1. 06 Sep, 2012 13 commits
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · eeea3ac9
      Linus Torvalds authored
      Pull ARM SoC bug fixes from Olof Johansson:
       "Mostly Renesas and Atmel bugfixes this time, targeting boot and build
        problems.  A couple of patches for gemini and kirkwood as well.  On a
        whole nothing very controversial."
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: gemini: fix the gemini build
        ARM: shmobile: armadillo800eva: enable rw rootfs mount
        ARM: Kirkwood: Fix 'SZ_1M' undeclared here for db88f6281-bp-setup.c
        ARM: shmobile: mackerel: fixup usb module order
        ARM: shmobile: armadillo800eva: fixup: sound card detection order
        ARM: shmobile: marzen: fixup smsc911x id for regulator
        ARM: at91/feature-removal-schedule: delay at91_mci removal
        ARM: mach-shmobile: armadillo800eva: Enable power button as wakeup source
        ARM: mach-shmobile: armadillo800eva: Fix GPIO buttons descriptions
        ARM: at91/dts: remove partial parameter in at91sam9g25ek.dts
        ARM: at91/clock: fix PLLA overclock warning
        ARM: at91: fix rtc-at91sam9 irq issue due to sparse irq support
        ARM: at91: fix system timer irq issue due to sparse irq support
        ARM: shmobile: sh73a0: fixup RELOC_BASE of intca_irq_pins_desc
      eeea3ac9
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging · c7c6bf1e
      Linus Torvalds authored
      Pull a hwmon fix from Guenter Roeck:
       "One patch, fixing DIV_ROUND_CLOSEST to support negative dividends.
      
        While the changes are not in the drivers/hwmon directory, the problem
        primarily affects hwmon drivers, and it makes sense to push the patch
        through the hwmon tree."
      
      * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        linux/kernel.h: Fix DIV_ROUND_CLOSEST to support negative dividends
      c7c6bf1e
    • Linus Torvalds's avatar
      Merge branch 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild · bd12ce8c
      Linus Torvalds authored
      Pull kbuild fixes from Michal Marek:
       "These are two fixes that should go into 3.6.  The link-vmlinux.sh one
        is obvious.
      
        The other one fixes make firmware_install with certain configurations,
        where a file in the toplevel firmware tree gets installed first, and
        $(INSTALL_FW_PATH)/$$(dir <file>) results in /lib/firmware/./, which
        confuses make 3.82 for some reason."
      
      * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
        firmware: fix directory creation rule matching with make 3.82
        link-vmlinux.sh: Fix stray "echo" in error message
      bd12ce8c
    • Dave Jones's avatar
      Remove user-triggerable BUG from mpol_to_str · 80de7c31
      Dave Jones authored
      Trivially triggerable, found by trinity:
      
        kernel BUG at mm/mempolicy.c:2546!
        Process trinity-child2 (pid: 23988, threadinfo ffff88010197e000, task ffff88007821a670)
        Call Trace:
          show_numa_map+0xd5/0x450
          show_pid_numa_map+0x13/0x20
          traverse+0xf2/0x230
          seq_read+0x34b/0x3e0
          vfs_read+0xac/0x180
          sys_pread64+0xa2/0xc0
          system_call_fastpath+0x1a/0x1f
        RIP: mpol_to_str+0x156/0x360
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDave Jones <davej@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      80de7c31
    • Linus Torvalds's avatar
      Merge tag 'mmc-fixes-for-3.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc · 08090950
      Linus Torvalds authored
      Pull MMC fixes from Chris Ball:
       - a firmware bug on several Samsung MoviNAND eMMC models causes
         permanent corruption on the device when secure erase and secure trim
         requests are made, so we disable those requests on these eMMC devices.
       - atmel-mci: fix a hang with some SD cards by waiting for not-busy flag.
       - dw_mmc: low-power mode breaks SDIO interrupts; fix PIO error handling;
         fix handling of error interrupts.
       - mxs-mmc: fix deadlocks; fix compile error due to dma.h arch change.
       - omap: fix broken PIO mode causing memory corruption.
       - sdhci-esdhc: fix card detection.
      
      * tag 'mmc-fixes-for-3.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc:
        mmc: omap: fix broken PIO mode
        mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.
        mmc: dw_mmc: Disable low power mode if SDIO interrupts are used
        mmc: dw_mmc: fix error handling in PIO mode
        mmc: dw_mmc: correct mishandling error interrupt
        mmc: dw_mmc: amend using error interrupt status
        mmc: atmel-mci: not busy flag has also to be used for read operations
        mmc: sdhci-esdhc: break out early if clock is 0
        mmc: mxs-mmc: fix deadlock caused by recursion loop
        mmc: mxs-mmc: fix deadlock in SDIO IRQ case
        mmc: bfin_sdh: fix dma_desc_array build error
      08090950
    • Miklos Szeredi's avatar
      uml: fix compile error in deliver_alarm() · bc6c8364
      Miklos Szeredi authored
      Fix the following compile error on UML.
      
        arch/um/os-Linux/time.c: In function 'deliver_alarm':
        arch/um/os-Linux/time.c:117:3: error: too few arguments to function 'alarm_handler'
        arch/um/os-Linux/internal.h:1:6: note: declared here
      
      The error was introduced by commit d3c1cfcd ("um: pass siginfo to guest
      process") in 3.6-rc1.
      Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
      CC: Martin Pärtel <martin.partel@gmail.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      bc6c8364
    • Alan Cox's avatar
      dj: memory scribble in logi_dj · 8a55ade7
      Alan Cox authored
      Allocate a structure not a pointer to it !
      Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8a55ade7
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · cb4f9a29
      Linus Torvalds authored
      Pull powerpc fixes from Benjamin Herrenschmidt:
       "Here are a few fixes for 3.6 that were piling up while I was away or
        busy (I was mostly MIA a week or two before San Diego).
      
        Some fixes from Anton fixing up issues with our relatively new DSCR
        control feature, and a few other fixes that are either regressions or
        bugs nasty enough to warrant not waiting."
      
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
        powerpc: Don't use __put_user() in patch_instruction
        powerpc: Make sure IPI handlers see data written by IPI senders
        powerpc: Restore correct DSCR in context switch
        powerpc: Fix DSCR inheritance in copy_thread()
        powerpc: Keep thread.dscr and thread.dscr_inherit in sync
        powerpc: Update DSCR on all CPUs when writing sysfs dscr_default
        powerpc/powernv: Always go into nap mode when CPU is offline
        powerpc: Give hypervisor decrementer interrupts their own handler
        powerpc/vphn: Fix arch_update_cpu_topology() return value
      cb4f9a29
    • Linus Torvalds's avatar
      Merge tag 'gpio-fixes-for-v3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 813e6438
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "These are some GPIO regression fixes for v3.6:
         - Erroneous debug message from of_get_named_gpio_flags()
         - Make sure the MC9S08DZ60 GPIO driver depend on I2C being compiled
           in (not module) or allmodconfig breaks.
         - Check return value from irq_alloc_descs() in the Emma Mobile GPIO
           driver.
         - Assign the owner field for the rdc321x driver so the module won't
           be removed if it has active GPIOs."
      
      * tag 'gpio-fixes-for-v3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: rdc321x: Prevent removal of modules exporting active GPIOs
        gpio: em: Fix checking return value of irq_alloc_descs
        gpio: mc9s08dz60: Fix build error if I2C=m
        gpio: Fix debug message in of_get_named_gpio_flags()
      813e6438
    • Linus Torvalds's avatar
      Merge tag 'sound-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 5e682c0e
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "There are nothing scaring, contains only small fixes for HD-audio and
        USB-audio:
         - EPSS regression fix and GPIO fix for HD-audio IDT codecs
         - A series of USB-audio regression fixes that are found since 3.5
           kernel"
      
      * tag 'sound-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: snd-usb: fix cross-interface streaming devices
        ALSA: snd-usb: fix calls to next_packet_size
        ALSA: snd-usb: restore delay information
        ALSA: snd-usb: use list_for_each_safe for endpoint resources
        ALSA: snd-usb: Fix URB cancellation at stream start
        ALSA: hda - Don't trust codec EPSS bit for IDT 92HD83xx & co
        ALSA: hda - Avoid unnecessary parameter read for EPSS
        ALSA: hda - Do not set GPIOs for speakers on IDT if there are no speakers
      5e682c0e
    • Linus Torvalds's avatar
      Merge tag 'fbdev-fixes-for-3.6-1' of git://github.com/schandinat/linux-2.6 · 6d1a0503
      Linus Torvalds authored
      Pull fbdev fixes from Florian Tobias Schandinat:
       - a fix by Paul Cercueil to prevent a possible buffer overflow
       - a fix by Bruno Prémont to prevent a rare sleep in invalid context
       - a fix by Julia Lawall for a double free in auo_k190x
       - a fix by Dan Carpenter to prevent a division by zero in mb862xxfb
       - a regression fix by Tomi Valkeinen for the SDI output in OMAP
       - a fix by Grazvydas Ignotas to fix the console colors in OMAP
      
      * tag 'fbdev-fixes-for-3.6-1' of git://github.com/schandinat/linux-2.6:
        OMAPFB: fix framebuffer console colors
        OMAPDSS: Fix SDI PLL locking
        video: mb862xxfb: prevent divide by zero bug
        drivers/video/auo_k190x.c: drop kfree of devm_kzalloc's data
        fbcon: Fix bit_putcs() call to kmalloc(s, GFP_KERNEL)
        fbcon: prevent possible buffer overflow.
      6d1a0503
    • Linus Torvalds's avatar
      Merge tag 'upstream-3.6-rc5' of git://git.infradead.org/linux-ubi · 50234c58
      Linus Torvalds authored
      Pull ubi fix from Artem Bityutskiy:
       "A single small fix for memory deallocation: we allocated memory using
        'kmem_cache_alloc()' but were freeing it using 'kfree()' in some
        cases.  Now we fix this by using 'kmem_cache_free()' instead."
      
      * tag 'upstream-3.6-rc5' of git://git.infradead.org/linux-ubi:
        UBI: fix a horrible memory deallocation bug
      50234c58
    • Mikulas Patocka's avatar
      Fix order of arguments to compat_put_time[spec|val] · ed6fe9d6
      Mikulas Patocka authored
      Commit 644595f8 ("compat: Handle COMPAT_USE_64BIT_TIME in
      net/socket.c") introduced a bug where the helper functions to take
      either a 64-bit or compat time[spec|val] got the arguments in the wrong
      order, passing the kernel stack pointer off as a user pointer (and vice
      versa).
      
      Because of the user address range check, that in turn then causes an
      EFAULT due to the user pointer range checking failing for the kernel
      address.  Incorrectly resuling in a failed system call for 32-bit
      processes with a 64-bit kernel.
      
      On odder architectures like HP-PA (with separate user/kernel address
      spaces), it can be used read kernel memory.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ed6fe9d6
  2. 05 Sep, 2012 11 commits
  3. 04 Sep, 2012 12 commits
    • Paul Walmsley's avatar
      mmc: omap: fix broken PIO mode · 75b53aee
      Paul Walmsley authored
      After commit 26b88520 ("mmc:
      omap_hsmmc: remove private DMA API implementation"), the Nokia N800
      here stopped booting:
      
      [    2.086181] Waiting for root device /dev/mmcblk0p1...
      [    2.324066] Unhandled fault: imprecise external abort (0x406) at 0x00000000
      [    2.331451] Internal error: : 406 [#1] ARM
      [    2.335784] Modules linked in:
      [    2.339050] CPU: 0    Not tainted  (3.6.0-rc3 #60)
      [    2.344146] PC is at default_idle+0x28/0x30
      [    2.348602] LR is at trace_hardirqs_on_caller+0x15c/0x1b0
      
      ...
      
      This turned out to be due to memory corruption caused by long-broken
      PIO code in drivers/mmc/host/omap.c.  (Previously, this driver had
      been using DMA; but the above commit caused the MMC driver to fall
      back to PIO mode with an unmodified Kconfig.)
      
      The PIO code, added with the rest of the driver in commit
      730c9b7e ("[MMC] Add OMAP MMC host
      driver"), confused bytes with 16-bit words.  This bug caused memory
      located after the PIO transfer buffer to be corrupted with transfers
      larger than 32 bytes.  The driver also did not increment the buffer
      pointer after the transfer occurred.  This bug resulted in data
      corruption during any transfer larger than 64 bytes.
      Signed-off-by: default avatarPaul Walmsley <paul@pwsan.com>
      Reviewed-by: default avatarFelipe Balbi <balbi@ti.com>
      Tested-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarChris Ball <cjb@laptop.org>
      75b53aee
    • Ian Chen's avatar
      mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption. · 3550ccdb
      Ian Chen authored
      For several MoviNAND eMMC parts, there are known issues with secure
      erase and secure trim.  For these specific MoviNAND devices, we skip
      these operations.
      
      Specifically, there is a bug in the eMMC firmware that causes
      unrecoverable corruption when the MMC is erased with MMC_CAP_ERASE
      enabled.
      
      References:
      
      http://forum.xda-developers.com/showthread.php?t=1644364
      https://plus.google.com/111398485184813224730/posts/21pTYfTsCkB#111398485184813224730/posts/21pTYfTsCkBSigned-off-by: default avatarIan Chen <ian.cy.chen@samsung.com>
      Reviewed-by: default avatarNamjae Jeon <linkinjeon@gmail.com>
      Acked-by: default avatarJaehoon Chung <jh80.chung@samsung.com>
      Reviewed-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Cc: stable <stable@vger.kernel.org> [3.0+]
      Signed-off-by: default avatarChris Ball <cjb@laptop.org>
      3550ccdb
    • Doug Anderson's avatar
      mmc: dw_mmc: Disable low power mode if SDIO interrupts are used · 9623b5b9
      Doug Anderson authored
      The documentation for the dw_mmc part says that the low power
      mode should normally only be set for MMC and SD memory and should
      be turned off for SDIO cards that need interrupts detected.
      
      The best place I could find to do this is when the SDIO interrupt
      was first enabled.  I rely on the fact that dw_mci_setup_bus()
      will be called when it's time to reenable.
      Signed-off-by: default avatarDoug Anderson <dianders@chromium.org>
      Acked-by: default avatarSeungwon Jeon <tgih.jun@samsung.com>
      Signed-off-by: default avatarChris Ball <cjb@laptop.org>
      9623b5b9
    • Seungwon Jeon's avatar
      mmc: dw_mmc: fix error handling in PIO mode · e74f3a9c
      Seungwon Jeon authored
      Data transfer will be continued until all the bytes are transmitted,
      even if data crc error occurs during a multiple-block data transfer.
      This means RXDR/TXDR interrupts will occurs until data transfer is
      terminated. Early setting of host->sg to NULL prevents going into
      xxx_data_pio functions, hence permanent unhandled RXDR/TXDR interrupts
      occurs. And checking error interrupt status in the xxx_data_pio functions
      is no need because dw_mci_interrupt does do the same. This patch also
      removes it.
      Signed-off-by: default avatarSeungwon Jeon <tgih.jun@samsung.com>
      Acked-by: default avatarJaehoon Chung <jh80.chung@samsung.com>
      Acked-by: default avatarWill Newton <will.newton@imgtec.com>
      Signed-off-by: default avatarChris Ball <cjb@laptop.org>
      e74f3a9c
    • Seungwon Jeon's avatar
      mmc: dw_mmc: correct mishandling error interrupt · 9b2026a1
      Seungwon Jeon authored
      Datasheet of SYNOPSYS mentions that DTO(Data Transfer Over) interrupt
      will be raised even if some error interrupts, however it is actually
      found that DTO does not occur. SYNOPSYS has confirmed this issue.
      Current implementation defers the call of tasklet_schedule until DTO
      when the error interrupts is happened. This patch fixes error handling.
      Signed-off-by: default avatarSeungwon Jeon <tgih.jun@samsung.com>
      Acked-by: default avatarJaehoon Chung <jh80.chung@samsung.com>
      Acked-by: default avatarWill Newton <will.newton@imgtec.com>
      Signed-off-by: default avatarChris Ball <cjb@laptop.org>
      9b2026a1
    • Seungwon Jeon's avatar
      mmc: dw_mmc: amend using error interrupt status · 182c9081
      Seungwon Jeon authored
      RINTSTS status includes masked interrupts as well as unmasked.
      data_status and cmd_status are set by value of RINTSTS in interrupt handler
      and tasklet finally uses it to decide whether error is happened or not.
      In addition, MINTSTS status is used for setting data_status in PIO.
      Masked error interrupt will not be handled and that status can be considered
      non-error case.
      Signed-off-by: default avatarSeungwon Jeon <tgih.jun@samsung.com>
      Reviewed By: Girish K S <girish.shivananjappa@linaro.org>
      Acked-by: default avatarJaehoon Chung <jh80.chung@samsung.com>
      Acked-by: default avatarWill Newton <will.newton@imgtec.com>
      Signed-off-by: default avatarChris Ball <cjb@laptop.org>
      182c9081
    • Ludovic Desroches's avatar
      mmc: atmel-mci: not busy flag has also to be used for read operations · 077d4073
      Ludovic Desroches authored
      Even if the datasheet says that the not busy flag has to be used only
      for write operations, it's false except for version lesser than v2xx.
      
      Not waiting on the not busy flag for read operations can cause the
      controller to hang-up during the initialization of some SD cards
      with DMA after the first CMD6 -- the next command is sent too early.
      Signed-off-by: default avatarLudovic Desroches <ludovic.desroches@atmel.com>
      Cc: stable <stable@vger.kernel.org> [3.5, 3.6]
      Signed-off-by: default avatarChris Ball <cjb@laptop.org>
      077d4073
    • Shawn Guo's avatar
      mmc: sdhci-esdhc: break out early if clock is 0 · 74f330bc
      Shawn Guo authored
      Since commit 30832ab5 ("mmc: sdhci: Always pass clock request value
      zero to set_clock host op") was merged, esdhc_set_clock starts hitting
      "if (clock == 0)" where ESDHC_SYSTEM_CONTROL has been operated.  This
      causes SDHCI card-detection function being broken.  Fix the regression
      by moving "if (clock == 0)" above ESDHC_SYSTEM_CONTROL operation.
      Signed-off-by: default avatarShawn Guo <shawn.guo@linaro.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarChris Ball <cjb@laptop.org>
      74f330bc
    • Lauri Hintsala's avatar
      mmc: mxs-mmc: fix deadlock caused by recursion loop · fc108d24
      Lauri Hintsala authored
      Release the lock before mmc_signal_sdio_irq is called by
      mxs_mmc_enable_sdio_irq.
      
      Backtrace:
      [   65.470000] =============================================
      [   65.470000] [ INFO: possible recursive locking detected ]
      [   65.470000] 3.5.0-rc5 #2 Not tainted
      [   65.470000] ---------------------------------------------
      [   65.470000] ksdioirqd/mmc0/73 is trying to acquire lock:
      [   65.470000]  (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
      [   65.470000]
      [   65.470000] but task is already holding lock:
      [   65.470000]  (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
      [   65.470000]
      [   65.470000] other info that might help us debug this:
      [   65.470000]  Possible unsafe locking scenario:
      [   65.470000]
      [   65.470000]        CPU0
      [   65.470000]        ----
      [   65.470000]   lock(&(&host->lock)->rlock#2);
      [   65.470000]   lock(&(&host->lock)->rlock#2);
      [   65.470000]
      [   65.470000]  *** DEADLOCK ***
      [   65.470000]
      [   65.470000]  May be due to missing lock nesting notation
      [   65.470000]
      [   65.470000] 1 lock held by ksdioirqd/mmc0/73:
      [   65.470000]  #0:  (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
      [   65.470000]
      [   65.470000] stack backtrace:
      [   65.470000] [<c0014990>] (unwind_backtrace+0x0/0xf4) from [<c005ccb8>] (__lock_acquire+0x14f8/0x1b98)
      [   65.470000] [<c005ccb8>] (__lock_acquire+0x14f8/0x1b98) from [<c005d3f8>] (lock_acquire+0xa0/0x108)
      [   65.470000] [<c005d3f8>] (lock_acquire+0xa0/0x108) from [<c02f671c>] (_raw_spin_lock_irqsave+0x48/0x5c)
      [   65.470000] [<c02f671c>] (_raw_spin_lock_irqsave+0x48/0x5c) from [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc])
      [   65.470000] [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc])
      [   65.470000] [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [<c0219b38>] (sdio_irq_thread+0x1bc/0x274)
      [   65.470000] [<c0219b38>] (sdio_irq_thread+0x1bc/0x274) from [<c003c324>] (kthread+0x8c/0x98)
      [   65.470000] [<c003c324>] (kthread+0x8c/0x98) from [<c00101ac>] (kernel_thread_exit+0x0/0x8)
      [   65.470000] BUG: spinlock lockup suspected on CPU#0, ksdioirqd/mmc0/73
      [   65.470000]  lock: 0xc3358724, .magic: dead4ead, .owner: ksdioirqd/mmc0/73, .owner_cpu: 0
      [   65.470000] [<c0014990>] (unwind_backtrace+0x0/0xf4) from [<c01b46b0>] (do_raw_spin_lock+0x100/0x144)
      [   65.470000] [<c01b46b0>] (do_raw_spin_lock+0x100/0x144) from [<c02f6724>] (_raw_spin_lock_irqsave+0x50/0x5c)
      [   65.470000] [<c02f6724>] (_raw_spin_lock_irqsave+0x50/0x5c) from [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc])
      [   65.470000] [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc])
      [   65.470000] [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [<c0219b38>] (sdio_irq_thread+0x1bc/0x274)
      [   65.470000] [<c0219b38>] (sdio_irq_thread+0x1bc/0x274) from [<c003c324>] (kthread+0x8c/0x98)
      [   65.470000] [<c003c324>] (kthread+0x8c/0x98) from [<c00101ac>] (kernel_thread_exit+0x0/0x8)
      Reported-by: default avatarAttila Kinali <attila@kinali.ch>
      Signed-off-by: default avatarLauri Hintsala <lauri.hintsala@bluegiga.com>
      Acked-by: default avatarShawn Guo <shawn.guo@linaro.org>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarChris Ball <cjb@laptop.org>
      fc108d24
    • Lauri Hintsala's avatar
      mmc: mxs-mmc: fix deadlock in SDIO IRQ case · 1af36b2a
      Lauri Hintsala authored
      Release the lock before mmc_signal_sdio_irq is called by mxs_mmc_irq_handler.
      
      Backtrace:
      [   79.660000] =============================================
      [   79.660000] [ INFO: possible recursive locking detected ]
      [   79.660000] 3.4.0-00009-g3e96082-dirty #11 Not tainted
      [   79.660000] ---------------------------------------------
      [   79.660000] swapper/0 is trying to acquire lock:
      [   79.660000]  (&(&host->lock)->rlock#2){-.....}, at: [<c026ea3c>] mxs_mmc_enable_sdio_irq+0x18/0xd4
      [   79.660000]
      [   79.660000] but task is already holding lock:
      [   79.660000]  (&(&host->lock)->rlock#2){-.....}, at: [<c026f744>] mxs_mmc_irq_handler+0x1c/0xe8
      [   79.660000]
      [   79.660000] other info that might help us debug this:
      [   79.660000]  Possible unsafe locking scenario:
      [   79.660000]
      [   79.660000]        CPU0
      [   79.660000]        ----
      [   79.660000]   lock(&(&host->lock)->rlock#2);
      [   79.660000]   lock(&(&host->lock)->rlock#2);
      [   79.660000]
      [   79.660000]  *** DEADLOCK ***
      [   79.660000]
      [   79.660000]  May be due to missing lock nesting notation
      [   79.660000]
      [   79.660000] 1 lock held by swapper/0:
      [   79.660000]  #0:  (&(&host->lock)->rlock#2){-.....}, at: [<c026f744>] mxs_mmc_irq_handler+0x1c/0xe8
      [   79.660000]
      [   79.660000] stack backtrace:
      [   79.660000] [<c0014bd0>] (unwind_backtrace+0x0/0xf4) from [<c005f9c0>] (__lock_acquire+0x1948/0x1d48)
      [   79.660000] [<c005f9c0>] (__lock_acquire+0x1948/0x1d48) from [<c005fea0>] (lock_acquire+0xe0/0xf8)
      [   79.660000] [<c005fea0>] (lock_acquire+0xe0/0xf8) from [<c03a8460>] (_raw_spin_lock_irqsave+0x44/0x58)
      [   79.660000] [<c03a8460>] (_raw_spin_lock_irqsave+0x44/0x58) from [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4)
      [   79.660000] [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4) from [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8)
      [   79.660000] [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8) from [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254)
      [   79.660000] [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254) from [<c006bff8>] (handle_irq_event+0x3c/0x5c)
      [   79.660000] [<c006bff8>] (handle_irq_event+0x3c/0x5c) from [<c006e6d0>] (handle_level_irq+0x90/0x110)
      [   79.660000] [<c006e6d0>] (handle_level_irq+0x90/0x110) from [<c006b930>] (generic_handle_irq+0x38/0x50)
      [   79.660000] [<c006b930>] (generic_handle_irq+0x38/0x50) from [<c00102fc>] (handle_IRQ+0x30/0x84)
      [   79.660000] [<c00102fc>] (handle_IRQ+0x30/0x84) from [<c000f058>] (__irq_svc+0x38/0x60)
      [   79.660000] [<c000f058>] (__irq_svc+0x38/0x60) from [<c0010520>] (default_idle+0x2c/0x40)
      [   79.660000] [<c0010520>] (default_idle+0x2c/0x40) from [<c0010a90>] (cpu_idle+0x64/0xcc)
      [   79.660000] [<c0010a90>] (cpu_idle+0x64/0xcc) from [<c04ff858>] (start_kernel+0x244/0x2c8)
      [   79.660000] BUG: spinlock lockup on CPU#0, swapper/0
      [   79.660000]  lock: c398cb2c, .magic: dead4ead, .owner: swapper/0, .owner_cpu: 0
      [   79.660000] [<c0014bd0>] (unwind_backtrace+0x0/0xf4) from [<c01ddb1c>] (do_raw_spin_lock+0xf0/0x144)
      [   79.660000] [<c01ddb1c>] (do_raw_spin_lock+0xf0/0x144) from [<c03a8468>] (_raw_spin_lock_irqsave+0x4c/0x58)
      [   79.660000] [<c03a8468>] (_raw_spin_lock_irqsave+0x4c/0x58) from [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4)
      [   79.660000] [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4) from [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8)
      [   79.660000] [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8) from [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254)
      [   79.660000] [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254) from [<c006bff8>] (handle_irq_event+0x3c/0x5c)
      [   79.660000] [<c006bff8>] (handle_irq_event+0x3c/0x5c) from [<c006e6d0>] (handle_level_irq+0x90/0x110)
      [   79.660000] [<c006e6d0>] (handle_level_irq+0x90/0x110) from [<c006b930>] (generic_handle_irq+0x38/0x50)
      [   79.660000] [<c006b930>] (generic_handle_irq+0x38/0x50) from [<c00102fc>] (handle_IRQ+0x30/0x84)
      [   79.660000] [<c00102fc>] (handle_IRQ+0x30/0x84) from [<c000f058>] (__irq_svc+0x38/0x60)
      [   79.660000] [<c000f058>] (__irq_svc+0x38/0x60) from [<c0010520>] (default_idle+0x2c/0x40)
      [   79.660000] [<c0010520>] (default_idle+0x2c/0x40) from [<c0010a90>] (cpu_idle+0x64/0xcc)
      [   79.660000] [<c0010a90>] (cpu_idle+0x64/0xcc) from [<c04ff858>] (start_kernel+0x244/0x2c8)
      Signed-off-by: default avatarLauri Hintsala <lauri.hintsala@bluegiga.com>
      Acked-by: default avatarShawn Guo <shawn.guo@linaro.org>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarChris Ball <cjb@laptop.org>
      1af36b2a
    • Sonic Zhang's avatar
      mmc: bfin_sdh: fix dma_desc_array build error · 660d9a9c
      Sonic Zhang authored
      Descriptor array structure has been moved into blackfin dma.h head file.
      This patch fix below error:
      
      drivers/mmc/host/bfin_sdh.c:52:8: error: redefinition of 'struct
      dma_desc_array'
      make[4]: *** [drivers/mmc/host/bfin_sdh.o] Error 1
      Signed-off-by: default avatarSonic Zhang <sonic.zhang@analog.com>
      Signed-off-by: default avatarBob Liu <lliubbo@gmail.com>
      Signed-off-by: default avatarChris Ball <cjb@laptop.org>
      660d9a9c
    • Artem Bityutskiy's avatar
      UBI: fix a horrible memory deallocation bug · 78b495c3
      Artem Bityutskiy authored
      UBI was mistakingly using 'kfree()' instead of 'kmem_cache_free()' when
      freeing "attach eraseblock" structures in vtbl.c. Thankfully, this happened
      only when we were doing auto-format, so many systems were unaffected. However,
      there are still many users affected.
      
      It is strange, but the system did not crash and nothing bad happened when
      the SLUB memory allocator was used. However, in case of SLOB we observed an
      crash right away.
      
      This problem was introduced in 2.6.39 by commit
      "6c1e875c UBI: add slab cache for ubi_scan_leb objects"
      
      A note for stable trees:
        Because variable were renamed, this won't cleanly apply to older kernels.
        Changing names like this should help:
      	1. ai -> si
      	2. aeb_slab_cache -> seb_slab_cache
      	3. new_aeb -> new_seb
      Reported-by: default avatarRichard Genoud <richard.genoud@gmail.com>
      Tested-by: default avatarRichard Genoud <richard.genoud@gmail.com>
      Tested-by: default avatarArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
      Cc: stable@vger.kernel.org [v2.6.39+]
      Signed-off-by: default avatarArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
      78b495c3
  4. 03 Sep, 2012 1 commit
  5. 02 Sep, 2012 3 commits
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 · 5b716ac7
      Linus Torvalds authored
      Pull CIFS fixes from Steve French.
      
      * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
        CIFS: Fix cifs_do_create error hadnling
        cifs: print error code if smb signature verification fails
        CIFS: Fix log messages in packet checking for SMB2
        CIFS: Protect i_nlink from being negative
      5b716ac7
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 0b1a34c9
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) NLA_PUT* --> nla_put_* conversion got one case wrong in
          nfnetlink_log, fix from Patrick McHardy.
      
       2) Missed error return check in ipw2100 driver, from Julia Lawall.
      
       3) PMTU updates in ipv4 were setting the expiry time incorrectly, fix
          from Eric Dumazet.
      
       4) SFC driver erroneously reversed src and dst when reporting filters
          via ethtool.
      
       5) Memory leak in CAN protocol and wrong setting of IRQF_SHARED in
          sja1000 can platform driver, from Alexey Khoroshilov and Sven
          Schmitt.
      
       6) Fix multicast traffic scaling regression in ipv4_dst_destroy, only
          take the lock when we really need to.  From Eric Dumazet.
      
       7) Fix non-root process spoofing in netlink, from Pablo Neira Ayuso.
      
       8) CWND reduction in TCP is done incorrectly during non-SACK recovery,
          fix from Yuchung Cheng.
      
       9) Revert netpoll change, and fix what was actually a driver specific
          problem.  From Amerigo Wang.  This should cure bootup hangs with
          netconsole some people reported.
      
      10) Fix xen-netfront invoking __skb_fill_page_desc() with a NULL page
          pointer.  From Ian Campbell.
      
      11) SIP NAT fix for expectiontation creation, from Pablo Neira Ayuso.
      
      12) __ip_rt_update_pmtu() needs RCU locking, from Eric Dumazet.
      
      13) Fix usbnet deadlock on resume, can't use GFP_KERNEL in this
          situation.  From Oliver Neukum.
      
      14) The davinci ethernet driver triggers an OOPS on removal because it
          frees an MDIO object before unregistering it.  Fix from Bin Liu.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (41 commits)
        net: qmi_wwan: add several new Gobi devices
        fddi: 64 bit bug in smt_add_para()
        net: ethernet: fix kernel OOPS when remove davinci_mdio module
        net/xfrm/xfrm_state.c: fix error return code
        net: ipv6: fix error return code
        net: qmi_wwan: new device: Foxconn/Novatel E396
        usbnet: fix deadlock in resume
        cs89x0 : packet reception not working
        netfilter: nf_conntrack: fix racy timer handling with reliable events
        bnx2x: Correct the ndo_poll_controller call
        bnx2x: Move netif_napi_add to the open call
        ipv4: must use rcu protection while calling fib_lookup
        bnx2x: fix 57840_MF pci id
        net: ipv4: ipmr_expire_timer causes crash when removing net namespace
        e1000e: DoS while TSO enabled caused by link partner with small MSS
        l2tp: avoid to use synchronize_rcu in tunnel free function
        gianfar: fix default tx vlan offload feature flag
        netfilter: nf_nat_sip: fix incorrect handling of EBUSY for RTCP expectation
        xen-netfront: use __pskb_pull_tail to ensure linear area is big enough on RX
        netfilter: nfnetlink_log: fix error return code in init path
        ...
      0b1a34c9
    • Olof Johansson's avatar
      3729d4a4