user: Ohad Ben-Cohen date: Tue Mar 08 16:55:04 2011 -0500 files: drivers/mmc/core/core.c description: mmc: fix CONFIG_MMC_UNSAFE_RESUME regression 30201e7f3 ("mmc: skip detection of nonremovable cards on rescan") allowed skipping detection of nonremovable cards on mmc_rescan(). The intention was to only skip detection of hardwired cards that cannot be removed, so make sure this is indeed the case by directly checking for (lack of) MMC_CAP_NONREMOVABLE, instead of using mmc_card_is_removable(), which is overloaded with CONFIG_MMC_UNSAFE_RESUME semantics. The user-visible symptom of the bug this patch fixes is that no "mmc: card XXXX removed" message appears in dmesg when a card is removed and CONFIG_MMC_UNSAFE_RESUME=y. Reported-and-tested-by: Dmitry Shmidt Reported-and-tested-by: Maxim Levitsky Signed-off-by: Ohad Ben-Cohen Signed-off-by: Chris Ball committer: Chris Ball user: Naga Chumbalkar date: Wed Mar 09 12:33:15 2011 -0500 files: arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c description: [CPUFREQ] pcc-cpufreq: don't load driver if get_freq fails during init. Return 0 on failure. This will cause the initialization of the driver to fail and prevent the driver from loading if the BIOS cannot handle the PCC interface command to "get frequency". Otherwise, the driver will load and display a very high value like "4294967274" (which is actually -EINVAL) for frequency: # cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_cur_freq 4294967274 Signed-off-by: Naga Chumbalkar CC: stable@kernel.org Signed-off-by: Dave Jones committer: Dave Jones user: Jiri Slaby date: Wed Mar 09 21:33:37 2011 +0000 files: drivers/watchdog/sbc_fitpc2_wdt.c description: watchdog: sbc_fitpc2_wdt, fix crash on systems without DMI_BOARD_NAME Some systems don't provide DMI_BOARD_NAME in their DMI tables. Avoid crash in such situations in fitpc2_wdt_init. The fix is to check if the dmi_get_system_info return value is NULL. The oops: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] strstr+0x26/0xa0 PGD 3966e067 PUD 39605067 PMD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map CPU 1 Modules linked in: ... Pid: 1748, comm: modprobe Not tainted 2.6.37-22-default #1 /Bochs RIP: 0010:[] [] strstr+0x26/0xa0 RSP: 0018:ffff88003ad73f18 EFLAGS: 00010206 RAX: 0000000000000000 RBX: 00000000ffffffed RCX: 00000000ffffffff RDX: ffffffffa003f4cc RSI: ffffffffa003f4c2 RDI: 0000000000000000 ... CR2: 0000000000000000 CR3: 000000003b7ac000 CR4: 00000000000006e0 ... Process modprobe (pid: 1748, threadinfo ffff88003ad72000, task ffff88002e6365c0) Stack: ... Call Trace: [] fitpc2_wdt_init+0x1f/0x13c [sbc_fitpc2_wdt] [] do_one_initcall+0x3a/0x170 ... Code: f3 c3 0f 1f 00 80 3e 00 53 48 89 f8 74 1b 48 89 f2 0f 1f 40 00 48 83 c2 01 80 3a 00 75 f7 49 89 d0 48 89 f8 49 29 f0 75 02 5b c3 <80> 3f 00 74 0e 0f 1f 44 00 00 48 83 c0 01 80 38 00 75 f7 49 89 Signed-off-by: Jiri Slaby Signed-off-by: Wim Van Sebroeck committer: Wim Van Sebroeck user: Al Viro date: Fri Mar 04 13:14:21 2011 -0500 files: fs/namei.c description: minimal fix for do_filp_open() race failure exits on the no-O_CREAT side of do_filp_open() merge with those of O_CREAT one; unfortunately, if do_path_lookup() returns -ESTALE, we'll get out_filp:, notice that we are about to return -ESTALE without having trying to create the sucker with LOOKUP_REVAL and jump right into the O_CREAT side of code. And proceed to try and create a file. Usually that'll fail with -ESTALE again, but we can race and get that attempt of pathname resolution to succeed. open() without O_CREAT really shouldn't end up creating files, races or not. The real fix is to rearchitect the whole do_filp_open(), but for now splitting the failure exits will do. Signed-off-by: Al Viro user: Al Viro date: Tue Mar 08 02:22:27 2011 -0500 files: fs/proc/inode.c fs/proc/proc_sysctl.c include/linux/sysctl.h kernel/sysctl.c description: unfuck proc_sysctl ->d_compare() a) struct inode is not going to be freed under ->d_compare(); however, the thing PROC_I(inode)->sysctl points to just might. Fortunately, it's enough to make freeing that sucker delayed, provided that we don't step on its ->unregistering, clear the pointer to it in PROC_I(inode) before dropping the reference and check if it's NULL in ->d_compare(). b) I'm not sure that we *can* walk into NULL inode here (we recheck dentry->seq between verifying that it's still hashed / fetching dentry->d_inode and passing it to ->d_compare() and there's no negative hashed dentries in /proc/sys/*), but if we can walk into that, we really should not have ->d_compare() return 0 on it! Said that, I really suspect that this check can be simply killed. Nick? Signed-off-by: Al Viro user: Al Viro date: Tue Mar 08 21:16:28 2011 -0500 files: fs/namei.c description: nd->inode is not set on the second attempt in path_walk() We leave it at whatever it had been pointing to after the first link_path_walk() had failed with -ESTALE. Things do not work well after that... Signed-off-by: Al Viro user: Matt Turner date: Wed Mar 09 14:03:00 2011 -0800 files: arch/alpha/kernel/sys_titan.c description: alpha: fix compile error from IRQ clean up Signed-off-by: Matt Turner Signed-off-by: Linus Torvalds committer: Linus Torvalds user: Benny Halevy date: Tue Feb 22 15:55:09 2011 -0800 files: fs/nfsd/nfs4callback.c description: NFSD: fix decode_cb_sequence4resok Fix bug introduced in patch 85a56480 NFSD: Update XDR decoders in NFSv4 callback client Although decode_cb_sequence4resok ignores highest slotid and target highest slotid it must account for their space in their xdr stream when calling xdr_inline_decode Cc: Chuck Lever Signed-off-by: Benny Halevy Signed-off-by: J. Bruce Fields committer: J. Bruce Fields user: J. Bruce Fields date: Mon Mar 07 11:44:53 2011 -0500 files: fs/nfsd/nfs4state.c description: nfsd4: fix bad pointer on failure to find delegation In case of a nonempty list, the return on error here is obviously bogus; it ends up being a pointer to the list head instead of to any valid delegation on the list. In particular, if nfsd4_delegreturn() hits this case, and you're quite unlucky, then renew_client may oops, and it may take an embarassingly long time to figure out why. Facepalm. BUG: unable to handle kernel NULL pointer dereference at 0000000000000090 IP: [] nfsd4_delegreturn+0x125/0x200 ... Cc: stable@kernel.org Signed-off-by: J. Bruce Fields user: roel date: Tue Mar 08 19:46:10 2011 -0500 files: fs/nfsd/nfs4xdr.c description: nfsd: wrong index used in inner loop Index i was already used in the outer loop Cc: stable@kernel.org Signed-off-by: Roel Kluin Signed-off-by: J. Bruce Fields committer: J. Bruce Fields user: Rajendra Nayak date: Mon Mar 07 09:53:38 2011 +0000 files: drivers/i2c/busses/i2c-omap.c description: i2c-omap: Program I2C_WE on OMAP4 to enable i2c wakeup For the I2C module to be wakeup capable, programming I2C_WE register (which was skipped for OMAP4430) is needed even on OMAP4. This fixes i2c controller timeouts which were seen recently with the static dependency being cleared between MPU and L4PER clockdomains. Signed-off-by: Rajendra Nayak [ben-linux@fluff.org: re-flowed description] Signed-off-by: Ben Dooks committer: Ben Dooks user: Grant Likely date: Tue Mar 08 22:57:51 2011 +0000 files: drivers/i2c/busses/i2c-ocores.c description: i2c-ocores: Fix pointer type mismatch error ocores_i2c_of_probe needs to use a const __be32 type for handing device tree property values. This patch fixed the following build warning: CC drivers/i2c/busses/i2c-ocores.o drivers/i2c/busses/i2c-ocores.c: In function 'ocores_i2c_of_probe': drivers/i2c/busses/i2c-ocores.c:254: warning: assignment discards qualifiers from pointer target type drivers/i2c/busses/i2c-ocores.c:261: warning: assignment discards qualifiers from pointer target type Signed-off-by: Grant Likely Cc: Peter Korsgaard Cc: Ben Dooks Cc: linux-i2c@vger.kernel.org Signed-off-by: Ben Dooks committer: Ben Dooks user: Wolfram Sang date: Tue Mar 08 23:13:30 2011 +0000 files: drivers/i2c/busses/i2c-eg20t.c description: i2c-eg20t: include slab.h for memory allocations Fixes (with v2.6.38-rc3/parisc/parisc-allmodconfig): src/drivers/i2c/busses/i2c-eg20t.c:720: error: implicit declaration of function 'kzalloc' src/drivers/i2c/busses/i2c-eg20t.c:790: error: implicit declaration of function 'kfree' Reported-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang Cc: Tomoya MORINAGA Cc: Ben Dooks Signed-off-by: Ben Dooks committer: Ben Dooks user: Vasiliy Kulikov date: Thu Mar 10 10:25:19 2011 +1100 files: include/linux/netdevice.h net/core/dev.c net/ipv4/ip_gre.c net/ipv4/ipip.c net/ipv6/sit.c description: net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules Since a8f80e8ff94ecba629542d9b4b5f5a8ee3eb565c any process with CAP_NET_ADMIN may load any module from /lib/modules/. This doesn't mean that CAP_NET_ADMIN is a superset of CAP_SYS_MODULE as modules are limited to /lib/modules/**. However, CAP_NET_ADMIN capability shouldn't allow anybody load any module not related to networking. This patch restricts an ability of autoloading modules to netdev modules with explicit aliases. This fixes CVE-2011-1019. Arnd Bergmann suggested to leave untouched the old pre-v2.6.32 behavior of loading netdev modules by name (without any prefix) for processes with CAP_SYS_MODULE to maintain the compatibility with network scripts that use autoloading netdev modules by aliases like "eth0", "wlan0". Currently there are only three users of the feature in the upstream kernel: ipip, ip_gre and sit. root@albatros:~# capsh --drop=$(seq -s, 0 11),$(seq -s, 13 34) -- root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: fffffff800001000 CapEff: fffffff800001000 CapBnd: fffffff800001000 root@albatros:~# modprobe xfs FATAL: Error inserting xfs (/lib/modules/2.6.38-rc6-00001-g2bf4ca3/kernel/fs/xfs/xfs.ko): Operation not permitted root@albatros:~# lsmod | grep xfs root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit sit: error fetching interface information: Device not found root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit0 sit0 Link encap:IPv6-in-IPv4 NOARP MTU:1480 Metric:1 root@albatros:~# lsmod | grep sit sit 10457 0 tunnel4 2957 1 sit For CAP_SYS_MODULE module loading is still relaxed: root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: ffffffffffffffff CapEff: ffffffffffffffff CapBnd: ffffffffffffffff root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs xfs 745319 0 Reference: https://lkml.org/lkml/2011/2/24/203 Signed-off-by: Vasiliy Kulikov Signed-off-by: Michael Tokarev Acked-by: David S. Miller Acked-by: Kees Cook Signed-off-by: James Morris committer: James Morris user: Stephen Rothwell date: Wed Mar 09 16:43:24 2011 -0800 files: include/linux/sysctl.h description: sysctl: the include of rcupdate.h is only needed in the kernel Fixes this build-check error: include/linux/sysctl.h:28: included file 'linux/rcupdate.h' is not exported Signed-off-by: Stephen Rothwell Signed-off-by: Linus Torvalds committer: Linus Torvalds user: Benjamin Herrenschmidt date: Thu Mar 10 10:06:02 2011 +1100 files: arch/powerpc/include/asm/lppaca.h arch/powerpc/kernel/paca.c arch/powerpc/platforms/iseries/dt.c arch/powerpc/platforms/iseries/setup.c description: powerpc/iseries: Fix early init access to lppaca The combination of commit 8154c5d22d91cd16bd9985b0638c8957e4688d0e and 93c22703efa72c7527dbd586d1951c1f4a85fd70 Broke boot on iSeries. The problem is that iSeries very early boot code, which generates the device-tree and runs before our normal early initializations does need access the lppaca's very early, before the PACA array is initialized, and in fact even before the boot PACA has been initialized (it contains all 0's at this stage). However, the first patch above makes that code use the new llpaca_of(cpu) accessor, which itself is changed by the second patch to use the PACA array. We fix that by reverting iSeries to directly dereferencing the array. In addition, we fix all iterators in the iSeries code to always skip CPU whose number is above 63 which is the maximum size of that array and the maximum number of supported CPUs on these machines. Additionally, we make sure the boot_paca is properly initialized in our early startup code. Signed-off-by: Benjamin Herrenschmidt user: Benjamin Herrenschmidt date: Thu Mar 10 10:06:41 2011 +1100 files: arch/powerpc/mm/numa.c description: powerpc/pseries: Disable VPNH feature This feature triggers nasty races in the scheduler between the rebuilding of the topology and the load balancing code, causing the machine to hang. Disable it for now until the races are fixed. Signed-off-by: Benjamin Herrenschmidt user: Al Viro date: Thu Mar 10 03:41:53 2011 -0500 files: fs/proc/base.c description: /proc/self is never going to be invalidated... Signed-off-by: Al Viro user: Al Viro date: Thu Mar 10 03:42:01 2011 -0500 files: fs/reiserfs/xattr.c description: reiserfs xattr ->d_revalidate() shouldn't care about RCU ... it returns an error unconditionally Signed-off-by: Al Viro user: Al Viro date: Thu Mar 10 03:44:05 2011 -0500 files: fs/ceph/dir.c description: ceph: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro user: Al Viro date: Thu Mar 10 03:44:31 2011 -0500 files: fs/fuse/dir.c description: fuse: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro user: Al Viro date: Thu Mar 10 03:44:48 2011 -0500 files: fs/gfs2/dentry.c description: gfs2: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro user: Al Viro date: Thu Mar 10 03:45:07 2011 -0500 files: fs/ocfs2/dcache.c description: ocfs2: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro user: Al Viro date: Thu Mar 10 03:45:28 2011 -0500 files: fs/jfs/namei.c description: jfs: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro user: Al Viro date: Thu Mar 10 03:45:49 2011 -0500 files: fs/fat/namei_vfat.c description: fat: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro user: Stephen Rothwell date: Thu Mar 10 04:19:56 2011 -0500 files: include/linux/sysctl.h description: sysctl: the include of rcupdate.h is only needed in the kernel Fixes this built error: include/linux/sysctl.h:28: included file 'linux/rcupdate.h' is not exported Signed-off-by: Stephen Rothwell Acked-by: Al Viro Signed-off-by: Al Viro committer: Al Viro user: Marco Stornelli date: Thu Mar 10 04:22:15 2011 -0500 files: fs/open.c description: Check for immutable/append flag in fallocate path In the fallocate path the kernel doesn't check for the immutable/append flag. It's possible to have a race condition in this scenario: an application open a file in read/write and it does something, meanwhile root set the immutable flag on the file, the application at that point can call fallocate with success. In addition, we don't allow to do any unreserve operation on an append only file but only the reserve one. Signed-off-by: Marco Stornelli Signed-off-by: Al Viro committer: Al Viro user: J. Bruce Fields date: Thu Mar 10 05:18:54 2011 -0500 files: fs/dcache.c description: fs/dcache: allow d_obtain_alias() to return unhashed dentries Without this patch, inodes are not promptly freed on last close of an unlinked file by an nfs client: client$ mount -tnfs4 server:/export/ /mnt/ client$ tail -f /mnt/FOO ... server$ df -i /export server$ rm /export/FOO (^C the tail -f) server$ df -i /export server$ echo 2 >/proc/sys/vm/drop_caches server$ df -i /export the df's will show that the inode is not freed on the filesystem until the last step, when it could have been freed after killing the client's tail -f. On-disk data won't be deallocated either, leading to possible spurious ENOSPC. This occurs because when the client does the close, it arrives in a compound with a putfh and a close, processed like: - putfh: look up the filehandle. The only alias found for the inode will be DCACHE_UNHASHED alias referenced by the filp this, so it creates a new DCACHE_DISCONECTED dentry and returns that instead. - close: closes the existing filp, which is destroyed immediately by dput() since it's DCACHE_UNHASHED. - end of the compound: release the reference to the current filehandle, and dput() the new DCACHE_DISCONECTED dentry, which gets put on the unused list instead of being destroyed immediately. Nick Piggin suggested fixing this by allowing d_obtain_alias to return the unhashed dentry that is referenced by the filp, instead of making it create a new dentry. Leave __d_find_alias() alone to avoid changing behavior of other callers. Also nfsd doesn't need all the checks of __d_find_alias(); any dentry, hashed or unhashed, disconnected or not, should work. Signed-off-by: J. Bruce Fields Signed-off-by: Al Viro committer: Al Viro user: Daniel J Blueman date: Tue Mar 01 16:32:03 2011 -0800 files: arch/x86/boot/compressed/mkpiggy.c description: x86, build: Make sure mkpiggy fails on read error Ensure build doesn't silently continue despite read failure, addressing a warning due to the unchecked call. Signed-off-by: Daniel J Blueman LKML-Reference: Signed-off-by: H. Peter Anvin committer: H. Peter Anvin user: Yinghai Lu date: Fri Mar 04 15:20:19 2011 +0100 files: arch/x86/mm/numa_64.c description: x86, numa: Fix numa_emulation code with memory-less node0 This crash happens on a system that does not have RAM on node0. When numa_emulation is compiled in, and: 1. we boot the system without numa=fake... 2. or we boot the system with numa=fake=128 to make emulation fail we will get: [ 0.076025] ------------[ cut here ]------------ [ 0.080004] kernel BUG at arch/x86/mm/numa_64.c:788! [ 0.080004] invalid opcode: 0000 [#1] SMP [...] need to use early_cpu_to_node() directly, because cpu_to_apicid and apicid_to_node will return node0 that is not onlined. Signed-off-by: Yinghai Lu Acked-by: Tejun Heo Cc: David Rientjes LKML-Reference: <4D6ECF72.5010308@kernel.org> Signed-off-by: Ingo Molnar committer: Ingo Molnar user: Cliff Wickman date: Wed Mar 09 16:36:16 2011 +0100 files: arch/x86/include/asm/uv/uv_bau.h arch/x86/platform/uv/tlb_uv.c description: x86, UV: Initialize the broadcast assist unit base destination node id properly The BAU's initialization of the broadcast description header is lacking the coherence domain (high bits) in the nasid. This causes a catastrophic system failure when running on a system with multiple coherence domains. Signed-off-by: Cliff Wickman LKML-Reference: Signed-off-by: Ingo Molnar committer: Ingo Molnar user: Takashi Iwai date: Thu Mar 10 13:06:57 2011 -0800 files: drivers/gpu/drm/i915/i915_reg.h drivers/gpu/drm/i915/intel_panel.c description: drm/i915: Revive combination mode for backlight control This reverts commit 951f3512dba5bd44cda3e5ee22b4b522e4bb09fb drm/i915: Do not handle backlight combination mode specially since this commit introduced other regressions due to untouched LBPC register, e.g. the backlight dimmed after resume. In addition to the revert, this patch includes a fix for the original issue (weird backlight levels) by removing the wrong bit shift for computing the current backlight level. Also, including typo fixes (lpbc -> lbpc). Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=34524 Acked-by: Indan Zupancic Reviewed-by: Keith Packard Reviewed-by: Jesse Barnes Cc: Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds committer: Linus Torvalds user: Arnaldo Carvalho de Melo date: Mon Feb 28 13:54:38 2011 -0300 files: tools/perf/util/symbol.c description: perf symbols: Fix vmlinux path when not using --symfs The ec5761e cset introduced the symfs feature with a bug for loading vmlinux files that ended up causing this failure: [root@emilia v2.6.38-rc5+]# strace -e trace=open perf top --vmlinux ./vmlinux 2>&1 | tail -3 open("/./vmlinux", O_RDONLY) = -1 ENOENT (No such file or directory) ./vmlinux with build id b9266bf40e98dadb5d43a2f3e95d3c5d4aff46dc not found, continuing without symbols The ./vmlinux file can't be used [root@emilia v2.6.38-rc5+]# Remove the extra slash, just like is done in the DSO__ORIG_DSO handling in dso__load() and other parts of the ec5761e cset. Reported-by: Ingo Molnar Cc: David Ahern Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Mike Galbraith Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Tom Zanussi LKML-Reference: Signed-off-by: Arnaldo Carvalho de Melo user: Lin Ming date: Wed Mar 09 13:44:10 2011 -0300 files: tools/perf/util/header.c description: perf symbols: Avoid resolving [kernel.kallsyms] to real path for buildid cache kallsyms has a virtual file name [kernel.kallsyms]. Currently, it can't be added to buildid cache successfully because the code (build_id_cache__add_s) tries to resolve [kernel.kallsyms] to a real absolute pathname and that fails. Fixes it by not resolving it and just use the name [kernel.kallsyms]. So dir ~/.debug/[kernel.kallsyms] is created. Original bug report at: https://lkml.org/lkml/2011/3/1/524 Tested-by: Han Pingtian Cc: Han Pingtian Cc: Ingo Molnar Cc: Peter Zijlstra LKML-Reference: <1299165837-27817-1-git-send-email-ming.m.lin@intel.com> Signed-off-by: Lin Ming Signed-off-by: Arnaldo Carvalho de Melo committer: Arnaldo Carvalho de Melo user: Balbir Singh date: Fri Mar 04 11:03:18 2011 +0100 files: kernel/sched_rt.c description: sched: Fix sched rt group scheduling when hierachy is enabled The current sched rt code is broken when it comes to hierarchical scheduling, this patch fixes two problems 1. It adds redundant enqueuing (harmless) when it finds a queue has tasks enqueued, but it has no run time and it is not throttled. 2. The most important change is in sched_rt_rq_enqueue/dequeue. The code just picks the rt_rq belonging to the current cpu on which the period timer runs, the patch fixes it, so that the correct rt_se is enqueued/dequeued. Tested with a simple hierarchy /c/d, c and d assigned similar runtimes of 50,000 and a while 1 loop runs within "d". Both c and d get throttled, without the patch, the task just stops running and never runs (depends on where the sched_rt b/w timer runs). With the patch, the task is throttled and runs as expected. [ bharata, suggestions on how to pick the rt_se belong to the rt_rq and correct cpu ] Signed-off-by: Balbir Singh Acked-by: Bharata B Rao Signed-off-by: Peter Zijlstra Cc: stable@kernel.org LKML-Reference: <20110303113435.GA2868@balbir.in.ibm.com> Signed-off-by: Ingo Molnar committer: Ingo Molnar user: Doe, YiCheng date: Thu Mar 10 13:21:16 2011 -0800 files: drivers/char/ipmi/ipmi_si_intf.c description: ipmi: Fix IPMI errors due to timing problems This patch fixes an issue in OpenIPMI module where sometimes an ABORT command is sent after sending an IPMI request to BMC causing the IPMI request to fail. Signed-off-by: YiCheng Doe Signed-off-by: Corey Minyard Acked-by: Tom Mingarelli Tested-by: Andy Cress Tested-by: Mika Lansirine Tested-by: Brian De Wolf Cc: Jean Michel Audet Cc: Jozef Sudelsky Acked-by: Matthew Garrett Signed-off-by: Linus Torvalds committer: Linus Torvalds user: Malcolm Priestley date: Wed Feb 02 10:42:14 2011 -0200 files: drivers/media/dvb/dvb-usb/lmedm04.c description: [media] DM04/QQBOX memcpy to const char fix Driver Version v1.75 Kernel oops appears in 2.6.37-rc8 in lme_firmware_switch because of a memcpy to a const char. Signed-off-by: Malcolm Priestley Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Pawel Osciak date: Wed Feb 02 10:42:48 2011 -0200 files: drivers/media/video/mem2mem_testdev.c description: [media] Fix double free of video_device in mem2mem_testdev video_device is already being freed in video_device.release callback on release. Signed-off-by: Pawel Osciak Reported-by: Roland Kletzing Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: sensoray-dev date: Wed Feb 02 11:13:37 2011 -0200 files: drivers/media/video/s2255drv.c description: [media] s2255drv: firmware re-loading changes Change for firmware re-loading and updated firmware versions. Signed-off-by: Dean Anderson Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Mauro Carvalho Chehab date: Wed Feb 02 11:20:04 2011 -0200 files: drivers/media/rc/ir-raw.c description: [media] ir-raw: Properly initialize the IR event (BZ#27202) Changeset 4651918a4afdd49bdea21d2f919b189ef17a6399 changed the way events are stored. However, it forgot to fix ir_raw_event_store_edge() to work with the new way. Due to that, the decoders will likely do bad things. Signed-off-by: Mauro Carvalho Chehab user: Devin Heitmueller date: Wed Feb 02 12:08:33 2011 -0200 files: drivers/media/video/au0828/au0828-video.c description: [media] au0828: fix VBI handling when in V4L2 streaming mode au0828: fix VBI handling when in V4L2 streaming mode It turns up V4L2 streaming mode (a.k.a mmap) was broken for VBI streaming. This was causing libzvbi to fall back to V4L1 capture mode, and is a blatent violation of the V4L2 specification. Make the implementation work properly in this mode. Signed-off-by: Devin Heitmueller Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Antti Seppälä date: Wed Mar 02 13:44:40 2011 -0300 files: drivers/media/rc/rc-main.c description: [media] Fix sysfs rc protocol lookup for rc-5-sz With the current matching rules the lookup for rc protocol named rc-5-sz matches with "rc-5" before finding "rc-5-sz". Thus one is able to never enable/disable the rc-5-sz protocol via sysfs. Fix the lookup to require an exact match which allows the manipulation of sz protocol. Signed-off-by: Antti Seppälä Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Olivier Grenie date: Wed Mar 02 13:45:12 2011 -0300 files: drivers/media/dvb/dvb-usb/dib0700_devices.c drivers/media/dvb/frontends/dib7000m.c drivers/media/dvb/frontends/dib7000m.h description: [media] DiB7000M: add pid filtering This patch adds the pid filtering for the dib7000M demod. It also corrects the pid filtering for the dib7700 based board. It should prevent an oops, when using dib7700p based board. References: https://bugzilla.novell.com/show_bug.cgi?id=644807 Signed-off-by: Olivier Grenie Signed-off-by: Patrick Boettcher Tested-by: Pavel SKARKA Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Andy Walls date: Wed Mar 02 13:45:19 2011 -0300 files: drivers/media/video/cx23885/cx23885-i2c.c description: [media] cx23885: Revert "Check for slave nack on all transactions" This reverts commit 44835f197bf1e3f57464f23dfb239fef06cf89be. With the CX23885 hardware I2C master, checking for I2C slave ACK/NAK is not valid when the I2C_EXTEND or I2C_NOSTOP bits are set. Revert the commit that checks for I2C slave ACK/NAK on all transactions, so that XC5000 tuners work with the CX23885 again. Thanks go to Mark Zimmerman for reporting and bisecting this problem. Bisected-by: Mark Zimmerman Reported-by: Mark Zimmerman Signed-off-by: Andy Walls Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Andy Walls date: Wed Mar 02 13:45:27 2011 -0300 files: drivers/media/video/cx23885/cx23885-i2c.c description: [media] cx23885: Remove unused 'err:' labels to quiet compiler warning The previous revert-commit, that affected cx23885-i2c.c, left some unused labels that the compiler griped about. Clean them up. Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Sven Barth date: Wed Mar 02 13:45:33 2011 -0300 files: drivers/media/video/cx25840/cx25840-core.c description: [media] cx25840: fix probing of cx2583x chips Fix the probing of cx2583x chips, because two controls were clustered that are not created for these chips. This regression was introduced in 2.6.36. Signed-off-by: Sven Barth Signed-off-by: Andy Walls Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Michael date: Wed Mar 02 13:45:42 2011 -0300 files: drivers/media/video/ivtv/ivtv-irq.c description: [media] ivtv: Fix corrective action taken upon DMA ERR interrupt to avoid hang After upgrading the kernel from stock Ubuntu 7.10 to 10.04, with no hardware changes, I started getting the dreaded DMA TIMEOUT errors, followed by inability to encode until the machine was rebooted. I came across a post from Andy in March (http://www.gossamer-threads.com/lists/ivtv/users/40943#40943) where he speculates that perhaps the corrective actions being taken after a DMA ERROR are not sufficient to recover the situation. After some testing I suspect that this is indeed the case, and that in fact the corrective action may be what hangs the card's DMA engine, rather than the original error. Specifically these DMA ERROR IRQs seem to present with two different values in the IVTV_REG_DMASTATUS register: 0x11 and 0x13. The current corrective action is to clear that status register back to 0x01 or 0x03, and then issue the next DMA request. In the case of a 0x13 this seems to result in a minor glitch in the encoded stream due to the failed transfer that was not retried, but otherwise things continue OK. In the case of a 0x11 the card's DMA write engine is never heard from again, and a DMA TIMEOUT follows shortly after. 0x11 is the killer. I suspect that the two cases need to be handled differently. The difference is in bit 1 (0x02), which is set when the error is about to be successfully recovered, and clear when things are about to go bad. Bit 1 of DMASTATUS is described differently in different places either as a positive "write finished", or an inverted "write busy". If we take the first definition, then when an error arises with state 0x11, it means that the write did not complete. It makes sense to start a new transfer, as in the current code. But if we take the second definition, then 0x11 means "an error but the write engine is still busy". Trying to feed it a new transfer in this situation might not be a good idea. As an experiment, I added code to ignore the DMA ERROR IRQ if DMASTATUS is 0x11. I.e., don't start a new transfer, don't clear our flags, etc. The hope was that the card would complete the transfer and issue a ENC DMA COMPLETE, either successfully or with an error condition there. However the card still hung. The only remaining corrective action being taken with a 0x11 status was then the write back to the status register to clear the error, i.e. DMASTATUS = DMASTATUS & ~3. This would have the effect of clearing the error bit 4, while leaving the lower bits indicating DMA write busy. Strangely enough, removing this write to the status register solved the problem! If the DMA ERROR IRQ with DMASTATUS=0x11 is completely ignored, with no corrective action at all, then the card will complete the transfer and issue a new IRQ. If the status register is written to when it has the value 0x11, then the DMA engine hangs. Perhaps it's illegal to write to DMASTATUS while the read or write busy bit is set? At any rate, it appears that the current corrective action is indeed making things worse rather than better. I put together a patch that modifies ivtv_irq_dma_err to do the following: - Don't write back to IVTV_REG_DMASTATUS. - If write-busy is asserted, leave the card alone. Just extend the timeout slightly. - If write-busy is de-asserted, retry the current transfer. This has completely fixed my DMA TIMEOUT woes. DMA ERR events still occur, but now they seem to be correctly handled. 0x11 events no longer hang the card, and 0x13 events no longer result in a glitch in the stream, as the failed transfer is retried. I'm happy. I've inlined the patch below in case it is of interest. As described above, I have a theory about why it works (based on a different interpretation of bit 1 of DMASTATUS), but I can't guarantee that my theory is correct. There may be another explanation, or it may be a fluke. Maybe ignoring that IRQ entirely would be equally effective? Maybe the status register read/writeback sequence is race condition if the card changes it in the mean time? Also as I am using a PVR-150 only, I have not been able to test it on other cards, which may be especially relevant for 350s that support concurrent decoding. Hopefully the patch does not break the DMA READ path. Mike [awalls@md.metrocast.net: Modified patch to add a verbose comment, make minor brace reformats, and clear the error flags in the IVTV_REG_DMASTATUS iff both read and write DMA were not in progress. Mike's conjecture about a race condition with the writeback is correct; it can confuse the DMA engine.] [Comment and analysis from the ML post by Michael ] Signed-off-by: Andy Walls Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Devin Heitmueller date: Wed Mar 02 13:45:56 2011 -0300 files: drivers/media/video/cx18/cx18-cards.c drivers/media/video/cx18/cx18-driver.c drivers/media/video/cx18/cx18-driver.h drivers/media/video/cx18/cx18-dvb.c description: [media] cx18: Add support for Hauppauge HVR-1600 models with s5h1411 The newest variants of the HVR-1600 have an s5h1411/tda18271 for the digital frontend. Add support for these boards. Thanks to Hauppauge Computer Works for providing sample hardware. [awalls@md.metrocast.net: Changed an additional log message to clarify for the end user that the driver is defaulting to an original HVR-1600 for unknown model numbers.] Signed-off-by: Devin Heitmueller Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Jarod Wilson date: Wed Mar 02 14:12:24 2011 -0300 files: drivers/media/rc/nuvoton-cir.c drivers/media/rc/nuvoton-cir.h description: [media] nuvoton-cir: fix wake from suspend The CIR Wake FIFO is 67 bytes long, but the stock remote appears to only populate 65 of them. Limit comparison to 65 bytes, and wake from suspend works a whole lot better (it wasn't working at all for most folks). Fix based on comparison with the old lirc_wb677 driver from Nuvoton, debugging and testing done by Dave Treacy by way of the lirc mailing list. Reported-by: Dave Treacy Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Jarod Wilson date: Wed Mar 02 14:15:17 2011 -0300 files: drivers/media/rc/mceusb.c description: [media] mceusb: don't claim multifunction device non-IR parts There's a Realtek combo card reader and IR receiver device with multiple usb interfaces on it. The mceusb driver is incorrectly grabbing all of them. This change should make it bind to only interface 2 (patch based on lsusb output on the linux-media list from Lucian Muresan). Tested regression-free with the six mceusb devices I have myself. Reported-by: Patrick Boettcher Reported-by: Lucian Muresan Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Jarod Wilson date: Wed Mar 02 14:18:12 2011 -0300 files: drivers/media/common/tuners/tda8290.c description: [media] tda829x: fix regression in probe functions In commit 567aba0b7997dad5fe3fb4aeb174ee9018df8c5b, the probe address for tda8290_probe and tda8295_probe was hard-coded to 0x4b, which is the default i2c address for those devices, but its possible for the device to be at an alternate address, 0x42, which is the case for the HVR-1950. If we probe the wrong address, probe fails and we have a non-working device. We have the actual address passed into the function by way of i2c_props, we just need to use it. Also fix up some copy/paste comment issues and streamline debug spew a touch. Verified to restore my HVR-1950 to full working order. Special thanks to Ken Bass for reporting the issue in the first place, and to both he and Gary Buhrmaster for aiding in debugging and analysis of the problem. Reported-by: Ken Bass Tested-by: Jarod Wilson Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Arnaud Patard (Rtp) date: Thu Mar 03 10:15:35 2011 -0300 files: drivers/media/dvb/mantis/mantis_pci.c description: [media] mantis_pci: remove asm/pgtable.h include mantis_pci.c is including asm/pgtable.h and it's leading to a build failure on arm. It has been noticed here : https://buildd.debian.org/fetch.cgi?pkg=linux-2.6&arch=armel&ver=2.6.38~rc6-1~experimental.1&stamp=1298430952&file=log&as=raw As this header doesn't seem to be used, I'm removing it. I've build tested it with arm and x86. Signed-off-by: Arnaud Patard Signed-off-by: Mauro Carvalho Chehab committer: Mauro Carvalho Chehab user: Dmitry Kravkov date: Sun Mar 06 18:06:02 2011 -0800 files: drivers/net/bnx2x/bnx2x_main.c description: bnx2x: fix non-pmf device load flow Remove port MAX BW configuration from non-pmf functions, which caused reconfigure of HW according to 10G (fake) link. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller committer: David S. Miller user: Dmitry Kravkov date: Sun Mar 06 18:06:03 2011 -0800 files: drivers/net/bnx2x/bnx2x_main.c description: bnx2x: fix link notification Report link to OS and other PFs after HW is fully reconfigured according to new link parameters. (Affected only Multi Function modes). Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller committer: David S. Miller user: Dmitry Kravkov date: Sun Mar 06 18:06:03 2011 -0800 files: drivers/net/bnx2x/bnx2x.h drivers/net/bnx2x/bnx2x_cmn.c drivers/net/bnx2x/bnx2x_cmn.h drivers/net/bnx2x/bnx2x_ethtool.c description: bnx2x: (NPAR) prevent HW access in D3 state Changing speed setting in NPAR requires HW access, this patch delays the access to D0 state when performed in D3. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller committer: David S. Miller user: Dmitry Kravkov date: Sun Mar 06 18:06:04 2011 -0800 files: drivers/net/bnx2x/bnx2x.h description: bnx2x: fix MaxBW configuration Increase resolution of MaxBW algorithm to suit Min Bandwidth configuration. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller committer: David S. Miller user: Göran Weinholt date: Mon Mar 07 12:30:12 2011 -0800 files: drivers/net/smsc911x.c description: net/smsc911x.c: Set the VLAN1 register to fix VLAN MTU problem The smsc911x driver would drop frames longer than 1518 bytes, which is a problem for networks with VLAN tagging. The VLAN1 tag register is used to increase the legal frame size to 1522 when a VLAN tag is identified. Signed-off-by: Göran Weinholt Signed-off-by: David S. Miller committer: David S. Miller user: Thomas Graf date: Mon Mar 07 12:50:52 2011 -0800 files: net/Makefile description: net: Enter net/ipv6/ even if CONFIG_IPV6=n exthdrs_core.c and addrconf_core.c in net/ipv6/ contain bits which must be made available even if IPv6 is disabled. net/ipv6/Makefile already correctly includes them if CONFIG_IPV6=n but net/Makefile prevents entering the subdirectory. Signed-off-by: Thomas Graf Acked-by: Randy Dunlap Signed-off-by: David S. Miller committer: David S. Miller user: Rainer Weikusat date: Mon Mar 07 15:31:16 2011 -0800 files: net/unix/af_unix.c description: net: fix multithreaded signal handling in unix recv routines The unix_dgram_recvmsg and unix_stream_recvmsg routines in net/af_unix.c utilize mutex_lock(&u->readlock) calls in order to serialize read operations of multiple threads on a single socket. This implies that, if all n threads of a process block in an AF_UNIX recv call trying to read data from the same socket, one of these threads will be sleeping in state TASK_INTERRUPTIBLE and all others in state TASK_UNINTERRUPTIBLE. Provided that a particular signal is supposed to be handled by a signal handler defined by the process and that none of this threads is blocking the signal, the complete_signal routine in kernel/signal.c will select the 'first' such thread it happens to encounter when deciding which thread to notify that a signal is supposed to be handled and if this is one of the TASK_UNINTERRUPTIBLE threads, the signal won't be handled until the one thread not blocking on the u->readlock mutex is woken up because some data to process has arrived (if this ever happens). The included patch fixes this by changing mutex_lock to mutex_lock_interruptible and handling possible error returns in the same way interruptions are handled by the actual receive-code. Signed-off-by: Rainer Weikusat Signed-off-by: David S. Miller committer: David S. Miller user: Nicolas Kaiser date: Mon Mar 07 15:57:58 2011 -0800 files: drivers/net/macvtap.c description: drivers/net/macvtap: fix error check 'len' is unsigned of type size_t and can't be negative. Signed-off-by: Nicolas Kaiser Acked-by: Arnd Bergmann Signed-off-by: David S. Miller committer: David S. Miller user: Nils Carlson date: Mon Mar 07 16:02:17 2011 -0800 files: drivers/net/bonding/bond_3ad.c description: bonding 802.3ad: Fix the state machine locking v2 Changes since v1: * Clarify an unclear comment * Move a (possible) name change to a separate patch The ad_rx_machine, ad_periodic_machine and ad_port_selection_logic functions all inspect and alter common fields within the port structure. Previous to this patch, only the ad_rx_machines were mutexed, and the periodic and port_selection could run unmutexed against an ad_rx_machine trigged by an arriving LACPDU. This patch remedies the situation by protecting all the state machines from concurrency. This is accomplished by locking around all the state machines for a given port, which are executed at regular intervals; and the ad_rx_machine when handling an incoming LACPDU. Signed-off-by: Nils Carlson Signed-off-by: David S. Miller committer: David S. Miller user: Nils Carlson date: Mon Mar 07 16:02:18 2011 -0800 files: drivers/net/bonding/bond_3ad.c drivers/net/bonding/bond_3ad.h description: bonding 802.3ad: Rename rx_machine_lock to state_machine_lock Rename the rx_machine_lock to state_machine_lock as this makes more sense in light of it now protecting all the state machines against concurrency. Signed-off-by: Nils Carlson Signed-off-by: David S. Miller committer: David S. Miller user: Neil Horman date: Tue Mar 08 11:22:43 2011 -0800 files: net/rds/ib_send.c net/rds/loop.c description: rds: prevent BUG_ON triggering on congestion map updates Recently had this bug halt reported to me: kernel BUG at net/rds/send.c:329! Oops: Exception in kernel mode, sig: 5 [#1] SMP NR_CPUS=1024 NUMA pSeries Modules linked in: rds sunrpc ipv6 dm_mirror dm_region_hash dm_log ibmveth sg ext4 jbd2 mbcache sd_mod crc_t10dif ibmvscsic scsi_transport_srp scsi_tgt dm_mod [last unloaded: scsi_wait_scan] NIP: d000000003ca68f4 LR: d000000003ca67fc CTR: d000000003ca8770 REGS: c000000175cab980 TRAP: 0700 Not tainted (2.6.32-118.el6.ppc64) MSR: 8000000000029032 CR: 44000022 XER: 00000000 TASK = c00000017586ec90[1896] 'krdsd' THREAD: c000000175ca8000 CPU: 0 GPR00: 0000000000000150 c000000175cabc00 d000000003cb7340 0000000000002030 GPR04: ffffffffffffffff 0000000000000030 0000000000000000 0000000000000030 GPR08: 0000000000000001 0000000000000001 c0000001756b1e30 0000000000010000 GPR12: d000000003caac90 c000000000fa2500 c0000001742b2858 c0000001742b2a00 GPR16: c0000001742b2a08 c0000001742b2820 0000000000000001 0000000000000001 GPR20: 0000000000000040 c0000001742b2814 c000000175cabc70 0800000000000000 GPR24: 0000000000000004 0200000000000000 0000000000000000 c0000001742b2860 GPR28: 0000000000000000 c0000001756b1c80 d000000003cb68e8 c0000001742b27b8 NIP [d000000003ca68f4] .rds_send_xmit+0x4c4/0x8a0 [rds] LR [d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds] Call Trace: [c000000175cabc00] [d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds] (unreliable) [c000000175cabd30] [d000000003ca7e64] .rds_send_worker+0x54/0x100 [rds] [c000000175cabdb0] [c0000000000b475c] .worker_thread+0x1dc/0x3c0 [c000000175cabed0] [c0000000000baa9c] .kthread+0xbc/0xd0 [c000000175cabf90] [c000000000032114] .kernel_thread+0x54/0x70 Instruction dump: 4bfffd50 60000000 60000000 39080001 935f004c f91f0040 41820024 813d017c 7d094a78 7d290074 7929d182 394a0020 <0b090000> 40e2ff68 4bffffa4 39200000 Kernel panic - not syncing: Fatal exception Call Trace: [c000000175cab560] [c000000000012e04] .show_stack+0x74/0x1c0 (unreliable) [c000000175cab610] [c0000000005a365c] .panic+0x80/0x1b4 [c000000175cab6a0] [c00000000002fbcc] .die+0x21c/0x2a0 [c000000175cab750] [c000000000030000] ._exception+0x110/0x220 [c000000175cab910] [c000000000004b9c] program_check_common+0x11c/0x180 Signed-off-by: David S. Miller committer: David S. Miller user: Shawn Lin date: Tue Mar 08 14:21:50 2011 -0800 files: drivers/net/r6040.c description: r6040: fix multicast operations The original code does not work well when the number of mulitcast address to handle is greater than MCAST_MAX. It only enable promiscous mode instead of multicast hash table mode, so the hash table function will not be activated and all multicast frames will be recieved in this condition. This patch fixes the following issues with the r6040 NIC operating in multicast: 1) When the IFF_ALLMULTI flag is set, we should write 0xffff to the NIC hash table registers to make it process multicast traffic. 2) When the number of multicast address to handle is smaller than MCAST_MAX, we should use the NIC multicast registers MID1_{L,M,H}. 3) The hashing of the address was not correct, due to an invalid substraction (15 - (crc & 0x0f)) instead of (crc & 0x0f) and an incorrect crc algorithm (ether_crc_le) instead of (ether_crc). 4) If necessary, we should set HASH_EN flag in MCR0 to enable multicast hash table function. Reported-by: Marc Leclerc Tested-by: Marc Leclerc Signed-off-by: Shawn Lin Signed-off-by: Albert Chen Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller committer: David S. Miller user: Florian Fainelli date: Tue Mar 08 14:21:50 2011 -0800 files: drivers/net/r6040.c description: r6040: bump to version 0.27 and date 23Feb2011 Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller committer: David S. Miller user: Jon Mason date: Tue Mar 08 14:28:29 2011 -0800 files: MAINTAINERS description: vxge: update MAINTAINERS Exar has exited the 10G Ethernet NIC market, orphaning both the s2io and vxge drivers. With the promise of free hardware, I'll take over maintainership. Signed-off-by: Jon Mason Signed-off-by: David S. Miller committer: David S. Miller user: David S. Miller date: Wed Mar 09 13:27:16 2011 -0800 files: net/ipv4/devinet.c description: ipv4: Fix erroneous uses of ifa_address. In usual cases ifa_address == ifa_local, but in the case where SIOCSIFDSTADDR sets the destination address on a point-to-point link, ifa_address gets set to that destination address. Therefore we should use ifa_local when we want the local interface address. There were two cases where the selection was done incorrectly: 1) When devinet_ioctl() does matching, it checks ifa_address even though gifconf correct reported ifa_local to the user 2) IN_DEV_ARP_NOTIFY handling sends a gratuitous ARP using ifa_address instead of ifa_local. Reported-by: Julian Anastasov Signed-off-by: David S. Miller user: Daniel Turull date: Wed Mar 09 14:11:00 2011 -0800 files: net/core/pktgen.c description: pktgen: fix errata in show results The units in show_results in pktgen were not correct. The results are in usec but it was displayed nsec. Reported-by: Jong-won Lee Signed-off-by: Daniel Turull Signed-off-by: David S. Miller committer: David S. Miller user: David S. Miller date: Wed Mar 09 19:55:25 2011 -0800 files: net/ipv6/route.c description: ipv6: Don't create clones of host routes. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=29252 Addresses https://bugzilla.kernel.org/show_bug.cgi?id=30462 In commit d80bc0fd262ef840ed4e82593ad6416fa1ba3fc4 ("ipv6: Always clone offlink routes.") we forced the kernel to always clone offlink routes. The reason we do that is to make sure we never bind an inetpeer to a prefixed route. The logic turned on here has existed in the tree for many years, but was always off due to a protecting CPP define. So perhaps it's no surprise that there is a logic bug here. The problem is that we canot clone a route that is already a host route (ie. has DST_HOST set). Because if we do, an identical entry already exists in the routing tree and therefore the ip6_rt_ins() call is going to fail. This sets off a series of failures and high cpu usage, because when ip6_rt_ins() fails we loop retrying this operation a few times in order to handle a race between two threads trying to clone and insert the same host route at the same time. Fix this by simply using the route as-is when DST_HOST is set. Reported-by: slash@ac.auone-net.jp Reported-by: Ernst Sjöstrand Signed-off-by: David S. Miller user: Randy Dunlap date: Thu Mar 10 13:45:57 2011 -0800 files: net/bridge/Kconfig description: net: bridge builtin vs. ipv6 modular When configs BRIDGE=y and IPV6=m, this build error occurs: br_multicast.c:(.text+0xa3341): undefined reference to `ipv6_dev_get_saddr' BRIDGE_IGMP_SNOOPING is boolean; if it were tristate, then adding depends on IPV6 || IPV6=n to BRIDGE_IGMP_SNOOPING would be a good fix. As it is currently, making BRIDGE depend on the IPV6 config works. Reported-by: Patrick Schaaf Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller committer: David S. Miller user: stephen hemminger date: Thu Mar 10 14:18:48 2011 -0800 files: net/ipv6/ip6_tunnel.c description: ip6ip6: autoload ip6 tunnel Add necessary alias to autoload ip6ip6 tunnel module. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller committer: David S. Miller user: j223yang@asset.uwaterloo.ca date: Thu Mar 10 14:41:51 2011 -0800 files: drivers/net/ariadne.c description: ariadne: remove redundant NULL check Simply remove redundant 'dev' NULL check. Signed-off-by: Jinqiu Yang Signed-off-by: David S. Miller committer: David S. Miller user: Abhilash K V date: Wed Mar 09 11:48:55 2011 +0000 files: sound/soc/omap/am3517evm.c description: ASoC: AM3517: Update codec name after multi-component update The i2c client device name (".2-001a" in this case, including the separator period) for the AIC23 codec on the TI AM3517-EVM was appended to the codec_name member of am3517evm_dai to resolve the names mismatch happening in soc_bind_dai_link(), due to which the card was not getting registered. Signed-off-by: Abhilash K V Acked-by: Jarkko Nikula Acked-by: Mark Brown Signed-off-by: Liam Girdwood committer: Liam Girdwood user: Lukas Czerner date: Fri Mar 11 15:36:08 2011 +0100 files: block/blk-lib.c description: block: fix mis-synchronisation in blkdev_issue_zeroout() BZ29402 https://bugzilla.kernel.org/show_bug.cgi?id=29402 We can hit serious mis-synchronization in bio completion path of blkdev_issue_zeroout() leading to a panic. The problem is that when we are going to wait_for_completion() in blkdev_issue_zeroout() we check if the bb.done equals issued (number of submitted bios). If it does, we can skip the wait_for_completition() and just out of the function since there is nothing to wait for. However, there is a ordering problem because bio_batch_end_io() is calling atomic_inc(&bb->done) before complete(), hence it might seem to blkdev_issue_zeroout() that all bios has been completed and exit. At this point when bio_batch_end_io() is going to call complete(bb->wait), bb and wait does not longer exist since it was allocated on stack in blkdev_issue_zeroout() ==> panic! (thread 1) (thread 2) bio_batch_end_io() blkdev_issue_zeroout() if(bb) { ... if (bb->end_io) ... bb->end_io(bio, err); ... atomic_inc(&bb->done); ... ... while (issued != atomic_read(&bb.done)) ... (let issued == bb.done) ... (do the rest of the function) ... return ret; complete(bb->wait); ^^^^^^^^ panic We can fix this easily by simplifying bio_batch and completion counting. Also remove bio_end_io_t *end_io since it is not used. Signed-off-by: Lukas Czerner Reported-by: Eric Whitney Tested-by: Eric Whitney Reviewed-by: Jeff Moyer CC: Dmitry Monakhov Signed-off-by: Jens Axboe committer: Jens Axboe user: Mark Brown date: Wed Mar 09 12:32:50 2011 +0000 files: sound/soc/codecs/wm8978.c description: ASoC: Fix broken bitfield definitions in WM8978 Signed-off-by: Mark Brown Acked-by: Liam Girdwood Cc: stable@kernel.org user: Mark Brown date: Wed Mar 09 12:32:50 2011 +0000 files: sound/soc/soc-dapm.c description: ASoC: Use the correct DAPM context when cleaning up final widget set Now we've got multi-component we need to make sure that the DAPM context (and hence register I/O context) we use to apply the pending updates at the end of a DAPM sequence is the one we were processing rather than the one that was used to initate the state change. Signed-off-by: Mark Brown Acked-by: Liam Girdwood user: Mark Brown date: Wed Mar 09 20:30:22 2011 +0000 files: sound/soc/codecs/wm8994.c description: ASoC: Fix typo in late revision WM8994 DAC2R name Without this fix the driver won't instantiate properly on relevant devices. Signed-off-by: Mark Brown Acked-by: Liam Girdwood Cc: stable@kernel.org user: Mark Brown date: Wed Mar 09 20:30:29 2011 +0000 files: sound/soc/codecs/wm8994.c description: ASoC: Ensure WM8958 gets all WM8994 late revision widgets Without this fix the driver won't instantiate properly on relevant devices. Signed-off-by: Mark Brown Acked-by: Liam Girdwood Cc: stable@kernel.org user: Nicholas Bellinger date: Mon Feb 28 11:23:32 2011 -0600 files: drivers/target/target_core_tmr.c drivers/target/target_core_transport.c include/target/target_core_transport.h description: [SCSI] target: Fix t_transport_aborted handling in LUN_RESET + active I/O shutdown This patch addresses two outstanding bugs related to T_TASK(cmd)->t_transport_aborted handling during TMR LUN_RESET and active I/O shutdown. This first involves adding two explict t_transport_aborted=1 assignments in core_tmr_lun_reset() in order to signal the task has been aborted, and updating transport_generic_wait_for_tasks() to skip sleeping when t_transport_aborted=1 has been set. This fixes an issue where transport_generic_wait_for_tasks() would end up sleeping indefinately when called from fabric module context while TMR LUN_RESET was happening with long outstanding backend struct se_task not yet being completed. The second adds a missing call to transport_remove_task_from_execute_queue() when task->task_execute_queue=1 is set in order to fix an OOPs when task->t_execute_list has not been dropped. It also fixes the same case in transport_processing_shutdown() to prevent the issue from happening during active I/O struct se_device shutdown. Signed-off-by: Nicholas A. Bellinger Signed-off-by: James Bottomley committer: James Bottomley user: Andrea Arcangeli date: Sun Mar 13 15:35:57 2011 -0700 files: mm/rmap.c description: thp: fix page_referenced to modify mapcount/vm_flags only if page is found When vmscan.c calls page_referenced(), if an anon page was created before a process forked, rmap will search for it in both of the processes, even though one of them might have since broken COW. If the child process mlocks the vma where the COWed page belongs to, page_referenced() running on the page mapped by the parent would lead to *vm_flags getting VM_LOCKED set erroneously (leading to the references on the parent page being ignored and evicting the parent page too early). *mapcount would also be decremented by page_referenced_one even if the page wasn't found by page_check_address. This also lets pmdp_clear_flush_young_notify() go ahead on a pmd_trans_splitting() pmd. We hold the page_table_lock so __split_huge_page_map() must wait the pmdp_clear_flush_young_notify() to complete before it can modify the pmd. The pmd is also still mapped in userland so the young bit may materialize through a tlb miss before split_huge_page_map runs. This will provide a more accurate page_referenced() behavior during split_huge_page(). Signed-off-by: Andrea Arcangeli Reported-by: Michel Lespinasse Reviewed-by: Michel Lespinasse Reviewed-by: Minchan Kim Reviewed-by: Johannes Weiner Reviewed-by: Rik van Riel Reviewed-by: KOSAKI Motohiro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds committer: Linus Torvalds user: Axel Lin date: Sun Mar 13 15:35:59 2011 -0700 files: drivers/gpio/ml_ioh_gpio.c drivers/gpio/pch_gpio.c description: gpio: add MODULE_DEVICE_TABLE The device table is required to load modules based on modaliases. After adding MODULE_DEVICE_TABLE, below entries will be added to modules.pcimap: pch_gpio 0x00008086 0x00008803 0xffffffff 0xffffffff 0x00000000 0x00000000 0x0 ml_ioh_gpio 0x000010db 0x0000802e 0xffffffff 0xffffffff 0x00000000 0x00000000 0x0 Signed-off-by: Axel Lin Cc: Tomoya MORINAGA Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds committer: Linus Torvalds user: Chris Mason date: Mon Mar 07 10:42:27 2011 -0500 files: fs/btrfs/file.c description: Btrfs: fix regressions in copy_from_user handling Commit 914ee295af418e936ec20a08c1663eaabe4cd07a fixed deadlocks in btrfs_file_write where we would catch page faults on pages we had locked. But, there were a few problems: 1) The x86-32 iov_iter_copy_from_user_atomic code always fails to copy data when the amount to copy is more than 4K and the offset to start copying from is not page aligned. The result was btrfs_file_write looping forever retrying the iov_iter_copy_from_user_atomic We deal with this by changing btrfs_file_write to drop down to single page copies when iov_iter_copy_from_user_atomic starts returning failure. 2) The btrfs_file_write code was leaking delalloc reservations when iov_iter_copy_from_user_atomic returned zero. The looping above would result in the entire filesystem running out of delalloc reservations and constantly trying to flush things to disk. 3) btrfs_file_write will lock down page cache pages, make sure any writeback is finished, do the copy_from_user and then release them. Before the loop runs we check the first and last pages in the write to see if they are only being partially modified. If the start or end of the write isn't aligned, we make sure the corresponding pages are up to date so that we don't introduce garbage into the file. With the copy_from_user changes, we're allowing the VM to reclaim the pages after a partial update from copy_from_user, but we're not making sure the page cache page is up to date when we loop around to resume the write. We deal with this by pushing the up to date checks down into the page prep code. This fits better with how the rest of file_write works. Signed-off-by: Chris Mason Reported-by: Mitch Harder cc: stable@kernel.org user: Chris Mason date: Mon Mar 07 11:10:24 2011 -0500 files: fs/btrfs/file.c description: Btrfs: deal with short returns from copy_from_user When copy_from_user is only able to copy some of the bytes we requested, we may end up creating a partially up to date page. To avoid garbage in the page, we need to treat a partial copy as a zero length copy. This makes the rest of the file_write code drop the page and retry the whole copy instead of marking the partially up to date page as dirty. Signed-off-by: Chris Mason cc: stable@kernel.org user: Chris Mason date: Tue Mar 08 11:58:09 2011 -0500 files: fs/btrfs/extent_io.c description: Btrfs: make sure not to return overlapping extents to fiemap The btrfs fiemap code was incorrectly returning duplicate or overlapping extents in some cases. cp was blindly trusting this result and we would end up with a destination file that was bigger than the original because some bytes were copied twice. The fix here adjusts our offsets to make sure we're always moving forward in the fiemap results. Signed-off-by: Chris Mason user: Daniel J Blueman date: Thu Mar 10 11:21:49 2011 -0500 files: fs/btrfs/inode.c description: btrfs: fix dip leak The btrfs DIO code leaks dip structs when dip->csums allocation fails; bio->bi_end_io isn't set at the point where the free_ordered branch is consequently taken, thus bio_endio doesn't call the function which would free it in the normal case. Fix. Signed-off-by: Daniel J Blueman Acked-by: Miao Xie Signed-off-by: Chris Mason committer: Chris Mason user: Miao Xie date: Thu Mar 10 11:21:49 2011 -0500 files: fs/btrfs/inode.c description: btrfs: fix not enough reserved space btrfs_link() will insert 3 items(inode ref, dir name item and dir index item) into the b+ tree and update 2 items(its inode, and parent's inode) in the b+ tree. So we should reserve space for these 5 items, not 3 items. Reported-by: Tsutomu Itoh Signed-off-by: Miao Xie Signed-off-by: Chris Mason committer: Chris Mason user: Chris Mason date: Sat Mar 12 07:08:42 2011 -0500 files: fs/btrfs/ctree.h fs/btrfs/extent-tree.c description: Btrfs: break out of shrink_delalloc earlier Josef had changed shrink_delalloc to exit after three shrink attempts, which wasn't quite enough because new writers could race in and steal free space. But it also fixed deadlocks and stalls as we tried to recover delalloc reservations. The code was tweaked to loop 1024 times, and would reset the counter any time a small amount of progress was made. This was too drastic, and with a lot of writers we can end up stuck in shrink_delalloc forever. The shrink_delalloc loop is fairly complex because the caller is looping too, and the caller will go ahead and force a transaction commit to make sure we reclaim space. This reworks things to exit shrink_delalloc when we've forced some writeback and the delalloc reservations have gone down. This means the writeback has not just started but has also finished at least some of the metadata changes required to reclaim delalloc space. If we've got this wrong, we're returning ENOSPC too early, which is a big improvement over the current behavior of hanging the machine. Test 224 in xfstests hammers on this nicely, and with 1000 writers trying to fill a 1GB drive we get our first ENOSPC at 93% full. The other writers are able to continue until we get 100%. This is a worst case test for btrfs because the 1000 writers are doing small IO, and the small FS size means we don't have a lot of room for metadata chunks. Signed-off-by: Chris Mason user: Hans de Goede date: Sun Mar 13 07:40:41 2011 -0700 files: drivers/hwmon/f71882fg.c description: hwmon/f71882fg: Fix a typo in a comment Signed-off-by: Hans de Goede Acked-by: Jean Delvare Signed-off-by: Guenter Roeck committer: Guenter Roeck user: Hans de Goede