summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2013-04-17s390/monreader: Remove redundant NULL check before kfreeSyam Sidhardhan1-2/+1
kfree on NULL pointer is a no-op. Signed-off-by: Syam Sidhardhan <s.syam@samsung.com> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2013-04-14Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds2-3/+9
Pull drm fixes from Dave Airlie: "One fix for a hotplug locking regressions, and one fix for an oops if you unplug the monitor at an inopportune moment on the udl device." * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/fb-helper: Fix locking in drm_fb_helper_hotplug_event udl: handle EDID failure properly.
2013-04-14watchdog: Revert the AT91RM9200_WATCHDOG dependencyNicolas Ferre1-1/+1
Compiling the at91rm9200_wdt.c driver without at91rm9200 support was leading to several errors: drivers/built-in.o: In function `at91_wdt_close': at91_adc.c:(.text+0xc9fe4): undefined reference to `at91_st_base' drivers/built-in.o: In function `at91_wdt_write': at91_adc.c:(.text+0xca004): undefined reference to `at91_st_base' drivers/built-in.o: In function `at91wdt_shutdown': at91_adc.c:(.text+0xca01c): undefined reference to `at91_st_base' drivers/built-in.o: In function `at91wdt_suspend': at91_adc.c:(.text+0xca038): undefined reference to `at91_st_base' drivers/built-in.o: In function `at91_wdt_open': at91_adc.c:(.text+0xca0cc): undefined reference to `at91_st_base' drivers/built-in.o:at91_adc.c:(.text+0xca2c8): more undefined references to `at91_st_base' follow So, reverting the modification of the "depends" Kconfig line introduced by patch a6a1bcd37 (watchdog: at91rm9200: add DT support) seems to be the good solution. Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com> Acked-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
2013-04-12Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pendingLinus Torvalds2-68/+133
Pull SCSI target fixes from Nicholas Bellinger: "Here are remaining target-pending items for v3.9-rc7 code. The tcm_vhost patches are more than I'd usually include in a -rc7 pull, but are changes required for v3.9 to work correctly with the pending vhost-scsi-pci QEMU upstream series merge. (Paolo CC'ed) Plus Asias's conversion to use vhost_virtqueue->private_data + RCU for managing vhost-scsi endpoints has gotten alot of review + testing over the past weeks, and MST has ACKed the full series. Also, there is a target patch to fix a long-standing bug within control CDB handling with Standby/Offline/Transition ALUA port access states, that had been incorrectly rejecting the control CDBs required for LUN scan to work during these port group states. CC'ing to stable." * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: target: Fix incorrect fallthrough of ALUA Standby/Offline/Transition CDBs tcm_vhost: Send bad target to guest when cmd fails tcm_vhost: Add vhost_scsi_send_bad_target() helper tcm_vhost: Fix tv_cmd leak in vhost_scsi_handle_vq tcm_vhost: Remove double check of response tcm_vhost: Initialize vq->last_used_idx when set endpoint tcm_vhost: Use vq->private_data to indicate if the endpoint is setup tcm_vhost: Use ACCESS_ONCE for vs->vs_tpg[target] access
2013-04-12Merge tag 'scsi-fixes' of ↵Linus Torvalds12-79/+37
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is a set of ten bug fixes (and two consisting of copyright year update and version number change) pretty much all of which involve either a crash or a hang except the removal of the random sleep from the qla2xxx driver (which is a coding error so bad, we want it gone before anyone has a chance to copy it)." * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: [SCSI] lpfc: fix potential NULL pointer dereference in lpfc_sli4_rq_put() [SCSI] libsas: fix handling vacant phy in sas_set_ex_phy() [SCSI] ibmvscsi: Fix slave_configure deadlock [SCSI] qla2xxx: Update the driver version to 8.04.00.13-k. [SCSI] qla2xxx: Remove debug code that msleeps for random duration. [SCSI] qla2xxx: Update copyright dates information in LICENSE.qla2xxx file. [SCSI] qla2xxx: Fix crash during firmware dump procedure. [SCSI] Revert "qla2xxx: Add setting of driver version string for vendor application." [SCSI] ipr: dlpar failed when adding an adapter back [SCSI] ipr: fix addition of abort command to HRRQ free queue [SCSI] st: Take additional queue ref in st_probe [SCSI] libsas: use right function to alloc smp response [SCSI] ipr: ipr_test_msi() fails when running with msi-x enabled adapter
2013-04-12drm/fb-helper: Fix locking in drm_fb_helper_hotplug_eventDaniel Vetter1-3/+5
Driver's and ->fill_modes functions are allowed to grab crtc mutexes (for e.g. load detect). Hence we need to first only grab the general kms mutex, and only in a second step grab all locks to do the modesets. This prevents a deadlock on my gm45 in the tv load detect code called by drm_helper_probe_single_connector_modes. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-04-12udl: handle EDID failure properly.Dave Airlie1-0/+4
Don't oops seems proper. Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-04-11Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dmaLinus Torvalds2-17/+41
Pull slave-dmaengine fixes from Vinod Koul: "The first one fixes issue in pl330 to check for DT compatible and the second one fixes omap-dma to start without delay" * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: omap-dma: Start DMA without delay for cyclic channels DMA: PL330: Add check if device tree compatible
2013-04-11Merge tag 'pm-3.9-rc7' of ↵Linus Torvalds1-1/+0
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: - System reboot/halt fix related to CPU offline ordering from Huacai Chen. - intel_pstate driver fix for a delay time computation error occasionally crashing systems using it from Dirk Brandewie. * tag 'pm-3.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM / reboot: call syscore_shutdown() after disable_nonboot_cpus() cpufreq / intel_pstate: Set timer timeout correctly
2013-04-11Merge tag 'regmap-v3.9-rc6' of ↵Linus Torvalds1-1/+2
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap revert from Mark Brown: "regmap: Back out work buffer fix This reverts commit bc8ce4 (regmap: don't corrupt work buffer in _regmap_raw_write()) since it turns out that it can cause issues when taken in isolation from the other changes in -next that lead to its discovery. On the basis that nobody noticed the problems for quite some time without that subsequent work let's drop it from v3.9." * tag 'regmap-v3.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: Back out work buffer fix
2013-04-11Merge tag 'gpio-fixes-v3.9-rc6' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fix from Linus Walleij: "Oneliner fix for the PCA 953x driver." * tag 'gpio-fixes-v3.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: pca953x: fix irq_domain_add_simple usage
2013-04-11[SCSI] lpfc: fix potential NULL pointer dereference in lpfc_sli4_rq_put()Wei Yongjun1-1/+2
The dereference to 'put_index' should be moved below the NULL test. Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn> Acked-by: James Smart <james.smart@emulex.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-04-11gpio: pca953x: fix irq_domain_add_simple usageAlexandre Belloni1-1/+1
We actually have to pass chip as the host_data parameter of irq_domain_add_simple() as later on, it is used to initialize chip_data in pca953x_gpio_irq_map(). Failing to do so is leading to a NULL pointer dereference after calling irq_data_get_irq_chip_data() in pca953x_irq_mask(), pca953x_irq_unmask(), pca953x_irq_bus_lock(), pca953x_irq_bus_sync_unlock() and pca953x_irq_set_type(). Fixes regression introduced by commit 0e8f2fdacf1d44651aa7e57063c76142d1f4988b (gpio: pca953x: use simple irqdomain) Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2013-04-11target: Fix incorrect fallthrough of ALUA Standby/Offline/Transition CDBsNicholas Bellinger1-0/+3
This patch fixes a bug where a handful of informational / control CDBs that should be allowed during ALUA access state Standby/Offline/Transition where incorrectly returning CHECK_CONDITION + ASCQ_04H_ALUA_TG_PT_*. This includes INQUIRY + REPORT_LUNS, which would end up preventing LUN registration when LUN scanning occured during these ALUA access states. Cc: Hannes Reinecke <hare@suse.de> Cc: <stable@vger.kernel.org> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-04-11tcm_vhost: Send bad target to guest when cmd failsAsias He1-4/+6
Send bad target to guest in case: 1) we can not allocate the cmd 2) fail to submit the cmd Signed-off-by: Asias He <asias@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-04-11tcm_vhost: Add vhost_scsi_send_bad_target() helperAsias He1-13/+18
Share the send bad target code with other use cases. Signed-off-by: Asias He <asias@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-04-11tcm_vhost: Fix tv_cmd leak in vhost_scsi_handle_vqAsias He1-2/+7
If we fail to submit the allocated tv_vmd to tcm_vhost_submission_work, we will leak the tv_vmd. Free tv_vmd on fail path. Signed-off-by: Asias He <asias@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-04-11tcm_vhost: Remove double check of responseAsias He1-9/+0
We did the length of response check twice. Signed-off-by: Asias He <asias@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-04-10Merge tag 'char-misc-3.9-rc6' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fix from Greg Kroah-Hartman: "Here is a single Kconfig dependancy build fix for 3.9. It's been in linux-next for a while, and fixes a problem that has been reported multiple times." * tag 'char-misc-3.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: misc/vmw_vmci: Add dependency on CONFIG_NET
2013-04-10Merge tag 'tty-3.9-rc6' of ↵Linus Torvalds3-11/+20
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg Kroah-Hartman: "Here are 4 small tty/serial fixes for 3.9. One fixes a bug where we broke the documentation build, and the others fix reported problems in some serial drivers. All have been in linux-next for a while" * tag 'tty-3.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: mxser: fix cycle termination condition in mxser_probe() and mxser_module_init() Revert "tty/8250_pnp: serial port detection regression since v3.7" OMAP/serial: Revert bad fix of Rx FIFO threshold granularity tty: Documentation: fix a path in a DocBook template
2013-04-10Merge tag 'stable/for-linus-3.9-rc6-tag' of ↵Linus Torvalds1-4/+15
git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen Pull Xen fixes from Konrad Rzeszutek Wilk: "Two bug-fixes: - Early bootup issue found on DL380 machines - Fix for the timer interrupt not being processed right awaym leading to quite delayed time skew on certain workloads" * tag 'stable/for-linus-3.9-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: xen/mmu: On early bootup, flush the TLB when changing RO->RW bits Xen provided pagetables. xen/events: Handle VIRQ_TIMER before any other hardirq in event loop.
2013-04-10Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds26-334/+480
Pull networking fixes from David Miller: 1) cfg80211_conn_scan() must be called with the sched_scan_mutex, fix from Artem Savkov. 2) Fix regression in TCP ICMPv6 processing, we do not want to treat redirects as socket errors, from Christoph Paasch. 3) Fix several recvmsg() msg_name kernel memory leaks into userspace, in ATM, AX25, Bluetooth, CAIF, IRDA, s390 IUCV, L2TP, LLC, Netrom, NFC, Rose, TIPC, and VSOCK. From Mathias Krause and Wei Yongjun. 4) Fix AF_IUCV handling of segmented SKBs in recvmsg(), from Ursula Braun and Eric Dumazet. 5) CAN gw.c code does kfree() on SLAB cache memory, use kmem_cache_free() instead. Fix from Wei Yongjun. 6) Fix LSM regression on TCP SYN/ACKs, some LSMs such as SELINUX want an skb->sk socket context available for these packets, but nothing else requires it. From Eric Dumazet and Paul Moore. 7) Fix ipv4 address lifetime processing so that we don't perform sleepable acts inside of rcu_read_lock() sections, do them in an rtnl_lock() section instead. From Jiri Pirko. 8) mvneta driver accidently sets HW features after device registry, it should do so beforehand. Fix from Willy Tarreau. 9) Fix bonding unload races more correctly, from Nikolay Aleksandrov and Veaceslav Falico. 10) rtnl_dump_ifinfo() and rtnl_calcit() invoke nlmsg_parse() with wrong header size argument. Fix from Michael Riesch. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits) lsm: add the missing documentation for the security_skb_owned_by() hook bnx2x: Prevent null pointer dereference in AFEX mode e100: Add dma mapping error check selinux: add a skb_owned_by() hook can: gw: use kmem_cache_free() instead of kfree() netrom: fix invalid use of sizeof in nr_recvmsg() qeth: fix qeth_wait_for_threads() deadlock for OSN devices af_iucv: fix recvmsg by replacing skb_pull() function rtnetlink: Call nlmsg_parse() with correct header length bonding: fix bonding_masters race condition in bond unloading Revert "bonding: remove sysfs before removing devices" net: mvneta: enable features before registering the driver hyperv: Fix RNDIS send_completion code path hyperv: Fix a kernel warning from netvsc_linkstatus_callback() net: ipv4: fix schedule while atomic bug in check_lifetime() net: ipv4: reset check_lifetime_work after changing lifetime bnx2x: Fix KR2 rapid link flap sctp: remove 'sridhar' from maintainers list VSOCK: Fix missing msg_namelen update in vsock_stream_recvmsg() VSOCK: vmci - fix possible info leak in vmci_transport_dgram_dequeue() ...
2013-04-10bnx2x: Prevent null pointer dereference in AFEX modeYuval Mintz1-1/+2
The cnic module is responsible for initializing various bnx2x structs via callbacks provided by the bnx2x module. One such struct is the queue object for the FCoE queue. If a device is working in AFEX mode and its configuration allows FCoE yet the cnic module is not loaded, it's very likely a null pointer dereference will occur, as the bnx2x will erroneously access the FCoE's queue object. Prevent said access until cnic properly registers itself. Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com> Signed-off-by: Ariel Elior <ariele@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-04-10e100: Add dma mapping error checkNeil Horman1-11/+25
e100 uses pci_map_single, but fails to check for a dma mapping error after its use, resulting in a stack trace: [ 46.656594] ------------[ cut here ]------------ [ 46.657004] WARNING: at lib/dma-debug.c:933 check_unmap+0x47b/0x950() [ 46.657004] Hardware name: To Be Filled By O.E.M. [ 46.657004] e100 0000:00:0e.0: DMA-API: device driver failed to check map error[device address=0x000000007a4540fa] [size=90 bytes] [mapped as single] [ 46.657004] Modules linked in: [ 46.657004] w83627hf hwmon_vid snd_via82xx ppdev snd_ac97_codec ac97_bus snd_seq snd_pcm snd_mpu401 snd_mpu401_uart ns558 snd_rawmidi gameport parport_pc e100 snd_seq_device parport snd_page_alloc snd_timer snd soundcore skge shpchp k8temp mii edac_core i2c_viapro edac_mce_amd nfsd auth_rpcgss nfs_acl lockd sunrpc binfmt_misc uinput ata_generic pata_acpi radeon i2c_algo_bit drm_kms_helper ttm firewire_ohci drm firewire_core pata_via sata_via i2c_core sata_promise crc_itu_t [ 46.657004] Pid: 792, comm: ip Not tainted 3.8.0-0.rc6.git0.1.fc19.x86_64 #1 [ 46.657004] Call Trace: [ 46.657004] <IRQ> [<ffffffff81065ed0>] warn_slowpath_common+0x70/0xa0 [ 46.657004] [<ffffffff81065f4c>] warn_slowpath_fmt+0x4c/0x50 [ 46.657004] [<ffffffff81364cfb>] check_unmap+0x47b/0x950 [ 46.657004] [<ffffffff8136522f>] debug_dma_unmap_page+0x5f/0x70 [ 46.657004] [<ffffffffa030f0f0>] ? e100_tx_clean+0x30/0x210 [e100] [ 46.657004] [<ffffffffa030f1a8>] e100_tx_clean+0xe8/0x210 [e100] [ 46.657004] [<ffffffffa030fc6f>] e100_poll+0x56f/0x6c0 [e100] [ 46.657004] [<ffffffff8159dce1>] ? net_rx_action+0xa1/0x370 [ 46.657004] [<ffffffff8159ddb2>] net_rx_action+0x172/0x370 [ 46.657004] [<ffffffff810703bf>] __do_softirq+0xef/0x3d0 [ 46.657004] [<ffffffff816e4ebc>] call_softirq+0x1c/0x30 [ 46.657004] [<ffffffff8101c485>] do_softirq+0x85/0xc0 [ 46.657004] [<ffffffff81070885>] irq_exit+0xd5/0xe0 [ 46.657004] [<ffffffff816e5756>] do_IRQ+0x56/0xc0 [ 46.657004] [<ffffffff816dacb2>] common_interrupt+0x72/0x72 [ 46.657004] <EOI> [<ffffffff816da1eb>] ? _raw_spin_unlock_irqrestore+0x3b/0x70 [ 46.657004] [<ffffffff816d124d>] __slab_free+0x58/0x38b [ 46.657004] [<ffffffff81214424>] ? fsnotify_clear_marks_by_inode+0x34/0x120 [ 46.657004] [<ffffffff811b0417>] ? kmem_cache_free+0x97/0x320 [ 46.657004] [<ffffffff8157fc14>] ? sock_destroy_inode+0x34/0x40 [ 46.657004] [<ffffffff8157fc14>] ? sock_destroy_inode+0x34/0x40 [ 46.657004] [<ffffffff811b0692>] kmem_cache_free+0x312/0x320 [ 46.657004] [<ffffffff8157fc14>] sock_destroy_inode+0x34/0x40 [ 46.657004] [<ffffffff811e8c28>] destroy_inode+0x38/0x60 [ 46.657004] [<ffffffff811e8d5e>] evict+0x10e/0x1a0 [ 46.657004] [<ffffffff811e9605>] iput+0xf5/0x180 [ 46.657004] [<ffffffff811e4338>] dput+0x248/0x310 [ 46.657004] [<ffffffff811ce0e1>] __fput+0x171/0x240 [ 46.657004] [<ffffffff811ce26e>] ____fput+0xe/0x10 [ 46.657004] [<ffffffff8108d54c>] task_work_run+0xac/0xe0 [ 46.657004] [<ffffffff8106c6ed>] do_exit+0x26d/0xc30 [ 46.657004] [<ffffffff8109eccc>] ? finish_task_switch+0x7c/0x120 [ 46.657004] [<ffffffff816dad58>] ? retint_swapgs+0x13/0x1b [ 46.657004] [<ffffffff8106d139>] do_group_exit+0x49/0xc0 [ 46.657004] [<ffffffff8106d1c4>] sys_exit_group+0x14/0x20 [ 46.657004] [<ffffffff816e3b19>] system_call_fastpath+0x16/0x1b [ 46.657004] ---[ end trace 4468c44e2156e7d1 ]--- [ 46.657004] Mapped at: [ 46.657004] [<ffffffff813663d1>] debug_dma_map_page+0x91/0x140 [ 46.657004] [<ffffffffa030e8eb>] e100_xmit_prepare+0x12b/0x1c0 [e100] [ 46.657004] [<ffffffffa030c924>] e100_exec_cb+0x84/0x140 [e100] [ 46.657004] [<ffffffffa030e56a>] e100_xmit_frame+0x3a/0x190 [e100] [ 46.657004] [<ffffffff8159ee89>] dev_hard_start_xmit+0x259/0x6c0 Easy fix, modify the cb paramter to e100_exec_cb to return an error, and do the dma_mapping_error check in the obvious place This was reported previously here: http://article.gmane.org/gmane.linux.network/257893 But nobody stepped up and fixed it. CC: Josh Boyer <jwboyer@redhat.com> CC: e1000-devel@lists.sourceforge.net Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Reported-by: Michal Jaegermann <michal@harddata.com> Tested-by: Aaron Brown <aaron.f.brown@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-04-10dmaengine: omap-dma: Start DMA without delay for cyclic channelsPeter Ujfalusi1-6/+14
cyclic DMA is only used by audio which needs DMA to be started without a delay. If the DMA for audio is started using the tasklet we experience random channel switch (to be more precise: channel shift). Reported-by: Peter Meerwald <pmeerw@pmeerw.net> CC: stable@vger.kernel.org # v3.7+ Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com> Acked-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2013-04-09Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds1-1/+1
Pull crypto fixes from Herbert Xu: "This fixes a GCM bug that breaks IPsec and a compile problem in ux500." * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: ux500 - add missing comma crypto: gcm - fix assumption that assoc has one segment
2013-04-09Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds2-11/+4
Pull drm fixes from Dave Airlie: "Just a spare semicolon in nouveau that caused some issues, and an mgag200 fix" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/mgag200: Index 24 in extended CRTC registers is 24 in hex, not decimal. drm/nouveau: fix unconditional return waiting on memory
2013-04-10drm/mgag200: Index 24 in extended CRTC registers is 24 in hex, not decimal.Christopher Harvey1-10/+3
This change properly enables the "requester" in G200ER cards that is responsible for getting pixels out of memory and clocking them out to the screen. Signed-off-by: Christopher Harvey <charvey@matrox.com> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-04-09Merge tag 'vfio-v3.9-rc7' of git://github.com/awilliam/linux-vfioLinus Torvalds1-1/+2
Pull vfio overflow fix from Alex Williamson. * tag 'vfio-v3.9-rc7' of git://github.com/awilliam/linux-vfio: vfio-pci: Fix possible integer overflow
2013-04-09Merge tag 'for-linus-20130409' of git://git.kernel.dk/linux-blockLinus Torvalds3-121/+245
Pull block fixes from Jens Axboe: "I've got a few smaller fixes queued up for 3.9 that should go in. The major one is the loop regression, the others are nice fixes on their own though. It contains: - Fix for unitialized var in the block sysfs code, courtesy of Arnd and gcc-4.8. - Two fixes for mtip32xx, fixing probe and command timeout. Also a debug measure that could have waited for 3.10, but it's driver only, so I let it slip in. - Revert the loop partition cleanup fix, it could cause a deadlock on auto-teardown as part of umount. The fix is clear, but at this point we just want to revert it and get a real fix in for 3.10." * tag 'for-linus-20130409' of git://git.kernel.dk/linux-block: Revert "loop: cleanup partitions when detaching loop device" mtip32xx: fix two smatch warnings mtip32xx: Add debugfs entry device_status mtip32xx: return 0 from pci probe in case of rebuild mtip32xx: recovery from command timeout block: avoid using uninitialized value in from queue_var_store
2013-04-09regmap: Back out work buffer fixMark Brown1-1/+2
This reverts commit bc8ce4 (regmap: don't corrupt work buffer in _regmap_raw_write()) since it turns out that it can cause issues when taken in isolation from the other changes in -next that lead to its discovery. On the basis that nobody noticed the problems for quite some time without that subsequent work let's drop it from v3.9. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2013-04-08Merge tag 'hwspinlock-3.9-fix' of ↵Linus Torvalds1-0/+2
git://git.kernel.org/pub/scm/linux/kernel/git/ohad/hwspinlock Pull a hwspinlock fix from Ohad Ben-Cohen: "An hwspinlock fix from Li Fei, taking care of a faulty error path." * tag 'hwspinlock-3.9-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/hwspinlock: hwspinlock: fix __hwspin_lock_request error path
2013-04-08Merge tag 'remoteproc-3.9-fixes' of ↵Linus Torvalds3-4/+11
git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc Pull remoteproc fixes from Ohad Ben-Cohen: "Four small remoteproc fixes: - Suman fixed an issue that crawled in with the move to the new idr_alloc interface in 3.9 - Dmitry fixed an STE specific memory leak - Sjur fixed an error path in the core - Rob fixed a Kconfig typo" * tag 'remoteproc-3.9-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc: remoteproc: fix FW_CONFIG typo remoteproc: fix error path of handle_vdev remoteproc/ste: fix memory leak on shutdown remoteproc: fix the error check for idr_alloc
2013-04-09Merge branch 'drm-nouveau-fixes-3.9' of ↵Dave Airlie1-1/+1
git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes too many semicolons. * 'drm-nouveau-fixes-3.9' of git://anongit.freedesktop.org/git/nouveau/linux-2.6: drm/nouveau: fix unconditional return waiting on memory
2013-04-09drm/nouveau: fix unconditional return waiting on memoryCalvin Owens1-1/+1
Typo in nv50_display_flip_wait allows page flipping to run ahead before memory has time to settle. Signed-off-by: Calvin Owens <jcalvinowens@gmail.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-04-08Merge tag 'upstream-linus' of ↵Linus Torvalds3-6/+22
git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev Pull libata fixes from Jeff Garzik: "The HDIO_DRIVE_* fix is really the biggie. 1) Fix ATAPI regression, noticed mainly on tape drives, due to a commit which mistakenly changed an 'int' return type to a 'bool'. Broken by commit 4dce8ba94c75 ("libata: Use 'bool' return value for ata_id_XXX") 2) Add Slimtype DVD A DS8A8SH ATAPI quirk 3) ata_piix: Intel Haswell platform quirk 4) Avoid DMA'ing to stack buffer, when obtaining DEVSLP timings. IMO a mild regression, given that libata previously did not DMA to a stack buffer. Broken by commit commit 803739d25c23 ("[libata] replace sata_settings with devslp_timing") 5) Fix regression impacting SMART and smartd, broken by commit 84a9a8cd9d0a ("[libata] Set proper SK when CK_COND is set")" * tag 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: [libata] Fix HDIO_DRIVE_* ioctl() Linux 3.9 regression libata: fix DMA to stack in reading devslp_timing parameters ata_piix: Fix DVD not dectected at some Haswell platforms libata: Set max sector to 65535 for Slimtype DVD A DS8A8SH drive libata: Use integer return value for atapi_command_packet_set
2013-04-08qeth: fix qeth_wait_for_threads() deadlock for OSN devicesStefan Raspl4-0/+26
Any recovery thread will deadlock when calling qeth_wait_for_threads(), most notably when triggering a recovery on an OSN device. This patch will store the recovery thread's task pointer on recovery invocation and check in qeth_wait_for_threads() respectively to avoid deadlocks. Signed-off-by: Stefan Raspl <raspl@linux.vnet.ibm.com> Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com> Reviewed-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-04-08tcm_vhost: Initialize vq->last_used_idx when set endpointAsias He1-0/+1
This patch fixes guest hang when booting seabios and guest. [ 0.576238] scsi0 : Virtio SCSI HBA [ 0.616754] virtio_scsi virtio1: request:id 0 is not a head! vq->last_used_idx is initialized only when /dev/vhost-scsi is opened or closed. vhost_scsi_open -> vhost_dev_init() -> vhost_vq_reset() vhost_scsi_release() -> vhost_dev_cleanup -> vhost_vq_reset() So, when guest talks to tcm_vhost after seabios does, vq->last_used_idx still contains the old valule for seabios. This confuses guest. Fix this by calling vhost_init_used() to init vq->last_used_idx when we set endpoint. Signed-off-by: Asias He <asias@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-04-08tcm_vhost: Use vq->private_data to indicate if the endpoint is setupAsias He1-43/+101
Currently, vs->vs_endpoint is used indicate if the endpoint is setup or not. It is set or cleared in vhost_scsi_set_endpoint() or vhost_scsi_clear_endpoint() under the vs->dev.mutex lock. However, when we check it in vhost_scsi_handle_vq(), we ignored the lock. Instead of using the vs->vs_endpoint and the vs->dev.mutex lock to indicate the status of the endpoint, we use per virtqueue vq->private_data to indicate it. In this way, we can only take the vq->mutex lock which is per queue and make the concurrent multiqueue process having less lock contention. Further, in the read side of vq->private_data, we can even do not take the lock if it is accessed in the vhost worker thread, because it is protected by "vhost rcu". (nab: Do s/VHOST_FEATURES/~VHOST_SCSI_FEATURES) Signed-off-by: Asias He <asias@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2013-04-08bonding: fix bonding_masters race condition in bond unloadingnikolay@redhat.com1-0/+9
While the bonding module is unloading, it is considered that after rtnl_link_unregister all bond devices are destroyed but since no synchronization mechanism exists, a new bond device can be created via bonding_masters before unregister_pernet_subsys which would lead to multiple problems (e.g. NULL pointer dereference, wrong RIP, list corruption). This patch fixes the issue by removing any bond devices left in the netns after bonding_masters is removed from sysfs. Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com> Acked-by: Veaceslav Falico <vfalico@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-04-08Revert "bonding: remove sysfs before removing devices"nikolay@redhat.com1-1/+1
This reverts commit 4de79c737b200492195ebc54a887075327e1ec1d. This patch introduces a new bug which causes access to freed memory. In bond_uninit: list_del(&bond->bond_list); bond_list is linked in bond_net's dev_list which is freed by unregister_pernet_subsys. Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-04-08cpufreq / intel_pstate: Set timer timeout correctlyDirk Brandewie1-1/+0
The current calculation of the delay time is wrong and a cut and paste error from a previous experimental driver. This can result in the timeout being set to jiffies + 1 which setup the driver to race with itself if the APIC timer interrupt happens at just the right time. References: https://bugzilla.redhat.com/show_bug.cgi?id=920289 Reported-by: Adam Williamson <awilliam@redhat.com> Reported-and-tested-by: Parag Warudkar <parag.lkml@gmail.com> Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-04-08tty: mxser: fix cycle termination condition in mxser_probe() and ↵Alexey Khoroshilov1-4/+4
mxser_module_init() There is a bug in resources deallocation code in mxser_probe() and mxser_module_init(). As soon as variable 'i' is unsigned int, cycle termination condition i >= 0 is always true. The patch fixes the issue. Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Acked-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-08Revert "tty/8250_pnp: serial port detection regression since v3.7"Sean Young1-7/+5
This reverts commit 77e372a3d82e5e4878ce1962207edd766773cc76. Checking for disabled resources board breaks detection pnp on another board "AMI UEFI implementation (Version: 0406 Release Date: 06/06/2012)". I'm working with the reporter of the original bug to write and test a better fix. https://bugzilla.redhat.com/show_bug.cgi?id=928246 Signed-off-by: Sean Young <sean@mess.org> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-08Merge branch 'master' of ↵John W. Linville14-290/+388
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2013-04-08net: mvneta: enable features before registering the driverwilly tarreau1-4/+5
It seems that the reason why the dev features were ignored was because they were enabled after registeration. Signed-off-by: Willy Tarreau <w@1wt.eu> Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-04-08hyperv: Fix RNDIS send_completion code pathHaiyang Zhang2-18/+13
In some cases, the VM_PKT_COMP message can arrive later than RNDIS completion message, which will free the packet memory. This may cause panic due to access to freed memory in netvsc_send_completion(). This patch fixes this problem by removing rndis_filter_send_request_completion() from the code path. The function was a no-op. Reported-by: Long Li <longli@microsoft.com> Tested-by: Long Li <longli@microsoft.com> Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com> Reviewed-by: K. Y. Srinivasan <kys@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-04-08hyperv: Fix a kernel warning from netvsc_linkstatus_callback()Haiyang Zhang1-2/+0
The warning about local_bh_enable inside IRQ happens when disconnecting a virtual NIC. The reason for the warning is -- netif_tx_disable() is called when the NIC is disconnected. And it's called within irq context. netif_tx_disable() calls local_bh_enable() which displays warning if in irq. The fix is to remove the unnecessary netif_tx_disable & wake_queue() in the netvsc_linkstatus_callback(). Reported-by: Richard Genoud <richard.genoud@gmail.com> Tested-by: Long Li <longli@microsoft.com> Tested-by: Richard Genoud <richard.genoud@gmail.com> Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com> Reviewed-by: K. Y. Srinivasan <kys@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-04-08Revert "loop: cleanup partitions when detaching loop device"Jens Axboe1-19/+2
This reverts commit 8761a3dc1f07b163414e2215a2cadbb4cfe2a107. There are situations where the destruction path is called with the bdev->bd_mutex already held, which then deadlocks in loop_clr_fd(). The normal partition cleanup does a trylock() on the mutex, but it'd be nice to have a more bullet proof method in loop. So punt this more involved fix to the next merge window, and just back out this buggy fix for now. Signed-off-by: Jens Axboe <axboe@kernel.dk>
2013-04-07bnx2x: Fix KR2 rapid link flapYaniv Rosner1-7/+11
Check KR2 recovery time at the beginning of the work-around function. Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>