26 Mar, 2013

7 commits

  • If suspend callback fails in system sleep context, usb core will
    ignore the failure and let system sleep go ahead further, so
    this patch doesn't recover device under this situation.

    Also add comments on the case.

    Acked-by: David S. Miller
    Cc: Steve Glendinning
    Signed-off-by: Ming Lei
    Signed-off-by: Greg Kroah-Hartman

    Ming Lei
     
  • If suspend callback fails in system sleep context, usb core will
    ignore the failure and let system sleep go ahead further, so
    this patch comments on the case and requires that both
    usbnet_suspend() and subdriver->suspend() MUST return 0 in
    system sleep context.

    Acked-by: David S. Miller
    Acked-by: Bjørn Mork
    Signed-off-by: Ming Lei
    Signed-off-by: Greg Kroah-Hartman

    Ming Lei
     
  • If suspend callback fails in system sleep context, usb core will
    ignore the failure and let system sleep go ahead further, so
    this patch comments on the case and requires that both
    usbnet_suspend() and subdriver->suspend() MUST return 0 in
    system sleep context.

    Acked-by: David S. Miller
    Acked-by: Bjørn Mork
    Signed-off-by: Ming Lei
    Signed-off-by: Greg Kroah-Hartman

    Ming Lei
     
  • If suspend callback fails in system sleep context, usb core will
    ignore the failure and let the system sleep go ahead further, so this
    patch doesn't recover device under this situation, otherwise
    may cause resume() confused.

    Acked-by: Jiri Kosina
    Signed-off-by: Ming Lei
    Signed-off-by: Greg Kroah-Hartman

    Ming Lei
     
  • If suspend callback fails in system sleep context, usb core will
    ignore the failure and let system sleep go ahead further, so
    this patch comments on the case and requires that serial->type->suspend()
    MUST return 0 in system sleep context.

    Acked-by: Johan Hovold
    Signed-off-by: Ming Lei
    Signed-off-by: Greg Kroah-Hartman

    Ming Lei
     
  • This patch adds comments on interface driver suspend callback
    to emphasize that the failure return value is ignored by
    USB core in system sleep context, so do not try to recover
    device for this case and let resume/reset_resume callback
    handle the suspend failure if needed.

    Also kerneldoc for usb_suspend_both() is updated with the
    fact.

    Acked-by: Alan Stern
    Signed-off-by: Ming Lei
    Signed-off-by: Greg Kroah-Hartman

    Ming Lei
     
  • This picks up the fixes we had for USB in 3.9-rc4

    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

24 Mar, 2013

8 commits

  • Linus Torvalds
     
  • Pull SCSI target fixes from Nicholas Bellinger:
    "These are mostly minor fixes this time around. The iscsi-target CHAP
    big-endian bugfix and bump FD_MAX_SECTORS=2048 default patch to allow
    1MB sized I/Os for FILEIO backends on >= v3.5 code are both CC'ed to
    stable.

    Also, there is a persistent reservations regression that has recently
    been reported for >= v3.8.x code, that is currently being tracked down
    for v3.9."

    * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
    target/pscsi: Reject cross page boundary case in pscsi_map_sg
    target/file: Bump FD_MAX_SECTORS to 2048 to handle 1M sized I/Os
    tcm_vhost: Flush vhost_work in vhost_scsi_flush()
    tcm_vhost: Add missed lock in vhost_scsi_clear_endpoint()
    target: fix possible memory leak in core_tpg_register()
    target/iscsi: Fix mutual CHAP auth on big-endian arches
    target_core_sbc: use noop for SYNCHRONIZE_CACHE

    Linus Torvalds
     
  • Pull md fixes from NeilBrown:
    "A few bugfixes for md

    - recent regressions in raid5
    - recent regressions in dmraid
    - a few instances of CONFIG_MULTICORE_RAID456 linger

    Several tagged for -stable"

    * tag 'md-3.9-fixes' of git://neil.brown.name/md:
    md: remove CONFIG_MULTICORE_RAID456 entirely
    md/raid5: ensure sync and DISCARD don't happen at the same time.
    MD: Prevent sysfs operations on uninitialized kobjects
    MD RAID5: Avoid accessing gendisk or queue structs when not available
    md/raid5: schedule_construction should abort if nothing to do.

    Linus Torvalds
     
  • Pull libata updates from Jeff Garzik:
    "Simple stuff. See one-line summaries."

    * tag 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
    pata_samsung_cf: use module_platform_driver_probe()
    [libata] Avoid specialized TLA's in ZPODD's Kconfig
    libata-acpi.c: fix copy and paste mistake in ata_acpi_register_power_resource
    sata_fsl: Remove redundant NULL check before kfree
    ahci: Add Device IDs for Intel Wellsburg PCH
    ata_piix: Add MODULE_PARM_DESC to prefer_ms_hyperv

    Linus Torvalds
     
  • Pull i2c fixes from Wolfram Sang:
    "One bugfix for the tegra driver. Two updates regarding email
    addresses and MAINTAINERS which I like to have up-to-date so people
    can be reached immediately. While we are here, there is on PCI_ID
    addition."

    * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
    MAINTAINERS: add maintainer entry for atmel i2c driver
    i2c: Fix my e-mail address in drivers and documentation
    i2c: iSMT: add Intel Avoton DeviceIDs
    i2c: tegra: check the clk_prepare_enable() return value

    Linus Torvalds
     
  • Pull watchdog fixes from Wim Van Sebroeck:
    "Fix a boot issues and correct the AcpiMmioSel bitmask in the
    sp5100_tco watchdog device driver"

    * git://www.linux-watchdog.org/linux-watchdog:
    watchdog: sp5100_tco: Set the AcpiMmioSel bitmask value to 1 instead of 2
    watchdog: sp5100_tco: Remove code that may cause a boot failure

    Linus Torvalds
     
  • When KMS has parsed an EDID "detailed timing", it leaves the frame rate
    zeroed. Consecutive (debug-) output of that mode thus yields 0 for
    vsync. This simple fix also speeds up future invocations of
    drm_mode_vrefresh().

    While it is debatable whether this qualifies as a -stable fix I'd apply
    it for consistency's sake; drm_helper_probe_single_connector_modes()
    does the same thing already for all probed modes.

    Cc: stable@vger.kernel.org
    Signed-off-by: Torsten Duwe
    Signed-off-by: Linus Torvalds

    Torsten Duwe
     
  • EDID spreads some values across multiple bytes; bit-fiddling is needed
    to retrieve these. The current code to parse "detailed timings" has a
    cut&paste error that results in a vsync offset of at most 15 lines
    instead of 63.

    See

    http://en.wikipedia.org/wiki/EDID

    and in the "EDID Detailed Timing Descriptor" see bytes 10+11 show why
    that needs to be a left shift.

    Cc: stable@vger.kernel.org
    Signed-off-by: Torsten Duwe
    Signed-off-by: Linus Torvalds

    Torsten Duwe
     

23 Mar, 2013

22 commits

  • Pull NVMe driver update from Matthew Wilcox:
    "These patches have mostly been baking for a few months; sorry I didn't
    get them in during the merge window. They're all bug fixes, except
    for the addition of the SMART log and the addition to MAINTAINERS."

    * git://git.infradead.org/users/willy/linux-nvme:
    NVMe: Add namespaces with no LBA range feature
    MAINTAINERS: Add entry for the NVMe driver
    NVMe: Initialize iod nents to 0
    NVMe: Define SMART log
    NVMe: Add result to nvme_get_features
    NVMe: Set result from user admin command
    NVMe: End queued bio requests when freeing queue
    NVMe: Free cmdid on nvme_submit_bio error

    Linus Torvalds
     
  • Merge misc fixes from Andrew Morton.

    * emailed patches from Andrew Morton :
    mqueue: sys_mq_open: do not call mnt_drop_write() if read-only
    mm/hotplug: only free wait_table if it's allocated by vmalloc
    dma-debug: update DMA debug API to better handle multiple mappings of a buffer
    dma-debug: fix locking bug in check_unmap()
    drivers/rtc/rtc-at91rm9200.c: use a variable for storing IMR
    drivers/video/ep93xx-fb.c: include for devm_ioremap()
    drivers/rtc/rtc-da9052.c: fix for rtc device registration
    mm: zone_end_pfn is too small
    poweroff: change orderly_poweroff() to use schedule_work()
    mm/hugetlb: fix total hugetlbfs pages count when using memory overcommit accouting
    printk: Provide a wake_up_klogd() off-case
    irq_work.h: fix warning when CONFIG_IRQ_WORK=n

    Linus Torvalds
     
  • mnt_drop_write() must be called only if mnt_want_write() succeeded,
    otherwise the mnt_writers counter will diverge.

    mnt_writers counters are used to check if remounting FS as read-only is
    OK, so after an extra mnt_drop_write() call, it would be impossible to
    remount mqueue FS as read-only. Besides, on umount a warning would be
    printed like this one:

    =====================================
    [ BUG: bad unlock balance detected! ]
    3.9.0-rc3 #5 Not tainted
    -------------------------------------
    a.out/12486 is trying to release lock (sb_writers) at:
    mnt_drop_write+0x1f/0x30
    but there are no more locks to release!

    Signed-off-by: Vladimir Davydov
    Cc: Doug Ledford
    Cc: KOSAKI Motohiro
    Cc: "Eric W. Biederman"
    Cc: Al Viro
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Vladimir Davydov
     
  • zone->wait_table may be allocated from bootmem, it can not be freed.

    Signed-off-by: Jianguo Wu
    Reviewed-by: Tang Chen
    Cc: Tang Chen
    Cc: Jiang Liu
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jianguo Wu
     
  • There were reports of the igb driver unmapping buffers without calling
    dma_mapping_error. On closer inspection issues were found in the DMA
    debug API and how it handled multiple mappings of the same buffer.

    The issue I found is the fact that the debug_dma_mapping_error would
    only set the map_err_type to MAP_ERR_CHECKED in the case that the was
    only one match for device and device address. However in the case of
    non-IOMMU, multiple addresses existed and as a result it was not setting
    this field once a second mapping was instantiated. I have resolved this
    by changing the search so that it instead will now set MAP_ERR_CHECKED
    on the first buffer that matches the device and DMA address that is
    currently in the state MAP_ERR_NOT_CHECKED.

    A secondary side effect of this patch is that in the case of multiple
    buffers using the same address only the last mapping will have a valid
    map_err_type. The previous mappings will all end up with map_err_type
    set to MAP_ERR_CHECKED because of the dma_mapping_error call in
    debug_dma_map_page. However this behavior may be preferable as it means
    you will likely only see one real error per multi-mapped buffer, versus
    the current behavior of multiple false errors mer multi-mapped buffer.

    Signed-off-by: Alexander Duyck
    Cc: Joerg Roedel
    Reviewed-by: Shuah Khan
    Tested-by: Shuah Khan
    Cc: Jakub Kicinski
    Cc: Konrad Rzeszutek Wilk
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexander Duyck
     
  • In check_unmap() it is possible to get into a dead-locked state if
    dma_mapping_error is called. The problem is that the bucket is locked in
    check_unmap, and locked again by debug_dma_mapping_error which is called
    by dma_mapping_error. To resolve that we must release the lock on the
    bucket before making the call to dma_mapping_error.

    [akpm@linux-foundation.org: restore 80-col trickery to be consistent with the rest of the file]
    Signed-off-by: Alexander Duyck
    Cc: Joerg Roedel
    Reviewed-by: Shuah Khan
    Tested-by: Shuah Khan
    Cc: Jakub Kicinski
    Cc: Konrad Rzeszutek Wilk
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexander Duyck
     
  • On some revisions of AT91 SoCs, the RTC IMR register is not working.
    Instead of elaborating a workaround for that specific SoC or IP version,
    we simply use a software variable to store the Interrupt Mask Register
    and modify it for each enabling/disabling of an interrupt. The overhead
    of this is negligible anyway.

    The interrupt mask register (IMR) for the RTC is broken on the AT91SAM9x5
    sub-family of SoCs (good overview of the members here:
    http://www.eewiki.net/display/linuxonarm/AT91SAM9x5 ). The "user visible
    effect" is the RTC doesn't work.

    That sub-family is less than two years old and only has devicetree (DT)
    support and came online circa lk 3.7 . The dust is yet to settle on the
    DT stuff at least for AT91 SoCs (translation: lots of stuff is still
    broken, so much that it is hard to know where to start).

    The fix in the patch is pretty simple: just shadow the silicon IMR
    register with a variable in the driver. Some older SoCs (pre-DT) use the
    the rtc-at91rm9200 driver (e.g. obviously the AT91RM9200) and they should
    not be impacted by the change. There shouldn't be a large volume of
    interrupts associated with a RTC.

    Signed-off-by: Nicolas Ferre
    Reported-by: Douglas Gilbert
    Cc: Jean-Christophe PLAGNIOL-VILLARD
    Cc: Ludovic Desroches
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Nicolas Ferre
     
  • Commit be8678149701 ("drivers/video/ep93xx-fb.c: use devm_ functions")
    introduced a build error:

    drivers/video/ep93xx-fb.c: In function 'ep93xxfb_probe':
    drivers/video/ep93xx-fb.c:532: error: implicit declaration of function 'devm_ioremap'
    drivers/video/ep93xx-fb.c:533: warning: assignment makes pointer from integer without a cast

    Include to pickup the declaration of 'devm_ioremap'.

    Signed-off-by: H Hartley Sweeten
    Cc: Florian Tobias Schandinat
    Acked-by: Ryan Mallon
    Cc: Damien Cassou
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    H Hartley Sweeten
     
  • Add support for the virtual irq since now MFD only handles virtual irq
    Without this patch rtc device will fail in registration.

    (akpm: Ashish has a different version whcih will be needed for 3.8.x and
    earlier kernels)

    Signed-off-by: Ashish
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Ashish Jangam
     
  • Booting with 32 TBytes memory hits BUG at mm/page_alloc.c:552! (output
    below).

    The key hint is "page 4294967296 outside zone".
    4294967296 = 0x100000000 (bit 32 is set).

    The problem is in include/linux/mmzone.h:

    530 static inline unsigned zone_end_pfn(const struct zone *zone)
    531 {
    532 return zone->zone_start_pfn + zone->spanned_pages;
    533 }

    zone_end_pfn is "unsigned" (32 bits). Changing it to "unsigned long"
    (64 bits) fixes the problem.

    zone_end_pfn() was added recently in commit 108bcc96ef70 ("mm: add & use
    zone_end_pfn() and zone_spans_pfn()")

    Output from the failure.

    No AGP bridge found
    page 4294967296 outside zone [ 4294967296 - 4327469056 ]
    ------------[ cut here ]------------
    kernel BUG at mm/page_alloc.c:552!
    invalid opcode: 0000 [#1] SMP
    Modules linked in:
    CPU 0
    Pid: 0, comm: swapper Not tainted 3.9.0-rc2.dtp+ #10
    RIP: free_one_page+0x382/0x430
    Process swapper (pid: 0, threadinfo ffffffff81942000, task ffffffff81955420)
    Call Trace:
    __free_pages_ok+0x96/0xb0
    __free_pages+0x25/0x50
    __free_pages_bootmem+0x8a/0x8c
    __free_memory_core+0xea/0x131
    free_low_memory_core_early+0x4a/0x98
    free_all_bootmem+0x45/0x47
    mem_init+0x7b/0x14c
    start_kernel+0x216/0x433
    x86_64_start_reservations+0x2a/0x2c
    x86_64_start_kernel+0x144/0x153
    Code: 89 f1 ba 01 00 00 00 31 f6 d3 e2 4c 89 ef e8 66 a4 01 00 e9 2c fe ff ff 0f 0b eb fe 0f 0b 66 66 2e 0f 1f 84 00 00 00 00 00 eb f3 0b eb fe 0f 0b 0f 1f 84 00 00 00 00 00 eb f6 0f 0b eb fe 49

    Signed-off-by: Russ Anderson
    Reported-by: George Beshers
    Acked-by: Hedi Berriche
    Cc: Cody P Schafer
    Cc: Michal Hocko
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Russ Anderson
     
  • David said:

    Commit 6c0c0d4d1080 ("poweroff: fix bug in orderly_poweroff()")
    apparently fixes one bug in orderly_poweroff(), but introduces
    another. The comments on orderly_poweroff() claim it can be called
    from any context - and indeed we call it from interrupt context in
    arch/powerpc/platforms/pseries/ras.c for example. But since that
    commit this is no longer safe, since call_usermodehelper_fns() is not
    safe in interrupt context without the UMH_NO_WAIT option.

    orderly_poweroff() can be used from any context but UMH_WAIT_EXEC is
    sleepable. Move the "force" logic into __orderly_poweroff() and change
    orderly_poweroff() to use the global poweroff_work which simply calls
    __orderly_poweroff().

    While at it, remove the unneeded "int argc" and change argv_split() to
    use GFP_KERNEL.

    We use the global "bool poweroff_force" to pass the argument, this can
    obviously affect the previous request if it is pending/running. So we
    only allow the "false => true" transition assuming that the pending
    "true" should succeed anyway. If schedule_work() fails after that we
    know that work->func() was not called yet, it must see the new value.

    This means that orderly_poweroff() becomes async even if we do not run
    the command and always succeeds, schedule_work() can only fail if the
    work is already pending. We can export __orderly_poweroff() and change
    the non-atomic callers which want the old semantics.

    Signed-off-by: Oleg Nesterov
    Reported-by: Benjamin Herrenschmidt
    Reported-by: David Gibson
    Cc: Lucas De Marchi
    Cc: Feng Hong
    Cc: Kees Cook
    Cc: Serge Hallyn
    Cc: "Eric W. Biederman"
    Cc: "Rafael J. Wysocki"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Oleg Nesterov
     
  • hugetlb_total_pages is used for overcommit calculations but the current
    implementation considers only the default hugetlb page size (which is
    either the first defined hugepage size or the one specified by
    default_hugepagesz kernel boot parameter).

    If the system is configured for more than one hugepage size, which is
    possible since commit a137e1cc6d6e ("hugetlbfs: per mount huge page
    sizes") then the overcommit estimation done by __vm_enough_memory()
    (resp. shown by meminfo_proc_show) is not precise - there is an
    impression of more available/allowed memory. This can lead to an
    unexpected ENOMEM/EFAULT resp. SIGSEGV when memory is accounted.

    Testcase:
    boot: hugepagesz=1G hugepages=1
    the default overcommit ratio is 50
    before patch:

    egrep 'CommitLimit' /proc/meminfo
    CommitLimit: 55434168 kB

    after patch:

    egrep 'CommitLimit' /proc/meminfo
    CommitLimit: 54909880 kB

    [akpm@linux-foundation.org: coding-style tweak]
    Signed-off-by: Wanpeng Li
    Acked-by: Michal Hocko
    Cc: "Aneesh Kumar K.V"
    Cc: Hillf Danton
    Cc: KAMEZAWA Hiroyuki
    Cc: [3.0+]
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Wanpeng Li
     
  • wake_up_klogd() is useless when CONFIG_PRINTK=n because neither printk()
    nor printk_sched() are in use and there are actually no waiter on
    log_wait waitqueue. It should be a stub in this case for users like
    bust_spinlocks().

    Otherwise this results in this warning when CONFIG_PRINTK=n and
    CONFIG_IRQ_WORK=n:

    kernel/built-in.o In function `wake_up_klogd':
    (.text.wake_up_klogd+0xb4): undefined reference to `irq_work_queue'

    To fix this, provide an off-case for wake_up_klogd() when
    CONFIG_PRINTK=n.

    There is much more from console_unlock() and other console related code
    in printk.c that should be moved under CONFIG_PRINTK. But for now,
    focus on a minimal fix as we passed the merged window already.

    [akpm@linux-foundation.org: include printk.h in bust_spinlocks.c]
    Signed-off-by: Frederic Weisbecker
    Reported-by: James Hogan
    Cc: James Hogan
    Cc: Steven Rostedt
    Cc: Peter Zijlstra
    Cc: Ingo Molnar
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Frederic Weisbecker
     
  • A randconfig caught repeated compiler warnings when CONFIG_IRQ_WORK=n
    due to the definition of a non-inline static function in
    :

    include/linux/irq_work.h +40 : warning: 'irq_work_needs_cpu' defined but not used

    Make it inline to supress the warning. This is caused commit
    00b42959106a ("irq_work: Don't stop the tick with pending works") merged
    in v3.9-rc1.

    Signed-off-by: James Hogan
    Signed-off-by: Frederic Weisbecker
    Cc: Steven Rostedt
    Cc: Peter Zijlstra
    Cc: Thomas Gleixner
    Cc: Ingo Molnar
    Cc: Paul Gortmaker
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    James Hogan
     
  • The AcpiMmioSel bit is bit 1 in the AcpiMmioEn register, but the current
    sp5100_tco driver is using bit 2.

    See 2.3.3 Power Management (PM) Registers page 150 of the
    AMD SB800-Series Southbridges Register Reference Guide [1].

    AcpiMmioEn - RW – 8/16/32 bits - [PM_Reg: 24h]
    Field Name Bits Default Description
    AcpiMMioDecodeEn 0 0b Set to 1 to enable AcpiMMio space.
    AcpiMMIoSel 1 0b Set AcpiMMio registers to be memory-mapped or IO-mapped space.
    0: Memory-mapped space
    1: I/O-mapped space

    The sp5100_tco driver expects zero as a value of AcpiMmioSel (bit 1).

    Fortunately, no problems were caused by this typo, because the default
    value of the undocumented misused bit 2 seems to be zero.

    However, the sp5100_tco driver should use the correct bitmask value.

    [1] http://support.amd.com/us/Embedded_TechDocs/45482.pdf

    Signed-off-by: Takahisa Tanaka
    Signed-off-by: Paul Menzel
    Signed-off-by: Wim Van Sebroeck
    Cc: stable

    Takahisa Tanaka
     
  • A problem was found on PC's with the SB700 chipset: The PC fails to
    load BIOS after running the 3.8.x kernel until the power is completely
    cut off. It occurs in all 3.8.x versions and the mainline version as of
    2/4. The issue does not occur with the 3.7.x builds.

    There are two methods for accessing the watchdog registers.

    1. Re-programming a resource address obtained by allocate_resource()
    to chipset.
    2. Use the direct memory-mapped IO access.

    The method 1 can be used by all the chipsets (SP5100, SB7x0, SB8x0 or
    later). However, experience shows that only PC with the SB8x0 (or
    later) chipsets can use the method 2.

    This patch removes the method 1, because the critical problem was found.
    That's why the watchdog timer was able to be used on SP5100 and SB7x0
    chipsets until now.

    Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1116835
    Link: https://lkml.org/lkml/2013/2/14/271

    Signed-off-by: Takahisa Tanaka
    Signed-off-by: Wim Van Sebroeck
    Cc: stable

    Takahisa Tanaka
     
  • Pull KVM fix from Marcelo Tosatti:
    "Fix compilation on PPC with !CONFIG_KVM"

    * git://git.kernel.org/pub/scm/virt/kvm/kvm:
    Revert "KVM: allow host header to be included even for !CONFIG_KVM"

    Linus Torvalds
     
  • Pull USB fixes from Greg Kroah-Hartman:
    "Here are a number of USB fixes that resolve issues that have been
    reported against 3.9-rc3."

    * tag 'usb-3.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (37 commits)
    USB: ti_usb_3410_5052: fix use-after-free in TIOCMIWAIT
    USB: ssu100: fix use-after-free in TIOCMIWAIT
    USB: spcp8x5: fix use-after-free in TIOCMIWAIT
    USB: quatech2: fix use-after-free in TIOCMIWAIT
    USB: pl2303: fix use-after-free in TIOCMIWAIT
    USB: oti6858: fix use-after-free in TIOCMIWAIT
    USB: mos7840: fix use-after-free in TIOCMIWAIT
    USB: mos7840: fix broken TIOCMIWAIT
    USB: mct_u232: fix use-after-free in TIOCMIWAIT
    USB: io_ti: fix use-after-free in TIOCMIWAIT
    USB: io_edgeport: fix use-after-free in TIOCMIWAIT
    USB: ftdi_sio: fix use-after-free in TIOCMIWAIT
    USB: f81232: fix use-after-free in TIOCMIWAIT
    USB: cypress_m8: fix use-after-free in TIOCMIWAIT
    USB: ch341: fix use-after-free in TIOCMIWAIT
    USB: ark3116: fix use-after-free in TIOCMIWAIT
    USB: serial: add modem-status-change wait queue
    USB: serial: fix interface refcounting
    USB: io_ti: fix get_icount for two port adapters
    USB: garmin_gps: fix memory leak on disconnect
    ...

    Linus Torvalds
     
  • Pull sound fixes from Takashi Iwai:
    "Mostly HD-audio and USB-audio regression fixes:
    - Oops fix at unloading of snd-hda-codec-conexant module
    - A few trivial regression fixes for Cirrus and Conexant HD-audio
    codecs
    - Relax the USB-audio descriptor parse errors as non-fatal
    - Fix locking of HD-audio CA0132 DSP loader
    - Fix the generic HD-audio parser for VIA codecs"

    * tag 'sound-3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
    ALSA: hda - Fix DAC assignment for independent HP
    ALSA: hda - Fix abuse of snd_hda_lock_devices() for DSP loader
    ALSA: hda - Fix typo in checking IEC958 emphasis bit
    ALSA: snd-usb: mixer: ignore -EINVAL in snd_usb_mixer_controls()
    ALSA: snd-usb: mixer: propagate errors up the call chain
    ALSA: usb: Parse UAC2 extension unit like for UAC1
    ALSA: hda - Fix yet missing GPIO/EAPD setup in cirrus driver
    ALSA: hda/cirrus - Fix the digital beep registration
    ALSA: hda - Fix missing beep detach in patch_conexant.c
    ALSA: documentation: Fix typo in Documentation/sound

    Linus Torvalds
     
  • Pull EDAC fixes from Borislav Petkov:
    "A fix from Mauro to correct csrow size accounting in sysfs and a
    sparse fix from Stephen Hemminger."

    * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
    EDAC: Merge mci.mem_is_per_rank with mci.csbased
    amd64_edac: Correct DIMM sizes
    EDAC: Make sysfs functions static

    Linus Torvalds
     
  • The LBA Range Type feature is optional in the NVMe specification,
    so we should continue with adding namespaces for controllers that do
    not implement this feature.

    Signed-off-by: Keith Busch
    Signed-off-by: Matthew Wilcox

    Keith Busch
     
  • Dave Jones found another /proc issue with his Trinity tool: thanks to
    the namespace model, we can have multiple /proc dentries that point to
    the same inode, aliasing directories in /proc//net/ for example.

    This ends up being a total disaster, because it acts like hardlinked
    directories, and causes locking problems. We rely on the topological
    sort of the inodes pointed to by dentries, and if we have aliased
    directories, that odering becomes unreliable.

    In short: don't do this. Multiple dentries with the same (directory)
    inode is just a bad idea, and the namespace code should never have
    exposed things this way. But we're kind of stuck with it.

    This solves things by just always allocating a new inode during /proc
    dentry lookup, instead of using "iget_locked()" to look up existing
    inodes by superblock and number. That actually simplies the code a bit,
    at the cost of potentially doing more inode [de]allocations.

    That said, the inode lookup wasn't free either (and did a lot of locking
    of inodes), so it is probably not that noticeable. We could easily keep
    the old lookup model for non-directory entries, but rather than try to
    be excessively clever this just implements the minimal and simplest
    workaround for the problem.

    Reported-and-tested-by: Dave Jones
    Analyzed-by: Al Viro
    Cc: stable@vger.kernel.org
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

22 Mar, 2013

3 commits