- 23 Feb, 2010 40 commits
-
-
Thomas Renninger authored
commit d2f6650a upstream. If acpi_bus_add does not return a device and it's passed to acpi_bus_start, bad things will happen: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: [<ffffffff8128402d>] acpi_bus_start+0x14/0x24 ... [<ffffffffa008977a>] acpiphp_bus_add+0xba/0x130 [acpiphp] [<ffffffffa008aa72>] enable_device+0x132/0x2ff [acpiphp] [<ffffffffa0089b68>] acpiphp_enable_slot+0xb8/0x130 [acpiphp] [<ffffffffa0089df7>] handle_hotplug_event_func+0x87/0x190 [acpiphp] Next patch would make this NULL pointer check obsolete, but better having one more than one missing... Signed-off-by:
Thomas Renninger <trenn@suse.de> Acked-by:
Bjorn Helgaas <bjorn.helgaas@hp.com> Signed-off-by:
Len Brown <len.brown@intel.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
-
Jelle Martijn Kok authored
commit 174b2496 upstream. Add new RTL8187B device. Signed-off-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
John W. Linville <linville@tuxdriver.com> Signed-off-by:
-
Linus Torvalds authored
commit ddeee0b2 upstream. I notice that the processcompl_compat() function seems to be leaking the 'struct async *as' in the error paths. I think that the calling convention is fundamentally buggered. The caller is the one that did the "reap_as()" to get the as thing, the caller should be the one to free it too. Freeing it in the caller also means that it very clearly always gets freed, and avoids the need for any "free in the error case too". From: Linus Torvalds <torvalds@linux-foundation.org> Cc: Alan Stern <stern@rowland.harvard.edu> Cc: Marcus Meissner <meissner@suse.de> Signed-off-by:
-
Greg KH authored
commit d4a4683c upstream. We need to only copy the data received by the device to userspace, not the whole kernel buffer, which can contain "stale" data. Thanks to Marcus Meissner for pointing this out and testing the fix. Reported-by:
Marcus Meissner <meissner@suse.de> Tested-by:
-
Laurent Pinchart authored
commit 18d19c96 upstream. Fix a memory leak by freeing the memory allocated in __class_register for the class private data. Signed-off-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by:
Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by:
-
Eric W. Biederman authored
commit 7c0ff870 upstream. There is currently a bug in sysfs_sd_setattr inherited from sysfs_setattr in 2.6.32 where the first time we set the attributes on a sysfs file we allocate backing store but do not set the backing store attributes. Resulting in overly restrictive permissions on sysfs files. The fix is to simply modify the code so that it always executes when we update the sysfs attributes, as we did in 2.6.31 and earlier. Signed-off-by:
Eric W. Biederman <ebiederm@xmission.com> Tested-by:
Jean Delvare <khali@linux-fr.org> Signed-off-by:
-
Dick Hollenbeck authored
commit bca47613 upstream. When controlling an industrial radio modem it can be necessary to manipulate the handshake lines in order to control the radio modem's transmitter, from userspace. The transmitter should not be turned off before all characters have been transmitted. serial8250_tx_empty() was reporting that all characters were transmitted before they actually were. === Discovered in parallel with more testing and analysis by Kees Schoenmakers as follows: I ran into an NetMos 9835 serial pci board which behaves a little different than the standard. This type of expansion board is very common. "Standard" 8250 compatible devices clear the 'UART_LST_TEMT" bit together with the "UART_LSR_THRE" bit when writing data to the device. The NetMos device does it slightly different I believe that the TEMT bit is coupled to the shift register. The problem is that after writing data to the device and very quickly after that one does call serial8250_tx_empty, it returns the wrong information. My patch makes the test more robust (and solves the problem) and it does not affect the already correct devices. Alan: We may yet need to quirk this but now we know which chips we have a way to do that should we find this breaks some other 8250 clone with dodgy THRE. Signed-off-by:
Dick Hollenbeck <dick@softplc.com> Signed-off-by:
Alan Cox <alan@linux.intel.com> Cc: Kees Schoenmakers <k.schoenmakers@sigmae.nl> Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
-
Takashi Iwai authored
commit 78b8d5d2 upstream. As the release of substreams may be done asynchronously from the disconnection, close callback needs to check the shutdown flag before actually accessing the usb interface. Reference: Novell bnc#505027 http://bugzilla.novell.com/show_bug.cgi?id=565027Signed-off-by:
Takashi Iwai <tiwai@suse.de> Signed-off-by:
-
George Kadianakis authored
commit df574b8e upstream. This patch fixes compilation problems that were caused by function naming conflicts between the rtl8187se driver and the mac80211 stack. Signed-off-by:
George Kadianakis <desnacked@gmail.com> Cc: maximilian attems <max@stro.at> Signed-off-by:
-
Yinghai Lu authored
commit 37ef2a30 upstream. When irq_desc is moved, we need to make sure to use the right cfg_new. Signed-off-by:
Yinghai Lu <yinghai@kernel.org> LKML-Reference: <4B07A739.3030104@kernel.org> Signed-off-by:
Ingo Molnar <mingo@elte.hu> Signed-off-by:
-
Joerg Roedel authored
commit d3ad9373 upstream. Deassigning a device from the passthrough domain does not work and breaks device assignment to kvm guests. This patch fixes the issue. Signed-off-by:
Joerg Roedel <joerg.roedel@amd.com> Signed-off-by:
-
Joerg Roedel authored
commit f5325094 upstream This patch moves the initialization of the iommu-api out of the dma-ops initialization code. This ensures that the iommu-api is initialized even with iommu=pt. Signed-off-by:
-
Rafael J. Wysocki authored
commit 1b3f720b upstream. Add missing try_to_freeze() to one of the pktgen_thread_worker() code paths so that it doesn't block suspend/hibernation. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=15006Signed-off-by:
Rafael J. Wysocki <rjw@sisk.pl> Reported-and-tested-by:
Ciprian Dorin Craciun <ciprian.craciun@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
-
Tejun Heo authored
commit cedc9bf9 upstream. Acer G725 shares the same suspend problem with the HP laptops which lose ATA devices on resume. New firmware which fixes the problem is already available. Add G725 with old firmwares to the broken suspend list. This problem has been reported in bko#15104. http://bugzilla.kernel.org/show_bug.cgi?id=15104Signed-off-by:
Tejun Heo <tj@kernel.org> Reported-by:
Jani-Matti Hätinen <jani-matti.hatinen@iki.fi> Signed-off-by:
Jeff Garzik <jgarzik@redhat.com> Signed-off-by:
-
Catalin Marinas authored
commit 2d68b7fe upstream. flush_dcache_page() must be called after (!ATA_TFLAG_WRITE) the data copying to avoid D-cache aliasing with user space or I-D cache coherency issues (when reading data from an ATA device using PIO, the kernel dirties the D-cache but there is no flush_dcache_page() required on Harvard architectures). Signed-off-by:
Catalin Marinas <catalin.marinas@arm.com> Signed-off-by:
-
Sergey Matyukevich authored
commit f4b51628 upstream. Add missing braces for multiline 'if' statements in fm3130_probe. Signed-off-by:
Sergey Matyukevich <geomatsi@gmail.com> Signed-off-by:
Alessandro Zummo <a.zummo@towertech.it> Cc: Sergey Lapin <slapin@ossfans.org> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by:
-
Al Viro authored
commit 8dd5ca53 upstream. Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
-
Alex Murray authored
commit a76221d4 upstream. This patch adds support for automatically muting the speakers when headphones are inserted, as well as relabelling the headphone widgets from the non-standard "HP" to the standard "Headphone" for the mb5 model. Signed-off-by:
Alex Murray <murray.alex@gmail.com> Signed-off-by:
-
Eric Dumazet authored
commit 2fc1b5dd upstream. Kernel bugzilla #15239 On some workloads, it is quite possible to get a huge dst list to process in dst_gc_task(), and trigger soft lockup detection. Fix is to call cond_resched(), as we run in process context. Reported-by:
Pawel Staszewski <pstaszewski@itcare.pl> Tested-by:
Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by:
-
Takashi Iwai authored
commit d6d8bf54 upstream. Replace the zero-division warning message with WARN_ON_ONCE() per the advice by Linus. This shouldn't happen, but if it happens, it's possible that the bug happens often due to buggy IRQs. Signed-off-by:
-
Matt Fleming authored
commit fcb4ebd6 upstream. pte_write() should check whether the permissions include either the user or kernel write permission bits. Likewise, pte_wrprotect() needs to remove both the kernel and user write bits. Without this patch handle_tlbmiss() doesn't handle faulting in pages from the P3 area (our vmalloc space) because of a write. Mappings of the P3 space have the _PAGE_EXT_KERN_WRITE bit but not _PAGE_EXT_USER_WRITE. Signed-off-by:
Matt Fleming <matt@console-pimps.org> Signed-off-by:
Paul Mundt <lethal@linux-sh.org> Signed-off-by:
-
Kashyap, Desai authored
commit 9858ae38 upstream. retval should be SUCCESS/FAILED which is defined at scsi.h retval = 0 is directing wrong return value. It must be retval = SUCCESS. Signed-off-by:
Kashyap Desai <kashyap.desai@lsi.com> Signed-off-by:
James Bottomley <James.Bottomley@suse.de> Signed-off-by:
-
Wu Fengguang authored
commit c85e9a97 upstream devmem: fix kmem write bug on memory holes [ cebbert@redhat.com : backport to 2.6.32 ] write_kmem() used to assume vwrite() always return the full buffer length. However now vwrite() could return 0 to indicate memory hole. This creates a bug that "buf" is not advanced accordingly. Fix it to simply ignore the return value, hence the memory hole. Signed-off-by:
Wu Fengguang <fengguang.wu@intel.com> Cc: Andi Kleen <andi@firstfloor.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Christoph Lameter <cl@linux-foundation.org> Cc: Ingo Molnar <mingo@elte.hu> Cc: Tejun Heo <tj@kernel.org> Cc: Nick Piggin <npiggin@suse.de> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: <stable@kernel.org> Signed-off-by:
-
KAMEZAWA Hiroyuki authored
commit 325fda71 [ cebbert@redhat.com : backport to 2.6.32 ] devmem: check vmalloc address on kmem read/write Otherwise vmalloc_to_page() will BUG(). This also makes the kmem read/write implementation aligned with mem(4): "References to nonexistent locations cause errors to be returned." Here we return -ENXIO (inspired by Hugh) if no bytes have been transfered to/from user space, otherwise return partial read/write results. Signed-off-by:
KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Signed-off-by:
-
Wu Fengguang authored
commit f222318e upstream /dev/mem: introduce size_inside_page() [ cebbert@redhat.com : backport to 2.6.32 ] [ subset of original patch, for just /dev/kmem ] Introduce size_inside_page() to replace duplicate /dev/mem code. Also apply it to /dev/kmem, whose alignment logic was buggy. Signed-off-by:
Andi Kleen <ak@linux.intel.com> Cc: Marcelo Tosatti <mtosatti@redhat.com> Cc: Greg Kroah-Hartman <gregkh@suse.de> Cc: Mark Brown <broonie@opensource.wolfsonmicro.com> Cc: Johannes Berg <johannes@sipsolutions.net> Cc: Avi Kivity <avi@qumranet.com> Signed-off-by:
-
Len Brown authored
commit fda11e61 upstream [ backport to 2.6.32 ] When acpi_evaluate_object() is passed ACPI_ALLOCATE_BUFFER, the caller must kfree the returned buffer if AE_OK is returned. The callers of wmi_get_event_data() pass ACPI_ALLOCATE_BUFFER, and thus must check its return value before accessing or kfree() on the buffer. Signed-off-by:
-
Anisse Astier authored
commit 3e9b988e upstream [ backported to 2.6.32 ] These function allocate an acpi object by calling wmi_get_event_data, which then calls acpi_evaluate_object, and it is not freed afterwards. And kernel doc is fixed for parameters of wmi_get_event_data. Signed-off-by:
Anisse Astier <anisse@astier.eu> Acked-by:
Randy Dunlap <randy.dunlap@oracle.com> Acked-by:
Carlos Corbacho <carlos@strangeworlds.co.uk> Signed-off-by:
-
Herbert Xu authored
commit a8d7ac27 upstream. As the padlock driver for SHA uses a software fallback to perform partial hashing, it must implement custom import/export functions. Otherwise hmac which depends on import/export for prehashing will not work with padlock-sha. Reported-by:
Wolfgang Walter <wolfgang.walter@stwm.de> Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Stefan Haberland authored
commit b8ed5dd5 upstream. Remove strings from s390 debugfeature entries that could lead to a crash when the data is read from dbf because the strings do not exist any more. Signed-off-by:
Stefan Haberland <stefan.haberland@de.ibm.com> Signed-off-by:
Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by:
-
Zhenyu Wang authored
commit b9241ea3 upstream. When we setup buffer for display plane, we'll check any pending required GPU flush and possible make interruptible wait for flush complete. But that wait would be most possibly to fail in case of signals received for X process, which will then fail modeset process and put display engine in unconsistent state. The result could be blank screen or CPU hang, and DDX driver would always turn on outputs DPMS after whatever modeset fails or not. So this one creates new helper for setup display plane buffer, and when needing flush using uninterruptible wait for that. This one should fix bug like https://bugs.freedesktop.org/show_bug.cgi?id=24009. Also fixing mode switch stress test on Ironlake. Signed-off-by:
Zhenyu Wang <zhenyuw@linux.intel.com> Signed-off-by:
Eric Anholt <eric@anholt.net> Signed-off-by:
-
Daniel Vetter authored
commit 48764bf4 upstream. This just waits until the hw passed the current ring position with cmd execution. This slightly changes the existing i915_wait_request function to make uninterruptible waiting possible - no point in returning to userspace while mucking around with the overlay, that piece of hw is just too fragile. Also replace a magic 0 with the symbolic constant (and kill the then superflous comment) while I was looking at the code. Signed-off-by:
Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by:
-
Zhenyu Wang authored
commit 823f68fd upstream. This one reverts 9e3a6d15. As reported by http://bugzilla.kernel.org/show_bug.cgi?id=14485, this dump will cause hang problem on some machine. If something really needs this kind of full registers dump, that could be done within intel-gpu-tools. Cc: Ben Gamari <bgamari.foss@gmail.com> Signed-off-by:
-
Patrick McHardy authored
commit d696c7bd upstream. As noticed by Jon Masters <jonathan@jonmasters.org>, the conntrack hash size is global and not per namespace, but modifiable at runtime through /sys/module/nf_conntrack/hashsize. Changing the hash size will only resize the hash in the current namespace however, so other namespaces will use an invalid hash size. This can cause crashes when enlarging the hashsize, or false negative lookups when shrinking it. Move the hash size into the per-namespace data and only use the global hash size to initialize the per-namespace value when instanciating a new namespace. Additionally restrict hash resizing to init_net for now as other namespaces are not handled currently. Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
-
Alexey Dobriyan authored
commit 14c7dbe0 upstream. As per C99 6.2.4(2) when temporary table data goes out of scope, the behaviour is undefined: if (compat) { struct foo tmp; ... private = &tmp; } [dereference private] Signed-off-by:
Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by:
-
Alexey Dobriyan authored
commit 13ccdfc2 upstream. Expectation hashtable size was simply glued to a variable with no code to rehash expectations, so it was a bug to allow writing to it. Make "expect_hashsize" readonly. Signed-off-by:
-
Eric Dumazet authored
commit 5b3501fa upstream. nf_conntrack_cachep is currently shared by all netns instances, but because of SLAB_DESTROY_BY_RCU special semantics, this is wrong. If we use a shared slab cache, one object can instantly flight between one hash table (netns ONE) to another one (netns TWO), and concurrent reader (doing a lookup in netns ONE, 'finding' an object of netns TWO) can be fooled without notice, because no RCU grace period has to be observed between object freeing and its reuse. We dont have this problem with UDP/TCP slab caches because TCP/UDP hashtables are global to the machine (and each object has a pointer to its netns). If we use per netns conntrack hash tables, we also *must* use per netns conntrack slab caches, to guarantee an object can not escape from one namespace to another one. Signed-off-by:
-
Patrick McHardy authored
commit 9edd7ca0 upstream. As discovered by Jon Masters <jonathan@jonmasters.org>, the "untracked" conntrack, which is located in the data section, might be accidentally freed when a new namespace is instantiated while the untracked conntrack is attached to a skb because the reference count it re-initialized. The best fix would be to use a seperate untracked conntrack per namespace since it includes a namespace pointer. Unfortunately this is not possible without larger changes since the namespace is not easily available everywhere we need it. For now move the untracked conntrack initialization to the init_net setup function to make sure the reference count is not re-initialized and handle cleanup in the init_net cleanup function to make sure namespaces can exit properly while the untracked conntrack is in use in other namespaces. Signed-off-by:
-
Borislav Petkov authored
commit cab4d277 upstream. An unfortunate "WARNING" in the message amd64_edac dumps when the system doesn't support DRAM ECC or ECC checking is not enabled in the BIOS used to trigger kerneloops which qualified the message as an OOPS thus misleading the users. See, e.g. https://bugs.launchpad.net/ubuntu/+source/linux/+bug/422536 http://bugzilla.kernel.org/show_bug.cgi?id=15238 Downgrade the message level to KERN_NOTICE and fix the formulation. Signed-off-by:
Borislav Petkov <borislav.petkov@amd.com> Acked-by:
Doug Thompson <dougthompson@xmission.com> Signed-off-by:
-
Marcel Selhorst authored
commit 93716b94 upstream. When suspending, tpm_infineon calls the generic suspend function of the TPM framework. However, the TPM framework does not return and the system hangs upon suspend. When sending the necessary command "TPM_SaveState" directly within the driver, suspending and resuming works fine. Signed-off-by:
Marcel Selhorst <m.selhorst@sirrix.com> Cc: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Cc: Debora Velarde <debora@linux.vnet.ibm.com> Cc: Rajiv Andrade <srajiv@linux.vnet.ibm.com> Signed-off-by:
-
Marcelo Tosatti authored
commit ee73f656 upstream. PIT control word (address 0x43) is write-only, reads are undefined. Signed-off-by:
Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by:
-
