* [01/26] ALSA: hda - Dont add elements of other codecs to vmaster slave
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [02/26] virtio-pci: fix use after free Greg KH
` (24 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Takashi Iwai
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit aeb4b88ec0a948efce8e3a23a8f964d3560a7308 upstream.
When a virtual mater control is created, the driver looks for slave
elements from the assigned card instance. But this may include the
elements of other codecs when multiple codecs are on the same HD-audio
bus. This works at the first time, but it'll give Oops when it's once
freed and re-created via reconfig sysfs.
This patch changes the element-look-up strategy to limit only to the
mixer elements of the same codec.
Reported-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/pci/hda/hda_codec.c | 60 +++++++++++++++++++++++++++++-----------------
1 file changed, 39 insertions(+), 21 deletions(-)
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -2187,6 +2187,39 @@ int snd_hda_codec_reset(struct hda_codec
return 0;
}
+typedef int (*map_slave_func_t)(void *, struct snd_kcontrol *);
+
+/* apply the function to all matching slave ctls in the mixer list */
+static int map_slaves(struct hda_codec *codec, const char * const *slaves,
+ map_slave_func_t func, void *data)
+{
+ struct hda_nid_item *items;
+ const char * const *s;
+ int i, err;
+
+ items = codec->mixers.list;
+ for (i = 0; i < codec->mixers.used; i++) {
+ struct snd_kcontrol *sctl = items[i].kctl;
+ if (!sctl || !sctl->id.name ||
+ sctl->id.iface != SNDRV_CTL_ELEM_IFACE_MIXER)
+ continue;
+ for (s = slaves; *s; s++) {
+ if (!strcmp(sctl->id.name, *s)) {
+ err = func(data, sctl);
+ if (err)
+ return err;
+ break;
+ }
+ }
+ }
+ return 0;
+}
+
+static int check_slave_present(void *data, struct snd_kcontrol *sctl)
+{
+ return 1;
+}
+
/**
* snd_hda_add_vmaster - create a virtual master control and add slaves
* @codec: HD-audio codec
@@ -2207,12 +2240,10 @@ int snd_hda_add_vmaster(struct hda_codec
unsigned int *tlv, const char * const *slaves)
{
struct snd_kcontrol *kctl;
- const char * const *s;
int err;
- for (s = slaves; *s && !snd_hda_find_mixer_ctl(codec, *s); s++)
- ;
- if (!*s) {
+ err = map_slaves(codec, slaves, check_slave_present, NULL);
+ if (err != 1) {
snd_printdd("No slave found for %s\n", name);
return 0;
}
@@ -2223,23 +2254,10 @@ int snd_hda_add_vmaster(struct hda_codec
if (err < 0)
return err;
- for (s = slaves; *s; s++) {
- struct snd_kcontrol *sctl;
- int i = 0;
- for (;;) {
- sctl = _snd_hda_find_mixer_ctl(codec, *s, i);
- if (!sctl) {
- if (!i)
- snd_printdd("Cannot find slave %s, "
- "skipped\n", *s);
- break;
- }
- err = snd_ctl_add_slave(kctl, sctl);
- if (err < 0)
- return err;
- i++;
- }
- }
+ err = map_slaves(codec, slaves, (map_slave_func_t)snd_ctl_add_slave,
+ kctl);
+ if (err < 0)
+ return err;
return 0;
}
EXPORT_SYMBOL_HDA(snd_hda_add_vmaster);
^ permalink raw reply [flat|nested] 27+ messages in thread* [02/26] virtio-pci: fix use after free
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
2011-11-18 23:58 ` [01/26] ALSA: hda - Dont add elements of other codecs to vmaster slave Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [03/26] ASoC: Dont use wm8994->control_data in wm8994_readable_register() Greg KH
` (23 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, Michael S. Tsirkin, Amit Shah,
Rusty Russell
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Michael S. Tsirkin" <mst@redhat.com>
commit 72103bd1285211440621f2c46f4fce377584de54 upstream.
Commit 31a3ddda166cda86d2b5111e09ba4bda5239fae6 introduced
a use after free in virtio-pci. The main issue is
that the release method signals removal of the virtio device,
while remove signals removal of the pci device.
For example, on driver removal or hot-unplug,
virtio_pci_release_dev is called before virtio_pci_remove.
We then might get a crash as virtio_pci_remove tries to use the
device freed by virtio_pci_release_dev.
We allocate/free all resources together with the
pci device, so we can leave the release method empty.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/virtio/virtio_pci.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -590,11 +590,11 @@ static struct virtio_config_ops virtio_p
static void virtio_pci_release_dev(struct device *_d)
{
- struct virtio_device *dev = container_of(_d, struct virtio_device,
- dev);
- struct virtio_pci_device *vp_dev = to_vp_device(dev);
-
- kfree(vp_dev);
+ /*
+ * No need for a release method as we allocate/free
+ * all devices together with the pci devices.
+ * Provide an empty one to avoid getting a warning from core.
+ */
}
/* the PCI probing function */
@@ -682,6 +682,7 @@ static void __devexit virtio_pci_remove(
pci_iounmap(pci_dev, vp_dev->ioaddr);
pci_release_regions(pci_dev);
pci_disable_device(pci_dev);
+ kfree(vp_dev);
}
#ifdef CONFIG_PM
^ permalink raw reply [flat|nested] 27+ messages in thread* [03/26] ASoC: Dont use wm8994->control_data in wm8994_readable_register()
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
2011-11-18 23:58 ` [01/26] ALSA: hda - Dont add elements of other codecs to vmaster slave Greg KH
2011-11-18 23:58 ` [02/26] virtio-pci: fix use after free Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [04/26] sh: Fix cached/uncaced address calculation in 29bit mode Greg KH
` (22 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Mark Brown
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@opensource.wolfsonmicro.com>
commit 8eeea521d9d0fa6afd62df8c6e6566ee946117fa upstream.
The field is no longer initialised so this will crash if running on
wm8958.
Reported-by: Thomas Abraham <thomas.abraham@linaro.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/soc/codecs/wm8994.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -56,7 +56,7 @@ static int wm8994_retune_mobile_base[] =
static int wm8994_readable(struct snd_soc_codec *codec, unsigned int reg)
{
struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
- struct wm8994 *control = wm8994->control_data;
+ struct wm8994 *control = codec->control_data;
switch (reg) {
case WM8994_GPIO_1:
^ permalink raw reply [flat|nested] 27+ messages in thread* [04/26] sh: Fix cached/uncaced address calculation in 29bit mode
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (2 preceding siblings ...)
2011-11-18 23:58 ` [03/26] ASoC: Dont use wm8994->control_data in wm8994_readable_register() Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [05/26] drm/i915: Fix object refcount leak on mmappable size limit error path Greg KH
` (21 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Nobuhiro Iwamatsu, Paul Mundt
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
commit dfd3b596fbbfa48b8e7966ef996d587157554b69 upstream.
In the case of 29bit mode, CAC/UNCAC_ADDR does not return a right address.
This revises this problem by using P1SEGADDR and P2SEGADDR in 29bit mode.
Reported-by: Yutaro Ebihara <ebiharaml@si-linux.co.jp>
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
Tested-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Tested-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/sh/include/asm/page.h | 5 +++++
1 file changed, 5 insertions(+)
--- a/arch/sh/include/asm/page.h
+++ b/arch/sh/include/asm/page.h
@@ -141,8 +141,13 @@ typedef struct page *pgtable_t;
#endif /* !__ASSEMBLY__ */
#ifdef CONFIG_UNCACHED_MAPPING
+#if defined(CONFIG_29BIT)
+#define UNCAC_ADDR(addr) P2SEGADDR(addr)
+#define CAC_ADDR(addr) P1SEGADDR(addr)
+#else
#define UNCAC_ADDR(addr) ((addr) - PAGE_OFFSET + uncached_start)
#define CAC_ADDR(addr) ((addr) - uncached_start + PAGE_OFFSET)
+#endif
#else
#define UNCAC_ADDR(addr) ((addr))
#define CAC_ADDR(addr) ((addr))
^ permalink raw reply [flat|nested] 27+ messages in thread* [05/26] drm/i915: Fix object refcount leak on mmappable size limit error path.
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (3 preceding siblings ...)
2011-11-18 23:58 ` [04/26] sh: Fix cached/uncaced address calculation in 29bit mode Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [06/26] drm/nouveau: initialize chan->fence.lock before use Greg KH
` (20 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Eric Anholt, Keith Packard
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Anholt <eric@anholt.net>
commit 14660ccd599dc7bd6ecef17408bd76dc853f9b77 upstream.
I've been seeing memory leaks on my system in the form of large
(300-400MB) GEM objects created by now-dead processes laying around
clogging up memory. I usually notice when it gets to about 1.2GB of
them. Hopefully this clears up the issue, but I just found this bug
by inspection.
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/i915/i915_gem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1475,7 +1475,7 @@ i915_gem_mmap_gtt(struct drm_file *file,
if (obj->base.size > dev_priv->mm.gtt_mappable_end) {
ret = -E2BIG;
- goto unlock;
+ goto out;
}
if (obj->madv != I915_MADV_WILLNEED) {
^ permalink raw reply [flat|nested] 27+ messages in thread* [06/26] drm/nouveau: initialize chan->fence.lock before use
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (4 preceding siblings ...)
2011-11-18 23:58 ` [05/26] drm/i915: Fix object refcount leak on mmappable size limit error path Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [07/26] drm/radeon/kms: make an aux failure debug only Greg KH
` (19 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Marcin Slusarz, Ben Skeggs
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Slusarz <marcin.slusarz@gmail.com>
commit 5e60ee780e792efe6dce97eceb110b1d30bab850 upstream.
Fence lock needs to be initialized before any call to nouveau_channel_put
because it calls nouveau_channel_idle->nouveau_fence_update which uses
fence lock.
BUG: spinlock bad magic on CPU#0, test/24134
lock: ffff88019f90dba8, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
Pid: 24134, comm: test Not tainted 3.0.0-nv+ #800
Call Trace:
spin_bug+0x9c/0xa3
do_raw_spin_lock+0x29/0x13c
_raw_spin_lock+0x1e/0x22
nouveau_fence_update+0x2d/0xf1
nouveau_channel_idle+0x22/0xa0
nouveau_channel_put_unlocked+0x84/0x1bd
nouveau_channel_put+0x20/0x24
nouveau_channel_alloc+0x4ec/0x585
nouveau_ioctl_fifo_alloc+0x50/0x130
drm_ioctl+0x289/0x361
do_vfs_ioctl+0x4dd/0x52c
sys_ioctl+0x42/0x65
system_call_fastpath+0x16/0x1b
It's easily triggerable from userspace.
Additionally remove double initialization of chan->fence.pending.
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/nouveau/nouveau_channel.c | 1 +
drivers/gpu/drm/nouveau/nouveau_fence.c | 2 --
2 files changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/gpu/drm/nouveau/nouveau_channel.c
+++ b/drivers/gpu/drm/nouveau/nouveau_channel.c
@@ -159,6 +159,7 @@ nouveau_channel_alloc(struct drm_device
INIT_LIST_HEAD(&chan->nvsw.vbl_wait);
INIT_LIST_HEAD(&chan->nvsw.flip);
INIT_LIST_HEAD(&chan->fence.pending);
+ spin_lock_init(&chan->fence.lock);
/* Allocate DMA push buffer */
chan->pushbuf_bo = nouveau_channel_user_pushbuf_alloc(dev);
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -542,8 +542,6 @@ nouveau_fence_channel_init(struct nouvea
return ret;
}
- INIT_LIST_HEAD(&chan->fence.pending);
- spin_lock_init(&chan->fence.lock);
atomic_set(&chan->fence.last_sequence_irq, 0);
return 0;
}
^ permalink raw reply [flat|nested] 27+ messages in thread* [07/26] drm/radeon/kms: make an aux failure debug only
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (5 preceding siblings ...)
2011-11-18 23:58 ` [06/26] drm/nouveau: initialize chan->fence.lock before use Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [08/26] ALSA: usb-audio - Check the dB-range validity in the later read, too Greg KH
` (18 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Alex Deucher, Dave Airlie
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 091264f0bc12419560ac64fcef4567809d611658 upstream.
Can happen when there is no DP panel attached, confusing
users. Make it debug only.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/radeon/atombios_dp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -283,7 +283,7 @@ int radeon_dp_i2c_aux_ch(struct i2c_adap
}
}
- DRM_ERROR("aux i2c too many retries, giving up\n");
+ DRM_DEBUG_KMS("aux i2c too many retries, giving up\n");
return -EREMOTEIO;
}
^ permalink raw reply [flat|nested] 27+ messages in thread* [08/26] ALSA: usb-audio - Check the dB-range validity in the later read, too
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (6 preceding siblings ...)
2011-11-18 23:58 ` [07/26] drm/radeon/kms: make an aux failure debug only Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [09/26] ALSA: usb-audio - Fix the missing volume quirks at delayed init Greg KH
` (17 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Takashi Iwai
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 9fcd0ab130579d9742538340edda3225f2b49a3e upstream.
When the initial check of dB-range failed due to the read error, try to
check again at the later read, too. When an invalid dB range is found,
remove TLV flags and notify the mixer info change.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/usb/mixer.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -881,8 +881,17 @@ static int mixer_ctl_feature_info(struct
uinfo->value.integer.min = 0;
uinfo->value.integer.max = 1;
} else {
- if (! cval->initialized)
- get_min_max(cval, 0);
+ if (!cval->initialized) {
+ get_min_max(cval, 0);
+ if (cval->initialized && cval->dBmin >= cval->dBmax) {
+ kcontrol->vd[0].access &=
+ ~(SNDRV_CTL_ELEM_ACCESS_TLV_READ |
+ SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK);
+ snd_ctl_notify(cval->mixer->chip->card,
+ SNDRV_CTL_EVENT_MASK_INFO,
+ &kcontrol->id);
+ }
+ }
uinfo->value.integer.min = 0;
uinfo->value.integer.max =
(cval->max - cval->min + cval->res - 1) / cval->res;
^ permalink raw reply [flat|nested] 27+ messages in thread* [09/26] ALSA: usb-audio - Fix the missing volume quirks at delayed init
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (7 preceding siblings ...)
2011-11-18 23:58 ` [08/26] ALSA: usb-audio - Check the dB-range validity in the later read, too Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [10/26] KEYS: Fix a NULL pointer deref in the user-defined key type Greg KH
` (16 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Takashi Iwai
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit dcaaf9f2c16b56f8bb316881fcd3f15c18fc71e7 upstream.
In the recent usb-audio driver, the initialization of volume ranges
may be delayed when the device doesn't respond well at the probing time.
But the volume quirks for certain devices are applied only in
mixer_ctl_feature_info() thus only at the very first probe and will be
missing when the volume range is initialized later.
This patch moves the volume quirk code to be always called from the
volume-range extraction (get_min_max()), so that the quirks are properly
applied in the later init time.
Reported-and-tested-by: Alexey Fisher <bug-track@fisher-privat.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/usb/mixer.c | 109 +++++++++++++++++++++++++++++-------------------------
1 file changed, 59 insertions(+), 50 deletions(-)
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -765,10 +765,60 @@ static void usb_mixer_elem_free(struct s
* interface to ALSA control for feature/mixer units
*/
+/* volume control quirks */
+static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ struct snd_kcontrol *kctl)
+{
+ switch (cval->mixer->chip->usb_id) {
+ case USB_ID(0x0471, 0x0101):
+ case USB_ID(0x0471, 0x0104):
+ case USB_ID(0x0471, 0x0105):
+ case USB_ID(0x0672, 0x1041):
+ /* quirk for UDA1321/N101.
+ * note that detection between firmware 2.1.1.7 (N101)
+ * and later 2.1.1.21 is not very clear from datasheets.
+ * I hope that the min value is -15360 for newer firmware --jk
+ */
+ if (!strcmp(kctl->id.name, "PCM Playback Volume") &&
+ cval->min == -15616) {
+ snd_printk(KERN_INFO
+ "set volume quirk for UDA1321/N101 chip\n");
+ cval->max = -256;
+ }
+ break;
+
+ case USB_ID(0x046d, 0x09a4):
+ if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+ snd_printk(KERN_INFO
+ "set volume quirk for QuickCam E3500\n");
+ cval->min = 6080;
+ cval->max = 8768;
+ cval->res = 192;
+ }
+ break;
+
+ case USB_ID(0x046d, 0x0808):
+ case USB_ID(0x046d, 0x0809):
+ case USB_ID(0x046d, 0x0991):
+ /* Most audio usb devices lie about volume resolution.
+ * Most Logitech webcams have res = 384.
+ * Proboly there is some logitech magic behind this number --fishor
+ */
+ if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+ snd_printk(KERN_INFO
+ "set resolution quirk: cval->res = 384\n");
+ cval->res = 384;
+ }
+ break;
+
+ }
+}
+
/*
* retrieve the minimum and maximum values for the specified control
*/
-static int get_min_max(struct usb_mixer_elem_info *cval, int default_min)
+static int get_min_max_with_quirks(struct usb_mixer_elem_info *cval,
+ int default_min, struct snd_kcontrol *kctl)
{
/* for failsafe */
cval->min = default_min;
@@ -844,6 +894,9 @@ static int get_min_max(struct usb_mixer_
cval->initialized = 1;
}
+ if (kctl)
+ volume_control_quirks(cval, kctl);
+
/* USB descriptions contain the dB scale in 1/256 dB unit
* while ALSA TLV contains in 1/100 dB unit
*/
@@ -864,6 +917,7 @@ static int get_min_max(struct usb_mixer_
return 0;
}
+#define get_min_max(cval, def) get_min_max_with_quirks(cval, def, NULL)
/* get a feature/mixer unit info */
static int mixer_ctl_feature_info(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_info *uinfo)
@@ -882,7 +936,7 @@ static int mixer_ctl_feature_info(struct
uinfo->value.integer.max = 1;
} else {
if (!cval->initialized) {
- get_min_max(cval, 0);
+ get_min_max_with_quirks(cval, 0, kcontrol);
if (cval->initialized && cval->dBmin >= cval->dBmax) {
kcontrol->vd[0].access &=
~(SNDRV_CTL_ELEM_ACCESS_TLV_READ |
@@ -1045,9 +1099,6 @@ static void build_feature_ctl(struct mix
cval->ch_readonly = readonly_mask;
}
- /* get min/max values */
- get_min_max(cval, 0);
-
/* if all channels in the mask are marked read-only, make the control
* read-only. set_cur_mix_value() will check the mask again and won't
* issue write commands to read-only channels. */
@@ -1069,6 +1120,9 @@ static void build_feature_ctl(struct mix
len = snd_usb_copy_string_desc(state, nameid,
kctl->id.name, sizeof(kctl->id.name));
+ /* get min/max values */
+ get_min_max_with_quirks(cval, 0, kctl);
+
switch (control) {
case UAC_FU_MUTE:
case UAC_FU_VOLUME:
@@ -1118,51 +1172,6 @@ static void build_feature_ctl(struct mix
break;
}
- /* volume control quirks */
- switch (state->chip->usb_id) {
- case USB_ID(0x0471, 0x0101):
- case USB_ID(0x0471, 0x0104):
- case USB_ID(0x0471, 0x0105):
- case USB_ID(0x0672, 0x1041):
- /* quirk for UDA1321/N101.
- * note that detection between firmware 2.1.1.7 (N101)
- * and later 2.1.1.21 is not very clear from datasheets.
- * I hope that the min value is -15360 for newer firmware --jk
- */
- if (!strcmp(kctl->id.name, "PCM Playback Volume") &&
- cval->min == -15616) {
- snd_printk(KERN_INFO
- "set volume quirk for UDA1321/N101 chip\n");
- cval->max = -256;
- }
- break;
-
- case USB_ID(0x046d, 0x09a4):
- if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
- snd_printk(KERN_INFO
- "set volume quirk for QuickCam E3500\n");
- cval->min = 6080;
- cval->max = 8768;
- cval->res = 192;
- }
- break;
-
- case USB_ID(0x046d, 0x0808):
- case USB_ID(0x046d, 0x0809):
- case USB_ID(0x046d, 0x0991):
- /* Most audio usb devices lie about volume resolution.
- * Most Logitech webcams have res = 384.
- * Proboly there is some logitech magic behind this number --fishor
- */
- if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
- snd_printk(KERN_INFO
- "set resolution quirk: cval->res = 384\n");
- cval->res = 384;
- }
- break;
-
- }
-
range = (cval->max - cval->min) / cval->res;
/* Are there devices with volume range more than 255? I use a bit more
* to be sure. 384 is a resolution magic number found on Logitech
^ permalink raw reply [flat|nested] 27+ messages in thread* [10/26] KEYS: Fix a NULL pointer deref in the user-defined key type
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (8 preceding siblings ...)
2011-11-18 23:58 ` [09/26] ALSA: usb-audio - Fix the missing volume quirks at delayed init Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [11/26] hfs: add sanity check for file name length Greg KH
` (15 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, David Howells, Jeff Layton, Neil Horman,
Steve Dickson, James Morris
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 9f35a33b8d06263a165efe3541d9aa0cdbd70b3b upstream.
Fix a NULL pointer deref in the user-defined key type whereby updating a
negative key into a fully instantiated key will cause an oops to occur
when the code attempts to free the non-existent old payload.
This results in an oops that looks something like the following:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
IP: [<ffffffff81085fa1>] __call_rcu+0x11/0x13e
PGD 3391d067 PUD 3894a067 PMD 0
Oops: 0002 [#1] SMP
CPU 1
Pid: 4354, comm: keyctl Not tainted 3.1.0-fsdevel+ #1140 /DG965RY
RIP: 0010:[<ffffffff81085fa1>] [<ffffffff81085fa1>] __call_rcu+0x11/0x13e
RSP: 0018:ffff88003d591df8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000006e
RDX: ffffffff8161d0c0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88003d591e18 R08: 0000000000000000 R09: ffffffff8152fa6c
R10: 0000000000000000 R11: 0000000000000300 R12: ffff88003b8f9538
R13: ffffffff8161d0c0 R14: ffff88003b8f9d50 R15: ffff88003c69f908
FS: 00007f97eb18c720(0000) GS:ffff88003bd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000008 CR3: 000000003d47a000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process keyctl (pid: 4354, threadinfo ffff88003d590000, task ffff88003c78a040)
Stack:
ffff88003e0ffde0 ffff88003b8f9538 0000000000000001 ffff88003b8f9d50
ffff88003d591e28 ffffffff810860f0 ffff88003d591e68 ffffffff8117bfea
ffff88003d591e68 ffffffff00000000 ffff88003e0ffde1 ffff88003e0ffde0
Call Trace:
[<ffffffff810860f0>] call_rcu_sched+0x10/0x12
[<ffffffff8117bfea>] user_update+0x8d/0xa2
[<ffffffff8117723a>] key_create_or_update+0x236/0x270
[<ffffffff811789b1>] sys_add_key+0x123/0x17e
[<ffffffff813b84bb>] system_call_fastpath+0x16/0x1b
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Acked-by: Neil Horman <nhorman@redhat.com>
Acked-by: Steve Dickson <steved@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
security/keys/user_defined.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -102,7 +102,8 @@ int user_update(struct key *key, const v
key->expiry = 0;
}
- kfree_rcu(zap, rcu);
+ if (zap)
+ kfree_rcu(zap, rcu);
error:
return ret;
^ permalink raw reply [flat|nested] 27+ messages in thread* [11/26] hfs: add sanity check for file name length
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (9 preceding siblings ...)
2011-11-18 23:58 ` [10/26] KEYS: Fix a NULL pointer deref in the user-defined key type Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [12/26] Revert "leds: save the delay values after a successful call to blink_set()" Greg KH
` (14 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Dan Carpenter
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit bc5b8a9003132ae44559edd63a1623b7b99dfb68 upstream.
On a corrupted file system the ->len field could be wrong leading to
a buffer overflow.
Reported-and-acked-by: Clement LECIGNE <clement.lecigne@netasq.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/hfs/trans.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/hfs/trans.c
+++ b/fs/hfs/trans.c
@@ -40,6 +40,8 @@ int hfs_mac2asc(struct super_block *sb,
src = in->name;
srclen = in->len;
+ if (srclen > HFS_NAMELEN)
+ srclen = HFS_NAMELEN;
dst = out;
dstlen = HFS_MAX_NAMELEN;
if (nls_io) {
^ permalink raw reply [flat|nested] 27+ messages in thread* [12/26] Revert "leds: save the delay values after a successful call to blink_set()"
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (10 preceding siblings ...)
2011-11-18 23:58 ` [11/26] hfs: add sanity check for file name length Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [13/26] drm/radeon: add some missing FireMV pci ids Greg KH
` (13 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, Johan Hovold, Antonio Ospite, Johannes Berg,
Richard Purdie
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit cb871513f656bdfc48b185b55f37857b5c750c40 upstream.
Revert commit 6123b0e274503a0d3588e84fbe07c9aa01bfaf5d.
The problem this patch intends to solve has alreadqy been fixed by
commit 7a5caabd090b ("drivers/leds/ledtrig-timer.c: fix broken sysfs
delay handling").
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Cc: Antonio Ospite <ospite@studenti.unina.it>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/leds/led-class.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -270,11 +270,8 @@ void led_blink_set(struct led_classdev *
del_timer_sync(&led_cdev->blink_timer);
if (led_cdev->blink_set &&
- !led_cdev->blink_set(led_cdev, delay_on, delay_off)) {
- led_cdev->blink_delay_on = *delay_on;
- led_cdev->blink_delay_off = *delay_off;
+ !led_cdev->blink_set(led_cdev, delay_on, delay_off))
return;
- }
/* blink with 1 Hz as default if nothing specified */
if (!*delay_on && !*delay_off)
^ permalink raw reply [flat|nested] 27+ messages in thread* [13/26] drm/radeon: add some missing FireMV pci ids
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (11 preceding siblings ...)
2011-11-18 23:58 ` [12/26] Revert "leds: save the delay values after a successful call to blink_set()" Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [14/26] drm/i915: enable ring freq scaling, RC6 and graphics turbo on Ivy Bridge v3 Greg KH
` (12 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, Alex Deucher, Egbert Eich, Dave Airlie
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit b872a37437e93df9d112ce674752b3b3a0a17020 upstream.
Noticed by Egbert.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: Egbert Eich <eich@suse.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/drm/drm_pciids.h | 2 ++
1 file changed, 2 insertions(+)
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -4,6 +4,7 @@
*/
#define radeon_PCI_IDS \
{0x1002, 0x3150, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY}, \
+ {0x1002, 0x3151, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
{0x1002, 0x3152, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
{0x1002, 0x3154, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
{0x1002, 0x3155, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
@@ -55,6 +56,7 @@
{0x1002, 0x4C64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \
{0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \
{0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \
+ {0x1002, 0x4C6E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|RADEON_IS_MOBILITY}, \
{0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
{0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
{0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
^ permalink raw reply [flat|nested] 27+ messages in thread* [14/26] drm/i915: enable ring freq scaling, RC6 and graphics turbo on Ivy Bridge v3
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (12 preceding siblings ...)
2011-11-18 23:58 ` [13/26] drm/radeon: add some missing FireMV pci ids Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [15/26] sfi: table irq 0xFF means no interrupt Greg KH
` (11 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, Jesse Barnes, Keith Packard, Robert Hooker,
Leann Ogasawara, Herton Krzesinski, Tim Gardner
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Barnes <jbarnes@virtuousgeek.org>
commit 1c70c0cebd1295a42fec75045b8a6b4419cedef3 upstream.
They use the same register interfaces, so we can simply enable the
existing code on IVB.
v2:
- resolve conflict with ring freq scaling, we can enable it too
v3:
- resolve conflict again, this time on drm-intel-next
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Robert Hooker <robert.hooker@canonical.com>
Acked-by: Leann Ogasawara <leann.ogasawara@canonical.com>
Acked-by: Herton Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/i915/i915_debugfs.c | 2 +-
drivers/gpu/drm/i915/intel_display.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -865,7 +865,7 @@ static int i915_cur_delayinfo(struct seq
MEMSTAT_VID_SHIFT);
seq_printf(m, "Current P-state: %d\n",
(rgvstat & MEMSTAT_PSTATE_MASK) >> MEMSTAT_PSTATE_SHIFT);
- } else if (IS_GEN6(dev)) {
+ } else if (IS_GEN6(dev) || IS_GEN7(dev)) {
u32 gt_perf_status = I915_READ(GEN6_GT_PERF_STATUS);
u32 rp_state_limits = I915_READ(GEN6_RP_STATE_LIMITS);
u32 rp_state_cap = I915_READ(GEN6_RP_STATE_CAP);
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -7943,7 +7943,7 @@ void intel_modeset_init(struct drm_devic
intel_init_emon(dev);
}
- if (IS_GEN6(dev))
+ if (IS_GEN6(dev) || IS_GEN7(dev))
gen6_enable_rps(dev_priv);
INIT_WORK(&dev_priv->idle_work, intel_idle_update);
@@ -7985,7 +7985,7 @@ void intel_modeset_cleanup(struct drm_de
if (IS_IRONLAKE_M(dev))
ironlake_disable_drps(dev);
- if (IS_GEN6(dev))
+ if (IS_GEN6(dev) || IS_GEN7(dev))
gen6_disable_rps(dev);
if (IS_IRONLAKE_M(dev))
^ permalink raw reply [flat|nested] 27+ messages in thread* [15/26] sfi: table irq 0xFF means no interrupt
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (13 preceding siblings ...)
2011-11-18 23:58 ` [14/26] drm/i915: enable ring freq scaling, RC6 and graphics turbo on Ivy Bridge v3 Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [16/26] x86, mrst: use a temporary variable for SFI irq Greg KH
` (10 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Kirill A. Shutemov, Alan Cox
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
commit a94cc4e6c0a26a7c8f79a432ab2c89534aa674d5 upstream.
According to the SFI specification irq number 0xFF means device has no
interrupt or interrupt attached via GPIO.
Currently, we don't handle this special case and set irq field in
*_board_info structs to 255. It leads to confusion in some drivers.
Accelerometer driver tries to register interrupt 255, fails and prints
"Cannot get IRQ" to dmesg.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/platform/mrst/mrst.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -689,7 +689,9 @@ static int __init sfi_parse_devs(struct
irq_attr.trigger = 1;
irq_attr.polarity = 1;
io_apic_set_pci_routing(NULL, pentry->irq, &irq_attr);
- }
+ } else
+ pentry->irq = 0; /* No irq */
+
switch (pentry->type) {
case SFI_DEV_TYPE_IPC:
/* ID as IRQ is a hack that will go away */
^ permalink raw reply [flat|nested] 27+ messages in thread* [16/26] x86, mrst: use a temporary variable for SFI irq
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (14 preceding siblings ...)
2011-11-18 23:58 ` [15/26] sfi: table irq 0xFF means no interrupt Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [17/26] b43: refuse to load unsupported firmware Greg KH
` (9 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Mika Westerberg
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <mika.westerberg@linux.intel.com>
commit 153b19a3b9fd8b9478495b9ee1f93f6a77c564f9 upstream.
SFI tables reside in RAM and should not be modified once they are
written. Current code went to set pentry->irq to zero which causes
subsequent reads to fail with invalid SFI table checksum. This will
break kexec as the second kernel fails to validate SFI tables.
To fix this we use temporary variable for irq number.
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/platform/mrst/mrst.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -678,38 +678,40 @@ static int __init sfi_parse_devs(struct
pentry = (struct sfi_device_table_entry *)sb->pentry;
for (i = 0; i < num; i++, pentry++) {
- if (pentry->irq != (u8)0xff) { /* native RTE case */
+ int irq = pentry->irq;
+
+ if (irq != (u8)0xff) { /* native RTE case */
/* these SPI2 devices are not exposed to system as PCI
* devices, but they have separate RTE entry in IOAPIC
* so we have to enable them one by one here
*/
- ioapic = mp_find_ioapic(pentry->irq);
+ ioapic = mp_find_ioapic(irq);
irq_attr.ioapic = ioapic;
- irq_attr.ioapic_pin = pentry->irq;
+ irq_attr.ioapic_pin = irq;
irq_attr.trigger = 1;
irq_attr.polarity = 1;
- io_apic_set_pci_routing(NULL, pentry->irq, &irq_attr);
+ io_apic_set_pci_routing(NULL, irq, &irq_attr);
} else
- pentry->irq = 0; /* No irq */
+ irq = 0; /* No irq */
switch (pentry->type) {
case SFI_DEV_TYPE_IPC:
/* ID as IRQ is a hack that will go away */
- pdev = platform_device_alloc(pentry->name, pentry->irq);
+ pdev = platform_device_alloc(pentry->name, irq);
if (pdev == NULL) {
pr_err("out of memory for SFI platform device '%s'.\n",
pentry->name);
continue;
}
- install_irq_resource(pdev, pentry->irq);
+ install_irq_resource(pdev, irq);
pr_debug("info[%2d]: IPC bus, name = %16.16s, "
- "irq = 0x%2x\n", i, pentry->name, pentry->irq);
+ "irq = 0x%2x\n", i, pentry->name, irq);
sfi_handle_ipc_dev(pdev);
break;
case SFI_DEV_TYPE_SPI:
memset(&spi_info, 0, sizeof(spi_info));
strncpy(spi_info.modalias, pentry->name, SFI_NAME_LEN);
- spi_info.irq = pentry->irq;
+ spi_info.irq = irq;
spi_info.bus_num = pentry->host_num;
spi_info.chip_select = pentry->addr;
spi_info.max_speed_hz = pentry->max_freq;
@@ -726,7 +728,7 @@ static int __init sfi_parse_devs(struct
memset(&i2c_info, 0, sizeof(i2c_info));
bus = pentry->host_num;
strncpy(i2c_info.type, pentry->name, SFI_NAME_LEN);
- i2c_info.irq = pentry->irq;
+ i2c_info.irq = irq;
i2c_info.addr = pentry->addr;
pr_debug("info[%2d]: I2C bus = %d, name = %16.16s, "
"irq = 0x%2x, addr = 0x%x\n", i, bus,
^ permalink raw reply [flat|nested] 27+ messages in thread* [17/26] b43: refuse to load unsupported firmware
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (15 preceding siblings ...)
2011-11-18 23:58 ` [16/26] x86, mrst: use a temporary variable for SFI irq Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [18/26] md/raid5: abort any pending parity operations when array fails Greg KH
` (8 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable, greg
Cc: torvalds, akpm, alan, linux-wireless, b43-dev, roman-vl,
Rafał Miłecki
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1080 bytes --]
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
[This patch is supposed to be applied in 3.1 (and maybe older) branches only.]
New kernels support newer firmware that users may try to incorrectly use
with older kernels. Display error and explain the problem in such a case
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/b43/main.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2401,6 +2401,13 @@ static int b43_upload_microcode(struct b
b43_print_fw_helptext(dev->wl, 1);
err = -EOPNOTSUPP;
goto error;
+ } else if (fwrev >= 598) {
+ b43err(dev->wl, "YOUR FIRMWARE IS TOO NEW. Support for "
+ "firmware 598 and up requires kernel 3.2 or newer. You "
+ "have to install older firmware or upgrade kernel.\n");
+ b43_print_fw_helptext(dev->wl, 1);
+ err = -EOPNOTSUPP;
+ goto error;
}
dev->fw.rev = fwrev;
dev->fw.patch = fwpatch;
^ permalink raw reply [flat|nested] 27+ messages in thread* [18/26] md/raid5: abort any pending parity operations when array fails.
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (16 preceding siblings ...)
2011-11-18 23:58 ` [17/26] b43: refuse to load unsupported firmware Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [19/26] mfd: Fix twl4030 dependencies for audio codec Greg KH
` (7 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Dan Williams, NeilBrown
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit 9a3f530f39f4490eaa18b02719fb74ce5f4d2d86 upstream.
When the number of failed devices exceeds the allowed number
we must abort any active parity operations (checks or updates) as they
are no longer meaningful, and can lead to a BUG_ON in
handle_parity_checks6.
This bug was introduce by commit 6c0069c0ae9659e3a91b68eaed06a5c6c37f45c8
in 2.6.29.
Reported-by: Manish Katiyar <mkatiyar@gmail.com>
Tested-by: Manish Katiyar <mkatiyar@gmail.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/md/raid5.c | 32 ++++++++++++++++++++------------
1 file changed, 20 insertions(+), 12 deletions(-)
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3120,12 +3120,16 @@ static void handle_stripe5(struct stripe
/* check if the array has lost two devices and, if so, some requests might
* need to be failed
*/
- if (s.failed > 1 && s.to_read+s.to_write+s.written)
- handle_failed_stripe(conf, sh, &s, disks, &return_bi);
- if (s.failed > 1 && s.syncing) {
- md_done_sync(conf->mddev, STRIPE_SECTORS,0);
- clear_bit(STRIPE_SYNCING, &sh->state);
- s.syncing = 0;
+ if (s.failed > 1) {
+ sh->check_state = 0;
+ sh->reconstruct_state = 0;
+ if (s.to_read+s.to_write+s.written)
+ handle_failed_stripe(conf, sh, &s, disks, &return_bi);
+ if (s.syncing) {
+ md_done_sync(conf->mddev, STRIPE_SECTORS,0);
+ clear_bit(STRIPE_SYNCING, &sh->state);
+ s.syncing = 0;
+ }
}
/* might be able to return some write requests if the parity block
@@ -3412,12 +3416,16 @@ static void handle_stripe6(struct stripe
/* check if the array has lost >2 devices and, if so, some requests
* might need to be failed
*/
- if (s.failed > 2 && s.to_read+s.to_write+s.written)
- handle_failed_stripe(conf, sh, &s, disks, &return_bi);
- if (s.failed > 2 && s.syncing) {
- md_done_sync(conf->mddev, STRIPE_SECTORS,0);
- clear_bit(STRIPE_SYNCING, &sh->state);
- s.syncing = 0;
+ if (s.failed > 2) {
+ sh->check_state = 0;
+ sh->reconstruct_state = 0;
+ if (s.to_read+s.to_write+s.written)
+ handle_failed_stripe(conf, sh, &s, disks, &return_bi);
+ if (s.syncing) {
+ md_done_sync(conf->mddev, STRIPE_SECTORS,0);
+ clear_bit(STRIPE_SYNCING, &sh->state);
+ s.syncing = 0;
+ }
}
/*
^ permalink raw reply [flat|nested] 27+ messages in thread* [19/26] mfd: Fix twl4030 dependencies for audio codec
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (17 preceding siblings ...)
2011-11-18 23:58 ` [18/26] md/raid5: abort any pending parity operations when array fails Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [20/26] xen:pvhvm: enable PVHVM VCPU placement when using more than 32 CPUs Greg KH
` (6 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, Thomas Weber, Peter Ujfalusi, Samuel Ortiz,
Jarkko Nikula
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weber <weber@corscience.de>
commit f09ee0451a44a4e913a7c3cec3805508f7de6c54 upstream.
The codec for Devkit8000 (TWL4030) was not detected except
when build with CONFIG_SND_SOC_ALL_CODECS.
twl-core.c still uses the CONFIG_TWL4030_CODEC for
twl_has_codec().
In commit 57fe7251f5bfc4332f24479376de48a1e8ca6211
the CONFIG_TWL4030_CODEC was renamed
into CONFIG_MFD_TWL4030_AUDIO, thatswhy the codec
was not detected.
This patch renames the CONFIG_ TWL4030_CODEC into
CONFIG_MFD_TWL4030_AUDIO in twl-core.c.
Signed-off-by: Thomas Weber <weber@corscience.de>
Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Cc: Jarkko Nikula <jarkko.nikula@bitmer.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/mfd/twl-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -109,7 +109,7 @@
#define twl_has_watchdog() false
#endif
-#if defined(CONFIG_TWL4030_CODEC) || defined(CONFIG_TWL4030_CODEC_MODULE) ||\
+#if defined(CONFIG_MFD_TWL4030_AUDIO) || defined(CONFIG_MFD_TWL4030_AUDIO_MODULE) ||\
defined(CONFIG_SND_SOC_TWL6040) || defined(CONFIG_SND_SOC_TWL6040_MODULE)
#define twl_has_codec() true
#else
^ permalink raw reply [flat|nested] 27+ messages in thread* [20/26] xen:pvhvm: enable PVHVM VCPU placement when using more than 32 CPUs.
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (18 preceding siblings ...)
2011-11-18 23:58 ` [19/26] mfd: Fix twl4030 dependencies for audio codec Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [21/26] xen-gntalloc: integer overflow in gntalloc_ioctl_alloc() Greg KH
` (5 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, Stefano Stabellini, Zhenzhong Duan,
Konrad Rzeszutek Wilk
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
commit 90d4f5534d14815bd94c10e8ceccc57287657ecc upstream.
PVHVM running with more than 32 vcpus and pv_irq/pv_time enabled
need VCPU placement to work, or else it will softlockup.
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/xen/enlighten.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1337,7 +1337,7 @@ static int __cpuinit xen_hvm_cpu_notify(
int cpu = (long)hcpu;
switch (action) {
case CPU_UP_PREPARE:
- per_cpu(xen_vcpu, cpu) = &HYPERVISOR_shared_info->vcpu_info[cpu];
+ xen_vcpu_setup(cpu);
if (xen_have_vector_callback)
xen_init_lock_cpu(cpu);
break;
@@ -1367,7 +1367,6 @@ static void __init xen_hvm_guest_init(vo
xen_hvm_smp_init();
register_cpu_notifier(&xen_hvm_cpu_notifier);
xen_unplug_emulated_devices();
- have_vcpu_info_placement = 0;
x86_init.irqs.intr_init = xen_init_IRQ;
xen_hvm_init_time_ops();
xen_hvm_init_mmu_ops();
^ permalink raw reply [flat|nested] 27+ messages in thread* [21/26] xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (19 preceding siblings ...)
2011-11-18 23:58 ` [20/26] xen:pvhvm: enable PVHVM VCPU placement when using more than 32 CPUs Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [22/26] xen-gntalloc: signedness bug in add_grefs() Greg KH
` (4 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, Dan Carpenter, Konrad Rzeszutek Wilk
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 21643e69a4c06f7ef155fbc70e3fba13fba4a756 upstream.
On 32 bit systems a high value of op.count could lead to an integer
overflow in the kzalloc() and gref_ids would be smaller than
expected. If the you triggered another integer overflow in
"if (gref_size + op.count > limit)" then you'd probably get memory
corruption inside add_grefs().
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/xen/gntalloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/xen/gntalloc.c
+++ b/drivers/xen/gntalloc.c
@@ -280,7 +280,7 @@ static long gntalloc_ioctl_alloc(struct
goto out;
}
- gref_ids = kzalloc(sizeof(gref_ids[0]) * op.count, GFP_TEMPORARY);
+ gref_ids = kcalloc(op.count, sizeof(gref_ids[0]), GFP_TEMPORARY);
if (!gref_ids) {
rc = -ENOMEM;
goto out;
^ permalink raw reply [flat|nested] 27+ messages in thread* [22/26] xen-gntalloc: signedness bug in add_grefs()
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (20 preceding siblings ...)
2011-11-18 23:58 ` [21/26] xen-gntalloc: integer overflow in gntalloc_ioctl_alloc() Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [23/26] powerpc/ps3: Fix lost SMP IPIs Greg KH
` (3 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, Dan Carpenter, Konrad Rzeszutek Wilk
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 99cb2ddcc617f43917e94a4147aa3ccdb2bcd77e upstream.
gref->gref_id is unsigned so the error handling didn't work.
gnttab_grant_foreign_access() returns an int type, so we can add a
cast here, and it doesn't cause any problems.
gnttab_grant_foreign_access() can return a variety of errors
including -ENOSPC, -ENOSYS and -ENOMEM.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/xen/gntalloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/xen/gntalloc.c
+++ b/drivers/xen/gntalloc.c
@@ -135,7 +135,7 @@ static int add_grefs(struct ioctl_gntall
/* Grant foreign access to the page. */
gref->gref_id = gnttab_grant_foreign_access(op->domid,
pfn_to_mfn(page_to_pfn(gref->page)), readonly);
- if (gref->gref_id < 0) {
+ if ((int)gref->gref_id < 0) {
rc = gref->gref_id;
goto undo;
}
^ permalink raw reply [flat|nested] 27+ messages in thread* [23/26] powerpc/ps3: Fix lost SMP IPIs
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (21 preceding siblings ...)
2011-11-18 23:58 ` [22/26] xen-gntalloc: signedness bug in add_grefs() Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [24/26] powerpc: Copy down exception vectors after feature fixups Greg KH
` (2 subsequent siblings)
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, Geoff Levand, Benjamin Herrenschmidt
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoff Levand <geoff@infradead.org>
commit 72f3bea075287785ed32b777b6dd2636aa7002e8 upstream.
Fixes the PS3 bootup hang introduced in 3.0-rc1 by:
commit 317f394160e9beb97d19a84c39b7e5eb3d7815a
sched: Move the second half of ttwu() to the remote cpu
Move the PS3's LV1 EOI call lv1_end_of_interrupt_ext() from ps3_chip_eoi()
to ps3_get_irq() for IPI messages.
If lv1_send_event_locally() is called between a previous call to
lv1_send_event_locally() and the coresponding call to
lv1_end_of_interrupt_ext() the second event will not be delivered to the
target cpu.
The PS3's SMP IPIs are implemented using lv1_send_event_locally(), so if two
IPI messages of the same type are sent to the same target in a relatively
short period of time the second IPI event can become lost when
lv1_end_of_interrupt_ext() is called from ps3_chip_eoi().
Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/powerpc/platforms/ps3/interrupt.c | 23 ++++++++++++++++++++++-
arch/powerpc/platforms/ps3/platform.h | 1 +
arch/powerpc/platforms/ps3/smp.c | 2 ++
3 files changed, 25 insertions(+), 1 deletion(-)
--- a/arch/powerpc/platforms/ps3/interrupt.c
+++ b/arch/powerpc/platforms/ps3/interrupt.c
@@ -88,6 +88,7 @@ struct ps3_private {
struct ps3_bmp bmp __attribute__ ((aligned (PS3_BMP_MINALIGN)));
u64 ppe_id;
u64 thread_id;
+ unsigned long ipi_mask;
};
static DEFINE_PER_CPU(struct ps3_private, ps3_private);
@@ -144,7 +145,11 @@ static void ps3_chip_unmask(struct irq_d
static void ps3_chip_eoi(struct irq_data *d)
{
const struct ps3_private *pd = irq_data_get_irq_chip_data(d);
- lv1_end_of_interrupt_ext(pd->ppe_id, pd->thread_id, d->irq);
+
+ /* non-IPIs are EOIed here. */
+
+ if (!test_bit(63 - d->irq, &pd->ipi_mask))
+ lv1_end_of_interrupt_ext(pd->ppe_id, pd->thread_id, d->irq);
}
/**
@@ -691,6 +696,16 @@ void __init ps3_register_ipi_debug_brk(u
cpu, virq, pd->bmp.ipi_debug_brk_mask);
}
+void __init ps3_register_ipi_irq(unsigned int cpu, unsigned int virq)
+{
+ struct ps3_private *pd = &per_cpu(ps3_private, cpu);
+
+ set_bit(63 - virq, &pd->ipi_mask);
+
+ DBG("%s:%d: cpu %u, virq %u, ipi_mask %lxh\n", __func__, __LINE__,
+ cpu, virq, pd->ipi_mask);
+}
+
static unsigned int ps3_get_irq(void)
{
struct ps3_private *pd = &__get_cpu_var(ps3_private);
@@ -720,6 +735,12 @@ static unsigned int ps3_get_irq(void)
BUG();
}
#endif
+
+ /* IPIs are EOIed here. */
+
+ if (test_bit(63 - plug, &pd->ipi_mask))
+ lv1_end_of_interrupt_ext(pd->ppe_id, pd->thread_id, plug);
+
return plug;
}
--- a/arch/powerpc/platforms/ps3/platform.h
+++ b/arch/powerpc/platforms/ps3/platform.h
@@ -43,6 +43,7 @@ void ps3_mm_shutdown(void);
void ps3_init_IRQ(void);
void ps3_shutdown_IRQ(int cpu);
void __init ps3_register_ipi_debug_brk(unsigned int cpu, unsigned int virq);
+void __init ps3_register_ipi_irq(unsigned int cpu, unsigned int virq);
/* smp */
--- a/arch/powerpc/platforms/ps3/smp.c
+++ b/arch/powerpc/platforms/ps3/smp.c
@@ -94,6 +94,8 @@ static void __init ps3_smp_setup_cpu(int
if (result)
virqs[i] = NO_IRQ;
+ else
+ ps3_register_ipi_irq(cpu, virqs[i]);
}
ps3_register_ipi_debug_brk(cpu, virqs[PPC_MSG_DEBUGGER_BREAK]);
^ permalink raw reply [flat|nested] 27+ messages in thread* [24/26] powerpc: Copy down exception vectors after feature fixups
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (22 preceding siblings ...)
2011-11-18 23:58 ` [23/26] powerpc/ps3: Fix lost SMP IPIs Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [25/26] backing-dev: ensure wakeup_timer is deleted Greg KH
2011-11-18 23:58 ` [26/26] block: Always check length of all iov entries in blk_rq_map_user_iov() Greg KH
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, Anton Blanchard, Benjamin Herrenschmidt
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <anton@samba.org>
commit d715e433b7ad19c02fc4becf0d5e9a59f97925de upstream.
kdump fails because we try to execute an HV only instruction. Feature
fixups are being applied after we copy the exception vectors down to 0
so they miss out on any updates.
We have always had this issue but it only became critical in v3.0
when we added CFAR support (breaks POWER5) and v3.1 when we added
POWERNV (breaks everyone).
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/powerpc/include/asm/sections.h | 2 +-
arch/powerpc/include/asm/synch.h | 1 +
arch/powerpc/kernel/kvm.c | 1 -
arch/powerpc/kernel/setup_32.c | 2 ++
arch/powerpc/kernel/setup_64.c | 1 +
arch/powerpc/lib/feature-fixups.c | 23 +++++++++++++++++++++++
6 files changed, 28 insertions(+), 2 deletions(-)
--- a/arch/powerpc/include/asm/sections.h
+++ b/arch/powerpc/include/asm/sections.h
@@ -8,7 +8,7 @@
#ifdef __powerpc64__
-extern char _end[];
+extern char __end_interrupts[];
static inline int in_kernel_text(unsigned long addr)
{
--- a/arch/powerpc/include/asm/synch.h
+++ b/arch/powerpc/include/asm/synch.h
@@ -13,6 +13,7 @@
extern unsigned int __start___lwsync_fixup, __stop___lwsync_fixup;
extern void do_lwsync_fixups(unsigned long value, void *fixup_start,
void *fixup_end);
+extern void do_final_fixups(void);
static inline void eieio(void)
{
--- a/arch/powerpc/kernel/kvm.c
+++ b/arch/powerpc/kernel/kvm.c
@@ -131,7 +131,6 @@ static void kvm_patch_ins_b(u32 *inst, i
/* On relocatable kernels interrupts handlers and our code
can be in different regions, so we don't patch them */
- extern u32 __end_interrupts;
if ((ulong)inst < (ulong)&__end_interrupts)
return;
#endif
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -107,6 +107,8 @@ notrace unsigned long __init early_init(
PTRRELOC(&__start___lwsync_fixup),
PTRRELOC(&__stop___lwsync_fixup));
+ do_final_fixups();
+
return KERNELBASE + offset;
}
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -352,6 +352,7 @@ void __init setup_system(void)
&__start___fw_ftr_fixup, &__stop___fw_ftr_fixup);
do_lwsync_fixups(cur_cpu_spec->cpu_features,
&__start___lwsync_fixup, &__stop___lwsync_fixup);
+ do_final_fixups();
/*
* Unflatten the device-tree passed by prom_init or kexec
--- a/arch/powerpc/lib/feature-fixups.c
+++ b/arch/powerpc/lib/feature-fixups.c
@@ -18,6 +18,8 @@
#include <linux/init.h>
#include <asm/cputable.h>
#include <asm/code-patching.h>
+#include <asm/page.h>
+#include <asm/sections.h>
struct fixup_entry {
@@ -128,6 +130,27 @@ void do_lwsync_fixups(unsigned long valu
}
}
+void do_final_fixups(void)
+{
+#if defined(CONFIG_PPC64) && defined(CONFIG_RELOCATABLE)
+ int *src, *dest;
+ unsigned long length;
+
+ if (PHYSICAL_START == 0)
+ return;
+
+ src = (int *)(KERNELBASE + PHYSICAL_START);
+ dest = (int *)KERNELBASE;
+ length = (__end_interrupts - _stext) / sizeof(int);
+
+ while (length--) {
+ patch_instruction(dest, *src);
+ src++;
+ dest++;
+ }
+#endif
+}
+
#ifdef CONFIG_FTR_FIXUP_SELFTEST
#define check(x) \
^ permalink raw reply [flat|nested] 27+ messages in thread* [25/26] backing-dev: ensure wakeup_timer is deleted
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (23 preceding siblings ...)
2011-11-18 23:58 ` [24/26] powerpc: Copy down exception vectors after feature fixups Greg KH
@ 2011-11-18 23:58 ` Greg KH
2011-11-18 23:58 ` [26/26] block: Always check length of all iov entries in blk_rq_map_user_iov() Greg KH
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: torvalds, akpm, alan, Rabin Vincent, Linus Walleij, Jens Axboe
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rabin Vincent <rabin.vincent@stericsson.com>
commit 7a401a972df8e184b3d1a3fc958c0a4ddee8d312 upstream.
bdi_prune_sb() in bdi_unregister() attempts to removes the bdi links
from all super_blocks and then del_timer_sync() the writeback timer.
However, this can race with __mark_inode_dirty(), leading to
bdi_wakeup_thread_delayed() rearming the writeback timer on the bdi
we're unregistering, after we've called del_timer_sync().
This can end up with the bdi being freed with an active timer inside it,
as in the case of the following dump after the removal of an SD card.
Fix this by redoing the del_timer_sync() in bdi_destory().
------------[ cut here ]------------
WARNING: at /home/rabin/kernel/arm/lib/debugobjects.c:262 debug_print_object+0x9c/0xc8()
ODEBUG: free active (active state 0) object type: timer_list hint: wakeup_timer_fn+0x0/0x180
Modules linked in:
Backtrace:
[<c00109dc>] (dump_backtrace+0x0/0x110) from [<c0236e4c>] (dump_stack+0x18/0x1c)
r6:c02bc638 r5:00000106 r4:c79f5d18 r3:00000000
[<c0236e34>] (dump_stack+0x0/0x1c) from [<c0025e6c>] (warn_slowpath_common+0x54/0x6c)
[<c0025e18>] (warn_slowpath_common+0x0/0x6c) from [<c0025f28>] (warn_slowpath_fmt+0x38/0x40)
r8:20000013 r7:c780c6f0 r6:c031613c r5:c780c6f0 r4:c02b1b29
r3:00000009
[<c0025ef0>] (warn_slowpath_fmt+0x0/0x40) from [<c015eb4c>] (debug_print_object+0x9c/0xc8)
r3:c02b1b29 r2:c02bc662
[<c015eab0>] (debug_print_object+0x0/0xc8) from [<c015f574>] (debug_check_no_obj_freed+0xac/0x1dc)
r6:c7964000 r5:00000001 r4:c7964000
[<c015f4c8>] (debug_check_no_obj_freed+0x0/0x1dc) from [<c00a9e38>] (kmem_cache_free+0x88/0x1f8)
[<c00a9db0>] (kmem_cache_free+0x0/0x1f8) from [<c014286c>] (blk_release_queue+0x70/0x78)
[<c01427fc>] (blk_release_queue+0x0/0x78) from [<c015290c>] (kobject_release+0x70/0x84)
r5:c79641f0 r4:c796420c
[<c015289c>] (kobject_release+0x0/0x84) from [<c0153ce4>] (kref_put+0x68/0x80)
r7:00000083 r6:c74083d0 r5:c015289c r4:c796420c
[<c0153c7c>] (kref_put+0x0/0x80) from [<c01527d0>] (kobject_put+0x48/0x5c)
r5:c79643b4 r4:c79641f0
[<c0152788>] (kobject_put+0x0/0x5c) from [<c013ddd8>] (blk_cleanup_queue+0x68/0x74)
r4:c7964000
[<c013dd70>] (blk_cleanup_queue+0x0/0x74) from [<c01a6370>] (mmc_blk_put+0x78/0xe8)
r5:00000000 r4:c794c400
[<c01a62f8>] (mmc_blk_put+0x0/0xe8) from [<c01a64b4>] (mmc_blk_release+0x24/0x38)
r5:c794c400 r4:c0322824
[<c01a6490>] (mmc_blk_release+0x0/0x38) from [<c00de11c>] (__blkdev_put+0xe8/0x170)
r5:c78d5e00 r4:c74083c0
[<c00de034>] (__blkdev_put+0x0/0x170) from [<c00de2c0>] (blkdev_put+0x11c/0x12c)
r8:c79f5f70 r7:00000001 r6:c74083d0 r5:00000083 r4:c74083c0
r3:00000000
[<c00de1a4>] (blkdev_put+0x0/0x12c) from [<c00b0724>] (kill_block_super+0x60/0x6c)
r7:c7942300 r6:c79f4000 r5:00000083 r4:c74083c0
[<c00b06c4>] (kill_block_super+0x0/0x6c) from [<c00b0a94>] (deactivate_locked_super+0x44/0x70)
r6:c79f4000 r5:c031af64 r4:c794dc00 r3:c00b06c4
[<c00b0a50>] (deactivate_locked_super+0x0/0x70) from [<c00b1358>] (deactivate_super+0x6c/0x70)
r5:c794dc00 r4:c794dc00
[<c00b12ec>] (deactivate_super+0x0/0x70) from [<c00c88b0>] (mntput_no_expire+0x188/0x194)
r5:c794dc00 r4:c7942300
[<c00c8728>] (mntput_no_expire+0x0/0x194) from [<c00c95e0>] (sys_umount+0x2e4/0x310)
r6:c7942300 r5:00000000 r4:00000000 r3:00000000
[<c00c92fc>] (sys_umount+0x0/0x310) from [<c000d940>] (ret_fast_syscall+0x0/0x30)
---[ end trace e5c83c92ada51c76 ]---
Signed-off-by: Rabin Vincent <rabin.vincent@stericsson.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
mm/backing-dev.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -686,6 +686,14 @@ void bdi_destroy(struct backing_dev_info
bdi_unregister(bdi);
+ /*
+ * If bdi_unregister() had already been called earlier, the
+ * wakeup_timer could still be armed because bdi_prune_sb()
+ * can race with the bdi_wakeup_thread_delayed() calls from
+ * __mark_inode_dirty().
+ */
+ del_timer_sync(&bdi->wb.wakeup_timer);
+
for (i = 0; i < NR_BDI_STAT_ITEMS; i++)
percpu_counter_destroy(&bdi->bdi_stat[i]);
^ permalink raw reply [flat|nested] 27+ messages in thread* [26/26] block: Always check length of all iov entries in blk_rq_map_user_iov()
2011-11-19 0:00 [00/26] 3.0.10-stable review Greg KH
` (24 preceding siblings ...)
2011-11-18 23:58 ` [25/26] backing-dev: ensure wakeup_timer is deleted Greg KH
@ 2011-11-18 23:58 ` Greg KH
25 siblings, 0 replies; 27+ messages in thread
From: Greg KH @ 2011-11-18 23:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: torvalds, akpm, alan, Ben Hutchings, Jens Axboe
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 6b76106d8ef31111d6fc469564b83b5f5542794f upstream.
Even after commit 5478755616ae2ef1ce144dded589b62b2a50d575
("block: check for proper length of iov entries earlier ...")
we still won't check for zero-length entries after an unaligned
entry. Remove the break-statement, so all entries are checked.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
block/blk-map.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -204,10 +204,11 @@ int blk_rq_map_user_iov(struct request_q
if (!iov[i].iov_len)
return -EINVAL;
- if (uaddr & queue_dma_alignment(q)) {
+ /*
+ * Keep going so we check length of all segments
+ */
+ if (uaddr & queue_dma_alignment(q))
unaligned = 1;
- break;
- }
}
if (unaligned || (q->dma_pad_mask & len) || map_data)
^ permalink raw reply [flat|nested] 27+ messages in thread