch)

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
    PCI: EHCI: Fix crash during hibernation on ASUS computers
    PCI / PM: Fix D3/D3cold/D4 messages printed by acpi_pci_set_power_state()

    Linus Torvalds
     
  • Use rcu_dereference_protected in order to prevent lockdep
    complaint. Sequel of the patch 863555be

    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Denis Efremov
    Acked-by: Mark D. Rustad
    Signed-off-by: Nicholas Bellinger

    Denis Efremov
     
  • Here TRANSPORT_IQN_LEN is 224, which is a multiple of 4.
    Since vhost_tpgt is 2 bytes and abi_version is 4, the total size would
    be 230. But gcc needs struct size be aligned to first field size, which
    is 4 bytes, so it pads the structure by extra 2 bytes to the total of
    232.

    This padding is very undesirable in an ABI:
    - it can not be initialized easily
    - it can not be checked easily
    - it can leak information between kernel and userspace

    Simplest solution is probably just to make the padding
    explicit.

    (v2: Add check for zero'ed backend->reserved field for VHOST_SCSI_SET_ENDPOINT
    and VHOST_SCSI_CLEAR_ENDPOINT ops as requested by MST)

    Reported-by: Michael S. Tsirkin
    Signed-off-by: Michael S. Tsirkin
    Signed-off-by: Nicholas Bellinger

    Michael S. Tsirkin
     
  • Pull more USB patches from Greg Kroah-Hartman:
    "Here are 10 more USB patches for 3.6-rc3. They all fix reported
    problems (build problems for one of them, and easily repeatable oopses
    for the others.)

    Signed-off-by: Greg Kroah-Hartman "

    * tag 'usb-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
    gpu/mfd/usb: Fix USB randconfig problems
    USB: CDC ACM: Fix NULL pointer dereference
    USB: emi62: remove __devinit* from the struct usb_device_id table
    USB: winbond: remove __devinit* from the struct usb_device_id table
    USB: vt6656: remove __devinit* from the struct usb_device_id table
    USB: rtl8187: remove __devinit* from the struct usb_device_id table
    USB: p54usb: remove __devinit* from the struct usb_device_id table
    USB: spca506: remove __devinit* from the struct usb_device_id table
    USB: jl2005bcd: remove __devinit* from the struct usb_device_id table
    USB: smsusb: remove __devinit* from the struct usb_device_id table

    Linus Torvalds
     
  • Pull one more driver core fix from Greg Kroah-Hartman:
    "Here is one fix for the dmesg line corruption problem that the
    previous set of patches caused.

    Signed-off-by: Greg Kroah-Hartman "

    * tag 'driver-core-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
    dyndbg: fix for SOH in logging messages

    Linus Torvalds
     
  • Pull x86 platform driver update from Matthew Garrett:
    "Some small updates for a few drivers, and some hardware enablement for
    new Ideapads and the gmux hardware in the latest Macs.

    This code won't run on older devices and has been well tested on new
    ones, so low risk of regressions."

    * 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86:
    ideapad: add Lenovo IdeaPad Z570 support (part 3)
    ideapad: add Lenovo IdeaPad Z570 support (part 2)
    ideapad: add Lenovo IdeaPad Z570 support (part 1)
    classmate-laptop: always call input_sync() after input_report_switch()
    thinkpad-acpi: recognize latest V-Series using DMI_BIOS_VENDOR
    dell-laptop: Fixed typo in touchpad LED quirk
    vga_switcheroo: Don't require handler init callback
    vga_switcheroo: Remove assumptions about registration/unregistration ordering
    apple-gmux: Add display mux support
    apple-gmux: Fix kconfig dependencies
    asus-wmi: record wlan status while controlled by userapp
    apple_gmux: Fix ACPI video unregister
    apple_gmux: Add support for newer hardware
    gmux: Add generic write32 function

    Linus Torvalds
     
  • Pull a hwmon fix from Guenter Roeck:
    "One patch with section conflict fixes."

    * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
    sections: Fix section conflicts in drivers/hwmon

    Linus Torvalds
     
  • Pull spi fixes from Mark Brown:
    "Grant is still away so another pull request with some fairly minor
    fixes, the most notable of which are several fixes for some common
    error patterns with the reference counting spi_master_get/put do."

    * tag 'spi-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/misc:
    spi/coldfire-qspi: Drop extra calls to spi_master_get in suspend/resume functions
    spi: spi-coldfire-qspi: Drop extra spi_master_put in device remove function
    spi/pl022: fix spi-pl022 pm enable at probe
    spi/bcm63xx: Ensure that memory is freed only after it is no longer used
    spi: omap2-mcspi: Fix the error handling in probe
    spi/s3c64xx: Add missing static storage class specifiers

    Linus Torvalds
     
  • Pull regulator fixes from Mark Brown:
    "A bunch of fixes which are a combination of minor fixes that have been
    shaken down due to greater testing exposure, the biggest block of
    which are for the Palmas driver which hadn't had all the changes
    required for mainline properly tested when it was merged."

    * tag 'regulator-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
    regulator: twl-regulator: fix up VINTANA1/VINTANA2
    regulator: core: request only valid gpio pins for regulator enable
    regulator: twl: Remove references to the twl4030 regulator
    regulator: gpio-regulator: Split setting of voltages and currents
    regulator: ab3100: add missing voltage table
    regulator: anatop: Fix wrong mask used in anatop_get_voltage_sel
    regulator: tps6586x: correct vin pin for sm0/sm1/sm2
    regulator: palmas: Fix palmas_probe error handling
    regulator: palmas: Call palmas_ldo_[read|write] in palmas_ldo_init
    regulator: palmas: Fix regmap offsets for PALMAS_REG_SMPS10 vsel_reg
    regulator: palmas: Fix calculating selector in palmas_map_voltage_ldo

    Linus Torvalds