Reading TCP stats when using TCP Illinois congestion control algorithm
can cause a divide by zero kernel oops.
The division by zero occur in tcp_illinois_info() at:
do_div(t, ca->cnt_rtt);
where ca->cnt_rtt can become zero (when rtt_reset is called)
Steps to Reproduce:
1. Register tcp_illinois:
# sysctl -w net.ipv4.tcp_congestion_control=illinois
2. Monitor internal TCP information via command "ss -i"
# watch -d ss -i
3. Establish new TCP conn to machine
Either it fails at the initial conn, or else it needs to wait
for a loss or a reset.
This is only related to reading stats. The function avg_delay() also
performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its
calling point in update_params(). Thus, simply fix tcp_illinois_info().
Function tcp_illinois_info() / get_info() is called without
socket lock. Thus, eliminate any race condition on ca->cnt_rtt
by using a local stack variable. Simply reuse info.tcpv_rttcnt,
as its already set to ca->cnt_rtt.
Function avg_delay() is not affected by this race condition, as
its called with the socket lock.
Cc: Petr Matousek <pmatouse@redhat.com> Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> Acked-by: Eric Dumazet <edumazet@google.com> Acked-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Masanari Iida [Wed, 31 Oct 2012 05:48:19 +0000 (05:48 +0000)]
net: sctp: Fix typo in net/sctp
Correct spelling typo in net/sctp/socket.c
Signed-off-by: Masanari Iida <standby24x7@gmail.com> Acked-by: Vlad Yasevich <vyasevich@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Fix off-by-one error because IFNAMSIZ == 16 and when this
code gets executed we stick a NULL byte where we should not.
How to reproduce:
with CONFIG_CC_STACKPROTECTOR=y (otherwise it may pass by silently)
modprobe bonding; echo 1 > /sys/class/net/bond0/bonding/mode;
echo "AAAAAAAAAAAAAAAA" > /sys/class/net/bond0/bonding/active_slave;
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Note: Sorry for the second patch but I missed this one while checking
the file. You can squash them into one patch. Signed-off-by: David S. Miller <davem@davemloft.net>
Fix off-by-one error because IFNAMSIZ == 16 and when this
code gets executed we stick a NULL byte where we should not.
How to reproduce:
with CONFIG_CC_STACKPROTECTOR=y (otherwise it may pass by silently)
modprobe bonding; echo 1 > /sys/class/net/bond0/bonding/mode;
echo "AAAAAAAAAAAAAAAA" > /sys/class/net/bond0/bonding/primary;
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Yaniv Rosner [Wed, 31 Oct 2012 05:46:57 +0000 (05:46 +0000)]
bnx2x: Fix no link on 577xx 10G-baseT
Since the Warpcore supports various link types, need to set only the correct
supported modes for XFI which is the serdes interface for the 10G-baseT PHY.
Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Barak Witkowski <barak@broadcom.com> Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Yaniv Rosner [Wed, 31 Oct 2012 05:46:56 +0000 (05:46 +0000)]
bnx2x: Fix unrecognized SFP+ module after driver is loaded
When SFP+ module is plugged in after driver is already loaded, it may not be
recognized, so set SFP module recognition time up to 300ms, without resetting
the module power in the middle.
Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Barak Witkowski <barak@broadcom.com> Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Yaniv Rosner [Wed, 31 Oct 2012 05:46:55 +0000 (05:46 +0000)]
bnx2x: Fix potential incorrect link speed provision
Fix possible incorrect link speed provision following rapid link speed change.
Clear link speed mask after each link change, and not only after link down.
Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Barak Witkowski <barak@broadcom.com> Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Yaniv Rosner [Wed, 31 Oct 2012 05:46:54 +0000 (05:46 +0000)]
bnx2x: Restore global registers back to default.
Several KR registers were not set correctly back to default after
loopback test, so set those global registers over the global WC lane (zero)
rather than the current lane.
Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Barak Witkowski <barak@broadcom.com> Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Jacob Keller [Wed, 31 Oct 2012 22:30:54 +0000 (22:30 +0000)]
ixgbe: PTP get_ts_info missing software support
This patch corrects the ethtool get_ts_info functon which did not state that
software timestamping was supported, even though it is.
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> CC: Stable <stable@vger.kernel.org> [3.5] Tested-by: Stephen Ko <stephen.s.ko@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Pull scsi target fixes from Nicholas Bellinger:
"These are the current target pending fixes headed for v3.7-rc4 code.
This includes the following highlights:
- Fix long-standing qla2xxx target bug where certain fc_port_t state
transitions could cause the internal session b-tree list to become
out-of-sync. (Roland)
- Fix task management double free of se_cmd descriptor in exception
path for users of target_submit_tmr(). (nab)
- Re-introduce simple NOP emulation of REZERO_UNIT, SEEK_6, and
SEEK_10 SCSI-2 commands in order to support legacy initiators that
still require them. (Bernhard)
Note these three patches are also CC'ed to stable.
Also, there a couple of outstanding (external) regressions that are
still being tracked down for tcm_fc(FCoE) and tcm_vhost fabrics for
v3.7.0 code, so please expect another PULL as these issues identified
-> resolved."
* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
target: reintroduce some obsolete SCSI-2 commands
target: Fix double-free of se_cmd in target_complete_tmr_failure
qla2xxx: Update target lookup session tables when a target session changes
tcm_qla2xxx: Format VPD page 83h SCSI name string according to SPC
qla2xxx: Add missing ->vport_slock while calling qlt_update_vp_map
Linus Torvalds [Wed, 31 Oct 2012 22:40:21 +0000 (15:40 -0700)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull nouveau fixes from Dave Airlie:
"Just a nouveau set, since we have a couple of reports on lkml and
dri-devel of regressions that this should fix I sent it along on its
own."
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/nouveau: headless mode by default if pci class != vga display
drm/nouveau: resurrect headless mode since rework
drm/nv50/fb: prevent oops on chipsets without compression tags
drm/nouveau: allow creation of zero-sized mm
drm/nouveau/i2c: fix typo when checking nvio i2c port validity
drm/nouveau: silence modesetting spam on pre-gf8 chipsets
Linus Torvalds [Wed, 31 Oct 2012 22:39:28 +0000 (15:39 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
Pull HID updates from Jiri Kosina:
"This contains fixes for two devices by Jiri Slaby and Xianhan Yu, new
device IDs for MacBook Pro 10,2 from Dirk Hohndel and generic
multitouch code fix from Alan Cox."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: Add support for the MacBook Pro 10,2 keyboard / touchpad
HID: multitouch: fix maxcontacts problem on GeneralTouch
HID: multitouch: put the case in the right switch statement
HID: microsoft: fix invalid rdesc for 3k kbd
Linus Torvalds [Wed, 31 Oct 2012 22:38:32 +0000 (15:38 -0700)]
Merge tag 'sound-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"This contains unexpectedly many changes in a wide range due to the
fixes for races at disconnection of USB audio devices. In the end, we
end up covering fairly core parts of sound subsystem.
Other than that, just a few usual small fixes."
* tag 'sound-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: ice1724: Fix rate setup after resume
ALSA: Avoid endless sleep after disconnect
ALSA: Add a reference counter to card instance
ALSA: usb-audio: Fix races at disconnection in mixer_quirks.c
ALSA: usb-audio: Use rwsem for disconnect protection
ALSA: usb-audio: Fix races at disconnection
ALSA: PCM: Fix some races at disconnection
ASoC: omap-dmic: Correct functional clock name
ASoC: zoom2: Fix compile error by including correct header files
ALSA: hda - Fix mute-LED setup for HP dv5 laptop
Xiao Guangrong [Wed, 24 Oct 2012 06:07:59 +0000 (14:07 +0800)]
KVM: x86: fix vcpu->mmio_fragments overflow
After commit b3356bf0dbb349 (KVM: emulator: optimize "rep ins" handling),
the pieces of io data can be collected and write them to the guest memory
or MMIO together
Unfortunately, kvm splits the mmio access into 8 bytes and store them to
vcpu->mmio_fragments. If the guest uses "rep ins" to move large data, it
will cause vcpu->mmio_fragments overflow
Actually, we can use one mmio_fragment to store a large mmio access then
split it when we pass the mmio-exit-info to userspace. After that, we only
need two entries to store mmio info for the cross-mmio pages access
David S. Miller [Wed, 31 Oct 2012 18:59:01 +0000 (14:59 -0400)]
Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
John W. Linville says:
====================
This is a batch of fixes intended for 3.7...
The biggest portion of this is a pull request from Johannes Berg:
"Please pull my mac80211.git tree per below to get a number of fixes. I
have included a patch from Antonio to fix a memcpy overrun, Felix's
patches for the antenna gain/tx power issues, a few mesh-related fixes
from Javier for mac80211 and my own patches to not access data that
might not be present in an skb at all as well as a patch (the duplicate
IE check one) to make mac80211 forward-compatible with potential future
spec extensions that use the same IE multiple times.
It's a bit bigger than I'd like maybe, but I think all of these are
worthwhile fixes at this point."
In addition...
Felix Fietkau fixes an ath9k use-after-free issue.
Stanislaw Gruszka adds a valid value check to rt2800.
Sven Eckelmann adds a check to only check a TID value in a BlockAck, for
frames that could be either a BlockAck or a normal Ack.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Wed, 31 Oct 2012 18:54:15 +0000 (14:54 -0400)]
Merge branch 'master' of git://1984.lsi.us.es/nf
Pablo Neira Ayuso says:
====================
The following patchset contains fixes for your net tree, two of them
are due to relatively recent changes, one has been a longstanding bug,
they are:
* Fix incorrect usage of rt_gateway in the H.323 helper, from
Julian Anastasov.
* Skip re-route in nf_nat code for ICMP traffic. If CONFIG_XFRM is
enabled, we waste cycles to look up for the route again. This problem
seems to be there since really long time. From Ulrich Weber.
* Fix mismatching section in nf_conntrack_reasm, from Hein Tibosch.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Dirk Hohndel [Tue, 30 Oct 2012 18:11:48 +0000 (11:11 -0700)]
HID: Add support for the MacBook Pro 10,2 keyboard / touchpad
This enables the existing drivers for keyboard and touchpad with the new
USB IDs found on the MBP 13" Reasonable Resolution (also known as the
Retina Display).
Added entries to both keyboard and mouse ignore lists.
Xianhan Yu [Mon, 29 Oct 2012 15:04:37 +0000 (23:04 +0800)]
HID: multitouch: fix maxcontacts problem on GeneralTouch
Fix maxcontacts problem for PWT GeneralTouch multi-touchscreen.
Our device didn't contain HID_DG_CONTACTMAX usage. This usage use to describe
touchscreen's maxcontacts for hid-multitouch.c to get maxcontacts automatic. We
fix the device that driver can get maxcontact from our device, hence it doesn't
need .maxcontact=10. Now there is just one device class can fix all our PWT
touchscreen.
Jiri Slaby [Fri, 19 Oct 2012 11:28:46 +0000 (13:28 +0200)]
HID: microsoft: fix invalid rdesc for 3k kbd
Microsoft Digital Media Keyboard 3000 has two interfaces, and the
second one has a report descriptor with a bug. The second collection
says:
05 01 -- global; usage page -- 01 -- Generic Desktop Controls
09 80 -- local; usage -- 80 -- System Control
a1 01 -- main; collection -- 01 -- application
I.e. it makes us think that there are all kinds of usages of system
control. That the keyboard is a not only a keyboard, but also a
joystick, mouse, gamepad, keypad, etc. The same as for the Wireless
Desktop Receiver, this should be Physical Min/Max. So fix that
appropriately.
Takashi Iwai [Wed, 31 Oct 2012 06:41:42 +0000 (07:41 +0100)]
ALSA: ice1724: Fix rate setup after resume
The rate isn't restored properly after resume since it's only set up
in hw_params, and not in prepare callback. For fixing it, put the
corresponding call to resume callback as well.
Reported-and-tested-by: Ondrej Zary <linux@rainbow-software.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Input: tsc40 - remove wrong announcement of pressure support
The tsc40 driver announces it supports the pressure event, but will never
send one. The announcement will cause tslib to wait for such events and
sending all touch events with a pressure of 0. Removing the announcement
will make tslib fall back to emulating the pressure on touch events so
everything works as expected.
Al Viro [Wed, 31 Oct 2012 03:37:48 +0000 (03:37 +0000)]
Return the right error value when dup[23]() newfd argument is too large
Jack Lin reports that the error return from dup3() for the RLIMIT_NOFILE
case changed incorrectly after 3.6.
The culprit is commit f33ff9927f42 ("take rlimit check to callers of
expand_files()") which when it moved the "return -EMFILE" out to the
caller, didn't notice that the dup3() had special code to turn the
EMFILE return into EBADF.
The replace_fd() helper that got added later then inherited the bug too.
Reported-by: Jack Lin <linliangjie@huawei.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[ Noted more bugs, wrote proper changelog, fixed up typos - Linus ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Dave Airlie [Wed, 31 Oct 2012 03:46:04 +0000 (13:46 +1000)]
Merge branch 'drm-nouveau-fixes' of git://people.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes
This covers all known nouveau regressions at the moment, along with a fix
to not steal the console on headless GPUs.
* 'drm-nouveau-fixes' of git://people.freedesktop.org/git/nouveau/linux-2.6:
drm/nouveau: headless mode by default if pci class != vga display
drm/nouveau: resurrect headless mode since rework
drm/nv50/fb: prevent oops on chipsets without compression tags
drm/nouveau: allow creation of zero-sized mm
drm/nouveau/i2c: fix typo when checking nvio i2c port validity
drm/nouveau: silence modesetting spam on pre-gf8 chipsets
Rusty Russell [Thu, 25 Oct 2012 00:19:25 +0000 (10:49 +1030)]
module: fix out-by-one error in kallsyms
Masaki found and patched a kallsyms issue: the last symbol in a
module's symtab wasn't transferred. This is because we manually copy
the zero'th entry (which is always empty) then copy the rest in a loop
starting at 1, though from src[0]. His fix was minimal, I prefer to
rewrite the loops in more standard form.
There are two loops: one to get the size, and one to copy. Make these
identical: always count entry 0 and any defined symbol in an allocated
non-init section.
Linus Torvalds [Wed, 31 Oct 2012 02:48:48 +0000 (19:48 -0700)]
Merge tag 'md-3.7-fixes' of git://neil.brown.name/md
Pull md fixes from NeilBrown:
"Some fixes for md in 3.7
- one recently introduced crash for dm-raid10 with discard
- one bug in new functionality that has been around for a few
releases.
- minor bug in md's 'faulty' personality
and UAPI disintegration for md."
* tag 'md-3.7-fixes' of git://neil.brown.name/md:
MD RAID10: Fix oops when creating RAID10 arrays via dm-raid.c
md/raid1: Fix assembling of arrays containing Replacements.
md faulty: use disk_stack_limits()
UAPI: (Scripted) Disintegrate include/linux/raid
Ben Skeggs [Wed, 31 Oct 2012 01:19:40 +0000 (11:19 +1000)]
drm/nouveau: allow creation of zero-sized mm
Useful for places where a given chipset may or may not have a given
resource, and we want to avoid having to spray checks for the mm's
existance around everywhere.
Jonathan Brassow [Wed, 31 Oct 2012 00:42:30 +0000 (11:42 +1100)]
MD RAID10: Fix oops when creating RAID10 arrays via dm-raid.c
Commit 2863b9eb didn't take into account the changes to add TRIM support to
RAID10 (commit 532a2a3fb). That is, when using dm-raid.c to create the
RAID10 arrays, there is no mddev->gendisk or mddev->queue. The code added
to support TRIM simply assumes that mddev->queue is available without
checking. The result is an oops any time dm-raid.c attempts to create a
RAID10 device.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com> Signed-off-by: NeilBrown <neilb@suse.de>
NeilBrown [Wed, 31 Oct 2012 00:42:03 +0000 (11:42 +1100)]
md/raid1: Fix assembling of arrays containing Replacements.
setup_conf in raid1.c uses conf->raid_disks before assigning
a value. It is used when including 'Replacement' devices.
The consequence is that assembling an array which contains a
replacement will misbehave and either not include the replacement, or
not include the device being replaced.
Though this doesn't lead directly to data corruption, it could lead to
reduced data safety.
So use mddev->raid_disks, which is initialised, instead.
Linus Torvalds [Tue, 30 Oct 2012 22:56:22 +0000 (15:56 -0700)]
Merge tag 'gpio-fixes-v3.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio
Pull GPIO fixes from Linus Walleij:
- Fix a potential bit wrap issue in the Timberdale driver
- Fix up the buffer allocation size in the 74x164 driver
- Set the value in direction_output() right in the mvebu driver
- Return proper error codes for invalid GPIOs
- Fix an off-mode bug for the OMAP
- Don't initialize the mask_cach on the mvebu driver
* tag 'gpio-fixes-v3.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
GPIO: mvebu-gpio: Don't initialize the mask_cache
gpio/omap: fix off-mode bug: clear debounce settings on free/reset
gpiolib: Don't return -EPROBE_DEFER to sysfs, or for invalid gpios
gpio: mvebu: correctly set the value in direction_output()
gpio-74x164: Fix buffer allocation size
gpio-timberdale: fix a potential wrapping issue
Linus Torvalds [Tue, 30 Oct 2012 22:35:16 +0000 (15:35 -0700)]
Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
Pull ext4 bugfix from Ted Ts'o:
"This fixes the root cause of the ext4 data corruption bug which raised
a ruckus on LWN, Phoronix, and Slashdot.
This bug only showed up when non-standard mount options
(journal_async_commit and/or journal_checksum) were enabled, and when
the file system was not cleanly unmounted, but the root cause was the
inode bitmap modifications was not being properly journaled.
This could potentially lead to minor file system corruptions (pass 5
complaints with the inode allocation bitmap) after an unclean shutdown
under the wrong/unlucky workloads, but it turned into major failure if
the journal_checksum and/or jouaral_async_commit was enabled."
* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
ext4: fix unjournaled inode bitmap modification
Linus Torvalds [Tue, 30 Oct 2012 22:34:09 +0000 (15:34 -0700)]
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
Pull block driver update from Jens Axboe:
"Distilled down variant, the rest will pass over to 3.8. I pulled it
into the for-linus branch I had waiting for a pull request as well, in
case you are wondering why there are new entries in here too. This
also got rid of two reverts and the ones of the mtip32xx patches that
went in later in the 3.6 cycle, so the series looks a bit cleaner."
* 'for-linus' of git://git.kernel.dk/linux-block:
loop: Make explicit loop device destruction lazy
mtip32xx:Added appropriate timeout value for secure erase
xen/blkback: Change xen_vbd's flush_support and discard_secure to have type unsigned int, rather than bool
cciss: select CONFIG_CHECK_SIGNATURE
cciss: remove unneeded memset()
xen/blkback: use kmem_cache_zalloc instead of kmem_cache_alloc/memset
pktcdvd: update MAINTAINERS
floppy: remove dr, reuse drive on do_floppy_init
floppy: use common function to check if floppies can be registered
floppy: properly handle failure on add_disk loop
floppy: do put_disk on current dr if blk_init_queue fails
floppy: don't call alloc_ordered_workqueue inside the alloc_disk loop
xen/blkback: Fix compile warning
block: Add blk_rq_pos(rq) to sort rq when plushing
drivers/block: remove CONFIG_EXPERIMENTAL
block: remove CONFIG_EXPERIMENTAL
vfs: fix: don't increase bio_slab_max if krealloc() fails
blkcg: stop iteration early if root_rl is the only request list
blkcg: Fix use-after-free of q->root_blkg and q->root_rl.blkg
Andrew Lunn [Sat, 27 Oct 2012 13:28:58 +0000 (15:28 +0200)]
GPIO: mvebu-gpio: Don't initialize the mask_cache
Due to the SMP nature of some of the chips, which have per CPU
registers, the driver does not use the generic irq_gc_mask_set_bit() &
irq_gc_mask_clr_bit() functions, which only support a single register.
The driver has its own implementation of these functions, which can
pick the correct register depending on the CPU being used. The
functions do however use the gc->mask_cache value.
The call to irq_setup_generic_chip() was passing
IRQ_GC_INIT_MASK_CACHE, which caused the gc->mask_cache to be
initialized to the contents of some random register. This resulted in
unexpected interrupts been delivered from random GPIO lines.
Signed-off-by: Andrew Lunn <andrew@lunn.ch> Tested-by: Jamie Lentin <jm@lentin.co.uk> Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Tested-by: Michael Walle <michael@walle.cc> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Jan Beulich [Mon, 29 Oct 2012 16:45:54 +0000 (16:45 +0000)]
USB: fix build with XEN and EARLY_PRINTK_DBGP enabled but USB_SUPPORT disabled
Since there's no possible caller of dbgp_external_startup() and
dbgp_reset_prep() when !USB_EHCI_HCD, there's no point in building and
exporting these functions in that case. This eliminates a build error
under the conditions listed in the subject, introduced with the merge f1c6872e4980bc4078cfaead05f892b3d78dea64.
Reported-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: Jan Beulich <jbeulich@suse.com> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Sven Eckelmann [Mon, 29 Oct 2012 12:25:20 +0000 (13:25 +0100)]
ath9k: Test for TID only in BlockAcks while checking tx status
The ath9k xmit functions for AMPDUs can send frames as non-aggregate in case
only one frame is currently available. The client will then answer using a
normal Ack instead of a BlockAck. This acknowledgement has no TID stored and
therefore the hardware is not able to provide us the corresponding TID.
The TID set by the hardware in the tx status descriptor has to be seen as
undefined and not as a valid TID value for normal acknowledgements. Doing
otherwise results in a massive amount of retransmissions and stalls of
connections.
Users may experience low bandwidth and complete connection stalls in
environments with transfers using multiple TIDs.
Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de> Cc: stable@vger.kernel.org Acked-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
rt2800: validate step value for temperature compensation
Some hardware has correct (!= 0xff) value of tssi_bounds[4] in the
EEPROM, but step is equal to 0xff. This results on ridiculous delta
calculations and completely broke TX power settings.
Reported-and-tested-by: Pavel Lucik <pavel.lucik@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Acked-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Merge tag 'fixes-for-v3.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
usb: fixes for v3.7-rc4
We're reverting MUSB Mode 1 DMA patch which caused many regressions. Meanwhile
Roger is cooking a better version of that patch, which will hopefully be ready
for v3.8 merge window.
We also fix an undeclared error in ux5000_remove() and another build error
when we try to build USB_MUSB_OMAP2PLUS as a module.
LD init/built-in.o
drivers/built-in.o: In function `twl4030_usb_irq':
drivers/usb/otg/twl4030-usb.c:518: undefined reference to `omap_musb_mailbox'
drivers/built-in.o: In function `twl4030_usb_phy_init':
drivers/usb/otg/twl4030-usb.c:540: undefined reference to `omap_musb_mailbox'
drivers/built-in.o: In function `twl6030_usb_irq':
drivers/usb/otg/twl6030-usb.c:230: undefined reference to `omap_musb_mailbox'
drivers/usb/otg/twl6030-usb.c:225: undefined reference to `omap_musb_mailbox'
drivers/built-in.o: In function `twl6030_usbotg_irq':
drivers/usb/otg/twl6030-usb.c:259: undefined reference to `omap_musb_mailbox'
CC: Peter Meerwald <pmeerw@pmeerw.net> Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
Takashi Iwai [Tue, 16 Oct 2012 14:43:39 +0000 (16:43 +0200)]
ALSA: Avoid endless sleep after disconnect
When disconnect callback is called, each component should wake up
sleepers and check card->shutdown flag for avoiding the endless sleep
blocking the proper resource release.
Takashi Iwai [Tue, 16 Oct 2012 11:05:59 +0000 (13:05 +0200)]
ALSA: Add a reference counter to card instance
For more strict protection for wild disconnections, a refcount is
introduced to the card instance, and let it up/down when an object is
referred via snd_lookup_*() in the open ops.
The free-after-last-close check is also changed to check this refcount
instead of the empty list, too.
Takashi Iwai [Fri, 12 Oct 2012 13:12:55 +0000 (15:12 +0200)]
ALSA: usb-audio: Fix races at disconnection
Close some races at disconnection of a USB audio device by adding the
chip->shutdown_mutex and chip->shutdown check at appropriate places.
The spots to put bandaids are:
- PCM prepare, hw_params and hw_free
- where the usb device is accessed for communication or get speed, in
mixer.c and others; the device speed is now cached in subs->speed
instead of accessing to chip->dev
The accesses in PCM open and close don't need the mutex protection
because these are already handled in the core PCM disconnection code.
The autosuspend/autoresume codes are still uncovered by this patch
because of possible mutex deadlocks. They'll be covered by the
upcoming change to rwsem.
Also the mixer codes are untouched, too. These will be fixed in
another patch, too.
Takashi Iwai [Fri, 12 Oct 2012 13:07:34 +0000 (15:07 +0200)]
ALSA: PCM: Fix some races at disconnection
Fix races at PCM disconnection:
- while a PCM device is being opened or closed
- while the PCM state is being changed without lock in prepare,
hw_params, hw_free ops
Dave Chinner [Fri, 28 Sep 2012 08:42:23 +0000 (10:42 +0200)]
loop: Make explicit loop device destruction lazy
xfstests has always had random failures of tests due to loop devices
failing to be torn down and hence leaving filesytems that cannot be
unmounted. This causes test runs to immediately stop.
Over the past 6 or 7 years we've added hacks like explicit unmount
-d commands for loop mounts, losetup -d after unmount -d fails, etc,
but still the problems persist. Recently, the frequency of loop
related failures increased again to the point that xfstests 259 will
reliably fail with a stray loop device that was not torn down.
That is despite the fact the test is above as simple as it gets -
loop 5 or 6 times running mkfs.xfs with different paramters:
And losteup -d $lofile is failing with EBUSY on 1-3 of these loops
every time the test is run.
Turns out that blkid is running simultaneously with losetup -d, and
so it sees an elevated reference count and returns EBUSY. But why
is blkid running? It's obvious, isn't it? udev has decided to try
and find out what is on the block device as a result of a creation
notification. And it is racing with mkfs, so might still be scanning
the device when mkfs finishes and we try to tear it down.
So, make losetup -d force autoremove behaviour. That is, when the
last reference goes away, tear down the device. xfstests wants it
*gone*, not causing random teardown failures when we know that all
the operations the tests have specifically run on the device have
completed and are no longer referencing the loop device.
Signed-off-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Oliver Chick [Fri, 21 Sep 2012 09:04:18 +0000 (10:04 +0100)]
xen/blkback: Change xen_vbd's flush_support and discard_secure to have type unsigned int, rather than bool
Changing the type of bdev parameters to be unsigned int :1, rather than bool.
This is more consistent with the types of other features in the block drivers.
Signed-off-by: Oliver Chick <oliver.chick@citrix.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
The memory return by kzalloc() or kmem_cache_zalloc() has already be set
to zero, so remove useless memset(0).
spatch with a semantic match is used to found this problem.
(http://coccinelle.lip6.fr/)
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn> Cc: Mike Miller <mike.miller@hp.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
This is a small cleanup, that also may turn error handling of
unitialized disks more readable. We don't need a separate variable to
track allocated disks, remove dr and reuse drive variable instead.
floppy: use common function to check if floppies can be registered
The same checks to see if a drive can be or is registered are
repeated through the code, factor out the checks in a common function
and replace the repeated checks with it.
floppy: don't call alloc_ordered_workqueue inside the alloc_disk loop
Since commit 070ad7e ("floppy: convert to delayed work and single-thread
wq"), we end up calling alloc_ordered_workqueue multiple times inside
the loop, which shouldn't be intended. Besides the leak, other side
effect in the current code is if blk_init_queue fails, we would end up
calling unregister_blkdev even if we didn't call yet register_blkdev.
Just moved the allocation of floppy_wq before the loop, and adjusted the
code accordingly.
drivers/block/xen-blkback/xenbus.c:260:5: warning: symbol 'xenvbd_sysfs_addif' was not declared. Should it be static?
drivers/block/xen-blkback/xenbus.c:284:6: warning: symbol 'xenvbd_sysfs_delif' was not declared. Should it be static?
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Roland Stigge [Tue, 30 Oct 2012 05:30:56 +0000 (22:30 -0700)]
Input: lpc32xx-keys - select INPUT_MATRIXKMAP
This adds a "select" dependency of KEYBOARD_LPC32XX on INPUT_MATRIXKMAP,
as the other drivers are doing in this regard. This fixes the following
compile error if KEYBOARD_LPC32XX is enabled but INPUT_MATRIXKMAP is not:
drivers/input/keyboard/lpc32xx-keys.c:230: undefined reference to
`matrix_keypad_build_keymap'
Signed-off-by: Roland Stigge <stigge@antcom.de> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Felix Fietkau [Thu, 25 Oct 2012 22:31:11 +0000 (00:31 +0200)]
ath9k: fix stale pointers potentially causing access to free'd skbs
bf->bf_next is only while buffers are chained as part of an A-MPDU
in the tx queue. When a tid queue is flushed (e.g. on tearing down
an aggregation session), frames can be enqueued again as normal
transmission, without bf_next being cleared. This can lead to the
old pointer being dereferenced again later.
This patch might fix crashes and "Failed to stop TX DMA!" messages.
Signed-off-by: Felix Fietkau <nbd@openwrt.org> Cc: stable@vger.kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com>
Linus Torvalds [Mon, 29 Oct 2012 15:49:25 +0000 (08:49 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client
Pull Ceph fixes form Sage Weil:
"There are two fixes in the messenger code, one that can trigger a NULL
dereference, and one that error in refcounting (extra put). There is
also a trivial fix that in the fs client code that is triggered by NFS
reexport."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
ceph: fix dentry reference leak in encode_fh()
libceph: avoid NULL kref_put when osd reset races with alloc_msg
rbd: reset BACKOFF if unable to re-queue
Eric Sandeen [Mon, 29 Oct 2012 02:24:57 +0000 (22:24 -0400)]
ext4: fix unjournaled inode bitmap modification
commit 119c0d4460b001e44b41dcf73dc6ee794b98bd31 changed
ext4_new_inode() such that the inode bitmap was being modified
outside a transaction, which could lead to corruption, and was
discovered when journal_checksum found a bad checksum in the
journal during log replay.
Nix ran into this when using the journal_async_commit mount
option, which enables journal checksumming. The ensuing
journal replay failures due to the bad checksums led to
filesystem corruption reported as the now infamous
"Apparent serious progressive ext4 data corruption bug"
[ Changed by tytso to only call ext4_journal_get_write_access() only
when we're fairly certain that we're going to allocate the inode. ]
I've tested this by mounting with journal_checksum and
running fsstress then dropping power; I've also tested by
hacking DM to create snapshots w/o first quiescing, which
allows me to test journal replay repeatedly w/o actually
power-cycling the box. Without the patch I hit a journal
checksum error every time. With this fix it survives
many iterations.
Hein Tibosch [Fri, 26 Oct 2012 23:49:26 +0000 (23:49 +0000)]
netfilter: nf_defrag_ipv6: solve section mismatch in nf_conntrack_reasm
WARNING: net/ipv6/netfilter/nf_defrag_ipv6.o(.text+0xe0): Section mismatch in
reference from the function nf_ct_net_init() to the function
.init.text:nf_ct_frag6_sysctl_register()
The function nf_ct_net_init() references the function
__init nf_ct_frag6_sysctl_register().
In case nf_conntrack_ipv6 is compiled as a module, nf_ct_net_init could be
called after the init code and data are unloaded. Therefore remove the
"__net_init" annotation from nf_ct_frag6_sysctl_register().
Signed-off-by: Hein Tibosch <hein_tibosch@yahoo.es> Acked-by: Cong Wang <amwang@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Ulrich Weber [Thu, 25 Oct 2012 05:34:45 +0000 (05:34 +0000)]
netfilter: nf_nat: don't check for port change on ICMP tuples
ICMP tuples have id in src and type/code in dst.
So comparing src.u.all with dst.u.all will always fail here
and ip_xfrm_me_harder() is called for every ICMP packet,
even if there was no NAT.
Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Jean Delvare [Sun, 28 Oct 2012 20:37:01 +0000 (21:37 +0100)]
i2c-i801: Simplify dependency towards GPIOLIB
Arbitrarily selecting GPIOLIB causes trouble on some architectures,
so don't do that. Instead, just make the optional multiplexing code
depend on CONFIG_I2C_MUX_GPIO instead of CONFIG_I2C_MUX for now. We
can revisit if the i2c-i801 driver ever supports other multiplexing
flavors.
Also make that optional code depend on DMI, as it won't do anything
without that.
Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: Fengguang Wu <fengguang.wu@intel.com>
David S. Miller [Sun, 28 Oct 2012 20:26:37 +0000 (13:26 -0700)]
qlogicpti: Fix build warning.
The build warns:
drivers/scsi/qlogicpti.c: In function 'qpti_sbus_probe':
drivers/scsi/qlogicpti.c:1316:45: warning: passing argument 1 of 'scsi_host_alloc' discards 'const' qualifier from pointer target type [enabled by default]
include/scsi/scsi_host.h:778:26: note: expected 'struct scsi_host_template *' but argument is of type 'const struct scsi_host_template *'
The problem is that of_device_id->data is a const void pointer.
This is pretty silly in this specific instance, because for all
matched device IDs we set match->data to the same value,
&qpti_template.
So just use that directly instead of the unnecessary and improperly
typed abstraction.
Signed-off-by: David S. Miller <davem@davemloft.net>
projects / karo-tx-linux.git / log