26 Feb, 2012

4 commits

  • Linus Torvalds
     
  • Couple of minor driver fixes.

    * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
    hwmon: (max34440) Fix resetting temperature history
    hwmon: (f75375s) Fix register write order when setting fans to full speed
    hwmon: (ads1015) Fix file leak in probe function
    hwmon: (max6639) Fix PPR register initialization to set both channels
    hwmon: (max6639) Fix FAN_FROM_REG calculation

    Linus Torvalds
     
  • three kbuild fixes for 3.3:
    - make deb-pkg symlink race fix.
    - make coccicheck fix.
    - Dropping the check for modutils. This is not a regression, but
    allows the module-init-tools replacement kmod work with the 3.3
    kernel.

    * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
    coccicheck: change handling of C={1,2} when M= is set
    builddeb: Don't create files in /tmp with predictable names
    kbuild: do not check for ancient modutils tools

    Linus Torvalds
     
  • When the autofs protocol version 5 packet type was added in commit
    5c0a32fc2cd0 ("autofs4: add new packet type for v5 communications"), it
    obvously tried quite hard to be word-size agnostic, and uses explicitly
    sized fields that are all correctly aligned.

    However, with the final "char name[NAME_MAX+1]" array at the end, the
    actual size of the structure ends up being not very well defined:
    because the struct isn't marked 'packed', doing a "sizeof()" on it will
    align the size of the struct up to the biggest alignment of the members
    it has.

    And despite all the members being the same, the alignment of them is
    different: a "__u64" has 4-byte alignment on x86-32, but native 8-byte
    alignment on x86-64. And while 'NAME_MAX+1' ends up being a nice round
    number (256), the name[] array starts out a 4-byte aligned.

    End result: the "packed" size of the structure is 300 bytes: 4-byte, but
    not 8-byte aligned.

    As a result, despite all the fields being in the same place on all
    architectures, sizeof() will round up that size to 304 bytes on
    architectures that have 8-byte alignment for u64.

    Note that this is *not* a problem for 32-bit compat mode on POWER, since
    there __u64 is 8-byte aligned even in 32-bit mode. But on x86, 32-bit
    and 64-bit alignment is different for 64-bit entities, and as a result
    the structure that has exactly the same layout has different sizes.

    So on x86-64, but no other architecture, we will just subtract 4 from
    the size of the structure when running in a compat task. That way we
    will write the properly sized packet that user mode expects.

    Not pretty. Sadly, this very subtle, and unnecessary, size difference
    has been encoded in user space that wants to read packets of *exactly*
    the right size, and will refuse to touch anything else.

    Reported-and-tested-by: Thomas Meyer
    Signed-off-by: Ian Kent
    Signed-off-by: Linus Torvalds

    Ian Kent
     

25 Feb, 2012

15 commits

  • One InfiniBand/RDMA regression fix for 3.3:

    - mlx4 SR-IOV changes added static exported functions, which doesn't
    build on powerpc at least. Fix from Doug Ledford for this.

    * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
    mlx4_core: Exported functions can't be static

    Linus Torvalds
     
  • SCSI fixes on 20120224:
    "This is a set of assorted bug fixes for power management, mpt2sas,
    ipr, the rdac device handler and quite a big chunk for qla2xxx (plus a
    use after free of scsi_host in scsi_scan.c). "

    * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
    [SCSI] scsi_dh_rdac: Fix for unbalanced reference count
    [SCSI] scsi_pm: Fix bug in the SCSI power management handler
    [SCSI] scsi_scan: Fix 'Poison overwritten' warning caused by using freed 'shost'
    [SCSI] qla2xxx: Update version number to 8.03.07.13-k.
    [SCSI] qla2xxx: Proper detection of firmware abort error code for ISP82xx.
    [SCSI] qla2xxx: Remove resetting memory during device initialization for ISP82xx.
    [SCSI] qla2xxx: Complete mailbox command timedout to avoid initialization failures during next reset cycle.
    [SCSI] qla2xxx: Remove check for null fcport from host reset handler.
    [SCSI] qla2xxx: Correct out of bounds read of ISP2200 mailbox registers.
    [SCSI] qla2xxx: Remove errant clearing of MBX_INTERRUPT flag during CT-IOCB processing.
    [SCSI] qla2xxx: Clear options-flags while issuing stop-firmware mbx command.
    [SCSI] qla2xxx: Add an "is reset active" helper.
    [SCSI] qla2xxx: Add check for null fcport references in qla2xxx_queuecommand.
    [SCSI] qla2xxx: Propagate up abort failures.
    [SCSI] isci: Fix NULL ptr dereference when no firmware is being loaded
    [SCSI] ipr: fix eeh recovery for 64-bit adapters
    [SCSI] mpt2sas: Fix mismatch in mpt2sas_base_hard_reset_handler() mutex lock-unlock

    Linus Torvalds
     
  • This patch reverts a portion of d0bc1fb4 so that coccicheck will
    work properly when C=1 or C=2.

    Reported-and-tested-by: Brice Goglin
    Signed-off-by: Greg Dietsche
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Greg Dietsche
     
  • * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
    [media] hdpvr: update picture controls to support firmware versions > 0.15
    [media] wl128x: fix build errors when GPIOLIB is not enabled
    [media] hdpvr: fix race conditon during start of streaming
    [media] omap3isp: Fix crash caused by subdevs now having a pointer to devnodes
    [media] imon: don't wedge hardware after early callbacks

    Linus Torvalds
     
  • signalfd_cleanup() ensures that ->signalfd_wqh is not used, but
    this is not enough. eppoll_entry->whead still points to the memory
    we are going to free, ep_unregister_pollwait()->remove_wait_queue()
    is obviously unsafe.

    Change ep_poll_callback(POLLFREE) to set eppoll_entry->whead = NULL,
    change ep_unregister_pollwait() to check pwq->whead != NULL under
    rcu_read_lock() before remove_wait_queue(). We add the new helper,
    ep_remove_wait_queue(), for this.

    This works because sighand_cachep is SLAB_DESTROY_BY_RCU and because
    ->signalfd_wqh is initialized in sighand_ctor(), not in copy_sighand.
    ep_unregister_pollwait()->remove_wait_queue() can play with already
    freed and potentially reused ->sighand, but this is fine. This memory
    must have the valid ->signalfd_wqh until rcu_read_unlock().

    Reported-by: Maxime Bizon
    Cc:
    Signed-off-by: Oleg Nesterov
    Signed-off-by: Linus Torvalds

    Oleg Nesterov
     
  • This patch is intentionally incomplete to simplify the review.
    It ignores ep_unregister_pollwait() which plays with the same wqh.
    See the next change.

    epoll assumes that the EPOLL_CTL_ADD'ed file controls everything
    f_op->poll() needs. In particular it assumes that the wait queue
    can't go away until eventpoll_release(). This is not true in case
    of signalfd, the task which does EPOLL_CTL_ADD uses its ->sighand
    which is not connected to the file.

    This patch adds the special event, POLLFREE, currently only for
    epoll. It expects that init_poll_funcptr()'ed hook should do the
    necessary cleanup. Perhaps it should be defined as EPOLLFREE in
    eventpoll.

    __cleanup_sighand() is changed to do wake_up_poll(POLLFREE) if
    ->signalfd_wqh is not empty, we add the new signalfd_cleanup()
    helper.

    ep_poll_callback(POLLFREE) simply does list_del_init(task_list).
    This make this poll entry inconsistent, but we don't care. If you
    share epoll fd which contains our sigfd with another process you
    should blame yourself. signalfd is "really special". I simply do
    not know how we can define the "right" semantics if it used with
    epoll.

    The main problem is, epoll calls signalfd_poll() once to establish
    the connection with the wait queue, after that signalfd_poll(NULL)
    returns the different/inconsistent results depending on who does
    EPOLL_CTL_MOD/signalfd_read/etc. IOW: apart from sigmask, signalfd
    has nothing to do with the file, it works with the current thread.

    In short: this patch is the hack which tries to fix the symptoms.
    It also assumes that nobody can take tasklist_lock under epoll
    locks, this seems to be true.

    Note:

    - we do not have wake_up_all_poll() but wake_up_poll()
    is fine, poll/epoll doesn't use WQ_FLAG_EXCLUSIVE.

    - signalfd_cleanup() uses POLLHUP along with POLLFREE,
    we need a couple of simple changes in eventpoll.c to
    make sure it can't be "lost".

    Reported-by: Maxime Bizon
    Cc:
    Signed-off-by: Oleg Nesterov
    Signed-off-by: Linus Torvalds

    Oleg Nesterov
     
  • Quoth Chris:
    "This is later than I wanted because I got backed up running through
    btrfs bugs from the Oracle QA teams. But they are all bug fixes that
    we've queued and tested since rc1.

    Nothing in particular stands out, this just reflects bug fixing and QA
    done in parallel by all the btrfs developers. The most user visible
    of these is:

    Btrfs: clear the extent uptodate bits during parent transid failures

    Because that helps deal with out of date drives (say an iscsi disk
    that has gone away and come back). The old code wasn't always
    properly retrying the other mirror for this type of failure."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: (24 commits)
    Btrfs: fix compiler warnings on 32 bit systems
    Btrfs: increase the global block reserve estimates
    Btrfs: clear the extent uptodate bits during parent transid failures
    Btrfs: add extra sanity checks on the path names in btrfs_mksubvol
    Btrfs: make sure we update latest_bdev
    Btrfs: improve error handling for btrfs_insert_dir_item callers
    Btrfs: be less strict on finding next node in clear_extent_bit
    Btrfs: fix a bug on overcommit stuff
    Btrfs: kick out redundant stuff in convert_extent_bit
    Btrfs: skip states when they does not contain bits to clear
    Btrfs: check return value of lookup_extent_mapping() correctly
    Btrfs: fix deadlock on page lock when doing auto-defragment
    Btrfs: fix return value check of extent_io_ops
    btrfs: honor umask when creating subvol root
    btrfs: silence warning in raid array setup
    btrfs: fix structs where bitfields and spinlock/atomic share 8B word
    btrfs: delalloc for page dirtied out-of-band in fixup worker
    Btrfs: fix memory leak in load_free_space_cache()
    btrfs: don't check DUP chunks twice
    Btrfs: fix trim 0 bytes after a device delete
    ...

    Linus Torvalds
     
  • This is the arch/c6x part of commit 7c43185138cf ("Kbuild: Use dtc's -d
    (dependency) option") which was dropped because c6x had not yet been
    merged at the time.

    * tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
    Kbuild: Use dtc's -d (dependency) option

    Linus Torvalds
     
  • I don't even live in the same country as any of my PA-RISC hardware
    these days, so the odds of me touching the code are pretty low.
    (Also re-order things to ensure jejb gets CC'd since he's been the
    primary maintainer for the last few years.)

    Signed-off-by: Kyle McMartin
    Signed-off-by: Linus Torvalds

    Kyle McMartin
     
  • Don't clear vm_mm in a deleted VMA as it's unnecessary and might
    conceivably break the filesystem or driver VMA close routine.

    Reported-by: Al Viro
    Signed-off-by: David Howells
    Acked-by: Al Viro
    cc: stable@vger.kernel.org
    Signed-off-by: Linus Torvalds

    David Howells
     
  • Lock i_mmap_mutex for access to the VMA prio list to prevent concurrent
    access. Currently, certain parts of the mmap handling are protected by
    the region mutex, but not all.

    Reported-by: Al Viro
    Signed-off-by: David Howells
    Acked-by: Al Viro
    cc: stable@vger.kernel.org
    Signed-off-by: Linus Torvalds

    David Howells
     
  • SH/R-Mobile fixes for 3.3-rc5

    * tag 'rmobile-for-linus' of git://github.com/pmundt/linux-sh:
    arch/arm/mach-shmobile/board-ag5evm.c: included linux/dma-mapping.h twice
    ARM: mach-shmobile: r8a7779 PFC IPSR4 fix
    ARM: mach-shmobile: sh73a0 PSTR 32-bit access fix
    ARM: mach-shmobile: add GPIO-to-IRQ translation to sh7372
    ARM: mach-shmobile: clock-sh73a0: add DSIxPHY clock support
    arm: fix compile failure in mach-shmobile/board-ag5evm.c
    ARM: mach-shmobile: mackerel: add ak4642 amixer settings on comment
    ARM: mach-shmobile: mackerel: use renesas_usbhs instead of r8a66597_hcd
    ARM: mach-shmobile: simplify MMCIF DMA configuration
    ARM: mach-shmobile: IRQ driven GPIO key support for Kota2
    ARM: mach-shmobile: sh73a0 IRQ sparse alloc fix
    ARM: mach-shmobile: sh73a0 PINT IRQ base fix

    Linus Torvalds
     
  • SuperH fixes for 3.3-rc5

    * tag 'sh-for-linus' of git://github.com/pmundt/linux-sh:
    sh: Fix sh2a build error for CONFIG_CACHE_WRITETHROUGH
    sh: modify a resource of sh_eth_giga1_resources in board-sh7757lcr
    arch/sh: remove references to cpu_*_map.
    sh: Fix typo in pci-sh7780.c
    sh: add platform_device for SPI1 in setup-sh7757
    sh: modify resource for SPI0 in setup-sh7757
    sh: se7724: fix compile breakage
    sh: clkfwk: bugfix: use clk_reparent() for div6 clocks
    sh: clock-sh7724: fixup sh_fsi clock settings
    sh: sh7757lcr: update to the new MMCIF DMA configuration
    sh: fix the sh_mmcif_plat_data in board-sh7757lcr
    video: pvr2fb: Fix up spurious section mismatch warnings.
    sh: Defer to asm-generic/device.h.

    Linus Torvalds
     
  • There is an issue when memcg unregisters events that were attached to
    the same eventfd:

    - On the first call mem_cgroup_usage_unregister_event() removes all
    events attached to a given eventfd, and if there were no events left,
    thresholds->primary would become NULL;

    - Since there were several events registered, cgroups core will call
    mem_cgroup_usage_unregister_event() again, but now kernel will oops,
    as the function doesn't expect that threshold->primary may be NULL.

    That's a good question whether mem_cgroup_usage_unregister_event()
    should actually remove all events in one go, but nowadays it can't
    do any better as cftype->unregister_event callback doesn't pass
    any private event-associated cookie. So, let's fix the issue by
    simply checking for threshold->primary.

    FWIW, w/o the patch the following oops may be observed:

    BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
    IP: [] mem_cgroup_usage_unregister_event+0x9c/0x1f0
    Pid: 574, comm: kworker/0:2 Not tainted 3.3.0-rc4+ #9 Bochs Bochs
    RIP: 0010:[] [] mem_cgroup_usage_unregister_event+0x9c/0x1f0
    RSP: 0018:ffff88001d0b9d60 EFLAGS: 00010246
    Process kworker/0:2 (pid: 574, threadinfo ffff88001d0b8000, task ffff88001de91cc0)
    Call Trace:
    [] cgroup_event_remove+0x2b/0x60
    [] process_one_work+0x174/0x450
    [] worker_thread+0x123/0x2d0

    Cc: stable
    Signed-off-by: Anton Vorontsov
    Acked-by: KAMEZAWA Hiroyuki
    Cc: Kirill A. Shutemov
    Cc: Michal Hocko
    Signed-off-by: Linus Torvalds

    Anton Vorontsov
     
  • Temperature history is reset by writing 0x8000 into the peak temperature
    register, not 0xffff.

    Signed-off-by: Guenter Roeck
    Acked-by: Jean Delvare

    Guenter Roeck
     

24 Feb, 2012

13 commits

  • The enospc tracing code added some interesting uses of
    u64 pointer casts.

    Signed-off-by: Chris Mason

    Chris Mason
     
  • arch/arm/mach-shmobile/board-ag5evm.c: included 'linux/dma-mapping.h'
    twice, remove the duplicate.

    Signed-off-by: Danny Kukawka
    Signed-off-by: Paul Mundt

    Danny Kukawka
     
  • Fix the bit field width information for the IPSR4 register
    in the r8a7779 pin function controller (PFC).

    Without this fix the Marzen board fails to receive data
    over the serial console due to misconfigured pin function
    for the RX pin.

    Signed-off-by: Magnus Damm
    Tested-by: Kuninori Morimoto
    Tested-by: Simon Horman
    Signed-off-by: Paul Mundt

    Magnus Damm
     
  • Convert the sh73a0 SMP code to use 32-bit PSTR access.

    This fixes wakeup from deep sleep for sh73a0 secondary CPUs.

    Signed-off-by: Magnus Damm
    Signed-off-by: Paul Mundt

    Magnus Damm
     
  • Paul Mundt
     
  • Signed-off-by: Phil Edworthy
    Signed-off-by: Paul Mundt

    Phil Edworthy
     
  • The latest sh_eth driver needs a resource of TSU in the channel 1,
    if the controller has TSU registers. So, this patch adds the resource.

    Signed-off-by: Yoshihiro Shimoda
    Signed-off-by: Paul Mundt

    Shimoda, Yoshihiro
     
  • This has been obsolescent for a while; time for the final push.

    Signed-off-by: Rusty Russell
    Cc: Paul Mundt
    Cc: linux-sh@vger.kernel.org
    Signed-off-by: Paul Mundt

    Rusty Russell
     
  • Correct spelling "erorr" to "error" in
    arch/sh/drivers/pci/pci-sh7780.c

    Signed-off-by: Masanari Iida
    Signed-off-by: Paul Mundt

    Masanari Iida
     
  • With kernel 3.1, Christoph removed i_alloc_sem and replaced it with
    calls (namely inode_dio_wait() and inode_dio_done()) which are
    EXPORT_SYMBOL_GPL() thus they cannot be used by non-GPL file systems and
    further inode_dio_wait() was pushed from notify_change() into the file
    system ->setattr() method but no non-GPL file system can make this call.

    That means non-GPL file systems cannot exist any more unless they do not
    use any VFS functionality related to reading/writing as far as I can
    tell or at least as long as they want to implement direct i/o.

    Both Linus and Al (and others) have said on LKML that this breakage of
    the VFS API should not have happened and that the change was simply
    missed as it was not documented in the change logs of the patches that
    did those changes.

    This patch changes the two function exports in question to be
    EXPORT_SYMBOL() thus restoring the VFS API as it used to be - accessible
    for all modules.

    Christoph, who introduced the two functions and exported them GPL-only
    is CC-ed on this patch to give him the opportunity to object to the
    symbols being changed in this manner if he did indeed intend them to be
    GPL-only and does not want them to become available to all modules.

    Signed-off-by: Anton Altaparmakov
    CC: Christoph Hellwig
    Signed-off-by: Linus Torvalds

    Anton Altaparmakov
     
  • A fix from Jesper Juhl removes an assignment in an ASSERT when a compare
    is intended. Two fixes from Mitsuo Hayasaka address off-by-ones in XFS
    quota enforcement.

    * 'for-linus' of git://oss.sgi.com/xfs/xfs:
    xfs: make inode quota check more general
    xfs: change available ranges of softlimit and hardlimit in quota check
    XFS: xfs_trans_add_item() - don't assign in ASSERT() when compare is intended

    Linus Torvalds
     
  • BenH says:
    'Here are a few more powerpc bits for you. A stupid regression I
    introduced with my previous commit to "fix" program check exceptions
    (brown paper bag for me), fix the cpuidle default, a bug fix for
    something that isn't strictly speaking a regression but some upstream
    changes causes it to show in lockdep now while it didn't before, and
    finally a trivial one for rusty to make his life easier later on
    removing the old cpumask cruft. '

    * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
    powerpc: Fix various issues with return to userspace
    cpuidle: Default y on powerpc pSeries
    powerpc: Fix program check handling when lockdep is enabled
    powerpc: Remove references to cpu_*_map

    Linus Torvalds
     
  • sound fixes for 3.3-rc5

    Just a collection of boring small fixes for ASoC, HD-audio Realtek
    and USB-audio drivers.

    * tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
    ALSA: snd-usb-caiaq: Fix the return of XRUN
    ASoC: ak4642: fixup HeadPhone L/R dapm settings
    ALSA: hda/realtek - Fix surround output regression on Acer Aspire 5935
    ALSA: hda/realtek - Fix overflow of vol/sw check bitmap
    ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk()
    ASoC: wm8962: Fix sidetone enumeration texts

    Linus Torvalds
     

23 Feb, 2012

8 commits