1. 13 Mar, 2012 17 commits
  2. 12 Mar, 2012 4 commits
  3. 10 Mar, 2012 4 commits
    • Linus Torvalds's avatar
      Linux 3.3-rc7 · fde7d904
      Linus Torvalds authored
      fde7d904
    • Al Viro's avatar
      aio: fix the "too late munmap()" race · c7b28555
      Al Viro authored
      Current code has put_ioctx() called asynchronously from aio_fput_routine();
      that's done *after* we have killed the request that used to pin ioctx,
      so there's nothing to stop io_destroy() waiting in wait_for_all_aios()
      from progressing.  As the result, we can end up with async call of
      put_ioctx() being the last one and possibly happening during exit_mmap()
      or elf_core_dump(), neither of which expects stray munmap() being done
      to them...
      
      We do need to prevent _freeing_ ioctx until aio_fput_routine() is done
      with that, but that's all we care about - neither io_destroy() nor
      exit_aio() will progress past wait_for_all_aios() until aio_fput_routine()
      does really_put_req(), so the ioctx teardown won't be done until then
      and we don't care about the contents of ioctx past that point.
      
      Since actual freeing of these suckers is RCU-delayed, we don't need to
      bump ioctx refcount when request goes into list for async removal.
      All we need is rcu_read_lock held just over the ->ctx_lock-protected
      area in aio_fput_routine().
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Reviewed-by: default avatarJeff Moyer <jmoyer@redhat.com>
      Acked-by: default avatarBenjamin LaHaise <bcrl@kvack.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c7b28555
    • Al Viro's avatar
      aio: fix io_setup/io_destroy race · 86b62a2c
      Al Viro authored
      Have ioctx_alloc() return an extra reference, so that caller would drop it
      on success and not bother with re-grabbing it on failure exit.  The current
      code is obviously broken - io_destroy() from another thread that managed
      to guess the address io_setup() would've returned would free ioctx right
      under us; gets especially interesting if aio_context_t * we pass to
      io_setup() points to PROT_READ mapping, so put_user() fails and we end
      up doing io_destroy() on kioctx another thread has just got freed...
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Acked-by: default avatarBenjamin LaHaise <bcrl@kvack.org>
      Reviewed-by: default avatarJeff Moyer <jmoyer@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      86b62a2c
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 86e06008
      Linus Torvalds authored
      Pull btrfs updates from Chris Mason:
       "I have two additional and btrfs fixes in my for-linus branch.  One is
        a casting error that leads to memory corruption on i386 during scrub,
        and the other fixes a corner case in the backref walking code (also
        triggered by scrub)."
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: fix casting error in scrub reada code
        btrfs: fix locking issues in find_parent_nodes()
      86e06008
  4. 09 Mar, 2012 15 commits
    • Hugh Dickins's avatar
      memcg: revert fix to mapcount check for this release · be22aece
      Hugh Dickins authored
      Respectfully revert commit e6ca7b89 "memcg: fix mapcount check
      in move charge code for anonymous page" for the 3.3 release, so that
      it behaves exactly like releases 2.6.35 through 3.2 in this respect.
      
      Horiguchi-san's commit is correct in itself, 1 makes much more sense
      than 2 in that check; but it does not go far enough - swapcount
      should be considered too - if we really want such a check at all.
      
      We appear to have reached agreement now, and expect that 3.4 will
      remove the mapcount check, but had better not make 3.3 different.
      Signed-off-by: default avatarHugh Dickins <hughd@google.com>
      Reviewed-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      be22aece
    • Thomas Gleixner's avatar
      x86: Derandom delay_tsc for 64 bit · a7f4255f
      Thomas Gleixner authored
      Commit f0fbf0ab ("x86: integrate delay functions") converted
      delay_tsc() into a random delay generator for 64 bit.  The reason is
      that it merged the mostly identical versions of delay_32.c and
      delay_64.c.  Though the subtle difference of the result was:
      
       static void delay_tsc(unsigned long loops)
       {
      -	unsigned bclock, now;
      +	unsigned long bclock, now;
      
      Now the function uses rdtscl() which returns the lower 32bit of the
      TSC. On 32bit that's not problematic as unsigned long is 32bit. On 64
      bit this fails when the lower 32bit are close to wrap around when
      bclock is read, because the following check
      
             if ((now - bclock) >= loops)
             	  	break;
      
      evaluated to true on 64bit for e.g. bclock = 0xffffffff and now = 0
      because the unsigned long (now - bclock) of these values results in
      0xffffffff00000001 which is definitely larger than the loops
      value. That explains Tvortkos observation:
      
      "Because I am seeing udelay(500) (_occasionally_) being short, and
       that by delaying for some duration between 0us (yep) and 491us."
      
      Make those variables explicitely u32 again, so this works for both 32
      and 64 bit.
      Reported-by: default avatarTvrtko Ursulin <tvrtko.ursulin@onelan.co.uk>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: stable@vger.kernel.org # >= 2.6.27
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a7f4255f
    • Linus Torvalds's avatar
      Merge tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · c447064d
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Nothing exciting here: just a few regression fixes for HD-audio and
        ASoC, also the support of missing 32bit compat ioctl for HDSPM."
      
      * tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hdspm - Provide ioctl_compat
        ALSA: hda/realtek - Apply the coef-setup only to ALC269VB
        ALSA: hda - add quirk to detect CD input on Gigabyte EP45-DS3
        ASoC: neo1973: fix neo1973 wm8753 initialization
      c447064d
    • David Brown's avatar
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming · 0ab5d757
      Linus Torvalds authored
      Pull C6X fix from Mark Salter:
       "Fix for C6X KSTK_EIP and KSTK_ESP macros."
      
      * tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
        C6X: fix KSTK_EIP and KSTK_ESP macros
      0ab5d757
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 0cacaf51
      Linus Torvalds authored
      Pull two IOMMU fixes from Joerg Roedel:
       "The first is an additional fix for the OMAP initialization order issue
        and the second patch fixes a possible section mismatch which can lead
        to a kernel crash in the AMD IOMMU driver when suspend/resume is used
        and the compiler has not inlined the iommu_set_device_table function."
      
      * tag 'iommu-fixes-v3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        x86/amd: iommu_set_device_table() must not be __init
        ARM: OMAP: fix iommu, not mailbox
      0cacaf51
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 45b8da90
      Linus Torvalds authored
      Pull radeon drm stuff from Dave Airlie:
       "Just some radeon fixes, one is for an oops where we run out of ioremap
        space on some big hardware systems in 32-bit mode, stuff doesn't work
        properly but at least the machine will boot.
      
        One regression fix, and two bugs, one hw, one blit code."
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/radeon/kms: fix hdmi duallink checks
        drm/radeon/kms: set SX_MISC in the r6xx blit code (v2)
        drm/radeon: deal with errors from framebuffer init path.
        drm/radeon: fix a semaphore deadlock on pre cayman asics
      45b8da90
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · e304dfdb
      Linus Torvalds authored
      Pull networking from David Miller:
      
      1) IPV4 routing metrics can become stale when routes are changed by the
         administrator, fix from Steffen Klassert.
      
      2) atl1c does "val |= XXX;" where XXX is a bit number not a bit mask,
         fix by using set_bit.  From Dan Carpenter.
      
      3) Memory accounting bug in carl9170 driver results in wedged TX queue.
         Fix from Nicolas Cavallari.
      
      4) iwlwifi accidently uses "sizeof(ptr)" instead of "sizeof(*ptr)", fix
         from Johannes Berg.
      
      5) Openvswitch doesn't honor dp_ifindex when doing vport lookups, fix
         from Ben Pfaff.
      
      6) ehea conversion to 64-bit stats lost multicast and rx_errors
         accounting, fix from Eric Dumazet.
      
      7) Bridge state transition logging in br_stp_disable_port() is busted,
         it's emitted at the wrong time and the message is in the wrong tense,
         fix from Paulius Zaleckas.
      
      8) mlx4 device erroneously invokes the queue resize firmware operation
         twice, fix from Jack Morgenstein.
      
      9) Fix deadlock in usbnet, need to drop lock when invoking usb_unlink_urb()
         otherwise we recurse into taking it again.  Fix from Sebastian Siewior.
      
      10) hyperv network driver uses the wrong driver name string, fix from
          Haiyang Zhang.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        net/hyperv: Use the built-in macro KBUILD_MODNAME for this driver
        net/usbnet: avoid recursive locking in usbnet_stop()
        route: Remove redirect_genid
        inetpeer: Invalidate the inetpeer tree along with the routing cache
        mlx4_core: fix bug in modify_cq wrapper for resize flow.
        atl1c: set ATL1C_WORK_EVENT_RESET bit correctly
        bridge: fix state reporting when port is disabled
        bridge: br_log_state() s/entering/entered/
        ehea: restore multicast and rx_errors fields
        openvswitch: Fix checksum update for actions on UDP packets.
        openvswitch: Honor dp_ifindex, when specified, for vport lookup by name.
        iwlwifi: fix wowlan suspend
        mwifiex: reset encryption mode flag before association
        carl9170: fix frame delivery if sta is in powersave mode
        carl9170: Fix memory accounting when sta is in power-save mode.
      e304dfdb
    • Rafael J. Wysocki's avatar
      sh-sci / PM: Avoid deadlocking runtime PM · 048be431
      Rafael J. Wysocki authored
      The runtime PM of sh-sci devices is enabled when sci_probe() returns,
      so the pm_runtime_put_sync() executed by driver_probe_device()
      attempts to suspend the device.  Then, in some situations, a
      diagnostic message is printed to the console by one of the runtime
      suspend routines handling the sh-sci device, which causes synchronous
      runtime resume to be started from the device's own runtime suspend
      callback.  This causes rpm_resume() to be run eventually, which sees
      the RPM_SUSPENDING status set by rpm_suspend() and waits for it to
      change.  However, the device's runtime PM status cannot change at
      that point, because the routine that has set it waits for the
      rpm_suspend() to return.  A deadlock occurs as a result.
      
      To avoid that make sci_init_single() increment the device's
      runtime PM usage counter, so that it cannot be suspended by
      driver_probe_device().  That counter has to be decremented
      eventually, so make sci_startup() do that before starting to
      actually use the device and make sci_shutdown() increment it
      again before returning to balance the incrementation carried out by
      sci_startup().
      Signed-off-by: default avatarRafael J. Wysocki <rjw@sisk.pl>
      Tested-by: default avatarKuninori Morimoto <kuninori.morimoto.gx@renesas.com>
      Signed-off-by: default avatarPaul Mundt <lethal@linux-sh.org>
      048be431
    • Linus Torvalds's avatar
      Merge tag 'fixes-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 9f8050c4
      Linus Torvalds authored
      Pull last minute fixes from Olof Johansson:
       "One samsung build fix due to a mis-applied patch, and a small set of
        OMAP fixes.  This should be the last from arm-soc for 3.3, hopefully."
      
      * tag 'fixes-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: S3C2440: Fixed build error for s3c244x
        ARM: OMAP2+: Fix module build errors with CONFIG_OMAP4_ERRATA_I688
        ARM: OMAP: id: Add missing break statement in omap3xxx_check_revision
        ARM: OMAP2+: Remove apply_uV constraints for fixed regulator
        ARM: OMAP: irqs: Fix NR_IRQS value to handle PRCM interrupts
      9f8050c4
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator · 9a0cee71
      Linus Torvalds authored
      Pull regulator fix from Mark Brown:
       "Another small, clear fix in a specific driver."
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
        regulator: tps65910: Configure correct value for VDDCTRL vout reg
      9a0cee71
    • Linus Torvalds's avatar
      Merge tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux-2.6 · ee0849c9
      Linus Torvalds authored
      Pull minor devicetree bug fixes and documentation updates from Grant Likely:
       "Fixes up a duplicate #include, adds an empty implementation of
        of_find_compatible_node() and make git ignore .dtb files.  And fix up
        bus name on OF described PHYs.  Nothing exciting here."
      
      * tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux-2.6:
        doc: dt: Fix broken reference in gpio-leds documentation
        of/mdio: fix fixed link bus name
        of/fdt.c: asm/setup.h included twice
        of: add picochip vendor prefix
        dt: add empty of_find_compatible_node function
        ARM: devicetree: Add .dtb files to arch/arm/boot/.gitignore
      ee0849c9
    • Linus Torvalds's avatar
      Merge tag 'spi-for-linus' of git://git.secretlab.ca/git/linux-2.6 · 7d77696e
      Linus Torvalds authored
      Pull SPI section mismatch bug fix for v3.3-rc3 from Grant Likely:
       "Minor fix for pl022_dma_probe() function which was put in the wrong
        section."
      
      * tag 'spi-for-linus' of git://git.secretlab.ca/git/linux-2.6:
        Fix section mismatch in spi-pl022.c
      7d77696e
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging · 42a6c7ef
      Linus Torvalds authored
      Pull four hwmon patches from Guenter Roeck
      
      * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (jc42) Add support for AT30TS00, TS3000GB2, TSE2002GB2, and MCP9804
        hwmon: (zl6100) Maintain delay parameter in driver instance data
        hwmon: (pmbus_core) Fix maximum number of POUT alarm attributes
        hwmon: (jc42) Add support for ST Microelectronics STTS2002 and STTS3000
      42a6c7ef
    • Linus Torvalds's avatar
      Merge tag 'dm-3.3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm · 5d0edf29
      Linus Torvalds authored
      Pull device-mapper fixes for 3.3 from Alasdair Kergon
      
      Eight small device-mapper bug fixes.
      
      * tag 'dm-3.3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm:
        dm raid: fix flush support
        dm raid: set MD_CHANGE_DEVS when rebuilding
        dm thin metadata: decrement counter after removing mapped block
        dm thin metadata: unlock superblock in init_pmd error path
        dm thin metadata: remove incorrect close_device on creation error paths
        dm flakey: fix crash on read when corrupt_bio_byte not set
        dm io: fix discard support
        dm ioctl: do not leak argv if target message only contains whitespace
      5d0edf29