The appended fixes it by returning the appropriate error code in module_init
whenever something goes wrong, thus cancelling the insertion of the module.
Steven Rostedt [Thu, 11 Nov 2010 16:29:25 +0000 (11:29 -0500)]
staging: ft1000: Copy from user into correct data
While doing a ktest.pl I used a MIN_CONFIG that had STAGING enabled, and
a randconfig with CONFIG_DEBUG_STRICT_USER_COPY_CHECKS enabled caught
the following bug:
In file included from /home/rostedt/work/autotest/nobackup/linux-test.git/arch/x86/include/asm/uaccess.h:571:0,
from /home/rostedt/work/autotest/nobackup/linux-test.git/include/linux/poll.h:14,
from /home/rostedt/work/autotest/nobackup/linux-test.git/drivers/staging/ft1000/ft1000-usb/ft1000_chdev.c:32:
In function 'copy_from_user',
inlined from 'ft1000_ChIoctl' at /home/rostedt/work/autotest/nobackup/linux-test.git/drivers/staging/ft1000/ft1000-usb/ft1000_chdev.c:702:36:
/home/rostedt/work/autotest/nobackup/linux-test.git/arch/x86/include/asm/uaccess_32.h:212:26: error: call to 'copy_from_user_overflow' declared with attribute error: copy_from_user() buffer size is not provably correct
Looking at the code it was obvious what the problem was. The pointer
dpram_data was being allocated but the address was being written to.
Looking at the comment above the code shows that it use to write into an
element of that pointer where the '&' is appropriate. But now that it
writes to the pointer itself, we need to remove the '&' otherwise we
write over the pointer and not into the data it points to.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Cc: Marek Belisko <marek.belisko@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This was necessary in order to resolve some conflicts that happened
between -rc1 and -rc2 with the following files:
drivers/staging/bcm/Bcmchar.c
drivers/staging/intel_sst/intel_sst_app_interface.c
Eric Paris [Mon, 15 Nov 2010 23:36:29 +0000 (18:36 -0500)]
capabilities/syslog: open code cap_syslog logic to fix build failure
The addition of CONFIG_SECURITY_DMESG_RESTRICT resulted in a build
failure when CONFIG_PRINTK=n. This is because the capabilities code
which used the new option was built even though the variable in question
didn't exist.
The patch here fixes this by moving the capabilities checks out of the
LSM and into the caller. All (known) LSMs should have been calling the
capabilities hook already so it actually makes the code organization
better to eliminate the hook altogether.
Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Mon, 15 Nov 2010 22:06:11 +0000 (14:06 -0800)]
Merge branch 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6
* 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6:
arm: omap1: devices: need to return with a value
OMAP1: camera.h: add missing include
omap: dma: Add read-back to DMA interrupt handler to avoid spuriousinterrupts
OMAP2: Devkit8000: Fix mmc regulator failure
Linus Torvalds [Mon, 15 Nov 2010 22:05:44 +0000 (14:05 -0800)]
Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging
* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
hwmon: (w83795) Check for BEEP pin availability
hwmon: (w83795) Clear intrusion alarm immediately
hwmon: (w83795) Read the intrusion state properly
hwmon: (w83795) Print the actual temperature channels as sources
hwmon: (w83795) List all usable temperature sources
hwmon: (w83795) Expose fan control method
hwmon: (w83795) Fix fan control mode attributes
hwmon: (lm95241) Check validity of input values
hwmon: Change mail address of Hans J. Koch
Linus Torvalds [Mon, 15 Nov 2010 22:01:33 +0000 (14:01 -0800)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
PCI: sysfs: fix printk warnings
PCI: fix pci_bus_alloc_resource() hang, prefer positive decode
PCI: read current power state at enable time
PCI: fix size checks for mmap() on /proc/bus/pci files
x86/PCI: coalesce overlapping host bridge windows
PCI hotplug: ibmphp: Add check to prevent reading beyond mapped area
Jean Delvare [Mon, 15 Nov 2010 21:40:38 +0000 (22:40 +0100)]
i2c: Delete unused adapter IDs
Delete unused I2C adapter IDs. Special cases are:
* I2C_HW_B_RIVA was still set in driver rivafb, however no other
driver is ever looking for this value, so we can safely remove it.
* I2C_HW_B_HDPVR is used in staging driver lirc_zilog, however no
adapter ID is ever set to this value, so the code in question never
runs. As the code additionally expects that I2C_HW_B_HDPVR may not
be defined, we can delete it now and let the lirc_zilog driver
maintainer rewrite this piece of code.
Big thanks for Hans Verkuil for doing all the hard work :)
Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Jarod Wilson <jarod@redhat.com> Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com> Acked-by: Hans Verkuil <hverkuil@xs4all.nl>
Wolfram Sang [Mon, 15 Nov 2010 21:40:38 +0000 (22:40 +0100)]
i2c: Remove obsolete cleanup for clientdata
A few new i2c-drivers came into the kernel which clear the clientdata-pointer
on exit. This is obsolete meanwhile, so fix it and hope the word will spread.
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Acked-by: Alan Cox <alan@linux.intel.com> Acked-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Acked-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Jean Delvare <khali@linux-fr.org>
Linus Torvalds [Mon, 15 Nov 2010 21:37:37 +0000 (13:37 -0800)]
include/linux/kernel.h: Move logging bits to include/linux/printk.h
Move the logging bits from kernel.h into printk.h so that
there is a bit more logical separation of the generic from
the printk logging specific parts.
Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The fix in commit 6b4e81db2552 ("i8k: Tell gcc that *regs gets
clobbered") to work around the gcc miscompiling i8k.c to add "+m
(*regs)" caused register pressure problems and a build failure.
Changing the 'asm' statement to 'asm volatile' instead should prevent
that and works around the gcc bug as well, so we can remove the "+m".
[ Background on the gcc bug: a memory clobber fails to mark the function
the asm resides in as non-pure (aka "__attribute__((const))"), so if
the function does nothing else that triggers the non-pure logic, gcc
will think that that function has no side effects at all. As a result,
callers will be mis-compiled.
Adding the "+m" made gcc see that it's not a pure function, and so
does "asm volatile". The problem was never really the need to mark
"*regs" as changed, since the memory clobber did that part - the
problem was just a bug in the gcc "pure" function analysis - Linus ]
Signed-off-by: Jim Bos <jim876@xs4all.nl> Acked-by: Jakub Jelinek <jakub@redhat.com> Cc: Andi Kleen <andi@firstfloor.org> Cc: Andreas Schwab <schwab@linux-m68k.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Jean Delvare [Mon, 15 Nov 2010 20:38:57 +0000 (21:38 +0100)]
hwmon: (w83795) Check for BEEP pin availability
On the W83795ADG, there's a single pin for BEEP and OVT#, so you
can't have both. Check the configuration and don't create beep
attributes when BEEP pin is not available.
The W83795G has a dedicated BEEP pin so the functionality is always
available there.
Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
Jean Delvare [Mon, 15 Nov 2010 20:38:57 +0000 (21:38 +0100)]
hwmon: (w83795) Clear intrusion alarm immediately
When asked to clear the intrusion alarm, do so immediately. We have to
invalidate the cache to make sure the new status will be read. But we
also have to read from the status register once to clear the pending
alarm, as writing to CLR_CHS surprising won't clear it automatically.
Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
Jean Delvare [Mon, 15 Nov 2010 20:38:56 +0000 (21:38 +0100)]
hwmon: (w83795) Read the intrusion state properly
We can't read the intrusion state from the real-time alarm registers
as we do for all other alarm flags, because real-time alarm bits don't
stick (by definition) and the intrusion state has to stick until
explicitly cleared (otherwise it has little value.)
So we have to use the interrupt status register instead, which is read
from the same address but with a configuration bit flipped in another
register.
Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
Jean Delvare [Mon, 15 Nov 2010 20:38:56 +0000 (21:38 +0100)]
hwmon: (w83795) List all usable temperature sources
Temperature sources are not correlated directly with temperature
channels. A look-up table is required to find out which temperature
sources can be used depending on which temperature channels (both
analog and digital) are enabled.
Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
Jean Delvare [Mon, 15 Nov 2010 20:38:56 +0000 (21:38 +0100)]
hwmon: (w83795) Expose fan control method
Expose fan control method (DC vs. PWM) using the standard sysfs
attributes. I've made it read-only as the board should be wired for
a given mode, the BIOS should have set up the chip for this mode, and
you shouldn't have to change it. But it would be easy enough to make
it changeable if someone comes up with a use case.
Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
Jean Delvare [Mon, 15 Nov 2010 20:38:56 +0000 (21:38 +0100)]
hwmon: (w83795) Fix fan control mode attributes
There were two bugs:
* Speed cruise mode was improperly reported for all fans but fan1.
* Fan control method (PWM vs. DC) was mixed with the control mode.
It will be added back as a separate attribute, as per the standard
sysfs interface.
Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
Jean Delvare [Mon, 15 Nov 2010 20:38:56 +0000 (21:38 +0100)]
hwmon: (lm95241) Check validity of input values
This clears the following build-time warnings I was seeing:
drivers/hwmon/lm95241.c: In function "set_interval":
drivers/hwmon/lm95241.c:132:15: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result
drivers/hwmon/lm95241.c: In function "set_max2":
drivers/hwmon/lm95241.c:278:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result
drivers/hwmon/lm95241.c: In function "set_max1":
drivers/hwmon/lm95241.c:277:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result
drivers/hwmon/lm95241.c: In function "set_min2":
drivers/hwmon/lm95241.c:249:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result
drivers/hwmon/lm95241.c: In function "set_min1":
drivers/hwmon/lm95241.c:248:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result
drivers/hwmon/lm95241.c: In function "set_type2":
drivers/hwmon/lm95241.c:220:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result
drivers/hwmon/lm95241.c: In function "set_type1":
drivers/hwmon/lm95241.c:219:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result
This also fixes a small race in set_interval() as a side effect: by
working with a temporary local variable we prevent data->interval from
being accessed at a time it contains the interval value in the wrong
unit.
Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: Davide Rizzo <elpa.rizzo@gmail.com>
Randy Dunlap [Sat, 13 Nov 2010 16:44:33 +0000 (08:44 -0800)]
PCI: sysfs: fix printk warnings
Cast pci_resource_start() and pci_resource_len() to u64 for printk.
drivers/pci/pci-sysfs.c:753: warning: format '%16Lx' expects type 'long long unsigned int', but argument 9 has type 'resource_size_t'
drivers/pci/pci-sysfs.c:753: warning: format '%16Lx' expects type 'long long unsigned int', but argument 10 has type 'resource_size_t'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Linus Torvalds [Mon, 15 Nov 2010 16:42:07 +0000 (08:42 -0800)]
Merge branch 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6
* 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6:
fsl-diu-fb: drop dead ioctl define
MAINTAINERS: Add an fbdev git tree entry.
OMAP: DSS: Fix documentation regarding 'vram' kernel parameter
OMAP: VRAM: Fix boot-time memory allocation
OMAP: VRAM: improve VRAM error prints
sisfb: limit POST memory test according to PCI resource length
fbdev: sh_mobile_lcdc: use correct number of modes, when using the default
fbdev: sh_mobile_lcdc: use the standard CEA-861 720p timing
fbdev: sh_mobile_hdmi: properly clean up modedb on monitor unplug
Linus Torvalds [Mon, 15 Nov 2010 16:41:30 +0000 (08:41 -0800)]
Merge branches 'sh-fixes-for-linus' and 'rmobile-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6
* 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
sh: intc: Fix up build failure introduced by radix tree changes.
MAINTAINERS: update the sh git tree entry.
sh: clkfwk: fix up compiler warnings.
sh: intc: Fix up initializers for gcc 4.5.
rtc: rtc-sh - fix a memory leak
* 'rmobile-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
ARM: mach-shmobile: ap4evb: add fsib 44100Hz rate
MAINTAINERS: update the ARM SH-Mobile git tree entry.
ARM: mach-shmobile: ap4evb: Mark NOR boot loader partitions read-only.
ARM: mach-shmobile: intc-sh7372: fix interrupt number
This area of the code has always been a bit delicate due to the
subtleties of lock ordering. The problem is that for "normal"
alloc/dealloc, we always grab the inode locks first and the rgrp lock
later.
In order to ensure no races in looking up the unlinked, but still
allocated inodes, we need to hold the rgrp lock when we do the lookup,
which means that we can't take the inode glock.
The solution is to borrow the technique already used by NFS to solve
what is essentially the same problem (given an inode number, look up
the inode carefully, checking that it really is in the expected
state).
We cannot do that directly from the allocation code (lock ordering
again) so we give the job to the pre-existing delete workqueue and
carry on with the allocation as normal.
If we find there is no space, we do a journal flush (required anyway
if space from a deallocation is to be released) which should block
against the pending deallocations, so we should always get the space
back.
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
Paul Mundt [Mon, 15 Nov 2010 05:30:30 +0000 (14:30 +0900)]
sh: intc: Fix up build failure introduced by radix tree changes.
The radix tree retry logic got a bit of an overhaul and subsequently
broke the virtual IRQ subgroup build. Simply switch over to
radix_tree_deref_retry() as per the filemap changes, which the virq
lookup logic was modelled after in the first place.
Pavel Emelyanov [Thu, 28 Oct 2010 09:50:37 +0000 (13:50 +0400)]
slub: Fix slub_lock down/up imbalance
There are two places, that do not release the slub_lock.
Respective bugs were introduced by sysfs changes ab4d5ed5 (slub: Enable
sysfs support for !CONFIG_SLUB_DEBUG) and 2bce6485 ( slub: Allow removal
of slab caches during boot).
Acked-by: Christoph Lameter <cl@linux.com> Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: Pekka Enberg <penberg@kernel.org>
Jim Bos [Sat, 13 Nov 2010 11:13:53 +0000 (12:13 +0100)]
i8k: Tell gcc that *regs gets clobbered
More recent GCC caused the i8k driver to stop working, on Slackware
compiler was upgraded from gcc-4.4.4 to gcc-4.5.1 after which it didn't
work anymore, meaning the driver didn't load or gave total nonsensical
output.
As it turned out the asm(..) statement forgot to mention it modifies the
*regs variable.
Credits to Andi Kleen and Andreas Schwab for providing the fix.
Signed-off-by: Jim Bos <jim876@xs4all.nl> Cc: Andi Kleen <andi@firstfloor.org> Cc: Andreas Schwab <schwab@linux-m68k.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Dave Jones <davej@redhat.com> Signed-off-by: Len Brown <len.brown@intel.com> Cc: stable@kernel.org (for 2.6.36) Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tao Ma [Sat, 13 Nov 2010 08:22:02 +0000 (16:22 +0800)]
ocfs2: Change some lock status member in ocfs2_lock_res to char.
Commit 83fd9c7 changes l_level, l_requested and l_blocking of
ocfs2_lock_res from int to unsigned char. But actually it is
initially as -1(ocfs2_lock_res_init_common) which
correspoding to 255 for unsigned char. So the whole dlm lock
mechanism doesn't work now which means a disaster to ocfs2.
Cc: Goldwyn Rodrigues <rgoldwyn@suse.de> Signed-off-by: Tao Ma <tao.ma@oracle.com> Signed-off-by: Joel Becker <joel.becker@oracle.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
[kgene.kim@samsung.com: Added fix same warning(mach-s3c64xx/Kconfig)] Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (66 commits)
can-bcm: fix minor heap overflow
gianfar: Do not call device_set_wakeup_enable() under a spinlock
ipv6: Warn users if maximum number of routes is reached.
docs: Add neigh/gc_thresh3 and route/max_size documentation.
axnet_cs: fix resume problem for some Ax88790 chip
ipv6: addrconf: don't remove address state on ifdown if the address is being kept
tcp: Don't change unlocked socket state in tcp_v4_err().
x25: Prevent crashing when parsing bad X.25 facilities
cxgb4vf: add call to Firmware to reset VF State.
cxgb4vf: Fail open if link_start() fails.
cxgb4vf: flesh out PCI Device ID Table ...
cxgb4vf: fix some errors in Gather List to skb conversion
cxgb4vf: fix bug in Generic Receive Offload
cxgb4vf: don't implement trivial (and incorrect) ndo_select_queue()
ixgbe: Look inside vlan when determining offload protocol.
bnx2x: Look inside vlan when determining checksum proto.
vlan: Add function to retrieve EtherType from vlan packets.
virtio-net: init link state correctly
ucc_geth: Fix deadlock
ucc_geth: Do not bring the whole IF down when TX failure.
...
Linus Torvalds [Sat, 13 Nov 2010 01:13:28 +0000 (17:13 -0800)]
Merge branch 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6
* 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (28 commits)
Revert "USB: xhci: Use GFP_ATOMIC under spin_lock"
USB: ohci-jz4740: Fix spelling in MODULE_ALIAS
UWB: Return UWB_RSV_ALLOC_NOT_FOUND rather than crashing on NULL dereference if kzalloc fails
usb: core: fix information leak to userland
usb: misc: iowarrior: fix information leak to userland
usb: misc: sisusbvga: fix information leak to userland
usb: subtle increased memory usage in u_serial
USB: option: fix when the driver is loaded incorrectly for some Huawei devices.
USB: xhci: Use GFP_ATOMIC under spin_lock
usb: gadget: goku_udc: add registered flag bit, fixing build
USB: ehci/mxc: compile fix
USB: Fix FSL USB driver on non Open Firmware systems
USB: the development of the usb tree is now in git
usb: musb: fail unaligned DMA transfers on v1.8 and above
USB: ftdi_sio: add device IDs for Milkymist One JTAG/serial
usb.h: fix ioctl kernel-doc info
usb: musb: gadget: kill duplicate code in musb_gadget_queue()
usb: musb: Fix handling of spurious SESSREQ
usb: musb: fix kernel oops when loading musb_hdrc module for the 2nd time
USB: musb: blackfin: push clkin value to platform resources
...
Linus Torvalds [Sat, 13 Nov 2010 00:02:30 +0000 (16:02 -0800)]
Merge branch 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6
* 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
n_gsm: Fix length handling
n_gsm: Copy n2 over when configuring via ioctl interface
serial: bfin_5xx: grab port lock before making port termios changes
serial: bfin_5xx: disable CON_PRINTBUFFER for consoles
serial: bfin_5xx: remove redundant SSYNC to improve TX speed
serial: bfin_5xx: always include DMA headers
vcs: make proper usage of the poll flags
amiserial: Remove unused variable icount
8250: Fix tcsetattr to avoid ioctl(TIOCMIWAIT) hang
tty_ldisc: Fix BUG() on hangup
TTY: restore tty_ldisc_wait_idle
SERIAL: blacklist si3052 chip
drivers/serial/bfin_5xx.c: Fix line continuation defects
tty: prevent DOS in the flush_to_ldisc
8250: add support for Kouwell KW-L221N-2
nozomi: Fix warning from the previous TIOCGCOUNT changes
tty: fix warning in synclink driver
tty: Fix formatting in tty.h
tty: the development tree is now done in git
Linus Torvalds [Sat, 13 Nov 2010 00:01:55 +0000 (16:01 -0800)]
Merge branch 'upstream/core' of git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen
* 'upstream/core' of git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen:
xen: do not release any memory under 1M in domain 0
xen: events: do not unmask event channels on resume
xen: correct size of level2_kernel_pgt
Linus Torvalds [Fri, 12 Nov 2010 23:54:39 +0000 (15:54 -0800)]
Merge branch 'stable/xen-pcifront-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen
* 'stable/xen-pcifront-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
MAINTAINERS: Mark XEN lists as moderated
xen-pcifront: fix PCI reference leak
xen-pcifront: Remove duplicate inclusion of headers.
xen: fix memory leak in Xen PCI MSI/MSI-X allocator.
MAINTAINERS: Update mailing list name for Xen pieces.
Tejun Heo [Mon, 1 Nov 2010 10:39:19 +0000 (11:39 +0100)]
libata: fix NULL sdev dereference race in atapi_qc_complete()
SCSI commands may be issued between __scsi_add_device() and dev->sdev
assignment, so it's unsafe for ata_qc_complete() to dereference
dev->sdev->locked without checking whether it's NULL or not. Fix it.
Signed-off-by: Tejun Heo <tj@kernel.org> Cc: stable@kernel.org Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Reported-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> CC: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
gianfar: Do not call device_set_wakeup_enable() under a spinlock
The gianfar driver calls device_set_wakeup_enable() under a spinlock,
which causes a problem to happen after the recent core power
management changes, because this function can sleep now. Fix this
by moving the device_set_wakeup_enable() call out of the
spinlock-protected area.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
Lorenzo Colitti [Wed, 27 Oct 2010 18:16:49 +0000 (18:16 +0000)]
ipv6: addrconf: don't remove address state on ifdown if the address is being kept
Currently, addrconf_ifdown does not delete statically configured IPv6
addresses when the interface is brought down. The intent is that when
the interface comes back up the address will be usable again. However,
this doesn't actually work, because the system stops listening on the
corresponding solicited-node multicast address, so the address cannot
respond to neighbor solicitations and thus receive traffic. Also, the
code notifies the rest of the system that the address is being deleted
(e.g, RTM_DELADDR), even though it is not. Fix it so that none of this
state is updated if the address is being kept on the interface.
Tested: Added a statically configured IPv6 address to an interface,
started ping, brought link down, brought link up again. When link came
up ping kept on going and "ip -6 maddr" showed that the host was still
subscribed to there
Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Fri, 12 Nov 2010 21:35:00 +0000 (13:35 -0800)]
tcp: Don't change unlocked socket state in tcp_v4_err().
Alexey Kuznetsov noticed a regression introduced by
commit f1ecd5d9e7366609d640ff4040304ea197fbc618
("Revert Backoff [v3]: Revert RTO on ICMP destination unreachable")
The RTO and timer modification code added to tcp_v4_err()
doesn't check sock_owned_by_user(), which if true means we
don't have exclusive access to the socket and therefore cannot
modify it's critical state.
Just skip this new code block if sock_owned_by_user() is true
and eliminate the now superfluous sock_owned_by_user() code
block contained within.
Reported-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Signed-off-by: David S. Miller <davem@davemloft.net> CC: Damian Lukowski <damian@tvk.rwth-aachen.de> Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Dan Rosenberg [Fri, 12 Nov 2010 20:44:42 +0000 (12:44 -0800)]
x25: Prevent crashing when parsing bad X.25 facilities
Now with improved comma support.
On parsing malformed X.25 facilities, decrementing the remaining length
may cause it to underflow. Since the length is an unsigned integer,
this will result in the loop continuing until the kernel crashes.
This patch adds checks to ensure decrementing the remaining length does
not cause it to wrap around.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Casey Leedom [Thu, 11 Nov 2010 09:06:50 +0000 (09:06 +0000)]
cxgb4vf: fix some errors in Gather List to skb conversion
There were some errors in the way that internal Gather Lists were being
translated into skb's. This also makes the VF Driver look more like the PF
Driver to facilitate easier comarison.
Signed-off-by: Casey Leedom <leedom@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Don't implement (struct net_device_ops *)->ndo_select_queue() with simple
call to skb_tx_hash(). This leads to non-persistent TX queue selection in
the Linux dev_pick_tx() routine for TCP connections.
Signed-off-by: Casey Leedom <leedom@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Hao Zheng [Thu, 11 Nov 2010 13:47:59 +0000 (13:47 +0000)]
ixgbe: Look inside vlan when determining offload protocol.
Currently the skb->protocol field is used to setup various
offloading parameters on transmit for the correct protocol.
However, if vlan offloading is disabled or otherwise not used,
the protocol field will be ETH_P_8021Q, not the actual protocol.
This will cause the offloading to be not performed correctly,
even though the hardware is capable of looking inside vlan tags.
Instead, look inside the header if necessary to determine the
correct protocol type.
To some extent this fixes a regression from 2.6.36 because it
was previously not possible to disable vlan offloading and this
error case was not exposed.
Signed-off-by: Hao Zheng <hzheng@nicira.com> CC: Jeff Kirsher <jeffrey.t.kirsher@intel.com> CC: Alex Duyck <alexander.h.duyck@intel.com> CC: Jesse Brandeburg <jesse.brandeburg@intel.com> Signed-off-by: Jesse Gross <jesse@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Hao Zheng [Thu, 11 Nov 2010 13:47:58 +0000 (13:47 +0000)]
bnx2x: Look inside vlan when determining checksum proto.
Currently the skb->protocol field is used to setup checksum
offloading on transmit for the correct protocol. However, if
vlan offloading is disabled or otherwise not used, the protocol
field will be ETH_P_8021Q, not the actual protocol. This will
cause the checksum to be not computed correctly, even though the
hardware is capable of looking inside vlan tags. Instead,
look inside the header if necessary to determine the correct
protocol type.
To some extent this fixes a regression from 2.6.36 because it
was previously not possible to disable vlan offloading and this
error case was not exposed.
Signed-off-by: Hao Zheng <hzheng@nicira.com> CC: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: Jesse Gross <jesse@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Hao Zheng [Thu, 11 Nov 2010 13:47:57 +0000 (13:47 +0000)]
vlan: Add function to retrieve EtherType from vlan packets.
Depending on how a packet is vlan tagged (i.e. hardware accelerated or
not), the encapsulated protocol is stored in different locations. This
provides a consistent method of accessing that protocol, which is needed
by drivers, security checks, etc.
Signed-off-by: Hao Zheng <hzheng@nicira.com> Signed-off-by: Jesse Gross <jesse@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Jason Wang [Wed, 10 Nov 2010 14:45:41 +0000 (14:45 +0000)]
virtio-net: init link state correctly
For device that supports VIRTIO_NET_F_STATUS, there's no need to
assume the link is up and we need to call nerif_carrier_off() before
querying device status, otherwise we may get wrong operstate after
diver was loaded because the link watch event was not fired as
expected.
For device that does not support VIRITO_NET_F_STATUS, we could not get
its status through virtnet_update_status() and what we can only do is
always assuming the link is up.
Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>
The reason appears to be ucc_geth_stop meets adjust_link as the
PHY reports PHY changes. I belive adjust_link hangs somewhere,
holding the PHY lock, because ucc_geth_stop disabled the
controller HW.
Fix is to stop the PHY before disabling the controller.
Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se> Reviewed-by: Anton Vorontsov <cbouatmailru@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Joakim Tjernlund [Fri, 12 Nov 2010 03:55:08 +0000 (03:55 +0000)]
ucc_geth: Do not bring the whole IF down when TX failure.
ucc_geth_close lacks a cancel_work_sync(&ugeth->timeout_work)
to stop any outstanding processing of TX fail. However, one
can not call cancel_work_sync without fixing the timeout function
otherwise it will deadlock. This patch brings ucc_geth in line with
gianfar:
Don't bring the interface down and up, just reinit controller HW
and PHY.
Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se> Reviewed-by: Anton Vorontsov <cbouatmailru@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Thomas Graf [Thu, 11 Nov 2010 15:47:59 +0000 (15:47 +0000)]
rtnetlink: Fix message size calculation for link messages
nlmsg_total_size() calculates the length of a netlink message
including header and alignment. nla_total_size() calculates the
space an individual attribute consumes which was meant to be used
in this context.
Also, ensure to account for the attribute header for the
IFLA_INFO_XSTATS attribute as implementations of get_xstats_size()
seem to assume that we do so.
The addition of two message headers minus the missing attribute
header resulted in a calculated message size that was larger than
required. Therefore we never risked running out of skb tailroom.
Signed-off-by: Thomas Graf <tgraf@infradead.org> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Fri, 12 Nov 2010 18:30:49 +0000 (10:30 -0800)]
Merge master.kernel.org:/home/rmk/linux-2.6-arm
* master.kernel.org:/home/rmk/linux-2.6-arm:
ARM: GIC: don't disable software generated interrupts
ARM: 6472/1: vexpress ct-ca9x4: only set twd_base if local timers are being used
ARM: arch/arm/kernel/traps.c: Convert sprintf_symbol to %pS
ARM: arch/arm/kernel/hw_breakpoint.c: Convert WARN_ON to WARN
ARM: 6462/1: EP93xx: Document DMA M2P API
ARM: 6470/1: atomic64: use generic implementation for OABI configurations
ARM: 6469/1: perf-events: squash compiler warning
ARM: 6468/1: backtrace: fix calculation of thread stack base
ARM: Fix DMA coherent allocator alignment
ARM: orion5x/kirkwood/mv78xx0: fix MPP configuration corner cases
[ARM] TS-78xxx NAND resource type should be IORESOURCE_MEM
ARM: pxa/saar: fix the building failure caused by typo
ARM: pxa/cm-x2xx: remove duplicate call to pxa27x_init_irq
ARM: pxa: fix the missing definition of IRQ_BOARD_END
ARM: mmp: fix cpuid detection on mmp2
[ARM] Kirkwood: restrict the scope of the PCIe reset workaround
[ARM] Kirkwood: fix timer initialization for LaCie boards
[ARM] Kirkwood: enhance TCLK detection
Linus Torvalds [Fri, 12 Nov 2010 17:52:31 +0000 (09:52 -0800)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: do not pass injected events back to the originating handler
Input: pcf8574_keypad - fix error handling in pcf8574_kp_probe
Input: acecad - fix a memory leak in usb_acecad_probe error path
Input: atkbd - add 'terminal' parameter for IBM Terminal keyboards
Input: i8042 - add Sony VAIOs to MUX blacklist
kgdboc: reset input devices (keyboards) when exiting debugger
Input: export input_reset_device() for use in KGDB
Input: adp5588-keys - unify common header defines