1. 20 Jun, 2013 5 commits
    • Tony Lindgren's avatar
      drivers/rtc/rtc-twl.c: fix missing device_init_wakeup() when booted with device tree · e053ee3f
      Tony Lindgren authored
      commit 24b8256a upstream.
      
      When booted in legacy mode device_init_wakeup() gets called by
      drivers/mfd/twl-core.c when the children are initialized.  However, when
      booted using device tree, the children are created with
      of_platform_populate() instead add_children().
      
      This means that the RTC driver will not have device_init_wakeup() set,
      and we need to call it from the driver probe like RTC drivers typically
      do.
      
      Without this we cannot test PM wake-up events on omaps for cases where
      there may not be any physical wake-up event.
      Signed-off-by: default avatarTony Lindgren <tony@atomide.com>
      Reported-by: default avatarKevin Hilman <khilman@linaro.org>
      Cc: Alessandro Zummo <a.zummo@towertech.it>
      Cc: Jingoo Han <jg1.han@samsung.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e053ee3f
    • Jim Schutt's avatar
      ceph: ceph_pagelist_append might sleep while atomic · c7ed0848
      Jim Schutt authored
      commit 39be95e9 upstream.
      
      Ceph's encode_caps_cb() worked hard to not call __page_cache_alloc()
      while holding a lock, but it's spoiled because ceph_pagelist_addpage()
      always calls kmap(), which might sleep.  Here's the result:
      
      [13439.295457] ceph: mds0 reconnect start
      [13439.300572] BUG: sleeping function called from invalid context at include/linux/highmem.h:58
      [13439.309243] in_atomic(): 1, irqs_disabled(): 0, pid: 12059, name: kworker/1:1
          . . .
      [13439.376225] Call Trace:
      [13439.378757]  [<ffffffff81076f4c>] __might_sleep+0xfc/0x110
      [13439.384353]  [<ffffffffa03f4ce0>] ceph_pagelist_append+0x120/0x1b0 [libceph]
      [13439.391491]  [<ffffffffa0448fe9>] ceph_encode_locks+0x89/0x190 [ceph]
      [13439.398035]  [<ffffffff814ee849>] ? _raw_spin_lock+0x49/0x50
      [13439.403775]  [<ffffffff811cadf5>] ? lock_flocks+0x15/0x20
      [13439.409277]  [<ffffffffa045e2af>] encode_caps_cb+0x41f/0x4a0 [ceph]
      [13439.415622]  [<ffffffff81196748>] ? igrab+0x28/0x70
      [13439.420610]  [<ffffffffa045e9f8>] ? iterate_session_caps+0xe8/0x250 [ceph]
      [13439.427584]  [<ffffffffa045ea25>] iterate_session_caps+0x115/0x250 [ceph]
      [13439.434499]  [<ffffffffa045de90>] ? set_request_path_attr+0x2d0/0x2d0 [ceph]
      [13439.441646]  [<ffffffffa0462888>] send_mds_reconnect+0x238/0x450 [ceph]
      [13439.448363]  [<ffffffffa0464542>] ? ceph_mdsmap_decode+0x5e2/0x770 [ceph]
      [13439.455250]  [<ffffffffa0462e42>] check_new_map+0x352/0x500 [ceph]
      [13439.461534]  [<ffffffffa04631ad>] ceph_mdsc_handle_map+0x1bd/0x260 [ceph]
      [13439.468432]  [<ffffffff814ebc7e>] ? mutex_unlock+0xe/0x10
      [13439.473934]  [<ffffffffa043c612>] extra_mon_dispatch+0x22/0x30 [ceph]
      [13439.480464]  [<ffffffffa03f6c2c>] dispatch+0xbc/0x110 [libceph]
      [13439.486492]  [<ffffffffa03eec3d>] process_message+0x1ad/0x1d0 [libceph]
      [13439.493190]  [<ffffffffa03f1498>] ? read_partial_message+0x3e8/0x520 [libceph]
          . . .
      [13439.587132] ceph: mds0 reconnect success
      [13490.720032] ceph: mds0 caps stale
      [13501.235257] ceph: mds0 recovery completed
      [13501.300419] ceph: mds0 caps renewed
      
      Fix it up by encoding locks into a buffer first, and when the number
      of encoded locks is stable, copy that into a ceph_pagelist.
      
      [elder@inktank.com: abbreviated the stack info a bit.]
      Signed-off-by: default avatarJim Schutt <jaschut@sandia.gov>
      Reviewed-by: default avatarAlex Elder <elder@inktank.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c7ed0848
    • Jim Schutt's avatar
      ceph: add cpu_to_le32() calls when encoding a reconnect capability · a169043d
      Jim Schutt authored
      commit c420276a upstream.
      
      In his review, Alex Elder mentioned that he hadn't checked that
      num_fcntl_locks and num_flock_locks were properly decoded on the
      server side, from a le32 over-the-wire type to a cpu type.
      I checked, and AFAICS it is done; those interested can consult
          Locker::_do_cap_update()
      in src/mds/Locker.cc and src/include/encoding.h in the Ceph server
      code (git://github.com/ceph/ceph).
      
      I also checked the server side for flock_len decoding, and I believe
      that also happens correctly, by virtue of having been declared
      __le32 in struct ceph_mds_cap_reconnect, in src/include/ceph_fs.h.
      Signed-off-by: default avatarJim Schutt <jaschut@sandia.gov>
      Reviewed-by: default avatarAlex Elder <elder@inktank.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      a169043d
    • Alex Elder's avatar
      libceph: must hold mutex for reset_changed_osds() · b84a4fc1
      Alex Elder authored
      commit 14d2f38d upstream.
      
      An osd client has a red-black tree describing its osds, and
      occasionally we would get crashes due to one of these trees tree
      becoming corrupt somehow.
      
      The problem turned out to be that reset_changed_osds() was being
      called without protection of the osd client request mutex.  That
      function would call __reset_osd() for any osd that had changed, and
      __reset_osd() would call __remove_osd() for any osd with no
      outstanding requests, and finally __remove_osd() would remove the
      corresponding entry from the red-black tree.  Thus, the tree was
      getting modified without having any lock protection, and was
      vulnerable to problems due to concurrent updates.
      
      This appears to be the only osd tree updating path that has this
      problem.  It can be fairly easily fixed by moving the call up
      a few lines, to just before the request mutex gets dropped
      in kick_requests().
      
      This resolves:
          http://tracker.ceph.com/issues/5043Signed-off-by: default avatarAlex Elder <elder@inktank.com>
      Reviewed-by: default avatarSage Weil <sage@inktank.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b84a4fc1
    • Kees Cook's avatar
      b43: stop format string leaking into error msgs · d2305b5a
      Kees Cook authored
      commit e0e29b68 upstream.
      
      The module parameter "fwpostfix" is userspace controllable, unfiltered,
      and is used to define the firmware filename. b43_do_request_fw() populates
      ctx->errors[] on error, containing the firmware filename. b43err()
      parses its arguments as a format string. For systems with b43 hardware,
      this could lead to a uid-0 to ring-0 escalation.
      
      CVE-2013-2852
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d2305b5a
  2. 13 Jun, 2013 33 commits
  3. 07 Jun, 2013 2 commits
    • Greg Kroah-Hartman's avatar
      Linux 3.4.48 · 39869ce7
      Greg Kroah-Hartman authored
      39869ce7
    • Manoj Iyer's avatar
      thinkpad-acpi: recognize latest V-Series using DMI_BIOS_VENDOR · e455d058
      Manoj Iyer authored
      commit a4f46bb9 upstream.
      
      In the latest V-series bios DMI_PRODUCT_VERSION does not contain
      the string Lenovo or Thinkpad, but is set to the model number, this
      causes the thinkpad_acpi module to fail to load. Recognize laptop
      as Lenovo using DMI_BIOS_VENDOR instead, which is set to Lenovo.
      
      Test on V490u
      =============
      == After the patch ==
      
      [ 1350.295757] thinkpad_acpi: ThinkPad ACPI Extras v0.24
      [ 1350.295760] thinkpad_acpi: http://ibm-acpi.sf.net/
      [ 1350.295761] thinkpad_acpi: ThinkPad BIOS H7ET21WW (1.00 ), EC unknown
      [ 1350.295763] thinkpad_acpi: Lenovo LENOVO, model LV5DXXX
      [ 1350.296086] thinkpad_acpi: detected a 8-level brightness capable ThinkPad
      [ 1350.296694] thinkpad_acpi: radio switch found; radios are enabled
      [ 1350.296703] thinkpad_acpi: possible tablet mode switch found; ThinkPad in laptop mode
      [ 1350.306466] thinkpad_acpi: rfkill switch tpacpi_bluetooth_sw: radio is unblocked
      [ 1350.307082] Registered led device: tpacpi::thinklight
      [ 1350.307215] Registered led device: tpacpi::power
      [ 1350.307255] Registered led device: tpacpi::standby
      [ 1350.307294] Registered led device: tpacpi::thinkvantage
      [ 1350.308160] thinkpad_acpi: Standard ACPI backlight interface available, not loading native one
      [ 1350.308333] thinkpad_acpi: Console audio control enabled, mode: monitor (read only)
      [ 1350.312287] input: ThinkPad Extra Buttons as /devices/platform/thinkpad_acpi/input/input14
      
      == Before the patch ==
      sudo modprobe thinkpad_acpi
      FATAL: Error inserting thinkpad_acpi (/lib/modules/3.2.0-27-generic/kernel/drivers/platform/x86/thinkpad_acpi.ko): No such device
      
      Test on B485
      =============
      This patch was also test in a B485 where the thinkpad_acpi module does not
      have any issues loading. But, I tested it to make sure this patch does not
      break on already functioning models of Lenovo products.
      
      [13486.746359] thinkpad_acpi: ThinkPad ACPI Extras v0.24
      [13486.746364] thinkpad_acpi: http://ibm-acpi.sf.net/
      [13486.746368] thinkpad_acpi: ThinkPad BIOS HJET15WW(1.01), EC unknown
      [13486.746373] thinkpad_acpi: Lenovo Lenovo LB485, model 814TR01
      [13486.747300] thinkpad_acpi: detected a 8-level brightness capable ThinkPad
      [13486.752435] thinkpad_acpi: rfkill switch tpacpi_bluetooth_sw: radio is unblocked
      [13486.752883] Registered led device: tpacpi::thinklight
      [13486.752915] thinkpad_acpi: Standard ACPI backlight interface available, not loading native one
      [13486.753216] thinkpad_acpi: Console audio control enabled, mode: monitor (read only)
      [13486.757147] input: ThinkPad Extra Buttons as /devices/platform/thinkpad_acpi/input/input15
      Signed-off-by: default avatarManoj Iyer <manoj.iyer@canonical.com>
      Signed-off-by: default avatarMatthew Garrett <mjg@redhat.com>
      Cc: Shuduo Sang <shuduo.sang@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e455d058