1. 13 Apr, 2012 26 commits
  2. 12 Apr, 2012 14 commits
    • David S. Miller's avatar
    • Eldad Zack's avatar
      net/ipv6/exthdrs.c: Strict PadN option checking · c1412fce
      Eldad Zack authored
      Added strict checking of PadN, as PadN can be used to increase header
      size and thus push the protocol header into the 2nd fragment.
      
      PadN is used to align the options within the Hop-by-Hop or
      Destination Options header to 64-bit boundaries. The maximum valid
      size is thus 7 bytes.
      RFC 4942 recommends to actively check the "payload" itself and
      ensure that it contains only zeroes.
      
      See also RFC 4942 section 2.1.9.5.
      Signed-off-by: default avatarEldad Zack <eldad@fogrefinery.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c1412fce
    • Linus Torvalds's avatar
      Merge branch 'akpm' (Andrew's patch-bomb) · ecca5c3a
      Linus Torvalds authored
      Merge fixes from Andrew Morton.
      
      * emailed from Andrew Morton <akpm@linux-foundation.org>: (14 patches)
        panic: fix stack dump print on direct call to panic()
        drivers/rtc/rtc-pl031.c: enable clock on all ST variants
        Revert "mm: vmscan: fix misused nr_reclaimed in shrink_mem_cgroup_zone()"
        hugetlb: fix race condition in hugetlb_fault()
        drivers/rtc/rtc-twl.c: use static register while reading time
        drivers/rtc/rtc-s3c.c: add placeholder for driver private data
        drivers/rtc/rtc-s3c.c: fix compilation error
        MAINTAINERS: add PCDP console maintainer
        memcg: do not open code accesses to res_counter members
        drivers/rtc/rtc-efi.c: fix section mismatch warning
        drivers/rtc/rtc-r9701.c: reset registers if invalid values are detected
        drivers/char/random.c: fix boot id uniqueness race
        memcg: fix broken boolen expression
        memcg: fix up documentation on global LRU
      ecca5c3a
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 174808af
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix bluetooth userland regression reported by Keith Packard, from
          Gustavo Padovan.
      
       2) Revert ath9k PS idle change, from Sujith Manoharan.
      
       3) Correct default TCP memory limits (again), from Eric Dumazet.
      
       4) Fix tcp_rcv_rtt_update() accidental use of unscaled RTT, from Neal
          Cardwell.
      
       5) We made a facility for layers like wireless to say how much tailroom
          they need in the SKB for link layer stuff such as wireless
          encryption etc., but TCP works hard to fill every SKB out to the end
          defeating this specification.
      
          This leads to every TCP packet getting reallocated by the wireless
          code in order to have the right amount of tailroom available.
      
          Fix TCP to only fill SKBs out to the real amount of data area it
          asked for during the allocation, this way it won't eat into the
          slack added for the device's tailroom needs.
      
          Reported by Marc Merlin and fixed by Eric Dumazet.
      
       6) Leaks, endian bugs, and new device IDs in bluetooth from Santosh
          Nayak, João Paulo Rechi Vita, Cho, Yu-Chen, Andrei Emeltchenko,
          AceLan Kao, and Andrei Emeltchenko.
      
       7) OOPS on tty_close fix in bluetooth's hci_ldisc from Johan Hovold.
      
       8) netfilter erroneously scales TCP window twice, fix from Changli Gao.
      
       9) Memleak fix in wext-core from Julia Lawall.
      
      10) Consistently handle invalid TCP packets in ipv4 vs.  ipv6 conntrack,
          from Jozsef Kadlecsik.
      
      11) Validate IP header length properly in netfilter conntrack's
          ipv4_get_l4proto().
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (39 commits)
        NFC: Fix the LLCP Tx fragmentation loop
        rtlwifi: Add missing DMA buffer unmapping for PCI drivers
        rtlwifi: Preallocate USB read buffers and eliminate kalloc in read routine
        tcp: avoid order-1 allocations on wifi and tx path
        net: allow pskb_expand_head() to get maximum tailroom
        bridge: Do not send queries on multicast group leaves
        MAINTAINERS: Mark NATSEMI driver as orphan'd.
        tcp: fix tcp_rcv_rtt_update() use of an unscaled RTT sample
        tcp: restore correct limit
        Revert "ath9k: fix going to full-sleep on PS idle"
        rt2x00: Fix rfkill_polling register function.
        bcma: fix build error on MIPS; implicit pcibios_enable_device
        netfilter: nf_conntrack: fix incorrect logic in nf_conntrack_init_net
        netfilter: nf_ct_ipv4: packets with wrong ihl are invalid
        netfilter: nf_ct_ipv4: handle invalid IPv4 and IPv6 packets consistently
        net/wireless/wext-core.c: add missing kfree
        rtlwifi: Fix oops on rate-control failure
        mac80211: Convert WARN_ON to WARN_ON_ONCE
        rtlwifi: rtl8192de: Fix firmware initialization
        nl80211: ensure interface is up in various APIs
        ...
      174808af
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 778c2dee
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Mostly exynos and intel.
      
        Intel has 3 regression fixers (more info in intel merge commit), along
        with some other make hw work fixes, exynos has some cleanups and an
        ioctl fix.
      
        A couple of radeon fixes, couple of build fixes, and a savage
        userspace interface possible overflow fix."
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (23 commits)
        drm/exynos: fixed exynos broken ioctl
        drm/i915: clear fencing tracking state when retiring requests
        drm/exynos: fix to pointer manager member of struct exynos_drm_subdrv
        drm/exynos: fix struct for operation callback functions to driver name
        drm/exynos: use define instead of default_win member in struct mixer_context
        drm/exynos: rename s/HDMI_OVERLAY_NUMBER/MIXER_WIN_NR
        drm/exynos: remove unused codes in hdmi and mixer
        drm/exynos: remove unnecessary type conversion of hdmi and mixer
        drm/i915: make rc6 module parameter read-only
        drm/i915: implement ColorBlt w/a
        drm/i915/ringbuffer: Exclude last 2 cachlines of ring on 845g
        Revert "drm/i915: reenable gmbus on gen3+ again"
        drm/radeon: only add the mm i2c bus if the hw_i2c module param is set
        vgaarb.h: fix build warnings
        drm/i915: properly compute dp dithering for user-created modes
        drm/radeon/kms: fix DVO setup on some r4xx chips
        drm/savage: fix integer overflows in savage_bci_cmdbuf()
        drm/radeon: replace udelay with mdelay for long timeouts
        drm/i915: Finish any pending operations on the framebuffer before disabling
        drm/i915: Removed IVB forced enable of sprite dest key.
        ...
      778c2dee
    • Jeffrin Jose's avatar
      net: Fixed coding style issues relating to braces. · 46ba5b23
      Jeffrin Jose authored
      Fixed coding style issues in net/core/utils.c
      in relation with braces placement.
      Signed-off-by: default avatarJeffrin Jose <ahiliation@yahoo.co.in>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      46ba5b23
    • Eldad Zack's avatar
      net/ipv6/ipv6_sockglue.c: Removed redundant extern · 6fdbd164
      Eldad Zack authored
      extern int sysctl_mld_max_msf is already defined in linux/ipv6.h.
      Signed-off-by: default avatarEldad Zack <eldad@fogrefinery.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6fdbd164
    • Linus Torvalds's avatar
      Merge tag 'md-3.4-fixes' of git://neil.brown.name/md · e42bd6e4
      Linus Torvalds authored
      Pull a few more fixes for md from NeilBrown:
       "Two are tagged for -stable.  They can cause an oops, but very rarely."
      
      * tag 'md-3.4-fixes' of git://neil.brown.name/md:
        md/bitmap: prevent bitmap_daemon_work running while initialising bitmap
        md/raid1,raid10: Fix calculation of 'vcnt' when processing error recovery.
        MD: Bitmap version cleanup.
      e42bd6e4
    • Jason Wessel's avatar
      panic: fix stack dump print on direct call to panic() · 026ee1f6
      Jason Wessel authored
      Commit 6e6f0a1f ("panic: don't print redundant backtraces on oops")
      causes a regression where no stack trace will be printed at all for the
      case where kernel code calls panic() directly while not processing an
      oops, and of course there are 100's of instances of this type of call.
      
      The original commit executed the check (!oops_in_progress), but this will
      always be false because just before the dump_stack() there is a call to
      bust_spinlocks(1), which does the following:
      
        void __attribute__((weak)) bust_spinlocks(int yes)
        {
      	if (yes) {
      		++oops_in_progress;
      
      The proper way to resolve the problem that original commit tried to
      solve is to avoid printing a stack dump from panic() when the either of
      the following conditions is true:
      
        1) TAINT_DIE has been set (this is done by oops_end())
           This indicates and oops has already been printed.
        2) oops_in_progress > 1
           This guards against the rare case where panic() is invoked
           a second time, or in between oops_begin() and oops_end()
      Signed-off-by: default avatarJason Wessel <jason.wessel@windriver.com>
      Cc: Andi Kleen <ak@linux.intel.com>
      Cc: <stable@vger.kernel.org>	[3.3+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      026ee1f6
    • Linus Walleij's avatar
      drivers/rtc/rtc-pl031.c: enable clock on all ST variants · 2f397216
      Linus Walleij authored
      The ST variants of the PL031 all require bit 26 in the control register
      to be set before they work properly.  Discovered this when testing on
      the Nomadik board where it would suprisingly just stand still.
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Cc: Mian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com>
      Cc: Alessandro Rubini <rubini@unipv.it>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2f397216
    • Ying Han's avatar
      Revert "mm: vmscan: fix misused nr_reclaimed in shrink_mem_cgroup_zone()" · 41c93088
      Ying Han authored
      This reverts commit c38446cc.
      
      Before the commit, the code makes senses to me but not after the commit.
      The "nr_reclaimed" is the number of pages reclaimed by scanning through
      the memcg's lru lists.  The "nr_to_reclaim" is the target value for the
      whole function.  For example, we like to early break the reclaim if
      reclaimed 32 pages under direct reclaim (not DEF_PRIORITY).
      
      After the reverted commit, the target "nr_to_reclaim" is decremented each
      time by "nr_reclaimed" but we still use it to compare the "nr_reclaimed".
      It just doesn't make sense to me...
      Signed-off-by: default avatarYing Han <yinghan@google.com>
      Acked-by: default avatarHugh Dickins <hughd@google.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Hillf Danton <dhillf@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      41c93088
    • Chris Metcalf's avatar
      hugetlb: fix race condition in hugetlb_fault() · 66aebce7
      Chris Metcalf authored
      The race is as follows:
      
      Suppose a multi-threaded task forks a new process (on cpu A), thus
      bumping up the ref count on all the pages.  While the fork is occurring
      (and thus we have marked all the PTEs as read-only), another thread in
      the original process (on cpu B) tries to write to a huge page, taking an
      access violation from the write-protect and calling hugetlb_cow().  Now,
      suppose the fork() fails.  It will undo the COW and decrement the ref
      count on the pages, so the ref count on the huge page drops back to 1.
      Meanwhile hugetlb_cow() also decrements the ref count by one on the
      original page, since the original address space doesn't need it any
      more, having copied a new page to replace the original page.  This
      leaves the ref count at zero, and when we call unlock_page(), we panic.
      
      	fork on CPU A				fault on CPU B
      	=============				==============
      	...
      	down_write(&parent->mmap_sem);
      	down_write_nested(&child->mmap_sem);
      	...
      	while duplicating vmas
      		if error
      			break;
      	...
      	up_write(&child->mmap_sem);
      	up_write(&parent->mmap_sem);		...
      						down_read(&parent->mmap_sem);
      						...
      						lock_page(page);
      						handle COW
      						page_mapcount(old_page) == 2
      						alloc and prepare new_page
      	...
      	handle error
      	page_remove_rmap(page);
      	put_page(page);
      	...
      						fold new_page into pte
      						page_remove_rmap(page);
      						put_page(page);
      						...
      				oops ==>	unlock_page(page);
      						up_read(&parent->mmap_sem);
      
      The solution is to take an extra reference to the page while we are
      holding the lock on it.
      Signed-off-by: default avatarChris Metcalf <cmetcalf@tilera.com>
      Cc: Hillf Danton <dhillf@gmail.com>
      Cc: Michal Hocko <mhocko@suse.cz>
      Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      66aebce7
    • Konstantin Shlyakhovoy's avatar
      drivers/rtc/rtc-twl.c: use static register while reading time · f3ec434c
      Konstantin Shlyakhovoy authored
      RTC stores time and date in several registers.  Due to the fact that
      these registers can't be read instantaneously, there is a chance that
      reading from counting registers gives an error of one minute, one hour,
      one day, etc.
      
      To address this issue, the RTC has hardware support to copy the RTC
      counting registers to static shadowed registers.  The current
      implementation does not use this feature, and in a stress test, we can
      reproduce this error at a rate of around two times per 300000 readings.
      
      Fix the implementation to ensure that the right snapshot of time is
      captured.
      Signed-off-by: default avatarKonstantin Shlyakhovoy <x0155534@ti.com>
      Signed-off-by: default avatarNishanth Menon <nm@ti.com>
      Cc: Alessandro Zummo <a.zummo@towertech.it>
      Cc: Benoit Cousson <b-cousson@ti.com>
      Cc: linux-omap <linux-omap@vger.kernel.org>
      Acked-by: default avatarMykola Oleksiienko <x0174904@ti.com>
      Acked-by: default avatarOleksandr Dmytryshyn <oleksandr.dmytryshyn@ti.com>
      Acked-by: default avatarGraeme Gregory <gg@slimlogic.co.uk>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f3ec434c
    • Tushar Behera's avatar
      drivers/rtc/rtc-s3c.c: add placeholder for driver private data · c3cba928
      Tushar Behera authored
      Driver data field is a pointer, hence assigning that to an integer results
      in compilation warnings.
      
      Fixes following compilation warnings:
      
        drivers/rtc/rtc-s3c.c: In function `s3c_rtc_get_driver_data':
        drivers/rtc/rtc-s3c.c:452:3: warning: return makes integer from pointer without a cast [enabled by default]
        drivers/rtc/rtc-s3c.c: At top level:
        drivers/rtc/rtc-s3c.c:674:3: warning: initialization makes pointer from integer without a cast [enabled by default]
        drivers/rtc/rtc-s3c.c:674:3: warning: (near initialization for `s3c_rtc_dt_match[1].data') [enabled by default]
        drivers/rtc/rtc-s3c.c:677:3: warning: initialization makes pointer from integer without a cast [enabled by default]
        drivers/rtc/rtc-s3c.c:677:3: warning: (near initialization for `s3c_rtc_dt_match[2].data') [enabled by default]
        drivers/rtc/rtc-s3c.c:680:3: warning: initialization makes pointer from integer without a cast [enabled by default]
        drivers/rtc/rtc-s3c.c:680:3: warning: (near initialization for `s3c_rtc_dt_match[3].data') [enabled by default]
      Signed-off-by: default avatarTushar Behera <tushar.behera@linaro.org>
      Cc: Heiko Stuebner <heiko@sntech.de>
      Cc: Alessandro Zummo <a.zummo@towertech.it>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c3cba928