[media] m88rs2000 ver 1.13 Correct deseqc and tuner gain functions
Remove incorrect SEC_MINI_B settings-TODO complete this section.
Correct break and remove return -EINVAL within set tone. It appears
there is a bug that occasionally something other than ON/OFF is
sent stalling the driver. Just continue and write back registers.
Set register b2 in setup. This is the set voltage pin which
isn't used in lmedm04 driver but it is always set to 0x1.
Antti Palosaari [Wed, 14 Mar 2012 13:27:31 +0000 (10:27 -0300)]
[media] af9015: fix i2c failures for dual-tuner devices - part 2
Some changes for previous patch I liked to do.
Just move tuner init and sleep to own functions from the demod
init and sleep functions. Functionality remains still almost the same.
Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Gordon Hecker [Wed, 14 Mar 2012 13:27:30 +0000 (10:27 -0300)]
[media] af9015: fix i2c failures for dual-tuner devices
The i2c failures were caused by enabling both i2c gates
at the same time while putting the tuners asleep.
This patch removes the init() and sleep() callbacks from the tuner,
to prevent frontend.c from calling
i2c_gate_ctrl
tuner init / sleep
i2c_gate_ctrl
without holding the lock.
tuner init() and sleep() are instead called in frontend init() and
sleep().
Signed-off-by: Gordon Hecker <ghecker@gmx.de> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Jean Delvare [Tue, 13 Mar 2012 16:50:37 +0000 (13:50 -0300)]
[media] dib0700: Drop useless check when remote key is pressed
struct dvb_usb_device *d can never be NULL so don't waste time
checking for this.
Rationale: the urb's context is set when usb_fill_bulk_urb() is called
in dib0700_rc_setup(), and never changes after that. d is dereferenced
unconditionally in dib0700_rc_setup() so it can't be NULL or the
driver would crash right away.
Michael Krufky [Mon, 12 Mar 2012 20:07:22 +0000 (17:07 -0300)]
[media] au8522: bug-fix: enable modulation AFTER tune (instead of before tuning)
The au8522 driver programs the tuner after programming the demodulator,
but the tuner should be programmed first. This patch fixes this behavior.
EDIT: Apparantly Devin created a similar patch some time ago, but hasn't
submitted it for merge. I never saw his patch, but I thank him anyhow
for his efforts. In addition, Devin pointed out a flaw in my patch:
This newly generated patch takes Devin's comments into account.
Laurent Pinchart [Mon, 12 Mar 2012 13:02:47 +0000 (10:02 -0300)]
[media] media: Initialize the media core with subsys_initcall()
Media-related drivers living outside drivers/media/ (such as the UVC
gadget driver in drivers/usb/gadget/) rely on the media core being
initialized before they're probed. As drivers/usb/ is linked before
drivers/media/, this is currently not the case and will lead to crashes
if the drivers are not compiled as modules.
Register media_devnode_init() as a subsys_initcall() instead of
module_init() to fix this.
Bhupesh Sharma [Mon, 12 Mar 2012 08:09:02 +0000 (05:09 -0300)]
[media] V4L/v4l2-dev: Make 'videodev_init' as a subsys initcall
As the V4L2 based UVC webcam gadget (g_webcam) expects the
'videodev' to present when the 'webcam_bind' routine is called,
so 'videodev' should be available as early as possible.
Now, when 'g_webcam' is built as a module (i.e. not a part of
kernel) the late availability of 'videodev' is OK, but if
'g_webcam' is built statically as a part of the kernel,
the kernel crashes (a sample crash dump using Designware 2.0 UDC
is provided below).
To solve the same, this patch makes 'videodev_init' as a subsys initcall.
[media] v4l: Add driver for Micron MT9M032 camera sensor
The MT9M032 is a parallel 1.6MP sensor from Micron controlled through I2C.
The driver creates a V4L2 subdevice. It currently supports cropping, gain,
exposure and v/h flipping controls in monochrome mode with an
external pixel clock.
Akihiro Tsukada [Sat, 10 Mar 2012 14:38:13 +0000 (11:38 -0300)]
[media] dvb: earth-pt1: stop polling data when no one accesses the device
The driver started a kthread to poll the DMA buffers soon after probing,
which relsuleted in 1000/sec sleeps and wakeups of the thread doing nothing
useful until someone started feeding.
This patch changes the creation and destruction of the kthread depending on the number of users.
Ezequiel García [Sat, 10 Mar 2012 14:34:27 +0000 (11:34 -0300)]
[media] media: em28xx: Remove unused urb arrays from device struct
These arrays were embedded in the struct itself, but they weren't
used by anyone, since urbs are now dinamically allocated
at em28xx_usb_isoc_ctl struct.
Tested by compilation only.
Dan Carpenter [Sat, 10 Mar 2012 07:58:18 +0000 (04:58 -0300)]
[media] gpio-ir-recv: a couple signedness bugs
There are couple places where we check unsigned values for negative. I
changed ->gpin_nr to signed because in gpio_ir_recv_probe() we do:
if (pdata->gpio_nr < 0)
return -EINVAL;
I also change gval to a signed int in gpio_ir_recv_irq() because that's
the type that gpio_get_value_cansleep() returns and we test for negative
returns.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Trilok Soni <tsoni@codeaurora.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
[media] s5p-csis: Fix compilation with PM_SLEEP disabled
Fix following compilation error when CONFIG_PM_SLEEP is disabled:
CC drivers/media/video/s5p-fimc/mipi-csis.o
drivers/media/video/s5p-fimc/mipi-csis.c: In function ‘s5pcsis_remove’:
drivers/media/video/s5p-fimc/mipi-csis.c:956: error: implicit declaration of function ‘s5pcsis_suspend’
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
drivers/media/video/w9966.c: In function ‘__check_pardev’:
drivers/media/video/w9966.c:136:1: warning: return from incompatible pointer type [enabled by default]
Fabio Estevam [Fri, 9 Mar 2012 11:15:38 +0000 (08:15 -0300)]
[media] video: Kconfig: Select VIDEOBUF2_DMA_CONTIG for VIDEO_MX2
Fix the following build error:
LD .tmp_vmlinux1
drivers/built-in.o: In function `mx2_camera_init_videobuf':
clkdev.c:(.text+0xcfaf4): undefined reference to `vb2_dma_contig_memops'
drivers/built-in.o: In function `mx2_camera_probe':
clkdev.c:(.devinit.text+0x5734): undefined reference to `vb2_dma_contig_init_ctx'
clkdev.c:(.devinit.text+0x5778): undefined reference to `vb2_dma_contig_cleanup_ctx'
drivers/built-in.o: In function `mx2_camera_remove':
clkdev.c:(.devexit.text+0x89c): undefined reference to `vb2_dma_contig_cleanup_ctx'
commit c6a41e3271 ([media] media i.MX27 camera: migrate driver to videobuf2)
missed to select VIDEOBUF2_DMA_CONTIG in Kconfig.
[media] V4L: Improve the selection API documentation
Make the VIDIOC_G/S_SELECTION ioctls documentation more consistent
with the rest of media Docbook, use capital letters where necessary
and correct few minor errors.
This field is handled internally by the DVB core, with uses the
selected delivery system to fill it, when a DVBv3 call is
handled. So, drivers should not touch on it.
[media] m88rs2000 1.12 v2 DVB-S frontend and tuner module
Support for m88rs2000 chip used in lmedm04 driver.
Note there are still lock problems.
Slow channel change due to the large block of registers sent in set_frontend.
Version 2 differences.
Front end is completely shut down when in sleep mode. This allow user to regain
control of device.
Kaffeine scan problem solved by removing register calls from get_frontend.
Kaffeine seems to call get_frontend when updating signal data. This can happen
in the middle of a tune stalling the driver.
Change calculations to those in the DS3000 driver.
[media] dib9000: implement error handling for DibAcquireLock
DibAcquireLock() is implemented as mutex_lock_interruptible()
but the driver does not handle unsuccessful locking.
As a result it may lead to unlock of an unheld mutex.
Found by Linux Driver Verification project (linuxtesting.org).
[media] as102: set optimal eLNA config values for each device
Ryley and me tested several eLNA configuration values with both a rooftop
and a portable antenna.
Ryley fuond out that the best value for his Elgato stick is indeed the current
default value 0xC0.
Instead, my stick is not capable of tuning VHF channels with 0xC0. With 0x80,
VHF works but the tuner sensitivity with the portable antenna is poor.
Instead, the value 0xA0 works with VHF and also gives good performance with
both the rooftop and the portable antenna.
So we concluded that devices built on the reference design work best with 0xA0,
while custom designs (Elgato, PCTV) seem to require 0xC0.
I also removed the unused parameter "minor" in struct as102_dev_t.
[media] as102: add __packed attribute to structs defined inside packed structs
This patch fixes a regression in kernel 3.3 due to this patch:
http://patchwork.linuxtv.org/patch/8332/
That patch changes "#pragma pack(1)" with "__packed" attributes, but it is not
complete. In fact, in the as102 driver there are a lot of structs/unions
defined inside other structs/unions.
When the "__packed" attribute is applied only on the external struct, it will
not affect the internal struct definitions.
So the regression is fixed by specifiying the "__packed" attribute also on the
internal structs.
This patch should go into 3.3, as it fixes a regression introduced in the new
kernel version.
Jesper Juhl [Sun, 4 Mar 2012 19:25:04 +0000 (16:25 -0300)]
[media] media, cx231xx: Fix double free on close
In cx231xx_v4l2_close() there are two calls to
cx231xx_release_resources(dev) followed by kfree(dev). That is a
problem since cx231xx_release_resources() already kfree()'s its
argument, so we end up doing a double free.
Easily resolved by just removing the redundant kfree() calls after the
calls to cx231xx_release_resources().
I also changed the 'dev = NULL' assignments (which are rather
pointless since 'dev' is about to go out of scope), to 'fh->dev = NULL'
since it looks to me that that is what was actually intended.
And I removed the 'dev = NULL' assignment at the end of
cx231xx_release_resources() since it is pointless.
Javier Martin [Mon, 2 Jan 2012 14:12:23 +0000 (11:12 -0300)]
[media] uvcvideo: Allow userptr IO mode
Userptr can be very useful if a UVC camera is requested to use video
buffers allocated by another processing device. So that buffers don't
need to be copied.
Signed-off-by: Javier Martin <javier.martin@vista-silicon.com> Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Laurent Pinchart [Sun, 18 Dec 2011 23:41:19 +0000 (20:41 -0300)]
[media] v4l: Add custom compat_ioctl32 operation
Drivers implementing custom ioctls need to handle 32-bit/64-bit
compatibility themselves. Provide them with a way to do so.
To avoid circular module dependencies, merge the v4l2-compat-ioctl32
module into videodev. There is no point in keeping them separate, as the
v4l2_compat_ioctl32() function is required by videodev if CONFIG_COMPAT
is set anyway.
* tag 'v3.3': (1646 commits)
Linux 3.3
Don't limit non-nested epoll paths
netfilter: ctnetlink: fix race between delete and timeout expiration
ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu.
nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
nilfs2: clamp ns_r_segments_percentage to [1, 99]
afs: Remote abort can cause BUG in rxrpc code
afs: Read of file returns EBADMSG
C6X: remove dead code from entry.S
wimax/i2400m: fix erroneous NETDEV_TX_BUSY use
net/hyperv: fix erroneous NETDEV_TX_BUSY use
net/usbnet: reserve headroom on rx skbs
bnx2x: fix memory leak in bnx2x_init_firmware()
bnx2x: fix a crash on corrupt firmware file
sch_sfq: revert dont put new flow at the end of flows
ipv6: fix icmp6_dst_alloc()
MAINTAINERS: Add Serge as maintainer of capabilities
drivers/video/backlight/s6e63m0.c: fix corruption storing gamma mode
MAINTAINERS: add entry for exynos mipi display drivers
MAINTAINERS: fix link to Gustavo Padovans tree
...
WARNING: drivers/media/radio/built-in.o(.data+0x284): Section mismatch in reference from the variable fmr2_driver to the function .init.text:fmr2_probe()
The variable fmr2_driver references
the function __init fmr2_probe()
If the reference is valid then annotate the
variable with __init* or __refdata (see linux/init.h) or name the variable:
*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console
WARNING: drivers/media/built-in.o(.data+0x48200): Section mismatch in reference from the variable fmr2_driver to the function .init.text:fmr2_probe()
The variable fmr2_driver references
the function __init fmr2_probe()
If the reference is valid then annotate the
variable with __init* or __refdata (see linux/init.h) or name the variable:
*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console
Cc: Hans Verkuil <hans.verkuil@cisco.com> Cc: Ondrej Zary <linux@rainbow-software.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Hans Verkuil [Mon, 27 Feb 2012 08:31:58 +0000 (05:31 -0300)]
[media] tea575x: fix HW seek
Fix HW seek in TEA575x to work properly:
- a delay must be present after search start and before first register read
or the seek does weird things
- when the search stops, the new frequency is not available immediately, we
must wait until it appears in the register (fortunately, we can clear the
frequency bits when starting the search as it starts at the frequency
currently set, not from the value written)
- sometimes, seek remains on the current frequency (or moves only a little),
so repeat it until it moves by at least 50 kHz
Signed-off-by: Ondrej Zary <linux@rainbow-software.org> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Hans Verkuil [Mon, 27 Feb 2012 08:30:13 +0000 (05:30 -0300)]
[media] tea575x-tuner: update to latest V4L2 framework requirements
The tea575x-tuner module has been updated to use the latest V4L2 framework
functionality. This also required changes in the drivers that rely on it.
The tea575x changes are:
- The drivers must provide a v4l2_device struct to the tea module.
- The radio_nr module parameter must be part of the actual radio driver,
and not of the tea module.
- Changed the frequency range to the normal 76-108 MHz range instead of
50-150.
- Add hardware frequency seek support.
- Fix broken rxsubchans/audmode handling.
- The application can now select between stereo and mono.
- Support polling for control events.
- Add V4L2 priority handling.
And radio-sf16fmr2.c now uses the isa bus kernel framework.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Thanks-to: Ondrej Zary <linux@rainbow-software.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Andreas Regel [Tue, 28 Feb 2012 17:40:44 +0000 (14:40 -0300)]
[media] stb0899: fixed reading of IF_AGC_GAIN register
When reading IF_AGC_GAIN register a wrong value for the base address
register was used (STB0899_DEMOD instead of STB0899_S2DEMOD). That
lead to a wrong signal strength value on DVB-S2 transponders.
Signed-off-by: Andreas Regel <andreas.regel@gmx.de> Acked-by: Klaus Schmidinger <Klaus.Schmidinger@tvdr.de> Cc: Manu Abraham <abraham.manu@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Andreas Regel [Tue, 28 Feb 2012 17:40:40 +0000 (14:40 -0300)]
[media] stb0899: set FE_HAS_SIGNAL flag in read_status
In stb0899_read_status the FE_HAS_SIGNAL flag was not set in case of a
successful carrier lock. This change fixes that.
Signed-off-by: Andreas Regel <andreas.regel@gmx.de> Acked-by: Klaus Schmidinger <Klaus.Schmidinger@tvdr.de> Cc: Manu Abraham <abraham.manu@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Antti Palosaari [Mon, 12 Mar 2012 21:21:20 +0000 (18:21 -0300)]
[media] tda10071: fix the delivery system
Commit b2a29b578d9c21b2e5c88020f830d3c42115c51d sets accidentally
supported delivery systems as DVB-T/T2 whilst it should be
DVB-S/S2. Due to that frontend cannot be used at all.
Reported-by: Jiří Zelenka <klacek@bubakov.net> Signed-off-by: Antti Palosaari <crope@iki.fi> Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Jason Baron [Fri, 16 Mar 2012 20:34:03 +0000 (16:34 -0400)]
Don't limit non-nested epoll paths
Commit 28d82dc1c4ed ("epoll: limit paths") that I did to limit the
number of possible wakeup paths in epoll is causing a few applications
to longer work (dovecot for one).
The original patch is really about limiting the amount of epoll nesting
(since epoll fds can be attached to other fds). Thus, we probably can
allow an unlimited number of paths of depth 1. My current patch limits
it at 1000. And enforce the limits on paths that have a greater depth.
This is captured in: https://bugzilla.redhat.com/show_bug.cgi?id=681578
Signed-off-by: Jason Baron <jbaron@redhat.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Pull networking changes from David Miller:
"1) icmp6_dst_alloc() returns NULL instead of ERR_PTR() leading to
crashes, particularly during shutdown. Reported by Dave Jones and
fixed by Eric Dumazet.
2) hyperv and wimax/i2400m return NETDEV_TX_BUSY when they have
already freed the SKB, which causes crashes as to the caller this
means requeue the packet. Fixes from Eric Dumazet.
3) usbnet driver doesn't allocate the right amount of headroom on
fresh RX SKBs, fix from Eric Dumazet.
4) Fix regression in ip6_mc_find_dev_rcu(), as an RCU lookup it
abolutely should not take a reference to 'dev', this leads to
leaks. Fix from RonQing Li.
5) Fix netfilter ctnetlink race between delete and timeout expiration.
From Pablo Neira Ayuso.
6) Revert SFQ change which causes regressions, specifically queueing
to tail can lead to unavoidable flow starvation. From Eric
Dumazet.
7) Fix a memory leak and a crash on corrupt firmware files in bnx2x,
from Michal Schmidt."
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
netfilter: ctnetlink: fix race between delete and timeout expiration
ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu.
wimax/i2400m: fix erroneous NETDEV_TX_BUSY use
net/hyperv: fix erroneous NETDEV_TX_BUSY use
net/usbnet: reserve headroom on rx skbs
bnx2x: fix memory leak in bnx2x_init_firmware()
bnx2x: fix a crash on corrupt firmware file
sch_sfq: revert dont put new flow at the end of flows
ipv6: fix icmp6_dst_alloc()
Linus Torvalds [Sat, 17 Mar 2012 16:54:16 +0000 (09:54 -0700)]
Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf fixes from Ingo Molnar.
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf tools, x86: Build perf on older user-space as well
perf tools: Use scnprintf where applicable
perf tools: Incorrect use of snprintf results in SEGV
netfilter: ctnetlink: fix race between delete and timeout expiration
Kerin Millar reported hardlockups while running `conntrackd -c'
in a busy firewall. That system (with several processors) was
acting as backup in a primary-backup setup.
After several tries, I found a race condition between the deletion
operation of ctnetlink and timeout expiration. This patch fixes
this problem.
Tested-by: Kerin Millar <kerframil@gmail.com> Reported-by: Kerin Millar <kerframil@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>
RongQing.Li [Thu, 15 Mar 2012 22:54:14 +0000 (22:54 +0000)]
ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu.
ip6_mc_find_dev_rcu() is called with rcu_read_lock(), so don't
need to dev_hold().
With dev_hold(), not corresponding dev_put(), will lead to leak.
[ bug introduced in 96b52e61be1 (ipv6: mcast: RCU conversions) ]
Signed-off-by: RongQing.Li <roy.qing.li@gmail.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Sat, 17 Mar 2012 00:14:55 +0000 (17:14 -0700)]
Merge branch 'akpm' (more patches from Andrew)
Merge some more email patches from Andrew Morton:
"A couple of nilfs fixes"
* emailed from Andrew Morton <akpm@linux-foundation.org>:
nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
nilfs2: clamp ns_r_segments_percentage to [1, 99]
Ryusuke Konishi [Sat, 17 Mar 2012 00:08:39 +0000 (17:08 -0700)]
nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
According to the report from Slicky Devil, nilfs caused kernel oops at
nilfs_load_super_block function during mount after he shrank the
partition without resizing the filesystem:
Haogang Chen [Sat, 17 Mar 2012 00:08:38 +0000 (17:08 -0700)]
nilfs2: clamp ns_r_segments_percentage to [1, 99]
ns_r_segments_percentage is read from the disk. Bogus or malicious
value could cause integer overflow and malfunction due to meaningless
disk usage calculation. This patch reports error when mounting such
bogus volumes.
Linus Torvalds [Sat, 17 Mar 2012 00:04:02 +0000 (17:04 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull maintainer update from James Morris:
"Please pull this patch which adds Serge as maintainer of the
capabilities code, as discussed on lwn and the lsm list.
New capabilities must be signed off by the maintainer, and new uses of
any capabilities should at be cc'd to the maintainer."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
MAINTAINERS: Add Serge as maintainer of capabilities
Linus Torvalds [Sat, 17 Mar 2012 00:03:15 +0000 (17:03 -0700)]
Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming
Pull c6x bugfix from Mark Salter:
"Remove dead code from entry.S which causes a build failure when using
a newer assembler (v2.22 complains about it, v2.20 ignores it)."
* tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
C6X: remove dead code from entry.S
Mark Salter [Fri, 16 Mar 2012 13:27:57 +0000 (09:27 -0400)]
C6X: remove dead code from entry.S
The ENDPROC() on sys_fadvise64_c6x() in arch/c6x/kernel/entry.S is
outside of the conditional block with the matching ENTRY() macro. This
leads a newer (v2.22 vs. v2.20) assembler to complain:
/tmp/ccGZBaPT.s: Assembler messages:
/tmp/ccGZBaPT.s: Error: .size expression for sys_fadvise64_c6x does not evaluate to a constant
The conditional block became dead code when c6x switched to generic
unistd.h and should be removed along with the offending ENDPROC().
Signed-off-by: Mark Salter <msalter@redhat.com> Acked-by: David Howells <dhowells@redhat.com>
Eric Dumazet [Wed, 14 Mar 2012 09:21:44 +0000 (09:21 +0000)]
wimax/i2400m: fix erroneous NETDEV_TX_BUSY use
A driver start_xmit() method cannot free skb and return NETDEV_TX_BUSY,
since caller is going to reuse freed skb.
In fact netif_tx_stop_queue() / netif_stop_queue() is needed before
returning NETDEV_TX_BUSY or you can trigger a ksoftirqd fatal loop.
In case of memory allocation error, only safe way is to drop the packet
and return NETDEV_TX_OK
Also increments tx_dropped counter
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Wed, 14 Mar 2012 06:56:25 +0000 (06:56 +0000)]
net/usbnet: reserve headroom on rx skbs
network drivers should reserve some headroom on incoming skbs so that we
dont need expensive reallocations, eg forwarding packets in tunnels.
This NET_SKB_PAD padding is done in various helpers, like
__netdev_alloc_skb_ip_align() in this patch, combining NET_SKB_PAD and
NET_IP_ALIGN magic.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Oliver Neukum <oneukum@suse.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: David S. Miller <davem@davemloft.net>
Michal Schmidt [Thu, 15 Mar 2012 14:08:29 +0000 (14:08 +0000)]
bnx2x: fix memory leak in bnx2x_init_firmware()
When cycling the interface down and up, bnx2x_init_firmware() knows that
the firmware is already loaded, but nevertheless it allocates certain
arrays anew (init_data, init_ops, init_ops_offsets, iro_arr). The old
arrays are leaked.
Fix the leaks by returning early if the firmware was already loaded.
Because if the firmware is loaded, so are the arrays.
Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Acked-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Michal Schmidt [Thu, 15 Mar 2012 14:08:28 +0000 (14:08 +0000)]
bnx2x: fix a crash on corrupt firmware file
If the requested firmware is deemed corrupt and then released, reset the
pointer to NULL in order to avoid double-freeing it in
bnx2x_release_firmware() or dereferencing it in bnx2x_init_firmware().
Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Acked-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Tue, 13 Mar 2012 18:04:25 +0000 (18:04 +0000)]
sch_sfq: revert dont put new flow at the end of flows
This reverts commit d47a0ac7b6 (sch_sfq: dont put new flow at the end of
flows)
As Jesper found out, patch sounded great but has bad side effects.
In stress situation, pushing new flows in front of the queue can prevent
old flows doing any progress. Packets can stay in SFQ queue for
unlimited amount of time.
It's possible to add heuristics to limit this problem, but this would
add complexity outside of SFQ scope.
A more sensible answer to Dave Taht concerns (who reported the issued I
tried to solve in original commit) is probably to use a qdisc hierarchy
so that high prio packets dont enter a potentially crowded SFQ qdisc.
Reported-by: Jesper Dangaard Brouer <jdb@comx.dk> Cc: Dave Taht <dave.taht@gmail.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Fri, 16 Mar 2012 00:16:22 +0000 (17:16 -0700)]
Merge branch 'akpm' (Andrew's patch-bomb)
Merge patches from Andrew Morton:
"Nine patches - some bug fixes and some MAINTAINERS fiddling."
* emailed from Andrew Morton <akpm@linux-foundation.org>:
drivers/video/backlight/s6e63m0.c: fix corruption storing gamma mode
MAINTAINERS: add entry for exynos mipi display drivers
MAINTAINERS: fix link to Gustavo Padovans tree
MAINTAINERS: add Johan to Bluetooth maintainers
MAINTAINERS: Gustavo has moved
prctl: use CAP_SYS_RESOURCE for PR_SET_MM option
rapidio/tsi721: fix bug in register offset definitions
MAINTAINERS: update ST's Mailing list for SPEAr
memcg: free mem_cgroup by RCU to fix oops
Linus Torvalds [Fri, 16 Mar 2012 00:14:35 +0000 (17:14 -0700)]
Merge branch 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging
Pull i2c subsystem fixes from Jean Delvare.
* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
i2c-algo-bit: Fix spurious SCL timeouts under heavy load
i2c-core: Comment says "transmitted" but means "received"
Linus Torvalds [Fri, 16 Mar 2012 00:13:39 +0000 (17:13 -0700)]
Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck.
* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
hwmon: (zl6100) Enable interval between chip accesses for all chips
hwmon: (w83627ehf) Describe undocumented pwm attributes
hwmon: (w83627ehf) Fix temp2 source for W83627UHG
hwmon: (w83627ehf) Fix memory leak in probe function
hwmon: (w83627ehf) Fix writing into fan_stop_time for NCT6775F/NCT6776F
Linus Torvalds [Fri, 16 Mar 2012 00:07:25 +0000 (17:07 -0700)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm exynos/intel updates from Dave Airlie:
"Two minor updates from Jesse for Intel SNB fixes, and a few fixes from
Samsung for exynos. The pull req has Alan's commit in it since Intel
based their tree on my tree at that time, but it all seems fine wrt
merging."
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm exynos: use drm_fb_helper_set_par directly
drm/exynos: Fix fb_videomode <-> drm_mode_modeinfo conversion
drm/exynos: fix runtime_pm fimd device state on probe
drm/exynos: use correct 'exynos-drm' name for platform device
drm/i915: support 32 bit BGR formats in sprite planes
drm/i915: fix color order for BGR formats on SNB
drm/gma500: Fix Cedarview boot failures in 3.3-rc
Linus Torvalds [Fri, 16 Mar 2012 00:06:05 +0000 (17:06 -0700)]
Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media fixes from Mauro Carvalho Chehab:
"For 4 fixes for 3.3 (all trivial):
- uvc video driver: fixes a division by zero;
- davinci: add module.h to fix compilation;
- smsusb: fix the delivery system setting;
- smsdvb: the get_frontend implementation there is broken.
The smsdvb patch has 127 lines, but it is trivial: instead of
returning a cache of the set_frontend (with is wrong, as it doesn't
have the updated values for the data, and the implementation there is
buggy), it copies the information of the detected DVB parameters from
the smsdvb private structures into the corresponding DVBv5 struct
fields."
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
[media] smsdvb: fix get_frontend
[media] smsusb: fix the default delivery system setting
[media] media: davinci: added module.h to resolve unresolved macros
[media] [FOR,v3.3] uvcvideo: Avoid division by 0 in timestamp calculation
Linus Torvalds [Fri, 16 Mar 2012 00:04:56 +0000 (17:04 -0700)]
Merge branch '3.3-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
Pull target fixes from Nicholas Bellinger:
"This series addresses two recently reported regression bugs related to
legacy SCSI reservation usage in target core, and iscsi-target
reservation conflict handling.
The second patch in particular addresses possible data-corruption with
SCSI reservations that is specific to iscsi-target fabric LUNs with
multiple client writers. Both patches need to go into v3.2 stable
ASAP, and the branch based on the last target-pending/3.3-rc-fixes
HEAD.
Again, thanks to Martin Svec for his help to identify and address this
regression bug with iscsi-target."
strict_strtoul() writes a long but ->gamma_mode only has space to store an
int, so on 64 bit systems we end up scribbling over ->gamma_table_count as
well. I've changed it to use kstrtouint() instead.
Donghwa Lee [Thu, 15 Mar 2012 22:17:11 +0000 (15:17 -0700)]
MAINTAINERS: add entry for exynos mipi display drivers
I'd like to add Inki Dae, Donghwa Lee and Kyungmin Park as maintainers
who developers for exynos mipi display drivers for
video/driver/exynos/exynos_mipi* and include/video/exynos_mipi*.
Signed-off-by: Donghwa Lee <dh09.lee@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de> Cc: Richard Purdie <rpurdie@rpsys.net> Cc: Kukjin Kim <kgene.kim@samsung.com> Cc: Jingoo Han <jg1.han@samsung.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Johan Hedberg [Thu, 15 Mar 2012 22:17:11 +0000 (15:17 -0700)]
MAINTAINERS: add Johan to Bluetooth maintainers
I've been coordinating Bluetooth patches in my tree for some time and
it's possible I'll do it in the future too, so add myself to the
Bluetooth sections as well as mention my tree there.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: "Gustavo F. Padovan" <padovan@profusion.mobi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cyrill Gorcunov [Thu, 15 Mar 2012 22:17:10 +0000 (15:17 -0700)]
prctl: use CAP_SYS_RESOURCE for PR_SET_MM option
CAP_SYS_ADMIN is already overloaded left and right, so to have more
fine-grained access control use CAP_SYS_RESOURCE here.
The CAP_SYS_RESOUCE is chosen because this prctl option allows a current
process to adjust some fields of memory map descriptor which rather
represents what the process owns: pointers to code, data, stack
segments, command line, auxiliary vector data and etc.
Suggested-by: Michael Kerrisk <mtk.manpages@gmail.com> Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Michael Kerrisk <mtk.manpages@gmail.com> Cc: Pavel Emelyanov <xemul@parallels.com> Cc: Tejun Heo <tj@kernel.org> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Paul Bolle <pebolle@tiscali.nl> Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
rapidio/tsi721: fix bug in register offset definitions
Fix indexed register offset definitions that use decimal (wrong) instead
of hexadecimal (correct) notation for indexing multipliers.
Incorrect definitions do not affect Tsi721 driver in its current default
configuration because it uses only IDB queue 0. Loss of inbound
doorbell functionality should be observed if queue other than 0 is used.
Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com> Cc: Matt Porter <mporter@kernel.crashing.org> Cc: Chul Kim <chul.kim@idt.com> Cc: <stable@vger.kernel.org> [3.2+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Viresh Kumar [Thu, 15 Mar 2012 22:17:09 +0000 (15:17 -0700)]
MAINTAINERS: update ST's Mailing list for SPEAr
We have created a ST's Mailing list for SPEAr. This can be accessed
from non-st email ids. I want people to cc this list, when they have
changes specific to SPEAr. So, its better to get this updated in
MAINTAINERS file.
linux-arm-kernel@lists.infradead.org is also added for SPEAr.
Signed-off-by: Viresh Kumar <viresh.kumar@st.com> Cc: Russell King <rmk@arm.linux.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Hugh Dickins [Thu, 15 Mar 2012 22:17:07 +0000 (15:17 -0700)]
memcg: free mem_cgroup by RCU to fix oops
After fixing the GPF in mem_cgroup_lru_del_list(), three times one
machine running a similar load (moving and removing memcgs while
swapping) has oopsed in mem_cgroup_zone_nr_lru_pages(), when retrieving
memcg zone numbers for get_scan_count() for shrink_mem_cgroup_zone():
this is where a struct mem_cgroup is first accessed after being chosen
by mem_cgroup_iter().
Just what protects a struct mem_cgroup from being freed, in between
mem_cgroup_iter()'s css_get_next() and its css_tryget()? css_tryget()
fails once css->refcnt is zero with CSS_REMOVED set in flags, yes: but
what if that memory is freed and reused for something else, which sets
"refcnt" non-zero? Hmm, and scope for an indefinite freeze if refcnt is
left at zero but flags are cleared.
It's tempting to move the css_tryget() into css_get_next(), to make it
really "get" the css, but I don't think that actually solves anything:
the same difficulty in moving from css_id found to stable css remains.
But we already have rcu_read_lock() around the two, so it's easily fixed
if __mem_cgroup_free() just uses kfree_rcu() to free mem_cgroup.
However, a big struct mem_cgroup is allocated with vzalloc() instead of
kzalloc(), and we're not allowed to vfree() at interrupt time: there
doesn't appear to be a general vfree_rcu() to help with this, so roll
our own using schedule_work(). The compiler decently removes
vfree_work() and vfree_rcu() when the config doesn't need them.
Signed-off-by: Hugh Dickins <hughd@google.com> Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Konstantin Khlebnikov <khlebnikov@openvz.org> Cc: Tejun Heo <tj@kernel.org> Cc: Ying Han <yinghan@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Ville Syrjala [Thu, 15 Mar 2012 17:11:05 +0000 (18:11 +0100)]
i2c-algo-bit: Fix spurious SCL timeouts under heavy load
When the system is under heavy load, there can be a significant delay
between the getscl() and time_after() calls inside sclhi(). That delay
may cause the time_after() check to trigger after SCL has gone high,
causing sclhi() to return -ETIMEDOUT.
To fix the problem, double check that SCL is still low after the
timeout has been reached, before deciding to return -ETIMEDOUT.
Signed-off-by: Ville Syrjala <syrjala@sci.fi> Cc: stable@vger.kernel.org Signed-off-by: Jean Delvare <khali@linux-fr.org>
projects / linux-beck.git / log