- 12 Apr, 2012 40 commits
-
-
-
Eldad Zack authored
Added strict checking of PadN, as PadN can be used to increase header size and thus push the protocol header into the 2nd fragment. PadN is used to align the options within the Hop-by-Hop or Destination Options header to 64-bit boundaries. The maximum valid size is thus 7 bytes. RFC 4942 recommends to actively check the "payload" itself and ensure that it contains only zeroes. See also RFC 4942 section 2.1.9.5. Signed-off-by:
Eldad Zack <eldad@fogrefinery.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Linus Torvalds authored
Merge fixes from Andrew Morton. * emailed from Andrew Morton <akpm@linux-foundation.org>: (14 patches) panic: fix stack dump print on direct call to panic() drivers/rtc/rtc-pl031.c: enable clock on all ST variants Revert "mm: vmscan: fix misused nr_reclaimed in shrink_mem_cgroup_zone()" hugetlb: fix race condition in hugetlb_fault() drivers/rtc/rtc-twl.c: use static register while reading time drivers/rtc/rtc-s3c.c: add placeholder for driver private data drivers/rtc/rtc-s3c.c: fix compilation error MAINTAINERS: add PCDP console maintainer memcg: do not open code accesses to res_counter members drivers/rtc/rtc-efi.c: fix section mismatch warning drivers/rtc/rtc-r9701.c: reset registers if invalid values are detected drivers/char/random.c: fix boot id uniqueness race memcg: fix broken boolen expression memcg: fix up documentation on global LRU
-
git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds authored
Pull networking fixes from David Miller: 1) Fix bluetooth userland regression reported by Keith Packard, from Gustavo Padovan. 2) Revert ath9k PS idle change, from Sujith Manoharan. 3) Correct default TCP memory limits (again), from Eric Dumazet. 4) Fix tcp_rcv_rtt_update() accidental use of unscaled RTT, from Neal Cardwell. 5) We made a facility for layers like wireless to say how much tailroom they need in the SKB for link layer stuff such as wireless encryption etc., but TCP works hard to fill every SKB out to the end defeating this specification. This leads to every TCP packet getting reallocated by the wireless code in order to have the right amount of tailroom available. Fix TCP to only fill SKBs out to the real amount of data area it asked for during the allocation, this way it won't eat into the slack added for the device's tailroom needs. Reported by Marc Merlin and fixed by Eric Dumazet. 6) Leaks, endian bugs, and new device IDs in bluetooth from Santosh Nayak, João Paulo Rechi Vita, Cho, Yu-Chen, Andrei Emeltchenko, AceLan Kao, and Andrei Emeltchenko. 7) OOPS on tty_close fix in bluetooth's hci_ldisc from Johan Hovold. 8) netfilter erroneously scales TCP window twice, fix from Changli Gao. 9) Memleak fix in wext-core from Julia Lawall. 10) Consistently handle invalid TCP packets in ipv4 vs. ipv6 conntrack, from Jozsef Kadlecsik. 11) Validate IP header length properly in netfilter conntrack's ipv4_get_l4proto(). * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (39 commits) NFC: Fix the LLCP Tx fragmentation loop rtlwifi: Add missing DMA buffer unmapping for PCI drivers rtlwifi: Preallocate USB read buffers and eliminate kalloc in read routine tcp: avoid order-1 allocations on wifi and tx path net: allow pskb_expand_head() to get maximum tailroom bridge: Do not send queries on multicast group leaves MAINTAINERS: Mark NATSEMI driver as orphan'd. tcp: fix tcp_rcv_rtt_update() use of an unscaled RTT sample tcp: restore correct limit Revert "ath9k: fix going to full-sleep on PS idle" rt2x00: Fix rfkill_polling register function. bcma: fix build error on MIPS; implicit pcibios_enable_device netfilter: nf_conntrack: fix incorrect logic in nf_conntrack_init_net netfilter: nf_ct_ipv4: packets with wrong ihl are invalid netfilter: nf_ct_ipv4: handle invalid IPv4 and IPv6 packets consistently net/wireless/wext-core.c: add missing kfree rtlwifi: Fix oops on rate-control failure mac80211: Convert WARN_ON to WARN_ON_ONCE rtlwifi: rtl8192de: Fix firmware initialization nl80211: ensure interface is up in various APIs ... -
git://people.freedesktop.org/~airlied/linuxLinus Torvalds authored
Pull drm fixes from Dave Airlie: "Mostly exynos and intel. Intel has 3 regression fixers (more info in intel merge commit), along with some other make hw work fixes, exynos has some cleanups and an ioctl fix. A couple of radeon fixes, couple of build fixes, and a savage userspace interface possible overflow fix." * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (23 commits) drm/exynos: fixed exynos broken ioctl drm/i915: clear fencing tracking state when retiring requests drm/exynos: fix to pointer manager member of struct exynos_drm_subdrv drm/exynos: fix struct for operation callback functions to driver name drm/exynos: use define instead of default_win member in struct mixer_context drm/exynos: rename s/HDMI_OVERLAY_NUMBER/MIXER_WIN_NR drm/exynos: remove unused codes in hdmi and mixer drm/exynos: remove unnecessary type conversion of hdmi and mixer drm/i915: make rc6 module parameter read-only drm/i915: implement ColorBlt w/a drm/i915/ringbuffer: Exclude last 2 cachlines of ring on 845g Revert "drm/i915: reenable gmbus on gen3+ again" drm/radeon: only add the mm i2c bus if the hw_i2c module param is set vgaarb.h: fix build warnings drm/i915: properly compute dp dithering for user-created modes drm/radeon/kms: fix DVO setup on some r4xx chips drm/savage: fix integer overflows in savage_bci_cmdbuf() drm/radeon: replace udelay with mdelay for long timeouts drm/i915: Finish any pending operations on the framebuffer before disabling drm/i915: Removed IVB forced enable of sprite dest key. ...
-
Jeffrin Jose authored
Fixed coding style issues in net/core/utils.c in relation with braces placement. Signed-off-by:
Jeffrin Jose <ahiliation@yahoo.co.in> Signed-off-by:
-
Eldad Zack authored
extern int sysctl_mld_max_msf is already defined in linux/ipv6.h. Signed-off-by:
-
git://neil.brown.name/mdLinus Torvalds authored
Pull a few more fixes for md from NeilBrown: "Two are tagged for -stable. They can cause an oops, but very rarely." * tag 'md-3.4-fixes' of git://neil.brown.name/md: md/bitmap: prevent bitmap_daemon_work running while initialising bitmap md/raid1,raid10: Fix calculation of 'vcnt' when processing error recovery. MD: Bitmap version cleanup.
-
Jason Wessel authored
Commit 6e6f0a1f ("panic: don't print redundant backtraces on oops") causes a regression where no stack trace will be printed at all for the case where kernel code calls panic() directly while not processing an oops, and of course there are 100's of instances of this type of call. The original commit executed the check (!oops_in_progress), but this will always be false because just before the dump_stack() there is a call to bust_spinlocks(1), which does the following: void __attribute__((weak)) bust_spinlocks(int yes) { if (yes) { ++oops_in_progress; The proper way to resolve the problem that original commit tried to solve is to avoid printing a stack dump from panic() when the either of the following conditions is true: 1) TAINT_DIE has been set (this is done by oops_end()) This indicates and oops has already been printed. 2) oops_in_progress > 1 This guards against the rare case where panic() is invoked a second time, or in between oops_begin() and oops_end() Signed-off-by:
Jason Wessel <jason.wessel@windriver.com> Cc: Andi Kleen <ak@linux.intel.com> Cc: <stable@vger.kernel.org> [3.3+] Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
Linus Walleij authored
The ST variants of the PL031 all require bit 26 in the control register to be set before they work properly. Discovered this when testing on the Nomadik board where it would suprisingly just stand still. Signed-off-by:
Linus Walleij <linus.walleij@linaro.org> Cc: Mian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com> Cc: Alessandro Rubini <rubini@unipv.it> Cc: <stable@vger.kernel.org> Signed-off-by:
-
Ying Han authored
This reverts commit c38446cc. Before the commit, the code makes senses to me but not after the commit. The "nr_reclaimed" is the number of pages reclaimed by scanning through the memcg's lru lists. The "nr_to_reclaim" is the target value for the whole function. For example, we like to early break the reclaim if reclaimed 32 pages under direct reclaim (not DEF_PRIORITY). After the reverted commit, the target "nr_to_reclaim" is decremented each time by "nr_reclaimed" but we still use it to compare the "nr_reclaimed". It just doesn't make sense to me... Signed-off-by:
Ying Han <yinghan@google.com> Acked-by:
Hugh Dickins <hughd@google.com> Cc: Rik van Riel <riel@redhat.com> Cc: Hillf Danton <dhillf@gmail.com> Signed-off-by:
-
Chris Metcalf authored
The race is as follows: Suppose a multi-threaded task forks a new process (on cpu A), thus bumping up the ref count on all the pages. While the fork is occurring (and thus we have marked all the PTEs as read-only), another thread in the original process (on cpu B) tries to write to a huge page, taking an access violation from the write-protect and calling hugetlb_cow(). Now, suppose the fork() fails. It will undo the COW and decrement the ref count on the pages, so the ref count on the huge page drops back to 1. Meanwhile hugetlb_cow() also decrements the ref count by one on the original page, since the original address space doesn't need it any more, having copied a new page to replace the original page. This leaves the ref count at zero, and when we call unlock_page(), we panic. fork on CPU A fault on CPU B ============= ============== ... down_write(&parent->mmap_sem); down_write_nested(&child->mmap_sem); ... while duplicating vmas if error break; ... up_write(&child->mmap_sem); up_write(&parent->mmap_sem); ... down_read(&parent->mmap_sem); ... lock_page(page); handle COW page_mapcount(old_page) == 2 alloc and prepare new_page ... handle error page_remove_rmap(page); put_page(page); ... fold new_page into pte page_remove_rmap(page); put_page(page); ... oops ==> unlock_page(page); up_read(&parent->mmap_sem); The solution is to take an extra reference to the page while we are holding the lock on it. Signed-off-by:
Chris Metcalf <cmetcalf@tilera.com> Cc: Hillf Danton <dhillf@gmail.com> Cc: Michal Hocko <mhocko@suse.cz> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Hugh Dickins <hughd@google.com> Cc: <stable@vger.kernel.org> Signed-off-by:
-
Konstantin Shlyakhovoy authored
RTC stores time and date in several registers. Due to the fact that these registers can't be read instantaneously, there is a chance that reading from counting registers gives an error of one minute, one hour, one day, etc. To address this issue, the RTC has hardware support to copy the RTC counting registers to static shadowed registers. The current implementation does not use this feature, and in a stress test, we can reproduce this error at a rate of around two times per 300000 readings. Fix the implementation to ensure that the right snapshot of time is captured. Signed-off-by:
Konstantin Shlyakhovoy <x0155534@ti.com> Signed-off-by:
Nishanth Menon <nm@ti.com> Cc: Alessandro Zummo <a.zummo@towertech.it> Cc: Benoit Cousson <b-cousson@ti.com> Cc: linux-omap <linux-omap@vger.kernel.org> Acked-by:
Mykola Oleksiienko <x0174904@ti.com> Acked-by:
Oleksandr Dmytryshyn <oleksandr.dmytryshyn@ti.com> Acked-by:
Graeme Gregory <gg@slimlogic.co.uk> Signed-off-by:
-
Tushar Behera authored
Driver data field is a pointer, hence assigning that to an integer results in compilation warnings. Fixes following compilation warnings: drivers/rtc/rtc-s3c.c: In function `s3c_rtc_get_driver_data': drivers/rtc/rtc-s3c.c:452:3: warning: return makes integer from pointer without a cast [enabled by default] drivers/rtc/rtc-s3c.c: At top level: drivers/rtc/rtc-s3c.c:674:3: warning: initialization makes pointer from integer without a cast [enabled by default] drivers/rtc/rtc-s3c.c:674:3: warning: (near initialization for `s3c_rtc_dt_match[1].data') [enabled by default] drivers/rtc/rtc-s3c.c:677:3: warning: initialization makes pointer from integer without a cast [enabled by default] drivers/rtc/rtc-s3c.c:677:3: warning: (near initialization for `s3c_rtc_dt_match[2].data') [enabled by default] drivers/rtc/rtc-s3c.c:680:3: warning: initialization makes pointer from integer without a cast [enabled by default] drivers/rtc/rtc-s3c.c:680:3: warning: (near initialization for `s3c_rtc_dt_match[3].data') [enabled by default] Signed-off-by:
Tushar Behera <tushar.behera@linaro.org> Cc: Heiko Stuebner <heiko@sntech.de> Cc: Alessandro Zummo <a.zummo@towertech.it> Signed-off-by:
-
Tushar Behera authored
Fix this error: drivers/rtc/rtc-s3c.c: At top level: drivers/rtc/rtc-s3c.c:671:3: error: request for member `data' in something not a structure or union drivers/rtc/rtc-s3c.c:674:3: error: request for member `data' in something not a structure or union drivers/rtc/rtc-s3c.c:677:3: error: request for member `data' in something not a structure or union drivers/rtc/rtc-s3c.c:680:3: error: request for member `data' in something not a structure or union Signed-off-by:
-
Khalid Aziz authored
Add missing maintainer info for PCDP console code. Signed-off-by:
Khalid Aziz <khalid.aziz@hp.com> Cc: Joe Perches <joe@perches.com> Signed-off-by:
-
Glauber Costa authored
We should use the accessor res_counter_read_u64 for that. Although a purely cosmetic change is sometimes better delayed, to avoid conflicting with other people's work, we are starting to have people touching this code as well, and reproducing the open code behavior because that's the standard =) Time to fix it, then. Signed-off-by:
Glauber Costa <glommer@parallels.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Acked-by:
Michal Hocko <mhocko@suse.cz> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Signed-off-by:
-
Jan Beulich authored
efi_rtc_init() uses platform_driver_probe(), so there's no need to also set efi_rtc_driver's probe member (as it won't be used anyway). This fixes a modpost section mismatch warning (as efi_rtc_probe() validly is __init). Signed-off-by:
Jan Beulich <jbeulich@suse.com> Cc: Matthew Garrett <mjg@redhat.com> Cc: Alessandro Zummo <a.zummo@towertech.it> Signed-off-by:
-
Andreas Dumberger authored
hwclock refuses to set date/time if RTC registers contain invalid values. Check the date/time register values at probe time and initialize them to make hwclock happy. Signed-off-by:
Andreas Dumberger <andreas.dumberger@tqs.de> Signed-off-by:
Anatolij Gustschin <agust@denx.de> Cc: Alessandro Zummo <a.zummo@towertech.it> Signed-off-by:
-
Mathieu Desnoyers authored
/proc/sys/kernel/random/boot_id can be read concurrently by userspace processes. If two (or more) user-space processes concurrently read boot_id when sysctl_bootid is not yet assigned, a race can occur making boot_id differ between the reads. Because the whole point of the boot id is to be unique across a kernel execution, fix this by protecting this operation with a spinlock. Given that this operation is not frequently used, hitting the spinlock on each call should not be an issue. Signed-off-by:
Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: "Theodore Ts'o" <tytso@mit.edu> Cc: Matt Mackall <mpm@selenic.com> Signed-off-by:
Eric Dumazet <eric.dumazet@gmail.com> Cc: Greg Kroah-Hartman <greg@kroah.com> Signed-off-by:
-
Kirill A. Shutemov authored
action != CPU_DEAD || action != CPU_DEAD_FROZEN is always true. Signed-off-by:
Kirill A. Shutemov <kirill@shutemov.name> Acked-by:
KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Acked-by:
-
Ying Han authored
In v3.3-rc1, the global LRU was removed in commit 925b7673 ("mm: make per-memcg LRU lists exclusive"). The patch fixes up the memcg docs. I left the swap session to someone who has better understanding of 'memory+swap'. Signed-off-by:
-
Shuah Khan authored
Changed net/core/net-sysfs.c: netdev_store() to use kstrtoul() instead of obsolete simple_strtoul(). Signed-off-by:
Shuah Khan <shuahkhan@gmail.com> Signed-off-by:
-
Florian Fainelli authored
Signed-off-by:
Florian Fainelli <florian@openwrt.org> Signed-off-by:
-
Florian Fainelli authored
Define and use the bits of the PHY_CC (status change configuration) register. Signed-off-by:
-
Florian Fainelli authored
Define MTPR bit 0 of the register and use it where it is appropriate. Signed-off-by:
-
Florian Fainelli authored
Define the MLSR (MAC Last Status Register bits) for: - tx fifo under-run - tx exceed collision - tx late collision Signed-off-by:
-
Florian Fainelli authored
We are currently updating the rx fifo error counter in the tx path while it should have been the tx fifo error counter, fix that. Signed-off-by:
-
Florian Fainelli authored
2048 is the usual value for busy-waiting on a register r/w, define it as MAC_DEF_TIMEOUT and use it where it is appropriate. Signed-off-by:
-
Florian Fainelli authored
Signed-off-by:
-
Florian Fainelli authored
The reset of the MAC is currently done identically from two places and one place is not waiting for the MAC_SM bit to be set after reset. Everytime the MAC is software resetted a state machine is also needed so consolidate the reset to its own function. Signed-off-by:
-
Richard Cochran authored
Commit e77bd1ec121ee4163a6b42a44e87b2e382c39e04 added support for a new ethtool function, but that cannot compile due to a misnamed global variable. Not that it really matters (since the IXP4xx does compile either, as of about Linux 3.1) but just in case, this patch fixes the misnamed variable in the PHC driver. Signed-off-by:
Richard Cochran <richardcochran@gmail.com> Signed-off-by:
-
Alexey I. Froloff authored
As specified in RFC6106, DNSSL option contains one or more domain names of DNS suffixes. 8-bit identifier of the DNSSL option type as assigned by the IANA is 31. This option should also be treated as userland. Signed-off-by:
Alexey I. Froloff <raorn@raorn.name> Signed-off-by:
-
git://git.secretlab.ca/git/linux-2.6Linus Torvalds authored
Pull irqdomain bug fixes from Grant Likely: "This branch fixes a bug in irq_create_mapping() where an error return from irq_alloc_desc_from() gets ignored. It also removes irq_virq_count to fix a bug on powerpc where the irqdomain code does not find irqs allocated above the CONFIG_NR_IRQS boundary. The remaining patches get rid of an completely pointless export and fix some minor bugs in the irqdomain debug output." * tag 'irqdomain-for-linus' of git://git.secretlab.ca/git/linux-2.6: irq_domain: Move irq_virq_count into NOMAP revmap irqdomain: Fix debugfs formatting irq_domain: correct the debugfs file name irq: Kill pointless irqd_to_hw export irq/irq_domain: Quit ignoring error returns from irq_alloc_desc_from().
-
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/inputLinus Torvalds authored
Pull input updates from Dmitry Torokhov: "Just a few small fixes..." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: da9052 - fix memory leak in da9052_onkey_probe() Input: gpio_mouse - use linux/gpio.h rather than asm/gpio.h Input: trackpoint - use psmouse_fmt() for messages Input: elantech - v4 is a clickpad, with only one button Input: elantech - reset touchpad before configuring it Input: sentelic - filter taps in absolute mode Input: tps6507x-ts - fix MODULE_ALIAS to match driver name
-
Geert Uytterhoeven authored
m68k/allmodconfig: drivers/net/ethernet/wiznet/w5100.c: In function ‘w5100_hw_probe’: drivers/net/ethernet/wiznet/w5100.c:680: error: ‘IRQ_TYPE_LEVEL_LOW’ undeclared (first use in this function) drivers/net/ethernet/wiznet/w5300.c: In function ‘w5300_hw_probe’: drivers/net/ethernet/wiznet/w5300.c:594: error: ‘IRQ_TYPE_LEVEL_LOW’ undeclared (first use in this function) Include <linux/irq.h>, which provides the declaration for IRQ_TYPE_LEVEL_LOW. Signed-off-by:
Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by:
-
Mike Sinkovsky authored
This option was there for debugging race conditions, just remove it, and assume TX_FLOW is always enabled. Signed-off-by:
Mike Sinkovsky <msink@permonline.ru> Signed-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfsLinus Torvalds authored
Pull vfs fixes from Al Viro: "Regression fix in mtdchar_open(), fix for a really old leak (almost never hit in practice - it's a b0rken failure exit in simple_fill_super()) and a typo fix in vfs.txt (misspelled method type)." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: typo fix in Documentation/filesystems/vfs.txt dentry leak in simple_fill_super() failure exit fix breakage in mtdchar_open(), sanitize failure exits
-
Dave Airlie authored
Merge branch 'exynos-drm-fixes' of git://git.infradead.org/users/kmpark/linux-samsung into drm-intel-fixes * 'exynos-drm-fixes' of git://git.infradead.org/users/kmpark/linux-samsung: drm/exynos: fixed exynos broken ioctl drm/exynos: fix to pointer manager member of struct exynos_drm_subdrv drm/exynos: fix struct for operation callback functions to driver name drm/exynos: use define instead of default_win member in struct mixer_context drm/exynos: rename s/HDMI_OVERLAY_NUMBER/MIXER_WIN_NR drm/exynos: remove unused codes in hdmi and mixer drm/exynos: remove unnecessary type conversion of hdmi and mixer drm/exynos: add format list of plane drm/exynos: fixed duplicated page allocation bug. drm/exynos: fixed page align and code clean.
-
Dave Airlie authored
Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel into drm-intel-fixes Daniel Vetter writes: 3 regression fixes: - disable gmbus again, too broken for 3.4, we'll try again for 3.5 - dp bandwidth computation fix, we've lost the 6bpc dithering flag sometimes, this is a 3.3 regression (maybe even earlier for some configurations). - fix resume regression caused by the gen2/3 fencing fix merged into -rc2. And a few other fixes: - gpu hang fix for i845 (Chris) - sprite fix (Armin Reese) - crtc disable vs. scanlinewait race fix (Chris) - rc6 module option read-only, it confused testers (Jesse) - fbc related blitter death hw workaround, note that we disable fbc on snb by default anyway. With these fixes we have one 3.4 regression outstanding: One of the cleanup patches for the interlaced support managed to confuse the lvds panel fitter when upscaling. The root-cause is still unclear, but test patches are awaiting feedback from the reporter. * 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel: drm/i915: clear fencing tracking state when retiring requests drm/i915: make rc6 module parameter read-only drm/i915: implement ColorBlt w/a drm/i915/ringbuffer: Exclude last 2 cachlines of ring on 845g Revert "drm/i915: reenable gmbus on gen3+ again" drm/i915: properly compute dp dithering for user-created modes drm/i915: Finish any pending operations on the framebuffer before disabling drm/i915: Removed IVB forced enable of sprite dest key.
-
