1. 29 Sep, 2014 1 commit
    • Al Viro's avatar
      missing data dependency barrier in prepend_name() · 6d13f694
      Al Viro authored
      AFAICS, prepend_name() is broken on SMP alpha.  Disclaimer: I don't have
      SMP alpha boxen to reproduce it on.  However, it really looks like the race
      is real.
      
      CPU1: d_path() on /mnt/ramfs/<255-character>/foo
      CPU2: mv /mnt/ramfs/<255-character> /mnt/ramfs/<63-character>
      
      CPU2 does d_alloc(), which allocates an external name, stores the name there
      including terminating NUL, does smp_wmb() and stores its address in
      dentry->d_name.name.  It proceeds to d_add(dentry, NULL) and d_move()
      old dentry over to that.  ->d_name.name value ends up in that dentry.
      
      In the meanwhile, CPU1 gets to prepend_name() for that dentry.  It fetches
      ->d_name.name and ->d_name.len; the former ends up pointing to new name
      (64-byte kmalloc'ed array), the latter - 255 (length of the old name).
      Nothing to force the ordering there, and normally that would be OK, since we'd
      run into the terminating NUL and stop.  Except that it's alpha, and we'd need
      a data dependency barrier to guarantee that we see that store of NUL
      __d_alloc() has done.  In a similar situation dentry_cmp() would survive; it
      does explicit smp_read_barrier_depends() after fetching ->d_name.name.
      prepend_name() doesn't and it risks walking past the end of kmalloc'ed object
      and possibly oops due to taking a page fault in kernel mode.
      
      Cc: stable@vger.kernel.org # 3.12+
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      6d13f694
  2. 28 Sep, 2014 1 commit
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 1e3827bf
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "Assorted fixes + unifying __d_move() and __d_materialise_dentry() +
        minimal regression fix for d_path() of victims of overwriting rename()
        ported on top of that"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        vfs: Don't exchange "short" filenames unconditionally.
        fold swapping ->d_name.hash into switch_names()
        fold unlocking the children into dentry_unlock_parents_for_move()
        kill __d_materialise_dentry()
        __d_materialise_dentry(): flip the order of arguments
        __d_move(): fold manipulations with ->d_child/->d_subdirs
        don't open-code d_rehash() in d_materialise_unique()
        pull rehashing and unlocking the target dentry into __d_materialise_dentry()
        ufs: deal with nfsd/iget races
        fuse: honour max_read and max_write in direct_io mode
        shmem: fix nlink for rename overwrite directory
      1e3827bf
  3. 27 Sep, 2014 15 commits
  4. 26 Sep, 2014 14 commits
  5. 25 Sep, 2014 9 commits
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-3.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · f4cb707e
      Linus Torvalds authored
      Pull ACPI and power management fixes from Rafael Wysocki:
       "These are regression fixes (ACPI hotplug, cpufreq, hibernation, ACPI
        LPSS driver), fixes for stuff that never worked correctly (ACPI GPIO
        support in some cases and a wrong sign of an error code in the ACPI
        core in one place), and one blacklist item for ACPI backlight
        handling.
      
        Specifics:
      
         - Revert of a recent hibernation core commit that introduced a NULL
           pointer dereference during resume for at least one user (Rafael J
           Wysocki).
      
         - Fix for the ACPI LPSS (Low-Power Subsystem) driver to disable
           asynchronous PM callback execution for LPSS devices during system
           suspend/resume (introduced in 3.16) which turns out to break
           ordering expectations on some systems.  From Fu Zhonghui.
      
         - cpufreq core fix related to the handling of sysfs nodes during
           system suspend/resume that has been broken for intel_pstate since
           3.15 from Lan Tianyu.
      
         - Restore the generation of "online" uevents for ACPI container
           devices that was removed in 3.14, but some user space utilities
           turn out to need them (Rafael J Wysocki).
      
         - The cpufreq core fails to release a lock in an error code path
           after changes made in 3.14.  Fix from Prarit Bhargava.
      
         - ACPICA and ACPI/GPIO fixes to make the handling of ACPI GPIO
           operation regions (which means AML using GPIOs) work correctly in
           all cases from Bob Moore and Srinivas Pandruvada.
      
         - Fix for a wrong sign of the ACPI core's create_modalias() return
           value in case of an error from Mika Westerberg.
      
         - ACPI backlight blacklist entry for ThinkPad X201s from Aaron Lu"
      
      * tag 'pm+acpi-3.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        Revert "PM / Hibernate: Iterate over set bits instead of PFNs in swsusp_free()"
        gpio / ACPI: Use pin index and bit length
        ACPICA: Update to GPIO region handler interface.
        ACPI / platform / LPSS: disable async suspend/resume of LPSS devices
        cpufreq: release policy->rwsem on error
        cpufreq: fix cpufreq suspend/resume for intel_pstate
        ACPI / scan: Correct error return value of create_modalias()
        ACPI / video: disable native backlight for ThinkPad X201s
        ACPI / hotplug: Generate online uevents for ACPI containers
      f4cb707e
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 12df9f37
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "This is probably not the kind of pull request you want to see that
        late in the cycle.  Yet, the ACPI refactorization was problematic
        again and caused another two issues which need fixing.  My holidays
        with limited internet (plus travelling) and the developer's illness
        didn't help either :(
      
        The details:
      
         - ACPI code was refactored out into a seperate file and as a
           side-effect, the i2c-core module got renamed.  Jean Delvare
           rightfully complained about the rename being problematic for
           distributions.  So, Mika and I thought the least problematic way to
           deal with it is to move all the code back into the main i2c core
           source file.  This is mainly a huge code move with some #ifdeffery
           applied.  No functional code changes.  Our personal tests and the
           testbots did not find problems.  (I was thinking about reverting,
           too, yet that would also have ~800 lines changed)
      
         - The new ACPI code also had a NULL pointer exception, thanks to
           Peter for finding and fixing it.
      
         - Mikko fixed a locking problem by decoupling clock_prepare and
           clock_enable.
      
         - Addy learnt that the datasheet was wrong and reimplemented the
           frequency setup according to the new algorithm.
      
        - Fan fixed an off-by-one error when copying data
      
        - Janusz fixed a copy'n'paste bug which gave a wrong error message
      
        - Sergei made sure that "don't touch" bits are not accessed"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: acpi: Fix NULL Pointer dereference
        i2c: move acpi code back into the core
        i2c: rk3x: fix divisor calculation for SCL frequency
        i2c: mxs: fix error message in pio transfer
        i2c: ismt: use correct length when copy buffer
        i2c: rcar: fix RCAR_IRQ_ACK_{RECV|SEND}
        i2c: tegra: Move clk_prepare/clk_set_rate to probe
      12df9f37
    • Randy Dunlap's avatar
      MAINTAINERS: new Documentation maintainer · d671e424
      Randy Dunlap authored
      Transfer Documentation maintainership to Jiri Kosina.
      Thanks, Jiri.
      
      I'll still be reviewing and working on documentation.
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Acked-by: default avatarJiri Kosina <jkosina@suse.cz>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d671e424
    • Rafael J. Wysocki's avatar
      Merge branches 'pm-cpufreq' and 'pm-sleep' · 381e63da
      Rafael J. Wysocki authored
      * pm-cpufreq:
        cpufreq: release policy->rwsem on error
        cpufreq: fix cpufreq suspend/resume for intel_pstate
      
      * pm-sleep:
        Revert "PM / Hibernate: Iterate over set bits instead of PFNs in swsusp_free()"
      381e63da
    • Rafael J. Wysocki's avatar
      Merge branches 'acpi-hotplug', 'acpi-scan', 'acpi-lpss', 'acpi-gpio' and 'acpi-video' · 9ef5a306
      Rafael J. Wysocki authored
      * acpi-hotplug:
        ACPI / hotplug: Generate online uevents for ACPI containers
      
      * acpi-scan:
        ACPI / scan: Correct error return value of create_modalias()
      
      * acpi-lpss:
        ACPI / platform / LPSS: disable async suspend/resume of LPSS devices
      
      * acpi-gpio:
        gpio / ACPI: Use pin index and bit length
        ACPICA: Update to GPIO region handler interface.
      
      * acpi-video:
        ACPI / video: disable native backlight for ThinkPad X201s
      9ef5a306
    • Linus Torvalds's avatar
      Merge tag 'gpio-v3.17-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 2289823c
      Linus Torvalds authored
      Pull gpio fixes from Linus Walleij:
       "Two GPIO fixes:
      
         - GPIO direction flags where handled wrong in the new descriptor-
           based API, so direction changes did not always "take".
      
         - Fix a handler installation race in the generic GPIO irqchip code"
      
      * tag 'gpio-v3.17-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: Fix potential NULL handler data in chained irqchip handler
        gpio: Fix gpio direction flags not getting set
      2289823c
    • Ingo Molnar's avatar
      Merge tag 'efi-urgent' of... · 29282ac0
      Ingo Molnar authored
      Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/urgent
      
      Pull EFI fixes from Matt Fleming:
      
        * Revert the static library changes from the merge window since they're
          causing issues for Macbooks and Fedora + Grub2 (Matt Fleming)
      
        * Delete the misleading "setup_efi_pci() failed!" message which some
          people are seeing when booting EFI (Matt Fleming)
      
        * Fix printing strings from the 32-bit EFI boot stub by only passing
          32-bit addresses to the firmware (Matt Fleming)
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      29282ac0
    • Linus Torvalds's avatar
      Merge tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux · 4d3afba3
      Linus Torvalds authored
      Pull devicetree bug fixes and documentation from Grant Likely:
       "Several bug fix commits for issues found in the v3.17 rc series.
      
        Most of these are minor in that they aren't actively dangerous, but
        they have been seen in the wild.  The one important fix is commit
        7dbe5849 ("of: make sure of_alias is initialized before accessing
        it"), without which some powerpc platforms will fail to find stdout
        for the console"
      
      * tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux:
        of/fdt: fix memory range check
        of: Fix memory block alignment in early_init_dt_add_memory_arch()
        of: make sure of_alias is initialized before accessing it
        of: Documentation regarding attaching OF Selftest testdata
        of: Disabling OF functions that use sysfs if CONFIG_SYSFS disabled
        of: correct of_console_check()'s return value
      4d3afba3
    • Peter Hüwe's avatar
      i2c: acpi: Fix NULL Pointer dereference · 0aef44e8
      Peter Hüwe authored
      If adapter->dev.parent == NULL there is a NULL pointer dereference in
      acpi_i2c_install_space_handler and acpi_i2c_remove_space_handler.
      
      This is present since introduction of this code:
      36604751 "i2c: rework kernel config I2C_ACPI" or even
      da3c6647 "I2C/ACPI: Clean up I2C ACPI code and Add CONFIG_I2C_ACPI"
      
      The adapter->dev.parent == NULL case is valid for the i2c_stub,
      so loading i2c_stub with ACPI_I2C_OPREGION enabled results in an oops.
      This is also valid at least for i2c_tiny_usb and i2c_robotfuzz_osif.
      
      Fix by checking whether it is null before calling ACPI_HANDLE.
      Signed-off-by: default avatarPeter Huewe <peterhuewe@gmx.de>
      Acked-by: default avatarMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
      0aef44e8