platform/kernel/kernel-mfld-blackbay.git
13 years agoMerge branch 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git...
Linus Torvalds [Fri, 3 Dec 2010 17:19:54 +0000 (09:19 -0800)]
Merge branch 'sh-fixes-for-linus' of git://git./linux/kernel/git/lethal/sh-2.6

* 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
  sh: se/7724: Remove FSI/B of GPIO init code
  sh: se/7724: Update clock framework of FSI clock to non-legacy
  sh: Assume new page cache pages have dirty dcache lines.
  sh: boards: mach-se: use IS_ERR() instead of NULL check
  sh: Add div6_reparent_clks to clock framework for FSI
  dma: shdma: add a MODULE_ALIAS() to allow module autoloading

13 years agoMerge branch 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...
Linus Torvalds [Fri, 3 Dec 2010 17:19:31 +0000 (09:19 -0800)]
Merge branch 'fbdev-fixes-for-linus' of git://git./linux/kernel/git/lethal/fbdev-2.6

* 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6:
  lxfb: Maintain video processor palette through suspend/resume
  video: da8xx: Register IRQ as last thing in driver probing.
  framebuffer: fix fbcmap.c kernel-doc warning

13 years agoMN10300: Implement asm/syscall.h
David Howells [Fri, 3 Dec 2010 15:59:50 +0000 (15:59 +0000)]
MN10300: Implement asm/syscall.h

Implement asm/syscall.h for the MN10300 arch.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agoMerge branch 'sh/urgent' into sh-fixes-for-linus
Paul Mundt [Fri, 3 Dec 2010 05:42:29 +0000 (14:42 +0900)]
Merge branch 'sh/urgent' into sh-fixes-for-linus

13 years agosh: se/7724: Remove FSI/B of GPIO init code
Nobuhiro Iwamatsu [Fri, 3 Dec 2010 05:37:54 +0000 (05:37 +0000)]
sh: se/7724: Remove FSI/B of GPIO init code

se7724 board does not have FSI/B.

Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
13 years agosh: se/7724: Update clock framework of FSI clock to non-legacy
Nobuhiro Iwamatsu [Fri, 3 Dec 2010 05:37:53 +0000 (05:37 +0000)]
sh: se/7724: Update clock framework of FSI clock to non-legacy

Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
13 years agoMerge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
Linus Torvalds [Fri, 3 Dec 2010 01:40:04 +0000 (17:40 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jikos/hid

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: length resolution should be reported units/mm
  HID: add support for F430 Force Feedback Wheel
  HID: egalax: Use kzalloc
  HID: Remove KERN_DEBUG from dbg_hid use

Manually fixed trivial conflict in drivers/hid/hid-input.c (due to
removal of KERN_DEBUG from dbg_hid use clashing with new keycode
interface switch)

13 years agodo_exit(): make sure that we run with get_fs() == USER_DS
Nelson Elhage [Thu, 2 Dec 2010 22:31:21 +0000 (14:31 -0800)]
do_exit(): make sure that we run with get_fs() == USER_DS

If a user manages to trigger an oops with fs set to KERNEL_DS, fs is not
otherwise reset before do_exit().  do_exit may later (via mm_release in
fork.c) do a put_user to a user-controlled address, potentially allowing
a user to leverage an oops into a controlled write into kernel memory.

This is only triggerable in the presence of another bug, but this
potentially turns a lot of DoS bugs into privilege escalations, so it's
worth fixing.  I have proof-of-concept code which uses this bug along
with CVE-2010-3849 to write a zero to an arbitrary kernel address, so
I've tested that this is not theoretical.

A more logical place to put this fix might be when we know an oops has
occurred, before we call do_exit(), but that would involve changing
every architecture, in multiple places.

Let's just stick it in do_exit instead.

[akpm@linux-foundation.org: update code comment]
Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agoksm: annotate ksm_thread_mutex is no deadlock source
KOSAKI Motohiro [Thu, 2 Dec 2010 22:31:20 +0000 (14:31 -0800)]
ksm: annotate ksm_thread_mutex is no deadlock source

commit 62b61f611e ("ksm: memory hotremove migration only") caused the
following new lockdep warning.

  =======================================================
  [ INFO: possible circular locking dependency detected ]
  -------------------------------------------------------
  bash/1621 is trying to acquire lock:
   ((memory_chain).rwsem){.+.+.+}, at: [<ffffffff81079339>]
  __blocking_notifier_call_chain+0x69/0xc0

  but task is already holding lock:
   (ksm_thread_mutex){+.+.+.}, at: [<ffffffff8113a3aa>]
  ksm_memory_callback+0x3a/0xc0

  which lock already depends on the new lock.

  the existing dependency chain (in reverse order) is:

  -> #1 (ksm_thread_mutex){+.+.+.}:
       [<ffffffff8108b70a>] lock_acquire+0xaa/0x140
       [<ffffffff81505d74>] __mutex_lock_common+0x44/0x3f0
       [<ffffffff81506228>] mutex_lock_nested+0x48/0x60
       [<ffffffff8113a3aa>] ksm_memory_callback+0x3a/0xc0
       [<ffffffff8150c21c>] notifier_call_chain+0x8c/0xe0
       [<ffffffff8107934e>] __blocking_notifier_call_chain+0x7e/0xc0
       [<ffffffff810793a6>] blocking_notifier_call_chain+0x16/0x20
       [<ffffffff813afbfb>] memory_notify+0x1b/0x20
       [<ffffffff81141b7c>] remove_memory+0x1cc/0x5f0
       [<ffffffff813af53d>] memory_block_change_state+0xfd/0x1a0
       [<ffffffff813afd62>] store_mem_state+0xe2/0xf0
       [<ffffffff813a0bb0>] sysdev_store+0x20/0x30
       [<ffffffff811bc116>] sysfs_write_file+0xe6/0x170
       [<ffffffff8114f398>] vfs_write+0xc8/0x190
       [<ffffffff8114fc14>] sys_write+0x54/0x90
       [<ffffffff810028b2>] system_call_fastpath+0x16/0x1b

  -> #0 ((memory_chain).rwsem){.+.+.+}:
       [<ffffffff8108b5ba>] __lock_acquire+0x155a/0x1600
       [<ffffffff8108b70a>] lock_acquire+0xaa/0x140
       [<ffffffff81506601>] down_read+0x51/0xa0
       [<ffffffff81079339>] __blocking_notifier_call_chain+0x69/0xc0
       [<ffffffff810793a6>] blocking_notifier_call_chain+0x16/0x20
       [<ffffffff813afbfb>] memory_notify+0x1b/0x20
       [<ffffffff81141f1e>] remove_memory+0x56e/0x5f0
       [<ffffffff813af53d>] memory_block_change_state+0xfd/0x1a0
       [<ffffffff813afd62>] store_mem_state+0xe2/0xf0
       [<ffffffff813a0bb0>] sysdev_store+0x20/0x30
       [<ffffffff811bc116>] sysfs_write_file+0xe6/0x170
       [<ffffffff8114f398>] vfs_write+0xc8/0x190
       [<ffffffff8114fc14>] sys_write+0x54/0x90
       [<ffffffff810028b2>] system_call_fastpath+0x16/0x1b

But it's a false positive.  Both memory_chain.rwsem and ksm_thread_mutex
have an outer lock (mem_hotplug_mutex).  So they cannot deadlock.

Thus, This patch annotate ksm_thread_mutex is not deadlock source.

[akpm@linux-foundation.org: update comment, from Hugh]
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agomem-hotplug: introduce {un}lock_memory_hotplug()
KOSAKI Motohiro [Thu, 2 Dec 2010 22:31:19 +0000 (14:31 -0800)]
mem-hotplug: introduce {un}lock_memory_hotplug()

Presently hwpoison is using lock_system_sleep() to prevent a race with
memory hotplug.  However lock_system_sleep() is a no-op if
CONFIG_HIBERNATION=n.  Therefore we need a new lock.

Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Kamezawa Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Suggested-by: Hugh Dickins <hughd@google.com>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agoDocumentation/filesystems/vfs.txt: fix ->repeasepage() description
Andrew Morton [Thu, 2 Dec 2010 22:31:19 +0000 (14:31 -0800)]
Documentation/filesystems/vfs.txt: fix ->repeasepage() description

->releasepage() does not remove the page from the mapping.

Acked-by: Neil Brown <neilb@suse.de>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agovmalloc: eagerly clear ptes on vunmap
Jeremy Fitzhardinge [Thu, 2 Dec 2010 22:31:18 +0000 (14:31 -0800)]
vmalloc: eagerly clear ptes on vunmap

On stock 2.6.37-rc4, running:

  # mount lilith:/export /mnt/lilith
  # find  /mnt/lilith/ -type f -print0 | xargs -0 file

crashes the machine fairly quickly under Xen.  Often it results in oops
messages, but the couple of times I tried just now, it just hung quietly
and made Xen print some rude messages:

    (XEN) mm.c:2389:d80 Bad type (saw 7400000000000001 != exp
    3000000000000000) for mfn 1d7058 (pfn 18fa7)
    (XEN) mm.c:964:d80 Attempt to create linear p.t. with write perms
    (XEN) mm.c:2389:d80 Bad type (saw 7400000000000010 != exp
    1000000000000000) for mfn 1d2e04 (pfn 1d1fb)
    (XEN) mm.c:2965:d80 Error while pinning mfn 1d2e04

Which means the domain tried to map a pagetable page RW, which would
allow it to map arbitrary memory, so Xen stopped it.  This is because
vm_unmap_ram() left some pages mapped in the vmalloc area after NFS had
finished with them, and those pages got recycled as pagetable pages
while still having these RW aliases.

Removing those mappings immediately removes the Xen-visible aliases, and
so it has no problem with those pages being reused as pagetable pages.
Deferring the TLB flush doesn't upset Xen because it can flush the TLB
itself as needed to maintain its invariants.

When unmapping a region in the vmalloc space, clear the ptes
immediately.  There's no point in deferring this because there's no
amortization benefit.

The TLBs are left dirty, and they are flushed lazily to amortize the
cost of the IPIs.

This specific motivation for this patch is an oops-causing regression
since 2.6.36 when using NFS under Xen, triggered by the NFS client's use
of vm_map_ram() introduced in 56e4ebf877b60 ("NFS: readdir with vmapped
pages") .  XFS also uses vm_map_ram() and could cause similar problems.

Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Cc: Nick Piggin <npiggin@kernel.dk>
Cc: Bryan Schumaker <bjschuma@netapp.com>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Alex Elder <aelder@sgi.com>
Cc: Dave Chinner <david@fromorbit.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agocs5535-gpio: apply CS5536 errata workaround for GPIOs
Andres Salomon [Thu, 2 Dec 2010 22:31:17 +0000 (14:31 -0800)]
cs5535-gpio: apply CS5536 errata workaround for GPIOs

The AMD Geode CS5536 Companion Device Silicon Revision B1 Specification
Update mentions the follow as issue #36:

 "Atomic write transactions to the atomic GPIO High Bank Feature Bit
  registers should only affect the bits selected [...]"

 "after Suspend, an atomic write transaction [...] will clear all
  non-selected bits of the accessed register."

In other words, writing to the high bank for a single GPIO bit will
clear every other GPIO bit (but only sometimes after a suspend).

The workaround described is obvious and simple; do a read-modify-write.
This patch does that, and documents why we're doing it.

Signed-off-by: Andres Salomon <dilinger@queued.net>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agoreiserfs: don't acquire lock recursively in reiserfs_acl_chmod
Frederic Weisbecker [Thu, 2 Dec 2010 22:31:16 +0000 (14:31 -0800)]
reiserfs: don't acquire lock recursively in reiserfs_acl_chmod

reiserfs_acl_chmod() can be called by reiserfs_set_attr() and then take
the reiserfs lock a second time.  Thereafter it may call journal_begin()
that definitely requires the lock not to be nested in order to release
it before taking the journal mutex because the reiserfs lock depends on
the journal mutex already.

So, aviod nesting the lock in reiserfs_acl_chmod().

Reported-by: Pawel Zawora <pzawora@gmail.com>
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
Tested-by: Pawel Zawora <pzawora@gmail.com>
Cc: Jeff Mahoney <jeffm@suse.com>
Cc: <stable@kernel.org> [2.6.32.x+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agoleds: fix up dependencies
Johannes Berg [Thu, 2 Dec 2010 22:31:14 +0000 (14:31 -0800)]
leds: fix up dependencies

It's not useful to build LED triggers when there's no LEDs that can be
triggered by them.  Therefore, fix up the dependencies so that this
cannot happen, and fix a few users that select triggers to depend on
LEDS_CLASS as well (there is also one user that also selects LEDS_CLASS,
which is OK).

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reported-by: Randy Dunlap <randy.dunlap@oracle.com>
Acked-by: Randy Dunlap <randy.dunlap@oracle.com>
Tested-by: Ingo Molnar <mingo@elte.hu>
Cc: Arnd Hannemann <arnd@arndnet.de>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Richard Purdie <rpurdie@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agovmstat: fix dirty threshold ordering
Wu Fengguang [Thu, 2 Dec 2010 22:31:13 +0000 (14:31 -0800)]
vmstat: fix dirty threshold ordering

The nr_dirty_[background_]threshold fields are misplaced before the
numa_* fields, and users will read strange values.

This is the right order.  Before patch, nr_dirty_background_threshold
will read as 0 (the value from numa_miss).

numa_hit 128501
numa_miss 0
numa_foreign 0
numa_interleave 7388
numa_local 128501
numa_other 0
nr_dirty_threshold 144291
nr_dirty_background_threshold 72145

Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
Cc: Michael Rubin <mrubin@google.com>
Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Reviewed-by: Minchan Kim <minchan.kim@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agomm/mempolicy.c: add rcu read lock to protect pid structure
Zeng Zhaoming [Thu, 2 Dec 2010 22:31:13 +0000 (14:31 -0800)]
mm/mempolicy.c: add rcu read lock to protect pid structure

find_task_by_vpid() should be protected by rcu_read_lock(), to prevent
free_pid() reclaiming pid.

Signed-off-by: Zeng Zhaoming <zengzm.kernel@gmail.com>
Cc: "Paul E. McKenney" <paulmck@us.ibm.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Christoph Lameter <cl@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agomm/hugetlb.c: avoid double unlock_page() in hugetlb_fault()
Dean Nelson [Thu, 2 Dec 2010 22:31:12 +0000 (14:31 -0800)]
mm/hugetlb.c: avoid double unlock_page() in hugetlb_fault()

Have hugetlb_fault() call unlock_page(page) only if it had previously
called lock_page(page).

Setting CONFIG_DEBUG_VM=y and then running the libhugetlbfs test suite,
resulted in the tripping of VM_BUG_ON(!PageLocked(page)) in
unlock_page() having been called by hugetlb_fault() when page ==
pagecache_page.  This patch remedied the problem.

Signed-off-by: Dean Nelson <dnelson@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agoMerge branch 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh...
Linus Torvalds [Thu, 2 Dec 2010 20:59:11 +0000 (12:59 -0800)]
Merge branch 'staging-linus' of git://git./linux/kernel/git/gregkh/staging-2.6

* 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: (27 commits)
  Staging: rt2870: Add USB ID for Buffalo Airstation WLI-UC-GN
  staging: easycap needs smp_lock.h, fixes build error
  Staging: batman-adv: ensure that eth_type_trans gets linear memory
  Staging: batman-adv: Don't remove interface with spinlock held
  staging: brcm80211: updated maintainers contact information
  staging: fix winbond build, needs delay.h
  Staging: line6: fix up my fixup for some sysfs attribute permissions
  Staging: zram: fix up my fixup for some sysfs attribute permissions
  Staging: udlfb: fix up my fixup for some sysfs attribute permissions
  Staging: samsung-laptop: fix up my fixup for some sysfs attribute permissions
  Staging: iio: adis16220: fix up my fixup for some sysfs attribute permissions
  Staging: frontier: fix up my fixup for some sysfs attribute permissions
  Staging: asus_oled: fix up my fixup for some sysfs attribute permissions
  staging: spectra: fix build error
  Staging: intel_sst: fix memory leak
  Staging: rtl8712: signedness bug in init
  staging: rtl8187se: Change panic to warn when RF switch turned off
  staging: comedi: fix memory leak
  Staging: quickstart: free after input_unregister_device()
  Staging: speakup: free after input_unregister_device()
  ...

13 years agoMerge branch 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git...
Linus Torvalds [Thu, 2 Dec 2010 20:58:36 +0000 (12:58 -0800)]
Merge branch 'driver-core-linus' of git://git./linux/kernel/git/gregkh/driver-core-2.6

* 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6:
  uio: Change mail address of Hans J. Koch
  driver core: prune docs about device_interface
  driver core: the development tree has switched to git

13 years agoMerge branch 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh...
Linus Torvalds [Thu, 2 Dec 2010 20:58:16 +0000 (12:58 -0800)]
Merge branch 'tty-linus' of git://git./linux/kernel/git/gregkh/tty-2.6

* 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
  serial: mfd: adjust the baud rate setting
  TTY: open/hangup race fixup
  TTY: don't allow reopen when ldisc is changing
  NET: wan/x25, fix ldisc->open retval
  TTY: ldisc, fix open flag handling
  serial8250: Mark console as CON_ANYTIME

13 years agoMerge branch 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh...
Linus Torvalds [Thu, 2 Dec 2010 20:57:35 +0000 (12:57 -0800)]
Merge branch 'usb-linus' of git://git./linux/kernel/git/gregkh/usb-2.6

* 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: fix autosuspend bug in usb-serial
  USB: ehci: disable LPM and PPCD for nVidia MCP89 chips
  USB: serial: ftdi_sio: Vardaan USB RS422/485 converter PID added
  USB: yurex: add .llseek fop to file_operations
  USB: ftdi_sio: Add ID for RT Systems USB-29B radio cable
  usb: musb: do not use dma for control transfers
  usb: musb: gadget: fix compilation warning
  usb: musb: clear RXCSR_AUTOCLEAR before PIO read
  usb: musb: unmap dma buffer when switching to PIO
  xhci: Don't let the USB core disable SuperSpeed ports.
  xhci: Setup array of USB 2.0 and USB 3.0 ports.
  xhci: Fix reset-device and configure-endpoint commands

13 years agoMerge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog
Linus Torvalds [Thu, 2 Dec 2010 20:11:31 +0000 (12:11 -0800)]
Merge git://git./linux/kernel/git/wim/linux-2.6-watchdog

* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
  watchdog: it8712f_wdt: add note to Kconfig
  watchdog: gef_wdt: include fs.h
  watchdog: bcm63xx_wdt: improve platform part.
  watchdog: iTCO_wdt: TCO Watchdog patch for Intel Patsburg PCH

13 years agoMerge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland...
Linus Torvalds [Thu, 2 Dec 2010 20:10:56 +0000 (12:10 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/roland/infiniband

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IB: Fix information leak in marshalling code
  IB/pack: Remove some unused code added by the IBoE patches
  IB/mlx4: Fix IBoE link state
  IB/mlx4: Fix IBoE reported link rate
  mlx4_core: Workaround firmware bug in query dev cap
  IB/mlx4: Fix memory ordering of VLAN insertion control bits
  MAINTAINERS: Update NetEffect entry

13 years agoMerge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
Linus Torvalds [Thu, 2 Dec 2010 17:13:36 +0000 (09:13 -0800)]
Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs

* 'for-linus' of git://oss.sgi.com/xfs/xfs:
  xfs: only run xfs_error_test if error injection is active
  xfs: avoid moving stale inodes in the AIL
  xfs: delayed alloc blocks beyond EOF are valid after writeback
  xfs: push stale, pinned buffers on trylock failures
  xfs: fix failed write truncation handling.

13 years agoMerge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6
Linus Torvalds [Thu, 2 Dec 2010 16:06:16 +0000 (08:06 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/lrg/voltage-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6:
  regulator: fix kernel-doc for set_consumer_device_supply
  regulator: enable supply regulator only when use count is zero
  regulator: twl-regulator - fix twlreg_set_mode
  regulator: lock supply in regulator enable
  regulator: Return proper error for regulator_register()
  regulator: Ensure enough delay time for enabling regulator
  regulator: Remove a redundant device_remove_file call in create_regulator
  regulator: Staticise mc13783_powermisc_rmw()
  regulator: regulator disable supply fix

13 years agoMerge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab...
Linus Torvalds [Thu, 2 Dec 2010 16:05:56 +0000 (08:05 -0800)]
Merge branch 'v4l_for_linus' of git://git./linux/kernel/git/mchehab/linux-2.6

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6:
  [media] v4l: Remove module_name argument to the v4l2_i2c_new_subdev* functions
  [media] v4l: Remove hardcoded module names passed to v4l2_i2c_new_subdev* (2)

13 years agoMerge branch 'rbd-sysfs' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph...
Linus Torvalds [Thu, 2 Dec 2010 16:05:22 +0000 (08:05 -0800)]
Merge branch 'rbd-sysfs' of git://git./linux/kernel/git/sage/ceph-client

* 'rbd-sysfs' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
  rbd: replace the rbd sysfs interface

13 years agoMerge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6
Linus Torvalds [Thu, 2 Dec 2010 16:04:21 +0000 (08:04 -0800)]
Merge git://git./linux/kernel/git/sfrench/cifs-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  cifs: fix parsing of hostname in dfs referrals
  cifs: display fsc in /proc/mounts
  cifs: enable fscache iff fsc mount option is used explicitly
  cifs: allow fsc mount option only if CONFIG_CIFS_FSCACHE is set
  cifs: Handle extended attribute name cifs_acl to generate cifs acl blob (try #4)
  cifs: Misc. cleanup in cifsacl handling [try #4]
  cifs: trivial comment fix for cifs_invalidate_mapping
  [CIFS] fs/cifs/Kconfig: CIFS depends on CRYPTO_HMAC
  cifs: don't take extra tlink reference in initiate_cifs_search
  cifs: Percolate error up to the caller during get/set acls [try #4]
  cifs: fix another memleak, in cifs_root_iget
  cifs: fix potential use-after-free in cifs_oplock_break_put

13 years agowatchdog: it8712f_wdt: add note to Kconfig
Wim Van Sebroeck [Thu, 2 Dec 2010 14:03:29 +0000 (14:03 +0000)]
watchdog: it8712f_wdt: add note to Kconfig

On some motherboards the it8712f watchdog does not work unless
the game port was enabled. see Bug 13140. We therefor add a note
to Kconfig.

Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
13 years agowatchdog: gef_wdt: include fs.h
Wolfram Sang & Martyn Welch [Wed, 1 Dec 2010 23:11:16 +0000 (00:11 +0100)]
watchdog: gef_wdt: include fs.h

Add missing include "linux/fs.h".
This fixes compile failure.

Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Signed-off-by: Martyn Welch <martyn.welch@ge.com>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
13 years agowatchdog: bcm63xx_wdt: improve platform part.
Wim Van Sebroeck [Sat, 23 Oct 2010 20:59:42 +0000 (20:59 +0000)]
watchdog: bcm63xx_wdt: improve platform part.

* fix devinit and devexit sections
* fix platform removal code so that the iounmap happens after the removal of the timer.
* changes the reboot_notifier by a platform shutdown method.

Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
13 years agowatchdog: iTCO_wdt: TCO Watchdog patch for Intel Patsburg PCH
Seth Heasley [Wed, 17 Nov 2010 19:15:08 +0000 (12:15 -0700)]
watchdog: iTCO_wdt: TCO Watchdog patch for Intel Patsburg PCH

This patch adds an additional LPC Controller DeviceID for the Intel Patsburg PCH for TCO Watchdog.

Signed-off-by: Seth Heasley <seth.heasley@intel.com>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
13 years agoHID: length resolution should be reported units/mm
Dmitry Torokhov [Thu, 2 Dec 2010 10:49:06 +0000 (11:49 +0100)]
HID: length resolution should be reported units/mm

Input ABI requires reporting resolution on main axes in units per
millimeter, not units per inch, so we need to convert accordingly.

Tested-by: Nikolai Kondrashov <spbnick@gmail.com>
Acked-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
13 years agoMerge branches 'misc', 'mlx4' and 'nes' into for-next
Roland Dreier [Thu, 2 Dec 2010 00:33:47 +0000 (16:33 -0800)]
Merge branches 'misc', 'mlx4' and 'nes' into for-next

13 years agoIB: Fix information leak in marshalling code
Vasiliy Kulikov [Sun, 14 Nov 2010 09:22:52 +0000 (09:22 +0000)]
IB: Fix information leak in marshalling code

ib_ucm_init_qp_attr() and ucma_init_qp_attr() pass struct ib_uverbs_qp_attr
with reserved, qp_state, {ah_attr,alt_ah_attr}{reserved,->grh.reserved}
fields uninitialized to copy_to_user().  This leads to leaking of
contents of kernel stack memory to userspace.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
13 years agoIB/pack: Remove some unused code added by the IBoE patches
Or Gerlitz [Mon, 29 Nov 2010 07:20:50 +0000 (07:20 +0000)]
IB/pack: Remove some unused code added by the IBoE patches

Remove unused functions added by commit ff7f5aab354d ("IB/pack: IBoE UD
packet packing support").

Signed-off-by: Or Gerlitz <ogerlitz@voltaire.com>
13 years agoIB/mlx4: Fix IBoE link state
Eli Cohen [Thu, 11 Nov 2010 21:05:58 +0000 (21:05 +0000)]
IB/mlx4: Fix IBoE link state

Use netif_running() and netif_carrier_ok() to report link state,
exactly as is done to report Ethernet link state in sysfs.

Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
13 years agoIB/mlx4: Fix IBoE reported link rate
Eli Cohen [Mon, 15 Nov 2010 14:04:39 +0000 (14:04 +0000)]
IB/mlx4: Fix IBoE reported link rate

The link rate is the product of the link speed in the link width. For
Etherent ports the rate is 10G, so we use 1 for the width and 4 for
speed to get the correct rate.

Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
13 years agomlx4_core: Workaround firmware bug in query dev cap
Eli Cohen [Wed, 10 Nov 2010 12:52:37 +0000 (12:52 +0000)]
mlx4_core: Workaround firmware bug in query dev cap

ConnectX firmware is supposed to report the number blue flame
registers per page as log2 of the value.  However, due to a firmware
bug, it reports actual number.  This patch works around this by
checking if the number of registers calculated fits within a page.  If
it does not, we use 8 registers per page.

Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
13 years agorbd: replace the rbd sysfs interface
Yehuda Sadeh [Fri, 19 Nov 2010 22:51:04 +0000 (14:51 -0800)]
rbd: replace the rbd sysfs interface

The new interface creates directories per mapped image
and under each it creates a subdir per available snapshot.
This allows keeping a cleaner interface within the sysfs
guidelines. The ABI documentation was updated too.

Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Yehuda Sadeh <yehuda@hq.newdream.net>
Signed-off-by: Sage Weil <sage@newdream.net>
13 years agoIB/mlx4: Fix memory ordering of VLAN insertion control bits
Eli Cohen [Wed, 17 Nov 2010 13:39:43 +0000 (13:39 +0000)]
IB/mlx4: Fix memory ordering of VLAN insertion control bits

We must fully update the control segment before marking it as valid,
so that hardware doesn't start executing it before we're ready.

Signed-off-by: Eli Cohen <eli@mellanox.co.il>
[ Move VLAN control bit setting to before wmb().  - Roland ]

Signed-off-by: Roland Dreier <rolandd@cisco.com>
13 years agoMAINTAINERS: Update NetEffect entry
Chien Tung [Tue, 2 Nov 2010 16:29:54 +0000 (16:29 +0000)]
MAINTAINERS: Update NetEffect entry

Correct web link as www.neteffect.com is no longer valid.  Remove
Chien Tung as maintainer.  I am moving on to other responsibilities at
Intel.  Thanks for all the fish.

Signed-off-by: Chien Tung <chien.tin.tung@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
13 years agoxfs: only run xfs_error_test if error injection is active
Dave Chinner [Tue, 30 Nov 2010 04:15:31 +0000 (15:15 +1100)]
xfs: only run xfs_error_test if error injection is active

Recent tests writing lots of small files showed the flusher thread
being CPU bound and taking a long time to do allocations on a debug
kernel. perf showed this as the prime reason:

             samples  pcnt function                    DSO
             _______ _____ ___________________________ _________________

           224648.00 36.8% xfs_error_test              [kernel.kallsyms]
            86045.00 14.1% xfs_btree_check_sblock      [kernel.kallsyms]
            39778.00  6.5% prandom32                   [kernel.kallsyms]
            37436.00  6.1% xfs_btree_increment         [kernel.kallsyms]
            29278.00  4.8% xfs_btree_get_rec           [kernel.kallsyms]
            27717.00  4.5% random32                    [kernel.kallsyms]

Walking btree blocks during allocation checking them requires each
block (a cache hit, so no I/O) call xfs_error_test(), which then
does a random32() call as the first operation.  IOWs, ~50% of the
CPU is being consumed just testing whether we need to inject an
error, even though error injection is not active.

Kill this overhead when error injection is not active by adding a
global counter of active error traps and only calling into
xfs_error_test when fault injection is active.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
13 years agoxfs: avoid moving stale inodes in the AIL
Dave Chinner [Tue, 30 Nov 2010 04:15:46 +0000 (15:15 +1100)]
xfs: avoid moving stale inodes in the AIL

When an inode has been marked stale because the cluster is being
freed, we don't want to (re-)insert this inode into the AIL. There
is a race condition where the cluster buffer may be unpinned before
the inode is inserted into the AIL during transaction committed
processing. If the buffer is unpinned before the inode item has been
committed and inserted, then it is possible for the buffer to be
released and hence processthe stale inode callbacks before the inode
is inserted into the AIL.

In this case, we then insert a clean, stale inode into the AIL which
will never get removed by an IO completion. It will, however, get
reclaimed and that triggers an assert in xfs_inode_free()
complaining about freeing an inode still in the AIL.

This race can be avoided by not moving stale inodes forward in the AIL
during transaction commit completion processing. This closes the
race condition by ensuring we never insert clean stale inodes into
the AIL. It is safe to do this because a dirty stale inode, by
definition, must already be in the AIL.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
13 years agoxfs: delayed alloc blocks beyond EOF are valid after writeback
Dave Chinner [Tue, 30 Nov 2010 04:16:02 +0000 (15:16 +1100)]
xfs: delayed alloc blocks beyond EOF are valid after writeback

There is an assumption in the parts of XFS that flushing a dirty
file will make all the delayed allocation blocks disappear from an
inode. That is, that after calling xfs_flush_pages() then
ip->i_delayed_blks will be zero.

This is an invalid assumption as we may have specualtive
preallocation beyond EOF and they are recorded in
ip->i_delayed_blks. A flush of the dirty pages of an inode will not
change the state of these blocks beyond EOF, so a non-zero
deeelalloc block count after a flush is valid.

The bmap code has an invalid ASSERT() that needs to be removed, and
the swapext code has a bug in that while it swaps the data forks
around, it fails to swap the i_delayed_blks counter associated with
the fork and hence can get the block accounting wrong.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
13 years agoxfs: push stale, pinned buffers on trylock failures
Dave Chinner [Tue, 30 Nov 2010 04:16:16 +0000 (15:16 +1100)]
xfs: push stale, pinned buffers on trylock failures

As reported by Nick Piggin, XFS is suffering from long pauses under
highly concurrent workloads when hosted on ramdisks. The problem is
that an inode buffer is stuck in the pinned state in memory and as a
result either the inode buffer or one of the inodes within the
buffer is stopping the tail of the log from being moved forward.

The system remains in this state until a periodic log force issued
by xfssyncd causes the buffer to be unpinned. The main problem is
that these are stale buffers, and are hence held locked until the
transaction/checkpoint that marked them state has been committed to
disk. When the filesystem gets into this state, only the xfssyncd
can cause the async transactions to be committed to disk and hence
unpin the inode buffer.

This problem was encountered when scaling the busy extent list, but
only the blocking lock interface was fixed to solve the problem.
Extend the same fix to the buffer trylock operations - if we fail to
lock a pinned, stale buffer, then force the log immediately so that
when the next attempt to lock it comes around, it will have been
unpinned.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
13 years agoxfs: fix failed write truncation handling.
Dave Chinner [Tue, 30 Nov 2010 04:14:39 +0000 (15:14 +1100)]
xfs: fix failed write truncation handling.

Since the move to the new truncate sequence we call xfs_setattr to
truncate down excessively instanciated blocks.  As shown by the testcase
in kernel.org BZ #22452 that doesn't work too well.  Due to the confusion
of the internal inode size, and the VFS inode i_size it zeroes data that
it shouldn't.

But full blown truncate seems like overkill here.  We only instanciate
delayed allocations in the write path, and given that we never released
the iolock we can't have converted them to real allocations yet either.

The only nasty case is pre-existing preallocation which we need to skip.
We already do this for page discard during writeback, so make the delayed
allocation block punching a generic function and call it from the failed
write path as well as xfs_aops_discard_page. The callers are
responsible for ensuring that partial blocks are not truncated away,
and that they hold the ilock.

Based on a fix originally from Christoph Hellwig. This version used
filesystem blocks as the range unit.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
13 years agolxfb: Maintain video processor palette through suspend/resume
Daniel Drake [Tue, 30 Nov 2010 20:34:52 +0000 (20:34 +0000)]
lxfb: Maintain video processor palette through suspend/resume

The Geode X driver uses both of the LX's palettes, one for gamma
correction and one for colormaps.

The kernel driver currently only backs up the one used for colormaps
during suspend/resume. If you mess with gamma settings and do a
suspend/resume, colors go funny.

Fix this by backing up the video proc palette during suspend/resume,
alongside the display controller one which is already handled.

Signed-off-by: Daniel Drake <dsd@laptop.org>
Acked-by: Andres Salomon <dilinger@queued.net>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
13 years agovideo: da8xx: Register IRQ as last thing in driver probing.
Caglar Akyuz [Tue, 30 Nov 2010 20:04:14 +0000 (20:04 +0000)]
video: da8xx: Register IRQ as last thing in driver probing.

Following commit exposed a bug in driver:

"fbdev: da8xx/omap-l1xx: implement double buffering"

Bug is, if interrupt handler is called before initialization is
finished, raster controller is enabled and following register
modifications causes hardware to stay in a broken state.

By looking at this one may say that proper locking is missing in
this driver, and a more proper fix should be prepared. However,
aformentioned commit causes a regression in the driver and some
fix to current one should be applied first.

Signed-off-by: Caglar Akyuz <caglar@bilkon-kontrol.com.tr>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
13 years agoMerge branch 'sh/cachetlb' into sh-fixes-for-linus
Paul Mundt [Wed, 1 Dec 2010 07:39:08 +0000 (16:39 +0900)]
Merge branch 'sh/cachetlb' into sh-fixes-for-linus

13 years agosh: Assume new page cache pages have dirty dcache lines.
Paul Mundt [Wed, 1 Dec 2010 06:39:51 +0000 (15:39 +0900)]
sh: Assume new page cache pages have dirty dcache lines.

This follows the ARM change c01778001a4f5ad9c62d882776235f3f31922fdd
("ARM: 6379/1: Assume new page cache pages have dirty D-cache") for the
same rationale:

    There are places in Linux where writes to newly allocated page
    cache pages happen without a subsequent call to flush_dcache_page()
    (several PIO drivers including USB HCD). This patch changes the
    meaning of PG_arch_1 to be PG_dcache_clean and always flush the
    D-cache for a newly mapped page in update_mmu_cache().

This addresses issues seen with executing binaries from MMC, in
addition to some of the other HCDs that don't explicitly do cache
management for their pipe-in buffers.

Requested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
13 years agoMerge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied...
Linus Torvalds [Wed, 1 Dec 2010 04:13:35 +0000 (20:13 -0800)]
Merge branch 'drm-fixes' of git://git./linux/kernel/git/airlied/drm-2.6

* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm/radeon/kms: add workaround for dce3 ddc line vbios bug
  drm/radeon/kms: fix interlaced and doublescan handling
  drm/radeon/kms: fix typos in disabled vbios code
  Revert "drm/i915/dp: use VBT provided eDP params if available"
  drm/i915: Clear pfit registers when not used by any outputs
  drm: record monitor status in output_poll_execute
  drm: Set connector DPMS status to ON in drm_crtc_helper_set_config
  drm/i915: fix regression due to ba3d8d749b01548b9
  Revert "drm/radeon/kms: fix typo in r600 cs checker"
  drm/i915/sdvo: Always add a 30ms delay to make SDVO TV detection reliable
  MAINTAINERS: INTEL DRM DRIVERS list (intel-gfx) is subscribers-only
  drm/i915/sdvo: Always fallback to querying the shared DDC line
  drm/i915: Handle pagefaults in execbuffer user relocations
  drm/i915/sdvo: Only enable HDMI encodings only if the commandset is supported
  drm/radeon/kms: fix resume regression for some r5xx laptops
  drm/radeon/kms: fix regression in rs4xx i2c setup
  drm/i915: Only save/restore cursor regs if !KMS
  drm/i915: Prevent integer overflow when validating the execbuffer

13 years agodrm/radeon/kms: add workaround for dce3 ddc line vbios bug
Alex Deucher [Tue, 30 Nov 2010 05:15:10 +0000 (00:15 -0500)]
drm/radeon/kms: add workaround for dce3 ddc line vbios bug

fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=23752

Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc:stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
13 years agodrm/radeon/kms: fix interlaced and doublescan handling
Alex Deucher [Tue, 30 Nov 2010 20:46:47 +0000 (15:46 -0500)]
drm/radeon/kms: fix interlaced and doublescan handling

Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
13 years agodrm/radeon/kms: fix typos in disabled vbios code
Alex Deucher [Wed, 1 Dec 2010 00:11:45 +0000 (19:11 -0500)]
drm/radeon/kms: fix typos in disabled vbios code

6xx/7xx was hitting the wrong BUS_CNTL reg and bits.

Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
13 years agoMerge remote branch 'intel/drm-intel-fixes' of /ssd/git/drm-next into drm-fixes
Dave Airlie [Wed, 1 Dec 2010 02:10:34 +0000 (12:10 +1000)]
Merge remote branch 'intel/drm-intel-fixes' of /ssd/git/drm-next into drm-fixes

* 'intel/drm-intel-fixes' of /ssd/git/drm-next:
  Revert "drm/i915/dp: use VBT provided eDP params if available"
  drm/i915: Clear pfit registers when not used by any outputs
  drm/i915: fix regression due to ba3d8d749b01548b9

13 years agoMerge branch 'for_linus' of git://github.com/at91linux/linux-2.6-at91
Linus Torvalds [Wed, 1 Dec 2010 01:57:57 +0000 (17:57 -0800)]
Merge branch 'for_linus' of git://github.com/at91linux/linux-2.6-at91

* 'for_linus' of git://github.com/at91linux/linux-2.6-at91:
  at91/board-yl-9200: fix typo in video support
  atmel_spi: fix warning In function 'atmel_spi_dma_map_xfer'
  at91/picotux200: remove commenting usb device and dataflash support
  at91: rename rm9200ek and rm9200dk board file name
  at91rm9200ek: fix warning: 'ek_mmc_data' defined but not used
  at91rm9200dk: fix warning: 'dk_mmc_data' defined but not used
  at91: Convert remaining boards to new-style UART initialization
  at91: merge all at91rm9200 defconfig in one single file

13 years agoexec: copy-and-paste the fixes into compat_do_execve() paths
Oleg Nesterov [Tue, 30 Nov 2010 19:56:02 +0000 (20:56 +0100)]
exec: copy-and-paste the fixes into compat_do_execve() paths

Note: this patch targets 2.6.37 and tries to be as simple as possible.
That is why it adds more copy-and-paste horror into fs/compat.c and
uglifies fs/exec.c, this will be cleanuped later.

compat_copy_strings() plays with bprm->vma/mm directly and thus has
two problems: it lacks the RLIMIT_STACK check and argv/envp memory
is not visible to oom killer.

Export acct_arg_size() and get_arg_page(), change compat_copy_strings()
to use get_arg_page(), change compat_do_execve() to do acct_arg_size(0)
as do_execve() does.

Add the fatal_signal_pending/cond_resched checks into compat_count() and
compat_copy_strings(), this matches the code in fs/exec.c and certainly
makes sense.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agoexec: make argv/envp memory visible to oom-killer
Oleg Nesterov [Tue, 30 Nov 2010 19:55:34 +0000 (20:55 +0100)]
exec: make argv/envp memory visible to oom-killer

Brad Spengler published a local memory-allocation DoS that
evades the OOM-killer (though not the virtual memory RLIMIT):
http://www.grsecurity.net/~spender/64bit_dos.c

execve()->copy_strings() can allocate a lot of memory, but
this is not visible to oom-killer, nobody can see the nascent
bprm->mm and take it into account.

With this patch get_arg_page() increments current's MM_ANONPAGES
counter every time we allocate the new page for argv/envp. When
do_execve() succeds or fails, we change this counter back.

Technically this is not 100% correct, we can't know if the new
page is swapped out and turn MM_ANONPAGES into MM_SWAPENTS, but
I don't think this really matters and everything becomes correct
once exec changes ->mm or fails.

Reported-by: Brad Spengler <spender@grsecurity.net>
Reviewed-and-discussed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agoserial: mfd: adjust the baud rate setting
Feng Tang [Fri, 19 Nov 2010 03:01:48 +0000 (11:01 +0800)]
serial: mfd: adjust the baud rate setting

Previous baud rate setting code only has been tested with 3.5M/9600/
115200/230400/460800 bps, and recently we got a 3M bps device to test,
which needs to modify current MUL register setting, and with this
patch 2.5M/2M/1.5M/1M/0.5M should also work as they just use a MUL
value scale down from 3M's.

Also got some reference register setting from silicon guys for
different baud rates, which tries to keep the pre-scalar register value
to 16.

Signed-off-by: Feng Tang <feng.tang@intel.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
13 years agoMerge branch 'for-greg' of git://gitorious.org/usb/usb into work
Greg Kroah-Hartman [Tue, 30 Nov 2010 23:52:04 +0000 (15:52 -0800)]
Merge branch 'for-greg' of git://gitorious.org/usb/usb into work

13 years agoMerge branch 'for-usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sarah...
Greg Kroah-Hartman [Tue, 30 Nov 2010 23:38:41 +0000 (15:38 -0800)]
Merge branch 'for-usb-linus' of git://git./linux/kernel/git/sarah/xhci into work

13 years agocifs: fix parsing of hostname in dfs referrals
Jeff Layton [Tue, 30 Nov 2010 20:14:48 +0000 (15:14 -0500)]
cifs: fix parsing of hostname in dfs referrals

The DFS referral parsing code does a memchr() call to find the '\\'
delimiter that separates the hostname in the referral UNC from the
sharename. It then uses that value to set the length of the hostname via
pointer subtraction.  Instead of subtracting the start of the hostname
however, it subtracts the start of the UNC, which causes the code to
pass in a hostname length that is 2 bytes too long.

Regression introduced in commit 1a4240f4.

Reported-and-Tested-by: Robbert Kouprie <robbert@exx.nl>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Cc: Wang Lei <wang840925@gmail.com>
Cc: David Howells <dhowells@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Steve French <sfrench@us.ibm.com>
13 years agoUSB: fix autosuspend bug in usb-serial
Alan Stern [Mon, 29 Nov 2010 15:17:22 +0000 (10:17 -0500)]
USB: fix autosuspend bug in usb-serial

This patch (as1437) fixes a bug in the usb-serial autosuspend
handling.  Since the usb-serial core now has autosuspend support, it
must set the .supports_autosuspend member in every serial driver it
registers.  Otherwise the usb_autopm_get_interface() call won't work.

This fixes Bugzilla #23012.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: stable@kernel.org
Reported-by: Kevin Smith <thirdwiggin@gmail.com>
Reported-and-tested-by: Simon Gerber <gesimu@gmail.com>
Reported-and-tested-by: Matteo Croce <matteo@openwrt.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
13 years agoUSB: ehci: disable LPM and PPCD for nVidia MCP89 chips
Brian J. Tarricone [Mon, 22 Nov 2010 05:15:52 +0000 (21:15 -0800)]
USB: ehci: disable LPM and PPCD for nVidia MCP89 chips

Tested on MacBookAir3,1.  Without this, we get EPROTO errors when
fetching device config descriptors.

Signed-off-by: Brian Tarricone <brian@tarricone.org>
Reported-by: Benoit Gschwind <gschwind@gnu-log.net>
Tested-by: Edgar Hucek <gimli@dark-green.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
13 years agoUSB: serial: ftdi_sio: Vardaan USB RS422/485 converter PID added
Jacques Viviers [Wed, 24 Nov 2010 09:56:38 +0000 (11:56 +0200)]
USB: serial: ftdi_sio: Vardaan USB RS422/485 converter PID added

Add the PID for the Vardaan Enterprises VEUSB422R3 USB to RS422/485
converter. It uses the same chip as the FTDI_8U232AM_PID 0x6001.

This should also work with the stable branches for:
2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36

Signed-off-by: Jacques Viviers <jacques.viviers@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
13 years agoUSB: yurex: add .llseek fop to file_operations
Tomoki Sekiyama [Mon, 22 Nov 2010 10:29:23 +0000 (19:29 +0900)]
USB: yurex: add .llseek fop to file_operations

Default llseek operation behavior was changed by the patch named
"vfs: make no_llseek the default" after the yurex driver had been merged,
so the llseek to yurex is now ignored.

This patch add llseek fop with default_llseek to yurex driver
to catch up to the change.

Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
13 years agoUSB: ftdi_sio: Add ID for RT Systems USB-29B radio cable
Michael Stuermer [Wed, 17 Nov 2010 23:45:43 +0000 (00:45 +0100)]
USB: ftdi_sio: Add ID for RT Systems USB-29B radio cable

Another variant of the RT Systems programming cable for ham radios.

Signed-off-by: Michael Stuermer <ms@mallorn.de>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
13 years agoNFS: Fix a readdirplus bug
Trond Myklebust [Tue, 30 Nov 2010 17:42:34 +0000 (12:42 -0500)]
NFS: Fix a readdirplus bug

When comparing filehandles in the helper nfs_same_file(), we should not be
using 'strncmp()': filehandles are not null terminated strings.

Instead, we should just use the existing helper nfs_compare_fh().

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agoat91/board-yl-9200: fix typo in video support
Jean-Christophe PLAGNIOL-VILLARD [Sun, 21 Nov 2010 03:24:07 +0000 (11:24 +0800)]
at91/board-yl-9200: fix typo in video support

for the epson frambuffer support it's CONFIG_FB_S1D13XXX
not CONFIG_FB_S1D135XX

Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
13 years agoatmel_spi: fix warning In function 'atmel_spi_dma_map_xfer'
Jean-Christophe PLAGNIOL-VILLARD [Sat, 20 Nov 2010 06:52:53 +0000 (14:52 +0800)]
atmel_spi: fix warning In function 'atmel_spi_dma_map_xfer'

passing argument 2 of 'dma_map_single' discards qualifiers from pointer target type

Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
13 years agoat91/picotux200: remove commenting usb device and dataflash support
Jean-Christophe PLAGNIOL-VILLARD [Sun, 21 Nov 2010 02:31:19 +0000 (10:31 +0800)]
at91/picotux200: remove commenting usb device and dataflash support

as based on http://www.picotux.com/pt200/picotux200.pdf
these board does not have such I/O

Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
13 years agoat91: rename rm9200ek and rm9200dk board file name
Jean-Christophe PLAGNIOL-VILLARD [Fri, 19 Nov 2010 14:34:38 +0000 (22:34 +0800)]
at91: rename rm9200ek and rm9200dk board file name

to be a few more concistant with the other boards

as ek is for evaluation kit and dk for development kit

Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Andrew Victor <linux@maxim.org.za>
13 years agoat91rm9200ek: fix warning: 'ek_mmc_data' defined but not used
Jean-Christophe PLAGNIOL-VILLARD [Fri, 19 Nov 2010 14:31:35 +0000 (22:31 +0800)]
at91rm9200ek: fix warning: 'ek_mmc_data' defined but not used

Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Andrew Victor <linux@maxim.org.za>
13 years agoat91rm9200dk: fix warning: 'dk_mmc_data' defined but not used
Jean-Christophe PLAGNIOL-VILLARD [Fri, 19 Nov 2010 14:31:03 +0000 (22:31 +0800)]
at91rm9200dk: fix warning: 'dk_mmc_data' defined but not used

Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Andrew Victor <linux@maxim.org.za>
13 years agoat91: Convert remaining boards to new-style UART initialization
Jean-Christophe PLAGNIOL-VILLARD [Fri, 19 Nov 2010 14:23:28 +0000 (22:23 +0800)]
at91: Convert remaining boards to new-style UART initialization

Convert the following AT91RM9200-based boards to the new-style UART
initialization:
  - Ajeco 1ARM Single Board Computer
  - Sperry-Sun KAFA board
  - picotux 200

Remove the deprecated at91_init_serial

Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Andrew Victor <linux@maxim.org.za>
13 years agoregulator: fix kernel-doc for set_consumer_device_supply
Randy Dunlap [Thu, 18 Nov 2010 23:02:26 +0000 (15:02 -0800)]
regulator: fix kernel-doc for set_consumer_device_supply

Fix kernel-doc warning for set_consumer_device_supply():

Warning(drivers/regulator/core.c:912): missing initial short description on line:
 * set_consumer_device_supply: Bind a regulator to a symbolic supply

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: Liam Girdwood <lrg@slimlogic.co.uk>
Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
13 years agoregulator: enable supply regulator only when use count is zero
Bengt Jonsson [Wed, 10 Nov 2010 10:06:22 +0000 (11:06 +0100)]
regulator: enable supply regulator only when use count is zero

Supply regulators are disabled only when the last
reference count is removed on the child regulator
(the use count goes from 1 to 0). This patch changes
the behaviour of enable so the supply regulator is
enabled only when the use count of the child
regulator goes from 0 to 1.

Signed-off-by: Bengt Jonsson <bengt.g.jonsson@stericsson.com>
Acked-by: Linus Walleij <linus.walleij@stericsson.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
13 years agoregulator: twl-regulator - fix twlreg_set_mode
Axel Lin [Fri, 22 Oct 2010 08:38:22 +0000 (16:38 +0800)]
regulator: twl-regulator - fix twlreg_set_mode

The Singular Message is 16 bits:
        DEV_GRP[15:13] MT[12]  RES_ID[11:4]  RES_STATE[3:0]

Current implementation return immedially after sucessfuly write MSB part.
To properly set mode, we need to write the complete message ( MSB and LSB ).

In twl.h, now we have defines for PM Master module register offsets,
use it instead of hard coded 0x15/0x16.

Use "message & 0xff" to ensure we send correct value for LSB.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Tested-by: Lesly Arackal Manuel <leslyam@ti.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
13 years agoregulator: lock supply in regulator enable
Mattias Wallin [Thu, 4 Nov 2010 10:01:31 +0000 (11:01 +0100)]
regulator: lock supply in regulator enable

This patch add locks around regulator supply enable.

Signed-off-by: Mattias Wallin <mattias.wallin@stericsson.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
13 years agoregulator: Return proper error for regulator_register()
Axel Lin [Fri, 5 Nov 2010 07:27:17 +0000 (15:27 +0800)]
regulator: Return proper error for regulator_register()

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
13 years agoregulator: Ensure enough delay time for enabling regulator
Axel Lin [Fri, 5 Nov 2010 13:51:32 +0000 (21:51 +0800)]
regulator: Ensure enough delay time for enabling regulator

Integer division will truncate the result, this patch ensures we have
enough delay time for enabling regulator.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
13 years agoregulator: Remove a redundant device_remove_file call in create_regulator
Axel Lin [Fri, 5 Nov 2010 07:25:12 +0000 (15:25 +0800)]
regulator: Remove a redundant device_remove_file call in create_regulator

We already have device_remove_file() in error path,
no need to call it before goto link_name_err.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
13 years agoregulator: Staticise mc13783_powermisc_rmw()
Mark Brown [Wed, 3 Nov 2010 04:08:04 +0000 (00:08 -0400)]
regulator: Staticise mc13783_powermisc_rmw()

It is not used outside this driver so no need to make the symbol global.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Alberto Panizzo <maramaopercheseimorto@gmail.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
13 years agoregulator: regulator disable supply fix
Mattias Wallin [Tue, 2 Nov 2010 13:55:34 +0000 (14:55 +0100)]
regulator: regulator disable supply fix

This patch fixes a disable failure when regulator supply is used.
A while loop in regulator disable checks for supply pointer != NULL
but the pointer is not always updated, resulting in the while loop
running too many times causing a disable failure.

Signed-off-by: Mattias Wallin <mattias.wallin@stericsson.com>
Acked-by: Linus Walleij <linus.walleij@stericsson.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
13 years agoat91: merge all at91rm9200 defconfig in one single file
Eric Benard [Fri, 15 Oct 2010 09:27:17 +0000 (11:27 +0200)]
at91: merge all at91rm9200 defconfig in one single file

About all options present in each file are activated
in the single file.

Signed-off-by: Eric Benard <eric@eukrea.com>
Tested-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
13 years agoRevert "drm/i915/dp: use VBT provided eDP params if available"
Chris Wilson [Mon, 29 Nov 2010 10:09:55 +0000 (10:09 +0000)]
Revert "drm/i915/dp: use VBT provided eDP params if available"

This reverts commit 869184a675662bddcdf76c5b95665272facff2b8.

This is required for the Sony Vaio Jesse was working on at the time, but
breaks most other eDP machines - machines that were working in earlier
kernels.

Reported-and-tested-by: Dave Airlie <airlied@redhat.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=31188
Tested-by: Zhao Jian <jian.j.zhao@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
13 years agocifs: display fsc in /proc/mounts
Suresh Jayaraman [Wed, 24 Nov 2010 12:19:07 +0000 (17:49 +0530)]
cifs: display fsc in /proc/mounts

Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
Signed-off-by: Steve French <sfrench@us.ibm.com>
13 years agocifs: enable fscache iff fsc mount option is used explicitly
Suresh Jayaraman [Wed, 24 Nov 2010 12:19:06 +0000 (17:49 +0530)]
cifs: enable fscache iff fsc mount option is used explicitly

Currently, if CONFIG_CIFS_FSCACHE is set, fscache is enabled on files opened
as read-only irrespective of the 'fsc' mount option. Fix this by enabling
fscache only if 'fsc' mount option is specified explicitly.

Remove an extraneous cFYI debug message and fix a typo while at it.

Reported-by: Jeff Layton <jlayton@redhat.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
Signed-off-by: Steve French <sfrench@us.ibm.com>
13 years agocifs: allow fsc mount option only if CONFIG_CIFS_FSCACHE is set
Suresh Jayaraman [Wed, 24 Nov 2010 12:19:05 +0000 (17:49 +0530)]
cifs: allow fsc mount option only if CONFIG_CIFS_FSCACHE is set

Currently, it is possible to specify 'fsc' mount option even if
CONFIG_CIFS_FSCACHE has not been set. The option is being ignored silently
while the user fscache functionality to work. Fix this by raising error when
the CONFIG option is not set.

Reported-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
Signed-off-by: Steve French <sfrench@us.ibm.com>
13 years agocifs: Handle extended attribute name cifs_acl to generate cifs acl blob (try #4)
Shirish Pargaonkar [Sat, 27 Nov 2010 17:37:54 +0000 (11:37 -0600)]
cifs: Handle extended attribute name cifs_acl to generate cifs acl blob (try #4)

Add extended attribute name system.cifs_acl

Get/generate cifs/ntfs acl blob and hand over to the invoker however
it wants to parse/process it under experimental configurable option CIFS_ACL.

Do not get CIFS/NTFS ACL for xattr for attribute system.posix_acl_access

Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
13 years agocifs: Misc. cleanup in cifsacl handling [try #4]
Shirish Pargaonkar [Sat, 27 Nov 2010 17:37:26 +0000 (11:37 -0600)]
cifs: Misc. cleanup in cifsacl handling [try #4]

Change the name of function mode_to_acl to mode_to_cifs_acl.

Handle return code in functions mode_to_cifs_acl and
cifs_acl_to_fattr.

Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
13 years agoLinux 2.6.37-rc4
Linus Torvalds [Tue, 30 Nov 2010 04:42:04 +0000 (20:42 -0800)]
Linux 2.6.37-rc4

13 years agoMerge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
Linus Torvalds [Tue, 30 Nov 2010 04:41:39 +0000 (20:41 -0800)]
Merge branch 'merge' of git://git./linux/kernel/git/benh/powerpc

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc: Use call_rcu_sched() for pagetables

13 years agopowerpc: Use call_rcu_sched() for pagetables
Peter Zijlstra [Fri, 26 Nov 2010 14:38:45 +0000 (15:38 +0100)]
powerpc: Use call_rcu_sched() for pagetables

PowerPC relies on IRQ-disable to guard against RCU quiecent states,
use the appropriate RCU call version.

Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
13 years agoRevert "debug_locks: set oops_in_progress if we will log messages."
Dave Airlie [Mon, 29 Nov 2010 23:15:46 +0000 (09:15 +1000)]
Revert "debug_locks: set oops_in_progress if we will log messages."

This reverts commit e0fdace10e75dac67d906213b780ff1b1a4cc360.

On-list discussion seems to suggest that the robustness fixes for printk
make this unnecessary and DaveM has also agreed in person at Kernel Summit
and on list.

The main problem with this code is once we hit a lockdep splat we always
keep oops_in_progress set, the console layer uses oops_in_progress with KMS
to decide when it should be showing the oops and not showing X, so it causes
problems around suspend/resume time when a userspace resume can cause a console
switch away from X, only if oops_in_progress is set (which is what we want
if an oops actually is in progress, but not because we had a lockdep splat
2 days prior).

Cc: David S Miller <davem@davemloft.net>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
13 years agoTTY: open/hangup race fixup
Jiri Slaby [Mon, 29 Nov 2010 09:16:54 +0000 (10:16 +0100)]
TTY: open/hangup race fixup

Like in the "TTY: don't allow reopen when ldisc is changing" patch,
this one fixes a TTY WARNING as described in the option 1) there:
1) __tty_hangup from tty_ldisc_hangup to tty_ldisc_enable. During this
section tty_lock is held. However tty_lock is temporarily dropped in
the middle of the function by tty_ldisc_hangup.

The fix is to introduce a new flag which we set during the unlocked
window and check it in tty_reopen too. The flag is TTY_HUPPING and is
cleared after TTY_HUPPED is set.

While at it, remove duplicate TTY_HUPPED set_bit. The one after
calling ops->hangup seems to be more correct. But anyway, we hold
tty_lock, so there should be no difference.

Also document the function it does that kind of crap.

Nicely reproducible with two forked children:
static void do_work(const char *tty)
{
if (signal(SIGHUP, SIG_IGN) == SIG_ERR) exit(1);
setsid();
while (1) {
int fd = open(tty, O_RDWR|O_NOCTTY);
if (fd < 0) continue;
if (ioctl(fd, TIOCSCTTY)) continue;
if (vhangup()) continue;
close(fd);
}
exit(0);
}

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-by: <Valdis.Kletnieks@vt.edu>
Reported-by: Kyle McMartin <kyle@mcmartin.ca>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
13 years agoTTY: don't allow reopen when ldisc is changing
Jiri Slaby [Mon, 29 Nov 2010 09:16:53 +0000 (10:16 +0100)]
TTY: don't allow reopen when ldisc is changing

There are many WARNINGs like the following reported nowadays:
WARNING: at drivers/tty/tty_io.c:1331 tty_open+0x2a2/0x49a()
Hardware name: Latitude E6500
Modules linked in:
Pid: 1207, comm: plymouthd Not tainted 2.6.37-rc3-mmotm1123 #3
Call Trace:
 [<ffffffff8103b189>] warn_slowpath_common+0x80/0x98
 [<ffffffff8103b1b6>] warn_slowpath_null+0x15/0x17
 [<ffffffff8128a3ab>] tty_open+0x2a2/0x49a
 [<ffffffff810fd53f>] chrdev_open+0x11d/0x146
...

This means tty_reopen is called without TTY_LDISC set. For further
considerations, note tty_lock is held in tty_open. TTY_LDISC is cleared in:
1) __tty_hangup from tty_ldisc_hangup to tty_ldisc_enable. During this
section tty_lock is held. However tty_lock is temporarily dropped in
the middle of the function by tty_ldisc_hangup.

2) tty_release via tty_ldisc_release till the end of tty existence. If
tty->count <= 1, tty_lock is taken, TTY_CLOSING bit set and then
tty_ldisc_release called. tty_reopen checks TTY_CLOSING before checking
TTY_LDISC.

3) tty_set_ldisc from tty_ldisc_halt to tty_ldisc_enable. We:
   * take tty_lock, set TTY_LDISC_CHANGING, put tty_lock
   * call tty_ldisc_halt (clear TTY_LDISC), tty_lock is _not_ held
   * do some other work
   * take tty_lock, call tty_ldisc_enable (set TTY_LDISC), put
     tty_lock

I cannot see how 2) can be a problem, as there I see no race. OTOH, 1)
and 3) can happen without problems. This patch the case 3) by checking
TTY_LDISC_CHANGING along with TTY_CLOSING in tty_reopen. 1) will be
fixed in the following patch.

Nicely reproducible with two processes:
while (1) {
fd = open("/dev/ttyS1", O_RDWR);
if (fd < 0) {
warn("open");
continue;
}
close(fd);
}
--------
while (1) {
        fd = open("/dev/ttyS1", O_RDWR);
        ld1 = 0; ld2 = 2;
        while (1) {
                ioctl(fd, TIOCSETD, &ld1);
                ioctl(fd, TIOCSETD, &ld2);
        }
        close(fd);
}

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-by: <Valdis.Kletnieks@vt.edu>
Cc: Kyle McMartin <kyle@mcmartin.ca>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
13 years agoNET: wan/x25, fix ldisc->open retval
Jiri Slaby [Wed, 24 Nov 2010 23:27:55 +0000 (00:27 +0100)]
NET: wan/x25, fix ldisc->open retval

We should never return positive values from ldisc->open, tty layer
doesn't (and never did) expect that.

If we do that, weird things like warnings in tty_ldisc_close happen.

Not sure if dev->base_addr is used somehow now.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Cc: Andrew Hendry <andrew.hendry@gmail.com>
Cc: linux-x25@vger.kernel.org
Tested-by: Sergey Lapin <slapin@ossfans.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>