03 Oct, 2008
4 commits
-
Found by static checker (http://repo.or.cz/w/smatch.git).
Signed-off-by: Dan Carpenter
Acked-by: Thomas Gleixner
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
Only register the braille driver VT and keyboard notifiers when the
braille console is used. Avoids eating insert or backspace keys.Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11242
Signed-off-by: Pascal Terjan
Signed-off-by: Samuel Thibault
Cc:
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
Fix inotify lock order reversal with mmap_sem due to holding locks over
copy_to_user.Signed-off-by: Nick Piggin
Reported-by: "Daniel J Blueman"
Tested-by: "Daniel J Blueman"
Cc: Ingo Molnar
Cc: Peter Zijlstra
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
Commit 22af89aa0c0b4012a7431114a340efd3665a7617 ("fbcon: replace mono_col
macro with static inline") changed the order of operations for computing
monochrome color values. This generates 0xffff000f instead of 0x0000000f
for a 4 bit monochrome color, leading to image corruption if it is passed
to cfb_imageblit or other similar functions. Fix it up.Cc: Harvey Harrison
Cc: "Antonino A. Daplas"
Cc: Krzysztof Helt
Cc: [2.6.26.x]
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
02 Oct, 2008
12 commits
-
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ALSA: snd-powermac: HP detection for 1st iMac G3 SL
ALSA: snd-powermac: mixers for PowerMac G4 AGP
ASoC: Set correct name for WM8753 rec mixer output -
Correct headphone detection for 1st generation iMac G3 Slot-loading (Screamer).
This patch fixes the regression in the recent snd-powermac which
doesn't support some G3/G4 PowerMacs:
http://lkml.org/lkml/2008/10/1/220Signed-off-by: Risto Suominen
Tested-by: Mariusz Kozlowski
Cc: stable@kernel.org
Signed-off-by: Takashi Iwai -
Add mixer controls for PowerMac G4 AGP (Screamer).
This patch fixes the regression in the recent snd-powermac which
doesn't support some G3/G4 PowerMacs:
http://lkml.org/lkml/2008/10/1/220Signed-off-by: Risto Suominen
Tested-by: Mariusz Kozlowski
Cc: stable@kernel.org
Signed-off-by: Takashi Iwai -
Rob Sims wrote:
"I can't seem to turn on register 0x17, bit 3 in the sound chip, except
by codec_reg_write; the mixer lacks direct or indirect control. It
seems there are two names for the output of the rec mixer:
Capture ST Mixer
Playback MixerWould the following do the trick?"
I confirm that this solves the audio problems I was having.
Signed-off-by: Jonas Bonn
Signed-off-by: Mark Brown
Signed-off-by: Takashi Iwai -
Commit 00c5372d37a78990c1530184a9c792ee60a30067 caused the MPC8544DS
board to hang at boot. The MPC8544DS is unique in that it doesn't use
the PCI slots on the ULI (unlike the MPC8572DS or MPC8610HPCD). So
the dummy read at the end of the address space causes us to hang.We can detect the situation by comparing the bridge's BARs versus
the root complex.Signed-off-by: Kumar Gala
-
Set the hardware to ignore all write/erase cycles to the GbE region in
the ICHx NVM. This feature can be disabled by the WriteProtectNVM module
parameter (enabled by default) only after a hardware reset, but
the machine must be power cycled before trying to enable writes.Signed-off-by: Bruce Allan
Signed-off-by: Jesse Brandeburg
CC: arjan@linux.intel.com
Signed-off-by: Linus Torvalds -
This patch fixes a build error in the pxa2xx-spi driver,
introduced by commit 7e96445533ac3f4f7964646a202ff3620602fab4
("pxa2xx_spi: dma bugfixes")CC drivers/spi/pxa2xx_spi.o
drivers/spi/pxa2xx_spi.c: In function 'map_dma_buffers':
drivers/spi/pxa2xx_spi.c:331: error: invalid operands to binary &
drivers/spi/pxa2xx_spi.c:331: error: invalid operands to binary &
drivers/spi/pxa2xx_spi.c: In function 'pump_transfers':
drivers/spi/pxa2xx_spi.c:897: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'unsigned int'[dbrownell@users.sourceforge.net: fix warning too ]
Signed-off-by: Mike Rapoport
Acked-by: Eric Miao
Signed-off-by: Andrew Morton
Signed-off-by: David Brownell
Signed-off-by: Linus Torvalds -
…git/tip/linux-2.6-tip
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86, vmi: fix broken LDT access
x86: fix typo in enable_mtrr_cleanup early parameter -
Fix the IRQ handling on the MN10300 arch.
This patch makes a number of significant changes:
(1) It separates the irq_chip definition for edge-triggered interrupts from
the one for level-triggered interrupts.This is necessary because the MN10300 PIC latches the IRQ channel's
interrupt request bit (GxICR_REQUEST), even after the device has ceased to
assert its interrupt line and the interrupt channel has been disabled in
the PIC. So for level-triggered interrupts we need to clear this bit when
we re-enable - which is achieved by setting GxICR_DETECT but not
GxICR_REQUEST when writing to the register.Not doing this results in spurious interrupts occurring because calling
mask_ack() at the start of handle_level_irq() is insufficient - it fails
to clear the REQUEST latch because the device that caused the interrupt is
still asserting its interrupt line at this point.(2) IRQ disablement [irq_chip::disable_irq()] shouldn't clear the interrupt
request flag for edge-triggered interrupts lest it lose an interrupt.(3) IRQ unmasking [irq_chip::unmask_irq()] also shouldn't clear the interrupt
request flag for edge-triggered interrupts lest it lose an interrupt.(4) The end() operation is now left to the default (no-operation) as
__do_IRQ() is compiled out. This may affect misrouted_irq(), but
according to Thomas Gleixner it's the correct thing to do.(5) handle_level_irq() is used for edge-triggered interrupts rather than
handle_edge_irq() as the MN10300 PIC latches interrupt events even on
masked IRQ channels, thus rendering IRQ_PENDING unnecessary. It is
sufficient to call mask_ack() at the start and unmask() at the end.(6) For level-triggered interrupts, ack() is now NULL as it's not used, and
there is no effective ACK function on the PIC. mask_ack() is now the
same as mask() as the latch continues to latch, even when the channel is
masked.Further, the patch discards the disable() op implementation as its now the same
as the mask() op implementation, which is used instead.It also discards the enable() op implementations as they're now the same as
the unmask() op implementations, which are used instead.Signed-off-by: David Howells
Signed-off-by: Linus Torvalds -
* git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm:
dm mpath: add missing path switching locking
dm: cope with access beyond end of device in dm_merge_bvec
dm: always allow one page in dm_merge_bvec -
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
af_key: Free dumping state on socket close
XFRM,IPv6: initialize ip6_dst_blackhole_ops.kmem_cachep
ipv6: NULL pointer dereferrence in tcp_v6_send_ack
tcp: Fix NULL dereference in tcp_4_send_ack()
sctp: Fix kernel panic while process protocol violation parameter
iucv: Fix mismerge again.
ipsec: Fix pskb_expand_head corruption in xfrm_state_check_space
01 Oct, 2008
11 commits
-
Moving the path activation to workqueue along with scsi_dh patches introduced
a race. It is due to the fact that the current_pgpath (in the multipath data
structure) can be modified if changes happen in any of the paths leading to
the lun. If the changes lead to current_pgpath being set to NULL, then it
leads to the invalid access which results in the panic below.This patch fixes that by storing the pgpath to activate in the multipath data
structure and properly protecting it.Note that if activate_path is called twice in succession with different pgpath,
with the second one being called before the first one is done, then activate
path will be called twice for the second pgpath, which is fine.Unable to handle kernel paging request for data at address 0x00000020
Faulting instruction address: 0xd000000000aa1844
cpu 0x1: Vector: 300 (Data Access) at [c00000006b987a80]
pc: d000000000aa1844: .activate_path+0x30/0x218 [dm_multipath]
lr: c000000000087a2c: .run_workqueue+0x114/0x204
sp: c00000006b987d00
msr: 8000000000009032
dar: 20
dsisr: 40000000
current = 0xc0000000676bb3f0
paca = 0xc0000000006f3680
pid = 2528, comm = kmpath_handlerd
enter ? for help
[c00000006b987da0] c000000000087a2c .run_workqueue+0x114/0x204
[c00000006b987e40] c000000000088b58 .worker_thread+0x120/0x144
[c00000006b987f00] c00000000008ca70 .kthread+0x78/0xc4
[c00000006b987f90] c000000000027cc8 .kernel_thread+0x4c/0x68Signed-off-by: Chandra Seetharaman
Signed-off-by: Alasdair G Kergon -
If for any reason dm_merge_bvec() is given an offset beyond the end of the
device, avoid an oops and always allow one page to be added to an empty bio.
We'll reject the I/O later after the bio is submitted.Signed-off-by: Mikulas Patocka
Signed-off-by: Alasdair G Kergon -
Some callers assume they can always add at least one page to an empty bio,
so dm_merge_bvec should not return 0 in this case: we'll reject the I/O
later after the bio is submitted.Signed-off-by: Mikulas Patocka
Signed-off-by: Alasdair G Kergon -
Fix a xfrm_{state,policy}_walk leak if pfkey socket is closed while
dumping is on-going.Signed-off-by: Timo Teras
Signed-off-by: David S. Miller -
ip6_dst_blackhole_ops.kmem_cachep is not expected to be NULL (i.e. to
be initialized) when dst_alloc() is called from ip6_dst_blackhole().
Otherwise, it results in the following (xfrm_larval_drop is now set to
1 by default):[ 78.697642] Unable to handle kernel paging request for data at address 0x0000004c
[ 78.703449] Faulting instruction address: 0xc0097f54
[ 78.786896] Oops: Kernel access of bad area, sig: 11 [#1]
[ 78.792791] PowerMac
[ 78.798383] Modules linked in: btusb usbhid bluetooth b43 mac80211 cfg80211 ehci_hcd ohci_hcd sungem sungem_phy usbcore ssb
[ 78.804263] NIP: c0097f54 LR: c0334a28 CTR: c002d430
[ 78.809997] REGS: eef19ad0 TRAP: 0300 Not tainted (2.6.27-rc5)
[ 78.815743] MSR: 00001032 CR: 22242482 XER: 20000000
[ 78.821550] DAR: 0000004c, DSISR: 40000000
[ 78.827278] TASK = eef0df40[3035] 'mip6d' THREAD: eef18000
[ 78.827408] GPR00: 00001032 eef19b80 eef0df40 00000000 00008020 eef19c30 00000001 00000000
[ 78.833249] GPR08: eee5101c c05a5c10 ef9ad500 00000000 24242422 1005787c 00000000 1004f960
[ 78.839151] GPR16: 00000000 10024e90 10050040 48030018 0fe44150 00000000 00000000 eef19c30
[ 78.845046] GPR24: eef19e44 00000000 eef19bf8 efb37c14 eef19bf8 00008020 00009032 c0596064
[ 78.856671] NIP [c0097f54] kmem_cache_alloc+0x20/0x94
[ 78.862581] LR [c0334a28] dst_alloc+0x40/0xc4
[ 78.868451] Call Trace:
[ 78.874252] [eef19b80] [c03c1810] ip6_dst_lookup_tail+0x1c8/0x1dc (unreliable)
[ 78.880222] [eef19ba0] [c0334a28] dst_alloc+0x40/0xc4
[ 78.886164] [eef19bb0] [c03cd698] ip6_dst_blackhole+0x28/0x1cc
[ 78.892090] [eef19be0] [c03d9be8] rawv6_sendmsg+0x75c/0xc88
[ 78.897999] [eef19cb0] [c038bca4] inet_sendmsg+0x4c/0x78
[ 78.903907] [eef19cd0] [c03207c8] sock_sendmsg+0xac/0xe4
[ 78.909734] [eef19db0] [c03209e4] sys_sendmsg+0x1e4/0x2a0
[ 78.915540] [eef19f00] [c03220a8] sys_socketcall+0xfc/0x210
[ 78.921406] [eef19f40] [c0014b3c] ret_from_syscall+0x0/0x38
[ 78.927295] --- Exception: c01 at 0xfe2d730
[ 78.927297] LR = 0xfe2d71c
[ 78.939019] Instruction dump:
[ 78.944835] 91640018 9144001c 900a0000 4bffff44 9421ffe0 7c0802a6 bf810010 7c9d2378
[ 78.950694] 90010024 7fc000a6 57c0045e 7c000124 8383005c 2f9f0000 419e0050
[ 78.956464] ---[ end trace 05fa1ed7972487a1 ]---As commented by Benjamin Thery, the bug was introduced by
f2fc6a54585a1be6669613a31fbaba2ecbadcd36, while adding network
namespaces support to ipv6 routes.Signed-off-by: Arnaud Ebalard
Acked-by: Benjamin Thery
Signed-off-by: David S. Miller -
The following actions are possible:
tcp_v6_rcv
skb->dev = NULL;
tcp_v6_do_rcv
tcp_v6_hnd_req
tcp_check_req
req->rsk_ops->send_ack == tcp_v6_send_ackSo, skb->dev can be NULL in tcp_v6_send_ack. We must obtain namespace
from dst entry.Thanks to Vitaliy Gusev for initial problem finding
in IPv4 code.Signed-off-by: Denis V. Lunev
Signed-off-by: David S. Miller -
Fix NULL dereference in tcp_4_send_ack().
As skb->dev is reset to NULL in tcp_v4_rcv() thus OOPS occurs:
BUG: unable to handle kernel NULL pointer dereference at 00000000000004d0
IP: [] tcp_v4_send_ack+0x203/0x250Stack: ffff810005dbb000 ffff810015c8acc0 e77b2c6e5f861600 a01610802e90cb6d
0a08010100000000 88afffff88afffff 0000000080762be8 0000000115c872e8
0004122000000000 0000000000000001 ffffffff80762b88 0000000000000020
Call Trace:
[] tcp_v4_reqsk_send_ack+0x20/0x22
[] tcp_check_req+0x108/0x14c
[] ? rt_intern_hash+0x322/0x33c
[] tcp_v4_do_rcv+0x399/0x4ec
[] ? skb_checksum+0x4f/0x272
[] ? __inet_lookup_listener+0x14a/0x15c
[] tcp_v4_rcv+0x6a1/0x701
[] ip_local_deliver_finish+0x157/0x24a
[] ip_local_deliver+0x72/0x7c
[] ip_rcv_finish+0x38d/0x3b2
[] ? scsi_io_completion+0x19d/0x39e
[] ip_rcv+0x2a2/0x2e5
[] netif_receive_skb+0x293/0x303
[] process_backlog+0x80/0xd0
[] ? __rcu_process_callbacks+0x125/0x1b4
[] net_rx_action+0xb9/0x17f
[] __do_softirq+0xa3/0x164
[] call_softirq+0x1c/0x28
[] do_softirq+0x34/0x72
[] local_bh_enable_ip+0x3f/0x50
[] _spin_unlock_bh+0x12/0x14
[] release_sock+0xb8/0xc1
[] inet_stream_connect+0x146/0x25c
[] ? autoremove_wake_function+0x0/0x38
[] sys_connect+0x68/0x8e
[] ? fd_install+0x5f/0x68
[] ? sock_map_fd+0x55/0x62
[] system_call_after_swapgs+0x7b/0x80Code: 41 10 11 d0 83 d0 00 4d 85 ed 89 45 c0 c7 45 c4 08 00 00 00 74 07 41 8b 45 04 89 45 c8 48 8b 43 20 8b 4d b8 48 8d 55 b0 48 89 de 8b 80 d0 04 00 00 48 8b b8 60 01 00 00 e8 20 ae fe ff 65 48
RIP [] tcp_v4_send_ack+0x203/0x250
RSP
CR2: 00000000000004d0Signed-off-by: Vitaliy Gusev
Signed-off-by: David S. Miller -
This one took a long time to rear up because LDT usage is not very
common, but the bug is quite serious. It got introduced along with
another bug, already fixed, by 75b8bb3e56ca09a467fbbe5229bc68627f7445beAfter investigating a JRE failure, I found this bug was introduced a long time
ago, and had already managed to survive another bugfix which occurred on the
same line. The result is a total failure of the JRE due to LDT selectors not
working properly.Signed-off-by: Zachary Amsden
Cc: Glauber de Oliveira Costa
Cc: stable@kernel.org
Signed-off-by: Ingo Molnar -
After investigating a JRE failure, I found this bug was introduced a
long time ago, and had already managed to survive another bugfix which
occurred on the same line. The result is a total failure of the JRE due
to LDT selectors not working properly.This one took a long time to rear up because LDT usage is not very
common, but the bug is quite serious. It got introduced along with
another bug, already fixed, by 75b8bb3e56ca09a467fbbe5229bc68627f7445beSigned-off-by: Zachary Amsden
Cc: Ingo Molnar
Cc: Glauber de Oliveira Costa
Cc:
Signed-off-by: Linus Torvalds -
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
[IA64] Put the space for cpu0 per-cpu area into .data section -
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ALSA: hda - Fix model for Dell Inspiron 1525
ALSA: ASoC: Fix cs4270 error path
30 Sep, 2008
13 commits
-
* 'for-linus' of git://git.o-hand.com/linux-mfd:
mfd: Fix asic3 compilation
mfd: Fix Kconfig accroding to the new gpiolib symbols -
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc: Fix failure to shutdown with CPU hotplug
powerpc: Fix PCI in Holly device tree -
…el/git/tip/linux-2.6-tip
* 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
hrtimer: prevent migration of per CPU hrtimers
hrtimer: mark migration state
hrtimer: fix migration of CB_IRQSAFE_NO_SOFTIRQ hrtimers
hrtimer: migrate pending list on cpu offlineAcked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Tested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> -
Since call to function sctp_sf_abort_violation() need paramter 'arg' with
'struct sctp_chunk' type, it will read the chunk type and chunk length from
the chunk_hdr member of chunk. But call to sctp_sf_violation_paramlen()
always with 'struct sctp_paramhdr' type's parameter, it will be passed to
sctp_sf_abort_violation(). This may cause kernel panic.sctp_sf_violation_paramlen()
|-- sctp_sf_abort_violation()
|-- sctp_make_abort_violation()This patch fixed this problem. This patch also fix two place which called
sctp_sf_violation_paramlen() with wrong paramter type.Signed-off-by: Wei Yongjun
Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller -
Dell Inspiron 1525 seems to have a buggy BIOS setup and screws up
the recent codec parser, as reported by Oleksandr Natalenko:
http://lkml.org/lkml/2008/9/12/203This patch adds the working model, dell-3stack, statically.
Signed-off-by: Takashi Iwai
Cc: -
The error path in cs4270_probe/cs4270_remove is pretty broken:
* If cs4270_probe fails, codec is leaked.
* If snd_soc_register_card fails, cs4270_i2c_driver stays registered.
* If I2C support is enabled but no I2C device is found, i2c_del_driver
is never called (neither in cs4270_probe nor in cs4270_remove.Fix all 3 problems by implementing a clean error path in cs4270_probe
and jumping to its labels as needed.Signed-off-by: Jean Delvare
Acked-by: Timur Tabi
Signed-off-by: Takashi Iwai -
fb65a7c091529bfffb1262515252c0d0f6241c5c ("iucv: Fix bad merging.") fixed
a merge error, but in a wrong way. We now end up with the bug below.
This patch corrects the mismerge like it was intended.BUG: scheduling while atomic: swapper/1/0x00000000
Modules linked in:
CPU: 1 Not tainted 2.6.27-rc7-00094-gc0f4d6d #9
Process swapper (pid: 1, task: 000000003fe7d988, ksp: 000000003fe838c0)
0000000000000000 000000003fe839b8 0000000000000002 0000000000000000
000000003fe83a58 000000003fe839d0 000000003fe839d0 0000000000390de6
000000000058acd8 00000000000000d0 000000003fe7dcd8 0000000000000000
000000000000000c 000000000000000d 0000000000000000 000000003fe83a28
000000000039c5b8 0000000000015e5e 000000003fe839b8 000000003fe83a00
Call Trace:
([] show_trace+0xe6/0x134)
[] __schedule_bug+0xa2/0xa8
[] schedule+0x49c/0x910
[] schedule_timeout+0xc4/0x114
[] wait_for_common+0xe8/0x1b4
[] call_usermodehelper_exec+0xa6/0xec
[] kobject_uevent_env+0x418/0x438
[] bus_add_driver+0x1e4/0x298
[] driver_register+0x90/0x18c
[] netiucv_init+0x168/0x2c8
[] do_one_initcall+0x3e/0x17c
[] kernel_init+0x1ce/0x248
[] kernel_thread_starter+0x6/0xc
[] kernel_thread_starter+0x0/0xc
iucv: NETIUCV driver initialized
initcall netiucv_init+0x0/0x2c8 returned with preemption imbalanceSigned-off-by: Heiko Carstens
Signed-off-by: David S. Miller -
We're never supposed to shrink the headroom or tailroom. In fact,
shrinking the headroom is a fatal action.Signed-off-by: Herbert Xu
Signed-off-by: David S. Miller -
Correct typo for 'enable_mtrr_cleanup' early boot param name.
Signed-off-by: J.A. Magallon
Signed-off-by: Ingo Molnar -
map_size was declared from the wrong place.
Signed-off-by: Samuel Ortiz
-
HAVE_GPIO_LIB has basically been replaced by GPIOLIB
Signed-off-by: Samuel Ortiz
-
I tracked down the shutdown regression to CPUs not dying
when being shut down during power-off. This turns out to
be due to the system_state being SYSTEM_POWER_OFF, which
this code doesn't take as a valid state for shutting off
CPUs in.This has never made sense to me, but when I added hotplug
code to implement hibernate I only "made it work" and did
not question the need to check the system_state. Thomas
Gleixner helped me dig, but the only thing we found is
that it was added with the original commit that added CPU
hotplug support.Signed-off-by: Johannes Berg
Acked-by: Joel Schopp
Signed-off-by: Benjamin Herrenschmidt -
The PCI bridge on the Holly board is incorrectly represented in the
device tree. The current device tree node for the PCI bridge sits
under the tsi-bridge node. That's not obviously wrong, but the PCI
bridge translates some PCI spaces into CPU address ranges which were
not translated by the "ranges" property in tsi-bridge node.We used to get away with this problem because the PCI bridge discovery
code was also buggy, assuming incorrectly that PCI host bridge nodes
were always directly under the root bus and treating the translated
addresses as raw CPU addresses, rather than parent bus addresses.
This has since been fixed, thus breaking Holly.This could be fixed by adding extra translations to the tsi-bridge
node, but this patch instead moves the Holly PCI bridge out of the
tsi-bridge node to the root bus. This makes the tsi-bridge node
represent only the built-in IO devices in the bridge, with a
more-or-less contiguous address range. This is the same convention
used on Freescale SoC chips, where the "soc" node represents only the
IMMR region, and the PCI and other bus bridges are separate nodes
under the root bus.Signed-off-by: David Gibson
Acked-by: Josh Boyer
Signed-off-by: Benjamin Herrenschmidt
