Commit Graph

388790 Commits

Author SHA1 Message Date
Dimitris Papastamos 4f8b19143d ASoC: wm0010: Fix resource leak
If kzalloc() fails for `img' then we are going to leak the memory
for `out'.  We are freeing the memory of all the tx/rx transfers
but the tx/rx buf pointers will be NULL if we drop out earlier.

Signed-off-by: Dimitris Papastamos <dp@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2013-07-31 14:50:34 +01:00
Li Zefan da0a12caff cgroup: fix a leak when percpu_ref_init() fails
ss->css_free() is not called when perfcpu_ref_init() fails.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2013-07-31 06:13:25 -04:00
Paul Walmsley 067e710b9a ARM: 7801/1: v6: prevent gcc 4.5 from reordering extended CP15 reads above is_smp() test
Commit 621a0147d5 ("ARM: 7757/1: mm:
don't flush icache in switch_mm with hardware broadcasting") breaks
the boot on OMAP2430SDP with omap2plus_defconfig.  Tracked to an
undefined instruction abort from the CP15 read in
cache_ops_need_broadcast().  It turns out that gcc 4.5 reorders the
extended CP15 read above the is_smp() test.  This breaks ARM1136 r0
cores, since they don't support several CP15 registers that later ARM
cores do.  ARM1136JF-S TRM section 3.2.1 "Register allocation" has the
details.

So mark the extended CP15 read as clobbering memory, which prevents
the compiler from reordering it before the is_smp() test.  Russell
states that the code generated from this approach is preferable to
marking the inline asm as volatile.  Remove the existing condition
code clobber as it's obsolete, per Nico's post:

    http://www.spinics.net/lists/arm-kernel/msg261208.html

This patch is a collaboration with Will Deacon and Russell King.

Comments from Paul Walmsley:

 Russell, if you accept this one, might you also add Will's ack from the lists:

Comments from Paul Walmsley:

 I'd also be obliged if you could add a Cc: line for Jonathan Austin, since he helped test:

Signed-off-by: Paul Walmsley <paul@pwsan.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Nicolas Pitre <nicolas.pitre@linaro.org>
Cc: Tony Lindgren <tony@atomide.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Cc: Jonathan Austin <jonathan.austin@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2013-07-31 11:12:59 +01:00
Uwe Kleine-König bed859c1ee ARM: 7800/1: ARMv7-M: Fix name of NVIC handler function
The name changed in response to review comments for the nvic irqchip
driver when the original name was already accepted into Russell King's
tree.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2013-07-31 11:12:58 +01:00
Ralf Baechle d2ee88d0aa ASoC: au1x: Fix build
d8b51c11ff [ASoC: ac97c: Use
module_platform_driver()] broke the build:

 CC      sound/soc/au1x/ac97c.o
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: expected identifier or ‘(’ before ‘&’ token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: pasting "__initcall_" and "&" does not give a valid preprocessing token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘&’ token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: expected identifier or ‘(’ before ‘&’ token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: pasting "__exitcall_" and "&" does not give a valid preprocessing token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:344:1: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘&’ token
/home/ralf/src/linux/upstream-sfr/sound/soc/au1x/ac97c.c:334:31: warning: ‘au1xac97c_driver’ defined but not used [-Wunused-variable]
make[5]: *** [sound/soc/au1x/ac97c.o] Error 1
make[4]: *** [sound/soc/au1x] Error 2
make[3]: *** [sound/soc] Error 2

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2013-07-31 10:06:04 +01:00
Sean Hefty 5eb695c177 RDMA/cma: Only call cma_save_ib_info() for CM REQs
Calling cma_save_ib_info() for CM SIDR REQs results in a crash
accessing an invalid path record pointer.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-31 00:50:44 -07:00
Sean Hefty e511d1ae16 RDMA/cma: Fix accessing invalid private data for UD
If a application is using AF_IB with a UD QP, but does not provide any
private data, we will end up accessing invalid memory.  Check for this
case and handle it appropriately.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-31 00:50:40 -07:00
Wei Yongjun a661b43fd0 mlx5: fix error return code in mlx5_alloc_uuars()
Fix to return -ENOMEM from the ioremap error handling
case instead of 0, as done elsewhere in this function.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 19:33:45 -07:00
Arnaud Patard \(Rtp\) 5445eaf309 mvneta: Try to fix mvneta when compiled as module
When the mvneta driver is compiled as module, the clock is disabled before
it's loading. This will reset the registers values and all configuration
made by the bootloader.

This patch sets the "sgmii serdes configuration" register to a magical value
found in:
https://github.com/yellowback/ubuntu-precise-armadaxp/blob/master/arch/arm/mach-armadaxp/armada_xp_family/ctrlEnv/mvCtrlEnvLib.c

With this change, the interrupts are working/generated and ethernet is
working.

Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 19:32:36 -07:00
Arnaud Patard \(Rtp\) aded09555b mvneta: Fix hang when loading the mvneta driver
When the mvneta driver is compiled, it'll be loaded with clocks disabled.
This implies that the clocks should be enabled again before any register
access or it'll hang.

To fix it:
- enable clock earlier
- move timer callback after setting timer.data

Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 19:32:36 -07:00
Eric Dumazet 7b70176421 atl1c: Fix misuse of netdev_alloc_skb in refilling rx ring
On Mon, 2013-07-29 at 08:30 -0700, Eric Dumazet wrote:
> On Mon, 2013-07-29 at 13:09 +0100, Luis Henriques wrote:
>
> >
> > I confirm that I can't reproduce the issue using this patch.
> >
>
> Thanks, I'll send a polished patch, as this one had an error if
> build_skb() returns NULL (in case sk_buff allocation fails)

Please try the following patch : It should use 2K frags instead of 4K
for normal 1500 mtu

Thanks !

[PATCH] atl1c: use custom skb allocator

We had reports ( https://bugzilla.kernel.org/show_bug.cgi?id=54021 )
that using high order pages for skb allocations is problematic for atl1c

We do not know exactly what the problem is, but we suspect that crossing
4K pages is not well supported by this hardware.

Use a custom allocator, using page allocator and 2K fragments for
optimal stack behavior. We might make this allocator generic
in future kernels.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Luis Henriques <luis.henriques@canonical.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 18:12:07 -07:00
Simon Horman a601469386 ARM: shmobile: lager: do not annotate gpio_buttons as __initdata
When the gpio-keys device is registered using
platform_device_register_data() the platform data argument,
lager_keys_pdata is duplicated and thus should be marked as __initdata
to avoid wasting memory. However, this is not true of gpio_buttons,
a reference to it rather than its value is duplicated when lager_keys_pdata
is duplicated.

This avoids accessing freed memory if gpio-key events occur
after unused kernel memory is freed late in the kernel's boot.

This but was added when support for gpio-keys was added to lager
in c3842e4fcb
("ARM: shmobile: lager: support GPIO switches") which was included
in v3.11-rc1.

Tested-by: Magnus Damm <damm@opensource.se>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
2013-07-31 10:11:17 +09:00
Sergei Shtylyov fa3e0cee12 ARM: shmobile: BOCK-W: fix SDHI0 PFC settings
The following message is printed on the BOCK-W kernel bootup:

sh-pfc pfc-r8a7778: invalid group "sdhi0" for function "sdhi0"

In addition, SD card cannot be detected.  The reason is apparently that commit
ca7bb30948 (ARM: shmobile: bockw: add SDHI0 support) matched
the previous version of commit 564617d2f9 (sh-pfc: r8a7778:
add SDHI support).

Add the missing pin groups according to the BOCK-W board schematics.

Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
2013-07-31 10:11:17 +09:00
Kuninori Morimoto 3c4d927662 shdma: fixup sh_dmae_get_partial() calculation error
sh_desc->hw.tcr is controlling real data size,
and, register TCR is controlling data transfer count
which was xmit_shifted value of hw.tcr.
Current sh_dmae_get_partial() is calculating in different unit.
This patch fixes it.

This bug has been present since c014906a87
("dmaengine: shdma: extend .device_terminate_all() to record partial
transfer"), which was added in 2.6.34-rc1.

Cc: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Acked-by: Guennadi Liakhovetski <g.liakhovetski+renesas@gmail.com>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
2013-07-31 10:10:17 +09:00
Steven Rostedt (Red Hat) 8c4f3c3fa9 ftrace: Check module functions being traced on reload
There's been a nasty bug that would show up and not give much info.
The bug displayed the following warning:

 WARNING: at kernel/trace/ftrace.c:1529 __ftrace_hash_rec_update+0x1e3/0x230()
 Pid: 20903, comm: bash Tainted: G           O 3.6.11+ #38405.trunk
 Call Trace:
  [<ffffffff8103e5ff>] warn_slowpath_common+0x7f/0xc0
  [<ffffffff8103e65a>] warn_slowpath_null+0x1a/0x20
  [<ffffffff810c2ee3>] __ftrace_hash_rec_update+0x1e3/0x230
  [<ffffffff810c4f28>] ftrace_hash_move+0x28/0x1d0
  [<ffffffff811401cc>] ? kfree+0x2c/0x110
  [<ffffffff810c68ee>] ftrace_regex_release+0x8e/0x150
  [<ffffffff81149f1e>] __fput+0xae/0x220
  [<ffffffff8114a09e>] ____fput+0xe/0x10
  [<ffffffff8105fa22>] task_work_run+0x72/0x90
  [<ffffffff810028ec>] do_notify_resume+0x6c/0xc0
  [<ffffffff8126596e>] ? trace_hardirqs_on_thunk+0x3a/0x3c
  [<ffffffff815c0f88>] int_signal+0x12/0x17
 ---[ end trace 793179526ee09b2c ]---

It was finally narrowed down to unloading a module that was being traced.

It was actually more than that. When functions are being traced, there's
a table of all functions that have a ref count of the number of active
tracers attached to that function. When a function trace callback is
registered to a function, the function's record ref count is incremented.
When it is unregistered, the function's record ref count is decremented.
If an inconsistency is detected (ref count goes below zero) the above
warning is shown and the function tracing is permanently disabled until
reboot.

The ftrace callback ops holds a hash of functions that it filters on
(and/or filters off). If the hash is empty, the default means to filter
all functions (for the filter_hash) or to disable no functions (for the
notrace_hash).

When a module is unloaded, it frees the function records that represent
the module functions. These records exist on their own pages, that is
function records for one module will not exist on the same page as
function records for other modules or even the core kernel.

Now when a module unloads, the records that represents its functions are
freed. When the module is loaded again, the records are recreated with
a default ref count of zero (unless there's a callback that traces all
functions, then they will also be traced, and the ref count will be
incremented).

The problem is that if an ftrace callback hash includes functions of the
module being unloaded, those hash entries will not be removed. If the
module is reloaded in the same location, the hash entries still point
to the functions of the module but the module's ref counts do not reflect
that.

With the help of Steve and Joern, we found a reproducer:

 Using uinput module and uinput_release function.

 cd /sys/kernel/debug/tracing
 modprobe uinput
 echo uinput_release > set_ftrace_filter
 echo function > current_tracer
 rmmod uinput
 modprobe uinput
 # check /proc/modules to see if loaded in same addr, otherwise try again
 echo nop > current_tracer

 [BOOM]

The above loads the uinput module, which creates a table of functions that
can be traced within the module.

We add uinput_release to the filter_hash to trace just that function.

Enable function tracincg, which increments the ref count of the record
associated to uinput_release.

Remove uinput, which frees the records including the one that represents
uinput_release.

Load the uinput module again (and make sure it's at the same address).
This recreates the function records all with a ref count of zero,
including uinput_release.

Disable function tracing, which will decrement the ref count for uinput_release
which is now zero because of the module removal and reload, and we have
a mismatch (below zero ref count).

The solution is to check all currently tracing ftrace callbacks to see if any
are tracing any of the module's functions when a module is loaded (it already does
that with callbacks that trace all functions). If a callback happens to have
a module function being traced, it increments that records ref count and starts
tracing that function.

There may be a strange side effect with this, where tracing module functions
on unload and then reloading a new module may have that new module's functions
being traced. This may be something that confuses the user, but it's not
a big deal. Another approach is to disable all callback hashes on module unload,
but this leaves some ftrace callbacks that may not be registered, but can
still have hashes tracing the module's function where ftrace doesn't know about
it. That situation can cause the same bug. This solution solves that case too.
Another benefit of this solution, is it is possible to trace a module's
function on unload and load.

Link: http://lkml.kernel.org/r/20130705142629.GA325@redhat.com

Reported-by: Jörn Engel <joern@logfs.org>
Reported-by: Dave Jones <davej@redhat.com>
Reported-by: Steve Hodgson <steve@purestorage.com>
Tested-by: Steve Hodgson <steve@purestorage.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-30 20:52:51 -04:00
Ben Widawsky e1b4d3036c drm/i915: fix missed hunk after GT access breakage
Upon some code refactoring, a hunk was missed. This was fixed for
next, but missed the current trees, and hasn't yet been merged by Dave
Airlie. It is fixed in:
commit 907b28c56e
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Jul 19 20:36:52 2013 +0100

    drm/i915: Colocate all GT access routines in the same file

It is introduced by:
commit 181d1b9e31
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Sun Jul 21 13:16:24 2013 +0200

    drm/i915: fix up gt init sequence fallout

Reported-by: Dave Jones <davej@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Ben Widawsky <ben@bwidawsk.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-07-31 09:54:09 +10:00
Pablo Neira e1ee3673a8 genetlink: fix usage of NLM_F_EXCL or NLM_F_REPLACE
Currently, it is not possible to use neither NLM_F_EXCL nor
NLM_F_REPLACE from genetlink. This is due to this checking in
genl_family_rcv_msg:

	if (nlh->nlmsg_flags & NLM_F_DUMP)

NLM_F_DUMP is NLM_F_MATCH|NLM_F_ROOT. Thus, if NLM_F_EXCL or
NLM_F_REPLACE flag is set, genetlink believes that you're
requesting a dump and it calls the .dumpit callback.

The solution that I propose is to refine this checking to
make it stricter:

	if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP)

And given the combination NLM_F_REPLACE and NLM_F_EXCL does
not make sense to me, it removes the ambiguity.

There was a patch that tried to fix this some time ago (0ab03c2
netlink: test for all flags of the NLM_F_DUMP composite) but it
tried to resolve this ambiguity in *all* existing netlink subsystems,
not only genetlink. That patch was reverted since it broke iproute2,
which is using NLM_F_ROOT to request the dump of the routing cache.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 16:43:19 -07:00
Dan Carpenter ff862a4668 af_key: more info leaks in pfkey messages
This is inspired by a5cc68f3d6 "af_key: fix info leaks in notify
messages".  There are some struct members which don't get initialized
and could disclose small amounts of private information.

Acked-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 16:26:16 -07:00
Samuel Ortiz 9ea7187c53 NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD
Loading a firmware into a target is typically called firmware
download, not firmware upload. So we rename the netlink API to
NFC_CMD_FW_DOWNLOAD in order to avoid any terminology confusion from
userspace.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-07-31 01:19:43 +02:00
Paul Bolle 8fb488d740 RDMA/cma: Fix gcc warning
Building cma.o triggers this gcc warning:

    drivers/infiniband/core/cma.c: In function ‘rdma_resolve_addr’:
    drivers/infiniband/core/cma.c:465:23: warning: ‘port’ may be used uninitialized in this function [-Wmaybe-uninitialized]
    drivers/infiniband/core/cma.c:426:5: note: ‘port’ was declared here

This is a false positive, as "port" will always be initialized if we're
at "found". But if we assign to "id_priv->id.port_num" directly, we can
drop "port". That will, obviously, silence gcc.

Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 16:11:22 -07:00
Uwe Kleine-König a264b981f2 net/fec: Don't let ndo_start_xmit return NETDEV_TX_BUSY without link
Don't test for having link and let hardware deal with this situation.

Without this patch I see a machine running an -rt patched Linux being
stuck in sch_direct_xmit when it looses link while there is still a
packet to be sent. In this case the fec_enet_start_xmit routine returned
NETDEV_TX_BUSY which makes the network stack reschedule the packet and
so sch_direct_xmit calls fec_enet_start_xmit again.
I failed to reproduce a complete hang without -rt, but I think the
problem exists there, too.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 16:05:04 -07:00
Roland Dreier 3c93f039d2 Revert "RDMA/nes: Fix compilation error when nes_debug is enabled"
This reverts commit bca1935ccd, which removes variables
nes_tcp_state_str and nes_iwarp_state_str, assuming that they aren't
defined.  However, they are defined within a #ifdef NES_DEBUG statement,
which if enabled causes "defined but not used" compiler warning, when
the variables are removed.

Signed-off-by: Tatyana Nikolova <Tatyana.E.Nikolova@intel.com>
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 15:48:35 -07:00
Dave Airlie f34f516a8d Merge branch 'drm-fixes-3.11' of git://people.freedesktop.org/~agd5f/linux
Alex writes:
- more fixes for SI dpm
- fix DP on some rv6xx boards

* 'drm-fixes-3.11' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon/dpm: re-enable cac control on SI
  drm/radeon/dpm: fix calculations in si_calculate_leakage_for_v_and_t_formula
  drm: fix 64 bit drm fixed point helpers
  drm/radeon/atom: initialize more atom interpretor elements to 0
2013-07-31 08:46:21 +10:00
Stephen Boyd 011b2039df gpio_msm: Fix build error due to missing err.h
drivers/gpio/gpio-msm-v1.c: In function 'gpio_msm_v1_probe':
drivers/gpio/gpio-msm-v1.c:656:2:
error: implicit declaration of function 'IS_ERR'
[-Werror=implicit-function-declaration]
drivers/gpio/gpio-msm-v1.c:657:3:
error: implicit declaration of function 'PTR_ERR'
[-Werror=implicit-function-declaration]

This driver failed to compile after commit 68515bb
(gpio_msm: Convert to use devm_ioremap_resource,
2013-06-10).

Acked-by: Tushar Behera <tushar.behera@linaro.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2013-07-31 00:34:31 +02:00
Linus Walleij 253403b035 Revert "gpio/omap: don't create an IRQ mapping for every GPIO on DT"
This reverts commit 0e970cec05.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2013-07-31 00:34:31 +02:00
Linus Walleij c119fee063 Revert "gpio/omap: auto request GPIO as input if used as IRQ via DT"
This reverts commit b4419e1a15.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2013-07-31 00:34:31 +02:00
Linus Walleij 27d470c1ab Revert "gpio/omap: fix build error when OF_GPIO is not defined."
This reverts commit 949eb1a4d2.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2013-07-31 00:34:30 +02:00
Alex Deucher 5a344dda94 drm/radeon/dpm: re-enable cac control on SI
Now that the fixed point functions are fixed we
can re-enable cac support.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-30 17:24:14 -04:00
Alex Deucher 31f731af51 drm/radeon/dpm: fix calculations in si_calculate_leakage_for_v_and_t_formula
Need to make some slight adjustments for the fixed point math to
work properly.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-30 17:24:13 -04:00
Alex Deucher a838834b2f drm: fix 64 bit drm fixed point helpers
Sign bit wasn't handled properly and a small typo.

Thanks to Christian for helping me sort this out.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2013-07-30 17:24:13 -04:00
Alex Deucher 42a21826dc drm/radeon/atom: initialize more atom interpretor elements to 0
The ProcessAuxChannel table on some rv635 boards assumes
the divmul members are initialized to 0 otherwise we get
an invalid fb offset since it has a bad mask set when
setting the fb base.  While here initialize all the
atom interpretor elements to 0.

Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=60639

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2013-07-30 17:24:12 -04:00
Ingo Molnar f155b6303d * The size of memory that gets freed by free_pages() needs to be
specified in pages, not bytes - Roy Franz.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.13 (GNU/Linux)
 
 iQIcBAABAgAGBQJR8o2aAAoJEC84WcCNIz1VmC8QAKTvaLsaAkg603K1AOtNBRLq
 OIRxffV78Xw2mpVnJR0oWcKdGkh0R1QyXY/epxezuZ72gOZFPbjlt6o26FWpR4wD
 0vzxDZatvpW6+b0nm65IcXA2dOBKyHkgpQH1hB0N++Vze7aMvNaCnzWehzTK7QQr
 Ns2t7ZzXIzDMzbBxDr7WFJu/QBmfByDpHS2/w56+kKr8LiZoz4SP6F+c62l+dKW5
 SoQ4ZEir/khd2sCeebjK4OKJcAqpPByJrpJY6uYcNrXCaykKyHEebAeWMx+9aIEq
 kZ3jl8D1sP1lYeHj/gJfLiDs5gW+39rao5+HrToU/BC6ghBGnEHSCQcecgWYmmUG
 Z3KXt7KfyThe+Xbw1JnBwc649Cx7rw7sks3POlgKxsyvoRCXMTj5/KxImydY4fbG
 HTMgtgJhuhwsXGuUeJnR7JUMBqjR3k6EMgGbRqFwkn/UXD6thlJuoRJwqSurc4Lh
 Tkekivbw5OgNEL44ZzCXzmBw7VN0Rt0+esKxbAhnEPAzwFjB18F5AzfONuUX/ull
 9k/Ed1tVsMgIFmzmCx2LTwj/U3QJ1uCdpIeouzN+jvS86vPo6HB9launENRjcj/X
 fA6cLgypfIj5qYD/SCPMq4nysC2ab551XABWidvkmbaDCiJgch5TXksuIcbpnZqJ
 s8I8gub6hqh+9VFcw+5R
 =QwjF
 -----END PGP SIGNATURE-----

Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/urgent

Pull EFI fix from Matt Fleming:

 * The size of memory that gets freed by free_pages() needs to be
   specified in pages, not bytes - by Roy Franz.

Signed-off-by: Ingo Molnar <mingo@kernel.org>
2013-07-30 20:50:33 +02:00
Stefano Stabellini 741ddbcfd2 xen/tmem: do not allow XEN_TMEM on ARM64
tmem is not supported on arm or arm64 yet. Will revert this
once the Xen hypervisor supports it.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2013-07-30 13:44:02 -04:00
Mike Marciniszyn b268e4db3d IB/qib: Add err_decode() call for ring dump
Commit 0b3ddf380c ("Log all SDMA errors unconditionally") missed
part of the patch.

This also corrects a format warning when dma_addr_t is 32 bits
on a 64 bit system.

Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:13:00 -07:00
Dan Carpenter 246fcdbc9d RDMA/cxgb3: Fix stack info leak in iwch_create_cq()
The "uresp.reserved" field isn't initialized on this path so it could
leak uninitialized stack information to the user.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:11:33 -07:00
Dan Carpenter 604296303f RDMA/nes: Fix info leaks in nes_create_qp() and nes_create_cq()
We pass a few bytes of uninitialized stack memory to the user here.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:10:35 -07:00
Dan Carpenter 63ea374957 RDMA/ocrdma: Fix several stack info leaks
A grab bag of places which don't properly initialize stack data.  I
removed one place which cleared ".rsvd" because it's not needed now
that I have added a memset() earlier in the function.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:09:16 -07:00
Dan Carpenter ae1fe07f3f RDMA/cxgb4: Fix stack info leak in c4iw_create_qp()
"uresp.ma_sync_key" doesn't get set on this path so we leak 8 bytes of data.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:07:56 -07:00
Florian Fainelli ff5fadaff3 MIPS: BMIPS: fix slave CPU booting when physical CPU is not 0
The current BMIPS SMP code assumes that the slave CPU is physical and
logical CPU 1, but on some systems such as BCM3368, the slave CPU is
physical CPU0. Fix the code to read the physical CPU (thread ID) we are
running this code on, and adjust the relocation vector address based on
it. This allows bringing up the second CPU on BCM3368 for instance.

Signed-off-by: Florian Fainelli <florian@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: cernekee@gmail.com
Cc: jogo@openwrt.org
Cc: blogic@openwrt.org
Patchwork: https://patchwork.linux-mips.org/patch/5621/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:54:29 +02:00
Florian Fainelli c4091d3fbb MIPS: BMIPS: do not change interrupt routing depending on boot CPU
Commit 4df715aa ("MIPS: BMIPS: support booting from physical CPU other
than 0") changed the interupt routing when we are booting from physical
CPU 0, but the settings are actually correct if we are booting from
physical CPU 0 or CPU 1. Revert that specific change.

Signed-off-by: Florian Fainelli <florian@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: cernekee@gmail.com
Cc: jogo@openwrt.org
Cc: blogic@openwrt.org
Patchwork: https://patchwork.linux-mips.org/patch/5622/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:54:09 +02:00
Markos Chandras c055629b27 MIPS: powertv: Fix arguments for free_reserved_area()
Commit 6e7582bf35
"MIPS: PowerTV: use free_reserved_area() to simplify code"

merged in 3.11-rc1, broke the build for the powertv defconfig with
the following build error:

arch/mips/powertv/asic/asic_devices.c: In function 'platform_release_memory':
arch/mips/powertv/asic/asic_devices.c:533:7: error: passing argument 1 of
'free_reserved_area' makes pointer from integer without a cast [-Werror]

The free_reserved_area() function expects a void * pointer for the start
address and a void * pointer for the end one.

Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5624/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:50:31 +02:00
Markos Chandras 314878d246 MIPS: Set default CPU type for BCM47XX platforms
If neither BCM47XX_SSD nor BCM47XX_BCMA is selected, then no
CPU type is available leading to build problems. We fix
this problem by using MIPS32r1 as the default CPU type for
the BCM47XX platform.

Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Acked-by: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5618/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:48:50 +02:00
Maciej W. Rozycki 1d3e2d79a7 MIPS: uapi/asm/siginfo.h: Fix GCC 4.1.2 compilation
It wasn't until GCC 4.3 I believe that the __SIZEOF_*__ predefined macros
were added.  The change below switches <uapi/asm/siginfo.h> to the
_MIPS_SZLONG macro so that compilation with e.g. GCC 4.1.2 succeeds.
This is a user API header so I think this is even more important, for
older userland support.  The change adds an unsuccessful default too, to
catch any compiler configuration oddities.

Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5630/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:40:40 +02:00
Steven J. Hill 7ad18dd03c MIPS: Fix multiple definitions of UNCAC_BASE.
Fix build error below:

arch/mips/include/asm/mach-generic/spaces.h:29:0: warning:
"UNCAC_BASE" redefined [enabled by default]
In file included from arch/mips/include/asm/addrspace.h:13:0,
                 from arch/mips/include/asm/barrier.h:11,
                 from arch/mips/include/asm/bitops.h:18,
                 from include/linux/bitops.h:22,
                 from include/linux/kernel.h:10,
                 from include/asm-generic/bug.h:13,
                 from arch/mips/include/asm/bug.h:41,
                 from include/linux/bug.h:4,
                 from include/linux/page-flags.h:9,
                 from kernel/bounds.c:9:
arch/mips/include/asm/mach-ar7/spaces.h:20:0: note: this is the
location of the previous definition

Signed-off-by: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5583/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:40:40 +02:00
Stefan Haberland 0e003b709e s390/dasd: fix hanging devices after path events
The processing of the dasd_block tasklet may have been interrupted
by a path event.
Restart the dasd tasklets in sleep_on_immediately function.

Signed-off-by: Stefan Haberland <stefan.haberland@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2013-07-30 16:17:25 +02:00
David Vrabel 179fbd5a45 xen/evtchn: avoid a deadlock when unbinding an event channel
Unbinding an event channel (either with the ioctl or when the evtchn
device is closed) may deadlock because disable_irq() is called with
port_user_lock held which is also locked by the interrupt handler.

Think of the IOCTL_EVTCHN_UNBIND is being serviced, the routine has
just taken the lock, and an interrupt happens. The evtchn_interrupt
is invoked, tries to take the lock and spins forever.

A quick glance at the code shows that the spinlock is a local IRQ
variant. Unfortunately that does not help as "disable_irq() waits for
the interrupt handler on all CPUs to stop running.  If the irq occurs
on another VCPU, it tries to take port_user_lock and can't because
the unbind ioctl is holding it." (from David). Hence we cannot
depend on the said spinlock to protect us. We could make it a system
wide IRQ disable spinlock but there is a better way.

We can piggyback on the fact that the existence of the spinlock is
to make get_port_user() checks be up-to-date. And we can alter those
checks to not depend on the spin lock (as it's protected by u->bind_mutex
in the ioctl) and can remove the unnecessary locking (this is
IOCTL_EVTCHN_UNBIND) path.

In the interrupt handler we cannot use the mutex, but we do not
need it.

"The unbind disables the irq before making the port user stale, so when
you clear it you are guaranteed that the interrupt handler that might
use that port cannot be running." (from David).

Hence this patch removes the spinlock usage on the teardown path
and piggybacks on disable_irq happening before we muck with the
get_port_user() data. This ensures that the interrupt handler will
never run on stale data.

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
[v1: Expanded the commit description a bit]
2013-07-30 09:21:14 -04:00
Colin Cross 2b44c4db2e freezer: set PF_SUSPEND_TASK flag on tasks that call freeze_processes
Calling freeze_processes sets a global flag that will cause any
process that calls try_to_freeze to enter the refrigerator.  It
skips sending a signal to the current task, but if the current
task ever hits try_to_freeze, all threads will be frozen and the
system will deadlock.

Set a new flag, PF_SUSPEND_TASK, on the task that calls
freeze_processes.  The flag notifies the freezer that the thread
is involved in suspend and should not be frozen.  Also add a
WARN_ON in thaw_processes if the caller does not have the
PF_SUSPEND_TASK flag set to catch if a different task calls
thaw_processes than the one that called freeze_processes, leaving
a task with PF_SUSPEND_TASK permanently set on it.

Threads that spawn off a task with PF_SUSPEND_TASK set (which
swsusp does) will also have PF_SUSPEND_TASK set, preventing them
from freezing while they are helping with suspend, but they need
to be dead by the time suspend is triggered, otherwise they may
run when userspace is expected to be frozen.  Add a WARN_ON in
thaw_processes if more than one thread has the PF_SUSPEND_TASK
flag set.

Reported-and-tested-by: Michael Leun <lkml20130126@newton.leun.net>
Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-07-30 14:05:06 +02:00
Lan Tianyu 016d5baad0 ACPI / battery: Fix parsing _BIX return value
The _BIX method returns extended battery info as a package.
According the ACPI spec (ACPI 5, Section 10.2.2.2), the first member
of that package should be "Revision".  However, the current ACPI
battery driver treats the first member as "Power Unit" which should
be the second member.  This causes the result of _BIX return data
parsing to be incorrect.

Fix this by adding a new member called 'revision' to struct
acpi_battery and adding the offsetof() information on it to
extended_info_offsets[] as the first row.

[rjw: Changelog]
Reported-and-tested-by: Jan Hoffmann <jan.christian.hoffmann@gmail.com>
References: http://bugzilla.kernel.org/show_bug.cgi?id=60519
Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Cc: 2.6.34+ <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-07-30 14:00:42 +02:00
Lars-Peter Clausen 610d80eaa9 ASoC: bf5xx-ac97: Fix compile error with SND_BF5XX_HAVE_COLD_RESET
If CONFIG_SND_BF5XX_HAVE_COLD_RESET is enabled building the blackfin ac97 driver
fails with the following compile error:
	sound/soc/blackfin/bf5xx-ac97.c: In function ‘asoc_bfin_ac97_probe’:
	sound/soc/blackfin/bf5xx-ac97.c:297: error: expected ‘;’ before ‘{’ token
	sound/soc/blackfin/bf5xx-ac97.c:302: error: label ‘gpio_err’ used but not defined

The issue was introduced in commit 6dab2fd7 ("ASoC: bf5xx-ac97: Convert to
devm_gpio_request_one()").

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
2013-07-30 12:51:02 +01:00
Afzal Mohammed 50c2a3a151 ARM: OMAP2+: hwmod: AM335x: fix cpgmac address space
Register target address to be used for cpgmac is the second device
address space. By default, hwmod picks first address space (0th index)
for register target.

With removal of address space from hwmod and using DT instead, cpgmac
is getting wrong address space for register target.

Fix it by indicating the address space to be used for register target.

Signed-off-by: Afzal Mohammed <afzal@ti.com>
Tested-by: Mugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: Paul Walmsley <paul@pwsan.com>
2013-07-30 05:13:37 -06:00