1. 29 Nov, 2013 3 commits
  2. 28 Nov, 2013 20 commits
    • Dave Airlie's avatar
      drm/qxl: fix memory leak in release list handling · 1b28c3e6
      Dave Airlie authored
      wow no idea how I got this far without seeing this,
      leaking the entries in the list makes kmalloc-64 slab grow.
      
      References: https://bugzilla.kernel.org/show_bug.cgi?id=65121
      Cc: stable@vger.kernel.org
      Reported-by: default avatarMatthew Stapleton <matthew4196@gmail.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      1b28c3e6
    • Linus Torvalds's avatar
      Merge tag 'gpio-v3.13-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · dda9cc3a
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "Here us a bunch of patches for the v3.13 series.  Most important stuff
        is related to fixes and documentation for the new GPIO descriptor API.
        If the diffstat is scary you'll notice most of it is to
        Documentation/*:
      
         - A big slew of documentation for the gpiod transition that happened
           in the merge window, no semantic effect, but we should provide
           proper documentation with the new API.
      
         - Fix flags related to the new API.
      
         - Fix to the find_chip_by_name() lookup function related to the new
           API.
      
         - Fix of_find_gpio() when not using device tree.
      
         - Bug fix for the TB10x direction setting.
      
         - Error path fixes from Dan Carpenter.
      
         - Nasty IRQdomain bug relating to taking an unitialized spinlock.
      
         - Minor fixes here and there"
      
      * tag 'gpio-v3.13-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: bcm281xx: Fix return value of bcm_kona_gpio_get()
        gpio: pl061: move irqdomain initialization
        gpio: ucb1400: Add MODULE_ALIAS
        gpiolib: fix of_find_gpio() when OF not defined
        gpio: fix memory leak in error path
        gpio: rcar: NULL dereference on error in probe()
        gpio: msm: make msm_gpio.summary_irq signed for error handling
        gpio: mvebu: make mvchip->irqbase signed for error handling
        gpiolib: use dedicated flags for GPIO properties
        gpiolib: fix find_chip_by_name()
        Documentation: gpiolib: document new interface
        gpio: tb10x: Set output value before setting direction to output
      dda9cc3a
    • Linus Torvalds's avatar
      Merge tag 'md/3.13-fixes' of git://neil.brown.name/md · 962ba263
      Linus Torvalds authored
      Pull md fixes from Neil Brown:
       "Three bug fixes for md in 3.13-rc
      
        All recent regressions, one in 3.12 so marked for -stable"
      
      * tag 'md/3.13-fixes' of git://neil.brown.name/md:
        md/raid5: fix newly-broken locking in get_active_stripe.
        md: test mddev->flags more safely in md_check_recovery.
        md/raid5: fix new memory-reference bug in alloc_thread_groups.
      962ba263
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 · 3bad8bb5
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "SMB3 "validate negotiate" is needed to prevent certain types of
        downgrade attacks.
      
        Also changes SMB2/SMB3 copy offload from using the BTRFS copy ioctl
        (BTRFS_IOC_CLONE) to a cifs specific ioctl (CIFS_IOC_COPYCHUNK_FILE)
        to address Christoph's comment that there are semantic differences
        between requesting copy offload in which copy-on-write is mandatory
        (as in the BTRFS ioctl) and optional in the SMB2/SMB3 case.  Also
        fixes SMB2/SMB3 copychunk for large files"
      
      * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
        [CIFS] Do not use btrfs refcopy ioctl for SMB2 copy offload
        Check SMB3 dialects against downgrade attacks
        Removed duplicated (and unneeded) goto
        CIFS: Fix SMB2/SMB3 Copy offload support (refcopy) for large files
      3bad8bb5
    • Helge Deller's avatar
      kernel/extable: fix address-checks for core_kernel and init areas · 5ecbe3c3
      Helge Deller authored
      The init_kernel_text() and core_kernel_text() functions should not
      include the labels _einittext and _etext when checking if an address is
      inside the .text or .init sections.
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5ecbe3c3
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · e7c0d3da
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Just two minor fixes as people keep resending since they are so low
        hanging"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/nouveau/hwmon: fix compilation without CONFIG_HWMON
        drm/sysfs: fix OOM verification
      e7c0d3da
    • Linus Torvalds's avatar
      Merge tag 'tty-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 682a2512
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are some tty/serial driver fixes for reported issues in 3.13-rc2.
      
        The n_gsm "fix" was reverted as it was found to not be correct.
        Hopefully this will be resolved in a future pull request, but as
        there's really only one user of this line setting, it's not a big
        deal..."
      
      * tag 'tty-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        Revert "n_gsm: race between ld close and gsmtty open"
        n_tty: Protect minimum_to_wake reset for concurrent readers
        tty: Reset hupped state on open
        TTY: amiserial, add missing platform check
        TTY: pmac_zilog, check existence of ports in pmz_console_init()
        n_gsm: race between ld close and gsmtty open
        tty/serial/8250: fix typo in help text
        n_tty: Fix 4096-byte canonical reads
        n_tty: Fix echo overrun tail computation
        n_tty: Ensure reader restarts worker for next reader
      682a2512
    • Linus Torvalds's avatar
      Merge tag 'staging-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 0b0f7f1c
      Linus Torvalds authored
      Pull staging fixes from Greg KH:
       "Here are a number of staging, and IIO driver, fixes for 3.13-rc2 that
        resolve issues that have been reported for 3.13-rc1.  All of these
        have been in linux-next for a bit this week"
      
      * tag 'staging-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (25 commits)
        Staging: tidspbridge: disable driver
        staging: zsmalloc: Ensure handle is never 0 on success
        staging/lustre/ptlrpc: fix ptlrpc_stop_pinger logic
        staging: r8188eu: Fix AP mode
        Staging: btmtk_usb: Add hdev parameter to hdev->send driver callback
        Staging: go7007: fix up some remaining go->dev issues
        staging: imx-drm: Fix modular build of DRM_IMX_IPUV3
        staging: ft1000: fix use of potentially uninitialized variable
        Revert "staging:media: Use dev_dbg() instead of pr_debug()"
        Staging: zram: Fix memory leak by refcount mismatch
        staging: vt6656: [BUG] Fix for TX USB resets from vendors driver.
        staging: nvec: potential NULL dereference on error path
        Staging: vt6655-6: potential NULL dereference in hostap_disable_hostapd()
        staging: comedi: s626: fix value written by s626_set_dac()
        Staging: comedi: pcl730: fix some bitwise vs logical AND bugs
        staging: comedi: fix potentially uninitialised variable
        iio:accel:kxsd9 fix missing mutex unlock
        iio: adc: ti_am335x_adc: avoid double free of buffer.
        staging:iio: Fix hmc5843 Kconfig dependencies
        iio: Fix tcs3472 Kconfig dependencies
        ...
      0b0f7f1c
    • Linus Torvalds's avatar
      Merge tag 'driver-core-3.13-rc2' of... · f4968636
      Linus Torvalds authored
      Merge tag 'driver-core-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      
      Pull driver core fixes from Greg KH:
       "Here are 3 patches for sysfs issues that have been reported.  Well, 1
        patch really, the first one is reverted as it's not really needed (the
        correct fix is coming in through the different driver subsystems
        instead)
      
        But that 1 sysfs fix is needed, so this is still a good thing to pull
        in now"
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      
      * tag 'driver-core-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        Revert "sysfs: handle duplicate removal attempts in sysfs_remove_group()"
        sysfs: use a separate locking class for open files depending on mmap
        sysfs: handle duplicate removal attempts in sysfs_remove_group()
      f4968636
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid · ba33fef0
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
       - fix compat ioctl leak in uhid, by David Herrmann
       - fix scheduling in atomic context (causing actual lockups in real
         world) in hid-sony driver, by Sven Eckelmann
       - revert patch introducing VID/PID conflict, by Jiri Kosina
       - support from various new device IDs by Benjamin Tissoires and
         KaiChung Cheng
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
        HID: uhid: fix leak for 64/32 UHID_CREATE
        HID: kye: fix unresponsive keyboard
        HID: kye: Add report fixup for Genius Manticore Keyboard
        HID: multicouh: add PID VID to support 1 new Wistron optical touch device
        HID: appleir: force input to be set
        Revert "HID: wiimote: add LEGO-wiimote VID"
        HID: sony: Send FF commands in non-atomic context
      ba33fef0
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · b7fe6bf7
      Linus Torvalds authored
      Pull ACPI and power management fixes from Rafael Wysocki:
      
       - Fix for a recent regression in the Tegra cpufreq driver causing
         excess error messages to be printed from Stephen Warren
      
       - ACPI-based device hotplug fix to prevent conflicting notify handlers
         from being installed for PCI host bridge objects.  From Toshi Kani
      
       - ACPICA update to upstream version 20131115.  This contains bug fixes
         mostly (loop termination fix for the get AML length function, fixes
         related to namespace node removal and debug output).  From Bob Moore,
         Tomasz Nowicki and Lv Zheng
      
       - Removal of incorrect inclusions of internal ACPICA header files by
         non-ACPICA code from Lv Zheng
      
       - Fixes for the ACPI sysfs interface exposing tables to user space from
         Daisuke Hatayama and Jeremy Compostella
      
       - Assorted ACPI and cpufreq cleanups from Sachin Kamat and Al Stone
      
       - cpupower tool fix and man page from Thomas Renninger
      
      * tag 'pm+acpi-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: Clean up incorrect inclusions of ACPICA headers
        tools: cpupower: fix wrong err msg not supported vs not available
        tools: cpupower: Add cpupower-idle-set(1) manpage
        ACPI / sysfs: Fix incorrect ACPI tables walk in acpi_tables_sysfs_init()
        ACPI / sysfs: Set file size for each exposed ACPI table
        ACPICA: Update version to 20131115.
        ACPICA: Add support to delete all objects attached to the root namespace node.
        ACPICA: Delete all attached data objects during namespace node deletion.
        ACPICA: Resources: Fix loop termination for the get AML length function.
        ACPICA: Tests: Add CHECKSUM_ABORT protection for test utilities.
        ACPICA: Debug output: Do not emit function nesting level for kernel build.
        ACPI / sleep: clean up compiler warning about uninitialized field
        cpufreq: exynos: Remove unwanted EXPORT_SYMBOL
        cpufreq: tegra: don't error target() when suspended
        ACPI / hotplug: Fix conflicted PCI bridge notify handlers
      b7fe6bf7
    • Nicolas Dichtel's avatar
      doc: fix generation of device-drivers · 96d5d9d9
      Nicolas Dichtel authored
      Since commit 7a6354e2 ("sched: Move wait.c into kernel/sched/"), the
      path of this file has changed.
      Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
      Acked-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Acked-by: default avatarAndy Whitcroft <apw@canonical.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Ingo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      96d5d9d9
    • Ilia Mirkin's avatar
    • Will Deacon's avatar
      lockref: include mutex.h rather than reinvent arch_mutex_cpu_relax · 14058d20
      Will Deacon authored
      arch_mutex_cpu_relax is already conditionally defined in mutex.h, so
      simply include that header rather than replicate the code here.
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      14058d20
    • David Herrmann's avatar
      drm/sysfs: fix OOM verification · a1f84f57
      David Herrmann authored
      Copy/Paste typo.. we need to test for ->kdev instead of ->dev.
      Reported-by: default avatarJuha Leppänen <juha_efku@dnainternet.net>
      Signed-off-by: default avatarDavid Herrmann <dh.herrmann@gmail.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      a1f84f57
    • Dave Jones's avatar
      remove obsolete references to powertweak · dad33750
      Dave Jones authored
      This tool hasn't been maintained in over a decade, and is pretty much
      useless these days.  Let's pretend it never happened.
      
      Also remove a long-dead email address.
      Signed-off-by: default avatarDave Jones <davej@fedoraproject.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      dad33750
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · a456c0d9
      Linus Torvalds authored
      Pull powerpc fixes from Ben Herrenschmidt:
       "The main thing that caused problem was that CONFIG_CPU_LITTLE_ENDIAN
        got turned on with allyesconfig and such, which is not a very good
        idea especially since it requires a newer toolchain than what most
        people have.
      
        So we turned it into a choice instead that defaults to big endian"
      
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
        powerpc/windfarm: Fix XServe G5 fan control Makefile issue
        arch/powerpc/kernel: Use %12.12s instead of %12s to avoid memory overflow
        powerpc/signals: Improved mark VSX not saved with small contexts fix
        powerpc/kdump: Adding symbols in vmcoreinfo to facilitate dump filtering
        powerpc: allyesconfig should not select CONFIG_CPU_LITTLE_ENDIAN
        powerpc: Fix error when cross building TAGS & cscope
        powerpc/booke: Only check for hugetlb in flush if vma != NULL
        powerpc/85xx: typo in dts: "interupt" (four devices)
        powerpc/8xx: mfspr SPRN_TBRx in lieu of mftb/mftbu is not supported
        powerpc/corenet64: compile with CONFIG_E{5,6}500_CPU well
      a456c0d9
    • NeilBrown's avatar
      md/raid5: fix newly-broken locking in get_active_stripe. · 6d183de4
      NeilBrown authored
      commit 566c09c5 raid5: relieve lock contention in get_active_stripe()
      
      modified the locking in get_active_stripe() reducing the range
      protected by the (highly contended) device_lock.
      Unfortunately it reduced the range too much opening up some races.
      
      One race can occur if get_priority_stripe runs between the
      test on sh->count and device_lock being taken.
      This will mean that sh->lru is not empty while get_active_stripe
      thinks ->count is zero resulting in a 'BUG' firing.
      
      Another race happens if __release_stripe is called immediately
      after sh->count is tested and found to be non-zero.  If STRIPE_HANDLE
      is not set, get_active_stripe should increment ->active_stripes
      when it increments ->count from 0, but as it didn't think it was 0,
      it doesn't.
      
      Extending device_lock to cover the test on sh->count close these
      races.
      
      While we are here, fix the two BUG tests:
       -If count is zero, then lru really must not be empty, or we've
        lock the stripe_head somehow - no other tests are relevant.
       -STRIPE_ON_RELEASE_LIST is completely independent of ->lru so
        testing it is pointless.
      Reported-and-tested-by: default avatarBrassow Jonathan <jbrassow@redhat.com>
      Reviewed-by: default avatarShaohua Li <shli@kernel.org>
      Fixes: 566c09c5Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      6d183de4
    • NeilBrown's avatar
      md: test mddev->flags more safely in md_check_recovery. · 142d44c3
      NeilBrown authored
      commit 7a0a5355 md: Don't test all of mddev->flags at once.
      made most tests on mddev->flags safer, but missed one.
      
      When
      commit 260fa034 md: avoid deadlock when dirty buffers during md_stop.
      added MD_STILL_CLOSED, this caused md_check_recovery to misbehave.
      It can think there is something to do but find nothing.  This can
      lead to the md thread spinning during array shutdown.
      
      https://bugzilla.kernel.org/show_bug.cgi?id=65721Reported-and-tested-by: default avatarRichard W.M. Jones <rjones@redhat.com>
      Fixes: 260fa034
      Cc: stable@vger.kernel.org (3.12)
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      142d44c3
    • NeilBrown's avatar
      md/raid5: fix new memory-reference bug in alloc_thread_groups. · 0c775d52
      NeilBrown authored
      In alloc_thread_groups, worker_groups is a pointer to an array,
      not an array of pointers.
      So
         worker_groups[i]
      is wrong.  It should be
         &(*worker_groups)[i]
      
      Found-by: coverity
      Fixes: 60aaf933Reported-by: default avatarBen Hutchings <bhutchings@solarflare.com>
      Cc: majianpeng <majianpeng@gmail.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      0c775d52
  3. 27 Nov, 2013 11 commits
    • Greg Kroah-Hartman's avatar
      Revert "sysfs: handle duplicate removal attempts in sysfs_remove_group()" · 81440e73
      Greg Kroah-Hartman authored
      This reverts commit 54d71145.
      
      The root cause of these "inverted" sysfs removals have now been found,
      so there is no need for this patch.  Keep this functionality around so
      that this type of error doesn't show up in driver code again.
      
      Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
      Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
      Cc: Tejun Heo <tj@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      81440e73
    • Greg Kroah-Hartman's avatar
      Staging: tidspbridge: disable driver · 930ba4a3
      Greg Kroah-Hartman authored
      There seems to be no active maintainer for the driver, and there is an
      unfixed security bug, so disable the driver for now.
      
      Hopefully someone steps up to be the maintainer, and works to get this
      out of staging, otherwise it will be deleted soon.
      Reported-by: default avatarNico Golde <nico@ngolde.de>
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Cc: Omar Ramirez Luna <omar.ramirez@copitl.com>
      Cc: Omar Ramirez Luna <omar.ramirez@ti.com>
      Cc: Kanigeri, Hari <h-kanigeri2@ti.com>
      Cc: Ameya Palande <ameya.palande@nokia.com>
      Cc: Guzman Lugo, Fernando <fernando.lugo@ti.com>
      Cc: Hebbar, Shivananda <x0hebbar@ti.com>
      Cc: Ramos Falcon, Ernesto <ernesto@ti.com>
      Cc: Felipe Contreras <felipe.contreras@gmail.com>
      Cc: Anna, Suman <s-anna@ti.com>
      Cc: Gupta, Ramesh <grgupta@ti.com>
      Cc: Gomez Castellanos, Ivan <ivan.gomez@ti.com>
      Cc: Andy Shevchenko <ext-andriy.shevchenko@nokia.com>
      Cc: Armando Uribe De Leon <x0095078@ti.com>
      Cc: Deepak Chitriki <deepak.chitriki@ti.com>
      Cc: Menon, Nishanth <nm@ti.com>
      Cc: Phil Carmody <ext-phil.2.carmody@nokia.com>
      Cc: Ohad Ben-Cohen <ohad@wizery.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      930ba4a3
    • Markus Mayer's avatar
      gpio: bcm281xx: Fix return value of bcm_kona_gpio_get() · e2f0b005
      Markus Mayer authored
      We need to return the corresponding bit for a particular GPIO. This bit
      contains shift not mask.
      Signed-off-by: default avatarMarkus Mayer <markus.mayer@linaro.org>
      Reviewed-by: default avatarTim Kryger <tim.kryger@linaro.org>
      Reviewed-by: default avatarMatt Porter <matt.porter@linaro.org>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      e2f0b005
    • Linus Walleij's avatar
      gpio: pl061: move irqdomain initialization · 2ba3154d
      Linus Walleij authored
      The PL061 driver had the irqdomain initialization in an unfortunate
      place: when used with device tree (and thus passing the base IRQ
      0) the driver would work, as this registers an irqdomain and waits
      for mappings to be done dynamically as the devices request their
      IRQs, whereas when booting using platform data the irqdomain core
      would attempt to allocate IRQ descriptors dynamically (which works
      fine) but also to associate the irq_domain_associate_many() on all
      IRQs, which in turn will call the mapping function which at this
      point will try to set the type of the IRQ and then tries to acquire
      a non-initialized spinlock yielding a backtrace like this:
      
      CPU: 0 PID: 1 Comm: swapper Not tainted 3.13.0-rc1+ #652
      Backtrace:
      [<c0016f0c>] (dump_backtrace) from [<c00172ac>] (show_stack+0x18/0x1c)
       r6:c798ace0 r5:00000000 r4:c78257e0 r3:00200140
      [<c0017294>] (show_stack) from [<c0329ea0>] (dump_stack+0x20/0x28)
      [<c0329e80>] (dump_stack) from [<c004fa80>] (__lock_acquire+0x1c0/0x1b80)
      [<c004f8c0>] (__lock_acquire) from [<c0051970>] (lock_acquire+0x6c/0x80)
       r10:00000000 r9:c0455234 r8:00000060 r7:c047d798 r6:600000d3 r5:00000000
       r4:c782c000
      [<c0051904>] (lock_acquire) from [<c032e484>] (_raw_spin_lock_irqsave+0x60/0x74)
       r6:c01a1100 r5:800000d3 r4:c798acd0
      [<c032e424>] (_raw_spin_lock_irqsave) from [<c01a1100>] (pl061_irq_type+0x28/0x)
       r6:00000000 r5:00000000 r4:c798acd0
      [<c01a10d8>] (pl061_irq_type) from [<c0059ef4>] (__irq_set_trigger+0x70/0x104)
       r6:00000000 r5:c01a10d8 r4:c046da1c r3:c01a10d8
      [<c0059e84>] (__irq_set_trigger) from [<c005b348>] (irq_set_irq_type+0x40/0x60)
       r10:c043240c r8:00000060 r7:00000000 r6:c046da1c r5:00000060 r4:00000000
      [<c005b308>] (irq_set_irq_type) from [<c01a1208>] (pl061_irq_map+0x40/0x54)
       r6:c79693c0 r5:c798acd0 r4:00000060
      [<c01a11c8>] (pl061_irq_map) from [<c005d27c>] (irq_domain_associate+0xc0/0x190)
       r5:00000060 r4:c046da1c
      [<c005d1bc>] (irq_domain_associate) from [<c005d604>] (irq_domain_associate_man)
       r8:00000008 r7:00000000 r6:c79693c0 r5:00000060 r4:00000000
      [<c005d5d0>] (irq_domain_associate_many) from [<c005d864>] (irq_domain_add_simp)
       r8:c046578c r7:c035b72c r6:c79693c0 r5:00000060 r4:00000008 r3:00000008
      [<c005d814>] (irq_domain_add_simple) from [<c01a1380>] (pl061_probe+0xc4/0x22c)
       r6:00000060 r5:c0464380 r4:c798acd0
      [<c01a12bc>] (pl061_probe) from [<c01c0450>] (amba_probe+0x74/0xe0)
       r10:c043240c r9:c0455234 r8:00000000 r7:c047d7f8 r6:c047d744 r5:00000000
       r4:c0464380
      
      This moves the irqdomain initialization to a point where the spinlock
      and GPIO chip are both fully propulated, so the callbacks can be used
      without crashes.
      
      I had some problem reproducing the crash, as the devm_kzalloc():ed
      zeroed memory would seemingly mask the spinlock as something OK,
      but by poisoning the lock like this:
      
      u32 *dum;
      dum = (u32 *) &chip->lock;
      *dum = 0xaaaaaaaaU;
      
      I could reproduce, fix and test the patch.
      Reported-by: default avatarRussell King <linux@arm.linux.org.uk>
      Cc: Rob Herring <robherring2@gmail.com>
      Cc: Haojian Zhuang <haojian.zhuang@linaro.org>
      Cc: Baruch Siach <baruch@tkos.co.il>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      2ba3154d
    • David Herrmann's avatar
      HID: uhid: fix leak for 64/32 UHID_CREATE · 80897aa7
      David Herrmann authored
      UHID allows short writes so user-space can omit unused fields. We
      automatically set them to 0 in the kernel. However, the 64/32 bit
      compat-handler didn't do that in the UHID_CREATE fallback. This will
      reveal random kernel heap data (of random size, even) to user-space.
      
      Fixes: befde022 ('HID: uhid: make creating devices work on 64/32 systems')
      Reported-by: default avatarBen Hutchings <ben@decadent.org.uk>
      Signed-off-by: default avatarDavid Herrmann <dh.herrmann@gmail.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      80897aa7
    • Linus Torvalds's avatar
      Merge tag 'trace-fixes-v3.13-rc1' of... · 8ae516aa
      Linus Torvalds authored
      Merge tag 'trace-fixes-v3.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
      
      Pull tracing fixes from Steven Rostedt:
       "This includes two fixes.
      
        1) is a bug fix that happens when root does the following:
      
           echo function_graph > current_tracer
           modprobe foo
           echo nop > current_tracer
      
         This causes the ftrace internal accounting to get screwed up and
         crashes ftrace, preventing the user from using the function tracer
         after that.
      
        2) if a TRACE_EVENT has a string field, and NULL is given for it.
      
         The internal trace event code does a strlen() and strcpy() on the
         source of field.  If it is NULL it causes the system to oops.
      
         This bug has been there since 2.6.31, but no TRACE_EVENT ever passed
         in a NULL to the string field, until now"
      
      * tag 'trace-fixes-v3.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        ftrace: Fix function graph with loading of modules
        tracing: Allow events to have NULL strings
      8ae516aa
    • Linus Torvalds's avatar
      Merge branch 'for-linus-bugs' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client · 4f9e5df2
      Linus Torvalds authored
      Pull ceph bug-fixes from Sage Weil:
       "These include a couple fixes to the new fscache code that went in
        during the last cycle (which will need to go stable@ shortly as well),
        a couple client-side directory fragmentation fixes, a fix for a race
        in the cap release queuing path, and a couple race fixes in the
        request abort and resend code.
      
        Obviously some of this could have gone into 3.12 final, but I
        preferred to overtest rather than send things in for a late -rc, and
        then my travel schedule intervened"
      
      * 'for-linus-bugs' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
        ceph: allocate non-zero page to fscache in readpage()
        ceph: wake up 'safe' waiters when unregistering request
        ceph: cleanup aborted requests when re-sending requests.
        ceph: handle race between cap reconnect and cap release
        ceph: set caps count after composing cap reconnect message
        ceph: queue cap release in __ceph_remove_cap()
        ceph: handle frag mismatch between readdir request and reply
        ceph: remove outdated frag information
        ceph: hung on ceph fscache invalidate in some cases
      4f9e5df2
    • Benjamin Herrenschmidt's avatar
      powerpc/windfarm: Fix XServe G5 fan control Makefile issue · 721cb59e
      Benjamin Herrenschmidt authored
      We are missing building windfarm_max6690_sensor.o when building
      CONFIG_WINDFARM_RM31. Usually all the windfarm drivers are built
      and thus this isn't a problem but some more "tailored" setups
      (Gentoo ?) building only that driver are not working because
      the require sensor module is missing.
      Reported-by: default avatarStanislav Ponomarev <devhexorg@gmail.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      721cb59e
    • Rafael J. Wysocki's avatar
      Merge branch 'pm-tools' · b90f7b8a
      Rafael J. Wysocki authored
      * pm-tools:
        tools: cpupower: fix wrong err msg not supported vs not available
        tools: cpupower: Add cpupower-idle-set(1) manpage
      b90f7b8a
    • Rafael J. Wysocki's avatar
      Merge branch 'pm-cpufreq' · db8fbb49
      Rafael J. Wysocki authored
      * pm-cpufreq:
        cpufreq: exynos: Remove unwanted EXPORT_SYMBOL
        cpufreq: tegra: don't error target() when suspended
      db8fbb49
    • Rafael J. Wysocki's avatar
      Merge branch 'acpica' · 2d304ba7
      Rafael J. Wysocki authored
      * acpica:
        ACPI: Clean up incorrect inclusions of ACPICA headers
        ACPICA: Update version to 20131115.
        ACPICA: Add support to delete all objects attached to the root namespace node.
        ACPICA: Delete all attached data objects during namespace node deletion.
        ACPICA: Resources: Fix loop termination for the get AML length function.
        ACPICA: Tests: Add CHECKSUM_ABORT protection for test utilities.
        ACPICA: Debug output: Do not emit function nesting level for kernel build.
      2d304ba7
  4. 26 Nov, 2013 6 commits
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 0e4b0743
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "Mostly bugfixes and a few small code removals.  Worth pointing out is:
      
         - A handful of more fixes to get DT enablement working properly on
           OMAP, finding new breakage of things that don't work quite right
           yet without the traditional board files.  I expect a bit more of
           this to come in this release as people test on their hardware.
         - Implementation of power_down_finish() on vexpress, to make kexec
           work and to stop the MCPM core to produce a warning (the warning
           was new to 3.13-rc1).
         - A handful of minor fixes for various platforms"
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: bcm2835: add missing #xxx-cells to I2C nodes
        ARM: dts: Add max77686 RTC interrupt to cros5250-common
        ARM: vexpress/TC2: Implement MCPM power_down_finish()
        ARM: tegra: Provide dummy powergate implementation
        ARM: omap: fix warning with LPAE build
        ARM: OMAP2+: Remove legacy omap4_twl6030_hsmmc_init
        ARM: OMAP2+: Remove legacy mux code for display.c
        ARM: OMAP2+: Fix undefined reference to set_cntfreq
        gpio: twl4030: Fix passing of pdata in the device tree case
        gpio: twl4030: Fix regression for twl gpio output
        ARM: OMAP2+: More randconfig fixes for reconfigure_io_chain
        ARM: dts: imx6qdl: disable spdif "rxtx5" clock option
        ARM: dts: Fix omap2 specific dtsi files by adding the missing entries
        ARM: OMAP2+: Fix GPMC and simplify bootloader timings for 8250 and smc91x
        i2c: omap: Fix missing device tree flags for omap2
      0e4b0743
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security · 3af4977e
      Linus Torvalds authored
      Pull IMA fixes from James Morris:
       "These three patches fix regressions in the IMA code in your current
        tree.
      
        The first fixes a couple of bugs in template_desc_init_fields(), and
        the other two ensure that changes in this kernel don't break
        userspace"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
        ima: make a copy of template_fmt in template_desc_init_fields()
        ima: do not send field length to userspace for digest of ima template
        ima: do not include field length in template digest calc for ima template
      3af4977e
    • Linus Torvalds's avatar
      Merge tag 'ntb-3.13' of git://github.com/jonmason/ntb · b9548514
      Linus Torvalds authored
      Pull non-transparent bridge updates from Jon Mason:
       "NTB driver bug fixes to address a missed call to pci_enable_msix,
        NTB-RP Link Up issue, Xeon Doorbell errata workaround, ntb_transport
        link down race, and correct dmaengine_get/put usage.
      
        Also, clean-ups to remove duplicate defines and document a hardware
        errata.  Finally, some changes to improve performance"
      
      * tag 'ntb-3.13' of git://github.com/jonmason/ntb:
        NTB: Disable interrupts and poll under high load
        NTB: Enable Snoop on Primary Side
        NTB: Document HW errata
        NTB: remove duplicate defines
        NTB: correct dmaengine_get/put usage
        NTB: Fix ntb_transport link down race
        ntb: Fix missed call to pci_enable_msix()
        NTB: Fix NTB-RP Link Up
        NTB: Xeon Doorbell errata workaround
      b9548514
    • Steven Rostedt (Red Hat)'s avatar
      ftrace: Fix function graph with loading of modules · 8a56d776
      Steven Rostedt (Red Hat) authored
      Commit 8c4f3c3f "ftrace: Check module functions being traced on reload"
      fixed module loading and unloading with respect to function tracing, but
      it missed the function graph tracer. If you perform the following
      
       # cd /sys/kernel/debug/tracing
       # echo function_graph > current_tracer
       # modprobe nfsd
       # echo nop > current_tracer
      
      You'll get the following oops message:
      
       ------------[ cut here ]------------
       WARNING: CPU: 2 PID: 2910 at /linux.git/kernel/trace/ftrace.c:1640 __ftrace_hash_rec_update.part.35+0x168/0x1b9()
       Modules linked in: nfsd exportfs nfs_acl lockd ipt_MASQUERADE sunrpc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables uinput snd_hda_codec_idt
       CPU: 2 PID: 2910 Comm: bash Not tainted 3.13.0-rc1-test #7
       Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007
        0000000000000668 ffff8800787efcf8 ffffffff814fe193 ffff88007d500000
        0000000000000000 ffff8800787efd38 ffffffff8103b80a 0000000000000668
        ffffffff810b2b9a ffffffff81a48370 0000000000000001 ffff880037aea000
       Call Trace:
        [<ffffffff814fe193>] dump_stack+0x4f/0x7c
        [<ffffffff8103b80a>] warn_slowpath_common+0x81/0x9b
        [<ffffffff810b2b9a>] ? __ftrace_hash_rec_update.part.35+0x168/0x1b9
        [<ffffffff8103b83e>] warn_slowpath_null+0x1a/0x1c
        [<ffffffff810b2b9a>] __ftrace_hash_rec_update.part.35+0x168/0x1b9
        [<ffffffff81502f89>] ? __mutex_lock_slowpath+0x364/0x364
        [<ffffffff810b2cc2>] ftrace_shutdown+0xd7/0x12b
        [<ffffffff810b47f0>] unregister_ftrace_graph+0x49/0x78
        [<ffffffff810c4b30>] graph_trace_reset+0xe/0x10
        [<ffffffff810bf393>] tracing_set_tracer+0xa7/0x26a
        [<ffffffff810bf5e1>] tracing_set_trace_write+0x8b/0xbd
        [<ffffffff810c501c>] ? ftrace_return_to_handler+0xb2/0xde
        [<ffffffff811240a8>] ? __sb_end_write+0x5e/0x5e
        [<ffffffff81122aed>] vfs_write+0xab/0xf6
        [<ffffffff8150a185>] ftrace_graph_caller+0x85/0x85
        [<ffffffff81122dbd>] SyS_write+0x59/0x82
        [<ffffffff8150a185>] ftrace_graph_caller+0x85/0x85
        [<ffffffff8150a2d2>] system_call_fastpath+0x16/0x1b
       ---[ end trace 940358030751eafb ]---
      
      The above mentioned commit didn't go far enough. Well, it covered the
      function tracer by adding checks in __register_ftrace_function(). The
      problem is that the function graph tracer circumvents that (for a slight
      efficiency gain when function graph trace is running with a function
      tracer. The gain was not worth this).
      
      The problem came with ftrace_startup() which should always be called after
      __register_ftrace_function(), if you want this bug to be completely fixed.
      
      Anyway, this solution moves __register_ftrace_function() inside of
      ftrace_startup() and removes the need to call them both.
      Reported-by: default avatarDave Wysochanski <dwysocha@redhat.com>
      Fixes: ed926f9b ("ftrace: Use counters to enable functions to trace")
      Cc: stable@vger.kernel.org # 3.0+
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      8a56d776
    • Steven Rostedt (Red Hat)'s avatar
      tracing: Allow events to have NULL strings · 4e58e547
      Steven Rostedt (Red Hat) authored
      If an TRACE_EVENT() uses __assign_str() or __get_str on a NULL pointer
      then the following oops will happen:
      
      BUG: unable to handle kernel NULL pointer dereference at   (null)
      IP: [<c127a17b>] strlen+0x10/0x1a
      *pde = 00000000 ^M
      Oops: 0000 [#1] PREEMPT SMP
      Modules linked in:
      CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.13.0-rc1-test+ #2
      Hardware name:                  /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006^M
      task: f5cde9f0 ti: f5e5e000 task.ti: f5e5e000
      EIP: 0060:[<c127a17b>] EFLAGS: 00210046 CPU: 1
      EIP is at strlen+0x10/0x1a
      EAX: 00000000 EBX: c2472da8 ECX: ffffffff EDX: c2472da8
      ESI: c1c5e5fc EDI: 00000000 EBP: f5e5fe84 ESP: f5e5fe80
       DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
      CR0: 8005003b CR2: 00000000 CR3: 01f32000 CR4: 000007d0
      Stack:
       f5f18b90 f5e5feb8 c10687a8 0759004f 00000005 00000005 00000005 00200046
       00000002 00000000 c1082a93 f56c7e28 c2472da8 c1082a93 f5e5fee4 c106bc61^M
       00000000 c1082a93 00000000 00000000 00000001 00200046 00200082 00000000
      Call Trace:
       [<c10687a8>] ftrace_raw_event_lock+0x39/0xc0
       [<c1082a93>] ? ktime_get+0x29/0x69
       [<c1082a93>] ? ktime_get+0x29/0x69
       [<c106bc61>] lock_release+0x57/0x1a5
       [<c1082a93>] ? ktime_get+0x29/0x69
       [<c10824dd>] read_seqcount_begin.constprop.7+0x4d/0x75
       [<c1082a93>] ? ktime_get+0x29/0x69^M
       [<c1082a93>] ktime_get+0x29/0x69
       [<c108a46a>] __tick_nohz_idle_enter+0x1e/0x426
       [<c10690e8>] ? lock_release_holdtime.part.19+0x48/0x4d
       [<c10bc184>] ? time_hardirqs_off+0xe/0x28
       [<c1068c82>] ? trace_hardirqs_off_caller+0x3f/0xaf
       [<c108a8cb>] tick_nohz_idle_enter+0x59/0x62
       [<c1079242>] cpu_startup_entry+0x64/0x192
       [<c102299c>] start_secondary+0x277/0x27c
      Code: 90 89 c6 89 d0 88 c4 ac 38 e0 74 09 84 c0 75 f7 be 01 00 00 00 89 f0 48 5e 5d c3 55 89 e5 57 66 66 66 66 90 83 c9 ff 89 c7 31 c0 <f2> ae f7 d1 8d 41 ff 5f 5d c3 55 89 e5 57 66 66 66 66 90 31 ff
      EIP: [<c127a17b>] strlen+0x10/0x1a SS:ESP 0068:f5e5fe80
      CR2: 0000000000000000
      ---[ end trace 01bc47bf519ec1b2 ]---
      
      New tracepoints have been added that have allowed for NULL pointers
      being assigned to strings. To fix this, change the TRACE_EVENT() code
      to check for NULL and if it is, it will assign "(null)" to it instead
      (similar to what glibc printf does).
      Reported-by: default avatarShuah Khan <shuah.kh@samsung.com>
      Reported-by: default avatarJovi Zhangwei <jovi.zhangwei@gmail.com>
      Link: http://lkml.kernel.org/r/CAGdX0WFeEuy+DtpsJzyzn0343qEEjLX97+o1VREFkUEhndC+5Q@mail.gmail.com
      Link: http://lkml.kernel.org/r/528D6972.9010702@samsung.com
      Fixes: 9cbf1176 ("tracing/events: provide string with undefined size support")
      Cc: stable@vger.kernel.org # 2.6.31+
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      4e58e547
    • Stephen Warren's avatar
      ARM: bcm2835: add missing #xxx-cells to I2C nodes · a31ab44e
      Stephen Warren authored
      The I2C controller node needs #address-cells and #size-cells properties,
      but these are currently missing. Add them. This allows child nodes to be
      parsed correctly.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarStephen Warren <swarren@wwwdotorg.org>
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      a31ab44e