1. 17 Jan, 2013 28 commits
    • Eugene Shatokhin's avatar
      ext4: fix memory leak in ext4_xattr_set_acl()'s error path · aadee0f0
      Eugene Shatokhin authored
      commit 24ec19b0 upstream.
      
      In ext4_xattr_set_acl(), if ext4_journal_start() returns an error,
      posix_acl_release() will not be called for 'acl' which may result in a
      memory leak.
      
      This patch fixes that.
      Reviewed-by: default avatarLukas Czerner <lczerner@redhat.com>
      Signed-off-by: default avatarEugene Shatokhin <eugene.shatokhin@rosalab.ru>
      Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      aadee0f0
    • Charles Keepax's avatar
      mfd: Only unregister platform devices allocated by the mfd core · af713fb8
      Charles Keepax authored
      commit b9fbb62e upstream.
      
      mfd_remove_devices would iterate over all devices sharing a parent with
      an mfd device regardless of whether they were allocated by the mfd core
      or not. This especially caused problems when the device structure was
      not contained within a platform_device, because to_platform_device is
      used on each device pointer.
      
      This patch defines a device_type for mfd devices and checks this is
      present from mfd_remove_devices_fn before processing the device.
      Signed-off-by: default avatarCharles Keepax <ckeepax@opensource.wolfsonmicro.com>
      Tested-by: default avatarPeter Tyser <ptyser@xes-inc.com>
      Reviewed-by: default avatarMark Brown <broonie@opensource.wolfsonmicro.com>
      Signed-off-by: default avatarSamuel Ortiz <sameo@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      af713fb8
    • Mark Brown's avatar
      mfd: wm8994: Add support for WM1811 rev E · 4bc4d7ec
      Mark Brown authored
      commit fee546ce upstream.
      
      This is supported identically to the previous revisions.
      Signed-off-by: default avatarMark Brown <broonie@opensource.wolfsonmicro.com>
      Signed-off-by: default avatarSamuel Ortiz <sameo@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4bc4d7ec
    • Yi Zou's avatar
      target/tcm_fc: fix the lockdep warning due to inconsistent lock state · 28a63b67
      Yi Zou authored
      commit 9f4ad44b upstream.
      
      The lockdep warning below is in theory correct but it will be in really weird
      rare situation that ends up that deadlock since the tcm fc session is hashed
      based the rport id. Nonetheless, the complaining below is about rcu callback
      that does the transport_deregister_session() is happening in softirq, where
      transport_register_session() that happens earlier is not. This triggers the
      lockdep warning below. So, just fix this to make lockdep happy by disabling
      the soft irq before calling transport_register_session() in ft_prli.
      
      BTW, this was found in FCoE VN2VN over two VMs, couple of create and destroy
      would get this triggered.
      
      v1: was enforcing register to be in softirq context which was not righ. See,
      http://www.spinics.net/lists/target-devel/msg03614.html
      
      v2: following comments from Roland&Nick (thanks), it seems we don't have to
      do transport_deregister_session() in rcu callback, so move it into ft_sess_free()
      but still do kfree() of the corresponding ft_sess struct in rcu callback to
      make sure the ft_sess is not freed till the rcu callback.
      
      ...
      [ 1328.370592] scsi2 : FCoE Driver
      [ 1328.383429] fcoe: No FDMI support.
      [ 1328.384509] host2: libfc: Link up on port (000000)
      [ 1328.934229] host2: Assigned Port ID 00a292
      [ 1357.232132] host2: rport 00a393: Remove port
      [ 1357.232568] host2: rport 00a393: Port sending LOGO from Ready state
      [ 1357.233692] host2: rport 00a393: Delete port
      [ 1357.234472] host2: rport 00a393: work event 3
      [ 1357.234969] host2: rport 00a393: callback ev 3
      [ 1357.235979] host2: rport 00a393: Received a LOGO response closed
      [ 1357.236706] host2: rport 00a393: work delete
      [ 1357.237481]
      [ 1357.237631] =================================
      [ 1357.238064] [ INFO: inconsistent lock state ]
      [ 1357.238450] 3.7.0-rc7-yikvm+ #3 Tainted: G           O
      [ 1357.238450] ---------------------------------
      [ 1357.238450] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
      [ 1357.238450] ksoftirqd/0/3 [HC0[0]:SC1[1]:HE0:SE0] takes:
      [ 1357.238450]  (&(&se_tpg->session_lock)->rlock){+.?...}, at: [<ffffffffa01eacd4>] transport_deregister_session+0x41/0x148 [target_core_mod]
      [ 1357.238450] {SOFTIRQ-ON-W} state was registered at:
      [ 1357.238450]   [<ffffffff810834f5>] mark_held_locks+0x6d/0x95
      [ 1357.238450]   [<ffffffff8108364a>] trace_hardirqs_on_caller+0x12d/0x197
      [ 1357.238450]   [<ffffffff810836c1>] trace_hardirqs_on+0xd/0xf
      [ 1357.238450]   [<ffffffff8149caba>] _raw_spin_unlock_irq+0x2d/0x45
      [ 1357.238450]   [<ffffffffa01e8d10>] __transport_register_session+0xb8/0x122 [target_core_mod]
      [ 1357.238450]   [<ffffffffa01e8dbe>] transport_register_session+0x44/0x5a [target_core_mod]
      [ 1357.238450]   [<ffffffffa018e32c>] ft_prli+0x1e3/0x275 [tcm_fc]
      [ 1357.238450]   [<ffffffffa0160e8d>] fc_rport_recv_req+0x95e/0xdc5 [libfc]
      [ 1357.238450]   [<ffffffffa015be88>] fc_lport_recv_els_req+0xc4/0xd5 [libfc]
      [ 1357.238450]   [<ffffffffa015c778>] fc_lport_recv_req+0x12f/0x18f [libfc]
      [ 1357.238450]   [<ffffffffa015a6d7>] fc_exch_recv+0x8ba/0x981 [libfc]
      [ 1357.238450]   [<ffffffffa0176d7a>] fcoe_percpu_receive_thread+0x47a/0x4e2 [fcoe]
      [ 1357.238450]   [<ffffffff810549f1>] kthread+0xb1/0xb9
      [ 1357.238450]   [<ffffffff814a40ec>] ret_from_fork+0x7c/0xb0
      [ 1357.238450] irq event stamp: 275411
      [ 1357.238450] hardirqs last  enabled at (275410): [<ffffffff810bb6a0>] rcu_process_callbacks+0x229/0x42a
      [ 1357.238450] hardirqs last disabled at (275411): [<ffffffff8149c2f7>] _raw_spin_lock_irqsave+0x22/0x8e
      [ 1357.238450] softirqs last  enabled at (275394): [<ffffffff8103d669>] __do_softirq+0x246/0x26f
      [ 1357.238450] softirqs last disabled at (275399): [<ffffffff8103d6bb>] run_ksoftirqd+0x29/0x62
      [ 1357.238450]
      [ 1357.238450] other info that might help us debug this:
      [ 1357.238450]  Possible unsafe locking scenario:
      [ 1357.238450]
      [ 1357.238450]        CPU0
      [ 1357.238450]        ----
      [ 1357.238450]   lock(&(&se_tpg->session_lock)->rlock);
      [ 1357.238450]   <Interrupt>
      [ 1357.238450]     lock(&(&se_tpg->session_lock)->rlock);
      [ 1357.238450]
      [ 1357.238450]  *** DEADLOCK ***
      [ 1357.238450]
      [ 1357.238450] no locks held by ksoftirqd/0/3.
      [ 1357.238450]
      [ 1357.238450] stack backtrace:
      [ 1357.238450] Pid: 3, comm: ksoftirqd/0 Tainted: G           O 3.7.0-rc7-yikvm+ #3
      [ 1357.238450] Call Trace:
      [ 1357.238450]  [<ffffffff8149399a>] print_usage_bug+0x1f5/0x206
      [ 1357.238450]  [<ffffffff8100da59>] ? save_stack_trace+0x2c/0x49
      [ 1357.238450]  [<ffffffff81082aae>] ? print_irq_inversion_bug.part.14+0x1ae/0x1ae
      [ 1357.238450]  [<ffffffff81083336>] mark_lock+0x106/0x258
      [ 1357.238450]  [<ffffffff81084e34>] __lock_acquire+0x2e7/0xe53
      [ 1357.238450]  [<ffffffff8102903d>] ? pvclock_clocksource_read+0x48/0xb4
      [ 1357.238450]  [<ffffffff810ba6a3>] ? rcu_process_gp_end+0xc0/0xc9
      [ 1357.238450]  [<ffffffffa01eacd4>] ? transport_deregister_session+0x41/0x148 [target_core_mod]
      [ 1357.238450]  [<ffffffff81085ef1>] lock_acquire+0x119/0x143
      [ 1357.238450]  [<ffffffffa01eacd4>] ? transport_deregister_session+0x41/0x148 [target_core_mod]
      [ 1357.238450]  [<ffffffff8149c329>] _raw_spin_lock_irqsave+0x54/0x8e
      [ 1357.238450]  [<ffffffffa01eacd4>] ? transport_deregister_session+0x41/0x148 [target_core_mod]
      [ 1357.238450]  [<ffffffffa01eacd4>] transport_deregister_session+0x41/0x148 [target_core_mod]
      [ 1357.238450]  [<ffffffff810bb6a0>] ? rcu_process_callbacks+0x229/0x42a
      [ 1357.238450]  [<ffffffffa018ddc5>] ft_sess_rcu_free+0x17/0x24 [tcm_fc]
      [ 1357.238450]  [<ffffffffa018ddae>] ? ft_sess_free+0x1b/0x1b [tcm_fc]
      [ 1357.238450]  [<ffffffff810bb6d7>] rcu_process_callbacks+0x260/0x42a
      [ 1357.238450]  [<ffffffff8103d55d>] __do_softirq+0x13a/0x26f
      [ 1357.238450]  [<ffffffff8149b34e>] ? __schedule+0x65f/0x68e
      [ 1357.238450]  [<ffffffff8103d6bb>] run_ksoftirqd+0x29/0x62
      [ 1357.238450]  [<ffffffff8105c83c>] smpboot_thread_fn+0x1a5/0x1aa
      [ 1357.238450]  [<ffffffff8105c697>] ? smpboot_unregister_percpu_thread+0x47/0x47
      [ 1357.238450]  [<ffffffff810549f1>] kthread+0xb1/0xb9
      [ 1357.238450]  [<ffffffff8149b49d>] ? wait_for_common+0xbb/0x10a
      [ 1357.238450]  [<ffffffff81054940>] ? __init_kthread_worker+0x59/0x59
      [ 1357.238450]  [<ffffffff814a40ec>] ret_from_fork+0x7c/0xb0
      [ 1357.238450]  [<ffffffff81054940>] ? __init_kthread_worker+0x59/0x59
      [ 1417.440099]  rport-2:0-0: blocked FC remote port time out: removing rport
      Signed-off-by: default avatarYi Zou <yi.zou@intel.com>
      Cc: Open-FCoE <devel@open-fcoe.org>
      Cc: Nicholas A. Bellinger <nab@risingtidesystems.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      28a63b67
    • Xiaotian Feng's avatar
      libata: fix Null pointer dereference on disk error · 93269101
      Xiaotian Feng authored
      commit 26cd4d65 upstream.
      
      Following oops were observed when disk error happened:
      
      [ 4272.896937] sd 0:0:0:0: [sda] Unhandled error code
      [ 4272.896939] sd 0:0:0:0: [sda] Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
      [ 4272.896942] sd 0:0:0:0: [sda] CDB: Read(10): 28 00 00 5a de a7 00 00 08 00
      [ 4272.896951] end_request: I/O error, dev sda, sector 5955239
      [ 4291.574947] BUG: unable to handle kernel NULL pointer dereference at (null)
      [ 4291.658305] IP: [] ahci_activity_show+0x1/0x40
      [ 4291.730090] PGD 76dbbc067 PUD 6c4fba067 PMD 0
      [ 4291.783408] Oops: 0000 [#1] SMP
      [ 4291.822100] last sysfs file: /sys/devices/pci0000:00/0000:00:1f.2/host0/target0:0:0/0:0:0:0/sw_activity
      [ 4291.934235] CPU 9
      [ 4291.958301] Pid: 27942, comm: hwinfo ......
      
      ata_scsi_find_dev could return NULL, so ata_scsi_activity_{show,store} should check if atadev is NULL.
      Signed-off-by: default avatarXiaotian Feng <dannyfeng@tencent.com>
      Cc: James Bottomley <JBottomley@Parallels.com>
      Signed-off-by: default avatarJeff Garzik <jgarzik@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      93269101
    • Aaron Lu's avatar
      libata: set dma_mode to 0xff in reset · d8876cb6
      Aaron Lu authored
      commit 5416912a upstream.
      
      ata_device->dma_mode's initial value is zero, which is not a valid dma
      mode, but ata_dma_enabled will return true for this value. This patch
      sets dma_mode to 0xff in reset function, so that ata_dma_enabled will
      not return true for this case, or it will cause problem for pata_acpi.
      
      The corrsponding bugzilla page is at:
      https://bugzilla.kernel.org/show_bug.cgi?id=49151Reported-by: default avatarPhillip Wood <phillip.wood@dunelm.org.uk>
      Signed-off-by: default avatarAaron Lu <aaron.lu@intel.com>
      Tested-by: default avatarSzymon Janc <szymon@janc.net.pl>
      Tested-by: default avatarDutra Julio <dutra.julio@gmail.com>
      Acked-by: default avatarAlan Cox <alan@linux.intel.com>
      Signed-off-by: default avatarJeff Garzik <jgarzik@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d8876cb6
    • Mikael Pettersson's avatar
      sata_promise: fix hardreset lockdep error · 4b693aca
      Mikael Pettersson authored
      commit 3100d49d upstream.
      
      sata_promise's pdc_hard_reset_port() needs to serialize because it
      flips a port-specific bit in controller register that's shared by
      all ports. The code takes the ata host lock for this, but that's
      broken because an interrupt may arrive on our irq during the hard
      reset sequence, and that too will take the ata host lock. With
      lockdep enabled a big nasty warning is seen.
      
      Fixed by adding private state to the ata host structure, containing
      a second lock used only for serializing the hard reset sequences.
      This eliminated the lockdep warnings both on my test rig and on
      the original reporter's machine.
      Signed-off-by: default avatarMikael Pettersson <mikpe@it.uu.se>
      Tested-by: default avatarAdko Branil <adkobranil@yahoo.com>
      Signed-off-by: default avatarJeff Garzik <jgarzik@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4b693aca
    • Wei Yongjun's avatar
      iscsit: use GFP_ATOMIC under spin lock · 370caef9
      Wei Yongjun authored
      commit 3c989d76 upstream.
      
      The function iscsit_build_conn_drop_async_message() is called
      from iscsit_close_connection() with spin lock 'sess->conn_lock'
      held, so we should use GFP_ATOMIC instead of GFP_KERNEL.
      Signed-off-by: default avatarWei Yongjun <yongjun_wei@trendmicro.com.cn>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      370caef9
    • David Jeffery's avatar
      SCSI: qla2xxx: Test and clear FCPORT_UPDATE_NEEDED atomically. · 2e4be188
      David Jeffery authored
      commit a394aac8 upstream.
      
      When the qla2xxx driver loses access to multiple, remote ports, there is a race
      condition which can occur which will keep the request stuck on a scsi request
      queue indefinitely.
      
      This bad state occurred do to a race condition with how the FCPORT_UPDATE_NEEDED
      bit is set in qla2x00_schedule_rport_del(), and how it is cleared in
      qla2x00_do_dpc().  The problem port has its drport pointer set, but it has never
      been processed by the driver to inform the fc transport that the port has been
      lost.  qla2x00_schedule_rport_del() sets drport, and then sets the
      FCPORT_UPDATE_NEEDED bit.  In qla2x00_do_dpc(), the port lists are walked and
      any drport pointer is handled and the fc transport informed of the port loss,
      then the FCPORT_UPDATE_NEEDED bit is cleared.  This leaves a race where the
      dpc thread is processing one port removal, another port removal is marked
      with a call to qla2x00_schedule_rport_del(), and the dpc thread clears the
      bit for both removals, even though only the first removal was actually
      handled.  Until another event occurs to set FCPORT_UPDATE_NEEDED, the later
      port removal is never finished and qla2xxx stays in a bad state which causes
      requests to become stuck on request queues.
      
      This patch updates the driver to test and clear FCPORT_UPDATE_NEEDED
      atomically.  This ensures the port state changes are processed and not lost.
      Signed-off-by: default avatarDavid Jeffery <djeffery@redhat.com>
      Signed-off-by: default avatarChad Dupuis <chad.dupuis@qlogic.com>
      Signed-off-by: default avatarSaurav Kashyap <saurav.kashyap@qlogic.com>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2e4be188
    • Sasha Levin's avatar
      SCSI: prevent stack buffer overflow in host_reset · e21c4b90
      Sasha Levin authored
      commit 072f19b4 upstream.
      
      store_host_reset() has tried to re-invent the wheel to compare sysfs strings.
      Unfortunately it did so poorly and never bothered to check the input from
      userspace before overwriting stack with it, so something simple as:
      
      echo "WoopsieWoopsie" >
      /sys/devices/pseudo_0/adapter0/host0/scsi_host/host0/host_reset
      
      would result in:
      
      [  316.310101] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff81f5bac7
      [  316.310101]
      [  316.320051] Pid: 6655, comm: sh Tainted: G        W    3.7.0-rc5-next-20121114-sasha-00016-g5c9d68d-dirty #129
      [  316.320051] Call Trace:
      [  316.340058] pps pps0: PPS event at 1352918752.620355751
      [  316.340062] pps pps0: capture assert seq #303
      [  316.320051]  [<ffffffff83b3856b>] panic+0xcd/0x1f4
      [  316.320051]  [<ffffffff81f5bac7>] ? store_host_reset+0xd7/0x100
      [  316.320051]  [<ffffffff8110b996>] __stack_chk_fail+0x16/0x20
      [  316.320051]  [<ffffffff81f5bac7>] store_host_reset+0xd7/0x100
      [  316.320051]  [<ffffffff81e55bb3>] dev_attr_store+0x13/0x30
      [  316.320051]  [<ffffffff812f7db1>] sysfs_write_file+0x101/0x170
      [  316.320051]  [<ffffffff8127acc8>] vfs_write+0xb8/0x180
      [  316.320051]  [<ffffffff8127ae80>] sys_write+0x50/0xa0
      [  316.320051]  [<ffffffff83c03418>] tracesys+0xe1/0xe6
      
      Fix this by uninventing whatever was going on there and just use sysfs_streq.
      
      Bug introduced by 29443691 ("[SCSI] scsi: Added support for adapter and
      firmware reset").
      
      [jejb: added necessary const to prevent compile warnings]
      Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e21c4b90
    • Xi Wang's avatar
      SCSI: mvsas: fix undefined bit shift · 3814b31a
      Xi Wang authored
      commit beecadea upstream.
      
      The macro bit(n) is defined as ((u32)1 << n), and thus it doesn't work
      with n >= 32, such as in mvs_94xx_assign_reg_set():
      
      	if (i >= 32) {
      		mvi->sata_reg_set |= bit(i);
      		...
      	}
      
      The shift ((u32)1 << n) with n >= 32 also leads to undefined behavior.
      The result varies depending on the architecture.
      
      This patch changes bit(n) to do a 64-bit shift.  It also simplifies
      mv_ffc64() using __ffs64(), since invoking ffz() with ~0 is undefined.
      Signed-off-by: default avatarXi Wang <xi.wang@gmail.com>
      Acked-by: default avatarXiangliang Yu <yuxiangl@marvell.com>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      3814b31a
    • Jianpeng Ma's avatar
      SCSI: mvsas: Fix oops when ata commond timeout. · 8f735b27
      Jianpeng Ma authored
      commit 95ab0003 upstream.
      
      Kernel message follows:
      
      [  511.712011] sd 11:0:0:0: [sdf] command ffff8800a4e81400 timed out
      [  511.712022] sas: Enter sas_scsi_recover_host busy: 1 failed: 1
      [  511.712024] sas: trying to find task 0xffff8800a4d24c80
      [  511.712026] sas: sas_scsi_find_task: aborting task 0xffff8800a4d24c80
      [  511.712029] drivers/scsi/mvsas/mv_sas.c 1631:mvs_abort_task()
      mvi=ffff8800b5300000 task=ffff8800a4d24c80 slot=ffff8800b5325038
      slot_idx=x0
      [  511.712035] BUG: unable to handle kernel NULL pointer dereference at
      0000000000000058
      [  511.712040] IP: [<ffffffff815f8c0c>] _raw_spin_lock_irqsave+0xc/0x30
      [  511.712047] PGD 0
      [  511.712049] Oops: 0002 [#1] SMP
      [  511.712052] Modules linked in: mvsas libsas scsi_transport_sas
      raid456 async_pq async_xor xor async_memcpy async_raid6_recov raid6_pq
      async_tx [last unloaded: mvsas]
      [  511.712062] CPU 3
      [  511.712066] Pid: 7322, comm: scsi_eh_11 Not tainted 3.5.0+ #106 To Be
      Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M.
      [  511.712068] RIP: 0010:[<ffffffff815f8c0c>]  [<ffffffff815f8c0c>]
      _raw_spin_lock_irqsave+0xc/0x30
      [  511.712073] RSP: 0018:ffff880098d3bcb0  EFLAGS: 00010086
      [  511.712074] RAX: 0000000000000286 RBX: 0000000000000058 RCX:
      00000000000000c3
      [  511.712076] RDX: 0000000000000100 RSI: 0000000000000046 RDI:
      0000000000000058
      [  511.712078] RBP: ffff880098d3bcb0 R08: 000000000000000a R09:
      0000000000000000
      [  511.712080] R10: 00000000000004e8 R11: 00000000000004e7 R12:
      ffff8800a4d24c80
      [  511.712082] R13: 0000000000000050 R14: ffff8800b5325038 R15:
      ffff8800a4eafe00
      [  511.712084] FS:  0000000000000000(0000) GS:ffff8800bdb80000(0000)
      knlGS:0000000000000000
      [  511.712086] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      [  511.712088] CR2: 0000000000000058 CR3: 00000000a4ce6000 CR4:
      00000000000407e0
      [  511.712090] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
      0000000000000000
      [  511.712091] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
      0000000000000400
      [  511.712093] Process scsi_eh_11 (pid: 7322, threadinfo
      ffff880098d3a000, task ffff8800a61dde40)
      [  511.712095] Stack:
      [  511.712096]  ffff880098d3bce0 ffffffff81060683 ffff880000000000
      0000000000000000
      [  511.712099]  ffff8800a4d24c80 ffff8800b5300000 ffff880098d3bcf0
      ffffffffa0076a88
      [  511.712102]  ffff880098d3bd50 ffffffffa0079bb5 ffff880000000000
      ffff880000000018
      [  511.712106] Call Trace:
      [  511.712110]  [<ffffffff81060683>] complete+0x23/0x60
      [  511.712115]  [<ffffffffa0076a88>] mvs_tmf_timedout+0x18/0x20 [mvsas]
      [  511.712119]  [<ffffffffa0079bb5>] mvs_slot_complete+0x765/0x7d0
      [mvsas]
      [  511.712125]  [<ffffffffa005a17d>] sas_scsi_recover_host+0x55d/0xdb0
      [libsas]
      [  511.712128]  [<ffffffff8106d600>] ? idle_balance+0xe0/0x130
      [  511.712133]  [<ffffffff813b150c>] scsi_error_handler+0xcc/0x470
      [  511.712136]  [<ffffffff815f7ad0>] ? __schedule+0x370/0x730
      [  511.712139]  [<ffffffff8105f728>] ? __wake_up_common+0x58/0x90
      [  511.712142]  [<ffffffff813b1440>] ? scsi_eh_get_sense+0x110/0x110
      [  511.712146]  [<ffffffff810571be>] kthread+0x8e/0xa0
      [  511.712150]  [<ffffffff816015f4>] kernel_thread_helper+0x4/0x10
      [  511.712153]  [<ffffffff81057130>] ? flush_kthread_work+0x120/0x120
      [  511.712156]  [<ffffffff816015f0>] ? gs_change+0xb/0xb
      [  511.712157] Code: 8a 00 01 00 00 89 d0 f0 66 0f b1 0f 66 39 d0 0f 94
      c0 0f b6 c0 5d c3 0f 1f 84 00 00 00 00 00 55 48 89 e5 9c 58 fa ba 00 01
      00 00 <f0> 66 0f c1 17 0f b6 ce 38 d1 74 11 0f 1f 84 00 00 00 00 00 f3
      [  511.712191] RIP  [<ffffffff815f8c0c>] _raw_spin_lock_irqsave+0xc/0x30
      [  511.712194]  RSP <ffff880098d3bcb0>
      [  511.712196] CR2: 0000000000000058
      [  511.712198] ---[ end trace a781c7b1e65db92c ]---
      Signed-off-by: default avatarJianpeng Ma <majianpeng@gmail.com>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
      Cc: CAI Qian <caiqian@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      8f735b27
    • Lars-Peter Clausen's avatar
      ASoC: sigmadsp: Fix endianness conversion issue · a565623f
      Lars-Peter Clausen authored
      commit a3adb143 upstream.
      
      The 'addr' field of the sigma_action struct is stored as big endian in the
      firmware file.
      Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Signed-off-by: default avatarMark Brown <broonie@opensource.wolfsonmicro.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      a565623f
    • Stephan Gatzka's avatar
      firewire: net: Fix handling of fragmented multicast/broadcast packets. · 2d2b65ee
      Stephan Gatzka authored
      commit 9d237342 upstream.
      
      This patch fixes both the transmit and receive portion of sending
      fragmented mutlicast and broadcast packets.
      
      The transmit section was broken because the offset for INTFRAG and
      LASTFRAG packets were just miscalculated by IEEE1394_GASP_HDR_SIZE (which
      was reserved with skb_push() in fwnet_send_packet).
      
      The receive section was broken because in fwnet_incoming_packet is a call
      to fwnet_peer_find_by_node_id(). Called with generation == -1 it will
      not find a peer and the partial datagrams are associated to a peer.
      
      [Stefan R:  The fix to use context->card->generation is not perfect.
      It relies on the IR tasklet which processes packets from the prior bus
      generation to run before the self-ID-complete worklet which sets the
      current card generation.  Alas, there is no simple way of a race-free
      implementation.  Let's do it this way for now.]
      Signed-off-by: default avatarStephan Gatzka <stephan.gatzka@gmail.com>
      Signed-off-by: default avatarStefan Richter <stefanr@s5r6.in-berlin.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2d2b65ee
    • Felix Fietkau's avatar
      ath9k_hw: Fix signal strength / channel noise reporting · 5004c758
      Felix Fietkau authored
      commit b7c0c238 upstream.
      
      While AR_PHY_CCA_NOM_VAL_* does contain the expected internal noise floor
      for a chip measured in clean air, it refers to the lowest expected reading.
      
      Depending on the frequency, this measurement can vary by about 6db, thus
      causing a higher reported channel noise and signal strength.
      
      Factor in the 6db offset when converting internal noisefloor to channel noise.
      
      This patch makes the reported values more accurate for all chips without
      affecting NF calibration behavior.
      Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5004c758
    • Gabor Juhos's avatar
      ath9k: ar9003: fix OTP register offsets for AR9340 · 324b9beb
      Gabor Juhos authored
      commit b3cd8021 upstream.
      
      Trying to access the OTP memory on the AR9340
      causes a data bus error like this:
      
        Data bus error, epc == 86e84164, ra == 86e84164
        Oops[#1]:
        Cpu 0
        $ 0   : 00000000 00000061 deadc0de 00000000
        $ 4   : b8115f18 00015f18 00000007 00000004
        $ 8   : 00000001 7c7c3c7c 7c7c7c7c 7c7c7c7c
        $12   : 7c7c3c7c 001f0041 00000000 7c7c7c3c
        $16   : 86ee0000 00015f18 00000000 00000007
        $20   : 00000004 00000064 00000004 86d71c44
        $24   : 00000000 86e6ca00
        $28   : 86d70000 86d71b20 86ece0c0 86e84164
        Hi    : 00000000
        Lo    : 00000064
        epc   : 86e84164 ath9k_hw_wait+0x58/0xb0 [ath9k_hw]
            Tainted: G           O
        ra    : 86e84164 ath9k_hw_wait+0x58/0xb0 [ath9k_hw]
        Status: 1100d403    KERNEL EXL IE
        Cause : 4080801c
        PrId  : 0001974c (MIPS 74Kc)
        Modules linked in: ath9k(O+) ath9k_common(O) ath9k_hw(O) ath(O) ar934x_nfc
        mac80211(O) usbcore usb_common scsi_mod nls_base nand nand_ecc nand_ids
        crc_ccitt cfg80211(O) compat(O) arc4 aes_generic crypto_blkcipher cryptomgr
        aead crypto_hash crypto_algapi ledtrig_timer ledtrig_default_on leds_gpio
        Process insmod (pid: 459, threadinfo=86d70000, task=87942140, tls=779ac440)
        Stack : 802fb500 000200da 804db150 804e0000 87816130 86ee0000 00010000 86d71b88
                86d71bc0 00000004 00000003 86e9fcd0 80305300 0002c0d0 86e74c50 800b4c20
                000003e8 00000001 00000000 86ee0000 000003ff 86e9fd64 80305300 80123938
                fffffffc 00000004 000058bc 00000000 86ea0000 86ee0000 000001ff 878d6000
                99999999 86e9fdc0 86ee0fcc 86e9e664 0000c0d0 86ee0000 0000700000007000
                ...
        Call Trace:
        [<86e84164>] ath9k_hw_wait+0x58/0xb0 [ath9k_hw]
        [<86e9fcd0>] ath9k_hw_setup_statusring+0x16b8/0x1c7c [ath9k_hw]
      
        Code: 0000a812  0040f809  00000000 <00531024> 1054000b  24020001  0c05b5dc  2404000a  26520001
      
      The cause of the error is that the OTP register
      offsets are different on the AR9340 than the
      actually used values.
      Signed-off-by: default avatarGabor Juhos <juhosg@openwrt.org>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      324b9beb
    • Felix Fietkau's avatar
      Revert "ath9k_hw: Update AR9003 high_power tx gain table" · 867f263c
      Felix Fietkau authored
      commit 9c170e06 upstream.
      
      This reverts commit f74b9d36.
      
      Turns out reverting commit a240dc7b
      "ath9k_hw: Updated AR9003 tx gain table for 5GHz" was not enough to
      bring the tx power back to normal levels on devices like the
      Buffalo WZR-HP-G450H, this one needs to be reverted as well.
      
      This revert improves tx power by ~10 db on that device
      Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
      Cc: rmanohar@qca.qualcomm.com
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      867f263c
    • Laura Abbott's avatar
      mm: use aligned zone start for pfn_to_bitidx calculation · ce194222
      Laura Abbott authored
      commit c060f943 upstream.
      
      The current calculation in pfn_to_bitidx assumes that (pfn -
      zone->zone_start_pfn) >> pageblock_order will return the same bit for
      all pfn in a pageblock.  If zone_start_pfn is not aligned to
      pageblock_nr_pages, this may not always be correct.
      
      Consider the following with pageblock order = 10, zone start 2MB:
      
        pfn     | pfn - zone start | (pfn - zone start) >> page block order
        ----------------------------------------------------------------
        0x26000 | 0x25e00	   |  0x97
        0x26100 | 0x25f00	   |  0x97
        0x26200 | 0x26000	   |  0x98
        0x26300 | 0x26100	   |  0x98
      
      This means that calling {get,set}_pageblock_migratetype on a single page
      will not set the migratetype for the full block.  Fix this by rounding
      down zone_start_pfn when doing the bitidx calculation.
      
      For our use case, the effects of this bug were mostly tied to the fact
      that CMA allocations would either take a long time or fail to happen.
      Depending on the driver using CMA, this could result in anything from
      visual glitches to application failures.
      Signed-off-by: default avatarLaura Abbott <lauraa@codeaurora.org>
      Acked-by: default avatarMel Gorman <mgorman@suse.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      ce194222
    • Jason Liu's avatar
      mm: compaction: fix echo 1 > compact_memory return error issue · c0b96525
      Jason Liu authored
      commit 7964c06d upstream.
      
      when run the folloing command under shell, it will return error
      
        sh/$ echo 1 > /proc/sys/vm/compact_memory
        sh/$ sh: write error: Bad address
      
      After strace, I found the following log:
      
        ...
        write(1, "1\n", 2)               = 3
        write(1, "", 4294967295)         = -1 EFAULT (Bad address)
        write(2, "echo: write error: Bad address\n", 31echo: write error: Bad address
        ) = 31
      
      This tells system return 3(COMPACT_COMPLETE) after write data to
      compact_memory.
      
      The fix is to make the system just return 0 instead 3(COMPACT_COMPLETE)
      from sysctl_compaction_handler after compaction_nodes finished.
      Signed-off-by: default avatarJason Liu <r64343@freescale.com>
      Suggested-by: default avatarDavid Rientjes <rientjes@google.com>
      Acked-by: default avatarMel Gorman <mgorman@suse.de>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Minchan Kim <minchan@kernel.org>
      Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
      Acked-by: default avatarDavid Rientjes <rientjes@google.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c0b96525
    • Huacai Chen's avatar
      MIPS: Fix poweroff failure when HOTPLUG_CPU configured. · b1ca4207
      Huacai Chen authored
      commit 8add1ecb upstream.
      
      When poweroff machine, kernel_power_off() call disable_nonboot_cpus().
      And if we have HOTPLUG_CPU configured, disable_nonboot_cpus() is not an
      empty function but attempt to actually disable the nonboot cpus. Since
      system state is SYSTEM_POWER_OFF, play_dead() won't be called and thus
      disable_nonboot_cpus() hangs. Therefore, we make this patch to avoid
      poweroff failure.
      Signed-off-by: default avatarHuacai Chen <chenhc@lemote.com>
      Signed-off-by: default avatarHongliang Tao <taohl@lemote.com>
      Signed-off-by: default avatarHua Yan <yanh@lemote.com>
      Cc: Yong Zhang <yong.zhang@windriver.com>
      Cc: Fuxin Zhang <zhangfx@lemote.com>
      Cc: Zhangjin Wu <wuzhangjin@gmail.com>
      Patchwork: https://patchwork.linux-mips.org/patch/4211/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b1ca4207
    • Sebastian Ott's avatar
      s390/cio: fix pgid reserved check · 4305c46a
      Sebastian Ott authored
      commit d99e79ec upstream.
      
      The check to whom a device is reserved is done by checking the path
      state of the affected channel paths. If it turns out that one path is
      flagged as reserved by someone else the whole device is marked as such.
      
      However the meaning of the RESVD_ELSE bit is that the addressed device
      is reserved to a different pathgroup (and not reserved to a different
      LPAR). If we do this test on a path which is currently not a member of
      the pathgroup we could erroneously mark the device as reserved to
      someone else.
      
      To fix this collect the reserved state for all potential members of the
      pathgroup and only mark the device as reserved if all of those potential
      members have the RESVD_ELSE bit set.
      Acked-by: default avatarPeter Oberparleiter <peter.oberparleiter@de.ibm.com>
      Signed-off-by: default avatarSebastian Ott <sebott@linux.vnet.ibm.com>
      Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4305c46a
    • Alex Williamson's avatar
      KVM: Fix user memslot overlap check · 9d4c74b8
      Alex Williamson authored
      commit 5419369e upstream.
      
      Prior to memory slot sorting this loop compared all of the user memory
      slots for overlap with new entries.  With memory slot sorting, we're
      just checking some number of entries in the array that may or may not
      be user slots.  Instead, walk all the slots with kvm_for_each_memslot,
      which has the added benefit of terminating early when we hit the first
      empty slot, and skip comparison to private slots.
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9d4c74b8
    • Gabor Juhos's avatar
      powerpc: Add missing NULL terminator to avoid boot panic on PPC40x · 91534f73
      Gabor Juhos authored
      commit e6449c9b upstream.
      
      The missing NULL terminator can cause a panic on
      PPC405 boards during boot:
      
        Linux/PowerPC load: console=ttyS0,115200 root=/dev/mtdblock1 rootfstype=squashfs,jffs2 noinitrd init=/etc/preinit
        Finalizing device tree... flat tree at 0x6a5160
        bootconsole [udbg0] enabled
        Page fault in user mode with in_atomic() = 1 mm = (null)
        NIP = c0275f50  MSR = fffffffe
        Oops: Weird page fault, sig: 11 [#1]
        PowerPC 40x Platform
        Modules linked in:
        NIP: c0275f50 LR: c0275f60 CTR: c0280000
        REGS: c0275eb0 TRAP: 636f7265   Not tainted  (3.7.1)
        MSR: fffffffe <VEC,VSX,EE,PR,FP,ME,SE,BE,IR,DR,PMM,RI> CR: c06a6190  XER: 00000001
        TASK = c02662a8[0] 'swapper' THREAD: c0274000
        GPR00: c0275ec0 c000c658 c027c4bf 00000000 c0275ee0 c000a0ec c020a1a8 c020a1f0
        GPR08: c020f631 c020f404 c025f078 c025f080 c0275f10
         Call Trace:
         ---[ end trace 31fd0ba7d8756001 ]---
      
        Kernel panic - not syncing: Attempted to kill the idle task!
      
      The panic happens since commit 9597abe0
      (sections: fix section conflicts in arch/powerpc), however the root
      cause of this is that the NULL terminator were not added in commit
      a4f740cf (of/flattree: Add of_flat_dt_match()
      helper function).
      Signed-off-by: default avatarGabor Juhos <juhosg@openwrt.org>
      Cc: Grant Likely <grant.likely@secretlab.ca>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      91534f73
    • Shan Hai's avatar
      powerpc/vdso: Remove redundant locking in update_vsyscall_tz() · 23c4e04a
      Shan Hai authored
      commit ce73ec6d upstream.
      
      The locking in update_vsyscall_tz() is not only unnecessary because the vdso
      code copies the data unproteced in __kernel_gettimeofday() but also
      introduces a hard to reproduce race condition between update_vsyscall()
      and update_vsyscall_tz(), which causes user space process to loop
      forever in vdso code.
      
      The following patch removes the locking from update_vsyscall_tz().
      
      Locking is not only unnecessary because the vdso code copies the data
      unprotected in __kernel_gettimeofday() but also erroneous because updating
      the tb_update_count is not atomic and introduces a hard to reproduce race
      condition between update_vsyscall() and update_vsyscall_tz(), which further
      causes user space process to loop forever in vdso code.
      
      The below scenario describes the race condition,
      x==0	Boot CPU			other CPU
      	proc_P: x==0
      	    timer interrupt
      		update_vsyscall
      x==1		    x++;sync		settimeofday
      					    update_vsyscall_tz
      x==2						x++;sync
      x==3		    sync;x++
      						sync;x++
      	proc_P: x==3 (loops until x becomes even)
      
      Because the ++ operator would be implemented as three instructions and not
      atomic on powerpc.
      
      A similar change was made for x86 in commit 6c260d58
      ("x86: vdso: Remove bogus locking in update_vsyscall_tz")
      Signed-off-by: default avatarShan Hai <shan.hai@windriver.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      23c4e04a
    • Anton Blanchard's avatar
      powerpc: Fix CONFIG_RELOCATABLE=y CONFIG_CRASH_DUMP=n build · 55800cd5
      Anton Blanchard authored
      commit 11ee7e99 upstream.
      
      If we build a kernel with CONFIG_RELOCATABLE=y CONFIG_CRASH_DUMP=n,
      the kernel fails when we run at a non zero offset. It turns out
      we were incorrectly wrapping some of the relocatable kernel code
      with CONFIG_CRASH_DUMP.
      Signed-off-by: default avatarAnton Blanchard <anton@samba.org>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      55800cd5
    • Rafał Miłecki's avatar
      bcma: mips: fix clearing device IRQ · 8fcd6a44
      Rafał Miłecki authored
      commit cbbc0138 upstream.
      
      We were using wrong IRQ number so clearing wasn't working at all.
      Depending on a platform this could result in a one device having two
      interrupts assigned. On BCM4706 this resulted in all IRQs being broken.
      Signed-off-by: default avatarRafał Miłecki <zajec5@gmail.com>
      Cc: Hauke Mehrtens <hauke@hauke-m.de>
      Acked-by: default avatarHauke Mehrtens <hauke@hauke-m.de>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      8fcd6a44
    • Felix Fietkau's avatar
      ath5k: fix tx path skb leaks · 2686f897
      Felix Fietkau authored
      commit 596ab5ec upstream.
      
      ieee80211_free_txskb() needs to be used instead of dev_kfree_skb_any for
      tx packets passed to the driver from mac80211
      Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2686f897
    • Mark Brown's avatar
  2. 11 Jan, 2013 12 commits
    • Greg Kroah-Hartman's avatar
      Linux 3.4.25 · 0ba1cd8d
      Greg Kroah-Hartman authored
      0ba1cd8d
    • Alexander Stein's avatar
      can: Do not call dev_put if restart timer is running upon close · 4ca05c86
      Alexander Stein authored
      commit ab48b03e upstream.
      
      If the restart timer is running due to BUS-OFF and the device is
      disconnected an dev_put will decrease the usage counter to -1 thus
      blocking the interface removal, resulting in the following dmesg
      lines repeating every 10s:
      can: notifier: receive list not found for dev can0
      can: notifier: receive list not found for dev can0
      can: notifier: receive list not found for dev can0
      unregister_netdevice: waiting for can0 to become free. Usage count = -1
      Signed-off-by: default avatarAlexander Stein <alexander.stein@systec-electronic.com>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4ca05c86
    • Ben Hutchings's avatar
      HID: Add Apple wireless keyboard 2011 ANSI to special driver list · c0c7cf28
      Ben Hutchings authored
      commit f9af7b9e upstream.
      
      Commit 0a97e1e9 ('HID: apple: Add Apple wireless keyboard 2011 ANSI PID')
      did not update the special driver list in hid-core.c, so hid-generic may
      still bind to this device.
      Reported-by: default avatarAri Pollak <ari@scvngr.com>
      References: http://bugs.debian.org/694546Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c0c7cf28
    • Michal Hocko's avatar
      mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT · b14d5527
      Michal Hocko authored
      commit 53a59fc6 upstream.
      
      Since commit e303297e ("mm: extended batches for generic
      mmu_gather") we are batching pages to be freed until either
      tlb_next_batch cannot allocate a new batch or we are done.
      
      This works just fine most of the time but we can get in troubles with
      non-preemptible kernel (CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY)
      on large machines where too aggressive batching might lead to soft
      lockups during process exit path (exit_mmap) because there are no
      scheduling points down the free_pages_and_swap_cache path and so the
      freeing can take long enough to trigger the soft lockup.
      
      The lockup is harmless except when the system is setup to panic on
      softlockup which is not that unusual.
      
      The simplest way to work around this issue is to limit the maximum
      number of batches in a single mmu_gather.  10k of collected pages should
      be safe to prevent from soft lockups (we would have 2ms for one) even if
      they are all freed without an explicit scheduling point.
      
      This patch doesn't add any new explicit scheduling points because it
      relies on zap_pmd_range during page tables zapping which calls
      cond_resched per PMD.
      
      The following lockup has been reported for 3.0 kernel with a huge
      process (in order of hundreds gigs but I do know any more details).
      
        BUG: soft lockup - CPU#56 stuck for 22s! [kernel:31053]
        Modules linked in: af_packet nfs lockd fscache auth_rpcgss nfs_acl sunrpc mptctl mptbase autofs4 binfmt_misc dm_round_robin dm_multipath bonding cpufreq_conservative cpufreq_userspace cpufreq_powersave pcc_cpufreq mperf microcode fuse loop osst sg sd_mod crc_t10dif st qla2xxx scsi_transport_fc scsi_tgt netxen_nic i7core_edac iTCO_wdt joydev e1000e serio_raw pcspkr edac_core iTCO_vendor_support acpi_power_meter rtc_cmos hpwdt hpilo button container usbhid hid dm_mirror dm_region_hash dm_log linear uhci_hcd ehci_hcd usbcore usb_common scsi_dh_emc scsi_dh_alua scsi_dh_hp_sw scsi_dh_rdac scsi_dh dm_snapshot pcnet32 mii edd dm_mod raid1 ext3 mbcache jbd fan thermal processor thermal_sys hwmon cciss scsi_mod
        Supported: Yes
        CPU 56
        Pid: 31053, comm: kernel Not tainted 3.0.31-0.9-default #1 HP ProLiant DL580 G7
        RIP: 0010:  _raw_spin_unlock_irqrestore+0x8/0x10
        RSP: 0018:ffff883ec1037af0  EFLAGS: 00000206
        RAX: 0000000000000e00 RBX: ffffea01a0817e28 RCX: ffff88803ffd9e80
        RDX: 0000000000000200 RSI: 0000000000000206 RDI: 0000000000000206
        RBP: 0000000000000002 R08: 0000000000000001 R09: ffff887ec724a400
        R10: 0000000000000000 R11: dead000000200200 R12: ffffffff8144c26e
        R13: 0000000000000030 R14: 0000000000000297 R15: 000000000000000e
        FS:  00007ed834282700(0000) GS:ffff88c03f200000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
        CR2: 000000000068b240 CR3: 0000003ec13c5000 CR4: 00000000000006e0
        DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
        DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
        Process kernel (pid: 31053, threadinfo ffff883ec1036000, task ffff883ebd5d4100)
        Call Trace:
          release_pages+0xc5/0x260
          free_pages_and_swap_cache+0x9d/0xc0
          tlb_flush_mmu+0x5c/0x80
          tlb_finish_mmu+0xe/0x50
          exit_mmap+0xbd/0x120
          mmput+0x49/0x120
          exit_mm+0x122/0x160
          do_exit+0x17a/0x430
          do_group_exit+0x3d/0xb0
          get_signal_to_deliver+0x247/0x480
          do_signal+0x71/0x1b0
          do_notify_resume+0x98/0xb0
          int_signal+0x12/0x17
        DWARF2 unwinder stuck at int_signal+0x12/0x17
      Signed-off-by: default avatarMichal Hocko <mhocko@suse.cz>
      Cc: Mel Gorman <mgorman@suse.de>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b14d5527
    • Tony Prisk's avatar
      drivers/rtc/rtc-vt8500.c: fix handling of data passed in struct rtc_time · e0996e35
      Tony Prisk authored
      commit 2f90b683 upstream.
      
      tm_mon is 0..11, whereas vt8500 expects 1..12 for the month field,
      causing invalid date errors for January, and causing the day field to
      roll over incorrectly.
      
      The century flag is only handled in vt8500_rtc_read_time, but not set in
      vt8500_rtc_set_time.  This patch corrects the behaviour of the century
      flag.
      Signed-off-by: default avatarEdgar Toernig <froese@gmx.de>
      Signed-off-by: default avatarTony Prisk <linux@prisktech.co.nz>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e0996e35
    • Tony Prisk's avatar
      drivers/rtc/rtc-vt8500.c: correct handling of CR_24H bitfield · 8f4d9c2f
      Tony Prisk authored
      commit 532db570 upstream.
      
      Control register bitfield for 12H/24H mode is handled incorrectly.
      Setting CR_24H actually enables 12H mode.  This patch renames the define
      and changes the initialization code to correctly set 24H mode.
      Signed-off-by: default avatarTony Prisk <linux@prisktech.co.nz>
      Cc: Edgar Toernig <froese@gmx.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      8f4d9c2f
    • Corey Minyard's avatar
      CRIS: fix I/O macros · 850fcad1
      Corey Minyard authored
      commit c24bf9b4 upstream.
      
      The inb/outb macros for CRIS are broken from a number of points of view,
      missing () around parameters and they have an unprotected if statement
      in them.  This was breaking the compile of IPMI on CRIS and thus I was
      being annoyed by build regressions, so I fixed them.
      
      Plus I don't think they would have worked at all, since the data values
      were missing "&" and the outsl had a "3" instead of a "4" for the size.
      From what I can tell, this stuff is not used at all, so this can't be
      any more broken than it was before, anyway.
      Signed-off-by: default avatarCorey Minyard <cminyard@mvista.com>
      Cc: Jesper Nilsson <jesper.nilsson@axis.com>
      Cc: Mikael Starvik <starvik@axis.com>
      Acked-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      850fcad1
    • Stephen Boyd's avatar
      lib: atomic64: Initialize locks statically to fix early users · 0f7ac9c8
      Stephen Boyd authored
      commit fcc16882 upstream.
      
      The atomic64 library uses a handful of static spin locks to implement
      atomic 64-bit operations on architectures without support for atomic
      64-bit instructions.
      
      Unfortunately, the spinlocks are initialized in a pure initcall and that
      is too late for the vfs namespace code which wants to use atomic64
      operations before the initcall is run.
      
      This became a problem as of commit 8823c079: "vfs: Add setns support
      for the mount namespace".
      
      This leads to BUG messages such as:
      
        BUG: spinlock bad magic on CPU#0, swapper/0/0
         lock: atomic64_lock+0x240/0x400, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
          do_raw_spin_lock+0x158/0x198
          _raw_spin_lock_irqsave+0x4c/0x58
          atomic64_add_return+0x30/0x5c
          alloc_mnt_ns.clone.14+0x44/0xac
          create_mnt_ns+0xc/0x54
          mnt_init+0x120/0x1d4
          vfs_caches_init+0xe0/0x10c
          start_kernel+0x29c/0x300
      
      coming out early on during boot when spinlock debugging is enabled.
      
      Fix this by initializing the spinlocks statically at compile time.
      Reported-and-tested-by: default avatarVaibhav Bedia <vaibhav.bedia@ti.com>
      Tested-by: default avatarTony Lindgren <tony@atomide.com>
      Cc: Eric W. Biederman <ebiederm@xmission.com>
      Signed-off-by: default avatarStephen Boyd <sboyd@codeaurora.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      0f7ac9c8
    • Gustavo Padovan's avatar
      Bluetooth: cancel power_on work when unregistering the device · 1a0da46b
      Gustavo Padovan authored
      commit b9b5ef18 upstream.
      
      We need to cancel the hci_power_on work in order to avoid it run when we
      try to free the hdev.
      
      [ 1434.201149] ------------[ cut here ]------------
      [ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0()
      [ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: hci
      _power_on+0x0/0x90
      [ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G        W    3.7.0-rc5-next-
      20121112-sasha-00018-g2f4ce0e #127
      [ 1434.210760] Call Trace:
      [ 1434.210760]  [<ffffffff819f3d6e>] ? debug_print_object+0x8e/0xb0
      [ 1434.210760]  [<ffffffff8110b887>] warn_slowpath_common+0x87/0xb0
      [ 1434.210760]  [<ffffffff8110b911>] warn_slowpath_fmt+0x41/0x50
      [ 1434.210760]  [<ffffffff819f3d6e>] debug_print_object+0x8e/0xb0
      [ 1434.210760]  [<ffffffff8376b750>] ? hci_dev_open+0x310/0x310
      [ 1434.210760]  [<ffffffff83bf94e5>] ? _raw_spin_unlock_irqrestore+0x55/0xa0
      [ 1434.210760]  [<ffffffff819f3ee5>] __debug_check_no_obj_freed+0xa5/0x230
      [ 1434.210760]  [<ffffffff83785db0>] ? bt_host_release+0x10/0x20
      [ 1434.210760]  [<ffffffff819f4d15>] debug_check_no_obj_freed+0x15/0x20
      [ 1434.210760]  [<ffffffff8125eee7>] kfree+0x227/0x330
      [ 1434.210760]  [<ffffffff83785db0>] bt_host_release+0x10/0x20
      [ 1434.210760]  [<ffffffff81e539e5>] device_release+0x65/0xc0
      [ 1434.210760]  [<ffffffff819d3975>] kobject_cleanup+0x145/0x190
      [ 1434.210760]  [<ffffffff819d39cd>] kobject_release+0xd/0x10
      [ 1434.210760]  [<ffffffff819d33cc>] kobject_put+0x4c/0x60
      [ 1434.210760]  [<ffffffff81e548b2>] put_device+0x12/0x20
      [ 1434.210760]  [<ffffffff8376a334>] hci_free_dev+0x24/0x30
      [ 1434.210760]  [<ffffffff82fd8fe1>] vhci_release+0x31/0x60
      [ 1434.210760]  [<ffffffff8127be12>] __fput+0x122/0x250
      [ 1434.210760]  [<ffffffff811cab0d>] ? rcu_user_exit+0x9d/0xd0
      [ 1434.210760]  [<ffffffff8127bf49>] ____fput+0x9/0x10
      [ 1434.210760]  [<ffffffff81133402>] task_work_run+0xb2/0xf0
      [ 1434.210760]  [<ffffffff8106cfa7>] do_notify_resume+0x77/0xa0
      [ 1434.210760]  [<ffffffff83bfb0ea>] int_signal+0x12/0x17
      [ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]---
      Reported-by: default avatarSasha Levin <sasha.levin@oracle.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1a0da46b
    • Gustavo Padovan's avatar
      Bluetooth: Add missing lock nesting notation · 7e274180
      Gustavo Padovan authored
      commit dc2a0e20 upstream.
      
      This patch fixes the following report, it happens when accepting rfcomm
      connections:
      
      [  228.165378] =============================================
      [  228.165378] [ INFO: possible recursive locking detected ]
      [  228.165378] 3.7.0-rc1-00536-gc1d5dc4a #120 Tainted: G        W
      [  228.165378] ---------------------------------------------
      [  228.165378] bluetoothd/1341 is trying to acquire lock:
      [  228.165378]  (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+...}, at:
      [<ffffffffa0000aa0>] bt_accept_dequeue+0xa0/0x180 [bluetooth]
      [  228.165378]
      [  228.165378] but task is already holding lock:
      [  228.165378]  (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+...}, at:
      [<ffffffffa0205118>] rfcomm_sock_accept+0x58/0x2d0 [rfcomm]
      [  228.165378]
      [  228.165378] other info that might help us debug this:
      [  228.165378]  Possible unsafe locking scenario:
      [  228.165378]
      [  228.165378]        CPU0
      [  228.165378]        ----
      [  228.165378]   lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);
      [  228.165378]   lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);
      [  228.165378]
      [  228.165378]  *** DEADLOCK ***
      [  228.165378]
      [  228.165378]  May be due to missing lock nesting notation
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7e274180
    • Marcos Chaparro's avatar
      Bluetooth: ath3k: Add support for VAIO VPCEH [0489:e027] · 2145cea1
      Marcos Chaparro authored
      commit acd94544 upstream.
      
      Added Atheros AR3011 internal bluetooth device found in Sony VAIO VPCEH to the
      devices list.
      Before this, the bluetooth module was identified as an Foxconn / Hai bluetooth
      device [0489:e027], now it claims to be an AtherosAR3011 Bluetooth
      [0cf3:3005].
      
      T:  Bus=01 Lev=02 Prnt=02 Port=04 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=0489 ProdID=e027 Rev= 0.01
      C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      Signed-off-by: default avatarMarcos Chaparro <marcos@mrkindustries.com.ar>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      Cc: Ben Hutchings <ben@decadent.org.uk>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2145cea1
    • Andy Lutomirski's avatar
      PCI: Reduce Ricoh 0xe822 SD card reader base clock frequency to 50MHz · 7164ac21
      Andy Lutomirski authored
      commit 812089e0 upstream.
      
      Otherwise it fails like this on cards like the Transcend 16GB SDHC card:
      
          mmc0: new SDHC card at address b368
          mmcblk0: mmc0:b368 SDC   15.0 GiB
          mmcblk0: error -110 sending status command, retrying
          mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response 0x900, card status 0xb0
      
      Tested on my Lenovo x200 laptop.
      
      [bhelgaas: changelog]
      Signed-off-by: default avatarAndy Lutomirski <luto@amacapital.net>
      Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
      Acked-by: default avatarChris Ball <cjb@laptop.org>
      CC: Manoj Iyer <manoj.iyer@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7164ac21