1. 18 Apr, 2012 7 commits
  2. 17 Apr, 2012 4 commits
    • Hiroaki SHIMODA's avatar
      dummy: Add ndo_uninit(). · 890fdf2a
      Hiroaki SHIMODA authored
      In register_netdevice(), when ndo_init() is successful and later
      some error occurred, ndo_uninit() will be called.
      So dummy deivce is desirable to implement ndo_uninit() method
      to free percpu stats for this case.
      And, ndo_uninit() is also called along with dev->destructor() when
      device is unregistered, so in order to prevent dev->dstats from
      being freed twice, dev->destructor is modified to free_netdev().
      Signed-off-by: default avatarHiroaki SHIMODA <shimoda.hiroaki@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      890fdf2a
    • Stephane Fillod's avatar
      net: usb: smsc75xx: fix mtu · a99ff7d0
      Stephane Fillod authored
      Make smsc75xx recalculate the hard_mtu after adjusting the
      hard_header_len.
      
      Without this, usbnet adjusts the MTU down to 1492 bytes, and the host is
      unable to receive standard 1500-byte frames from the device.
      
      Inspired by same fix on cdc_eem 78fb72f7.
      
      Tested on ARM/Omap3 with EVB-LAN7500-LC.
      Signed-off-by: default avatarStephane Fillod <fillods@users.sf.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a99ff7d0
    • David Ward's avatar
      4362aaf6
    • David Ward's avatar
      net_sched: gred: Fix oops in gred_dump() in WRED mode · 244b65db
      David Ward authored
      A parameter set exists for WRED mode, called wred_set, to hold the same
      values for qavg and qidlestart across all VQs. The WRED mode values had
      been previously held in the VQ for the default DP. After these values
      were moved to wred_set, the VQ for the default DP was no longer created
      automatically (so that it could be omitted on purpose, to have packets
      in the default DP enqueued directly to the device without using RED).
      
      However, gred_dump() was overlooked during that change; in WRED mode it
      still reads qavg/qidlestart from the VQ for the default DP, which might
      not even exist. As a result, this command sequence will cause an oops:
      
      tc qdisc add dev $DEV handle $HANDLE parent $PARENT gred setup \
          DPs 3 default 2 grio
      tc qdisc change dev $DEV handle $HANDLE gred DP 0 prio 8 $RED_OPTIONS
      tc qdisc change dev $DEV handle $HANDLE gred DP 1 prio 8 $RED_OPTIONS
      
      This fixes gred_dump() in WRED mode to use the values held in wred_set.
      Signed-off-by: default avatarDavid Ward <david.ward@ll.mit.edu>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      244b65db
  3. 16 Apr, 2012 1 commit
  4. 14 Apr, 2012 3 commits
  5. 13 Apr, 2012 17 commits
    • Will Deacon's avatar
      net: smsc911x: fix skb handling in receive path · 3c5e979b
      Will Deacon authored
      The SMSC911x driver resets the ->head, ->data and ->tail pointers in the
      skb on the reset path in order to avoid buffer overflow due to packet
      padding performed by the hardware.
      
      This patch fixes the receive path so that the skb pointers are fixed up
      after the data has been read from the device, The error path is also
      fixed to use number of words consistently and prevent erroneous FIFO
      fastforwarding when skipping over bad data.
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3c5e979b
    • Matt Renzelmann's avatar
      ks8851: Fix missing mutex_lock/unlock · 51c61a28
      Matt Renzelmann authored
      Move the ks8851_rdreg16 call above the call to request_irq and cache
      the result for subsequent repeated use.  A spurious interrupt may
      otherwise cause a crash.  Thanks to Stephen Boyd, Flavio Leitner, and
      Ben Hutchings for feedback.
      Signed-off-by: default avatarMatt Renzelmann <mjr@cs.wisc.edu>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      51c61a28
    • Michal Simek's avatar
      drivers/net/ethernet/xilinx/axi ethernet: Correct Copyright · 59a54f30
      Michal Simek authored
      Also fix MAINTAINERS file to reflect autorship.
      
      Daniel and Ariane changed coding style but not any functional changes in the driver
      itself.
      Signed-off-by: default avatarMichal Simek <monstr@monstr.eu>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      59a54f30
    • Jason Wang's avatar
      8139cp: set intr mask after its handler is registered · a8c9cb10
      Jason Wang authored
      We set intr mask before its handler is registered, this does not work well when
      8139cp is sharing irq line with other devices. As the irq could be enabled by
      the device before 8139cp's hander is registered which may lead unhandled
      irq. Fix this by introducing an helper cp_irq_enable() and call it after
      request_irq().
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Reviewed-by: default avatarFlavio Leitner <fbl@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a8c9cb10
    • Tony Zelenoff's avatar
      atl1: fix kernel panic in case of DMA errors · 03662e41
      Tony Zelenoff authored
      Problem:
      There was two separate work_struct structures which share one
      handler. Unfortunately getting atl1_adapter structure from
      work_struct in case of DMA error was done from incorrect
      offset which cause kernel panics.
      
      Solution:
      The useless work_struct for DMA error removed and
      handler name changed to more generic one.
      Signed-off-by: default avatarTony Zelenoff <antonz@parallels.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      03662e41
    • Michael S. Tsirkin's avatar
      skbuff: struct ubuf_info callback type safety · ca8f4fb2
      Michael S. Tsirkin authored
      The skb struct ubuf_info callback gets passed struct ubuf_info
      itself, not the arg value as the field name and the function signature
      seem to imply. Rename the arg field to ctx to match usage,
      add documentation and change the callback argument type
      to make usage clear and to have compiler check correctness.
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ca8f4fb2
    • David Woodhouse's avatar
      ppp: Fix race condition with queue start/stop · 9a5d2bd9
      David Woodhouse authored
      Commit e675f0cc ("ppp: Don't stop and
      restart queue on every TX packet") introduced a race condition which
      could leave the net queue stopped even when the channel is no longer
      busy. By calling netif_stop_queue() from ppp_start_xmit(), based on the
      return value from ppp_xmit_process() but *after* all the locks have been
      dropped, we could potentially do so *after* the channel has actually
      finished transmitting and attempted to re-wake the queue.
      
      Fix this by moving the netif_stop_queue() into ppp_xmit_process() under
      the xmit lock. I hadn't done this previously, because it gets called
      from other places than ppp_start_xmit(). But I now think it's the better
      option. The net queue *should* be stopped if the channel becomes
      congested due to writes from pppd, anyway.
      Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9a5d2bd9
    • Gao feng's avatar
      ipv6: fix problem with expired dst cache · 1716a961
      Gao feng authored
      If the ipv6 dst cache which copy from the dst generated by ICMPV6 RA packet.
      this dst cache will not check expire because it has no RTF_EXPIRES flag.
      So this dst cache will always be used until the dst gc run.
      
      Change the struct dst_entry,add a union contains new pointer from and expires.
      When rt6_info.rt6i_flags has no RTF_EXPIRES flag,the dst.expires has no use.
      we can use this field to point to where the dst cache copy from.
      The dst.from is only used in IPV6.
      
      rt6_check_expired check if rt6_info.dst.from is expired.
      
      ip6_rt_copy only set dst.from when the ort has flag RTF_ADDRCONF
      and RTF_DEFAULT.then hold the ort.
      
      ip6_dst_destroy release the ort.
      
      Add some functions to operate the RTF_EXPIRES flag and expires(from) together.
      and change the code to use these new adding functions.
      
      Changes from v5:
      modify ip6_route_add and ndisc_router_discovery to use new adding functions.
      
      Only set dst.from when the ort has flag RTF_ADDRCONF
      and RTF_DEFAULT.then hold the ort.
      Signed-off-by: default avatarGao feng <gaofeng@cn.fujitsu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1716a961
    • Kim Lilliestierna XX's avatar
      caif_hsi: use dev_dbg not dev_err for reporting · d62f8dbb
      Kim Lilliestierna XX authored
      Use dev_dbg instead of dev_err for reporting in cfhsi_wakeup_cb.
      Signed-off-by: default avatarKim Lilliestierna <kim.xx.lilliestierna@stericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d62f8dbb
    • sjur.brandeland@stericsson.com's avatar
      caif-hsi: Free flip_buffer at shutdown · 5f614e6b
      sjur.brandeland@stericsson.com authored
      Fix memory leak of RX flip-buffer.
      Signed-off-by: default avatarSjur Brændeland <sjur.brandeland@stericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5f614e6b
    • Tomasz Gregorek's avatar
      caif: Fix memory leakage in the chnl_net.c. · 5c699fb7
      Tomasz Gregorek authored
      Added kfree_skb() calls in the chnk_net.c file on
      the error paths.
      Signed-off-by: default avatarSjur Brændeland <sjur.brandeland@stericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5c699fb7
    • James Chapman's avatar
      l2tp: don't overwrite source address in l2tp_ip_bind() · c9be48dc
      James Chapman authored
      Applications using L2TP/IP sockets want to be able to bind() an L2TP/IP
      socket to set the local tunnel id while leaving the auto-assigned source
      address alone. So if no source address is supplied, don't overwrite
      the address already stored in the socket.
      Signed-off-by: default avatarJames Chapman <jchapman@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c9be48dc
    • James Chapman's avatar
      l2tp: fix refcount leak in l2tp_ip sockets · d1f224ae
      James Chapman authored
      The l2tp_ip socket close handler does not update the module refcount
      correctly which prevents module unload after the first bind() call on
      an L2TPv3 IP encapulation socket.
      Signed-off-by: default avatarJames Chapman <jchapman@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d1f224ae
    • Torsten Kaiser's avatar
      net: Fix misplaced parenthesis in virtio_net.c · 31304165
      Torsten Kaiser authored
      Commit 2e57b79c misplaced its
      parenthesis and now tx_fifo_errors will only be incremented if an
      ENOMEM error is not written to the syslog.
      
      Correct the parenthesis and indentation to the original goal of
      counting all non ENOMEM errors and ratelimiting only the messages.
      Signed-of-by: default avatarTorsten Kaiser <just.for.lkml@googlemail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      31304165
    • Julia Lawall's avatar
      net/key/af_key.c: add missing kfree_skb · 89eb06f1
      Julia Lawall authored
      At the point of this error-handling code, alloc_skb has succeded, so free
      the resulting skb by jumping to the err label.
      Signed-off-by: default avatarJulia Lawall <Julia.Lawall@lip6.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      89eb06f1
    • Eric W. Biederman's avatar
      phonet: Sort out initiailziation and cleanup code. · 03478756
      Eric W. Biederman authored
      Recently an oops was reported in phonet if there was a failure during
      network namespace creation.
      
      [  163.733755] ------------[ cut here ]------------
      [  163.734501] kernel BUG at include/net/netns/generic.h:45!
      [  163.734501] invalid opcode: 0000 [#1] PREEMPT SMP
      [  163.734501] CPU 2
      [  163.734501] Pid: 19145, comm: trinity Tainted: G        W 3.4.0-rc1-next-20120405-sasha-dirty #57
      [  163.734501] RIP: 0010:[<ffffffff824d6062>]  [<ffffffff824d6062>] phonet_pernet+0x182/0x1a0
      [  163.734501] RSP: 0018:ffff8800674d5ca8  EFLAGS: 00010246
      [  163.734501] RAX: 000000003fffffff RBX: 0000000000000000 RCX: ffff8800678c88d8
      [  163.734501] RDX: 00000000003f4000 RSI: ffff8800678c8910 RDI: 0000000000000282
      [  163.734501] RBP: ffff8800674d5cc8 R08: 0000000000000000 R09: 0000000000000000
      [  163.734501] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880068bec920
      [  163.734501] R13: ffffffff836b90c0 R14: 0000000000000000 R15: 0000000000000000
      [  163.734501] FS:  00007f055e8de700(0000) GS:ffff88007d000000(0000) knlGS:0000000000000000
      [  163.734501] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      [  163.734501] CR2: 00007f055e6bb518 CR3: 0000000070c16000 CR4: 00000000000406e0
      [  163.734501] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  163.734501] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      [  163.734501] Process trinity (pid: 19145, threadinfo ffff8800674d4000, task ffff8800678c8000)
      [  163.734501] Stack:
      [  163.734501]  ffffffff824d5f00 ffffffff810e2ec1 ffff880067ae0000 00000000ffffffd4
      [  163.734501]  ffff8800674d5cf8 ffffffff824d667a ffff880067ae0000 00000000ffffffd4
      [  163.734501]  ffffffff836b90c0 0000000000000000 ffff8800674d5d18 ffffffff824d707d
      [  163.734501] Call Trace:
      [  163.734501]  [<ffffffff824d5f00>] ? phonet_pernet+0x20/0x1a0
      [  163.734501]  [<ffffffff810e2ec1>] ? get_parent_ip+0x11/0x50
      [  163.734501]  [<ffffffff824d667a>] phonet_device_destroy+0x1a/0x100
      [  163.734501]  [<ffffffff824d707d>] phonet_device_notify+0x3d/0x50
      [  163.734501]  [<ffffffff810dd96e>] notifier_call_chain+0xee/0x130
      [  163.734501]  [<ffffffff810dd9d1>] raw_notifier_call_chain+0x11/0x20
      [  163.734501]  [<ffffffff821cce12>] call_netdevice_notifiers+0x52/0x60
      [  163.734501]  [<ffffffff821cd235>] rollback_registered_many+0x185/0x270
      [  163.734501]  [<ffffffff821cd334>] unregister_netdevice_many+0x14/0x60
      [  163.734501]  [<ffffffff823123e3>] ipip_exit_net+0x1b3/0x1d0
      [  163.734501]  [<ffffffff82312230>] ? ipip_rcv+0x420/0x420
      [  163.734501]  [<ffffffff821c8515>] ops_exit_list+0x35/0x70
      [  163.734501]  [<ffffffff821c911b>] setup_net+0xab/0xe0
      [  163.734501]  [<ffffffff821c9416>] copy_net_ns+0x76/0x100
      [  163.734501]  [<ffffffff810dc92b>] create_new_namespaces+0xfb/0x190
      [  163.734501]  [<ffffffff810dca21>] unshare_nsproxy_namespaces+0x61/0x80
      [  163.734501]  [<ffffffff810afd1f>] sys_unshare+0xff/0x290
      [  163.734501]  [<ffffffff8187622e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
      [  163.734501]  [<ffffffff82665539>] system_call_fastpath+0x16/0x1b
      [  163.734501] Code: e0 c3 fe 66 0f 1f 44 00 00 48 c7 c2 40 60 4d 82 be 01 00 00 00 48 c7 c7 80 d1 23 83 e8 48 2a c4 fe e8 73 06 c8 fe 48 85 db 75 0e <0f> 0b 0f 1f 40 00 eb fe 66 0f 1f 44 00 00 48 83 c4 10 48 89 d8
      [  163.734501] RIP  [<ffffffff824d6062>] phonet_pernet+0x182/0x1a0
      [  163.734501]  RSP <ffff8800674d5ca8>
      [  163.861289] ---[ end trace fb5615826c548066 ]---
      
      After investigation it turns out there were two issues.
      1) Phonet was not implementing network devices but was using register_pernet_device
         instead of register_pernet_subsys.
      
         This was allowing there to be cases when phonenet was not initialized and
         the phonet net_generic was not set for a network namespace when network
         device events were being reported on the netdevice_notifier for a network
         namespace leading to the oops above.
      
      2) phonet_exit_net was implementing a confusing and special case of handling all
         network devices from going away that it was hard to see was correct, and would
         only occur when the phonet module was removed.
      
         Now that unregister_netdevice_notifier has been modified to synthesize unregistration
         events for the network devices that are extant when called this confusing special
         case in phonet_exit_net is no longer needed.
      Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
      Acked-by: default avatarRémi Denis-Courmont <remi.denis-courmont@nokia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      03478756
    • Eric W. Biederman's avatar
      net: In unregister_netdevice_notifier unregister the netdevices. · 7d3d43da
      Eric W. Biederman authored
      We already synthesize events in register_netdevice_notifier and synthesizing
      events in unregister_netdevice_notifier allows to us remove the need for
      special case cleanup code.
      
      This change should be safe as it adds no new cases for existing callers
      of unregiser_netdevice_notifier to handle.
      Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7d3d43da
  6. 12 Apr, 2012 8 commits
    • Linus Torvalds's avatar
      Merge branch 'akpm' (Andrew's patch-bomb) · ecca5c3a
      Linus Torvalds authored
      Merge fixes from Andrew Morton.
      
      * emailed from Andrew Morton <akpm@linux-foundation.org>: (14 patches)
        panic: fix stack dump print on direct call to panic()
        drivers/rtc/rtc-pl031.c: enable clock on all ST variants
        Revert "mm: vmscan: fix misused nr_reclaimed in shrink_mem_cgroup_zone()"
        hugetlb: fix race condition in hugetlb_fault()
        drivers/rtc/rtc-twl.c: use static register while reading time
        drivers/rtc/rtc-s3c.c: add placeholder for driver private data
        drivers/rtc/rtc-s3c.c: fix compilation error
        MAINTAINERS: add PCDP console maintainer
        memcg: do not open code accesses to res_counter members
        drivers/rtc/rtc-efi.c: fix section mismatch warning
        drivers/rtc/rtc-r9701.c: reset registers if invalid values are detected
        drivers/char/random.c: fix boot id uniqueness race
        memcg: fix broken boolen expression
        memcg: fix up documentation on global LRU
      ecca5c3a
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 174808af
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix bluetooth userland regression reported by Keith Packard, from
          Gustavo Padovan.
      
       2) Revert ath9k PS idle change, from Sujith Manoharan.
      
       3) Correct default TCP memory limits (again), from Eric Dumazet.
      
       4) Fix tcp_rcv_rtt_update() accidental use of unscaled RTT, from Neal
          Cardwell.
      
       5) We made a facility for layers like wireless to say how much tailroom
          they need in the SKB for link layer stuff such as wireless
          encryption etc., but TCP works hard to fill every SKB out to the end
          defeating this specification.
      
          This leads to every TCP packet getting reallocated by the wireless
          code in order to have the right amount of tailroom available.
      
          Fix TCP to only fill SKBs out to the real amount of data area it
          asked for during the allocation, this way it won't eat into the
          slack added for the device's tailroom needs.
      
          Reported by Marc Merlin and fixed by Eric Dumazet.
      
       6) Leaks, endian bugs, and new device IDs in bluetooth from Santosh
          Nayak, João Paulo Rechi Vita, Cho, Yu-Chen, Andrei Emeltchenko,
          AceLan Kao, and Andrei Emeltchenko.
      
       7) OOPS on tty_close fix in bluetooth's hci_ldisc from Johan Hovold.
      
       8) netfilter erroneously scales TCP window twice, fix from Changli Gao.
      
       9) Memleak fix in wext-core from Julia Lawall.
      
      10) Consistently handle invalid TCP packets in ipv4 vs.  ipv6 conntrack,
          from Jozsef Kadlecsik.
      
      11) Validate IP header length properly in netfilter conntrack's
          ipv4_get_l4proto().
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (39 commits)
        NFC: Fix the LLCP Tx fragmentation loop
        rtlwifi: Add missing DMA buffer unmapping for PCI drivers
        rtlwifi: Preallocate USB read buffers and eliminate kalloc in read routine
        tcp: avoid order-1 allocations on wifi and tx path
        net: allow pskb_expand_head() to get maximum tailroom
        bridge: Do not send queries on multicast group leaves
        MAINTAINERS: Mark NATSEMI driver as orphan'd.
        tcp: fix tcp_rcv_rtt_update() use of an unscaled RTT sample
        tcp: restore correct limit
        Revert "ath9k: fix going to full-sleep on PS idle"
        rt2x00: Fix rfkill_polling register function.
        bcma: fix build error on MIPS; implicit pcibios_enable_device
        netfilter: nf_conntrack: fix incorrect logic in nf_conntrack_init_net
        netfilter: nf_ct_ipv4: packets with wrong ihl are invalid
        netfilter: nf_ct_ipv4: handle invalid IPv4 and IPv6 packets consistently
        net/wireless/wext-core.c: add missing kfree
        rtlwifi: Fix oops on rate-control failure
        mac80211: Convert WARN_ON to WARN_ON_ONCE
        rtlwifi: rtl8192de: Fix firmware initialization
        nl80211: ensure interface is up in various APIs
        ...
      174808af
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 778c2dee
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Mostly exynos and intel.
      
        Intel has 3 regression fixers (more info in intel merge commit), along
        with some other make hw work fixes, exynos has some cleanups and an
        ioctl fix.
      
        A couple of radeon fixes, couple of build fixes, and a savage
        userspace interface possible overflow fix."
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (23 commits)
        drm/exynos: fixed exynos broken ioctl
        drm/i915: clear fencing tracking state when retiring requests
        drm/exynos: fix to pointer manager member of struct exynos_drm_subdrv
        drm/exynos: fix struct for operation callback functions to driver name
        drm/exynos: use define instead of default_win member in struct mixer_context
        drm/exynos: rename s/HDMI_OVERLAY_NUMBER/MIXER_WIN_NR
        drm/exynos: remove unused codes in hdmi and mixer
        drm/exynos: remove unnecessary type conversion of hdmi and mixer
        drm/i915: make rc6 module parameter read-only
        drm/i915: implement ColorBlt w/a
        drm/i915/ringbuffer: Exclude last 2 cachlines of ring on 845g
        Revert "drm/i915: reenable gmbus on gen3+ again"
        drm/radeon: only add the mm i2c bus if the hw_i2c module param is set
        vgaarb.h: fix build warnings
        drm/i915: properly compute dp dithering for user-created modes
        drm/radeon/kms: fix DVO setup on some r4xx chips
        drm/savage: fix integer overflows in savage_bci_cmdbuf()
        drm/radeon: replace udelay with mdelay for long timeouts
        drm/i915: Finish any pending operations on the framebuffer before disabling
        drm/i915: Removed IVB forced enable of sprite dest key.
        ...
      778c2dee
    • Linus Torvalds's avatar
      Merge tag 'md-3.4-fixes' of git://neil.brown.name/md · e42bd6e4
      Linus Torvalds authored
      Pull a few more fixes for md from NeilBrown:
       "Two are tagged for -stable.  They can cause an oops, but very rarely."
      
      * tag 'md-3.4-fixes' of git://neil.brown.name/md:
        md/bitmap: prevent bitmap_daemon_work running while initialising bitmap
        md/raid1,raid10: Fix calculation of 'vcnt' when processing error recovery.
        MD: Bitmap version cleanup.
      e42bd6e4
    • Jason Wessel's avatar
      panic: fix stack dump print on direct call to panic() · 026ee1f6
      Jason Wessel authored
      Commit 6e6f0a1f ("panic: don't print redundant backtraces on oops")
      causes a regression where no stack trace will be printed at all for the
      case where kernel code calls panic() directly while not processing an
      oops, and of course there are 100's of instances of this type of call.
      
      The original commit executed the check (!oops_in_progress), but this will
      always be false because just before the dump_stack() there is a call to
      bust_spinlocks(1), which does the following:
      
        void __attribute__((weak)) bust_spinlocks(int yes)
        {
      	if (yes) {
      		++oops_in_progress;
      
      The proper way to resolve the problem that original commit tried to
      solve is to avoid printing a stack dump from panic() when the either of
      the following conditions is true:
      
        1) TAINT_DIE has been set (this is done by oops_end())
           This indicates and oops has already been printed.
        2) oops_in_progress > 1
           This guards against the rare case where panic() is invoked
           a second time, or in between oops_begin() and oops_end()
      Signed-off-by: default avatarJason Wessel <jason.wessel@windriver.com>
      Cc: Andi Kleen <ak@linux.intel.com>
      Cc: <stable@vger.kernel.org>	[3.3+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      026ee1f6
    • Linus Walleij's avatar
      drivers/rtc/rtc-pl031.c: enable clock on all ST variants · 2f397216
      Linus Walleij authored
      The ST variants of the PL031 all require bit 26 in the control register
      to be set before they work properly.  Discovered this when testing on
      the Nomadik board where it would suprisingly just stand still.
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Cc: Mian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com>
      Cc: Alessandro Rubini <rubini@unipv.it>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2f397216
    • Ying Han's avatar
      Revert "mm: vmscan: fix misused nr_reclaimed in shrink_mem_cgroup_zone()" · 41c93088
      Ying Han authored
      This reverts commit c38446cc.
      
      Before the commit, the code makes senses to me but not after the commit.
      The "nr_reclaimed" is the number of pages reclaimed by scanning through
      the memcg's lru lists.  The "nr_to_reclaim" is the target value for the
      whole function.  For example, we like to early break the reclaim if
      reclaimed 32 pages under direct reclaim (not DEF_PRIORITY).
      
      After the reverted commit, the target "nr_to_reclaim" is decremented each
      time by "nr_reclaimed" but we still use it to compare the "nr_reclaimed".
      It just doesn't make sense to me...
      Signed-off-by: default avatarYing Han <yinghan@google.com>
      Acked-by: default avatarHugh Dickins <hughd@google.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Hillf Danton <dhillf@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      41c93088
    • Chris Metcalf's avatar
      hugetlb: fix race condition in hugetlb_fault() · 66aebce7
      Chris Metcalf authored
      The race is as follows:
      
      Suppose a multi-threaded task forks a new process (on cpu A), thus
      bumping up the ref count on all the pages.  While the fork is occurring
      (and thus we have marked all the PTEs as read-only), another thread in
      the original process (on cpu B) tries to write to a huge page, taking an
      access violation from the write-protect and calling hugetlb_cow().  Now,
      suppose the fork() fails.  It will undo the COW and decrement the ref
      count on the pages, so the ref count on the huge page drops back to 1.
      Meanwhile hugetlb_cow() also decrements the ref count by one on the
      original page, since the original address space doesn't need it any
      more, having copied a new page to replace the original page.  This
      leaves the ref count at zero, and when we call unlock_page(), we panic.
      
      	fork on CPU A				fault on CPU B
      	=============				==============
      	...
      	down_write(&parent->mmap_sem);
      	down_write_nested(&child->mmap_sem);
      	...
      	while duplicating vmas
      		if error
      			break;
      	...
      	up_write(&child->mmap_sem);
      	up_write(&parent->mmap_sem);		...
      						down_read(&parent->mmap_sem);
      						...
      						lock_page(page);
      						handle COW
      						page_mapcount(old_page) == 2
      						alloc and prepare new_page
      	...
      	handle error
      	page_remove_rmap(page);
      	put_page(page);
      	...
      						fold new_page into pte
      						page_remove_rmap(page);
      						put_page(page);
      						...
      				oops ==>	unlock_page(page);
      						up_read(&parent->mmap_sem);
      
      The solution is to take an extra reference to the page while we are
      holding the lock on it.
      Signed-off-by: default avatarChris Metcalf <cmetcalf@tilera.com>
      Cc: Hillf Danton <dhillf@gmail.com>
      Cc: Michal Hocko <mhocko@suse.cz>
      Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      66aebce7