Skip to content
  1. Feb 04, 2012
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm · d1256667
      Linus Torvalds authored
      * 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
        ARM: 7314/1: kuser: consistently use usr_ret for returning from helpers
        ARM: 7302/1: Add TLB flushing for both entries in a PMD
        ARM: 7303/1: perf: add empty NODE event definitions for Cortex-A5 and Cortex-A15
        ARM: 7308/1: vfp: flush thread hwstate before copying ptrace registers
        ARM: 7307/1: vfp: fix ptrace regset modification race
        ARM: 7306/1: vfp: flush thread hwstate before restoring context from sigframe
        Revert "ARM: 7304/1: ioremap: fix boundary check when reusing static mapping"
      d1256667
    • Linus Torvalds's avatar
      Merge tag 'kmemleak-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux · 7c7ed8ec
      Linus Torvalds authored
      Trivial kmemleak bug-fixes:
      
       - Early logging doesn't stop when kmemleak is off by default.
       - Zero-size scanning areas should be ignored (currently it prints a
         warning).
      
      * tag 'kmemleak-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux:
        kmemleak: Disable early logging when kmemleak is off by default
        kmemleak: Only scan non-zero-size areas
      7c7ed8ec
    • Linus Torvalds's avatar
      Merge tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 7f06db34
      Linus Torvalds authored
      sound fixes for 3.3-rc3
      
      Most of commits are either regression fixes for varioud HD-audio
      codecs or small ASoC fixes.  Also a trivial build fix is included.
      
      * tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - Disable dynamic-power control for VIA as default
        ALSA: hda - Allow analog low-current mode when dynamic power-control is on
        ALSA: hda - Fix the logic to detect VIA analog low-current mode
        ALSA: hda - Check power-state before changing in patch_via.c
        ALSA: HDA: Fix duplicated output to more than one codec
        ALSA: hda - Fix calling cs_automic twice for Cirrus codecs.
        ALSA: HDA: Remove quirk for Toshiba Qosmio G50
        ALSA: HDA: Fix jack creation for codecs with front and rear Line In
        ALSA: hda - Apply 0x0f-VREF fix to all ASUS laptops with ALC861/660
        ASoC: neo1973_wm8753: remove references to the neo1973-gta01 machine
        ALSA: Add #ifdef CONFIG_PCI guard for snd_pci_quirk_* functions
        ASoC: wm_hubs: fix wrong bits for LINEOUT2 N/P mixer
        ALSA: HDA: Remove quirk for Asus N53Jq
        ASoC: wm_hubs: Enable line out VMID buffer for single ended line outputs
        ASoC: wm5100: Mark register cache as dirty when regulators are disabled
        ASoC: wm8962: Mark register cache as dirty when regulators are disabled
        ASoC: wm8996: Mark register cache as dirty when regulators are disabled
        ASoC: wm5100: Fix microphone configuration
        ASoC: wm5100: Make sure we switch to button reporting mode
      7f06db34
  2. Feb 03, 2012
    • Will Deacon's avatar
      ARM: 7314/1: kuser: consistently use usr_ret for returning from helpers · 5a97d0ae
      Will Deacon authored
      
      
      __kuser_cmpxchg64 has a return path using bx lr to get back to the caller.
      This is actually ok since the code in question is predicated on
      CONFIG_CPU_32v6K, but for the sake of consistency using the usr_ret
      macro is probably better.
      
      Acked-by: default avatarDave Martin <dave.martin@linaro.org>
      Acked-by: default avatarNicolas Pitre <nico@linaro.org>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      5a97d0ae
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client · 6c073a7e
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
        rbd: fix safety of rbd_put_client()
        rbd: fix a memory leak in rbd_get_client()
        ceph: create a new session lock to avoid lock inversion
        ceph: fix length validation in parse_reply_info()
        ceph: initialize client debugfs outside of monc->mutex
        ceph: change "ceph.layout" xattr to be "ceph.file.layout"
      6c073a7e
    • Josh Triplett's avatar
    • Alex Elder's avatar
      rbd: fix safety of rbd_put_client() · d23a4b3f
      Alex Elder authored
      
      
      The rbd_client structure uses a kref to arrange for cleaning up and
      freeing an instance when its last reference is dropped.  The cleanup
      routine is rbd_client_release(), and one of the things it does is
      delete the rbd_client from rbd_client_list.  It acquires node_lock
      to do so, but the way it is done is still not safe.
      
      The problem is that when attempting to reuse an existing rbd_client,
      the structure found might already be in the process of getting
      destroyed and cleaned up.
      
      Here's the scenario, with "CLIENT" representing an existing
      rbd_client that's involved in the race:
      
       Thread on CPU A                | Thread on CPU B
       ---------------                | ---------------
       rbd_put_client(CLIENT)         | rbd_get_client()
         kref_put()                   |   (acquires node_lock)
           kref->refcount becomes 0   |   __rbd_client_find() returns CLIENT
           calls rbd_client_release() |   kref_get(&CLIENT->kref);
                                      |   (releases node_lock)
             (acquires node_lock)     |
             deletes CLIENT from list | ...and starts using CLIENT...
             (releases node_lock)     |
             and frees CLIENT         | <-- but CLIENT gets freed here
      
      Fix this by having rbd_put_client() acquire node_lock.  The result
      could still be improved, but at least it avoids this problem.
      
      Signed-off-by: default avatarAlex Elder <elder@dreamhost.com>
      Signed-off-by: default avatarSage Weil <sage@newdream.net>
      d23a4b3f
    • Christopher Yeoh's avatar
      Fix race in process_vm_rw_core · 8cdb878d
      Christopher Yeoh authored
      This fixes the race in process_vm_core found by Oleg (see
      
        http://article.gmane.org/gmane.linux.kernel/1235667/
      
      
      
      for details).
      
      This has been updated since I last sent it as the creation of the new
      mm_access() function did almost exactly the same thing as parts of the
      previous version of this patch did.
      
      In order to use mm_access() even when /proc isn't enabled, we move it to
      kernel/fork.c where other related process mm access functions already
      are.
      
      Signed-off-by: default avatarChris Yeoh <yeohc@au1.ibm.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8cdb878d
    • Alex Elder's avatar
      rbd: fix a memory leak in rbd_get_client() · 97bb59a0
      Alex Elder authored
      
      
      If an existing rbd client is found to be suitable for use in
      rbd_get_client(), the rbd_options structure is not being
      freed as it should.  Fix that.
      
      Signed-off-by: default avatarAlex Elder <elder@dreamhost.com>
      Signed-off-by: default avatarSage Weil <sage@newdream.net>
      97bb59a0
    • Alex Elder's avatar
      ceph: create a new session lock to avoid lock inversion · d8fb02ab
      Alex Elder authored
      
      
      Lockdep was reporting a possible circular lock dependency in
      dentry_lease_is_valid().  That function needs to sample the
      session's s_cap_gen and and s_cap_ttl fields coherently, but needs
      to do so while holding a dentry lock.  The s_cap_lock field was
      being used to protect the two fields, but that can't be taken while
      holding a lock on a dentry within the session.
      
      In most cases, the s_cap_gen and s_cap_ttl fields only get operated
      on separately.  But in three cases they need to be updated together.
      Implement a new lock to protect the spots updating both fields
      atomically is required.
      
      Signed-off-by: default avatarAlex Elder <elder@dreamhost.com>
      Reviewed-by: default avatarSage Weil <sage@newdream.net>
      d8fb02ab
    • Xi Wang's avatar
      ceph: fix length validation in parse_reply_info() · 32852a81
      Xi Wang authored
      
      
      "len" is read from network and thus needs validation.  Otherwise, given
      a bogus "len" value, p+len could be an out-of-bounds pointer, which is
      used in further parsing.
      
      Signed-off-by: default avatarXi Wang <xi.wang@gmail.com>
      Signed-off-by: default avatarSage Weil <sage@newdream.net>
      32852a81
    • Sage Weil's avatar
      ceph: initialize client debugfs outside of monc->mutex · ab434b60
      Sage Weil authored
      
      
      Initializing debufs under monc->mutex introduces a lock dependency for
      sb->s_type->i_mutex_key, which (combined with several other dependencies)
      leads to an annoying lockdep warning.  There's no particular reason to do
      the debugfs setup under this lock, so move it out.
      
      It used to be the case that our first monmap could come from the OSD; that
      is no longer the case with recent servers, so we will reliably set up the
      client entry during the initial authentication.
      
      We don't have to worry about racing with debugfs teardown by
      ceph_debugfs_client_cleanup() because ceph_destroy_client() calls
      ceph_msgr_flush() first, which will wait for the message dispatch work
      to complete (and the debugfs init to complete).
      
      Fixes: #1940
      Signed-off-by: default avatarSage Weil <sage@newdream.net>
      ab434b60
    • Alex Elder's avatar
      ceph: change "ceph.layout" xattr to be "ceph.file.layout" · 114fc474
      Alex Elder authored
      
      
      The virtual extended attribute named "ceph.layout" is meaningful
      only for regular files.  Change its name to be "ceph.file.layout" to
      more directly reflect that in the ceph xattr namespace.  Preserve
      the old "ceph.layout" name for the time being (until we decide it's
      safe to get rid of it entirely).
      
      Add a missing initializer for "readonly" in the terminating entry.
      
      Signed-off-by: default avatarAlex Elder <elder@dreamhost.com>
      Reviewed-by: default avatarSage Weil <sage@newdream.net>
      114fc474
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 24b36da3
      Linus Torvalds authored
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/radeon/kms/blit: fix blit copy for very large buffers
        drm/radeon/kms: fix TRAVIS panel setup
        drm/radeon: fix use after free in ATRM bios reading code.
        drm/radeon/kms: Fix device tree linkage of DP i2c buses too
        drm/radeon: Set DESKTOP_HEIGHT register to the framebuffer (not mode) height.
        drm/radeon/kms: disable output polling when suspended
        drm/nv50/pm: signedness bug in nv50_pm_clocks_pre()
        drm/nouveau/gem: fix fence_sync race / oops
        drm/nouveau: fix typo on mxmdcb option
        drm/nouveau/mxm: pretend to succeed, even if we can't shadow the MXM-SIS
        drm/nouveau/disp: check that panel power gpio is enabled at init time
      24b36da3
    • Linus Torvalds's avatar
      Merge branch 'next' of git://git.monstr.eu/linux-2.6-microblaze · c84e295b
      Linus Torvalds authored
      * 'next' of git://git.monstr.eu/linux-2.6-microblaze:
        Revert "microblaze: Add topology init"
      c84e295b
    • Linus Torvalds's avatar
      Merge branches 'core-urgent-for-linus', 'perf-urgent-for-linus',... · 2f2fde92
      Linus Torvalds authored
      Merge branches 'core-urgent-for-linus', 'perf-urgent-for-linus', 'sched-urgent-for-linus' and 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        bugs, x86: Fix printk levels for panic, softlockups and stack dumps
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf top: Fix number of samples displayed
        perf tools: Fix strlen() bug in perf_event__synthesize_event_type()
        perf tools: Fix broken build by defining _GNU_SOURCE in Makefile
        x86/dumpstack: Remove unneeded check in dump_trace()
        perf: Fix broken interrupt rate throttling
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/rt: Fix task stack corruption under __ARCH_WANT_INTERRUPTS_ON_CTXSW
        sched: Fix ancient race in do_exit()
        sched/nohz: Fix nohz cpu idle load balancing state with cpu hotplug
        sched/s390: Fix compile error in sched/core.c
        sched: Fix rq->nr_uninterruptible update race
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/reboot: Remove VersaLogic Menlow reboot quirk
        x86/reboot: Skip DMI checks if reboot set by user
        x86: Properly parenthesize cmpxchg() macro arguments
      2f2fde92
    • Catalin Marinas's avatar
      ARM: 7302/1: Add TLB flushing for both entries in a PMD · 6d3ec1ae
      Catalin Marinas authored
      
      
      Linux uses two PMD entries for a PTE with the classic page table format,
      covering 2MB range. However, the __pte_free_tlb() function only adds a
      single TLB flush corresponding to 1MB range covering 'addr'. On
      Cortex-A15, level 1 entries can be cached by the TLB independently of
      the level 2 entries and without additional flushing a PMD entry would be
      left pointing at the wrong PTE. The patch limits the TLB flushing range
      to two 4KB pages around the 1MB boundary within PMD.
      
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      6d3ec1ae
    • Will Deacon's avatar
      ARM: 7303/1: perf: add empty NODE event definitions for Cortex-A5 and Cortex-A15 · 91756acb
      Will Deacon authored
      Commit 89d6c0b5
      
       ("perf, arch: Add generic NODE cache events") added
      empty NODE event definitions for the ARM PMU implementations. This was
      merged along with Cortex-A5 and Cortex-A15 PMU support, so they missed
      out on the original patch.
      
      This patch adds the empty definitions to Cortex-A5 and Cortex-A15.
      
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      91756acb
    • Will Deacon's avatar
      ARM: 7308/1: vfp: flush thread hwstate before copying ptrace registers · 8130b9d7
      Will Deacon authored
      
      
      If we are context switched whilst copying into a thread's
      vfp_hard_struct then the partial copy may be corrupted by the VFP
      context switching code (see "ARM: vfp: flush thread hwstate before
      restoring context from sigframe").
      
      This patch updates the ptrace VFP set code so that the thread state is
      flushed before the copy, therefore disabling VFP and preventing
      corruption from occurring.
      
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      8130b9d7
    • Dave Martin's avatar
      ARM: 7307/1: vfp: fix ptrace regset modification race · 247f4993
      Dave Martin authored
      
      
      In a preemptible kernel, vfp_set() can be preempted, causing the
      hardware VFP context to be switched while the thread vfp state is
      being read and modified.  This leads to a race condition which can
      cause the thread vfp state to become corrupted if lazy VFP context
      save occurs due to preemption in between the time thread->vfpstate
      is read and the time the modified state is written back.
      
      This may occur if preemption occurs during the execution of a
      ptrace() call which modifies the VFP register state of a thread.
      Such instances should be very rare in most realistic scenarios --
      none has been reported, so far as I am aware.  Only uniprocessor
      systems should be affected, since VFP context save is not currently
      lazy in SMP kernels.
      
      The problem was introduced by my earlier patch migrating to use
      regsets to implement ptrace.
      
      This patch does a vfp_sync_hwstate() before reading
      thread->vfpstate, to make sure that the thread's VFP state is not
      live in the hardware registers while the registers are modified.
      
      Thanks to Will Deacon for spotting this.
      
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarDave Martin <dave.martin@linaro.org>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      247f4993
    • Will Deacon's avatar
      ARM: 7306/1: vfp: flush thread hwstate before restoring context from sigframe · 2af276df
      Will Deacon authored
      
      
      Following execution of a signal handler, we currently restore the VFP
      context from the ucontext in the signal frame. This involves copying
      from the user stack into the current thread's vfp_hard_struct and then
      flushing the new data out to the hardware registers.
      
      This is problematic when using a preemptible kernel because we could be
      context switched whilst updating the vfp_hard_struct. If the current
      thread has made use of VFP since the last context switch, the VFP
      notifier will copy from the hardware registers into the vfp_hard_struct,
      overwriting any data that had been partially copied by the signal code.
      
      Disabling preemption across copy_from_user calls is a terrible idea, so
      instead we move the VFP thread flush *before* we update the
      vfp_hard_struct. Since the flushing is performed lazily, this has the
      effect of disabling VFP and clearing the CPU's VFP state pointer,
      therefore preventing the thread from being updated with stale data on
      the next context switch.
      
      Cc: stable <stable@vger.kernel.org>
      Tested-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      2af276df
    • Russell King's avatar
      Revert "ARM: 7304/1: ioremap: fix boundary check when reusing static mapping" · 97f10409
      Russell King authored
      This reverts commit 3c424f35.
      
      Joachim Eastwood reports:
      | "ARM: 7304/1: ioremap: fix boundary check when reusing static mapping"
      | Commit: 3c424f35
      
       in Linus master
      |
      | Breaks booting on my custom AT91RM9200 board.
      | There isn't any error messages or anything that indicates what goes
      | wrong it just stops after; Uncompressing Linux... done, booting the
      | kernel.
      |
      | Reverting it makes my board boot again.
      
      and further debugging reveals:
      
      ioremap: pfn=fffff phys=fffff000 offset=400 size=1000
      ioremap: area c3ffdfc0: phys_addr=200000 pfn=200 size=4000
      ioremap: found: addr fef74000 => fed73000 => fed73400
      
      Clearly, an area for pfn 0x200, 16K can't ever satisfy a request for pfn
      0xfffff.  This happens because the changed if statement becomes:
      
                      if (0x00200 > 0xfffff ||
                          0xfffff000 + 0x400 + 0x1000-1 > 0x00200000 + 0x4000-1)
      and therefore:
                      if (0x00200 > 0xfffff ||
                          0x000003ff > 0x00203fff)
      
      The if condition fails, and so we _believe_ that the SRAM mapping fits
      our request.  Clearly that's totally bogus.
      
      Moreover, the original premise of the 'fix' patch was wrong:
      |    The condition checking boundaries of the requested and existing
      |    mappings didn't take in-page offset into consideration though,
      |    which lead to obscure and hard to debug problems when requested
      |    mapping crossed end of the static one.
      
      as the code immediately above this loop does:
      
              size = PAGE_ALIGN(offset + size);
      
      so 'size' already contains the requested offset into the page.
      
      So, revert the broken 'fix'.
      
      Acked-by: default avatarNicolas Pitre <nico@linaro.org>
      97f10409
  3. Feb 02, 2012