summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2014-04-22arm64: __NR_compat_syscalls fixMiklos Szeredi
This fixes commit 6290b53de025 (arm64: compat: Wire up new AArch32 syscalls) which did not update __NR_compat_syscalls accordingly. Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> Cc: <stable@vger.kernel.org> # 3.14+ Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2014-04-22Merge tag 'gpio-v3.15-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull gpio fixes from Linus Walleij: "A small batch of GPIO fixes for the v3.15 series. I expect more to come in but I'm a bit behind on mail, might as well get these to you right now: - Change a crucial semantic ordering in the GPIO irqchip helpers - Fix two nasty regressions in the ACPI gpiolib extensions" * tag 'gpio-v3.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio / ACPI: Prevent potential wrap of GPIO value on OpRegion read gpio / ACPI: Don't crash on NULL chip->dev gpio: set data first, then chip and handler
2014-04-22Merge branch 'x86-vdso-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 vdso fix from Peter Anvin: "This is a single build fix for building with gold as opposed to GNU ld. It got queued up separately and was expected to be pushed during the merge window, but it got left behind" * 'x86-vdso-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86, vdso: Make the vdso linker script compatible with Gold
2014-04-22pinctrl: as3722: fix handling of GPIO invert bitAndrew Bresticker
The AS3722_GPIO_INV bit will always be blindly overwritten by as3722_pinctrl_gpio_set_direction() and will be ignored when setting the value of the GPIO in as3722_gpio_set() since the enable_gpio_invert flag is never set. This will cause an initially inverted GPIO to toggle when requested as an output, which could be problematic if, for example, the GPIO controls a critical regulator. Instead of setting up the enable_gpio_invert flag, just leave the invert bit alone and check it before setting the GPIO value. Cc: <stable@vger.kernel.org> # v3.14+ Signed-off-by: Andrew Bresticker <abrestic@chromium.org> Reviewed-by: Stephen Warren <swarren@nvidia.com> Tested-by: Stephen Warren <swarren@nvidia.com> Acked-by: Laxman Dewangan <ldewangan@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2014-04-22drm/radeon: don't allow runpm=1 on systems with out ATPXAlex Deucher
vgaswitcheroo and the ATPX ACPI methods are required to power down the dGPU. bug: https://bugzilla.kernel.org/show_bug.cgi?id=73901 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-22drm/radeon: fix ATPX detection on non-VGA GPUsAlex Deucher
Some newer PX laptops have the pci device class set to DISPLAY_OTHER rather than DISPLAY_VGA. This properly detects ATPX on those laptops. Based on a patch from: Pali Rohár <pali.rohar@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org Cc: airlied@gmail.com
2014-04-22drm/radeon/pm: don't walk the crtc list before it has been initialized (v2)Alex Deucher
Avoids a crash in certain cases when thermal irqs are generated before the display structures have been initialized. v2: fix the vblank and vrefresh helpers as well bug: https://bugzilla.kernel.org/show_bug.cgi?id=73931 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-22drm/radeon: properly unregister hwmon interface (v2)Alex Deucher
Need to properly unregister the hwmon device on driver unload. v2: minor clean up bug: https://bugzilla.kernel.org/show_bug.cgi?id=73931 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-04-22pinctrl/TB10x: Fix signedness bugChristian Ruppert
In the TB10x pin database, a port index of -1 is used to indicate unmuxed GPIO pin groups. This bug fixes a 'cast to unsigned' bug of this value. Thanks to Dan Carpenter for highlighting this. CC: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Christian Ruppert <christian.ruppert@abilis.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2014-04-22drm/radeon: fix count in cik_sdma_ring_test()Alex Deucher
Should be 5 rather than 4. Noticed-by: Mathias Fröhlich <Mathias.Froehlich@gmx.net> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org Signed-off-by: Christian König <christian.koenig@amd.com>
2014-04-22locks: rename file-private locks to "open file description locks"Jeff Layton
File-private locks have been merged into Linux for v3.15, and *now* people are commenting that the name and macro definitions for the new file-private locks suck. ...and I can't even disagree. The names and command macros do suck. We're going to have to live with these for a long time, so it's important that we be happy with the names before we're stuck with them. The consensus on the lists so far is that they should be rechristened as "open file description locks". The name isn't a big deal for the kernel, but the command macros are not visually distinct enough from the traditional POSIX lock macros. The glibc and documentation folks are recommending that we change them to look like F_OFD_{GETLK|SETLK|SETLKW}. That lessens the chance that a programmer will typo one of the commands wrong, and also makes it easier to spot this difference when reading code. This patch makes the following changes that I think are necessary before v3.15 ships: 1) rename the command macros to their new names. These end up in the uapi headers and so are part of the external-facing API. It turns out that glibc doesn't actually use the fcntl.h uapi header, but it's hard to be sure that something else won't. Changing it now is safest. 2) make the the /proc/locks output display these as type "OFDLCK" Cc: Michael Kerrisk <mtk.manpages@gmail.com> Cc: Christoph Hellwig <hch@infradead.org> Cc: Carlos O'Donell <carlos@redhat.com> Cc: Stefan Metzmacher <metze@samba.org> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Frank Filz <ffilzlnx@mindspring.com> Cc: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Jeff Layton <jlayton@redhat.com>
2014-04-22drm/i915: Allow user modes to exceed DVI 165MHz limitVille Syrjälä
In commit commit 6375b768a9850b6154478993e5fb566fa4614a9c Author: Ville Syrjälä <ville.syrjala@linux.intel.com> Date: Mon Mar 3 11:33:36 2014 +0200 drm/i915: Reject >165MHz modes w/ DVI monitors the driver started to filter out display modes which exceed the single-link DVI 165Mz dotclock limits when the monitor doesn't report itself as being HDMI compliant. The intent was to filter out all EDID derived modes that require dual-link DVI to operate since we don't support dual-link. However the patch went a bit too far and also causes the driver to reject such modes even when specified by the user. Normally we don't check the sink limitations when setting a mode from the user. This allows the user to specify any mode whether the sink reports to support it or not. This can be useful since often the sinks support more modes than they report in the EDID. So relax the checks a bit, and apply the single-link DVI dotclock limit only when filtering the mode list, and ignore the limit when setting a user specified mode. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=72961 Tested-by: Nicholas Vinson <nvinson@comcast.net> Cc: stable@vger.kernel.org [3.14] Reviewed-by: Daniel Vetter <daniel@ffwll.ch> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2014-04-22x86: LLVMLinux: Wrap -mno-80387 with cc-optionBehan Webster
Wrap -mno-80387 gcc options with cc-option so they don't break clang. Signed-off-by: Behan Webster <behanw@converseincode.com> Cc: torvalds@linux-foundation.org Cc: dwmw2@infradead.org Cc: pageexec@freemail.hu Link: http://lkml.kernel.org/r/1398145227-25053-1-git-send-email-behanw@converseincode.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
2014-04-22drm/radeon/aux: fix hpd assignment for aux busAlex Deucher
The hpd (hot plug detect) pin assignment got lost in the conversion to to the common i2c over aux code. Without this information, aux transactions do not work properly. Fixes DP failures. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Christian König <christian.koenig@amd.com>
2014-04-22ARM: zynq: dt: Add I2C nodes to Zynq device treeSoren Brinkmann
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com> Tested-by: Michal Simek <michal.simek@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com>
2014-04-22ARM: zynq: DT: Add 'clock-latency' propertySoren Brinkmann
Specify the 'clock-latency' property to avoid certain cpufreq governors from refusing to work with the following error: ondemand governor failed, too long transition latency of HW, fallback to performance governor Reported-by: Mike Looijmans <mike.looijmans@topic.nl> Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com> Tested-by: Mike Looijmans <mike.looijmans@topic.nl> Signed-off-by: Michal Simek <michal.simek@xilinx.com>
2014-04-21ARM: OMAP2+: Fix oops for GPMC freeTony Lindgren
If gpmc_cs_remap() fails we will get an error because we are calling release_resource() on an uninitialized resource. Let's fix that by checking the resource flags. And while at it, let's also make gpmc_cs_delete_mem() use the res pointer that we already have to avoid confusion. Without this patch we can get the following error: omap-gpmc 6e000000.gpmc: cannot remap GPMC CS 1 to 0x01000300 Unable to handle kernel NULL pointer dereference at virtual address 00000018 ... (gpmc_cs_free+0x94/0xc8) (gpmc_probe_generic_child+0x178/0x1ec) (gpmc_probe_dt+0x1bc/0x2cc) (gpmc_probe+0x250/0x44c) (platform_drv_probe+0x3c/0x6c) (really_probe+0x74/0x208) (driver_probe_device+0x34/0x50) (bus_for_each_drv+0x60/0x8c) (device_attach+0x80/0xa4) (bus_probe_device+0x88/0xb0) (device_add+0x320/0x450) (of_platform_device_create_pdata+0x80/0x9c) (of_platform_bus_create+0xd0/0x170) (of_platform_bus_create+0x12c/0x170) (of_platform_populate+0x60/0x98) (pdata_quirks_init+0x30/0x48) (customize_machine+0x20/0x48) (do_one_initcall+0x2c/0x14c) (do_basic_setup+0x98/0xd8) (kernel_init_freeable+0x12c/0x1e0) (kernel_init+0x8/0xf0) (ret_from_fork+0x14/0x2c) Code: e1a04000 e59f0070 eb195136 e5942010 (e5923018) Cc: Pekon Gupta <pekon@ti.com> Reviewed-by: Javier Martinez Canillas <javier@dowhile0.org> Signed-off-by: tony Lindgren <tony@atomide.com>
2014-04-22Merge branches 'pm-sleep', 'pm-cpuidle' and 'pm-cpufreq'Rafael J. Wysocki
* pm-sleep: PM / suspend: Make cpuidle work in the "freeze" state * pm-cpuidle: intel_idle: fix IVT idle state table setting * pm-cpufreq: cpufreq: highbank: fix ARM_HIGHBANK_CPUFREQ dependency warning cpufreq: ppc: Fix integer overflow in expression cpufreq, powernv: Fix build failure on UP cpufreq: unicore32: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERO
2014-04-22Merge branches 'acpica' and 'acpi-tools'Rafael J. Wysocki
* acpica: ACPICA: Fix buffer allocation issue for generic_serial_bus region accesses. * acpi-tools: tools/power/acpi: Minor bugfixes
2014-04-22cpufreq: highbank: fix ARM_HIGHBANK_CPUFREQ dependency warningKefeng Wang
When make ARCH=arm multi_v7_defconfig, we get the following warnings: warning: (ARM_HIGHBANK_CPUFREQ) selects GENERIC_CPUFREQ_CPU0 which has unmet direct dependencies (ARCH_HAS_CPUFREQ && CPU_FREQ && HAVE_CLK && REGULATOR && OF && THERMAL && CPU_THERMAL) To fix this, make ARM_HIGHBANK_CPUFREQ depend on ARCH_HAS_CPUFREQ and REGULATOR instead of selecting them, PM_OPP will be selected by ARCH_HAS_CPUFREQ. Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-04-21cpufreq: ppc: Fix integer overflow in expressionGeert Uytterhoeven
On 32-bit, "12 * NSEC_PER_SEC" doesn't fit in "unsigned long" (NSEC_PER_SEC is a "long" constant), causing an integer overflow: drivers/cpufreq/ppc-corenet-cpufreq.c: In function 'corenet_cpufreq_cpu_init': drivers/cpufreq/ppc-corenet-cpufreq.c:211:9: warning: integer overflow in expression [-Woverflow] Force the intermediate to be 64-bit by adding an "ULL" suffix to the constant multiplier to fix this. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-04-21cpufreq, powernv: Fix build failure on UPSrivatsa S. Bhat
Paul Gortmaker reported the following build failure of the powernv cpufreq driver on UP configs: drivers/cpufreq/powernv-cpufreq.c:241:2: error: implicit declaration of function 'cpu_sibling_mask' [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [drivers/cpufreq/powernv-cpufreq.o] Error 1 make[2]: *** [drivers/cpufreq] Error 2 make[1]: *** [drivers] Error 2 make: *** [sub-make] Error 2 The trouble here is that cpu_sibling_mask is defined only in <asm/smp.h>, and <linux/smp.h> includes <asm/smp.h> only in SMP builds. So fix this build failure by explicitly including <asm/smp.h> in the driver, so that we get the definition of cpu_sibling_mask even in UP configurations. Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-04-21cpufreq: unicore32: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERODuan Jiong
This patch fixes coccinelle error regarding usage of IS_ERR and PTR_ERR instead of PTR_ERR_OR_ZERO. Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-04-21PM / suspend: Make cpuidle work in the "freeze" stateRafael J. Wysocki
The "freeze" system sleep state introduced by commit 7e73c5ae6e79 (PM: Introduce suspend state PM_SUSPEND_FREEZE) requires cpuidle to be functional when freeze_enter() is executed to work correctly (that is, to be able to save any more energy than runtime idle), but that is impossible after commit 8651f97bd951d (PM / cpuidle: System resume hang fix with cpuidle) which caused cpuidle to be paused in dpm_suspend_noirq() and resumed in dpm_resume_noirq(). To avoid that problem, add cpuidle_resume() and cpuidle_pause() to the beginning and the end of freeze_enter(), respectively. Reported-by: Zhang Rui <rui.zhang@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Preeti U Murthy <preeti@linux.vnet.ibm.com>
2014-04-21intel_idle: fix IVT idle state table settingChristoph Jaeger
Ivy Town idle state table will not be set as intended. Fix it. Picked up by Coverity - CID 1201420/1201421. Fixes: 0138d8f075 ("intel_idle: fine-tune IVT residency targets") Signed-off-by: Christoph Jaeger <christophjaeger@linux.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-04-21[SCSI] More USB deadlock fixesJames Bottomley
This patch fixes a corner case in the previous USB Deadlock fix patch (12023e7 [SCSI] Fix USB deadlock caused by SCSI error handling). The scenario is abort command, set flag, abort completes, send TUR, TUR doesn't return, so we now try to abort the TUR, but scsi_abort_eh_cmnd() will skip the abort because the flag is set and move straight to reset. Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-04-21[SCSI] Fix USB deadlock caused by SCSI error handlingHannes Reinecke
USB requires that every command be aborted first before we escalate to reset. In particular, USB will deadlock if we try to reset first before aborting the command. Unfortunately, the flag we use to tell if a command has already been aborted: SCSI_EH_ABORT_SCHEDULED is not cleared properly leading to cases where we can requeue a command with the flag set and proceed immediately to reset if it fails (thus causing USB to deadlock). Fix by clearing the SCSI_EH_ABORT_SCHEDULED flag if it has been set. Which means this will be the second time scsi_abort_command() has been called for the same command. IE the first abort went out, did its thing, but now the same command has timed out again. So this flag gets cleared, and scsi_abort_command() returns FAILED, and _no_ asynchronous abort is being scheduled. scsi_times_out() will then proceed to call scsi_eh_scmd_add(). But as we've cleared the SCSI_EH_ABORT_SCHEDULED flag the SCSI_EH_CANCEL_CMD flag will continue to be set, and the command will be aborted with the main SCSI EH routine. Reported-by: Alan Stern <stern@rowland.harvard.edu> Tested-by: Andreas Reis <andreas.reis@gmail.com> Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-04-21[SCSI] Fix command result state propagationAlan Stern
We're seeing a case where the contents of scmd->result isn't being reset after a SCSI command encounters an error, is resubmitted, times out and then gets handled. The error handler acts on the stale result of the previous error instead of the timeout. Fix this by properly zeroing the scmd->status before the command is resubmitted. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-04-21[SCSI] Fix spurious request sense in error handlingJames Bottomley
We unconditionally execute scsi_eh_get_sense() to make sure all failed commands that should have sense attached, do. However, the routine forgets that some commands, because of the way they fail, will not have any sense code ... we should not bother them with a REQUEST_SENSE command. Fix this by testing to see if we actually got a CHECK_CONDITION return and skip asking for sense if we don't. Tested-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-04-21ACPICA: Fix buffer allocation issue for generic_serial_bus region accesses.Lv Zheng
The size of the buffer allocated for generic_serial_bus region access is not correct. This patch introduces acpi_ex_get_serial_access_length() to be invoked to obtain correct data buffer length. Signed-off-by: Lv Zheng <lv.zheng@intel.com> Reported by: Lan Tianyu <tianyu.lan@intel.com> Acked-by: Lan Tianyu <tianyu.lan@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-04-21tools/power/acpi: Minor bugfixesThomas Renninger
- bindir is created, but sbindir is used -> fix that - the debug parts are there twice (copy paste bug?). Remove one of the exact same parts Signed-off-by: Thomas Renninger <trenn@suse.de> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-04-21MAINTAINERS: SXGBE authors updateFlorian Fainelli
The mail address for Siva Reddy Kallam is bouncing, remove the email address from the MAINTAINERS entry for Samsung's SXGBE driver. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-21Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/umlLinus Torvalds
Pull UML fixes from Richard Weinberger: "Assorted fixes for UML" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: Memory corruption on startup um: Missing pipe handling uml: Simplify tempdir logic.
2014-04-21Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates This series contains updates to e1000e, igb, ixgbe and i40e. Most notably are Jakub's patches to clean up the Rx time stamping code for ixgbe and the fix up of debug messages with proper termination. Jesse's i40e patch fixes an issue reported by Eric Dumazet that the i40e driver was allowing the hardware to replicate the PSH flag on all segments of a TSO operation. With this fix, we are now configuring the CWR bit to only be set in the first packet of a TSO and we enable TSO_ECN in order to advertise to the stack that we do the right thing on the wire. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-21usb: phy: am335x-control: wait 1ms after power-up transitionsDaniel Mack
Tests have shown that when a power-up transition is followed by other PHY operations too quickly, the USB port appears dead. Waiting 1ms fixes this problem. Signed-off-by: Daniel Mack <zonque@gmail.com> Cc: stable@vger.kernel.org [3.14] Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-04-21usb: gadget: f_rndis: reduce NETTX irq caused by free skb headerMacpaul Lin
This patch reduce unecessary NETTX softirq call caused by free skb header. You will see this softirq comes twice while there is only one TX packet to be transmitted. So using dev_kfree_skb() instead of dev_kfree_skb_any() to avoid this problem. Cc: David S. Miller <davem@davemloft.net> Cc: Stephen Hemminger <shemminger@vyatta.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Macpaul Lin <macpaul@gmail.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-04-21Revert "usb: gadget: u_ether: move hardware transmit to RX NAPI"Felipe Balbi
This reverts commit 716fb91dfe1777bd6d5e598f3d3572214b3ed296. That commit caused a regression which would end up in a kernel BUG() as below: [ 101.554300] g_ether gadget: full-speed config #1: CDC Subset/SAFE [ 101.585186] ------------[ cut here ]------------ [ 101.600587] kernel BUG at include/linux/netdevice.h:495! [ 101.615850] Internal error: Oops - BUG: 0 [#1] PREEMPT ARM [ 101.645539] Modules linked in: [ 101.660483] CPU: 0 PID: 0 Comm: swapper Not tainted 3.15.0-rc1+ #104 [ 101.690175] task: c05dc5c8 ti: c05d2000 task.ti: c05d2000 [ 101.705579] PC is at eth_start+0x64/0x8c [ 101.720981] LR is at __netif_schedule+0x7c/0x90 [ 101.736455] pc : [<c0299174>] lr : [<c036a134>] psr: 60000093 [ 101.736455] sp : c05d3d18 ip : c05d3cf8 fp : c05d3d2c [ 101.782340] r10: 00000000 r9 : c196c1f0 r8 : c196c1a0 [ 101.797823] r7 : 00000000 r6 : 00000002 r5 : c1976400 r4 : c1976400 [ 101.828058] r3 : 00000000 r2 : c05d3ce8 r1 : 00000001 r0 : 00000002 [ 101.858722] Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel Reported-by: Robert Jarzmik <robert.jarzmik@free.fr> Signed-of-by: Felipe Balbi <balbi@ti.com>
2014-04-21[SCSI] don't reference freed command in scsi_prep_returnChristoph Hellwig
Patch commit 0479633686d370303e3430256ace4bd5f7f138dc Author: Christoph Hellwig <hch@infradead.org> Date: Thu Feb 20 14:20:55 2014 -0800 [SCSI] do not manipulate device reference counts in scsi_get/put_command Introduced a use after free:I in the kill case of scsi_prep_return we have to release our device reference, but we do this trying to reference the just freed command. Use the local sdev pointer instead. Fixes: 0479633686d370303e3430256ace4bd5f7f138dc Reported-by: Joe Lawrence <joe.lawrence@stratus.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-04-21[SCSI] don't reference freed command in scsi_init_sgtableChristoph Hellwig
Patch commit 0479633686d370303e3430256ace4bd5f7f138dc Author: Christoph Hellwig <hch@infradead.org> Date: Thu Feb 20 14:20:55 2014 -0800 [SCSI] do not manipulate device reference counts in scsi_get/put_command Introduced a use after free: when scsi_init_io fails we have to release our device reference, but we do this trying to reference the just freed command. Add a local scsi_device pointer to fix this. Fixes: 0479633686d370303e3430256ace4bd5f7f138dc Reported-by: Sander Eikelenboom <linux@eikelenboom.it> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-04-21[SCSI] hpsa: fix NULL dereference in hpsa_put_ctlr_into_performant_mode()scameron@beardog.cce.hp.com
Initialize local variable trans_support before it is used rather than after. It is supposed to contain the value of a register on the controller containing bits that describe which transport modes the controller supports (e.g. "performant", "ioaccel1", "ioaccel2"). A NULL pointer dereference will almost certainly occur if trans_support is not initialized at the right point. If for example the uninitialized trans_support value does not have the bit set for ioaccel2 support when it should be, then ioaccel2_alloc_cmds_and_bft() will not get called as it should be and the h->ioaccel2_blockFetchTable array will remain NULL instead of being allocated. Too late, trans_support finally gets initialized with the correct value with ioaccel2 mode bit set, which later causes calc_bucket_map() to be called to fill in h->ioaccel2_blockFetchTable[]. However h->ioaccel2_blockFetchTable is NULL because it didn't get allocated because earlier trans_support wasn't initialized at the right point. Fixes: e1f7de0cdd68d246d7008241cd9e443a54f880a8 Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Reported-by: Baoquan He <bhe@redhat.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-04-21ASoC: dapm: Fix widget double free with auto-disable DAPM kcontrolJarkko Nikula
Commit 9e1fda4ae158 ("ASoC: dapm: Implement mixer input auto-disable") is trying to free the widget it allocated by snd_soc_dapm_new_control() call in dapm_kcontrol_data_alloc() by adding kfree(data->widget) to dapm_kcontrol_free(). This is causing a widget double free with auto-disabled DAPM kcontrols in sound card unregistration because widgets are already freed before dapm_kcontrol_free() is called. Reason for that is all widgets are added into dapm->card->widgets list in snd_soc_dapm_new_control() and freed in dapm_free_widgets() during execution of snd_soc_dapm_free(). Now snd_soc_dapm_free() calls for different DAPM contexts happens before snd_card_free() call from where the call chain to dapm_kcontrol_free() begins: soc_cleanup_card_resources() soc_remove_dai_links() soc_remove_link_dais() snd_soc_dapm_free(&cpu_dai->dapm) soc_remove_link_components() soc_remove_platform() snd_soc_dapm_free(&platform->dapm) soc_remove_codec() snd_soc_dapm_free(&codec->dapm) snd_soc_dapm_free(&card->dapm) snd_card_free() snd_card_do_free() snd_device_free_all() snd_device_free() snd_ctl_dev_free() snd_ctl_remove() snd_ctl_free_one() dapm_kcontrol_free() This wasn't making harm with ordinary DAPM kcontrols since data->widget is NULL for them. Fixes: 9e1fda4ae158 (ASoC: dapm: Implement mixer input auto-disable) Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com> Acked-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Mark Brown <broonie@linaro.org> Cc: stable@vger.kernel.org
2014-04-20Merge tag 'ext4_for_linus_stable' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "These are regression and bug fixes for ext4. We had a number of new features in ext4 during this merge window (ZERO_RANGE and COLLAPSE_RANGE fallocate modes, renameat, etc.) so there were many more regression and bug fixes this time around. It didn't help that xfstests hadn't been fully updated to fully stress test COLLAPSE_RANGE until after -rc1" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (31 commits) ext4: disable COLLAPSE_RANGE for bigalloc ext4: fix COLLAPSE_RANGE failure with 1KB block size ext4: use EINVAL if not a regular file in ext4_collapse_range() ext4: enforce we are operating on a regular file in ext4_zero_range() ext4: fix extent merging in ext4_ext_shift_path_extents() ext4: discard preallocations after removing space ext4: no need to truncate pagecache twice in collapse range ext4: fix removing status extents in ext4_collapse_range() ext4: use filemap_write_and_wait_range() correctly in collapse range ext4: use truncate_pagecache() in collapse range ext4: remove temporary shim used to merge COLLAPSE_RANGE and ZERO_RANGE ext4: fix ext4_count_free_clusters() with EXT4FS_DEBUG and bigalloc enabled ext4: always check ext4_ext_find_extent result ext4: fix error handling in ext4_ext_shift_extents ext4: silence sparse check warning for function ext4_trim_extent ext4: COLLAPSE_RANGE only works on extent-based files ext4: fix byte order problems introduced by the COLLAPSE_RANGE patches ext4: use i_size_read in ext4_unaligned_aio() fs: disallow all fallocate operation on active swapfile fs: move falloc collapse range check into the filesystem methods ...
2014-04-20um: Memory corruption on startupAnton Ivanov
The reverse case of this race (you must msync before read) is well known. This is the not so common one. It can be triggered only on systems which do a lot of task switching and only at UML startup. If you are starting 200+ UMLs ~ 0.5% will always die without this fix. Signed-off-by: Anton Ivanov <antivano@cisco.com> [rw: minor whitespace fixes] Signed-off-by: Richard Weinberger <richard@nod.at>
2014-04-20um: Missing pipe handlingAnton Ivanov
UML does not handle sigpipe. As a result when running it under expect or redirecting the IO from the console to an external program it will crash if the program stops or exits. Signed-off-by: Anton Ivanov <antivano@cisco.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2014-04-20uml: Simplify tempdir logic.Tristan Schmelcher
Inferring the mount hierarchy correctly from /proc/mounts is hard when MS_MOVE may have been used, and the previous code did it wrongly. This change simplifies the logic to only require that /dev/shm be _on_ tmpfs (which can be checked trivially with statfs) rather than that it be a _mountpoint_ of tmpfs, since there isn't a compelling reason to be that strict. We also now check for tmpfs on whatever directory we ultimately use so that the user is better informed. This change also moves the more standard TMPDIR environment variable check ahead of the others. Applies to 3.12. Signed-off-by: Tristan Schmelcher <tschmelcher@google.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2014-04-20irqchip: armada-370-xp: Fix releasing of MSIsNeil Greatorex
Store the value of d->hwirq in a local variable as the real value is wiped out by calling irq_dispose_mapping. Without this patch, the armada_370_xp_free_msi function would always free MSI#0, no matter what was passed to it. Fixes: 31f614edb726fcc4d5aa0f2895fbdec9b04a3ca4 ('irqchip: armada-370-xp: implement MSI support') Cc: <stable@vger.kernel.org> # v3.13+ Signed-off-by: Neil Greatorex <neil@fatboyfat.co.uk> Link: https://lkml.kernel.org/r/1397823593-1932-4-git-send-email-thomas.petazzoni@free-electrons.com Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Link: https://lkml.kernel.org/r/1397823593-1932-4-git-send-email-thomas.petazzoni@free-electrons.com Signed-off-by: Jason Cooper <jason@lakedaemon.net>
2014-04-20irqchip: armada-370-xp: implement the ->check_device() msi_chip operationThomas Petazzoni
Until now, we were leaving the ->check_device() msi_chip operation empty, which leads the PCI core to believe that we support both MSI and MSI-X. In fact, we do not support MSI-X, so we have to tell this to the PCI core by providing an implementation of this operation. Fixes: 31f614edb726fcc4d5aa0f2895fbdec9b04a3ca4 ('irqchip: armada-370-xp: implement MSI support') Cc: <stable@vger.kernel.org> # v3.13+ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Link: https://lkml.kernel.org/r/1397823593-1932-3-git-send-email-thomas.petazzoni@free-electrons.com Tested-by: Neil Greatorex <neil@fatboyfat.co.uk> Signed-off-by: Jason Cooper <jason@lakedaemon.net>
2014-04-20irqchip: armada-370-xp: fix invalid cast of signed value into unsigned variableThomas Petazzoni
The armada_370_xp_alloc_msi() function returns a signed int, which is negative on error. However, we store the return value into an irq_hw_number_t, which is unsigned. Therefore, we actually never test if armada_370_xp_alloc_msi() returns an error or not, which may lead us to use hwirq numbers of as 0xffffffe4 (when armada_370_xp_alloc_msi() returns -ENOSPC). This commit fixes that by storing the return value of armada_370_xp_alloc_msi() in a signed variable. Fixes: 31f614edb726fcc4d5aa0f2895fbdec9b04a3ca4 ('irqchip: armada-370-xp: implement MSI support') Cc: <stable@vger.kernel.org> # v3.13+ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Link: https://lkml.kernel.org/r/1397823593-1932-2-git-send-email-thomas.petazzoni@free-electrons.com Tested-by: Neil Greatorex <neil@fatboyfat.co.uk> Signed-off-by: Jason Cooper <jason@lakedaemon.net>
2014-04-20Linux 3.15-rc2v3.15-rc2Linus Torvalds
2014-04-20Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dmaLinus Torvalds
Pull slave-dmaengine fixes from Vinod Koul: "Back from long weekend here in India and now the time to send fixes for slave dmaengine. - Dan's fix of sirf xlate code - Jean's fix for timberland - edma fixes by Sekhar for SG handling and Yuan for changing init call" * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma: dma: fix eDMA driver as a subsys_initcall dmaengine: sirf: off by one in of_dma_sirfsoc_xlate() platform: Fix timberdale dependencies dma: edma: fix incorrect SG list handling