1. 16 Jun, 2013 1 commit
  2. 12 Jun, 2013 1 commit
  3. 11 Jun, 2013 2 commits
  4. 10 Jun, 2013 2 commits
  5. 07 Jun, 2013 1 commit
    • Lai Jiangshan's avatar
      clk: remove notifier from list before freeing it · 72b5322f
      Lai Jiangshan authored
      The @cn is stay in @clk_notifier_list after it is freed, it cause
      memory corruption.
      
      Example, if @clk is registered(first), unregistered(first),
      registered(second), unregistered(second).
      
      The freed @cn will be used when @clk is registered(second),
      and the bug will be happened when @clk is unregistered(second):
      
      [  517.040000] clk_notif_dbg clk_notif_dbg.1: clk_notifier_unregister()
      [  517.040000] Unable to handle kernel paging request at virtual address 00df3008
      [  517.050000] pgd = ed858000
      [  517.050000] [00df3008] *pgd=00000000
      [  517.060000] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
      [  517.060000] Modules linked in: clk_notif_dbg(O-) [last unloaded: clk_notif_dbg]
      [  517.060000] CPU: 1 PID: 499 Comm: modprobe Tainted: G           O 3.10.0-rc3-00119-ga93cb29a-dirty #85
      [  517.060000] task: ee1e0180 ti: ee3e6000 task.ti: ee3e6000
      [  517.060000] PC is at srcu_readers_seq_idx+0x48/0x84
      [  517.060000] LR is at srcu_readers_seq_idx+0x60/0x84
      [  517.060000] pc : [<c0052720>]    lr : [<c0052738>]    psr: 80070013
      [  517.060000] sp : ee3e7d48  ip : 00000000  fp : ee3e7d6c
      [  517.060000] r10: 00000000  r9 : ee3e6000  r8 : 00000000
      [  517.060000] r7 : ed84fe4c  r6 : c068ec90  r5 : c068e430  r4 : 00000000
      [  517.060000] r3 : 00df3000  r2 : 00000000  r1 : 00000002  r0 : 00000000
      [  517.060000] Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
      [  517.060000] Control: 18c5387d  Table: 2d85804a  DAC: 00000015
      [  517.060000] Process modprobe (pid: 499, stack limit = 0xee3e6238)
      [  517.060000] Stack: (0xee3e7d48 to 0xee3e8000)
      ....
      [  517.060000] [<c0052720>] (srcu_readers_seq_idx+0x48/0x84) from [<c0052790>] (try_check_zero+0x34/0xfc)
      [  517.060000] [<c0052790>] (try_check_zero+0x34/0xfc) from [<c00528b0>] (srcu_advance_batches+0x58/0x114)
      [  517.060000] [<c00528b0>] (srcu_advance_batches+0x58/0x114) from [<c0052c30>] (__synchronize_srcu+0x114/0x1ac)
      [  517.060000] [<c0052c30>] (__synchronize_srcu+0x114/0x1ac) from [<c0052d14>] (synchronize_srcu+0x2c/0x34)
      [  517.060000] [<c0052d14>] (synchronize_srcu+0x2c/0x34) from [<c0053a08>] (srcu_notifier_chain_unregister+0x68/0x74)
      [  517.060000] [<c0053a08>] (srcu_notifier_chain_unregister+0x68/0x74) from [<c0375a78>] (clk_notifier_unregister+0x7c/0xc0)
      [  517.060000] [<c0375a78>] (clk_notifier_unregister+0x7c/0xc0) from [<bf008034>] (clk_notif_dbg_remove+0x34/0x9c [clk_notif_dbg])
      [  517.060000] [<bf008034>] (clk_notif_dbg_remove+0x34/0x9c [clk_notif_dbg]) from [<c02bb974>] (platform_drv_remove+0x24/0x28)
      [  517.060000] [<c02bb974>] (platform_drv_remove+0x24/0x28) from [<c02b9bf8>] (__device_release_driver+0x8c/0xd4)
      [  517.060000] [<c02b9bf8>] (__device_release_driver+0x8c/0xd4) from [<c02ba680>] (driver_detach+0x9c/0xc4)
      [  517.060000] [<c02ba680>] (driver_detach+0x9c/0xc4) from [<c02b99c4>] (bus_remove_driver+0xcc/0xfc)
      [  517.060000] [<c02b99c4>] (bus_remove_driver+0xcc/0xfc) from [<c02bace4>] (driver_unregister+0x54/0x78)
      [  517.060000] [<c02bace4>] (driver_unregister+0x54/0x78) from [<c02bbb44>] (platform_driver_unregister+0x1c/0x20)
      [  517.060000] [<c02bbb44>] (platform_driver_unregister+0x1c/0x20) from [<bf0081f8>] (clk_notif_dbg_driver_exit+0x14/0x1c [clk_notif_dbg])
      [  517.060000] [<bf0081f8>] (clk_notif_dbg_driver_exit+0x14/0x1c [clk_notif_dbg]) from [<c00835e4>] (SyS_delete_module+0x200/0x28c)
      [  517.060000] [<c00835e4>] (SyS_delete_module+0x200/0x28c) from [<c000edc0>] (ret_fast_syscall+0x0/0x48)
      [  517.060000] Code: e5973004 e7911102 e0833001 e2881002 (e7933101)
      
      Cc: stable@kernel.org
      Reported-by: default avatarSören Brinkmann <soren.brinkmann@xilinx.com>
      Signed-off-by: default avatarLai Jiangshan <laijs@cn.fujitsu.com>
      Tested-by: default avatarSören Brinkmann <soren.brinkmann@xilinx.com>
      Signed-off-by: default avatarMike Turquette <mturquette@linaro.org>
      [mturquette@linaro.org: shortened $SUBJECT]
      72b5322f
  6. 02 Jun, 2013 1 commit
  7. 01 Jun, 2013 16 commits
    • Linus Torvalds's avatar
      Merge branch 'for-3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · cc863973
      Linus Torvalds authored
      Pull parisc fixes from Helge Deller:
       "This patcheset includes fixes for:
      
         - the PCI/LBA which brings back the stifb graphics framebuffer
           console
         - possible memory overflows in parisc kernel init code
         - parport support on older GSC machines
         - avoids that users by mistake enable PARPORT_PC_SUPERIO on parisc
         - MAINTAINERS file list updates for parisc."
      
      * 'for-3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: parport0: fix this legacy no-device port driver!
        parport_pc: disable PARPORT_PC_SUPERIO on parisc architecture
        parisc/PCI: lba: fix: convert to pci_create_root_bus() for correct root bus resources (v2)
        parisc/PCI: Set type for LBA bus_num resource
        MAINTAINERS: update parisc architecture file list
        parisc: kernel: using strlcpy() instead of strcpy()
        parisc: rename "CONFIG_PA7100" to "CONFIG_PA7000"
        parisc: fix kernel BUG at arch/parisc/include/asm/mmzone.h:50
        parisc: memory overflow, 'name' length is too short for using
      cc863973
    • Helge Deller's avatar
      parisc: parport0: fix this legacy no-device port driver! · 4edb3869
      Helge Deller authored
      Fix the above kernel error from parport_announce_port() on 32bit GSC
      machines (e.g. B160L). The parport driver requires now a pointer to the
      device struct.
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      4edb3869
    • Helge Deller's avatar
      parport_pc: disable PARPORT_PC_SUPERIO on parisc architecture · c218c713
      Helge Deller authored
      If enabled, CONFIG_PARPORT_PC_SUPERIO scans on PC-like hardware for
      various super-io chips by accessing i/o ports in a range which will
      crash any parisc hardware at once.
      
      In addition, parisc has it's own incompatible superio chip
      (CONFIG_SUPERIO), so if we disable PARPORT_PC_SUPERIO completely for
      parisc we can avoid that people by accident enable the parport_pc
      superio option too.
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      c218c713
    • Helge Deller's avatar
      parisc/PCI: lba: fix: convert to pci_create_root_bus() for correct root bus resources (v2) · b204a4d2
      Helge Deller authored
      commit dc7dce28
      Author: Bjorn Helgaas <bhelgaas@google.com>
      Date:   Fri Oct 28 16:27:27 2011 -0600
         parisc/PCI: lba: convert to pci_create_root_bus() for correct root bus
                          resources
      
        Supply root bus resources to pci_create_root_bus() so they're correct
        immediately.  This fixes the problem of "early" and "header" quirks seeing
        incorrect root bus resources.
      
      added tests for elmmio_space.start while it should use
      elmmio_space.flags.  This for example led to incorrect resource
      assignments and a non-working stifb framebuffer on most parisc machines.
      
      LBA 10:1: PCI host bridge to bus 0000:01
      pci_bus 0000:01: root bus resource [io  0x12000-0x13fff] (bus address [0x2000-0x3fff])
      pci_bus 0000:01: root bus resource [mem 0xfffffffffa000000-0xfffffffffbffffff] (bus address [0xfa000000-0xfbffffff])
      pci_bus 0000:01: root bus resource [mem 0xfffffffff4800000-0xfffffffff4ffffff] (bus address [0xf4800000-0xf4ffffff])
      pci_bus 0000:01: root bus resource [??? 0x00000001 flags 0x0]
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      Acked-by: default avatarBjorn Helgaas <bhelgaas@google.com>
      b204a4d2
    • Bjorn Helgaas's avatar
      parisc/PCI: Set type for LBA bus_num resource · b47d4934
      Bjorn Helgaas authored
      The non-PAT resource probing code failed to set the type of the LBA bus_num
      resource (30aa80da "parisc/PCI: register busn_res for root buses" did
      the corresponding thing for the PAT case).
      
      This causes incorrect resource assignments and a non-working stifb
      framebuffer on most parisc machines.
      Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      b47d4934
    • Helge Deller's avatar
      2b6bac9e
    • Chen Gang's avatar
      parisc: kernel: using strlcpy() instead of strcpy() · ea99b1ad
      Chen Gang authored
      'boot_args' is an input args, and 'boot_command_line' has a fix length.
      So use strlcpy() instead of strcpy() to avoid memory overflow.
      Signed-off-by: default avatarChen Gang <gang.chen@asianux.com>
      Acked-by: default avatarKyle McMartin <kyle@mcmartin.ca>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      ea99b1ad
    • Paul Bolle's avatar
      parisc: rename "CONFIG_PA7100" to "CONFIG_PA7000" · 76603902
      Paul Bolle authored
      There's a Makefile line setting cflags for CONFIG_PA7100. But that
      Kconfig macro doesn't exist. There is a Kconfig symbol PA7000, which
      covers both PA7000 and PA7100 processors. So let's use the corresponding
      Kconfig macro.
      Signed-off-by: default avatarPaul Bolle <pebolle@tiscali.nl>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      76603902
    • Helge Deller's avatar
      parisc: fix kernel BUG at arch/parisc/include/asm/mmzone.h:50 · ae249b5f
      Helge Deller authored
      With CONFIG_DISCONTIGMEM=y and multiple physical memory areas,
      cat /proc/kpageflags triggers this kernel bug:
      
      kernel BUG at arch/parisc/include/asm/mmzone.h:50!
      CPU: 2 PID: 7848 Comm: cat Tainted: G      D W 3.10.0-rc3-64bit #44
       IAOQ[0]: kpageflags_read0x128/0x238
       IAOQ[1]: kpageflags_read0x12c/0x238
       RP(r2): proc_reg_read0xbc/0x130
      Backtrace:
       [<00000000402ca2d4>] proc_reg_read0xbc/0x130
       [<0000000040235bcc>] vfs_read0xc4/0x1d0
       [<0000000040235f0c>] SyS_read0x94/0xf0
       [<0000000040105fc0>] syscall_exit0x0/0x14
      
      kpageflags_read() walks through the whole memory, even if some memory
      areas are physically not available. So, we should better not BUG on an
      unavailable pfn in pfn_to_nid() but just return the expected value -1 or
      0.
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      ae249b5f
    • Chen Gang's avatar
      parisc: memory overflow, 'name' length is too short for using · 3f108de9
      Chen Gang authored
      'path.bc[i]' can be asigned by PCI_SLOT() which can '> 10', so sizeof(6
      * "%u:" + "%u" + '\0') may be 21.
      
      Since 'name' length is 20, it may be memory overflow.
      
      And 'path.bc[i]' is 'unsigned char' for printing, we can be sure the
      max length of 'name' must be less than 28.
      
      So simplify thinking, we can use 28 instead of 20 directly, and do not
      think of whether 'patchc.bc[i]' can '> 100'.
      Signed-off-by: default avatarChen Gang <gang.chen@asianux.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      3f108de9
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · aa3ae6de
      Linus Torvalds authored
      Pull powerpc fixes from Ben Herrenschmidt:
       "Here are a few more fixes for powerpc 3.10.  It's a bit more than I
        would have liked this late in the game but I suppose that's what
        happens with a brand new chip generation coming out.
      
        A few regression fixes, some last minute fixes for new P8 features
        such as transactional memory,...
      
        There's also one powerpc KVM patch that I requested that adds two
        missing functions to our in-kernel interrupt controller support which
        is itself a new 3.10 feature.  These are defined by the base
        hypervisor specification.  We didn't implement them originally because
        Linux doesn't use them but they are simple and I'm not comfortable
        having a half-implemented interface in 3.10 and having to deal with
        versionning etc...  later when something starts needing those calls.
        They cannot be emulated in qemu when using in-kernel interrupt
        controller (not enough shared state).
      
        Just added a last minute patch to fix a typo introducing a breakage in
        our cputable for Power7+ processors, sorry about that, but the
        regression it fixes just hurt me :-)"
      
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
        powerpc/cputable: Fix typo on P7+ cputable entry
        powerpc/perf: Add missing SIER support
        powerpc/perf: Revert to original NO_SIPR logic
        powerpc/pci: Remove the unused variables in pci_process_bridge_OF_ranges
        powerpc/pci: Remove the stale comments of pci_process_bridge_OF_ranges
        powerpc/pseries: Always enable CONFIG_HOTPLUG_CPU on PSERIES SMP
        powerpc/kvm/book3s: Add support for H_IPOLL and H_XIRR_X in XICS emulation
        powerpc/32bit:Store temporary result in r0 instead of r8
        powerpc/mm: Always invalidate tlb on hpte invalidate and update
        powerpc/pseries: Improve stream generation comments in copypage/user
        powerpc/pseries: Kill all prefetch streams on context switch
        powerpc/cputable: Fix oprofile_cpu_type on power8
        powerpc/mpic: Fix irq distribution problem when MPIC_SINGLE_DEST_CPU
        powerpc/tm: Fix userspace stack corruption on signal delivery for active transactions
        powerpc/tm: Move TM abort cause codes to uapi
        powerpc/tm: Abort on emulation and alignment faults
        powerpc/tm: Update cause codes documentation
        powerpc/tm: Make room for hypervisor in abort cause codes
      aa3ae6de
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · 008bd2de
      Linus Torvalds authored
      Pull scsi target fixes from Nicholas Bellinger:
       "The highlights include:
      
         - Re-instate sess->wait_list in target_wait_for_sess_cmds() for
           active I/O shutdown handling in fabrics using se_cmd->cmd_kref
         - Make ib_srpt call target_sess_cmd_list_set_waiting() during session
           shutdown
         - Fix FILEIO off-by-one READ_CAPACITY bug for !S_ISBLK export
         - Fix iscsi-target login error heap buffer overflow (Kees)
         - Fix iscsi-target active I/O shutdown handling regression in
           v3.10-rc1
      
        A big thanks to Kees Cook for fixing a long standing login error
        buffer overflow bug.
      
        All patches are CC'ed to stable with the exception of the v3.10-rc1
        specific regression + other minor target cleanup."
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
        iscsi-target: Fix iscsit_free_cmd() se_cmd->cmd_kref shutdown handling
        target: Propigate up ->cmd_kref put return via transport_generic_free_cmd
        iscsi-target: fix heap buffer overflow on error
        target/file: Fix off-by-one READ_CAPACITY bug for !S_ISBLK export
        ib_srpt: Call target_sess_cmd_list_set_waiting during shutdown_session
        target: Re-instate sess_wait_list for target_wait_for_sess_cmds
        target: Remove unused wait_for_tasks bit in target_wait_for_sess_cmds
      008bd2de
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mturquette/linux · 0f7dafd4
      Linus Torvalds authored
      Pull clock subsystem fixes from Mike Turquette:
       "A mix of small fixes affecting mostly ARM platforms as well as a
        discrete clock expander chip.  Most fixes are corrections to lousy
        clock data of one form or another."
      
      * tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mturquette/linux:
        clk: mxs: Include clk mxs header file
        clk: vt8500: Fix unbalanced spinlock in vt8500_dclk_set_rate()
        clk: si5351: Set initial clkout rate when defined in platform data.
        clk: si5351: Fix clkout rate computation.
        clk: samsung: Add CLK_IGNORE_UNUSED flag for the sysreg clocks
        clk: ux500: clk-sysctrl: handle clocks with no parents
        clk: ux500: Provide device enumeration number suffix for SMSC911x
      0f7dafd4
    • Linus Torvalds's avatar
      Merge tag 'fbdev-for-3.10-rc4' of... · c361cb59
      Linus Torvalds authored
      Merge tag 'fbdev-for-3.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/plagnioj/linux-fbdev
      
      Pull fbdev fixes from Jean-Christophe PLAGNIOL-VILLARD:
       "This contains some small fixes
      
         - Atmel LCDC: fix blank the backlight on remove
         - ps3fb: fix compile warning
         - OMAPDSS: Fix crash with DT boot"
      
      * tag 'fbdev-for-3.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/plagnioj/linux-fbdev:
        atmel_lcdfb: blank the backlight on remove
        trivial: atmel_lcdfb: add missing error message
        OMAPDSS: Fix crash with DT boot
        fbdev/ps3fb: fix compile warning
      c361cb59
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 6cf3c736
      Linus Torvalds authored
      Pull assorted fixes from Al Viro:
       "There'll be more - I'm trying to dig out from under the pile of mail
        (a couple of weeks of something flu-like ;-/) and there's several more
        things waiting for review; this is just the obvious stuff."
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        zoran: racy refcount handling in vm_ops ->open()/->close()
        befs_readdir(): do not increment ->f_pos if filldir tells us to stop
        hpfs: deadlock and race in directory lseek()
        qnx6: qnx6_readdir() has a braino in pos calculation
        fix buffer leak after "scsi: saner replacements for ->proc_info()"
        vfs: Fix invalid ida_remove() call
      6cf3c736
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-3.10-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · f8cb2791
      Linus Torvalds authored
      Pull two NFS client fixes from Trond Myklebust:
       - Fix a regression that broke NFS mounting using klibc and busybox
       - Stable fix to check access modes correctly on NFSv4 delegated open()
      
      * tag 'nfs-for-3.10-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        NFS: Fix security flavor negotiation with legacy binary mounts
        NFSv4: Fix a thinko in nfs4_try_open_cached
      f8cb2791
  8. 31 May, 2013 16 commits