Commit graph

288293 commits

Author SHA1 Message Date
Linus Torvalds
1a4edd9072 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  digsig: changed type of the timestamp
2012-02-20 16:13:23 -08:00
John W. Linville
9d4990a260 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem 2012-02-20 14:47:17 -05:00
Linus Torvalds
7e16838d94 i387: support lazy restore of FPU state
This makes us recognize when we try to restore FPU state that matches
what we already have in the FPU on this CPU, and avoids the restore
entirely if so.

To do this, we add two new data fields:

 - a percpu 'fpu_owner_task' variable that gets written any time we
   update the "has_fpu" field, and thus acts as a kind of back-pointer
   to the task that owns the CPU.  The exception is when we save the FPU
   state as part of a context switch - if the save can keep the FPU
   state around, we leave the 'fpu_owner_task' variable pointing at the
   task whose FP state still remains on the CPU.

 - a per-thread 'last_cpu' field, that indicates which CPU that thread
   used its FPU on last.  We update this on every context switch
   (writing an invalid CPU number if the last context switch didn't
   leave the FPU in a lazily usable state), so we know that *that*
   thread has done nothing else with the FPU since.

These two fields together can be used when next switching back to the
task to see if the CPU still matches: if 'fpu_owner_task' matches the
task we are switching to, we know that no other task (or kernel FPU
usage) touched the FPU on this CPU in the meantime, and if the current
CPU number matches the 'last_cpu' field, we know that this thread did no
other FP work on any other CPU, so the FPU state on the CPU must match
what was saved on last context switch.

In that case, we can avoid the 'f[x]rstor' entirely, and just clear the
CR0.TS bit.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-02-20 10:58:54 -08:00
Linus Torvalds
80ab6f1e8c i387: use 'restore_fpu_checking()' directly in task switching code
This inlines what is usually just a couple of instructions, but more
importantly it also fixes the theoretical error case (can that FPU
restore really ever fail? Maybe we should remove the checking).

We can't start sending signals from within the scheduler, we're much too
deep in the kernel and are holding the runqueue lock etc.  So don't
bother even trying.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-02-20 10:58:28 -08:00
Linus Torvalds
cea20ca3f3 i387: fix up some fpu_counter confusion
This makes sure we clear the FPU usage counter for newly created tasks,
just so that we start off in a known state (for example, don't try to
preload the FPU state on the first task switch etc).

It also fixes a thinko in when we increment the fpu_counter at task
switch time, introduced by commit 34ddc81a23 ("i387: re-introduce FPU
state preloading at context switch time").  We should increment the
*new* task fpu_counter, not the old task, and only if we decide to use
that state (whether lazily or preloaded).

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-02-20 10:24:09 -08:00
Tony Lindgren
856c540346 Merge branch 'fixes-mmc' into fixes 2012-02-20 10:11:08 -08:00
Tony Lindgren
d517110243 ARM: OMAP: Fix build error when mmc_omap is built as module
Otherwise we get the following error:

arch/arm/mach-omap2/built-in.o: In function `n8x0_mmc_callback':
twl-common.c:(.text+0x108a0): undefined reference to
`omap_mmc_notify_cover_event'

Fix this by warning about unusable MMC cover events.

The long term fix needs to change the MMC drivers to
register board specific callbacks directly with PMIC.

Reported-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2012-02-20 10:00:38 -08:00
Tony Lindgren
97899e555b ARM: OMAP: Fix kernel panic with HSMMC when twl4030_gpio is a module
On some omaps twl4030_gpio has a callback to try to initialize
the MMC controller. If twl4030_gpio is compiled as a module,
bad things can happen because the callback function starts
calling functions that are supposed to be marked __init:

Kernel panic - not syncing: Attempted to kill the idle task!
twl4030_gpio twl4030_gpio: can't dispatch IRQs from modules
gpiochip_add: registered GPIOs 192 to 209 on device: twl4030
Unable to handle kernel paging request at virtual address b82a4c74
...

Additionally if this does not fail, warnings are produced
about trying to register the MMC multiple times.

Fix this by removing __init from omap_mux_get_by_name,
and add checks if omap2_hsmmc_init() is getting called more
than once.

Note that this will get fixed properly later on by splitting
omap2_hsmmc_init into two functions.

Reported-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2012-02-20 09:43:28 -08:00
Masanari Iida
f232c7e829 MIPS: traps.c: Fix typo
Correct spelling of "Schedulier" to "Scheduler" in arch/mips/kernel/traps.c

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: trivial@kernel.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/3354/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:20 +01:00
Ralf Baechle
d7eb0922b9 MIPS: PowerTV: Fix defconfigs for coverage builds
The toolchain prefix is most likely be site specific and is not
guaranteed to always be "mips-linux-gnu-", so simply don't specify one.
A quick "git grep" shows this to be consistent amongst other cross
compiled targets.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:20 +01:00
Paul Gortmaker
410e512925 MIPS: Netlogic: Fix defconfigs for coverage builds
The toolchain prefix will most likely be site specific and is not
guaranteed to always be "mips-linux-gnu-", so simply don't specify one.
A quick "git grep" shows this to be consistent amongst other cross
compiled targets.

Similarly, the site specific initramfs source location should not be used,
since that won't exist for most people, and it prevents them from doing
coverage builds on the defconfigs, such as those done in linux-next and run
routinely by many others.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Jayachandran C <jayachandranc@netlogicmicro.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/3296/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:19 +01:00
Gabor Juhos
87b43457f8 MIPS: ATH79: Avoid a kernel bug on AR913X
Wireless mac registration causes a BUG on AR913X SoCs due to
a missing 'else'.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/3182/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:19 +01:00
Bjorn Helgaas
f79eaeb108 MIPS: PCI: use list_for_each_entry() for bus->devices traversal
Replace open-coded list traversal with list_for_each_entry().

Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: linux-pci@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/3200/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:19 +01:00
Kautuk Consul
43ca4957a1 MIPS: fault.c: Port OOM changes to do_page_fault
Commit d065bd810b
(mm: retry page fault when blocking on disk transfer) and
commit 37b23e0525
(x86,mm: make pagefault killable)

The above commits introduced changes into the x86 pagefault handler
for making the page fault handler retryable as well as killable.

These changes reduce the mmap_sem hold time, which is crucial
during OOM killer invocation.

Port these changes to MIPS.

Without these changes, my MIPS board encounters many hang and livelock
scenarios.
After applying this patch, OOM feature performance improves according to
my testing.

Signed-off-by: Mohd. Faris <mohdfarisq2010@gmail.com>
Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/3217/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:19 +01:00
Tony Wu
58a7fca67a MIPS: vmlinux.lds.S: remove duplicate _sdata symbol
_sdata is defined twice in vmlinux.lds.S. According to vmlinux.ld.h
in asm-generic, _sdata should be marked at the beginning RO_DATA_SECTION.

 *      _sdata = .;
 *      RO_DATA_SECTION(PAGE_SIZE)
 *      RW_DATA_SECTION(...)
 *      _edata = .;

Remove the one that is marked at RW_DATA_SECTION.

Signed-off-by: Tony Wu <tung7970@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/3215/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:18 +01:00
Manuel Lauss
8e36579035 MIPS: Alchemy: Increase minimum timeout for 32kHz timer.
Since a clocksource change post 3.2-rc1, tasks on my DB1500 board
hang after random amounts of time (from a few minutes to a few hours),
regardless of load.  Debugging showed that the compare-match register
value is a few seconds lower than the current counter value.

The minimum value of 8 was initialy determined by a trial-and-error
approach.  Currently it is sufficient for all Alchemys (without PCI
apparently), independent of CPU clock;  only the DB1500 and DB1550
boards experience these timer-related tasks hangs now.

This patch increases the minimum timeout by 1 (to 9 counter ticks)
which seems sufficient since the systems are still working perfectly
fine after over 24 hours.

Signed-off-by: Manuel Lauss <manuel.lauss@googlemail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/3214/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:18 +01:00
Yoichi Yuasa
193fb42613 MIPS: txx9 7segled fix struct device has no member
arch/mips/txx9/generic/7segled.c: In function 'tx_7segled_init_sysfs':
arch/mips/txx9/generic/7segled.c:105:6: error: 'struct device' has no member named 'dev'
make[3]: *** [arch/mips/txx9/generic/7segled.o] Error 1

Signed-off-by: Yoichi Yuasa <yuasa@linux-mips.org>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Cc: Kay Sievers <kay.sievers@vrfy.org>
Cc: linux-mips@linux-mips.org>
Patchwork: https://patchwork.linux-mips.org/patch/3250/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:18 +01:00
Manuel Lauss
3624919c24 MIPS: Alchemy: Update Au1300 inlined GPIO macros
Add a few missing macros for the inlined (!CONFIG_GPIOLIB) GPIO case.
Fixes a build failure in the mmc core due to missing gpio_request_one()
function:
mmc/core/cd-gpio.c: In function 'mmc_cd_gpio_request':
mmc/core/cd-gpio.c:43:2: error: implicit declaration of function 'gpio_request_one' [-Werror=implicit-function-declaration]

Signed-off-by: Manuel Lauss <manuel.lauss@googlemail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/3268/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:18 +01:00
Ralf Baechle
35d1a455b9 MIPS: Remove temporary kludge from <asm/page.h>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:18 +01:00
Jesper Juhl
dfe981ffb9 MIPS: BMIPS: smp-bmips.c does not need to include version.h
As 'make versioncheck' nicely points out, arch/mips/kernel/smp-bmips.c
has no need to '#include <linux/version.h>'. This patch removes the
unneeded include.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Cc: Kevin Cernekee <cernekee@gmail.com>
Cc: trivial@kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/3269/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-02-20 18:33:17 +01:00
Laxman Dewangan
0a35ee4783 mfd: Initialize tps65910 irq platform data properly
irq_base of the tps65910 irq platform data should be
initialized with the board provided irq_base data.

Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-02-20 17:45:26 +01:00
Konrad Rzeszutek Wilk
8eaffa67b4 xen/pat: Disable PAT support for now.
[Pls also look at https://lkml.org/lkml/2012/2/10/228]

Using of PAT to change pages from WB to WC works quite nicely.
Changing it back to WB - not so much. The crux of the matter is
that the code that does this (__page_change_att_set_clr) has only
limited information so when it tries to the change it gets
the "raw" unfiltered information instead of the properly filtered one -
and the "raw" one tell it that PSE bit is on (while infact it
is not).  As a result when the PTE is set to be WB from WC, we get
tons of:

:WARNING: at arch/x86/xen/mmu.c:475 xen_make_pte+0x67/0xa0()
:Hardware name: HP xw4400 Workstation
.. snip..
:Pid: 27, comm: kswapd0 Tainted: G        W    3.2.2-1.fc16.x86_64 #1
:Call Trace:
: [<ffffffff8106dd1f>] warn_slowpath_common+0x7f/0xc0
: [<ffffffff8106dd7a>] warn_slowpath_null+0x1a/0x20
: [<ffffffff81005a17>] xen_make_pte+0x67/0xa0
: [<ffffffff810051bd>] __raw_callee_save_xen_make_pte+0x11/0x1e
: [<ffffffff81040e15>] ? __change_page_attr_set_clr+0x9d5/0xc00
: [<ffffffff8114c2e8>] ? __purge_vmap_area_lazy+0x158/0x1d0
: [<ffffffff8114cca5>] ? vm_unmap_aliases+0x175/0x190
: [<ffffffff81041168>] change_page_attr_set_clr+0x128/0x4c0
: [<ffffffff81041542>] set_pages_array_wb+0x42/0xa0
: [<ffffffff8100a9b2>] ? check_events+0x12/0x20
: [<ffffffffa0074d4c>] ttm_pages_put+0x1c/0x70 [ttm]
: [<ffffffffa0074e98>] ttm_page_pool_free+0xf8/0x180 [ttm]
: [<ffffffffa0074f78>] ttm_pool_mm_shrink+0x58/0x90 [ttm]
: [<ffffffff8112ba04>] shrink_slab+0x154/0x310
: [<ffffffff8112f17a>] balance_pgdat+0x4fa/0x6c0
: [<ffffffff8112f4b8>] kswapd+0x178/0x3d0
: [<ffffffff815df134>] ? __schedule+0x3d4/0x8c0
: [<ffffffff81090410>] ? remove_wait_queue+0x50/0x50
: [<ffffffff8112f340>] ? balance_pgdat+0x6c0/0x6c0
: [<ffffffff8108fb6c>] kthread+0x8c/0xa0

for every page. The proper fix for this is has been posted
and is https://lkml.org/lkml/2012/2/10/228
"x86/cpa: Use pte_attrs instead of pte_flags on CPA/set_p.._wb/wc operations."
along with a detailed description of the problem and solution.

But since that posting has gone nowhere I am proposing
this band-aid solution so that at least users don't get
the page corruption (the pages that are WC don't get changed to WB
and end up being recycled for filesystem or other things causing
mysterious crashes).

The negative impact of this patch is that users of WC flag
(which are InfiniBand, radeon, nouveau drivers) won't be able
to set that flag - so they are going to see performance degradation.
But stability is more important here.

Fixes RH BZ# 742032, 787403, and 745574
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2012-02-20 10:41:35 -05:00
Konrad Rzeszutek Wilk
416d721474 xen/setup: Remove redundant filtering of PTE masks.
commit 7347b4082e "xen: Allow
unprivileged Xen domains to create iomap pages" added a redundant
line in the early bootup code to filter out the PTE. That
filtering is already done a bit earlier so this extra processing
is not required.

Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2012-02-20 10:40:54 -05:00
Jonghwan Choi
4a55320117 mfd: Fix possible s5m null pointer dereference
This patch checks for pdata to using it.

Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-02-20 16:18:55 +01:00
Jonghwan Choi
aa12242f19 mfd: wm8350 variable dereferenced before check
Remove "wm8350->irq_base = pdata->irq_base" to avoid
null pointer exception and wm8350->irq_base got from
irq_alloc_descs().

Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-02-20 16:18:47 +01:00
Oliver Hartkopp
a7762b10c1 can: sja1000: fix isr hang when hw is unplugged under load
In the case of hotplug enabled devices (PCMCIA/PCIeC) the removal of the
hardware can cause an infinite loop in the common sja1000 isr.

Use the already retrieved status register to indicate a possible hardware
removal and double check by reading the mode register in sja1000_is_absent.

Cc: stable@kernel.org [3.2+]
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Acked-by: Wolfgang Grandegger <wg@grandegger.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2012-02-20 11:36:56 +01:00
Dmitry Kasatkin
59cca653a6 digsig: changed type of the timestamp
time_t was used in the signature and key packet headers,
which is typedef of long and is different on 32 and 64 bit architectures.
Signature and key format should be independent of architecture.
Similar to GPG, I have changed the type to uint32_t.

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Signed-off-by: James Morris <jmorris@namei.org>
2012-02-20 19:46:36 +11:00
Steven Rostedt
45d5a1683c x86/nmi: Test saved %cs in NMI to determine nested NMI case
Currently, the NMI handler tests if it is nested by checking the
special variable saved on the stack (set during NMI handling)
and whether the saved stack is the NMI stack as well (to prevent
the race when the variable is set to zero).

But userspace may set their %rsp to any value as long as they do
not derefence it, and it may make it point to the NMI stack,
which will prevent NMIs from triggering while the userspace app
is running. (I tested this, and it is indeed the case)

Add another check to determine nested NMIs by looking at the
saved %cs (code segment register) and making sure that it is the
kernel code segment.

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <stable@kernel.org>
Link: http://lkml.kernel.org/r/1329687817.1561.27.camel@acer.local.home
Signed-off-by: Ingo Molnar <mingo@elte.hu>
2012-02-20 09:09:57 +01:00
Nikola Pajkovsky
64f0a836f6 b44: remove __exit from b44_pci_exit()
WARNING: drivers/net/ethernet/broadcom/built-in.o(.init.text+0x5d): Section mismatch in reference from the function b44_init() to the function .exit.text:b44_pci_exit()

module exits with b44_cleanup()

Signed-off-by: Nikola Pajkovsky <n.pajkovsky@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-02-19 18:57:51 -05:00
Julia Lawall
8ae0cfee2a drivers/atm/solos-pci.c: exchange pci_iounmaps
The calls to pci_iounmap are in the wrong order, as compared to the
associated calls to pci_iomap.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression e,x;
statement S,S1;
int ret;
@@
e = pci_iomap(x,...)
... when != pci_iounmap(x,e)
if (<+...e...+>) S
... when any
    when != pci_iounmap(x,e)
*if (...)
   { ... when != pci_iounmap(x,e)
     return ...; }
... when any
pci_iounmap(x,e);
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-02-19 18:57:51 -05:00
Dan Carpenter
32aa64f77e net/ethernet: ks8851_mll: signedness bug in ks8851_probe()
netdev->irq is unsigned, so it's never less than zero.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Tested-by: Jan Weitzel <j.weitzel@phytec.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-02-19 18:57:51 -05:00
Neil Horman
b203262de6 vmxnet3: cap copy length at size of skb to prevent dropped frames on tx
I was recently shown that vmxnet3 devices on transmit, will drop very small udp
frames consistently.  This is due to a regression introduced by commit
39d4a96fd7.  This commit attempts to introduce an
optimization to the tx path, indicating that the underlying hardware behaves
optimally when at least 54 bytes of header data are available for direct access.
This causes problems however, if the entire frame is less than 54 bytes long.
The subsequent pskb_may_pull in vmxnet3_parse_and_copy_hdr fails, causing an
error return code, which leads to vmxnet3_tq_xmit dropping the frame.

Fix it by placing a cap on the copy length.  For frames longer than 54 bytes, we
do the pull as we normally would.  If the frame is shorter than that, copy the
whole frame, but no more.  This ensures that we still get the optimization for
qualifying frames, but don't do any damange for frames that are too short.

Also, since I'm unable to do this, it wuold be great if vmware could follow up
this patch with some additional code commentary as to why 54 bytes is an optimal
pull length for a virtual NIC driver.  The comment that introduced this was
vague on that.  Thanks!

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: Max Matveev <mmatveev@redhat.com>
CC: Max Matveev <mmatveev@redhat.com>
CC: "David S. Miller" <davem@davemloft.net>
CC: Shreyas Bhatewara <sbhatewara@vmware.com>
CC: "VMware, Inc." <pv-drivers@vmware.com>
Signed-off-by: Shreyas N Bhatewara <sbhatewara@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-02-19 18:57:51 -05:00
Eric Dumazet
11aad99af6 atl1c: dont use highprio tx queue
This driver attempts to use two TX rings but lacks proper support :

1) IRQ handler only takes care of TX completion on first TX ring
2) the stop/start logic uses the legacy functions (for non multiqueue
drivers)

This means all packets witk skb mark set to 1 are sent through high
queue but are never cleaned and queue eventualy fills and block the
device, triggering the infamous "NETDEV WATCHDOG" message.

Lets use a single TX ring to fix the problem, this driver is not a real
multiqueue one yet.

Minimal fix for stable kernels.

Reported-by: Thomas Meyer <thomas@m3y3r.de>
Tested-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Jay Cliburn <jcliburn@gmail.com>
Cc: Chris Snook <chris.snook@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-02-19 18:57:50 -05:00
Eric Dumazet
cd961c2ca9 netem: fix dequeue
commit 50612537e9 (netem: fix classful handling) added two errors in
netem_dequeue()

1) After checking skb at the head of tfifo queue for time constraints,
   it dequeues tail skb, thus adding unwanted reordering.

2) qdisc stats are updated twice per packet
   (one when packet dequeued from tfifo, once when delivered)

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-02-19 18:57:50 -05:00
Linus Torvalds
b01543dfe6 Linux 3.3-rc4 2012-02-18 15:53:33 -08:00
Linus Torvalds
be2874cb4e These are the bug fixes that have accumulated since 3.3-rc3 in arm-soc.
The majority of them are regression fixes for stuff that broke during
 the merge 3.3 window.
 
 The notable ones are:
 
 * The at91 ata drivers both broke because of an earlier cleanup patch that
   some other patches were based on. Jean-Christophe decided to remove
   the legacy at91_ide driver and fix the new-style at91-pata driver while
   keeping the cleanup patch. I almost rejected the patches for being too
   late and too big but in the end decided to accept them because they
   fix a regression.
 
 * A patch fixing build breakage from the sysdev-to-device conversion
   colliding with other changes touches a number of mach-s3c files.
 
 * b0654037 "ARM: orion: Fix Orion5x GPIO regression from MPP cleanup"
   is a mechanical change that unfortunately touches a lot of lines
   that should up in the diffstat.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIVAwUATztTM2CrR//JCVInAQJu3Q/+KN4npDjjJbRm1FR4J+z7dEy3631gt7Ku
 M64JuC2259da0AtXlHXoc8XB7ZrBkMR2k1n+Q42FqUFVILOXcrHSTId6osPQ8WYE
 TGWR0E2APP6/w4YH3dz0aTUauX0HhnWNP4ShWalWxw2Zsc1nhPNcMO3k57E/PNnp
 nUHb2ZR+Huqk9Eje6/Vkr7OQq7dhl0KJvITJKCT1H93vVYZc5l2O5ZytcOC3dsFg
 yMP/btmu9JlCenOwoKcQFv6ug0tWAYiY4ALqQujLN0kcf7rmjLLOG2HQrnycmeh3
 gv9jwK04gYxHkhPbCLCgO/bg906LVcYIl9/TY7jXK8oE4kR0vVxdQOWEzKIX5+KO
 dyAuwy3uGi4szG8f1DKnz1h7vR1MEyBVgQ+yRqnfhLh7mFmuZcOlGTzziD3csDXG
 qd5B2xf9WvLupfpbvgnHUUKEIJVfWPDoJeN3jGCOjd4+j8OzPR6yeAtU85TDQzIx
 IKs2x+0zrYMBre3R+m5vb9v3IhPb1wZU29eXXRzDmLuHJDM00Qc8LmpiWUoeu3cX
 DwuLstYLm8EhWN+LnjAABd3mKeR5tyBojK3EsDFRxIfz3mKHVNEAPE6Iky60Lfwr
 Pq+LgBBftFfcct70UyXWSK7UI92suavDgCHVejIxpbvIWF1UVY7S1mgmflZ1WZAL
 R5tdx6oe5Y4=
 =QYVn
 -----END PGP SIGNATURE-----

Merge tag 'fixes-3.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

These are the bug fixes that have accumulated since 3.3-rc3 in arm-soc.
The majority of them are regression fixes for stuff that broke during
the merge 3.3 window.

The notable ones are:

* The at91 ata drivers both broke because of an earlier cleanup patch that
  some other patches were based on. Jean-Christophe decided to remove
  the legacy at91_ide driver and fix the new-style at91-pata driver while
  keeping the cleanup patch. I almost rejected the patches for being too
  late and too big but in the end decided to accept them because they
  fix a regression.

* A patch fixing build breakage from the sysdev-to-device conversion
  colliding with other changes touches a number of mach-s3c files.

* b0654037 "ARM: orion: Fix Orion5x GPIO regression from MPP cleanup"
  is a mechanical change that unfortunately touches a lot of lines
  that should up in the diffstat.

* tag 'fixes-3.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (28 commits)
  ARM: at91: drop ide driver in favor of the pata one
  pata/at91: use newly introduced SMC accessors
  ARM: at91: add accessor to manage SMC
  ARM: at91:rtc/rtc-at91sam9: ioremap register bank
  ARM: at91: USB AT91 gadget registration for module
  ep93xx: fix build of vision_ep93xx.c
  ARM: OMAP2xxx: PM: fix OMAP2xxx-specific UART idle bug in v3.3
  ARM: orion: Fix USB phy for orion5x.
  ARM: orion: Fix Orion5x GPIO regression from MPP cleanup
  ARM: EXYNOS: Add cpu-offset property in gic device tree node
  ARM: EXYNOS: Bring exynos4-dt up to date
  ARM: OMAP3: cm-t35: fix section mismatch warning
  ARM: OMAP2: Fix the OMAP2 only build break seen with 2011+ ARM tool-chains
  ARM: tegra: paz00: fix wrong UART port on mini-pcie plug
  ARM: tegra: paz00: fix wrong SD1 power gpio
  i2c: tegra: Add devexit_p() for remove
  ARM: EXYNOS: Correct M-5MOLS sensor clock frequency on Universal C210 board
  ARM: EXYNOS: Correct framebuffer window size on Nuri board
  ARM: SAMSUNG: Fix missing api-change from subsys_interface change
  ARM: EXYNOS: Fix "warning: initialization from incompatible pointer type"
  ...
2012-02-18 15:40:00 -08:00
Linus Torvalds
584216b79c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
1) VETH_INFO_PEER netlink attribute needs to have it's size validated,
   from Thomas Graf.

2) 'poll' module option of bnx2x driver crashes the machine, just remove
   it.  From Michal Schmidt.

3) ks8851_mll driver reads the irq number from two places, but only
   initializes one of them, oops.  Use only one location and fix this
   problem, from Jan Weitzel.

4) Fix buffer overrun and unicast sterring bugs in mellanox mlx4 driver,
   from Eugenia Emantayev.

5) Swapped kcalloc() args in RxRPC and mlx4, from Axel Lin.

6) PHY MDIO device name regression fixes from Florian Fainelli.

7) If the wake event IRQ line is different from the netdevice one, we
   have to properly route it to the stmmac interrupt handler.  From
   Francesco Virlinzi.

8) Fix rwlock lock initialization ordering bug in mac80211, from
   Mohammed Shafi Shajakhan.

9) TCP lost_cnt can get out of sync, and in fact go negative, in certain
   circumstances.  Fix the way we specify what sequence range to operate
   on in tcp_sacktag_one() to fix this bug.  From Neal Cardwell.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (27 commits)
  net/ethernet: ks8851_mll fix irq handling
  veth: Enforce minimum size of VETH_INFO_PEER
  stmmac: update the driver version to Feb 2012 (v2)
  stmmac: move hw init in the probe (v2)
  stmmac: request_irq when use an ext wake irq line (v2)
  stmmac: do not discard frame on dribbling bit assert
  ipheth: Add iPhone 4S
  mlx4: add unicast steering entries to resource_tracker
  mlx4: fix QP tree trashing
  mlx4: fix buffer overrun
  3c59x: shorten timer period for slave devices
  netpoll: netpoll_poll_dev() should access dev->flags
  RxRPC: Fix kcalloc parameters swapped
  bnx2x: remove the 'poll' module option
  tcp: fix tcp_shifted_skb() adjustment of lost_cnt_hint for FACK
  ks8851: Fix NOHZ local_softirq_pending 08 warning
  bnx2x: fix bnx2x_storm_stats_update() on big endian
  ixp4xx-eth: fix PHY name to match MDIO bus name
  octeon: fix PHY name to match MDIO bus name
  fec: fix PHY name to match fixed MDIO bus name
  ...
2012-02-18 15:38:12 -08:00
Linus Torvalds
bff98bfcdb Fixes a bootstrapping issue for some registers when a less commonly used
method for register cache initialisation is used.  Only affects a fairly
 small proportion of users that both don't use explicit register defaults
 and do use the cache.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJPO94HAAoJEBus8iNuMP3dL+kP/2mfXyC8Nrxp9ussST9cElJA
 5S6lnaKVKoA7jSa4MB5QEuMX2C4P9lgKhfZoSOmvbkdgSSU+q18nSYXDDMhgjgWt
 4JUxgmXEeloj17DBpi1iEkJaUBPfmpr5HR8Bu7eFsUbXVd3cYKFVmmPBe+QC6Hf8
 2MvbkcFrOL7TSA1jwYO/O9oZooE1gEkBDpmo/YgwX0u6hWU2Jc/axGhc2ZXWLTmM
 SfPrfAmLq/P6q/RGJX/NPfbLxcPn1nrgv6O8ptgrMeqLjvnWUKfs26tVgiqmzEGi
 SQr5oUZKxwRalHd06Q4P1tBB/tErqnYCC7I3ys3b8zKBcDudRfSIMrwOkhn9XObI
 ePBMwZb6tjWpzCf2NyKwSDhONEf5puE/n36N9vuyyVMNJCnjiCbYcJ2OrRttqOtw
 UDa6ohdH3QzHbIhujvyyE7WM5JiJz+Qtx8/3ZJS6kTEb7oAVPB2luF9e8P7lGfRv
 +TypFrYGkAJhPhafkk5Qx29NX24fvIaErlNLPdgKHr+6O+oAizFXx8XkR7xbIibM
 8RY3ZKrQNvDSTE3lI1sne1GQdJX/4XlVjgZxv6AS/jIKRpI8FMkOmL8hHK2Ttgaq
 lFYeWW8xRD5gtU/ViFbGrFNytMyro/qIVmJ1qVV2IeCz1tdg16oa/3E6F7ubvjHM
 a3IvzDF5njnoKpeWFwiA
 =pU4C
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap

Fixes a bootstrapping issue for some registers when a less commonly used
method for register cache initialisation is used.  Only affects a fairly
small proportion of users that both don't use explicit register defaults
and do use the cache.

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: Fix cache defaults initialization from raw cache defaults
2012-02-18 15:37:25 -08:00
Linus Torvalds
4686066689 Fixes maximum filename length and filesystem type reporting in statfs() calls
and also fixes stale inode mode bits on eCryptfs inodes after a POSIX ACL was
 set on the lower filesystem's inode.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABCgAGBQJPPZzXAAoJENaSAD2qAscKNjsP/0KEqvVV7SXFXq/4yXEij/02
 +wHS8/4SsTXcE2fkzQM2Jx/osoZfO0Tse8VMADwpX+aNyYlfnsdI4RLYm0y5X1JL
 kKdSKNuuEQaA0+YEge4KicsjMQ6nVmYIHGWs3kpEpkk3dKeafVKgh5/+k+NCOs7U
 tZricmWrLV/Rn9pb7S1tp4hOo4cVQEJQGPqaFJ0QwORcdmBWTw904yFsZV+TojFf
 1kEV6ue/mFav7ZPOhz8Cx2xIukUHk8EUykbScTWx3kpdkffF3INsf9b3mt34lEFB
 chuLdcJZuABBBe8RL4g/qRcDOHNUmZx01uX4eHwejs7sYFDfnmNz+tjomr1MRaCv
 JEUgE31n407HR3ChA8IxX1bqHOfjN0mgVnOwnmK4nbnLKX0WvmogaIDV7hZK3Z9Q
 lGeKN0qwU3Cr1N9K/+JLHB3xB/yieE/53tlksHDjRgJAEXy7SV0fcftmgDLxyx5m
 DX4u+eFKdFt+3YBFzTBWRtDO5GVgbylT31JVnKJUi+RDFiOWUf0PzAOXUp5nmr8w
 Md8zZ/kCZY/pbnrETNVcXPrEP9eDb6nY5b16ZP5nADMRtZLQdKiKRRdHtwnKg5N6
 7nU/cS1bpG7bUekJkkRgzrAz+ziDielzVvkhwb7sq3sac9fegjW67K3/SEiJiQJC
 XTBZCrTW3RdEAt6WCTVV
 =hwGP
 -----END PGP SIGNATURE-----

Merge tag 'ecryptfs-3.3-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs

Fixes maximum filename length and filesystem type reporting in statfs() calls
and also fixes stale inode mode bits on eCryptfs inodes after a POSIX ACL was
set on the lower filesystem's inode.

* tag 'ecryptfs-3.3-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
  ecryptfs: remove the second argument of k[un]map_atomic()
  eCryptfs: Copy up lower inode attrs after setting lower xattr
  eCryptfs: Improve statfs reporting
2012-02-18 15:28:56 -08:00
Linus Torvalds
7857b996c2 pinctrl fixes for v3.3
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJPPWTRAAoJEEEQszewGV1zN+EP/iilkZ324VRPgmJHb4C20tb/
 YmMhDNBCptA3yS6XeBeS15F+FLAsKa6/NV3/Czz7AE1nHDLJAkWsomA08TQi8OwR
 LqHeSdn9y7FSILFgpi56/5SoVab4+xFg2MBc+Fm1YqzY6zsdAGeBZxq3Vbw2KnCc
 UcFswmNUtcrJJPHEP1hxQ2V53JXxWZvt76CiUGIgidQ5BXOb0wY6EUrYQAnb9olB
 mwYA9MzUeY06tlKK3uHywgYO5ASdFsiXF01kRJstTceg/BNyaSUxLbyETaL/qBej
 X7HnrFbNjNHJGfd+vpO7eOfEZOa4lr+2vnFeM57d2aVL+S7ktwp4jMcWOVf44vsV
 r3e0jz+lvWuEK7JiZxa4ALcv+RaBrTfZfJANqdboEzdSkKNr7gCN/golnMK78QAb
 hHeHmCP9K65+q4iVdJF3ezvSIzqnA6lYHmnF6cNxFuIUUHnSaGXtulpxqOjSncDT
 +UzoXeLgyrAAXEN/RZTxxKZHW/SIhZafi5gLcTPj2QEAUZkPQk6Ett6E2cXTEoFi
 ai9gW4Y3mEofHbJuhk/KNIRK1m/cAsVmmqoEOOLqoo6XOg9QnJrI3UQ5z+DLI9X/
 pc85Mku63IY6wZqzNwqZ8zJzSoXx8Qyb3CBfe8yq4k54qDqClxDJS2f+6nqLrTgP
 uy82otHBDwYXxhITF463
 =FJrC
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

pinctrl fixes for v3.3

* tag 'pinctrl-for-torvalds-20120216' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: restore pin naming
2012-02-18 15:27:40 -08:00
Linus Torvalds
06ca7c4376 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
Here are a few more fixes for powerpc.  Some are regressions, the rest
is simple/obvious/nasty enough that I deemed it good to go now.

Here's also step one of deprecating legacy iSeries support: we are
removing it from the main defconfig.

Nobody seems to be using it anymore and the code is nasty to maintain,
(involves horrible hacks in various low level areas of the kernel) so we
plan to actually rip it out at some point.  For now let's just avoid
building it by default.  Stephen will proceed to do the actual removal
later (probably 3.4 or 3.5).

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc/perf: power_pmu_start restores incorrect values, breaking frequency events
  powerpc/adb: Use set_current_state()
  powerpc: Disable interrupts early in Program Check
  powerpc: Remove legacy iSeries from ppc64_defconfig
  powerpc/fsl/pci: Fix PCIe fixup regression
  powerpc: Fix kernel log of oops/panic instruction dump
2012-02-18 15:26:37 -08:00
Linus Torvalds
7bcd5b4671 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci
One regression fix for SR-IOV on PPC and a couple of misc fixes from
Yinghai.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci:
  PCI: Fix pci cardbus removal
  PCI: set pci sriov page size before reading SRIOV BAR
  PCI: workaround hard-wired bus number V2
2012-02-18 15:26:11 -08:00
Linus Torvalds
58e44bafbb Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
3 radeon fixes, I have some exynos fixes to push later but I'll queue
them separately once I've looked them over a bit.

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon/kms: fix MSI re-arm on rv370+
  drm/radeon/kms/atom: bios scratch reg handling updates
  drm/radeon/kms: drop lock in return path of radeon_fence_count_emitted.
2012-02-18 15:25:39 -08:00
Linus Torvalds
a18d3afefa Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: sha512 - use standard ror64()
2012-02-18 15:24:05 -08:00
Linus Torvalds
34ddc81a23 i387: re-introduce FPU state preloading at context switch time
After all the FPU state cleanups and finally finding the problem that
caused all our FPU save/restore problems, this re-introduces the
preloading of FPU state that was removed in commit b3b0870ef3 ("i387:
do not preload FPU state at task switch time").

However, instead of simply reverting the removal, this reimplements
preloading with several fixes, most notably

 - properly abstracted as a true FPU state switch, rather than as
   open-coded save and restore with various hacks.

   In particular, implementing it as a proper FPU state switch allows us
   to optimize the CR0.TS flag accesses: there is no reason to set the
   TS bit only to then almost immediately clear it again.  CR0 accesses
   are quite slow and expensive, don't flip the bit back and forth for
   no good reason.

 - Make sure that the same model works for both x86-32 and x86-64, so
   that there are no gratuitous differences between the two due to the
   way they save and restore segment state differently due to
   architectural differences that really don't matter to the FPU state.

 - Avoid exposing the "preload" state to the context switch routines,
   and in particular allow the concept of lazy state restore: if nothing
   else has used the FPU in the meantime, and the process is still on
   the same CPU, we can avoid restoring state from memory entirely, just
   re-expose the state that is still in the FPU unit.

   That optimized lazy restore isn't actually implemented here, but the
   infrastructure is set up for it.  Of course, older CPU's that use
   'fnsave' to save the state cannot take advantage of this, since the
   state saving also trashes the state.

In other words, there is now an actual _design_ to the FPU state saving,
rather than just random historical baggage.  Hopefully it's easier to
follow as a result.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-02-18 14:03:48 -08:00
Ben Hutchings
6c63522460 builddeb: Don't create files in /tmp with predictable names
The current use of /tmp for file lists is insecure.  Put them under
$objtree/debian instead.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: stable@vger.kernel.org  # 2.6.39+
Acked-by: maximilian attems <max@stro.at>
Signed-off-by: Michal Marek <mmarek@suse.cz>
2012-02-18 22:33:26 +01:00
Linus Torvalds
f94edacf99 i387: move TS_USEDFPU flag from thread_info to task_struct
This moves the bit that indicates whether a thread has ownership of the
FPU from the TS_USEDFPU bit in thread_info->status to a word of its own
(called 'has_fpu') in task_struct->thread.has_fpu.

This fixes two independent bugs at the same time:

 - changing 'thread_info->status' from the scheduler causes nasty
   problems for the other users of that variable, since it is defined to
   be thread-synchronous (that's what the "TS_" part of the naming was
   supposed to indicate).

   So perfectly valid code could (and did) do

	ti->status |= TS_RESTORE_SIGMASK;

   and the compiler was free to do that as separate load, or and store
   instructions.  Which can cause problems with preemption, since a task
   switch could happen in between, and change the TS_USEDFPU bit. The
   change to TS_USEDFPU would be overwritten by the final store.

   In practice, this seldom happened, though, because the 'status' field
   was seldom used more than once, so gcc would generally tend to
   generate code that used a read-modify-write instruction and thus
   happened to avoid this problem - RMW instructions are naturally low
   fat and preemption-safe.

 - On x86-32, the current_thread_info() pointer would, during interrupts
   and softirqs, point to a *copy* of the real thread_info, because
   x86-32 uses %esp to calculate the thread_info address, and thus the
   separate irq (and softirq) stacks would cause these kinds of odd
   thread_info copy aliases.

   This is normally not a problem, since interrupts aren't supposed to
   look at thread information anyway (what thread is running at
   interrupt time really isn't very well-defined), but it confused the
   heck out of irq_fpu_usable() and the code that tried to squirrel
   away the FPU state.

   (It also caused untold confusion for us poor kernel developers).

It also turns out that using 'task_struct' is actually much more natural
for most of the call sites that care about the FPU state, since they
tend to work with the task struct for other reasons anyway (ie
scheduling).  And the FPU data that we are going to save/restore is
found there too.

Thanks to Arjan Van De Ven <arjan@linux.intel.com> for pointing us to
the %esp issue.

Cc: Arjan van de Ven <arjan@linux.intel.com>
Reported-and-tested-by: Raphael Prevost <raphael@buro.asia>
Acked-and-tested-by: Suresh Siddha <suresh.b.siddha@intel.com>
Tested-by: Peter Anvin <hpa@zytor.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-02-18 10:19:41 -08:00
Alan Stern
fea6d607e1 [SCSI] scsi_pm: Fix bug in the SCSI power management handler
This patch (as1520) fixes a bug in the SCSI layer's power management
implementation.

LUN scanning can be carried out asynchronously in do_scan_async(), and
sd uses an asynchronous thread for the time-consuming parts of disk
probing in sd_probe_async().  Currently nothing coordinates these
async threads with system sleep transitions; they can and do attempt
to continue scanning/probing SCSI devices even after the host adapter
has been suspended.  As one might expect, the outcome is not ideal.

This is what the "prepare" stage of system suspend was created for.
After the prepare callback has been called for a host, target, or
device, drivers are not allowed to register any children underneath
them.  Currently the SCSI prepare callback is not implemented; this
patch rectifies that omission.

For SCSI hosts, the prepare routine calls scsi_complete_async_scans()
to wait until async scanning is finished.  It might be slightly more
efficient to wait only until the host in question has been scanned,
but there's currently no way to do that.  Besides, during a sleep
transition we will ultimately have to wait until all the host scanning
has finished anyway.

For SCSI devices, the prepare routine calls async_synchronize_full()
to wait until sd probing is finished.  The routine does nothing for
SCSI targets, because asynchronous target scanning is done only as
part of host scanning.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@kernel.org>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-02-18 08:54:19 -06:00
Huajun Li
267a6ad4ae [SCSI] scsi_scan: Fix 'Poison overwritten' warning caused by using freed 'shost'
In do_scan_async(), calling scsi_autopm_put_host(shost) may reference
freed shost, and cause Posison overwitten warning.
Yes, this case can happen, for example, an USB is disconnected just
when do_scan_async() thread starts to run, then scsi_host_put() called
in scsi_finish_async_scan() will lead to shost be freed(because the
refcount of shost->shost_gendev decreases to 1 after USB disconnects),
at this point, if references shost again, system will show following
warning msg.

To make scsi_autopm_put_host(shost) always reference a valid shost,
put it just before scsi_host_put() in function
scsi_finish_async_scan().

[  299.281565] =============================================================================
[  299.281634] BUG kmalloc-4096 (Tainted: G          I ): Poison overwritten
[  299.281682] -----------------------------------------------------------------------------
[  299.281684]
[  299.281752] INFO: 0xffff880056c305d0-0xffff880056c305d0. First byte
0x6a instead of 0x6b
[  299.281816] INFO: Allocated in scsi_host_alloc+0x4a/0x490 age=1688
cpu=1 pid=2004
[  299.281870] 	__slab_alloc+0x617/0x6c1
[  299.281901] 	__kmalloc+0x28c/0x2e0
[  299.281931] 	scsi_host_alloc+0x4a/0x490
[  299.281966] 	usb_stor_probe1+0x5b/0xc40 [usb_storage]
[  299.282010] 	storage_probe+0xa4/0xe0 [usb_storage]
[  299.282062] 	usb_probe_interface+0x172/0x330 [usbcore]
[  299.282105] 	driver_probe_device+0x257/0x3b0
[  299.282138] 	__driver_attach+0x103/0x110
[  299.282171] 	bus_for_each_dev+0x8e/0xe0
[  299.282201] 	driver_attach+0x26/0x30
[  299.282230] 	bus_add_driver+0x1c4/0x430
[  299.282260] 	driver_register+0xb6/0x230
[  299.282298] 	usb_register_driver+0xe5/0x270 [usbcore]
[  299.282337] 	0xffffffffa04ab03d
[  299.282364] 	do_one_initcall+0x47/0x230
[  299.282396] 	sys_init_module+0xa0f/0x1fe0
[  299.282429] INFO: Freed in scsi_host_dev_release+0x18a/0x1d0 age=85
cpu=0 pid=2008
[  299.282482] 	__slab_free+0x3c/0x2a1
[  299.282510] 	kfree+0x296/0x310
[  299.282536] 	scsi_host_dev_release+0x18a/0x1d0
[  299.282574] 	device_release+0x74/0x100
[  299.282606] 	kobject_release+0xc7/0x2a0
[  299.282637] 	kobject_put+0x54/0xa0
[  299.282668] 	put_device+0x27/0x40
[  299.282694] 	scsi_host_put+0x1d/0x30
[  299.282723] 	do_scan_async+0x1fc/0x2b0
[  299.282753] 	kthread+0xdf/0xf0
[  299.282782] 	kernel_thread_helper+0x4/0x10
[  299.282817] INFO: Slab 0xffffea00015b0c00 objects=7 used=7 fp=0x
      (null) flags=0x100000000004080
[  299.282882] INFO: Object 0xffff880056c30000 @offset=0 fp=0x          (null)
[  299.282884]
...

Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
Cc: stable@kernel.org
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-02-18 08:52:48 -06:00
Chad Dupuis
477e3e9ffc [SCSI] qla2xxx: Update version number to 8.03.07.13-k.
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-02-18 08:50:20 -06:00